@parall/parall 1.61.0 → 1.63.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/parall",
-  "version": "1.61.0",
+  "version": "1.63.0",
   "description": "OpenClaw channel plugin for Parall IM",
   "license": "MIT",
   "repository": {
@@ -16,8 +16,8 @@
     "openclaw.plugin.json"
   ],
   "dependencies": {
-    "@parall/agent-core": "1.61.0",
-    "@parall/sdk": "1.61.0"
+    "@parall/agent-core": "1.63.0",
+    "@parall/sdk": "1.63.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/skills/parall-clip-authoring/SKILL.md

@@ -212,14 +212,17 @@ or configure.
 
    ```sh
    parall clip exec <clip> <command> '{"query":"AI","count":10}' --connection <ccn_id|alias>
-   # or route to a desktop (BYOC) device you own: --edge <edge-id>
-   # --connection and --edge are mutually exclusive; --timeout <ms> defaults to 30000
+   # --connection is REQUIRED for an agent: a desktop device, a cloud profile
+   # and an MCP server are all reached through the connection bound to the
+   # clip. --timeout <ms> defaults to 30000
    ```
 
-   A **cloud (hosted) profile is reachable ONLY via `--connection`** — the
-   binding its maintainer created IS the authorization. With neither flag the
-   server resolves only your own online desktop device, never a cloud profile.
-   Discover the bindings with `parall clip connections <clip>`.
+   Who may run through a connection follows its layer (ADR-020): an
+   org-shared connection (cloud profile, MCP server, org-managed device) is
+   decided by the clip's access list an org admin edits; a member's personal
+   desktop device is theirs alone. Discover what YOU may run through with
+   `parall clip connections <clip>` — an ungranted connection is not listed,
+   so a missing row means "ask an admin", not "retry".
 
 3. **Iterate**: edit locally → `parall clip publish` again → re-exec. Exec
    resolves the file set from the REGISTRY, server-side — your own org always

package/skills/parall-clips/SKILL.md

@@ -18,11 +18,17 @@ parall clip tools <clip>       # MCP clips only: live tool schemas
 ```
 
 `clip list` answers both discovery questions at once: WHICH clip (name,
-description, version) and WHERE it can run — every connection with its
-`ccn_…` id, alias, and target kind:
+description, version) and WHERE it could run — every connection you can SEE
+(public org-layer rows or those the clip's access list admits you to, plus rows on your
+own personal device; an admin's list is a management view of the whole org
+layer and does not by itself grant exec) with its `ccn_…` id, alias, and
+target kind:
 
 - `cloud` — an org-shared cloud profile (a maintainer's signed-in browser)
-- `desktop` — a member's own device (only its owner can exec through it)
+- `desktop` — a member's device: org-shared (`layer: org` — an org admin
+  binds it; public connections admit everyone, otherwise the clip's access
+  list decides, same as cloud and MCP) or
+  personal (`layer: personal` — its owner alone, nobody else sees it)
 - `mcp` — a remote MCP tool server
 - `device` — a device whose placement could not be resolved just now (the
   device list was unavailable); don't guess which kind it is — re-run
@@ -54,15 +60,18 @@ via a quoted heredoc, as above; strict JSON, mutually exclusive with the
 sees them, exactly the trap `messages send --text-file` exists for.
 Results are JSON on stdout; failures print a typed error.
 
-**Name the target explicitly — every exec.** `clip exec` refuses to run
-without `--connection` or `--edge`; there is no implicit route to any
-profile, and the legacy no-flag desktop fallback is gone from the CLI.
-
-- A cloud (hosted) profile is reachable ONLY via `--connection` — the clip
-  connection its maintainer bound. That binding IS your authorization;
-  without one the server answers `HOSTED_CONNECTION_REQUIRED` and the fix
-  is to ask an owner/admin to bind the clip, never to retry.
-- `--edge <edgeId>` targets only a desktop device YOU own.
+**Name the connection — every exec.** `clip exec` refuses to run without
+`--connection`; there is no other target form. A desktop device, a cloud
+(hosted) profile and an MCP server are all reached through the connection
+bound to the clip, and the connection is what your access is granted on.
+
+- Without a connection the server answers `AGENT_CONNECTION_REQUIRED`; the
+  fix is to discover the clip's connections and name one, never to retry.
+- human 调用返回 `CONNECTION_NOT_ALLOWED` 时，请 org admin 公开该 connection
+  或把调用者加入 Clip 名单；agent 本版仍返回下述两个错误码。
+- `CLIP_AGENT_NOT_ALLOWED` / `CLIP_AGENT_CONNECTION_NOT_ALLOWED` mean a
+  human has restricted who may run this clip (or through which account);
+  ask them to widen access — you cannot grant it to yourself.
 - Waiting on a cloud profile is handled by the CLI: `EDGE_ACTIVATING` (cold
   start), `EDGE_BUSY` (another exec is running) and
   `EDGE_CONCURRENCY_LIMIT` (org at capacity) are all guaranteed-unexecuted
@@ -89,10 +98,9 @@ parall clip exec <clip> <tool> [json-args] --connection <ccn_|alias>
 - `clip connections` marks MCP rows with their auth mode, `credential_set`
   / `oauth_status` and `tool_count` — a `needs_reauth` or credential-less
   row will refuse exec until an org admin fixes it in the Clip Console.
-- `--connection` is REQUIRED to exec an MCP connection, exactly like a cloud
-  profile — the only other target form, `--edge`, is a desktop device and
-  never routes to MCP. The alias tells you WHICH account you act as —
-  always name it.
+- `--connection` is REQUIRED to exec an MCP connection, exactly like every
+  other target. The alias tells you WHICH account you act as — always name
+  it.
   (`is_default` marks the org's primary connection in listings and the
   Console, not an implicit exec route.)
 - `clip tools` without `--connection` reads the default connection's
@@ -110,11 +118,22 @@ parall clip exec <clip> <tool> [json-args] --connection <ccn_|alias>
 - `OUTCOME_UNKNOWN` follows the rule below: dispatched and MAY HAVE
   EXECUTED — never auto-retry.
 
+## Browser Use
+
+Browser Use 接受 personal key 和 agent key，无需 managed key；权限按调用者
+在目标设备 profile 上的授权裁决。`PROFILE_NOT_ALLOWED` 表示未获授权，
+请 org admin 调整该 profile 的公开状态或名单，不要重试或改用其他 key 绕过。
+profile 公开只授予 browser.read / browser.interact，browser.advanced 仍需显式授权。
+Clip exec 的 connection 是另一种目标：agent 调用仍必须带 connection，缺失会返回
+`AGENT_CONNECTION_REQUIRED`，先发现 connection 再调用。
+
 ## Behavior rules
 
-- An authorization error (`HOSTED_CONNECTION_REQUIRED`, `FORBIDDEN`) is a
-  fail-fast: ask the clip's maintainer or an org admin to bind the clip or
-  grant the connection — do not retry or work around it.
+- An authorization error (`CLIP_AGENT_NOT_ALLOWED`,
+  `CLIP_AGENT_CONNECTION_NOT_ALLOWED`, `CONNECTION_NOT_ALLOWED`,
+  `PROFILE_NOT_ALLOWED`, `FORBIDDEN`) is a fail-fast: ask
+  an org admin to grant the clip or the connection — do not retry or work
+  around it.
 - If the target device is offline or the call times out, report that
   plainly; do not queue, and never fabricate a result for a run that errored.
 - **`OUTCOME_UNKNOWN` is never retryable.** It means the command was

package/skills/parall-platform/SKILL.md

@@ -264,16 +264,16 @@ Every entity is addressable with a `prll://` URI. Common prefixes you'll see in
 | `prll://prj_` | Project | parall-tasks |
 | `prll://sch_` | Schedule (time trigger) | parall-schedules |
 | `prll://srn_` | Schedule run (single fire audit record; carries fire-time snapshot) | parall-schedules |
-| `prll://xcn_` | External Trigger Connection (incoming endpoint) | parall-external-triggers |
-| `prll://xin_` | External Trigger Event (single incoming event audit record) | parall-external-triggers |
-| `prll://xtr_` | External Trigger (incoming trigger configuration) | parall-external-triggers |
-| `prll://xrn_` | External Trigger run (single matched dispatch audit record) | parall-external-triggers |
+| `prll://xcn_` | Trigger Connection (incoming endpoint) | parall-triggers |
+| `prll://xin_` | Trigger Event (single incoming event audit record) | parall-triggers |
+| `prll://xtr_` | Trigger (incoming trigger configuration) | parall-triggers |
+| `prll://xrn_` | Trigger run (single matched dispatch audit record) | parall-triggers |
 | `prll://wik_` | Wiki | parall-wiki |
 | `prll://att_` | Attachment | parall-platform (files) |
 
 When a message or event references `prll://sch_xxx` or `prll://srn_xxx`, or when you receive `[Event: schedule.fired]`, switch to the **parall-schedules** skill for the CLI commands (create / list / pause / resume / cancel / runs).
 
-When a message or event references `prll://xcn_xxx`, `prll://xin_xxx`, `prll://xtr_xxx`, or `prll://xrn_xxx`, or when you receive `[Event: external.trigger]`, switch to the **parall-external-triggers** skill for the CLI commands (connections / triggers / events / runs).
+When a message or event references `prll://xcn_xxx`, `prll://xin_xxx`, `prll://xtr_xxx`, or `prll://xrn_xxx`, or when you receive `[Event: external.trigger]`, switch to the **parall-triggers** skill for the CLI commands (connections / triggers / events / runs).
 
 ## References (relationship graph)
 

package/skills/{parall-external-triggers → parall-triggers}/SKILL.md

@@ -1,27 +1,27 @@
 ---
-name: parall-external-triggers
-description: "Parall External Trigger operations: create incoming connections, configure CEL/Liquid triggers, inspect incoming events and runs, and respond to `[Event: external.trigger]` dispatches. Use when: user asks to connect an external system to an agent, set up incoming callbacks/notifications, or when the agent receives an external trigger event."
+name: parall-triggers
+description: "Parall Trigger operations: create incoming connections, configure CEL/Liquid triggers, inspect incoming events and runs, and respond to `[Event: external.trigger]` dispatches. Use when: user asks to connect an external system to an agent, set up incoming callbacks/notifications, or when the agent receives a trigger event."
 ---
 
-# Parall External Triggers
+# Parall Triggers
 
-An **External Trigger** is an incoming platform trigger. External systems send events to an External Trigger Connection, Parall matches active triggers with CEL, renders a Liquid template into an agent input body, and dispatches that input to the configured target agents.
+A **Trigger** is an incoming automation entity. External systems send events to a Trigger Connection, Parall matches active triggers with CEL, renders a Liquid template into an agent input body, and dispatches that input to the configured target agents.
 
-Use External Triggers for incoming events such as GitHub callbacks, Slack/Feishu notifications, generic webhooks, or emails once the platform has a connection for them. The runtime behavior is incoming-only: receiving a trigger does not imply that you can call the external system back unless another explicit Parall capability is available.
+Use Triggers for incoming events such as GitHub callbacks, Slack/Feishu notifications, generic webhooks, or emails once the platform has a connection for them. The runtime behavior is incoming-only: receiving a trigger does not imply that you can call the external system back unless another explicit Parall capability is available.
 
 ## Prerequisite
 
-External Trigger CLI commands are gated by the org-level `external-triggers` feature flag. If a command reports that the feature is unavailable, ask a human org admin to enable the flag before trying again. Public ingress delivery may still be live even when the management CLI is hidden behind the rollout flag.
+Trigger CLI commands are gated by the org-level `external-triggers` feature flag. If a command reports that the feature is unavailable, ask a human org admin to enable the flag before trying again. Public ingress delivery may still be live even when the management CLI is hidden behind the rollout flag.
 
 ## Creating a trigger
 
 ```bash
 # 1. Create a connection. The ingress token is shown once; prefer writing it
 # to a local file so it does not land in shell history or logs.
-parall external-triggers create-connection --name "GitHub CI" --token-file ./github-ci-webhook-token.txt
+parall triggers create-connection --name "GitHub CI" --token-file ./github-ci-webhook-token.txt
 
 # 2. Create a trigger that targets one or more agents.
-parall external-triggers create \
+parall triggers create \
   --connection prll://xcn_xxx \
   --name "Failed checks" \
   --target-ids prll://usr_agent_xxx \
@@ -53,25 +53,25 @@ Do not render access tokens, signing secrets, cookies, or private credentials in
 ## Inspecting and lifecycle
 
 ```bash
-parall external-triggers connections
-parall external-triggers connection prll://xcn_xxx
-parall external-triggers schema prll://xcn_xxx
-
-parall external-triggers list
-parall external-triggers list --connection prll://xcn_xxx
-parall external-triggers get prll://xtr_xxx
-parall external-triggers update prll://xtr_xxx --filter "event.type == 'check_run'"
-parall external-triggers pause prll://xtr_xxx
-parall external-triggers resume prll://xtr_xxx
-parall external-triggers delete prll://xtr_xxx
-
-parall external-triggers runs prll://xtr_xxx
-parall external-triggers run prll://xrn_xxx
-parall external-triggers events --connection prll://xcn_xxx
-parall external-triggers event prll://xin_xxx
+parall triggers connections
+parall triggers connection prll://xcn_xxx
+parall triggers schema prll://xcn_xxx
+
+parall triggers list
+parall triggers list --connection prll://xcn_xxx
+parall triggers get prll://xtr_xxx
+parall triggers update prll://xtr_xxx --filter "event.type == 'check_run'"
+parall triggers pause prll://xtr_xxx
+parall triggers resume prll://xtr_xxx
+parall triggers delete prll://xtr_xxx
+
+parall triggers runs prll://xtr_xxx
+parall triggers run prll://xrn_xxx
+parall triggers events --connection prll://xcn_xxx
+parall triggers event prll://xin_xxx
 ```
 
-## Responding to external trigger dispatches
+## Responding to trigger dispatches
 
 When you receive `[Event: external.trigger]`, Parall has already matched a trigger and rendered its template. The prompt includes headers such as:
 
@@ -84,9 +84,9 @@ When you receive `[Event: external.trigger]`, Parall has already matched a trigg
 The rendered agent input body follows those headers. You usually do not need to fetch the run before acting. Fetch the run only for audit/debugging:
 
 ```bash
-parall external-triggers run prll://xrn_xxx
+parall triggers run prll://xrn_xxx
 ```
 
-Act on the rendered input the same way you would act on a user message: send a message, create or update tasks, edit wiki pages, or use available clips. If no visible response is needed, use `parall no-reply --reason "handled external trigger"` before sending any message.
+Act on the rendered input the same way you would act on a user message: send a message, create or update tasks, edit wiki pages, or use available clips. If no visible response is needed, use `parall no-reply --reason "handled trigger"` before sending any message.
 
 CLI command results are JSON on stdout; mutation commands may emit auxiliary hints on stderr, for example `Created: prll://xtr_xxx`.

package/src/gateway.ts

@@ -14,6 +14,7 @@ import {
   initAgentTelemetry,
   resolveServiceVersion,
   createOtelLogger,
+  traceContextHeaders,
   type DispatchAdapter,
   type ParallEvent,
   type RuntimeEvent,
@@ -436,6 +437,7 @@ export const parallGateway: ChannelGatewayAdapter<ResolvedParallAccount> = {
       baseUrl: config.parall_url,
       token: config.api_key,
       swimlaneName: process.env.PRLL_SWIMLANE_NAME,
+      getRequestHeaders: traceContextHeaders,
     });
 
     const me = await getAgentMeWithLegacyFallback(client, config.org_id);
@@ -443,10 +445,11 @@ export const parallGateway: ChannelGatewayAdapter<ResolvedParallAccount> = {
     setAgentIdentity(identityFromMe(me));
     log?.info(`parall[${ctx.accountId}]: authenticated as ${me.display_name} (${agentUserId})`);
 
+    const serviceVersion = resolveServiceVersion(import.meta.url);
     const telemetry = await initAgentTelemetry('parall-openclaw-agent', 'openclaw', {
       apiUrl: process.env.PRLL_API_URL,
       apiKey: process.env.PRLL_API_KEY,
-      serviceVersion: resolveServiceVersion(import.meta.url),
+      serviceVersion,
     });
     const otelLog = createOtelLogger('agent', 'openclaw-agent');
     try {
@@ -526,6 +529,7 @@ export const parallGateway: ChannelGatewayAdapter<ResolvedParallAccount> = {
         },
         agentUserId,
         runtimeType: 'openclaw',
+        runtimeVersion: serviceVersion,
         runtimeKey: orchestratorKey,
         runtimeRef: { hostname: os.hostname(), pid: process.pid },
         dispatchAdapter,