@parall/daemon 1.45.0 → 1.46.0

package/bundle/parall-openclaw-agent.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire as __prllCreateRequire } from 'node:module'; const require = __prllCreateRequire(import.meta.url);
 
 // ts/openclaw-agent/dist/index.js
 import { execFileSync, spawn } from "node:child_process";

package/dist/browser-pod.d.ts

@@ -68,6 +68,13 @@ export interface BrowserPodConfig {
     /** Per-profile outbound proxy (controller-injected via PRLL_BROWSER_PROXY_* env on a
      *  cold pod, or the /assign body on a warm one). null = direct egress. */
     proxy: BrowserProxyConfig | null;
+    /** Proxy readiness probe endpoint (PRLL_BROWSER_PROXY_PROBE_URL; the controller
+     *  injects `<public api base>/generate_204` via ProxyProbeURLFromAPIBase).
+     *  MUST be a PUBLIC, proxy-resolvable first-party 204 — never a cluster-internal
+     *  /health host, which an external residential/datacenter proxy cannot resolve
+     *  (the probe's whole point is "can we reach the public internet through this
+     *  proxy"). Zero-byte 204 keeps per-GB proxy cost negligible. */
+    proxyProbeUrl: string;
 }
 /**
  * Resolve and validate the pod's runtime config from the environment. Throws on
@@ -76,6 +83,14 @@ export interface BrowserPodConfig {
  * doomed reconnect loop).
  */
 export declare function resolveBrowserPodConfig(env?: NodeJS.ProcessEnv): BrowserPodConfig;
+/** Probe endpoint for proxy readiness (browser-readiness.ts). The probe navigates
+ *  a sacrificial tab THROUGH the profile's proxy, so the target must be a PUBLIC,
+ *  proxy-resolvable host — the pod's cluster-internal clip-service (`clipRpcUrl`)
+ *  could NEVER be resolved by an external residential/datacenter proxy, so it is
+ *  deliberately not used here. Order: explicit `PRLL_BROWSER_PROXY_PROBE_URL`
+ *  (controller may inject a per-env Parall-owned public 204), else a well-known
+ *  public 204 fallback. `clipRpcUrl` is unused now; kept for signature stability. */
+export declare function resolveProxyProbeUrl(env: NodeJS.ProcessEnv, _clipRpcUrl: string): string;
 /** Resolved warm-pool config — the identity-less env a warm pod boots with. */
 export interface PoolPodConfig {
     /** Controller-minted pba_ pool bootstrap token; the bearer required on POST /assign. */
@@ -112,6 +127,9 @@ export interface AssignRequest {
     orgId: string;
     leaseId: string;
     generation: number;
+    /** State epoch (reset_generation at assignment) — scopes the S3 state key.
+     *  Absent from an older controller → 0 (legacy un-suffixed key). */
+    stateEpoch: number;
     state?: AssignStateCreds;
     /** Per-profile outbound proxy (warm-pod counterpart of the cold pod's
      *  PRLL_BROWSER_PROXY_* env). Absent = direct egress. */
@@ -205,10 +223,14 @@ export declare class BrowserPodRuntime {
     private readonly log;
     private readonly checkpointer?;
     private readonly checkpointIntervalMs;
+    private readonly quiesce?;
     private draining;
     private drainPromise;
     private checkpointTimer;
-    constructor(provider: PodProvider, browser: PodBrowser, log: Pick<GatewayLogger, 'info' | 'warn' | 'error'>, checkpointer?: PodStateCheckpointer | undefined, checkpointIntervalMs?: number);
+    constructor(provider: PodProvider, browser: PodBrowser, log: Pick<GatewayLogger, 'info' | 'warn' | 'error'>, checkpointer?: PodStateCheckpointer | undefined, checkpointIntervalMs?: number, quiesce?: (() => Promise<{
+        quiesced: boolean;
+        reason?: string;
+    }>) | undefined);
     /**
      * Route-readiness: registered to the hub AND not draining. `draining` is checked
      * first so the readiness gate flips false the instant a drain begins — before

package/dist/browser-pod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-pod.d.ts","sourceRoot":"","sources":["../src/browser-pod.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAIH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAgB9F,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB;8EAC0E;IAC1E,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAClC;AASD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuC9F;AA6CD,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAuBxF;AAED;kEACkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;0EAC0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;6DACyD;IACzD,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,KAAK,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAiEnE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,IAAI,CAwBnF;AAED,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACjE,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAElG,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,OAAO,IAAI,OAAO,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;CAClC;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACpE,GAAG,UAAU,CA0Cb;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,IAAI,OAAO,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,qBAAa,iBAAiB;IAM1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAGpB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAXvC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,eAAe,CAA+C;gBAGnD,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EAGnD,YAAY,CAAC,EAAE,oBAAoB,YAAA,EACnC,oBAAoB,GAAE,MAAuC;IAGhF;;;;;;OAMG;IACH,OAAO,IAAI,OAAO;IAIlB;qEACiE;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B;;oDAEgD;IAChD,OAAO,CAAC,mBAAmB;IAY3B;;;;;;OAMG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAkC7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAGpD,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,GAAG,IAAI,CAAC,MAAM,CAqBd;AAqED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,aAAa,GACjB,iBAAiB,GAAG,IAAI,CAiC1B;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAK1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE3E;AAcD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,iBAAiB,CAAC,CA0F5B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAyCf;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAmDf"}
+{"version":3,"file":"browser-pod.d.ts","sourceRoot":"","sources":["../src/browser-pod.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAIH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2CAA2C,CAAC;AAInD,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAgB9F,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB;8EAC0E;IAC1E,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACjC;;;;;qEAKiE;IACjE,aAAa,EAAE,MAAM,CAAC;CACvB;AASD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAwC9F;AAED;;;;;;qFAMqF;AACrF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAIxF;AAoCD,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAuBxF;AAED;kEACkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;0EAC0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB;wEACoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;6DACyD;IACzD,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,KAAK,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAuEnE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,IAAI,CAyBnF;AAED,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACjE,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAElG,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,OAAO,IAAI,OAAO,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;CAClC;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACpE,GAAG,UAAU,CA0Cb;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,IAAI,OAAO,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,qBAAa,iBAAiB;IAM1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAGpB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAOrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAlB3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,eAAe,CAA+C;gBAGnD,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EAGnD,YAAY,CAAC,EAAE,oBAAoB,YAAA,EACnC,oBAAoB,GAAE,MAAuC,EAO7D,OAAO,CAAC,GAAE,MAAM,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,aAAA;IAGlF;;;;;;OAMG;IACH,OAAO,IAAI,OAAO;IAIlB;qEACiE;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B;;oDAEgD;IAChD,OAAO,CAAC,mBAAmB;IAY3B;;;;;;OAMG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAuD7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAGpD,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,GAAG,IAAI,CAAC,MAAM,CAqBd;AAqED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,aAAa,GACjB,iBAAiB,GAAG,IAAI,CAgD1B;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAK1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE3E;AAcD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAyG5B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAyCf;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAmDf"}

package/dist/browser-pod.js

@@ -52,6 +52,9 @@ import * as path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { createLogger } from '@parall/agent-core';
 import { BrowserProfileManager, } from './clip-runtime/browser-profile-manager.js';
+import { normalizeProxyConfig } from './clip-runtime/browser-proxy-state.js';
+import { awaitBrowserQuiescence } from './clip-runtime/browser-quiescence.js';
+import { PUBLIC_PROXY_PROBE_FALLBACK_URL } from './clip-runtime/browser-readiness.js';
 import { BrowserStateStore } from './clip-runtime/browser-state-store.js';
 import { ClipProvider } from './clip-runtime/clip-provider.js';
 import { ClipProcessManager } from './clip-runtime/process-manager.js';
@@ -115,11 +118,30 @@ export function resolveBrowserPodConfig(env = process.env) {
         stateDir,
         homeDir,
         proxy: parseProxyEnv(env),
+        proxyProbeUrl: resolveProxyProbeUrl(env, clipRpcUrl),
     };
 }
+/** Probe endpoint for proxy readiness (browser-readiness.ts). The probe navigates
+ *  a sacrificial tab THROUGH the profile's proxy, so the target must be a PUBLIC,
+ *  proxy-resolvable host — the pod's cluster-internal clip-service (`clipRpcUrl`)
+ *  could NEVER be resolved by an external residential/datacenter proxy, so it is
+ *  deliberately not used here. Order: explicit `PRLL_BROWSER_PROXY_PROBE_URL`
+ *  (controller may inject a per-env Parall-owned public 204), else a well-known
+ *  public 204 fallback. `clipRpcUrl` is unused now; kept for signature stability. */
+export function resolveProxyProbeUrl(env, _clipRpcUrl) {
+    const override = env.PRLL_BROWSER_PROXY_PROBE_URL?.trim();
+    if (override)
+        return override;
+    return PUBLIC_PROXY_PROBE_FALLBACK_URL;
+}
 /** Parse the controller-injected PRLL_BROWSER_PROXY_* env into a proxy config, or
  *  null when no proxy is set (PRLL_BROWSER_PROXY_SERVER absent → direct egress).
- *  The cold pod gets these as env; the warm pod's /assign writes the same vars. */
+ *  The cold pod gets these as env; the warm pod's /assign writes the same vars.
+ *  Validation is the SHARED rule set (browser-proxy-state.ts, mirroring the Go
+ *  server): orphan/half credentials, credential-less proxies (silently dropped by
+ *  bb-browser → real-IP egress), SOCKS5+auth, and unknown schemes all FAIL CLOSED
+ *  here — a misconfigured pod spec or a legacy DB row must crash the pod at boot,
+ *  never leak traffic past the intended proxy. */
 function parseProxyEnv(env) {
     const server = env.PRLL_BROWSER_PROXY_SERVER?.trim();
     // username + password are credential-like passthrough — kept VERBATIM (never
@@ -127,23 +149,12 @@ function parseProxyEnv(env) {
     // a provider could legitimately use surrounding whitespace. Empty string → undefined.
     const username = env.PRLL_BROWSER_PROXY_USERNAME || undefined;
     const password = env.PRLL_BROWSER_PROXY_PASSWORD || undefined;
-    if (!server) {
-        // Orphan credentials with no server must FAIL CLOSED, not silently fall through
-        // to direct egress: a misconfigured pod spec that drops the server var while
-        // keeping creds should crash here, not leak traffic past the intended proxy.
-        if (username !== undefined || password !== undefined) {
-            throw new Error('browser-pod: PRLL_BROWSER_PROXY_USERNAME/PASSWORD set without PRLL_BROWSER_PROXY_SERVER');
-        }
-        return null; // no proxy at all → direct egress
+    if (!server && (username !== undefined || password !== undefined)) {
+        throw new Error('browser-pod: PRLL_BROWSER_PROXY_USERNAME/PASSWORD set without PRLL_BROWSER_PROXY_SERVER');
     }
-    // Reject half-auth at the pod boundary too (the server already enforces the
-    // user+pass pair). A version skew / bad pod spec should fail fast here, not
-    // forward incomplete creds to account_create where it becomes a confusing
-    // runtime auth failure.
-    if ((username === undefined) !== (password === undefined)) {
-        throw new Error('browser-pod: PRLL_BROWSER_PROXY_USERNAME and PRLL_BROWSER_PROXY_PASSWORD must be set together');
-    }
-    return { server, username, password };
+    if (!server)
+        return null; // no proxy at all → direct egress
+    return normalizeProxyConfig({ server, username, password });
 }
 /**
  * Resolve a warm pod's identity-less config. Unlike resolveBrowserPodConfig this
@@ -192,6 +203,9 @@ export function parseAssignRequest(body) {
     const orgId = str(b.org_id);
     const leaseId = str(b.lease_id);
     const generation = typeof b.generation === 'number' && Number.isFinite(b.generation) ? b.generation : 0;
+    const stateEpoch = typeof b.state_epoch === 'number' && Number.isSafeInteger(b.state_epoch) && b.state_epoch > 0
+        ? b.state_epoch
+        : 0;
     if (!assignmentToken)
         return { ok: false, error: 'assignment_token required' };
     if (!assignmentToken.startsWith(ASSIGNMENT_TOKEN_PREFIX)) {
@@ -237,16 +251,19 @@ export function parseAssignRequest(body) {
         // empty string → undefined. (server is a structured host:port, so it is trimmed.)
         const username = (typeof p.username === 'string' ? p.username : '') || undefined;
         const password = (typeof p.password === 'string' ? p.password : '') || undefined;
-        // Reject half-auth (same invariant the server enforces) before it reaches
-        // account_create as a confusing runtime auth failure.
-        if ((username === undefined) !== (password === undefined)) {
-            return { ok: false, error: 'proxy username and password must be provided together' };
+        // Shared rule set (browser-proxy-state.ts, mirrors the Go server): half or
+        // missing credentials, SOCKS5+auth, and unknown schemes are rejected before
+        // they can reach account_create as a silent drop / confusing runtime failure.
+        try {
+            proxy = normalizeProxyConfig({ server, username, password }) ?? undefined;
+        }
+        catch (err) {
+            return { ok: false, error: err instanceof Error ? err.message : String(err) };
         }
-        proxy = { server, username, password };
     }
     return {
         ok: true,
-        value: { assignmentToken, profileId, orgId, leaseId, generation, state, proxy },
+        value: { assignmentToken, profileId, orgId, leaseId, generation, stateEpoch, state, proxy },
     };
 }
 /**
@@ -268,6 +285,7 @@ export function applyAssignmentEnv(env, req) {
             env.AWS_REGION = req.state.region;
         env.PRLL_BROWSER_STATE_BUCKET = req.state.bucket;
         env.PRLL_STATE_GENERATION = String(req.generation);
+        env.PRLL_STATE_EPOCH = String(req.stateEpoch);
         if (req.state.endpoint)
             env.PRLL_BROWSER_STATE_ENDPOINT = req.state.endpoint;
     }
@@ -362,18 +380,27 @@ export class BrowserPodRuntime {
     log;
     checkpointer;
     checkpointIntervalMs;
+    quiesce;
     draining = false;
     drainPromise = null;
     checkpointTimer = null;
     constructor(provider, browser, log, 
     // Optional S3 state checkpointer (PR4). Absent => stateless pod (no
     // hydrate/checkpoint); the drain order then matches the pre-PR4 contract.
-    checkpointer, checkpointIntervalMs = DEFAULT_CHECKPOINT_INTERVAL_MS) {
+    checkpointer, checkpointIntervalMs = DEFAULT_CHECKPOINT_INTERVAL_MS, 
+    // Chrome-exit barrier before the FINAL checkpoint (browser-quiescence.ts):
+    // bb-browser exits without awaiting Chrome, so the drain must independently
+    // confirm the user-data-dir is quiet before snapshotting it. Absent (older
+    // wiring / stateless pod) => checkpoint immediately after browser.stop() as
+    // before. quiesced=false => the final checkpoint is SKIPPED — a possibly-torn
+    // snapshot must never be published (bounded loss, structured error).
+    quiesce) {
         this.provider = provider;
         this.browser = browser;
         this.log = log;
         this.checkpointer = checkpointer;
         this.checkpointIntervalMs = checkpointIntervalMs;
+        this.quiesce = quiesce;
     }
     /**
      * Route-readiness: registered to the hub AND not draining. `draining` is checked
@@ -436,17 +463,35 @@ export class BrowserPodRuntime {
             catch (err) {
                 this.log.warn(`browser stop during drain failed: ${String(err)}`);
             }
-            // Final checkpoint AFTER bb-browser has torn down — Chromium has flushed and
-            // released its files, so the snapshot is consistent. A failure here is bounded
-            // loss (the delta since the last successful checkpoint), logged below —
-            // durability is best-effort + on-close, with no controller-side verify/repair
-            // (design §3.2 "simplified durability").
+            // Final checkpoint AFTER bb-browser has torn down AND Chrome's exit +
+            // write-quiescence are CONFIRMED (bb-browser SIGTERMs Chrome and exits
+            // without awaiting it, so browser.stop() returning does not mean the
+            // user-data-dir is quiet). An unconfirmed exit SKIPS the upload — a
+            // possibly-torn snapshot must never be published as good state; the last
+            // periodic checkpoint stands (bounded loss, design §3.2 "simplified
+            // durability", no controller-side verify/repair).
             if (this.checkpointer) {
-                try {
-                    await this.checkpointer.checkpointFinal();
+                let safe = true;
+                if (this.quiesce) {
+                    try {
+                        const q = await this.quiesce();
+                        if (!q.quiesced) {
+                            safe = false;
+                            this.log.error(`BROWSER_CHECKPOINT_UNSAFE: ${q.reason ?? 'browser did not quiesce'} — skipping the final checkpoint (the last periodic snapshot stands)`);
+                        }
+                    }
+                    catch (err) {
+                        safe = false;
+                        this.log.error(`BROWSER_CHECKPOINT_UNSAFE: quiescence check failed (${String(err)}) — skipping the final checkpoint`);
+                    }
                 }
-                catch (err) {
-                    this.log.error(`final checkpoint during drain failed: ${String(err)}`);
+                if (safe) {
+                    try {
+                        await this.checkpointer.checkpointFinal();
+                    }
+                    catch (err) {
+                        this.log.error(`final checkpoint during drain failed: ${String(err)}`);
+                    }
                 }
             }
         })();
@@ -570,6 +615,18 @@ export function buildStateStore(config, env, log) {
     if (!Number.isSafeInteger(gen) || gen < 0) {
         throw new Error(`browser state enabled (bucket=${bucket}) but PRLL_STATE_GENERATION="${genRaw}" is not a non-negative safe integer — refusing to run a non-persisted profile (fail closed)`);
     }
+    // Epoch is deliberately fail-OPEN to 0 (unlike the generation): a missing value
+    // means an older controller that predates epoch-scoped keys, and 0 IS the
+    // legacy key — the correct read for every profile that has never been reset
+    // under the new scheme. A garbled value still refuses (misconfiguration).
+    const epochRaw = env.PRLL_STATE_EPOCH?.trim();
+    let epoch = 0;
+    if (epochRaw) {
+        epoch = Number(epochRaw);
+        if (!Number.isSafeInteger(epoch) || epoch < 0) {
+            throw new Error(`browser state enabled (bucket=${bucket}) but PRLL_STATE_EPOCH="${epochRaw}" is not a non-negative safe integer — refusing to run a non-persisted profile (fail closed)`);
+        }
+    }
     return new BrowserStateStore({
         bucket,
         region: env.AWS_REGION?.trim() || env.PRLL_BROWSER_STATE_REGION?.trim() || '',
@@ -577,6 +634,7 @@ export function buildStateStore(config, env, log) {
         orgId: config.orgId,
         profileId: config.profileId,
         generation: gen,
+        epoch,
         homeDir: config.homeDir,
         log,
     });
@@ -632,6 +690,7 @@ export async function preparePodRuntime(config, env, log) {
         homeDir: config.homeDir,
         log,
         resolveProxy: () => config.proxy,
+        proxyProbeUrl: config.proxyProbeUrl,
     });
     // The process manager hosts no installable clips in pod mode — its only job is
     // to advertise the synthetic "browser" capability (getProviderClips appends it
@@ -691,7 +750,18 @@ export async function preparePodRuntime(config, env, log) {
     else {
         log.info('browser state externalization disabled (no PRLL_BROWSER_STATE_BUCKET) — running stateless');
     }
-    return new BrowserPodRuntime(provider, browser, log, checkpointer, resolveCheckpointIntervalMs(env));
+    // Chrome-exit barrier before the final checkpoint — only meaningful when a
+    // checkpointer exists (its whole purpose is snapshot consistency). The
+    // manager's spawned process group is the ownership handle: quiescence waits
+    // for (and if needed, signals) exactly that group — never a scanned pid.
+    const quiesce = checkpointer
+        ? () => awaitBrowserQuiescence({
+            pgid: browser.lastKnownProcessGroup(),
+            cdpEndpoint: browser.lastKnownCdpEndpoint(),
+            log,
+        })
+        : undefined;
+    return new BrowserPodRuntime(provider, browser, log, checkpointer, resolveCheckpointIntervalMs(env), quiesce);
 }
 /**
  * Wire the real clip-runtime stack for a hosted browser pod and run until the

package/dist/browser-profile-reconcile.d.ts

@@ -0,0 +1,21 @@
+import type { GatewayLogger } from '@parall/agent-core';
+import type { ParallClient } from '@parall/sdk';
+import type { BrowserProfilePool } from './clip-runtime/index.js';
+export interface BrowserProfileReconcileContext {
+    /** The pool captured by the caller BEFORE the server fetch. */
+    pool: BrowserProfilePool;
+    /** The supervisor's CURRENT pool — a concurrent stop() may have nulled/replaced it. */
+    currentPool: () => BrowserProfilePool | null;
+    client: Pick<ParallClient, 'listMachineBrowserProfiles'>;
+    log: GatewayLogger;
+    /** Serialized per-profile op (stop/reset/release/wipe) — the supervisor's queue. */
+    enqueueOp: (profileId: string, op: () => Promise<void>) => Promise<void>;
+    /** Serialized per-profile REVIVE (open/ensure), tracked for reconnect fencing. */
+    enqueueRevive: (profileId: string, op: () => Promise<void>) => Promise<void>;
+    /** Wipe-then-report-error-on-failure, then re-throw so the caller skips the open. */
+    wipeBeforeRevive: (pool: BrowserProfilePool, profileId: string, resetGen: number, generation: number | undefined) => Promise<void>;
+    /** Snapshot of profiles with a queued-but-not-yet-live revive (pre-fetch). */
+    pendingReviveIds: () => Set<string>;
+}
+export declare function reconcileBrowserProfiles(ctx: BrowserProfileReconcileContext): Promise<void>;
+//# sourceMappingURL=browser-profile-reconcile.d.ts.map

package/dist/browser-profile-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-profile-reconcile.d.ts","sourceRoot":"","sources":["../src/browser-profile-reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAyB,YAAY,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAYlE,MAAM,WAAW,8BAA8B;IAC7C,+DAA+D;IAC/D,IAAI,EAAE,kBAAkB,CAAC;IACzB,uFAAuF;IACvF,WAAW,EAAE,MAAM,kBAAkB,GAAG,IAAI,CAAC;IAC7C,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IACzD,GAAG,EAAE,aAAa,CAAC;IACnB,oFAAoF;IACpF,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,kFAAkF;IAClF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,qFAAqF;IACrF,gBAAgB,EAAE,CAChB,IAAI,EAAE,kBAAkB,EACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,SAAS,KAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;CACrC;AAED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8LjG"}

package/dist/browser-profile-reconcile.js

@@ -0,0 +1,188 @@
+export async function reconcileBrowserProfiles(ctx) {
+    const pool = ctx.pool;
+    // Snapshot the locally-live set BEFORE the server fetch. A profile opened via a
+    // WS lifecycle event DURING the fetch is NOT in this snapshot, so the negative
+    // convergence below (which is stale w.r.t. that open) can never release it.
+    // There is no periodic browser reconcile to re-open a wrongly-released profile —
+    // it only runs on startup / WS-hello — so a stale release would strand it until
+    // the next reconnect.
+    const activeBeforeList = new Set(pool.activeProfileIds());
+    // Also snapshot revives (open/ensure) queued but not yet a live manager: such a
+    // stale open is invisible to activeProfileIds() and would otherwise drain after a
+    // missed offline stop/delete and start a runtime the server no longer wants.
+    const pendingReviveBeforeList = ctx.pendingReviveIds();
+    // And ALL local profile state — per-profile homes AND legacy flat account files
+    // (the pool owns that storage layout). State with NO server row is a
+    // deleted/reassigned profile whose cookies/storage must be wiped from this host;
+    // a pre-upgrade profile never reopened after migration exists only as a legacy flat
+    // file, so home-only enumeration would miss it. Pre-fetch so state created during
+    // the fetch is left alone.
+    const localStateBeforeList = new Set(pool.localStateProfileIds());
+    let profiles;
+    try {
+        profiles = await ctx.client.listMachineBrowserProfiles();
+    }
+    catch (err) {
+        ctx.log.warn(`browser profile reconcile: list failed: ${String(err)}`);
+        return;
+    }
+    // The pool must still be the same instance after the await — stop() may have
+    // nulled/replaced it during a concurrent shutdown; bail rather than act on a
+    // torn-down pool (also avoids NPE-ing through Promise.allSettled into warnings).
+    if (ctx.currentPool() !== pool)
+        return;
+    // Converge local runtimes to the server's desired-live set (the server is the
+    // SSOT). The supervisor is the desired-state coordinator; the pool is the
+    // per-profile runtime registry. Every op here goes through
+    // enqueueBrowserProfileOp so all supervisor-originated profile work shares one
+    // ordering layer (the pool's own queue is the final per-profile mutex).
+    const desiredLive = new Set();
+    const serverIds = new Set(); // every byoc profile the server still lists (any status)
+    const serverResetGen = new Map();
+    const ops = [];
+    // reset_generation (server) is the SSOT for reset intent; the daemon's per-profile
+    // sidecar (read via pool.appliedResetGeneration) is only a local ack of "already
+    // wiped up to this generation". A missed reset (server newer than the local ack) must
+    // wipe local state BEFORE any open/ensure, so a reopen starts clean and never
+    // resurrects the cookies the reset cleared. Returns the server reset_generation to
+    // apply, or null if nothing is missed. Pure (no side effects).
+    const missedResetGen = (profileId) => {
+        const gen = serverResetGen.get(profileId) ?? 0;
+        return gen > pool.appliedResetGeneration(profileId) ? gen : null;
+    };
+    // Negative-path helper (a stopped profile with a missed reset): fence synchronously
+    // then enqueue a STANDALONE wipe. No revive follows, so a wipe failure simply leaves
+    // the profile fenced and the sidecar unwritten → the next reconcile retries (the
+    // SSOT reset_generation is still unapplied locally). Fail-closed by construction.
+    const enqueueResetWipeIfMissed = (profileId) => {
+        const gen = missedResetGen(profileId);
+        if (gen === null)
+            return false;
+        // Fence SYNCHRONOUSLY before the async wipe — same contract as the WS stop/reset
+        // path. On a machine-WS reconnect whose clip-provider stream stays live, a hub
+        // invoke could otherwise run on the stale runtime in the gap before the wipe op
+        // starts. (In the negative loop this re-asserts an already-set fence within the same
+        // synchronous iteration — atomic, no revive can observe an intermediate generation.)
+        pool.fence(profileId);
+        ops.push(ctx.enqueueOp(profileId, () => pool.applyResetWipe(profileId, gen)));
+        return true;
+    };
+    for (const profile of profiles) {
+        // The daemon supervises only machine-bound (byoc) profiles; hosted profiles
+        // (null machine_id) run on the platform pool and are never owned by a daemon.
+        if (!profile.machine_id)
+            continue;
+        serverIds.add(profile.id);
+        serverResetGen.set(profile.id, profile.reset_generation ?? 0);
+        if (profile.status !== 'running' && profile.status !== 'pending')
+            continue;
+        desiredLive.add(profile.id);
+        // A missed reset must wipe SUCCESSFULLY before this profile is revived. Fence
+        // synchronously now (reject hub invokes in the gap before the queued wipe runs).
+        const wipeGen = missedResetGen(profile.id);
+        if (wipeGen !== null)
+            pool.fence(profile.id);
+        // Capture the fence generation AFTER any fence bump so a stop arriving while the op
+        // waits makes it skip as stale; carry the lifecycle generation so the daemon's
+        // `running` report is fenced server-side. Drive desired state through the CAPTURED
+        // pool (not enqueueBrowserProfileLifecycle, which re-reads this.browserProfilePool
+        // and would negative-ACK `error` for a pending profile if stop() nulled the field).
+        const sinceSeq = pool.stopSeqOf(profile.id);
+        const generation = profile.lifecycle_generation;
+        // forceStatusReport ONLY for a `pending` row: the daemon's last report may already be
+        // `running` (Chromium survived the WS drop), so a deduped repeat would leave the
+        // server stuck at `pending`. A `running` row keeps the normal dedup.
+        const forceStatusReport = profile.status === 'pending';
+        ops.push(ctx.enqueueRevive(profile.id, async () => {
+            // Reset-before-open, FAIL-CLOSED: a missed reset must wipe successfully BEFORE
+            // the revive un-fences and reopens. If applyResetWipe throws, the await
+            // propagates and ensureRuntime is SKIPPED — the profile stays fenced (the wipe
+            // fenced it and the applied-reset sidecar was NOT written), so the next reconcile
+            // retries because the SSOT reset_generation is still unapplied locally. This
+            // ordering is expressed locally; the enqueueBrowserProfileOp queue contract (a
+            // rejected op does not block later ops) is intentionally unchanged. A failed
+            // wipe reports `error` (visible) and re-throws here, so ensureRuntime is skipped.
+            if (wipeGen !== null)
+                await ctx.wipeBeforeRevive(pool, profile.id, wipeGen, generation);
+            // Reconnect recovery is liveness-only: ensure the runtime is live (account +
+            // tab) for both pending and running. The original open's `start_url` is NOT
+            // replayed (it rides only the live lifecycle event, not persisted); a `pending`
+            // profile whose open event the daemon missed comes up at the default page rather
+            // than a targetless `about:blank`. Persisting start_url is a separate follow-up.
+            await pool.ensureRuntime(profile.id, sinceSeq, generation, { forceStatusReport });
+        }));
+    }
+    // Negative convergence over everything locally known but NOT desired — active
+    // runtimes, queued revives (open/ensure not yet a manager), and local state (homes +
+    // legacy flat files) — all from the PRE-FETCH snapshots, so a profile that appeared
+    // DURING the fetch is left alone (no periodic reconcile would undo a wrong teardown).
+    const candidates = new Set([
+        ...activeBeforeList,
+        ...pendingReviveBeforeList,
+        ...localStateBeforeList,
+    ]);
+    for (const profileId of candidates) {
+        if (desiredLive.has(profileId))
+            continue;
+        const isActive = activeBeforeList.has(profileId);
+        const hasLocalState = localStateBeforeList.has(profileId);
+        // Pending-only revive (queued open/ensure, no runtime, no on-disk state at the
+        // pre-fetch snapshot): the synchronous fence alone neutralizes the stale open (it
+        // bumps stopSeq, so the queued revive skips as stale). Do NOT AWAIT a teardown — it
+        // would block behind the possibly-stuck queue and stall the whole reconcile (the
+        // queued-stale-open deadlock).
+        if (!isActive && !hasLocalState) {
+            pool.fence(profileId);
+            // Race: a pending-only revive can COMPLETE during the list fetch (create a manager
+            // + on-disk state) BEFORE this fence — the snapshot is then stale, so the fence
+            // alone leaves an orphaned runtime/disk the negative loop never converged. Converge
+            // it FIRE-AND-FORGET (NOT in `ops`: a still-stuck revive queue must not hang the
+            // reconcile; it runs once the queue drains — after the fenced open skips or
+            // completes — and is a no-op if nothing was created):
+            //   - deleted/reassigned    → wipeAbsent: the old host must keep no session data.
+            //   - present + missed reset → applyResetWipe: the completed open may have applied
+            //     only its event's (older) reset_generation, not the current one.
+            //   - present + stopped      → releaseRuntime: free the orphaned Chromium; a plain
+            //     stop keeps its cookies on disk.
+            let cleanup;
+            if (!serverIds.has(profileId)) {
+                cleanup = pool.wipeAbsent(profileId);
+            }
+            else {
+                const wipeGen = missedResetGen(profileId);
+                cleanup =
+                    wipeGen !== null
+                        ? pool.applyResetWipe(profileId, wipeGen)
+                        : pool.releaseRuntime(profileId);
+            }
+            void cleanup.catch((err) => ctx.log.warn(`browser profile pending-revive cleanup failed for ${profileId}: ${String(err)}`));
+            continue;
+        }
+        if (!serverIds.has(profileId)) {
+            // Absent from the server list → deleted/reassigned → fence + wipe local state (the
+            // old host must not keep cookies/storage). No status report — server is the SSOT.
+            pool.fence(profileId);
+            ops.push(ctx.enqueueOp(profileId, () => pool.wipeAbsent(profileId)));
+        }
+        else if (enqueueResetWipeIfMissed(profileId)) {
+            // Present (stopped) with a missed reset → fenced synchronously + wipe enqueued.
+        }
+        else if (isActive) {
+            // Present (stopped) but the runtime is still live → fence + release the runtime
+            // only; a plain stop keeps its cookies on disk.
+            pool.fence(profileId);
+            ops.push(ctx.enqueueOp(profileId, () => pool.releaseRuntime(profileId)));
+        }
+        // else: present + stopped + on-disk state + no runtime + no missed reset → LEAVE
+        // ALONE (do NOT fence). Its stopped-fence is already held — the start-sequence
+        // pre-fence on a fresh daemon, or the persisted pool state on a WS reconnect — so a
+        // hub invoke is still rejected. Re-fencing here would bump stopSeq and drop an `open`
+        // that arrived during the list fetch (it captured an older sinceSeq, and the stale
+        // `stopped` snapshot doesn't reflect it yet), stranding the server at `pending`.
+    }
+    for (const result of await Promise.allSettled(ops)) {
+        if (result.status === 'rejected') {
+            ctx.log.warn(`browser profile reconcile op failed: ${String(result.reason)}`);
+        }
+    }
+}

package/dist/clip-runtime/browser-cdp.d.ts

@@ -0,0 +1,40 @@
+export declare class BrowserCdpClient {
+    private readonly socket;
+    private nextId;
+    private readonly pending;
+    private closed;
+    private constructor();
+    /**
+     * Connect to the browser-level CDP endpoint behind host:port (`/json/version`).
+     * `timeoutMs` bounds BOTH the /json/version fetch and the websocket handshake —
+     * injectable so tests can force a fast timeout against a hung server, and so a
+     * caller with a wall-clock budget can hand down its remaining budget.
+     */
+    static connect(host: string, port: number, timeoutMs?: number): Promise<BrowserCdpClient>;
+    /** Send a browser-level CDP command and await its result. */
+    command<T>(method: string, params?: Record<string, unknown>): Promise<T>;
+    close(): void;
+    private onMessage;
+    private failAll;
+}
+/** The browserContextId owning a page target (empty for the default context). */
+export declare function targetBrowserContextId(cdp: BrowserCdpClient, targetId: string): Promise<string>;
+/**
+ * The full cookie jar of a BrowserContext (HttpOnly included) as CDP
+ * `Network.Cookie` objects — the capture side of cookie-preserving proxy
+ * reconciliation.
+ */
+export declare function getContextCookies(cdp: BrowserCdpClient, browserContextId: string): Promise<Array<Record<string, unknown>>>;
+/** Restore a captured jar into a (fresh) BrowserContext. */
+export declare function setContextCookies(cdp: BrowserCdpClient, browserContextId: string, cookies: Array<Record<string, unknown>>): Promise<void>;
+/**
+ * Map a CDP `Network.Cookie` (as returned by Storage.getCookies) to a
+ * `Network.CookieParam` accepted by Storage.setCookies. Allowlisted fields only:
+ * read-side extras (`size`, `session`, `sameParty`, …) are not valid params. A
+ * session cookie (session=true / expires=-1) is restored WITHOUT `expires`,
+ * which is exactly what makes it a session cookie again. This is
+ * higher-fidelity than bb-browser's own account-JSON persistence (which drops
+ * `sameSite=None` and partition keys).
+ */
+export declare function toCookieParam(cookie: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=browser-cdp.d.ts.map

package/dist/clip-runtime/browser-cdp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-cdp.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/browser-cdp.ts"],"names":[],"mappings":"AAyCA,qBAAa,gBAAgB;IAKP,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJ3C,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,OAAO,CAAC,MAAM,CAAS;IAEvB,OAAO;IAOP;;;;;OAKG;WACU,OAAO,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,SAAqB,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IAgD5B,6DAA6D;IAC7D,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IA0B5E,KAAK,IAAI,IAAI;IAUb,OAAO,CAAC,SAAS;IAmBjB,OAAO,CAAC,OAAO;CAOhB;AAED,iFAAiF;AACjF,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,gBAAgB,EACrB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAMzC;AAED,4DAA4D;AAC5D,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,gBAAgB,EACrB,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBtF"}