@vtxmacro/cli 2026.8.22 → 2026.8.24

package/bin/vtx.js

@@ -38,7 +38,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.8.22",
+      package_version: "2026.8.24",
       codex_package_name: "@openai/codex",
       codex_version: "0.147.0",
       platforms: {
@@ -16132,7 +16132,10 @@ function assertLocalState(value) {
   }
   return record2;
 }
-async function ensureInferencePrivateDirectory(path) {
+async function ensureInferencePrivateDirectory(path, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  const runner = dependencies.runner ?? runWindowsPrivateAcl;
+  const defaultRoot = dependencies.defaultRoot ?? resolve(homedir(), ".vtx", "inference-host");
   let created = false;
   try {
     const before = await lstat(path);
@@ -16148,9 +16151,18 @@ async function ensureInferencePrivateDirectory(path) {
   if (after.isSymbolicLink() || !after.isDirectory()) {
     throw new Error("Inference host state directory is unsafe.");
   }
-  if (process.platform === "win32") {
-    if (created) await secureWindowsPrivatePath(path, "directory", "harden");
-    else await secureExistingWindowsPath(path, "directory");
+  if (platform === "win32") {
+    if (created) {
+      await secureWindowsPrivatePath(path, "directory", "harden", platform, runner);
+    } else {
+      await secureExistingWindowsPath(
+        path,
+        "directory",
+        platform,
+        runner,
+        defaultRoot
+      );
+    }
     return;
   }
   if ((after.mode & 63) !== 0) {
@@ -16173,9 +16185,16 @@ async function syncInferenceDirectory(path, platform = process.platform) {
     await handle.close();
   }
 }
-async function writeAtomicInferencePrivateFile(path, contents) {
+async function writeAtomicInferencePrivateFile(path, contents, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  const runner = dependencies.runner ?? runWindowsPrivateAcl;
+  const defaultRoot = dependencies.defaultRoot ?? resolve(homedir(), ".vtx", "inference-host");
   const directory = dirname(path);
-  await ensureInferencePrivateDirectory(directory);
+  await ensureInferencePrivateDirectory(directory, dependencies);
+  const hardenedDirectoryIdentity = platform === "win32" && isDefaultWindowsPrivatePath(directory, defaultRoot) ? windowsAclCache.get(aclCacheKey(directory, "directory", "harden")) : void 0;
+  if (platform === "win32" && isDefaultWindowsPrivatePath(directory, defaultRoot) && !hardenedDirectoryIdentity) {
+    throw new Error("Windows private directory ACL hardening was not durably verified.");
+  }
   const temporary = join(
     directory,
     `.${process.pid}.${randomBytes(12).toString("hex")}.tmp`
@@ -16194,19 +16213,42 @@ async function writeAtomicInferencePrivateFile(path, contents) {
     throw error48;
   }
   await handle.close();
-  await secureWindowsPrivatePath(temporary, "file", "harden");
+  await secureWindowsPrivatePath(temporary, "file", "harden", platform, runner);
+  const hardenedIdentity = platform === "win32" ? windowsAclCache.get(aclCacheKey(temporary, "file", "harden")) : void 0;
+  if (platform === "win32" && !hardenedIdentity) {
+    await rm(temporary, { force: true }).catch(() => void 0);
+    throw new Error("Windows private ACL hardening was not durably verified.");
+  }
   try {
     invalidateWindowsAclCache(path);
     await rename(temporary, path);
-    invalidateWindowsAclCache(temporary);
-    await secureWindowsPrivatePath(path, "file", "verify");
-    await syncInferenceDirectory(directory);
+    if (platform === "win32" && hardenedIdentity) {
+      await rebindHardenedWindowsAclAfterRename(
+        temporary,
+        path,
+        "file",
+        hardenedIdentity
+      );
+    } else {
+      invalidateWindowsAclCache(temporary);
+    }
+    await syncInferenceDirectory(directory, platform);
+    if (platform === "win32" && hardenedDirectoryIdentity) {
+      await rebindHardenedWindowsDirectoryAfterOwnedMutation(
+        directory,
+        hardenedDirectoryIdentity
+      );
+    }
   } catch (error48) {
     await rm(temporary, { force: true }).catch(() => void 0);
+    invalidateWindowsAclCache(temporary);
     throw error48;
   }
 }
-async function readInferencePrivateFile(path, label) {
+async function readInferencePrivateFile(path, label, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  const runner = dependencies.runner ?? runWindowsPrivateAcl;
+  const defaultRoot = dependencies.defaultRoot ?? resolve(homedir(), ".vtx", "inference-host");
   let before;
   try {
     before = await lstat(path);
@@ -16217,15 +16259,21 @@ async function readInferencePrivateFile(path, label) {
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error(`${label} is unsafe.`);
   }
-  await secureExistingWindowsPath(dirname(path), "directory");
-  await secureExistingWindowsPath(path, "file");
+  await secureExistingWindowsPath(
+    dirname(path),
+    "directory",
+    platform,
+    runner,
+    defaultRoot
+  );
+  await secureExistingWindowsPath(path, "file", platform, runner, defaultRoot);
   const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
   try {
     const opened = await handle.stat();
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size > MAX_INFERENCE_PRIVATE_FILE_BYTES || typeof process.getuid === "function" && opened.uid !== process.getuid()) {
       throw new Error(`${label} changed while it was opened.`);
     }
-    if (process.platform !== "win32" && (opened.mode & 63) !== 0) {
+    if (platform !== "win32" && (opened.mode & 63) !== 0) {
       throw new Error(`${label} must have mode 0600.`);
     }
     return await handle.readFile("utf8");
@@ -16440,7 +16488,7 @@ async function acquireInferenceHostProcessLock(path, dependencies = {}) {
     }
   };
 }
-var INFERENCE_CREDENTIAL_NAMESPACE, MAX_INFERENCE_PRIVATE_FILE_BYTES, WINDOWS_PRIVATE_ACL_SCRIPT, windowsPrivateAclInvocation, runWindowsPrivateAcl, windowsAclCache, windowsAclIdentity, aclCacheKey, secureWindowsPrivatePath, invalidateWindowsAclCache, isDefaultWindowsPrivatePath, secureExistingWindowsPath, linuxProcessIdentity, windowsProcessIdentity, darwinProcessIdentity, runSmallIdentityCommand, cachedSystemBootIdentity, readInferenceSystemBootIdentity, defaultProcessIdentity, defaultCurrentProcessIdentity, processLockObservationCache, inferenceProcessIdentitiesMatch, credentialStoreIdentity;
+var INFERENCE_CREDENTIAL_NAMESPACE, MAX_INFERENCE_PRIVATE_FILE_BYTES, WINDOWS_PRIVATE_ACL_SCRIPT, windowsPrivateAclInvocation, runWindowsPrivateAcl, windowsAclCache, windowsAclIdentity, aclCacheKey, secureWindowsPrivatePath, invalidateWindowsAclCache, rebindHardenedWindowsAclAfterRename, rebindHardenedWindowsDirectoryAfterOwnedMutation, isDefaultWindowsPrivatePath, secureExistingWindowsPath, linuxProcessIdentity, windowsProcessIdentity, darwinProcessIdentity, runSmallIdentityCommand, cachedSystemBootIdentity, readInferenceSystemBootIdentity, defaultProcessIdentity, defaultCurrentProcessIdentity, processLockObservationCache, inferenceProcessIdentitiesMatch, credentialStoreIdentity;
 var init_config = __esm({
   "lib/inference-host/config.ts"() {
     "use strict";
@@ -16581,6 +16629,35 @@ if(-not $userFull) { throw 'private ACL does not grant the current user full con
         }
       }
     };
+    rebindHardenedWindowsAclAfterRename = async (source, destination, kind, expected) => {
+      const resolvedSource = resolve(source);
+      const resolvedDestination = resolve(destination);
+      if (resolvedSource === resolvedDestination || dirname(resolvedSource) !== dirname(resolvedDestination)) {
+        throw new Error("Windows private ACL cache rename boundary is invalid.");
+      }
+      const published = await windowsAclIdentity(destination);
+      if (published.dev !== expected.dev || published.ino !== expected.ino || published.mode !== expected.mode || published.mtimeNs !== expected.mtimeNs || published.size !== expected.size) {
+        invalidateWindowsAclCache(source);
+        invalidateWindowsAclCache(destination);
+        throw new Error("Windows private file identity changed during atomic publication.");
+      }
+      invalidateWindowsAclCache(source);
+      invalidateWindowsAclCache(destination);
+      for (const mode of ["harden", "verify", "verify-owner"]) {
+        windowsAclCache.set(aclCacheKey(destination, kind, mode), published);
+      }
+    };
+    rebindHardenedWindowsDirectoryAfterOwnedMutation = async (path, expected) => {
+      const current = await windowsAclIdentity(path);
+      if (current.dev !== expected.dev || current.ino !== expected.ino || current.mode !== expected.mode) {
+        invalidateWindowsAclCache(path);
+        throw new Error("Windows private directory identity changed during atomic publication.");
+      }
+      invalidateWindowsAclCache(path);
+      for (const mode of ["harden", "verify", "verify-owner"]) {
+        windowsAclCache.set(aclCacheKey(path, "directory", mode), current);
+      }
+    };
     isDefaultWindowsPrivatePath = (path, root = resolve(homedir(), ".vtx", "inference-host")) => {
       const child = relative(root, resolve(path));
       return child === "" || !child.startsWith("..") && !child.includes(":");
@@ -16591,8 +16668,6 @@ if(-not $userFull) { throw 'private ACL does not grant the current user full con
         await secureWindowsPrivatePath(path, kind, "verify", platform, runner);
         return;
       }
-      await secureWindowsPrivatePath(path, kind, "verify-owner", platform, runner);
-      invalidateWindowsAclCache(path);
       await secureWindowsPrivatePath(path, kind, "harden", platform, runner);
     };
     linuxProcessIdentity = async (pid) => {
@@ -20047,11 +20122,27 @@ child.once('close', async () => {
           });
         }
       }
-      async requireModel(modelName, reasoningEffort, deadlineAtMs, signal) {
+      async readModelCapabilities(deadlineAtMs, signal) {
         let cursor = null;
         const seen = /* @__PURE__ */ new Set();
-        let match = null;
+        const capabilities = [];
         do {
+          if (signal?.aborted) {
+            throw new CodexAppServerError({
+              message: "Codex model catalog request was cancelled before dispatch.",
+              category: "cancelled",
+              code: "cancelled",
+              retryable: false
+            });
+          }
+          if (Date.now() >= deadlineAtMs) {
+            throw new CodexAppServerError({
+              message: "Codex model catalog request exceeded the immutable deadline before dispatch.",
+              category: "timeout",
+              code: "deadline_exceeded",
+              retryable: false
+            });
+          }
           const result2 = await this.request("model/list", {
             includeHidden: true,
             ...cursor ? { cursor } : {}
@@ -20062,7 +20153,19 @@ child.once('close', async () => {
           const data = Array.isArray(result2.data) ? result2.data : [];
           for (const raw of data) {
             const candidate = objectOrNull(raw);
-            if (candidate && (candidate.model === modelName || candidate.id === modelName)) match = candidate;
+            if (!candidate) continue;
+            const id2 = typeof candidate.id === "string" && candidate.id.trim() ? candidate.id.trim() : null;
+            const model = typeof candidate.model === "string" && candidate.model.trim() ? candidate.model.trim() : null;
+            if (!id2 && !model) continue;
+            const supportedReasoningEfforts = Array.isArray(candidate.supportedReasoningEfforts) ? candidate.supportedReasoningEfforts.flatMap((item) => {
+              const reasoningEffort = objectOrNull(item)?.reasoningEffort;
+              return typeof reasoningEffort === "string" && reasoningEffort.trim() ? [reasoningEffort.trim()] : [];
+            }) : [];
+            capabilities.push(Object.freeze({
+              id: id2,
+              model,
+              supportedReasoningEfforts: Object.freeze(supportedReasoningEfforts)
+            }));
           }
           cursor = typeof result2.nextCursor === "string" && result2.nextCursor ? result2.nextCursor : null;
           if (cursor && seen.has(cursor)) {
@@ -20075,6 +20178,10 @@ child.once('close', async () => {
           }
           if (cursor) seen.add(cursor);
         } while (cursor);
+        return Object.freeze(capabilities);
+      }
+      requireModelCapability(capabilities, modelName, reasoningEffort) {
+        const match = capabilities.find((candidate) => candidate.model === modelName || candidate.id === modelName);
         if (!match) {
           throw new CodexAppServerError({
             message: "The requested Codex model is unavailable.",
@@ -20083,8 +20190,7 @@ child.once('close', async () => {
             retryable: false
           });
         }
-        const efforts = Array.isArray(match.supportedReasoningEfforts) ? match.supportedReasoningEfforts.map((item) => objectOrNull(item)?.reasoningEffort) : [];
-        if (!efforts.includes(reasoningEffort)) {
+        if (!match.supportedReasoningEfforts.includes(reasoningEffort)) {
           throw new CodexAppServerError({
             message: "The requested Codex reasoning effort is unavailable.",
             category: "model",
@@ -20093,7 +20199,30 @@ child.once('close', async () => {
           });
         }
       }
+      async requireModel(modelName, reasoningEffort, deadlineAtMs, signal) {
+        this.requireModelCapability(
+          await this.readModelCapabilities(deadlineAtMs, signal),
+          modelName,
+          reasoningEffort
+        );
+      }
       async startThread(options) {
+        if (options.signal?.aborted) {
+          throw new CodexAppServerError({
+            message: "Codex thread request was cancelled before dispatch.",
+            category: "cancelled",
+            code: "cancelled",
+            retryable: false
+          });
+        }
+        if (Date.now() >= options.deadlineAtMs) {
+          throw new CodexAppServerError({
+            message: "Codex thread request exceeded the immutable deadline before dispatch.",
+            category: "timeout",
+            code: "deadline_exceeded",
+            retryable: false
+          });
+        }
         const result2 = await this.request("thread/start", {
           model: options.requestedModel,
           modelProvider: "openai",
@@ -20823,7 +20952,7 @@ import {
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
 import { isAbsolute as isAbsolute2, join as join4, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
-var INITIAL_CODEX_INFERENCE_MODEL, SUPPORTED_CODEX_REASONING_EFFORTS, MAX_PROMPT_BYTES2, tokenUsageReceiptSchema, turnResultReceiptSchema, terminalReceiptSchema, recoveryCheckpointSchema, recoveryFileSchema, FileCodexAttemptRecoveryStore, utf8Bytes, tomlString, permissionConfig, ensureDedicatedCodexHome, createIsolatedCodexAttemptResources, createIsolatedCodexHostResources, validateAttemptInput, isStrictDescendant, assertRecoveryResourceScope, removeRecoveredThread, confirmGuardianTerminatedForRecovery, reconcileCodexAttemptRecovery, CodexSubscriptionAdapter;
+var INITIAL_CODEX_INFERENCE_MODEL, SUPPORTED_CODEX_REASONING_EFFORTS, MAX_PROMPT_BYTES2, tokenUsageReceiptSchema, turnResultReceiptSchema, terminalReceiptSchema, recoveryCheckpointSchema, recoveryFileSchema, FileCodexAttemptRecoveryStore, utf8Bytes, assertAttemptActive, tomlString, permissionConfig, ensureDedicatedCodexHome, createIsolatedCodexAttemptResources, createIsolatedCodexHostResources, validateAttemptInput, isStrictDescendant, assertRecoveryResourceScope, removeRecoveredThread, confirmGuardianTerminatedForRecovery, reconcileCodexAttemptRecovery, CodexSubscriptionAdapter;
 var init_codex_adapter = __esm({
   "lib/inference-host/codex-adapter.ts"() {
     "use strict";
@@ -20971,6 +21100,24 @@ var init_codex_adapter = __esm({
       }
     };
     utf8Bytes = (value) => Buffer.byteLength(value, "utf8");
+    assertAttemptActive = (deadlineAtMs, signal) => {
+      if (signal?.aborted) {
+        throw new CodexAppServerError({
+          message: "Codex attempt was cancelled before dispatch.",
+          category: "cancelled",
+          code: "cancelled",
+          retryable: false
+        });
+      }
+      if (Date.now() >= deadlineAtMs) {
+        throw new CodexAppServerError({
+          message: "Codex attempt exceeded the immutable deadline before dispatch.",
+          category: "timeout",
+          code: "deadline_exceeded",
+          retryable: false
+        });
+      }
+    };
     tomlString = (value) => JSON.stringify(value);
     permissionConfig = (codexHome) => [
       'forced_login_method = "chatgpt"',
@@ -21335,6 +21482,7 @@ var init_codex_adapter = __esm({
         return {
           session,
           codexHome,
+          capabilityPreflight: null,
           processToken,
           processReceiptPath,
           bootIdentity,
@@ -21417,6 +21565,65 @@ var init_codex_adapter = __esm({
         }
         await session.closePromise;
       }
+      async requireDurableSessionCapability(durableSession, modelName, reasoningEffort, deadlineAtMs, signal) {
+        assertAttemptActive(deadlineAtMs, signal);
+        if (!durableSession.capabilityPreflight) {
+          durableSession.capabilityPreflight = (async () => {
+            try {
+              await durableSession.session.requireManagedChatGptAuth(deadlineAtMs, signal);
+              assertAttemptActive(deadlineAtMs, signal);
+              return await durableSession.session.readModelCapabilities(deadlineAtMs, signal);
+            } catch (error48) {
+              try {
+                await this.invalidateDurableSession(durableSession);
+              } catch (invalidationError) {
+                throw new CodexAppServerError({
+                  message: "Codex capability preflight failed and session shutdown was not confirmed.",
+                  category: "adapter",
+                  code: "capability_preflight_invalidation_unconfirmed",
+                  retryable: false,
+                  cause: new AggregateError([error48, invalidationError])
+                });
+              }
+              throw error48;
+            }
+          })();
+        }
+        const preflight = durableSession.capabilityPreflight;
+        const capabilities = await new Promise((resolve6, reject) => {
+          let settled = false;
+          const finish = (callback) => {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            callback();
+          };
+          const onAbort = () => finish(() => reject(new CodexAppServerError({
+            message: "Codex capability preflight wait was cancelled.",
+            category: "cancelled",
+            code: "cancelled",
+            retryable: false
+          })));
+          const timer = setTimeout(() => finish(() => reject(new CodexAppServerError({
+            message: "Codex capability preflight wait exceeded the immutable deadline.",
+            category: "timeout",
+            code: "deadline_exceeded",
+            retryable: false
+          }))), Math.max(1, deadlineAtMs - Date.now()));
+          signal?.addEventListener("abort", onAbort, { once: true });
+          if (signal?.aborted) {
+            onAbort();
+            return;
+          }
+          void preflight.then(
+            (value) => finish(() => resolve6(value)),
+            (error48) => finish(() => reject(error48))
+          );
+        });
+        assertAttemptActive(deadlineAtMs, signal);
+        durableSession.session.requireModelCapability(capabilities, modelName, reasoningEffort);
+      }
       runAttempt(input) {
         const active = this.inFlightAttempts.get(input.attemptId);
         if (active) {
@@ -21647,13 +21854,14 @@ var init_codex_adapter = __esm({
           };
           latestCheckpoint = baseCheckpoint;
           await recoveryHooks?.save(baseCheckpoint);
-          await session.requireManagedChatGptAuth(input.deadlineAtMs, input.signal);
-          await session.requireModel(
+          await this.requireDurableSessionCapability(
+            sessionLease,
             input.requestedModel,
             input.requestedReasoningEffort,
             input.deadlineAtMs,
             input.signal
           );
+          assertAttemptActive(input.deadlineAtMs, input.signal);
           const thread = await session.startThread({
             workspacePath: resources.workspacePath,
             systemPrompt: input.systemPrompt,
@@ -21708,6 +21916,7 @@ var init_codex_adapter = __esm({
             "rpc_rejected",
             "invalid_rpc_result",
             "rpc_timeout",
+            "capability_preflight_invalidation_unconfirmed",
             "invalid_thread_provenance",
             "thread_cleanup_identity_missing",
             "thread_delete_unconfirmed"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.8.22",
+  "version": "2026.8.24",
   "description": "VTX Macro CLI, MCP server, and durable subscription inference host.",
   "type": "module",
   "license": "UNLICENSED",