@vtxmacro/cli 2026.10.6 → 2026.10.8

package/bin/vtx-mcp.js

@@ -37,7 +37,7 @@ var init_define_VTX_PI_MODEL_POLICY = __esm({
 var agent_cli_release_default;
 var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
-    agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.6", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
+    agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.8", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
   }
 });
 
@@ -1199,7 +1199,7 @@ init_define_VTX_PI_MODEL_POLICY();
 init_agent_cli_release();
 import { spawn as spawn2 } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { access, appendFile, chmod, lstat as lstat2, mkdir as mkdir3, readFile as readFile3, readdir as readdir3, realpath as realpath2, rename as rename2, rm as rm3 } from "node:fs/promises";
+import { access, appendFile, chmod, lstat as lstat2, readFile as readFile3, readdir as readdir3, realpath as realpath2, rename as rename2, rm as rm3 } from "node:fs/promises";
 import { constants as osConstants, homedir as homedir3 } from "node:os";
 import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3, relative as relative2, resolve as resolve2, win32 as windowsPath2 } from "node:path";
 
@@ -1296,6 +1296,9 @@ var runtime_policy_generated_default = {
           evidence_max_items: 32,
           evidence_shared_read_seconds: 10
         },
+        protective_plan_set_lock: {
+          wait_seconds: 120
+        },
         history_evidence: {
           device_rounds_per_beat: 6,
           device_retry_seconds: 60
@@ -1561,6 +1564,7 @@ var InferenceHostProcessLockBusyError = class extends Error {
   }
 };
 var MAX_INFERENCE_PRIVATE_FILE_BYTES = 16 * 1024 * 1024;
+var WINDOWS_PRIVATE_ACL_MODES = ["harden", "verify", "verify-owner", "verify-private"];
 var WINDOWS_PRIVATE_ACL_BROKER_SCRIPT = `$ErrorActionPreference='Stop'
 $ProgressPreference='SilentlyContinue'
 while(($line=[Console]::In.ReadLine()) -ne $null) {
@@ -1577,7 +1581,7 @@ while(($line=[Console]::In.ReadLine()) -ne $null) {
     $kind=[string]$request.kind
     $mode=[string]$request.mode
     if($kind -ne 'directory' -and $kind -ne 'file') { throw 'invalid path kind' }
-    if($mode -ne 'harden' -and $mode -ne 'verify' -and $mode -ne 'verify-owner') { throw 'invalid ACL mode' }
+    if($mode -ne 'harden' -and $mode -ne 'verify' -and $mode -ne 'verify-owner' -and $mode -ne 'verify-private') { throw 'invalid ACL mode' }
     $path=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([string]$request.path_b64))
     if([string]::IsNullOrWhiteSpace($path) -or $path.Length -gt 32767 -or $path.Contains([char]0)) { throw 'invalid path' }
     $failureStage='path_lookup'
@@ -1626,11 +1630,12 @@ while(($line=[Console]::In.ReadLine()) -ne $null) {
     $owner=(New-Object Security.Principal.NTAccount($actual.Owner)).Translate([Security.Principal.SecurityIdentifier]).Value
     if($owner -ne $current.Value -and ($owner -ne $admins.Value -or -not $currentIsAdmin)) { throw 'private ACL owner is invalid' }
     if($mode -ne 'verify-owner') {
-      if(-not $actual.AreAccessRulesProtected) { throw 'private ACL inheritance is invalid' }
+      $inheritedAllowed=$mode -eq 'verify-private'
+      if(-not $inheritedAllowed -and -not $actual.AreAccessRulesProtected) { throw 'private ACL inheritance is invalid' }
       $userFull=$false
       foreach($rule in $actual.Access) {
         $sid=$rule.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value
-        if($rule.IsInherited -or $allowed -notcontains $sid -or $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow) {
+        if(($rule.IsInherited -and -not $inheritedAllowed) -or $allowed -notcontains $sid -or $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow) {
           throw 'private ACL contains an unauthorized access rule'
         }
         if($sid -eq $current.Value -and (($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl)) { $userFull=$true }
@@ -1766,9 +1771,9 @@ var WindowsPrivateAclBroker = class {
       error.code = "ENOENT";
       pending.reject(error);
     } else {
-      pending.reject(new Error(
+      pending.reject(Object.assign(new Error(
         `Windows private ACL ${pending.mode} failed (${response.error_code}).`
-      ));
+      ), { aclStage: response.error_code }));
     }
     this.scheduleIdleShutdown();
   }
@@ -1873,7 +1878,7 @@ var secureWindowsPrivatePath = async (path, kind, mode, platform = process.platf
 };
 var invalidateWindowsAclCache = (path) => {
   for (const kind of ["file", "directory"]) {
-    for (const mode of ["harden", "verify", "verify-owner"]) {
+    for (const mode of WINDOWS_PRIVATE_ACL_MODES) {
       windowsAclCache.delete(aclCacheKey(path, kind, mode));
     }
   }
@@ -1892,7 +1897,7 @@ var rebindHardenedWindowsAclAfterRename = async (source, destination, kind, expe
   }
   invalidateWindowsAclCache(source);
   invalidateWindowsAclCache(destination);
-  for (const mode of ["harden", "verify", "verify-owner"]) {
+  for (const mode of WINDOWS_PRIVATE_ACL_MODES) {
     windowsAclCache.set(aclCacheKey(destination, kind, mode), published);
   }
 };
@@ -1903,10 +1908,11 @@ var rebindHardenedWindowsDirectoryAfterOwnedMutation = async (path, expected) =>
     throw new Error("Windows private directory identity changed during atomic publication.");
   }
   invalidateWindowsAclCache(path);
-  for (const mode of ["harden", "verify", "verify-owner"]) {
+  for (const mode of WINDOWS_PRIVATE_ACL_MODES) {
     windowsAclCache.set(aclCacheKey(path, "directory", mode), current);
   }
 };
+var isWindowsPrivateAclVerificationFailure = (error) => error?.aclStage === "acl_verification";
 var isDefaultWindowsPrivatePath = (path, root = resolve(homedir2(), ".vtx", "inference-host")) => {
   const child = relative(root, resolve(path));
   return child === "" || !child.startsWith("..") && !child.includes(":");
@@ -2740,7 +2746,32 @@ var cleanupInterruptedReleaseStaging = async (releasesPath) => {
 };
 var ensureUpdaterPrivateDirectory = async (path, root, dependencies = {}) => {
   const platform = dependencies.platform ?? process.platform;
-  if (platform !== "win32" && (resolve2(path) === resolve2(root) || isPathWithin(root, path))) {
+  if (platform === "win32") {
+    const existing = await lstat2(path).catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (!existing) {
+      await ensureInferencePrivateDirectory(path, { ...dependencies, defaultRoot: root });
+      return;
+    }
+    if (existing.isSymbolicLink() || !existing.isDirectory()) {
+      throw new Error("Inference host state directory is unsafe.");
+    }
+    const runner = dependencies.runner ?? runWindowsPrivateAcl;
+    try {
+      await secureWindowsPrivatePath(path, "directory", "verify-private", platform, runner);
+    } catch (error) {
+      if (!isWindowsPrivateAclVerificationFailure(error)) throw error;
+      if ((await readdir3(path)).length > 0) {
+        const recovery = /\.service-releases$/u.test(path) ? "run 'vtx inference-host service uninstall' then 'install'" : "delete this directory; it is recreated private";
+        throw new Error(`updater_dir_not_private: ${recovery} (${path})`, { cause: error });
+      }
+      await secureWindowsPrivatePath(path, "directory", "harden", platform, runner);
+    }
+    return;
+  }
+  if (resolve2(path) === resolve2(root) || isPathWithin(root, path)) {
     const existing = await lstat2(path).catch(() => null);
     if (existing && existing.isDirectory() && !existing.isSymbolicLink() && (existing.mode & 63) !== 0 && (typeof process.getuid !== "function" || existing.uid === process.getuid())) {
       await chmod(path, 448);
@@ -2797,8 +2828,8 @@ var stageCliReleaseWithin = async (input) => {
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
-  await mkdir3(stagingPath, { recursive: true, mode: 448 });
-  await mkdir3(downloadPath, { recursive: true, mode: 448 });
+  await ensureUpdaterPrivateDirectory(stagingPath, input.privateRoot, { platform });
+  await ensureUpdaterPrivateDirectory(downloadPath, input.privateRoot, { platform });
   try {
     const packed = await runCliReleaseNpmCommand(executable, [
       "pack",

package/bin/vtx-service-bootstrap.js

@@ -14,7 +14,7 @@ import { dirname as dirname4, relative as relative4, resolve as resolve4 } from
 import { fileURLToPath } from "node:url";
 
 // agent-cli-release.json
-var agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.6", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
+var agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.8", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
 
 // lib/runtime-policy.generated.json
 var runtime_policy_generated_default = {
@@ -109,6 +109,9 @@ var runtime_policy_generated_default = {
           evidence_max_items: 32,
           evidence_shared_read_seconds: 10
         },
+        protective_plan_set_lock: {
+          wait_seconds: 120
+        },
         history_evidence: {
           device_rounds_per_beat: 6,
           device_retry_seconds: 60
@@ -305,7 +308,7 @@ var runtime_policy_generated_default = {
 // lib/cli-release/updater.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { access, appendFile, chmod, lstat as lstat2, mkdir as mkdir2, readFile as readFile2, readdir as readdir2, realpath as realpath2, rename as rename2, rm as rm2 } from "node:fs/promises";
+import { access, appendFile, chmod, lstat as lstat2, readFile as readFile2, readdir as readdir2, realpath as realpath2, rename as rename2, rm as rm2 } from "node:fs/promises";
 import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2, win32 as windowsPath2 } from "node:path";
 
 // lib/inference-host/config.ts
@@ -322,6 +325,7 @@ var InferenceHostProcessLockBusyError = class extends Error {
   }
 };
 var MAX_INFERENCE_PRIVATE_FILE_BYTES = 16 * 1024 * 1024;
+var WINDOWS_PRIVATE_ACL_MODES = ["harden", "verify", "verify-owner", "verify-private"];
 var WINDOWS_PRIVATE_ACL_BROKER_SCRIPT = `$ErrorActionPreference='Stop'
 $ProgressPreference='SilentlyContinue'
 while(($line=[Console]::In.ReadLine()) -ne $null) {
@@ -338,7 +342,7 @@ while(($line=[Console]::In.ReadLine()) -ne $null) {
     $kind=[string]$request.kind
     $mode=[string]$request.mode
     if($kind -ne 'directory' -and $kind -ne 'file') { throw 'invalid path kind' }
-    if($mode -ne 'harden' -and $mode -ne 'verify' -and $mode -ne 'verify-owner') { throw 'invalid ACL mode' }
+    if($mode -ne 'harden' -and $mode -ne 'verify' -and $mode -ne 'verify-owner' -and $mode -ne 'verify-private') { throw 'invalid ACL mode' }
     $path=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([string]$request.path_b64))
     if([string]::IsNullOrWhiteSpace($path) -or $path.Length -gt 32767 -or $path.Contains([char]0)) { throw 'invalid path' }
     $failureStage='path_lookup'
@@ -387,11 +391,12 @@ while(($line=[Console]::In.ReadLine()) -ne $null) {
     $owner=(New-Object Security.Principal.NTAccount($actual.Owner)).Translate([Security.Principal.SecurityIdentifier]).Value
     if($owner -ne $current.Value -and ($owner -ne $admins.Value -or -not $currentIsAdmin)) { throw 'private ACL owner is invalid' }
     if($mode -ne 'verify-owner') {
-      if(-not $actual.AreAccessRulesProtected) { throw 'private ACL inheritance is invalid' }
+      $inheritedAllowed=$mode -eq 'verify-private'
+      if(-not $inheritedAllowed -and -not $actual.AreAccessRulesProtected) { throw 'private ACL inheritance is invalid' }
       $userFull=$false
       foreach($rule in $actual.Access) {
         $sid=$rule.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value
-        if($rule.IsInherited -or $allowed -notcontains $sid -or $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow) {
+        if(($rule.IsInherited -and -not $inheritedAllowed) -or $allowed -notcontains $sid -or $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow) {
           throw 'private ACL contains an unauthorized access rule'
         }
         if($sid -eq $current.Value -and (($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl)) { $userFull=$true }
@@ -527,9 +532,9 @@ var WindowsPrivateAclBroker = class {
       error.code = "ENOENT";
       pending.reject(error);
     } else {
-      pending.reject(new Error(
+      pending.reject(Object.assign(new Error(
         `Windows private ACL ${pending.mode} failed (${response.error_code}).`
-      ));
+      ), { aclStage: response.error_code }));
     }
     this.scheduleIdleShutdown();
   }
@@ -634,7 +639,7 @@ var secureWindowsPrivatePath = async (path, kind, mode, platform = process.platf
 };
 var invalidateWindowsAclCache = (path) => {
   for (const kind of ["file", "directory"]) {
-    for (const mode of ["harden", "verify", "verify-owner"]) {
+    for (const mode of WINDOWS_PRIVATE_ACL_MODES) {
       windowsAclCache.delete(aclCacheKey(path, kind, mode));
     }
   }
@@ -653,7 +658,7 @@ var rebindHardenedWindowsAclAfterRename = async (source, destination, kind, expe
   }
   invalidateWindowsAclCache(source);
   invalidateWindowsAclCache(destination);
-  for (const mode of ["harden", "verify", "verify-owner"]) {
+  for (const mode of WINDOWS_PRIVATE_ACL_MODES) {
     windowsAclCache.set(aclCacheKey(destination, kind, mode), published);
   }
 };
@@ -664,10 +669,11 @@ var rebindHardenedWindowsDirectoryAfterOwnedMutation = async (path, expected) =>
     throw new Error("Windows private directory identity changed during atomic publication.");
   }
   invalidateWindowsAclCache(path);
-  for (const mode of ["harden", "verify", "verify-owner"]) {
+  for (const mode of WINDOWS_PRIVATE_ACL_MODES) {
     windowsAclCache.set(aclCacheKey(path, "directory", mode), current);
   }
 };
+var isWindowsPrivateAclVerificationFailure = (error) => error?.aclStage === "acl_verification";
 var isDefaultWindowsPrivatePath = (path, root = resolve(homedir(), ".vtx", "inference-host")) => {
   const child = relative(root, resolve(path));
   return child === "" || !child.startsWith("..") && !child.includes(":");
@@ -1464,7 +1470,32 @@ var cleanupInterruptedReleaseStaging = async (releasesPath) => {
 };
 var ensureUpdaterPrivateDirectory = async (path, root, dependencies = {}) => {
   const platform = dependencies.platform ?? process.platform;
-  if (platform !== "win32" && (resolve2(path) === resolve2(root) || isPathWithin(root, path))) {
+  if (platform === "win32") {
+    const existing = await lstat2(path).catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (!existing) {
+      await ensureInferencePrivateDirectory(path, { ...dependencies, defaultRoot: root });
+      return;
+    }
+    if (existing.isSymbolicLink() || !existing.isDirectory()) {
+      throw new Error("Inference host state directory is unsafe.");
+    }
+    const runner = dependencies.runner ?? runWindowsPrivateAcl;
+    try {
+      await secureWindowsPrivatePath(path, "directory", "verify-private", platform, runner);
+    } catch (error) {
+      if (!isWindowsPrivateAclVerificationFailure(error)) throw error;
+      if ((await readdir2(path)).length > 0) {
+        const recovery = /\.service-releases$/u.test(path) ? "run 'vtx inference-host service uninstall' then 'install'" : "delete this directory; it is recreated private";
+        throw new Error(`updater_dir_not_private: ${recovery} (${path})`, { cause: error });
+      }
+      await secureWindowsPrivatePath(path, "directory", "harden", platform, runner);
+    }
+    return;
+  }
+  if (resolve2(path) === resolve2(root) || isPathWithin(root, path)) {
     const existing = await lstat2(path).catch(() => null);
     if (existing && existing.isDirectory() && !existing.isSymbolicLink() && (existing.mode & 63) !== 0 && (typeof process.getuid !== "function" || existing.uid === process.getuid())) {
       await chmod(path, 448);
@@ -1521,8 +1552,8 @@ var stageCliReleaseWithin = async (input) => {
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
-  await mkdir2(stagingPath, { recursive: true, mode: 448 });
-  await mkdir2(downloadPath, { recursive: true, mode: 448 });
+  await ensureUpdaterPrivateDirectory(stagingPath, input.privateRoot, { platform });
+  await ensureUpdaterPrivateDirectory(downloadPath, input.privateRoot, { platform });
   try {
     const packed = await runCliReleaseNpmCommand(executable, [
       "pack",

package/bin/vtx-service-launcher.js

@@ -93,6 +93,9 @@ var runtime_policy_generated_default = {
           evidence_max_items: 32,
           evidence_shared_read_seconds: 10
         },
+        protective_plan_set_lock: {
+          wait_seconds: 120
+        },
         history_evidence: {
           device_rounds_per_beat: 6,
           device_retry_seconds: 60
@@ -306,6 +309,7 @@ var InferenceHostProcessLockBusyError = class extends Error {
   }
 };
 var MAX_INFERENCE_PRIVATE_FILE_BYTES = 16 * 1024 * 1024;
+var WINDOWS_PRIVATE_ACL_MODES = ["harden", "verify", "verify-owner", "verify-private"];
 var WINDOWS_PRIVATE_ACL_BROKER_SCRIPT = `$ErrorActionPreference='Stop'
 $ProgressPreference='SilentlyContinue'
 while(($line=[Console]::In.ReadLine()) -ne $null) {
@@ -322,7 +326,7 @@ while(($line=[Console]::In.ReadLine()) -ne $null) {
     $kind=[string]$request.kind
     $mode=[string]$request.mode
     if($kind -ne 'directory' -and $kind -ne 'file') { throw 'invalid path kind' }
-    if($mode -ne 'harden' -and $mode -ne 'verify' -and $mode -ne 'verify-owner') { throw 'invalid ACL mode' }
+    if($mode -ne 'harden' -and $mode -ne 'verify' -and $mode -ne 'verify-owner' -and $mode -ne 'verify-private') { throw 'invalid ACL mode' }
     $path=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([string]$request.path_b64))
     if([string]::IsNullOrWhiteSpace($path) -or $path.Length -gt 32767 -or $path.Contains([char]0)) { throw 'invalid path' }
     $failureStage='path_lookup'
@@ -371,11 +375,12 @@ while(($line=[Console]::In.ReadLine()) -ne $null) {
     $owner=(New-Object Security.Principal.NTAccount($actual.Owner)).Translate([Security.Principal.SecurityIdentifier]).Value
     if($owner -ne $current.Value -and ($owner -ne $admins.Value -or -not $currentIsAdmin)) { throw 'private ACL owner is invalid' }
     if($mode -ne 'verify-owner') {
-      if(-not $actual.AreAccessRulesProtected) { throw 'private ACL inheritance is invalid' }
+      $inheritedAllowed=$mode -eq 'verify-private'
+      if(-not $inheritedAllowed -and -not $actual.AreAccessRulesProtected) { throw 'private ACL inheritance is invalid' }
       $userFull=$false
       foreach($rule in $actual.Access) {
         $sid=$rule.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value
-        if($rule.IsInherited -or $allowed -notcontains $sid -or $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow) {
+        if(($rule.IsInherited -and -not $inheritedAllowed) -or $allowed -notcontains $sid -or $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow) {
           throw 'private ACL contains an unauthorized access rule'
         }
         if($sid -eq $current.Value -and (($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl)) { $userFull=$true }
@@ -511,9 +516,9 @@ var WindowsPrivateAclBroker = class {
       error.code = "ENOENT";
       pending.reject(error);
     } else {
-      pending.reject(new Error(
+      pending.reject(Object.assign(new Error(
         `Windows private ACL ${pending.mode} failed (${response.error_code}).`
-      ));
+      ), { aclStage: response.error_code }));
     }
     this.scheduleIdleShutdown();
   }
@@ -618,7 +623,7 @@ var secureWindowsPrivatePath = async (path, kind, mode, platform = process.platf
 };
 var invalidateWindowsAclCache = (path) => {
   for (const kind of ["file", "directory"]) {
-    for (const mode of ["harden", "verify", "verify-owner"]) {
+    for (const mode of WINDOWS_PRIVATE_ACL_MODES) {
       windowsAclCache.delete(aclCacheKey(path, kind, mode));
     }
   }
@@ -637,7 +642,7 @@ var rebindHardenedWindowsAclAfterRename = async (source, destination, kind, expe
   }
   invalidateWindowsAclCache(source);
   invalidateWindowsAclCache(destination);
-  for (const mode of ["harden", "verify", "verify-owner"]) {
+  for (const mode of WINDOWS_PRIVATE_ACL_MODES) {
     windowsAclCache.set(aclCacheKey(destination, kind, mode), published);
   }
 };
@@ -648,7 +653,7 @@ var rebindHardenedWindowsDirectoryAfterOwnedMutation = async (path, expected) =>
     throw new Error("Windows private directory identity changed during atomic publication.");
   }
   invalidateWindowsAclCache(path);
-  for (const mode of ["harden", "verify", "verify-owner"]) {
+  for (const mode of WINDOWS_PRIVATE_ACL_MODES) {
     windowsAclCache.set(aclCacheKey(path, "directory", mode), current);
   }
 };