@parall/daemon 1.49.0 → 1.50.1

package/bundle/parall-daemon.js

@@ -123,10 +123,20 @@ var init_lane_key = __esm({
   }
 });
 
-// ts/sdk/dist/types.js
-var init_types2 = __esm({
-  "ts/sdk/dist/types.js"() {
+// ts/sdk/dist/browser-viewer.js
+function browserViewerRequestOptions(command, opts) {
+  if (command !== "stream.answer" && command !== "stream.switch")
+    return opts;
+  return {
+    ...opts,
+    timeoutMs: Math.max(opts?.timeoutMs ?? 0, BROWSER_VIEWER_READINESS_TIMEOUT_MS)
+  };
+}
+var BROWSER_VIEWER_READINESS_TIMEOUT_MS;
+var init_browser_viewer = __esm({
+  "ts/sdk/dist/browser-viewer.js"() {
     "use strict";
+    BROWSER_VIEWER_READINESS_TIMEOUT_MS = 6e4;
   }
 });
 
@@ -168,6 +178,12 @@ var init_constants = __esm({
       ORG_MEMBER: (orgId, userId) => `${API_BASE}/orgs/${orgId}/members/${userId}`,
       ORG_MEMBER_CHATS: (orgId, memberId) => `${API_BASE}/orgs/${orgId}/members/${memberId}/chats`,
       ORG_MEMBER_TASKS: (orgId, memberId) => `${API_BASE}/orgs/${orgId}/members/${memberId}/tasks`,
+      // Org-scoped public profile (title / description). GET readable by every
+      // active member; PATCH is CAS-guarded (expected_version).
+      ORG_MEMBER_PROFILE: (orgId, userId) => `${API_BASE}/orgs/${orgId}/members/${userId}/profile`,
+      // Private agent Instructions — visibility gated server-side
+      // (agent self + Human org admin/owner). Never cached.
+      AGENT_INSTRUCTIONS: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/instructions`,
       REF_SEARCH: (orgId) => `${API_BASE}/orgs/${orgId}/refs/search`,
       // Direct messages (org-scoped, atomic find-or-create + send)
       DM: (orgId) => `${API_BASE}/orgs/${orgId}/dm`,
@@ -451,6 +467,11 @@ var init_constants = __esm({
       SEARCH: (orgId) => `${API_BASE}/orgs/${orgId}/search`,
       // Feature flags (org-scoped, server-evaluated)
       FEATURE_FLAGS: (orgId) => `${API_BASE}/orgs/${orgId}/feature-flags`,
+      // Team templates (org-scoped, owner/admin only)
+      TEMPLATES: (orgId) => `${API_BASE}/orgs/${orgId}/templates`,
+      TEMPLATE: (orgId, templateId) => `${API_BASE}/orgs/${orgId}/templates/${templateId}`,
+      TEMPLATE_DEPLOYMENTS: (orgId) => `${API_BASE}/orgs/${orgId}/template-deployments`,
+      TEMPLATE_DEPLOYMENT: (orgId, deploymentId) => `${API_BASE}/orgs/${orgId}/template-deployments/${deploymentId}`,
       // Billing & Credits (org-scoped)
       BILLING: (orgId) => `${API_BASE}/orgs/${orgId}/billing`,
       BILLING_TRANSACTIONS: (orgId) => `${API_BASE}/orgs/${orgId}/billing/transactions`,
@@ -644,6 +665,7 @@ var ParallClient, ApiError;
 var init_client = __esm({
   "ts/sdk/dist/client.js"() {
     "use strict";
+    init_browser_viewer();
     init_constants();
     ParallClient = class _ParallClient {
       baseUrl;
@@ -1015,6 +1037,30 @@ var init_client = __esm({
       async updateOrgMember(orgId, userId, role) {
         return this.request("PATCH", ENDPOINTS.ORG_MEMBER(orgId, userId), { role });
       }
+      /** Org-scoped public profile (title / description) of any active member. */
+      async getMemberProfile(orgId, userId) {
+        return this.request("GET", ENDPOINTS.ORG_MEMBER_PROFILE(orgId, userId));
+      }
+      /**
+       * CAS full-replacement of a member's public profile. Humans edit their
+       * own; Human org admins/owners edit agents'. A stale expected_version
+       * gets 409 PROFILE_VERSION_CONFLICT with error.details.current_version.
+       */
+      async updateMemberProfile(orgId, userId, req) {
+        return this.request("PATCH", ENDPOINTS.ORG_MEMBER_PROFILE(orgId, userId), req);
+      }
+      /** Private agent Instructions — agent self or Human org admin/owner only. */
+      async getAgentInstructions(orgId, agentId) {
+        return this.request("GET", ENDPOINTS.AGENT_INSTRUCTIONS(orgId, agentId));
+      }
+      /**
+       * CAS update of the private Instructions (Human org admin/owner only).
+       * A stale expected_version gets 409 INSTRUCTIONS_VERSION_CONFLICT with
+       * error.details.current_version.
+       */
+      async updateAgentInstructions(orgId, agentId, req) {
+        return this.request("PATCH", ENDPOINTS.AGENT_INSTRUCTIONS(orgId, agentId), req);
+      }
       // Member activity surfaces — chats the member participates in within this org,
       // ordered by most recent activity. Powers the member profile Activity tab.
       async getMemberChats(orgId, memberId, params) {
@@ -1572,11 +1618,7 @@ var init_client = __esm({
       async postBrowseResponse(requestId, response) {
         return this.request("POST", ENDPOINTS.MACHINES_ME_BROWSE_RESPONSE(requestId), response);
       }
-      /**
-       * `POST /machines/me/browser-profiles/viewer-response/{requestId}` — daemon
-       * reply to a `machine.browser_profile.viewer` control command. Wakes the
-       * api-server request/reply bridge (mirrors {@link postBrowseResponse}).
-       */
+      /** Reply to `machine.browser_profile.viewer` and wake its request/reply bridge. */
       async postBrowserProfileViewerResponse(requestId, response) {
         return this.request("POST", ENDPOINTS.MACHINES_ME_BROWSER_PROFILE_VIEWER_RESPONSE(requestId), response);
       }
@@ -1586,7 +1628,7 @@ var init_client = __esm({
        * owner or org admin. api-server brokers the command to the host daemon.
        */
       async browserViewerCommand(orgId, profileId, req, opts) {
-        return this.request("POST", ENDPOINTS.BROWSER_PROFILE_VIEWER_COMMAND(orgId, profileId), req, void 0, false, opts);
+        return this.request("POST", ENDPOINTS.BROWSER_PROFILE_VIEWER_COMMAND(orgId, profileId), req, void 0, false, browserViewerRequestOptions(req.command, opts));
       }
       /**
        * Drive the Cloud Edge live viewer (V1b, design §6): WebRTC signaling + input +
@@ -2358,6 +2400,22 @@ var init_client = __esm({
       async getFeatureFlags(orgId) {
         return this.request("GET", ENDPOINTS.FEATURE_FLAGS(orgId));
       }
+      // ---- Official Template catalog (org-contextual owner/admin reads + Hire) ----
+      async listOfficialTemplates(orgId) {
+        const response = await this.request("GET", ENDPOINTS.TEMPLATES(orgId));
+        return response.templates ?? [];
+      }
+      async getOfficialTemplate(orgId, templateId) {
+        return this.request("GET", ENDPOINTS.TEMPLATE(orgId, templateId));
+      }
+      async deployTemplate(orgId, request3) {
+        return this.request("POST", ENDPOINTS.TEMPLATE_DEPLOYMENTS(orgId), request3, void 0, false, {
+          timeoutMs: 185e3
+        });
+      }
+      async getTemplateDeployment(orgId, deploymentId) {
+        return this.request("GET", ENDPOINTS.TEMPLATE_DEPLOYMENT(orgId, deploymentId));
+      }
       // ---- Billing & Credits (org-scoped) ----
       async getBilling(orgId) {
         return this.request("GET", ENDPOINTS.BILLING(orgId));
@@ -2719,6 +2777,13 @@ var init_client = __esm({
   }
 });
 
+// ts/sdk/dist/types.js
+var init_types2 = __esm({
+  "ts/sdk/dist/types.js"() {
+    "use strict";
+  }
+});
+
 // ts/sdk/dist/ws.js
 function isRetryableNetworkError(err) {
   return err instanceof Error && err.name === "ApiError" && "status" in err && err.status === 0;
@@ -3063,9 +3128,10 @@ var init_ws = __esm({
 var init_dist = __esm({
   "ts/sdk/dist/index.js"() {
     "use strict";
-    init_types2();
-    init_constants();
+    init_browser_viewer();
     init_client();
+    init_constants();
+    init_types2();
     init_ws();
   }
 });
@@ -56204,6 +56270,147 @@ var init_cli = __esm({
   }
 });
 
+// ts/daemon/dist/browser-profile-reconcile.js
+async function reconcileBrowserProfiles(ctx) {
+  const pool = ctx.pool;
+  const activeBeforeList = new Set(pool.activeProfileIds());
+  const pendingReviveBeforeList = ctx.pendingReviveIds();
+  const localStateBeforeList = new Set(pool.localStateProfileIds());
+  let profiles;
+  try {
+    profiles = await ctx.client.listMachineBrowserProfiles();
+  } catch (err) {
+    ctx.log.warn(`browser profile reconcile: list failed: ${String(err)}`);
+    return;
+  }
+  if (ctx.currentPool() !== pool)
+    return;
+  const desiredLive = /* @__PURE__ */ new Set();
+  const serverIds = /* @__PURE__ */ new Set();
+  const serverResetGen = /* @__PURE__ */ new Map();
+  const ops = [];
+  const missedResetGen = (profileId) => {
+    const gen = serverResetGen.get(profileId) ?? 0;
+    return gen > pool.appliedResetGeneration(profileId) ? gen : null;
+  };
+  const enqueueResetWipeIfMissed = (profileId) => {
+    const gen = missedResetGen(profileId);
+    if (gen === null)
+      return false;
+    pool.fence(profileId);
+    ops.push(ctx.enqueueOp(profileId, () => pool.applyResetWipe(profileId, gen)));
+    return true;
+  };
+  for (const profile of profiles) {
+    if (!profile.machine_id)
+      continue;
+    serverIds.add(profile.id);
+    serverResetGen.set(profile.id, profile.reset_generation ?? 0);
+    if (profile.status !== "running" && profile.status !== "pending")
+      continue;
+    desiredLive.add(profile.id);
+    const wipeGen = missedResetGen(profile.id);
+    if (wipeGen !== null)
+      pool.fence(profile.id);
+    const sinceSeq = pool.stopSeqOf(profile.id);
+    const generation = profile.lifecycle_generation;
+    const forceStatusReport = profile.status === "pending";
+    ops.push(ctx.enqueueRevive(profile.id, async () => {
+      if (wipeGen !== null)
+        await ctx.wipeBeforeRevive(pool, profile.id, wipeGen, generation);
+      await pool.ensureRuntime(profile.id, sinceSeq, generation, { forceStatusReport });
+    }));
+  }
+  const candidates = /* @__PURE__ */ new Set([
+    ...activeBeforeList,
+    ...pendingReviveBeforeList,
+    ...localStateBeforeList
+  ]);
+  for (const profileId of candidates) {
+    if (desiredLive.has(profileId))
+      continue;
+    const isActive = activeBeforeList.has(profileId);
+    const hasLocalState = localStateBeforeList.has(profileId);
+    if (!isActive && !hasLocalState) {
+      pool.fence(profileId);
+      let cleanup;
+      if (!serverIds.has(profileId)) {
+        cleanup = pool.wipeAbsent(profileId);
+      } else {
+        const wipeGen = missedResetGen(profileId);
+        cleanup = wipeGen !== null ? pool.applyResetWipe(profileId, wipeGen) : pool.releaseRuntime(profileId);
+      }
+      void cleanup.catch((err) => ctx.log.warn(`browser profile pending-revive cleanup failed for ${profileId}: ${String(err)}`));
+      continue;
+    }
+    if (!serverIds.has(profileId)) {
+      pool.fence(profileId);
+      ops.push(ctx.enqueueOp(profileId, () => pool.wipeAbsent(profileId)));
+    } else if (enqueueResetWipeIfMissed(profileId)) {
+    } else if (isActive) {
+      pool.fence(profileId);
+      ops.push(ctx.enqueueOp(profileId, () => pool.releaseRuntime(profileId)));
+    }
+  }
+  for (const result of await Promise.allSettled(ops)) {
+    if (result.status === "rejected") {
+      ctx.log.warn(`browser profile reconcile op failed: ${String(result.reason)}`);
+    }
+  }
+}
+var init_browser_profile_reconcile = __esm({
+  "ts/daemon/dist/browser-profile-reconcile.js"() {
+    "use strict";
+  }
+});
+
+// ts/daemon/dist/clip-runtime/viewer-command-error.js
+function viewerCommandFailure(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (error instanceof ViewerCommandError && error.code) {
+    return { code: error.code, message };
+  }
+  return { message };
+}
+var ViewerCommandError;
+var init_viewer_command_error = __esm({
+  "ts/daemon/dist/clip-runtime/viewer-command-error.js"() {
+    "use strict";
+    ViewerCommandError = class extends Error {
+      code;
+      constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "ViewerCommandError";
+      }
+    };
+  }
+});
+
+// ts/daemon/dist/browser-profile-viewer-control.js
+async function handleBrowserProfileViewerCommand(deps, data) {
+  if (!deps.pool) {
+    await deps.client.postBrowserProfileViewerResponse(data.request_id, {
+      error: { message: "Browser profile runtime is disabled on this daemon" }
+    }).catch((err) => deps.log.warn(`browser profile viewer negative ACK failed: ${String(err)}`));
+    return;
+  }
+  try {
+    const result = await deps.pool.handleViewerCommand(data.profile_id, data.session_id, data.command, data.input, data.turn);
+    await deps.client.postBrowserProfileViewerResponse(data.request_id, { result });
+  } catch (err) {
+    const failure = viewerCommandFailure(err);
+    deps.log.warn(`browser profile viewer command failed (profile=${data.profile_id}, command=${data.command}): ${failure.message}`);
+    await deps.client.postBrowserProfileViewerResponse(data.request_id, { error: failure }).catch((replyErr) => deps.log.warn(`browser profile viewer error ACK failed: ${String(replyErr)}`));
+  }
+}
+var init_browser_profile_viewer_control = __esm({
+  "ts/daemon/dist/browser-profile-viewer-control.js"() {
+    "use strict";
+    init_viewer_command_error();
+  }
+});
+
 // ts/node_modules/.pnpm/ws@8.20.0/node_modules/ws/lib/constants.js
 var require_constants9 = __commonJS({
   "ts/node_modules/.pnpm/ws@8.20.0/node_modules/ws/lib/constants.js"(exports2, module2) {
@@ -62394,6 +62601,31 @@ var init_process_manager = __esm({
   }
 });
 
+// ts/daemon/dist/clip-runtime/viewer-command-deadline.js
+function isViewerReadinessCommand(command) {
+  return command === "stream.answer" || command === "stream.switch";
+}
+function parseViewerDispatchDeadlineUnixMs(value) {
+  let parsed;
+  if (typeof value === "number") {
+    parsed = value;
+  } else if (typeof value === "string" && /^[1-9]\d*$/.test(value)) {
+    parsed = Number(value);
+  } else {
+    return void 0;
+  }
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : void 0;
+}
+function viewerReadinessDeadlineError(phase) {
+  return new ViewerCommandError(`viewer readiness deadline elapsed ${phase}`, "VIEWER_STREAM_CANCELLED");
+}
+var init_viewer_command_deadline = __esm({
+  "ts/daemon/dist/clip-runtime/viewer-command-deadline.js"() {
+    "use strict";
+    init_viewer_command_error();
+  }
+});
+
 // ts/daemon/dist/clip-runtime/clip-provider.js
 import * as http23 from "node:http2";
 function encodeEnvelope2(msg) {
@@ -62411,8 +62643,10 @@ var ENVELOPE_FLAG_DATA2, ENVELOPE_FLAG_TRAILER2, EnvelopeDecoder2, ClipProvider;
 var init_clip_provider = __esm({
   "ts/daemon/dist/clip-runtime/clip-provider.js"() {
     "use strict";
-    init_process();
     init_browser_dependency();
+    init_process();
+    init_viewer_command_deadline();
+    init_viewer_command_error();
     ENVELOPE_FLAG_DATA2 = 0;
     ENVELOPE_FLAG_TRAILER2 = 2;
     EnvelopeDecoder2 = class _EnvelopeDecoder {
@@ -62768,8 +63002,8 @@ var init_clip_provider = __esm({
       /**
        * Handle a hosted-browser live-viewer command relayed by clip-service over the
        * stream and reply on the same stream (design §3.4). Always answers the
-       * request/reply bridge exactly once — `{result}` on success, `{error:{message}}`
-       * on failure — and never throws into the message loop, mirroring the BYOC
+       * request/reply bridge exactly once — `{result}` on success,
+       * `{error:{code?,message}}` on failure — and never throws into the message loop, mirroring the BYOC
        * daemon's handleBrowserProfileViewer (which replies over HTTP instead).
        */
       async handleViewerCommand(cmd) {
@@ -62782,6 +63016,10 @@ var init_clip_provider = __esm({
           return;
         }
         try {
+          const dispatchDeadlineUnixMs = parseViewerDispatchDeadlineUnixMs(cmd.dispatchDeadlineUnixMs);
+          if (isViewerReadinessCommand(cmd.command) && dispatchDeadlineUnixMs === void 0) {
+            throw viewerReadinessDeadlineError("because the ProviderStream command has no authenticated deadline");
+          }
           let input;
           if (cmd.input) {
             const decoded = Buffer.from(cmd.input, "base64").toString("utf-8");
@@ -62796,13 +63034,14 @@ var init_clip_provider = __esm({
             sessionId: cmd.sessionId,
             command: cmd.command,
             input,
-            turn: cmd.turn
+            turn: cmd.turn,
+            dispatchDeadlineUnixMs
           });
           await this.sendViewerReply(requestId, { result });
         } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          this.opts.log.warn(`[clip-provider] viewer command failed (profile=${cmd.profileId}, command=${cmd.command}): ${message}`);
-          await this.sendViewerReply(requestId, { error: { message } }).catch(() => {
+          const failure = viewerCommandFailure(err);
+          this.opts.log.warn(`[clip-provider] viewer command failed (profile=${cmd.profileId}, command=${cmd.command}): ${failure.message}`);
+          await this.sendViewerReply(requestId, { error: failure }).catch(() => {
           });
         }
       }
@@ -63183,6 +63422,80 @@ var init_browser_target_registry = __esm({
   }
 });
 
+// ts/daemon/dist/clip-runtime/bb-viewer-command-client.js
+function bbViewerCommandTimeoutMs(method) {
+  return method === "answer" || method === "switch" ? BB_VIEWER_READINESS_COMMAND_TIMEOUT_MS : BB_VIEWER_COMMAND_TIMEOUT_MS;
+}
+function bbViewerCommandEffectiveTimeoutMs(method, deadlineUnixMs, now = Date.now()) {
+  const configured = bbViewerCommandTimeoutMs(method);
+  if (deadlineUnixMs === void 0)
+    return configured;
+  const remaining = deadlineUnixMs - now;
+  if (remaining <= 0) {
+    throw viewerReadinessDeadlineError(`before bb-viewer ${method}`);
+  }
+  return Math.max(1, Math.min(configured, remaining));
+}
+async function sendBBViewerCommand(port, method, params, deadlineUnixMs) {
+  const controller = new AbortController();
+  const timeoutMs = bbViewerCommandEffectiveTimeoutMs(method, deadlineUnixMs);
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetch(`http://127.0.0.1:${port}/command`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ method, params }),
+      signal: controller.signal
+    });
+    const text = await resp.text();
+    return parseBBViewerCommandResponse(resp.status, text, method);
+  } catch (err) {
+    if (controller.signal.aborted && (method === "answer" || method === "switch")) {
+      throw viewerReadinessDeadlineError(`while waiting for bb-viewer ${method}`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function parseBBViewerCommandResponse(status, text, method) {
+  let parsed;
+  try {
+    parsed = text ? JSON.parse(text) : {};
+  } catch {
+    throw new ViewerCommandError(`bb-viewer ${method} returned invalid JSON`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new ViewerCommandError(`bb-viewer ${method} returned an invalid response`);
+  }
+  const envelope = parsed;
+  if (envelope.error) {
+    const code = typeof envelope.error.code === "string" && envelope.error.code.trim() ? envelope.error.code.trim() : void 0;
+    const message = typeof envelope.error.message === "string" && envelope.error.message.trim() ? envelope.error.message : `bb-viewer ${method} failed`;
+    throw new ViewerCommandError(message, code);
+  }
+  if (status < 200 || status >= 300) {
+    throw new ViewerCommandError(`bb-viewer ${method} returned ${status}`);
+  }
+  if (envelope.result === void 0 || envelope.result === null) {
+    return {};
+  }
+  if (typeof envelope.result !== "object" || Array.isArray(envelope.result)) {
+    throw new ViewerCommandError(`bb-viewer ${method} returned an invalid result`);
+  }
+  return envelope.result;
+}
+var BB_VIEWER_COMMAND_TIMEOUT_MS, BB_VIEWER_READINESS_COMMAND_TIMEOUT_MS;
+var init_bb_viewer_command_client = __esm({
+  "ts/daemon/dist/clip-runtime/bb-viewer-command-client.js"() {
+    "use strict";
+    init_viewer_command_deadline();
+    init_viewer_command_error();
+    BB_VIEWER_COMMAND_TIMEOUT_MS = 15e3;
+    BB_VIEWER_READINESS_COMMAND_TIMEOUT_MS = 3e4;
+  }
+});
+
 // ts/daemon/dist/clip-runtime/browser-viewer-streamer.js
 import { spawn as spawn3 } from "node:child_process";
 function isLoopbackBindHost(host) {
@@ -63226,13 +63539,15 @@ function filterTabListToAccount(result, account) {
   const owned = tabs.filter((t) => t?.account === account);
   return { ...result, tabs: owned, activeIndex: owned.findIndex((t) => t?.active === true) };
 }
-var BB_VIEWER_HEALTH_TIMEOUT_MS, BB_VIEWER_COMMAND_TIMEOUT_MS, BB_VIEWER_UNANSWERED_REAP_MS, BB_VIEWER_TERM_GRACE_MS, BrowserViewerStreamer, REFLESS_PIN_NAV, VIEWER_NAVIGABLE_PROTOCOLS;
+var BB_VIEWER_HEALTH_TIMEOUT_MS, BB_VIEWER_UNANSWERED_REAP_MS, BB_VIEWER_TERM_GRACE_MS, BrowserViewerStreamer, REFLESS_PIN_NAV, VIEWER_NAVIGABLE_PROTOCOLS;
 var init_browser_viewer_streamer = __esm({
   "ts/daemon/dist/clip-runtime/browser-viewer-streamer.js"() {
     "use strict";
+    init_bb_viewer_command_client();
     init_subprocess();
+    init_viewer_command_deadline();
+    init_bb_viewer_command_client();
     BB_VIEWER_HEALTH_TIMEOUT_MS = 1e4;
-    BB_VIEWER_COMMAND_TIMEOUT_MS = 15e3;
     BB_VIEWER_UNANSWERED_REAP_MS = 9e4;
     BB_VIEWER_TERM_GRACE_MS = 5e3;
     BrowserViewerStreamer = class {
@@ -63261,7 +63576,7 @@ var init_browser_viewer_streamer = __esm({
        * partial result. `data.input` / `data.turn` / `data.session_id` come from
        * MachineBrowserProfileViewerData.
        */
-      async handleViewerCommand(profileId, sessionId, command, input, turn) {
+      async handleViewerCommand(profileId, sessionId, command, input, turn, execution) {
         if (!profileId)
           throw new Error("browser profile id is required");
         if (command !== "stream.start" && sessionId && this.kickedSessions.get(profileId) === sessionId) {
@@ -63271,11 +63586,11 @@ var init_browser_viewer_streamer = __esm({
           case "stream.start":
             return this.viewerStreamStart(profileId, sessionId, turn);
           case "stream.answer":
-            return this.viewerStreamAnswer(profileId, sessionId, input);
+            return this.viewerStreamAnswer(profileId, sessionId, input, execution?.deadlineUnixMs);
           case "stream.close":
             return this.viewerStreamClose(profileId, sessionId, input);
           case "stream.switch":
-            return this.viewerStreamSwitch(profileId, sessionId, input);
+            return this.viewerStreamSwitch(profileId, sessionId, input, execution?.deadlineUnixMs);
           case "kick":
             return this.viewerKick(profileId, sessionId, input);
           case "close":
@@ -63327,7 +63642,7 @@ var init_browser_viewer_streamer = __esm({
         await this.bringTargetToFront(cdpUrl);
         const streamer = await this.spawnStreamer(profileId, sessionId, turn);
         try {
-          const result = await this.streamerCommand(streamer, "connect", { cdpUrl });
+          const result = await sendBBViewerCommand(streamer.port, "connect", { cdpUrl });
           streamer.streamedTabId = targetIdFromCdpUrl(cdpUrl);
           const reapTimer = setTimeout(() => {
             const current = this.streamers.get(profileId);
@@ -63348,14 +63663,17 @@ var init_browser_viewer_streamer = __esm({
        * Rejects if the streamer's sessionId no longer matches (a stale viewer
        * session from a superseded stream.start).
        */
-      async viewerStreamAnswer(profileId, sessionId, input) {
+      async viewerStreamAnswer(profileId, sessionId, input, deadlineUnixMs) {
         const streamer = this.streamers.get(profileId);
         if (!streamer)
           throw new Error("no active viewer streamer for profile");
         if (streamer.sessionId !== sessionId)
           throw new Error("stale viewer session");
+        this.assertViewerExecutionDeadline(deadlineUnixMs, "before bb-viewer answer");
         streamer.answered = true;
-        return this.streamerCommand(streamer, "answer", input ?? {});
+        const result = await sendBBViewerCommand(streamer.port, "answer", input ?? {}, deadlineUnixMs);
+        this.assertViewerExecutionDeadline(deadlineUnixMs, "after bb-viewer answer");
+        return result;
       }
       /**
        * stream.close — best-effort stop the streamer, then kill + remove it. A
@@ -63376,7 +63694,7 @@ var init_browser_viewer_streamer = __esm({
             return { ok: true, stale: true };
           }
           try {
-            await this.streamerCommand(streamer, "stop", {});
+            await sendBBViewerCommand(streamer.port, "stop", {});
           } catch (err) {
             this.host.log.warn(`[bb-viewer] stop command failed for ${profileId} (killing anyway): ${formatErrorForLog(err)}`);
           }
@@ -63393,7 +63711,7 @@ var init_browser_viewer_streamer = __esm({
        * the stream.start response), so a session-less switch is by definition not
        * the current viewer.
        */
-      async viewerStreamSwitch(profileId, sessionId, input) {
+      async viewerStreamSwitch(profileId, sessionId, input, deadlineUnixMs) {
         const streamer = this.streamers.get(profileId);
         if (!streamer)
           throw new Error("no active viewer streamer for profile");
@@ -63403,9 +63721,13 @@ var init_browser_viewer_streamer = __esm({
         if (tab === void 0 || tab === null || tab === "") {
           throw new Error("stream.switch requires input.tab");
         }
+        this.assertViewerExecutionDeadline(deadlineUnixMs, "before resolving the switch target");
         const cdpUrl = await this.host.withDaemonRecovery(() => this.resolveAccountPageCdpUrl(profileId, tab), `viewer stream.switch ${profileId}`);
-        await this.bringTargetToFront(cdpUrl);
-        const result = await this.streamerCommand(streamer, "switch", { cdpUrl });
+        this.assertViewerExecutionDeadline(deadlineUnixMs, "after resolving the switch target");
+        await this.bringTargetToFront(cdpUrl, deadlineUnixMs);
+        this.assertViewerExecutionDeadline(deadlineUnixMs, "before bb-viewer switch");
+        const result = await sendBBViewerCommand(streamer.port, "switch", { cdpUrl }, deadlineUnixMs);
+        this.assertViewerExecutionDeadline(deadlineUnixMs, "after bb-viewer switch");
         streamer.streamedTabId = targetIdFromCdpUrl(cdpUrl);
         return { ...result, streamed_tab_id: streamer.streamedTabId };
       }
@@ -63429,7 +63751,7 @@ var init_browser_viewer_streamer = __esm({
         }
         const cdpUrl = await this.host.withDaemonRecovery(() => this.resolveAccountPageCdpUrl(profileId), `viewer close re-switch ${profileId}`);
         await this.bringTargetToFront(cdpUrl);
-        const sw = await this.streamerCommand(streamer, "switch", { cdpUrl });
+        const sw = await sendBBViewerCommand(streamer.port, "switch", { cdpUrl });
         streamer.streamedTabId = targetIdFromCdpUrl(cdpUrl);
         return { ...result, ...sw, streamed_tab_id: streamer.streamedTabId };
       }
@@ -63441,15 +63763,17 @@ var init_browser_viewer_streamer = __esm({
        * must not block the stream. host:port + targetId are parsed from the cdpUrl
        * (`ws://host:port/devtools/page/<targetId>`) to avoid an extra /status call.
        */
-      async bringTargetToFront(cdpUrl) {
+      async bringTargetToFront(cdpUrl, deadlineUnixMs) {
         const m = /^ws:\/\/([^/]+)\/devtools\/page\/(.+)$/.exec(cdpUrl);
         if (!m)
           return;
         const [, hostPort, targetId] = m;
+        this.assertViewerExecutionDeadline(deadlineUnixMs, "before foregrounding the switch target");
+        const timeoutMs = deadlineUnixMs === void 0 ? 5e3 : Math.max(1, Math.min(5e3, deadlineUnixMs - Date.now()));
         try {
           const resp = await fetch(`http://${hostPort}/json/activate/${targetId}`, {
             method: "GET",
-            signal: AbortSignal.timeout(5e3)
+            signal: AbortSignal.timeout(timeoutMs)
           });
           if (!resp.ok) {
             this.host.log.warn(`[bb-viewer] activate target ${targetId} returned ${resp.status} (continuing)`);
@@ -63458,6 +63782,11 @@ var init_browser_viewer_streamer = __esm({
           this.host.log.warn(`[bb-viewer] activate target ${targetId} failed (continuing): ${formatErrorForLog(err)}`);
         }
       }
+      assertViewerExecutionDeadline(deadlineUnixMs, phase) {
+        if (deadlineUnixMs !== void 0 && Date.now() >= deadlineUnixMs) {
+          throw viewerReadinessDeadlineError(phase);
+        }
+      }
       /**
        * Forward a navigation command (tab_list/tab_new/open/reload/back/forward/
        * close) to bb-browser scoped to the profile's account. This lets the human
@@ -63658,34 +63987,6 @@ var init_browser_viewer_streamer = __esm({
         killTimer.unref?.();
         child.once("exit", () => clearTimeout(killTimer));
       }
-      /**
-       * POST a command to the profile's bb-viewer `/command` endpoint. Parses the
-       * `{result}` / `{error:{message}}` envelope (bb-viewer api.go) and returns
-       * the inner result, throwing the error message on failure.
-       */
-      async streamerCommand(streamer, method, params) {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), BB_VIEWER_COMMAND_TIMEOUT_MS);
-        try {
-          const resp = await fetch(`http://127.0.0.1:${streamer.port}/command`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ method, params }),
-            signal: controller.signal
-          });
-          const text = await resp.text();
-          const parsed = text ? JSON.parse(text) : {};
-          if (parsed.error) {
-            throw new Error(parsed.error.message || `bb-viewer ${method} failed`);
-          }
-          if (!resp.ok) {
-            throw new Error(`bb-viewer ${method} returned ${resp.status}: ${text}`);
-          }
-          return parsed.result ?? {};
-        } finally {
-          clearTimeout(timer);
-        }
-      }
       /**
        * Kill + remove the profile's bb-viewer streamer, if any. Idempotent. Also
        * clears any kick marker for the profile: a (re)kill establishes a clean
@@ -63981,8 +64282,8 @@ var init_browser_profile_manager = __esm({
        * (browser-viewer-streamer.ts), which owns the per-profile bb-viewer
        * subprocesses and viewer tab navigation.
        */
-      async handleViewerCommand(profileId, sessionId, command, input, turn) {
-        return this.viewer.handleViewerCommand(profileId, sessionId, command, input, turn);
+      async handleViewerCommand(profileId, sessionId, command, input, turn, execution) {
+        return this.viewer.handleViewerCommand(profileId, sessionId, command, input, turn, execution);
       }
       /** Read cdpHost/cdpPort from the bb-browser daemon `GET /status`. */
       async cdpEndpoint() {
@@ -64940,104 +65241,11 @@ var init_clip_runtime = __esm({
     init_hub_client();
     init_browser_profile_manager();
     init_browser_profile_pool();
+    init_viewer_command_error();
     init_clip_installer();
   }
 });
 
-// ts/daemon/dist/browser-profile-reconcile.js
-async function reconcileBrowserProfiles(ctx) {
-  const pool = ctx.pool;
-  const activeBeforeList = new Set(pool.activeProfileIds());
-  const pendingReviveBeforeList = ctx.pendingReviveIds();
-  const localStateBeforeList = new Set(pool.localStateProfileIds());
-  let profiles;
-  try {
-    profiles = await ctx.client.listMachineBrowserProfiles();
-  } catch (err) {
-    ctx.log.warn(`browser profile reconcile: list failed: ${String(err)}`);
-    return;
-  }
-  if (ctx.currentPool() !== pool)
-    return;
-  const desiredLive = /* @__PURE__ */ new Set();
-  const serverIds = /* @__PURE__ */ new Set();
-  const serverResetGen = /* @__PURE__ */ new Map();
-  const ops = [];
-  const missedResetGen = (profileId) => {
-    const gen = serverResetGen.get(profileId) ?? 0;
-    return gen > pool.appliedResetGeneration(profileId) ? gen : null;
-  };
-  const enqueueResetWipeIfMissed = (profileId) => {
-    const gen = missedResetGen(profileId);
-    if (gen === null)
-      return false;
-    pool.fence(profileId);
-    ops.push(ctx.enqueueOp(profileId, () => pool.applyResetWipe(profileId, gen)));
-    return true;
-  };
-  for (const profile of profiles) {
-    if (!profile.machine_id)
-      continue;
-    serverIds.add(profile.id);
-    serverResetGen.set(profile.id, profile.reset_generation ?? 0);
-    if (profile.status !== "running" && profile.status !== "pending")
-      continue;
-    desiredLive.add(profile.id);
-    const wipeGen = missedResetGen(profile.id);
-    if (wipeGen !== null)
-      pool.fence(profile.id);
-    const sinceSeq = pool.stopSeqOf(profile.id);
-    const generation = profile.lifecycle_generation;
-    const forceStatusReport = profile.status === "pending";
-    ops.push(ctx.enqueueRevive(profile.id, async () => {
-      if (wipeGen !== null)
-        await ctx.wipeBeforeRevive(pool, profile.id, wipeGen, generation);
-      await pool.ensureRuntime(profile.id, sinceSeq, generation, { forceStatusReport });
-    }));
-  }
-  const candidates = /* @__PURE__ */ new Set([
-    ...activeBeforeList,
-    ...pendingReviveBeforeList,
-    ...localStateBeforeList
-  ]);
-  for (const profileId of candidates) {
-    if (desiredLive.has(profileId))
-      continue;
-    const isActive = activeBeforeList.has(profileId);
-    const hasLocalState = localStateBeforeList.has(profileId);
-    if (!isActive && !hasLocalState) {
-      pool.fence(profileId);
-      let cleanup;
-      if (!serverIds.has(profileId)) {
-        cleanup = pool.wipeAbsent(profileId);
-      } else {
-        const wipeGen = missedResetGen(profileId);
-        cleanup = wipeGen !== null ? pool.applyResetWipe(profileId, wipeGen) : pool.releaseRuntime(profileId);
-      }
-      void cleanup.catch((err) => ctx.log.warn(`browser profile pending-revive cleanup failed for ${profileId}: ${String(err)}`));
-      continue;
-    }
-    if (!serverIds.has(profileId)) {
-      pool.fence(profileId);
-      ops.push(ctx.enqueueOp(profileId, () => pool.wipeAbsent(profileId)));
-    } else if (enqueueResetWipeIfMissed(profileId)) {
-    } else if (isActive) {
-      pool.fence(profileId);
-      ops.push(ctx.enqueueOp(profileId, () => pool.releaseRuntime(profileId)));
-    }
-  }
-  for (const result of await Promise.allSettled(ops)) {
-    if (result.status === "rejected") {
-      ctx.log.warn(`browser profile reconcile op failed: ${String(result.reason)}`);
-    }
-  }
-}
-var init_browser_profile_reconcile = __esm({
-  "ts/daemon/dist/browser-profile-reconcile.js"() {
-    "use strict";
-  }
-});
-
 // ts/daemon/dist/filesystem.js
 import * as fs9 from "fs";
 import * as path16 from "path";
@@ -66393,12 +66601,13 @@ var init_supervisor = __esm({
     "use strict";
     init_dist2();
     init_dist();
+    init_browser_profile_reconcile();
+    init_browser_profile_viewer_control();
     init_browser_readiness();
     init_clip_installer();
     init_manifest();
     init_clip_runtime();
     init_config();
-    init_browser_profile_reconcile();
     init_filesystem();
     init_local_profile_control();
     init_home_isolation();
@@ -66642,7 +66851,7 @@ var init_supervisor = __esm({
         });
         this.ws.on("machine.browser_profile.viewer", (data) => {
           this.log.info(`WS: browser profile viewer command \u2014 profile=${data.profile_id} command=${data.command}`);
-          this.enqueueBrowserProfileViewer(data);
+          void this.enqueueBrowserProfileOp(data.profile_id, () => handleBrowserProfileViewerCommand({ pool: this.browserProfilePool, client: this.client, log: this.log }, data));
         });
         this.ws.onStateChange((state) => {
           if (state === "disconnected" || state === "reconnecting") {
@@ -67105,31 +67314,6 @@ var init_supervisor = __esm({
             this.browserProfilePendingRevives.set(profileId, remaining);
         });
       }
-      /**
-       * Handle one viewer control command and reply via REST. Always answers the
-       * request/reply bridge exactly once ({result} on success, {error:{message}}
-       * on failure) and never throws into the WS event loop — mirrors
-       * handleFilesystemBrowse. Serialized per profile by enqueueBrowserProfileViewer.
-       */
-      async handleBrowserProfileViewer(data) {
-        if (!this.browserProfilePool) {
-          await this.client.postBrowserProfileViewerResponse(data.request_id, {
-            error: { message: "Browser profile runtime is disabled on this daemon" }
-          }).catch((err) => this.log.warn(`browser profile viewer negative ACK failed: ${String(err)}`));
-          return;
-        }
-        try {
-          const result = await this.browserProfilePool.handleViewerCommand(data.profile_id, data.session_id, data.command, data.input, data.turn);
-          await this.client.postBrowserProfileViewerResponse(data.request_id, { result });
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          this.log.warn(`browser profile viewer command failed (profile=${data.profile_id}, command=${data.command}): ${message}`);
-          await this.client.postBrowserProfileViewerResponse(data.request_id, { error: { message } }).catch((replyErr) => this.log.warn(`browser profile viewer error ACK failed: ${String(replyErr)}`));
-        }
-      }
-      enqueueBrowserProfileViewer(data) {
-        void this.enqueueBrowserProfileOp(data.profile_id, () => this.handleBrowserProfileViewer(data));
-      }
       async handleClipSync(_data) {
         await this.reconcileMachineClips();
       }