@parall/daemon 1.58.1 → 1.58.2

package/bundle/manifest.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.58.1",
-  "built_at": "2026-08-31T06:18:26.328Z",
+  "version": "1.58.2",
+  "built_at": "2026-08-31T17:39:36.772Z",
   "min_node_version": "20.0.0",
   "files": {
     "bb-browser-daemon.js": {
@@ -16,29 +16,29 @@
       "size": 18
     },
     "parall-browser-pod.js": {
-      "sha256": "110e15542b7816fed7400a3cb1261d876a534fe756480e7a1a82f33d8bbd95dc",
-      "size": 2972173
+      "sha256": "4841b686837495489d1834d25f14fca452daaed9be52ddb4692b302ce2c6d3bc",
+      "size": 2972260
     },
     "parall-channel-exec.js": {
       "sha256": "7c2a6e12483a45e9eb4a42cd7d4cdd3c4fa21dd09ac1347d9a3e177b4ddee930",
       "size": 7220
     },
     "parall-claude-agent.js": {
-      "sha256": "0ed8b74b056eef72f4b3ff16d5a6278fc480fb80cfe8097ad47322cc04a68cc8",
-      "size": 2815581
+      "sha256": "5f59e7dcaca4767befb052001114875411b8e930dfe567eafbced3a78b359985",
+      "size": 2815668
     },
     "parall-codex-agent.js": {
-      "sha256": "40da8f4df4790ff923aaf736aab173b1002585b4117e38bf2448e7bad6abec3c",
-      "size": 2844812
+      "sha256": "2a99b85b443e81863cc418a572c35bbad9660868828b634a1a00a87c8840ea8a",
+      "size": 2845907
     },
     "parall-daemon.js": {
-      "sha256": "8395ec40201b0dd60d798113947253c3ccf5d25f210470f6d024e8dbc7220e0c",
-      "size": 3041166
+      "sha256": "e2c686bde1bc01107de15c4e970ab85160f9262878ab4b034ff1f4dff4ea15a6",
+      "size": 3041257
     },
     "parall-openclaw-agent.js": {
       "sha256": "856a1c3a9ae0ffef8efe2481fa1171dbeb1d67cccb88616aa9bf16da96a69355",
       "size": 9923
     }
   },
-  "signature": "M7Lk69BP79NRgmmdwtrMToFKNNCT6D44Oop6alLRJDXW6E66Cw0FCrmGo3fOFlLw7P055GiZ86ygM72OVh+xBw=="
+  "signature": "aVhILaJo6FTemM7X/iQDr+yuH8gtE/p5B070rqImrvaqz5fnMg9HlHz5h7MsbCtc8zndR68VOBR+rxksbF+GAg=="
 }

package/bundle/parall-browser-pod.js

@@ -66909,7 +66909,8 @@ var ParallClient = class _ParallClient extends AttachmentClient {
    * `404 NOT_FOUND`. An installed cross-org clip with no connection yet lists
    * as an empty array — including one whose approved auth mode cannot be
    * configured at all (auth=none), which the write path is what refuses. With
-   * `cap:clip-mcp` off the route is not registered at all.
+   * `cap:clip-mcp` off the route is not registered at all. The envelope also
+   * carries `official_oauth_ready` (see MCPConnectionListResponse).
    */
   async listClipMCPConnections(orgId, clipId) {
     return this.request("GET", ENDPOINTS.ORG_CLIP_MCP_CONFIGS(orgId, clipId));

package/bundle/parall-claude-agent.js

@@ -55008,7 +55008,8 @@ var ParallClient = class _ParallClient extends AttachmentClient {
    * `404 NOT_FOUND`. An installed cross-org clip with no connection yet lists
    * as an empty array — including one whose approved auth mode cannot be
    * configured at all (auth=none), which the write path is what refuses. With
-   * `cap:clip-mcp` off the route is not registered at all.
+   * `cap:clip-mcp` off the route is not registered at all. The envelope also
+   * carries `official_oauth_ready` (see MCPConnectionListResponse).
    */
   async listClipMCPConnections(orgId, clipId) {
     return this.request("GET", ENDPOINTS.ORG_CLIP_MCP_CONFIGS(orgId, clipId));

package/bundle/parall-codex-agent.js

@@ -17719,9 +17719,9 @@ var require_getMachineId_linux = __commonJS({
     var api_1 = (init_esm(), __toCommonJS(esm_exports));
     async function getMachineId() {
       const paths = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
-      for (const path12 of paths) {
+      for (const path13 of paths) {
         try {
-          const result = await fs_1.promises.readFile(path12, { encoding: "utf8" });
+          const result = await fs_1.promises.readFile(path13, { encoding: "utf8" });
           return result.trim();
         } catch (e) {
           api_1.diag.debug(`error reading machine id: ${e}`);
@@ -21124,7 +21124,7 @@ function appendRootPathToUrlIfNeeded(url) {
     return void 0;
   }
 }
-function appendResourcePathToUrl(url, path12) {
+function appendResourcePathToUrl(url, path13) {
   try {
     new URL(url);
   } catch (_a) {
@@ -21134,11 +21134,11 @@ function appendResourcePathToUrl(url, path12) {
   if (!url.endsWith("/")) {
     url = url + "/";
   }
-  url += path12;
+  url += path13;
   try {
     new URL(url);
   } catch (_b) {
-    diag2.warn("Configuration: Provided URL appended with '" + path12 + "' is not a valid URL, using 'undefined' instead of '" + url + "'");
+    diag2.warn("Configuration: Provided URL appended with '" + path13 + "' is not a valid URL, using 'undefined' instead of '" + url + "'");
     return void 0;
   }
   return url;
@@ -27549,14 +27549,14 @@ var require_util2 = __commonJS({
         }
         const port = url.port != null ? url.port : url.protocol === "https:" ? 443 : 80;
         let origin = url.origin != null ? url.origin : `${url.protocol || ""}//${url.hostname || ""}:${port}`;
-        let path12 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
+        let path13 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path12 && path12[0] !== "/") {
-          path12 = `/${path12}`;
+        if (path13 && path13[0] !== "/") {
+          path13 = `/${path13}`;
         }
-        return new URL(`${origin}${path12}`);
+        return new URL(`${origin}${path13}`);
       }
       if (!isHttpOrHttpsPrefixed(url.origin || url.protocol)) {
         throw new InvalidArgumentError("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -28377,9 +28377,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path12, origin }
+            request: { method, path: path13, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path12);
+          debugLog("sending request to %s %s%s", method, origin, path13);
         }
       );
     }
@@ -28397,14 +28397,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path12, origin },
+            request: { method, path: path13, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path12,
+            path13,
             statusCode
           );
         }
@@ -28413,23 +28413,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path12, origin }
+            request: { method, path: path13, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path12);
+          debugLog("trailers received from %s %s%s", method, origin, path13);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path12, origin },
+            request: { method, path: path13, origin },
             error
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path12,
+            path13,
             error.message
           );
         }
@@ -28532,7 +28532,7 @@ var require_request = __commonJS({
     var kHandler = Symbol("handler");
     var Request = class {
       constructor(origin, {
-        path: path12,
+        path: path13,
         method,
         body,
         headers,
@@ -28549,11 +28549,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path12 !== "string") {
+        if (typeof path13 !== "string") {
           throw new InvalidArgumentError("path must be a string");
-        } else if (path12[0] !== "/" && !(path12.startsWith("http://") || path12.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path13[0] !== "/" && !(path13.startsWith("http://") || path13.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path12)) {
+        } else if (invalidPathRegex.test(path13)) {
           throw new InvalidArgumentError("invalid request path");
         }
         if (typeof method !== "string") {
@@ -28628,7 +28628,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path12, query) : path12;
+        this.path = query ? serializePathWithQuery(path13, query) : path13;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -33667,7 +33667,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request3) {
-      const { method, path: path12, host, upgrade, blocking, reset } = request3;
+      const { method, path: path13, host, upgrade, blocking, reset } = request3;
       let { body, headers, contentLength } = request3;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -33736,7 +33736,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request3.typeOfService);
       }
-      let header = `${method} ${path12} HTTP/1.1\r
+      let header = `${method} ${path13} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -34389,7 +34389,7 @@ var require_client_h2 = __commonJS({
     function writeH2(client, request3) {
       const requestTimeout = request3.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path12, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request3;
+      const { method, path: path13, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request3;
       let { body } = request3;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request3, new InvalidArgumentError(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -34457,7 +34457,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path12;
+          headers[HTTP2_HEADER_PATH] = path13;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -34498,7 +34498,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(requestTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path12;
+      headers[HTTP2_HEADER_PATH] = path13;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -36800,10 +36800,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path12 = "/",
+          path: path13 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path12;
+        opts.path = origin + path13;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -38866,20 +38866,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path12) {
-      if (typeof path12 !== "string") {
-        return path12;
+    function safeUrl(path13) {
+      if (typeof path13 !== "string") {
+        return path13;
       }
-      const pathSegments = path12.split("?", 3);
+      const pathSegments = path13.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path12;
+        return path13;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path12, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path12);
+    function matchKey(mockDispatch2, { path: path13, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path13);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -38904,8 +38904,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path12, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path12)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path12), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path13, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path13)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path13), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -38944,19 +38944,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path12) {
-      while (path12.endsWith("/")) {
-        path12 = path12.slice(0, -1);
+    function removeTrailingSlash(path13) {
+      while (path13.endsWith("/")) {
+        path13 = path13.slice(0, -1);
       }
-      if (path12.length === 0) {
-        path12 = "/";
+      if (path13.length === 0) {
+        path13 = "/";
       }
-      return path12;
+      return path13;
     }
     function buildKey(opts) {
-      const { path: path12, method, body, headers, query } = opts;
+      const { path: path13, method, body, headers, query } = opts;
       return {
-        path: path12,
+        path: path13,
         method,
         body,
         headers,
@@ -39646,10 +39646,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path12, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path13, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path12,
+            Path: path13,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -39731,9 +39731,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path12, searchParams] = dispatchOpts.path.split("?");
+          const [path13, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path12}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path13}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -40134,12 +40134,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path12 = filePath || this.#snapshotPath;
-        if (!path12) {
+        const path13 = filePath || this.#snapshotPath;
+        if (!path13) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve4(path12), "utf8");
+          const data = await readFile(resolve4(path13), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -40153,7 +40153,7 @@ var require_snapshot_recorder = __commonJS({
           if (error.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path12}`, { cause: error });
+            throw new UndiciError(`Failed to load snapshots from ${path13}`, { cause: error });
           }
         }
       }
@@ -40164,11 +40164,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path12 = filePath || this.#snapshotPath;
-        if (!path12) {
+        const path13 = filePath || this.#snapshotPath;
+        if (!path13) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
-        const resolvedPath = resolve4(path12);
+        const resolvedPath = resolve4(path13);
         await mkdir2(dirname8(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
@@ -40793,15 +40793,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path12 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path12}`;
+        const path13 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path13}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path12;
+        this.opts.path = path13;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -44411,10 +44411,10 @@ var require_headers = __commonJS({
         const lowercaseName = isLowerCase ? name : name.toLowerCase();
         const exists = this.headersMap.get(lowercaseName);
         if (exists) {
-          const delimiter2 = lowercaseName === "cookie" ? "; " : ", ";
+          const delimiter3 = lowercaseName === "cookie" ? "; " : ", ";
           this.headersMap.set(lowercaseName, {
             name: exists.name,
-            value: `${exists.value}${delimiter2}${value}`
+            value: `${exists.value}${delimiter3}${value}`
           });
         } else {
           this.headersMap.set(lowercaseName, { name, value });
@@ -47008,11 +47008,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url = requestCurrentURL(request3);
         const agent = fetchParams.controller.dispatcher;
-        const path12 = url.pathname + url.search;
+        const path13 = url.pathname + url.search;
         const hasTrailingQuestionMark = url.search.length === 0 && url.href[url.href.length - url.hash.length - 1] === "?";
         return new Promise((resolve4, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path12}?` : path12,
+            path: hasTrailingQuestionMark ? `${path13}?` : path13,
             origin: url.origin,
             method: request3.method,
             body: agent.isMockActive ? request3.body && (request3.body.source || request3.body.stream) : body,
@@ -47959,9 +47959,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path12) {
-      for (let i = 0; i < path12.length; ++i) {
-        const code = path12.charCodeAt(i);
+    function validateCookiePath(path13) {
+      for (let i = 0; i < path13.length; ++i) {
+        const code = path13.charCodeAt(i);
         if (code < 32 || // exclude CTLs (0-31)
         code === 127 || // DEL
         code === 59) {
@@ -51131,11 +51131,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError("invalid opts.path");
           }
-          let path12 = opts.path;
+          let path13 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path12 = `/${path12}`;
+            path13 = `/${path13}`;
           }
-          url = new URL(util.parseOrigin(url).origin + path12);
+          url = new URL(util.parseOrigin(url).origin + path13);
         } else {
           if (!opts) {
             opts = typeof url === "object" ? url : {};
@@ -52603,7 +52603,7 @@ var ParallClient = class _ParallClient extends AttachmentClient {
     return apiError;
   }
   /** Build headers common to all requests (auth, swimlane). */
-  buildHeaders(path12, extra) {
+  buildHeaders(path13, extra) {
     const headers = {
       "Content-Type": "application/json",
       ...extra
@@ -52614,7 +52614,7 @@ var ParallClient = class _ParallClient extends AttachmentClient {
     if (this.swimlaneName) {
       headers["X-Prll-Swimlane"] = this.swimlaneName;
     }
-    if (path12.startsWith(API_BASE)) {
+    if (path13.startsWith(API_BASE)) {
       const overrides = this.getFeatureFlagOverrides?.();
       if (overrides)
         headers["X-Prll-FF-Override"] = overrides;
@@ -52638,8 +52638,8 @@ var ParallClient = class _ParallClient extends AttachmentClient {
    * is authoritative, so wiki vs api routing can't drift from how a caller
    * happens to invoke the client.
    */
-  baseUrlFor(path12) {
-    return path12.startsWith(WIKI_BASE) ? this.wikiBaseUrl : this.baseUrl;
+  baseUrlFor(path13) {
+    return path13.startsWith(WIKI_BASE) ? this.wikiBaseUrl : this.baseUrl;
   }
   setToken(token) {
     this.token = token;
@@ -52666,10 +52666,10 @@ var ParallClient = class _ParallClient extends AttachmentClient {
    * REFRESH_THRESHOLD_S, refresh it **before** sending the request.
    * No-op when the token is still fresh, missing, or un-parseable.
    */
-  async ensureFreshToken(path12) {
+  async ensureFreshToken(path13) {
     if (!this.token || !this.getRefreshToken)
       return;
-    const pathSuffix = path12.replace(/^\/api\/v1/, "");
+    const pathSuffix = path13.replace(/^\/api\/v1/, "");
     if (_ParallClient.AUTH_PATHS.has(pathSuffix))
       return;
     const exp = _ParallClient.decodeJwtExp(this.token);
@@ -52701,11 +52701,11 @@ var ParallClient = class _ParallClient extends AttachmentClient {
       this.refreshPromise = null;
     }
   }
-  async request(method, path12, body, query, retried = false, opts) {
+  async request(method, path13, body, query, retried = false, opts) {
     if (!retried) {
-      await this.ensureFreshToken(path12);
+      await this.ensureFreshToken(path13);
     }
-    let url = `${this.baseUrlFor(path12)}${path12}`;
+    let url = `${this.baseUrlFor(path13)}${path13}`;
     if (query) {
       const params = new URLSearchParams();
       for (const [key, value] of Object.entries(query)) {
@@ -52717,7 +52717,7 @@ var ParallClient = class _ParallClient extends AttachmentClient {
       if (qs)
         url += `?${qs}`;
     }
-    const headers = this.buildHeaders(path12, opts?.headers);
+    const headers = this.buildHeaders(path13, opts?.headers);
     const timeoutSignal = AbortSignal.timeout(opts?.timeoutMs ?? 15e3);
     const signal = opts?.signal ? AbortSignal.any([opts.signal, timeoutSignal]) : timeoutSignal;
     let res;
@@ -52735,12 +52735,12 @@ var ParallClient = class _ParallClient extends AttachmentClient {
       throw _ParallClient.normalizeFetchError(err);
     }
     if (res.status === 401) {
-      const pathSuffix = path12.replace(/^\/api\/v1/, "");
+      const pathSuffix = path13.replace(/^\/api\/v1/, "");
       const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
       if (!retried && !isAuthPath && this.getRefreshToken) {
         const refreshed = await this.tryRefresh();
         if (refreshed) {
-          return this.request(method, path12, body, query, true, opts);
+          return this.request(method, path13, body, query, true, opts);
         }
       }
       if (this.onTokenExpired && !isAuthPath) {
@@ -52770,18 +52770,18 @@ var ParallClient = class _ParallClient extends AttachmentClient {
    * hit the 100 MiB cap, so a longer 5-minute timeout is used so a
    * 50 MiB blob on a slow connection doesn't get chopped at 15 s.
    */
-  async multipartRequest(method, path12, body, retried = false, opts) {
+  async multipartRequest(method, path13, body, retried = false, opts) {
     if (!retried) {
-      await this.ensureFreshToken(path12);
+      await this.ensureFreshToken(path13);
     }
-    const { "Content-Type": _drop, ...headers } = this.buildHeaders(path12);
+    const { "Content-Type": _drop, ...headers } = this.buildHeaders(path13);
     void _drop;
     const timeoutMs = opts?.timeoutMs ?? 5 * 60 * 1e3;
     let res;
     try {
       res = await sendMultipartRequest({
         method,
-        url: `${this.baseUrlFor(path12)}${path12}`,
+        url: `${this.baseUrlFor(path13)}${path13}`,
         headers,
         body,
         timeoutMs,
@@ -52792,12 +52792,12 @@ var ParallClient = class _ParallClient extends AttachmentClient {
       throw _ParallClient.normalizeFetchError(err);
     }
     if (res.status === 401) {
-      const pathSuffix = path12.replace(/^\/api\/v1/, "");
+      const pathSuffix = path13.replace(/^\/api\/v1/, "");
       const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
       if (!retried && !isAuthPath && this.getRefreshToken) {
         const refreshed = await this.tryRefresh();
         if (refreshed) {
-          return this.multipartRequest(method, path12, body, true, opts);
+          return this.multipartRequest(method, path13, body, true, opts);
         }
       }
       if (this.onTokenExpired && !isAuthPath) {
@@ -53641,8 +53641,8 @@ var ParallClient = class _ParallClient extends AttachmentClient {
    *  remote filesystem browse of a member's machine was remote device access.
    *  The endpoint now answers 409 LOCAL_BROWSE_NOT_SUPPORTED unconditionally;
    *  workspace paths are typed in (or picked on the machine's own Desktop). */
-  async browseMachineFilesystem(orgId, machineId, path12) {
-    return this.request("POST", ENDPOINTS.MACHINE_BROWSE(orgId, machineId), { path: path12 }, void 0, false, { timeoutMs: 15e3 });
+  async browseMachineFilesystem(orgId, machineId, path13) {
+    return this.request("POST", ENDPOINTS.MACHINE_BROWSE(orgId, machineId), { path: path13 }, void 0, false, { timeoutMs: 15e3 });
   }
   /** Create a new machine key. Returns the raw key string (shown once) + metadata. */
   async createMachineKey(orgId, machineId, name) {
@@ -54216,12 +54216,12 @@ var ParallClient = class _ParallClient extends AttachmentClient {
   async deleteWikiRestriction(orgId, wikiId, restrictionId) {
     await this.request("DELETE", ENDPOINTS.WIKI_RESTRICTION(orgId, wikiId, restrictionId));
   }
-  async getWikiAccessStatus(orgId, wikiId, path12) {
-    return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path12 ? { path: path12 } : void 0);
+  async getWikiAccessStatus(orgId, wikiId, path13) {
+    return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path13 ? { path: path13 } : void 0);
   }
   // ---- Wiki membership projection (who-can-access, invites, join/leave) ----
-  async getWikiAccessPolicy(orgId, wikiId, path12 = "") {
-    return this.request("GET", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), void 0, path12 ? { path: path12 } : void 0);
+  async getWikiAccessPolicy(orgId, wikiId, path13 = "") {
+    return this.request("GET", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), void 0, path13 ? { path: path13 } : void 0);
   }
   async putWikiAccessPolicy(orgId, wikiId, policy) {
     return this.request("PUT", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), policy);
@@ -54266,14 +54266,14 @@ var ParallClient = class _ParallClient extends AttachmentClient {
   async getWikiCommits(orgId, wikiId, params) {
     return this.request("GET", ENDPOINTS.WIKI_COMMITS(orgId, wikiId), void 0, params);
   }
-  async getWikiFileCommits(orgId, wikiId, path12, params) {
+  async getWikiFileCommits(orgId, wikiId, path13, params) {
     return this.request("GET", ENDPOINTS.WIKI_FILE_COMMITS(orgId, wikiId), void 0, {
-      path: path12,
+      path: path13,
       ...params
     });
   }
-  async getWikiBlame(orgId, wikiId, path12, ref) {
-    return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path12, ref });
+  async getWikiBlame(orgId, wikiId, path13, ref) {
+    return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path13, ref });
   }
   // ---- Wiki Operations (audit log) ----
   async getWikiOperations(orgId, wikiId, params) {
@@ -55008,7 +55008,8 @@ var ParallClient = class _ParallClient extends AttachmentClient {
    * `404 NOT_FOUND`. An installed cross-org clip with no connection yet lists
    * as an empty array — including one whose approved auth mode cannot be
    * configured at all (auth=none), which the write path is what refuses. With
-   * `cap:clip-mcp` off the route is not registered at all.
+   * `cap:clip-mcp` off the route is not registered at all. The envelope also
+   * carries `official_oauth_ready` (see MCPConnectionListResponse).
    */
   async listClipMCPConnections(orgId, clipId) {
     return this.request("GET", ENDPOINTS.ORG_CLIP_MCP_CONFIGS(orgId, clipId));
@@ -60997,7 +60998,7 @@ function stepIdFilePathForSession(stateDir, sessionKey) {
 // ts/codex-agent/dist/dispatch.js
 import { spawn } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import * as path8 from "node:path";
+import * as path9 from "node:path";
 
 // ts/agent-core/dist/internal/attachment-input.js
 import { execSync } from "node:child_process";
@@ -62067,6 +62068,24 @@ function answerServerRequest(method) {
   return Object.hasOwn(APPROVAL_DENIALS, method) ? APPROVAL_DENIALS[method] : void 0;
 }
 
+// ts/codex-agent/dist/thread-config.js
+import * as path8 from "node:path";
+function buildThreadConfigOverrides({ reasoningEffort, capabilityBinDir: capabilityBinDir2, inheritedPath, platform = process.platform }) {
+  const config = {};
+  if (reasoningEffort)
+    config.model_reasoning_effort = reasoningEffort;
+  if (capabilityBinDir2 && platform !== "win32") {
+    const pathEntries = (inheritedPath ?? "").split(path8.delimiter).filter((entry) => entry && entry !== capabilityBinDir2);
+    const effectivePath = [capabilityBinDir2, ...pathEntries].join(path8.delimiter);
+    config.allow_login_shell = false;
+    config.shell_environment_policy = {
+      experimental_use_profile: false,
+      set: { PATH: effectivePath }
+    };
+  }
+  return Object.keys(config).length > 0 ? config : void 0;
+}
+
 // ts/codex-agent/dist/event-mapping.js
 var EventMapper = class {
   toolCallStart = /* @__PURE__ */ new Map();
@@ -62529,6 +62548,13 @@ var CodexAppServerAdapter = class {
     if (config.developerInstructions !== void 0)
       this.opts.developerInstructions = config.developerInstructions ?? void 0;
   }
+  threadConfigOverrides() {
+    return buildThreadConfigOverrides({
+      reasoningEffort: this.opts.reasoningEffort,
+      capabilityBinDir: this.opts.capabilityBinDir,
+      inheritedPath: process.env.PATH
+    });
+  }
   async enqueueDuringDispatch(sessionKey, body) {
     const client = this.client;
     if (!client || client.isDisposed())
@@ -62889,9 +62915,9 @@ var CodexAppServerAdapter = class {
       }
       if (this.opts.model)
         forkParams.model = this.opts.model;
-      if (this.opts.reasoningEffort) {
-        forkParams.config = { model_reasoning_effort: this.opts.reasoningEffort };
-      }
+      const threadConfig = this.threadConfigOverrides();
+      if (threadConfig)
+        forkParams.config = threadConfig;
       const result = await client.sendRequest("thread/fork", forkParams);
       const forkedThreadId = extractThreadId(result);
       if (!forkedThreadId) {
@@ -63001,7 +63027,7 @@ var CodexAppServerAdapter = class {
     if (this.opts.capabilityBinDir) {
       const pathKey = IS_WIN32 ? Object.keys(env).find((k) => k.toUpperCase() === "PATH") ?? "PATH" : "PATH";
       const existing = env[pathKey];
-      env[pathKey] = existing ? `${this.opts.capabilityBinDir}${path8.delimiter}${existing}` : this.opts.capabilityBinDir;
+      env[pathKey] = existing ? `${this.opts.capabilityBinDir}${path9.delimiter}${existing}` : this.opts.capabilityBinDir;
     }
     if (this.opts.contextFilePath) {
       env.PRLL_CONTEXT_FILE = this.opts.contextFilePath;
@@ -63103,9 +63129,9 @@ var CodexAppServerAdapter = class {
     }
     if (this.opts.model)
       commonParams.model = this.opts.model;
-    if (this.opts.reasoningEffort) {
-      commonParams.config = { model_reasoning_effort: this.opts.reasoningEffort };
-    }
+    const threadConfig = this.threadConfigOverrides();
+    if (threadConfig)
+      commonParams.config = threadConfig;
     const method = opts.resumeId ? "thread/resume" : "thread/start";
     const params = opts.resumeId ? {
       threadId: opts.resumeId,
@@ -63168,7 +63194,7 @@ function errToString2(err) {
 
 // ts/codex-agent/dist/session-manager.js
 import * as fs8 from "node:fs";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 var CodexSessionManager = class {
   mainSessionKey;
   stateFilePath;
@@ -63265,7 +63291,7 @@ var CodexSessionManager = class {
     if (!threadId)
       return;
     try {
-      fs8.mkdirSync(path9.dirname(this.stateFilePath), { recursive: true });
+      fs8.mkdirSync(path10.dirname(this.stateFilePath), { recursive: true });
       const tmpPath = `${this.stateFilePath}.tmp`;
       const state = { runtimeKey: this.mainSessionKey, threadId };
       const effectiveSha = this.effectiveInstructionsShas.get(this.mainSessionKey);
@@ -63281,18 +63307,18 @@ var CodexSessionManager = class {
 
 // ts/codex-agent/dist/workspace.js
 import * as fs10 from "node:fs";
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 
 // ts/codex-agent/dist/legacy-workspace-config-migration.js
 import * as fs9 from "node:fs";
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 var LEGACY_CONFIG_RELPATH = [".codex", "config.toml"];
 var MIGRATION_SENTINEL_RELPATH = [".parall", "legacy-workspace-config-migration.v1"];
 function legacyWorkspaceConfigPath(workspaceDir) {
-  return path10.join(workspaceDir, ...LEGACY_CONFIG_RELPATH);
+  return path11.join(workspaceDir, ...LEGACY_CONFIG_RELPATH);
 }
 function migrationSentinelPath(workspaceDir) {
-  return path10.join(workspaceDir, ...MIGRATION_SENTINEL_RELPATH);
+  return path11.join(workspaceDir, ...MIGRATION_SENTINEL_RELPATH);
 }
 function legacyWorkspaceConfigToml(prompt) {
   return `developer_instructions = """
@@ -63344,7 +63370,7 @@ If a stale .codex/config.toml is still present, remove it by hand.
 `;
 function claimLegacyWorkspaceConfigMigration(workspaceDir) {
   const sentinel = migrationSentinelPath(workspaceDir);
-  fs9.mkdirSync(path10.dirname(sentinel), { recursive: true });
+  fs9.mkdirSync(path11.dirname(sentinel), { recursive: true });
   try {
     fs9.writeFileSync(sentinel, SENTINEL_BODY, { flag: "wx" });
     return "claimed";
@@ -63410,9 +63436,9 @@ function sleepSync(ms) {
   Atomics.wait(SLEEP_SIGNAL, 0, 0, ms);
 }
 function withConfigLock(codexHome, log2, fn) {
-  const queueDir = path11.join(codexHome, "config.toml.lock.d");
+  const queueDir = path12.join(codexHome, "config.toml.lock.d");
   let ticketName = bakeryEnqueue(queueDir);
-  let ticketPath = ticketName ? path11.join(queueDir, ticketName) : "";
+  let ticketPath = ticketName ? path12.join(queueDir, ticketName) : "";
   let acquired = false;
   let heldPath = "";
   const deadline = Date.now() + CONFIG_LOCK_TIMINGS.waitMs;
@@ -63427,7 +63453,7 @@ function withConfigLock(codexHome, log2, fn) {
       ticketName = bakeryEnqueue(queueDir);
       if (!ticketName)
         break;
-      ticketPath = path11.join(queueDir, ticketName);
+      ticketPath = path12.join(queueDir, ticketName);
       continue;
     }
     const now = Date.now();
@@ -63435,7 +63461,7 @@ function withConfigLock(codexHome, log2, fn) {
     let blocked = false;
     let head;
     for (const name of names) {
-      const entryPath = path11.join(queueDir, name);
+      const entryPath = path12.join(queueDir, name);
       if (name.startsWith("held-")) {
         const enteredAt = Number.parseInt(name.slice(5, 20), 10);
         if (Number.isFinite(enteredAt) && now - enteredAt > CONFIG_LOCK_TIMINGS.staleMs) {
@@ -63478,7 +63504,7 @@ function withConfigLock(codexHome, log2, fn) {
     if (!blocked && head === ticketName) {
       CONFIG_LOCK_TEST_HOOKS.beforeTicketEntry?.();
       const heldName = `held-${String(Date.now()).padStart(15, "0")}-${ticketName.slice(2)}`;
-      const candidateHeldPath = path11.join(queueDir, heldName);
+      const candidateHeldPath = path12.join(queueDir, heldName);
       try {
         fs10.renameSync(ticketPath, candidateHeldPath);
       } catch {
@@ -63519,7 +63545,7 @@ var CONFIG_LOCK_TEST_HOOKS = {};
 function bakeryEnqueue(queueDir) {
   for (let attempt = 0; attempt < 3; attempt++) {
     const token = `${process.pid}-${Math.random().toString(36).slice(2, 10)}`;
-    const markerPath = path11.join(queueDir, `choosing-${token}`);
+    const markerPath = path12.join(queueDir, `choosing-${token}`);
     try {
       fs10.mkdirSync(queueDir, { recursive: true });
       CONFIG_LOCK_TEST_HOOKS.beforeChoosingMarker?.();
@@ -63537,7 +63563,7 @@ function bakeryEnqueue(queueDir) {
           maxSeq = seq;
       }
       const ticketName = `t-${String(maxSeq + 1).padStart(10, "0")}-${token}`;
-      const ticketPath = path11.join(queueDir, ticketName);
+      const ticketPath = path12.join(queueDir, ticketName);
       CONFIG_LOCK_TEST_HOOKS.beforeTicketPublish?.();
       fs10.renameSync(markerPath, ticketPath);
       try {
@@ -63591,7 +63617,7 @@ function resolveWriteTarget(filePath) {
       throw err;
   }
   const seen = /* @__PURE__ */ new Set();
-  let p = path11.resolve(filePath);
+  let p = path12.resolve(filePath);
   for (let depth = 0; depth < 40; depth++) {
     if (seen.has(p)) {
       throw new Error(`symlink cycle at ${p} while resolving ${filePath}`);
@@ -63606,7 +63632,7 @@ function resolveWriteTarget(filePath) {
         return p;
       throw err;
     }
-    p = path11.resolve(path11.dirname(p), link);
+    p = path12.resolve(path12.dirname(p), link);
   }
   throw new Error(`symlink chain deeper than 40 while resolving ${filePath}`);
 }
@@ -63655,7 +63681,7 @@ function ensureParallProvider(codexHome, apiUrl, log2, opts) {
   withConfigLock(codexHome, log2, () => ensureParallProviderLocked(codexHome, apiUrl, opts));
 }
 function ensureParallProviderLocked(codexHome, apiUrl, opts) {
-  const configPath = path11.join(codexHome, "config.toml");
+  const configPath = path12.join(codexHome, "config.toml");
   const baseUrl = apiUrl.replace(/\/$/, "") + "/api/llm/v1";
   try {
     let content = "";
@@ -63701,11 +63727,11 @@ function findSectionEnd(content, fromIndex) {
   return nextHeader === -1 ? content.length : nextHeader;
 }
 function systemPromptCopyPath(workspaceDir) {
-  return path11.join(workspaceDir, ".parall", "system-prompt.md");
+  return path12.join(workspaceDir, ".parall", "system-prompt.md");
 }
 function writeCodexSystemPrompt(workspaceDir, agentIdentity, capabilityFragments) {
   const systemPrompt = buildCodexPlatformInstructions(workspaceDir, agentIdentity, capabilityFragments);
-  fs10.mkdirSync(path11.join(workspaceDir, ".parall"), { recursive: true });
+  fs10.mkdirSync(path12.join(workspaceDir, ".parall"), { recursive: true });
   fs10.writeFileSync(systemPromptCopyPath(workspaceDir), systemPrompt, "utf8");
   return systemPrompt;
 }
@@ -63713,7 +63739,7 @@ function ensureCodexWorkspace(workspaceDir, log2, agentIdentity, capabilityFragm
   fs10.mkdirSync(workspaceDir, { recursive: true });
   runLegacyWorkspaceConfigMigration(workspaceDir, () => readAuthorshipProof(workspaceDir, log2), log2);
   const systemPrompt = writeCodexSystemPrompt(workspaceDir, agentIdentity, capabilityFragments);
-  writeSkillFiles(path11.join(workspaceDir, ".parall", "skills"));
+  writeSkillFiles(path12.join(workspaceDir, ".parall", "skills"));
   return systemPrompt;
 }
 function readAuthorshipProof(workspaceDir, log2) {

package/bundle/parall-daemon.js

@@ -3780,7 +3780,8 @@ var init_client = __esm({
        * `404 NOT_FOUND`. An installed cross-org clip with no connection yet lists
        * as an empty array — including one whose approved auth mode cannot be
        * configured at all (auth=none), which the write path is what refuses. With
-       * `cap:clip-mcp` off the route is not registered at all.
+       * `cap:clip-mcp` off the route is not registered at all. The envelope also
+       * carries `official_oauth_ready` (see MCPConnectionListResponse).
        */
       async listClipMCPConnections(orgId, clipId) {
         return this.request("GET", ENDPOINTS.ORG_CLIP_MCP_CONFIGS(orgId, clipId));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/daemon",
-  "version": "1.58.1",
+  "version": "1.58.2",
   "description": "Parall local agent runtime — daemon supervisor + bridge runtimes, bundled as standalone JS files",
   "license": "MIT",
   "repository": {
@@ -33,11 +33,11 @@
     "@aws-sdk/client-s3": "3.984.0",
     "@pinixai/bb-browser-pro": "0.15.0",
     "ws": "^8.18.0",
-    "@parall/sdk": "1.58.1",
-    "@parall/agent-core": "1.58.1",
-    "@parall/claude-agent": "1.58.1",
-    "@parall/codex-agent": "1.58.1",
-    "@parall/openclaw-agent": "1.58.1"
+    "@parall/agent-core": "1.58.2",
+    "@parall/sdk": "1.58.2",
+    "@parall/claude-agent": "1.58.2",
+    "@parall/codex-agent": "1.58.2",
+    "@parall/openclaw-agent": "1.58.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",