@parall/parall 1.53.0 → 1.54.0

package/dist/index.bundle.mjs

@@ -51698,10 +51698,17 @@ var ENDPOINTS = {
   // Per-org agent exec access for one clip (default all agents; PUT human-only)
   ORG_CLIP_EXEC_ACCESS: (orgId, clipId) => `/api/v1/orgs/${orgId}/clips/${clipId}/exec-access`,
   // MCP clip server config (cap:clip-mcp; publisher-org only — cross-org gets
-  // 403 MCP_CROSS_ORG_DISABLED on the whole family, reads included)
+  // 403 MCP_CROSS_ORG_DISABLED on the whole family, reads included). The
+  // singular family addresses the org's DEFAULT connection (pre-165
+  // back-compat shim); the plural family is the multi-connection surface —
+  // one config row (credential slot) per connection, addressed by config id.
   ORG_CLIP_MCP_CONFIG: (orgId, clipId) => `/api/v1/orgs/${orgId}/clip-registry/${clipId}/mcp-config`,
   ORG_CLIP_MCP_TOOLS_REFRESH: (orgId, clipId) => `/api/v1/orgs/${orgId}/clip-registry/${clipId}/mcp-config/tools/refresh`,
-  ORG_CLIP_MCP_OAUTH_DISCONNECT: (orgId, clipId) => `/api/v1/orgs/${orgId}/clip-registry/${clipId}/mcp-config/oauth/disconnect`
+  ORG_CLIP_MCP_OAUTH_DISCONNECT: (orgId, clipId) => `/api/v1/orgs/${orgId}/clip-registry/${clipId}/mcp-config/oauth/disconnect`,
+  ORG_CLIP_MCP_CONFIGS: (orgId, clipId) => `/api/v1/orgs/${orgId}/clip-registry/${clipId}/mcp-configs`,
+  ORG_CLIP_MCP_CONFIG_BY_ID: (orgId, clipId, configId) => `/api/v1/orgs/${orgId}/clip-registry/${clipId}/mcp-configs/${configId}`,
+  ORG_CLIP_MCP_TOOLS_REFRESH_BY_ID: (orgId, clipId, configId) => `/api/v1/orgs/${orgId}/clip-registry/${clipId}/mcp-configs/${configId}/tools/refresh`,
+  ORG_CLIP_MCP_OAUTH_DISCONNECT_BY_ID: (orgId, clipId, configId) => `/api/v1/orgs/${orgId}/clip-registry/${clipId}/mcp-configs/${configId}/oauth/disconnect`
 };
 var WS_EVENTS = {
   // Client -> Server
@@ -53994,6 +54001,17 @@ var ParallClient = class _ParallClient {
   async deleteClipMCPConfig(orgId, clipId, expectedVersion) {
     return this.request("DELETE", ENDPOINTS.ORG_CLIP_MCP_CONFIG(orgId, clipId), void 0, void 0, false, { headers: { "If-Match": `"${expectedVersion}"` } });
   }
+  /**
+   * List the org's MCP connections for a clip, default first — one row per
+   * connection (credential slot), WITHOUT the tools snapshot (`tool_count`
+   * summarizes it; the per-config GET carries the full snapshot). Same
+   * family-wide fence as the singular GET: publisher-org members only —
+   * cross-org installs get `403 MCP_CROSS_ORG_DISABLED`, and with
+   * `cap:clip-mcp` off the route is not registered at all.
+   */
+  async listClipMCPConnections(orgId, clipId) {
+    return this.request("GET", ENDPOINTS.ORG_CLIP_MCP_CONFIGS(orgId, clipId));
+  }
   /**
    * Re-run tools/list and replace the cached snapshot (org-admin only).
    * Deliberately does NOT advance the CAS version, so an in-flight edit in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/parall",
-  "version": "1.53.0",
+  "version": "1.54.0",
   "description": "OpenClaw channel plugin for Parall IM",
   "license": "MIT",
   "repository": {
@@ -16,8 +16,8 @@
     "openclaw.plugin.json"
   ],
   "dependencies": {
-    "@parall/sdk": "1.53.0",
-    "@parall/agent-core": "1.53.0"
+    "@parall/agent-core": "1.54.0",
+    "@parall/sdk": "1.54.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/skills/parall-clip-authoring/SKILL.md

@@ -242,8 +242,15 @@ and the folder is just a manifest:
   republishing.
 - Entering the credential / completing OAuth is a HUMAN step in the Clip
   Console (the config-write endpoints are session-only — an API key cannot
-  call them). Once configured, discover the live tool schemas with
-  `parall clip tools <clip>` and exec like any other clip.
+  call them). An org can add SEVERAL connections to one MCP clip — one
+  credential slot per account of the same service — all sharing the declared
+  `server_url`/`auth`. Once configured, discover the live tool schemas with
+  `parall clip tools <clip> [--connection <ref>]` and exec like any other
+  clip (`--connection` picks the account).
+- Do NOT declare anything about OAuth client registration in the manifest —
+  there is no such field. Whether the provider needs a manually registered
+  OAuth app (Google-style) is probed by the server at connect time; the
+  Console walks the admin through it when required.
 - Publish is the same command: `parall clip publish ./my-clip/`.
 
 ## Cloud (hosted) vs desktop (BYOC) Edge

package/skills/parall-clips/SKILL.md

@@ -40,16 +40,23 @@ guessing which signed-in account you are about to act through.
 ```bash
 parall clip exec <clip> <command> [args] --connection <ccn_|alias>  # the normal form
 parall clip exec browser-tools screenshot '{"url":"…"}' --connection cloud-main
+parall clip exec browser-tools scrape --args-file - --connection cloud-main <<'EOF'
+{"url":"https://example.com","fields":["title","price"]}
+EOF
 ```
 
 Build `args` as JSON per the command's params from `clip info` (or the
 tool's `inputSchema` from `clip tools` for MCP clips — tool names are NOT
 frozen in the manifest, so never guess a tool name or its argument shape).
+Quote-heavy or large JSON goes through `--args-file <path>` (`-` = stdin
+via a quoted heredoc, as above; strict JSON, mutually exclusive with the
+`[args]` positional) — the shell mangles inline quotes long before the CLI
+sees them, exactly the trap `messages send --text-file` exists for.
 Results are JSON on stdout; failures print a typed error.
 
-**Name the target explicitly.** A cloud profile has NO implicit route;
-omitting the target entirely is a desktop-only legacy form that reaches just
-YOUR OWN online desktop device — never a shared cloud profile.
+**Name the target explicitly — every exec.** `clip exec` refuses to run
+without `--connection` or `--edge`; there is no implicit route to any
+profile, and the legacy no-flag desktop fallback is gone from the CLI.
 
 - A cloud (hosted) profile is reachable ONLY via `--connection` — the clip
   connection its maintainer bound. That binding IS your authorization;
@@ -67,21 +74,39 @@ YOUR OWN online desktop device — never a shared cloud profile.
 ## MCP clips (remote tool servers)
 
 A connection with target `mcp` routes to a remote MCP server; the command
-is an MCP tool name and the args are that tool's JSON arguments. Read each
-tool's `inputSchema` from `clip tools` first, then exec against the
-explicit target — the same form as any other clip:
+is an MCP tool name and the args are that tool's JSON arguments. **An MCP
+clip can hold SEVERAL connections — one per account of the same service**
+(e.g. two Google Drive accounts), exactly like the browser arm's multiple
+profiles. The flow is: discover the connections, pick by alias, exec with the
+explicit target:
 
 ```bash
+parall clip connections <clip>            # per-connection auth status, alias, is_default
+parall clip tools <clip> --connection <ccn_|alias>   # tools are PER CONNECTION
 parall clip exec <clip> <tool> [json-args] --connection <ccn_|alias>
 ```
 
+- `clip connections` marks MCP rows with their auth mode, `credential_set`
+  / `oauth_status` and `tool_count` — a `needs_reauth` or credential-less
+  row will refuse exec until an org admin fixes it in the Clip Console.
+- `--connection` is REQUIRED to exec an MCP connection, exactly like a cloud
+  profile — the only other target form, `--edge`, is a desktop device and
+  never routes to MCP. The alias tells you WHICH account you act as —
+  always name it.
+  (`is_default` marks the org's primary connection in listings and the
+  Console, not an implicit exec route.)
+- `clip tools` without `--connection` reads the default connection's
+  snapshot; with several connections and no default it asks you to name one.
 - No cold start: MCP clips never return `EDGE_ACTIVATING`.
 - `MCP_TOOL_FAILED` = the tool RAN and reported failure; a sanitized summary
   of its output rides in the error details. Read it and decide — do not
   blind-retry.
 - `MCP_CONCURRENCY_LIMIT` = not started; back off briefly, then retry.
-- `MCP_CONFIG_MISSING` / `MCP_DISABLED` = the clip isn't configured, or MCP
-  is off for this deployment — ask an org admin; retrying won't help.
+- `MCP_CONFIG_MISSING` / `MCP_DISABLED` = that connection isn't configured,
+  or MCP is off for this deployment — ask an org admin; retrying won't help.
+- `MCP_OAUTH_REAUTH_REQUIRED` = that connection's authorization expired or
+  was disconnected — ask an org admin to re-authorize it in the Clip Console
+  (name the connection's alias); retrying won't help.
 - `OUTCOME_UNKNOWN` follows the rule below: dispatched and MAY HAVE
   EXECUTED — never auto-retry.