@vtxmacro/cli 2026.8.40 → 2026.8.42

package/README.md

@@ -10,9 +10,9 @@ vtx --version
 ```
 
 The host supports Windows x64 and Linux x64, including WSL. The package installs
-the exact supported OpenAI Codex runtime for those platforms.
-The VTX host verifies that native runtime's version and digest before use; it
-does not borrow a Codex binary from PATH or an editor extension.
+the exact supported OpenAI Codex runtime and GitHub Copilot SDK. The VTX host
+verifies the Codex runtime's version and digest before use; it does not borrow a
+Codex binary from PATH or an editor extension.
 For Windows-login auto-start, install and configure the CLI from native Windows;
 a CLI installed only inside WSL cannot start the WSL virtual machine at login.
 An npm update does not replace code already loaded by a running durable service.
@@ -52,7 +52,15 @@ Both paths use a separate least-privilege `insights:inference` OAuth grant.
 VTX never receives an agent vendor password, OAuth token, or subscription
 credential.
 
-### Automated Codex host
+### Durable subscription hosts
+
+Codex remains the reference implementation and its existing App Server,
+authentication, quota, recovery, and provider-mode path are unchanged. GitHub
+Copilot is an additive preview adapter that uses the official SDK and validates
+final text against VTX's immutable schema. An uncertain interrupted Copilot call
+is quarantined as `outcome_unknown` and is never blindly repeated. A different
+adapter cannot replace an installed Codex instance; it needs a distinct instance
+and VTX grant.
 
 Before the first Codex login, enable **Device code authorization for Codex** in
 ChatGPT Security settings. Only enter a device code from a login you initiated,
@@ -80,6 +88,14 @@ vtx inference-host codex-logout
 vtx inference-host revoke
 ```
 
+For Copilot, sign in with the official Copilot CLI, then run:
+
+```bash
+vtx inference-host login --instance copilot-1
+vtx inference-host doctor --adapter copilot --instance copilot-1 --json
+vtx inference-host service install --adapter copilot --instance copilot-1
+```
+
 To connect another Codex subscription to the same VTX account, repeat the
 login and service-install commands with a stable local name such as
 `--instance codex-2`. Each named instance has an isolated VTX grant, Codex
@@ -121,10 +137,10 @@ capacity beyond the authenticated account's current entitlement. Updating from
 an older bounded host removes its previous numeric limit; run
 `service install --max-concurrency <positive-integer>` only to add one back.
 
-This durable host uses a separate least-privilege `insights:inference`
-OAuth grant. It also keeps its ChatGPT subscription login in a dedicated private
-Codex home. Neither credential is copied from or widens the ordinary CLI or Codex
-session. The per-user OS service starts immediately, starts again at login, and
+Every durable host uses a separate least-privilege `insights:inference`
+OAuth grant. Codex additionally keeps its ChatGPT subscription login in a dedicated
+private Codex home; Copilot uses its official cached user login.
+No vendor credential is written to the VTX service manifest. The per-user OS service starts immediately, starts again at login, and
 reconnects after sleep, network loss, or a worker exit. Stopping a VTX bot leaves
 the provider online and idle. Use `vtx inference-host run` only for foreground
 diagnostics. VTX logout/revoke and Codex logout are intentionally separate operations.
@@ -184,11 +200,11 @@ Use `not_dispatched` only when no harness inference began,
 `outcome_unknown` when dispatch itself cannot be confirmed. Pipe exactly one
 object to `vtx inference-host agent-fail --json`.
 
-Claude Code, GitHub Copilot, Cursor, and Google Antigravity remain on the
-explicit foreground agent loop. Their supported CLI or account contracts do not
-provide the durable, private third-party service boundary VTX requires, so
-`service install --adapter ...` rejects them instead of advertising false
-durability.
+Claude Code, Kiro, Grok Build, Cursor, Amp, Auggie, Junie, and Warp/Oz remain on
+the explicit foreground agent loop. Their current subscription routing,
+effective-model identity, schema, usage, or crash-recovery contracts do not yet
+meet every durable VTX acceptance fence. The public Insights matrix records the
+specific limitation instead of treating headless support alone as durability.
 
 Keep `agent-run` open in a separate terminal and keep calling `agent-next`
 while the host should remain available. The independent keeper preserves

package/bin/vtx.js

@@ -38,9 +38,13 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.8.40",
+      package_version: "2026.8.42",
       codex_package_name: "@openai/codex",
       codex_version: "0.147.0",
+      copilot_sdk_package_name: "@github/copilot-sdk",
+      copilot_sdk_version: "1.0.0-beta.8",
+      copilot_cli_package_name: "@github/copilot",
+      copilot_cli_version: "1.0.80",
       platforms: {
         "linux-x64": {
           package_name: "@openai/codex-linux-x64",
@@ -14725,6 +14729,7 @@ var init_external_inference_contract = __esm({
       key_generation: generationSchema,
       adapter: externalInferenceAdapterIdSchema,
       display_name: displayNameSchema,
+      authenticated_account_identity: safeCodeSchema.nullable().optional(),
       authenticated_account_email: authenticatedAccountEmailSchema.nullable().optional(),
       authenticated_account_plan: safeCodeSchema.nullable().optional(),
       protocol_version: protocolVersionSchema,
@@ -15644,6 +15649,7 @@ var init_external_inference_contract = __esm({
     hostStatusReadSchema = external_exports.strictObject({
       host_id: identifierSchema,
       display_name: displayNameSchema,
+      authenticated_account_identity: safeCodeSchema.nullable().optional(),
       authenticated_account_email: authenticatedAccountEmailSchema.nullable().optional(),
       authenticated_account_plan: safeCodeSchema.nullable().optional(),
       adapter: externalInferenceAdapterIdSchema,
@@ -18179,7 +18185,7 @@ var init_mcp_client = __esm({
         if (!host) return invalidBoundResult(name);
         if (host.host_id !== request.host_id || host.host_generation !== request.host_generation || host.advertisement_generation !== request.advertisement_generation || host.key_generation !== request.key_generation || request.adapter !== void 0 && host.adapter !== request.adapter) invalidBoundResult(name);
         if (name !== "inference.host.heartbeat") {
-          if (host.display_name !== request.display_name || host.authenticated_account_email !== void 0 && host.authenticated_account_email !== null && host.authenticated_account_email !== request.authenticated_account_email || (host.authenticated_account_plan ?? null) !== (request.authenticated_account_plan ?? null) || !exactJson(host.models, request.models) || host.status === "revoked") invalidBoundResult(name);
+          if (host.display_name !== request.display_name || host.authenticated_account_identity !== void 0 && host.authenticated_account_identity !== null && host.authenticated_account_identity !== request.authenticated_account_identity || host.authenticated_account_email !== void 0 && host.authenticated_account_email !== null && host.authenticated_account_email !== request.authenticated_account_email || (host.authenticated_account_plan ?? null) !== (request.authenticated_account_plan ?? null) || !exactJson(host.models, request.models) || host.status === "revoked") invalidBoundResult(name);
           return;
         }
         const expectedStatus = request.status === "healthy" ? "online" : request.status;
@@ -19478,8 +19484,8 @@ async function preflightCodexSubscription(options) {
       });
     }
     const rateLimits = await session.readAccountRateLimits(options.deadlineAtMs, options.signal);
-    const modelCapabilities = await session.readModelCapabilities(options.deadlineAtMs, options.signal);
-    if (modelCapabilities.length === 0) {
+    const modelCapabilities2 = await session.readModelCapabilities(options.deadlineAtMs, options.signal);
+    if (modelCapabilities2.length === 0) {
       throw new CodexAppServerError({
         message: "Codex did not return any visible models with supported reasoning efforts.",
         category: "model",
@@ -19491,7 +19497,7 @@ async function preflightCodexSubscription(options) {
       authenticated_account_email: account.authenticatedChatGptAccount.email,
       authenticated_account_plan: account.authenticatedChatGptAccount.planType,
       rate_limits: rateLimits,
-      model_capabilities: modelCapabilities
+      model_capabilities: modelCapabilities2
     };
   } finally {
     await session.close();
@@ -22780,6 +22786,317 @@ $items = @(Get-CimInstance Win32_Process | Where-Object { $_.Name -in @('node.ex
   }
 });
 
+// lib/inference-host/copilot-adapter.ts
+import { mkdtemp as mkdtemp2, rm as rm4 } from "node:fs/promises";
+import { tmpdir as tmpdir3 } from "node:os";
+import { join as join5 } from "node:path";
+import { CopilotClient } from "@github/copilot-sdk";
+var COPILOT_SDK_VERSION, MAX_RESULT_BYTES, createPrivateWorkspace, cleanCopilotEnvironment, defaultClient, modelCapabilities, requiredUsageInteger, optionalUsageInteger, CopilotSubscriptionAdapter;
+var init_copilot_adapter = __esm({
+  "lib/inference-host/copilot-adapter.ts"() {
+    "use strict";
+    init_codex_app_server();
+    COPILOT_SDK_VERSION = "1.0.0-beta.8";
+    MAX_RESULT_BYTES = 3e5;
+    createPrivateWorkspace = async () => {
+      const path = await mkdtemp2(join5(tmpdir3(), "vtx-copilot-"));
+      return {
+        path,
+        cleanup: async () => {
+          await rm4(path, { recursive: true, force: true });
+        }
+      };
+    };
+    cleanCopilotEnvironment = () => {
+      const environment = { ...process.env };
+      for (const name of [
+        "COPILOT_GITHUB_TOKEN",
+        "GH_TOKEN",
+        "GITHUB_TOKEN",
+        "COPILOT_PROVIDER_API_KEY",
+        "COPILOT_PROVIDER_BASE_URL",
+        "COPILOT_PROVIDER_TYPE",
+        "COPILOT_CLI_PATH",
+        "COPILOT_SDK_AUTH_TOKEN",
+        "COPILOT_CONNECTION_TOKEN",
+        "COPILOT_HOME"
+      ]) delete environment[name];
+      return environment;
+    };
+    defaultClient = (workingDirectory) => new CopilotClient({
+      workingDirectory,
+      env: cleanCopilotEnvironment(),
+      useLoggedInUser: true,
+      logLevel: "error"
+    });
+    modelCapabilities = (models) => {
+      const capabilities = models.filter((model) => model.policy?.state !== "disabled" && model.policy?.state !== "unconfigured").flatMap((model) => {
+        const efforts = model.capabilities.supports.reasoningEffort ? [...model.supportedReasoningEfforts ?? []] : ["none"];
+        if (efforts.length === 0) return [];
+        const defaultEffort = model.defaultReasoningEffort && efforts.includes(model.defaultReasoningEffort) ? model.defaultReasoningEffort : efforts[0];
+        return [{
+          id: model.id,
+          model: model.id,
+          displayName: model.name,
+          hidden: false,
+          supportedReasoningEfforts: efforts,
+          defaultReasoningEffort: defaultEffort,
+          isDefault: false
+        }];
+      });
+      return capabilities.map((capability, index) => ({
+        ...capability,
+        isDefault: index === 0
+      }));
+    };
+    requiredUsageInteger = (value, field) => {
+      if (!Number.isSafeInteger(value) || Number(value) < 0) {
+        throw new Error(`copilot_usage_${field}_missing`);
+      }
+      return Number(value);
+    };
+    optionalUsageInteger = (value, field) => {
+      if (value === void 0) return 0;
+      if (!Number.isSafeInteger(value) || Number(value) < 0) {
+        throw new Error(`copilot_usage_${field}_invalid`);
+      }
+      return Number(value);
+    };
+    CopilotSubscriptionAdapter = class {
+      constructor(dependencies = {}) {
+        this.inFlight = /* @__PURE__ */ new Map();
+        this.dependencies = dependencies;
+      }
+      async preflight(signal) {
+        const workspace = await (this.dependencies.createWorkspace ?? createPrivateWorkspace)();
+        const client = (this.dependencies.createClient ?? defaultClient)(workspace.path);
+        try {
+          signal?.throwIfAborted();
+          await client.start();
+          const [status, auth, models] = await Promise.all([
+            client.getStatus(),
+            client.getAuthStatus(),
+            client.listModels()
+          ]);
+          if (!auth.isAuthenticated || auth.authType !== "user" && auth.authType !== "gh-cli") {
+            throw new CodexAppServerError({
+              message: "GitHub Copilot must use a logged-in Copilot subscription, not BYOK.",
+              category: "auth",
+              code: "copilot_subscription_auth_required",
+              retryable: false
+            });
+          }
+          const accountIdentity = auth.login?.trim().toLowerCase() ?? "";
+          if (!/^[a-z0-9][a-z0-9._-]{0,95}$/u.test(accountIdentity)) {
+            throw new CodexAppServerError({
+              message: "GitHub Copilot did not return a stable authenticated login identity.",
+              category: "auth",
+              code: "copilot_account_identity_required",
+              retryable: false
+            });
+          }
+          const capabilities = modelCapabilities(models);
+          if (capabilities.length === 0) {
+            throw new CodexAppServerError({
+              message: "GitHub Copilot did not return an enabled model catalog.",
+              category: "model",
+              code: "copilot_model_catalog_empty",
+              retryable: false
+            });
+          }
+          return {
+            adapterId: "copilot",
+            runtimeVersion: `${COPILOT_SDK_VERSION}+cli.${status.version}.rpc${status.protocolVersion}`,
+            authenticatedAccountIdentity: accountIdentity,
+            authenticatedAccountEmail: null,
+            authenticatedAccountPlan: null,
+            modelCapabilities: capabilities,
+            rateLimits: null,
+            sameAttemptRecovery: false
+          };
+        } finally {
+          await client.stop().catch(async () => {
+            await client.forceStop();
+          });
+          await workspace.cleanup();
+        }
+      }
+      runAttempt(input) {
+        const active = this.inFlight.get(input.attemptId);
+        if (active) return active;
+        const promise2 = this.executeAttempt(input).finally(() => {
+          if (this.inFlight.get(input.attemptId) === promise2) this.inFlight.delete(input.attemptId);
+        });
+        this.inFlight.set(input.attemptId, promise2);
+        return promise2;
+      }
+      async executeAttempt(input) {
+        const startedAt = (this.dependencies.now ?? Date.now)();
+        const workspace = await (this.dependencies.createWorkspace ?? createPrivateWorkspace)();
+        const client = (this.dependencies.createClient ?? defaultClient)(workspace.path);
+        let session = null;
+        let dispatchEntered = false;
+        let providerReceiptObserved = false;
+        try {
+          input.signal?.throwIfAborted();
+          if (Date.now() >= input.deadlineAtMs) throw new Error("deadline_exceeded");
+          await client.start();
+          session = await client.createSession({
+            clientName: "@vtxmacro/cli durable Copilot inference host",
+            model: input.requestedModel,
+            ...input.requestedReasoningEffort === "none" ? {} : { reasoningEffort: input.requestedReasoningEffort },
+            systemMessage: {
+              mode: "replace",
+              content: `${input.systemPrompt}
+
+Return only one JSON value matching this JSON Schema exactly:
+${input.outputSchemaJson}`
+            },
+            tools: [],
+            availableTools: [],
+            enableConfigDiscovery: false,
+            enableSessionTelemetry: true,
+            workingDirectory: workspace.path,
+            streaming: true
+          });
+          const usageEvents = [];
+          session.on((event) => {
+            if (event.type === "assistant.usage" && !event.agentId) {
+              providerReceiptObserved = true;
+              usageEvents.push(event);
+            }
+          });
+          const onAbort = () => {
+            void session?.abort().catch(() => void 0);
+          };
+          input.signal?.addEventListener("abort", onAbort, { once: true });
+          dispatchEntered = true;
+          let response;
+          try {
+            response = await session.sendAndWait(
+              { prompt: input.userPrompt },
+              Math.max(1, input.deadlineAtMs - Date.now())
+            );
+            providerReceiptObserved = true;
+          } finally {
+            input.signal?.removeEventListener("abort", onAbort);
+          }
+          if (!response?.data.content || Buffer.byteLength(response.data.content, "utf8") > MAX_RESULT_BYTES) {
+            throw new Error("copilot_invalid_result");
+          }
+          const observedModels = /* @__PURE__ */ new Set();
+          const observedEfforts = /* @__PURE__ */ new Set();
+          let inputTokens = 0;
+          let cachedInputTokens = 0;
+          let outputTokens = 0;
+          let reasoningOutputTokens = 0;
+          let cacheWriteInputTokens = 0;
+          let cacheWriteSupported = false;
+          let timeToFirstTokenMs = null;
+          let providerCallId = null;
+          for (const event of usageEvents) {
+            if (event.type !== "assistant.usage") continue;
+            observedModels.add(event.data.model);
+            if (event.data.reasoningEffort) observedEfforts.add(event.data.reasoningEffort);
+            inputTokens += requiredUsageInteger(event.data.inputTokens, "input_tokens");
+            cachedInputTokens += optionalUsageInteger(event.data.cacheReadTokens, "cache_read_tokens");
+            outputTokens += requiredUsageInteger(event.data.outputTokens, "output_tokens");
+            reasoningOutputTokens += optionalUsageInteger(event.data.reasoningTokens, "reasoning_tokens");
+            if (event.data.cacheWriteTokens !== void 0) {
+              cacheWriteSupported = true;
+              cacheWriteInputTokens += optionalUsageInteger(
+                event.data.cacheWriteTokens,
+                "cache_write_tokens"
+              );
+            }
+            if (timeToFirstTokenMs === null && Number.isSafeInteger(event.data.timeToFirstTokenMs)) {
+              timeToFirstTokenMs = Number(event.data.timeToFirstTokenMs);
+            }
+            providerCallId = event.data.providerCallId ?? event.data.apiCallId ?? providerCallId;
+          }
+          if (usageEvents.length === 0) {
+            throw new Error("copilot_usage_receipt_missing");
+          }
+          if (response.data.model) observedModels.add(response.data.model);
+          if (observedModels.size !== 1 || !observedModels.has(input.requestedModel)) {
+            throw new Error("copilot_effective_model_mismatch");
+          }
+          const effectiveEffort = input.requestedReasoningEffort === "none" ? observedEfforts.size === 0 ? "none" : observedEfforts.size === 1 ? [...observedEfforts][0] : null : observedEfforts.size === 1 ? [...observedEfforts][0] : null;
+          if (effectiveEffort !== input.requestedReasoningEffort) {
+            throw new Error("copilot_effective_effort_mismatch");
+          }
+          const usage = {
+            inputTokens,
+            cachedInputTokens: Math.min(cachedInputTokens, inputTokens),
+            outputTokens,
+            reasoningOutputTokens: Math.min(reasoningOutputTokens, outputTokens),
+            totalTokens: inputTokens + outputTokens,
+            cacheWriteInputTokens: cacheWriteSupported ? cacheWriteInputTokens : null,
+            cacheWriteSupported
+          };
+          return {
+            text: response.data.content,
+            reasoningContent: response.data.reasoningText ?? null,
+            reasoningSummary: null,
+            requestedModel: input.requestedModel,
+            effectiveModel: input.requestedModel,
+            requestedReasoningEffort: input.requestedReasoningEffort,
+            effectiveReasoningEffort: effectiveEffort,
+            adapterRequestId: providerCallId ?? response.data.requestId ?? response.data.messageId,
+            adapterResponseId: response.data.serviceRequestId ?? response.data.messageId,
+            usage,
+            latencyMs: Math.max(0, (this.dependencies.now ?? Date.now)() - startedAt),
+            timeToFirstTokenMs,
+            terminalStatus: "completed"
+          };
+        } catch (error48) {
+          if (error48 instanceof CodexAppServerError) throw error48;
+          const cancelled = input.signal?.aborted === true;
+          const deadline = Date.now() >= input.deadlineAtMs;
+          if (dispatchEntered && session) {
+            await session.abort().catch(() => void 0);
+          }
+          throw new CodexAppServerError({
+            message: cancelled ? "GitHub Copilot attempt was cancelled." : deadline ? "GitHub Copilot attempt exceeded its immutable deadline." : error48 instanceof Error ? error48.message : "GitHub Copilot adapter failed.",
+            category: cancelled ? "cancelled" : deadline ? "timeout" : "adapter",
+            code: cancelled ? "cancelled" : deadline ? "deadline_exceeded" : "copilot_adapter_failure",
+            retryable: false,
+            dispatchOutcome: providerReceiptObserved ? "confirmed_dispatched" : dispatchEntered ? "outcome_unknown" : "not_dispatched",
+            cause: error48
+          });
+        } finally {
+          if (session) {
+            const sessionId = session.sessionId;
+            await session.disconnect().catch(() => void 0);
+            await client.deleteSession(sessionId).catch(() => void 0);
+          }
+          await client.stop().catch(async () => {
+            await client.forceStop();
+          });
+          await workspace.cleanup();
+        }
+      }
+    };
+  }
+});
+
+// lib/inference-host/durable-adapter.ts
+var DURABLE_INFERENCE_ADAPTER_IDS, isDurableInferenceAdapterId, durableAdapterDisplayName;
+var init_durable_adapter = __esm({
+  "lib/inference-host/durable-adapter.ts"() {
+    "use strict";
+    DURABLE_INFERENCE_ADAPTER_IDS = [
+      "codex",
+      "copilot"
+    ];
+    isDurableInferenceAdapterId = (value) => DURABLE_INFERENCE_ADAPTER_IDS.includes(value);
+    durableAdapterDisplayName = (adapter) => ({
+      codex: "Codex",
+      copilot: "GitHub Copilot"
+    })[adapter];
+  }
+});
+
 // lib/inference-host/crypto.ts
 import {
   createCipheriv,
@@ -29371,7 +29688,7 @@ function createDefaultInferenceHostRunnerDependencies(options) {
     envelopePublicKey: options.envelopePublicKey
   };
 }
-var import_ajv, RUNTIME_RECEIPT_SCHEMA_VERSION, ATTEMPT_RECEIPT_SCHEMA_VERSION, DEFAULT_ADVERTISEMENT_TTL_MS, DEFAULT_ADVERTISEMENT_REFRESH_LEAD_MS, DEFAULT_HOST_HEARTBEAT_MS, DEFAULT_PROVIDER_RATE_LIMIT_REFRESH_MS, DEFAULT_ATTEMPT_HEARTBEAT_MS, DEFAULT_DRAIN_TIMEOUT_MS, DEFAULT_REMOTE_RETRY_LIMIT, MIN_SLEEP_MS, DEFAULT_CODEX_ACCOUNT_COOLDOWN_MS, MIN_CLAIM_START_WINDOW_MS, UNBOUNDED_AVAILABLE_SLOTS, buildCodexInferenceAdvertisedModels, summarizeInferenceHostRuntimeRecovery, FileInferenceHostRuntimeReceiptStore, InferenceHostRecoveryRequiredError, InferenceHostRunnerError, defaultSleep, abortError, defaultRegisterSignalHandlers, safeInteger, exactObjectKeys, validIso, validateAttemptReceipt, validateRuntimeReceipt, sha256, stableOperationId, buildAttemptStartRequest, isoAt, providerWeeklyQuotaFromRateLimits, finitePositiveOption, validateRunnerOptions, assertLocalCredentialIdentity, retryableRemoteError, remoteRetryAfterMs, controlPlaneFatal, defaultValidateOutput, objectRecord, positiveUtf8ByteLimit, assertCompilableOutputSchema, parseOutputContract, membershipFailureDisposition, safeFailureCode, exactJson2, runnerIdentityMismatch, assertAdvertisementResult, assertHostHeartbeatResult, assertClaimResult, assertStartResult, assertJobHeartbeatResult, assertTerminalResult, classifyFailure, ambiguousHeartbeatTransport, reportedTokenUsage, reportedUsage, InferenceHostRunner;
+var import_ajv, RUNTIME_RECEIPT_SCHEMA_VERSION, ATTEMPT_RECEIPT_SCHEMA_VERSION, DEFAULT_ADVERTISEMENT_TTL_MS, DEFAULT_ADVERTISEMENT_REFRESH_LEAD_MS, DEFAULT_HOST_HEARTBEAT_MS, DEFAULT_PROVIDER_RATE_LIMIT_REFRESH_MS, DEFAULT_ATTEMPT_HEARTBEAT_MS, DEFAULT_DRAIN_TIMEOUT_MS, DEFAULT_REMOTE_RETRY_LIMIT, MIN_SLEEP_MS, DEFAULT_CODEX_ACCOUNT_COOLDOWN_MS, MIN_CLAIM_START_WINDOW_MS, UNBOUNDED_AVAILABLE_SLOTS, buildInferenceAdvertisedModels, summarizeInferenceHostRuntimeRecovery, FileInferenceHostRuntimeReceiptStore, InferenceHostRecoveryRequiredError, InferenceHostRunnerError, defaultSleep, abortError, defaultRegisterSignalHandlers, safeInteger, exactObjectKeys, validIso, validateAttemptReceipt, validateRuntimeReceipt, sha256, stableOperationId, buildAttemptStartRequest, isoAt, providerWeeklyQuotaFromRateLimits, finitePositiveOption, validateRunnerOptions, assertLocalCredentialIdentity, retryableRemoteError, remoteRetryAfterMs, controlPlaneFatal, defaultValidateOutput, objectRecord, positiveUtf8ByteLimit, assertCompilableOutputSchema, parseOutputContract, membershipFailureDisposition, safeFailureCode, exactJson2, runnerIdentityMismatch, assertAdvertisementResult, assertHostHeartbeatResult, assertClaimResult, assertStartResult, assertJobHeartbeatResult, assertTerminalResult, classifyFailure, ambiguousHeartbeatTransport, reportedTokenUsage, reportedUsage, InferenceHostRunner;
 var init_runner = __esm({
   "lib/inference-host/runner.ts"() {
     "use strict";
@@ -29396,18 +29713,18 @@ var init_runner = __esm({
     DEFAULT_CODEX_ACCOUNT_COOLDOWN_MS = 5 * 60 * 1e3;
     MIN_CLAIM_START_WINDOW_MS = 5e3;
     UNBOUNDED_AVAILABLE_SLOTS = Number.MAX_SAFE_INTEGER;
-    buildCodexInferenceAdvertisedModels = (capabilities, adapterRuntimeVersion) => {
+    buildInferenceAdvertisedModels = (capabilities, adapterRuntimeVersion, adapter = "codex", structuredOutput = true, sameAttemptRecovery = adapter === "codex") => {
       const visible = capabilities.filter((capability) => !capability.hidden);
       if (visible.length === 0 || visible.length > 64) {
         throw new InferenceHostRunnerError(
           "invalid_configuration",
-          visible.length === 0 ? "Codex did not return any visible models that VTX can advertise." : "Codex returned more models than the VTX advertisement contract can represent."
+          visible.length === 0 ? `${adapter} did not return any visible models that VTX can advertise.` : `${adapter} returned more models than the VTX advertisement contract can represent.`
         );
       }
       const models = visible.map((capability) => ({
         model_id: capability.model,
         label: capability.displayName,
-        adapter: "codex",
+        adapter,
         supported_lanes: ["main", "review", "screener"],
         supported_reasoning_efforts: [...capability.supportedReasoningEfforts],
         default_reasoning_effort: capability.defaultReasoningEffort,
@@ -29416,14 +29733,14 @@ var init_runner = __esm({
           requested_model: capability.model,
           effective_models: [capability.model]
         }],
-        structured_output: true,
-        same_attempt_recovery: true,
+        structured_output: structuredOutput,
+        same_attempt_recovery: sameAttemptRecovery,
         adapter_runtime_version: adapterRuntimeVersion
       }));
       if (new Set(models.map((model) => model.model_id)).size !== models.length) {
         throw new InferenceHostRunnerError(
           "invalid_configuration",
-          "Codex returned duplicate runtime model identities."
+          `${adapter} returned duplicate runtime model identities.`
         );
       }
       return models;
@@ -29699,6 +30016,10 @@ var init_runner = __esm({
       return result2;
     };
     validateRunnerOptions = (options) => {
+      const adapterId = options.adapterId ?? "codex";
+      if (!/^[a-z0-9][a-z0-9._-]{0,63}$/u.test(adapterId)) {
+        throw new InferenceHostRunnerError("invalid_configuration", "Inference adapter ID is invalid.");
+      }
       if (!options.displayName.trim() || options.displayName.length > 128) {
         throw new InferenceHostRunnerError("invalid_configuration", "Inference host display name is invalid.");
       }
@@ -29722,9 +30043,15 @@ var init_runner = __esm({
         );
       }
       return {
-        advertisedModels: buildCodexInferenceAdvertisedModels(
+        adapterId,
+        usageSource: options.usageSource ?? (adapterId === "codex" ? "codex_app_server" : adapterId),
+        sameAttemptRecovery: options.sameAttemptRecovery ?? adapterId === "codex",
+        advertisedModels: buildInferenceAdvertisedModels(
           options.codexModelCapabilities,
-          options.adapterRuntimeVersion
+          options.adapterRuntimeVersion,
+          adapterId,
+          options.structuredOutput ?? adapterId === "codex",
+          options.sameAttemptRecovery ?? adapterId === "codex"
         ),
         maxConcurrency: options.maxConcurrency === null || options.maxConcurrency === void 0 ? null : finitePositiveOption(options.maxConcurrency, 1, "Maximum concurrency"),
         advertisementTtlMs,
@@ -29929,12 +30256,12 @@ var init_runner = __esm({
     };
     assertAdvertisementResult = (advertisement, result2) => {
       const host = result2.host;
-      if (host.host_id !== advertisement.host_id || host.host_generation !== advertisement.host_generation || host.advertisement_generation !== advertisement.advertisement_generation || host.key_generation !== advertisement.key_generation || host.display_name !== advertisement.display_name || host.authenticated_account_email !== void 0 && host.authenticated_account_email !== null && host.authenticated_account_email !== advertisement.authenticated_account_email || (host.authenticated_account_plan ?? null) !== (advertisement.authenticated_account_plan ?? null) || host.adapter !== advertisement.adapter || host.status === "revoked" || !exactJson2(host.models, advertisement.models)) runnerIdentityMismatch("Host advertisement");
+      if (host.host_id !== advertisement.host_id || host.host_generation !== advertisement.host_generation || host.advertisement_generation !== advertisement.advertisement_generation || host.key_generation !== advertisement.key_generation || host.display_name !== advertisement.display_name || host.authenticated_account_identity !== void 0 && host.authenticated_account_identity !== null && host.authenticated_account_identity !== advertisement.authenticated_account_identity || host.authenticated_account_email !== void 0 && host.authenticated_account_email !== null && host.authenticated_account_email !== advertisement.authenticated_account_email || (host.authenticated_account_plan ?? null) !== (advertisement.authenticated_account_plan ?? null) || host.adapter !== advertisement.adapter || host.status === "revoked" || !exactJson2(host.models, advertisement.models)) runnerIdentityMismatch("Host advertisement");
     };
-    assertHostHeartbeatResult = (request, result2, allowOfflineProjection = false) => {
+    assertHostHeartbeatResult = (request, result2, expectedAdapter, allowOfflineProjection = false) => {
       const expectedStatus = request.status === "healthy" ? "online" : request.status;
       const expectedTemporaryOffline = allowOfflineProjection && request.status === "healthy" && result2.host.status === "offline";
-      if (result2.host.host_id !== request.host_id || result2.host.host_generation !== request.host_generation || result2.host.advertisement_generation !== request.advertisement_generation || result2.host.key_generation !== request.key_generation || result2.host.adapter !== "codex" || result2.host.status !== expectedStatus && !expectedTemporaryOffline) runnerIdentityMismatch("Host heartbeat");
+      if (result2.host.host_id !== request.host_id || result2.host.host_generation !== request.host_generation || result2.host.advertisement_generation !== request.advertisement_generation || result2.host.key_generation !== request.key_generation || result2.host.adapter !== expectedAdapter || result2.host.status !== expectedStatus && !expectedTemporaryOffline) runnerIdentityMismatch("Host heartbeat");
     };
     assertClaimResult = (request, result2) => {
       if (result2.claim_request_id !== request.claim_request_id) {
@@ -30010,10 +30337,10 @@ var init_runner = __esm({
         "authentication_timeout"
       ].includes(code);
     };
-    reportedTokenUsage = (usage) => ({
+    reportedTokenUsage = (usage, source = "codex_app_server") => ({
       schema_version: EXTERNAL_INFERENCE_USAGE_SCHEMA_VERSION,
       availability: "reported",
-      source: "codex_app_server",
+      source,
       input_tokens: usage.inputTokens,
       cached_input_tokens: usage.cachedInputTokens,
       output_tokens: usage.outputTokens,
@@ -30022,7 +30349,7 @@ var init_runner = __esm({
       cache_write_input_tokens: usage.cacheWriteInputTokens,
       cache_write_support: usage.cacheWriteSupported ? "reported" : "unsupported"
     });
-    reportedUsage = (result2) => reportedTokenUsage(result2.usage);
+    reportedUsage = (result2, source) => reportedTokenUsage(result2.usage, source);
     InferenceHostRunner = class {
       constructor(dependencies, options) {
         this.receiptWriteChain = Promise.resolve();
@@ -30252,8 +30579,9 @@ var init_runner = __esm({
                 host_generation: localState.host_generation,
                 advertisement_generation: generation,
                 key_generation: localState.key_generation,
-                adapter: "codex",
+                adapter: settings.adapterId,
                 display_name: this.options.displayName.trim(),
+                ...this.options.authenticatedAccountIdentity ? { authenticated_account_identity: this.options.authenticatedAccountIdentity } : {},
                 authenticated_account_email: this.options.authenticatedAccountEmail ?? null,
                 authenticated_account_plan: this.options.authenticatedAccountPlan ?? null,
                 protocol_version: this.options.protocolVersion,
@@ -30362,7 +30690,7 @@ var init_runner = __esm({
               }
               throw error48;
             }
-            assertHostHeartbeatResult(request, result2, allowOfflineProjection);
+            assertHostHeartbeatResult(request, result2, settings.adapterId, allowOfflineProjection);
             if (result2.host.status === "revoked" || result2.host.status === "offline" && !allowOfflineProjection) {
               const error48 = new InferenceHostRunnerError(
                 result2.host.status === "revoked" ? "host_revoked" : "host_offline",
@@ -30806,6 +31134,9 @@ var init_runner = __esm({
           signal,
           now
         } = options;
+        const adapterId = this.options.adapterId ?? "codex";
+        const usageSource = this.options.usageSource ?? (adapterId === "codex" ? "codex_app_server" : adapterId);
+        const sameAttemptRecovery = this.options.sameAttemptRecovery ?? adapterId === "codex";
         const decryptClaim = this.dependencies.decryptClaim ?? decryptExternalInferenceClaim;
         const sealCandidate = this.dependencies.sealCandidate ?? sealExternalInferenceCandidate;
         const validateOutput = this.dependencies.validateOutput ?? defaultValidateOutput;
@@ -30982,6 +31313,15 @@ var init_runner = __esm({
             phase: "dispatched",
             dispatch_outcome: "outcome_unknown"
           });
+          if (options.resumeReceipt?.phase === "dispatched" && !sameAttemptRecovery) {
+            throw new CodexAppServerError({
+              message: `${adapterId} cannot prove the exact result of the interrupted attempt.`,
+              category: "adapter",
+              code: "same_attempt_recovery_unavailable",
+              retryable: false,
+              dispatchOutcome: "outcome_unknown"
+            });
+          }
           adapterResult = await this.dependencies.codexAdapter.runAttempt({
             attemptId,
             inputSha256: jobInput.input_sha256,
@@ -31007,7 +31347,7 @@ var init_runner = __esm({
           } catch (error48) {
             throw new InferenceHostRunnerError(
               "invalid_structured_output",
-              "Codex did not return valid structured JSON.",
+              `${adapterId} did not return valid structured JSON.`,
               { cause: error48 }
             );
           }
@@ -31019,7 +31359,7 @@ var init_runner = __esm({
             if (Buffer.byteLength(adapterResult.text, "utf8") > outputContract.providerResponseTextMaxUtf8Bytes) {
               throw new InferenceHostRunnerError(
                 "output_schema_response_text_too_large",
-                "Codex response text exceeds the immutable provider-response UTF-8 byte limit."
+                `${adapterId} response text exceeds the immutable provider-response UTF-8 byte limit.`
               );
             }
             if (outputContract.providerReasoningContentSupported && outputContract.providerReasoningContentMaxUtf8Bytes !== null && adapterResult.reasoningContent !== null && Buffer.byteLength(adapterResult.reasoningContent, "utf8") > outputContract.providerReasoningContentMaxUtf8Bytes) {
@@ -31092,7 +31432,7 @@ var init_runner = __esm({
               adapter_request_id: adapterResult.adapterRequestId,
               adapter_response_id: adapterResult.adapterResponseId
             },
-            usage: reportedUsage(adapterResult),
+            usage: reportedUsage(adapterResult, usageSource),
             outcome: {
               dispatch_outcome: "confirmed_dispatched",
               response_outcome: "completed"
@@ -31207,7 +31547,7 @@ var init_runner = __esm({
               adapter_request_id: canReportEffective ? adapterResult?.adapterRequestId ?? null : null,
               adapter_response_id: canReportEffective ? adapterResult?.adapterResponseId ?? null : null
             },
-            usage: adapterResult ? reportedUsage(adapterResult) : error48 instanceof CodexAppServerError && error48.usage ? reportedTokenUsage(error48.usage) : null,
+            usage: adapterResult ? reportedUsage(adapterResult, usageSource) : error48 instanceof CodexAppServerError && error48.usage ? reportedTokenUsage(error48.usage, usageSource) : null,
             failure_category: failure.category,
             failure_code: failure.code,
             retryable: failure.retryable,
@@ -31274,7 +31614,7 @@ var init_runner = __esm({
         if (result2.requestedModel !== jobInput.requested_model || result2.requestedReasoningEffort !== jobInput.requested_reasoning_effort || !mapping?.effective_models.includes(result2.effectiveModel) || !jobInput.allowed_effective_reasoning_efforts.includes(result2.effectiveReasoningEffort)) {
           throw new InferenceHostRunnerError(
             "effective_model_mismatch",
-            "Codex effective model provenance did not match the immutable allowance."
+            "The effective adapter model provenance did not match the immutable allowance."
           );
         }
       }
@@ -31286,13 +31626,14 @@ var init_runner = __esm({
 import { spawn as spawn6 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { createWriteStream, readFileSync } from "node:fs";
-import { access as access3, chmod as chmod3, mkdir as mkdir3, readFile as readFile5, rm as rm4, writeFile as writeFile2 } from "node:fs/promises";
+import { access as access3, chmod as chmod3, mkdir as mkdir3, readFile as readFile5, rm as rm5, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
+import { dirname as dirname4, join as join6, resolve as resolve4 } from "node:path";
 var SERVICE_NAME, SYSTEMD_UNIT, LAUNCHD_LABEL, SERVICE_COOPERATIVE_STOP_SECONDS, INFERENCE_HOST_SERVICE_DRAIN_COMMAND, inferenceHostServiceChildEnvironment, isWindowsSubsystemForLinux, inferenceHostServiceManifestPath, inferenceHostServiceDesiredPath, inferenceHostServiceLogPath, inferenceHostServiceRuntimePath, xmlEscape, plistEscape, systemdQuote, defaultRunCommand, managerName, assertRuntimeEnvironment, withoutConcurrencyLimit, assertServicePath, manifestGeneration, assertWorker, assertManifest, assertServiceRuntimeState, assertDesiredState, readInferenceHostServiceManifest, readManifestAcrossAtomicReplacement, readInferenceHostServiceRuntime, readRuntimeAcrossAtomicReplacement, readInferenceHostServiceDesired, readDesiredAcrossAtomicReplacement, writeDesired, runtimeEnvironment, serviceArguments, windowsOwnedCommandLine, vbScriptString, windowsServiceLauncher, windowsTaskXml, systemdUnit, launchAgentPlist, sameWorker, sameServiceDefinition, sameWorkerSet, InferenceHostServiceManager, appendServiceLog, spawnInferenceHostServiceChild, runInferenceHostServiceSupervisor;
 var init_service = __esm({
   "lib/inference-host/service.ts"() {
     "use strict";
+    init_durable_adapter();
     init_config();
     SERVICE_NAME = "VTX Macro Inference Host";
     SYSTEMD_UNIT = "vtx-inference-host.service";
@@ -31381,14 +31722,15 @@ var init_service = __esm({
         throw new Error("Inference-host service worker is invalid.");
       }
       const record2 = value;
-      if (typeof record2.instance_name !== "string" || !/^[a-z0-9](?:[a-z0-9-]{0,46}[a-z0-9])?$/u.test(record2.instance_name) || record2.adapter !== "codex" || typeof record2.display_name !== "string" || !record2.display_name || record2.max_concurrency !== null && (!Number.isSafeInteger(record2.max_concurrency) || Number(record2.max_concurrency) < 1) || record2.authenticated_account_email !== null && typeof record2.authenticated_account_email !== "string" || record2.authenticated_account_plan !== null && typeof record2.authenticated_account_plan !== "string") {
+      if (typeof record2.instance_name !== "string" || !/^[a-z0-9](?:[a-z0-9-]{0,46}[a-z0-9])?$/u.test(record2.instance_name) || typeof record2.adapter !== "string" || !isDurableInferenceAdapterId(record2.adapter) || typeof record2.display_name !== "string" || !record2.display_name || record2.max_concurrency !== null && (!Number.isSafeInteger(record2.max_concurrency) || Number(record2.max_concurrency) < 1) || record2.authenticated_account_email !== null && typeof record2.authenticated_account_email !== "string" || record2.authenticated_account_identity !== void 0 && record2.authenticated_account_identity !== null && typeof record2.authenticated_account_identity !== "string" || record2.authenticated_account_plan !== null && typeof record2.authenticated_account_plan !== "string") {
         throw new Error("Inference-host service worker is invalid.");
       }
       return {
         instance_name: record2.instance_name,
-        adapter: "codex",
+        adapter: record2.adapter,
         display_name: record2.display_name,
         max_concurrency: record2.max_concurrency === null ? null : Number(record2.max_concurrency),
+        authenticated_account_identity: record2.authenticated_account_identity,
         authenticated_account_email: record2.authenticated_account_email,
         authenticated_account_plan: record2.authenticated_account_plan,
         runtime_environment: assertRuntimeEnvironment(record2.runtime_environment)
@@ -31755,8 +32097,8 @@ WantedBy=default.target
       }
       definitionPath() {
         if (this.platform === "win32") return `${this.config.supervisorStatePath}.service-task.xml`;
-        if (this.platform === "darwin") return join5(this.home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-        return join5(this.home, ".config", "systemd", "user", SYSTEMD_UNIT);
+        if (this.platform === "darwin") return join6(this.home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+        return join6(this.home, ".config", "systemd", "user", SYSTEMD_UNIT);
       }
       windowsLauncherPath() {
         return `${this.config.supervisorStatePath}.service-launcher.vbs`;
@@ -31938,13 +32280,13 @@ ${cleanup.stderr}`)) {
               );
             }
           }
-          await rm4(this.definitionPath(), { force: true }).catch(() => void 0);
+          await rm5(this.definitionPath(), { force: true }).catch(() => void 0);
           if (this.platform === "win32") {
-            await rm4(this.windowsLauncherPath(), { force: true }).catch(() => void 0);
+            await rm5(this.windowsLauncherPath(), { force: true }).catch(() => void 0);
           }
-          await rm4(this.manifestPath(), { force: true }).catch(() => void 0);
-          await rm4(this.desiredPath(), { force: true }).catch(() => void 0);
-          await rm4(this.runtimePath(), { force: true }).catch(() => void 0);
+          await rm5(this.manifestPath(), { force: true }).catch(() => void 0);
+          await rm5(this.desiredPath(), { force: true }).catch(() => void 0);
+          await rm5(this.runtimePath(), { force: true }).catch(() => void 0);
           if (this.platform === "linux") {
             await this.runCommand("systemctl", ["--user", "daemon-reload"]).catch(() => void 0);
           }
@@ -32040,18 +32382,31 @@ ${cleanup.stderr}`)) {
       }
       async installUnlocked(options) {
         const existing = await readInferenceHostServiceManifest(this.manifestPath());
+        const currentWorker = existing?.workers.find(
+          (worker) => worker.instance_name === this.config.instanceName
+        );
+        if (currentWorker && currentWorker.adapter !== options.adapter) {
+          throw new Error(
+            `Inference-host instance ${this.config.instanceName} is already bound to ${currentWorker.adapter}; install ${options.adapter} under a distinct --instance and VTX grant.`
+          );
+        }
         const normalizedEmail = options.authenticatedAccountEmail?.trim().toLowerCase() || null;
+        const normalizedAccountIdentity = options.authenticatedAccountIdentity?.trim().toLowerCase() || null;
+        const normalizedIdentity = normalizedAccountIdentity || normalizedEmail;
         const otherWorkers = existing?.workers.filter(
           (worker) => worker.instance_name !== this.config.instanceName
         ) ?? [];
-        if (otherWorkers.length > 0 && (!normalizedEmail || otherWorkers.some((worker) => !worker.authenticated_account_email))) {
+        const peerAdapterWorkers = otherWorkers.filter(
+          (worker) => worker.adapter === options.adapter
+        );
+        if (peerAdapterWorkers.length > 0 && (!normalizedIdentity || peerAdapterWorkers.some((worker) => !(worker.authenticated_account_identity || worker.authenticated_account_email)))) {
           throw new Error(
-            "Cannot prove that every installed instance uses a distinct ChatGPT subscription. Reinstall instances with live account identity before adding another."
+            `Cannot prove that every installed ${options.adapter} instance uses a distinct subscription identity.`
           );
         }
-        if (normalizedEmail && otherWorkers.some((worker) => worker.authenticated_account_email?.trim().toLowerCase() === normalizedEmail)) {
+        if (normalizedIdentity && peerAdapterWorkers.some((worker) => (worker.authenticated_account_identity || worker.authenticated_account_email)?.trim().toLowerCase() === normalizedIdentity)) {
           throw new Error(
-            "This ChatGPT subscription is already installed under another inference-host instance."
+            `This ${options.adapter} subscription is already installed under another inference-host instance.`
           );
         }
         if (this.config.credentialFilePath && otherWorkers.some((worker) => {
@@ -32072,6 +32427,7 @@ ${cleanup.stderr}`)) {
             adapter: options.adapter,
             display_name: options.displayName,
             max_concurrency: maxConcurrency,
+            ...normalizedAccountIdentity ? { authenticated_account_identity: normalizedAccountIdentity } : {},
             authenticated_account_email: normalizedEmail,
             authenticated_account_plan: options.authenticatedAccountPlan ?? null,
             runtime_environment: runtimeEnvironment(this.config, maxConcurrency)
@@ -32245,12 +32601,14 @@ ${result2.stderr}`)) {
           manager_active: managerActive,
           manager: managerName(this.platform),
           manager_state: result2.exitCode === 0 ? output3 || "installed" : "not-installed",
-          adapter: manifest ? "codex" : null,
+          adapter: manifest && new Set(manifest.workers.map((worker) => worker.adapter)).size === 1 ? manifest.workers[0]?.adapter ?? null : null,
           log_path: manifest?.log_path ?? this.logPath(),
           workers: manifest?.workers.map((worker) => ({
             instance_name: worker.instance_name,
+            adapter: worker.adapter,
             display_name: worker.display_name,
             max_concurrency: worker.max_concurrency,
+            authenticated_account_identity: worker.authenticated_account_identity ?? null,
             authenticated_account_email: worker.authenticated_account_email,
             authenticated_account_plan: worker.authenticated_account_plan,
             runtime_state: runtime?.manifest_generation === manifest.generation && managerActive ? runtime.workers.find((item) => item.instance_name === worker.instance_name)?.state ?? "unknown" : "unknown"
@@ -32314,12 +32672,12 @@ ${result2.stderr}`)) {
 ${result2.stderr}`)) {
           throw new Error(`Background service uninstall failed: ${result2.stderr.trim()}`);
         }
-        await rm4(this.definitionPath(), { force: true });
-        if (this.platform === "win32") await rm4(this.windowsLauncherPath(), { force: true });
+        await rm5(this.definitionPath(), { force: true });
+        if (this.platform === "win32") await rm5(this.windowsLauncherPath(), { force: true });
         if (this.platform === "linux") await this.runCommand("systemctl", ["--user", "daemon-reload"]);
-        await rm4(this.manifestPath(), { force: true });
-        await rm4(this.desiredPath(), { force: true });
-        await rm4(this.runtimePath(), { force: true });
+        await rm5(this.manifestPath(), { force: true });
+        await rm5(this.desiredPath(), { force: true });
+        await rm5(this.runtimePath(), { force: true });
         return {
           installed: false,
           desired_running: false,
@@ -32348,6 +32706,8 @@ ${result2.stderr}`)) {
         "inference-host",
         "run",
         "--json",
+        "--adapter",
+        worker.adapter,
         "--display-name",
         worker.display_name
       ];
@@ -32460,7 +32820,7 @@ ${result2.stderr}`)) {
       });
       const launch = options.runWorker ?? options.spawnChild ?? spawnInferenceHostServiceChild;
       await appendServiceLog(initialManifest.log_path, "service_supervisor_started", {
-        adapter: "codex",
+        adapters: [...new Set(initialManifest.workers.map((worker) => worker.adapter))].sort(),
         instances: initialManifest.workers.map((worker) => worker.instance_name)
       });
       const workers = /* @__PURE__ */ new Map();
@@ -32681,8 +33041,8 @@ __export(cli_exports, {
 });
 import { createHash as createHash7, randomUUID as randomUUID2 } from "node:crypto";
 import { spawn as spawn7 } from "node:child_process";
-import { lstat as lstat4, realpath as realpath4, rm as rm5 } from "node:fs/promises";
-import { join as join6, resolve as resolve5 } from "node:path";
+import { lstat as lstat4, realpath as realpath4, rm as rm6 } from "node:fs/promises";
+import { join as join7, resolve as resolve5 } from "node:path";
 async function runInferenceHostCli(argv2, env = process.env, dependencies = {}) {
   const warnings = [];
   try {
@@ -32783,7 +33143,7 @@ async function runInferenceHostCli(argv2, env = process.env, dependencies = {})
     };
   }
 }
-var INFERENCE_HOST_CLI_VERSION, runtimeReceiptPath, codexRecoveryPath, codexGuardianReceiptRoot, revocationCheckpointPath, foregroundHostLockPath, credentialLifecycleLockPath, serviceRecoveryCommandLockPath, AGENT_HEARTBEAT_INTERVAL_MS, AGENT_HEARTBEAT_MAX_RETRY_DELAY_MS, retryableAgentHeartbeatError, assertRevocationCheckpoint, readRevocationCheckpoint, writeRevocationCheckpoint, clearRevocationCheckpoint, render, INFERENCE_HOST_HELP, parseHostConcurrency, parseInferenceHostArgs, defaultOpenBrowser, registerInferenceHostServiceControlInput, defaultRegisterLifecycleSignalHandlers, lifecycleCancellation, configuredCredentialStore, restoreInferenceHostCredentialContext, recoverInferenceHostCredentialContextTransition, accountKeyForState, assertCredentialMatchesState2, revocationCheckpointForCredential, assertRevocationCheckpointMatchesLocalIdentity, fileExistsPrivately, inspectCodexAuthentication, clearLocalRuntimeArtifacts, assertDurableServiceUninstalled, assertLocalRuntimeArtifactsMayBeDiscarded, defaultRunForeground, login, codexLogin, codexLogout, localStatus, doctor, cleanupLogin, runHost, defaultReadStdin, parseAgentStdin, agentOperationId, agentSession, agentConnect, agentRun, agentNext, agentComplete, agentFail, withAgentCommandLock, recoveryBackupPath, serviceRecoveryTransactionPath, readServiceRecoveryTransaction, assertResumableCodexRecoveryEvidence, recoverInstalledCodexService, serviceCommand, hasExplicitCredentialStoreConfiguration, credentialEnvironmentForIdentity, commandRequiresRetainedCredentialStore, commandUsesInstalledServiceCredentials, resolveInferenceHostCommandConfig;
+var INFERENCE_HOST_CLI_VERSION, runtimeReceiptPath, codexRecoveryPath, codexGuardianReceiptRoot, revocationCheckpointPath, foregroundHostLockPath, credentialLifecycleLockPath, serviceRecoveryCommandLockPath, AGENT_HEARTBEAT_INTERVAL_MS, AGENT_HEARTBEAT_MAX_RETRY_DELAY_MS, retryableAgentHeartbeatError, assertRevocationCheckpoint, readRevocationCheckpoint, writeRevocationCheckpoint, clearRevocationCheckpoint, render, INFERENCE_HOST_HELP, parseHostConcurrency, parseInferenceHostArgs, defaultOpenBrowser, registerInferenceHostServiceControlInput, defaultRegisterLifecycleSignalHandlers, lifecycleCancellation, configuredCredentialStore, restoreInferenceHostCredentialContext, recoverInferenceHostCredentialContextTransition, accountKeyForState, assertCredentialMatchesState2, revocationCheckpointForCredential, assertRevocationCheckpointMatchesLocalIdentity, fileExistsPrivately, inspectCodexAuthentication, clearLocalRuntimeArtifacts, assertDurableServiceUninstalled, assertLocalRuntimeArtifactsMayBeDiscarded, defaultRunForeground, preparePortableDurableAdapter, defaultRunPortableDurableAdapter, login, codexLogin, codexLogout, localStatus, doctor, cleanupLogin, runHost, defaultReadStdin, parseAgentStdin, agentOperationId, agentSession, agentConnect, agentRun, agentNext, agentComplete, agentFail, withAgentCommandLock, recoveryBackupPath, serviceRecoveryTransactionPath, readServiceRecoveryTransaction, assertResumableCodexRecoveryEvidence, recoverInstalledCodexService, serviceCommand, hasExplicitCredentialStoreConfiguration, credentialEnvironmentForIdentity, commandRequiresRetainedCredentialStore, commandUsesInstalledServiceCredentials, resolveInferenceHostCommandConfig;
 var init_cli = __esm({
   "lib/inference-host/cli.ts"() {
     "use strict";
@@ -32793,6 +33153,8 @@ var init_cli = __esm({
     init_agent_state();
     init_codex_adapter();
     init_codex_recovery_process();
+    init_copilot_adapter();
+    init_durable_adapter();
     init_codex_app_server();
     init_codex_binary();
     init_config();
@@ -32875,7 +33237,7 @@ var init_cli = __esm({
 Commands:
   login           Authorize the isolated VTX insights:inference grant
   codex-login     Sign the automated Codex host into a ChatGPT subscription
-  run             Run the automated Codex inference host in the foreground
+  run             Run a supported durable inference adapter in the foreground
   agent-connect   Advertise a model from a compatible agent harness
   agent-run       Keep an agent-driven host online in the foreground
   agent-next      Claim the next exact VTX inference request
@@ -32883,7 +33245,7 @@ Commands:
   agent-fail      Submit one truthful agent failure from stdin
   service         Install and control the durable background host
   status          Inspect local host and credential state
-  doctor          Verify credentials, Codex, and private runtime state
+  doctor          Verify credentials, provider runtime, and private state
   logout          Remove local VTX host state without revoking the grant
   revoke          Revoke the VTX grant and remove local host state
   codex-logout    Remove the automated host's dedicated Codex login
@@ -32891,7 +33253,8 @@ Commands:
 Common options:
   --json           Emit machine-readable JSON
   --instance NAME  Target an isolated local subscription instance (default: default)
-  --max-concurrency N  Optional positive-integer Codex slot limit (default: unlimited)
+  --adapter ID     Durable adapter: codex or copilot
+  --max-concurrency N  Optional positive-integer local slot limit (default: unlimited)
   --help, -h       Show this help
 
 If the OS credential store cannot retain the VTX grant, set
@@ -32905,6 +33268,7 @@ Durable service:
   vtx inference-host login --instance codex-2
   vtx inference-host codex-login --instance codex-2
   vtx inference-host service install --instance codex-2
+  vtx inference-host service install --adapter copilot --instance copilot-1
   vtx inference-host service uninstall --instance codex-2
   vtx inference-host service recover --instance codex-1 --force-recovery
   vtx inference-host service <start|stop|status|logs|recover|uninstall>
@@ -33010,6 +33374,8 @@ Durable service:
       }
       if (command === "agent-connect" && !displayNameExplicit) {
         displayName = "Agent-driven inference host";
+      } else if (adapter && isDurableInferenceAdapterId(adapter) && !displayNameExplicit) {
+        displayName = `${durableAdapterDisplayName(adapter)} subscription host`;
       }
       return {
         command,
@@ -33154,7 +33520,7 @@ Durable service:
       return raw !== null;
     };
     inspectCodexAuthentication = async (config2) => {
-      const path = join6(config2.codexHomePath, "auth.json");
+      const path = join7(config2.codexHomePath, "auth.json");
       try {
         const before = await lstat4(path);
         const canonical = await realpath4(path);
@@ -33172,7 +33538,7 @@ Durable service:
         runtimeReceiptPath(config2),
         "Inference host runtime receipt file"
       );
-      await rm5(codexGuardianReceiptRoot(config2), { recursive: true, force: true });
+      await rm6(codexGuardianReceiptRoot(config2), { recursive: true, force: true });
       await clearInferencePrivateFile(
         codexRecoveryPath(config2),
         "Codex attempt recovery file"
@@ -33254,6 +33620,49 @@ Durable service:
         signal: options.signal
       }).run();
     };
+    preparePortableDurableAdapter = async (adapterId, signal) => {
+      const adapter = new CopilotSubscriptionAdapter();
+      return { adapter, preflight: await adapter.preflight(signal) };
+    };
+    defaultRunPortableDurableAdapter = async (options) => {
+      const dependencies = createDefaultInferenceHostRunnerDependencies({
+        apiUrl: options.config.apiUrl,
+        statePath: options.config.statePath,
+        processLockPath: options.config.processLockPath,
+        credentialStore: options.credentialStore,
+        codexAdapter: options.adapter,
+        envelopePublicKey: (credential) => externalInferenceEnvelopePublicKey(credential.x25519_private_key),
+        clientVersion: INFERENCE_HOST_CLI_VERSION,
+        runtimeReceiptPath: runtimeReceiptPath(options.config)
+      });
+      const borrowedProcessLock = {
+        path: options.processLock.path,
+        ownerToken: options.processLock.ownerToken,
+        release: async () => void 0
+      };
+      return await new InferenceHostRunner({
+        ...dependencies,
+        acquireProcessLock: async () => borrowedProcessLock
+      }, {
+        adapterId: options.preflight.adapterId,
+        usageSource: options.preflight.adapterId,
+        structuredOutput: false,
+        sameAttemptRecovery: options.preflight.sameAttemptRecovery,
+        instanceName: options.config.instanceName,
+        displayName: options.displayName,
+        authenticatedAccountIdentity: options.preflight.authenticatedAccountIdentity,
+        authenticatedAccountEmail: options.preflight.authenticatedAccountEmail,
+        authenticatedAccountPlan: options.preflight.authenticatedAccountPlan,
+        codexRateLimits: options.preflight.rateLimits,
+        codexModelCapabilities: options.preflight.modelCapabilities,
+        protocolVersion: EXTERNAL_INFERENCE_CONTRACT_VERSION,
+        adapterRuntimeVersion: options.preflight.runtimeVersion,
+        maxConcurrency: options.maxConcurrency,
+        once: options.once,
+        emitDiagnosticEvent: options.emitDiagnosticEvent,
+        signal: options.signal
+      }).run();
+    };
     login = async (config2, parsed, env, dependencies, warnings) => {
       const credentialLock = await acquireInferenceHostProcessLock(
         credentialLifecycleLockPath(config2)
@@ -33601,6 +34010,35 @@ Waiting for approval...
           detail: error48 instanceof Error ? error48.message : "unavailable"
         });
       }
+      const adapterId = parsed.adapter ?? "codex";
+      if (!isDurableInferenceAdapterId(adapterId)) {
+        checks.push({ name: "provider_runtime", ok: false, detail: "unsupported-adapter" });
+      } else if (adapterId !== "codex") {
+        try {
+          const prepared = await (dependencies.prepareDurableAdapter ?? preparePortableDurableAdapter)(
+            adapterId
+          );
+          checks.push({
+            name: "provider_runtime",
+            ok: true,
+            detail: `${adapterId}:${prepared.preflight.runtimeVersion}:${prepared.preflight.modelCapabilities.length}-models`
+          });
+          await prepared.adapter.close?.();
+        } catch (error48) {
+          checks.push({
+            name: "provider_runtime",
+            ok: false,
+            detail: error48 instanceof Error ? error48.message : "unavailable"
+          });
+        }
+        const healthy2 = checks.every((check2) => check2.ok);
+        return {
+          exitCode: healthy2 ? 0 : 1,
+          stdout: render({ healthy: healthy2, adapter: adapterId, checks, source: "local_only" }, parsed.json),
+          stderr: warnings.length > 0 ? `${warnings.join("\n")}
+` : ""
+        };
+      }
       try {
         const binary = await (dependencies.resolveBinary ?? resolvePinnedCodexBinary)(env);
         checks.push({
@@ -33817,6 +34255,37 @@ Waiting for approval...
         if (await store.readRecovery?.()) {
           throw new Error("Inference host credential recovery is required before the runner can start.");
         }
+        const adapterId = parsed.adapter ?? "codex";
+        if (!isDurableInferenceAdapterId(adapterId)) {
+          throw new Error(`Adapter ${adapterId} does not have a supported durable integration.`);
+        }
+        const emitDiagnosticEvent = parsed.json ? (event) => (dependencies.emitStdout ?? ((text) => {
+          process.stdout.write(text);
+        }))(`${JSON.stringify(event)}
+`) : void 0;
+        if (adapterId !== "codex") {
+          const prepared = await (dependencies.prepareDurableAdapter ?? preparePortableDurableAdapter)(
+            adapterId,
+            cancellation.signal
+          );
+          const summary = await (dependencies.runPortableDurableAdapter ?? defaultRunPortableDurableAdapter)({
+            config: config2,
+            credentialStore: store,
+            ...prepared,
+            displayName: parsed.displayName,
+            maxConcurrency: parsed.maxConcurrency,
+            once: parsed.once,
+            processLock,
+            emitDiagnosticEvent,
+            signal: cancellation.signal
+          });
+          return {
+            exitCode: 0,
+            stdout: render({ status: "stopped", ...summary }, parsed.json),
+            stderr: warnings.length > 0 ? `${warnings.join("\n")}
+` : ""
+          };
+        }
         const verifiedBinary = await (dependencies.resolveBinary ?? resolvePinnedCodexBinary)(env);
         cancellation.signal.throwIfAborted();
         await reconcileCodexAttemptRecovery({
@@ -33847,10 +34316,7 @@ Waiting for approval...
             once: parsed.once,
             env,
             processLock,
-            emitDiagnosticEvent: parsed.json ? (event) => (dependencies.emitStdout ?? ((text) => {
-              process.stdout.write(text);
-            }))(`${JSON.stringify(event)}
-`) : void 0,
+            emitDiagnosticEvent,
             signal: cancellation.signal
           });
           return {
@@ -34399,6 +34865,17 @@ Waiting for approval...
         credentialLifecycleLockPath(config2)
       );
       try {
+        const installedManifest = await readInferenceHostServiceManifest(
+          `${config2.supervisorStatePath}.service.json`
+        );
+        const installedWorker = installedManifest?.workers.find(
+          (worker) => worker.instance_name === config2.instanceName
+        );
+        if (installedWorker && installedWorker.adapter !== "codex") {
+          throw new Error(
+            `Guarded same-attempt recovery is not supported for ${installedWorker.adapter}; interrupted attempts remain quarantined as outcome_unknown.`
+          );
+        }
         const recoveryStore = new FileCodexAttemptRecoveryStore(codexRecoveryPath(config2));
         const existingTransaction = await readServiceRecoveryTransaction(config2);
         if (existingTransaction && existingTransaction.instance_name !== config2.instanceName) {
@@ -34584,7 +35061,7 @@ Waiting for approval...
               serviceRecoveryTransactionPath(config2),
               "Inference-host service recovery transaction"
             );
-            await rm5(backupPath, { force: true });
+            await rm6(backupPath, { force: true });
           }
         }
       } finally {
@@ -34648,7 +35125,7 @@ Waiting for approval...
             );
           }
           const adapter = parsed.adapter || "codex";
-          if (adapter !== "codex") {
+          if (!isDurableInferenceAdapterId(adapter)) {
             throw new Error(
               `Adapter ${adapter} does not have a supported durable service integration. Use foreground agent-run instead.`
             );
@@ -34660,7 +35137,31 @@ Waiting for approval...
           if (!credential) throw new Error("Inference-host credential is missing. Run login again.");
           assertCredentialMatchesState2(state, credential);
           if (parsed.modelId || parsed.modelLabel || parsed.reasoningEffort) {
-            throw new Error("Automated Codex service does not accept agent model or effort options.");
+            throw new Error("Durable services discover their exact model and effort catalog from the authenticated runtime.");
+          }
+          if (adapter !== "codex") {
+            const prepared = await (dependencies.prepareDurableAdapter ?? preparePortableDurableAdapter)(
+              adapter
+            );
+            try {
+              const status2 = await manager.install({
+                adapter,
+                displayName: parsed.displayName,
+                maxConcurrency: parsed.maxConcurrency,
+                authenticatedAccountIdentity: prepared.preflight.authenticatedAccountIdentity,
+                authenticatedAccountEmail: prepared.preflight.authenticatedAccountEmail,
+                authenticatedAccountPlan: prepared.preflight.authenticatedAccountPlan
+              });
+              await writeInferenceHostCredentialContext(config2);
+              return {
+                exitCode: 0,
+                stdout: render({ status: "service_installed", ...status2 }, parsed.json),
+                stderr: warnings.length > 0 ? `${warnings.join("\n")}
+` : ""
+              };
+            } finally {
+              await prepared.adapter.close?.();
+            }
           }
           const auth = await inspectCodexAuthentication(config2);
           if (!auth.present || !auth.private) {
@@ -34827,11 +35328,11 @@ Waiting for approval...
 });
 
 // lib/agent-core/config.ts
-import { mkdir as mkdir5, readFile as readFile6, rm as rm6, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname5, join as join7 } from "node:path";
+import { mkdir as mkdir5, readFile as readFile6, rm as rm7, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname5, join as join8 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 function defaultBaseDir() {
-  return join7(homedir3(), ".vtx");
+  return join8(homedir3(), ".vtx");
 }
 function resolveAgentCliConfig(env = process.env) {
   const baseDir = String(env.VTX_HOME || "").trim() || defaultBaseDir();
@@ -34839,8 +35340,8 @@ function resolveAgentCliConfig(env = process.env) {
   const parsedProfile = rawProfile ? Number(rawProfile) : NaN;
   return {
     apiUrl: String(env.VTX_API_URL || "http://localhost:8000").replace(/\/+$/, ""),
-    tokenPath: String(env.VTX_TOKEN_PATH || "").trim() || join7(baseDir, "token.json"),
-    statePath: String(env.VTX_RUNTIME_STATE_PATH || "").trim() || join7(baseDir, "runtime-state.json"),
+    tokenPath: String(env.VTX_TOKEN_PATH || "").trim() || join8(baseDir, "token.json"),
+    statePath: String(env.VTX_RUNTIME_STATE_PATH || "").trim() || join8(baseDir, "runtime-state.json"),
     runtimeDeviceId: String(env.VTX_RUNTIME_DEVICE_ID || "").trim() || null,
     activeProfileId: Number.isFinite(parsedProfile) && parsedProfile > 0 ? parsedProfile : null,
     outputJson: String(env.VTX_OUTPUT || "").trim().toLowerCase() === "json"
@@ -34871,7 +35372,7 @@ async function writeStoredAgentAuth(path, auth) {
 `, { encoding: "utf8", mode: 384 });
 }
 async function clearStoredAgentAuth(path) {
-  await rm6(path, { force: true });
+  await rm7(path, { force: true });
 }
 async function readRuntimeState(path) {
   try {
@@ -34904,7 +35405,7 @@ async function writeRuntimeState(path, state) {
 `, { encoding: "utf8", mode: 384 });
 }
 async function clearRuntimeState(path) {
-  await rm6(path, { force: true });
+  await rm7(path, { force: true });
 }
 var init_config2 = __esm({
   "lib/agent-core/config.ts"() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.8.40",
+  "version": "2026.8.42",
   "description": "VTX Macro CLI, MCP server, and durable subscription inference host.",
   "type": "module",
   "license": "UNLICENSED",
@@ -20,7 +20,9 @@
     "node": ">=20.0.0"
   },
   "dependencies": {
-    "@openai/codex": "0.147.0"
+    "@openai/codex": "0.147.0",
+    "@github/copilot-sdk": "1.0.0-beta.8",
+    "@github/copilot": "1.0.80"
   },
   "files": [
     "bin",