@vtxmacro/cli 2026.10.4 → 2026.10.6

package/bin/vtx-service-bootstrap.js

@@ -1,119 +1,20 @@
+import { createRequire as __vtxCreateRequire } from 'node:module'; const require = __vtxCreateRequire(import.meta.url);
+
 // lib/inference-host/service-bootstrap.ts
-import { spawn as spawn2 } from "node:child_process";
-import { createHash, randomUUID } from "node:crypto";
+import { spawn as spawn3 } from "node:child_process";
 import {
-  access as access2,
-  appendFile,
-  mkdir as mkdir2,
-  readFile as readFile3,
-  readdir as readdir2,
-  rename as rename2,
-  rm as rm3
+  access as access3,
+  appendFile as appendFile2,
+  mkdir as mkdir3,
+  readFile as readFile4,
+  readdir as readdir3,
+  rm as rm4
 } from "node:fs/promises";
-import { dirname as dirname3, isAbsolute as isAbsolute3, join as join3, relative as relative3, resolve as resolve3, win32 as windowsPath2 } from "node:path";
+import { dirname as dirname4, relative as relative4, resolve as resolve4 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // agent-cli-release.json
-var agent_cli_release_default = {
-  package_name: "@vtxmacro/cli",
-  package_version: "2026.10.4",
-  codex_package_name: "@openai/codex",
-  codex_version: "0.155.0",
-  copilot_sdk_package_name: "@github/copilot-sdk",
-  copilot_sdk_version: "1.0.0-beta.8",
-  copilot_cli_package_name: "@github/copilot",
-  copilot_cli_version: "1.0.80",
-  deepseek_harness_version: "0.1.1-rc.2",
-  deepseek_harness_packages: [
-    "@deepseek-ai/dsh-agent",
-    "@deepseek-ai/dsh-agent-instructions",
-    "@deepseek-ai/dsh-agent-loop",
-    "@deepseek-ai/dsh-agent-spine-demo",
-    "@deepseek-ai/dsh-anonymous-user-id",
-    "@deepseek-ai/dsh-atomic-write",
-    "@deepseek-ai/dsh-attachment",
-    "@deepseek-ai/dsh-brand",
-    "@deepseek-ai/dsh-code-runtime",
-    "@deepseek-ai/dsh-credentials",
-    "@deepseek-ai/dsh-fs",
-    "@deepseek-ai/dsh-goal",
-    "@deepseek-ai/dsh-goal-round-driver",
-    "@deepseek-ai/dsh-home-paths",
-    "@deepseek-ai/dsh-invariants",
-    "@deepseek-ai/dsh-jobs",
-    "@deepseek-ai/dsh-jobs-local",
-    "@deepseek-ai/dsh-launch-environment",
-    "@deepseek-ai/dsh-llm",
-    "@deepseek-ai/dsh-llm-deepseek",
-    "@deepseek-ai/dsh-llm-retry",
-    "@deepseek-ai/dsh-output-retention",
-    "@deepseek-ai/dsh-sandbox",
-    "@deepseek-ai/dsh-sandbox-policy",
-    "@deepseek-ai/dsh-scope",
-    "@deepseek-ai/dsh-session",
-    "@deepseek-ai/dsh-session-checkpoint-policy",
-    "@deepseek-ai/dsh-session-persistence",
-    "@deepseek-ai/dsh-session-persistence-jsonl",
-    "@deepseek-ai/dsh-session-projection",
-    "@deepseek-ai/dsh-session-title",
-    "@deepseek-ai/dsh-settings",
-    "@deepseek-ai/dsh-shell",
-    "@deepseek-ai/dsh-shell-env",
-    "@deepseek-ai/dsh-skill",
-    "@deepseek-ai/dsh-skill-filesystem",
-    "@deepseek-ai/dsh-subprocess",
-    "@deepseek-ai/dsh-system-prompt",
-    "@deepseek-ai/dsh-timeout",
-    "@deepseek-ai/dsh-tool-bash",
-    "@deepseek-ai/dsh-tool-goal",
-    "@deepseek-ai/dsh-tool-jobs",
-    "@deepseek-ai/dsh-tool-skill",
-    "@deepseek-ai/dsh-tools",
-    "@deepseek-ai/dsh-typert-protocol",
-    "@deepseek-ai/dsh-user-approval"
-  ],
-  deepseek_cordis_package_name: "@deepseek-ai/cordis",
-  deepseek_cordis_version: "4.0.1",
-  deepseek_support_packages: {
-    "@deepseek-ai/cordis-plugin-timer": "1.1.3"
-  },
-  platforms: {
-    "linux-x64": {
-      package_name: "@openai/codex-linux-x64",
-      target: "x86_64-unknown-linux-musl",
-      binary_name: "codex",
-      sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501"
-    },
-    "win32-x64": {
-      package_name: "@openai/codex-win32-x64",
-      target: "x86_64-pc-windows-msvc",
-      binary_name: "codex.exe",
-      sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b"
-    }
-  },
-  pi_coding_agent_package_name: "@earendil-works/pi-coding-agent",
-  pi_ai_package_name: "@earendil-works/pi-ai",
-  pi_version: "0.85.1",
-  pi_support_packages: [
-    "@earendil-works/pi-agent-core",
-    "@earendil-works/pi-telemetry",
-    "@earendil-works/pi-tui",
-    "@earendil-works/chord"
-  ],
-  grok_version: "1.0.30",
-  grok_platforms: {
-    "linux-x64": {
-      package_name: "@xai-official/grok-linux-x64",
-      binary_name: "grok",
-      sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54"
-    },
-    "win32-x64": {
-      package_name: "@xai-official/grok-win32-x64",
-      binary_name: "grok.exe",
-      sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867"
-    }
-  }
-};
+var agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.6", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
 
 // lib/runtime-policy.generated.json
 var runtime_policy_generated_default = {
@@ -211,6 +112,17 @@ var runtime_policy_generated_default = {
         history_evidence: {
           device_rounds_per_beat: 6,
           device_retry_seconds: 60
+        },
+        panel_reads: {
+          device_open_orders_reuse_seconds: 2
+        },
+        account_stream: {
+          fill_forward_interval_ms: 1e3,
+          fill_forward_max_pending: 500
+        },
+        hyperliquid_snapshot: {
+          max_fills_per_execution: 20,
+          max_fill_payload_bytes: 32768
         }
       },
       server_runtime: {
@@ -225,6 +137,23 @@ var runtime_policy_generated_default = {
           client_presence_http_timeout_milliseconds: 5e3
         }
       }
+    },
+    history_reads: {
+      max_requests_per_read: 64,
+      history_start_ms: 16409952e5,
+      device_read_deadline_seconds: 180,
+      device_recent_window_hours: 24
+    }
+  },
+  agent_cli: {
+    update_check_interval_ms: 144e5,
+    update_check_timeout_ms: 5e3,
+    stage_timeout_ms: 6e5,
+    startup_ready_timeout_ms: 12e4
+  },
+  leaderboard: {
+    device_portfolio: {
+      device_retry_seconds: 300
     }
   },
   external_inference: {
@@ -248,6 +177,9 @@ var runtime_policy_generated_default = {
     runtime_watchdog: {
       ping_interval_milliseconds: 15e3,
       telemetry_interval_milliseconds: 3e5
+    },
+    updates: {
+      auto_check_interval_seconds: 21600
     }
   },
   screener: {
@@ -270,6 +202,8 @@ var runtime_policy_generated_default = {
       client_public_read_budget: {
         max_weight: 1200,
         window_seconds: 60,
+        ui_max_weight_percent: 75,
+        background_max_weight_percent: 50,
         cooldown_seconds: 60,
         metadata_ttl_seconds: 300,
         user_fees_ttl_seconds: 300,
@@ -341,14 +275,38 @@ var runtime_policy_generated_default = {
         trading_analysis: 4,
         ui: 5,
         background: 6
+      },
+      account_stream_backoff: {
+        initial_seconds: 1,
+        max_seconds: 15,
+        multiplier: 2,
+        jitter_seconds: 2,
+        reset_after_seconds: 60
+      },
+      websocket: {
+        ping_interval_seconds: 20,
+        account_open_timeout_seconds: 10
       }
+    },
+    cache: {
+      order_history_ttl_seconds: 30,
+      twap_history_ttl_seconds: 30,
+      twap_fills_ttl_seconds: 30,
+      funding_history_ttl_seconds: 300
+    }
+  },
+  data_sync: {
+    trade_chain_history: {
+      range_page_limit: 500
     }
   }
 };
 
-// lib/inference-host/service-launcher-state.ts
-import { access, readFile as readFile2, rm as rm2 } from "node:fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2 } from "node:path";
+// lib/cli-release/updater.ts
+import { spawn as spawn2 } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { access, appendFile, chmod, lstat as lstat2, mkdir as mkdir2, readFile as readFile2, readdir as readdir2, realpath as realpath2, rename as rename2, rm as rm2 } from "node:fs/promises";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2, win32 as windowsPath2 } from "node:path";
 
 // lib/inference-host/config.ts
 import { randomBytes } from "node:crypto";
@@ -978,7 +936,7 @@ var WINDOWS_PRIVATE_FILE_REPLACE_ERROR_CODES = /* @__PURE__ */ new Set([
 async function replaceAtomicInferencePrivateFile(temporaryPath, destinationPath, options = {}) {
   const platform = options.platform ?? process.platform;
   const renameFile = options.renameFile ?? rename;
-  const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve4) => setTimeout(resolve4, milliseconds)));
+  const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds)));
   const maxAttempts = Math.max(1, options.maxAttempts ?? 40);
   const retryDelayMs = Math.max(0, options.retryDelayMs ?? 25);
   for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
@@ -1384,118 +1342,22 @@ async function acquireInferenceHostProcessLock(path, dependencies = {}) {
   };
 }
 
-// lib/inference-host/service-launcher-state.ts
-var launcherSibling = (manifest, suffix) => {
-  if (!manifest.endsWith(".service.json")) throw new Error("Invalid service manifest path.");
-  return `${manifest.slice(0, -".service.json".length)}${suffix}`;
-};
-var within = (parent, child) => {
-  const part = relative2(resolve2(parent), resolve2(child));
-  return Boolean(part) && !part.startsWith("..") && !isAbsolute2(part);
-};
-var launcherSelection = (manifest, value) => {
-  if (!value || typeof value !== "object") return null;
-  const r = value;
-  if (r.schema_version !== "vtx_inference_service_release_v1" || r.package_name !== "@vtxmacro/cli" || typeof r.package_version !== "string" || !/^\d{4}\.\d{1,2}\.\d{1,3}$/u.test(r.package_version) || typeof r.integrity !== "string" || typeof r.selected_at !== "string" || !Number.isFinite(Date.parse(r.selected_at)) || typeof r.script !== "string" || !isAbsolute2(r.script) || /[\r\n\0]/u.test(r.script) || !within(launcherSibling(manifest, ".service-releases"), r.script)) return null;
-  return r;
-};
-var readLauncherState = async (manifest) => {
-  let value;
-  try {
-    value = JSON.parse(await readFile2(launcherSibling(manifest, ".service-launcher.json"), "utf8"));
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-  if (!value || typeof value !== "object") throw new Error("Invalid service launcher state.");
-  const r = value;
-  const target = (v) => {
-    if (!v || typeof v !== "object") return false;
-    const t = v;
-    return typeof t.package_version === "string" && /^\d{4}\.\d{1,2}\.\d{1,3}$/u.test(t.package_version) && typeof t.script === "string" && isAbsolute2(t.script) && !/[\r\n\0]/u.test(t.script) && (within(launcherSibling(manifest, ".service-releases"), t.script) || resolve2(t.script) === resolve2(launcherSibling(manifest, ".service-bootstrap.previous.js"))) && (t.selection === null || (() => {
-      const selected = launcherSelection(manifest, t.selection);
-      return Boolean(selected && selected.package_version === t.package_version && (resolve2(t.script) === resolve2(join2(dirname2(selected.script), "vtx-service-bootstrap.js")) || resolve2(t.script) === resolve2(launcherSibling(manifest, ".service-bootstrap.previous.js"))));
-    })());
-  };
-  if (r.schema_version !== "vtx_inference_service_launcher_v1" || !target(r.active) || r.previous !== null && !target(r.previous) || typeof r.pending !== "boolean") {
-    throw new Error("Invalid service launcher recovery targets.");
-  }
-  return r;
-};
-
-// lib/inference-host/service-bootstrap.ts
+// lib/cli-release/updater.ts
+var CLI_PACKAGE_NAME = "@vtxmacro/cli";
 var OFFICIAL_NPM_REGISTRY = "https://registry.npmjs.org";
-var PACKAGE_NAME = "@vtxmacro/cli";
-var UPDATE_ATTEMPTS = 3;
-var UPDATE_RETRY_MS = 2e3;
-var CANDIDATE_READINESS_TIMEOUT_MS = runtime_policy_generated_default.external_inference.service.bootstrap_readiness_timeout_ms;
-var SERVICE_DRAIN_COMMAND = "vtx-inference-host-service-drain-v1";
-var SERVICE_QUIESCE_COMMAND = "vtx-inference-host-service-quiesce-v1";
-var safePath = (value, label) => {
-  if (typeof value !== "string" || !value || /[\r\n\0]/u.test(value)) {
-    throw new Error(`Inference-host bootstrap ${label} is invalid.`);
-  }
-  return resolve3(value);
-};
-var parseManifest = (value) => {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("Inference-host bootstrap manifest is invalid.");
-  }
-  const record = value;
-  if (!["vtx_inference_service_v1", "vtx_inference_service_v2", "vtx_inference_service_v3"].includes(String(record.schema_version))) {
-    throw new Error("Inference-host bootstrap manifest version is unsupported.");
-  }
-  return {
-    generation: typeof record.generation === "string" && record.generation ? record.generation : `legacy:${String(record.installed_at ?? "")}`,
-    executable: safePath(record.executable, "executable"),
-    script: safePath(record.script, "script"),
-    log_path: safePath(record.log_path, "log path"),
-    worker_names: Array.isArray(record.workers) ? record.workers.map((worker) => {
-      if (!worker || typeof worker !== "object" || Array.isArray(worker)) {
-        throw new Error("Inference-host bootstrap worker is invalid.");
-      }
-      const instanceName = worker.instance_name;
-      if (typeof instanceName !== "string" || !instanceName) {
-        throw new Error("Inference-host bootstrap worker is invalid.");
-      }
-      return instanceName;
-    }).sort() : ["default"]
-  };
-};
-var serviceSiblingPath = (manifestPath, suffix) => {
-  if (!manifestPath.endsWith(".service.json")) {
-    throw new Error("Inference-host bootstrap manifest path is invalid.");
-  }
-  return `${manifestPath.slice(0, -".service.json".length)}${suffix}`;
-};
-var desiredPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-desired.json");
-var selectionPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-release.json");
-var releasesPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-releases");
-var rejectionPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-release-rejection.json");
-var runtimePathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-runtime.json");
-var readDesired = async (manifestPath) => {
-  const value = JSON.parse(await readFile3(desiredPathFor(manifestPath), "utf8"));
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("Inference-host bootstrap desired state is invalid.");
-  }
-  const record = value;
-  if (record.schema_version !== "vtx_inference_service_desired_v1" || typeof record.desired_running !== "boolean") {
-    throw new Error("Inference-host bootstrap desired state is invalid.");
-  }
-  return record.desired_running;
-};
-var parseVersion = (value) => {
+var CLI_UPDATE_COMMAND = `npm install -g ${CLI_PACKAGE_NAME}@latest`;
+var parseCliReleaseVersion = (value) => {
   const match = /^(\d{4})\.(\d{1,2})\.(\d{1,3})$/u.exec(value);
   if (!match) return null;
   const values = match.slice(1).map(Number);
   if (values.some((entry) => !Number.isSafeInteger(entry) || entry < 0)) return null;
   return values;
 };
-var compareInferenceHostReleaseVersions = (left, right) => {
-  const leftParts = parseVersion(left);
-  const rightParts = parseVersion(right);
+var compareCliReleaseVersions = (left, right) => {
+  const leftParts = parseCliReleaseVersion(left);
+  const rightParts = parseCliReleaseVersion(right);
   if (!leftParts || !rightParts) {
-    throw new Error("Inference-host release version is invalid.");
+    throw new Error("CLI release version is invalid.");
   }
   for (let index = 0; index < leftParts.length; index += 1) {
     const difference = leftParts[index] - rightParts[index];
@@ -1504,45 +1366,14 @@ var compareInferenceHostReleaseVersions = (left, right) => {
   return 0;
 };
 var isPathWithin = (parent, child) => {
-  const childRelative = relative3(resolve3(parent), resolve3(child));
-  return childRelative !== "" && !childRelative.startsWith("..") && !isAbsolute3(childRelative);
-};
-var parseSelection = async (manifestPath) => {
-  try {
-    const value = JSON.parse(await readFile3(selectionPathFor(manifestPath), "utf8"));
-    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-    const record = value;
-    const script = safePath(record.script, "selected script");
-    if (record.schema_version !== "vtx_inference_service_release_v1" || record.package_name !== PACKAGE_NAME || typeof record.package_version !== "string" || !parseVersion(record.package_version) || typeof record.integrity !== "string" || typeof record.selected_at !== "string" || !Number.isFinite(Date.parse(record.selected_at)) || !isPathWithin(releasesPathFor(manifestPath), script)) return null;
-    await access2(script);
-    return record;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    return null;
-  }
+  const childRelative = relative2(resolve2(parent), resolve2(child));
+  return childRelative !== "" && !childRelative.startsWith("..") && !isAbsolute2(childRelative);
 };
-var parseRejection = async (manifestPath) => {
-  try {
-    const value = JSON.parse(await readFile3(rejectionPathFor(manifestPath), "utf8"));
-    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-    const record = value;
-    if (record.schema_version !== "vtx_inference_service_release_rejection_v1" || typeof record.package_version !== "string" || !parseVersion(record.package_version) || typeof record.rejected_at !== "string" || !Number.isFinite(Date.parse(record.rejected_at)) || typeof record.reason !== "string" || !/^[a-z0-9_]{1,96}$/u.test(record.reason)) return null;
-    return record;
-  } catch {
-    return null;
-  }
-};
-var writeRejection = async (manifestPath, rejection) => {
-  await writeAtomicInferencePrivateFile(
-    rejectionPathFor(manifestPath),
-    `${JSON.stringify(rejection, null, 2)}
-`
-  );
-};
-var defaultRunCommand = async (command, args) => await new Promise((resolvePromise) => {
+var defaultRunCliCommand = async (command, args, options = {}) => await new Promise((resolvePromise) => {
   const child = spawn2(command, [...args], {
     windowsHide: true,
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: ["ignore", "pipe", "pipe"],
+    ...options.signal ? { signal: options.signal, killSignal: "SIGKILL" } : {}
   });
   const stdout = [];
   const stderr = [];
@@ -1561,8 +1392,8 @@ var defaultRunCommand = async (command, args) => await new Promise((resolvePromi
     stderr: Buffer.concat(stderr).toString("utf8")
   }));
 });
-var runInferenceHostBootstrapNpmCommand = async (executable, args, platform = process.platform, runCommand = defaultRunCommand) => {
-  if (platform !== "win32") return await runCommand(join3(dirname3(executable), "npm"), args);
+var runCliReleaseNpmCommand = async (executable, args, platform = process.platform, runCommand = defaultRunCliCommand) => {
+  if (platform !== "win32") return await runCommand(join2(dirname2(executable), "npm"), args);
   const npmScript = windowsPath2.join(
     windowsPath2.dirname(executable),
     "node_modules",
@@ -1572,48 +1403,12 @@ var runInferenceHostBootstrapNpmCommand = async (executable, args, platform = pr
   );
   return await runCommand(executable, [npmScript, ...args]);
 };
-var defaultRunSupervisor = (executable, args) => {
-  const child = spawn2(executable, [...args], {
-    windowsHide: true,
-    env: {
-      ...process.env,
-      VTX_INFERENCE_HOST_SERVICE_CHILD: "1",
-      VTX_INFERENCE_HOST_BOOTSTRAP_VERSION: agent_cli_release_default.package_version
-    },
-    stdio: ["pipe", "inherit", "inherit"]
-  });
-  const completion = new Promise((resolvePromise, reject) => {
-    child.once("error", reject);
-    child.once("exit", (code) => resolvePromise(code ?? 1));
-  });
-  child.stdin.on("error", () => {
-  });
-  return {
-    completion,
-    requestDrain: () => {
-      child.stdin.write(`${SERVICE_DRAIN_COMMAND}
-`);
-    },
-    requestQuiesce: () => {
-      child.stdin.write(`${SERVICE_QUIESCE_COMMAND}
-`);
-    }
-  };
-};
-var appendBootstrapLog = async (path, event, fields = {}) => {
-  await mkdir2(dirname3(path), { recursive: true, mode: 448 });
-  await appendFile(
-    path,
-    `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), event, ...fields })}
-`,
-    { encoding: "utf8", mode: 384 }
-  );
-};
-var fetchLatestRelease = async (fetchImpl, signal) => {
-  const response = await fetchImpl(`${OFFICIAL_NPM_REGISTRY}/%40vtxmacro%2Fcli/latest`, {
+var fetchLatestCliRelease = async (fetchImpl, options) => {
+  const registry = (options.registry ?? OFFICIAL_NPM_REGISTRY).replace(/\/+$/u, "");
+  const response = await fetchImpl(`${registry}/%40vtxmacro%2Fcli/latest`, {
     signal: AbortSignal.any([
-      AbortSignal.timeout(runtime_policy_generated_default.external_inference.service.update_registry_timeout_ms),
-      ...signal ? [signal] : []
+      AbortSignal.timeout(options.timeoutMs),
+      ...options.signal ? [options.signal] : []
     ])
   });
   if (!response.ok) throw new Error("registry_request_failed");
@@ -1623,52 +1418,36 @@ var fetchLatestRelease = async (fetchImpl, signal) => {
   }
   const record = value;
   const distribution = record.dist;
-  if (record.name !== PACKAGE_NAME || typeof record.version !== "string" || !parseVersion(record.version) || !distribution || typeof distribution !== "object" || Array.isArray(distribution) || typeof distribution.integrity !== "string") throw new Error("registry_metadata_invalid");
+  if (record.name !== CLI_PACKAGE_NAME || typeof record.version !== "string" || !parseCliReleaseVersion(record.version) || !distribution || typeof distribution !== "object" || Array.isArray(distribution) || typeof distribution.integrity !== "string") throw new Error("registry_metadata_invalid");
   return {
     version: record.version,
     integrity: distribution.integrity
   };
 };
-var verifyIntegrity = async (tarballPath, integrity) => {
+var verifyCliReleaseIntegrity = async (tarballPath, integrity) => {
   const candidates = integrity.split(/\s+/u).map((entry) => {
     const separator = entry.indexOf("-");
     return separator > 0 ? { algorithm: entry.slice(0, separator), digest: entry.slice(separator + 1) } : null;
   }).filter((entry) => entry !== null);
   const supported = ["sha512", "sha384", "sha256"].map((algorithm) => candidates.find((candidate) => candidate.algorithm === algorithm)).find(Boolean);
   if (!supported) throw new Error("release_integrity_unsupported");
-  const actual = createHash(supported.algorithm).update(await readFile3(tarballPath)).digest("base64");
+  const actual = createHash(supported.algorithm).update(await readFile2(tarballPath)).digest("base64");
   if (actual !== supported.digest) throw new Error("release_integrity_mismatch");
 };
-var atomicWriteSelection = async (manifestPath, selection) => {
-  await writeAtomicInferencePrivateFile(
-    selectionPathFor(manifestPath),
-    `${JSON.stringify(selection, null, 2)}
-`
-  );
-};
-var verifyInstalledRelease = async (prefix, targetVersion, executable, platform, runCommand) => {
-  const rootResult = await runInferenceHostBootstrapNpmCommand(
-    executable,
-    ["root", "--global", "--prefix", prefix],
-    platform,
-    runCommand
-  );
-  if (rootResult.exitCode !== 0 || !rootResult.stdout.trim()) {
-    throw new Error("release_install_invalid");
-  }
-  const packagePath = resolve3(rootResult.stdout.trim(), PACKAGE_NAME);
+var verifyInstalledCliRelease = async (prefix, targetVersion, executable, platform, runCommand) => {
+  const packagePath = platform === "win32" ? windowsPath2.join(prefix, "node_modules", "@vtxmacro", "cli") : join2(prefix, "lib", "node_modules", "@vtxmacro", "cli");
   if (!isPathWithin(prefix, packagePath)) throw new Error("release_install_invalid");
-  const packageJson = JSON.parse(await readFile3(join3(packagePath, "package.json"), "utf8"));
+  const packageJson = JSON.parse(await readFile2(join2(packagePath, "package.json"), "utf8"));
   if (!packageJson || typeof packageJson !== "object" || Array.isArray(packageJson)) {
     throw new Error("release_install_invalid");
   }
   const packageRecord = packageJson;
   const bin = packageRecord.bin;
   const binPath = bin && typeof bin === "object" && !Array.isArray(bin) ? bin.vtx : null;
-  if (packageRecord.name !== PACKAGE_NAME || packageRecord.version !== targetVersion || typeof binPath !== "string") throw new Error("release_install_invalid");
-  const script = resolve3(packagePath, binPath);
+  if (packageRecord.name !== CLI_PACKAGE_NAME || packageRecord.version !== targetVersion || typeof binPath !== "string") throw new Error("release_install_invalid");
+  const script = resolve2(packagePath, binPath);
   if (!isPathWithin(packagePath, script)) throw new Error("release_install_invalid");
-  await access2(script);
+  await access(script);
   const verified = await runCommand(executable, [script, "--version"]);
   if (verified.exitCode !== 0 || verified.stdout.trim() !== targetVersion) {
     throw new Error("release_version_verification_failed");
@@ -1679,48 +1458,79 @@ var cleanupInterruptedReleaseStaging = async (releasesPath) => {
   const entries = await readdir2(releasesPath, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isDirectory() && /^\.(?:staging|download)-\d{4}\.\d{1,2}\.\d{1,3}-[0-9a-f-]{36}$/u.test(entry.name)) {
-      await rm3(resolve3(releasesPath, entry.name), { recursive: true, force: true });
+      await rm2(resolve2(releasesPath, entry.name), { recursive: true, force: true });
     }
   }
 };
-var stageRelease = async (manifestPath, target, executable, platform, runCommand, now) => {
-  const releasesPath = releasesPathFor(manifestPath);
-  const finalPath = join3(releasesPath, target.version);
-  const stagingPath = join3(releasesPath, `.staging-${target.version}-${randomUUID()}`);
-  const downloadPath = join3(releasesPath, `.download-${target.version}-${randomUUID()}`);
-  await mkdir2(releasesPath, { recursive: true, mode: 448 });
+var ensureUpdaterPrivateDirectory = async (path, root, dependencies = {}) => {
+  const platform = dependencies.platform ?? process.platform;
+  if (platform !== "win32" && (resolve2(path) === resolve2(root) || isPathWithin(root, path))) {
+    const existing = await lstat2(path).catch(() => null);
+    if (existing && existing.isDirectory() && !existing.isSymbolicLink() && (existing.mode & 63) !== 0 && (typeof process.getuid !== "function" || existing.uid === process.getuid())) {
+      await chmod(path, 448);
+    }
+  }
+  await ensureInferencePrivateDirectory(path, { ...dependencies, defaultRoot: root });
+};
+var stageCliRelease = async (input) => {
+  const { releasesPath, target, executable, platform } = input;
+  const registry = input.registry ?? OFFICIAL_NPM_REGISTRY;
+  const deadline = new AbortController();
+  let reason = "release_stage_timeout";
+  const timer = setTimeout(() => deadline.abort(), input.timeoutMs);
+  const onCancel = () => {
+    reason = "release_stage_cancelled";
+    deadline.abort();
+  };
+  if (input.signal?.aborted) onCancel();
+  input.signal?.addEventListener("abort", onCancel, { once: true });
+  const timedOut = () => new Error(reason);
+  const runCommand = async (command, args) => {
+    if (deadline.signal.aborted) throw timedOut();
+    return await new Promise((resolveCommand, rejectCommand) => {
+      const onAbort = () => rejectCommand(timedOut());
+      deadline.signal.addEventListener("abort", onAbort, { once: true });
+      input.runCommand(command, args, { signal: deadline.signal }).then(resolveCommand, rejectCommand).finally(() => deadline.signal.removeEventListener("abort", onAbort));
+    });
+  };
+  try {
+    return await stageCliReleaseWithin({ ...input, registry, runCommand });
+  } finally {
+    clearTimeout(timer);
+    input.signal?.removeEventListener("abort", onCancel);
+  }
+};
+var stageCliReleaseWithin = async (input) => {
+  const { releasesPath, target, executable, platform, runCommand, registry } = input;
+  const finalPath = join2(releasesPath, target.version);
+  const stagingPath = join2(releasesPath, `.staging-${target.version}-${randomUUID()}`);
+  const downloadPath = join2(releasesPath, `.download-${target.version}-${randomUUID()}`);
+  await ensureUpdaterPrivateDirectory(input.privateRoot, input.privateRoot, { platform });
+  await ensureUpdaterPrivateDirectory(releasesPath, input.privateRoot, { platform });
   await cleanupInterruptedReleaseStaging(releasesPath);
   try {
-    await access2(finalPath);
-    const existingScript = await verifyInstalledRelease(
+    await access(finalPath);
+    const existingScript = await verifyInstalledCliRelease(
       finalPath,
       target.version,
       executable,
       platform,
       runCommand
     );
-    const existingSelection = {
-      schema_version: "vtx_inference_service_release_v1",
-      package_name: PACKAGE_NAME,
-      package_version: target.version,
-      integrity: target.integrity,
-      script: existingScript,
-      selected_at: now().toISOString()
-    };
-    return existingSelection;
+    return { package_version: target.version, integrity: target.integrity, script: existingScript };
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
   await mkdir2(stagingPath, { recursive: true, mode: 448 });
   await mkdir2(downloadPath, { recursive: true, mode: 448 });
   try {
-    const packed = await runInferenceHostBootstrapNpmCommand(executable, [
+    const packed = await runCliReleaseNpmCommand(executable, [
       "pack",
-      `${PACKAGE_NAME}@${target.version}`,
+      `${CLI_PACKAGE_NAME}@${target.version}`,
       "--pack-destination",
       downloadPath,
       "--registry",
-      OFFICIAL_NPM_REGISTRY,
+      registry,
       "--json"
     ], platform, runCommand);
     if (packed.exitCode !== 0) throw new Error("release_download_failed");
@@ -1731,12 +1541,12 @@ var stageRelease = async (manifestPath, target, executable, platform, runCommand
     } catch {
       throw new Error("release_download_invalid");
     }
-    const tarballPath = resolve3(downloadPath, filename);
+    const tarballPath = resolve2(downloadPath, filename);
     if (!filename || !isPathWithin(downloadPath, tarballPath)) {
       throw new Error("release_download_invalid");
     }
-    await verifyIntegrity(tarballPath, target.integrity);
-    const installed = await runInferenceHostBootstrapNpmCommand(executable, [
+    await verifyCliReleaseIntegrity(tarballPath, target.integrity);
+    const installed = await runCliReleaseNpmCommand(executable, [
       "install",
       "--global",
       "--prefix",
@@ -1745,10 +1555,10 @@ var stageRelease = async (manifestPath, target, executable, platform, runCommand
       "--no-audit",
       "--no-fund",
       "--registry",
-      OFFICIAL_NPM_REGISTRY
+      registry
     ], platform, runCommand);
     if (installed.exitCode !== 0) throw new Error("release_install_failed");
-    const stagedScript = await verifyInstalledRelease(
+    const stagedScript = await verifyInstalledCliRelease(
       stagingPath,
       target.version,
       executable,
@@ -1758,23 +1568,224 @@ var stageRelease = async (manifestPath, target, executable, platform, runCommand
     try {
       await rename2(stagingPath, finalPath);
     } catch (error) {
-      if (error.code !== "EEXIST") throw error;
+      if (!["EEXIST", "ENOTEMPTY"].includes(String(error.code))) throw error;
       throw new Error("release_path_already_exists");
     }
-    const finalScript = resolve3(finalPath, relative3(stagingPath, stagedScript));
-    const selection = {
-      schema_version: "vtx_inference_service_release_v1",
-      package_name: PACKAGE_NAME,
+    return {
       package_version: target.version,
       integrity: target.integrity,
-      script: finalScript,
-      selected_at: now().toISOString()
+      script: resolve2(finalPath, relative2(stagingPath, stagedScript))
     };
-    return selection;
   } finally {
-    await rm3(stagingPath, { recursive: true, force: true }).catch(() => void 0);
-    await rm3(downloadPath, { recursive: true, force: true }).catch(() => void 0);
+    await rm2(stagingPath, { recursive: true, force: true }).catch(() => void 0);
+    await rm2(downloadPath, { recursive: true, force: true }).catch(() => void 0);
+  }
+};
+var readCliReleaseRejection = async (path) => {
+  try {
+    const value = JSON.parse(await readFile2(path, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const record = value;
+    if (record.schema_version !== "vtx_inference_service_release_rejection_v1" || typeof record.package_version !== "string" || !parseCliReleaseVersion(record.package_version) || typeof record.rejected_at !== "string" || !Number.isFinite(Date.parse(record.rejected_at)) || typeof record.reason !== "string" || !/^[a-z0-9_]{1,96}$/u.test(record.reason)) return null;
+    return record;
+  } catch {
+    return null;
+  }
+};
+var writeCliReleaseRejection = async (path, rejection, privateRoot) => {
+  if (privateRoot) await ensureUpdaterPrivateDirectory(privateRoot, privateRoot);
+  await writeAtomicInferencePrivateFile(
+    path,
+    `${JSON.stringify(rejection, null, 2)}
+`,
+    privateRoot ? { defaultRoot: privateRoot } : {}
+  );
+};
+
+// lib/inference-host/service-launcher-state.ts
+import { access as access2, readFile as readFile3, rm as rm3 } from "node:fs/promises";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join3, relative as relative3, resolve as resolve3 } from "node:path";
+var launcherSibling = (manifest, suffix) => {
+  if (!manifest.endsWith(".service.json")) throw new Error("Invalid service manifest path.");
+  return `${manifest.slice(0, -".service.json".length)}${suffix}`;
+};
+var within = (parent, child) => {
+  const part = relative3(resolve3(parent), resolve3(child));
+  return Boolean(part) && !part.startsWith("..") && !isAbsolute3(part);
+};
+var launcherSelection = (manifest, value) => {
+  if (!value || typeof value !== "object") return null;
+  const r = value;
+  if (r.schema_version !== "vtx_inference_service_release_v1" || r.package_name !== "@vtxmacro/cli" || typeof r.package_version !== "string" || !/^\d{4}\.\d{1,2}\.\d{1,3}$/u.test(r.package_version) || typeof r.integrity !== "string" || typeof r.selected_at !== "string" || !Number.isFinite(Date.parse(r.selected_at)) || typeof r.script !== "string" || !isAbsolute3(r.script) || /[\r\n\0]/u.test(r.script) || !within(launcherSibling(manifest, ".service-releases"), r.script)) return null;
+  return r;
+};
+var readLauncherState = async (manifest) => {
+  let value;
+  try {
+    value = JSON.parse(await readFile3(launcherSibling(manifest, ".service-launcher.json"), "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  if (!value || typeof value !== "object") throw new Error("Invalid service launcher state.");
+  const r = value;
+  const target = (v) => {
+    if (!v || typeof v !== "object") return false;
+    const t = v;
+    return typeof t.package_version === "string" && /^\d{4}\.\d{1,2}\.\d{1,3}$/u.test(t.package_version) && typeof t.script === "string" && isAbsolute3(t.script) && !/[\r\n\0]/u.test(t.script) && (within(launcherSibling(manifest, ".service-releases"), t.script) || resolve3(t.script) === resolve3(launcherSibling(manifest, ".service-bootstrap.previous.js"))) && (t.selection === null || (() => {
+      const selected = launcherSelection(manifest, t.selection);
+      return Boolean(selected && selected.package_version === t.package_version && (resolve3(t.script) === resolve3(join3(dirname3(selected.script), "vtx-service-bootstrap.js")) || resolve3(t.script) === resolve3(launcherSibling(manifest, ".service-bootstrap.previous.js"))));
+    })());
+  };
+  if (r.schema_version !== "vtx_inference_service_launcher_v1" || !target(r.active) || r.previous !== null && !target(r.previous) || typeof r.pending !== "boolean") {
+    throw new Error("Invalid service launcher recovery targets.");
   }
+  return r;
+};
+
+// lib/inference-host/service-bootstrap.ts
+var UPDATE_ATTEMPTS = 3;
+var UPDATE_RETRY_MS = 2e3;
+var CANDIDATE_READINESS_TIMEOUT_MS = runtime_policy_generated_default.external_inference.service.bootstrap_readiness_timeout_ms;
+var SERVICE_DRAIN_COMMAND = "vtx-inference-host-service-drain-v1";
+var SERVICE_QUIESCE_COMMAND = "vtx-inference-host-service-quiesce-v1";
+var safePath = (value, label) => {
+  if (typeof value !== "string" || !value || /[\r\n\0]/u.test(value)) {
+    throw new Error(`Inference-host bootstrap ${label} is invalid.`);
+  }
+  return resolve4(value);
+};
+var parseManifest = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Inference-host bootstrap manifest is invalid.");
+  }
+  const record = value;
+  if (!["vtx_inference_service_v1", "vtx_inference_service_v2", "vtx_inference_service_v3"].includes(String(record.schema_version))) {
+    throw new Error("Inference-host bootstrap manifest version is unsupported.");
+  }
+  return {
+    generation: typeof record.generation === "string" && record.generation ? record.generation : `legacy:${String(record.installed_at ?? "")}`,
+    executable: safePath(record.executable, "executable"),
+    script: safePath(record.script, "script"),
+    log_path: safePath(record.log_path, "log path"),
+    worker_names: Array.isArray(record.workers) ? record.workers.map((worker) => {
+      if (!worker || typeof worker !== "object" || Array.isArray(worker)) {
+        throw new Error("Inference-host bootstrap worker is invalid.");
+      }
+      const instanceName = worker.instance_name;
+      if (typeof instanceName !== "string" || !instanceName) {
+        throw new Error("Inference-host bootstrap worker is invalid.");
+      }
+      return instanceName;
+    }).sort() : ["default"]
+  };
+};
+var serviceSiblingPath = (manifestPath, suffix) => {
+  if (!manifestPath.endsWith(".service.json")) {
+    throw new Error("Inference-host bootstrap manifest path is invalid.");
+  }
+  return `${manifestPath.slice(0, -".service.json".length)}${suffix}`;
+};
+var desiredPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-desired.json");
+var selectionPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-release.json");
+var releasesPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-releases");
+var rejectionPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-release-rejection.json");
+var runtimePathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-runtime.json");
+var readDesired = async (manifestPath) => {
+  const value = JSON.parse(await readFile4(desiredPathFor(manifestPath), "utf8"));
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Inference-host bootstrap desired state is invalid.");
+  }
+  const record = value;
+  if (record.schema_version !== "vtx_inference_service_desired_v1" || typeof record.desired_running !== "boolean") {
+    throw new Error("Inference-host bootstrap desired state is invalid.");
+  }
+  return record.desired_running;
+};
+var parseSelection = async (manifestPath) => {
+  try {
+    const value = JSON.parse(await readFile4(selectionPathFor(manifestPath), "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const record = value;
+    const script = safePath(record.script, "selected script");
+    if (record.schema_version !== "vtx_inference_service_release_v1" || record.package_name !== CLI_PACKAGE_NAME || typeof record.package_version !== "string" || !parseCliReleaseVersion(record.package_version) || typeof record.integrity !== "string" || typeof record.selected_at !== "string" || !Number.isFinite(Date.parse(record.selected_at)) || !isPathWithin(releasesPathFor(manifestPath), script)) return null;
+    await access3(script);
+    return record;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    return null;
+  }
+};
+var parseRejection = async (manifestPath) => await readCliReleaseRejection(rejectionPathFor(manifestPath));
+var writeRejection = async (manifestPath, rejection) => {
+  await writeCliReleaseRejection(rejectionPathFor(manifestPath), rejection);
+};
+var defaultRunSupervisor = (executable, args) => {
+  const child = spawn3(executable, [...args], {
+    windowsHide: true,
+    env: {
+      ...process.env,
+      VTX_INFERENCE_HOST_SERVICE_CHILD: "1",
+      VTX_INFERENCE_HOST_BOOTSTRAP_VERSION: agent_cli_release_default.package_version
+    },
+    stdio: ["pipe", "inherit", "inherit"]
+  });
+  const completion = new Promise((resolvePromise, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code) => resolvePromise(code ?? 1));
+  });
+  child.stdin.on("error", () => {
+  });
+  return {
+    completion,
+    requestDrain: () => {
+      child.stdin.write(`${SERVICE_DRAIN_COMMAND}
+`);
+    },
+    requestQuiesce: () => {
+      child.stdin.write(`${SERVICE_QUIESCE_COMMAND}
+`);
+    }
+  };
+};
+var appendBootstrapLog = async (path, event, fields = {}) => {
+  await mkdir3(dirname4(path), { recursive: true, mode: 448 });
+  await appendFile2(
+    path,
+    `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), event, ...fields })}
+`,
+    { encoding: "utf8", mode: 384 }
+  );
+};
+var fetchLatestRelease = async (fetchImpl, signal) => await fetchLatestCliRelease(fetchImpl, {
+  timeoutMs: runtime_policy_generated_default.external_inference.service.update_registry_timeout_ms,
+  signal
+});
+var atomicWriteSelection = async (manifestPath, selection) => {
+  await writeAtomicInferencePrivateFile(
+    selectionPathFor(manifestPath),
+    `${JSON.stringify(selection, null, 2)}
+`
+  );
+};
+var stageRelease = async (manifestPath, target, executable, platform, runCommand, now) => {
+  const staged = await stageCliRelease({
+    releasesPath: releasesPathFor(manifestPath),
+    target,
+    executable,
+    platform,
+    runCommand,
+    privateRoot: dirname4(manifestPath),
+    timeoutMs: runtime_policy_generated_default.agent_cli.stage_timeout_ms
+  });
+  return {
+    schema_version: "vtx_inference_service_release_v1",
+    package_name: CLI_PACKAGE_NAME,
+    package_version: staged.package_version,
+    integrity: staged.integrity,
+    script: staged.script,
+    selected_at: now().toISOString()
+  };
 };
 var updateSelection = async (manifestPath, manifest, dependencies) => {
   const active = await parseSelection(manifestPath);
@@ -1793,7 +1804,7 @@ var updateSelection = async (manifestPath, manifest, dependencies) => {
   }
   if (!latest) throw lastError ?? new Error("registry_request_failed");
   const installedVersion = active?.package_version ?? agent_cli_release_default.package_version;
-  if (compareInferenceHostReleaseVersions(latest.version, installedVersion) < 0) {
+  if (compareCliReleaseVersions(latest.version, installedVersion) < 0) {
     return { active, candidate: null };
   }
   if (active && latest.version === active.package_version) {
@@ -1819,8 +1830,8 @@ var waitForCandidateReadiness = async (manifestPath, candidate, signal, timeoutM
   while (!signal.aborted && Date.now() < deadline) {
     if (!await readDesired(manifestPath)) return "aborted";
     try {
-      const currentManifest = parseManifest(JSON.parse(await readFile3(manifestPath, "utf8")));
-      const value = JSON.parse(await readFile3(runtimePathFor(manifestPath), "utf8"));
+      const currentManifest = parseManifest(JSON.parse(await readFile4(manifestPath, "utf8")));
+      const value = JSON.parse(await readFile4(runtimePathFor(manifestPath), "utf8"));
       if (value && typeof value === "object" && !Array.isArray(value)) {
         const runtime = value;
         const workers = Array.isArray(runtime.workers) ? runtime.workers : [];
@@ -1839,20 +1850,20 @@ var prunePrivateReleases = async (manifestPath, keep) => {
   const recovery = await readLauncherState(manifestPath);
   const retained = [...keep, recovery?.active.selection ?? null, recovery?.previous?.selection ?? null];
   const keepPaths = new Set(
-    retained.filter((item) => item !== null).map((item) => resolve3(item.script)).filter((script) => isPathWithin(releasesPath, script)).map((script) => resolve3(releasesPath, relative3(releasesPath, script).split(/[\\/]/u)[0]))
+    retained.filter((item) => item !== null).map((item) => resolve4(item.script)).filter((script) => isPathWithin(releasesPath, script)).map((script) => resolve4(releasesPath, relative4(releasesPath, script).split(/[\\/]/u)[0]))
   );
   let entries;
   try {
-    entries = await readdir2(releasesPath, { withFileTypes: true });
+    entries = await readdir3(releasesPath, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return;
     throw error;
   }
   for (const entry of entries) {
-    if (!entry.isDirectory() || !parseVersion(entry.name)) continue;
-    const releasePath = resolve3(releasesPath, entry.name);
+    if (!entry.isDirectory() || !parseCliReleaseVersion(entry.name)) continue;
+    const releasePath = resolve4(releasesPath, entry.name);
     if (!keepPaths.has(releasePath)) {
-      await rm3(releasePath, { recursive: true, force: true });
+      await rm4(releasePath, { recursive: true, force: true });
     }
   }
 };
@@ -1877,7 +1888,7 @@ var waitForUpdateCheck = async (milliseconds, signal) => {
   });
 };
 var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies = {}, lockPathValue) => {
-  const manifestPath = resolve3(manifestPathValue);
+  const manifestPath = resolve4(manifestPathValue);
   const lockPath = safePath(
     lockPathValue ?? serviceSiblingPath(manifestPath, ".service-bootstrap.lock"),
     "lock path"
@@ -1902,7 +1913,7 @@ var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies =
   process.on("SIGINT", stop);
   if (dependencies.signal?.aborted) stop();
   try {
-    let manifest = parseManifest(JSON.parse(await readFile3(manifestPath, "utf8")));
+    let manifest = parseManifest(JSON.parse(await readFile4(manifestPath, "utf8")));
     const shouldRun = async () => !lifetime.signal.aborted && await readDesired(manifestPath);
     if (!await shouldRun()) {
       await appendBootstrapLog(manifest.log_path, "service_bootstrap_stopped");
@@ -1917,12 +1928,12 @@ var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies =
       fetch: dependencies.fetch ?? fetch,
       now,
       platform: dependencies.platform ?? process.platform,
-      runCommand: dependencies.runCommand ?? defaultRunCommand,
+      runCommand: dependencies.runCommand ?? defaultRunCliCommand,
       sleep,
       signal: lifetime.signal
     };
     const checkUpdate = async () => {
-      manifest = parseManifest(JSON.parse(await readFile3(manifestPath, "utf8")));
+      manifest = parseManifest(JSON.parse(await readFile4(manifestPath, "utf8")));
       const active = await parseSelection(manifestPath);
       try {
         return await updateSelection(manifestPath, manifest, updateDependencies);
@@ -1935,10 +1946,10 @@ var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies =
     };
     let launchedAt = now().toISOString();
     const launch = async (selection) => {
-      manifest = parseManifest(JSON.parse(await readFile3(manifestPath, "utf8")));
+      manifest = parseManifest(JSON.parse(await readFile4(manifestPath, "utf8")));
       const script = selection?.script ?? manifest.script;
-      await access2(manifest.executable);
-      await access2(script);
+      await access3(manifest.executable);
+      await access3(script);
       if (!await shouldRun()) return null;
       await appendBootstrapLog(manifest.log_path, "service_bootstrap_launch", {
         package_version: selection?.package_version ?? agent_cli_release_default.package_version
@@ -1952,7 +1963,7 @@ var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies =
     while (await shouldRun()) {
       if (updatePlan.candidate) {
         const candidate = { ...updatePlan.candidate, selected_at: now().toISOString() };
-        await rm3(runtimePathFor(manifestPath), { force: true });
+        await rm4(runtimePathFor(manifestPath), { force: true });
         await appendBootstrapLog(manifest.log_path, "service_release_candidate_started", {
           package_version: candidate.package_version
         });
@@ -1978,7 +1989,7 @@ var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies =
           ]);
           if (first.kind === "ready" && await shouldRun()) {
             await atomicWriteSelection(manifestPath, candidate);
-            await rm3(rejectionPathFor(manifestPath), { force: true }).catch(() => void 0);
+            await rm4(rejectionPathFor(manifestPath), { force: true }).catch(() => void 0);
             await prunePrivateReleases(manifestPath, [candidate, updatePlan.active]).catch(
               async () => await appendBootstrapLog(
                 manifest.log_path,
@@ -2039,7 +2050,7 @@ var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies =
         void waitForCandidateReadiness(manifestPath, {
           ...updatePlan.active ?? {
             schema_version: "vtx_inference_service_release_v1",
-            package_name: PACKAGE_NAME,
+            package_name: CLI_PACKAGE_NAME,
             package_version: agent_cli_release_default.package_version,
             integrity: "",
             script: manifest.script
@@ -2124,7 +2135,7 @@ var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies =
     await lock.release();
   }
 };
-var invokedPath = process.argv[1] ? resolve3(process.argv[1]) : "";
+var invokedPath = process.argv[1] ? resolve4(process.argv[1]) : "";
 if (invokedPath === fileURLToPath(import.meta.url)) {
   const manifestIndex = process.argv.indexOf("--service-manifest");
   const lockIndex = process.argv.indexOf("--service-lock");
@@ -2142,8 +2153,7 @@ if (invokedPath === fileURLToPath(import.meta.url)) {
   }
 }
 export {
-  compareInferenceHostReleaseVersions,
-  runInferenceHostBootstrapNpmCommand,
+  runCliReleaseNpmCommand,
   runInferenceHostServiceBootstrap
 };
 /*! Bundled license information: