@parall/daemon 1.55.0 → 1.55.1

package/bundle/manifest.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.55.0",
-  "built_at": "2026-08-09T16:02:07.000Z",
+  "version": "1.55.1",
+  "built_at": "2026-08-12T14:55:20.195Z",
   "min_node_version": "20.0.0",
   "files": {
     "bb-browser-daemon.js": {
@@ -16,29 +16,29 @@
       "size": 18
     },
     "parall-browser-pod.js": {
-      "sha256": "76ddb193bb4007f593954dd70db9a7555cd4ff230e69fb1d65b48effdb4cb8f1",
-      "size": 2940163
+      "sha256": "515f2339f2eed7e942fb06d9fc020060b5598c36f234f1bcbd08ab0e6a75fab1",
+      "size": 2946190
     },
     "parall-channel-exec.js": {
       "sha256": "7c2a6e12483a45e9eb4a42cd7d4cdd3c4fa21dd09ac1347d9a3e177b4ddee930",
       "size": 7220
     },
     "parall-claude-agent.js": {
-      "sha256": "40b0ce7d956b08a1d09898b6c0b4e99725df3f90dc885e9615caedb4751a8c74",
-      "size": 2805125
+      "sha256": "9be3b40a7a07ffe475bc2d89a24873dfb255318fbff44001aa91b46424f74764",
+      "size": 2814346
     },
     "parall-codex-agent.js": {
-      "sha256": "0d7102ec3a86125abad4de826946964faf88e401c55649280460fb71850e460f",
-      "size": 2835829
+      "sha256": "1951a7dd83d82108fb9db3f58d9dd8e338c059d67656de8370053c0355b50221",
+      "size": 2846371
     },
     "parall-daemon.js": {
-      "sha256": "0eb785ee505204bbf4a5c872a8cae61bc814f1400a1456cec9fa146f1958ef34",
-      "size": 3004344
+      "sha256": "9b22b08ee0d9bb544bc04cde5bfb81105efc48605cbb04e34bd72fc21cdf2791",
+      "size": 3011156
     },
     "parall-openclaw-agent.js": {
       "sha256": "856a1c3a9ae0ffef8efe2481fa1171dbeb1d67cccb88616aa9bf16da96a69355",
       "size": 9923
     }
   },
-  "signature": "GXPiJwnrho49eHkMv7aW6lYsT2d66zB5BN3JYHKmrWX4hRiOlPqNJ7Ti/jywf2LhTVsbCPtKLTda5H7Ft3KSDA=="
+  "signature": "6Qz7sggq6UHjp8N85qhLEIOUQo3HA2x0Sh0s2dkbSwti5TjfEznbi/jcYhZROXlPIV1wihB9i2eE7w+p3F6DCQ=="
 }

package/bundle/parall-browser-pod.js

@@ -63704,6 +63704,13 @@ var ENDPOINTS = {
   PROJECTS: (orgId) => `${API_BASE}/orgs/${orgId}/projects`,
   PROJECT_TASK_SUMMARY: (orgId) => `${API_BASE}/orgs/${orgId}/projects/task-summary`,
   PROJECT: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}`,
+  PROJECT_MEMBERS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/members`,
+  PROJECT_READERS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/readers`,
+  PROJECT_LIBRARY: (orgId) => `${API_BASE}/orgs/${orgId}/projects/library`,
+  PROJECT_JOIN: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/join`,
+  PROJECT_JOIN_REQUESTS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/join-requests`,
+  // subject is a bare user ID or a bare team ID; both are path-segment safe.
+  PROJECT_MEMBER: (orgId, projectId, subject) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/members/${subject}`,
   // Schedules (org-scoped, platform time trigger primitive)
   SCHEDULES: (orgId) => `${API_BASE}/orgs/${orgId}/schedules`,
   SCHEDULE: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}`,
@@ -63921,6 +63928,9 @@ var ENDPOINTS = {
   ORG_EDGE_PROFILES: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
   // Per-profile egress proxy (hosted Cloud Profiles; manager-only, human-only).
   ORG_EDGE_PROFILE_PROXY: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/proxy`,
+  // Per-profile one-shot cookie seed (hosted Cloud Profiles; manager-only,
+  // human-only, idle-only). Injected at the next cold start, then consumed.
+  ORG_EDGE_PROFILE_COOKIES: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/cookies`,
   ORG_EDGE_EXEC: (orgId) => `/api/v1/orgs/${orgId}/edge/exec`,
   // Cloud Edge live viewer command (V1b) — api-server, gated on cap:edge-viewer.
   // Same request/reply shape as the v2 browser-profile viewer, on the v3 edge
@@ -64067,6 +64077,62 @@ var ProjectTaskClient = class {
   async deleteProject(orgId, projectId) {
     return this.request("DELETE", ENDPOINTS.PROJECT(orgId, projectId));
   }
+  /** Roster with display info; readable by anyone who can read the project. */
+  async getProjectMembers(orgId, projectId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_MEMBERS(orgId, projectId));
+    return res.data;
+  }
+  /**
+   * User IDs who may read the project — the assignee-eligibility set. Every
+   * tier answers the roster expansion (direct, team-reached, org
+   * owners/admins); visibility only shapes admission, never reach.
+   */
+  async getProjectReaders(orgId, projectId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_READERS(orgId, projectId));
+    return res.data;
+  }
+  /** The join library: every discoverable project (public + restricted, plus
+   * private for org owners/admins) with the caller's admission state. */
+  async getProjectLibrary(orgId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_LIBRARY(orgId));
+    return res.data;
+  }
+  /** Public-tier self-admission: writes the caller's own member row.
+   * Other tiers answer `404 PROJECT_NOT_FOUND`; a duplicate answers
+   * `409 MEMBER_EXISTS`. */
+  async joinProject(orgId, projectId) {
+    return this.request("POST", ENDPOINTS.PROJECT_JOIN(orgId, projectId));
+  }
+  /** Restricted-tier admission petition. A pending duplicate answers
+   * `409 REQUEST_EXISTS`; membership answers `409 MEMBER_EXISTS`. */
+  async createProjectJoinRequest(orgId, projectId) {
+    return this.request("POST", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+  }
+  /** Pending petitions for one project — manager standing required. */
+  async listProjectJoinRequests(orgId, projectId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+    return res.data;
+  }
+  /** Withdraws the caller's own pending petition. */
+  async cancelProjectJoinRequest(orgId, projectId) {
+    return this.request("DELETE", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+  }
+  /**
+   * Adds one subject (user ID or team ID) to the roster. Manager-only,
+   * create-only: an existing row answers `409 MEMBER_EXISTS` — change roles
+   * through updateProjectMember instead.
+   */
+  async addProjectMember(orgId, projectId, req) {
+    return this.request("POST", ENDPOINTS.PROJECT_MEMBERS(orgId, projectId), req);
+  }
+  /** Sets one roster entry's role. Demoting the last manager answers `400 LAST_MANAGER`. */
+  async updateProjectMember(orgId, projectId, subject, req) {
+    return this.request("PATCH", ENDPOINTS.PROJECT_MEMBER(orgId, projectId, subject), req);
+  }
+  /** Removes one roster entry. Removing the last manager answers `400 LAST_MANAGER`. */
+  async removeProjectMember(orgId, projectId, subject) {
+    return this.request("DELETE", ENDPOINTS.PROJECT_MEMBER(orgId, projectId, subject));
+  }
 };
 
 // ts/sdk/dist/task-label-client.js
@@ -64459,8 +64525,9 @@ var ParallClient = class _ParallClient extends TaskLabelClient {
     return this.request("POST", ENDPOINTS.TEAMS(orgId), req);
   }
   /**
-   * Renames a team. The slug cannot be changed — wiki ACL rows reference it as
-   * `@slug`, so the server answers 400 SLUG_IMMUTABLE if one is sent.
+   * Renames a team. Renaming is an ordinary edit: ACL rows reference teams by
+   * ID. Names are org-unique (case-insensitive); a duplicate answers 409
+   * NAME_TAKEN.
    */
   async updateTeam(orgId, teamId, req) {
     return this.request("PATCH", ENDPOINTS.TEAM(orgId, teamId), req);
@@ -66089,15 +66156,18 @@ var ParallClient = class _ParallClient extends TaskLabelClient {
   /**
    * Read a clip's per-org agent exec access. Org-member readable (agents
    * included, so a denied agent can learn why exec answered
-   * `CLIP_AGENT_NOT_ALLOWED`).
+   * `CLIP_AGENT_NOT_ALLOWED` / `CLIP_AGENT_CONNECTION_NOT_ALLOWED`).
    */
   async getClipAgentExecAccess(orgId, clipId) {
     return this.request("GET", ENDPOINTS.ORG_CLIP_EXEC_ACCESS(orgId, clipId));
   }
   /**
    * Replace a clip's per-org agent exec access. Human-only (agent principals
-   * get 403); under `all_agents` the `agent_ids` must be empty. Every granted
-   * id must be an active agent of this org (else `400 INVALID_INPUT`).
+   * get 403); under `all_agents` both lists must be empty; pass either
+   * `agent_ids` (legacy flat form → every agent gets `connection_scope: 'all'`)
+   * or `grants` (connection-scoped), never both. Every granted id must be an
+   * active agent of this org, and every `connection_ids` entry a connection of
+   * THIS clip in this org (else `400 INVALID_INPUT`).
    */
   async putClipAgentExecAccess(orgId, clipId, access) {
     return this.request("PUT", ENDPOINTS.ORG_CLIP_EXEC_ACCESS(orgId, clipId), access);
@@ -66183,6 +66253,41 @@ var ParallClient = class _ParallClient extends TaskLabelClient {
       headers: expectedVersion ? { "If-Match": `"proxy-${expectedVersion}"` } : void 0
     });
   }
+  /**
+   * Read a hosted Cloud Profile's one-shot cookie-seed status (manager-only:
+   * hosted human maintainer or org admin). Sanitized — cookie VALUES never come
+   * back, only `cookie_count` and the distinct target `domains`. `can_mutate` /
+   * `lease_status` are the authoritative idle gate. Typed errors: `EDGE_NOT_HOSTED`
+   * (BYOC device), `NOT_FOUND` (unknown profile).
+   */
+  async getEdgeProfileCookieSeed(orgId, edgeId, profileName) {
+    return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName));
+  }
+  /**
+   * Set/replace the profile's one-shot cookie seed (the full normalized cookie
+   * array every time) — IDLE ONLY: while the profile's hosted browser is running
+   * the server answers 409 `EDGE_PROFILE_IN_USE`; close the viewer, wait for idle
+   * scale-to-zero, and retry. The next cold start injects the cookies into the
+   * profile partition and consumes the seed. Other typed errors:
+   * `EDGE_COOKIE_SEED_STALE` (409 — expectedVersion lost a tab race, sent as the
+   * `cookieseed-<version>` If-Match), `EDGE_DELETING` (409), and
+   * `SECRETBOX_UNCONFIGURED` (503 — server cannot store cookies safely).
+   */
+  async setEdgeProfileCookieSeed(orgId, edgeId, profileName, req, expectedVersion) {
+    return this.request("PUT", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName), req, void 0, false, {
+      headers: expectedVersion ? { "If-Match": `"cookieseed-${expectedVersion}"` } : void 0
+    });
+  }
+  /**
+   * Clear the pending cookie seed (does NOT sign the profile out — cookies
+   * already injected into the partition stay). Idle-only like set — 409
+   * `EDGE_PROFILE_IN_USE` while the browser is live.
+   */
+  async clearEdgeProfileCookieSeed(orgId, edgeId, profileName, expectedVersion) {
+    return this.request("DELETE", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName), void 0, void 0, false, {
+      headers: expectedVersion ? { "If-Match": `"cookieseed-${expectedVersion}"` } : void 0
+    });
+  }
   /**
    * Execute a registry clip command on an Edge device.
    *

package/bundle/parall-claude-agent.js

@@ -51863,6 +51863,13 @@ var ENDPOINTS = {
   PROJECTS: (orgId) => `${API_BASE}/orgs/${orgId}/projects`,
   PROJECT_TASK_SUMMARY: (orgId) => `${API_BASE}/orgs/${orgId}/projects/task-summary`,
   PROJECT: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}`,
+  PROJECT_MEMBERS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/members`,
+  PROJECT_READERS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/readers`,
+  PROJECT_LIBRARY: (orgId) => `${API_BASE}/orgs/${orgId}/projects/library`,
+  PROJECT_JOIN: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/join`,
+  PROJECT_JOIN_REQUESTS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/join-requests`,
+  // subject is a bare user ID or a bare team ID; both are path-segment safe.
+  PROJECT_MEMBER: (orgId, projectId, subject) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/members/${subject}`,
   // Schedules (org-scoped, platform time trigger primitive)
   SCHEDULES: (orgId) => `${API_BASE}/orgs/${orgId}/schedules`,
   SCHEDULE: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}`,
@@ -52080,6 +52087,9 @@ var ENDPOINTS = {
   ORG_EDGE_PROFILES: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
   // Per-profile egress proxy (hosted Cloud Profiles; manager-only, human-only).
   ORG_EDGE_PROFILE_PROXY: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/proxy`,
+  // Per-profile one-shot cookie seed (hosted Cloud Profiles; manager-only,
+  // human-only, idle-only). Injected at the next cold start, then consumed.
+  ORG_EDGE_PROFILE_COOKIES: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/cookies`,
   ORG_EDGE_EXEC: (orgId) => `/api/v1/orgs/${orgId}/edge/exec`,
   // Cloud Edge live viewer command (V1b) — api-server, gated on cap:edge-viewer.
   // Same request/reply shape as the v2 browser-profile viewer, on the v3 edge
@@ -52121,6 +52131,7 @@ var WS_EVENTS = {
   PONG: "pong",
   WATCHING: "watching",
   MESSAGE_NEW: "message.new",
+  /** @deprecated `message.patch` is retired and never published; kept for compile compatibility. */
   MESSAGE_PATCH: "message.patch",
   MESSAGE_EDIT: "message.edit",
   MESSAGE_DELETE: "message.delete",
@@ -52316,6 +52327,62 @@ var ProjectTaskClient = class {
   async deleteProject(orgId, projectId) {
     return this.request("DELETE", ENDPOINTS.PROJECT(orgId, projectId));
   }
+  /** Roster with display info; readable by anyone who can read the project. */
+  async getProjectMembers(orgId, projectId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_MEMBERS(orgId, projectId));
+    return res.data;
+  }
+  /**
+   * User IDs who may read the project — the assignee-eligibility set. Every
+   * tier answers the roster expansion (direct, team-reached, org
+   * owners/admins); visibility only shapes admission, never reach.
+   */
+  async getProjectReaders(orgId, projectId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_READERS(orgId, projectId));
+    return res.data;
+  }
+  /** The join library: every discoverable project (public + restricted, plus
+   * private for org owners/admins) with the caller's admission state. */
+  async getProjectLibrary(orgId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_LIBRARY(orgId));
+    return res.data;
+  }
+  /** Public-tier self-admission: writes the caller's own member row.
+   * Other tiers answer `404 PROJECT_NOT_FOUND`; a duplicate answers
+   * `409 MEMBER_EXISTS`. */
+  async joinProject(orgId, projectId) {
+    return this.request("POST", ENDPOINTS.PROJECT_JOIN(orgId, projectId));
+  }
+  /** Restricted-tier admission petition. A pending duplicate answers
+   * `409 REQUEST_EXISTS`; membership answers `409 MEMBER_EXISTS`. */
+  async createProjectJoinRequest(orgId, projectId) {
+    return this.request("POST", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+  }
+  /** Pending petitions for one project — manager standing required. */
+  async listProjectJoinRequests(orgId, projectId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+    return res.data;
+  }
+  /** Withdraws the caller's own pending petition. */
+  async cancelProjectJoinRequest(orgId, projectId) {
+    return this.request("DELETE", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+  }
+  /**
+   * Adds one subject (user ID or team ID) to the roster. Manager-only,
+   * create-only: an existing row answers `409 MEMBER_EXISTS` — change roles
+   * through updateProjectMember instead.
+   */
+  async addProjectMember(orgId, projectId, req) {
+    return this.request("POST", ENDPOINTS.PROJECT_MEMBERS(orgId, projectId), req);
+  }
+  /** Sets one roster entry's role. Demoting the last manager answers `400 LAST_MANAGER`. */
+  async updateProjectMember(orgId, projectId, subject, req) {
+    return this.request("PATCH", ENDPOINTS.PROJECT_MEMBER(orgId, projectId, subject), req);
+  }
+  /** Removes one roster entry. Removing the last manager answers `400 LAST_MANAGER`. */
+  async removeProjectMember(orgId, projectId, subject) {
+    return this.request("DELETE", ENDPOINTS.PROJECT_MEMBER(orgId, projectId, subject));
+  }
 };
 
 // ts/sdk/dist/task-label-client.js
@@ -52708,8 +52775,9 @@ var ParallClient = class _ParallClient extends TaskLabelClient {
     return this.request("POST", ENDPOINTS.TEAMS(orgId), req);
   }
   /**
-   * Renames a team. The slug cannot be changed — wiki ACL rows reference it as
-   * `@slug`, so the server answers 400 SLUG_IMMUTABLE if one is sent.
+   * Renames a team. Renaming is an ordinary edit: ACL rows reference teams by
+   * ID. Names are org-unique (case-insensitive); a duplicate answers 409
+   * NAME_TAKEN.
    */
   async updateTeam(orgId, teamId, req) {
     return this.request("PATCH", ENDPOINTS.TEAM(orgId, teamId), req);
@@ -54338,15 +54406,18 @@ var ParallClient = class _ParallClient extends TaskLabelClient {
   /**
    * Read a clip's per-org agent exec access. Org-member readable (agents
    * included, so a denied agent can learn why exec answered
-   * `CLIP_AGENT_NOT_ALLOWED`).
+   * `CLIP_AGENT_NOT_ALLOWED` / `CLIP_AGENT_CONNECTION_NOT_ALLOWED`).
    */
   async getClipAgentExecAccess(orgId, clipId) {
     return this.request("GET", ENDPOINTS.ORG_CLIP_EXEC_ACCESS(orgId, clipId));
   }
   /**
    * Replace a clip's per-org agent exec access. Human-only (agent principals
-   * get 403); under `all_agents` the `agent_ids` must be empty. Every granted
-   * id must be an active agent of this org (else `400 INVALID_INPUT`).
+   * get 403); under `all_agents` both lists must be empty; pass either
+   * `agent_ids` (legacy flat form → every agent gets `connection_scope: 'all'`)
+   * or `grants` (connection-scoped), never both. Every granted id must be an
+   * active agent of this org, and every `connection_ids` entry a connection of
+   * THIS clip in this org (else `400 INVALID_INPUT`).
    */
   async putClipAgentExecAccess(orgId, clipId, access) {
     return this.request("PUT", ENDPOINTS.ORG_CLIP_EXEC_ACCESS(orgId, clipId), access);
@@ -54432,6 +54503,41 @@ var ParallClient = class _ParallClient extends TaskLabelClient {
       headers: expectedVersion ? { "If-Match": `"proxy-${expectedVersion}"` } : void 0
     });
   }
+  /**
+   * Read a hosted Cloud Profile's one-shot cookie-seed status (manager-only:
+   * hosted human maintainer or org admin). Sanitized — cookie VALUES never come
+   * back, only `cookie_count` and the distinct target `domains`. `can_mutate` /
+   * `lease_status` are the authoritative idle gate. Typed errors: `EDGE_NOT_HOSTED`
+   * (BYOC device), `NOT_FOUND` (unknown profile).
+   */
+  async getEdgeProfileCookieSeed(orgId, edgeId, profileName) {
+    return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName));
+  }
+  /**
+   * Set/replace the profile's one-shot cookie seed (the full normalized cookie
+   * array every time) — IDLE ONLY: while the profile's hosted browser is running
+   * the server answers 409 `EDGE_PROFILE_IN_USE`; close the viewer, wait for idle
+   * scale-to-zero, and retry. The next cold start injects the cookies into the
+   * profile partition and consumes the seed. Other typed errors:
+   * `EDGE_COOKIE_SEED_STALE` (409 — expectedVersion lost a tab race, sent as the
+   * `cookieseed-<version>` If-Match), `EDGE_DELETING` (409), and
+   * `SECRETBOX_UNCONFIGURED` (503 — server cannot store cookies safely).
+   */
+  async setEdgeProfileCookieSeed(orgId, edgeId, profileName, req, expectedVersion) {
+    return this.request("PUT", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName), req, void 0, false, {
+      headers: expectedVersion ? { "If-Match": `"cookieseed-${expectedVersion}"` } : void 0
+    });
+  }
+  /**
+   * Clear the pending cookie seed (does NOT sign the profile out — cookies
+   * already injected into the partition stay). Idle-only like set — 409
+   * `EDGE_PROFILE_IN_USE` while the browser is live.
+   */
+  async clearEdgeProfileCookieSeed(orgId, edgeId, profileName, expectedVersion) {
+    return this.request("DELETE", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName), void 0, void 0, false, {
+      headers: expectedVersion ? { "If-Match": `"cookieseed-${expectedVersion}"` } : void 0
+    });
+  }
   /**
    * Execute a registry clip command on an Edge device.
    *
@@ -60516,6 +60622,7 @@ function parseTweets(data) { /* ... */ }
 - \`tab.cookie(name)\` \xB7 \`tab.fetch(url, opts)\` (in-browser fetch, carries the session)
 - \`tab.eval(expr)\` (escape hatch) \xB7 \`tab.click(sel)\` \xB7 \`tab.fill(sel, text)\` \xB7 \`tab.navigate(url)\`
 - \`tab.waitForSelector(sel)\` \xB7 \`tab.getTitle()\` \xB7 \`tab.getURL()\` \xB7 \`tab.screenshot()\` \xB7 \`tab.close()\`
+- \`tab.setFileInput(sel, url, opts?)\` \u2014 upload a file into an \`<input type=file>\`
 - \`fetch\` \u2014 runtime-side HTTP, does NOT go through the browser (no session)
 - \`console\` \u2014 logs \xB7 \`args\` \u2014 the invocation input
 
@@ -60524,6 +60631,40 @@ returns structured data; eval is the last resort. Always \`tab.close()\` what yo
 open, and do it in a \`finally\` \u2014 an early return or a thrown fetch is exactly
 when the tab leaks.
 
+### Uploading a file
+
+\`tab.setFileInput\` takes a URL, never a path, and the runtime \u2014 not the page \u2014
+fetches the bytes. That is what makes it work where an in-page \`fetch\` +
+\`DataTransfer\` cannot: upload targets ship a Content-Security-Policy that
+forbids the page from fetching an arbitrary file host (Instagram's \`default-src\`
+allows only its own domains), and you cannot change a header on their site. The
+runtime is not a page, so no CSP applies to it \u2014 and a large video never has to
+pass through the page's memory.
+
+\`\`\`js
+await tab.setFileInput("input[type=file]", videoUrl, { filename: "clip.mp4" });
+await tab.click("button[type=submit]");
+await tab.waitForSelector(".upload-complete");   // \u2190 do not skip this
+\`\`\`
+
+Four rules that decide whether your clip works:
+
+1. **The URL must be fetchable with no credentials** \u2014 a public direct link or a
+   signed temporary one. The runtime sends no cookies, so a Drive or Feishu link
+   copied from the address bar will not work: those are HTML pages behind a
+   login. If the file needs a session, use a logged-in tab to obtain a signed
+   direct link first, then pass THAT here. An HTML answer is refused with
+   \`EDGE_FILE_SOURCE_NOT_A_FILE\` rather than uploaded as if it were a file.
+2. **Finish the upload inside the same command.** The browser reads the file when
+   the page submits, and the runtime deletes it when your command ends. Injecting
+   and returning immediately uploads nothing \u2014 wait for the site to confirm.
+3. **Main-document inputs only.** An input inside an iframe or a shadow root is
+   not addressable and returns \`EDGE_FILE_SELECTOR_MISS\`. If the page rebuilds
+   the input after you inject (navigation, re-render), inject again.
+4. **\`opts.filename\` is what the page sees**, and many sites validate by
+   extension \u2014 set it when the URL has none. \`opts.timeoutMs\` bounds the
+   download. One file per call; there is no multi-file form yet.
+
 ## Develop \u2192 publish \u2192 iterate
 
 Use the platform \`parall clip\` subcommands \u2014 they reuse the credentials you
@@ -60630,18 +60771,30 @@ and the folder is just a manifest:
 }
 \`\`\`
 
-- The \`mcp\` block takes ONLY \`server_url\` and \`auth\` (\`"none" | "bearer" |
-  "api_key" | "oauth"\`). Any other key is refused at publish \u2014 a credential
-  belongs to the installing org's own configuration, NEVER to the clip
-  definition.
+- The \`mcp\` block takes ONLY \`server_url\`, \`auth\` (\`"none" | "api_key" |
+  "basic" | "oauth"\`, legacy \`"bearer"\` accepted) and \`auth_headers\`. Any
+  other key is refused at publish \u2014 a credential belongs to the installing
+  org's own configuration, NEVER to the clip definition.
+- \`auth\` is REQUIRED at publish: you know what your server speaks, and this
+  one word decides what the install form asks for (\`none\` = zero input,
+  \`api_key\` = key field(s), \`basic\` = username + password, \`oauth\` = a
+  Connect button).
+- \`api_key\` delivers as a single \`X-API-Key\` header by default. When the
+  server wants a different shape, declare \`auth_headers\` (max 4 slots, one
+  admin-supplied value each): \`[{"name": "Authorization", "scheme":
+  "Bearer"}]\` for Bearer tokens, \`[{"name": "api-key"}]\` for a custom
+  header, or a pair like \`[{"name": "CF-Access-Client-Id"}, {"name":
+  "CF-Access-Client-Secret"}]\`. Framing/platform headers (Host, Cookie,
+  X-Prll-*, \u2026) are refused.
 - \`server_url\` must be an absolute **https** URL with no embedded credentials,
   query, or fragment. It is review material, frozen with the approved version.
+  It stays OPTIONAL for self-hosted products where each org connects its own
+  instance URL.
 - Do NOT put the server in the top-level \`server\` / \`auth\` manifest keys \u2014
   those are legacy Edge-manifest fields nothing reads. Only the \`mcp\` block
   declares the server.
-- Both fields are optional, but what you declare is LOCKED: the installing
-  org's config must match it, and changing the URL or auth mode means
-  republishing.
+- What you declare is LOCKED: the installing org's config must match it, and
+  changing the URL, auth mode, or header shape means republishing.
 - Entering the credential / completing OAuth is a HUMAN step in the Clip
   Console (the config-write endpoints are session-only \u2014 an API key cannot
   call them). An org can add SEVERAL connections to one MCP clip \u2014 one
@@ -60727,14 +60880,17 @@ ${lines.join("\n")}
 }
 
 // ts/agent-core/dist/platform-instructions.js
-function buildBridgePlatformInstructions(workspaceDir, identity, capabilityFragments) {
+function buildPlatformInstructions(workspaceDir, runtimeAppendix, identity, capabilityFragments) {
   return renderPlatformInstructions({
     identity,
-    runtimeAppendix: PLATFORM_BRIDGE_WORKSPACE_INSTRUCTIONS,
+    runtimeAppendix,
     capabilityFragments,
     skillReferences: buildSkillReferences(workspaceDir)
   });
 }
+function buildBridgePlatformInstructions(workspaceDir, identity, capabilityFragments) {
+  return buildPlatformInstructions(workspaceDir, PLATFORM_BRIDGE_WORKSPACE_INSTRUCTIONS, identity, capabilityFragments);
+}
 
 // ts/agent-core/dist/prompt-fragments.js
 function identityFromMe(me) {

package/bundle/parall-codex-agent.js

@@ -51863,6 +51863,13 @@ var ENDPOINTS = {
   PROJECTS: (orgId) => `${API_BASE}/orgs/${orgId}/projects`,
   PROJECT_TASK_SUMMARY: (orgId) => `${API_BASE}/orgs/${orgId}/projects/task-summary`,
   PROJECT: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}`,
+  PROJECT_MEMBERS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/members`,
+  PROJECT_READERS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/readers`,
+  PROJECT_LIBRARY: (orgId) => `${API_BASE}/orgs/${orgId}/projects/library`,
+  PROJECT_JOIN: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/join`,
+  PROJECT_JOIN_REQUESTS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/join-requests`,
+  // subject is a bare user ID or a bare team ID; both are path-segment safe.
+  PROJECT_MEMBER: (orgId, projectId, subject) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/members/${subject}`,
   // Schedules (org-scoped, platform time trigger primitive)
   SCHEDULES: (orgId) => `${API_BASE}/orgs/${orgId}/schedules`,
   SCHEDULE: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}`,
@@ -52080,6 +52087,9 @@ var ENDPOINTS = {
   ORG_EDGE_PROFILES: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
   // Per-profile egress proxy (hosted Cloud Profiles; manager-only, human-only).
   ORG_EDGE_PROFILE_PROXY: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/proxy`,
+  // Per-profile one-shot cookie seed (hosted Cloud Profiles; manager-only,
+  // human-only, idle-only). Injected at the next cold start, then consumed.
+  ORG_EDGE_PROFILE_COOKIES: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/cookies`,
   ORG_EDGE_EXEC: (orgId) => `/api/v1/orgs/${orgId}/edge/exec`,
   // Cloud Edge live viewer command (V1b) — api-server, gated on cap:edge-viewer.
   // Same request/reply shape as the v2 browser-profile viewer, on the v3 edge
@@ -52121,6 +52131,7 @@ var WS_EVENTS = {
   PONG: "pong",
   WATCHING: "watching",
   MESSAGE_NEW: "message.new",
+  /** @deprecated `message.patch` is retired and never published; kept for compile compatibility. */
   MESSAGE_PATCH: "message.patch",
   MESSAGE_EDIT: "message.edit",
   MESSAGE_DELETE: "message.delete",
@@ -52316,6 +52327,62 @@ var ProjectTaskClient = class {
   async deleteProject(orgId, projectId) {
     return this.request("DELETE", ENDPOINTS.PROJECT(orgId, projectId));
   }
+  /** Roster with display info; readable by anyone who can read the project. */
+  async getProjectMembers(orgId, projectId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_MEMBERS(orgId, projectId));
+    return res.data;
+  }
+  /**
+   * User IDs who may read the project — the assignee-eligibility set. Every
+   * tier answers the roster expansion (direct, team-reached, org
+   * owners/admins); visibility only shapes admission, never reach.
+   */
+  async getProjectReaders(orgId, projectId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_READERS(orgId, projectId));
+    return res.data;
+  }
+  /** The join library: every discoverable project (public + restricted, plus
+   * private for org owners/admins) with the caller's admission state. */
+  async getProjectLibrary(orgId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_LIBRARY(orgId));
+    return res.data;
+  }
+  /** Public-tier self-admission: writes the caller's own member row.
+   * Other tiers answer `404 PROJECT_NOT_FOUND`; a duplicate answers
+   * `409 MEMBER_EXISTS`. */
+  async joinProject(orgId, projectId) {
+    return this.request("POST", ENDPOINTS.PROJECT_JOIN(orgId, projectId));
+  }
+  /** Restricted-tier admission petition. A pending duplicate answers
+   * `409 REQUEST_EXISTS`; membership answers `409 MEMBER_EXISTS`. */
+  async createProjectJoinRequest(orgId, projectId) {
+    return this.request("POST", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+  }
+  /** Pending petitions for one project — manager standing required. */
+  async listProjectJoinRequests(orgId, projectId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+    return res.data;
+  }
+  /** Withdraws the caller's own pending petition. */
+  async cancelProjectJoinRequest(orgId, projectId) {
+    return this.request("DELETE", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+  }
+  /**
+   * Adds one subject (user ID or team ID) to the roster. Manager-only,
+   * create-only: an existing row answers `409 MEMBER_EXISTS` — change roles
+   * through updateProjectMember instead.
+   */
+  async addProjectMember(orgId, projectId, req) {
+    return this.request("POST", ENDPOINTS.PROJECT_MEMBERS(orgId, projectId), req);
+  }
+  /** Sets one roster entry's role. Demoting the last manager answers `400 LAST_MANAGER`. */
+  async updateProjectMember(orgId, projectId, subject, req) {
+    return this.request("PATCH", ENDPOINTS.PROJECT_MEMBER(orgId, projectId, subject), req);
+  }
+  /** Removes one roster entry. Removing the last manager answers `400 LAST_MANAGER`. */
+  async removeProjectMember(orgId, projectId, subject) {
+    return this.request("DELETE", ENDPOINTS.PROJECT_MEMBER(orgId, projectId, subject));
+  }
 };
 
 // ts/sdk/dist/task-label-client.js
@@ -52708,8 +52775,9 @@ var ParallClient = class _ParallClient extends TaskLabelClient {
     return this.request("POST", ENDPOINTS.TEAMS(orgId), req);
   }
   /**
-   * Renames a team. The slug cannot be changed — wiki ACL rows reference it as
-   * `@slug`, so the server answers 400 SLUG_IMMUTABLE if one is sent.
+   * Renames a team. Renaming is an ordinary edit: ACL rows reference teams by
+   * ID. Names are org-unique (case-insensitive); a duplicate answers 409
+   * NAME_TAKEN.
    */
   async updateTeam(orgId, teamId, req) {
     return this.request("PATCH", ENDPOINTS.TEAM(orgId, teamId), req);
@@ -54338,15 +54406,18 @@ var ParallClient = class _ParallClient extends TaskLabelClient {
   /**
    * Read a clip's per-org agent exec access. Org-member readable (agents
    * included, so a denied agent can learn why exec answered
-   * `CLIP_AGENT_NOT_ALLOWED`).
+   * `CLIP_AGENT_NOT_ALLOWED` / `CLIP_AGENT_CONNECTION_NOT_ALLOWED`).
    */
   async getClipAgentExecAccess(orgId, clipId) {
     return this.request("GET", ENDPOINTS.ORG_CLIP_EXEC_ACCESS(orgId, clipId));
   }
   /**
    * Replace a clip's per-org agent exec access. Human-only (agent principals
-   * get 403); under `all_agents` the `agent_ids` must be empty. Every granted
-   * id must be an active agent of this org (else `400 INVALID_INPUT`).
+   * get 403); under `all_agents` both lists must be empty; pass either
+   * `agent_ids` (legacy flat form → every agent gets `connection_scope: 'all'`)
+   * or `grants` (connection-scoped), never both. Every granted id must be an
+   * active agent of this org, and every `connection_ids` entry a connection of
+   * THIS clip in this org (else `400 INVALID_INPUT`).
    */
   async putClipAgentExecAccess(orgId, clipId, access) {
     return this.request("PUT", ENDPOINTS.ORG_CLIP_EXEC_ACCESS(orgId, clipId), access);
@@ -54432,6 +54503,41 @@ var ParallClient = class _ParallClient extends TaskLabelClient {
       headers: expectedVersion ? { "If-Match": `"proxy-${expectedVersion}"` } : void 0
     });
   }
+  /**
+   * Read a hosted Cloud Profile's one-shot cookie-seed status (manager-only:
+   * hosted human maintainer or org admin). Sanitized — cookie VALUES never come
+   * back, only `cookie_count` and the distinct target `domains`. `can_mutate` /
+   * `lease_status` are the authoritative idle gate. Typed errors: `EDGE_NOT_HOSTED`
+   * (BYOC device), `NOT_FOUND` (unknown profile).
+   */
+  async getEdgeProfileCookieSeed(orgId, edgeId, profileName) {
+    return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName));
+  }
+  /**
+   * Set/replace the profile's one-shot cookie seed (the full normalized cookie
+   * array every time) — IDLE ONLY: while the profile's hosted browser is running
+   * the server answers 409 `EDGE_PROFILE_IN_USE`; close the viewer, wait for idle
+   * scale-to-zero, and retry. The next cold start injects the cookies into the
+   * profile partition and consumes the seed. Other typed errors:
+   * `EDGE_COOKIE_SEED_STALE` (409 — expectedVersion lost a tab race, sent as the
+   * `cookieseed-<version>` If-Match), `EDGE_DELETING` (409), and
+   * `SECRETBOX_UNCONFIGURED` (503 — server cannot store cookies safely).
+   */
+  async setEdgeProfileCookieSeed(orgId, edgeId, profileName, req, expectedVersion) {
+    return this.request("PUT", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName), req, void 0, false, {
+      headers: expectedVersion ? { "If-Match": `"cookieseed-${expectedVersion}"` } : void 0
+    });
+  }
+  /**
+   * Clear the pending cookie seed (does NOT sign the profile out — cookies
+   * already injected into the partition stay). Idle-only like set — 409
+   * `EDGE_PROFILE_IN_USE` while the browser is live.
+   */
+  async clearEdgeProfileCookieSeed(orgId, edgeId, profileName, expectedVersion) {
+    return this.request("DELETE", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName), void 0, void 0, false, {
+      headers: expectedVersion ? { "If-Match": `"cookieseed-${expectedVersion}"` } : void 0
+    });
+  }
   /**
    * Execute a registry clip command on an Edge device.
    *
@@ -59501,6 +59607,9 @@ function createPlatformConfigManager(opts) {
   };
 }
 
+// ts/agent-core/dist/generated/codex-message-delivery.js
+var PLATFORM_CODEX_MESSAGE_DELIVERY_INSTRUCTIONS = "### Codex message delivery\n\nCodex's native `commentary` and `final` prose is not a Parall message. The\nbridge records that prose only as a suppressed session step; nobody in the chat\nsees it. Tool calls made from `commentary` still execute, so use the shell/exec\ntool there to run the Parall CLI.\n\nThroughout these Parall instructions, \u201Creply\u201D, \u201Csay\u201D, \u201Cask\u201D, \u201Creport\u201D,\n\u201Cupdate\u201D, and \u201Ccommunicate\u201D mean creating a collaborator-visible Parall\nartifact through the CLI, never emitting runtime-native assistant prose.\n\nWhen the current event warrants a visible response, deliver acknowledgements,\nmeaningful progress, blockers or questions, requested status, and final results\nwith `parall messages send` or `parall dm`. Native `commentary` or `final` prose\ndoes not satisfy that communication requirement. A reply is delivered only\nafter the CLI command succeeds.\n\nDo not mirror every routine runtime commentary heartbeat into the chat. After a\nsuccessful send, native `final` output is only an audit record and does not need\nto duplicate the collaborator-visible message.";
+
 // ts/agent-core/dist/skills/index.js
 import * as fs5 from "node:fs";
 import * as path5 from "node:path";
@@ -60516,6 +60625,7 @@ function parseTweets(data) { /* ... */ }
 - \`tab.cookie(name)\` \xB7 \`tab.fetch(url, opts)\` (in-browser fetch, carries the session)
 - \`tab.eval(expr)\` (escape hatch) \xB7 \`tab.click(sel)\` \xB7 \`tab.fill(sel, text)\` \xB7 \`tab.navigate(url)\`
 - \`tab.waitForSelector(sel)\` \xB7 \`tab.getTitle()\` \xB7 \`tab.getURL()\` \xB7 \`tab.screenshot()\` \xB7 \`tab.close()\`
+- \`tab.setFileInput(sel, url, opts?)\` \u2014 upload a file into an \`<input type=file>\`
 - \`fetch\` \u2014 runtime-side HTTP, does NOT go through the browser (no session)
 - \`console\` \u2014 logs \xB7 \`args\` \u2014 the invocation input
 
@@ -60524,6 +60634,40 @@ returns structured data; eval is the last resort. Always \`tab.close()\` what yo
 open, and do it in a \`finally\` \u2014 an early return or a thrown fetch is exactly
 when the tab leaks.
 
+### Uploading a file
+
+\`tab.setFileInput\` takes a URL, never a path, and the runtime \u2014 not the page \u2014
+fetches the bytes. That is what makes it work where an in-page \`fetch\` +
+\`DataTransfer\` cannot: upload targets ship a Content-Security-Policy that
+forbids the page from fetching an arbitrary file host (Instagram's \`default-src\`
+allows only its own domains), and you cannot change a header on their site. The
+runtime is not a page, so no CSP applies to it \u2014 and a large video never has to
+pass through the page's memory.
+
+\`\`\`js
+await tab.setFileInput("input[type=file]", videoUrl, { filename: "clip.mp4" });
+await tab.click("button[type=submit]");
+await tab.waitForSelector(".upload-complete");   // \u2190 do not skip this
+\`\`\`
+
+Four rules that decide whether your clip works:
+
+1. **The URL must be fetchable with no credentials** \u2014 a public direct link or a
+   signed temporary one. The runtime sends no cookies, so a Drive or Feishu link
+   copied from the address bar will not work: those are HTML pages behind a
+   login. If the file needs a session, use a logged-in tab to obtain a signed
+   direct link first, then pass THAT here. An HTML answer is refused with
+   \`EDGE_FILE_SOURCE_NOT_A_FILE\` rather than uploaded as if it were a file.
+2. **Finish the upload inside the same command.** The browser reads the file when
+   the page submits, and the runtime deletes it when your command ends. Injecting
+   and returning immediately uploads nothing \u2014 wait for the site to confirm.
+3. **Main-document inputs only.** An input inside an iframe or a shadow root is
+   not addressable and returns \`EDGE_FILE_SELECTOR_MISS\`. If the page rebuilds
+   the input after you inject (navigation, re-render), inject again.
+4. **\`opts.filename\` is what the page sees**, and many sites validate by
+   extension \u2014 set it when the URL has none. \`opts.timeoutMs\` bounds the
+   download. One file per call; there is no multi-file form yet.
+
 ## Develop \u2192 publish \u2192 iterate
 
 Use the platform \`parall clip\` subcommands \u2014 they reuse the credentials you
@@ -60630,18 +60774,30 @@ and the folder is just a manifest:
 }
 \`\`\`
 
-- The \`mcp\` block takes ONLY \`server_url\` and \`auth\` (\`"none" | "bearer" |
-  "api_key" | "oauth"\`). Any other key is refused at publish \u2014 a credential
-  belongs to the installing org's own configuration, NEVER to the clip
-  definition.
+- The \`mcp\` block takes ONLY \`server_url\`, \`auth\` (\`"none" | "api_key" |
+  "basic" | "oauth"\`, legacy \`"bearer"\` accepted) and \`auth_headers\`. Any
+  other key is refused at publish \u2014 a credential belongs to the installing
+  org's own configuration, NEVER to the clip definition.
+- \`auth\` is REQUIRED at publish: you know what your server speaks, and this
+  one word decides what the install form asks for (\`none\` = zero input,
+  \`api_key\` = key field(s), \`basic\` = username + password, \`oauth\` = a
+  Connect button).
+- \`api_key\` delivers as a single \`X-API-Key\` header by default. When the
+  server wants a different shape, declare \`auth_headers\` (max 4 slots, one
+  admin-supplied value each): \`[{"name": "Authorization", "scheme":
+  "Bearer"}]\` for Bearer tokens, \`[{"name": "api-key"}]\` for a custom
+  header, or a pair like \`[{"name": "CF-Access-Client-Id"}, {"name":
+  "CF-Access-Client-Secret"}]\`. Framing/platform headers (Host, Cookie,
+  X-Prll-*, \u2026) are refused.
 - \`server_url\` must be an absolute **https** URL with no embedded credentials,
   query, or fragment. It is review material, frozen with the approved version.
+  It stays OPTIONAL for self-hosted products where each org connects its own
+  instance URL.
 - Do NOT put the server in the top-level \`server\` / \`auth\` manifest keys \u2014
   those are legacy Edge-manifest fields nothing reads. Only the \`mcp\` block
   declares the server.
-- Both fields are optional, but what you declare is LOCKED: the installing
-  org's config must match it, and changing the URL or auth mode means
-  republishing.
+- What you declare is LOCKED: the installing org's config must match it, and
+  changing the URL, auth mode, or header shape means republishing.
 - Entering the credential / completing OAuth is a HUMAN step in the Clip
   Console (the config-write endpoints are session-only \u2014 an API key cannot
   call them). An org can add SEVERAL connections to one MCP clip \u2014 one
@@ -60727,14 +60883,17 @@ ${lines.join("\n")}
 }
 
 // ts/agent-core/dist/platform-instructions.js
-function buildBridgePlatformInstructions(workspaceDir, identity, capabilityFragments) {
+function buildPlatformInstructions(workspaceDir, runtimeAppendix, identity, capabilityFragments) {
   return renderPlatformInstructions({
     identity,
-    runtimeAppendix: PLATFORM_BRIDGE_WORKSPACE_INSTRUCTIONS,
+    runtimeAppendix,
     capabilityFragments,
     skillReferences: buildSkillReferences(workspaceDir)
   });
 }
+function buildCodexPlatformInstructions(workspaceDir, identity, capabilityFragments) {
+  return buildPlatformInstructions(workspaceDir, [PLATFORM_BRIDGE_WORKSPACE_INSTRUCTIONS, PLATFORM_CODEX_MESSAGE_DELIVERY_INSTRUCTIONS].join("\n\n"), identity, capabilityFragments);
+}
 
 // ts/agent-core/dist/prompt-fragments.js
 function identityFromMe(me) {
@@ -63591,7 +63750,7 @@ function systemPromptCopyPath(workspaceDir) {
   return path11.join(workspaceDir, ".parall", "system-prompt.md");
 }
 function writeCodexSystemPrompt(workspaceDir, agentIdentity, capabilityFragments) {
-  const systemPrompt = buildBridgePlatformInstructions(workspaceDir, agentIdentity, capabilityFragments);
+  const systemPrompt = buildCodexPlatformInstructions(workspaceDir, agentIdentity, capabilityFragments);
   fs10.mkdirSync(path11.join(workspaceDir, ".parall"), { recursive: true });
   fs10.writeFileSync(systemPromptCopyPath(workspaceDir), systemPrompt, "utf8");
   return systemPrompt;

package/bundle/parall-daemon.js

@@ -354,6 +354,13 @@ var init_constants = __esm({
       PROJECTS: (orgId) => `${API_BASE}/orgs/${orgId}/projects`,
       PROJECT_TASK_SUMMARY: (orgId) => `${API_BASE}/orgs/${orgId}/projects/task-summary`,
       PROJECT: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}`,
+      PROJECT_MEMBERS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/members`,
+      PROJECT_READERS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/readers`,
+      PROJECT_LIBRARY: (orgId) => `${API_BASE}/orgs/${orgId}/projects/library`,
+      PROJECT_JOIN: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/join`,
+      PROJECT_JOIN_REQUESTS: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/join-requests`,
+      // subject is a bare user ID or a bare team ID; both are path-segment safe.
+      PROJECT_MEMBER: (orgId, projectId, subject) => `${API_BASE}/orgs/${orgId}/projects/${projectId}/members/${subject}`,
       // Schedules (org-scoped, platform time trigger primitive)
       SCHEDULES: (orgId) => `${API_BASE}/orgs/${orgId}/schedules`,
       SCHEDULE: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}`,
@@ -571,6 +578,9 @@ var init_constants = __esm({
       ORG_EDGE_PROFILES: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
       // Per-profile egress proxy (hosted Cloud Profiles; manager-only, human-only).
       ORG_EDGE_PROFILE_PROXY: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/proxy`,
+      // Per-profile one-shot cookie seed (hosted Cloud Profiles; manager-only,
+      // human-only, idle-only). Injected at the next cold start, then consumed.
+      ORG_EDGE_PROFILE_COOKIES: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/cookies`,
       ORG_EDGE_EXEC: (orgId) => `/api/v1/orgs/${orgId}/edge/exec`,
       // Cloud Edge live viewer command (V1b) — api-server, gated on cap:edge-viewer.
       // Same request/reply shape as the v2 browser-profile viewer, on the v3 edge
@@ -612,6 +622,7 @@ var init_constants = __esm({
       PONG: "pong",
       WATCHING: "watching",
       MESSAGE_NEW: "message.new",
+      /** @deprecated `message.patch` is retired and never published; kept for compile compatibility. */
       MESSAGE_PATCH: "message.patch",
       MESSAGE_EDIT: "message.edit",
       MESSAGE_DELETE: "message.delete",
@@ -814,6 +825,62 @@ var init_project_task_client = __esm({
       async deleteProject(orgId, projectId) {
         return this.request("DELETE", ENDPOINTS.PROJECT(orgId, projectId));
       }
+      /** Roster with display info; readable by anyone who can read the project. */
+      async getProjectMembers(orgId, projectId) {
+        const res = await this.request("GET", ENDPOINTS.PROJECT_MEMBERS(orgId, projectId));
+        return res.data;
+      }
+      /**
+       * User IDs who may read the project — the assignee-eligibility set. Every
+       * tier answers the roster expansion (direct, team-reached, org
+       * owners/admins); visibility only shapes admission, never reach.
+       */
+      async getProjectReaders(orgId, projectId) {
+        const res = await this.request("GET", ENDPOINTS.PROJECT_READERS(orgId, projectId));
+        return res.data;
+      }
+      /** The join library: every discoverable project (public + restricted, plus
+       * private for org owners/admins) with the caller's admission state. */
+      async getProjectLibrary(orgId) {
+        const res = await this.request("GET", ENDPOINTS.PROJECT_LIBRARY(orgId));
+        return res.data;
+      }
+      /** Public-tier self-admission: writes the caller's own member row.
+       * Other tiers answer `404 PROJECT_NOT_FOUND`; a duplicate answers
+       * `409 MEMBER_EXISTS`. */
+      async joinProject(orgId, projectId) {
+        return this.request("POST", ENDPOINTS.PROJECT_JOIN(orgId, projectId));
+      }
+      /** Restricted-tier admission petition. A pending duplicate answers
+       * `409 REQUEST_EXISTS`; membership answers `409 MEMBER_EXISTS`. */
+      async createProjectJoinRequest(orgId, projectId) {
+        return this.request("POST", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+      }
+      /** Pending petitions for one project — manager standing required. */
+      async listProjectJoinRequests(orgId, projectId) {
+        const res = await this.request("GET", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+        return res.data;
+      }
+      /** Withdraws the caller's own pending petition. */
+      async cancelProjectJoinRequest(orgId, projectId) {
+        return this.request("DELETE", ENDPOINTS.PROJECT_JOIN_REQUESTS(orgId, projectId));
+      }
+      /**
+       * Adds one subject (user ID or team ID) to the roster. Manager-only,
+       * create-only: an existing row answers `409 MEMBER_EXISTS` — change roles
+       * through updateProjectMember instead.
+       */
+      async addProjectMember(orgId, projectId, req) {
+        return this.request("POST", ENDPOINTS.PROJECT_MEMBERS(orgId, projectId), req);
+      }
+      /** Sets one roster entry's role. Demoting the last manager answers `400 LAST_MANAGER`. */
+      async updateProjectMember(orgId, projectId, subject, req) {
+        return this.request("PATCH", ENDPOINTS.PROJECT_MEMBER(orgId, projectId, subject), req);
+      }
+      /** Removes one roster entry. Removing the last manager answers `400 LAST_MANAGER`. */
+      async removeProjectMember(orgId, projectId, subject) {
+        return this.request("DELETE", ENDPOINTS.PROJECT_MEMBER(orgId, projectId, subject));
+      }
     };
   }
 });
@@ -1260,8 +1327,9 @@ var init_client = __esm({
         return this.request("POST", ENDPOINTS.TEAMS(orgId), req);
       }
       /**
-       * Renames a team. The slug cannot be changed — wiki ACL rows reference it as
-       * `@slug`, so the server answers 400 SLUG_IMMUTABLE if one is sent.
+       * Renames a team. Renaming is an ordinary edit: ACL rows reference teams by
+       * ID. Names are org-unique (case-insensitive); a duplicate answers 409
+       * NAME_TAKEN.
        */
       async updateTeam(orgId, teamId, req) {
         return this.request("PATCH", ENDPOINTS.TEAM(orgId, teamId), req);
@@ -2890,15 +2958,18 @@ var init_client = __esm({
       /**
        * Read a clip's per-org agent exec access. Org-member readable (agents
        * included, so a denied agent can learn why exec answered
-       * `CLIP_AGENT_NOT_ALLOWED`).
+       * `CLIP_AGENT_NOT_ALLOWED` / `CLIP_AGENT_CONNECTION_NOT_ALLOWED`).
        */
       async getClipAgentExecAccess(orgId, clipId) {
         return this.request("GET", ENDPOINTS.ORG_CLIP_EXEC_ACCESS(orgId, clipId));
       }
       /**
        * Replace a clip's per-org agent exec access. Human-only (agent principals
-       * get 403); under `all_agents` the `agent_ids` must be empty. Every granted
-       * id must be an active agent of this org (else `400 INVALID_INPUT`).
+       * get 403); under `all_agents` both lists must be empty; pass either
+       * `agent_ids` (legacy flat form → every agent gets `connection_scope: 'all'`)
+       * or `grants` (connection-scoped), never both. Every granted id must be an
+       * active agent of this org, and every `connection_ids` entry a connection of
+       * THIS clip in this org (else `400 INVALID_INPUT`).
        */
       async putClipAgentExecAccess(orgId, clipId, access) {
         return this.request("PUT", ENDPOINTS.ORG_CLIP_EXEC_ACCESS(orgId, clipId), access);
@@ -2984,6 +3055,41 @@ var init_client = __esm({
           headers: expectedVersion ? { "If-Match": `"proxy-${expectedVersion}"` } : void 0
         });
       }
+      /**
+       * Read a hosted Cloud Profile's one-shot cookie-seed status (manager-only:
+       * hosted human maintainer or org admin). Sanitized — cookie VALUES never come
+       * back, only `cookie_count` and the distinct target `domains`. `can_mutate` /
+       * `lease_status` are the authoritative idle gate. Typed errors: `EDGE_NOT_HOSTED`
+       * (BYOC device), `NOT_FOUND` (unknown profile).
+       */
+      async getEdgeProfileCookieSeed(orgId, edgeId, profileName) {
+        return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName));
+      }
+      /**
+       * Set/replace the profile's one-shot cookie seed (the full normalized cookie
+       * array every time) — IDLE ONLY: while the profile's hosted browser is running
+       * the server answers 409 `EDGE_PROFILE_IN_USE`; close the viewer, wait for idle
+       * scale-to-zero, and retry. The next cold start injects the cookies into the
+       * profile partition and consumes the seed. Other typed errors:
+       * `EDGE_COOKIE_SEED_STALE` (409 — expectedVersion lost a tab race, sent as the
+       * `cookieseed-<version>` If-Match), `EDGE_DELETING` (409), and
+       * `SECRETBOX_UNCONFIGURED` (503 — server cannot store cookies safely).
+       */
+      async setEdgeProfileCookieSeed(orgId, edgeId, profileName, req, expectedVersion) {
+        return this.request("PUT", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName), req, void 0, false, {
+          headers: expectedVersion ? { "If-Match": `"cookieseed-${expectedVersion}"` } : void 0
+        });
+      }
+      /**
+       * Clear the pending cookie seed (does NOT sign the profile out — cookies
+       * already injected into the partition stay). Idle-only like set — 409
+       * `EDGE_PROFILE_IN_USE` while the browser is live.
+       */
+      async clearEdgeProfileCookieSeed(orgId, edgeId, profileName, expectedVersion) {
+        return this.request("DELETE", ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName), void 0, void 0, false, {
+          headers: expectedVersion ? { "If-Match": `"cookieseed-${expectedVersion}"` } : void 0
+        });
+      }
       /**
        * Execute a registry clip command on an Edge device.
        *
@@ -55014,6 +55120,13 @@ var init_platform_config = __esm({
   }
 });
 
+// ts/agent-core/dist/generated/codex-message-delivery.js
+var init_codex_message_delivery = __esm({
+  "ts/agent-core/dist/generated/codex-message-delivery.js"() {
+    "use strict";
+  }
+});
+
 // ts/agent-core/dist/skills/parall-platform.js
 var init_parall_platform = __esm({
   "ts/agent-core/dist/skills/parall-platform.js"() {
@@ -55088,8 +55201,10 @@ var init_skills = __esm({
 var init_platform_instructions2 = __esm({
   "ts/agent-core/dist/platform-instructions.js"() {
     "use strict";
+    init_codex_message_delivery();
     init_platform_instructions();
     init_skills();
+    init_codex_message_delivery();
     init_platform_instructions();
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/daemon",
-  "version": "1.55.0",
+  "version": "1.55.1",
   "description": "Parall local agent runtime — daemon supervisor + bridge runtimes, bundled as standalone JS files",
   "license": "MIT",
   "repository": {
@@ -33,11 +33,11 @@
     "@aws-sdk/client-s3": "3.984.0",
     "@pinixai/bb-browser-pro": "0.15.0",
     "ws": "^8.18.0",
-    "@parall/agent-core": "1.55.0",
-    "@parall/sdk": "1.55.0",
-    "@parall/claude-agent": "1.55.0",
-    "@parall/codex-agent": "1.55.0",
-    "@parall/openclaw-agent": "1.55.0"
+    "@parall/sdk": "1.55.1",
+    "@parall/claude-agent": "1.55.1",
+    "@parall/codex-agent": "1.55.1",
+    "@parall/openclaw-agent": "1.55.1",
+    "@parall/agent-core": "1.55.1"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",