@parall/daemon 1.36.1 → 1.38.0

package/bundle/manifest.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.36.1",
-  "built_at": "2026-06-26T10:09:22.541Z",
+  "version": "1.38.0",
+  "built_at": "2026-07-06T10:59:40.316Z",
   "min_node_version": "20.0.0",
   "files": {
     "bb-browser-daemon.js": {
@@ -16,25 +16,25 @@
       "size": 18
     },
     "parall-browser-pod.js": {
-      "sha256": "a9f602f001380c7fdfd2db7e7109343f07267a1acd6c020f5802a949769cd9fb",
-      "size": 1682059
+      "sha256": "9426af841c2011c341e28e03a0176da146e6c30da88878cc2e70f3211512e7e8",
+      "size": 1697014
     },
     "parall-claude-agent.js": {
-      "sha256": "f38cb2274682403d735e9ea3772d56fcfeee9636a1866eb599e41b4a23075ea6",
-      "size": 1574204
+      "sha256": "11436cabd17a19f2af8eb433a506efc6342efb76fbe25c8c882aea13220b5350",
+      "size": 1616948
     },
     "parall-codex-agent.js": {
-      "sha256": "ceee4b4852cb9cc058dbb70022c8fcf81fd802d1bff709d063386b95a9d501e4",
-      "size": 1605214
+      "sha256": "5d28aecbd029c64cd1402f748e12ae6bdf502ab38a21b95bb546407469e4d826",
+      "size": 1647758
     },
     "parall-daemon.js": {
-      "sha256": "a7cae49ec5efb258f60e35f9a03b71a9edbd947886b0b037c761aaa36bf9af79",
-      "size": 1612971
+      "sha256": "0470fa07cce7477c70c075eb939e9e14b6dab40cfa4a6f609974c68f28537923",
+      "size": 1717086
     },
     "parall-openclaw-agent.js": {
       "sha256": "505433b4bf3a4b8dbb7b96978d8693d6c48079f4513282ff1ee59a6d13b3eddf",
       "size": 9801
     }
   },
-  "signature": "P/Lgycpu5bMlOGiMzEto4lrKQuoz4c17B0IJ0xmyP6n6DBpuUIEEGJZKs9lQtkz1kVhEgQ4dN9IipxLIZ6hhCg=="
+  "signature": "bfGTE2slDSlantJRoa8j9CEENod1u89vVzhn0aFI29c+V9Lj2IuXdage/Mu3vfr+kDUYCisH9DPqBD6o7X4kDA=="
 }

package/bundle/parall-browser-pod.js

@@ -8055,8 +8055,8 @@ var init_requestBuilder = __esm({
       async build() {
         const { hostname, protocol = "https", port, path: basePath } = await this.context.endpoint();
         this.path = basePath;
-        for (const resolvePath of this.resolvePathStack) {
-          resolvePath(this.path);
+        for (const resolvePath2 of this.resolvePathStack) {
+          resolvePath2(this.path);
         }
         return new import_protocol_http5.HttpRequest({
           protocol,
@@ -35113,6 +35113,7 @@ var ENDPOINTS = {
   // Org-scoped
   ORG: (orgId) => `${API_BASE}/orgs/${orgId}`,
   ORG_MEMBERS: (orgId) => `${API_BASE}/orgs/${orgId}/members`,
+  ORG_MEMBERS_FORMER: (orgId) => `${API_BASE}/orgs/${orgId}/members/former`,
   TEAMS: (orgId) => `${API_BASE}/orgs/${orgId}/teams`,
   ORG_MEMBERS_ONLINE: (orgId) => `${API_BASE}/orgs/${orgId}/members/online`,
   ORG_MEMBER: (orgId, userId) => `${API_BASE}/orgs/${orgId}/members/${userId}`,
@@ -35262,6 +35263,19 @@ var ENDPOINTS = {
   EXTERNAL_TRIGGER: (orgId, triggerId) => `${API_BASE}/orgs/${orgId}/external-triggers/${triggerId}`,
   EXTERNAL_TRIGGER_RUNS: (orgId) => `${API_BASE}/orgs/${orgId}/external-trigger-runs`,
   EXTERNAL_TRIGGER_RUN: (orgId, runId) => `${API_BASE}/orgs/${orgId}/external-trigger-runs/${runId}`,
+  // External IM channel (org-scoped, platform-mediated Feishu/Slack)
+  CHANNEL_CONNECTIONS: (orgId) => `${API_BASE}/orgs/${orgId}/channel-connections`,
+  CHANNEL_CONNECTION: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/channel-connections/${connectionId}`,
+  CHANNEL_CONNECTION_CREDENTIALS: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/channel-connections/${connectionId}/credentials`,
+  CHANNEL_CONNECTION_INGRESS_TOKEN_REGENERATE: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/channel-connections/${connectionId}/ingress-token/regenerate`,
+  CHANNEL_CONNECTION_CONVERSATIONS: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/channel-connections/${connectionId}/conversations`,
+  CHANNEL_CONVERSATION: (orgId, conversationId) => `${API_BASE}/orgs/${orgId}/channel-conversations/${conversationId}`,
+  CHANNEL_CONVERSATION_MESSAGES: (orgId, conversationId) => `${API_BASE}/orgs/${orgId}/channel-conversations/${conversationId}/messages`,
+  CHANNEL_CONVERSATION_SESSION: (orgId, conversationId) => `${API_BASE}/orgs/${orgId}/channel-conversations/${conversationId}/session`,
+  CHANNEL_MESSAGE: (orgId, messageId) => `${API_BASE}/orgs/${orgId}/channel-messages/${messageId}`,
+  CHANNEL_PROVISIONING: (orgId) => `${API_BASE}/orgs/${orgId}/channel-provisioning`,
+  CHANNEL_PROVISIONING_SESSION: (orgId, sessionId) => `${API_BASE}/orgs/${orgId}/channel-provisioning/${sessionId}`,
+  CHANNEL_PROVISIONING_CANCEL: (orgId, sessionId) => `${API_BASE}/orgs/${orgId}/channel-provisioning/${sessionId}/cancel`,
   // Invitations (org-scoped, admin)
   ORG_INVITATIONS: (orgId) => `${API_BASE}/orgs/${orgId}/invitations`,
   ORG_INVITATION: (orgId, invId) => `${API_BASE}/orgs/${orgId}/invitations/${invId}`,
@@ -35279,9 +35293,16 @@ var ENDPOINTS = {
   INVITE_LINK_JOIN: `${API_BASE}/invite-link/join`,
   // Wikis (org-scoped, served by wiki-service)
   WIKIS: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis`,
+  // Recycle bin — soft-deleted wikis (owner only). Must precede WIKI in the
+  // backend router so `deleted` isn't captured as a {wikiId}; the SDK builder
+  // is just a string.
+  WIKIS_DELETED: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis/deleted`,
+  // Detail URL — also reused for DELETE (soft-delete) and `${WIKI}/restore`.
   WIKI: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
+  WIKI_RESTORE: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restore`,
   WIKI_TREE: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/tree`,
   WIKI_BLOB: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/blob`,
+  WIKI_COPY: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/copy`,
   WIKI_NODE_SECTIONS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/node-sections`,
   WIKI_SEARCH: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/search`,
   WIKI_PAGE_INDEX: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/page-index`,
@@ -35335,6 +35356,11 @@ var ENDPOINTS = {
   DISPATCH_ACK_BY_ID: (orgId, id) => `${API_BASE}/orgs/${orgId}/dispatch/${id}/ack`,
   DISPATCH_EXPIRE: (orgId) => `${API_BASE}/orgs/${orgId}/dispatch/expire`,
   DISPATCH_BY_MESSAGES: (orgId) => `${API_BASE}/orgs/${orgId}/dispatch/by-messages`,
+  DISPATCH_CLAIM: (orgId) => `${API_BASE}/orgs/${orgId}/dispatch/claim`,
+  DISPATCH_STEER: (orgId) => `${API_BASE}/orgs/${orgId}/dispatch/steer`,
+  DISPATCH_COMPLETE: (orgId) => `${API_BASE}/orgs/${orgId}/dispatch/complete`,
+  DISPATCH_RELEASE: (orgId) => `${API_BASE}/orgs/${orgId}/dispatch/release`,
+  DISPATCH_HEARTBEAT: (orgId) => `${API_BASE}/orgs/${orgId}/dispatch/heartbeat`,
   // Unread
   UNREAD: `${API_BASE}/me/unread`,
   ORG_UNREAD: (orgId) => `${API_BASE}/orgs/${orgId}/unread`,
@@ -35364,6 +35390,14 @@ var ENDPOINTS = {
   BILLING_AUTO_RELOAD: (orgId) => `${API_BASE}/orgs/${orgId}/billing/auto-reload`,
   BILLING_SETUP_INTENT: (orgId) => `${API_BASE}/orgs/${orgId}/billing/setup-intent`,
   COMPUTE_PRICING: () => `${API_BASE}/billing/compute-pricing`,
+  // Runtime capability table (public, no auth) — SSOT for the create/settings
+  // interlock: per-runtime compute modes, native model family, cross-family
+  // availability, and recommended model.
+  RUNTIMES: () => `${API_BASE}/runtimes`,
+  // Model catalog (public, no auth) — served from the server's DB-backed
+  // snapshot. Optional include_model keeps an agent's pinned hidden legacy
+  // model representable in settings pickers.
+  MODELS: (includeModel) => includeModel ? `${API_BASE}/models?include_model=${encodeURIComponent(includeModel)}` : `${API_BASE}/models`,
   // ADMIN_GRANTS intentionally NOT exported here — it sits under the
   // unauthenticated `/internal/admin/*` surface and must not bleed into the
   // public SDK. Admin dashboard hits the URL directly from its own client.
@@ -35376,6 +35410,7 @@ var ENDPOINTS = {
   AGENT_CLIP: (orgId, agentId, clipId) => `${CLIP_BASE}/orgs/${orgId}/agents/${agentId}/clips/${clipId}`,
   CLIP_INVOKE: (orgId) => `${CLIP_BASE}/orgs/${orgId}/invoke`,
   CLIP_ONLINE: (orgId) => `${CLIP_BASE}/orgs/${orgId}/online`,
+  BROWSER_RUNTIME_STATUS: (orgId) => `${CLIP_BASE}/orgs/${orgId}/browser-runtime/status`,
   BROWSER_PROFILES: (orgId) => `${CLIP_BASE}/orgs/${orgId}/browser-profiles`,
   BROWSER_PROFILE: (orgId, profileId) => `${CLIP_BASE}/orgs/${orgId}/browser-profiles/${profileId}`,
   BROWSER_PROFILE_OPEN: (orgId, profileId) => `${CLIP_BASE}/orgs/${orgId}/browser-profiles/${profileId}/open`,
@@ -35571,6 +35606,7 @@ var ParallClient = class _ParallClient {
       const rawErrorBody = await res.json().catch(() => ({}));
       throw buildApiError(res, rawErrorBody);
     }
+    opts?.onStatus?.(res.status);
     if (res.status === 204)
       return void 0;
     if (res.status === 202) {
@@ -35720,6 +35756,13 @@ var ParallClient = class _ParallClient {
     const res = await this.request("GET", ENDPOINTS.ORG_MEMBERS(orgId));
     return res.data;
   }
+  /** User IDs of soft-removed (former) org members — for marking their avatar /
+   *  name as "left" where dormant relations still surface them (DMs, task
+   *  assignees, message history). */
+  async getFormerMemberIds(orgId) {
+    const res = await this.request("GET", ENDPOINTS.ORG_MEMBERS_FORMER(orgId));
+    return res.user_ids ?? [];
+  }
   async getTeams(orgId) {
     const res = await this.request("GET", ENDPOINTS.TEAMS(orgId));
     return res.data;
@@ -35897,6 +35940,21 @@ var ParallClient = class _ParallClient {
   async sendMessage(orgId, chatId, req) {
     return this.request("POST", ENDPOINTS.CHAT_MESSAGES(orgId, chatId), req);
   }
+  /**
+   * sendMessage variant that also reports whether the server answered with an
+   * idempotent replay (HTTP 200 — the message already existed for this
+   * idempotency/effect key) instead of a fresh create (201). Used by the CLI
+   * to surface "already sent by a previous run (deduplicated)".
+   */
+  async sendMessageDetailed(orgId, chatId, req) {
+    let status = 0;
+    const message = await this.request("POST", ENDPOINTS.CHAT_MESSAGES(orgId, chatId), req, void 0, false, {
+      onStatus: (s) => {
+        status = s;
+      }
+    });
+    return { message, deduplicated: status === 200 };
+  }
   async getMessages(orgId, chatId, params) {
     return this.request("GET", ENDPOINTS.CHAT_MESSAGES(orgId, chatId), void 0, params);
   }
@@ -36208,20 +36266,25 @@ var ParallClient = class _ParallClient {
     return res.data;
   }
   /** `POST /machines/me/browser-profiles/{profileId}/status` — report runtime status. */
-  async reportBrowserProfileStatus(profileId, status, errorMsg) {
+  async reportBrowserProfileStatus(profileId, status, errorMsg, generation) {
     await this.request("POST", ENDPOINTS.MACHINES_ME_BROWSER_PROFILE_STATUS(profileId), {
       status,
-      ...errorMsg ? { error_msg: errorMsg } : {}
+      ...errorMsg ? { error_msg: errorMsg } : {},
+      ...generation !== void 0 ? { generation } : {}
     });
   }
   /**
    * `POST /machines/me/health` — bump the Machine's `updated_at` to now and
-   * report daemon state. The daemon should call this on a fixed cadence (e.g.
-   * every 30s) so an external observer can detect a wedged supervisor. Both
+   * report daemon state. The daemon calls this on startup and again whenever
+   * periodic runtime re-detection produces a CHANGED result (there is no
+   * fixed-cadence keepalive loop today — steady state posts nothing). All
    * fields are optional and only persisted when changed:
    *  - `daemonVersion` — the running bundle/launcher version.
    *  - `selfUpdateCapable` — whether the daemon can act on a machine.update
    *    signal (true under a service manager, false for bare `npx` foreground).
+   *  - `detectedRuntimes` — runtime CLIs found on the host. Omitted = no
+   *    report this beat (server keeps the stored value); [] = detection ran
+   *    and found nothing (server clears to empty).
    */
   async postMachineHeartbeat(opts) {
     const body = {};
@@ -36229,6 +36292,8 @@ var ParallClient = class _ParallClient {
       body.daemon_version = opts.daemonVersion;
     if (opts?.selfUpdateCapable !== void 0)
       body.self_update_capable = opts.selfUpdateCapable;
+    if (opts?.detectedRuntimes !== void 0)
+      body.detected_runtimes = opts.detectedRuntimes;
     return this.request("POST", ENDPOINTS.MACHINES_ME_HEALTH, Object.keys(body).length > 0 ? body : void 0);
   }
   async reportAgentWorkspaceState(agentId, state2) {
@@ -36351,6 +36416,30 @@ var ParallClient = class _ParallClient {
     const params = maxAgeHours !== void 0 ? { max_age_hours: String(maxAgeHours) } : void 0;
     return this.request("POST", ENDPOINTS.DISPATCH_EXPIRE(orgId), void 0, params);
   }
+  /**
+   * Claim a dispatch lane (explicit consume endpoint). Occupies the
+   * (agent, target, thread) lane and folds claimable WorkItems into it;
+   * `claimed: false` means a healthy incumbent holds the lane.
+   */
+  async claimDispatch(orgId, req) {
+    return this.request("POST", ENDPOINTS.DISPATCH_CLAIM(orgId), req);
+  }
+  /** Fold a pending same-target WorkItem into a live lane (409 STALE_LANE when dethroned). */
+  async steerDispatch(orgId, req) {
+    return this.request("POST", ENDPOINTS.DISPATCH_STEER(orgId), req);
+  }
+  /** End a turn: no_action sweep of the lane's members + lane release + re-drive check. */
+  async completeDispatch(orgId, req) {
+    return this.request("POST", ENDPOINTS.DISPATCH_COMPLETE(orgId), req);
+  }
+  /** Release a lane on graceful shutdown — members return to pending immediately. */
+  async releaseDispatchLane(orgId, lane) {
+    return this.request("POST", ENDPOINTS.DISPATCH_RELEASE(orgId), { lane });
+  }
+  /** Renew a live lane's lease (long-turn keepalive). 409 STALE_LANE when dethroned. */
+  async heartbeatDispatchLane(orgId, req) {
+    return this.request("POST", ENDPOINTS.DISPATCH_HEARTBEAT(orgId), req);
+  }
   async getDispatchByMessages(orgId, chatId, messageIds) {
     const params = { chat_id: chatId, message_ids: messageIds.join(",") };
     return this.request("GET", ENDPOINTS.DISPATCH_BY_MESSAGES(orgId), void 0, params);
@@ -36547,6 +36636,59 @@ var ParallClient = class _ParallClient {
   async deleteExternalConnection(orgId, connectionId) {
     return this.request("DELETE", ENDPOINTS.EXTERNAL_CONNECTION(orgId, connectionId));
   }
+  // ---- External IM channel (org-scoped) ----
+  async createChannelConnection(orgId, input) {
+    return this.request("POST", ENDPOINTS.CHANNEL_CONNECTIONS(orgId), input);
+  }
+  async listChannelConnections(orgId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_CONNECTIONS(orgId));
+  }
+  async getChannelConnection(orgId, connectionId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_CONNECTION(orgId, connectionId));
+  }
+  async updateChannelConnection(orgId, connectionId, patch) {
+    return this.request("PATCH", ENDPOINTS.CHANNEL_CONNECTION(orgId, connectionId), patch);
+  }
+  async archiveChannelConnection(orgId, connectionId) {
+    return this.request("DELETE", ENDPOINTS.CHANNEL_CONNECTION(orgId, connectionId));
+  }
+  async deliverChannelCredentials(orgId, connectionId, credentials) {
+    return this.request("POST", ENDPOINTS.CHANNEL_CONNECTION_CREDENTIALS(orgId, connectionId), credentials);
+  }
+  async regenerateChannelIngressToken(orgId, connectionId) {
+    return this.request("POST", ENDPOINTS.CHANNEL_CONNECTION_INGRESS_TOKEN_REGENERATE(orgId, connectionId));
+  }
+  /** Start a Feishu one-click provisioning session (device flow QR). */
+  async initiateChannelProvisioning(orgId, input) {
+    return this.request("POST", ENDPOINTS.CHANNEL_PROVISIONING(orgId), input);
+  }
+  /**
+   * Lazy status poll — server-side this may forward one provider poll, so
+   * call it at the session's `poll_interval_seconds` cadence, not faster.
+   */
+  async getChannelProvisioningSession(orgId, sessionId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_PROVISIONING_SESSION(orgId, sessionId));
+  }
+  async cancelChannelProvisioning(orgId, sessionId) {
+    return this.request("POST", ENDPOINTS.CHANNEL_PROVISIONING_CANCEL(orgId, sessionId));
+  }
+  async listChannelConversations(orgId, connectionId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_CONNECTION_CONVERSATIONS(orgId, connectionId));
+  }
+  async getChannelConversation(orgId, conversationId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_CONVERSATION(orgId, conversationId));
+  }
+  async listChannelConversationMessages(orgId, conversationId, limit) {
+    return this.request("GET", ENDPOINTS.CHANNEL_CONVERSATION_MESSAGES(orgId, conversationId), void 0, { limit });
+  }
+  async setChannelConversationSession(orgId, conversationId, agentSessionId) {
+    return this.request("PATCH", ENDPOINTS.CHANNEL_CONVERSATION_SESSION(orgId, conversationId), {
+      agent_session_id: agentSessionId
+    });
+  }
+  async getChannelMessage(orgId, messageId) {
+    return this.request("GET", ENDPOINTS.CHANNEL_MESSAGE(orgId, messageId));
+  }
   async getExternalTriggerSchema(orgId, connectionId) {
     return this.request("GET", ENDPOINTS.EXTERNAL_TRIGGER_SCHEMA(orgId, connectionId));
   }
@@ -36588,6 +36730,23 @@ var ParallClient = class _ParallClient {
   async getWiki(orgId, wikiId) {
     return this.request("GET", ENDPOINTS.WIKI(orgId, wikiId));
   }
+  /** Soft-delete an entire wiki (org owner only; the default wiki is
+   *  protected → 403 WIKI_PROTECTED). Returns the deleted wiki. Recoverable
+   *  via restoreWiki within the retention window. */
+  async deleteWiki(orgId, wikiId) {
+    return this.request("DELETE", ENDPOINTS.WIKI(orgId, wikiId));
+  }
+  /** Restore a soft-deleted wiki (org owner only). 409 WIKI_PURGE_STARTED once
+   *  purge has been claimed (no longer restorable), or 404 once the row is gone.
+   *  Returns the restored wiki. */
+  async restoreWiki(orgId, wikiId) {
+    return this.request("POST", ENDPOINTS.WIKI_RESTORE(orgId, wikiId));
+  }
+  /** Recycle bin — list soft-deleted wikis for the org (owner only). */
+  async getDeletedWikis(orgId) {
+    const res = await this.request("GET", ENDPOINTS.WIKIS_DELETED(orgId));
+    return res.data;
+  }
   async getWikiTree(orgId, wikiId, params) {
     return this.request("GET", ENDPOINTS.WIKI_TREE(orgId, wikiId), void 0, params);
   }
@@ -36621,6 +36780,15 @@ var ParallClient = class _ParallClient {
       blob.signed_url = this.absoluteMediaUrl(blob.signed_url);
     return blob;
   }
+  /**
+   * Copy one wiki file to another path as an independent snapshot (no sync).
+   * Used to "share a private file out": copy a file from the caller's personal
+   * namespace (`users/{userId}/…`) into the public wiki, leaving the original
+   * untouched. 409 `FILE_EXISTS` if `dest_path` already exists.
+   */
+  async copyWikiFile(orgId, wikiId, req) {
+    return this.request("POST", ENDPOINTS.WIKI_COPY(orgId, wikiId), req);
+  }
   async getWikiNodeSections(orgId, wikiId, params) {
     return this.request("GET", ENDPOINTS.WIKI_NODE_SECTIONS(orgId, wikiId), void 0, params);
   }
@@ -36894,6 +37062,19 @@ var ParallClient = class _ParallClient {
     const resp = await this.request("GET", ENDPOINTS.COMPUTE_PRICING());
     return resp.data;
   }
+  /** Runtime capability table (public) — SSOT for the create/settings interlock. */
+  async getRuntimes() {
+    const resp = await this.request("GET", ENDPOINTS.RUNTIMES());
+    return resp.data;
+  }
+  /**
+   * Platform model catalog (public) — DB-backed, replaces the compile-time
+   * PLATFORM_MODELS constant. Pass includeModel to keep an agent's pinned
+   * hidden legacy model representable (settings picker).
+   */
+  async getModels(includeModel) {
+    return this.request("GET", ENDPOINTS.MODELS(includeModel));
+  }
   // ---- Clips ----
   async listClips(orgId) {
     const resp = await this.request("GET", ENDPOINTS.CLIPS(orgId));
@@ -36938,6 +37119,11 @@ var ParallClient = class _ParallClient {
     const resp = await this.request("GET", ENDPOINTS.CLIP_ONLINE(orgId));
     return resp.data;
   }
+  /** Deployment-wide hosted browser runtime availability — drives whether the
+   *  create UI offers the platform-hosted placement. Fail-closed server-side. */
+  async getBrowserRuntimeStatus(orgId) {
+    return this.request("GET", ENDPOINTS.BROWSER_RUNTIME_STATUS(orgId));
+  }
   /** Org-wide browser-profile discovery list. Returns the sanitized
    *  {@link BrowserProfileListItem} shape (not the full domain model), each row
    *  carrying a per-viewer `can_open` control hint. */
@@ -37046,6 +37232,50 @@ import { createRequire } from "node:module";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 
+// ts/daemon/dist/clip-runtime/browser-daemon-env.js
+var BROWSER_DAEMON_STRIPPED_ENV = [
+  "PRLL_API_KEY",
+  // machine key (mck_) — BYOC + agent control plane
+  "PRLL_PROVIDER_CONFIG",
+  // JSON ProviderConfig blob — may carry BYO LLM api keys
+  "PRLL_ASSIGNMENT_TOKEN",
+  // hosted pod platform assignment token (pba_)
+  "PRLL_POOL_TOKEN",
+  // hosted warm-pool bootstrap token (pba_)
+  "AWS_ACCESS_KEY_ID",
+  // hosted S3 browser-state STS creds (browser-pod.ts)
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  // AWS credential-RESOLUTION vars: the SDK derives creds from these too (IRSA
+  // web-identity, ECS/EKS container creds, named profile, on-disk cred/config
+  // files), so a child inheriting them could assume the pod's role even without
+  // the static keys above. bb-browser uses none of them.
+  "AWS_WEB_IDENTITY_TOKEN_FILE",
+  "AWS_ROLE_ARN",
+  "AWS_ROLE_SESSION_NAME",
+  "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",
+  "AWS_CONTAINER_CREDENTIALS_FULL_URI",
+  "AWS_CONTAINER_AUTHORIZATION_TOKEN",
+  "AWS_PROFILE",
+  "AWS_SHARED_CREDENTIALS_FILE",
+  "AWS_CONFIG_FILE",
+  "AWS_REGION",
+  // hosted browser-state config — bb-browser does not use it
+  "PRLL_BROWSER_STATE_REGION",
+  // browser-pod AWS_REGION fallback — same config family
+  "PRLL_BROWSER_STATE_BUCKET",
+  "PRLL_STATE_GENERATION",
+  "PRLL_BROWSER_STATE_ENDPOINT"
+];
+function buildBrowserDaemonEnv(baseEnv, homeDir) {
+  const env = { ...baseEnv, BB_BROWSER_HOME: homeDir };
+  clearAllProviderCreds(env);
+  for (const key of BROWSER_DAEMON_STRIPPED_ENV) {
+    delete env[key];
+  }
+  return env;
+}
+
 // ts/daemon/dist/clip-runtime/browser-viewer-streamer.js
 import { spawn } from "node:child_process";
 
@@ -37075,6 +37305,41 @@ async function findFreePort() {
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
+function waitForChildExit(child, log, graceMs = 5e3, hardCapMs = 15e3) {
+  if (child.exitCode !== null || child.signalCode !== null)
+    return Promise.resolve();
+  return new Promise((resolve2) => {
+    let killTimer;
+    let capTimer;
+    const finish = () => {
+      child.removeListener("exit", finish);
+      if (killTimer)
+        clearTimeout(killTimer);
+      if (capTimer)
+        clearTimeout(capTimer);
+      resolve2();
+    };
+    child.once("exit", finish);
+    try {
+      child.kill("SIGTERM");
+    } catch {
+    }
+    killTimer = setTimeout(() => {
+      if (child.exitCode === null && child.signalCode === null) {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }
+    }, graceMs);
+    capTimer = setTimeout(() => {
+      log?.warn(`child did not exit within ${hardCapMs}ms after SIGKILL; proceeding`);
+      finish();
+    }, hardCapMs);
+    killTimer.unref?.();
+    capTimer.unref?.();
+  });
+}
 
 // ts/daemon/dist/clip-runtime/browser-viewer-streamer.js
 var BB_VIEWER_HEALTH_TIMEOUT_MS = 1e4;
@@ -37653,6 +37918,7 @@ function filterTabListToAccount(result, account) {
 
 // ts/daemon/dist/clip-runtime/browser-profile-manager.js
 var BB_BROWSER_DAEMON_START_TIMEOUT_MS = 15e3;
+var BB_BROWSER_DAEMON_START_ATTEMPTS = 3;
 var BrowserCommandError = class extends Error {
   method;
   account;
@@ -37668,6 +37934,11 @@ var BrowserProfileManager = class {
   daemon = null;
   starting = null;
   restarting = null;
+  // Set by stop() and never reset (stop() is terminal — the pool disposes the
+  // manager and the hosted pod exits). Makes a startDaemon() that resolves after
+  // stop() began un-adoptable, so a late child can't be reassigned to this.daemon
+  // and escape teardown.
+  stopping = false;
   ensuredAccounts = /* @__PURE__ */ new Set();
   ensuringAccounts = /* @__PURE__ */ new Map();
   reportedStatuses = /* @__PURE__ */ new Map();
@@ -37718,9 +37989,12 @@ var BrowserProfileManager = class {
       throw err;
     }
   }
-  async ensureRuntime(profileId) {
+  async ensureRuntime(profileId, opts = {}) {
     if (!profileId)
       throw new Error("browser profile id is required");
+    if (opts.forceStatusReport) {
+      this.reportedStatuses.delete(profileId);
+    }
     try {
       await this.withDaemonRecovery(() => this.ensureAccount(profileId), `ensure runtime for ${profileId}`);
       this.reportStatus(profileId, "running");
@@ -37769,22 +38043,36 @@ var BrowserProfileManager = class {
     }
   }
   async stop() {
+    this.stopping = true;
     this.viewer.shutdown();
+    const inflight = this.starting;
+    const restarting = this.restarting;
     const daemon = this.daemon;
     this.daemon = null;
     this.starting = null;
     this.ensuredAccounts.clear();
     this.ensuringAccounts.clear();
     this.reportedStatuses.clear();
-    if (!daemon)
-      return;
-    try {
-      await this.post("/shutdown", daemon, void 0, 3e3);
-    } catch {
+    if (restarting) {
+      try {
+        await restarting;
+      } catch {
+      }
     }
-    if (daemon.child.exitCode === null && daemon.child.signalCode === null) {
-      daemon.child.kill("SIGTERM");
+    let started = null;
+    if (inflight) {
+      try {
+        started = await inflight;
+      } catch {
+      }
     }
+    await Promise.all([daemon, started].filter((d5) => d5 !== null).map(async (d5) => {
+      try {
+        await this.post("/shutdown", d5, void 0, 3e3);
+      } catch {
+      }
+      await waitForChildExit(d5.child, this.opts.log);
+    }));
   }
   /**
    * Viewer control command entrypoint — delegates to BrowserViewerStreamer
@@ -38010,17 +38298,28 @@ var BrowserProfileManager = class {
   async ensureDaemon() {
     if (this.restarting)
       await this.restarting;
+    if (this.stopping)
+      throw new Error("browser profile manager is stopping");
     if (this.daemon && this.daemon.child.exitCode === null && this.daemon.child.signalCode === null) {
       return this.daemon;
     }
-    if (this.starting)
-      return this.starting;
+    if (this.starting) {
+      const started = await this.starting;
+      if (this.stopping)
+        throw new Error("browser profile manager is stopping");
+      return started;
+    }
     this.starting = this.startDaemon();
+    const startPromise = this.starting;
     try {
-      this.daemon = await this.starting;
+      const started = await startPromise;
+      if (this.stopping)
+        throw new Error("browser profile manager is stopping");
+      this.daemon = started;
       return this.daemon;
     } finally {
-      this.starting = null;
+      if (this.starting === startPromise)
+        this.starting = null;
     }
   }
   async withDaemonRecovery(operation2, label) {
@@ -38056,20 +38355,46 @@ var BrowserProfileManager = class {
       await this.post("/shutdown", daemon, void 0, 3e3);
     } catch {
     }
-    if (daemon.child.exitCode === null && daemon.child.signalCode === null) {
-      daemon.child.kill("SIGTERM");
-    }
+    await waitForChildExit(daemon.child, this.opts.log);
   }
   async startDaemon() {
+    let lastErr;
+    for (let attempt = 1; attempt <= BB_BROWSER_DAEMON_START_ATTEMPTS; attempt++) {
+      try {
+        return await this.startDaemonAttempt();
+      } catch (err) {
+        lastErr = err;
+        if (attempt < BB_BROWSER_DAEMON_START_ATTEMPTS) {
+          this.opts.log.warn(`[bb-browser] daemon start attempt ${attempt} failed; retrying with fresh ports: ${String(err)}`);
+        }
+      }
+    }
+    throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+  }
+  async startDaemonAttempt() {
     const host = "127.0.0.1";
     const port = await findFreePort();
+    let cdpPort = await findFreePort();
+    for (let i5 = 0; cdpPort === port && i5 < 5; i5++) {
+      cdpPort = await findFreePort();
+    }
+    if (cdpPort === port) {
+      throw new Error("bb-browser: could not allocate distinct HTTP and CDP ports");
+    }
     const token = randomToken();
     const daemonPath = resolveBbBrowserDaemonPath();
-    const child = spawn2(process.execPath, [daemonPath, "--host", host, "--port", String(port), "--token", token], {
-      env: {
-        ...process.env,
-        BB_BROWSER_HOME: this.opts.homeDir
-      },
+    const child = spawn2(process.execPath, [
+      daemonPath,
+      "--host",
+      host,
+      "--port",
+      String(port),
+      "--token",
+      token,
+      "--cdp-port",
+      String(cdpPort)
+    ], {
+      env: buildBrowserDaemonEnv(process.env, this.opts.homeDir),
       stdio: ["ignore", "ignore", "pipe"]
     });
     let childError = null;
@@ -38098,7 +38423,7 @@ var BrowserProfileManager = class {
         await sleep(200);
       }
     }
-    child.kill("SIGTERM");
+    await waitForChildExit(child, this.opts.log);
     throw new Error("bb-browser-daemon did not start in time");
   }
   async post(pathName, daemon, body, timeoutMs = 1e4) {