@vtxmacro/cli 2026.8.17 → 2026.8.19

package/bin/vtx.js

@@ -38,7 +38,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.8.17",
+      package_version: "2026.8.19",
       codex_package_name: "@openai/codex",
       codex_version: "0.147.0",
       platforms: {
@@ -16080,10 +16080,11 @@ var init_external_inference_contract = __esm({
 
 // lib/inference-host/config.ts
 import { randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
 import { constants } from "node:fs";
 import { lstat, mkdir, open, readFile, realpath, rename, rm } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join, relative, resolve } from "node:path";
 function inferenceBaseDir(env) {
   const configured = String(env.VTX_INFERENCE_HOST_HOME || "").trim();
   return configured || join(homedir(), ".vtx", "inference-host");
@@ -16132,6 +16133,7 @@ function assertLocalState(value) {
   return record2;
 }
 async function ensureInferencePrivateDirectory(path) {
+  let created = false;
   try {
     const before = await lstat(path);
     if (before.isSymbolicLink() || !before.isDirectory()) {
@@ -16140,22 +16142,26 @@ async function ensureInferencePrivateDirectory(path) {
   } catch (error48) {
     if (error48.code !== "ENOENT") throw error48;
     await mkdir(path, { recursive: true, mode: 448 });
+    created = true;
   }
   const after = await lstat(path);
   if (after.isSymbolicLink() || !after.isDirectory()) {
     throw new Error("Inference host state directory is unsafe.");
   }
-  if (process.platform !== "win32") {
-    if ((after.mode & 63) !== 0) {
-      throw new Error("Inference host state directory must have mode 0700.");
-    }
-    if (typeof process.getuid === "function" && after.uid !== process.getuid()) {
-      throw new Error("Inference host state directory must be owned by the current user.");
-    }
-    const canonical = await realpath(path);
-    if (canonical !== resolve(path)) {
-      throw new Error("Inference host state directory may not traverse symbolic links.");
-    }
+  if (process.platform === "win32") {
+    if (created) await secureWindowsPrivatePath(path, "directory", "harden");
+    else await secureExistingWindowsPath(path, "directory");
+    return;
+  }
+  if ((after.mode & 63) !== 0) {
+    throw new Error("Inference host state directory must have mode 0700.");
+  }
+  if (typeof process.getuid === "function" && after.uid !== process.getuid()) {
+    throw new Error("Inference host state directory must be owned by the current user.");
+  }
+  const canonical = await realpath(path);
+  if (canonical !== resolve(path)) {
+    throw new Error("Inference host state directory may not traverse symbolic links.");
   }
 }
 async function syncInferenceDirectory(path, platform = process.platform) {
@@ -16188,8 +16194,12 @@ async function writeAtomicInferencePrivateFile(path, contents) {
     throw error48;
   }
   await handle.close();
+  await secureWindowsPrivatePath(temporary, "file", "harden");
   try {
+    invalidateWindowsAclCache(path);
     await rename(temporary, path);
+    invalidateWindowsAclCache(temporary);
+    await secureWindowsPrivatePath(path, "file", "verify");
     await syncInferenceDirectory(directory);
   } catch (error48) {
     await rm(temporary, { force: true }).catch(() => void 0);
@@ -16207,6 +16217,8 @@ async function readInferencePrivateFile(path, label) {
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error(`${label} is unsafe.`);
   }
+  await secureExistingWindowsPath(dirname(path), "directory");
+  await secureExistingWindowsPath(path, "file");
   const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
   try {
     const opened = await handle.stat();
@@ -16227,7 +16239,10 @@ async function clearInferencePrivateFile(path, label) {
     if (metadata.isSymbolicLink() || !metadata.isFile()) {
       throw new Error(`${label} is unsafe.`);
     }
+    await secureExistingWindowsPath(dirname(path), "directory");
+    await secureExistingWindowsPath(path, "file");
     await rm(path);
+    invalidateWindowsAclCache(path);
     await syncInferenceDirectory(dirname(path));
   } catch (error48) {
     if (error48.code !== "ENOENT") throw error48;
@@ -16257,10 +16272,21 @@ async function writeInferenceHostLocalState(path, state) {
 async function clearInferenceHostLocalState(path) {
   await clearInferencePrivateFile(path, "Inference host local state file");
 }
-async function acquireInferenceHostProcessLock(path) {
+async function acquireInferenceHostProcessLock(path, dependencies = {}) {
   const directory = dirname(path);
   await ensureInferencePrivateDirectory(directory);
   const ownerToken = randomBytes(24).toString("base64url");
+  const observeIdentity = dependencies.processIdentity ?? defaultProcessIdentity;
+  const currentBootIdentity = dependencies.currentBootIdentity ?? (() => readInferenceSystemBootIdentity());
+  const isProcessAlive = dependencies.processAlive ?? ((pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (error48) {
+      if (error48.code === "ESRCH") return false;
+      throw error48;
+    }
+  });
   let handle;
   for (let acquisition = 0; acquisition < 2; acquisition += 1) {
     try {
@@ -16275,41 +16301,123 @@ async function acquireInferenceHostProcessLock(path) {
       if (acquisition > 0) {
         throw new Error("Another inference host process already owns this local host.");
       }
-      const before = await lstat(path);
+      let before;
+      try {
+        before = await lstat(path);
+      } catch (error49) {
+        if (error49.code === "ENOENT") continue;
+        throw error49;
+      }
       if (before.isSymbolicLink() || !before.isFile() || process.platform !== "win32" && (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
         throw new Error("Inference host process lock is unsafe.");
       }
+      const reclaimPublicationResidue = async () => {
+        let current2;
+        try {
+          current2 = await lstat(path);
+        } catch (error49) {
+          if (error49.code === "ENOENT") return false;
+          throw error49;
+        }
+        if (current2.isSymbolicLink() || !current2.isFile() || current2.dev !== before.dev || current2.ino !== before.ino || process.platform !== "win32" && (current2.mode & 63) !== 0 || typeof process.getuid === "function" && current2.uid !== process.getuid()) {
+          throw new Error("Inference host process lock publication residue changed or is unsafe.");
+        }
+        try {
+          await rm(path);
+        } catch (error49) {
+          if (error49.code === "ENOENT") return false;
+          throw error49;
+        }
+        processLockObservationCache.delete(resolve(path));
+        await syncInferenceDirectory(directory);
+        return true;
+      };
+      try {
+        await secureExistingWindowsPath(path, "file");
+      } catch (error49) {
+        if (error49.code === "ENOENT") continue;
+        throw error49;
+      }
       let staleOwner;
       try {
         staleOwner = JSON.parse(await readFile(path, "utf8"));
-      } catch {
-        throw new Error("Inference host process lock is invalid.");
+      } catch (error49) {
+        if (error49.code === "ENOENT") continue;
+        if (Date.now() - before.mtimeMs < 1e4) {
+          throw new Error("Another inference host process already owns this local host.");
+        }
+        await reclaimPublicationResidue();
+        continue;
       }
-      if (staleOwner.schema_version !== 1 || !Number.isSafeInteger(staleOwner.pid) || Number(staleOwner.pid) < 1 || typeof staleOwner.owner_token !== "string" || !staleOwner.owner_token) {
-        throw new Error("Inference host process lock is invalid.");
+      if (staleOwner.schema_version !== 2 || !Number.isSafeInteger(staleOwner.pid) || Number(staleOwner.pid) < 1 || typeof staleOwner.owner_token !== "string" || !staleOwner.owner_token || typeof staleOwner.process_identity !== "string" || !staleOwner.process_identity || typeof staleOwner.boot_identity !== "string" || !staleOwner.boot_identity) {
+        if (Date.now() - before.mtimeMs < 1e4) {
+          throw new Error("Another inference host process already owns this local host.");
+        }
+        await reclaimPublicationResidue();
+        continue;
       }
+      const stalePid = Number(staleOwner.pid);
+      const bootIdentity2 = await currentBootIdentity();
+      if (bootIdentity2 === staleOwner.boot_identity && isProcessAlive(stalePid)) {
+        const cached2 = processLockObservationCache.get(resolve(path));
+        const observedIdentity = cached2 && cached2.dev === before.dev && cached2.ino === before.ino && cached2.pid === stalePid && cached2.storedIdentity === staleOwner.process_identity && Date.now() - cached2.observedAtMs < 5e3 ? cached2.observedIdentity : await observeIdentity(stalePid);
+        if (!observedIdentity) {
+          throw new Error("Inference host could not verify the existing lock owner identity.");
+        }
+        processLockObservationCache.set(resolve(path), {
+          dev: before.dev,
+          ino: before.ino,
+          pid: stalePid,
+          storedIdentity: staleOwner.process_identity,
+          observedIdentity,
+          observedAtMs: Date.now()
+        });
+        if (inferenceProcessIdentitiesMatch(staleOwner.process_identity, observedIdentity)) {
+          throw new Error("Another inference host process already owns this local host.");
+        }
+      }
+      let current;
       try {
-        process.kill(Number(staleOwner.pid), 0);
-        throw new Error("Another inference host process already owns this local host.");
-      } catch (probeError) {
-        if (probeError.code !== "ESRCH") throw probeError;
+        current = await lstat(path);
+      } catch (error49) {
+        if (error49.code === "ENOENT") continue;
+        throw error49;
       }
-      const current = await lstat(path);
       if (current.dev !== before.dev || current.ino !== before.ino) {
         throw new Error("Inference host process lock ownership changed.");
       }
       await rm(path);
+      processLockObservationCache.delete(resolve(path));
       await syncInferenceDirectory(directory);
     }
   }
   if (!handle) throw new Error("Inference host process lock could not be acquired.");
+  let ownerIdentity;
+  let bootIdentity;
+  try {
+    [ownerIdentity, bootIdentity] = await Promise.all([
+      (dependencies.currentProcessIdentity ?? defaultCurrentProcessIdentity)(),
+      currentBootIdentity()
+    ]);
+  } catch (error48) {
+    await handle.close().catch(() => void 0);
+    await rm(path, { force: true }).catch(() => void 0);
+    throw error48;
+  }
   await handle.writeFile(
-    `${JSON.stringify({ schema_version: 1, pid: process.pid, owner_token: ownerToken })}
+    `${JSON.stringify({
+      schema_version: 2,
+      pid: process.pid,
+      owner_token: ownerToken,
+      process_identity: ownerIdentity,
+      boot_identity: bootIdentity
+    })}
 `,
     "utf8"
   );
   await handle.sync();
   await handle.close();
+  await secureWindowsPrivatePath(path, "file", "harden");
   await syncInferenceDirectory(directory);
   let released = false;
   return {
@@ -16326,17 +16434,342 @@ async function acquireInferenceHostProcessLock(path) {
         throw new Error("Inference host process lock ownership changed.");
       }
       await rm(path);
+      processLockObservationCache.delete(resolve(path));
       await syncInferenceDirectory(directory);
       released = true;
     }
   };
 }
-var INFERENCE_CREDENTIAL_NAMESPACE, MAX_INFERENCE_PRIVATE_FILE_BYTES, credentialStoreIdentity;
+var INFERENCE_CREDENTIAL_NAMESPACE, MAX_INFERENCE_PRIVATE_FILE_BYTES, WINDOWS_PRIVATE_ACL_SCRIPT, windowsPrivateAclInvocation, runWindowsPrivateAcl, windowsAclCache, windowsAclIdentity, aclCacheKey, secureWindowsPrivatePath, invalidateWindowsAclCache, isDefaultWindowsPrivatePath, secureExistingWindowsPath, linuxProcessIdentity, windowsProcessIdentity, darwinProcessIdentity, runSmallIdentityCommand, cachedSystemBootIdentity, readInferenceSystemBootIdentity, defaultProcessIdentity, defaultCurrentProcessIdentity, processLockObservationCache, inferenceProcessIdentitiesMatch, credentialStoreIdentity;
 var init_config = __esm({
   "lib/inference-host/config.ts"() {
     "use strict";
     INFERENCE_CREDENTIAL_NAMESPACE = "vtxmacro-insights-inference";
     MAX_INFERENCE_PRIVATE_FILE_BYTES = 16 * 1024 * 1024;
+    WINDOWS_PRIVATE_ACL_SCRIPT = `$ErrorActionPreference='Stop'
+$path=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:VTX_PRIVATE_PATH_B64))
+$kind=$env:VTX_PRIVATE_PATH_KIND
+$mode=$env:VTX_PRIVATE_ACL_MODE
+if(-not (Test-Path -LiteralPath $path)) { [Console]::Out.Write('missing'); exit 3 }
+$current=[Security.Principal.WindowsIdentity]::GetCurrent().User
+$system=New-Object Security.Principal.SecurityIdentifier('S-1-5-18')
+$admins=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-544')
+$allowed=@($current.Value,$system.Value,$admins.Value)
+if($mode -eq 'harden') {
+  $acl=Get-Acl -LiteralPath $path
+  $existingOwner=(New-Object Security.Principal.NTAccount($acl.Owner)).Translate([Security.Principal.SecurityIdentifier]).Value
+  if($existingOwner -ne $current.Value) { throw 'private ACL owner is invalid' }
+  $acl.SetAccessRuleProtection($true,$false)
+  foreach($existingRule in @($acl.Access)) {
+    [void]$acl.RemoveAccessRuleSpecific($existingRule)
+  }
+  $inherit=if($kind -eq 'directory') {
+    [Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'
+  } else { [Security.AccessControl.InheritanceFlags]::None }
+  foreach($sid in @($current,$system,$admins)) {
+    $rule=New-Object Security.AccessControl.FileSystemAccessRule(
+      $sid,
+      [Security.AccessControl.FileSystemRights]::FullControl,
+      $inherit,
+      [Security.AccessControl.PropagationFlags]::None,
+      [Security.AccessControl.AccessControlType]::Allow
+    )
+    [void]$acl.AddAccessRule($rule)
+  }
+  (Get-Item -LiteralPath $path).SetAccessControl($acl)
+}
+$actual=Get-Acl -LiteralPath $path
+$owner=(New-Object Security.Principal.NTAccount($actual.Owner)).Translate([Security.Principal.SecurityIdentifier]).Value
+if($owner -ne $current.Value) { throw 'private ACL owner is invalid' }
+if($mode -eq 'verify-owner') { [Console]::Out.Write('ok'); exit 0 }
+if(-not $actual.AreAccessRulesProtected) { throw 'private ACL inheritance is invalid' }
+$userFull=$false
+foreach($rule in $actual.Access) {
+  $sid=$rule.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value
+  if($rule.IsInherited -or $allowed -notcontains $sid -or $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow) {
+    throw 'private ACL contains an unauthorized access rule'
+  }
+  if($sid -eq $current.Value -and (($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl)) { $userFull=$true }
+}
+if(-not $userFull) { throw 'private ACL does not grant the current user full control' }
+[Console]::Out.Write('ok')`;
+    windowsPrivateAclInvocation = (path, kind, mode) => ({
+      args: [
+        "-NoLogo",
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(WINDOWS_PRIVATE_ACL_SCRIPT, "utf16le").toString("base64")
+      ],
+      env: {
+        NODE_ENV: process.env.NODE_ENV,
+        SystemRoot: process.env.SystemRoot,
+        WINDIR: process.env.WINDIR,
+        ComSpec: process.env.ComSpec,
+        PATHEXT: process.env.PATHEXT,
+        PSModulePath: process.env.PSModulePath,
+        TEMP: process.env.TEMP,
+        TMP: process.env.TMP,
+        VTX_PRIVATE_PATH_B64: Buffer.from(path, "utf8").toString("base64"),
+        VTX_PRIVATE_PATH_KIND: kind,
+        VTX_PRIVATE_ACL_MODE: mode
+      }
+    });
+    runWindowsPrivateAcl = async (path, kind, mode) => await new Promise((resolvePromise, reject) => {
+      const invocation = windowsPrivateAclInvocation(path, kind, mode);
+      const child = spawn("powershell.exe", [...invocation.args], {
+        env: invocation.env,
+        windowsHide: true,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      const stdout = [];
+      const stderr = [];
+      let settled = false;
+      const timer = setTimeout(() => child.kill("SIGKILL"), 15e3);
+      child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
+      child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
+      const settle = (error48) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        if (error48) reject(error48);
+        else resolvePromise();
+      };
+      child.once("error", (error48) => settle(error48));
+      child.once("exit", (code) => {
+        const output3 = Buffer.concat(stdout).toString("utf8").trim();
+        if (code === 0 && output3 === "ok") {
+          settle();
+          return;
+        }
+        const detail = Buffer.concat(stderr).toString("utf8").trim();
+        if (code === 3 && output3 === "missing" || /GetAcl_PathNotFound|Cannot find path .* because it does not exist/iu.test(detail)) {
+          const error48 = new Error("Windows private path no longer exists.");
+          error48.code = "ENOENT";
+          settle(error48);
+          return;
+        }
+        settle(new Error(`Windows private ACL ${mode} failed${detail ? `: ${detail}` : "."}`));
+      });
+    });
+    windowsAclCache = /* @__PURE__ */ new Map();
+    windowsAclIdentity = async (path) => {
+      const metadata = await lstat(path, { bigint: true });
+      return {
+        dev: metadata.dev,
+        ino: metadata.ino,
+        ctimeNs: metadata.ctimeNs,
+        mtimeNs: metadata.mtimeNs,
+        mode: metadata.mode,
+        size: metadata.size
+      };
+    };
+    aclCacheKey = (path, kind, mode) => `${kind}:${mode}:${resolve(path)}`;
+    secureWindowsPrivatePath = async (path, kind, mode, platform = process.platform, runner = runWindowsPrivateAcl) => {
+      if (platform !== "win32") return;
+      const key = aclCacheKey(path, kind, mode);
+      const before = await windowsAclIdentity(path);
+      const cached2 = windowsAclCache.get(key);
+      if (cached2 && cached2.dev === before.dev && cached2.ino === before.ino && cached2.ctimeNs === before.ctimeNs && cached2.mtimeNs === before.mtimeNs && cached2.mode === before.mode && cached2.size === before.size) return;
+      await runner(path, kind, mode);
+      windowsAclCache.set(key, await windowsAclIdentity(path));
+    };
+    invalidateWindowsAclCache = (path) => {
+      for (const kind of ["file", "directory"]) {
+        for (const mode of ["harden", "verify", "verify-owner"]) {
+          windowsAclCache.delete(aclCacheKey(path, kind, mode));
+        }
+      }
+    };
+    isDefaultWindowsPrivatePath = (path, root = resolve(homedir(), ".vtx", "inference-host")) => {
+      const child = relative(root, resolve(path));
+      return child === "" || !child.startsWith("..") && !child.includes(":");
+    };
+    secureExistingWindowsPath = async (path, kind, platform = process.platform, runner = runWindowsPrivateAcl, defaultRoot = resolve(homedir(), ".vtx", "inference-host")) => {
+      if (platform !== "win32") return;
+      if (!isDefaultWindowsPrivatePath(path, defaultRoot)) {
+        await secureWindowsPrivatePath(path, kind, "verify", platform, runner);
+        return;
+      }
+      await secureWindowsPrivatePath(path, kind, "verify-owner", platform, runner);
+      invalidateWindowsAclCache(path);
+      await secureWindowsPrivatePath(path, kind, "harden", platform, runner);
+    };
+    linuxProcessIdentity = async (pid) => {
+      try {
+        const [bootId, statLine] = await Promise.all([
+          readFile("/proc/sys/kernel/random/boot_id", "utf8"),
+          readFile(`/proc/${pid}/stat`, "utf8")
+        ]);
+        const fields = statLine.slice(statLine.lastIndexOf(")") + 2).trim().split(/\s+/u);
+        const startTicks = fields[19];
+        return startTicks ? `linux:${bootId.trim()}:${startTicks}` : null;
+      } catch {
+        return null;
+      }
+    };
+    windowsProcessIdentity = async (pid) => await new Promise((resolvePromise) => {
+      const script = `$ErrorActionPreference='Stop';$p=Get-Process -Id ([int]$env:VTX_PROCESS_PID);[Console]::Out.Write($p.StartTime.ToUniversalTime().ToFileTimeUtc())`;
+      const child = spawn("powershell.exe", [
+        "-NoLogo",
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(script, "utf16le").toString("base64")
+      ], {
+        windowsHide: true,
+        stdio: ["ignore", "pipe", "ignore"],
+        env: {
+          NODE_ENV: process.env.NODE_ENV,
+          SystemRoot: process.env.SystemRoot,
+          WINDIR: process.env.WINDIR,
+          ComSpec: process.env.ComSpec,
+          PATHEXT: process.env.PATHEXT,
+          PSModulePath: process.env.PSModulePath,
+          VTX_PROCESS_PID: String(pid)
+        }
+      });
+      const output3 = [];
+      let settled = false;
+      const settle = (value) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolvePromise(value);
+      };
+      const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        settle(null);
+      }, 5e3);
+      child.stdout.on("data", (chunk) => {
+        if (output3.reduce((total, item) => total + item.byteLength, 0) + Buffer.byteLength(chunk) > 1024) {
+          child.kill("SIGKILL");
+          settle(null);
+          return;
+        }
+        output3.push(Buffer.from(chunk));
+      });
+      child.once("error", () => settle(null));
+      child.once("exit", (code) => {
+        const started = Buffer.concat(output3).toString("utf8").trim();
+        settle(code === 0 && /^\d+$/u.test(started) ? `win32:${started}` : null);
+      });
+    });
+    darwinProcessIdentity = async (pid) => await new Promise((resolvePromise) => {
+      const child = spawn("ps", ["-p", String(pid), "-o", "lstart="], {
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+      const output3 = [];
+      let settled = false;
+      const settle = (value) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolvePromise(value);
+      };
+      const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        settle(null);
+      }, 5e3);
+      child.stdout.on("data", (chunk) => output3.push(Buffer.from(chunk)));
+      child.once("error", () => settle(null));
+      child.once("exit", (code) => {
+        const started = Date.parse(Buffer.concat(output3).toString("utf8").trim());
+        settle(code === 0 && Number.isFinite(started) ? `darwin:${Math.floor(started / 1e3)}` : null);
+      });
+    });
+    runSmallIdentityCommand = async (command, args, env) => await new Promise((resolvePromise) => {
+      const child = spawn(command, [...args], {
+        windowsHide: true,
+        stdio: ["ignore", "pipe", "ignore"],
+        env
+      });
+      const output3 = [];
+      let bytes3 = 0;
+      let settled = false;
+      const settle = (value) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolvePromise(value);
+      };
+      const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        settle(null);
+      }, 5e3);
+      child.stdout.on("data", (chunk) => {
+        bytes3 += Buffer.byteLength(chunk);
+        if (bytes3 > 4096) {
+          child.kill("SIGKILL");
+          settle(null);
+          return;
+        }
+        output3.push(Buffer.from(chunk));
+      });
+      child.once("error", () => settle(null));
+      child.once("exit", (code) => settle(
+        code === 0 ? Buffer.concat(output3).toString("utf8").trim() || null : null
+      ));
+    });
+    cachedSystemBootIdentity = null;
+    readInferenceSystemBootIdentity = async (platform = process.platform) => {
+      if (platform === process.platform && cachedSystemBootIdentity) {
+        return await cachedSystemBootIdentity;
+      }
+      const read = async () => {
+        let identity = null;
+        if (platform === "linux") {
+          try {
+            identity = (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
+          } catch {
+            identity = null;
+          }
+        } else if (platform === "win32") {
+          const script = `$ErrorActionPreference='Stop';$v=(Get-CimInstance Win32_OperatingSystem).LastBootUpTime.ToUniversalTime().ToFileTimeUtc();[Console]::Out.Write($v)`;
+          identity = await runSmallIdentityCommand("powershell.exe", [
+            "-NoLogo",
+            "-NoProfile",
+            "-NonInteractive",
+            "-EncodedCommand",
+            Buffer.from(script, "utf16le").toString("base64")
+          ], {
+            NODE_ENV: process.env.NODE_ENV,
+            SystemRoot: process.env.SystemRoot,
+            WINDIR: process.env.WINDIR,
+            ComSpec: process.env.ComSpec,
+            PATHEXT: process.env.PATHEXT,
+            PSModulePath: process.env.PSModulePath
+          });
+        } else if (platform === "darwin") {
+          identity = await runSmallIdentityCommand("sysctl", ["-n", "kern.boottime"], void 0);
+        }
+        if (!identity || /[\r\n\0]/u.test(identity)) {
+          throw new Error("Inference host could not establish the current system boot identity.");
+        }
+        return `${platform}:${identity}`;
+      };
+      const pending = read();
+      if (platform === process.platform) cachedSystemBootIdentity = pending;
+      try {
+        return await pending;
+      } catch (error48) {
+        if (platform === process.platform) cachedSystemBootIdentity = null;
+        throw error48;
+      }
+    };
+    defaultProcessIdentity = async (pid) => {
+      if (process.platform === "linux") return await linuxProcessIdentity(pid);
+      if (process.platform === "win32") return await windowsProcessIdentity(pid);
+      if (process.platform === "darwin") return await darwinProcessIdentity(pid);
+      return null;
+    };
+    defaultCurrentProcessIdentity = async () => {
+      const identity = await defaultProcessIdentity(process.pid);
+      if (!identity) throw new Error("Inference host could not establish its process-start identity.");
+      return identity;
+    };
+    processLockObservationCache = /* @__PURE__ */ new Map();
+    inferenceProcessIdentitiesMatch = (stored, observed) => stored === observed;
     credentialStoreIdentity = (mode, filePath, env) => {
       if (mode === "file") {
         if (!filePath) throw new Error("Inference credential fallback path is unavailable.");
@@ -16354,7 +16787,7 @@ var init_config = __esm({
 
 // lib/inference-host/credential-store.ts
 import { createHash } from "node:crypto";
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 function canonicalUrl(raw, label) {
   let parsed;
   try {
@@ -16520,8 +16953,8 @@ var init_credential_store = __esm({
         }
         return;
       }
-      await new Promise((resolve5) => {
-        const terminator = spawn(
+      await new Promise((resolve6) => {
+        const terminator = spawn2(
           "taskkill.exe",
           ["/PID", String(pid), "/T", "/F"],
           {
@@ -16538,21 +16971,21 @@ var init_credential_store = __esm({
         const timer = setTimeout(() => {
           terminator.kill("SIGKILL");
           child.kill("SIGKILL");
-          resolve5();
+          resolve6();
         }, CREDENTIAL_COMMAND_TERMINATION_TIMEOUT_MS);
         terminator.once("error", () => {
           clearTimeout(timer);
           child.kill("SIGKILL");
-          resolve5();
+          resolve6();
         });
         terminator.once("close", () => {
           clearTimeout(timer);
           if (child.exitCode === null) child.kill("SIGKILL");
-          resolve5();
+          resolve6();
         });
       });
     };
-    runCredentialCommand = async (command, options) => await new Promise((resolve5, reject) => {
+    runCredentialCommand = async (command, options) => await new Promise((resolve6, reject) => {
       const timeoutMs = options.timeoutMs ?? DEFAULT_CREDENTIAL_COMMAND_TIMEOUT_MS;
       if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
         reject(new Error("OS credential command timeout must be a positive integer."));
@@ -16562,7 +16995,7 @@ var init_credential_store = __esm({
         reject(new Error("OS credential command was aborted."));
         return;
       }
-      const child = spawn(command.command, command.args, {
+      const child = spawn2(command.command, command.args, {
         detached: true,
         shell: false,
         stdio: ["pipe", "pipe", "pipe"],
@@ -16611,7 +17044,7 @@ var init_credential_store = __esm({
           const transformedStdout = normalizedExitCode === 0 ? command.transformStdout?.(stdout) ?? stdout : stdout;
           settled = true;
           cleanup();
-          resolve5({
+          resolve6({
             exitCode: normalizedExitCode,
             stdout: transformedStdout
           });
@@ -17403,11 +17836,13 @@ var init_mcp_client = __esm({
         }).passthrough().parse(rawResult);
         if (callResult.isError === true) {
           const errorText = (callResult.content ?? []).filter((block) => block.type === "text").map((block) => block.text ?? "").join("\n");
-          const definitivelyNotApplied = (name === "inference.host.register" || name === "inference.host.advertise") && (errorText.includes("Advertisement time is outside the allowed clock skew.") || errorText.includes("Advertisement is already expired.")) || (name === "inference.agent.next" || name === "inference.agent.heartbeat") && (errorText.includes("Advertisement time is outside the allowed clock skew.") || errorText.includes("Advertisement is already expired.") || errorText.includes("Heartbeat time is outside the allowed clock skew.")) || name === "inference.job.claim" && (errorText.includes(
+          const definitivelyNotApplied = (name === "inference.host.register" || name === "inference.host.advertise") && (errorText.includes("Advertisement time is outside the allowed clock skew.") || errorText.includes("Advertisement is already expired.")) || (name === "inference.agent.next" || name === "inference.agent.heartbeat") && (errorText.includes("Advertisement time is outside the allowed clock skew.") || errorText.includes("Advertisement is already expired.") || errorText.includes("Heartbeat time is outside the allowed clock skew.")) || name === "inference.host.heartbeat" && errorText.includes("Heartbeat time is outside the allowed clock skew.") || name === "inference.job.claim" && (errorText.includes(
             "External inference claim request was not applied before its generation became stale"
           ) || errorText.includes("External inference host advertisement is expired or superseded"));
           const retryableInfrastructureRejection = EXTERNAL_INFERENCE_AUTOMATED_HOST_TOOLS.includes(name) && (errorText.includes("External inference polling is at its configured concurrency limit") || errorText.includes("The Insights action reached the response timeout") || errorText.includes("Insights capability failed without exposing private runtime details"));
           const retryableClaimRejection = name === "inference.job.claim" && !definitivelyNotApplied && (retryableInfrastructureRejection || errorText.includes("External inference host is not live enough to claim work") || errorText.includes("External inference host request generation is stale"));
+          const retryableHeartbeatClockSkew = name === "inference.host.heartbeat" && definitivelyNotApplied;
+          const retryableAdvertisementClockSkew = (name === "inference.host.register" || name === "inference.host.advertise") && definitivelyNotApplied;
           throw new ExternalInferenceMcpError(
             "tool_rejected",
             `Insights MCP rejected ${name}.`,
@@ -17417,7 +17852,7 @@ var init_mcp_client = __esm({
               // API rotation the MCP server can return a tool error after the
               // request reached the application boundary, so retain and replay
               // the exact request unless the server proves it was not applied.
-              retryable: retryableInfrastructureRejection || retryableClaimRejection
+              retryable: retryableInfrastructureRejection || retryableClaimRejection || retryableHeartbeatClockSkew || retryableAdvertisementClockSkew
             }
           );
         }
@@ -17823,7 +18258,7 @@ async function registerInferenceOAuthClient(metadata, redirectUri, fetchImpl = f
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
       application_type: "native",
-      client_name: "VTX Codex inference host",
+      client_name: "VTX inference host",
       scope: INFERENCE_SCOPE
     })
   }, requestOptions);
@@ -18070,11 +18505,11 @@ async function revokeInferenceCredential(options) {
   }
 }
 async function listenLoopback(server) {
-  await new Promise((resolve5, reject) => {
+  await new Promise((resolve6, reject) => {
     server.once("error", reject);
     server.listen(0, CALLBACK_HOST, () => {
       server.off("error", reject);
-      resolve5();
+      resolve6();
     });
   });
   const address = server.address();
@@ -18085,7 +18520,7 @@ async function listenLoopback(server) {
 }
 async function closeServer(server) {
   if (!server.listening) return;
-  await new Promise((resolve5) => server.close(() => resolve5()));
+  await new Promise((resolve6) => server.close(() => resolve6()));
 }
 async function beginInferenceOAuthLogin(options) {
   const loginTimeoutMs = options.timeoutMs ?? 6e5;
@@ -18141,7 +18576,7 @@ async function beginInferenceOAuthLogin(options) {
     });
     let settled = false;
     let rejectCompletion;
-    const completion = new Promise((resolve5, reject) => {
+    const completion = new Promise((resolve6, reject) => {
       rejectCompletion = reject;
       handler = async (requestUrl, method, writeResponse) => {
         if (settled) {
@@ -18216,7 +18651,7 @@ async function beginInferenceOAuthLogin(options) {
             '<!doctype html><html><head><meta charset="utf-8"><title>VTX authorization complete</title></head><body><main><h1>VTX authorization complete</h1><p>The VTX CLI received your approval. You can close this tab and return to the terminal.</p></main></body></html>'
           );
           await closeServer(server);
-          resolve5({
+          resolve6({
             accessToken: tokens.accessToken,
             expiresIn: tokens.expiresIn,
             credential,
@@ -18330,7 +18765,7 @@ async function createInferenceAgentMcpSession(options) {
     options.fetchImpl,
     { signal: options.signal, timeoutMs: options.requestTimeoutMs }
   );
-  let access3 = null;
+  let access4 = null;
   let accessExpiresAt = 0;
   let refreshPromise = null;
   const refreshAccessToken = async (requestOptions = {}) => {
@@ -18347,7 +18782,7 @@ async function createInferenceAgentMcpSession(options) {
       });
       assertCredentialMatchesState(localState, refreshed.credential);
       credential = refreshed.credential;
-      access3 = refreshed;
+      access4 = refreshed;
       accessExpiresAt = Date.now() + refreshed.expiresIn * 1e3;
       return refreshed.accessToken;
     })();
@@ -18360,10 +18795,10 @@ async function createInferenceAgentMcpSession(options) {
   await refreshAccessToken({ signal: options.signal });
   const tokenSource = {
     accessToken: async (requestOptions) => {
-      if (!access3 || accessExpiresAt - Date.now() <= 5e3) {
+      if (!access4 || accessExpiresAt - Date.now() <= 5e3) {
         return refreshAccessToken(requestOptions);
       }
-      return access3.accessToken;
+      return access4.accessToken;
     },
     refreshAccessToken
   };
@@ -18516,10 +18951,10 @@ var init_agent_state = __esm({
 });
 
 // lib/inference-host/codex-app-server.ts
-import { spawn as spawn2 } from "node:child_process";
-import { chmod, lstat as lstat2, readFile as readFile2, rename as rename2, rm as rm2, writeFile } from "node:fs/promises";
+import { spawn as spawn3 } from "node:child_process";
+import { chmod, lstat as lstat2, open as open2, readFile as readFile2, rename as rename2, rm as rm2, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { isAbsolute, join as join2, resolve as resolve2, sep } from "node:path";
+import { dirname as dirname2, isAbsolute, join as join2, resolve as resolve2, sep } from "node:path";
 import { createInterface } from "node:readline";
 async function loginCodexSubscription(options) {
   const session = await CodexAppServerSession.start(options);
@@ -18585,6 +19020,7 @@ var CODEX_INFERENCE_PERMISSION_PROFILE, CODEX_ACCOUNT_PLAN_TYPES, CodexAppServer
 var init_codex_app_server = __esm({
   "lib/inference-host/codex-app-server.ts"() {
     "use strict";
+    init_config();
     CODEX_INFERENCE_PERMISSION_PROFILE = "vtx_inference_readonly";
     CODEX_ACCOUNT_PLAN_TYPES = [
       "free",
@@ -18818,8 +19254,8 @@ var init_codex_app_server = __esm({
       };
     };
     killWindowsProcessTree = async (pid) => {
-      await new Promise((resolve5, reject) => {
-        const child = spawn2(
+      await new Promise((resolve6, reject) => {
+        const child = spawn3(
           "taskkill.exe",
           ["/PID", String(pid), "/T", "/F"],
           {
@@ -18843,7 +19279,7 @@ var init_codex_app_server = __esm({
         });
         child.once("close", (code) => {
           clearTimeout(timer);
-          if (code === 0 || code === 128) resolve5();
+          if (code === 0 || code === 128) resolve6();
           else reject(new Error("Windows Codex process-tree cleanup failed."));
         });
       });
@@ -18877,7 +19313,8 @@ var init_codex_app_server = __esm({
     };
     GUARDIAN_SCRIPT = String.raw`
 import { spawn } from 'node:child_process';
-import { chmod, rename, rm, writeFile } from 'node:fs/promises';
+import { chmod, open, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
 const input = JSON.parse(Buffer.from(process.argv[1], 'base64url').toString('utf8'));
 // The guardian owns the process boundary for every attempt. Apply a private
 // umask before writing receipts or starting Codex so a lost thread/start reply
@@ -18914,6 +19351,7 @@ const writeReceipt = (state, childPid) => {
       state,
       guardian_pid: process.pid,
       child_pid: childPid ?? null,
+      boot_identity: input.bootIdentity,
       updated_at: new Date().toISOString(),
     }) + '\n';
     receiptWriteSequence += 1;
@@ -18921,7 +19359,13 @@ const writeReceipt = (state, childPid) => {
     try {
       await writeFile(temporary, body, { mode: 0o600 });
       await chmod(temporary, 0o600).catch(() => undefined);
+      const file = await open(temporary, 'r+');
+      try { await file.sync(); } finally { await file.close(); }
       await replaceReceipt(temporary);
+      if (process.platform !== 'win32') {
+        const directory = await open(dirname(input.receiptPath), 'r');
+        try { await directory.sync(); } finally { await directory.close(); }
+      }
     } finally {
       await rm(temporary, { force: true }).catch(() => undefined);
     }
@@ -18958,6 +19402,7 @@ child = spawn(input.binary, input.args, {
   windowsHide: true,
   detached: false,
 });
+child.stdin.on('error', () => undefined);
 process.stdin.pipe(child.stdin, { end: false });
 child.stdout.pipe(process.stdout);
 child.stderr.pipe(process.stderr);
@@ -18971,9 +19416,14 @@ child.once('spawn', async () => {
 child.once('error', shutdown);
 child.once('close', async () => {
   if (forceTimer) clearTimeout(forceTimer);
+  // A pending promise alone does not keep Node's event loop alive after the
+  // child and parent stdin have both closed. Hold one local handle until the
+  // serialized terminal tombstone is durably replaced.
+  const receiptKeepAlive = setInterval(() => undefined, 1_000);
   try {
     await writeReceipt('terminated', child.pid ?? null);
   } finally {
+    clearInterval(receiptKeepAlive);
     process.exit(0);
   }
 });
@@ -18989,7 +19439,7 @@ child.once('close', async () => {
       const platform = options.platform ?? process.platform;
       const renameFile = options.renameFile ?? rename2;
       const removeFile = options.removeFile ?? ((path) => rm2(path, { force: true }));
-      const sleep4 = options.sleep ?? ((milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds)));
+      const sleep4 = options.sleep ?? ((milliseconds) => new Promise((resolve6) => setTimeout(resolve6, milliseconds)));
       const maxAttempts = Math.max(1, options.maxAttempts ?? 40);
       const retryDelayMs = Math.max(0, options.retryDelayMs ?? 25);
       for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
@@ -19020,20 +19470,38 @@ child.once('close', async () => {
         state: "spawn_intent",
         guardian_pid: null,
         child_pid: null,
+        boot_identity: guardian.bootIdentity ?? null,
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       })}
 `;
       const temporary = `${guardian.receiptPath}.intent-${process.pid}`;
       await writeFile(temporary, body, { mode: 384 });
       await chmod(temporary, 384).catch(() => void 0);
+      const handle = await open2(temporary, "r+");
+      try {
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
       await replaceCodexGuardianReceiptFile(temporary, guardian.receiptPath);
+      if (process.platform !== "win32") {
+        const directory = await open2(dirname2(guardian.receiptPath), "r");
+        try {
+          await directory.sync();
+        } finally {
+          await directory.close();
+        }
+      }
     };
     parseGuardianReceipt = (raw) => {
       const value = JSON.parse(raw);
-      if (value.schema_version !== "vtx_codex_guardian_v1" || typeof value.process_token !== "string" || !/^[0-9a-f]{64}$/u.test(value.process_token) || !["spawn_intent", "starting", "running", "terminated"].includes(String(value.state)) || value.guardian_pid !== null && !Number.isSafeInteger(value.guardian_pid) || value.state === "spawn_intent" && value.guardian_pid !== null || value.state !== "spawn_intent" && !Number.isSafeInteger(value.guardian_pid) || value.child_pid !== null && !Number.isSafeInteger(value.child_pid) || typeof value.updated_at !== "string" || !Number.isFinite(Date.parse(value.updated_at))) {
+      if (value.schema_version !== "vtx_codex_guardian_v1" || typeof value.process_token !== "string" || !/^[0-9a-f]{64}$/u.test(value.process_token) || !["spawn_intent", "starting", "running", "terminated"].includes(String(value.state)) || value.guardian_pid !== null && !Number.isSafeInteger(value.guardian_pid) || value.state === "spawn_intent" && value.guardian_pid !== null || value.state !== "spawn_intent" && !Number.isSafeInteger(value.guardian_pid) || value.child_pid !== null && !Number.isSafeInteger(value.child_pid) || value.boot_identity !== null && value.boot_identity !== void 0 && typeof value.boot_identity !== "string" || typeof value.updated_at !== "string" || !Number.isFinite(Date.parse(value.updated_at))) {
         throw new Error("Codex guardian receipt is invalid.");
       }
-      return value;
+      return {
+        ...value,
+        boot_identity: typeof value.boot_identity === "string" ? value.boot_identity : null
+      };
     };
     readCodexGuardianReceipt = async (path) => {
       try {
@@ -19059,14 +19527,14 @@ child.once('close', async () => {
             throw new Error("Codex guardian terminated before app-server initialization.");
           }
         }
-        await new Promise((resolve5) => setTimeout(resolve5, 25));
+        await new Promise((resolve6) => setTimeout(resolve6, 25));
       }
       throw new Error(`Codex guardian ${expectedState} state was not confirmed.`);
     };
     defaultSpawn = (binary, args, options) => {
       if (!options.guardian) {
         const { guardian: _guardian, ...spawnOptions } = options;
-        return spawn2(binary, args, {
+        return spawn3(binary, args, {
           ...spawnOptions,
           detached: options.detached
         });
@@ -19076,9 +19544,10 @@ child.once('close', async () => {
         args,
         processToken: options.guardian.processToken,
         receiptPath: options.guardian.receiptPath,
-        shutdownGraceMs: Math.max(25, options.guardian.shutdownGraceMs ?? 2e3)
+        shutdownGraceMs: Math.max(25, options.guardian.shutdownGraceMs ?? 2e3),
+        bootIdentity: options.guardian.bootIdentity
       }), "utf8").toString("base64url");
-      return spawn2(process.execPath, ["--input-type=module", "--eval", GUARDIAN_SCRIPT, payload], {
+      return spawn3(process.execPath, ["--input-type=module", "--eval", GUARDIAN_SCRIPT, payload], {
         env: options.env,
         stdio: options.stdio,
         windowsHide: options.windowsHide,
@@ -19105,9 +19574,13 @@ child.once('close', async () => {
       }
       static async start(options) {
         const spawnProcess = options.spawnProcess ?? defaultSpawn;
-        if (options.guardian) {
+        const guardian = options.guardian ? {
+          ...options.guardian,
+          bootIdentity: options.guardian.bootIdentity ?? await readInferenceSystemBootIdentity()
+        } : void 0;
+        if (guardian) {
           try {
-            await writeCodexGuardianSpawnIntent(options.guardian);
+            await writeCodexGuardianSpawnIntent(guardian);
           } catch (error48) {
             throw new CodexAppServerError({
               message: "Codex guardian spawn intent could not be persisted.",
@@ -19123,17 +19596,32 @@ child.once('close', async () => {
           stdio: ["pipe", "pipe", "pipe"],
           windowsHide: true,
           detached: true,
-          guardian: options.guardian
+          guardian
         });
-        if (options.guardian) {
+        if (guardian) {
           try {
             await waitForCodexGuardianState(
-              options.guardian,
+              guardian,
               "running",
               Math.min(options.deadlineAtMs, Date.now() + 1e4)
             );
           } catch (error48) {
             child.stdin.end();
+            try {
+              await waitForCodexGuardianState(
+                guardian,
+                "terminated",
+                Date.now() + 5e3
+              );
+            } catch (terminationError) {
+              throw new CodexAppServerError({
+                message: "Codex guardian startup failed and termination was not confirmed.",
+                category: "transport",
+                code: "codex_guardian_termination_unconfirmed",
+                retryable: false,
+                cause: terminationError
+              });
+            }
             throw new CodexAppServerError({
               message: "Codex guardian startup could not be confirmed.",
               category: "transport",
@@ -19168,6 +19656,23 @@ child.once('close', async () => {
           return session;
         } catch (error48) {
           await session.close().catch(() => void 0);
+          if (guardian) {
+            try {
+              await waitForCodexGuardianState(
+                guardian,
+                "terminated",
+                Date.now() + 5e3
+              );
+            } catch (terminationError) {
+              throw new CodexAppServerError({
+                message: "Codex app-server failed and guardian termination was not confirmed.",
+                category: "transport",
+                code: "codex_guardian_termination_unconfirmed",
+                retryable: false,
+                cause: terminationError
+              });
+            }
+          }
           throw error48;
         }
       }
@@ -19285,8 +19790,8 @@ child.once('close', async () => {
             retryable: false
           });
         }
-        return await new Promise((resolve5, reject) => {
-          const pending = { resolve: resolve5, reject, timer: null, abortCleanup: null };
+        return await new Promise((resolve6, reject) => {
+          const pending = { resolve: resolve6, reject, timer: null, abortCleanup: null };
           pending.timer = setTimeout(() => {
             this.pending.delete(id2);
             pending.abortCleanup?.();
@@ -19674,8 +20179,8 @@ child.once('close', async () => {
         let terminal = null;
         let terminalResolve;
         let terminalReject;
-        const terminalPromise = new Promise((resolve5, reject) => {
-          terminalResolve = resolve5;
+        const terminalPromise = new Promise((resolve6, reject) => {
+          terminalResolve = resolve6;
           terminalReject = reject;
         });
         void terminalPromise.catch(() => void 0);
@@ -20096,15 +20601,15 @@ child.once('close', async () => {
         if (this.closed) return;
         this.closed = true;
         this.process.stdin.end();
-        const exited = await new Promise((resolve5) => {
+        const exited = await new Promise((resolve6) => {
           if (this.process.exitCode !== null) {
-            resolve5(true);
+            resolve6(true);
             return;
           }
-          const timer = setTimeout(() => resolve5(false), 5e3);
+          const timer = setTimeout(() => resolve6(false), 5e3);
           this.process.once("close", () => {
             clearTimeout(timer);
-            resolve5(true);
+            resolve6(true);
           });
         });
         if (exited) return;
@@ -20115,11 +20620,11 @@ child.once('close', async () => {
           else this.process.kill("SIGTERM");
         } catch {
         }
-        const terminated = await new Promise((resolve5) => {
-          const timer = setTimeout(() => resolve5(false), 1e3);
+        const terminated = await new Promise((resolve6) => {
+          const timer = setTimeout(() => resolve6(false), 1e3);
           this.process.once("close", () => {
             clearTimeout(timer);
-            resolve5(true);
+            resolve6(true);
           });
         });
         if (!terminated) {
@@ -20129,15 +20634,15 @@ child.once('close', async () => {
             else this.process.kill("SIGKILL");
           } catch {
           }
-          await new Promise((resolve5) => {
+          await new Promise((resolve6) => {
             if (this.process.exitCode !== null) {
-              resolve5();
+              resolve6();
               return;
             }
-            const timer = setTimeout(resolve5, 1e3);
+            const timer = setTimeout(resolve6, 1e3);
             this.process.once("close", () => {
               clearTimeout(timer);
-              resolve5();
+              resolve6();
             });
           });
           if (this.process.exitCode === null) {
@@ -20159,8 +20664,8 @@ import { createHash as createHash3 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { access, readFile as readFile3, realpath as realpath2 } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { dirname as dirname2, join as join3 } from "node:path";
-import { spawn as spawn3 } from "node:child_process";
+import { dirname as dirname3, join as join3 } from "node:path";
+import { spawn as spawn4 } from "node:child_process";
 var PINNED_CODEX_CLI_VERSION, PINNED_CODEX_LINUX_X64_SHA256, PINNED_CODEX_WINDOWS_X64_SHA256, pinnedShaForPlatform, pinnedPackageForPlatform, resolvePinnedCodexPackageBinaryPath, readCodexVersion, verifyPinnedCodexBinary, resolvePinnedCodexBinary;
 var init_codex_binary = __esm({
   "lib/inference-host/codex-binary.ts"() {
@@ -20197,15 +20702,15 @@ var init_codex_binary = __esm({
       const spec = pinnedPackageForPlatform(platform, architecture);
       const packageJsonPath = resolvePackage(`${spec.packageName}/package.json`);
       return join3(
-        dirname2(packageJsonPath),
+        dirname3(packageJsonPath),
         "vendor",
         spec.target,
         "bin",
         spec.binaryName
       );
     };
-    readCodexVersion = async (binaryPath) => await new Promise((resolve5, reject) => {
-      const child = spawn3(binaryPath, ["--version"], {
+    readCodexVersion = async (binaryPath) => await new Promise((resolve6, reject) => {
+      const child = spawn4(binaryPath, ["--version"], {
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,
         env: {
@@ -20242,7 +20747,7 @@ var init_codex_binary = __esm({
           reject(new Error("Codex version probe failed."));
           return;
         }
-        resolve5(stdout.trim());
+        resolve6(stdout.trim());
       });
     });
     verifyPinnedCodexBinary = async (candidatePath, dependencies = {}) => {
@@ -20302,7 +20807,7 @@ import {
 } from "node:fs/promises";
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { isAbsolute as isAbsolute2, join as join4, relative, resolve as resolve3, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join4, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var INITIAL_CODEX_INFERENCE_MODEL, SUPPORTED_CODEX_REASONING_EFFORTS, MAX_PROMPT_BYTES2, tokenUsageReceiptSchema, turnResultReceiptSchema, terminalReceiptSchema, recoveryCheckpointSchema, recoveryFileSchema, FileCodexAttemptRecoveryStore, utf8Bytes, tomlString, permissionConfig, ensureDedicatedCodexHome, createIsolatedCodexAttemptResources, createIsolatedCodexHostResources, validateAttemptInput, isStrictDescendant, assertRecoveryResourceScope, removeRecoveredThread, confirmGuardianTerminatedForRecovery, reconcileCodexAttemptRecovery, CodexSubscriptionAdapter;
 var init_codex_adapter = __esm({
   "lib/inference-host/codex-adapter.ts"() {
@@ -20368,6 +20873,7 @@ var init_codex_adapter = __esm({
       processToken: external_exports.string().regex(/^[0-9a-f]{64}$/u).nullable(),
       processReceiptPath: external_exports.string().min(1).max(4096).nullable(),
       processState: external_exports.enum(["unmanaged", "spawn_intent", "running", "terminated"]),
+      bootIdentity: external_exports.string().min(1).max(4096).nullable().optional(),
       cleanupConfirmed: external_exports.boolean(),
       adapterRequestId: external_exports.string().min(1).max(512).nullable(),
       adapterResponseId: external_exports.string().min(1).max(512).nullable(),
@@ -20611,7 +21117,7 @@ var init_codex_adapter = __esm({
     isStrictDescendant = (candidate, parent) => {
       const parentPath = resolve3(parent);
       const candidatePath = resolve3(candidate);
-      const scoped = relative(parentPath, candidatePath);
+      const scoped = relative2(parentPath, candidatePath);
       return scoped.length > 0 && !scoped.startsWith(`..${sep2}`) && scoped !== ".." && !isAbsolute2(scoped);
     };
     assertRecoveryResourceScope = (checkpoint) => {
@@ -20621,7 +21127,7 @@ var init_codex_adapter = __esm({
       if (!isStrictDescendant(resourceRoot, temporaryRoot)) {
         throw new Error("Codex recovery resource root crossed temporary scope.");
       }
-      const parts = relative(temporaryRoot, resourceRoot).split(sep2);
+      const parts = relative2(temporaryRoot, resourceRoot).split(sep2);
       const standalone = parts.length === 1 && parts[0].startsWith("vtx-codex-attempt-") && workspacePath === join4(resourceRoot, "workspace");
       const hosted = parts.length === 3 && parts[0].startsWith("vtx-codex-host-") && parts[1] === "workspaces" && parts[2].startsWith("attempt-") && workspacePath === resourceRoot;
       if (!standalone && !hosted) {
@@ -20745,6 +21251,7 @@ var init_codex_adapter = __esm({
     };
     reconcileCodexAttemptRecovery = async (options) => {
       const attempts = await options.recoveryHooks.loadAll?.() ?? {};
+      const currentBootIdentity = options.bootIdentity ?? await readInferenceSystemBootIdentity();
       let reconciled = 0;
       for (const checkpoint of Object.values(attempts)) {
         if (checkpoint.cleanupConfirmed) continue;
@@ -20755,18 +21262,29 @@ var init_codex_adapter = __esm({
           processToken: checkpoint.processToken,
           receiptPath: checkpoint.processReceiptPath
         };
-        await confirmGuardianTerminatedForRecovery(
-          checkpoint,
-          guardian,
-          options.deadlineMs ?? 5e3
+        const crossedBoot = Boolean(
+          checkpoint.bootIdentity && checkpoint.bootIdentity !== currentBootIdentity
         );
+        if (crossedBoot) {
+          const receipt = await readCodexGuardianReceipt(guardian.receiptPath);
+          if (receipt && (receipt.process_token !== checkpoint.processToken || receipt.boot_identity !== checkpoint.bootIdentity)) {
+            throw new Error("Codex cross-boot recovery receipt ownership is unconfirmed.");
+          }
+        } else {
+          await confirmGuardianTerminatedForRecovery(
+            checkpoint,
+            guardian,
+            options.deadlineMs ?? 5e3
+          );
+        }
         assertRecoveryResourceScope(checkpoint);
         await removeRecoveredThread(checkpoint, options.codexHome);
         await rm3(checkpoint.resourceRoot, { recursive: true, force: true });
         await options.recoveryHooks.save({
           ...checkpoint,
           processState: "terminated",
-          cleanupConfirmed: true
+          cleanupConfirmed: true,
+          dispatchOutcome: crossedBoot ? "outcome_unknown" : checkpoint.dispatchOutcome
         });
         reconciled += 1;
       }
@@ -20904,6 +21422,7 @@ var init_codex_adapter = __esm({
           await access2(resources.codexHome, fsConstants2.R_OK | fsConstants2.W_OK);
           await access2(resources.workspacePath, fsConstants2.R_OK);
           const guardianManaged = Boolean(recoveryHooks && !this.dependencies.spawnProcess);
+          const bootIdentity = guardianManaged ? await (this.dependencies.readBootIdentity ?? readInferenceSystemBootIdentity)() : null;
           const processToken = guardianManaged ? randomBytes3(32).toString("hex") : null;
           const guardianReceiptRoot = guardianManaged ? this.dependencies.guardianReceiptRoot ?? join4(tmpdir2(), "vtx-codex-guardian-receipts") : null;
           if (guardianReceiptRoot) {
@@ -20922,6 +21441,7 @@ var init_codex_adapter = __esm({
             processToken,
             processReceiptPath,
             processState: guardianManaged ? "spawn_intent" : "unmanaged",
+            bootIdentity,
             cleanupConfirmed: false,
             adapterRequestId: null,
             adapterResponseId: null,
@@ -20936,7 +21456,7 @@ var init_codex_adapter = __esm({
             deadlineAtMs: input.deadlineAtMs,
             signal: input.signal,
             spawnProcess: this.dependencies.spawnProcess,
-            guardian: processToken && processReceiptPath ? { processToken, receiptPath: processReceiptPath } : void 0
+            guardian: processToken && processReceiptPath ? { processToken, receiptPath: processReceiptPath, bootIdentity: bootIdentity ?? void 0 } : void 0
           });
           if (guardianManaged) {
             baseCheckpoint = { ...baseCheckpoint, processState: "running" };
@@ -22135,51 +22655,51 @@ var require_uri_all = __commonJS({
         }
         return uriTokens.join("");
       }
-      function resolveComponents(base2, relative2) {
+      function resolveComponents(base2, relative3) {
         var options = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : {};
         var skipNormalization = arguments[3];
         var target = {};
         if (!skipNormalization) {
           base2 = parse3(serialize(base2, options), options);
-          relative2 = parse3(serialize(relative2, options), options);
+          relative3 = parse3(serialize(relative3, options), options);
         }
         options = options || {};
-        if (!options.tolerant && relative2.scheme) {
-          target.scheme = relative2.scheme;
-          target.userinfo = relative2.userinfo;
-          target.host = relative2.host;
-          target.port = relative2.port;
-          target.path = removeDotSegments(relative2.path || "");
-          target.query = relative2.query;
+        if (!options.tolerant && relative3.scheme) {
+          target.scheme = relative3.scheme;
+          target.userinfo = relative3.userinfo;
+          target.host = relative3.host;
+          target.port = relative3.port;
+          target.path = removeDotSegments(relative3.path || "");
+          target.query = relative3.query;
         } else {
-          if (relative2.userinfo !== void 0 || relative2.host !== void 0 || relative2.port !== void 0) {
-            target.userinfo = relative2.userinfo;
-            target.host = relative2.host;
-            target.port = relative2.port;
-            target.path = removeDotSegments(relative2.path || "");
-            target.query = relative2.query;
+          if (relative3.userinfo !== void 0 || relative3.host !== void 0 || relative3.port !== void 0) {
+            target.userinfo = relative3.userinfo;
+            target.host = relative3.host;
+            target.port = relative3.port;
+            target.path = removeDotSegments(relative3.path || "");
+            target.query = relative3.query;
           } else {
-            if (!relative2.path) {
+            if (!relative3.path) {
               target.path = base2.path;
-              if (relative2.query !== void 0) {
-                target.query = relative2.query;
+              if (relative3.query !== void 0) {
+                target.query = relative3.query;
               } else {
                 target.query = base2.query;
               }
             } else {
-              if (relative2.path.charAt(0) === "/") {
-                target.path = removeDotSegments(relative2.path);
+              if (relative3.path.charAt(0) === "/") {
+                target.path = removeDotSegments(relative3.path);
               } else {
                 if ((base2.userinfo !== void 0 || base2.host !== void 0 || base2.port !== void 0) && !base2.path) {
-                  target.path = "/" + relative2.path;
+                  target.path = "/" + relative3.path;
                 } else if (!base2.path) {
-                  target.path = relative2.path;
+                  target.path = relative3.path;
                 } else {
-                  target.path = base2.path.slice(0, base2.path.lastIndexOf("/") + 1) + relative2.path;
+                  target.path = base2.path.slice(0, base2.path.lastIndexOf("/") + 1) + relative3.path;
                 }
                 target.path = removeDotSegments(target.path);
               }
-              target.query = relative2.query;
+              target.query = relative3.query;
             }
             target.userinfo = base2.userinfo;
             target.host = base2.host;
@@ -22187,10 +22707,10 @@ var require_uri_all = __commonJS({
           }
           target.scheme = base2.scheme;
         }
-        target.fragment = relative2.fragment;
+        target.fragment = relative3.fragment;
         return target;
       }
-      function resolve5(baseURI, relativeURI, options) {
+      function resolve6(baseURI, relativeURI, options) {
         var schemelessOptions = assign({ scheme: "null" }, options);
         return serialize(resolveComponents(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true), schemelessOptions);
       }
@@ -22455,7 +22975,7 @@ var require_uri_all = __commonJS({
       exports2.removeDotSegments = removeDotSegments;
       exports2.serialize = serialize;
       exports2.resolveComponents = resolveComponents;
-      exports2.resolve = resolve5;
+      exports2.resolve = resolve6;
       exports2.normalize = normalize;
       exports2.equal = equal;
       exports2.escapeComponent = escapeComponent;
@@ -22808,18 +23328,18 @@ var require_resolve = __commonJS({
     var util = require_util();
     var SchemaObject = require_schema_obj();
     var traverse = require_json_schema_traverse();
-    module.exports = resolve5;
-    resolve5.normalizeId = normalizeId;
-    resolve5.fullPath = getFullPath;
-    resolve5.url = resolveUrl;
-    resolve5.ids = resolveIds;
-    resolve5.inlineRef = inlineRef;
-    resolve5.schema = resolveSchema;
-    function resolve5(compile, root, ref) {
+    module.exports = resolve6;
+    resolve6.normalizeId = normalizeId;
+    resolve6.fullPath = getFullPath;
+    resolve6.url = resolveUrl;
+    resolve6.ids = resolveIds;
+    resolve6.inlineRef = inlineRef;
+    resolve6.schema = resolveSchema;
+    function resolve6(compile, root, ref) {
       var refVal = this._refs[ref];
       if (typeof refVal == "string") {
         if (this._refs[refVal]) refVal = this._refs[refVal];
-        else return resolve5.call(this, compile, root, refVal);
+        else return resolve6.call(this, compile, root, refVal);
       }
       refVal = refVal || this._schemas[ref];
       if (refVal instanceof SchemaObject) {
@@ -23024,7 +23544,7 @@ var require_resolve = __commonJS({
 var require_error_classes = __commonJS({
   "node_modules/ajv/lib/compile/error_classes.js"(exports, module) {
     "use strict";
-    var resolve5 = require_resolve();
+    var resolve6 = require_resolve();
     module.exports = {
       Validation: errorSubclass(ValidationError),
       MissingRef: errorSubclass(MissingRefError)
@@ -23039,8 +23559,8 @@ var require_error_classes = __commonJS({
     };
     function MissingRefError(baseId, ref, message) {
       this.message = message || MissingRefError.message(baseId, ref);
-      this.missingRef = resolve5.url(baseId, ref);
-      this.missingSchema = resolve5.normalizeId(resolve5.fullPath(this.missingRef));
+      this.missingRef = resolve6.url(baseId, ref);
+      this.missingSchema = resolve6.normalizeId(resolve6.fullPath(this.missingRef));
     }
     function errorSubclass(Subclass) {
       Subclass.prototype = Object.create(Error.prototype);
@@ -23568,7 +24088,7 @@ var require_validate = __commonJS({
 var require_compile = __commonJS({
   "node_modules/ajv/lib/compile/index.js"(exports, module) {
     "use strict";
-    var resolve5 = require_resolve();
+    var resolve6 = require_resolve();
     var util = require_util();
     var errorClasses = require_error_classes();
     var stableStringify = require_fast_json_stable_stringify();
@@ -23630,7 +24150,7 @@ var require_compile = __commonJS({
           RULES,
           validate: validateGenerator,
           util,
-          resolve: resolve5,
+          resolve: resolve6,
           resolveRef: resolveRef2,
           usePattern,
           useDefault,
@@ -23692,7 +24212,7 @@ var require_compile = __commonJS({
         return validate;
       }
       function resolveRef2(baseId2, ref, isRoot) {
-        ref = resolve5.url(baseId2, ref);
+        ref = resolve6.url(baseId2, ref);
         var refIndex = refs[ref];
         var _refVal, refCode;
         if (refIndex !== void 0) {
@@ -23709,11 +24229,11 @@ var require_compile = __commonJS({
           }
         }
         refCode = addLocalRef(ref);
-        var v2 = resolve5.call(self2, localCompile, root, ref);
+        var v2 = resolve6.call(self2, localCompile, root, ref);
         if (v2 === void 0) {
           var localSchema = localRefs && localRefs[ref];
           if (localSchema) {
-            v2 = resolve5.inlineRef(localSchema, opts.inlineRefs) ? localSchema : compile.call(self2, localSchema, root, localRefs, baseId2);
+            v2 = resolve6.inlineRef(localSchema, opts.inlineRefs) ? localSchema : compile.call(self2, localSchema, root, localRefs, baseId2);
           }
         }
         if (v2 === void 0) {
@@ -27330,7 +27850,7 @@ var require_ajv = __commonJS({
   "node_modules/ajv/lib/ajv.js"(exports, module) {
     "use strict";
     var compileSchema = require_compile();
-    var resolve5 = require_resolve();
+    var resolve6 = require_resolve();
     var Cache = require_cache();
     var SchemaObject = require_schema_obj();
     var stableStringify = require_fast_json_stable_stringify();
@@ -27412,7 +27932,7 @@ var require_ajv = __commonJS({
       var id2 = this._getId(schema);
       if (id2 !== void 0 && typeof id2 != "string")
         throw new Error("schema id must be string");
-      key = resolve5.normalizeId(key || id2);
+      key = resolve6.normalizeId(key || id2);
       checkUnique(this, key);
       this._schemas[key] = this._addSchema(schema, _skipValidation, _meta, true);
       return this;
@@ -27456,7 +27976,7 @@ var require_ajv = __commonJS({
       }
     }
     function _getSchemaFragment(self2, ref) {
-      var res = resolve5.schema.call(self2, { schema: {} }, ref);
+      var res = resolve6.schema.call(self2, { schema: {} }, ref);
       if (res) {
         var schema = res.schema, root = res.root, baseId = res.baseId;
         var v = compileSchema.call(self2, schema, root, void 0, baseId);
@@ -27472,7 +27992,7 @@ var require_ajv = __commonJS({
       }
     }
     function _getSchemaObj(self2, keyRef) {
-      keyRef = resolve5.normalizeId(keyRef);
+      keyRef = resolve6.normalizeId(keyRef);
       return self2._schemas[keyRef] || self2._refs[keyRef] || self2._fragments[keyRef];
     }
     function removeSchema(schemaKeyRef) {
@@ -27499,7 +28019,7 @@ var require_ajv = __commonJS({
           this._cache.del(cacheKey);
           var id2 = this._getId(schemaKeyRef);
           if (id2) {
-            id2 = resolve5.normalizeId(id2);
+            id2 = resolve6.normalizeId(id2);
             delete this._schemas[id2];
             delete this._refs[id2];
           }
@@ -27523,13 +28043,13 @@ var require_ajv = __commonJS({
       var cached2 = this._cache.get(cacheKey);
       if (cached2) return cached2;
       shouldAddSchema = shouldAddSchema || this._opts.addUsedSchema !== false;
-      var id2 = resolve5.normalizeId(this._getId(schema));
+      var id2 = resolve6.normalizeId(this._getId(schema));
       if (id2 && shouldAddSchema) checkUnique(this, id2);
       var willValidate = this._opts.validateSchema !== false && !skipValidation;
       var recursiveMeta;
-      if (willValidate && !(recursiveMeta = id2 && id2 == resolve5.normalizeId(schema.$schema)))
+      if (willValidate && !(recursiveMeta = id2 && id2 == resolve6.normalizeId(schema.$schema)))
         this.validateSchema(schema, true);
-      var localRefs = resolve5.ids.call(this, schema);
+      var localRefs = resolve6.ids.call(this, schema);
       var schemaObj = new SchemaObject({
         id: id2,
         schema,
@@ -27795,13 +28315,13 @@ var init_runner = __esm({
     };
     defaultSleep = async (milliseconds, signal) => {
       if (signal?.aborted) throw abortError();
-      await new Promise((resolve5, reject) => {
+      await new Promise((resolve6, reject) => {
         const finish = (callback) => {
           signal?.removeEventListener("abort", onAbort);
           callback();
         };
         const timer = setTimeout(
-          () => finish(resolve5),
+          () => finish(resolve6),
           Math.max(MIN_SLEEP_MS, milliseconds)
         );
         const onAbort = () => {
@@ -28284,8 +28804,8 @@ var init_runner = __esm({
         let failed = 0;
         let acceptAttemptUpdates = true;
         let wakeDrain;
-        const drainSignal = new Promise((resolve5) => {
-          wakeDrain = resolve5;
+        const drainSignal = new Promise((resolve6) => {
+          wakeDrain = resolve6;
         });
         const requestDrain = (reason) => {
           const priority = (value) => {
@@ -28334,7 +28854,7 @@ var init_runner = __esm({
           const metadata = await this.dependencies.discoverOAuth({
             signal: this.options.signal
           });
-          let access3 = null;
+          let access4 = null;
           let accessExpiresAt = 0;
           let refreshPromise = null;
           const refreshAccessToken = async (requestOptions = {}) => {
@@ -28347,7 +28867,7 @@ var init_runner = __esm({
               );
               assertLocalCredentialIdentity(localState, refreshed.credential);
               credential = refreshed.credential;
-              access3 = refreshed;
+              access4 = refreshed;
               accessExpiresAt = now() + refreshed.expiresIn * 1e3;
               return refreshed.accessToken;
             })();
@@ -28360,10 +28880,10 @@ var init_runner = __esm({
           await refreshAccessToken({ signal: this.options.signal });
           const tokenSource = {
             accessToken: async (requestOptions) => {
-              if (!access3 || accessExpiresAt - now() <= 5e3) {
+              if (!access4 || accessExpiresAt - now() <= 5e3) {
                 return refreshAccessToken(requestOptions);
               }
-              return access3.accessToken;
+              return access4.accessToken;
             },
             refreshAccessToken
           };
@@ -28420,7 +28940,7 @@ var init_runner = __esm({
                 return await operation();
               } catch (error48) {
                 lastError = error48;
-                if (!retryableRemoteError(error48) || attempt === settings.remoteRetryLimit) throw error48;
+                if (!retryableRemoteError(error48) || error48 instanceof ExternalInferenceMcpError && error48.definitivelyNotApplied || attempt === settings.remoteRetryLimit) throw error48;
                 const requestedRetryDelay = remoteRetryAfterMs(
                   error48,
                   Math.min(250 * attempt, 1e3)
@@ -28521,7 +29041,7 @@ var init_runner = __esm({
           }
           const hostHeartbeat = async (status, requestOptions = {
             signal: this.options.signal
-          }, retryRemote = true, allowOfflineProjection = false) => {
+          }, retryRemote = true, allowOfflineProjection = false, definitiveReseedAttempt = 0) => {
             const sequence = receipt.host_heartbeat_sequence + 1;
             const request = {
               schema_version: "external_inference_host_heartbeat_v1",
@@ -28547,7 +29067,22 @@ var init_runner = __esm({
               request,
               requestOptions
             );
-            const result2 = status === "draining" || !retryRemote ? await heartbeatOperation() : await retryExact(heartbeatOperation, requestOptions);
+            let result2;
+            try {
+              result2 = status === "draining" || !retryRemote ? await heartbeatOperation() : await retryExact(heartbeatOperation, requestOptions);
+            } catch (error48) {
+              if (status !== "draining" && retryRemote && error48 instanceof ExternalInferenceMcpError && error48.definitivelyNotApplied && error48.retryable && definitiveReseedAttempt < settings.remoteRetryLimit - 1) {
+                await sleep4(remoteRetryAfterMs(error48, MIN_SLEEP_MS), requestOptions.signal);
+                return await hostHeartbeat(
+                  status,
+                  requestOptions,
+                  retryRemote,
+                  allowOfflineProjection,
+                  definitiveReseedAttempt + 1
+                );
+              }
+              throw error48;
+            }
             assertHostHeartbeatResult(request, result2, allowOfflineProjection);
             if (result2.host.status === "revoked" || result2.host.status === "offline" && !allowOfflineProjection) {
               const error48 = new InferenceHostRunnerError(
@@ -29284,6 +29819,627 @@ var init_runner = __esm({
   }
 });
 
+// lib/inference-host/service.ts
+import { spawn as spawn5 } from "node:child_process";
+import { createWriteStream, readFileSync } from "node:fs";
+import { access as access3, chmod as chmod3, mkdir as mkdir3, readFile as readFile5, rm as rm4, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
+var SERVICE_NAME, SYSTEMD_UNIT, LAUNCHD_LABEL, SERVICE_COOPERATIVE_STOP_SECONDS, isWindowsSubsystemForLinux, inferenceHostServiceManifestPath, inferenceHostServiceDesiredPath, inferenceHostServiceLogPath, xmlEscape, plistEscape, systemdQuote, defaultRunCommand, managerName, assertManifest, assertDesiredState, readInferenceHostServiceManifest, readInferenceHostServiceDesired, readDesiredAcrossAtomicReplacement, writeDesired, runtimeEnvironment, serviceArguments, windowsTaskXml, systemdUnit, launchAgentPlist, InferenceHostServiceManager, appendServiceLog, spawnServiceChild, runInferenceHostServiceSupervisor;
+var init_service = __esm({
+  "lib/inference-host/service.ts"() {
+    "use strict";
+    init_config();
+    SERVICE_NAME = "VTX Macro Inference Host";
+    SYSTEMD_UNIT = "vtx-inference-host.service";
+    LAUNCHD_LABEL = "com.vtxmacro.inference-host";
+    SERVICE_COOPERATIVE_STOP_SECONDS = 75;
+    isWindowsSubsystemForLinux = (env = process.env, kernelRelease) => Boolean(
+      String(env.WSL_INTEROP || "").trim() || String(env.WSL_DISTRO_NAME || "").trim() || /microsoft/iu.test(kernelRelease ?? (() => {
+        try {
+          return readFileSync("/proc/sys/kernel/osrelease", "utf8");
+        } catch {
+          return "";
+        }
+      })())
+    );
+    inferenceHostServiceManifestPath = (config2) => `${config2.statePath}.service.json`;
+    inferenceHostServiceDesiredPath = (config2) => `${config2.statePath}.service-desired.json`;
+    inferenceHostServiceLogPath = (config2) => `${config2.statePath}.service.log`;
+    xmlEscape = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+    plistEscape = xmlEscape;
+    systemdQuote = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%")}"`;
+    defaultRunCommand = async (command, args) => await new Promise((resolvePromise) => {
+      const child = spawn5(command, [...args], {
+        windowsHide: true,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      const stdout = [];
+      const stderr = [];
+      child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
+      child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
+      child.once("error", (error48) => resolvePromise({
+        exitCode: 1,
+        stdout: "",
+        stderr: error48.message
+      }));
+      child.once("exit", (code) => resolvePromise({
+        exitCode: code ?? 1,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8")
+      }));
+    });
+    managerName = (platform) => {
+      if (platform === "win32") return "windows-task-scheduler";
+      if (platform === "darwin") return "launch-agent";
+      if (platform === "linux") return "systemd-user";
+      throw new Error(`Inference-host background service is unsupported on ${platform}.`);
+    };
+    assertManifest = (value) => {
+      if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Inference-host service manifest is invalid.");
+      }
+      const record2 = value;
+      if (record2.schema_version !== "vtx_inference_service_v1" || record2.adapter !== "codex" || typeof record2.installed_at !== "string" || !Number.isFinite(Date.parse(record2.installed_at)) || typeof record2.executable !== "string" || !record2.executable || typeof record2.script !== "string" || !record2.script || typeof record2.display_name !== "string" || !record2.display_name || typeof record2.log_path !== "string" || !record2.log_path || !record2.runtime_environment || typeof record2.runtime_environment !== "object" || Array.isArray(record2.runtime_environment)) {
+        throw new Error("Inference-host service manifest is invalid.");
+      }
+      for (const value2 of [
+        record2.executable,
+        record2.script,
+        record2.log_path
+      ]) {
+        if (typeof value2 === "string" && /[\r\n\0]/u.test(value2)) {
+          throw new Error("Inference-host service manifest paths contain control characters.");
+        }
+      }
+      for (const [key, entry] of Object.entries(record2.runtime_environment)) {
+        if (!key.startsWith("VTX_") || typeof entry !== "string") {
+          throw new Error("Inference-host service runtime environment is invalid.");
+        }
+      }
+      return record2;
+    };
+    assertDesiredState = (value) => {
+      if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Inference-host service desired state is invalid.");
+      }
+      const record2 = value;
+      if (record2.schema_version !== "vtx_inference_service_desired_v1" || typeof record2.desired_running !== "boolean" || typeof record2.updated_at !== "string" || !Number.isFinite(Date.parse(record2.updated_at))) {
+        throw new Error("Inference-host service desired state is invalid.");
+      }
+      return record2;
+    };
+    readInferenceHostServiceManifest = async (path) => {
+      const raw = await readInferencePrivateFile(path, "Inference-host service manifest");
+      if (raw === null) return null;
+      try {
+        return assertManifest(JSON.parse(raw));
+      } catch (error48) {
+        if (error48 instanceof SyntaxError) throw new Error("Inference-host service manifest is not valid JSON.");
+        throw error48;
+      }
+    };
+    readInferenceHostServiceDesired = async (path) => {
+      const raw = await readInferencePrivateFile(path, "Inference-host service desired state");
+      if (raw === null) return false;
+      try {
+        return assertDesiredState(JSON.parse(raw)).desired_running;
+      } catch (error48) {
+        if (error48 instanceof SyntaxError) throw new Error("Inference-host service desired state is not valid JSON.");
+        throw error48;
+      }
+    };
+    readDesiredAcrossAtomicReplacement = async (path) => {
+      for (let attempt = 0; attempt < 3; attempt += 1) {
+        try {
+          return await readInferenceHostServiceDesired(path);
+        } catch (error48) {
+          if (!(error48 instanceof Error) || !error48.message.includes("changed while it was opened")) {
+            throw error48;
+          }
+        }
+      }
+      return await readInferenceHostServiceDesired(path);
+    };
+    writeDesired = async (path, desired, now) => {
+      await writeAtomicInferencePrivateFile(path, `${JSON.stringify({
+        schema_version: "vtx_inference_service_desired_v1",
+        desired_running: desired,
+        updated_at: now.toISOString()
+      }, null, 2)}
+`);
+    };
+    runtimeEnvironment = (config2) => {
+      const result2 = {
+        VTX_API_URL: config2.apiUrl,
+        VTX_INFERENCE_HOST_HOME: dirname4(config2.codexHomePath),
+        VTX_INFERENCE_HOST_CREDENTIAL_STORE: config2.credentialStoreMode,
+        VTX_INFERENCE_HOST_STATE_PATH: config2.statePath,
+        VTX_INFERENCE_HOST_LOCK_PATH: config2.processLockPath
+      };
+      if (config2.credentialFilePath) {
+        result2.VTX_INFERENCE_HOST_CREDENTIAL_FILE = config2.credentialFilePath;
+      }
+      return result2;
+    };
+    serviceArguments = (script, manifestPath) => [
+      script,
+      "inference-host",
+      "service",
+      "run-internal",
+      "--service-manifest",
+      manifestPath
+    ];
+    windowsTaskXml = (executable, args, username) => `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo><Description>${xmlEscape(SERVICE_NAME)}</Description></RegistrationInfo>
+  <Triggers>
+    <LogonTrigger><Enabled>true</Enabled><UserId>${xmlEscape(username)}</UserId></LogonTrigger>
+    <TimeTrigger>
+      <StartBoundary>2020-01-01T00:00:00</StartBoundary>
+      <Enabled>true</Enabled>
+      <Repetition><Interval>PT1M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition>
+    </TimeTrigger>
+  </Triggers>
+  <Principals><Principal id="Author"><UserId>${xmlEscape(username)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <RestartOnFailure><Interval>PT1M</Interval><Count>255</Count></RestartOnFailure>
+  </Settings>
+  <Actions Context="Author"><Exec><Command>${xmlEscape(executable)}</Command><Arguments>${xmlEscape(args.map((arg) => `"${arg.replaceAll('"', '\\"')}"`).join(" "))}</Arguments></Exec></Actions>
+</Task>
+`;
+    systemdUnit = (executable, args) => `[Unit]
+Description=${SERVICE_NAME}
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+ExecStart=${[executable, ...args].map(systemdQuote).join(" ")}
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=${SERVICE_COOPERATIVE_STOP_SECONDS}s
+
+[Install]
+WantedBy=default.target
+`;
+    launchAgentPlist = (executable, args, logPath) => `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key><array>${[executable, ...args].map((arg) => `<string>${plistEscape(arg)}</string>`).join("")}</array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>
+  <key>ProcessType</key><string>Background</string>
+  <key>ThrottleInterval</key><integer>5</integer>
+  <key>ExitTimeOut</key><integer>${SERVICE_COOPERATIVE_STOP_SECONDS}</integer>
+  <key>StandardOutPath</key><string>${plistEscape(logPath)}</string>
+  <key>StandardErrorPath</key><string>${plistEscape(logPath)}</string>
+</dict></plist>
+`;
+    InferenceHostServiceManager = class {
+      constructor(config2, dependencies = {}) {
+        this.config = config2;
+        this.platform = dependencies.platform ?? process.platform;
+        this.home = dependencies.homedir ?? homedir2();
+        this.executable = resolve4(dependencies.executable ?? process.execPath);
+        this.script = resolve4(dependencies.script ?? process.argv[1] ?? "");
+        this.username = dependencies.username ?? ([process.env.USERDOMAIN, process.env.USERNAME].filter(Boolean).join("\\") || process.env.USER || "");
+        this.runCommand = dependencies.runCommand ?? defaultRunCommand;
+        this.now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
+        this.sleep = dependencies.sleep ?? (async (milliseconds) => {
+          await new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
+        });
+        this.stopWaitAttempts = dependencies.stopWaitAttempts ?? SERVICE_COOPERATIVE_STOP_SECONDS * 4;
+        this.startWaitAttempts = dependencies.startWaitAttempts ?? 40;
+        this.acquireProcessLock = dependencies.acquireProcessLock ?? acquireInferenceHostProcessLock;
+        managerName(this.platform);
+        if (dependencies.platform === void 0 && this.platform === "linux" && isWindowsSubsystemForLinux()) {
+          throw new Error(
+            "Windows-login auto-start requires the native Windows VTX CLI. A WSL-only service cannot start the WSL virtual machine at login."
+          );
+        }
+      }
+      manifestPath() {
+        return inferenceHostServiceManifestPath(this.config);
+      }
+      desiredPath() {
+        return inferenceHostServiceDesiredPath(this.config);
+      }
+      logPath() {
+        return inferenceHostServiceLogPath(this.config);
+      }
+      controlLockPath() {
+        return `${this.config.processLockPath}.service-control`;
+      }
+      async withControlLock(operation) {
+        let lock2 = null;
+        for (let attempt = 0; attempt < 400; attempt += 1) {
+          try {
+            lock2 = await this.acquireProcessLock(this.controlLockPath());
+            break;
+          } catch (error48) {
+            if (!/already owns/iu.test(error48 instanceof Error ? error48.message : "")) throw error48;
+            await this.sleep(250);
+          }
+        }
+        if (!lock2) {
+          throw new Error("Another inference-host service control operation did not finish within 100 seconds.");
+        }
+        try {
+          return await operation();
+        } finally {
+          await lock2.release();
+        }
+      }
+      windowsTaskName() {
+        const identity = this.username.replaceAll(/[^A-Za-z0-9_.@-]+/gu, "_").slice(-80) || "current-user";
+        return `VTX Macro Inference Host (${identity})`;
+      }
+      windowsPowerShell(script) {
+        return [
+          "-NoLogo",
+          "-NoProfile",
+          "-NonInteractive",
+          "-EncodedCommand",
+          Buffer.from(script, "utf16le").toString("base64")
+        ];
+      }
+      definitionPath() {
+        if (this.platform === "win32") return `${this.config.statePath}.service-task.xml`;
+        if (this.platform === "darwin") return join5(this.home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+        return join5(this.home, ".config", "systemd", "user", SYSTEMD_UNIT);
+      }
+      async managerCommand(action) {
+        const definition = this.definitionPath();
+        if (this.platform === "win32") {
+          const taskName = this.windowsTaskName();
+          if (action === "install") return await this.runCommand("schtasks.exe", ["/Create", "/F", "/TN", taskName, "/XML", definition]);
+          const quotedName = taskName.replaceAll("'", "''");
+          if (action === "start") return await this.runCommand("powershell.exe", this.windowsPowerShell(
+            `$ErrorActionPreference='Stop'; $task=Get-ScheduledTask -TaskName '${quotedName}' -ErrorAction Stop; Enable-ScheduledTask -InputObject $task -ErrorAction Stop | Out-Null; Start-ScheduledTask -TaskName '${quotedName}'`
+          ));
+          if (action === "stop") return await this.runCommand("powershell.exe", this.windowsPowerShell(
+            `$ErrorActionPreference='Stop'; $task=Get-ScheduledTask -TaskName '${quotedName}' -ErrorAction SilentlyContinue; if($null -ne $task) { Stop-ScheduledTask -InputObject $task -ErrorAction Stop; Disable-ScheduledTask -InputObject $task -ErrorAction Stop | Out-Null }`
+          ));
+          if (action === "status") return await this.runCommand("powershell.exe", this.windowsPowerShell(
+            `$ErrorActionPreference='Stop'; [Console]::Out.Write([int](Get-ScheduledTask -TaskName '${quotedName}').State)`
+          ));
+          return await this.runCommand("powershell.exe", this.windowsPowerShell(
+            `$ErrorActionPreference='Stop'; $task=Get-ScheduledTask -TaskName '${quotedName}' -ErrorAction SilentlyContinue; if($null -ne $task) { Unregister-ScheduledTask -InputObject $task -Confirm:$false -ErrorAction Stop }; if($null -ne (Get-ScheduledTask -TaskName '${quotedName}' -ErrorAction SilentlyContinue)) { throw 'scheduled task still exists after unregister' }`
+          ));
+        }
+        if (this.platform === "darwin") {
+          const domain2 = `gui/${typeof process.getuid === "function" ? process.getuid() : 0}`;
+          if (action === "install") return { exitCode: 0, stdout: "definition-written", stderr: "" };
+          if (action === "start") return await this.runCommand("launchctl", ["bootstrap", domain2, definition]);
+          if (action === "stop") return await this.runCommand("launchctl", ["bootout", domain2, definition]);
+          if (action === "status") return await this.runCommand("launchctl", ["print", `${domain2}/${LAUNCHD_LABEL}`]);
+          return await this.runCommand("launchctl", ["bootout", domain2, definition]);
+        }
+        if (action === "install") return await this.runCommand("systemctl", ["--user", "enable", SYSTEMD_UNIT]);
+        if (action === "start") return await this.runCommand("systemctl", ["--user", "start", SYSTEMD_UNIT]);
+        if (action === "stop") return await this.runCommand("systemctl", ["--user", "stop", SYSTEMD_UNIT]);
+        if (action === "status") return await this.runCommand("systemctl", ["--user", "show", SYSTEMD_UNIT, "--property=ActiveState,SubState,UnitFileState", "--no-pager"]);
+        return await this.runCommand("systemctl", ["--user", "disable", "--now", SYSTEMD_UNIT]);
+      }
+      async waitForManagerActive() {
+        for (let attempt = 0; attempt < this.startWaitAttempts; attempt += 1) {
+          const status = await this.status();
+          if (status.manager_active) return status;
+          await this.sleep(250);
+        }
+        throw new Error("Background service did not reach an active state within 10 seconds.");
+      }
+      async install(options) {
+        return await this.withControlLock(async () => await this.installUnlocked(options));
+      }
+      async installUnlocked(options) {
+        if (await readInferenceHostServiceManifest(this.manifestPath())) {
+          await this.uninstallUnlocked();
+        }
+        await access3(this.executable);
+        await access3(this.script);
+        const manifest = assertManifest({
+          schema_version: "vtx_inference_service_v1",
+          installed_at: this.now().toISOString(),
+          adapter: options.adapter,
+          executable: this.executable,
+          script: this.script,
+          display_name: options.displayName,
+          log_path: this.logPath(),
+          runtime_environment: runtimeEnvironment(this.config)
+        });
+        const args = serviceArguments(this.script, this.manifestPath());
+        const definition = this.platform === "win32" ? windowsTaskXml(this.executable, args, this.username) : this.platform === "darwin" ? launchAgentPlist(this.executable, args, this.logPath()) : systemdUnit(this.executable, args);
+        let managerInstallAttempted = false;
+        try {
+          await writeAtomicInferencePrivateFile(this.manifestPath(), `${JSON.stringify(manifest, null, 2)}
+`);
+          await writeDesired(this.desiredPath(), options.startImmediately !== false, this.now());
+          await mkdir3(dirname4(this.definitionPath()), { recursive: true, mode: 448 });
+          if (this.platform === "win32") {
+            await writeFile2(this.definitionPath(), `\uFEFF${definition}`, {
+              encoding: "utf16le",
+              mode: 384
+            });
+          } else {
+            await writeFile2(this.definitionPath(), definition, { encoding: "utf8", mode: 384 });
+            await chmod3(this.definitionPath(), 384);
+          }
+          if (this.platform === "linux") {
+            const reload = await this.runCommand("systemctl", ["--user", "daemon-reload"]);
+            if (reload.exitCode !== 0) throw new Error(`systemd user daemon reload failed: ${reload.stderr.trim()}`);
+          }
+          managerInstallAttempted = true;
+          const installed = await this.managerCommand("install");
+          if (installed.exitCode !== 0) throw new Error(`Background service installation failed: ${installed.stderr.trim()}`);
+          if (options.startImmediately !== false) {
+            const started = await this.managerCommand("start");
+            if (started.exitCode !== 0 && !/already running|in progress/iu.test(`${started.stdout}
+${started.stderr}`)) {
+              throw new Error(`Background service start failed: ${started.stderr.trim()}`);
+            }
+            await this.waitForManagerActive();
+          }
+        } catch (error48) {
+          await writeDesired(this.desiredPath(), false, this.now()).catch(() => void 0);
+          if (managerInstallAttempted) {
+            const cleanup = await this.managerCommand("uninstall").catch((cleanupError) => ({
+              exitCode: 1,
+              stdout: "",
+              stderr: cleanupError instanceof Error ? cleanupError.message : "unknown cleanup error"
+            }));
+            if (cleanup.exitCode !== 0 && !/not found|does not exist|not loaded|no such process|cannot find/iu.test(`${cleanup.stdout}
+${cleanup.stderr}`)) {
+              throw new Error(
+                `Background service setup failed and manager cleanup was not confirmed: ${cleanup.stderr.trim()}`,
+                { cause: error48 }
+              );
+            }
+          }
+          await rm4(this.definitionPath(), { force: true }).catch(() => void 0);
+          await rm4(this.manifestPath(), { force: true }).catch(() => void 0);
+          await rm4(this.desiredPath(), { force: true }).catch(() => void 0);
+          if (this.platform === "linux") {
+            await this.runCommand("systemctl", ["--user", "daemon-reload"]).catch(() => void 0);
+          }
+          throw error48;
+        }
+        return await this.status();
+      }
+      async start() {
+        return await this.withControlLock(async () => await this.startUnlocked());
+      }
+      async startUnlocked() {
+        if (!await readInferenceHostServiceManifest(this.manifestPath())) {
+          throw new Error("Inference-host service is not installed.");
+        }
+        await writeDesired(this.desiredPath(), true, this.now());
+        const result2 = await this.managerCommand("start");
+        if (result2.exitCode !== 0 && !/already running|in progress/iu.test(`${result2.stdout}
+${result2.stderr}`)) {
+          throw new Error(`Background service start failed: ${result2.stderr.trim()}`);
+        }
+        try {
+          return await this.waitForManagerActive();
+        } catch (error48) {
+          await writeDesired(this.desiredPath(), false, this.now());
+          await this.managerCommand("stop").catch(() => void 0);
+          throw error48;
+        }
+      }
+      async stop() {
+        return await this.withControlLock(async () => await this.stopUnlocked());
+      }
+      async stopUnlocked() {
+        if (!await readInferenceHostServiceManifest(this.manifestPath())) {
+          throw new Error("Inference-host service is not installed.");
+        }
+        await writeDesired(this.desiredPath(), false, this.now());
+        const serviceLockPath = `${this.config.processLockPath}.service`;
+        let serviceReleased = false;
+        for (let attempt = 0; attempt < this.stopWaitAttempts; attempt += 1) {
+          try {
+            const probe = await this.acquireProcessLock(serviceLockPath);
+            await probe.release();
+            serviceReleased = true;
+            break;
+          } catch (error48) {
+            if (error48 instanceof Error && error48.message.includes("Another inference host process already owns")) {
+              await this.sleep(250);
+              continue;
+            }
+            throw error48;
+          }
+        }
+        if (!serviceReleased) {
+          throw new Error(
+            `Inference-host worker did not stop cooperatively within ${SERVICE_COOPERATIVE_STOP_SECONDS} seconds; refusing forced termination while cleanup may be pending.`
+          );
+        }
+        const result2 = await this.managerCommand("stop");
+        if (result2.exitCode !== 0 && !/not running|not found|does not exist|not loaded|cannot find|no such process/iu.test(`${result2.stdout}
+${result2.stderr}`)) {
+          throw new Error(`Background service stop failed: ${result2.stderr.trim()}`);
+        }
+        const status = await this.status();
+        if (status.manager_active) {
+          throw new Error("Background service manager still reports the service active after stop.");
+        }
+        return status;
+      }
+      async status() {
+        const manifest = await readInferenceHostServiceManifest(this.manifestPath());
+        const desired = await readInferenceHostServiceDesired(this.desiredPath());
+        const result2 = await this.managerCommand("status");
+        const output3 = result2.stdout.trim();
+        const managerActive = result2.exitCode === 0 && (this.platform === "linux" ? /(?:^|\n)ActiveState=active(?:\n|$)/u.test(output3) : this.platform === "win32" ? output3.trim() === "4" : /\bstate\s*=\s*running\b/iu.test(output3));
+        return {
+          installed: manifest !== null,
+          desired_running: desired,
+          manager_active: managerActive,
+          manager: managerName(this.platform),
+          manager_state: result2.exitCode === 0 ? output3 || "installed" : "not-installed",
+          adapter: manifest?.adapter ?? null,
+          log_path: manifest?.log_path ?? this.logPath()
+        };
+      }
+      async logs(lines = 100) {
+        const manifest = await readInferenceHostServiceManifest(this.manifestPath());
+        const path = manifest?.log_path ?? this.logPath();
+        try {
+          const contents = await readFile5(path, "utf8");
+          return `${contents.trimEnd().split(/\r?\n/u).slice(-lines).join("\n")}
+`;
+        } catch (error48) {
+          if (error48.code === "ENOENT") return "";
+          throw error48;
+        }
+      }
+      async uninstall() {
+        return await this.withControlLock(async () => await this.uninstallUnlocked());
+      }
+      async uninstallUnlocked() {
+        const manifest = await readInferenceHostServiceManifest(this.manifestPath());
+        if (!manifest) throw new Error("Inference-host service is not installed.");
+        const current = await this.status();
+        if (current.desired_running || current.manager_active) {
+          await this.stopUnlocked();
+        } else {
+          await writeDesired(this.desiredPath(), false, this.now());
+        }
+        const result2 = await this.managerCommand("uninstall");
+        if (result2.exitCode !== 0 && !/not found|does not exist|not loaded|no such process|cannot find/iu.test(`${result2.stdout}
+${result2.stderr}`)) {
+          throw new Error(`Background service uninstall failed: ${result2.stderr.trim()}`);
+        }
+        await rm4(this.definitionPath(), { force: true });
+        if (this.platform === "linux") await this.runCommand("systemctl", ["--user", "daemon-reload"]);
+        await rm4(this.manifestPath(), { force: true });
+        await rm4(this.desiredPath(), { force: true });
+        return {
+          installed: false,
+          desired_running: false,
+          manager_active: false,
+          manager: managerName(this.platform),
+          manager_state: "not-installed",
+          adapter: null,
+          log_path: manifest.log_path
+        };
+      }
+    };
+    appendServiceLog = async (path, event, fields = {}) => {
+      await mkdir3(dirname4(path), { recursive: true, mode: 448 });
+      const stream = createWriteStream(path, { flags: "a", mode: 384 });
+      await new Promise((resolvePromise, reject) => {
+        stream.once("error", reject);
+        stream.end(`${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), event, ...fields })}
+`, resolvePromise);
+      });
+    };
+    spawnServiceChild = async (manifest, signal) => {
+      const args = [
+        manifest.script,
+        "inference-host",
+        "run",
+        "--json",
+        "--display-name",
+        manifest.display_name
+      ];
+      const startedAt = Date.now();
+      const log = createWriteStream(manifest.log_path, { flags: "a", mode: 384 });
+      return await new Promise((resolvePromise, reject) => {
+        const child = spawn5(manifest.executable, args, {
+          env: { ...process.env, ...manifest.runtime_environment },
+          windowsHide: true,
+          stdio: ["ignore", log, log]
+        });
+        const onAbort = () => child.kill("SIGTERM");
+        signal.addEventListener("abort", onAbort, { once: true });
+        child.once("error", (error48) => {
+          signal.removeEventListener("abort", onAbort);
+          log.end();
+          reject(error48);
+        });
+        child.once("exit", (code) => {
+          signal.removeEventListener("abort", onAbort);
+          log.end();
+          resolvePromise({ exitCode: code ?? 1, uptimeMs: Date.now() - startedAt });
+        });
+      });
+    };
+    runInferenceHostServiceSupervisor = async (manifestPath, options = {}) => {
+      const manifest = await readInferenceHostServiceManifest(manifestPath);
+      if (!manifest) throw new Error("Inference-host service manifest is missing.");
+      const desiredPath = `${manifest.runtime_environment.VTX_INFERENCE_HOST_STATE_PATH}.service-desired.json`;
+      const signal = options.signal ?? new AbortController().signal;
+      const sleep4 = options.sleep ?? (async (milliseconds) => {
+        await new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
+      });
+      const launch = options.runWorker ?? options.spawnChild ?? spawnServiceChild;
+      let failures = 0;
+      await appendServiceLog(manifest.log_path, "service_supervisor_started", { adapter: manifest.adapter });
+      while (!signal.aborted && await readDesiredAcrossAtomicReplacement(desiredPath)) {
+        try {
+          const workerController = new AbortController();
+          const forwardAbort = () => workerController.abort();
+          signal.addEventListener("abort", forwardAbort, { once: true });
+          let workerComplete = false;
+          let monitorError = null;
+          const desiredMonitor = (async () => {
+            while (!workerComplete && !workerController.signal.aborted) {
+              await sleep4(500);
+              if (!await readDesiredAcrossAtomicReplacement(desiredPath)) {
+                workerController.abort();
+                break;
+              }
+            }
+          })().catch((error48) => {
+            monitorError = error48;
+            workerController.abort();
+          });
+          let result2;
+          try {
+            result2 = await launch(manifest, workerController.signal);
+          } finally {
+            workerComplete = true;
+            workerController.abort();
+            signal.removeEventListener("abort", forwardAbort);
+            await desiredMonitor;
+          }
+          if (monitorError) throw monitorError;
+          if (signal.aborted || !await readDesiredAcrossAtomicReplacement(desiredPath)) break;
+          failures = result2.uptimeMs >= 6e4 ? 0 : failures + 1;
+          const retryAfterMs = Math.min(1e3 * 2 ** Math.min(failures, 5), 3e4);
+          await appendServiceLog(manifest.log_path, "worker_exited", {
+            exit_code: result2.exitCode,
+            uptime_ms: result2.uptimeMs,
+            retry_after_ms: retryAfterMs
+          });
+          await sleep4(retryAfterMs);
+        } catch (error48) {
+          if (signal.aborted) break;
+          failures += 1;
+          const retryAfterMs = Math.min(1e3 * 2 ** Math.min(failures, 5), 3e4);
+          await appendServiceLog(manifest.log_path, "worker_launch_failed", {
+            error: error48 instanceof Error ? error48.message : "unknown",
+            retry_after_ms: retryAfterMs
+          });
+          await sleep4(retryAfterMs);
+        }
+      }
+      await appendServiceLog(manifest.log_path, "service_supervisor_stopped");
+    };
+  }
+});
+
 // lib/inference-host/cli.ts
 var cli_exports = {};
 __export(cli_exports, {
@@ -29291,9 +30447,9 @@ __export(cli_exports, {
   runInferenceHostCli: () => runInferenceHostCli
 });
 import { randomUUID } from "node:crypto";
-import { spawn as spawn4 } from "node:child_process";
-import { lstat as lstat4, realpath as realpath4, rm as rm4 } from "node:fs/promises";
-import { join as join5, resolve as resolve4 } from "node:path";
+import { spawn as spawn6 } from "node:child_process";
+import { lstat as lstat4, realpath as realpath4, rm as rm5 } from "node:fs/promises";
+import { join as join6, resolve as resolve5 } from "node:path";
 async function runInferenceHostCli(argv2, env = process.env, dependencies = {}) {
   const warnings = [];
   try {
@@ -29338,6 +30494,9 @@ async function runInferenceHostCli(argv2, env = process.env, dependencies = {})
         async () => await agentFail(config2, parsed, dependencies, warnings)
       );
     }
+    if (parsed.command === "service") {
+      return await serviceCommand(config2, parsed, env, dependencies, warnings);
+    }
     if (parsed.command === "status") {
       return await localStatus(config2, parsed, dependencies, warnings);
     }
@@ -29354,7 +30513,7 @@ async function runInferenceHostCli(argv2, env = process.env, dependencies = {})
       return await cleanupLogin(config2, parsed, dependencies, warnings, true);
     }
     throw new Error(
-      "Usage: vtx inference-host <login|codex-login|run|agent-connect|agent-run|agent-next|agent-complete|agent-fail|status|doctor|logout|codex-logout|revoke> [--json]"
+      "Usage: vtx inference-host <login|codex-login|run|agent-connect|agent-run|agent-next|agent-complete|agent-fail|service|status|doctor|logout|codex-logout|revoke> [--json]"
     );
   } catch (error48) {
     return {
@@ -29365,7 +30524,7 @@ async function runInferenceHostCli(argv2, env = process.env, dependencies = {})
     };
   }
 }
-var INFERENCE_HOST_CLI_VERSION, runtimeReceiptPath, codexRecoveryPath, codexGuardianReceiptRoot, revocationCheckpointPath, foregroundHostLockPath, AGENT_HEARTBEAT_INTERVAL_MS, AGENT_HEARTBEAT_MAX_RETRY_DELAY_MS, retryableAgentHeartbeatError, assertRevocationCheckpoint, readRevocationCheckpoint, writeRevocationCheckpoint, clearRevocationCheckpoint, render, INFERENCE_HOST_HELP, parsePositiveInteger, parseInferenceHostArgs, defaultOpenBrowser, defaultRegisterLifecycleSignalHandlers, lifecycleCancellation, configuredCredentialStore, accountKeyForState, assertCredentialMatchesState2, revocationCheckpointForCredential, assertRevocationCheckpointMatchesLocalIdentity, fileExistsPrivately, inspectCodexAuthentication, clearLocalRuntimeArtifacts, assertLocalRuntimeArtifactsMayBeDiscarded, defaultRunForeground, login, codexLogin, codexLogout, localStatus, doctor, cleanupLogin, runHost, defaultReadStdin, parseAgentStdin, agentOperationId, agentSession, agentConnect, agentRun, agentNext, agentComplete, agentFail, withAgentCommandLock;
+var INFERENCE_HOST_CLI_VERSION, runtimeReceiptPath, codexRecoveryPath, codexGuardianReceiptRoot, revocationCheckpointPath, foregroundHostLockPath, AGENT_HEARTBEAT_INTERVAL_MS, AGENT_HEARTBEAT_MAX_RETRY_DELAY_MS, retryableAgentHeartbeatError, assertRevocationCheckpoint, readRevocationCheckpoint, writeRevocationCheckpoint, clearRevocationCheckpoint, render, INFERENCE_HOST_HELP, parsePositiveInteger, parseInferenceHostArgs, defaultOpenBrowser, defaultRegisterLifecycleSignalHandlers, lifecycleCancellation, configuredCredentialStore, accountKeyForState, assertCredentialMatchesState2, revocationCheckpointForCredential, assertRevocationCheckpointMatchesLocalIdentity, fileExistsPrivately, inspectCodexAuthentication, clearLocalRuntimeArtifacts, assertDurableServiceUninstalled, assertLocalRuntimeArtifactsMayBeDiscarded, defaultRunForeground, login, codexLogin, codexLogout, localStatus, doctor, cleanupLogin, runHost, defaultReadStdin, parseAgentStdin, agentOperationId, agentSession, agentConnect, agentRun, agentNext, agentComplete, agentFail, withAgentCommandLock, serviceCommand;
 var init_cli = __esm({
   "lib/inference-host/cli.ts"() {
     "use strict";
@@ -29382,6 +30541,7 @@ var init_cli = __esm({
     init_oauth();
     init_runner();
     init_mcp_client();
+    init_service();
     INFERENCE_HOST_CLI_VERSION = agent_cli_release_default.package_version;
     runtimeReceiptPath = (config2) => `${config2.statePath}.runtime.json`;
     codexRecoveryPath = (config2) => `${config2.statePath}.codex-recovery.json`;
@@ -29459,6 +30619,7 @@ Commands:
   agent-next      Claim the next exact VTX inference request
   agent-complete  Submit one completed agent result from stdin
   agent-fail      Submit one truthful agent failure from stdin
+  service         Install and control the durable background host
   status          Inspect local host and credential state
   doctor          Verify credentials, Codex, and private runtime state
   logout          Remove local VTX host state without revoking the grant
@@ -29472,6 +30633,10 @@ Common options:
 If the OS credential store cannot retain the VTX grant, set
 VTX_INFERENCE_HOST_CREDENTIAL_STORE=file before login to use the supported
 private-file fallback. See https://vtxmacro.com/insights#subscription-inference.
+
+Durable service:
+  vtx inference-host service install
+  vtx inference-host service <start|stop|status|logs|uninstall>
 `;
     parsePositiveInteger = (raw, label) => {
       const value = Number(raw);
@@ -29494,6 +30659,8 @@ private-file fallback. See https://vtxmacro.com/insights#subscription-inference.
       let modelLabel = null;
       let reasoningEffort = null;
       let waitSeconds = 50;
+      let lines = 100;
+      let serviceManifestPath = null;
       const positionals = [];
       for (let index = 0; index < argv2.length; index += 1) {
         const argument = argv2[index];
@@ -29520,7 +30687,7 @@ private-file fallback. See https://vtxmacro.com/insights#subscription-inference.
           index += 1;
           continue;
         }
-        if (["--adapter", "--model", "--model-label", "--effort", "--wait-seconds"].includes(argument)) {
+        if (["--adapter", "--model", "--model-label", "--effort", "--wait-seconds", "--lines", "--service-manifest"].includes(argument)) {
           const raw = argv2[index + 1];
           if (!raw?.trim()) throw new Error(`${argument} requires a value.`);
           if (argument === "--adapter") adapter = raw.trim();
@@ -29533,6 +30700,13 @@ private-file fallback. See https://vtxmacro.com/insights#subscription-inference.
               throw new Error("--wait-seconds must be an integer from 0 through 300.");
             }
           }
+          if (argument === "--lines") {
+            lines = Number(raw);
+            if (!Number.isInteger(lines) || lines < 1 || lines > 1e4) {
+              throw new Error("--lines must be an integer from 1 through 10000.");
+            }
+          }
+          if (argument === "--service-manifest") serviceManifestPath = resolve5(raw.trim());
           index += 1;
           continue;
         }
@@ -29544,10 +30718,14 @@ private-file fallback. See https://vtxmacro.com/insights#subscription-inference.
       if (positionals[0] !== "inference-host") {
         throw new Error("Inference-host command routing is invalid.");
       }
-      if (positionals.length > 2) {
+      if (positionals.length > 3) {
         throw new Error("Inference-host commands do not accept positional arguments.");
       }
       const command = positionals[1] || null;
+      const serviceAction = command === "service" ? positionals[2] ?? null : null;
+      if (command !== "service" && positionals.length > 2) {
+        throw new Error("Inference-host commands do not accept positional arguments.");
+      }
       if (command === "agent-connect" && !displayNameExplicit) {
         displayName = "Agent-driven inference host";
       }
@@ -29561,13 +30739,16 @@ private-file fallback. See https://vtxmacro.com/insights#subscription-inference.
         modelId,
         modelLabel,
         reasoningEffort,
-        waitSeconds
+        waitSeconds,
+        lines,
+        serviceAction,
+        serviceManifestPath
       };
     };
     defaultOpenBrowser = (url2) => {
       const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
       const args = process.platform === "win32" ? ["/c", "start", "", url2] : [url2];
-      const child = spawn4(command, args, {
+      const child = spawn6(command, args, {
         detached: true,
         stdio: "ignore",
         windowsHide: true
@@ -29636,11 +30817,11 @@ private-file fallback. See https://vtxmacro.com/insights#subscription-inference.
       return raw !== null;
     };
     inspectCodexAuthentication = async (config2) => {
-      const path = join5(config2.codexHomePath, "auth.json");
+      const path = join6(config2.codexHomePath, "auth.json");
       try {
         const before = await lstat4(path);
         const canonical = await realpath4(path);
-        const isPrivate = before.isFile() && !before.isSymbolicLink() && canonical === resolve4(path) && before.size <= 8 * 1024 * 1024 && (process.platform === "win32" || (before.mode & 63) === 0 && (typeof process.getuid !== "function" || before.uid === process.getuid()));
+        const isPrivate = before.isFile() && !before.isSymbolicLink() && canonical === resolve5(path) && before.size <= 8 * 1024 * 1024 && (process.platform === "win32" || (before.mode & 63) === 0 && (typeof process.getuid !== "function" || before.uid === process.getuid()));
         return { present: true, private: isPrivate };
       } catch (error48) {
         if (error48.code === "ENOENT") {
@@ -29654,7 +30835,7 @@ private-file fallback. See https://vtxmacro.com/insights#subscription-inference.
         runtimeReceiptPath(config2),
         "Inference host runtime receipt file"
       );
-      await rm4(codexGuardianReceiptRoot(config2), { recursive: true, force: true });
+      await rm5(codexGuardianReceiptRoot(config2), { recursive: true, force: true });
       await clearInferencePrivateFile(
         codexRecoveryPath(config2),
         "Codex attempt recovery file"
@@ -29663,6 +30844,13 @@ private-file fallback. See https://vtxmacro.com/insights#subscription-inference.
       await clearInferenceAgentNextState(config2.statePath);
       await clearInferenceHostLocalState(config2.statePath);
     };
+    assertDurableServiceUninstalled = async (config2) => {
+      if (await readInferenceHostServiceManifest(`${config2.statePath}.service.json`)) {
+        throw new Error(
+          "Uninstall the durable inference-host service before logout, revoke, or Codex logout."
+        );
+      }
+    };
     assertLocalRuntimeArtifactsMayBeDiscarded = async (config2) => {
       const receipt = await new FileInferenceHostRuntimeReceiptStore(
         runtimeReceiptPath(config2)
@@ -29761,20 +30949,20 @@ Waiting for approval...
           } catch {
           }
         }
-        let access3;
+        let access4;
         try {
-          access3 = await pending.completion;
+          access4 = await pending.completion;
         } catch (error48) {
           await pending.cancel().catch(() => void 0);
           throw error48;
         }
         const state = {
           schema_version: 1,
-          issuer: access3.credential.issuer,
-          client_id: access3.credential.client_id,
-          host_id: access3.credential.host_id,
+          issuer: access4.credential.issuer,
+          client_id: access4.credential.client_id,
+          host_id: access4.credential.host_id,
           host_generation: 1,
-          key_generation: access3.credential.key_generation
+          key_generation: access4.credential.key_generation
         };
         try {
           await writeInferenceHostLocalState(config2.statePath, state);
@@ -29784,7 +30972,7 @@ Waiting for approval...
             const metadata = await (dependencies.discoverOAuth ?? discoverInferenceOAuth)(config2.apiUrl);
             await (dependencies.revokeCredential ?? revokeInferenceCredential)({
               metadata,
-              credential: access3.credential,
+              credential: access4.credential,
               store
             });
             remoteCleanupConfirmed = true;
@@ -29795,8 +30983,8 @@ Waiting for approval...
                 { cause: stateError }
               );
             }
-            await store.writeRecovery(access3.accountKey, access3.credential);
-            await store.remove(access3.accountKey).catch(() => void 0);
+            await store.writeRecovery(access4.accountKey, access4.credential);
+            await store.remove(access4.accountKey).catch(() => void 0);
           }
           if (!remoteCleanupConfirmed) {
             throw new Error(
@@ -29875,6 +31063,7 @@ Waiting for approval...
       }
     };
     codexLogout = async (config2, parsed, env, dependencies) => {
+      await assertDurableServiceUninstalled(config2);
       const cancellation = lifecycleCancellation(dependencies);
       let lock2 = null;
       try {
@@ -30051,6 +31240,7 @@ Waiting for approval...
       };
     };
     cleanupLogin = async (config2, parsed, dependencies, warnings, revoke) => {
+      await assertDurableServiceUninstalled(config2);
       const lock2 = await acquireInferenceHostProcessLock(config2.processLockPath);
       let keeperLock = null;
       try {
@@ -30419,7 +31609,7 @@ Waiting for approval...
           }
           if (parsed.once && !commandLock) break;
           await (dependencies.sleep ?? (async (milliseconds) => {
-            await new Promise((resolve5) => setTimeout(resolve5, milliseconds));
+            await new Promise((resolve6) => setTimeout(resolve6, milliseconds));
           }))(retryDelayMs);
         }
         return {
@@ -30444,7 +31634,7 @@ Waiting for approval...
       const session = await agentSession(config2, dependencies, warnings);
       const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
       const sleep4 = dependencies.sleep ?? (async (milliseconds) => {
-        await new Promise((resolve5) => setTimeout(resolve5, milliseconds));
+        await new Promise((resolve6) => setTimeout(resolve6, milliseconds));
       });
       const stopAt = now().getTime() + parsed.waitSeconds * 1e3;
       while (true) {
@@ -30628,6 +31818,8 @@ Waiting for approval...
           throw new Error("agent-fail requires a boolean retryable field.");
         }
         const dispatched = dispatchOutcome !== "not_dispatched";
+        const effectiveModel = dispatched && Object.hasOwn(input, "effective_model") ? input.effective_model : null;
+        const effectiveEffort = dispatched && Object.hasOwn(input, "effective_reasoning_effort") ? input.effective_reasoning_effort : null;
         request = agentFailRequestSchema.parse({
           operation_id: state.failure_operation_id,
           host_id: state.host_id,
@@ -30635,8 +31827,8 @@ Waiting for approval...
           attempt_id: state.attempt_id,
           claim_handle: state.claim_handle,
           dispatch_outcome: dispatchOutcome,
-          effective_model: dispatched ? String(input.effective_model ?? state.requested_model) : null,
-          effective_reasoning_effort: dispatched ? String(input.effective_reasoning_effort ?? state.requested_reasoning_effort) : null,
+          effective_model: effectiveModel == null ? null : String(effectiveModel),
+          effective_reasoning_effort: effectiveEffort == null ? null : String(effectiveEffort),
           adapter_request_id: input.adapter_request_id == null ? null : String(input.adapter_request_id),
           adapter_response_id: input.adapter_response_id == null ? null : String(input.adapter_response_id),
           usage: input.usage ?? (dispatched ? {
@@ -30672,15 +31864,127 @@ Waiting for approval...
         await lock2.release();
       }
     };
+    serviceCommand = async (config2, parsed, env, dependencies, warnings) => {
+      const action = parsed.serviceAction;
+      if (!action) {
+        throw new Error("Usage: vtx inference-host service <install|start|stop|status|logs|uninstall>.");
+      }
+      if (action === "run-internal") {
+        if (!parsed.serviceManifestPath) throw new Error("Internal service manifest path is required.");
+        const serviceManifest = await readInferenceHostServiceManifest(parsed.serviceManifestPath);
+        if (!serviceManifest) throw new Error("Inference-host service manifest is missing.");
+        const serviceConfig = resolveInferenceHostConfig({
+          ...env,
+          ...serviceManifest.runtime_environment
+        });
+        const serviceLock = await acquireInferenceHostProcessLock(
+          `${serviceConfig.processLockPath}.service`
+        );
+        const cancellation = lifecycleCancellation(dependencies);
+        try {
+          await (dependencies.runServiceSupervisor ?? runInferenceHostServiceSupervisor)(
+            parsed.serviceManifestPath,
+            {
+              signal: cancellation.signal,
+              runWorker: async (manifest, signal) => {
+                const startedAt = Date.now();
+                const serviceEnv = { ...env, ...manifest.runtime_environment };
+                const serviceConfig2 = resolveInferenceHostConfig(serviceEnv);
+                const unregister = (abort) => {
+                  const onAbort = () => abort("SIGTERM");
+                  signal.addEventListener("abort", onAbort, { once: true });
+                  return () => signal.removeEventListener("abort", onAbort);
+                };
+                const result2 = await runHost(serviceConfig2, {
+                  ...parsed,
+                  command: "run",
+                  serviceAction: null,
+                  serviceManifestPath: null,
+                  displayName: manifest.display_name,
+                  once: false
+                }, serviceEnv, {
+                  ...dependencies,
+                  registerLifecycleSignalHandlers: unregister
+                }, warnings);
+                return { exitCode: result2.exitCode, uptimeMs: Date.now() - startedAt };
+              }
+            }
+          );
+          return { exitCode: 0, stdout: "", stderr: "" };
+        } finally {
+          cancellation.unregister();
+          await serviceLock.release();
+        }
+      }
+      const manager = dependencies.createServiceManager?.(
+        config2,
+        dependencies.serviceDependencies
+      ) ?? new InferenceHostServiceManager(config2, dependencies.serviceDependencies);
+      if (action === "install") {
+        const adapter = parsed.adapter || "codex";
+        if (adapter !== "codex") {
+          throw new Error(
+            `Adapter ${adapter} does not have a supported durable service integration. Use foreground agent-run instead.`
+          );
+        }
+        const state = await readInferenceHostLocalState(config2.statePath);
+        if (!state) throw new Error("Run vtx inference-host login before installing the service.");
+        const store = configuredCredentialStore(config2, dependencies, (message) => warnings.push(message));
+        const credential = await store.read(accountKeyForState(state));
+        if (!credential) throw new Error("Inference-host credential is missing. Run login again.");
+        assertCredentialMatchesState2(state, credential);
+        if (parsed.modelId || parsed.modelLabel || parsed.reasoningEffort) {
+          throw new Error("Automated Codex service does not accept agent model or effort options.");
+        }
+        const auth = await inspectCodexAuthentication(config2);
+        if (!auth.present || !auth.private) {
+          throw new Error("Run vtx inference-host codex-login before installing the automated Codex service.");
+        }
+        const binary = await (dependencies.resolveBinary ?? resolvePinnedCodexBinary)(env);
+        await (dependencies.preflightCodex ?? preflightCodexSubscription)({
+          binary,
+          codexHome: config2.codexHomePath,
+          deadlineAtMs: Date.now() + 3e4
+        });
+        const status = await manager.install({ adapter: "codex", displayName: parsed.displayName });
+        return {
+          exitCode: 0,
+          stdout: render({ status: "service_installed", ...status }, parsed.json),
+          stderr: warnings.length > 0 ? `${warnings.join("\n")}
+` : ""
+        };
+      }
+      if (parsed.adapter || parsed.modelId || parsed.modelLabel || parsed.reasoningEffort) {
+        throw new Error("Service adapter and model options are accepted only by service install.");
+      }
+      if (action === "logs") {
+        return { exitCode: 0, stdout: await manager.logs(parsed.lines), stderr: "" };
+      }
+      if (action === "start") {
+        return { exitCode: 0, stdout: render({ status: "service_started", ...await manager.start() }, parsed.json), stderr: "" };
+      }
+      if (action === "stop") {
+        return { exitCode: 0, stdout: render({ status: "service_stopped", ...await manager.stop() }, parsed.json), stderr: "" };
+      }
+      if (action === "status") {
+        const status = await manager.status();
+        const lifecycleMatches = status.installed && (status.desired_running ? status.manager_active : !status.manager_active);
+        return { exitCode: lifecycleMatches ? 0 : 1, stdout: render(status, parsed.json), stderr: "" };
+      }
+      if (action === "uninstall") {
+        return { exitCode: 0, stdout: render({ status: "service_uninstalled", ...await manager.uninstall() }, parsed.json), stderr: "" };
+      }
+      throw new Error("Usage: vtx inference-host service <install|start|stop|status|logs|uninstall>.");
+    };
   }
 });
 
 // lib/agent-core/config.ts
-import { mkdir as mkdir3, readFile as readFile5, rm as rm5, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname3, join as join6 } from "node:path";
-import { homedir as homedir2 } from "node:os";
+import { mkdir as mkdir5, readFile as readFile6, rm as rm6, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname5, join as join7 } from "node:path";
+import { homedir as homedir3 } from "node:os";
 function defaultBaseDir() {
-  return join6(homedir2(), ".vtx");
+  return join7(homedir3(), ".vtx");
 }
 function resolveAgentCliConfig(env = process.env) {
   const baseDir = String(env.VTX_HOME || "").trim() || defaultBaseDir();
@@ -30688,8 +31992,8 @@ function resolveAgentCliConfig(env = process.env) {
   const parsedProfile = rawProfile ? Number(rawProfile) : NaN;
   return {
     apiUrl: String(env.VTX_API_URL || "http://localhost:8000").replace(/\/+$/, ""),
-    tokenPath: String(env.VTX_TOKEN_PATH || "").trim() || join6(baseDir, "token.json"),
-    statePath: String(env.VTX_RUNTIME_STATE_PATH || "").trim() || join6(baseDir, "runtime-state.json"),
+    tokenPath: String(env.VTX_TOKEN_PATH || "").trim() || join7(baseDir, "token.json"),
+    statePath: String(env.VTX_RUNTIME_STATE_PATH || "").trim() || join7(baseDir, "runtime-state.json"),
     runtimeDeviceId: String(env.VTX_RUNTIME_DEVICE_ID || "").trim() || null,
     activeProfileId: Number.isFinite(parsedProfile) && parsedProfile > 0 ? parsedProfile : null,
     outputJson: String(env.VTX_OUTPUT || "").trim().toLowerCase() === "json"
@@ -30697,7 +32001,7 @@ function resolveAgentCliConfig(env = process.env) {
 }
 async function readStoredAgentAuth(path) {
   try {
-    const raw = await readFile5(path, "utf8");
+    const raw = await readFile6(path, "utf8");
     if (!raw.trim()) {
       throw new Error(`VTX token file is empty at ${path}. Run "vtx auth login" or remove the file and retry.`);
     }
@@ -30715,16 +32019,16 @@ async function readStoredAgentAuth(path) {
   }
 }
 async function writeStoredAgentAuth(path, auth) {
-  await mkdir3(dirname3(path), { recursive: true });
-  await writeFile2(path, `${JSON.stringify(auth, null, 2)}
+  await mkdir5(dirname5(path), { recursive: true });
+  await writeFile3(path, `${JSON.stringify(auth, null, 2)}
 `, { encoding: "utf8", mode: 384 });
 }
 async function clearStoredAgentAuth(path) {
-  await rm5(path, { force: true });
+  await rm6(path, { force: true });
 }
 async function readRuntimeState(path) {
   try {
-    const raw = await readFile5(path, "utf8");
+    const raw = await readFile6(path, "utf8");
     const parsed = JSON.parse(raw);
     const profileId = Number(parsed.profileId);
     const runtimeSessionId = String(parsed.runtimeSessionId || "").trim();
@@ -30748,12 +32052,12 @@ async function readRuntimeState(path) {
   }
 }
 async function writeRuntimeState(path, state) {
-  await mkdir3(dirname3(path), { recursive: true });
-  await writeFile2(path, `${JSON.stringify(state, null, 2)}
+  await mkdir5(dirname5(path), { recursive: true });
+  await writeFile3(path, `${JSON.stringify(state, null, 2)}
 `, { encoding: "utf8", mode: 384 });
 }
 async function clearRuntimeState(path) {
-  await rm5(path, { force: true });
+  await rm6(path, { force: true });
 }
 var init_config2 = __esm({
   "lib/agent-core/config.ts"() {
@@ -32578,12 +33882,12 @@ var init_hyperliquid_account_state_adapter = __esm({
       if (signal.aborted) {
         throw createAbortError(abortMessage);
       }
-      return new Promise((resolve5, reject) => {
+      return new Promise((resolve6, reject) => {
         const onAbort = () => {
           reject(createAbortError(abortMessage));
         };
         signal.addEventListener("abort", onAbort, { once: true });
-        promise2.then(resolve5, reject).finally(() => {
+        promise2.then(resolve6, reject).finally(() => {
           signal.removeEventListener("abort", onAbort);
         });
       });
@@ -33994,7 +35298,7 @@ var init_api2 = __esm({
       }
     };
     API_URL = getApiUrl();
-    sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+    sleep2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
     isTransientNetworkFetchError = (error48) => {
       const message = error48 instanceof Error ? error48.message : String(error48 || "");
       const normalized = message.toLowerCase();
@@ -42229,9 +43533,9 @@ function decryptKeystoreJsonSync(json2, _password) {
   return getAccount(data, key);
 }
 function stall(duration3) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     setTimeout(() => {
-      resolve5();
+      resolve6();
     }, duration3);
   });
 }
@@ -42841,9 +44145,9 @@ var init_json_crowdsale = __esm({
 
 // node_modules/ethers/lib.esm/wallet/wallet.js
 function stall2(duration3) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     setTimeout(() => {
-      resolve5();
+      resolve6();
     }, duration3);
   });
 }
@@ -43938,8 +45242,8 @@ var init_exchange_mutation_fence = __esm({
         return operation();
       }
       let markSettled;
-      const settlement = new Promise((resolve5) => {
-        markSettled = resolve5;
+      const settlement = new Promise((resolve6) => {
+        markSettled = resolve6;
       });
       const activeSettlements = activeSettlementsByScope.get(normalizedScope) ?? /* @__PURE__ */ new Set();
       activeSettlements.add(settlement);
@@ -45196,12 +46500,12 @@ var init_hyperliquid_client = __esm({
                       },
                       captureController.signal
                     ).then(() => void 0).catch(() => void 0);
-                    const captureDeadline = new Promise((resolve5) => {
+                    const captureDeadline = new Promise((resolve6) => {
                       captureTimeout = globalThis.setTimeout(() => {
                         captureController.abort(
                           new DOMException("Execution attempt capture timed out.", "TimeoutError")
                         );
-                        resolve5();
+                        resolve6();
                       }, remainingBudgetMs);
                     });
                     await Promise.race([captureRequest, captureDeadline]);
@@ -45635,7 +46939,7 @@ var init_vault = __esm({
       }
       return output3.buffer.slice(output3.byteOffset, output3.byteOffset + output3.byteLength);
     };
-    openVaultDb = async () => new Promise((resolve5, reject) => {
+    openVaultDb = async () => new Promise((resolve6, reject) => {
       const request = indexedDB.open(VAULT_DB_NAME, VAULT_DB_VERSION);
       request.onerror = () => reject(request.error ?? new Error("Failed to open client vault database."));
       request.onupgradeneeded = () => {
@@ -45644,7 +46948,7 @@ var init_vault = __esm({
           database.createObjectStore(VAULT_KEY_STORE);
         }
       };
-      request.onsuccess = () => resolve5(request.result);
+      request.onsuccess = () => resolve6(request.result);
     });
     withVaultStore = async (mode, fn) => {
       const database = await openVaultDb();
@@ -45652,8 +46956,8 @@ var init_vault = __esm({
         const transaction = database.transaction(VAULT_KEY_STORE, mode);
         const store = transaction.objectStore(VAULT_KEY_STORE);
         const result2 = await fn(store);
-        await new Promise((resolve5, reject) => {
-          transaction.oncomplete = () => resolve5();
+        await new Promise((resolve6, reject) => {
+          transaction.oncomplete = () => resolve6();
           transaction.onerror = () => reject(transaction.error ?? new Error("Client vault transaction failed."));
           transaction.onabort = () => reject(transaction.error ?? new Error("Client vault transaction aborted."));
         });
@@ -45668,9 +46972,9 @@ var init_vault = __esm({
       }
       return withVaultStore("readonly", async (store) => {
         const request = store.get(profileId);
-        return await new Promise((resolve5, reject) => {
+        return await new Promise((resolve6, reject) => {
           request.onerror = () => reject(request.error ?? new Error("Failed to read client vault key."));
-          request.onsuccess = () => resolve5(request.result ?? null);
+          request.onsuccess = () => resolve6(request.result ?? null);
         });
       });
     };
@@ -45692,9 +46996,9 @@ var init_vault = __esm({
       );
       await withVaultStore("readwrite", async (store) => {
         const request = store.put(createdKey, profileId);
-        await new Promise((resolve5, reject) => {
+        await new Promise((resolve6, reject) => {
           request.onerror = () => reject(request.error ?? new Error("Failed to persist client vault key."));
-          request.onsuccess = () => resolve5();
+          request.onsuccess = () => resolve6();
         });
       });
       return createdKey;
@@ -45705,9 +47009,9 @@ var init_vault = __esm({
       }
       await withVaultStore("readwrite", async (store) => {
         const request = store.delete(profileId);
-        await new Promise((resolve5, reject) => {
+        await new Promise((resolve6, reject) => {
           request.onerror = () => reject(request.error ?? new Error("Failed to remove client vault key."));
-          request.onsuccess = () => resolve5();
+          request.onsuccess = () => resolve6();
         });
       });
     };
@@ -46922,10 +48226,10 @@ var init_runtime_execution = __esm({
       }
     };
     sleep3 = async (ms, signal) => {
-      await new Promise((resolve5, reject) => {
+      await new Promise((resolve6, reject) => {
         const timer = setTimeout(() => {
           cleanup();
-          resolve5(void 0);
+          resolve6(void 0);
         }, ms);
         const cleanup = () => {
           clearTimeout(timer);
@@ -48563,7 +49867,7 @@ __export(vtx_exports, {
   runVtxCli: () => runVtxCli
 });
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn7 } from "node:child_process";
 function render2(value, json2) {
   if (json2) {
     return `${JSON.stringify(value, null, 2)}
@@ -48593,7 +49897,7 @@ function openBrowser(url2) {
   const platform = process.platform;
   const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url2] : [url2];
-  const child = spawn5(command, args, { detached: true, stdio: "ignore" });
+  const child = spawn7(command, args, { detached: true, stdio: "ignore" });
   child.unref();
 }
 function parseFlags(args) {
@@ -49123,7 +50427,7 @@ Global options:
       "alibaba_cloud_model_studio_api_key",
       "lightning_api_key"
     ]);
-    delay = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+    delay = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
   }
 });
 
@@ -49135,7 +50439,9 @@ var INFERENCE_HOST_VALUE_OPTIONS = /* @__PURE__ */ new Set([
   "--model",
   "--model-label",
   "--effort",
-  "--wait-seconds"
+  "--wait-seconds",
+  "--lines",
+  "--service-manifest"
 ]);
 var isInferenceHostCliInvocation = (argv2) => {
   for (let index = 0; index < argv2.length; index += 1) {