@vtxmacro/cli 2026.8.39 → 2026.8.41

package/README.md

@@ -10,11 +10,16 @@ vtx --version
 ```
 
 The host supports Windows x64 and Linux x64, including WSL. The package installs
-the exact supported OpenAI Codex runtime for those platforms.
-The VTX host verifies that native runtime's version and digest before use; it
-does not borrow a Codex binary from PATH or an editor extension.
+the exact supported OpenAI Codex runtime and GitHub Copilot SDK. The VTX host
+verifies the Codex runtime's version and digest before use; it does not borrow a
+Codex binary from PATH or an editor extension.
 For Windows-login auto-start, install and configure the CLI from native Windows;
 a CLI installed only inside WSL cannot start the WSL virtual machine at login.
+An npm update does not replace code already loaded by a running durable service.
+After updating, check `vtx inference-host service status --json`. If the service
+was already desired-running, run `vtx inference-host service stop` followed by
+`vtx inference-host service start`, then verify status and logs. Leave an
+intentionally stopped service stopped until you want to run it.
 
 ## Configure
 
@@ -47,7 +52,15 @@ Both paths use a separate least-privilege `insights:inference` OAuth grant.
 VTX never receives an agent vendor password, OAuth token, or subscription
 credential.
 
-### Automated Codex host
+### Durable subscription hosts
+
+Codex remains the reference implementation and its existing App Server,
+authentication, quota, recovery, and provider-mode path are unchanged. GitHub
+Copilot is an additive preview adapter that uses the official SDK and validates
+final text against VTX's immutable schema. An uncertain interrupted Copilot call
+is quarantined as `outcome_unknown` and is never blindly repeated. A different
+adapter cannot replace an installed Codex instance; it needs a distinct instance
+and VTX grant.
 
 Before the first Codex login, enable **Device code authorization for Codex** in
 ChatGPT Security settings. Only enter a device code from a login you initiated,
@@ -75,6 +88,14 @@ vtx inference-host codex-logout
 vtx inference-host revoke
 ```
 
+For Copilot, sign in with the official Copilot CLI, then run:
+
+```bash
+vtx inference-host login --instance copilot-1
+vtx inference-host doctor --adapter copilot --instance copilot-1 --json
+vtx inference-host service install --adapter copilot --instance copilot-1
+```
+
 To connect another Codex subscription to the same VTX account, repeat the
 login and service-install commands with a stable local name such as
 `--instance codex-2`. Each named instance has an isolated VTX grant, Codex
@@ -86,6 +107,21 @@ distinct. Use `service uninstall --instance <name>` to remove one worker;
 unqualified `service uninstall` removes the whole supervisor. The legacy
 unqualified host commands continue to target `default`.
 
+On native Windows, if service status or logs show that guarded recovery is
+blocking one installed subscription, recover that exact instance without rebooting:
+
+```bash
+vtx inference-host service recover --instance <name> --force-recovery --json
+```
+
+Recovery is intentionally noninteractive and requires both `--instance` and
+`--force-recovery`; `--json` changes only the output format. The shared
+supervisor briefly quiesces so every installed worker can stop cooperatively,
+then VTX restores its previous desired state and the same peer subscriptions.
+The command never kills an arbitrary process, logs either account out, changes
+VTX profile settings, or controls a Trader. If any package-owned VTX automation
+is still live, recovery fails closed and preserves its evidence.
+
 For each VTX profile and lane, **Subscription #1** is tried first and later
 compatible subscriptions follow in the saved Account cascade order.
 Quota/credits exhaustion, unusable authentication, and exhausted recoverable
@@ -101,10 +137,10 @@ capacity beyond the authenticated account's current entitlement. Updating from
 an older bounded host removes its previous numeric limit; run
 `service install --max-concurrency <positive-integer>` only to add one back.
 
-This durable host uses a separate least-privilege `insights:inference`
-OAuth grant. It also keeps its ChatGPT subscription login in a dedicated private
-Codex home. Neither credential is copied from or widens the ordinary CLI or Codex
-session. The per-user OS service starts immediately, starts again at login, and
+Every durable host uses a separate least-privilege `insights:inference`
+OAuth grant. Codex additionally keeps its ChatGPT subscription login in a dedicated
+private Codex home; Copilot uses its official cached user login.
+No vendor credential is written to the VTX service manifest. The per-user OS service starts immediately, starts again at login, and
 reconnects after sleep, network loss, or a worker exit. Stopping a VTX bot leaves
 the provider online and idle. Use `vtx inference-host run` only for foreground
 diagnostics. VTX logout/revoke and Codex logout are intentionally separate operations.
@@ -164,11 +200,11 @@ Use `not_dispatched` only when no harness inference began,
 `outcome_unknown` when dispatch itself cannot be confirmed. Pipe exactly one
 object to `vtx inference-host agent-fail --json`.
 
-Claude Code, GitHub Copilot, Cursor, and Google Antigravity remain on the
-explicit foreground agent loop. Their supported CLI or account contracts do not
-provide the durable, private third-party service boundary VTX requires, so
-`service install --adapter ...` rejects them instead of advertising false
-durability.
+Claude Code, Kiro, Grok Build, Cursor, Amp, Auggie, Junie, and Warp/Oz remain on
+the explicit foreground agent loop. Their current subscription routing,
+effective-model identity, schema, usage, or crash-recovery contracts do not yet
+meet every durable VTX acceptance fence. The public Insights matrix records the
+specific limitation instead of treating headless support alone as durability.
 
 Keep `agent-run` open in a separate terminal and keep calling `agent-next`
 while the host should remain available. The independent keeper preserves