@vtxmacro/cli 2026.8.53 → 2026.8.55

package/README.md

@@ -10,7 +10,8 @@ vtx --version
 ```
 
 The host supports Windows x64 and Linux x64, including WSL. The package installs
-the exact supported OpenAI Codex runtime and GitHub Copilot SDK. The VTX host
+the exact supported OpenAI Codex runtime, GitHub Copilot SDK, and official
+DeepSeek Harness package wave. The VTX host
 verifies the Codex runtime's version and digest before use; it does not borrow a
 Codex binary from PATH or an editor extension.
 For Windows-login auto-start, install and configure the CLI from native Windows;
@@ -52,7 +53,7 @@ Both paths use a separate least-privilege `insights:inference` OAuth grant.
 VTX never receives an agent vendor password, OAuth token, or subscription
 credential.
 
-### Durable subscription hosts
+### Durable inference hosts
 
 Codex remains the reference implementation and its existing App Server,
 authentication, quota, recovery, and provider-mode path are unchanged. GitHub
@@ -64,9 +65,10 @@ and VTX grant. VTX resolves the package-owned pinned Copilot platform runtime
 explicitly and rejects an `auto`-only catalog because it cannot prove the
 effective model.
 
-An explicitly capable durable Codex or Copilot model can also control Main in
-**Agent** mode using the same VTX OAuth grant and its own private subscription
-login. VTX assigns the running bot but does not send a VTX-authored prompt or set
+An explicitly capable durable Codex, Copilot, or DeepSeek Harness model can also
+control Main in **Agent** mode using the same VTX OAuth grant and its own local
+adapter-specific vendor credential: ChatGPT or Copilot login, or a DeepSeek API
+key. VTX assigns the running bot but does not send a VTX-authored prompt or set
 the analysis cadence. The assigned runtime keeps a durable Agent thread,
 chooses when to wake, requests only the assignment-scoped VTX data it needs (or
 none), and submits the normal structured decision for VTX to validate and
@@ -106,6 +108,27 @@ vtx inference-host doctor --adapter copilot --instance copilot-1 --json
 vtx inference-host service install --adapter copilot --instance copilot-1
 ```
 
+For DeepSeek Harness, import the API key through stdin so it never appears in
+process arguments, then install a distinct durable instance:
+
+```bash
+vtx inference-host login --instance deepseek-1
+vtx inference-host deepseek-login --instance deepseek-1 < /private/path/deepseek.key
+vtx inference-host doctor --adapter deepseek-harness --instance deepseek-1 --json
+vtx inference-host service install --adapter deepseek-harness --instance deepseek-1
+```
+
+The DeepSeek key remains in the local OS credential store or the explicitly
+selected private-file fallback; it is never written to the service manifest or
+sent to VTX. Provider mode is tool-less. Main Agent mode uses a durable Harness
+session with only the three assignment-scoped VTX tools. Review and Screener
+remain Provider-only. An Agent dispatch whose provider outcome cannot be proved
+is durably fenced and is not repeated after a service restart. Inspect
+`status --json`, `doctor --json`, and service logs; revoke and relink the exact
+instance after reconciling an ambiguous fence. An authentication fence clears
+only after a successful replacement key import. Quota and rate-limit failures
+honor their provider retry time or a bounded local cooldown.
+
 To connect another Codex subscription to the same VTX account, repeat the
 login and service-install commands with a stable local name such as
 `--instance codex-2`. Each named instance has an isolated VTX grant, Codex
@@ -132,26 +155,31 @@ The command never kills an arbitrary process, logs either account out, changes
 VTX profile settings, or controls a Trader. If any package-owned VTX automation
 is still live, recovery fails closed and preserves its evidence.
 
-For each VTX profile and lane, **Host #1** is tried first and later compatible
-hosts follow in the saved Host cascade order. Distinct computers may use the
-same authenticated subscription; provider quota remains account-level.
-Quota/credits exhaustion can advance only to a later host reporting a different
-account identity. Unusable authentication and exhausted recoverable host failures
+For each VTX profile and lane, **Host #1** is selected. Provider-mode calls may
+continue through later compatible hosts in the saved Host cascade order. Agent
+mode keeps its durable thread and assignment on Host #1 and fences a failure
+instead of automatically transferring it. Distinct computers may use the same
+authenticated subscription; when account identity is reported, provider quota
+remains account-level and quota exhaustion skips only positively matching
+identities. Unusable authentication and exhausted recoverable Provider failures
 can advance the same logical call. VTX never changes
 provider, model, effort, or response mode, and never cascades a bad request,
 policy rejection, or uncertain dispatch outcome.
 
-Automated hosts do not impose a subscription-specific profile-count or
+Automated hosts do not impose a provider-specific profile-count or
 concurrency limit by default. Set an explicit positive integer with
-`--max-concurrency` when you want a local limit. Every active turn shares the live subscription
-rate-limit gate and cooldown; unlimited local admission does not guarantee
-capacity beyond the authenticated account's current entitlement. Updating from
+`--max-concurrency` when you want a local limit. Every active turn still
+consumes capacity from its adapter-specific provider account or API key;
+unlimited local admission does not guarantee provider capacity. Codex uses its
+reported live subscription gate and cooldown. DeepSeek Harness is API-billed and
+does not claim a stable account identity or provider rate-limit window. Updating from
 an older bounded host removes its previous numeric limit; run
 `service install --max-concurrency <positive-integer>` only to add one back.
 
 Every durable host uses a separate least-privilege `insights:inference`
 OAuth grant. Codex additionally keeps its ChatGPT subscription login in a dedicated
-private Codex home; Copilot uses its official cached user login.
+private Codex home; Copilot uses its official cached user login; DeepSeek Harness
+keeps its API key in the local VTX credential boundary.
 No vendor credential is written to the VTX service manifest. The per-user OS service starts immediately, starts again at login, and
 reconnects after sleep, network loss, or a worker exit. Stopping a VTX bot leaves
 the provider online and idle. Use `vtx inference-host run` only for foreground
@@ -177,7 +205,7 @@ confirmation page was blocked; the grant succeeded.
 
 ### Any compatible agent harness
 
-Codex, Claude Code, Cursor, GitHub Copilot, Antigravity, and other agents that can
+Codex, DeepSeek Harness, Claude Code, Cursor, GitHub Copilot, Antigravity, and other agents that can
 run shell commands can use their existing first-party session without a
 VTX-owned vendor adapter: