@vtxmacro/cli 2026.8.30 → 2026.8.31

package/README.md

@@ -71,6 +71,22 @@ vtx inference-host codex-logout
 vtx inference-host revoke
 ```
 
+To connect another Codex subscription to the same VTX account, repeat the
+login and service-install commands with a stable local name such as
+`--instance codex-2`. Each named instance has an isolated VTX grant, Codex
+home, credential file, runtime state, recovery state, and worker; one per-user
+OS supervisor runs all installed instances. Use `service status --json` to
+inspect the installed workers. The installer rejects duplicate authenticated
+ChatGPT emails and fails closed when it cannot prove multiple subscriptions are
+distinct. Use `service uninstall --instance <name>` to remove one worker;
+unqualified `service uninstall` removes the whole supervisor. The legacy
+unqualified host commands continue to target `default`.
+
+Automated hosts use three concurrent slots per subscription by default. Set a
+bounded value from 1 through 8 with `--max-concurrency`. Slots share the live
+subscription rate-limit gate and cooldown; this does not guarantee capacity
+beyond the authenticated account's current entitlement.
+
 This durable host uses a separate least-privilege `insights:inference`
 OAuth grant. It also keeps its ChatGPT subscription login in a dedicated private
 Codex home. Neither credential is copied from or widens the ordinary CLI or Codex

package/bin/vtx.js

@@ -38,7 +38,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.8.30",
+      package_version: "2026.8.31",
       codex_package_name: "@openai/codex",
       codex_version: "0.147.0",
       platforms: {
@@ -16084,13 +16084,26 @@ import { spawn } from "node:child_process";
 import { constants } from "node:fs";
 import { lstat, mkdir, open, readFile, realpath, rename, rm } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 function inferenceBaseDir(env) {
   const configured = String(env.VTX_INFERENCE_HOST_HOME || "").trim();
   return configured || join(homedir(), ".vtx", "inference-host");
 }
+function normalizeInferenceHostInstanceName(raw) {
+  const value = raw.trim().toLowerCase();
+  if (!SAFE_INFERENCE_HOST_INSTANCE.test(value)) {
+    throw new Error(
+      "Inference host instance must be 1-48 lowercase letters, numbers, or hyphens, and cannot start or end with a hyphen."
+    );
+  }
+  return value;
+}
 function resolveInferenceHostConfig(env = process.env) {
   const baseDir = inferenceBaseDir(env);
+  const instanceName = normalizeInferenceHostInstanceName(
+    String(env.VTX_INFERENCE_HOST_INSTANCE || DEFAULT_INFERENCE_HOST_INSTANCE)
+  );
+  const instanceDir = instanceName === DEFAULT_INFERENCE_HOST_INSTANCE ? baseDir : join(baseDir, "instances", instanceName);
   const rawMode = String(env.VTX_INFERENCE_HOST_CREDENTIAL_STORE || "os").trim().toLowerCase();
   if (rawMode !== "os" && rawMode !== "file") {
     throw new Error("VTX_INFERENCE_HOST_CREDENTIAL_STORE must be os or file.");
@@ -16103,15 +16116,36 @@ function resolveInferenceHostConfig(env = process.env) {
       "VTX_INFERENCE_HOST_CREDENTIAL_FILE requires explicit file credential-store mode."
     );
   }
-  const credentialFilePath = rawMode === "file" ? explicitCredentialPath || join(baseDir, "credentials.json") : null;
+  const credentialFilePath = rawMode === "file" ? requireNamedInstancePath(
+    instanceName,
+    instanceDir,
+    explicitCredentialPath,
+    "VTX_INFERENCE_HOST_CREDENTIAL_FILE"
+  ) || join(instanceDir, "credentials.json") : null;
+  const explicitStatePath = requireNamedInstancePath(
+    instanceName,
+    instanceDir,
+    String(env.VTX_INFERENCE_HOST_STATE_PATH || "").trim(),
+    "VTX_INFERENCE_HOST_STATE_PATH"
+  );
+  const explicitLockPath = requireNamedInstancePath(
+    instanceName,
+    instanceDir,
+    String(env.VTX_INFERENCE_HOST_LOCK_PATH || "").trim(),
+    "VTX_INFERENCE_HOST_LOCK_PATH"
+  );
   return {
     apiUrl: String(env.VTX_API_URL || "https://api.vtxmacro.com").replace(/\/+$/, ""),
+    baseDir,
+    instanceName,
     credentialStoreMode: rawMode,
     credentialFilePath,
     credentialStoreIdentity: credentialStoreIdentity(rawMode, credentialFilePath, env),
-    codexHomePath: join(baseDir, "codex-home"),
-    statePath: String(env.VTX_INFERENCE_HOST_STATE_PATH || "").trim() || join(baseDir, "state.json"),
-    processLockPath: String(env.VTX_INFERENCE_HOST_LOCK_PATH || "").trim() || join(baseDir, "host.lock")
+    codexHomePath: join(instanceDir, "codex-home"),
+    statePath: explicitStatePath || join(instanceDir, "state.json"),
+    processLockPath: explicitLockPath || join(instanceDir, "host.lock"),
+    supervisorStatePath: join(baseDir, "state.json"),
+    supervisorProcessLockPath: join(baseDir, "host.lock")
   };
 }
 function assertLocalState(value) {
@@ -16488,12 +16522,14 @@ async function acquireInferenceHostProcessLock(path, dependencies = {}) {
     }
   };
 }
-var INFERENCE_CREDENTIAL_NAMESPACE, MAX_INFERENCE_PRIVATE_FILE_BYTES, WINDOWS_PRIVATE_ACL_SCRIPT, windowsPrivateAclInvocation, runWindowsPrivateAcl, windowsAclCache, windowsAclIdentity, aclCacheKey, secureWindowsPrivatePath, invalidateWindowsAclCache, rebindHardenedWindowsAclAfterRename, rebindHardenedWindowsDirectoryAfterOwnedMutation, isDefaultWindowsPrivatePath, secureExistingWindowsPath, linuxProcessIdentity, windowsProcessIdentity, darwinProcessIdentity, runSmallIdentityCommand, cachedSystemBootIdentity, readInferenceSystemBootIdentity, defaultProcessIdentity, defaultCurrentProcessIdentity, processLockObservationCache, inferenceProcessIdentitiesMatch, credentialStoreIdentity;
+var INFERENCE_CREDENTIAL_NAMESPACE, MAX_INFERENCE_PRIVATE_FILE_BYTES, DEFAULT_CODEX_HOST_CONCURRENCY, MAX_CODEX_HOST_CONCURRENCY, WINDOWS_PRIVATE_ACL_SCRIPT, windowsPrivateAclInvocation, runWindowsPrivateAcl, windowsAclCache, windowsAclIdentity, aclCacheKey, secureWindowsPrivatePath, invalidateWindowsAclCache, rebindHardenedWindowsAclAfterRename, rebindHardenedWindowsDirectoryAfterOwnedMutation, isDefaultWindowsPrivatePath, secureExistingWindowsPath, linuxProcessIdentity, windowsProcessIdentity, darwinProcessIdentity, runSmallIdentityCommand, cachedSystemBootIdentity, readInferenceSystemBootIdentity, defaultProcessIdentity, defaultCurrentProcessIdentity, processLockObservationCache, inferenceProcessIdentitiesMatch, DEFAULT_INFERENCE_HOST_INSTANCE, SAFE_INFERENCE_HOST_INSTANCE, requireNamedInstancePath, credentialStoreIdentity;
 var init_config = __esm({
   "lib/inference-host/config.ts"() {
     "use strict";
     INFERENCE_CREDENTIAL_NAMESPACE = "vtxmacro-insights-inference";
     MAX_INFERENCE_PRIVATE_FILE_BYTES = 16 * 1024 * 1024;
+    DEFAULT_CODEX_HOST_CONCURRENCY = 3;
+    MAX_CODEX_HOST_CONCURRENCY = 8;
     WINDOWS_PRIVATE_ACL_SCRIPT = `$ErrorActionPreference='Stop'
 $path=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:VTX_PRIVATE_PATH_B64))
 $kind=$env:VTX_PRIVATE_PATH_KIND
@@ -16845,6 +16881,16 @@ if(-not $userFull) { throw 'private ACL does not grant the current user full con
     };
     processLockObservationCache = /* @__PURE__ */ new Map();
     inferenceProcessIdentitiesMatch = (stored, observed) => stored === observed;
+    DEFAULT_INFERENCE_HOST_INSTANCE = "default";
+    SAFE_INFERENCE_HOST_INSTANCE = /^[a-z0-9](?:[a-z0-9-]{0,46}[a-z0-9])?$/u;
+    requireNamedInstancePath = (instanceName, instanceDir, rawPath, label) => {
+      if (!rawPath || instanceName === DEFAULT_INFERENCE_HOST_INSTANCE) return rawPath;
+      const relativePath = relative(resolve(instanceDir), resolve(rawPath));
+      if (relativePath === ".." || relativePath.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(relativePath)) {
+        throw new Error(`${label} for a named instance must stay inside its isolated instance directory.`);
+      }
+      return rawPath;
+    };
     credentialStoreIdentity = (mode, filePath, env) => {
       if (mode === "file") {
         if (!filePath) throw new Error("Inference credential fallback path is unavailable.");
@@ -19029,7 +19075,7 @@ var init_agent_state = __esm({
 import { spawn as spawn3 } from "node:child_process";
 import { chmod, lstat as lstat2, open as open2, readFile as readFile2, rename as rename2, rm as rm2, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname as dirname2, isAbsolute, join as join2, resolve as resolve2, sep } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, resolve as resolve2, sep } from "node:path";
 import { createInterface } from "node:readline";
 async function loginCodexSubscription(options) {
   const session = await CodexAppServerSession.start(options);
@@ -19726,7 +19772,10 @@ child.once('close', async () => {
               title: "VTX External Inference Host",
               version: "external_inference.v1"
             },
-            capabilities: { experimentalApi: true }
+            capabilities: {
+              experimentalApi: true,
+              optOutNotificationMethods: ["thread/started"]
+            }
           }, {
             timeoutMs: Math.max(1, options.deadlineAtMs - Date.now()),
             signal: options.signal
@@ -20297,7 +20346,7 @@ child.once('close', async () => {
         const resolvedHome = resolve2(this.codexHome);
         const resolvedThreadPath = resolve2(threadPath);
         const resolvedSessionsRoot = join2(resolvedHome, "sessions");
-        if (!threadId || !threadPath || !isAbsolute(threadPath) || !resolvedThreadPath.startsWith(`${resolvedSessionsRoot}${sep}`) || !resolvedThreadPath.endsWith(".jsonl") || thread?.ephemeral !== false || thread?.modelProvider !== "openai" || !Array.isArray(thread?.turns) || thread.turns.length !== 0 || result2.model !== options.requestedModel || result2.modelProvider !== "openai" || result2.serviceTier !== "default" || result2.reasoningEffort !== options.requestedReasoningEffort || String(result2.cwd || "") !== options.workspacePath || !Array.isArray(result2.runtimeWorkspaceRoots) || result2.runtimeWorkspaceRoots.length !== 0 || !Array.isArray(result2.instructionSources) || result2.instructionSources.length !== 0 || result2.approvalPolicy !== "never" || result2.approvalsReviewer !== "user" || sandbox?.type !== "readOnly" || sandbox.networkAccess !== false || permission?.id !== CODEX_INFERENCE_PERMISSION_PROFILE || permission.extends !== null) {
+        if (!threadId || !threadPath || !isAbsolute2(threadPath) || !resolvedThreadPath.startsWith(`${resolvedSessionsRoot}${sep}`) || !resolvedThreadPath.endsWith(".jsonl") || thread?.ephemeral !== false || thread?.modelProvider !== "openai" || !Array.isArray(thread?.turns) || thread.turns.length !== 0 || result2.model !== options.requestedModel || result2.modelProvider !== "openai" || result2.serviceTier !== "default" || result2.reasoningEffort !== options.requestedReasoningEffort || String(result2.cwd || "") !== options.workspacePath || !Array.isArray(result2.runtimeWorkspaceRoots) || result2.runtimeWorkspaceRoots.length !== 0 || !Array.isArray(result2.instructionSources) || result2.instructionSources.length !== 0 || result2.approvalPolicy !== "never" || result2.approvalsReviewer !== "user" || sandbox?.type !== "readOnly" || sandbox.networkAccess !== false || permission?.id !== CODEX_INFERENCE_PERMISSION_PROFILE || permission.extends !== null) {
           throw new CodexAppServerError({
             message: "Codex thread isolation or effective settings were invalid.",
             category: "adapter",
@@ -20353,6 +20402,19 @@ child.once('close', async () => {
         });
         const startedAt = Date.now();
         const unsubscribe = this.subscribe(({ method, params }) => {
+          if (method === "thread/started") {
+            const startedThread = objectOrNull(params.thread);
+            if (!String(startedThread?.id || "")) {
+              terminalReject(new CodexAppServerError({
+                message: "Codex returned an invalid thread lifecycle notification.",
+                category: "adapter",
+                code: "invalid_thread_started_notification",
+                retryable: false,
+                dispatchOutcome: requestWritten ? turnId ? "confirmed_dispatched" : "outcome_unknown" : "not_dispatched"
+              }));
+            }
+            return;
+          }
           const eventThreadId = String(params.threadId || "");
           const scopedMethod = method.startsWith("thread/") || method.startsWith("turn/") || method.startsWith("item/") || method.startsWith("rawResponse") || method === "model/rerouted";
           if (scopedMethod && !eventThreadId) {
@@ -20992,7 +21054,7 @@ import {
 } from "node:fs/promises";
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { isAbsolute as isAbsolute2, join as join4, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join4, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var MAX_PROMPT_BYTES2, CODEX_MODEL_NAME_PATTERN, CODEX_REASONING_EFFORT_PATTERN, tokenUsageReceiptSchema, turnResultReceiptSchema, terminalReceiptSchema, recoveryCheckpointSchema, recoveryFileSchema, FileCodexAttemptRecoveryStore, utf8Bytes, assertAttemptActive, tomlString, permissionConfig, ensureDedicatedCodexHome, createIsolatedCodexAttemptResources, createIsolatedCodexHostResources, validateAttemptInput, isStrictDescendant, assertRecoveryResourceScope, removeRecoveredThread, confirmGuardianTerminatedForRecovery, reconcileCodexAttemptRecovery, CodexSubscriptionAdapter;
 var init_codex_adapter = __esm({
   "lib/inference-host/codex-adapter.ts"() {
@@ -21323,7 +21385,7 @@ var init_codex_adapter = __esm({
       const parentPath = resolve3(parent);
       const candidatePath = resolve3(candidate);
       const scoped = relative2(parentPath, candidatePath);
-      return scoped.length > 0 && !scoped.startsWith(`..${sep2}`) && scoped !== ".." && !isAbsolute2(scoped);
+      return scoped.length > 0 && !scoped.startsWith(`..${sep2}`) && scoped !== ".." && !isAbsolute3(scoped);
     };
     assertRecoveryResourceScope = (checkpoint) => {
       const temporaryRoot = resolve3(tmpdir2());
@@ -21413,7 +21475,7 @@ var init_codex_adapter = __esm({
         }
       }
       if (checkpoint.threadPath !== null) {
-        if (!isAbsolute2(checkpoint.threadPath) || !isStrictDescendant(
+        if (!isAbsolute3(checkpoint.threadPath) || !isStrictDescendant(
           checkpoint.threadPath,
           sessionsRoot
         ) || !checkpoint.threadPath.endsWith(".jsonl")) {
@@ -28992,11 +29054,20 @@ var init_runner = __esm({
           options.codexModelCapabilities,
           options.adapterRuntimeVersion
         ),
-        maxConcurrency: finitePositiveOption(
-          options.maxConcurrency,
-          DEFAULT_MAX_CONCURRENCY,
-          "Maximum concurrency"
-        ),
+        maxConcurrency: (() => {
+          const value = finitePositiveOption(
+            options.maxConcurrency,
+            DEFAULT_MAX_CONCURRENCY,
+            "Maximum concurrency"
+          );
+          if (value > MAX_CODEX_HOST_CONCURRENCY) {
+            throw new InferenceHostRunnerError(
+              "invalid_configuration",
+              `Maximum concurrency must not exceed ${MAX_CODEX_HOST_CONCURRENCY}.`
+            );
+          }
+          return value;
+        })(),
         advertisementTtlMs,
         advertisementRefreshLeadMs,
         hostHeartbeatMs: finitePositiveOption(
@@ -30335,7 +30406,7 @@ import { createWriteStream, readFileSync } from "node:fs";
 import { access as access3, chmod as chmod3, mkdir as mkdir3, readFile as readFile5, rm as rm4, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
-var SERVICE_NAME, SYSTEMD_UNIT, LAUNCHD_LABEL, SERVICE_COOPERATIVE_STOP_SECONDS, isWindowsSubsystemForLinux, inferenceHostServiceManifestPath, inferenceHostServiceDesiredPath, inferenceHostServiceLogPath, xmlEscape, plistEscape, systemdQuote, defaultRunCommand, managerName, assertManifest, assertDesiredState, readInferenceHostServiceManifest, readInferenceHostServiceDesired, readDesiredAcrossAtomicReplacement, writeDesired, runtimeEnvironment, serviceArguments, windowsOwnedCommandLine, vbScriptString, windowsServiceLauncher, windowsTaskXml, systemdUnit, launchAgentPlist, InferenceHostServiceManager, appendServiceLog, spawnServiceChild, runInferenceHostServiceSupervisor;
+var SERVICE_NAME, SYSTEMD_UNIT, LAUNCHD_LABEL, SERVICE_COOPERATIVE_STOP_SECONDS, isWindowsSubsystemForLinux, inferenceHostServiceManifestPath, inferenceHostServiceDesiredPath, inferenceHostServiceLogPath, xmlEscape, plistEscape, systemdQuote, defaultRunCommand, managerName, assertRuntimeEnvironment, assertServicePath, assertWorker, assertManifest, assertDesiredState, readInferenceHostServiceManifest, readInferenceHostServiceDesired, readDesiredAcrossAtomicReplacement, writeDesired, runtimeEnvironment, serviceArguments, windowsOwnedCommandLine, vbScriptString, windowsServiceLauncher, windowsTaskXml, systemdUnit, launchAgentPlist, InferenceHostServiceManager, appendServiceLog, spawnServiceChild, runInferenceHostServiceSupervisor;
 var init_service = __esm({
   "lib/inference-host/service.ts"() {
     "use strict";
@@ -30353,9 +30424,9 @@ var init_service = __esm({
         }
       })())
     );
-    inferenceHostServiceManifestPath = (config2) => `${config2.statePath}.service.json`;
-    inferenceHostServiceDesiredPath = (config2) => `${config2.statePath}.service-desired.json`;
-    inferenceHostServiceLogPath = (config2) => `${config2.statePath}.service.log`;
+    inferenceHostServiceManifestPath = (config2) => `${config2.supervisorStatePath}.service.json`;
+    inferenceHostServiceDesiredPath = (config2) => `${config2.supervisorStatePath}.service-desired.json`;
+    inferenceHostServiceLogPath = (config2) => `${config2.supervisorStatePath}.service.log`;
     xmlEscape = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
     plistEscape = xmlEscape;
     systemdQuote = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%")}"`;
@@ -30385,29 +30456,79 @@ var init_service = __esm({
       if (platform === "linux") return "systemd-user";
       throw new Error(`Inference-host background service is unsupported on ${platform}.`);
     };
+    assertRuntimeEnvironment = (value) => {
+      if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Inference-host service runtime environment is invalid.");
+      }
+      for (const [key, entry] of Object.entries(value)) {
+        if (!key.startsWith("VTX_") || typeof entry !== "string") {
+          throw new Error("Inference-host service runtime environment is invalid.");
+        }
+      }
+      return value;
+    };
+    assertServicePath = (value) => {
+      if (typeof value !== "string" || !value || /[\r\n\0]/u.test(value)) {
+        throw new Error("Inference-host service manifest paths contain control characters.");
+      }
+      return value;
+    };
+    assertWorker = (value) => {
+      if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Inference-host service worker is invalid.");
+      }
+      const record2 = value;
+      if (typeof record2.instance_name !== "string" || !/^[a-z0-9](?:[a-z0-9-]{0,46}[a-z0-9])?$/u.test(record2.instance_name) || record2.adapter !== "codex" || typeof record2.display_name !== "string" || !record2.display_name || !Number.isSafeInteger(record2.max_concurrency) || Number(record2.max_concurrency) < 1 || Number(record2.max_concurrency) > MAX_CODEX_HOST_CONCURRENCY || record2.authenticated_account_email !== null && typeof record2.authenticated_account_email !== "string" || record2.authenticated_account_plan !== null && typeof record2.authenticated_account_plan !== "string") {
+        throw new Error("Inference-host service worker is invalid.");
+      }
+      return {
+        instance_name: record2.instance_name,
+        adapter: "codex",
+        display_name: record2.display_name,
+        max_concurrency: Number(record2.max_concurrency),
+        authenticated_account_email: record2.authenticated_account_email,
+        authenticated_account_plan: record2.authenticated_account_plan,
+        runtime_environment: assertRuntimeEnvironment(record2.runtime_environment)
+      };
+    };
     assertManifest = (value) => {
       if (!value || typeof value !== "object" || Array.isArray(value)) {
         throw new Error("Inference-host service manifest is invalid.");
       }
       const record2 = value;
-      if (record2.schema_version !== "vtx_inference_service_v1" || record2.adapter !== "codex" || typeof record2.installed_at !== "string" || !Number.isFinite(Date.parse(record2.installed_at)) || typeof record2.executable !== "string" || !record2.executable || typeof record2.script !== "string" || !record2.script || typeof record2.display_name !== "string" || !record2.display_name || typeof record2.log_path !== "string" || !record2.log_path || !record2.runtime_environment || typeof record2.runtime_environment !== "object" || Array.isArray(record2.runtime_environment)) {
-        throw new Error("Inference-host service manifest is invalid.");
+      if (record2.schema_version === "vtx_inference_service_v1") {
+        const legacy = record2;
+        if (legacy.adapter !== "codex" || typeof legacy.installed_at !== "string" || !Number.isFinite(Date.parse(legacy.installed_at)) || typeof legacy.executable !== "string" || !legacy.executable || typeof legacy.script !== "string" || !legacy.script || typeof legacy.display_name !== "string" || !legacy.display_name || typeof legacy.log_path !== "string" || !legacy.log_path) throw new Error("Inference-host service manifest is invalid.");
+        const runtime_environment = assertRuntimeEnvironment(legacy.runtime_environment);
+        const worker = assertWorker({
+          instance_name: "default",
+          adapter: "codex",
+          display_name: legacy.display_name,
+          max_concurrency: Number(runtime_environment.VTX_INFERENCE_HOST_MAX_CONCURRENCY || 1),
+          authenticated_account_email: null,
+          authenticated_account_plan: null,
+          runtime_environment
+        });
+        return {
+          schema_version: "vtx_inference_service_v2",
+          installed_at: legacy.installed_at,
+          executable: assertServicePath(legacy.executable),
+          script: assertServicePath(legacy.script),
+          log_path: assertServicePath(legacy.log_path),
+          workers: [worker]
+        };
       }
-      for (const value2 of [
-        record2.executable,
-        record2.script,
-        record2.log_path
-      ]) {
-        if (typeof value2 === "string" && /[\r\n\0]/u.test(value2)) {
-          throw new Error("Inference-host service manifest paths contain control characters.");
-        }
+      if (record2.schema_version !== "vtx_inference_service_v2" || typeof record2.installed_at !== "string" || !Number.isFinite(Date.parse(record2.installed_at)) || typeof record2.executable !== "string" || !record2.executable || typeof record2.script !== "string" || !record2.script || typeof record2.log_path !== "string" || !record2.log_path || !Array.isArray(record2.workers) || record2.workers.length < 1) {
+        throw new Error("Inference-host service manifest is invalid.");
       }
-      for (const [key, entry] of Object.entries(record2.runtime_environment)) {
-        if (!key.startsWith("VTX_") || typeof entry !== "string") {
-          throw new Error("Inference-host service runtime environment is invalid.");
-        }
+      assertServicePath(record2.executable);
+      assertServicePath(record2.script);
+      assertServicePath(record2.log_path);
+      const workers = record2.workers.map(assertWorker);
+      if (new Set(workers.map((worker) => worker.instance_name)).size !== workers.length) {
+        throw new Error("Inference-host service worker names must be unique.");
       }
-      return record2;
+      return { ...record2, workers };
     };
     assertDesiredState = (value) => {
       if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -30459,13 +30580,15 @@ var init_service = __esm({
       }, null, 2)}
 `);
     };
-    runtimeEnvironment = (config2) => {
+    runtimeEnvironment = (config2, maxConcurrency) => {
       const result2 = {
         VTX_API_URL: config2.apiUrl,
-        VTX_INFERENCE_HOST_HOME: dirname4(config2.codexHomePath),
+        VTX_INFERENCE_HOST_HOME: config2.baseDir,
+        VTX_INFERENCE_HOST_INSTANCE: config2.instanceName,
         VTX_INFERENCE_HOST_CREDENTIAL_STORE: config2.credentialStoreMode,
         VTX_INFERENCE_HOST_STATE_PATH: config2.statePath,
-        VTX_INFERENCE_HOST_LOCK_PATH: config2.processLockPath
+        VTX_INFERENCE_HOST_LOCK_PATH: config2.processLockPath,
+        VTX_INFERENCE_HOST_MAX_CONCURRENCY: String(maxConcurrency)
       };
       if (config2.credentialFilePath) {
         result2.VTX_INFERENCE_HOST_CREDENTIAL_FILE = config2.credentialFilePath;
@@ -30581,7 +30704,7 @@ WantedBy=default.target
         return inferenceHostServiceLogPath(this.config);
       }
       controlLockPath() {
-        return `${this.config.processLockPath}.service-control`;
+        return `${this.config.supervisorProcessLockPath}.service-control`;
       }
       async withControlLock(operation) {
         let lock2 = null;
@@ -30617,12 +30740,12 @@ WantedBy=default.target
         ];
       }
       definitionPath() {
-        if (this.platform === "win32") return `${this.config.statePath}.service-task.xml`;
+        if (this.platform === "win32") return `${this.config.supervisorStatePath}.service-task.xml`;
         if (this.platform === "darwin") return join5(this.home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
         return join5(this.home, ".config", "systemd", "user", SYSTEMD_UNIT);
       }
       windowsLauncherPath() {
-        return `${this.config.statePath}.service-launcher.vbs`;
+        return `${this.config.supervisorStatePath}.service-launcher.vbs`;
       }
       async managerCommand(action) {
         const definition = this.definitionPath();
@@ -30665,37 +30788,19 @@ WantedBy=default.target
         }
         throw new Error("Background service did not reach an active state within 10 seconds.");
       }
-      async install(options) {
-        return await this.withControlLock(async () => await this.installUnlocked(options));
-      }
-      async installUnlocked(options) {
-        if (await readInferenceHostServiceManifest(this.manifestPath())) {
-          await this.uninstallUnlocked();
-        }
-        await access3(this.executable);
-        await access3(this.script);
-        const manifest = assertManifest({
-          schema_version: "vtx_inference_service_v1",
-          installed_at: this.now().toISOString(),
-          adapter: options.adapter,
-          executable: this.executable,
-          script: this.script,
-          display_name: options.displayName,
-          log_path: this.logPath(),
-          runtime_environment: runtimeEnvironment(this.config)
-        });
-        const args = serviceArguments(this.script, this.manifestPath());
-        const definition = this.platform === "win32" ? windowsTaskXml(this.windowsLauncherPath(), this.windowsDirectory, this.username) : this.platform === "darwin" ? launchAgentPlist(this.executable, args, this.logPath()) : systemdUnit(this.executable, args);
+      async registerManifestUnlocked(manifest, desiredRunning) {
+        const args = serviceArguments(manifest.script, this.manifestPath());
+        const definition = this.platform === "win32" ? windowsTaskXml(this.windowsLauncherPath(), this.windowsDirectory, this.username) : this.platform === "darwin" ? launchAgentPlist(manifest.executable, args, manifest.log_path) : systemdUnit(manifest.executable, args);
         let managerInstallAttempted = false;
         try {
           await writeAtomicInferencePrivateFile(this.manifestPath(), `${JSON.stringify(manifest, null, 2)}
 `);
-          await writeDesired(this.desiredPath(), options.startImmediately !== false, this.now());
+          await writeDesired(this.desiredPath(), desiredRunning, this.now());
           await mkdir3(dirname4(this.definitionPath()), { recursive: true, mode: 448 });
           if (this.platform === "win32") {
             await writeAtomicInferencePrivateFile(
               this.windowsLauncherPath(),
-              windowsServiceLauncher(this.executable, args)
+              windowsServiceLauncher(manifest.executable, args)
             );
             await writeFile2(this.definitionPath(), `\uFEFF${definition}`, {
               encoding: "utf16le",
@@ -30712,7 +30817,7 @@ WantedBy=default.target
           managerInstallAttempted = true;
           const installed = await this.managerCommand("install");
           if (installed.exitCode !== 0) throw new Error(`Background service installation failed: ${installed.stderr.trim()}`);
-          if (options.startImmediately !== false) {
+          if (desiredRunning) {
             const started = await this.managerCommand("start");
             if (started.exitCode !== 0 && !/already running|in progress/iu.test(`${started.stdout}
 ${started.stderr}`)) {
@@ -30720,6 +30825,7 @@ ${started.stderr}`)) {
             }
             await this.waitForManagerActive();
           }
+          return await this.status();
         } catch (error48) {
           await writeDesired(this.desiredPath(), false, this.now()).catch(() => void 0);
           if (managerInstallAttempted) {
@@ -30747,7 +30853,83 @@ ${cleanup.stderr}`)) {
           }
           throw error48;
         }
-        return await this.status();
+      }
+      async replaceManifestUnlocked(next, desiredRunning) {
+        const previous = await readInferenceHostServiceManifest(this.manifestPath());
+        const previousDesired = previous ? await readInferenceHostServiceDesired(this.desiredPath()) : false;
+        if (previous) await this.uninstallUnlocked();
+        try {
+          return await this.registerManifestUnlocked(next, desiredRunning);
+        } catch (error48) {
+          if (!previous) throw error48;
+          try {
+            await this.registerManifestUnlocked(previous, previousDesired);
+          } catch (rollbackError) {
+            throw new Error(
+              "Inference-host service reconfiguration failed and the previous supervisor could not be restored.",
+              { cause: new AggregateError([error48, rollbackError]) }
+            );
+          }
+          throw new Error(
+            "Inference-host service reconfiguration failed; the previous supervisor was restored.",
+            { cause: error48 }
+          );
+        }
+      }
+      async install(options) {
+        return await this.withControlLock(async () => await this.installUnlocked(options));
+      }
+      async installUnlocked(options) {
+        const existing = await readInferenceHostServiceManifest(this.manifestPath());
+        const normalizedEmail = options.authenticatedAccountEmail?.trim().toLowerCase() || null;
+        const otherWorkers = existing?.workers.filter(
+          (worker) => worker.instance_name !== this.config.instanceName
+        ) ?? [];
+        if (otherWorkers.length > 0 && (!normalizedEmail || otherWorkers.some((worker) => !worker.authenticated_account_email))) {
+          throw new Error(
+            "Cannot prove that every installed instance uses a distinct ChatGPT subscription. Reinstall instances with live account identity before adding another."
+          );
+        }
+        if (normalizedEmail && otherWorkers.some((worker) => worker.authenticated_account_email?.trim().toLowerCase() === normalizedEmail)) {
+          throw new Error(
+            "This ChatGPT subscription is already installed under another inference-host instance."
+          );
+        }
+        if (this.config.credentialFilePath && otherWorkers.some((worker) => {
+          const otherPath = worker.runtime_environment.VTX_INFERENCE_HOST_CREDENTIAL_FILE;
+          return otherPath && resolve4(otherPath) === resolve4(this.config.credentialFilePath);
+        })) {
+          throw new Error(
+            "Each inference-host instance must use a different private credential file."
+          );
+        }
+        await access3(this.executable);
+        await access3(this.script);
+        const maxConcurrency = options.maxConcurrency ?? 1;
+        const workers = [
+          ...existing?.workers.filter((worker) => worker.instance_name !== this.config.instanceName) ?? [],
+          {
+            instance_name: this.config.instanceName,
+            adapter: options.adapter,
+            display_name: options.displayName,
+            max_concurrency: maxConcurrency,
+            authenticated_account_email: normalizedEmail,
+            authenticated_account_plan: options.authenticatedAccountPlan ?? null,
+            runtime_environment: runtimeEnvironment(this.config, maxConcurrency)
+          }
+        ].sort((left, right) => left.instance_name.localeCompare(right.instance_name));
+        const manifest = assertManifest({
+          schema_version: "vtx_inference_service_v2",
+          installed_at: this.now().toISOString(),
+          executable: this.executable,
+          script: this.script,
+          log_path: this.logPath(),
+          workers
+        });
+        return await this.replaceManifestUnlocked(
+          manifest,
+          options.startImmediately !== false
+        );
       }
       async start() {
         return await this.withControlLock(async () => await this.startUnlocked());
@@ -30774,11 +30956,12 @@ ${result2.stderr}`)) {
         return await this.withControlLock(async () => await this.stopUnlocked());
       }
       async stopUnlocked() {
-        if (!await readInferenceHostServiceManifest(this.manifestPath())) {
+        const manifest = await readInferenceHostServiceManifest(this.manifestPath());
+        if (!manifest) {
           throw new Error("Inference-host service is not installed.");
         }
         await writeDesired(this.desiredPath(), false, this.now());
-        const serviceLockPath = `${this.config.processLockPath}.service`;
+        const serviceLockPath = `${this.config.supervisorProcessLockPath}.service`;
         let serviceReleased = false;
         for (let attempt = 0; attempt < this.stopWaitAttempts; attempt += 1) {
           try {
@@ -30796,7 +30979,7 @@ ${result2.stderr}`)) {
         }
         if (!serviceReleased) {
           throw new Error(
-            `Inference-host worker did not stop cooperatively within ${SERVICE_COOPERATIVE_STOP_SECONDS} seconds; refusing forced termination while cleanup may be pending.`
+            `Inference-host workers did not stop cooperatively within ${SERVICE_COOPERATIVE_STOP_SECONDS} seconds; refusing forced termination while cleanup may be pending.`
           );
         }
         const result2 = await this.managerCommand("stop");
@@ -30822,8 +31005,15 @@ ${result2.stderr}`)) {
           manager_active: managerActive,
           manager: managerName(this.platform),
           manager_state: result2.exitCode === 0 ? output3 || "installed" : "not-installed",
-          adapter: manifest?.adapter ?? null,
-          log_path: manifest?.log_path ?? this.logPath()
+          adapter: manifest ? "codex" : null,
+          log_path: manifest?.log_path ?? this.logPath(),
+          workers: manifest?.workers.map((worker) => ({
+            instance_name: worker.instance_name,
+            display_name: worker.display_name,
+            max_concurrency: worker.max_concurrency,
+            authenticated_account_email: worker.authenticated_account_email,
+            authenticated_account_plan: worker.authenticated_account_plan
+          })) ?? []
         };
       }
       async logs(lines = 100) {
@@ -30838,6 +31028,24 @@ ${result2.stderr}`)) {
           throw error48;
         }
       }
+      async uninstallInstance(instanceName) {
+        return await this.withControlLock(async () => {
+          const manifest = await readInferenceHostServiceManifest(this.manifestPath());
+          if (!manifest) throw new Error("Inference-host service is not installed.");
+          if (!manifest.workers.some((worker) => worker.instance_name === instanceName)) {
+            throw new Error(`Inference-host instance ${instanceName} is not installed.`);
+          }
+          const remaining = manifest.workers.filter(
+            (worker) => worker.instance_name !== instanceName
+          );
+          if (remaining.length === 0) return await this.uninstallUnlocked();
+          return await this.replaceManifestUnlocked({
+            ...manifest,
+            installed_at: this.now().toISOString(),
+            workers: remaining
+          }, await readInferenceHostServiceDesired(this.desiredPath()));
+        });
+      }
       async uninstall() {
         return await this.withControlLock(async () => await this.uninstallUnlocked());
       }
@@ -30867,7 +31075,8 @@ ${result2.stderr}`)) {
           manager: managerName(this.platform),
           manager_state: "not-installed",
           adapter: null,
-          log_path: manifest.log_path
+          log_path: manifest.log_path,
+          workers: []
         };
       }
     };
@@ -30880,21 +31089,21 @@ ${result2.stderr}`)) {
 `, resolvePromise);
       });
     };
-    spawnServiceChild = async (manifest, signal) => {
+    spawnServiceChild = async (manifest, worker, signal) => {
       const args = [
         manifest.script,
         "inference-host",
         "run",
         "--json",
         "--display-name",
-        manifest.display_name
+        worker.display_name
       ];
       const startedAt = Date.now();
       const log = createWriteStream(manifest.log_path, { flags: "a", mode: 384 });
       return await new Promise((resolvePromise, reject) => {
         let stdout = "";
         const child = spawn5(manifest.executable, args, {
-          env: { ...process.env, ...manifest.runtime_environment },
+          env: { ...process.env, ...worker.runtime_environment },
           windowsHide: true,
           stdio: ["ignore", "pipe", "pipe"]
         });
@@ -30938,64 +31147,72 @@ ${result2.stderr}`)) {
     runInferenceHostServiceSupervisor = async (manifestPath, options = {}) => {
       const manifest = await readInferenceHostServiceManifest(manifestPath);
       if (!manifest) throw new Error("Inference-host service manifest is missing.");
-      const desiredPath = `${manifest.runtime_environment.VTX_INFERENCE_HOST_STATE_PATH}.service-desired.json`;
+      const desiredPath = manifestPath.replace(/\.service\.json$/u, ".service-desired.json");
       const signal = options.signal ?? new AbortController().signal;
       const sleep4 = options.sleep ?? (async (milliseconds) => {
         await new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
       });
       const launch = options.runWorker ?? options.spawnChild ?? spawnServiceChild;
-      let failures = 0;
-      await appendServiceLog(manifest.log_path, "service_supervisor_started", { adapter: manifest.adapter });
-      while (!signal.aborted && await readDesiredAcrossAtomicReplacement(desiredPath)) {
-        try {
-          const workerController = new AbortController();
-          const forwardAbort = () => workerController.abort();
-          signal.addEventListener("abort", forwardAbort, { once: true });
-          let workerComplete = false;
-          let monitorError = null;
-          const desiredMonitor = (async () => {
-            while (!workerComplete && !workerController.signal.aborted) {
-              await sleep4(500);
-              if (!await readDesiredAcrossAtomicReplacement(desiredPath)) {
-                workerController.abort();
-                break;
-              }
-            }
-          })().catch((error48) => {
-            monitorError = error48;
-            workerController.abort();
-          });
-          let result2;
+      await appendServiceLog(manifest.log_path, "service_supervisor_started", {
+        adapter: "codex",
+        instances: manifest.workers.map((worker) => worker.instance_name)
+      });
+      const superviseWorker = async (worker) => {
+        let failures = 0;
+        while (!signal.aborted && await readDesiredAcrossAtomicReplacement(desiredPath)) {
           try {
-            result2 = await launch(manifest, workerController.signal);
-          } finally {
-            workerComplete = true;
-            workerController.abort();
-            signal.removeEventListener("abort", forwardAbort);
-            await desiredMonitor;
-          }
-          if (monitorError) throw monitorError;
-          if (signal.aborted || !await readDesiredAcrossAtomicReplacement(desiredPath)) break;
-          failures = result2.uptimeMs >= 6e4 ? 0 : failures + 1;
-          const retryAfterMs = Math.min(1e3 * 2 ** Math.min(failures, 5), 3e4);
-          await appendServiceLog(manifest.log_path, "worker_exited", {
-            exit_code: result2.exitCode,
-            uptime_ms: result2.uptimeMs,
-            drain_reason: result2.drainReason ?? null,
-            retry_after_ms: retryAfterMs
-          });
-          await sleep4(retryAfterMs);
-        } catch (error48) {
-          if (signal.aborted) break;
-          failures += 1;
-          const retryAfterMs = Math.min(1e3 * 2 ** Math.min(failures, 5), 3e4);
-          await appendServiceLog(manifest.log_path, "worker_launch_failed", {
-            error: error48 instanceof Error ? error48.message : "unknown",
-            retry_after_ms: retryAfterMs
-          });
-          await sleep4(retryAfterMs);
+            const workerController = new AbortController();
+            const forwardAbort = () => workerController.abort();
+            signal.addEventListener("abort", forwardAbort, { once: true });
+            let workerComplete = false;
+            let monitorError = null;
+            const desiredMonitor = (async () => {
+              while (!workerComplete && !workerController.signal.aborted) {
+                await sleep4(500);
+                if (!await readDesiredAcrossAtomicReplacement(desiredPath)) {
+                  workerController.abort();
+                  break;
+                }
+              }
+            })().catch((error48) => {
+              monitorError = error48;
+              workerController.abort();
+            });
+            let result2;
+            try {
+              result2 = await launch(manifest, worker, workerController.signal);
+            } finally {
+              workerComplete = true;
+              workerController.abort();
+              signal.removeEventListener("abort", forwardAbort);
+              await desiredMonitor;
+            }
+            if (monitorError) throw monitorError;
+            if (signal.aborted || !await readDesiredAcrossAtomicReplacement(desiredPath)) break;
+            failures = result2.uptimeMs >= 6e4 ? 0 : failures + 1;
+            const retryAfterMs = Math.min(1e3 * 2 ** Math.min(failures, 5), 3e4);
+            await appendServiceLog(manifest.log_path, "worker_exited", {
+              instance_name: worker.instance_name,
+              exit_code: result2.exitCode,
+              uptime_ms: result2.uptimeMs,
+              drain_reason: result2.drainReason ?? null,
+              retry_after_ms: retryAfterMs
+            });
+            await sleep4(retryAfterMs);
+          } catch (error48) {
+            if (signal.aborted) break;
+            failures += 1;
+            const retryAfterMs = Math.min(1e3 * 2 ** Math.min(failures, 5), 3e4);
+            await appendServiceLog(manifest.log_path, "worker_launch_failed", {
+              instance_name: worker.instance_name,
+              error: error48 instanceof Error ? error48.message : "unknown",
+              retry_after_ms: retryAfterMs
+            });
+            await sleep4(retryAfterMs);
+          }
         }
-      }
+      };
+      await Promise.all(manifest.workers.map(superviseWorker));
       await appendServiceLog(manifest.log_path, "service_supervisor_stopped");
     };
   }
@@ -31085,7 +31302,7 @@ async function runInferenceHostCli(argv2, env = process.env, dependencies = {})
     };
   }
 }
-var INFERENCE_HOST_CLI_VERSION, runtimeReceiptPath, codexRecoveryPath, codexGuardianReceiptRoot, revocationCheckpointPath, foregroundHostLockPath, AGENT_HEARTBEAT_INTERVAL_MS, AGENT_HEARTBEAT_MAX_RETRY_DELAY_MS, retryableAgentHeartbeatError, assertRevocationCheckpoint, readRevocationCheckpoint, writeRevocationCheckpoint, clearRevocationCheckpoint, render, INFERENCE_HOST_HELP, parsePositiveInteger, parseInferenceHostArgs, defaultOpenBrowser, defaultRegisterLifecycleSignalHandlers, lifecycleCancellation, configuredCredentialStore, accountKeyForState, assertCredentialMatchesState2, revocationCheckpointForCredential, assertRevocationCheckpointMatchesLocalIdentity, fileExistsPrivately, inspectCodexAuthentication, clearLocalRuntimeArtifacts, assertDurableServiceUninstalled, assertLocalRuntimeArtifactsMayBeDiscarded, defaultRunForeground, login, codexLogin, codexLogout, localStatus, doctor, cleanupLogin, runHost, defaultReadStdin, parseAgentStdin, agentOperationId, agentSession, agentConnect, agentRun, agentNext, agentComplete, agentFail, withAgentCommandLock, serviceCommand, hasExplicitCredentialStoreConfiguration, commandUsesInstalledServiceCredentials, resolveInferenceHostCommandConfig;
+var INFERENCE_HOST_CLI_VERSION, runtimeReceiptPath, codexRecoveryPath, codexGuardianReceiptRoot, revocationCheckpointPath, foregroundHostLockPath, AGENT_HEARTBEAT_INTERVAL_MS, AGENT_HEARTBEAT_MAX_RETRY_DELAY_MS, retryableAgentHeartbeatError, assertRevocationCheckpoint, readRevocationCheckpoint, writeRevocationCheckpoint, clearRevocationCheckpoint, render, INFERENCE_HOST_HELP, parseHostConcurrency, parseInferenceHostArgs, defaultOpenBrowser, defaultRegisterLifecycleSignalHandlers, lifecycleCancellation, configuredCredentialStore, accountKeyForState, assertCredentialMatchesState2, revocationCheckpointForCredential, assertRevocationCheckpointMatchesLocalIdentity, fileExistsPrivately, inspectCodexAuthentication, clearLocalRuntimeArtifacts, assertDurableServiceUninstalled, assertLocalRuntimeArtifactsMayBeDiscarded, defaultRunForeground, login, codexLogin, codexLogout, localStatus, doctor, cleanupLogin, runHost, defaultReadStdin, parseAgentStdin, agentOperationId, agentSession, agentConnect, agentRun, agentNext, agentComplete, agentFail, withAgentCommandLock, serviceCommand, hasExplicitCredentialStoreConfiguration, commandUsesInstalledServiceCredentials, resolveInferenceHostCommandConfig;
 var init_cli = __esm({
   "lib/inference-host/cli.ts"() {
     "use strict";
@@ -31189,6 +31406,8 @@ Commands:
 
 Common options:
   --json           Emit machine-readable JSON
+  --instance NAME  Target an isolated local subscription instance (default: default)
+  --max-concurrency N  Automated Codex slots for this subscription (1-8; default: 3)
   --help, -h       Show this help
 
 If the OS credential store cannot retain the VTX grant, set
@@ -31196,23 +31415,31 @@ VTX_INFERENCE_HOST_CREDENTIAL_STORE=file before login to use the supported
 private-file fallback. See https://vtxmacro.com/insights#subscription-inference.
 
 Durable service:
-  vtx inference-host service install
+  vtx inference-host login --instance codex-1
+  vtx inference-host codex-login --instance codex-1
+  vtx inference-host service install --instance codex-1
+  vtx inference-host login --instance codex-2
+  vtx inference-host codex-login --instance codex-2
+  vtx inference-host service install --instance codex-2
+  vtx inference-host service uninstall --instance codex-2
   vtx inference-host service <start|stop|status|logs|uninstall>
 `;
-    parsePositiveInteger = (raw, label) => {
+    parseHostConcurrency = (raw, label) => {
       const value = Number(raw);
-      if (value !== 1) {
-        throw new Error(`${label} must be exactly 1 for the subscription-backed Codex host.`);
+      if (!Number.isSafeInteger(value) || value < 1 || value > MAX_CODEX_HOST_CONCURRENCY) {
+        throw new Error(`${label} must be an integer from 1 through ${MAX_CODEX_HOST_CONCURRENCY}.`);
       }
       return value;
     };
     parseInferenceHostArgs = (argv2, env) => {
       let json2 = String(env.VTX_OUTPUT_JSON || "").trim().toLowerCase() === "true";
       let once = false;
-      let maxConcurrency = parsePositiveInteger(
-        String(env.VTX_INFERENCE_HOST_MAX_CONCURRENCY || "1"),
+      let maxConcurrency = parseHostConcurrency(
+        String(env.VTX_INFERENCE_HOST_MAX_CONCURRENCY || DEFAULT_CODEX_HOST_CONCURRENCY),
         "VTX_INFERENCE_HOST_MAX_CONCURRENCY"
       );
+      let instanceName = String(env.VTX_INFERENCE_HOST_INSTANCE || "default").trim();
+      let instanceExplicit = Boolean(String(env.VTX_INFERENCE_HOST_INSTANCE || "").trim());
       let displayName = String(env.VTX_INFERENCE_HOST_DISPLAY_NAME || "").trim() || "Codex subscription host";
       let displayNameExplicit = Boolean(String(env.VTX_INFERENCE_HOST_DISPLAY_NAME || "").trim());
       let adapter = null;
@@ -31236,7 +31463,7 @@ Durable service:
         if (argument === "--max-concurrency") {
           const raw = argv2[index + 1];
           if (!raw) throw new Error("--max-concurrency requires a value.");
-          maxConcurrency = parsePositiveInteger(raw, "--max-concurrency");
+          maxConcurrency = parseHostConcurrency(raw, "--max-concurrency");
           index += 1;
           continue;
         }
@@ -31248,7 +31475,7 @@ Durable service:
           index += 1;
           continue;
         }
-        if (["--adapter", "--model", "--model-label", "--effort", "--wait-seconds", "--lines", "--service-manifest"].includes(argument)) {
+        if (["--adapter", "--model", "--model-label", "--effort", "--wait-seconds", "--lines", "--service-manifest", "--instance"].includes(argument)) {
           const raw = argv2[index + 1];
           if (!raw?.trim()) throw new Error(`${argument} requires a value.`);
           if (argument === "--adapter") adapter = raw.trim();
@@ -31268,6 +31495,10 @@ Durable service:
             }
           }
           if (argument === "--service-manifest") serviceManifestPath = resolve5(raw.trim());
+          if (argument === "--instance") {
+            instanceName = raw.trim();
+            instanceExplicit = true;
+          }
           index += 1;
           continue;
         }
@@ -31295,6 +31526,8 @@ Durable service:
         json: json2,
         once,
         maxConcurrency,
+        instanceName,
+        instanceExplicit,
         displayName,
         adapter,
         modelId,
@@ -31406,9 +31639,10 @@ Durable service:
       await clearInferenceHostLocalState(config2.statePath);
     };
     assertDurableServiceUninstalled = async (config2) => {
-      if (await readInferenceHostServiceManifest(`${config2.statePath}.service.json`)) {
+      const manifest = await readInferenceHostServiceManifest(`${config2.supervisorStatePath}.service.json`);
+      if (manifest?.workers.some((worker) => worker.instance_name === config2.instanceName)) {
         throw new Error(
-          "Uninstall the durable inference-host service before logout, revoke, or Codex logout."
+          `Uninstall the durable inference-host service before changing credentials for instance ${config2.instanceName}.`
         );
       }
     };
@@ -32436,55 +32670,19 @@ Waiting for approval...
         if (!parsed.serviceManifestPath) throw new Error("Internal service manifest path is required.");
         const serviceManifest = await readInferenceHostServiceManifest(parsed.serviceManifestPath);
         if (!serviceManifest) throw new Error("Inference-host service manifest is missing.");
-        const serviceConfig = resolveInferenceHostConfig({
+        const supervisorConfig = resolveInferenceHostConfig({
           ...env,
-          ...serviceManifest.runtime_environment
+          ...serviceManifest.workers[0].runtime_environment
         });
         const serviceLock = await acquireInferenceHostProcessLock(
-          `${serviceConfig.processLockPath}.service`
+          `${supervisorConfig.supervisorProcessLockPath}.service`
         );
         const cancellation = lifecycleCancellation(dependencies);
         try {
           await (dependencies.runServiceSupervisor ?? runInferenceHostServiceSupervisor)(
             parsed.serviceManifestPath,
             {
-              signal: cancellation.signal,
-              runWorker: async (manifest, signal) => {
-                const startedAt = Date.now();
-                const serviceEnv = { ...env, ...manifest.runtime_environment };
-                const serviceConfig2 = resolveInferenceHostConfig(serviceEnv);
-                const unregister = (abort) => {
-                  const onAbort = () => abort("SIGTERM");
-                  signal.addEventListener("abort", onAbort, { once: true });
-                  return () => signal.removeEventListener("abort", onAbort);
-                };
-                const result2 = await runHost(serviceConfig2, {
-                  ...parsed,
-                  command: "run",
-                  serviceAction: null,
-                  serviceManifestPath: null,
-                  displayName: manifest.display_name,
-                  once: false
-                }, serviceEnv, {
-                  ...dependencies,
-                  registerLifecycleSignalHandlers: unregister
-                }, warnings);
-                let drainReason = null;
-                try {
-                  const summary = JSON.parse(result2.stdout);
-                  if (summary && typeof summary === "object" && !Array.isArray(summary) && typeof summary.drain_reason === "string" && /^[a-z0-9_]{1,96}$/u.test(
-                    summary.drain_reason
-                  )) {
-                    drainReason = summary.drain_reason;
-                  }
-                } catch {
-                }
-                return {
-                  exitCode: result2.exitCode,
-                  uptimeMs: Date.now() - startedAt,
-                  drainReason
-                };
-              }
+              signal: cancellation.signal
             }
           );
           return { exitCode: 0, stdout: "", stderr: "" };
@@ -32518,12 +32716,18 @@ Waiting for approval...
           throw new Error("Run vtx inference-host codex-login before installing the automated Codex service.");
         }
         const binary = await (dependencies.resolveBinary ?? resolvePinnedCodexBinary)(env);
-        await (dependencies.preflightCodex ?? preflightCodexSubscription)({
+        const preflight = await (dependencies.preflightCodex ?? preflightCodexSubscription)({
           binary,
           codexHome: config2.codexHomePath,
           deadlineAtMs: Date.now() + 3e4
         });
-        const status = await manager.install({ adapter: "codex", displayName: parsed.displayName });
+        const status = await manager.install({
+          adapter: "codex",
+          displayName: parsed.displayName,
+          maxConcurrency: parsed.maxConcurrency,
+          authenticatedAccountEmail: preflight?.authenticated_account_email ?? null,
+          authenticatedAccountPlan: preflight?.authenticated_account_plan ?? null
+        });
         return {
           exitCode: 0,
           stdout: render({ status: "service_installed", ...status }, parsed.json),
@@ -32549,7 +32753,8 @@ Waiting for approval...
         return { exitCode: lifecycleMatches ? 0 : 1, stdout: render(status, parsed.json), stderr: "" };
       }
       if (action === "uninstall") {
-        return { exitCode: 0, stdout: render({ status: "service_uninstalled", ...await manager.uninstall() }, parsed.json), stderr: "" };
+        const status = parsed.instanceExplicit ? await manager.uninstallInstance(config2.instanceName) : await manager.uninstall();
+        return { exitCode: 0, stdout: render({ status: "service_uninstalled", ...status }, parsed.json), stderr: "" };
       }
       throw new Error("Usage: vtx inference-host service <install|start|stop|status|logs|uninstall>.");
     };
@@ -32558,16 +32763,20 @@ Waiting for approval...
     );
     commandUsesInstalledServiceCredentials = (parsed) => parsed.command === "status" || parsed.command === "doctor" || parsed.command === "service" && parsed.serviceAction === "install";
     resolveInferenceHostCommandConfig = async (parsed, env) => {
-      const baseConfig = resolveInferenceHostConfig(env);
+      const selectedEnv = {
+        ...env,
+        VTX_INFERENCE_HOST_INSTANCE: parsed.instanceName
+      };
+      const baseConfig = resolveInferenceHostConfig(selectedEnv);
       if (!commandUsesInstalledServiceCredentials(parsed) || hasExplicitCredentialStoreConfiguration(env)) {
         return baseConfig;
       }
-      const manifestPath = `${baseConfig.statePath}.service.json`;
+      const manifestPath = `${baseConfig.supervisorStatePath}.service.json`;
       const manifest = await readInferenceHostServiceManifest(manifestPath);
       if (!manifest) return baseConfig;
       const installedConfig = resolveInferenceHostConfig({
-        ...env,
-        ...manifest.runtime_environment
+        ...selectedEnv,
+        ...manifest.workers.find((worker) => worker.instance_name === baseConfig.instanceName)?.runtime_environment
       });
       if (resolve5(installedConfig.statePath) !== resolve5(baseConfig.statePath)) {
         throw new Error(
@@ -49994,7 +50203,11 @@ function buildHeadlessExchangeConfig(input) {
       user_fills_ttl_seconds: readCacheNumberField("user_fills_ttl_seconds"),
       stale_if_429_max_age_seconds: readCacheNumberField("stale_if_429_max_age_seconds")
     },
-    client_runtime_hyperliquid_case_sensitive_symbols: Array.isArray(input.client_runtime_hyperliquid_case_sensitive_symbols) ? input.client_runtime_hyperliquid_case_sensitive_symbols : null
+    client_runtime_hyperliquid_case_sensitive_symbols: Array.isArray(input.client_runtime_hyperliquid_case_sensitive_symbols) ? input.client_runtime_hyperliquid_case_sensitive_symbols : null,
+    client_runtime_hyperliquid_perp_dexs: input.client_runtime_hyperliquid_perp_dexs ? {
+      enabled: input.client_runtime_hyperliquid_perp_dexs.enabled === true,
+      allowed_dexes: Array.isArray(input.client_runtime_hyperliquid_perp_dexs.allowed_dexes) ? input.client_runtime_hyperliquid_perp_dexs.allowed_dexes.map((dex) => String(dex).trim()).filter(Boolean) : []
+    } : void 0
   };
 }
 async function fetchLocalHyperliquidSnapshot(input) {
@@ -50010,7 +50223,7 @@ async function fetchLocalHyperliquidSnapshot(input) {
     symbol: input.symbol,
     tickerPrice: 0,
     leverage,
-    aggregatePerpDexs: false
+    aggregatePerpDexs: true
   });
   const clientExchangeSnapshot = buildClientExchangeSnapshot({
     walletAddress,
@@ -51041,7 +51254,8 @@ var INFERENCE_HOST_VALUE_OPTIONS = /* @__PURE__ */ new Set([
   "--effort",
   "--wait-seconds",
   "--lines",
-  "--service-manifest"
+  "--service-manifest",
+  "--instance"
 ]);
 var isInferenceHostCliInvocation = (argv2) => {
   for (let index = 0; index < argv2.length; index += 1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.8.30",
+  "version": "2026.8.31",
   "description": "VTX Macro CLI, MCP server, and durable subscription inference host.",
   "type": "module",
   "license": "UNLICENSED",