@vtxmacro/cli 2026.8.54 → 2026.8.56

package/bin/vtx.js

@@ -47,7 +47,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.8.54",
+      package_version: "2026.8.56",
       codex_package_name: "@openai/codex",
       codex_version: "0.147.0",
       copilot_sdk_package_name: "@github/copilot-sdk",
@@ -14442,7 +14442,7 @@ var init_zod = __esm({
 });
 
 // lib/external-inference-contract.ts
-var EXTERNAL_INFERENCE_CONTRACT_VERSION, EXTERNAL_INFERENCE_CONTROLLER_SCHEMA_VERSION, EXTERNAL_INFERENCE_CONTROLLER_SCHEMA_VERSION_V2, EXTERNAL_INFERENCE_ADVERTISEMENT_SCHEMA_VERSION, EXTERNAL_INFERENCE_ENVELOPE_SCHEMA_VERSION, EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION, LEGACY_EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION, EXTERNAL_INFERENCE_USAGE_SCHEMA_VERSION, EXTERNAL_INFERENCE_INPUT_HASH_DOMAIN, MAX_EXTERNAL_INFERENCE_STATUS_HOSTS, MAX_GENERATION, MAX_SAFE_INTEGER, MAX_PROMPT_BYTES, MAX_IMMUTABLE_JOB_INPUT_BYTES, MAX_CANDIDATE_PLAINTEXT_BYTES, MAX_CIPHERTEXT_CHARS, SHA256_INITIAL_STATE, SHA256_ROUND_CONSTANTS, rotateRight, sha256BytesHex, sha256Utf8Hex, computeImmutableJobInputSha256, identifierSchema, operationIdentifierSchema, sha256HexSchema, generationSchema, zeroBasedGenerationSchema, nonNegativeSafeIntegerSchema, positiveSafeIntegerSchema, sqlIntegerTokenCountSchema, timestampSchema, safeCodeSchema, processExitCodeSchema, externalInferenceAdapterIdSchema, reasoningEffortSchema, modelNameSchema, displayNameSchema, authenticatedAccountEmailSchema, protocolVersionSchema, base64UrlAlphabet, isCanonicalBase64Url, base64Url32BytesSchema, base64UrlNonceSchema, base64UrlCiphertextSchema, claimHandleSchema, boundedJsonTextSchema, boundedPromptTextSchema, laneSchema, botModeSchema, executionModeSchema, responseModeSchema, controlModeSchema, dispatchOutcomeSchema, responseOutcomeSchema, nativeModelControllerSchema, legacyExternalAgentModelControllerSchema, externalAgentModelControllerSchema, boundExternalAgentModelControllerSchema, externalAgentUnboundControllerSchema, externalAgentUnboundControllerV2Schema, orderedFallbackHostIdsSchema, externalInferenceFallbackHostIdsSchema, liveModelControllerSchema, snapshotModelControllerSchema, modelIdentityMappingSchema, advertisedModelSchema, hostAdvertisementSchema, envelopeAadSchema, validateEnvelopeAad, commonEnvelopeShape, sealedKeyWrapEnvelopeSchema, sealedInputEnvelopeSchema, sealedCandidateEnvelopeSchema, sealedEnvelopeSchema, screenerCandidateRuntimeBindingSchema, screenerClientLeaseBindingSchema, screenerRuntimeBindingSchema, serverRuntimeBindingSchema, clientRuntimeBindingSchema, runtimeBindingSchema, immutableJobInputSchema, canonicalizeJsonValue, serializeImmutableJobInput, reportedTokenUsageSchema, unavailableTokenUsageSchema, tokenUsageSchema, agentConnectRequestSchema, agentNextRequestSchema, agentHeartbeatRequestSchema, emptyAgentNextResultSchema, claimedAgentNextResultSchema, agentNextResultSchema, agentCompleteRequestSchema, agentFailRequestSchema, requestedModelSelectionSchema, completedModelProvenanceSchema, attemptModelProvenanceSchema, providerWeeklyQuotaReadSchema, hostHeartbeatRequestSchema, jobClaimRequestSchema, emptyJobClaimSchema, claimedJobSchema, jobClaimResultSchema, attemptStartRequestSchema, jobHeartbeatRequestSchema, continueHeartbeatDirectiveSchema, cancelHeartbeatDirectiveSchema, jobHeartbeatResultSchema, adapterOutcomeEvidenceSchema, completionBaseShape, validateCompletion, providerResponseCompletionSchema, decisionCandidateCompletionSchema, jobCompleteRequestSchema, codexProcessExitDiagnosticsSchema, jobFailRequestSchema, jobCancelRequestSchema, jobCancellationReceiptSchema, jobDeliveryRequestSchema, deliveryBaseShape, validateDeliveryCandidate, providerResponseDeliverySchema, decisionCandidateDeliverySchema, jobDeliveryResultSchema, jobConsumptionRequestSchema, jobConsumptionReceiptSchema, jobStateSchema, jobStatusReadSchema, hostStatusReadSchema, controllerBindingStatusReadSchema, queueStatusReadSchema, outcomeStatusReadSchema, externalInferenceVolumeWindowReadSchema, externalInferenceFailureCountReadSchema, externalInferenceHostDiagnosticsReadSchema, externalInferenceProfileActivityReadSchema, externalInferenceStatusReadSchema, nativeResearchEvidenceSourceSchema, externalAgentResearchEvidenceSourceSchema, researchEvidenceSourceSchema, reportedResearchTokenUsageSchema, unavailableResearchTokenUsageSchema, researchTokenUsageSchema, externalInferenceProductLineageBaseShape, traderExternalInferenceProductLineageSchema, decisionChatExternalInferenceProductLineageSchema, screenerExternalInferenceProductLineageSchema, externalInferenceProductLineageSchema, normalProductLinkageSchema, evidenceMaterializationMarkerSchema, deliveredExternalAgentSourceIdentitySchema, deliveredRequestEvidenceSchema, researchEvidenceBaseShape, researchEvidenceBaseSchema, validateExactUtf8, validateResearchEvidence, providerResponseResearchEvidenceSchema, decisionCandidateResearchEvidenceSchema, researchEvidenceSchema;
+var EXTERNAL_INFERENCE_CONTRACT_VERSION, EXTERNAL_INFERENCE_CONTROLLER_SCHEMA_VERSION, EXTERNAL_INFERENCE_CONTROLLER_SCHEMA_VERSION_V2, EXTERNAL_INFERENCE_ADVERTISEMENT_SCHEMA_VERSION, EXTERNAL_INFERENCE_ENVELOPE_SCHEMA_VERSION, EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION, LEGACY_EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION, EXTERNAL_INFERENCE_USAGE_SCHEMA_VERSION, EXTERNAL_INFERENCE_INPUT_HASH_DOMAIN, MAX_EXTERNAL_INFERENCE_STATUS_HOSTS, MAX_PROFILE_EXTERNAL_INFERENCE_FALLBACKS_PER_LANE, MAX_GENERATION, MAX_SAFE_INTEGER, MAX_PROMPT_BYTES, MAX_IMMUTABLE_JOB_INPUT_BYTES, MAX_CANDIDATE_PLAINTEXT_BYTES, MAX_CIPHERTEXT_CHARS, SHA256_INITIAL_STATE, SHA256_ROUND_CONSTANTS, rotateRight, sha256BytesHex, sha256Utf8Hex, computeImmutableJobInputSha256, identifierSchema, operationIdentifierSchema, sha256HexSchema, generationSchema, zeroBasedGenerationSchema, nonNegativeSafeIntegerSchema, positiveSafeIntegerSchema, sqlIntegerTokenCountSchema, timestampSchema, safeCodeSchema, processExitCodeSchema, externalInferenceAdapterIdSchema, reasoningEffortSchema, modelNameSchema, displayNameSchema, authenticatedAccountEmailSchema, protocolVersionSchema, base64UrlAlphabet, isCanonicalBase64Url, base64Url32BytesSchema, base64UrlNonceSchema, base64UrlCiphertextSchema, claimHandleSchema, boundedJsonTextSchema, boundedPromptTextSchema, laneSchema, botModeSchema, executionModeSchema, responseModeSchema, controlModeSchema, dispatchOutcomeSchema, responseOutcomeSchema, nativeModelControllerSchema, legacyExternalAgentModelControllerSchema, externalAgentModelControllerSchema, boundExternalAgentModelControllerSchema, externalAgentUnboundControllerSchema, externalAgentUnboundControllerV2Schema, orderedFallbackHostIdsSchema, externalInferenceFallbackHostIdsSchema, liveModelControllerSchema, snapshotModelControllerSchema, modelIdentityMappingSchema, advertisedModelSchema, hostAdvertisementSchema, envelopeAadSchema, validateEnvelopeAad, commonEnvelopeShape, sealedKeyWrapEnvelopeSchema, sealedInputEnvelopeSchema, sealedCandidateEnvelopeSchema, sealedEnvelopeSchema, screenerCandidateRuntimeBindingSchema, screenerClientLeaseBindingSchema, screenerRuntimeBindingSchema, serverRuntimeBindingSchema, clientRuntimeBindingSchema, runtimeBindingSchema, immutableJobInputSchema, canonicalizeJsonValue, serializeImmutableJobInput, reportedTokenUsageSchema, unavailableTokenUsageSchema, tokenUsageSchema, agentConnectRequestSchema, agentNextRequestSchema, agentHeartbeatRequestSchema, emptyAgentNextResultSchema, claimedAgentNextResultSchema, agentNextResultSchema, agentCompleteRequestSchema, agentFailRequestSchema, requestedModelSelectionSchema, completedModelProvenanceSchema, attemptModelProvenanceSchema, providerWeeklyQuotaReadSchema, hostHeartbeatRequestSchema, jobClaimRequestSchema, emptyJobClaimSchema, claimedJobSchema, jobClaimResultSchema, attemptStartRequestSchema, jobHeartbeatRequestSchema, continueHeartbeatDirectiveSchema, cancelHeartbeatDirectiveSchema, jobHeartbeatResultSchema, adapterOutcomeEvidenceSchema, completionBaseShape, validateCompletion, providerResponseCompletionSchema, decisionCandidateCompletionSchema, jobCompleteRequestSchema, codexProcessExitDiagnosticsSchema, jobFailRequestSchema, jobCancelRequestSchema, jobCancellationReceiptSchema, jobDeliveryRequestSchema, deliveryBaseShape, validateDeliveryCandidate, providerResponseDeliverySchema, decisionCandidateDeliverySchema, jobDeliveryResultSchema, jobConsumptionRequestSchema, jobConsumptionReceiptSchema, jobStateSchema, jobStatusReadSchema, hostStatusReadSchema, controllerBindingStatusReadSchema, queueStatusReadSchema, outcomeStatusReadSchema, externalInferenceVolumeWindowReadSchema, externalInferenceFailureCountReadSchema, externalInferenceHostDiagnosticsReadSchema, externalInferenceProfileActivityReadSchema, externalInferenceStatusReadSchema, nativeResearchEvidenceSourceSchema, externalAgentResearchEvidenceSourceSchema, researchEvidenceSourceSchema, reportedResearchTokenUsageSchema, unavailableResearchTokenUsageSchema, researchTokenUsageSchema, externalInferenceProductLineageBaseShape, traderExternalInferenceProductLineageSchema, decisionChatExternalInferenceProductLineageSchema, screenerExternalInferenceProductLineageSchema, externalInferenceProductLineageSchema, normalProductLinkageSchema, evidenceMaterializationMarkerSchema, deliveredExternalAgentSourceIdentitySchema, deliveredRequestEvidenceSchema, researchEvidenceBaseShape, researchEvidenceBaseSchema, validateExactUtf8, validateResearchEvidence, providerResponseResearchEvidenceSchema, decisionCandidateResearchEvidenceSchema, researchEvidenceSchema;
 var init_external_inference_contract = __esm({
   "lib/external-inference-contract.ts"() {
     "use strict";
@@ -14457,6 +14457,7 @@ var init_external_inference_contract = __esm({
     EXTERNAL_INFERENCE_USAGE_SCHEMA_VERSION = "external_inference_usage_v1";
     EXTERNAL_INFERENCE_INPUT_HASH_DOMAIN = "vtx.external-inference.input-sha256.v1\0";
     MAX_EXTERNAL_INFERENCE_STATUS_HOSTS = 640;
+    MAX_PROFILE_EXTERNAL_INFERENCE_FALLBACKS_PER_LANE = 127;
     MAX_GENERATION = 2147483647;
     MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER;
     MAX_PROMPT_BYTES = 3e5;
@@ -14738,7 +14739,7 @@ var init_external_inference_contract = __esm({
       control_mode_hint: controlModeSchema,
       binding_state: external_exports.literal("rebind_required")
     });
-    orderedFallbackHostIdsSchema = external_exports.array(identifierSchema).max(127).refine(
+    orderedFallbackHostIdsSchema = external_exports.array(identifierSchema).max(MAX_PROFILE_EXTERNAL_INFERENCE_FALLBACKS_PER_LANE).refine(
       (values) => new Set(values).size === values.length,
       { message: "fallback host IDs must be unique" }
     );
@@ -15816,6 +15817,8 @@ var init_external_inference_contract = __esm({
       authenticated_account_identity: safeCodeSchema.nullable().optional(),
       authenticated_account_email: authenticatedAccountEmailSchema.nullable().optional(),
       authenticated_account_plan: safeCodeSchema.nullable().optional(),
+      account_identity_status: external_exports.enum(["reported", "not_reported"]).default("not_reported"),
+      membership_identity_sha256: sha256HexSchema.nullable().optional(),
       adapter: externalInferenceAdapterIdSchema,
       status: external_exports.enum(["online", "degraded", "offline", "draining", "revoked"]),
       host_generation: generationSchema,
@@ -15829,7 +15832,8 @@ var init_external_inference_contract = __esm({
       lane: laneSchema,
       controller: liveModelControllerSchema,
       availability: external_exports.enum(["available", "host_offline", "model_unavailable", "rebind_required"]),
-      reason_code: safeCodeSchema.nullable()
+      reason_code: safeCodeSchema.nullable(),
+      membership_host_ids: external_exports.array(identifierSchema).max(MAX_PROFILE_EXTERNAL_INFERENCE_FALLBACKS_PER_LANE + 1).default([])
     });
     queueStatusReadSchema = external_exports.strictObject({
       queued: nonNegativeSafeIntegerSchema,
@@ -33467,6 +33471,7 @@ var init_runner = __esm({
             }
             throw lastError;
           };
+          let advertisementHandoff = null;
           const publishAdvertisement = async (health, forceAdvance, retryRemote = true, allowDefinitiveReseed = true) => {
             let advertisement = receipt.pending_advertisement;
             if (!advertisement) {
@@ -33515,6 +33520,11 @@ var init_runner = __esm({
             }
             const tool = receipt.registered ? "inference.host.advertise" : "inference.host.register";
             let result2;
+            let releaseAdvertisementHandoff;
+            const currentAdvertisementHandoff = new Promise((resolve6) => {
+              releaseAdvertisementHandoff = resolve6;
+            });
+            advertisementHandoff = currentAdvertisementHandoff;
             try {
               const advertiseOperation = () => mcp.callTool(
                 tool,
@@ -33522,6 +33532,15 @@ var init_runner = __esm({
                 { signal: this.options.signal }
               );
               result2 = retryRemote ? await retryExact(advertiseOperation, { signal: this.options.signal }) : await advertiseOperation();
+              assertAdvertisementResult(advertisement, result2);
+              await mutateReceipt((current) => ({
+                ...current,
+                registered: true,
+                advertisement_generation: result2.host.advertisement_generation,
+                advertisement_expires_at: advertisement.expires_at,
+                pending_advertisement: current.pending_advertisement?.operation_id === advertisement.operation_id ? null : current.pending_advertisement,
+                updated_at: isoAt(now())
+              }));
             } catch (error48) {
               const definitivelyNotApplied = error48 instanceof ExternalInferenceMcpError ? error48.definitivelyNotApplied : Boolean(error48 && typeof error48 === "object" && error48.definitivelyNotApplied === true);
               const expectedGeneration = receipt.registered ? receipt.advertisement_generation + 1 : receipt.advertisement_generation;
@@ -33534,16 +33553,12 @@ var init_runner = __esm({
                 return await publishAdvertisement(health, forceAdvance, retryRemote, false);
               }
               throw error48;
+            } finally {
+              releaseAdvertisementHandoff();
+              if (advertisementHandoff === currentAdvertisementHandoff) {
+                advertisementHandoff = null;
+              }
             }
-            assertAdvertisementResult(advertisement, result2);
-            await mutateReceipt((current) => ({
-              ...current,
-              registered: true,
-              advertisement_generation: result2.host.advertisement_generation,
-              advertisement_expires_at: advertisement.expires_at,
-              pending_advertisement: current.pending_advertisement?.operation_id === advertisement.operation_id ? null : current.pending_advertisement,
-              updated_at: isoAt(now())
-            }));
           };
           const wasRegistered = receipt.registered;
           await publishAdvertisement("healthy", wasRegistered);
@@ -33658,10 +33673,24 @@ var init_runner = __esm({
               if (drainRequested || hostHeartbeatAbort.signal.aborted) return;
               const heartbeatStartedAt = now();
               observeHostHeartbeatGap(heartbeatStartedAt);
+              const pendingAdvertisementHandoff = advertisementHandoff;
+              if (pendingAdvertisementHandoff !== null) {
+                try {
+                  await Promise.race([
+                    pendingAdvertisementHandoff,
+                    sleep4(settings.hostHeartbeatMs, hostHeartbeatAbort.signal)
+                  ]);
+                } catch (error48) {
+                  if (hostHeartbeatAbort.signal.aborted || drainRequested) return;
+                  throw error48;
+                }
+              }
+              if (drainRequested || hostHeartbeatAbort.signal.aborted) return;
+              const heartbeatAttemptedAt = now();
               const attemptedAdvertisementGeneration = receipt.advertisement_generation;
               try {
                 const expiresAt = receipt.advertisement_expires_at ? Date.parse(receipt.advertisement_expires_at) : 0;
-                const refreshPendingAcrossExpiry = receipt.pending_advertisement !== null && expiresAt <= heartbeatStartedAt;
+                const refreshPendingAcrossExpiry = receipt.pending_advertisement !== null && expiresAt <= heartbeatAttemptedAt;
                 await hostHeartbeat(
                   "healthy",
                   { signal: hostHeartbeatAbort.signal },
@@ -35251,7 +35280,7 @@ import { createWriteStream, readFileSync } from "node:fs";
 import { access as access3, chmod as chmod3, mkdir as mkdir3, readFile as readFile5, rm as rm6, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname5, join as join7, resolve as resolve4 } from "node:path";
-var SERVICE_NAME, SYSTEMD_UNIT, LAUNCHD_LABEL, SERVICE_COOPERATIVE_STOP_SECONDS, INFERENCE_HOST_SERVICE_DRAIN_COMMAND, inferenceHostServiceChildEnvironment, isWindowsSubsystemForLinux, inferenceHostServiceManifestPath, inferenceHostServiceDesiredPath, inferenceHostServiceLogPath, inferenceHostServiceRuntimePath, xmlEscape, plistEscape, systemdQuote, defaultRunCommand, managerName, assertRuntimeEnvironment, withoutConcurrencyLimit, assertServicePath, manifestGeneration, assertWorker, assertManifest, assertServiceRuntimeState, assertDesiredState, readInferenceHostServiceManifest, readManifestAcrossAtomicReplacement, readInferenceHostServiceRuntime, readRuntimeAcrossAtomicReplacement, readInferenceHostServiceDesired, readDesiredAcrossAtomicReplacement, writeDesired, runtimeEnvironment, serviceArguments, windowsOwnedCommandLine, vbScriptString, windowsServiceLauncher, windowsTaskXml, systemdUnit, launchAgentPlist, sameWorker, sameServiceDefinition, sameWorkerSet, InferenceHostServiceManager, appendServiceLog, spawnInferenceHostServiceChild, runInferenceHostServiceSupervisor;
+var SERVICE_NAME, SYSTEMD_UNIT, LAUNCHD_LABEL, SERVICE_COOPERATIVE_STOP_SECONDS, SERVICE_UPDATE_STARTUP_SECONDS, INFERENCE_HOST_SERVICE_DRAIN_COMMAND, inferenceHostServiceChildEnvironment, isWindowsSubsystemForLinux, inferenceHostServiceManifestPath, inferenceHostServiceDesiredPath, inferenceHostServiceLogPath, inferenceHostServiceRuntimePath, xmlEscape, plistEscape, systemdQuote, defaultRunCommand, managerName, assertRuntimeEnvironment, withoutConcurrencyLimit, assertServicePath, manifestGeneration, assertWorker, assertManifest, assertServiceRuntimeState, assertDesiredState, readInferenceHostServiceManifest, readManifestAcrossAtomicReplacement, readInferenceHostServiceRuntime, readRuntimeAcrossAtomicReplacement, readInferenceHostServiceDesired, readDesiredAcrossAtomicReplacement, writeDesired, runtimeEnvironment, serviceBootstrapArguments, windowsOwnedCommandLine, vbScriptString, windowsServiceLauncher, windowsTaskXml, systemdUnit, launchAgentPlist, sameWorker, sameServiceDefinition, sameWorkerSet, InferenceHostServiceManager, appendServiceLog, spawnInferenceHostServiceChild, runInferenceHostServiceSupervisor;
 var init_service = __esm({
   "lib/inference-host/service.ts"() {
     "use strict";
@@ -35261,6 +35290,7 @@ var init_service = __esm({
     SYSTEMD_UNIT = "vtx-inference-host.service";
     LAUNCHD_LABEL = "com.vtxmacro.inference-host";
     SERVICE_COOPERATIVE_STOP_SECONDS = 75;
+    SERVICE_UPDATE_STARTUP_SECONDS = 600;
     INFERENCE_HOST_SERVICE_DRAIN_COMMAND = "vtx-inference-host-service-drain-v1";
     inferenceHostServiceChildEnvironment = (runtimeEnvironment2, inheritedEnvironment = process.env) => {
       const environment = { ...inheritedEnvironment };
@@ -35565,13 +35595,12 @@ var init_service = __esm({
       }
       return result2;
     };
-    serviceArguments = (script, manifestPath) => [
-      script,
-      "inference-host",
-      "service",
-      "run-internal",
+    serviceBootstrapArguments = (bootstrapScript, manifestPath, lockPath) => [
+      bootstrapScript,
       "--service-manifest",
-      manifestPath
+      manifestPath,
+      "--service-lock",
+      lockPath
     ];
     windowsOwnedCommandLine = (values) => {
       if (values.some((value) => value.includes('"') || value.includes("\0"))) {
@@ -35650,6 +35679,9 @@ WantedBy=default.target
         this.home = dependencies.homedir ?? homedir2();
         this.executable = resolve4(dependencies.executable ?? process.execPath);
         this.script = resolve4(dependencies.script ?? process.argv[1] ?? "");
+        this.bootstrapScript = resolve4(
+          dependencies.bootstrapScript ?? join7(dirname5(this.script), "vtx-service-bootstrap.js")
+        );
         this.username = dependencies.username ?? ([process.env.USERDOMAIN, process.env.USERNAME].filter(Boolean).join("\\") || process.env.USER || "");
         this.windowsDirectory = (dependencies.windowsDirectory ?? process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows").replace(/[\\/]+$/u, "");
         this.runCommand = dependencies.runCommand ?? defaultRunCommand;
@@ -35681,6 +35713,21 @@ WantedBy=default.target
       runtimePath() {
         return inferenceHostServiceRuntimePath(this.config);
       }
+      serviceBootstrapPath() {
+        return `${this.config.supervisorStatePath}.service-bootstrap.js`;
+      }
+      serviceReleasePath() {
+        return `${this.config.supervisorStatePath}.service-release.json`;
+      }
+      serviceReleaseRejectionPath() {
+        return `${this.config.supervisorStatePath}.service-release-rejection.json`;
+      }
+      serviceReleasesPath() {
+        return `${this.config.supervisorStatePath}.service-releases`;
+      }
+      serviceBootstrapLockPath() {
+        return `${this.config.supervisorProcessLockPath}.service-bootstrap`;
+      }
       controlLockPath() {
         return `${this.config.supervisorProcessLockPath}.service-control`;
       }
@@ -35725,6 +35772,18 @@ WantedBy=default.target
       windowsLauncherPath() {
         return `${this.config.supervisorStatePath}.service-launcher.vbs`;
       }
+      async hasBootstrapDefinition() {
+        try {
+          await access3(this.serviceBootstrapPath());
+          const definition = await readFile5(
+            this.platform === "win32" ? this.windowsLauncherPath() : this.definitionPath(),
+            "utf8"
+          );
+          return definition.includes(this.serviceBootstrapPath());
+        } catch {
+          return false;
+        }
+      }
       async managerCommand(action) {
         const definition = this.definitionPath();
         if (this.platform === "win32") {
@@ -35846,13 +35905,23 @@ ${result2.stderr}`)) {
         );
       }
       async registerManifestUnlocked(manifest, desiredRunning, targetInstanceName) {
-        const args = serviceArguments(manifest.script, this.manifestPath());
+        await access3(this.bootstrapScript);
+        const args = serviceBootstrapArguments(
+          this.serviceBootstrapPath(),
+          this.manifestPath(),
+          this.serviceBootstrapLockPath()
+        );
         const definition = this.platform === "win32" ? windowsTaskXml(this.windowsLauncherPath(), this.windowsDirectory, this.username) : this.platform === "darwin" ? launchAgentPlist(manifest.executable, args, manifest.log_path) : systemdUnit(manifest.executable, args);
         let managerInstallAttempted = false;
         try {
           await writeAtomicInferencePrivateFile(this.manifestPath(), `${JSON.stringify(manifest, null, 2)}
 `);
           await writeDesired(this.desiredPath(), desiredRunning, this.now());
+          await writeAtomicInferencePrivateFile(
+            this.serviceBootstrapPath(),
+            await readFile5(this.bootstrapScript, "utf8")
+          );
+          await chmod3(this.serviceBootstrapPath(), 448);
           await mkdir3(dirname5(this.definitionPath()), { recursive: true, mode: 448 });
           if (this.platform === "win32") {
             await writeAtomicInferencePrivateFile(
@@ -35882,7 +35951,11 @@ ${started.stderr}`)) {
             }
             await this.waitForManagerActive();
             if (this.confirmInitialReadiness) {
-              await this.waitForManifestApplied(manifest, targetInstanceName);
+              await this.waitForManifestApplied(
+                manifest,
+                targetInstanceName,
+                Math.max(this.reconcileWaitAttempts, SERVICE_UPDATE_STARTUP_SECONDS * 4)
+              );
             }
           }
           return await this.status();
@@ -35909,6 +35982,7 @@ ${cleanup.stderr}`)) {
           await rm6(this.manifestPath(), { force: true }).catch(() => void 0);
           await rm6(this.desiredPath(), { force: true }).catch(() => void 0);
           await rm6(this.runtimePath(), { force: true }).catch(() => void 0);
+          await rm6(this.serviceBootstrapPath(), { force: true }).catch(() => void 0);
           if (this.platform === "linux") {
             await this.runCommand("systemctl", ["--user", "daemon-reload"]).catch(() => void 0);
           }
@@ -35918,10 +35992,11 @@ ${cleanup.stderr}`)) {
       async replaceManifestUnlocked(next, desiredRunning, targetInstanceName) {
         const previous = await readInferenceHostServiceManifest(this.manifestPath());
         const previousDesired = previous ? await readInferenceHostServiceDesired(this.desiredPath()) : false;
-        if (previous && sameServiceDefinition(previous, next) && sameWorkerSet(previous, next) && previousDesired === desiredRunning) {
+        const hasBootstrapDefinition = previous ? await this.hasBootstrapDefinition() : false;
+        if (previous && sameServiceDefinition(previous, next) && sameWorkerSet(previous, next) && previousDesired === desiredRunning && hasBootstrapDefinition) {
           return await this.status();
         }
-        if (previous && previousDesired && desiredRunning && sameServiceDefinition(previous, next)) {
+        if (previous && previousDesired && desiredRunning && sameServiceDefinition(previous, next) && hasBootstrapDefinition) {
           const current = await this.status();
           const runtime = await readRuntimeAcrossAtomicReplacement(this.runtimePath()).catch(() => null);
           if (current.manager_active && runtime?.manifest_generation === previous.generation) {
@@ -36041,6 +36116,7 @@ ${cleanup.stderr}`)) {
         }
         await access3(this.executable);
         await access3(this.script);
+        await access3(this.bootstrapScript);
         const maxConcurrency = options.maxConcurrency ?? null;
         const workers = [
           ...existing?.workers.filter((worker) => worker.instance_name !== this.config.instanceName) ?? [],
@@ -36166,25 +36242,34 @@ ${result2.stderr}`)) {
         const restoreOnFailure = await readInferenceHostServiceDesired(this.desiredPath());
         await writeDesired(this.desiredPath(), false, this.now());
         try {
-          const serviceLockPath = `${this.config.supervisorProcessLockPath}.service`;
+          const serviceLockPaths = [
+            `${this.config.supervisorProcessLockPath}.service`,
+            this.serviceBootstrapLockPath()
+          ];
           let serviceReleased = false;
           for (let attempt = 0; attempt < this.stopWaitAttempts; attempt += 1) {
-            try {
-              const probe = await this.acquireProcessLock(serviceLockPath);
-              await probe.release();
+            let allReleased = true;
+            for (const serviceLockPath of serviceLockPaths) {
+              try {
+                const probe = await this.acquireProcessLock(serviceLockPath);
+                await probe.release();
+              } catch (error48) {
+                if (error48 instanceof Error && error48.message.includes("Another inference host process already owns")) {
+                  allReleased = false;
+                  break;
+                }
+                throw error48;
+              }
+            }
+            if (allReleased) {
               serviceReleased = true;
               break;
-            } catch (error48) {
-              if (error48 instanceof Error && error48.message.includes("Another inference host process already owns")) {
-                await this.sleep(250);
-                continue;
-              }
-              throw error48;
             }
+            await this.sleep(250);
           }
           if (!serviceReleased) {
             throw new Error(
-              `Inference-host workers did not stop cooperatively within ${SERVICE_COOPERATIVE_STOP_SECONDS} seconds; refusing forced termination while cleanup may be pending.`
+              `Inference-host updater or workers did not stop cooperatively within ${SERVICE_COOPERATIVE_STOP_SECONDS} seconds; refusing forced termination while cleanup may be pending.`
             );
           }
           const result2 = await this.managerCommand("stop");
@@ -36300,6 +36385,10 @@ ${result2.stderr}`)) {
         await rm6(this.manifestPath(), { force: true });
         await rm6(this.desiredPath(), { force: true });
         await rm6(this.runtimePath(), { force: true });
+        await rm6(this.serviceBootstrapPath(), { force: true });
+        await rm6(this.serviceReleasePath(), { force: true });
+        await rm6(this.serviceReleaseRejectionPath(), { force: true });
+        await rm6(this.serviceReleasesPath(), { recursive: true, force: true });
         return {
           installed: false,
           desired_running: false,
@@ -36432,8 +36521,11 @@ ${result2.stderr}`)) {
       });
     };
     runInferenceHostServiceSupervisor = async (manifestPath, options = {}) => {
-      const initialManifest = await readInferenceHostServiceManifest(manifestPath);
-      if (!initialManifest) throw new Error("Inference-host service manifest is missing.");
+      const storedInitialManifest = await readInferenceHostServiceManifest(manifestPath);
+      if (!storedInitialManifest) throw new Error("Inference-host service manifest is missing.");
+      const serviceScript = options.serviceScript ? resolve4(options.serviceScript) : null;
+      const withServiceScript = (manifest) => serviceScript ? { ...manifest, script: serviceScript } : manifest;
+      const initialManifest = withServiceScript(storedInitialManifest);
       const desiredPath = manifestPath.replace(/\.service\.json$/u, ".service-desired.json");
       const runtimePath = manifestPath.replace(/\.service\.json$/u, ".service-runtime.json");
       const signal = options.signal ?? new AbortController().signal;
@@ -36630,15 +36722,17 @@ ${result2.stderr}`)) {
       try {
         while (!signal.aborted) {
           while (!signal.aborted && await readDesiredAcrossAtomicReplacement(desiredPath)) {
-            const next = await readManifestAcrossAtomicReplacement(manifestPath);
-            if (!next) throw new Error("Inference-host service manifest is missing.");
+            const storedNext = await readManifestAcrossAtomicReplacement(manifestPath);
+            if (!storedNext) throw new Error("Inference-host service manifest is missing.");
+            const next = withServiceScript(storedNext);
             if (next.generation !== appliedManifest.generation && next.generation !== rejectedManifestGeneration) await reconcile(next);
             await sleep4(250);
           }
           await drainWorkers();
           if (signal.aborted || !await readDesiredAcrossAtomicReplacement(desiredPath)) break;
-          const restored = await readManifestAcrossAtomicReplacement(manifestPath);
-          if (!restored) throw new Error("Inference-host service manifest is missing.");
+          const storedRestored = await readManifestAcrossAtomicReplacement(manifestPath);
+          if (!storedRestored) throw new Error("Inference-host service manifest is missing.");
+          const restored = withServiceScript(storedRestored);
           await reconcile(restored);
           await appendServiceLog(restored.log_path, "service_desired_state_restored", {
             manifest_generation: restored.generation,
@@ -39377,7 +39471,8 @@ Waiting for approval...
           await (dependencies.runServiceSupervisor ?? runInferenceHostServiceSupervisor)(
             parsed.serviceManifestPath,
             {
-              signal: cancellation.signal
+              signal: cancellation.signal,
+              serviceScript: resolve5(process.argv[1] ?? "")
             }
           );
           return { exitCode: 0, stdout: "", stderr: "" };
@@ -53931,11 +54026,11 @@ var init_error_surface_contract = __esm({
       );
       let message;
       if (resolvedReason === "private_node_stale") {
-        message = `\u26A0\uFE0F The ${orderLabel} was not sent: Hyperliquid private account data was too stale to validate the signing key.`;
+        message = `\u26A0\uFE0F The ${orderLabel} was not sent: VTX could not verify this profile's signing-key authorization because required Hyperliquid account data was stale. No order was submitted, and the signing key was not rejected. VTX will try again automatically if the trader is running; no action is required.`;
       } else if (resolvedReason === "signer_validation_unavailable") {
-        message = `\u26A0\uFE0F The ${orderLabel} was not sent: Hyperliquid's private account service could not validate the signing key.`;
+        message = `\u26A0\uFE0F The ${orderLabel} was not sent: VTX could not verify this profile's signing-key authorization because required Hyperliquid account data was temporarily unavailable. No order was submitted, and the signing key was not rejected. VTX will try again automatically if the trader is running; no action is required.`;
       } else if (resolvedReason === "wallet_not_authorized") {
-        message = `\u26A0\uFE0F The ${orderLabel} was not sent: the signing key is not authorized for the configured wallet.`;
+        message = `\u26A0\uFE0F The ${orderLabel} was not sent: Hyperliquid confirmed that the signing key is not authorized for the configured wallet. No order was submitted. Stop the trader, then reconnect the correct wallet and signing key in System.`;
       } else if (resolvedReason === "credentials_missing") {
         message = `\u26A0\uFE0F The ${orderLabel} was not sent: a wallet address and authorized signing key are required for trading.`;
       } else if (resolvedReason === "local_safety_block") {
@@ -54856,13 +54951,28 @@ var init_hyperliquid_client = __esm({
         throw new Error("Malformed Hyperliquid userRole response.");
       }
       const response = payload;
-      const role = String(response.role || "").trim();
-      if (!role) {
+      const role = response.role;
+      if (typeof role !== "string" || !["missing", "user", "agent", "vault", "subAccount"].includes(role)) {
+        throw new Error("Malformed Hyperliquid userRole response.");
+      }
+      const rawData = response.data;
+      if (["missing", "user", "vault"].includes(role)) {
+        if (rawData !== void 0 && rawData !== null) {
+          throw new Error("Malformed Hyperliquid userRole response.");
+        }
+        return { role, data: null };
+      }
+      if (!rawData || typeof rawData !== "object" || Array.isArray(rawData)) {
+        throw new Error("Malformed Hyperliquid userRole response.");
+      }
+      const data = rawData;
+      const addressKey = role === "agent" ? "user" : "master";
+      if (typeof data[addressKey] !== "string" || !/^0x[0-9a-f]{40}$/i.test(data[addressKey])) {
         throw new Error("Malformed Hyperliquid userRole response.");
       }
       return {
         role,
-        data: response.data && typeof response.data === "object" && !Array.isArray(response.data) ? response.data : null
+        data
       };
     };
     fetchBrowserAccountState2 = async (input) => {
@@ -55961,7 +56071,7 @@ var init_hyperliquid_signer_binding = __esm({
       } catch (error48) {
         if (input.signal?.aborted) throw error48;
         throw new RuntimeExecutionError(
-          "Hyperliquid's private account service could not validate the signing key.",
+          "VTX could not verify this profile's signing-key authorization because required Hyperliquid account data was temporarily unavailable. The signing key was not rejected. Try again later; reconnecting is not required.",
           "signer_validation_unavailable"
         );
       }
@@ -55976,7 +56086,7 @@ var init_hyperliquid_signer_binding = __esm({
       if (signerRole === "agent") {
         const masterWallet = extractRoleAddress(
           roleResponse.data,
-          ["user", "master", "masterAddress", "master_address"]
+          ["user"]
         );
         if (masterWallet === walletAddress) {
           return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.8.54",
+  "version": "2026.8.56",
   "description": "VTX Macro CLI, MCP server, and durable external inference host.",
   "type": "module",
   "license": "UNLICENSED",