@vtxmacro/cli 2026.8.23 → 2026.8.24

package/bin/vtx.js

@@ -38,7 +38,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.8.23",
+      package_version: "2026.8.24",
       codex_package_name: "@openai/codex",
       codex_version: "0.147.0",
       platforms: {
@@ -16132,7 +16132,10 @@ function assertLocalState(value) {
   }
   return record2;
 }
-async function ensureInferencePrivateDirectory(path) {
+async function ensureInferencePrivateDirectory(path, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  const runner = dependencies.runner ?? runWindowsPrivateAcl;
+  const defaultRoot = dependencies.defaultRoot ?? resolve(homedir(), ".vtx", "inference-host");
   let created = false;
   try {
     const before = await lstat(path);
@@ -16148,9 +16151,18 @@ async function ensureInferencePrivateDirectory(path) {
   if (after.isSymbolicLink() || !after.isDirectory()) {
     throw new Error("Inference host state directory is unsafe.");
   }
-  if (process.platform === "win32") {
-    if (created) await secureWindowsPrivatePath(path, "directory", "harden");
-    else await secureExistingWindowsPath(path, "directory");
+  if (platform === "win32") {
+    if (created) {
+      await secureWindowsPrivatePath(path, "directory", "harden", platform, runner);
+    } else {
+      await secureExistingWindowsPath(
+        path,
+        "directory",
+        platform,
+        runner,
+        defaultRoot
+      );
+    }
     return;
   }
   if ((after.mode & 63) !== 0) {
@@ -16173,9 +16185,16 @@ async function syncInferenceDirectory(path, platform = process.platform) {
     await handle.close();
   }
 }
-async function writeAtomicInferencePrivateFile(path, contents) {
+async function writeAtomicInferencePrivateFile(path, contents, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  const runner = dependencies.runner ?? runWindowsPrivateAcl;
+  const defaultRoot = dependencies.defaultRoot ?? resolve(homedir(), ".vtx", "inference-host");
   const directory = dirname(path);
-  await ensureInferencePrivateDirectory(directory);
+  await ensureInferencePrivateDirectory(directory, dependencies);
+  const hardenedDirectoryIdentity = platform === "win32" && isDefaultWindowsPrivatePath(directory, defaultRoot) ? windowsAclCache.get(aclCacheKey(directory, "directory", "harden")) : void 0;
+  if (platform === "win32" && isDefaultWindowsPrivatePath(directory, defaultRoot) && !hardenedDirectoryIdentity) {
+    throw new Error("Windows private directory ACL hardening was not durably verified.");
+  }
   const temporary = join(
     directory,
     `.${process.pid}.${randomBytes(12).toString("hex")}.tmp`
@@ -16194,19 +16213,42 @@ async function writeAtomicInferencePrivateFile(path, contents) {
     throw error48;
   }
   await handle.close();
-  await secureWindowsPrivatePath(temporary, "file", "harden");
+  await secureWindowsPrivatePath(temporary, "file", "harden", platform, runner);
+  const hardenedIdentity = platform === "win32" ? windowsAclCache.get(aclCacheKey(temporary, "file", "harden")) : void 0;
+  if (platform === "win32" && !hardenedIdentity) {
+    await rm(temporary, { force: true }).catch(() => void 0);
+    throw new Error("Windows private ACL hardening was not durably verified.");
+  }
   try {
     invalidateWindowsAclCache(path);
     await rename(temporary, path);
-    invalidateWindowsAclCache(temporary);
-    await secureWindowsPrivatePath(path, "file", "verify");
-    await syncInferenceDirectory(directory);
+    if (platform === "win32" && hardenedIdentity) {
+      await rebindHardenedWindowsAclAfterRename(
+        temporary,
+        path,
+        "file",
+        hardenedIdentity
+      );
+    } else {
+      invalidateWindowsAclCache(temporary);
+    }
+    await syncInferenceDirectory(directory, platform);
+    if (platform === "win32" && hardenedDirectoryIdentity) {
+      await rebindHardenedWindowsDirectoryAfterOwnedMutation(
+        directory,
+        hardenedDirectoryIdentity
+      );
+    }
   } catch (error48) {
     await rm(temporary, { force: true }).catch(() => void 0);
+    invalidateWindowsAclCache(temporary);
     throw error48;
   }
 }
-async function readInferencePrivateFile(path, label) {
+async function readInferencePrivateFile(path, label, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  const runner = dependencies.runner ?? runWindowsPrivateAcl;
+  const defaultRoot = dependencies.defaultRoot ?? resolve(homedir(), ".vtx", "inference-host");
   let before;
   try {
     before = await lstat(path);
@@ -16217,15 +16259,21 @@ async function readInferencePrivateFile(path, label) {
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error(`${label} is unsafe.`);
   }
-  await secureExistingWindowsPath(dirname(path), "directory");
-  await secureExistingWindowsPath(path, "file");
+  await secureExistingWindowsPath(
+    dirname(path),
+    "directory",
+    platform,
+    runner,
+    defaultRoot
+  );
+  await secureExistingWindowsPath(path, "file", platform, runner, defaultRoot);
   const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
   try {
     const opened = await handle.stat();
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size > MAX_INFERENCE_PRIVATE_FILE_BYTES || typeof process.getuid === "function" && opened.uid !== process.getuid()) {
       throw new Error(`${label} changed while it was opened.`);
     }
-    if (process.platform !== "win32" && (opened.mode & 63) !== 0) {
+    if (platform !== "win32" && (opened.mode & 63) !== 0) {
       throw new Error(`${label} must have mode 0600.`);
     }
     return await handle.readFile("utf8");
@@ -16440,7 +16488,7 @@ async function acquireInferenceHostProcessLock(path, dependencies = {}) {
     }
   };
 }
-var INFERENCE_CREDENTIAL_NAMESPACE, MAX_INFERENCE_PRIVATE_FILE_BYTES, WINDOWS_PRIVATE_ACL_SCRIPT, windowsPrivateAclInvocation, runWindowsPrivateAcl, windowsAclCache, windowsAclIdentity, aclCacheKey, secureWindowsPrivatePath, invalidateWindowsAclCache, isDefaultWindowsPrivatePath, secureExistingWindowsPath, linuxProcessIdentity, windowsProcessIdentity, darwinProcessIdentity, runSmallIdentityCommand, cachedSystemBootIdentity, readInferenceSystemBootIdentity, defaultProcessIdentity, defaultCurrentProcessIdentity, processLockObservationCache, inferenceProcessIdentitiesMatch, credentialStoreIdentity;
+var INFERENCE_CREDENTIAL_NAMESPACE, MAX_INFERENCE_PRIVATE_FILE_BYTES, WINDOWS_PRIVATE_ACL_SCRIPT, windowsPrivateAclInvocation, runWindowsPrivateAcl, windowsAclCache, windowsAclIdentity, aclCacheKey, secureWindowsPrivatePath, invalidateWindowsAclCache, rebindHardenedWindowsAclAfterRename, rebindHardenedWindowsDirectoryAfterOwnedMutation, isDefaultWindowsPrivatePath, secureExistingWindowsPath, linuxProcessIdentity, windowsProcessIdentity, darwinProcessIdentity, runSmallIdentityCommand, cachedSystemBootIdentity, readInferenceSystemBootIdentity, defaultProcessIdentity, defaultCurrentProcessIdentity, processLockObservationCache, inferenceProcessIdentitiesMatch, credentialStoreIdentity;
 var init_config = __esm({
   "lib/inference-host/config.ts"() {
     "use strict";
@@ -16581,6 +16629,35 @@ if(-not $userFull) { throw 'private ACL does not grant the current user full con
         }
       }
     };
+    rebindHardenedWindowsAclAfterRename = async (source, destination, kind, expected) => {
+      const resolvedSource = resolve(source);
+      const resolvedDestination = resolve(destination);
+      if (resolvedSource === resolvedDestination || dirname(resolvedSource) !== dirname(resolvedDestination)) {
+        throw new Error("Windows private ACL cache rename boundary is invalid.");
+      }
+      const published = await windowsAclIdentity(destination);
+      if (published.dev !== expected.dev || published.ino !== expected.ino || published.mode !== expected.mode || published.mtimeNs !== expected.mtimeNs || published.size !== expected.size) {
+        invalidateWindowsAclCache(source);
+        invalidateWindowsAclCache(destination);
+        throw new Error("Windows private file identity changed during atomic publication.");
+      }
+      invalidateWindowsAclCache(source);
+      invalidateWindowsAclCache(destination);
+      for (const mode of ["harden", "verify", "verify-owner"]) {
+        windowsAclCache.set(aclCacheKey(destination, kind, mode), published);
+      }
+    };
+    rebindHardenedWindowsDirectoryAfterOwnedMutation = async (path, expected) => {
+      const current = await windowsAclIdentity(path);
+      if (current.dev !== expected.dev || current.ino !== expected.ino || current.mode !== expected.mode) {
+        invalidateWindowsAclCache(path);
+        throw new Error("Windows private directory identity changed during atomic publication.");
+      }
+      invalidateWindowsAclCache(path);
+      for (const mode of ["harden", "verify", "verify-owner"]) {
+        windowsAclCache.set(aclCacheKey(path, "directory", mode), current);
+      }
+    };
     isDefaultWindowsPrivatePath = (path, root = resolve(homedir(), ".vtx", "inference-host")) => {
       const child = relative(root, resolve(path));
       return child === "" || !child.startsWith("..") && !child.includes(":");
@@ -16591,8 +16668,6 @@ if(-not $userFull) { throw 'private ACL does not grant the current user full con
         await secureWindowsPrivatePath(path, kind, "verify", platform, runner);
         return;
       }
-      await secureWindowsPrivatePath(path, kind, "verify-owner", platform, runner);
-      invalidateWindowsAclCache(path);
       await secureWindowsPrivatePath(path, kind, "harden", platform, runner);
     };
     linuxProcessIdentity = async (pid) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.8.23",
+  "version": "2026.8.24",
   "description": "VTX Macro CLI, MCP server, and durable subscription inference host.",
   "type": "module",
   "license": "UNLICENSED",