@parall/daemon 1.55.4 → 1.56.0

package/bundle/parall-claude-agent.js

@@ -51481,6 +51481,12 @@ function isForwardedMessageBody(body) {
 function sanitizeMeta(value) {
   return value.replace(/[\r\n]+/g, " ").replace(/[[\]|]/g, " ").trim();
 }
+function formatApprovalDecisionReason(status, reason) {
+  const normalized = reason?.trim();
+  if (status !== "rejected" || !normalized)
+    return "";
+  return `Reason (JSON): ${JSON.stringify(normalized)}`;
+}
 function buildEventBody(event) {
   const lines = [];
   if (event.type === "message") {
@@ -51498,6 +51504,8 @@ function buildEventBody(event) {
       ].filter(Boolean).join(" | ");
       lines.push(`[Thread: ${threadMeta}]`);
     }
+    if (event.deliveryReason)
+      lines.push(`[Delivery: ${sanitizeMeta(event.deliveryReason)}]`);
     if (event.unreadCount != null && event.unreadCount > 1) {
       const countStr = event.unreadCount >= 1e3 ? "999+" : String(event.unreadCount);
       const sinceStr = event.unreadSince ? ` | since: prll://${event.unreadSince}` : "";
@@ -51701,6 +51709,16 @@ function browserViewerRequestOptions(command, opts) {
   };
 }
 
+// ts/sdk/dist/attachment-endpoints.js
+function attachmentEndpoints(apiBase) {
+  return {
+    UPLOAD_PRESIGN: (orgId) => `${apiBase}/orgs/${orgId}/upload/presign`,
+    UPLOAD_COMPLETE: (orgId) => `${apiBase}/orgs/${orgId}/upload/complete`,
+    UPLOAD_ABORT: (orgId) => `${apiBase}/orgs/${orgId}/upload/abort`,
+    FILE: (id) => `${apiBase}/files/${id}`
+  };
+}
+
 // ts/sdk/dist/constants.js
 var API_BASE = "/api/v1";
 var WIKI_BASE = "/wiki/v1";
@@ -51773,9 +51791,7 @@ var ENDPOINTS = {
   MESSAGE_REACTIONS: (id) => `${API_BASE}/messages/${id}/reactions`,
   MESSAGE_REACTION: (id, emoji) => `${API_BASE}/messages/${id}/reactions/${encodeURIComponent(emoji)}`,
   // Upload (org-scoped)
-  UPLOAD_PRESIGN: (orgId) => `${API_BASE}/orgs/${orgId}/upload/presign`,
-  UPLOAD_COMPLETE: (orgId) => `${API_BASE}/orgs/${orgId}/upload/complete`,
-  FILE: (id) => `${API_BASE}/files/${id}`,
+  ...attachmentEndpoints(API_BASE),
   // Approval requests (org-scoped)
   APPROVAL_REQUESTS: (orgId) => `${API_BASE}/orgs/${orgId}/approval-requests`,
   // Approvals (global)
@@ -51861,6 +51877,7 @@ var ENDPOINTS = {
   TASKS: (orgId) => `${API_BASE}/orgs/${orgId}/tasks`,
   TASK_SUBTASK_SUMMARY: (orgId) => `${API_BASE}/orgs/${orgId}/tasks/subtask-summary`,
   TASK: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}`,
+  TASK_MOVE: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/move`,
   TASK_ARCHIVE: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/archive`,
   TASK_RESTORE: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/restore`,
   TASK_WATCH: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/watch`,
@@ -51956,6 +51973,8 @@ var ENDPOINTS = {
   // backend router so `deleted` isn't captured as a {wikiId}; the SDK builder
   // is just a string.
   WIKIS_DELETED: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis/deleted`,
+  // Org-wide changeset listing across readable wikis (Working on tab).
+  WIKI_ORG_CHANGESETS: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wiki-changesets`,
   // Detail URL — also reused for DELETE (soft-delete) and `${WIKI}/restore`.
   WIKI: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
   WIKI_RESTORE: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restore`,
@@ -51985,6 +52004,12 @@ var ENDPOINTS = {
   // Wiki Path Restrictions (AFCS narrowing ACL — private subtrees)
   WIKI_RESTRICTIONS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions`,
   WIKI_RESTRICTION: (orgId, wikiId, restrictionId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions/${restrictionId}`,
+  WIKI_ACCESS_POLICY: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy`,
+  WIKI_ACCESS_POLICY_MEMBERS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy/members`,
+  WIKI_MEMBERSHIP_SELF: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/membership/self`,
+  // Library-level star (self-scoped bookmark; POST = star, DELETE = unstar).
+  WIKI_STARS_SELF: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/stars/self`,
+  WIKI_MEMBERS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/members`,
   WIKI_ACCESS_STATUS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-status`,
   WIKI_ACCESS_REQUESTS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-requests`,
   // Wiki History (commits, file commits, blame)
@@ -52105,6 +52130,21 @@ var ENDPOINTS = {
   ORG_EDGE_DEVICE_UNREGISTER: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/unregister`,
   ORG_EDGE_ONBOARDING: (orgId) => `/api/v1/orgs/${orgId}/edge/onboarding`,
   ORG_EDGE_PROFILES: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
+  ORG_EDGE_PROFILE_OPERATIONS: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations`,
+  ORG_EDGE_PROFILE_OPERATION: (orgId, edgeId, operationId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}`,
+  ORG_EDGE_PROFILE_OPERATION_CONFIRM: (orgId, edgeId, operationId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}/confirm`,
+  ORG_BROWSER_ALIASES: (orgId) => `/api/v1/orgs/${orgId}/browser-aliases`,
+  ORG_BROWSER_ALIAS: (orgId, aliasId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}`,
+  ORG_BROWSER_ALIAS_READINESS_CHECKS: (orgId, aliasId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks`,
+  ORG_BROWSER_ALIAS_READINESS_CHECK: (orgId, aliasId, checkId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks/${checkId}`,
+  ORG_API_KEY_BROWSER_ALIAS_GRANTS: (orgId, keyId) => `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants`,
+  ORG_API_KEY_BROWSER_ALIAS_GRANT: (orgId, keyId, aliasId) => `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants/${aliasId}`,
+  ORG_MANAGED_ALIASES: (orgId) => `/api/v1/orgs/${orgId}/aliases`,
+  ORG_MANAGED_ALIAS: (orgId, aliasName) => `/api/v1/orgs/${orgId}/aliases/${encodeURIComponent(aliasName)}`,
+  ORG_BROWSER_ALIAS_EXECUTIONS: (orgId) => `/api/v1/orgs/${orgId}/executions`,
+  ORG_BROWSER_ALIAS_EXECUTION: (orgId, requestId) => `/api/v1/orgs/${orgId}/executions/${encodeURIComponent(requestId)}`,
+  ORG_BROWSER_USE_OPERATIONS: (orgId) => `/api/v1/orgs/${orgId}/browser-use/operations`,
+  ORG_BROWSER_USE_OPERATION: (orgId, operationId) => `/api/v1/orgs/${orgId}/browser-use/operations/${encodeURIComponent(operationId)}`,
   // Per-profile egress proxy (hosted Cloud Profiles; manager-only, human-only).
   ORG_EDGE_PROFILE_PROXY: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/proxy`,
   // Per-profile one-shot cookie seed (hosted Cloud Profiles; manager-only,
@@ -52119,6 +52159,8 @@ var ENDPOINTS = {
   CLIP_CONNECTION: (orgId, connId) => `/api/v1/orgs/${orgId}/clip-connections/${connId}`,
   // Clip registry (v3, org-scoped, served by api-server — `crg_` entries)
   ORG_CLIP_REGISTRY: (orgId) => `/api/v1/orgs/${orgId}/clip-registry`,
+  ORG_CLIP_REGISTRY_RESOLVE: (orgId) => `/api/v1/orgs/${orgId}/clip-registry/resolve`,
+  ORG_CLIP_REGISTRY_SEARCH: (orgId) => `/api/v1/orgs/${orgId}/clip-registry/search`,
   ORG_CLIP_REGISTRY_CLIP: (orgId, clipId) => `/api/v1/orgs/${orgId}/clip-registry/${clipId}`,
   ORG_CLIP_REGISTRY_PUBLISH: (orgId) => `/api/v1/orgs/${orgId}/clip-registry/publish`,
   ORG_CLIP_INSTALL: (orgId) => `/api/v1/orgs/${orgId}/clips/install`,
@@ -52252,6 +52294,15 @@ var ProjectTaskClient = class {
   async deleteTask(orgId, taskId, opts) {
     return this.request("DELETE", ENDPOINTS.TASK(orgId, taskId), void 0, opts?.force ? { force: "true" } : void 0);
   }
+  /**
+   * Moves a task and its whole subtree into another project (renumbering it
+   * there; old identifiers stay resolvable as aliases). The caller needs
+   * update access on the task (source project membership) and read access to
+   * the target project.
+   */
+  async moveTask(orgId, taskId, data) {
+    return this.request("POST", ENDPOINTS.TASK_MOVE(orgId, taskId), data);
+  }
   async archiveTask(orgId, taskId) {
     return this.request("POST", ENDPOINTS.TASK_ARCHIVE(orgId, taskId));
   }
@@ -52455,8 +52506,44 @@ var WechatClient = class extends TaskLabelClient {
   }
 };
 
+// ts/sdk/dist/attachment-client.js
+var COMPLETION_RETRY_DELAYS_MS = [250, 750];
+function isRetryableCompletionError(error) {
+  if (!error || typeof error !== "object" || !("status" in error))
+    return false;
+  const status = error.status;
+  return status === 0 || typeof status === "number" && status >= 500;
+}
+var AttachmentClient = class extends WechatClient {
+  async getUploadPresignUrl(orgId, req) {
+    return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
+  }
+  async completeUpload(orgId, attachmentId, parts) {
+    const body = {
+      attachment_id: attachmentId,
+      parts
+    };
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        return await this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), body);
+      } catch (error) {
+        const delay = COMPLETION_RETRY_DELAYS_MS[attempt];
+        if (delay === void 0 || !isRetryableCompletionError(error))
+          throw error;
+        await new Promise((resolve3) => setTimeout(resolve3, delay));
+      }
+    }
+  }
+  async abortUpload(orgId, attachmentId) {
+    return this.request("POST", ENDPOINTS.UPLOAD_ABORT(orgId), { attachment_id: attachmentId });
+  }
+  async getFileUrl(id, opts) {
+    return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
+  }
+};
+
 // ts/sdk/dist/client.js
-var ParallClient = class _ParallClient extends WechatClient {
+var ParallClient = class _ParallClient extends AttachmentClient {
   baseUrl;
   wikiBaseUrl;
   token;
@@ -53103,16 +53190,6 @@ var ParallClient = class _ParallClient extends WechatClient {
     const res = await this.request("GET", ENDPOINTS.MESSAGE_REACTIONS(messageId));
     return res.reactions;
   }
-  // ---- File Upload ----
-  async getUploadPresignUrl(orgId, req) {
-    return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
-  }
-  async completeUpload(orgId, attachmentId) {
-    return this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), { attachment_id: attachmentId });
-  }
-  async getFileUrl(id, opts) {
-    return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
-  }
   // ---- Approvals ----
   async getApproval(id) {
     return this.request("GET", ENDPOINTS.APPROVAL(id));
@@ -53120,8 +53197,14 @@ var ParallClient = class _ParallClient extends WechatClient {
   async requestApproval(orgId, req) {
     return this.request("POST", ENDPOINTS.APPROVAL_REQUESTS(orgId), req);
   }
-  async decideApproval(id, decision) {
-    return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), { decision });
+  async decideApproval(id, decision, reason) {
+    if (decision === "approve" && reason?.trim()) {
+      throw new ApiError(400, "Approval reason is only allowed for rejection decisions", "INVALID_DECISION_REASON");
+    }
+    return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), {
+      decision,
+      ...decision === "reject" && reason !== void 0 ? { reason } : {}
+    });
   }
   async cancelApproval(id) {
     return this.request("POST", ENDPOINTS.APPROVAL_CANCEL(id));
@@ -53954,6 +54037,17 @@ var ParallClient = class _ParallClient extends WechatClient {
     const res = await this.request("GET", ENDPOINTS.WIKI_CHANGESETS(orgId, wikiId));
     return res.data.map(normalizeWikiChangeset);
   }
+  /** Org-wide changeset listing across every wiki the caller can read.
+   *  Server default (no `status`) is the pending set: proposed,
+   *  approval_pending, approved. */
+  async getOrgWikiChangesets(orgId, opts) {
+    const params = new URLSearchParams();
+    for (const s of opts?.status ?? [])
+      params.append("status", s);
+    const qs = params.toString();
+    const res = await this.request("GET", `${ENDPOINTS.WIKI_ORG_CHANGESETS(orgId)}${qs ? `?${qs}` : ""}`);
+    return (res.data ?? []).map(normalizeWikiChangeset);
+  }
   async getWikiChangeset(orgId, wikiId, changesetId) {
     return normalizeWikiChangeset(await this.request("GET", ENDPOINTS.WIKI_CHANGESET(orgId, wikiId, changesetId)));
   }
@@ -54042,6 +54136,46 @@ var ParallClient = class _ParallClient extends WechatClient {
   async getWikiAccessStatus(orgId, wikiId, path11) {
     return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path11 ? { path: path11 } : void 0);
   }
+  // ---- Wiki membership projection (who-can-access, invites, join/leave) ----
+  async getWikiAccessPolicy(orgId, wikiId, path11 = "") {
+    return this.request("GET", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), void 0, path11 ? { path: path11 } : void 0);
+  }
+  async putWikiAccessPolicy(orgId, wikiId, policy) {
+    return this.request("PUT", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), policy);
+  }
+  /** Add-only invite (viewer/editor); allowed for managers, and for editors
+   *  when the library enables editors_can_invite. */
+  async addWikiMember(orgId, wikiId, subject, role) {
+    await this.request("POST", ENDPOINTS.WIKI_ACCESS_POLICY_MEMBERS(orgId, wikiId), {
+      subject,
+      role
+    });
+  }
+  /** Join a PUBLIC library as an explicit member (lands at the library's
+   *  default role). Restricted libraries answer 409 JOIN_REQUIRES_REQUEST —
+   *  go through createWikiAccessRequest instead. */
+  async joinWiki(orgId, wikiId) {
+    await this.request("POST", ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+  }
+  /** Remove the caller's explicit membership (team-granted membership stays). */
+  async leaveWiki(orgId, wikiId) {
+    await this.request("DELETE", ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+  }
+  /** Star a library for the caller (sidebar Starred group). Idempotent —
+   *  re-starring is a 204 no-op. Requires read access; hidden private
+   *  libraries answer 404 like absent IDs. */
+  async starWiki(orgId, wikiId) {
+    await this.request("POST", ENDPOINTS.WIKI_STARS_SELF(orgId, wikiId));
+  }
+  /** Remove the caller's star. Idempotent — unstarring a never-starred
+   *  library is a 204 no-op. */
+  async unstarWiki(orgId, wikiId) {
+    await this.request("DELETE", ENDPOINTS.WIKI_STARS_SELF(orgId, wikiId));
+  }
+  async getWikiMembers(orgId, wikiId) {
+    const res = await this.request("GET", ENDPOINTS.WIKI_MEMBERS(orgId, wikiId));
+    return res.data ?? [];
+  }
   async createWikiAccessRequest(orgId, wikiId, data) {
     await this.request("POST", ENDPOINTS.WIKI_ACCESS_REQUESTS(orgId, wikiId), data);
   }
@@ -54391,6 +54525,31 @@ var ParallClient = class _ParallClient extends WechatClient {
     const resp = await this.request("GET", `${ENDPOINTS.ORG_CLIP_REGISTRY(orgId)}?limit=100`);
     return resp ?? [];
   }
+  /**
+   * Resolve an exact `<publisher org, name>` reference to its registry entry —
+   * the npm-style point read. Deliberately independent of catalog size: no
+   * Search, no pagination, same read-visibility boundary as `getRegistryClip`
+   * (cross-org requires public + approved). 404 `NOT_FOUND` when the publisher
+   * org has no visible clip of that exact name.
+   */
+  async resolveRegistryClip(orgId, publisherOrgId, name) {
+    const params = new URLSearchParams({ org_id: publisherOrgId, name });
+    return this.request("GET", `${ENDPOINTS.ORG_CLIP_REGISTRY_RESOLVE(orgId)}?${params}`);
+  }
+  /**
+   * Server-side fuzzy discovery over the visible registry (name/description
+   * substring match), paginated. The discovery verb: rows carry the `crg_` id
+   * that {@link installRegistryClip} takes.
+   */
+  async searchOrgRegistryClips(orgId, query, opts) {
+    const params = new URLSearchParams({ q: query });
+    if (opts?.limit !== void 0)
+      params.set("limit", String(opts.limit));
+    if (opts?.offset !== void 0)
+      params.set("offset", String(opts.offset));
+    const resp = await this.request("GET", `${ENDPOINTS.ORG_CLIP_REGISTRY_SEARCH(orgId)}?${params}`);
+    return resp ?? [];
+  }
   /**
    * Install a registry clip into the org (a reference in `clip_installs`, not a
    * copy). Idempotent: installing an already-installed clip returns the same
@@ -54504,6 +54663,86 @@ var ParallClient = class _ParallClient extends WechatClient {
   async listEdgeProfiles(orgId, edgeId) {
     return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILES(orgId, edgeId));
   }
+  /** Start one durable Local BYOC Profile operation. Network-unknown callers
+   * must retry with the same key or recover by operation id; a different body
+   * under the same key is rejected. */
+  async createEdgeProfileOperation(orgId, edgeId, request3, idempotencyKey) {
+    return this.request("POST", ENDPOINTS.ORG_EDGE_PROFILE_OPERATIONS(orgId, edgeId), request3, void 0, false, { headers: { "Idempotency-Key": idempotencyKey } });
+  }
+  /** Strong-confirm the exact durable Delete impact. A changed impact returns
+   * PROFILE_DELETE_IMPACT_CHANGED with a replacement receipt in
+   * `ApiError.extras.details.operation`. */
+  async confirmEdgeProfileOperation(orgId, edgeId, operationId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_EDGE_PROFILE_OPERATION_CONFIRM(orgId, edgeId, operationId), request3);
+  }
+  /** Sole read/recovery surface. The server may reconcile an already durable
+   * dispatch/finalization while returning this receipt. */
+  async getEdgeProfileOperation(orgId, edgeId, operationId) {
+    return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILE_OPERATION(orgId, edgeId, operationId));
+  }
+  /** Create and atomically materialize one Local BYOC Browser Alias. A replay
+   * with the same idempotency key and body returns the original stable ccn_. */
+  async createBrowserAlias(orgId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIASES(orgId), request3);
+  }
+  async listBrowserAliases(orgId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIASES(orgId));
+  }
+  async getBrowserAlias(orgId, aliasId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId));
+  }
+  async renameBrowserAlias(orgId, aliasId, request3) {
+    return this.request("PATCH", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request3);
+  }
+  async deleteBrowserAlias(orgId, aliasId, request3) {
+    return this.request("DELETE", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request3);
+  }
+  /** Start one durable readiness check. The key is carried as the standard
+   * Idempotency-Key header; the request body is intentionally empty. */
+  async createBrowserAliasReadinessCheck(orgId, aliasId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECKS(orgId, aliasId), void 0, void 0, false, { headers: { "Idempotency-Key": request3.idempotency_key } });
+  }
+  /** Sole durable recovery surface for one readiness request. */
+  async getBrowserAliasReadinessCheck(orgId, aliasId, checkId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECK(orgId, aliasId, checkId));
+  }
+  /** Organization Owner view. Hashes, reviewed snapshots and deltas are
+   * intentionally available only on this human-JWT management surface. */
+  async listBrowserAliasGrants(orgId, keyId) {
+    return this.request("GET", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANTS(orgId, keyId));
+  }
+  async getBrowserAliasGrant(orgId, keyId, aliasId) {
+    return this.request("GET", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId));
+  }
+  async replaceBrowserAliasGrant(orgId, keyId, aliasId, request3) {
+    return this.request("PUT", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId), request3);
+  }
+  /** Managed-key discovery. The response is already grant-filtered and never
+   * carries contract hashes, review snapshots, Edge IDs or Profile IDs. */
+  async listManagedBrowserAliases(orgId) {
+    return this.request("GET", ENDPOINTS.ORG_MANAGED_ALIASES(orgId));
+  }
+  async getManagedBrowserAlias(orgId, aliasName) {
+    return this.request("GET", ENDPOINTS.ORG_MANAGED_ALIAS(orgId, aliasName));
+  }
+  /** Accept and dispatch one @alias command. request_id is generated by the
+   * caller before local validation and is also the sole durable recovery key. */
+  async createBrowserAliasExecution(orgId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTIONS(orgId), request3);
+  }
+  async getBrowserAliasExecution(orgId, requestId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTION(orgId, requestId));
+  }
+  /** Accept one idempotent Browser Use operation for an explicit Profile.
+   * The Server resolves Profile→Edge; callers never select an Edge directly. */
+  async createBrowserUseOperation(orgId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_USE_OPERATIONS(orgId), request3);
+  }
+  /** Recover the durable receipt. Successful data is present only inside the
+   * Server's short encrypted result TTL; terminal proof remains afterwards. */
+  async getBrowserUseOperation(orgId, operationId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_USE_OPERATION(orgId, operationId));
+  }
   /**
    * Read a hosted Cloud Profile's egress-proxy status (manager-only: hosted
    * human maintainer or org admin). Sanitized — the password never comes back.
@@ -58752,11 +58991,28 @@ var ParallAgentGateway = class {
     const hasAttachments = message.attachments?.length;
     if (!body && !hasAttachments)
       return { action: "skip" };
-    if (chatInfo.type === "group" && chatInfo.agentRoutingMode !== "active") {
-      const mentions = content.mentions ?? [];
-      const isMentioned = mentions.some((mention) => mentionTargetsUser(mention.user_id, this.opts.agentUserId, "agent"));
-      if (!isMentioned)
+    const mentions = content.mentions ?? [];
+    const isMentioned = mentions.some((mention) => mentionTargetsUser(mention.user_id, this.opts.agentUserId, "agent"));
+    let deliveryReason;
+    if (message.thread_root_id) {
+      if (isMentioned) {
+        deliveryReason = "mention";
+      } else {
+        let watching;
+        try {
+          watching = await this.opts.client.isWatchingThread(message.thread_root_id);
+        } catch {
+          return { action: "retry" };
+        }
+        if (!watching)
+          return { action: "skip" };
+        deliveryReason = "watcher";
+      }
+    } else if (chatInfo.type === "group") {
+      if (chatInfo.agentRoutingMode !== "active" && !isMentioned)
         return { action: "skip" };
+      if (isMentioned)
+        deliveryReason = "mention";
     }
     const attachments = (message.attachments ?? []).map((a) => ({
       id: a.id,
@@ -58797,6 +59053,7 @@ var ParallAgentGateway = class {
         messageId: message.id,
         body: body || "[attachment]",
         threadRootId: message.thread_root_id ?? void 0,
+        deliveryReason,
         noReply: message.hints?.no_reply ?? false,
         attachments: attachments.length > 0 ? attachments : void 0,
         sentAt: message.created_at,
@@ -59274,7 +59531,10 @@ var ParallAgentGateway = class {
     this.opts.log?.info(`approval decided: ${approval.id} (${approval.status})`);
     const statusLabel = approval.status === "approved" ? "Approved" : "Rejected";
     const execInfo = approval.execution_status ? ` | execution: ${approval.execution_status}` : "";
-    const body = `${statusLabel}: ${approval.title}${execInfo}`;
+    const reasonLine = formatApprovalDecisionReason(approval.status, approval.decision_reason);
+    const reasonInfo = reasonLine ? `
+${reasonLine}` : "";
+    const body = `${statusLabel}: ${approval.title}${execInfo}${reasonInfo}`;
     const event = {
       type: "approval",
       targetId: chatId ?? approval.chat_id,
@@ -59888,7 +60148,7 @@ parall dm prll://usr_xxx --text-file /tmp/reply.md
 parall dm "Alice" --text "Hello"
 
 # Thread reply
-parall messages send prll://cht_xxx --text-file /tmp/reply.md --thread-root-id 01JWC...
+parall messages send prll://cht_xxx --text-file /tmp/reply.md --thread-root-id prll://msg_xxx
 
 # FYI message (no response expected \u2014 the recipient sees \`[Hint: no_reply]\`)
 parall messages send prll://cht_xxx --text "FYI: done" --no-reply
@@ -59899,6 +60159,27 @@ parall messages send prll://cht_xxx --text "FYI: done" --no-reply
 parall no-reply --reason "ack only, nothing to add"
 \`\`\`
 
+## Thread Subscriptions
+
+Replying in a thread subscribes you to it: every later reply reaches you as
+\`[Event: message.new]\` with a \`[Thread: ...]\` line, marked
+\`[Delivery: watcher]\`. You are also auto-subscribed when a thread reply
+@-mentions you personally, and when someone replies to a thread whose root
+message you wrote. \`[Delivery: mention]\` means you were @-mentioned in that
+message.
+
+\`\`\`bash
+parall messages watch prll://msg_xxx      # follow a thread without replying (ID = the thread's root message)
+parall messages unwatch prll://msg_xxx    # stop receiving a thread's replies
+parall messages watchers prll://msg_xxx   # list who is watching a thread
+\`\`\`
+
+Unwatch is sticky: no automatic source (including later @-mentions \u2014 you
+still get the one-off mention, just no subscription) re-subscribes you.
+Only replying in the thread yourself or an explicit \`watch\` does. Unwatch
+threads you have nothing more to contribute to instead of ignoring their
+wake-ups.
+
 ## Files & Attachments
 
 Attachments appear in events as \`[Attachment: prll://att_xxx | mime | size | name]\`.
@@ -61006,7 +61287,7 @@ bound to whatever profile the connection selected.
 var SKILLS = [
   {
     name: "parall-platform",
-    description: "Parall platform queries and lightweight agent provisioning: list org members, agents, chats, read message history, check identity, create another agent, or walk the prll:// reference graph (resolve URIs, backlinks, multi-hop graph). Use when: user asks about org members, who's online, chat history, agent list, creating an agent, identity/auth questions, or you need to find what an entity is connected to / who references it.",
+    description: "Parall platform queries and lightweight agent provisioning: list org members, agents, chats, read message history, watch/unwatch threads, check identity, create another agent, or walk the prll:// reference graph (resolve URIs, backlinks, multi-hop graph). Use when: user asks about org members, who's online, chat history, agent list, creating an agent, identity/auth questions, you want to follow or mute a thread (e.g. after `[Delivery: watcher]` wake-ups), or you need to find what an entity is connected to / who references it.",
     content: PARALL_PLATFORM_SKILL
   },
   {