@parall/daemon 1.36.1 → 1.37.0

package/dist/clip-runtime/subprocess.d.ts

@@ -1,3 +1,4 @@
+import { type ChildProcess } from 'node:child_process';
 /**
  * Child-subprocess plumbing shared by the bb-browser daemon manager
  * (browser-profile-manager.ts) and the bb-viewer streamer
@@ -8,4 +9,17 @@
 export declare function formatErrorForLog(err: unknown): string;
 export declare function findFreePort(): Promise<number>;
 export declare function sleep(ms: number): Promise<void>;
+/**
+ * Resolve once `child` has exited. Sends SIGTERM, then escalates to SIGKILL after
+ * `graceMs` so a child that ignores TERM can't block teardown forever, and resolves
+ * on the `exit` event. A `hardCapMs` backstop resolves anyway if the child never
+ * emits `exit` even after SIGKILL (kernel zombie / a missed event), so a caller's
+ * queue can't deadlock on a process that is gone for all practical purposes. The
+ * bb-browser pool awaits this before reusing a child's per-profile home (reopen /
+ * reset / recovery restart) so two Chromiums never share a user-data-dir and a reset
+ * never wipes a home a live Chromium still holds.
+ */
+export declare function waitForChildExit(child: ChildProcess, log?: {
+    warn(msg: string): void;
+}, graceMs?: number, hardCapMs?: number): Promise<void>;
 //# sourceMappingURL=subprocess.d.ts.map

package/dist/clip-runtime/subprocess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subprocess.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/subprocess.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAGtD;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBpD;AAED,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}
+{"version":3,"file":"subprocess.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/subprocess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD;;;;;;GAMG;AAEH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAGtD;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBpD;AAED,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,YAAY,EACnB,GAAG,CAAC,EAAE;IAAE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACjC,OAAO,SAAQ,EACf,SAAS,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC,CAiCf"}

package/dist/clip-runtime/subprocess.js

@@ -31,3 +31,52 @@ export async function findFreePort() {
 export function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+ * Resolve once `child` has exited. Sends SIGTERM, then escalates to SIGKILL after
+ * `graceMs` so a child that ignores TERM can't block teardown forever, and resolves
+ * on the `exit` event. A `hardCapMs` backstop resolves anyway if the child never
+ * emits `exit` even after SIGKILL (kernel zombie / a missed event), so a caller's
+ * queue can't deadlock on a process that is gone for all practical purposes. The
+ * bb-browser pool awaits this before reusing a child's per-profile home (reopen /
+ * reset / recovery restart) so two Chromiums never share a user-data-dir and a reset
+ * never wipes a home a live Chromium still holds.
+ */
+export function waitForChildExit(child, log, graceMs = 5_000, hardCapMs = 15_000) {
+    if (child.exitCode !== null || child.signalCode !== null)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        let killTimer;
+        let capTimer;
+        const finish = () => {
+            child.removeListener('exit', finish); // no-op if exit already fired; clears the dangling listener on the hard-cap path
+            if (killTimer)
+                clearTimeout(killTimer);
+            if (capTimer)
+                clearTimeout(capTimer);
+            resolve();
+        };
+        child.once('exit', finish);
+        try {
+            child.kill('SIGTERM');
+        }
+        catch {
+            /* already gone — the exit listener resolves */
+        }
+        killTimer = setTimeout(() => {
+            if (child.exitCode === null && child.signalCode === null) {
+                try {
+                    child.kill('SIGKILL');
+                }
+                catch {
+                    /* already gone */
+                }
+            }
+        }, graceMs);
+        capTimer = setTimeout(() => {
+            log?.warn(`child did not exit within ${hardCapMs}ms after SIGKILL; proceeding`);
+            finish();
+        }, hardCapMs);
+        killTimer.unref?.();
+        capTimer.unref?.();
+    });
+}

package/dist/config.d.ts

@@ -1,3 +1,5 @@
+import { daemonConfigDir, resolveBundleDir } from './daemon-paths.js';
+export { daemonConfigDir, resolveBundleDir };
 /**
  * Daemon-mode env. The daemon authenticates to the Parall API with an
  * `mck_*` bearer token (PRLL_API_KEY) and supervises N per-agent
@@ -53,17 +55,15 @@ export type ClaudeDaemonConfig = {
     updateIntervalMs: number;
     /** Disable self-update entirely (K8s env auto-disables). */
     updateDisabled: boolean;
+    /**
+     * Stability window for the update canary (PendingUpdateHealthGate): after the
+     * control-plane handshake (machine.hello), a freshly self-updated version must
+     * stay up this long before it is confirmed healthy and rollback protection
+     * clears. Until then a process-level unclean exit still rolls back. Default
+     * 60s; 0 = confirm immediately on the first machine.hello.
+     */
+    updateConfirmDelayMs: number;
 };
-/**
- * Root dir for all on-disk daemon state: `config.json`, the self-update
- * `bundle/` overlay (versions + current symlink + update-state.json), and
- * bridge-bin resolution all derive from this single path. `PRLL_DAEMON_CONFIG_DIR`
- * overrides it so multiple daemons can coexist on one host without colliding —
- * e.g. a staging desktop install points its launchd agent at
- * `~/.parall-daemon-staging` while prod keeps the default `~/.parall-daemon`.
- * Unset → default (no behavior change for existing single-env installs).
- */
-export declare function daemonConfigDir(env?: NodeJS.ProcessEnv): string;
 export declare function daemonConfigPath(env?: NodeJS.ProcessEnv): string;
 export declare function resolveClaudeDaemonConfig(env?: NodeJS.ProcessEnv): ClaudeDaemonConfig;
 /** Per-agent state dir under the shared host volume. */
@@ -79,11 +79,10 @@ export declare function agentClaudeCredentialsFileFor(agentClaudeHome: string):
 /** Per-agent workspace dir where the agent runs git commands. */
 export declare function agentWorkspaceDirFor(rootStateDir: string, agentId: string): string;
 /**
- * Resolve the bundle directory for self-update storage.
- * Desktop: ~/Library/Application Support/Parall/daemon/ (set via env)
- * Default: ~/.parall-daemon/bundle/ — always a writable overlay directory,
- * never the npm global install dir (which may be root-owned or read-only).
+ * Whether manual CLI update verifies the Ed25519 bundle signature. Supervised
+ * daemon self-update is always fail-closed; this resolver is only a LOCAL-DEV
+ * escape hatch for `parall-daemon update` against unsigned local bundles.
  */
-export declare function resolveBundleDir(env?: NodeJS.ProcessEnv): string;
+export declare function resolveUpdateSigningEnabled(env?: NodeJS.ProcessEnv): boolean;
 export declare function resolveWsUrl(apiUrl: string, explicitWsUrl?: string, swimlaneName?: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AA2BF;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI5E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAyBD,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,kBAAkB,CA0DpB;AASD,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;mEAEmE;AACnE,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG7E;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CAMR"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAe,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAuBF,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAyBD,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,kBAAkB,CA8DpB;AASD,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;mEAEmE;AACnE,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEzF;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CAMR"}

package/dist/config.js

@@ -1,6 +1,8 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { daemonConfigDir, resolveBundleDir, resolvePath } from './daemon-paths.js';
+export { daemonConfigDir, resolveBundleDir };
 function requireEnv(env, name) {
     const value = env[name]?.trim();
     if (!value) {
@@ -8,9 +10,6 @@ function requireEnv(env, name) {
     }
     return value;
 }
-function resolvePath(value) {
-    return path.isAbsolute(value) ? value : path.resolve(process.cwd(), value);
-}
 function parseMs(value, fallback) {
     if (!value)
         return fallback;
@@ -24,21 +23,6 @@ function parseMsAllowZero(value, fallback) {
     const n = Number(value);
     return Number.isFinite(n) && n >= 0 ? n : fallback;
 }
-/**
- * Root dir for all on-disk daemon state: `config.json`, the self-update
- * `bundle/` overlay (versions + current symlink + update-state.json), and
- * bridge-bin resolution all derive from this single path. `PRLL_DAEMON_CONFIG_DIR`
- * overrides it so multiple daemons can coexist on one host without colliding —
- * e.g. a staging desktop install points its launchd agent at
- * `~/.parall-daemon-staging` while prod keeps the default `~/.parall-daemon`.
- * Unset → default (no behavior change for existing single-env installs).
- */
-export function daemonConfigDir(env = process.env) {
-    const override = env.PRLL_DAEMON_CONFIG_DIR?.trim();
-    if (override)
-        return resolvePath(override);
-    return path.join(env.HOME || os.homedir(), '.parall-daemon');
-}
 export function daemonConfigPath(env = process.env) {
     return path.join(daemonConfigDir(env), 'config.json');
 }
@@ -109,6 +93,7 @@ export function resolveClaudeDaemonConfig(env = process.env) {
                 : 'https://releases.parall.com/daemon/production'),
         updateIntervalMs: parseMsAllowZero(env.PRLL_DAEMON_UPDATE_INTERVAL_MS, 6 * 60 * 60_000),
         updateDisabled: env.PRLL_DAEMON_UPDATE_DISABLED === 'true' || !!env.KUBERNETES_SERVICE_HOST,
+        updateConfirmDelayMs: parseMsAllowZero(env.PRLL_DAEMON_UPDATE_CONFIRM_DELAY_MS?.trim() || undefined, 60_000),
     };
 }
 function assertSafeAgentId(agentId) {
@@ -140,15 +125,12 @@ export function agentWorkspaceDirFor(rootStateDir, agentId) {
     return path.join(rootStateDir, 'agents', assertSafeAgentId(agentId), 'workspace');
 }
 /**
- * Resolve the bundle directory for self-update storage.
- * Desktop: ~/Library/Application Support/Parall/daemon/ (set via env)
- * Default: ~/.parall-daemon/bundle/ — always a writable overlay directory,
- * never the npm global install dir (which may be root-owned or read-only).
+ * Whether manual CLI update verifies the Ed25519 bundle signature. Supervised
+ * daemon self-update is always fail-closed; this resolver is only a LOCAL-DEV
+ * escape hatch for `parall-daemon update` against unsigned local bundles.
  */
-export function resolveBundleDir(env = process.env) {
-    if (env.PRLL_DAEMON_BUNDLE_DIR)
-        return resolvePath(env.PRLL_DAEMON_BUNDLE_DIR);
-    return path.join(daemonConfigDir(env), 'bundle');
+export function resolveUpdateSigningEnabled(env = process.env) {
+    return env.PRLL_DAEMON_SIGNING_DISABLED !== '1';
 }
 export function resolveWsUrl(apiUrl, explicitWsUrl, swimlaneName) {
     const base = explicitWsUrl || `${apiUrl.replace(/\/$/, '').replace(/^http/, 'ws')}/ws`;

package/dist/daemon-main.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+export type DaemonBootstrapState = {
+    lifecycleMarkerEnabled: boolean;
+    runningMarker: string;
+    uncleanPrevExit: boolean;
+};
+export declare function runDaemonEntry(bootstrap: DaemonBootstrapState, args?: string[]): Promise<void>;
+//# sourceMappingURL=daemon-main.d.ts.map

package/dist/daemon-main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-main.d.ts","sourceRoot":"","sources":["../src/daemon-main.ts"],"names":[],"mappings":";AAyBA,MAAM,MAAM,oBAAoB,GAAG;IACjC,sBAAsB,EAAE,OAAO,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AA4KF,wBAAsB,cAAc,CAClC,SAAS,EAAE,oBAAoB,EAC/B,IAAI,WAAwB,GAC3B,OAAO,CAAC,IAAI,CAAC,CASf"}

package/dist/daemon-main.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+import { createLogger, createOtelLogger, initAgentTelemetry, } from '@parall/agent-core';
+import { ParallClient } from '@parall/sdk';
+import { runCLI } from './cli.js';
+import { resolveBundleDir, resolveClaudeDaemonConfig, resolveWsUrl, } from './config.js';
+import { isSelfUpdateManaged } from './daemon-update-mode.js';
+import { DaemonSupervisor, sleepCancellable } from './supervisor.js';
+import { DaemonUpdater } from './updater.js';
+import { PendingUpdateHealthGate } from './update-health-gate.js';
+const UPDATE_EXIT_CODE = 42;
+let log = createLogger('daemon');
+function formatError(reason) {
+    if (reason instanceof Error) {
+        return reason.stack ?? reason.message;
+    }
+    return String(reason);
+}
+/**
+ * Outer keepalive: runs `supervisor.run()` in a loop, restarting it with
+ * exponential backoff if it rejects. The daemon process only exits when
+ * the abort signal fires (SIGINT/SIGTERM) — anything else is treated as
+ * a transient failure that we recover from in-process.
+ *
+ * Why this exists in addition to entrypoint.sh's `while :; do parall-daemon; done`:
+ *   - In-process restart preserves the `client` (= same TCP/TLS pool) and
+ *     skips the ~hundreds-of-ms cost of Node startup + module loading per
+ *     cycle, which matters when the API is flapping.
+ *   - The shell wrapper is the "process really crashed" backstop —
+ *     segfault, OOM, uncaughtException, etc. The two layers are
+ *     complementary: in-process for soft failures, shell for hard failures.
+ *
+ * Operators can disable the in-process loop by setting
+ * PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MS=0 — main() will then exit on
+ * any supervisor.run() rejection and rely entirely on the shell wrapper +
+ * K8s for restart.
+ */
+async function runForever(config, client, log, signal, updater, gate) {
+    let attempt = 0;
+    while (!signal.aborted) {
+        const supervisor = new DaemonSupervisor(config, client, log);
+        if (updater)
+            supervisor.setUpdater(updater);
+        if (gate)
+            supervisor.setHealthGate(gate);
+        try {
+            await supervisor.run(signal);
+            // Clean exit (signal aborted) — done.
+            await supervisor.stop();
+            return;
+        }
+        catch (err) {
+            // supervisor.run() rejected. The supervisor's per-tick handlers
+            // already swallow individual failures, so the only paths that reach
+            // here are (a) bootstrap fail-fast mode and (b) genuine programmer
+            // bugs. Restart anyway — operators rely on this daemon as the only
+            // thing keeping per-agent children alive on this host.
+            log.error(`supervisor crashed: ${String(err)}`);
+            try {
+                await supervisor.stop();
+            }
+            catch (stopErr) {
+                log.warn(`supervisor.stop() after crash threw: ${String(stopErr)}`);
+            }
+            if (config.supervisorRestartBackoffMs === 0) {
+                log.error('supervisor keepalive disabled (PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MS=0) — exiting');
+                throw err;
+            }
+            const delay = Math.min(config.supervisorRestartBackoffMs * 2 ** attempt, config.supervisorRestartBackoffMaxMs);
+            attempt += 1;
+            log.warn(`restarting supervisor in ${delay}ms (attempt ${attempt})`);
+            const slept = await sleepCancellable(delay, signal);
+            if (!slept)
+                return;
+        }
+    }
+}
+async function main(bootstrap) {
+    const config = resolveClaudeDaemonConfig(process.env);
+    const telemetry = await initAgentTelemetry('parall-daemon', 'daemon');
+    log = createOtelLogger('daemon', 'daemon');
+    log.info(`boot: api=${config.apiUrl} pollMs=${config.pollIntervalMs} heartbeatMs=${config.heartbeatIntervalMs} agentBin=${config.agentBin}`);
+    log.info(`keepalive: bootstrapBackoffMs=${config.bootstrapBackoffMs} supervisorRestartBackoffMs=${config.supervisorRestartBackoffMs}`);
+    // --- Self-update: rollback check (before any network calls) ---
+    // Only run when a service manager supervises us (see isSelfUpdateManaged):
+    // a bare `npx` foreground run can't load the overlay and won't be restarted
+    // after exit(42), so self-update there would just kill the daemon.
+    let updater = null;
+    let healthGate = null;
+    const bundleDir = resolveBundleDir(process.env);
+    const selfUpdateEnabled = !config.updateDisabled && isSelfUpdateManaged(bundleDir, process.env);
+    if (selfUpdateEnabled) {
+        const signingEnabled = true;
+        updater = new DaemonUpdater(bundleDir, config.updateCdnUrl, log, signingEnabled);
+        // Process-level canary gate: machine.hello arms a stability window; the
+        // version is confirmed only if the process stays up through it. Owned here
+        // (not in the supervisor) so it survives supervisor in-process restarts.
+        healthGate = new PendingUpdateHealthGate(updater, config.updateConfirmDelayMs, log);
+        // The thin bootstrap writes the process-level running marker before loading
+        // this app module. That keeps rollback accounting outside the replaceable
+        // daemon app startup path while still letting updater.ts stay mechanism-only.
+        if (updater.checkRollback(bootstrap.uncleanPrevExit)) {
+            log.info('rollback applied — exiting for service manager restart');
+            await telemetry.shutdown();
+            process.exit(UPDATE_EXIT_CODE);
+        }
+        log.info(`update: bundleDir=${bundleDir} cdn=${config.updateCdnUrl} interval=${config.updateIntervalMs}ms signing=${signingEnabled}`);
+    }
+    else if (!config.updateDisabled) {
+        log.info('update: skipped (foreground mode) — run `parall-daemon service install` for managed auto-update');
+    }
+    // The daemon talks to the API as a Machine — the bearer is mck_*.
+    // No orgId is configured here; per-agent subprocesses get their
+    // own org_id via the spawn env.
+    const client = new ParallClient({
+        baseUrl: config.apiUrl,
+        token: config.apiKey,
+        swimlaneName: config.swimlaneName,
+    });
+    const abortController = new AbortController();
+    const onSignal = (sig) => {
+        log.info(`received ${sig} — initiating shutdown`);
+        abortController.abort();
+    };
+    process.on('SIGINT', () => onSignal('SIGINT'));
+    process.on('SIGTERM', () => onSignal('SIGTERM'));
+    // Defensive: unexpected async failures are logged explicitly. Rejections
+    // stay in-process so the supervisor loop can recover; uncaught exceptions
+    // exit so entrypoint.sh's shell-level keepalive restarts from a clean VM.
+    process.on('unhandledRejection', (reason) => {
+        log.error(`unhandledRejection: ${formatError(reason)}`);
+    });
+    process.on('uncaughtException', (err) => {
+        log.error(`uncaughtException: ${formatError(err)}`);
+        process.exitCode = 1;
+        process.exit(1);
+    });
+    config.wsUrl = resolveWsUrl(config.apiUrl, config.wsUrl, config.swimlaneName);
+    // --- Self-update: boot check + periodic timer ---
+    if (updater) {
+        const applied = await updater.checkAndApply().catch((err) => {
+            log.warn(`boot update check failed: ${String(err)}`);
+            return false;
+        });
+        if (applied) {
+            log.info('boot update applied — exiting for restart');
+            await telemetry.shutdown();
+            process.exit(UPDATE_EXIT_CODE);
+        }
+        updater.startPeriodicCheck(config.updateIntervalMs);
+    }
+    await runForever(config, client, log, abortController.signal, updater, healthGate);
+    await telemetry.shutdown();
+}
+export async function runDaemonEntry(bootstrap, args = process.argv.slice(2)) {
+    try {
+        const result = await runCLI(args);
+        if (result === 'handled')
+            return;
+        await main(bootstrap);
+    }
+    catch (err) {
+        log.error(`fatal: ${formatError(err)}`);
+        process.exitCode = 1;
+    }
+}

package/dist/daemon-paths.d.ts

@@ -0,0 +1,14 @@
+export declare function resolvePath(value: string): string;
+/**
+ * Root directory for daemon-owned on-disk state: config.json, self-update
+ * bundles, and related process markers.
+ */
+export declare function daemonConfigDir(env?: NodeJS.ProcessEnv): string;
+/**
+ * Resolve the bundle directory for self-update storage.
+ * Desktop: ~/Library/Application Support/Parall/daemon/ (set via env)
+ * Default: ~/.parall-daemon/bundle/ — always a writable overlay directory,
+ * never the npm global install dir (which may be root-owned or read-only).
+ */
+export declare function resolveBundleDir(env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=daemon-paths.d.ts.map

package/dist/daemon-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-paths.d.ts","sourceRoot":"","sources":["../src/daemon-paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI5E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG7E"}

package/dist/daemon-paths.js

@@ -0,0 +1,26 @@
+import * as os from 'node:os';
+import * as path from 'node:path';
+export function resolvePath(value) {
+    return path.isAbsolute(value) ? value : path.resolve(process.cwd(), value);
+}
+/**
+ * Root directory for daemon-owned on-disk state: config.json, self-update
+ * bundles, and related process markers.
+ */
+export function daemonConfigDir(env = process.env) {
+    const override = env.PRLL_DAEMON_CONFIG_DIR?.trim();
+    if (override)
+        return resolvePath(override);
+    return path.join(env.HOME || os.homedir(), '.parall-daemon');
+}
+/**
+ * Resolve the bundle directory for self-update storage.
+ * Desktop: ~/Library/Application Support/Parall/daemon/ (set via env)
+ * Default: ~/.parall-daemon/bundle/ — always a writable overlay directory,
+ * never the npm global install dir (which may be root-owned or read-only).
+ */
+export function resolveBundleDir(env = process.env) {
+    if (env.PRLL_DAEMON_BUNDLE_DIR)
+        return resolvePath(env.PRLL_DAEMON_BUNDLE_DIR);
+    return path.join(daemonConfigDir(env), 'bundle');
+}

package/dist/daemon-update-mode.d.ts

@@ -0,0 +1,8 @@
+export declare function isSelfUpdateDisabledByEnv(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Self-update should run only when a service manager supervises the daemon:
+ * PRLL_DAEMON_MANAGED is injected by service install, while an overlay entry
+ * path covers service installs predating that marker.
+ */
+export declare function isSelfUpdateManaged(bundleDir: string, env?: NodeJS.ProcessEnv, entry?: string): boolean;
+//# sourceMappingURL=daemon-update-mode.d.ts.map

package/dist/daemon-update-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-update-mode.d.ts","sourceRoot":"","sources":["../src/daemon-update-mode.ts"],"names":[],"mappings":"AAEA,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,SAAkB,GACtB,OAAO,CAOT"}

package/dist/daemon-update-mode.js

@@ -0,0 +1,18 @@
+import * as path from 'node:path';
+export function isSelfUpdateDisabledByEnv(env = process.env) {
+    return env.PRLL_DAEMON_UPDATE_DISABLED === 'true' || !!env.KUBERNETES_SERVICE_HOST;
+}
+/**
+ * Self-update should run only when a service manager supervises the daemon:
+ * PRLL_DAEMON_MANAGED is injected by service install, while an overlay entry
+ * path covers service installs predating that marker.
+ */
+export function isSelfUpdateManaged(bundleDir, env = process.env, entry = process.argv[1]) {
+    if (env.PRLL_DAEMON_MANAGED === '1' || env.PRLL_DAEMON_MANAGED === 'true')
+        return true;
+    if (!entry)
+        return false;
+    const resolvedEntry = path.resolve(entry);
+    const resolvedBundle = path.resolve(bundleDir);
+    return resolvedEntry === resolvedBundle || resolvedEntry.startsWith(resolvedBundle + path.sep);
+}