@parall/daemon 1.46.0 → 1.48.0

package/bundle/parall-daemon.js

@@ -324,10 +324,17 @@ var init_constants = __esm({
       CHANNEL_CONVERSATION_SESSION: (orgId, conversationId) => `${API_BASE}/orgs/${orgId}/channel-conversations/${conversationId}/session`,
       CHANNEL_MESSAGE: (orgId, messageId) => `${API_BASE}/orgs/${orgId}/channel-messages/${messageId}`,
       CHANNEL_PROVISIONING: (orgId) => `${API_BASE}/orgs/${orgId}/channel-provisioning`,
+      CHANNEL_SLACK_MANIFEST_LINK: (orgId) => `${API_BASE}/orgs/${orgId}/channel-provisioning/slack/manifest-link`,
       CHANNEL_PROVISIONING_SESSION: (orgId, sessionId) => `${API_BASE}/orgs/${orgId}/channel-provisioning/${sessionId}`,
       CHANNEL_PROVISIONING_CANCEL: (orgId, sessionId) => `${API_BASE}/orgs/${orgId}/channel-provisioning/${sessionId}/cancel`,
       // Tier-B platform verb (agent-only): send one message as the bound bot.
       CHANNEL_SEND: (orgId) => `${API_BASE}/orgs/${orgId}/agents/me/channel-send`,
+      // Tier-B read verbs (agent-only): workspace visibility as the bot sees it.
+      SLACK_CHANNELS: (orgId) => `${API_BASE}/orgs/${orgId}/agents/me/slack/channels`,
+      SLACK_USERS: (orgId) => `${API_BASE}/orgs/${orgId}/agents/me/slack/users`,
+      SLACK_HISTORY: (orgId) => `${API_BASE}/orgs/${orgId}/agents/me/slack/history`,
+      SLACK_MEMBERS: (orgId) => `${API_BASE}/orgs/${orgId}/agents/me/slack/members`,
+      SLACK_STATUS: (orgId) => `${API_BASE}/orgs/${orgId}/agents/me/slack/status`,
       // Invitations (org-scoped, admin)
       ORG_INVITATIONS: (orgId) => `${API_BASE}/orgs/${orgId}/invitations`,
       ORG_INVITATION: (orgId, invId) => `${API_BASE}/orgs/${orgId}/invitations/${invId}`,
@@ -422,6 +429,7 @@ var init_constants = __esm({
       ORG_UNREAD: (orgId) => `${API_BASE}/orgs/${orgId}/unread`,
       CHAT_READ: (orgId, chatId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/read`,
       THREAD_UNREAD: (orgId, chatId, threadRootId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/threads/${threadRootId}/unread`,
+      THREAD_READ: (orgId, chatId, threadRootId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/threads/${threadRootId}/read`,
       // References (org-scoped)
       REFS_RESOLVE: (orgId) => `${API_BASE}/orgs/${orgId}/refs/resolve`,
       REFS_BACKLINKS: (orgId) => `${API_BASE}/orgs/${orgId}/refs/backlinks`,
@@ -483,10 +491,17 @@ var init_constants = __esm({
       ORG_EDGE: (orgId) => `/api/v1/orgs/${orgId}/edge`,
       ORG_EDGE_DEVICES: (orgId) => `/api/v1/orgs/${orgId}/edge/devices`,
       ORG_EDGE_DEVICE: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}`,
+      ORG_EDGE_DEVICE_UNREGISTER: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/unregister`,
       ORG_EDGE_ONBOARDING: (orgId) => `/api/v1/orgs/${orgId}/edge/onboarding`,
       ORG_EDGE_PROFILES: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
+      ORG_EDGE_EXEC: (orgId) => `/api/v1/orgs/${orgId}/edge/exec`,
       CLIP_CONNECTIONS: (orgId, clipId) => `/api/v1/orgs/${orgId}/clip-registry/${clipId}/connections`,
-      CLIP_CONNECTION: (orgId, connId) => `/api/v1/orgs/${orgId}/clip-connections/${connId}`
+      CLIP_CONNECTION: (orgId, connId) => `/api/v1/orgs/${orgId}/clip-connections/${connId}`,
+      // Clip registry (v3, org-scoped, served by api-server — `crg_` entries; the
+      // Pinix Hub catalog proxy above is a different, id-less surface)
+      ORG_CLIP_REGISTRY: (orgId) => `/api/v1/orgs/${orgId}/clip-registry`,
+      ORG_CLIP_INSTALL: (orgId) => `/api/v1/orgs/${orgId}/clips/install`,
+      ORG_CLIPS_INSTALLED: (orgId) => `/api/v1/orgs/${orgId}/clips/installed`
     };
     WS_EVENTS = {
       // Client -> Server
@@ -656,7 +671,7 @@ var init_client = __esm({
         return apiError;
       }
       /** Build headers common to all requests (auth, swimlane). */
-      buildHeaders(path22, extra) {
+      buildHeaders(path23, extra) {
         const headers = {
           "Content-Type": "application/json",
           ...extra
@@ -667,7 +682,7 @@ var init_client = __esm({
         if (this.swimlaneName) {
           headers["X-Prll-Swimlane"] = this.swimlaneName;
         }
-        if (path22.startsWith(API_BASE)) {
+        if (path23.startsWith(API_BASE)) {
           const overrides = this.getFeatureFlagOverrides?.();
           if (overrides)
             headers["X-Prll-FF-Override"] = overrides;
@@ -690,8 +705,8 @@ var init_client = __esm({
        * is authoritative, so wiki vs api routing can't drift from how a caller
        * happens to invoke the client.
        */
-      baseUrlFor(path22) {
-        return path22.startsWith(WIKI_BASE) ? this.wikiBaseUrl : this.baseUrl;
+      baseUrlFor(path23) {
+        return path23.startsWith(WIKI_BASE) ? this.wikiBaseUrl : this.baseUrl;
       }
       setToken(token) {
         this.token = token;
@@ -718,10 +733,10 @@ var init_client = __esm({
        * REFRESH_THRESHOLD_S, refresh it **before** sending the request.
        * No-op when the token is still fresh, missing, or un-parseable.
        */
-      async ensureFreshToken(path22) {
+      async ensureFreshToken(path23) {
         if (!this.token || !this.getRefreshToken)
           return;
-        const pathSuffix = path22.replace(/^\/api\/v1/, "");
+        const pathSuffix = path23.replace(/^\/api\/v1/, "");
         if (_ParallClient.AUTH_PATHS.has(pathSuffix))
           return;
         const exp = _ParallClient.decodeJwtExp(this.token);
@@ -753,11 +768,11 @@ var init_client = __esm({
           this.refreshPromise = null;
         }
       }
-      async request(method, path22, body, query, retried = false, opts) {
+      async request(method, path23, body, query, retried = false, opts) {
         if (!retried) {
-          await this.ensureFreshToken(path22);
+          await this.ensureFreshToken(path23);
         }
-        let url = `${this.baseUrlFor(path22)}${path22}`;
+        let url = `${this.baseUrlFor(path23)}${path23}`;
         if (query) {
           const params = new URLSearchParams();
           for (const [key, value] of Object.entries(query)) {
@@ -769,7 +784,7 @@ var init_client = __esm({
           if (qs)
             url += `?${qs}`;
         }
-        const headers = this.buildHeaders(path22);
+        const headers = this.buildHeaders(path23);
         const timeoutSignal = AbortSignal.timeout(opts?.timeoutMs ?? 15e3);
         const signal = opts?.signal ? AbortSignal.any([opts.signal, timeoutSignal]) : timeoutSignal;
         let res;
@@ -787,12 +802,12 @@ var init_client = __esm({
           throw _ParallClient.normalizeFetchError(err);
         }
         if (res.status === 401) {
-          const pathSuffix = path22.replace(/^\/api\/v1/, "");
+          const pathSuffix = path23.replace(/^\/api\/v1/, "");
           const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
           if (!retried && !isAuthPath && this.getRefreshToken) {
             const refreshed = await this.tryRefresh();
             if (refreshed) {
-              return this.request(method, path22, body, query, true, opts);
+              return this.request(method, path23, body, query, true, opts);
             }
           }
           if (this.onTokenExpired && !isAuthPath) {
@@ -822,15 +837,15 @@ var init_client = __esm({
        * hit the 100 MiB cap, so a longer 5-minute timeout is used so a
        * 50 MiB blob on a slow connection doesn't get chopped at 15 s.
        */
-      async multipartRequest(method, path22, body, retried = false) {
+      async multipartRequest(method, path23, body, retried = false) {
         if (!retried) {
-          await this.ensureFreshToken(path22);
+          await this.ensureFreshToken(path23);
         }
-        const { "Content-Type": _drop, ...headers } = this.buildHeaders(path22);
+        const { "Content-Type": _drop, ...headers } = this.buildHeaders(path23);
         void _drop;
         let res;
         try {
-          res = await fetch(`${this.baseUrlFor(path22)}${path22}`, {
+          res = await fetch(`${this.baseUrlFor(path23)}${path23}`, {
             method,
             headers,
             body,
@@ -840,12 +855,12 @@ var init_client = __esm({
           throw _ParallClient.normalizeFetchError(err);
         }
         if (res.status === 401) {
-          const pathSuffix = path22.replace(/^\/api\/v1/, "");
+          const pathSuffix = path23.replace(/^\/api\/v1/, "");
           const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
           if (!retried && !isAuthPath && this.getRefreshToken) {
             const refreshed = await this.tryRefresh();
             if (refreshed) {
-              return this.multipartRequest(method, path22, body, true);
+              return this.multipartRequest(method, path23, body, true);
             }
           }
           if (this.onTokenExpired && !isAuthPath) {
@@ -1553,12 +1568,18 @@ var init_client = __esm({
       async resizeMachine(orgId, machineId, spec) {
         return this.request("PATCH", ENDPOINTS.MACHINE_SPEC(orgId, machineId), spec);
       }
-      /** Signal a local daemon-mode Machine to check for and apply an update. */
+      /** @deprecated Retired server-side (daemon-control-authorization §4.2):
+       *  daemons update autonomously (CDN poll + platform release signal). The
+       *  endpoint now answers 409 LOCAL_UPDATE_NOT_SUPPORTED unconditionally. */
       async requestMachineUpdate(orgId, machineId, mandatory = false) {
         await this.request("POST", ENDPOINTS.MACHINE_REQUEST_UPDATE(orgId, machineId), { mandatory });
       }
-      async browseMachineFilesystem(orgId, machineId, path22) {
-        return this.request("POST", ENDPOINTS.MACHINE_BROWSE(orgId, machineId), { path: path22 }, void 0, false, { timeoutMs: 15e3 });
+      /** @deprecated Retired server-side (daemon-control-authorization §4.2):
+       *  remote filesystem browse of a member's machine was remote device access.
+       *  The endpoint now answers 409 LOCAL_BROWSE_NOT_SUPPORTED unconditionally;
+       *  workspace paths are typed in (or picked on the machine's own Desktop). */
+      async browseMachineFilesystem(orgId, machineId, path23) {
+        return this.request("POST", ENDPOINTS.MACHINE_BROWSE(orgId, machineId), { path: path23 }, void 0, false, { timeoutMs: 15e3 });
       }
       /** Create a new machine key. Returns the raw key string (shown once) + metadata. */
       async createMachineKey(orgId, machineId, name) {
@@ -1581,6 +1602,14 @@ var init_client = __esm({
       async getThreadUnread(orgId, chatId, threadRootId) {
         return this.request("GET", ENDPOINTS.THREAD_UNREAD(orgId, chatId, threadRootId));
       }
+      /** Advance the per-thread read cursor (forward-only). The server auto-clears
+       *  thread-scoped inbox items (thread_reply + in-thread mentions) the cursor
+       *  now covers. */
+      async markThreadRead(orgId, chatId, threadRootId, messageId) {
+        return this.request("POST", ENDPOINTS.THREAD_READ(orgId, chatId, threadRootId), {
+          message_id: messageId
+        });
+      }
       // ---- Inbox ----
       async getInbox(orgId, params) {
         return this.request("GET", ENDPOINTS.INBOX(orgId), void 0, params);
@@ -1604,9 +1633,12 @@ var init_client = __esm({
       async archiveAllInbox(orgId) {
         return this.request("POST", ENDPOINTS.INBOX_ARCHIVE_ALL(orgId));
       }
-      /** Mark an inbox item as read by its source (source_type + source_id) rather than inbox item ID. */
-      async ackInbox(orgId, source) {
-        return this.request("POST", ENDPOINTS.INBOX_ACK(orgId), source);
+      /** Mark inbox items as read by their source (source_type + source_id) or by
+       *  group_key, rather than by inbox item ID. The group_key form clears a whole
+       *  group at once (e.g. `task:{taskId}` — task_assign/task_update/task_comment
+       *  share it), used by the task detail view's auto-ack on open. */
+      async ackInbox(orgId, target) {
+        return this.request("POST", ENDPOINTS.INBOX_ACK(orgId), target);
       }
       async deleteInboxItem(orgId, id) {
         return this.request("DELETE", ENDPOINTS.INBOX_ITEM(orgId, id));
@@ -1888,6 +1920,15 @@ var init_client = __esm({
       async initiateChannelProvisioning(orgId, input) {
         return this.request("POST", ENDPOINTS.CHANNEL_PROVISIONING(orgId), input);
       }
+      /**
+       * Mint a pending slack connection + api.slack.com manifest-prefill link
+       * (guided manual path). Activate the returned connection_id with
+       * deliverChannelCredentials once the user brings back the bot token +
+       * signing secret.
+       */
+      async createSlackManifestLink(orgId, input) {
+        return this.request("POST", ENDPOINTS.CHANNEL_SLACK_MANIFEST_LINK(orgId), input);
+      }
       /**
        * Lazy status poll — server-side this may forward one provider poll, so
        * call it at the session's `poll_interval_seconds` cadence, not faster.
@@ -1906,6 +1947,38 @@ var init_client = __esm({
       async sendChannelMessage(orgId, input) {
         return this.request("POST", ENDPOINTS.CHANNEL_SEND(orgId), input);
       }
+      slackReadQuery(base, query, extra) {
+        const params = new URLSearchParams();
+        if (query?.cursor)
+          params.set("cursor", query.cursor);
+        if (query?.limit)
+          params.set("limit", String(query.limit));
+        for (const [k, v] of Object.entries(extra ?? {}))
+          params.set(k, v);
+        const qs = params.toString();
+        return qs ? `${base}?${qs}` : base;
+      }
+      /**
+       * Tier-B read verbs (agent-only): workspace visibility as the bot sees
+       * it. Same live gate as the send verb; authorization beyond it is the
+       * bot's own Slack permissions.
+       */
+      async listSlackChannels(orgId, query) {
+        return this.request("GET", this.slackReadQuery(ENDPOINTS.SLACK_CHANNELS(orgId), query));
+      }
+      async listSlackUsers(orgId, query) {
+        return this.request("GET", this.slackReadQuery(ENDPOINTS.SLACK_USERS(orgId), query));
+      }
+      async slackHistory(orgId, conversationId, query) {
+        return this.request("GET", this.slackReadQuery(ENDPOINTS.SLACK_HISTORY(orgId), query, { conversation: conversationId }));
+      }
+      async slackMembers(orgId, conversationId, query) {
+        return this.request("GET", this.slackReadQuery(ENDPOINTS.SLACK_MEMBERS(orgId), query, { conversation: conversationId }));
+      }
+      /** Set/clear the Agents-pane "typing…" indicator (best-effort cosmetic). */
+      async setSlackStatus(orgId, input) {
+        await this.request("POST", ENDPOINTS.SLACK_STATUS(orgId), input);
+      }
       async listChannelConversations(orgId, connectionId) {
         return this.request("GET", ENDPOINTS.CHANNEL_CONNECTION_CONVERSATIONS(orgId, connectionId));
       }
@@ -2141,8 +2214,8 @@ var init_client = __esm({
       async deleteWikiRestriction(orgId, wikiId, restrictionId) {
         await this.request("DELETE", ENDPOINTS.WIKI_RESTRICTION(orgId, wikiId, restrictionId));
       }
-      async getWikiAccessStatus(orgId, wikiId, path22) {
-        return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path22 ? { path: path22 } : void 0);
+      async getWikiAccessStatus(orgId, wikiId, path23) {
+        return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path23 ? { path: path23 } : void 0);
       }
       async createWikiAccessRequest(orgId, wikiId, data) {
         await this.request("POST", ENDPOINTS.WIKI_ACCESS_REQUESTS(orgId, wikiId), data);
@@ -2151,14 +2224,14 @@ var init_client = __esm({
       async getWikiCommits(orgId, wikiId, params) {
         return this.request("GET", ENDPOINTS.WIKI_COMMITS(orgId, wikiId), void 0, params);
       }
-      async getWikiFileCommits(orgId, wikiId, path22, params) {
+      async getWikiFileCommits(orgId, wikiId, path23, params) {
         return this.request("GET", ENDPOINTS.WIKI_FILE_COMMITS(orgId, wikiId), void 0, {
-          path: path22,
+          path: path23,
           ...params
         });
       }
-      async getWikiBlame(orgId, wikiId, path22, ref) {
-        return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path22, ref });
+      async getWikiBlame(orgId, wikiId, path23, ref) {
+        return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path23, ref });
       }
       // ---- Wiki Operations (audit log) ----
       async getWikiOperations(orgId, wikiId, params) {
@@ -2410,6 +2483,31 @@ var init_client = __esm({
         const resp = await this.request("GET", url);
         return resp.data;
       }
+      // ---- Clip registry (v3, api-server org registry — `crg_` entries) ----
+      /**
+       * List registry clips visible to the org: its own plus public+approved
+       * cross-org entries. This is the surface `installRegistryClip` and clip
+       * connections operate on — NOT the Pinix catalog proxy
+       * ({@link listRegistryClips}), whose entries carry no `crg_` id.
+       */
+      async listOrgRegistryClips(orgId) {
+        const resp = await this.request("GET", `${ENDPOINTS.ORG_CLIP_REGISTRY(orgId)}?limit=100`);
+        return resp ?? [];
+      }
+      /**
+       * Install a registry clip into the org (a reference in `clip_installs`, not a
+       * copy). Idempotent: installing an already-installed clip returns the same
+       * `200 {ok:true}`. Fails closed with `403 CLIP_NOT_APPROVED` when the clip is
+       * not eligible (cross-org requires public + approved).
+       */
+      async installRegistryClip(orgId, clipId) {
+        return this.request("POST", ENDPOINTS.ORG_CLIP_INSTALL(orgId), { clip_id: clipId });
+      }
+      /** List the org's installed registry clips (full entries). */
+      async listInstalledRegistryClips(orgId) {
+        const resp = await this.request("GET", ENDPOINTS.ORG_CLIPS_INSTALLED(orgId));
+        return resp ?? [];
+      }
       // ---- Edge devices ----
       async listEdgeDevices(orgId) {
         return this.request("GET", ENDPOINTS.ORG_EDGE_DEVICES(orgId));
@@ -2427,8 +2525,8 @@ var init_client = __esm({
         return this.request("POST", ENDPOINTS.ORG_EDGE(orgId), input);
       }
       /**
-       * Delete a hosted Cloud Profile. Hosted only — a BYOC device is removed by
-       * uninstalling Parall Clip on that machine (`400 EDGE_PLACEMENT_UNSUPPORTED`).
+       * Delete a hosted Cloud Profile. Hosted only — use {@link unregisterEdgeDevice}
+       * for an offline BYOC registration (`400 EDGE_PLACEMENT_UNSUPPORTED` here).
        *
        * Idempotent and ASYNC: returns `202` with `hosted_state: 'deleting'` on the first
        * call and on every repeat. The device stops being usable immediately (no exec, no
@@ -2438,12 +2536,68 @@ var init_client = __esm({
       async deleteEdgeDevice(orgId, edgeId) {
         return this.request("DELETE", ENDPOINTS.ORG_EDGE_DEVICE(orgId, edgeId));
       }
+      /**
+       * Remove the interactive human caller's own offline BYOC registration.
+       *
+       * Synchronous and idempotent: a committed removal and a repeat after removal
+       * both resolve with no response body. A live connection returns `EDGE_ONLINE`;
+       * callers must not clear local device identity until this method resolves.
+       */
+      async unregisterEdgeDevice(orgId, edgeId) {
+        await this.request("DELETE", ENDPOINTS.ORG_EDGE_DEVICE_UNREGISTER(orgId, edgeId));
+      }
       async getEdgeOnboarding(orgId) {
         return this.request("GET", ENDPOINTS.ORG_EDGE_ONBOARDING(orgId));
       }
       async listEdgeProfiles(orgId, edgeId) {
         return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILES(orgId, edgeId));
       }
+      /**
+       * Execute a registry clip command on an Edge device.
+       *
+       * A hosted (Cloud Profile) device is reachable ONLY through an explicit
+       * `connection` (id `ccn_…` or alias) — there is no implicit route to an
+       * org-shared browser login. BYOC keeps its legacy selectors (`edge_id`, or
+       * nothing for the caller's own online device).
+       *
+       * Returns the result envelope on completion (`success` may be false when the
+       * command RAN and failed — `error`/`error_code` describe why). Everything
+       * else throws a typed {@link ApiError}; match on `err.code`:
+       *
+       * Safe to retry (guaranteed nothing was dispatched):
+       * - `EDGE_ACTIVATING` 503 + `Retry-After` — cold cloud profile is starting.
+       *   Bounded backoff, same `correlation_id` across the loop.
+       * - `EDGE_BUSY` 409 — the device is executing another request.
+       * - `EDGE_CONCURRENCY_LIMIT` 429 — org at its concurrent-session limit.
+       * - `EDGE_UNAVAILABLE` 503 — session torn down / replaced mid-dispatch.
+       *
+       * NOT retryable:
+       * - `OUTCOME_UNKNOWN` 504 — dispatched, but no result arrived. The command
+       *   MAY HAVE EXECUTED (posted, ordered, deleted…). Never retry
+       *   automatically: verify the effect first, then decide. The message carries
+       *   the request id for audit.
+       * - `EDGE_DEADLINE_EXCEEDED` 504 — arrived late, provably NOT executed.
+       * - `EDGE_HOSTED_DISABLED_FOR_ORG` 403, `EDGE_REPAIR` 503 (operator-held),
+       *   `EDGE_RUNTIME_UNAVAILABLE` 503 (deployment has no hosted runtime).
+       * - Routing errors: `HOSTED_CONNECTION_REQUIRED`, `CONNECTION_NOT_FOUND`,
+       *   `CONNECTION_CLIP_MISMATCH`, `CONNECTION_TARGET_GONE`,
+       *   `CONNECTION_PROFILE_MISMATCH`, `EDGE_DELETING`, `DEVICE_OFFLINE`.
+       */
+      async execEdgeClip(orgId, req) {
+        const t = req.timeout;
+        const serverTimeout = t !== void 0 && t > 0 && t <= 12e4 ? t : 3e4;
+        const timeoutMs = serverTimeout + 1e4;
+        try {
+          return await this.request("POST", ENDPOINTS.ORG_EDGE_EXEC(orgId), req, void 0, false, {
+            timeoutMs
+          });
+        } catch (err) {
+          if (err instanceof ApiError && err.status === 422 && !err.code && typeof err.extras?.error_code === "string") {
+            err.code = err.extras.error_code;
+          }
+          throw err;
+        }
+      }
       // ---- Clip connections ----
       async listClipConnections(orgId, clipId) {
         return this.request("GET", ENDPOINTS.CLIP_CONNECTIONS(orgId, clipId));
@@ -20619,9 +20773,9 @@ var require_getMachineId_linux = __commonJS({
     var api_1 = (init_esm(), __toCommonJS(esm_exports));
     async function getMachineId() {
       const paths = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
-      for (const path22 of paths) {
+      for (const path23 of paths) {
         try {
-          const result = await fs_1.promises.readFile(path22, { encoding: "utf8" });
+          const result = await fs_1.promises.readFile(path23, { encoding: "utf8" });
           return result.trim();
         } catch (e) {
           api_1.diag.debug(`error reading machine id: ${e}`);
@@ -24024,7 +24178,7 @@ function appendRootPathToUrlIfNeeded(url) {
     return void 0;
   }
 }
-function appendResourcePathToUrl(url, path22) {
+function appendResourcePathToUrl(url, path23) {
   try {
     new URL(url);
   } catch (_a) {
@@ -24034,11 +24188,11 @@ function appendResourcePathToUrl(url, path22) {
   if (!url.endsWith("/")) {
     url = url + "/";
   }
-  url += path22;
+  url += path23;
   try {
     new URL(url);
   } catch (_b) {
-    diag2.warn("Configuration: Provided URL appended with '" + path22 + "' is not a valid URL, using 'undefined' instead of '" + url + "'");
+    diag2.warn("Configuration: Provided URL appended with '" + path23 + "' is not a valid URL, using 'undefined' instead of '" + url + "'");
     return void 0;
   }
   return url;
@@ -30492,7 +30646,7 @@ var require_util2 = __commonJS({
     var { kDestroyed, kBodyUsed, kListeners, kBody } = require_symbols();
     var { IncomingMessage } = __require("node:http");
     var stream = __require("node:stream");
-    var net2 = __require("node:net");
+    var net3 = __require("node:net");
     var { stringify } = __require("node:querystring");
     var { EventEmitter: EE } = __require("node:events");
     var timers = require_timers();
@@ -30604,14 +30758,14 @@ var require_util2 = __commonJS({
         }
         const port = url.port != null ? url.port : url.protocol === "https:" ? 443 : 80;
         let origin = url.origin != null ? url.origin : `${url.protocol || ""}//${url.hostname || ""}:${port}`;
-        let path22 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
+        let path23 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path22 && path22[0] !== "/") {
-          path22 = `/${path22}`;
+        if (path23 && path23[0] !== "/") {
+          path23 = `/${path23}`;
         }
-        return new URL(`${origin}${path22}`);
+        return new URL(`${origin}${path23}`);
       }
       if (!isHttpOrHttpsPrefixed(url.origin || url.protocol)) {
         throw new InvalidArgumentError("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -30641,7 +30795,7 @@ var require_util2 = __commonJS({
       }
       assert(typeof host === "string");
       const servername = getHostname(host);
-      if (net2.isIP(servername)) {
+      if (net3.isIP(servername)) {
         return "";
       }
       return servername;
@@ -31432,9 +31586,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path22, origin }
+            request: { method, path: path23, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path22);
+          debugLog("sending request to %s %s%s", method, origin, path23);
         }
       );
     }
@@ -31452,14 +31606,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path22, origin },
+            request: { method, path: path23, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path22,
+            path23,
             statusCode
           );
         }
@@ -31468,23 +31622,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path22, origin }
+            request: { method, path: path23, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path22);
+          debugLog("trailers received from %s %s%s", method, origin, path23);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path22, origin },
+            request: { method, path: path23, origin },
             error
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path22,
+            path23,
             error.message
           );
         }
@@ -31587,7 +31741,7 @@ var require_request = __commonJS({
     var kHandler = Symbol("handler");
     var Request = class {
       constructor(origin, {
-        path: path22,
+        path: path23,
         method,
         body,
         headers,
@@ -31604,11 +31758,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path22 !== "string") {
+        if (typeof path23 !== "string") {
           throw new InvalidArgumentError("path must be a string");
-        } else if (path22[0] !== "/" && !(path22.startsWith("http://") || path22.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path23[0] !== "/" && !(path23.startsWith("http://") || path23.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path22)) {
+        } else if (invalidPathRegex.test(path23)) {
           throw new InvalidArgumentError("invalid request path");
         }
         if (typeof method !== "string") {
@@ -31683,7 +31837,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path22, query) : path22;
+        this.path = query ? serializePathWithQuery(path23, query) : path23;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -32262,7 +32416,7 @@ var require_dispatcher_base = __commonJS({
 var require_connect = __commonJS({
   "ts/node_modules/.pnpm/undici@7.24.8/node_modules/undici/lib/core/connect.js"(exports2, module2) {
     "use strict";
-    var net2 = __require("node:net");
+    var net3 = __require("node:net");
     var assert = __require("node:assert");
     var util = require_util2();
     var { InvalidArgumentError } = require_errors();
@@ -32301,7 +32455,7 @@ var require_connect = __commonJS({
       const sessionCache = new SessionCache(maxCachedSessions == null ? 100 : maxCachedSessions);
       timeout = timeout == null ? 1e4 : timeout;
       allowH2 = allowH2 != null ? allowH2 : false;
-      return function connect3({ hostname, host, protocol, port, servername, localAddress, httpSocket }, callback) {
+      return function connect4({ hostname, host, protocol, port, servername, localAddress, httpSocket }, callback) {
         let socket;
         if (protocol === "https:") {
           if (!tls) {
@@ -32331,7 +32485,7 @@ var require_connect = __commonJS({
         } else {
           assert(!httpSocket, "httpSocket can only be sent on TLS update");
           port = port || 80;
-          socket = net2.connect({
+          socket = net3.connect({
             highWaterMark: 64 * 1024,
             // Same as nodejs fs streams.
             ...options,
@@ -36722,7 +36876,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request3) {
-      const { method, path: path22, host, upgrade, blocking, reset } = request3;
+      const { method, path: path23, host, upgrade, blocking, reset } = request3;
       let { body, headers, contentLength } = request3;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -36791,7 +36945,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request3.typeOfService);
       }
-      let header = `${method} ${path22} HTTP/1.1\r
+      let header = `${method} ${path23} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -37444,7 +37598,7 @@ var require_client_h2 = __commonJS({
     function writeH2(client, request3) {
       const requestTimeout = request3.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path22, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request3;
+      const { method, path: path23, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request3;
       let { body } = request3;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request3, new InvalidArgumentError(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -37512,7 +37666,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path22;
+          headers[HTTP2_HEADER_PATH] = path23;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -37553,7 +37707,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(requestTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path22;
+      headers[HTTP2_HEADER_PATH] = path23;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -37869,7 +38023,7 @@ var require_client = __commonJS({
   "ts/node_modules/.pnpm/undici@7.24.8/node_modules/undici/lib/dispatcher/client.js"(exports2, module2) {
     "use strict";
     var assert = __require("node:assert");
-    var net2 = __require("node:net");
+    var net3 = __require("node:net");
     var http3 = __require("node:http");
     var util = require_util2();
     var { ClientStats } = require_stats();
@@ -37960,7 +38114,7 @@ var require_client = __commonJS({
         tls,
         strictContentLength,
         maxCachedSessions,
-        connect: connect4,
+        connect: connect5,
         maxRequestsPerClient,
         localAddress,
         maxResponseSize,
@@ -38017,13 +38171,13 @@ var require_client = __commonJS({
         if (bodyTimeout != null && (!Number.isInteger(bodyTimeout) || bodyTimeout < 0)) {
           throw new InvalidArgumentError("bodyTimeout must be a positive integer or zero");
         }
-        if (connect4 != null && typeof connect4 !== "function" && typeof connect4 !== "object") {
+        if (connect5 != null && typeof connect5 !== "function" && typeof connect5 !== "object") {
           throw new InvalidArgumentError("connect must be a function or an object");
         }
         if (maxRequestsPerClient != null && (!Number.isInteger(maxRequestsPerClient) || maxRequestsPerClient < 0)) {
           throw new InvalidArgumentError("maxRequestsPerClient must be a positive number");
         }
-        if (localAddress != null && (typeof localAddress !== "string" || net2.isIP(localAddress) === 0)) {
+        if (localAddress != null && (typeof localAddress !== "string" || net3.isIP(localAddress) === 0)) {
           throw new InvalidArgumentError("localAddress must be valid string IP address");
         }
         if (maxResponseSize != null && (!Number.isInteger(maxResponseSize) || maxResponseSize < -1)) {
@@ -38051,8 +38205,8 @@ var require_client = __commonJS({
           throw new InvalidArgumentError("pingInterval must be a positive integer, greater or equal to 0");
         }
         super();
-        if (typeof connect4 !== "function") {
-          connect4 = buildConnector({
+        if (typeof connect5 !== "function") {
+          connect5 = buildConnector({
             ...tls,
             maxCachedSessions,
             allowH2,
@@ -38060,14 +38214,14 @@ var require_client = __commonJS({
             socketPath,
             timeout: connectTimeout,
             ...typeof autoSelectFamily === "boolean" ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : void 0,
-            ...connect4
+            ...connect5
           });
         } else if (socketPath != null) {
-          const customConnect = connect4;
-          connect4 = (opts, callback) => customConnect({ ...opts, socketPath }, callback);
+          const customConnect = connect5;
+          connect5 = (opts, callback) => customConnect({ ...opts, socketPath }, callback);
         }
         this[kUrl] = util.parseOrigin(url);
-        this[kConnector] = connect4;
+        this[kConnector] = connect5;
         this[kPipelining] = pipelining != null ? pipelining : 1;
         this[kMaxHeadersSize] = maxHeaderSize;
         this[kKeepAliveDefaultTimeout] = keepAliveTimeout == null ? 4e3 : keepAliveTimeout;
@@ -38125,7 +38279,7 @@ var require_client = __commonJS({
         );
       }
       [kConnect](cb) {
-        connect3(this);
+        connect4(this);
         this.once("connect", cb);
       }
       [kDispatch](opts, handler) {
@@ -38187,7 +38341,7 @@ var require_client = __commonJS({
         assert(client[kSize] === 0);
       }
     }
-    function connect3(client) {
+    function connect4(client) {
       assert(!client[kConnecting]);
       assert(!client[kHTTPContext]);
       let { host, hostname, protocol, port } = client[kUrl];
@@ -38195,7 +38349,7 @@ var require_client = __commonJS({
         const idx = hostname.indexOf("]");
         assert(idx !== -1);
         const ip = hostname.substring(1, idx);
-        assert(net2.isIPv6(ip));
+        assert(net3.isIPv6(ip));
         hostname = ip;
       }
       client[kConnecting] = true;
@@ -38366,7 +38520,7 @@ var require_client = __commonJS({
           return;
         }
         if (!client[kHTTPContext]) {
-          connect3(client);
+          connect4(client);
           return;
         }
         if (client[kHTTPContext].destroyed) {
@@ -38662,7 +38816,7 @@ var require_pool2 = __commonJS({
       constructor(origin, {
         connections,
         factory = defaultFactory,
-        connect: connect3,
+        connect: connect4,
         connectTimeout,
         tls,
         maxCachedSessions,
@@ -38679,24 +38833,24 @@ var require_pool2 = __commonJS({
         if (typeof factory !== "function") {
           throw new InvalidArgumentError("factory must be a function.");
         }
-        if (connect3 != null && typeof connect3 !== "function" && typeof connect3 !== "object") {
+        if (connect4 != null && typeof connect4 !== "function" && typeof connect4 !== "object") {
           throw new InvalidArgumentError("connect must be a function or an object");
         }
-        if (typeof connect3 !== "function") {
-          connect3 = buildConnector({
+        if (typeof connect4 !== "function") {
+          connect4 = buildConnector({
             ...tls,
             maxCachedSessions,
             allowH2,
             socketPath,
             timeout: connectTimeout,
             ...typeof autoSelectFamily === "boolean" ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : void 0,
-            ...connect3
+            ...connect4
           });
         }
         super();
         this[kConnections] = connections || null;
         this[kUrl] = util.parseOrigin(origin);
-        this[kOptions] = { ...util.deepClone(options), connect: connect3, allowH2, clientTtl, socketPath };
+        this[kOptions] = { ...util.deepClone(options), connect: connect4, allowH2, clientTtl, socketPath };
         this[kOptions].interceptors = options.interceptors ? { ...options.interceptors } : void 0;
         this[kFactory] = factory;
         this.on("connect", (origin2, targets) => {
@@ -38913,7 +39067,7 @@ var require_round_robin_pool = __commonJS({
       constructor(origin, {
         connections,
         factory = defaultFactory,
-        connect: connect3,
+        connect: connect4,
         connectTimeout,
         tls,
         maxCachedSessions,
@@ -38930,24 +39084,24 @@ var require_round_robin_pool = __commonJS({
         if (typeof factory !== "function") {
           throw new InvalidArgumentError("factory must be a function.");
         }
-        if (connect3 != null && typeof connect3 !== "function" && typeof connect3 !== "object") {
+        if (connect4 != null && typeof connect4 !== "function" && typeof connect4 !== "object") {
           throw new InvalidArgumentError("connect must be a function or an object");
         }
-        if (typeof connect3 !== "function") {
-          connect3 = buildConnector({
+        if (typeof connect4 !== "function") {
+          connect4 = buildConnector({
             ...tls,
             maxCachedSessions,
             allowH2,
             socketPath,
             timeout: connectTimeout,
             ...typeof autoSelectFamily === "boolean" ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : void 0,
-            ...connect3
+            ...connect4
           });
         }
         super();
         this[kConnections] = connections || null;
         this[kUrl] = util.parseOrigin(origin);
-        this[kOptions] = { ...util.deepClone(options), connect: connect3, allowH2, clientTtl, socketPath };
+        this[kOptions] = { ...util.deepClone(options), connect: connect4, allowH2, clientTtl, socketPath };
         this[kOptions].interceptors = options.interceptors ? { ...options.interceptors } : void 0;
         this[kFactory] = factory;
         this[kIndex] = -1;
@@ -39021,21 +39175,21 @@ var require_agent = __commonJS({
       return opts && opts.connections === 1 ? new Client(origin, opts) : new Pool(origin, opts);
     }
     var Agent4 = class extends DispatcherBase {
-      constructor({ factory = defaultFactory, maxOrigins = Infinity, connect: connect3, ...options } = {}) {
+      constructor({ factory = defaultFactory, maxOrigins = Infinity, connect: connect4, ...options } = {}) {
         if (typeof factory !== "function") {
           throw new InvalidArgumentError("factory must be a function.");
         }
-        if (connect3 != null && typeof connect3 !== "function" && typeof connect3 !== "object") {
+        if (connect4 != null && typeof connect4 !== "function" && typeof connect4 !== "object") {
           throw new InvalidArgumentError("connect must be a function or an object");
         }
         if (typeof maxOrigins !== "number" || Number.isNaN(maxOrigins) || maxOrigins <= 0) {
           throw new InvalidArgumentError("maxOrigins must be a number greater than 0");
         }
         super();
-        if (connect3 && typeof connect3 !== "function") {
-          connect3 = { ...connect3 };
+        if (connect4 && typeof connect4 !== "function") {
+          connect4 = { ...connect4 };
         }
-        this[kOptions] = { ...util.deepClone(options), maxOrigins, connect: connect3 };
+        this[kOptions] = { ...util.deepClone(options), maxOrigins, connect: connect4 };
         this[kFactory] = factory;
         this[kClients] = /* @__PURE__ */ new Map();
         this[kOrigins] = /* @__PURE__ */ new Set();
@@ -39138,10 +39292,10 @@ var require_socks5_utils = __commonJS({
   "ts/node_modules/.pnpm/undici@7.24.8/node_modules/undici/lib/core/socks5-utils.js"(exports2, module2) {
     "use strict";
     var { Buffer: Buffer2 } = __require("node:buffer");
-    var net2 = __require("node:net");
+    var net3 = __require("node:net");
     var { InvalidArgumentError } = require_errors();
     function parseAddress(address) {
-      if (net2.isIPv4(address)) {
+      if (net3.isIPv4(address)) {
         const parts = address.split(".").map(Number);
         return {
           type: 1,
@@ -39149,7 +39303,7 @@ var require_socks5_utils = __commonJS({
           buffer: Buffer2.from(parts)
         };
       }
-      if (net2.isIPv6(address)) {
+      if (net3.isIPv6(address)) {
         return {
           type: 4,
           // IPv6
@@ -39609,7 +39763,7 @@ var require_socks5_client = __commonJS({
 var require_socks5_proxy_agent = __commonJS({
   "ts/node_modules/.pnpm/undici@7.24.8/node_modules/undici/lib/dispatcher/socks5-proxy-agent.js"(exports2, module2) {
     "use strict";
-    var net2 = __require("node:net");
+    var net3 = __require("node:net");
     var { URL: URL2 } = __require("node:url");
     var tls;
     var DispatcherBase = require_dispatcher_base();
@@ -39671,7 +39825,7 @@ var require_socks5_proxy_agent = __commonJS({
             socket2.removeListener("connect", onConnect);
             reject(err);
           };
-          const socket2 = net2.connect({
+          const socket2 = net3.connect({
             host: proxyHost,
             port: proxyPort
           });
@@ -39830,16 +39984,16 @@ var require_proxy_agent = __commonJS({
     }
     var Http1ProxyWrapper = class extends DispatcherBase {
       #client;
-      constructor(proxyUrl, { headers = {}, connect: connect3, factory }) {
+      constructor(proxyUrl, { headers = {}, connect: connect4, factory }) {
         if (!proxyUrl) {
           throw new InvalidArgumentError("Proxy URL is mandatory");
         }
         super();
         this[kProxyHeaders] = headers;
         if (factory) {
-          this.#client = factory(proxyUrl, { connect: connect3 });
+          this.#client = factory(proxyUrl, { connect: connect4 });
         } else {
-          this.#client = new Client(proxyUrl, { connect: connect3 });
+          this.#client = new Client(proxyUrl, { connect: connect4 });
         }
       }
       [kDispatch](opts, handler) {
@@ -39855,10 +40009,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path22 = "/",
+          path: path23 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path22;
+        opts.path = origin + path23;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -39900,7 +40054,7 @@ var require_proxy_agent = __commonJS({
         } else if (username && password) {
           this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString("base64")}`;
         }
-        const connect3 = buildConnector({ ...opts.proxyTls });
+        const connect4 = buildConnector({ ...opts.proxyTls });
         this[kConnectEndpoint] = buildConnector({ ...opts.requestTls });
         const agentFactory = opts.factory || defaultAgentFactory;
         const factory = (origin2, options) => {
@@ -39908,7 +40062,7 @@ var require_proxy_agent = __commonJS({
           if (this[kProxy].protocol === "socks5:" || this[kProxy].protocol === "socks:") {
             return new Socks5ProxyAgent(this[kProxy].uri, {
               headers: this[kProxyHeaders],
-              connect: connect3,
+              connect: connect4,
               factory: agentFactory,
               username: opts.username || username,
               password: opts.password || password,
@@ -39918,7 +40072,7 @@ var require_proxy_agent = __commonJS({
           if (!this[kTunnelProxy] && protocol2 === "http:" && this[kProxy].protocol === "http:") {
             return new Http1ProxyWrapper(this[kProxy].uri, {
               headers: this[kProxyHeaders],
-              connect: connect3,
+              connect: connect4,
               factory: agentFactory
             });
           }
@@ -39927,7 +40081,7 @@ var require_proxy_agent = __commonJS({
         if (protocol === "socks5:" || protocol === "socks:") {
           this[kClient] = null;
         } else {
-          this[kClient] = clientFactory(url, { connect: connect3 });
+          this[kClient] = clientFactory(url, { connect: connect4 });
         }
         this[kAgent] = new Agent4({
           ...opts,
@@ -40533,7 +40687,7 @@ var require_h2c_client = __commonJS({
             "h2c-client: Only h2c protocol is supported"
           );
         }
-        const { connect: connect3, maxConcurrentStreams, pipelining, ...opts } = clientOpts ?? {};
+        const { connect: connect4, maxConcurrentStreams, pipelining, ...opts } = clientOpts ?? {};
         let defaultMaxConcurrentStreams = 100;
         let defaultPipelining = 100;
         if (maxConcurrentStreams != null && Number.isInteger(maxConcurrentStreams) && maxConcurrentStreams > 0) {
@@ -41715,10 +41869,10 @@ var require_api_connect = __commonJS({
         }
       }
     };
-    function connect3(opts, callback) {
+    function connect4(opts, callback) {
       if (callback === void 0) {
         return new Promise((resolve9, reject) => {
-          connect3.call(this, opts, (err, data) => {
+          connect4.call(this, opts, (err, data) => {
             return err ? reject(err) : resolve9(data);
           });
         });
@@ -41735,7 +41889,7 @@ var require_api_connect = __commonJS({
         queueMicrotask(() => callback(err, { opaque }));
       }
     }
-    module2.exports = connect3;
+    module2.exports = connect4;
   }
 });
 
@@ -41921,20 +42075,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path22) {
-      if (typeof path22 !== "string") {
-        return path22;
+    function safeUrl(path23) {
+      if (typeof path23 !== "string") {
+        return path23;
       }
-      const pathSegments = path22.split("?", 3);
+      const pathSegments = path23.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path22;
+        return path23;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path22, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path22);
+    function matchKey(mockDispatch2, { path: path23, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path23);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -41959,8 +42113,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path22, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path22)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path22), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path23, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path23)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path23), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -41999,19 +42153,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path22) {
-      while (path22.endsWith("/")) {
-        path22 = path22.slice(0, -1);
+    function removeTrailingSlash(path23) {
+      while (path23.endsWith("/")) {
+        path23 = path23.slice(0, -1);
       }
-      if (path22.length === 0) {
-        path22 = "/";
+      if (path23.length === 0) {
+        path23 = "/";
       }
-      return path22;
+      return path23;
     }
     function buildKey(opts) {
-      const { path: path22, method, body, headers, query } = opts;
+      const { path: path23, method, body, headers, query } = opts;
       return {
-        path: path22,
+        path: path23,
         method,
         body,
         headers,
@@ -42701,10 +42855,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path22, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path23, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path22,
+            Path: path23,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -42786,9 +42940,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path22, searchParams] = dispatchOpts.path.split("?");
+          const [path23, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path22}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path23}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -42993,7 +43147,7 @@ var require_snapshot_recorder = __commonJS({
   "ts/node_modules/.pnpm/undici@7.24.8/node_modules/undici/lib/mock/snapshot-recorder.js"(exports2, module2) {
     "use strict";
     var { writeFile, readFile, mkdir } = __require("node:fs/promises");
-    var { dirname: dirname12, resolve: resolve9 } = __require("node:path");
+    var { dirname: dirname13, resolve: resolve9 } = __require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -43189,12 +43343,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path22 = filePath || this.#snapshotPath;
-        if (!path22) {
+        const path23 = filePath || this.#snapshotPath;
+        if (!path23) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve9(path22), "utf8");
+          const data = await readFile(resolve9(path23), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -43208,7 +43362,7 @@ var require_snapshot_recorder = __commonJS({
           if (error.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path22}`, { cause: error });
+            throw new UndiciError(`Failed to load snapshots from ${path23}`, { cause: error });
           }
         }
       }
@@ -43219,12 +43373,12 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path22 = filePath || this.#snapshotPath;
-        if (!path22) {
+        const path23 = filePath || this.#snapshotPath;
+        if (!path23) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
-        const resolvedPath = resolve9(path22);
-        await mkdir(dirname12(resolvedPath), { recursive: true });
+        const resolvedPath = resolve9(path23);
+        await mkdir(dirname13(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
           snapshot
@@ -43848,15 +44002,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path22 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path22}`;
+        const path23 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path23}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path22;
+        this.opts.path = path23;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -50063,11 +50217,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url = requestCurrentURL(request3);
         const agent = fetchParams.controller.dispatcher;
-        const path22 = url.pathname + url.search;
+        const path23 = url.pathname + url.search;
         const hasTrailingQuestionMark = url.search.length === 0 && url.href[url.href.length - url.hash.length - 1] === "?";
         return new Promise((resolve9, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path22}?` : path22,
+            path: hasTrailingQuestionMark ? `${path23}?` : path23,
             origin: url.origin,
             method: request3.method,
             body: agent.isMockActive ? request3.body && (request3.body.source || request3.body.stream) : body,
@@ -51014,9 +51168,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path22) {
-      for (let i = 0; i < path22.length; ++i) {
-        const code = path22.charCodeAt(i);
+    function validateCookiePath(path23) {
+      for (let i = 0; i < path23.length; ++i) {
+        const code = path23.charCodeAt(i);
         if (code < 32 || // exclude CTLs (0-31)
         code === 127 || // DEL
         code === 59) {
@@ -54186,11 +54340,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError("invalid opts.path");
           }
-          let path22 = opts.path;
+          let path23 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path22 = `/${path22}`;
+            path23 = `/${path23}`;
           }
-          url = new URL(util.parseOrigin(url).origin + path22);
+          url = new URL(util.parseOrigin(url).origin + path23);
         } else {
           if (!opts) {
             opts = typeof url === "object" ? url : {};
@@ -58161,7 +58315,7 @@ var require_websocket2 = __commonJS({
     var EventEmitter = __require("events");
     var https3 = __require("https");
     var http3 = __require("http");
-    var net2 = __require("net");
+    var net3 = __require("net");
     var tls = __require("tls");
     var { randomBytes: randomBytes2, createHash: createHash5 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
@@ -58895,12 +59049,12 @@ var require_websocket2 = __commonJS({
     }
     function netConnect(options) {
       options.path = options.socketPath;
-      return net2.connect(options);
+      return net3.connect(options);
     }
     function tlsConnect(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
-        options.servername = net2.isIP(options.host) ? "" : options.host;
+        options.servername = net3.isIP(options.host) ? "" : options.host;
       }
       return tls.connect(options);
     }
@@ -64914,9 +65068,280 @@ var init_filesystem = __esm({
   }
 });
 
+// ts/daemon/dist/local-control.js
+import { chmodSync as chmodSync2, existsSync as existsSync10, mkdirSync as mkdirSync8, rmSync as rmSync4, statSync } from "node:fs";
+import * as net2 from "node:net";
+import * as path17 from "node:path";
+function localControlSocketPath(env = process.env) {
+  return path17.join(daemonConfigDir(env), "run", "control.sock");
+}
+function isSocketLive(sockPath) {
+  return new Promise((resolve9) => {
+    const probe = net2.connect(sockPath);
+    const done = (live) => {
+      probe.removeAllListeners();
+      probe.destroy();
+      clearTimeout(timer);
+      resolve9(live);
+    };
+    const timer = setTimeout(() => done(true), 1e3);
+    probe.once("connect", () => done(true));
+    probe.once("error", (err) => {
+      done(!(err.code === "ECONNREFUSED" || err.code === "ENOENT"));
+    });
+  });
+}
+var LocalControlError, MAX_LINE_BYTES, LocalControlServer;
+var init_local_control = __esm({
+  "ts/daemon/dist/local-control.js"() {
+    "use strict";
+    init_daemon_paths();
+    LocalControlError = class extends Error {
+      code;
+      constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "LocalControlError";
+      }
+    };
+    MAX_LINE_BYTES = 16 * 1024;
+    LocalControlServer = class {
+      opts;
+      server = null;
+      sockets = /* @__PURE__ */ new Set();
+      constructor(opts) {
+        this.opts = opts;
+      }
+      async start() {
+        if (this.server)
+          throw new Error("local control server already started");
+        const sockPath = this.opts.socketPath;
+        const dir = path17.dirname(sockPath);
+        mkdirSync8(dir, { recursive: true, mode: 448 });
+        try {
+          chmodSync2(dir, 448);
+        } catch (err) {
+          throw new Error(`could not restrict control socket directory: ${String(err)}`);
+        }
+        if (existsSync10(sockPath)) {
+          let st;
+          try {
+            st = statSync(sockPath);
+          } catch (err) {
+            throw new Error(`could not inspect existing control socket: ${String(err)}`);
+          }
+          if (st.isSocket()) {
+            if (await isSocketLive(sockPath)) {
+              throw new Error(`another process is already serving the local control socket at ${sockPath}`);
+            }
+            rmSync4(sockPath, { force: true });
+          }
+        }
+        const server = net2.createServer((socket) => this.handleConnection(socket));
+        this.server = server;
+        await new Promise((resolve9, reject) => {
+          const onError = (err) => {
+            this.server = null;
+            reject(err);
+          };
+          server.once("error", onError);
+          server.listen(sockPath, () => {
+            server.removeListener("error", onError);
+            try {
+              chmodSync2(sockPath, 384);
+            } catch (err) {
+              server.close();
+              this.server = null;
+              reject(new Error(`could not restrict control socket permissions: ${String(err)}`));
+              return;
+            }
+            resolve9();
+          });
+        });
+        server.on("error", (err) => this.opts.log.warn(`local control server error: ${String(err)}`));
+        this.opts.log.info(`local control socket listening at ${sockPath}`);
+      }
+      async stop() {
+        const server = this.server;
+        if (!server)
+          return;
+        this.server = null;
+        for (const s of this.sockets)
+          s.destroy();
+        this.sockets.clear();
+        await new Promise((resolve9) => server.close(() => resolve9()));
+        try {
+          rmSync4(this.opts.socketPath, { force: true });
+        } catch {
+        }
+      }
+      handleConnection(socket) {
+        this.sockets.add(socket);
+        socket.on("close", () => this.sockets.delete(socket));
+        socket.on("error", () => socket.destroy());
+        socket.setEncoding("utf8");
+        let buffer = "";
+        socket.on("data", (chunk) => {
+          buffer += chunk;
+          if (Buffer.byteLength(buffer) > MAX_LINE_BYTES) {
+            this.reply(socket, void 0, { code: "INVALID_REQUEST", message: "request too large" });
+            socket.end();
+            return;
+          }
+          let newline = buffer.indexOf("\n");
+          while (newline !== -1) {
+            const line = buffer.slice(0, newline).trim();
+            buffer = buffer.slice(newline + 1);
+            if (line)
+              void this.handleLine(socket, line);
+            newline = buffer.indexOf("\n");
+          }
+        });
+      }
+      async handleLine(socket, line) {
+        let req;
+        try {
+          const parsed = JSON.parse(line);
+          if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error("not an object");
+          }
+          req = parsed;
+        } catch {
+          this.reply(socket, void 0, { code: "INVALID_REQUEST", message: "invalid JSON request" });
+          socket.end();
+          return;
+        }
+        const id = typeof req.id === "string" ? req.id : void 0;
+        try {
+          switch (req.command) {
+            case "ping": {
+              const result = await this.opts.handlers.ping();
+              this.reply(socket, id, void 0, result);
+              return;
+            }
+            case "profile.open":
+            case "profile.stop":
+            case "profile.reset": {
+              const action = req.command.slice("profile.".length);
+              const profileId = typeof req.profile_id === "string" ? req.profile_id.trim() : "";
+              const requester = typeof req.requester_user_id === "string" ? req.requester_user_id.trim() : "";
+              if (!profileId || !requester) {
+                throw new LocalControlError("INVALID_REQUEST", "profile_id and requester_user_id are required");
+              }
+              await this.opts.handlers.profileControl(action, profileId, requester);
+              this.reply(socket, id, void 0, { status: "ok" });
+              return;
+            }
+            default:
+              throw new LocalControlError("UNKNOWN_COMMAND", `unknown command ${String(req.command)}`);
+          }
+        } catch (err) {
+          if (err instanceof LocalControlError) {
+            this.reply(socket, id, { code: err.code, message: err.message });
+          } else {
+            this.opts.log.warn(`local control command failed: ${String(err)}`);
+            this.reply(socket, id, {
+              code: "INTERNAL",
+              message: err instanceof Error ? err.message : String(err)
+            });
+          }
+        }
+      }
+      reply(socket, id, error, result) {
+        if (socket.destroyed)
+          return;
+        const payload = { ok: !error };
+        if (id !== void 0)
+          payload.id = id;
+        if (error)
+          payload.error = error;
+        if (result !== void 0)
+          payload.result = result;
+        try {
+          socket.write(`${JSON.stringify(payload)}
+`);
+        } catch {
+          socket.destroy();
+        }
+      }
+    };
+  }
+});
+
+// ts/daemon/dist/local-profile-control.js
+async function startLocalProfileControl(deps) {
+  if (process.env.KUBERNETES_SERVICE_HOST || process.platform === "win32")
+    return null;
+  const server = new LocalControlServer({
+    socketPath: localControlSocketPath(),
+    log: deps.log,
+    handlers: {
+      ping: async () => ({
+        machine_id: deps.machineId(),
+        org_id: deps.orgId(),
+        profile_control: deps.pool() !== null
+      }),
+      profileControl: (action, profileId, requesterUserId) => handleLocalProfileControl(deps, action, profileId, requesterUserId)
+    }
+  });
+  try {
+    await server.start();
+    return server;
+  } catch (err) {
+    deps.log.warn(`local control socket unavailable: ${String(err)}`);
+    return null;
+  }
+}
+async function handleLocalProfileControl(deps, action, profileId, requesterUserId) {
+  const owner = deps.owner();
+  if (!owner || !requesterUserId || requesterUserId !== owner) {
+    throw new LocalControlError("OWNER_MISMATCH", "Only the machine owner can control local browser profiles");
+  }
+  const pool = deps.pool();
+  if (!pool) {
+    throw new LocalControlError("RUNTIME_DISABLED", "Browser profile runtime is disabled on this daemon");
+  }
+  let profiles;
+  try {
+    profiles = await deps.listProfiles();
+  } catch (err) {
+    throw new LocalControlError("SERVER_UNAVAILABLE", `could not verify the profile with the server: ${String(err)}`);
+  }
+  const profile = profiles.find((p) => p.id === profileId && p.machine_id);
+  if (!profile) {
+    throw new LocalControlError("PROFILE_NOT_ON_MACHINE", "Browser profile is not assigned to this machine");
+  }
+  const generation = profile.lifecycle_generation;
+  if (action === "open") {
+    const resetGen = profile.reset_generation ?? 0;
+    const wipeGen = resetGen > pool.appliedResetGeneration(profileId) ? resetGen : null;
+    if (wipeGen !== null)
+      pool.fence(profileId);
+    const sinceSeq = pool.stopSeqOf(profileId);
+    await deps.enqueueRevive(profileId, async () => {
+      if (wipeGen !== null)
+        await deps.wipeBeforeRevive(pool, profileId, wipeGen, generation);
+      await pool.openProfile(profileId, void 0, sinceSeq, generation);
+    });
+    return;
+  }
+  pool.fence(profileId);
+  if (action === "stop") {
+    await deps.enqueueOp(profileId, () => pool.stopProfile(profileId, generation));
+    return;
+  }
+  await deps.enqueueOp(profileId, () => pool.resetProfile(profileId, generation, profile.reset_generation));
+}
+var init_local_profile_control = __esm({
+  "ts/daemon/dist/local-profile-control.js"() {
+    "use strict";
+    init_local_control();
+  }
+});
+
 // ts/daemon/dist/home-isolation.js
 import * as fs10 from "node:fs";
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 function ensureIsolatedHome(spec, agentId, log2, platform2 = process.platform) {
   fs10.mkdirSync(spec.homeDir, { recursive: true });
   const failures = [];
@@ -64928,18 +65353,18 @@ function ensureIsolatedHome(spec, agentId, log2, platform2 = process.platform) {
     }
   };
   attempt(".claude link", () => {
-    fs10.mkdirSync(path17.join(spec.claudeStateRoot, ".claude"), { recursive: true });
-    ensureLink(path17.join(spec.homeDir, ".claude"), path17.join(spec.claudeStateRoot, ".claude"), agentId, log2);
+    fs10.mkdirSync(path18.join(spec.claudeStateRoot, ".claude"), { recursive: true });
+    ensureLink(path18.join(spec.homeDir, ".claude"), path18.join(spec.claudeStateRoot, ".claude"), agentId, log2);
   });
-  attempt(".claude.json link", () => ensureLink(path17.join(spec.homeDir, ".claude.json"), path17.join(spec.claudeStateRoot, ".claude.json"), agentId, log2));
+  attempt(".claude.json link", () => ensureLink(path18.join(spec.homeDir, ".claude.json"), path18.join(spec.claudeStateRoot, ".claude.json"), agentId, log2));
   if (platform2 === "darwin") {
     attempt("Library/Keychains link", () => {
-      fs10.mkdirSync(path17.join(spec.homeDir, "Library"), { recursive: true });
-      ensureLink(path17.join(spec.homeDir, "Library", "Keychains"), path17.join(spec.systemHome, "Library", "Keychains"), agentId, log2);
+      fs10.mkdirSync(path18.join(spec.homeDir, "Library"), { recursive: true });
+      ensureLink(path18.join(spec.homeDir, "Library", "Keychains"), path18.join(spec.systemHome, "Library", "Keychains"), agentId, log2);
     });
   }
   attempt(".gitconfig", () => {
-    const gitconfig = path17.join(spec.homeDir, ".gitconfig");
+    const gitconfig = path18.join(spec.homeDir, ".gitconfig");
     if (!fs10.existsSync(gitconfig)) {
       fs10.writeFileSync(gitconfig, `[user]
 	name = ${gitConfigValue(spec.gitUserName)}
@@ -64965,7 +65390,7 @@ function ensureLink(linkPath, target, agentId, log2) {
   if (existing) {
     if (existing.isSymbolicLink()) {
       const current = fs10.readlinkSync(linkPath);
-      if (path17.resolve(path17.dirname(linkPath), current) === path17.resolve(target))
+      if (path18.resolve(path18.dirname(linkPath), current) === path18.resolve(target))
         return;
       fs10.unlinkSync(linkPath);
       log2.info(`agent ${agentId}: relinking ${linkPath} \u2192 ${target}`);
@@ -64978,16 +65403,16 @@ function ensureLink(linkPath, target, agentId, log2) {
   fs10.symlinkSync(target, linkPath);
 }
 function ensureSharedCredentialLink(rootClaudeHome, agentClaudeHome, agentId, log2) {
-  const sharedCredentials = path17.resolve(sharedClaudeCredentialsFileFor(rootClaudeHome));
+  const sharedCredentials = path18.resolve(sharedClaudeCredentialsFileFor(rootClaudeHome));
   const agentCredentials = agentClaudeCredentialsFileFor(agentClaudeHome);
-  const agentCredentialsDir = path17.dirname(agentCredentials);
-  fs10.mkdirSync(path17.dirname(sharedCredentials), { recursive: true });
+  const agentCredentialsDir = path18.dirname(agentCredentials);
+  fs10.mkdirSync(path18.dirname(sharedCredentials), { recursive: true });
   fs10.mkdirSync(agentCredentialsDir, { recursive: true });
   try {
     const existing = fs10.lstatSync(agentCredentials);
     if (existing.isSymbolicLink()) {
       const currentTarget = fs10.readlinkSync(agentCredentials);
-      if (path17.resolve(agentCredentialsDir, currentTarget) === sharedCredentials) {
+      if (path18.resolve(agentCredentialsDir, currentTarget) === sharedCredentials) {
         return;
       }
       fs10.unlinkSync(agentCredentials);
@@ -65015,7 +65440,7 @@ var init_home_isolation = __esm({
 import { execFileSync as execFileSync4 } from "node:child_process";
 import * as fs11 from "node:fs";
 import * as os6 from "node:os";
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 function runtimeBinaryEnvVar(runtimeType) {
   return RUNTIME_BINARIES[runtimeType]?.envVar;
 }
@@ -65092,16 +65517,16 @@ function resolveRuntimeCommand(command, env, inheritedPath, primaryPath, fallbac
 function resolveDirectPath(command) {
   if (!command.includes("/") && !command.includes("\\"))
     return null;
-  const abs = path18.isAbsolute(command) ? command : path18.resolve(process.cwd(), command);
+  const abs = path19.isAbsolute(command) ? command : path19.resolve(process.cwd(), command);
   return isExecutable(abs) ? abs : null;
 }
 function resolveFromPath(command, pathValue, env, platform2) {
   if (!pathValue || command.includes("/") || command.includes("\\"))
     return null;
-  const dirs = pathValue.split(path18.delimiter).filter(Boolean);
+  const dirs = pathValue.split(path19.delimiter).filter(Boolean);
   for (const dir of dirs) {
     for (const file of commandCandidates(command, env, platform2)) {
-      const candidate = path18.join(dir, file);
+      const candidate = path19.join(dir, file);
       if (isExecutable(candidate))
         return { binaryPath: candidate, pathValue };
     }
@@ -65142,7 +65567,7 @@ __PRLL_PATH__%s
         if (line.startsWith("__PRLL_PATH__"))
           pathValue = line.slice("__PRLL_PATH__".length);
       }
-      if (path18.isAbsolute(binaryPath) && isExecutable(binaryPath)) {
+      if (path19.isAbsolute(binaryPath) && isExecutable(binaryPath)) {
         return { binaryPath, pathValue: pathValue || void 0 };
       }
     } catch {
@@ -65162,18 +65587,18 @@ function cachedCandidatePathPlan(env, platform2) {
 function candidatePathPlan(env, platform2 = process.platform) {
   const home = env.HOME || os6.homedir();
   if (platform2 === "win32") {
-    const appData = env.APPDATA || path18.join(home, "AppData", "Roaming");
-    const localAppData = env.LOCALAPPDATA || path18.join(home, "AppData", "Local");
+    const appData = env.APPDATA || path19.join(home, "AppData", "Roaming");
+    const localAppData = env.LOCALAPPDATA || path19.join(home, "AppData", "Local");
     const winPrimaryDirs = [
       ...splitPath(env.PRLL_DAEMON_RUNTIME_PATH),
       ...splitPath(env.PRLL_DAEMON_EXTRA_PATH),
-      path18.dirname(process.execPath),
+      path19.dirname(process.execPath),
       env.PNPM_HOME,
-      path18.join(appData, "npm"),
-      path18.join(localAppData, "pnpm"),
-      path18.join(localAppData, "Volta", "bin"),
-      path18.join(home, ".volta", "bin"),
-      path18.join(home, ".bun", "bin")
+      path19.join(appData, "npm"),
+      path19.join(localAppData, "pnpm"),
+      path19.join(localAppData, "Volta", "bin"),
+      path19.join(home, ".volta", "bin"),
+      path19.join(home, ".bun", "bin")
     ];
     return {
       primaryDirs: unique(winPrimaryDirs).filter((dir) => !!dir && isDirectory(dir)),
@@ -65183,21 +65608,21 @@ function candidatePathPlan(env, platform2 = process.platform) {
   const primaryDirs = [
     ...splitPath(env.PRLL_DAEMON_RUNTIME_PATH),
     ...splitPath(env.PRLL_DAEMON_EXTRA_PATH),
-    path18.dirname(process.execPath),
-    path18.join(path18.dirname(process.execPath), "bin"),
-    path18.resolve(path18.dirname(process.execPath), "..", "Resources", "bin"),
-    path18.join(home, ".local", "bin"),
-    path18.join(home, "bin"),
-    path18.join(home, ".npm-global", "bin"),
-    path18.join(home, "Library", "pnpm"),
-    path18.join(home, ".local", "share", "pnpm"),
-    path18.join(home, ".volta", "bin"),
-    path18.join(home, ".bun", "bin"),
-    path18.join(home, ".asdf", "shims"),
-    path18.join(home, ".local", "share", "mise", "shims"),
-    path18.join(home, ".mise", "shims"),
-    path18.join(home, ".fnm", "aliases", "default", "bin"),
-    path18.join(home, "Library", "Application Support", "fnm", "aliases", "default", "bin"),
+    path19.dirname(process.execPath),
+    path19.join(path19.dirname(process.execPath), "bin"),
+    path19.resolve(path19.dirname(process.execPath), "..", "Resources", "bin"),
+    path19.join(home, ".local", "bin"),
+    path19.join(home, "bin"),
+    path19.join(home, ".npm-global", "bin"),
+    path19.join(home, "Library", "pnpm"),
+    path19.join(home, ".local", "share", "pnpm"),
+    path19.join(home, ".volta", "bin"),
+    path19.join(home, ".bun", "bin"),
+    path19.join(home, ".asdf", "shims"),
+    path19.join(home, ".local", "share", "mise", "shims"),
+    path19.join(home, ".mise", "shims"),
+    path19.join(home, ".fnm", "aliases", "default", "bin"),
+    path19.join(home, "Library", "Application Support", "fnm", "aliases", "default", "bin"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
     "/usr/bin",
@@ -65216,19 +65641,19 @@ function candidatePathPlan(env, platform2 = process.platform) {
   };
 }
 function nvmVersionBinDirs(home) {
-  const root = path18.join(home, ".nvm", "versions", "node");
+  const root = path19.join(home, ".nvm", "versions", "node");
   let versions;
   try {
     versions = fs11.readdirSync(root);
   } catch {
     return [];
   }
-  return sortVersionNamesDesc(versions).map((version) => path18.join(root, version, "bin"));
+  return sortVersionNamesDesc(versions).map((version) => path19.join(root, version, "bin"));
 }
 function fnmVersionBinDirs(home) {
   const roots = [
-    path18.join(home, ".fnm", "node-versions"),
-    path18.join(home, "Library", "Application Support", "fnm", "node-versions")
+    path19.join(home, ".fnm", "node-versions"),
+    path19.join(home, "Library", "Application Support", "fnm", "node-versions")
   ];
   const dirs = [];
   for (const root of roots) {
@@ -65238,7 +65663,7 @@ function fnmVersionBinDirs(home) {
     } catch {
       continue;
     }
-    dirs.push(...sortVersionNamesDesc(versions).map((version) => path18.join(root, version, "installation", "bin")));
+    dirs.push(...sortVersionNamesDesc(versions).map((version) => path19.join(root, version, "installation", "bin")));
   }
   return dirs;
 }
@@ -65260,13 +65685,13 @@ function parseVersionName(value) {
   return value.replace(/^v/i, "").split(".").map((part) => Number.parseInt(part, 10)).filter((part) => Number.isFinite(part));
 }
 function splitPath(value) {
-  return value?.split(path18.delimiter).filter(Boolean) ?? [];
+  return value?.split(path19.delimiter).filter(Boolean) ?? [];
 }
 function mergePath(prependDirs, existing) {
-  return unique([...prependDirs, ...splitPath(existing)]).join(path18.delimiter);
+  return unique([...prependDirs, ...splitPath(existing)]).join(path19.delimiter);
 }
 function anchorResolvedPath(pathValue, resolution) {
-  return mergePath([path18.dirname(resolution.binaryPath), ...splitPath(resolution.pathValue)], pathValue);
+  return mergePath([path19.dirname(resolution.binaryPath), ...splitPath(resolution.pathValue)], pathValue);
 }
 function commandCandidates(command, env, platform2 = process.platform) {
   if (platform2 !== "win32")
@@ -65421,7 +65846,7 @@ var init_runtime_detector = __esm({
 import { spawn as spawn5 } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import * as fs12 from "node:fs";
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 async function prepareWorkspace(opts) {
   const prior = opts.attached.workspace_state;
   const plan = buildWorkspacePlan(opts.attached.daemon_config, opts.defaultWorkspaceDir, prior?.config_hash);
@@ -65566,8 +65991,8 @@ async function ensureWorkspace(plan, log2) {
       assertSafeCustomWorkspacePath(plan);
     }
     if (!fs12.existsSync(plan.workspaceDir)) {
-      fs12.mkdirSync(path19.dirname(plan.workspaceDir), { recursive: true });
-      assertWritableWorkspaceDir(path19.dirname(plan.workspaceDir));
+      fs12.mkdirSync(path20.dirname(plan.workspaceDir), { recursive: true });
+      assertWritableWorkspaceDir(path20.dirname(plan.workspaceDir));
       await runCommand("git", ["clone", remote, plan.workspaceDir], process.cwd());
     } else {
       const st = fs12.statSync(plan.workspaceDir);
@@ -65749,10 +66174,10 @@ ${tail}`)));
   });
 }
 function requireAbsolute(value, field) {
-  if (!value || !path19.isAbsolute(value)) {
+  if (!value || !path20.isAbsolute(value)) {
     throw new Error(`${field} must be an absolute path`);
   }
-  return path19.resolve(value);
+  return path20.resolve(value);
 }
 function assertSafeCustomWorkspacePath(plan, candidate = plan.workspaceDir) {
   if (!plan.customWorkspaceField)
@@ -65762,14 +66187,14 @@ function assertSafeCustomWorkspacePath(plan, candidate = plan.workspaceDir) {
   if (reason) {
     throw new Error(`${plan.customWorkspaceField} must point to a project folder, not ${reason}: ${normalized}`);
   }
-  const defaultWorkspace = path19.resolve(plan.defaultWorkspaceDir);
+  const defaultWorkspace = path20.resolve(plan.defaultWorkspaceDir);
   if (isAncestorPath(normalized, defaultWorkspace) || normalized === defaultWorkspace) {
     throw new Error(`${plan.customWorkspaceField} must not point at daemon state directories: ${normalized}`);
   }
 }
 function assertWritableWorkspaceDir(dir) {
   fs12.accessSync(dir, fs12.constants.R_OK | fs12.constants.W_OK | fs12.constants.X_OK);
-  const probe = path19.join(dir, `.parall-workspace-check-${process.pid}-${Date.now()}`);
+  const probe = path20.join(dir, `.parall-workspace-check-${process.pid}-${Date.now()}`);
   const fd = fs12.openSync(probe, "wx", 384);
   fs12.closeSync(fd);
   fs12.unlinkSync(probe);
@@ -65833,11 +66258,11 @@ function workspacePathDenyReason(value) {
   return "";
 }
 function isAncestorPath(parent, child) {
-  const relative2 = path19.relative(parent, child);
-  return relative2 !== "" && !relative2.startsWith("..") && !path19.isAbsolute(relative2);
+  const relative2 = path20.relative(parent, child);
+  return relative2 !== "" && !relative2.startsWith("..") && !path20.isAbsolute(relative2);
 }
 function toPolicyPath(value) {
-  return path19.resolve(value).split(path19.sep).join("/");
+  return path20.resolve(value).split(path20.sep).join("/");
 }
 function isNodeError(err) {
   return err instanceof Error && "code" in err;
@@ -65856,7 +66281,7 @@ var init_workspace = __esm({
 import { spawn as spawn6 } from "node:child_process";
 import * as fs13 from "node:fs";
 import * as os7 from "node:os";
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 function sleepCancellable(ms, signal) {
   if (signal.aborted)
     return Promise.resolve(false);
@@ -65885,6 +66310,7 @@ var init_supervisor = __esm({
     init_config();
     init_browser_profile_reconcile();
     init_filesystem();
+    init_local_profile_control();
     init_home_isolation();
     init_runtimes();
     init_runtime_bin_resolver();
@@ -65938,6 +66364,11 @@ var init_supervisor = __esm({
       running = false;
       machineId = null;
       machineOrgId = null;
+      // machines.created_by — the machine owner. The local control socket's profile
+      // commands are authorized against it (requester must BE the owner); kept
+      // fresh via bootstrap + refreshMachineConfig. Null until bootstrap → the
+      // local control plane fails closed.
+      machineCreatedBy = null;
       machineLlmSource = "parall";
       // Whether this machine contributes its local clips as a hub provider. The
       // org admin toggles it via PATCH /machines/{id}/provider-enabled; default true.
@@ -65956,6 +66387,7 @@ var init_supervisor = __esm({
       // browserProfilePool replaces the old single browserProfileManager.
       healthGate = null;
       browserProfilePool = null;
+      localControl = null;
       clipManager = null;
       clipProvider = null;
       clipReconcileTimer = null;
@@ -66009,7 +66441,7 @@ var init_supervisor = __esm({
         this.migrateFlatLayout();
         if (process.env.PRLL_CLIP_RUNTIME_ENABLED === "true") {
           this.browserProfilePool = new BrowserProfilePool({
-            baseHomeDir: path20.join(this.config.rootStateDir, "bb-browser"),
+            baseHomeDir: path21.join(this.config.rootStateDir, "bb-browser"),
             log: this.log,
             reportStatus: (profileId, status, errorMsg, generation) => {
               this.client.reportBrowserProfileStatus(profileId, status, errorMsg, generation).catch((err) => this.log.warn(`browser profile status report failed: ${String(err)}`));
@@ -66018,8 +66450,8 @@ var init_supervisor = __esm({
             proxyProbeUrl: this.resolveBrowserProxyProbeUrl()
           });
           this.clipManager = new ClipProcessManager({
-            clipsDir: path20.join(this.config.rootStateDir, "clips"),
-            dataDir: path20.join(this.config.rootStateDir, "clip-data"),
+            clipsDir: path21.join(this.config.rootStateDir, "clips"),
+            dataDir: path21.join(this.config.rootStateDir, "clip-data"),
             browserProfileManager: this.browserProfilePool,
             // Execution side: nested browser dependency invokes resolve their
             // binding and route through the hub (no local shortcut).
@@ -66039,6 +66471,7 @@ var init_supervisor = __esm({
           await this.applyClipProviderState();
           this.startClipReconcileTimer();
         }
+        this.localControl = await startLocalProfileControl(this.localProfileControlDeps());
         void this.detectAndReportRuntimes(true);
         this.runtimeDetectTimer = setInterval(() => {
           void this.detectAndReportRuntimes(false);
@@ -66164,6 +66597,10 @@ var init_supervisor = __esm({
           }
           exits.push(this.terminateChild(state));
         }
+        if (this.localControl) {
+          exits.push(this.localControl.stop());
+          this.localControl = null;
+        }
         if (this.clipProvider) {
           exits.push(this.clipProvider.disconnect());
           this.clipProvider = null;
@@ -66192,6 +66629,7 @@ var init_supervisor = __esm({
             const machine = await this.client.getMachineSelf();
             this.machineId = machine.id;
             this.machineOrgId = machine.org_id;
+            this.machineCreatedBy = machine.created_by ?? null;
             this.machineLlmSource = machine.llm_source ?? "parall";
             this.machineProviderEnabled = machine.provider_enabled ?? true;
             this.machineClipProviderUrl = machine.clip_provider_url ?? null;
@@ -66365,12 +66803,12 @@ var init_supervisor = __esm({
        */
       migrateFlatLayout() {
         const root = this.config.rootStateDir;
-        const agentsDir = path20.join(root, "agents");
-        const flatWorkspace = path20.join(root, "workspace");
+        const agentsDir = path21.join(root, "agents");
+        const flatWorkspace = path21.join(root, "workspace");
         if (!fs13.existsSync(flatWorkspace) || fs13.existsSync(agentsDir))
           return;
         let ownerAgentId;
-        const sessionsDir = path20.join(root, "sessions");
+        const sessionsDir = path21.join(root, "sessions");
         if (fs13.existsSync(sessionsDir)) {
           try {
             for (const file of fs13.readdirSync(sessionsDir)) {
@@ -66387,13 +66825,13 @@ var init_supervisor = __esm({
           }
         }
         const targetId = ownerAgentId ?? "_orphan";
-        const targetDir = path20.join(agentsDir, targetId);
+        const targetDir = path21.join(agentsDir, targetId);
         try {
           fs13.mkdirSync(targetDir, { recursive: true });
           for (const sub of ["workspace", "sessions", "dispatch-context"]) {
-            const src = path20.join(root, sub);
+            const src = path21.join(root, sub);
             if (fs13.existsSync(src)) {
-              fs13.renameSync(src, path20.join(targetDir, sub));
+              fs13.renameSync(src, path21.join(targetDir, sub));
             }
           }
           this.log.info(`migrated legacy flat state \u2192 agents/${targetId}/`);
@@ -66527,6 +66965,28 @@ var init_supervisor = __esm({
         const op = () => this.handleBrowserProfileLifecycle(data, sinceSeq);
         return data.action === "open" ? this.enqueueBrowserProfileRevive(data.profile_id, op) : this.enqueueBrowserProfileOp(data.profile_id, op);
       }
+      /**
+       * What the supervisor lends the local control plane: identity, pool, queues.
+       * Getters, not values — owner and pool both change over the daemon's life
+       * (bootstrap / refresh / provider state), so the handler must read what is
+       * true AT CALL TIME; a snapshot could authorize against a stale owner.
+       *
+       * One definition, used by both `run()` and the authorization tests, so the
+       * matrix under test is wired exactly like production.
+       */
+      localProfileControlDeps() {
+        return {
+          log: this.log,
+          machineId: () => this.machineId,
+          orgId: () => this.machineOrgId,
+          owner: () => this.machineCreatedBy,
+          pool: () => this.browserProfilePool,
+          listProfiles: () => this.client.listMachineBrowserProfiles(),
+          enqueueRevive: (id, op) => this.enqueueBrowserProfileRevive(id, op),
+          enqueueOp: (id, op) => this.enqueueBrowserProfileOp(id, op),
+          wipeBeforeRevive: (pool, id, resetGen, gen) => this.wipeBeforeRevive(pool, id, resetGen, gen)
+        };
+      }
       enqueueBrowserProfileOp(profileId, op) {
         const previous = this.browserProfileOpQueues.get(profileId) ?? Promise.resolve();
         const next = previous.catch(() => {
@@ -66689,7 +67149,7 @@ var init_supervisor = __esm({
         return this.runtimeDetectInFlight;
       }
       machineClipToConfig(clip) {
-        const clipPath = path20.join(this.config.rootStateDir, "clips", clip.alias);
+        const clipPath = path21.join(this.config.rootStateDir, "clips", clip.alias);
         return {
           clipId: clip.clip_id,
           name: clip.alias,
@@ -66755,7 +67215,7 @@ var init_supervisor = __esm({
         if (!sourceRef) {
           throw new Error(`registry clip "${config.name}" is missing source_ref`);
         }
-        const expectedPath = path20.join(this.config.rootStateDir, "clips", config.name);
+        const expectedPath = path21.join(this.config.rootStateDir, "clips", config.name);
         const localVersion = this.readInstalledClipVersion(expectedPath);
         if (localVersion && (!config.version || localVersion === config.version)) {
           return { ...config, path: expectedPath, source: expectedPath };
@@ -66773,7 +67233,7 @@ var init_supervisor = __esm({
         const result = await installClip({
           source,
           alias: config.name,
-          clipsDir: path20.join(this.config.rootStateDir, "clips"),
+          clipsDir: path21.join(this.config.rootStateDir, "clips"),
           registryUrl: process.env.PRLL_PINIX_REGISTRY_URL?.trim() || void 0
         });
         this.log.info(`clip ensured: ${result.alias} v${result.version} at ${result.path}`);
@@ -66788,7 +67248,7 @@ var init_supervisor = __esm({
       readInstalledClipVersion(dir) {
         for (const file of ["clip.json", "package.json"]) {
           try {
-            const raw = fs13.readFileSync(path20.join(dir, file), "utf-8");
+            const raw = fs13.readFileSync(path21.join(dir, file), "utf-8");
             const parsed = JSON.parse(raw);
             if (typeof parsed.version === "string" && parsed.version.trim()) {
               return parsed.version.trim();
@@ -66857,6 +67317,7 @@ var init_supervisor = __esm({
       async refreshMachineConfig() {
         try {
           const machine = await this.client.getMachineSelf();
+          this.machineCreatedBy = machine.created_by ?? null;
           const newSource = machine.llm_source ?? "parall";
           if (newSource !== this.machineLlmSource) {
             this.log.info(`machine config refreshed: llm_source ${this.machineLlmSource} \u2192 ${newSource}`);
@@ -67511,7 +67972,7 @@ var init_daemon_main = __esm({
 init_daemon_paths();
 init_daemon_update_mode();
 import * as fs14 from "node:fs";
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 var UPDATE_EXIT_CODE2 = 42;
 function formatError2(reason) {
   if (reason instanceof Error) {
@@ -67536,7 +67997,7 @@ function clearRunningMarker(markerPath) {
 }
 function prepareDaemonBootstrap(env = process.env, args = process.argv.slice(2)) {
   const bundleDir = resolveBundleDir(env);
-  const runningMarker = path21.join(bundleDir, "daemon-running");
+  const runningMarker = path22.join(bundleDir, "daemon-running");
   const lifecycleMarkerEnabled = args.length === 0 && !isSelfUpdateDisabledByEnv(env) && isSelfUpdateManaged(bundleDir, env);
   if (!lifecycleMarkerEnabled) {
     return { lifecycleMarkerEnabled: false, runningMarker, uncleanPrevExit: false };