@parall/daemon 1.36.0 → 1.37.0

package/bundle/parall-browser-pod.js

@@ -8055,8 +8055,8 @@ var init_requestBuilder = __esm({
       async build() {
         const { hostname, protocol = "https", port, path: basePath } = await this.context.endpoint();
         this.path = basePath;
-        for (const resolvePath of this.resolvePathStack) {
-          resolvePath(this.path);
+        for (const resolvePath2 of this.resolvePathStack) {
+          resolvePath2(this.path);
         }
         return new import_protocol_http5.HttpRequest({
           protocol,
@@ -35113,6 +35113,7 @@ var ENDPOINTS = {
   // Org-scoped
   ORG: (orgId) => `${API_BASE}/orgs/${orgId}`,
   ORG_MEMBERS: (orgId) => `${API_BASE}/orgs/${orgId}/members`,
+  ORG_MEMBERS_FORMER: (orgId) => `${API_BASE}/orgs/${orgId}/members/former`,
   TEAMS: (orgId) => `${API_BASE}/orgs/${orgId}/teams`,
   ORG_MEMBERS_ONLINE: (orgId) => `${API_BASE}/orgs/${orgId}/members/online`,
   ORG_MEMBER: (orgId, userId) => `${API_BASE}/orgs/${orgId}/members/${userId}`,
@@ -35262,6 +35263,19 @@ var ENDPOINTS = {
   EXTERNAL_TRIGGER: (orgId, triggerId) => `${API_BASE}/orgs/${orgId}/external-triggers/${triggerId}`,
   EXTERNAL_TRIGGER_RUNS: (orgId) => `${API_BASE}/orgs/${orgId}/external-trigger-runs`,
   EXTERNAL_TRIGGER_RUN: (orgId, runId) => `${API_BASE}/orgs/${orgId}/external-trigger-runs/${runId}`,
+  // External IM channel (org-scoped, platform-mediated Feishu/Slack)
+  CHANNEL_CONNECTIONS: (orgId) => `${API_BASE}/orgs/${orgId}/channel-connections`,
+  CHANNEL_CONNECTION: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/channel-connections/${connectionId}`,
+  CHANNEL_CONNECTION_CREDENTIALS: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/channel-connections/${connectionId}/credentials`,
+  CHANNEL_CONNECTION_INGRESS_TOKEN_REGENERATE: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/channel-connections/${connectionId}/ingress-token/regenerate`,
+  CHANNEL_CONNECTION_CONVERSATIONS: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/channel-connections/${connectionId}/conversations`,
+  CHANNEL_CONVERSATION: (orgId, conversationId) => `${API_BASE}/orgs/${orgId}/channel-conversations/${conversationId}`,
+  CHANNEL_CONVERSATION_MESSAGES: (orgId, conversationId) => `${API_BASE}/orgs/${orgId}/channel-conversations/${conversationId}/messages`,
+  CHANNEL_CONVERSATION_SESSION: (orgId, conversationId) => `${API_BASE}/orgs/${orgId}/channel-conversations/${conversationId}/session`,
+  CHANNEL_MESSAGE: (orgId, messageId) => `${API_BASE}/orgs/${orgId}/channel-messages/${messageId}`,
+  CHANNEL_PROVISIONING: (orgId) => `${API_BASE}/orgs/${orgId}/channel-provisioning`,
+  CHANNEL_PROVISIONING_SESSION: (orgId, sessionId) => `${API_BASE}/orgs/${orgId}/channel-provisioning/${sessionId}`,
+  CHANNEL_PROVISIONING_CANCEL: (orgId, sessionId) => `${API_BASE}/orgs/${orgId}/channel-provisioning/${sessionId}/cancel`,
   // Invitations (org-scoped, admin)
   ORG_INVITATIONS: (orgId) => `${API_BASE}/orgs/${orgId}/invitations`,
   ORG_INVITATION: (orgId, invId) => `${API_BASE}/orgs/${orgId}/invitations/${invId}`,
@@ -35279,9 +35293,16 @@ var ENDPOINTS = {
   INVITE_LINK_JOIN: `${API_BASE}/invite-link/join`,
   // Wikis (org-scoped, served by wiki-service)
   WIKIS: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis`,
+  // Recycle bin — soft-deleted wikis (owner only). Must precede WIKI in the
+  // backend router so `deleted` isn't captured as a {wikiId}; the SDK builder
+  // is just a string.
+  WIKIS_DELETED: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis/deleted`,
+  // Detail URL — also reused for DELETE (soft-delete) and `${WIKI}/restore`.
   WIKI: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
+  WIKI_RESTORE: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restore`,
   WIKI_TREE: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/tree`,
   WIKI_BLOB: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/blob`,
+  WIKI_COPY: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/copy`,
   WIKI_NODE_SECTIONS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/node-sections`,
   WIKI_SEARCH: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/search`,
   WIKI_PAGE_INDEX: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/page-index`,
@@ -35343,6 +35364,7 @@ var ENDPOINTS = {
   // References (org-scoped)
   REFS_RESOLVE: (orgId) => `${API_BASE}/orgs/${orgId}/refs/resolve`,
   REFS_BACKLINKS: (orgId) => `${API_BASE}/orgs/${orgId}/refs/backlinks`,
+  REFS_GRAPH: (orgId) => `${API_BASE}/orgs/${orgId}/refs/graph`,
   REFS_CHECK: (orgId) => `${API_BASE}/orgs/${orgId}/refs/check`,
   // Platform config (agent-scoped, not org-scoped)
   PLATFORM_CONFIG: `${API_BASE}/agents/platform-config`,
@@ -35363,6 +35385,14 @@ var ENDPOINTS = {
   BILLING_AUTO_RELOAD: (orgId) => `${API_BASE}/orgs/${orgId}/billing/auto-reload`,
   BILLING_SETUP_INTENT: (orgId) => `${API_BASE}/orgs/${orgId}/billing/setup-intent`,
   COMPUTE_PRICING: () => `${API_BASE}/billing/compute-pricing`,
+  // Runtime capability table (public, no auth) — SSOT for the create/settings
+  // interlock: per-runtime compute modes, native model family, cross-family
+  // availability, and recommended model.
+  RUNTIMES: () => `${API_BASE}/runtimes`,
+  // Model catalog (public, no auth) — served from the server's DB-backed
+  // snapshot. Optional include_model keeps an agent's pinned hidden legacy
+  // model representable in settings pickers.
+  MODELS: (includeModel) => includeModel ? `${API_BASE}/models?include_model=${encodeURIComponent(includeModel)}` : `${API_BASE}/models`,
   // ADMIN_GRANTS intentionally NOT exported here — it sits under the
   // unauthenticated `/internal/admin/*` surface and must not bleed into the
   // public SDK. Admin dashboard hits the URL directly from its own client.
@@ -35375,6 +35405,7 @@ var ENDPOINTS = {
   AGENT_CLIP: (orgId, agentId, clipId) => `${CLIP_BASE}/orgs/${orgId}/agents/${agentId}/clips/${clipId}`,
   CLIP_INVOKE: (orgId) => `${CLIP_BASE}/orgs/${orgId}/invoke`,
   CLIP_ONLINE: (orgId) => `${CLIP_BASE}/orgs/${orgId}/online`,
+  BROWSER_RUNTIME_STATUS: (orgId) => `${CLIP_BASE}/orgs/${orgId}/browser-runtime/status`,
   BROWSER_PROFILES: (orgId) => `${CLIP_BASE}/orgs/${orgId}/browser-profiles`,
   BROWSER_PROFILE: (orgId, profileId) => `${CLIP_BASE}/orgs/${orgId}/browser-profiles/${profileId}`,
   BROWSER_PROFILE_OPEN: (orgId, profileId) => `${CLIP_BASE}/orgs/${orgId}/browser-profiles/${profileId}/open`,
@@ -35719,6 +35750,13 @@ var ParallClient = class _ParallClient {
     const res = await this.request("GET", ENDPOINTS.ORG_MEMBERS(orgId));
     return res.data;
   }
+  /** User IDs of soft-removed (former) org members — for marking their avatar /
+   *  name as "left" where dormant relations still surface them (DMs, task
+   *  assignees, message history). */
+  async getFormerMemberIds(orgId) {
+    const res = await this.request("GET", ENDPOINTS.ORG_MEMBERS_FORMER(orgId));
+    return res.user_ids ?? [];
+  }
   async getTeams(orgId) {
     const res = await this.request("GET", ENDPOINTS.TEAMS(orgId));
     return res.data;
@@ -36200,26 +36238,32 @@ var ParallClient = class _ParallClient {
     const res = await this.request("GET", ENDPOINTS.MACHINES_ME_CLIPS);
     return res.data;
   }
-  /** `GET /machines/me/browser-profiles` — browser profiles hosted by this machine. */
+  /** `GET /machines/me/browser-profiles` — browser profiles hosted by this machine.
+   *  Returns the daemon DTO (carries proxy_password for bb-browser replay). */
   async listMachineBrowserProfiles() {
     const res = await this.request("GET", ENDPOINTS.MACHINES_ME_BROWSER_PROFILES);
     return res.data;
   }
   /** `POST /machines/me/browser-profiles/{profileId}/status` — report runtime status. */
-  async reportBrowserProfileStatus(profileId, status, errorMsg) {
+  async reportBrowserProfileStatus(profileId, status, errorMsg, generation) {
     await this.request("POST", ENDPOINTS.MACHINES_ME_BROWSER_PROFILE_STATUS(profileId), {
       status,
-      ...errorMsg ? { error_msg: errorMsg } : {}
+      ...errorMsg ? { error_msg: errorMsg } : {},
+      ...generation !== void 0 ? { generation } : {}
     });
   }
   /**
    * `POST /machines/me/health` — bump the Machine's `updated_at` to now and
-   * report daemon state. The daemon should call this on a fixed cadence (e.g.
-   * every 30s) so an external observer can detect a wedged supervisor. Both
+   * report daemon state. The daemon calls this on startup and again whenever
+   * periodic runtime re-detection produces a CHANGED result (there is no
+   * fixed-cadence keepalive loop today — steady state posts nothing). All
    * fields are optional and only persisted when changed:
    *  - `daemonVersion` — the running bundle/launcher version.
    *  - `selfUpdateCapable` — whether the daemon can act on a machine.update
    *    signal (true under a service manager, false for bare `npx` foreground).
+   *  - `detectedRuntimes` — runtime CLIs found on the host. Omitted = no
+   *    report this beat (server keeps the stored value); [] = detection ran
+   *    and found nothing (server clears to empty).
    */
   async postMachineHeartbeat(opts) {
     const body = {};
@@ -36227,6 +36271,8 @@ var ParallClient = class _ParallClient {
       body.daemon_version = opts.daemonVersion;
     if (opts?.selfUpdateCapable !== void 0)
       body.self_update_capable = opts.selfUpdateCapable;
+    if (opts?.detectedRuntimes !== void 0)
+      body.detected_runtimes = opts.detectedRuntimes;
     return this.request("POST", ENDPOINTS.MACHINES_ME_HEALTH, Object.keys(body).length > 0 ? body : void 0);
   }
   async reportAgentWorkspaceState(agentId, state2) {
@@ -36545,6 +36591,59 @@ var ParallClient = class _ParallClient {
   async deleteExternalConnection(orgId, connectionId) {
     return this.request("DELETE", ENDPOINTS.EXTERNAL_CONNECTION(orgId, connectionId));
   }
+  // ---- External IM channel (org-scoped) ----
+  async createChannelConnection(orgId, input) {
+    return this.request("POST", ENDPOINTS.CHANNEL_CONNECTIONS(orgId), input);
+  }
+  async listChannelConnections(orgId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_CONNECTIONS(orgId));
+  }
+  async getChannelConnection(orgId, connectionId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_CONNECTION(orgId, connectionId));
+  }
+  async updateChannelConnection(orgId, connectionId, patch) {
+    return this.request("PATCH", ENDPOINTS.CHANNEL_CONNECTION(orgId, connectionId), patch);
+  }
+  async archiveChannelConnection(orgId, connectionId) {
+    return this.request("DELETE", ENDPOINTS.CHANNEL_CONNECTION(orgId, connectionId));
+  }
+  async deliverChannelCredentials(orgId, connectionId, credentials) {
+    return this.request("POST", ENDPOINTS.CHANNEL_CONNECTION_CREDENTIALS(orgId, connectionId), credentials);
+  }
+  async regenerateChannelIngressToken(orgId, connectionId) {
+    return this.request("POST", ENDPOINTS.CHANNEL_CONNECTION_INGRESS_TOKEN_REGENERATE(orgId, connectionId));
+  }
+  /** Start a Feishu one-click provisioning session (device flow QR). */
+  async initiateChannelProvisioning(orgId, input) {
+    return this.request("POST", ENDPOINTS.CHANNEL_PROVISIONING(orgId), input);
+  }
+  /**
+   * Lazy status poll — server-side this may forward one provider poll, so
+   * call it at the session's `poll_interval_seconds` cadence, not faster.
+   */
+  async getChannelProvisioningSession(orgId, sessionId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_PROVISIONING_SESSION(orgId, sessionId));
+  }
+  async cancelChannelProvisioning(orgId, sessionId) {
+    return this.request("POST", ENDPOINTS.CHANNEL_PROVISIONING_CANCEL(orgId, sessionId));
+  }
+  async listChannelConversations(orgId, connectionId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_CONNECTION_CONVERSATIONS(orgId, connectionId));
+  }
+  async getChannelConversation(orgId, conversationId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_CONVERSATION(orgId, conversationId));
+  }
+  async listChannelConversationMessages(orgId, conversationId, limit) {
+    return this.request("GET", ENDPOINTS.CHANNEL_CONVERSATION_MESSAGES(orgId, conversationId), void 0, { limit });
+  }
+  async setChannelConversationSession(orgId, conversationId, agentSessionId) {
+    return this.request("PATCH", ENDPOINTS.CHANNEL_CONVERSATION_SESSION(orgId, conversationId), {
+      agent_session_id: agentSessionId
+    });
+  }
+  async getChannelMessage(orgId, messageId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_MESSAGE(orgId, messageId));
+  }
   async getExternalTriggerSchema(orgId, connectionId) {
     return this.request("GET", ENDPOINTS.EXTERNAL_TRIGGER_SCHEMA(orgId, connectionId));
   }
@@ -36586,6 +36685,23 @@ var ParallClient = class _ParallClient {
   async getWiki(orgId, wikiId) {
     return this.request("GET", ENDPOINTS.WIKI(orgId, wikiId));
   }
+  /** Soft-delete an entire wiki (org owner only; the default wiki is
+   *  protected → 403 WIKI_PROTECTED). Returns the deleted wiki. Recoverable
+   *  via restoreWiki within the retention window. */
+  async deleteWiki(orgId, wikiId) {
+    return this.request("DELETE", ENDPOINTS.WIKI(orgId, wikiId));
+  }
+  /** Restore a soft-deleted wiki (org owner only). 409 WIKI_PURGE_STARTED once
+   *  purge has been claimed (no longer restorable), or 404 once the row is gone.
+   *  Returns the restored wiki. */
+  async restoreWiki(orgId, wikiId) {
+    return this.request("POST", ENDPOINTS.WIKI_RESTORE(orgId, wikiId));
+  }
+  /** Recycle bin — list soft-deleted wikis for the org (owner only). */
+  async getDeletedWikis(orgId) {
+    const res = await this.request("GET", ENDPOINTS.WIKIS_DELETED(orgId));
+    return res.data;
+  }
   async getWikiTree(orgId, wikiId, params) {
     return this.request("GET", ENDPOINTS.WIKI_TREE(orgId, wikiId), void 0, params);
   }
@@ -36619,6 +36735,15 @@ var ParallClient = class _ParallClient {
       blob.signed_url = this.absoluteMediaUrl(blob.signed_url);
     return blob;
   }
+  /**
+   * Copy one wiki file to another path as an independent snapshot (no sync).
+   * Used to "share a private file out": copy a file from the caller's personal
+   * namespace (`users/{userId}/…`) into the public wiki, leaving the original
+   * untouched. 409 `FILE_EXISTS` if `dest_path` already exists.
+   */
+  async copyWikiFile(orgId, wikiId, req) {
+    return this.request("POST", ENDPOINTS.WIKI_COPY(orgId, wikiId), req);
+  }
   async getWikiNodeSections(orgId, wikiId, params) {
     return this.request("GET", ENDPOINTS.WIKI_NODE_SECTIONS(orgId, wikiId), void 0, params);
   }
@@ -36787,6 +36912,16 @@ var ParallClient = class _ParallClient {
   async getBacklinks(orgId, params) {
     return this.request("GET", ENDPOINTS.REFS_BACKLINKS(orgId), void 0, params);
   }
+  /**
+   * Bounded multi-hop walk of the prll:// reference graph around `uri`. `uri`
+   * must be an entity-level prll:// URI — a refined URI (path/query/fragment) is
+   * rejected with 400 UNSUPPORTED_REFINED_URI. `depth` is clamped server-side to
+   * [1, 4]; breadth (node/edge counts) is capped server-side and surfaced via
+   * `truncated`. ACL is applied per hop (chat membership + wiki path scope).
+   */
+  async getRefsGraph(orgId, params) {
+    return this.request("GET", ENDPOINTS.REFS_GRAPH(orgId), void 0, params);
+  }
   async checkBrokenRefs(orgId) {
     return this.request("GET", ENDPOINTS.REFS_CHECK(orgId));
   }
@@ -36882,6 +37017,19 @@ var ParallClient = class _ParallClient {
     const resp = await this.request("GET", ENDPOINTS.COMPUTE_PRICING());
     return resp.data;
   }
+  /** Runtime capability table (public) — SSOT for the create/settings interlock. */
+  async getRuntimes() {
+    const resp = await this.request("GET", ENDPOINTS.RUNTIMES());
+    return resp.data;
+  }
+  /**
+   * Platform model catalog (public) — DB-backed, replaces the compile-time
+   * PLATFORM_MODELS constant. Pass includeModel to keep an agent's pinned
+   * hidden legacy model representable (settings picker).
+   */
+  async getModels(includeModel) {
+    return this.request("GET", ENDPOINTS.MODELS(includeModel));
+  }
   // ---- Clips ----
   async listClips(orgId) {
     const resp = await this.request("GET", ENDPOINTS.CLIPS(orgId));
@@ -36926,6 +37074,11 @@ var ParallClient = class _ParallClient {
     const resp = await this.request("GET", ENDPOINTS.CLIP_ONLINE(orgId));
     return resp.data;
   }
+  /** Deployment-wide hosted browser runtime availability — drives whether the
+   *  create UI offers the platform-hosted placement. Fail-closed server-side. */
+  async getBrowserRuntimeStatus(orgId) {
+    return this.request("GET", ENDPOINTS.BROWSER_RUNTIME_STATUS(orgId));
+  }
   /** Org-wide browser-profile discovery list. Returns the sanitized
    *  {@link BrowserProfileListItem} shape (not the full domain model), each row
    *  carrying a per-viewer `can_open` control hint. */
@@ -37034,6 +37187,50 @@ import { createRequire } from "node:module";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 
+// ts/daemon/dist/clip-runtime/browser-daemon-env.js
+var BROWSER_DAEMON_STRIPPED_ENV = [
+  "PRLL_API_KEY",
+  // machine key (mck_) — BYOC + agent control plane
+  "PRLL_PROVIDER_CONFIG",
+  // JSON ProviderConfig blob — may carry BYO LLM api keys
+  "PRLL_ASSIGNMENT_TOKEN",
+  // hosted pod platform assignment token (pba_)
+  "PRLL_POOL_TOKEN",
+  // hosted warm-pool bootstrap token (pba_)
+  "AWS_ACCESS_KEY_ID",
+  // hosted S3 browser-state STS creds (browser-pod.ts)
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  // AWS credential-RESOLUTION vars: the SDK derives creds from these too (IRSA
+  // web-identity, ECS/EKS container creds, named profile, on-disk cred/config
+  // files), so a child inheriting them could assume the pod's role even without
+  // the static keys above. bb-browser uses none of them.
+  "AWS_WEB_IDENTITY_TOKEN_FILE",
+  "AWS_ROLE_ARN",
+  "AWS_ROLE_SESSION_NAME",
+  "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",
+  "AWS_CONTAINER_CREDENTIALS_FULL_URI",
+  "AWS_CONTAINER_AUTHORIZATION_TOKEN",
+  "AWS_PROFILE",
+  "AWS_SHARED_CREDENTIALS_FILE",
+  "AWS_CONFIG_FILE",
+  "AWS_REGION",
+  // hosted browser-state config — bb-browser does not use it
+  "PRLL_BROWSER_STATE_REGION",
+  // browser-pod AWS_REGION fallback — same config family
+  "PRLL_BROWSER_STATE_BUCKET",
+  "PRLL_STATE_GENERATION",
+  "PRLL_BROWSER_STATE_ENDPOINT"
+];
+function buildBrowserDaemonEnv(baseEnv, homeDir) {
+  const env = { ...baseEnv, BB_BROWSER_HOME: homeDir };
+  clearAllProviderCreds(env);
+  for (const key of BROWSER_DAEMON_STRIPPED_ENV) {
+    delete env[key];
+  }
+  return env;
+}
+
 // ts/daemon/dist/clip-runtime/browser-viewer-streamer.js
 import { spawn } from "node:child_process";
 
@@ -37063,6 +37260,41 @@ async function findFreePort() {
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
+function waitForChildExit(child, log, graceMs = 5e3, hardCapMs = 15e3) {
+  if (child.exitCode !== null || child.signalCode !== null)
+    return Promise.resolve();
+  return new Promise((resolve2) => {
+    let killTimer;
+    let capTimer;
+    const finish = () => {
+      child.removeListener("exit", finish);
+      if (killTimer)
+        clearTimeout(killTimer);
+      if (capTimer)
+        clearTimeout(capTimer);
+      resolve2();
+    };
+    child.once("exit", finish);
+    try {
+      child.kill("SIGTERM");
+    } catch {
+    }
+    killTimer = setTimeout(() => {
+      if (child.exitCode === null && child.signalCode === null) {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }
+    }, graceMs);
+    capTimer = setTimeout(() => {
+      log?.warn(`child did not exit within ${hardCapMs}ms after SIGKILL; proceeding`);
+      finish();
+    }, hardCapMs);
+    killTimer.unref?.();
+    capTimer.unref?.();
+  });
+}
 
 // ts/daemon/dist/clip-runtime/browser-viewer-streamer.js
 var BB_VIEWER_HEALTH_TIMEOUT_MS = 1e4;
@@ -37641,6 +37873,7 @@ function filterTabListToAccount(result, account) {
 
 // ts/daemon/dist/clip-runtime/browser-profile-manager.js
 var BB_BROWSER_DAEMON_START_TIMEOUT_MS = 15e3;
+var BB_BROWSER_DAEMON_START_ATTEMPTS = 3;
 var BrowserCommandError = class extends Error {
   method;
   account;
@@ -37656,6 +37889,11 @@ var BrowserProfileManager = class {
   daemon = null;
   starting = null;
   restarting = null;
+  // Set by stop() and never reset (stop() is terminal — the pool disposes the
+  // manager and the hosted pod exits). Makes a startDaemon() that resolves after
+  // stop() began un-adoptable, so a late child can't be reassigned to this.daemon
+  // and escape teardown.
+  stopping = false;
   ensuredAccounts = /* @__PURE__ */ new Set();
   ensuringAccounts = /* @__PURE__ */ new Map();
   reportedStatuses = /* @__PURE__ */ new Map();
@@ -37706,9 +37944,12 @@ var BrowserProfileManager = class {
       throw err;
     }
   }
-  async ensureRuntime(profileId) {
+  async ensureRuntime(profileId, opts = {}) {
     if (!profileId)
       throw new Error("browser profile id is required");
+    if (opts.forceStatusReport) {
+      this.reportedStatuses.delete(profileId);
+    }
     try {
       await this.withDaemonRecovery(() => this.ensureAccount(profileId), `ensure runtime for ${profileId}`);
       this.reportStatus(profileId, "running");
@@ -37757,22 +37998,36 @@ var BrowserProfileManager = class {
     }
   }
   async stop() {
+    this.stopping = true;
     this.viewer.shutdown();
+    const inflight = this.starting;
+    const restarting = this.restarting;
     const daemon = this.daemon;
     this.daemon = null;
     this.starting = null;
     this.ensuredAccounts.clear();
     this.ensuringAccounts.clear();
     this.reportedStatuses.clear();
-    if (!daemon)
-      return;
-    try {
-      await this.post("/shutdown", daemon, void 0, 3e3);
-    } catch {
+    if (restarting) {
+      try {
+        await restarting;
+      } catch {
+      }
     }
-    if (daemon.child.exitCode === null && daemon.child.signalCode === null) {
-      daemon.child.kill("SIGTERM");
+    let started = null;
+    if (inflight) {
+      try {
+        started = await inflight;
+      } catch {
+      }
     }
+    await Promise.all([daemon, started].filter((d5) => d5 !== null).map(async (d5) => {
+      try {
+        await this.post("/shutdown", d5, void 0, 3e3);
+      } catch {
+      }
+      await waitForChildExit(d5.child, this.opts.log);
+    }));
   }
   /**
    * Viewer control command entrypoint — delegates to BrowserViewerStreamer
@@ -37922,10 +38177,12 @@ var BrowserProfileManager = class {
         if (!isBrowserAccountInfoUnauthenticatedError(err)) {
           if (!isBrowserAccountNotFoundError(err))
             throw err;
+          const proxy = this.opts.resolveProxy ? await this.opts.resolveProxy(account) : null;
           await this.sendCommand({
             method: "account_create",
             account,
-            ...accountUrl ? { accountUrl } : {}
+            ...accountUrl ? { accountUrl } : {},
+            ...proxyCreateFields(proxy)
           });
           accountCreated = true;
         }
@@ -37996,17 +38253,28 @@ var BrowserProfileManager = class {
   async ensureDaemon() {
     if (this.restarting)
       await this.restarting;
+    if (this.stopping)
+      throw new Error("browser profile manager is stopping");
     if (this.daemon && this.daemon.child.exitCode === null && this.daemon.child.signalCode === null) {
       return this.daemon;
     }
-    if (this.starting)
-      return this.starting;
+    if (this.starting) {
+      const started = await this.starting;
+      if (this.stopping)
+        throw new Error("browser profile manager is stopping");
+      return started;
+    }
     this.starting = this.startDaemon();
+    const startPromise = this.starting;
     try {
-      this.daemon = await this.starting;
+      const started = await startPromise;
+      if (this.stopping)
+        throw new Error("browser profile manager is stopping");
+      this.daemon = started;
       return this.daemon;
     } finally {
-      this.starting = null;
+      if (this.starting === startPromise)
+        this.starting = null;
     }
   }
   async withDaemonRecovery(operation2, label) {
@@ -38042,20 +38310,46 @@ var BrowserProfileManager = class {
       await this.post("/shutdown", daemon, void 0, 3e3);
     } catch {
     }
-    if (daemon.child.exitCode === null && daemon.child.signalCode === null) {
-      daemon.child.kill("SIGTERM");
-    }
+    await waitForChildExit(daemon.child, this.opts.log);
   }
   async startDaemon() {
+    let lastErr;
+    for (let attempt = 1; attempt <= BB_BROWSER_DAEMON_START_ATTEMPTS; attempt++) {
+      try {
+        return await this.startDaemonAttempt();
+      } catch (err) {
+        lastErr = err;
+        if (attempt < BB_BROWSER_DAEMON_START_ATTEMPTS) {
+          this.opts.log.warn(`[bb-browser] daemon start attempt ${attempt} failed; retrying with fresh ports: ${String(err)}`);
+        }
+      }
+    }
+    throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+  }
+  async startDaemonAttempt() {
     const host = "127.0.0.1";
     const port = await findFreePort();
+    let cdpPort = await findFreePort();
+    for (let i5 = 0; cdpPort === port && i5 < 5; i5++) {
+      cdpPort = await findFreePort();
+    }
+    if (cdpPort === port) {
+      throw new Error("bb-browser: could not allocate distinct HTTP and CDP ports");
+    }
     const token = randomToken();
     const daemonPath = resolveBbBrowserDaemonPath();
-    const child = spawn2(process.execPath, [daemonPath, "--host", host, "--port", String(port), "--token", token], {
-      env: {
-        ...process.env,
-        BB_BROWSER_HOME: this.opts.homeDir
-      },
+    const child = spawn2(process.execPath, [
+      daemonPath,
+      "--host",
+      host,
+      "--port",
+      String(port),
+      "--token",
+      token,
+      "--cdp-port",
+      String(cdpPort)
+    ], {
+      env: buildBrowserDaemonEnv(process.env, this.opts.homeDir),
       stdio: ["ignore", "ignore", "pipe"]
     });
     let childError = null;
@@ -38084,7 +38378,7 @@ var BrowserProfileManager = class {
         await sleep(200);
       }
     }
-    child.kill("SIGTERM");
+    await waitForChildExit(child, this.opts.log);
     throw new Error("bb-browser-daemon did not start in time");
   }
   async post(pathName, daemon, body, timeoutMs = 1e4) {
@@ -38182,6 +38476,16 @@ function resolveBbBrowserDaemonPath() {
 function randomToken() {
   return randomBytes(16).toString("hex");
 }
+function proxyCreateFields(proxy) {
+  if (!proxy?.server)
+    return {};
+  const fields = { proxyServer: proxy.server };
+  if (proxy.username)
+    fields.proxyUsername = proxy.username;
+  if (proxy.password)
+    fields.proxyPassword = proxy.password;
+  return fields;
+}
 
 // ts/daemon/dist/clip-runtime/browser-state-store.js
 var import_client_s3 = __toESM(require_dist_cjs73(), 1);
@@ -40165,9 +40469,25 @@ function resolveBrowserPodConfig(env = process.env) {
     orgId,
     healthPort: parsePort(env.PRLL_HEALTH_PORT, DEFAULT_HEALTH_PORT),
     stateDir,
-    homeDir
+    homeDir,
+    proxy: parseProxyEnv(env)
   };
 }
+function parseProxyEnv(env) {
+  const server = env.PRLL_BROWSER_PROXY_SERVER?.trim();
+  const username = env.PRLL_BROWSER_PROXY_USERNAME || void 0;
+  const password = env.PRLL_BROWSER_PROXY_PASSWORD || void 0;
+  if (!server) {
+    if (username !== void 0 || password !== void 0) {
+      throw new Error("browser-pod: PRLL_BROWSER_PROXY_USERNAME/PASSWORD set without PRLL_BROWSER_PROXY_SERVER");
+    }
+    return null;
+  }
+  if (username === void 0 !== (password === void 0)) {
+    throw new Error("browser-pod: PRLL_BROWSER_PROXY_USERNAME and PRLL_BROWSER_PROXY_PASSWORD must be set together");
+  }
+  return { server, username, password };
+}
 function resolvePoolPodConfig(env = process.env) {
   const poolToken = env.PRLL_POOL_TOKEN?.trim() || "";
   const podId = env.PRLL_POD_ID?.trim() || "";
@@ -40236,7 +40556,25 @@ function parseAssignRequest(body) {
       sessionToken
     };
   }
-  return { ok: true, value: { assignmentToken, profileId, orgId, leaseId, generation, state: state2 } };
+  let proxy;
+  if (b5.proxy !== void 0 && b5.proxy !== null) {
+    if (typeof b5.proxy !== "object")
+      return { ok: false, error: "proxy must be an object" };
+    const p2 = b5.proxy;
+    const server = str(p2.server);
+    if (!server)
+      return { ok: false, error: "proxy requires server" };
+    const username = (typeof p2.username === "string" ? p2.username : "") || void 0;
+    const password = (typeof p2.password === "string" ? p2.password : "") || void 0;
+    if (username === void 0 !== (password === void 0)) {
+      return { ok: false, error: "proxy username and password must be provided together" };
+    }
+    proxy = { server, username, password };
+  }
+  return {
+    ok: true,
+    value: { assignmentToken, profileId, orgId, leaseId, generation, state: state2, proxy }
+  };
 }
 function applyAssignmentEnv(env, req) {
   env.PRLL_ASSIGNMENT_TOKEN = req.assignmentToken;
@@ -40254,6 +40592,16 @@ function applyAssignmentEnv(env, req) {
     if (req.state.endpoint)
       env.PRLL_BROWSER_STATE_ENDPOINT = req.state.endpoint;
   }
+  delete env.PRLL_BROWSER_PROXY_SERVER;
+  delete env.PRLL_BROWSER_PROXY_USERNAME;
+  delete env.PRLL_BROWSER_PROXY_PASSWORD;
+  if (req.proxy) {
+    env.PRLL_BROWSER_PROXY_SERVER = req.proxy.server;
+    if (req.proxy.username)
+      env.PRLL_BROWSER_PROXY_USERNAME = req.proxy.username;
+    if (req.proxy.password)
+      env.PRLL_BROWSER_PROXY_PASSWORD = req.proxy.password;
+  }
 }
 function poolTokenMatches(bearer, expected) {
   if (!bearer)
@@ -40507,7 +40855,11 @@ function makeCheckpointer(store) {
   };
 }
 async function preparePodRuntime(config, env, log) {
-  const browser = new BrowserProfileManager({ homeDir: config.homeDir, log });
+  const browser = new BrowserProfileManager({
+    homeDir: config.homeDir,
+    log,
+    resolveProxy: () => config.proxy
+  });
   const clipManager = new ClipProcessManager({
     clipsDir: path5.join(config.stateDir, "clips"),
     dataDir: path5.join(config.stateDir, "clip-data"),