@vtxmacro/cli 2026.8.55 → 2026.8.56

package/bin/vtx-service-bootstrap.js

@@ -0,0 +1,1540 @@
+// lib/inference-host/service-bootstrap.ts
+import { spawn as spawn2 } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import {
+  access,
+  appendFile,
+  mkdir as mkdir2,
+  readFile as readFile2,
+  readdir,
+  rename as rename2,
+  rm as rm2
+} from "node:fs/promises";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2, win32 as windowsPath2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// agent-cli-release.json
+var agent_cli_release_default = {
+  package_name: "@vtxmacro/cli",
+  package_version: "2026.8.56",
+  codex_package_name: "@openai/codex",
+  codex_version: "0.147.0",
+  copilot_sdk_package_name: "@github/copilot-sdk",
+  copilot_sdk_version: "1.0.0-beta.8",
+  copilot_cli_package_name: "@github/copilot",
+  copilot_cli_version: "1.0.80",
+  deepseek_harness_version: "0.1.1-rc.2",
+  deepseek_harness_packages: [
+    "@deepseek-ai/dsh-agent",
+    "@deepseek-ai/dsh-agent-instructions",
+    "@deepseek-ai/dsh-agent-loop",
+    "@deepseek-ai/dsh-agent-spine-demo",
+    "@deepseek-ai/dsh-anonymous-user-id",
+    "@deepseek-ai/dsh-atomic-write",
+    "@deepseek-ai/dsh-attachment",
+    "@deepseek-ai/dsh-brand",
+    "@deepseek-ai/dsh-code-runtime",
+    "@deepseek-ai/dsh-credentials",
+    "@deepseek-ai/dsh-fs",
+    "@deepseek-ai/dsh-goal",
+    "@deepseek-ai/dsh-goal-round-driver",
+    "@deepseek-ai/dsh-home-paths",
+    "@deepseek-ai/dsh-invariants",
+    "@deepseek-ai/dsh-jobs",
+    "@deepseek-ai/dsh-jobs-local",
+    "@deepseek-ai/dsh-launch-environment",
+    "@deepseek-ai/dsh-llm",
+    "@deepseek-ai/dsh-llm-deepseek",
+    "@deepseek-ai/dsh-llm-retry",
+    "@deepseek-ai/dsh-output-retention",
+    "@deepseek-ai/dsh-sandbox",
+    "@deepseek-ai/dsh-sandbox-policy",
+    "@deepseek-ai/dsh-scope",
+    "@deepseek-ai/dsh-session",
+    "@deepseek-ai/dsh-session-checkpoint-policy",
+    "@deepseek-ai/dsh-session-persistence",
+    "@deepseek-ai/dsh-session-persistence-jsonl",
+    "@deepseek-ai/dsh-session-projection",
+    "@deepseek-ai/dsh-session-title",
+    "@deepseek-ai/dsh-settings",
+    "@deepseek-ai/dsh-shell",
+    "@deepseek-ai/dsh-shell-env",
+    "@deepseek-ai/dsh-skill",
+    "@deepseek-ai/dsh-skill-filesystem",
+    "@deepseek-ai/dsh-subprocess",
+    "@deepseek-ai/dsh-system-prompt",
+    "@deepseek-ai/dsh-timeout",
+    "@deepseek-ai/dsh-tool-bash",
+    "@deepseek-ai/dsh-tool-goal",
+    "@deepseek-ai/dsh-tool-jobs",
+    "@deepseek-ai/dsh-tool-skill",
+    "@deepseek-ai/dsh-tools",
+    "@deepseek-ai/dsh-typert-protocol",
+    "@deepseek-ai/dsh-user-approval"
+  ],
+  deepseek_cordis_package_name: "@deepseek-ai/cordis",
+  deepseek_cordis_version: "4.0.1",
+  deepseek_support_packages: {
+    "@deepseek-ai/cordis-plugin-timer": "1.1.3"
+  },
+  platforms: {
+    "linux-x64": {
+      package_name: "@openai/codex-linux-x64",
+      target: "x86_64-unknown-linux-musl",
+      binary_name: "codex",
+      sha256: "cb0a15567e9a60a5820d54b0f6ae86d504dc3805c1eab21a47f70e3eb7b73a40"
+    },
+    "win32-x64": {
+      package_name: "@openai/codex-win32-x64",
+      target: "x86_64-pc-windows-msvc",
+      binary_name: "codex.exe",
+      sha256: "935a1911ed2556e4ffcec995f4886ac2ac425863ba26fed264df62e30272ad9d"
+    }
+  }
+};
+
+// lib/inference-host/config.ts
+import { randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readFile, realpath, rename, rm } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve, win32 as windowsPath } from "node:path";
+var MAX_INFERENCE_PRIVATE_FILE_BYTES = 16 * 1024 * 1024;
+var WINDOWS_PRIVATE_ACL_BROKER_SCRIPT = `$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+while(($line=[Console]::In.ReadLine()) -ne $null) {
+  $requestId=$null
+  $failureStage='request_validation'
+  try {
+    if($line.Length -lt 2 -or $line.Length -gt 65536) { throw 'invalid request size' }
+    $request=$line | ConvertFrom-Json
+    $names=@($request.PSObject.Properties.Name | Sort-Object)
+    if(($names -join ',') -ne 'id,kind,mode,path_b64') { throw 'invalid request shape' }
+    if($request.id -isnot [long] -and $request.id -isnot [int]) { throw 'invalid request id' }
+    $requestId=[long]$request.id
+    if($requestId -lt 1) { throw 'invalid request id' }
+    $kind=[string]$request.kind
+    $mode=[string]$request.mode
+    if($kind -ne 'directory' -and $kind -ne 'file') { throw 'invalid path kind' }
+    if($mode -ne 'harden' -and $mode -ne 'verify' -and $mode -ne 'verify-owner') { throw 'invalid ACL mode' }
+    $path=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([string]$request.path_b64))
+    if([string]::IsNullOrWhiteSpace($path) -or $path.Length -gt 32767 -or $path.Contains([char]0)) { throw 'invalid path' }
+    $failureStage='path_lookup'
+    if(-not (Test-Path -LiteralPath $path)) {
+      [Console]::Out.WriteLine((@{id=$requestId;status='missing'} | ConvertTo-Json -Compress))
+      continue
+    }
+    $failureStage='principal_resolution'
+    $currentIdentity=[Security.Principal.WindowsIdentity]::GetCurrent()
+    $current=$currentIdentity.User
+    $system=New-Object Security.Principal.SecurityIdentifier('S-1-5-18')
+    $admins=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-544')
+    $currentIsAdmin=(New-Object Security.Principal.WindowsPrincipal($currentIdentity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+    $allowed=@($current.Value,$system.Value,$admins.Value)
+    if($mode -eq 'harden') {
+      $failureStage='acl_read'
+      $acl=Get-Acl -LiteralPath $path
+      $failureStage='owner_validation'
+      $existingOwner=(New-Object Security.Principal.NTAccount($acl.Owner)).Translate([Security.Principal.SecurityIdentifier]).Value
+      if($existingOwner -ne $current.Value -and ($existingOwner -ne $admins.Value -or -not $currentIsAdmin)) { throw 'private ACL owner is invalid' }
+      $failureStage='acl_mutation'
+      $acl.SetAccessRuleProtection($true,$false)
+      foreach($existingRule in @($acl.Access)) { [void]$acl.RemoveAccessRuleSpecific($existingRule) }
+      $inherit=if($kind -eq 'directory') {
+        [Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'
+      } else { [Security.AccessControl.InheritanceFlags]::None }
+      foreach($sid in @($current,$system,$admins)) {
+        $rule=New-Object Security.AccessControl.FileSystemAccessRule(
+          $sid,
+          [Security.AccessControl.FileSystemRights]::FullControl,
+          $inherit,
+          [Security.AccessControl.PropagationFlags]::None,
+          [Security.AccessControl.AccessControlType]::Allow
+        )
+        [void]$acl.AddAccessRule($rule)
+      }
+      $failureStage='acl_write'
+      (Get-Item -LiteralPath $path).SetAccessControl($acl)
+    }
+    $failureStage='acl_readback'
+    $actual=Get-Acl -LiteralPath $path
+    $failureStage='acl_verification'
+    $owner=(New-Object Security.Principal.NTAccount($actual.Owner)).Translate([Security.Principal.SecurityIdentifier]).Value
+    if($owner -ne $current.Value -and ($owner -ne $admins.Value -or -not $currentIsAdmin)) { throw 'private ACL owner is invalid' }
+    if($mode -ne 'verify-owner') {
+      if(-not $actual.AreAccessRulesProtected) { throw 'private ACL inheritance is invalid' }
+      $userFull=$false
+      foreach($rule in $actual.Access) {
+        $sid=$rule.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value
+        if($rule.IsInherited -or $allowed -notcontains $sid -or $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow) {
+          throw 'private ACL contains an unauthorized access rule'
+        }
+        if($sid -eq $current.Value -and (($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl)) { $userFull=$true }
+      }
+      if(-not $userFull) { throw 'private ACL does not grant the current user full control' }
+    }
+    [Console]::Out.WriteLine((@{id=$requestId;status='ok'} | ConvertTo-Json -Compress))
+  } catch {
+    [Console]::Out.WriteLine((@{id=$requestId;status='error';error_code=$failureStage} | ConvertTo-Json -Compress))
+  }
+}`;
+var WINDOWS_IDENTITY_COMMAND_TIMEOUT_MS = 15e3;
+var WINDOWS_PRIVATE_ACL_BROKER_STARTUP_TIMEOUT_MS = 9e4;
+var SMALL_IDENTITY_COMMAND_TIMEOUT_MS = 5e3;
+var windowsPowerShellEnvironment = (extra = {}) => {
+  const sanitizedExtra = { ...extra };
+  delete sanitizedExtra.PSModulePath;
+  const windowsRoot = process.env.SystemRoot ?? process.env.WINDIR;
+  return {
+    ...sanitizedExtra,
+    NODE_ENV: process.env.NODE_ENV,
+    SystemRoot: process.env.SystemRoot,
+    WINDIR: process.env.WINDIR,
+    ComSpec: process.env.ComSpec,
+    PATHEXT: process.env.PATHEXT,
+    PSModulePath: windowsRoot ? windowsPath.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "Modules") : void 0,
+    TEMP: process.env.TEMP,
+    TMP: process.env.TMP
+  };
+};
+var windowsPrivateAclBrokerInvocation = () => ({
+  args: [
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-EncodedCommand",
+    Buffer.from(WINDOWS_PRIVATE_ACL_BROKER_SCRIPT, "utf16le").toString("base64")
+  ],
+  env: windowsPowerShellEnvironment()
+});
+var WindowsPrivateAclBroker = class {
+  constructor(dependencies = {}) {
+    this.child = null;
+    this.requestSequence = 0;
+    this.queue = Promise.resolve();
+    this.pending = null;
+    this.outputBuffer = "";
+    this.idleTimer = null;
+    this.run = async (path, kind, mode) => {
+      const operation = this.queue.then(
+        () => this.dispatch(path, kind, mode),
+        () => this.dispatch(path, kind, mode)
+      );
+      this.queue = operation.then(() => void 0, () => void 0);
+      await operation;
+    };
+    this.requestTimeoutMs = dependencies.requestTimeoutMs ?? 15e3;
+    this.startupRequestTimeoutMs = dependencies.startupRequestTimeoutMs ?? WINDOWS_PRIVATE_ACL_BROKER_STARTUP_TIMEOUT_MS;
+    this.idleShutdownMs = dependencies.idleShutdownMs ?? 3e4;
+    this.spawnProcess = dependencies.spawnProcess ?? (() => {
+      const invocation = windowsPrivateAclBrokerInvocation();
+      return spawn("powershell.exe", [...invocation.args], {
+        env: invocation.env,
+        windowsHide: true,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+    });
+  }
+  scheduleIdleShutdown() {
+    if (this.idleTimer) clearTimeout(this.idleTimer);
+    this.idleTimer = setTimeout(() => {
+      this.idleTimer = null;
+      const child = this.child;
+      if (!child || this.pending) return;
+      this.child = null;
+      this.outputBuffer = "";
+      child.stdin.end();
+      const force = setTimeout(() => child.kill("SIGKILL"), 1e3);
+      force.unref();
+      child.once("exit", () => clearTimeout(force));
+    }, this.idleShutdownMs);
+    this.idleTimer.unref();
+  }
+  failChild(child, error) {
+    if (this.child !== child) return;
+    this.child = null;
+    this.outputBuffer = "";
+    if (this.idleTimer) {
+      clearTimeout(this.idleTimer);
+      this.idleTimer = null;
+    }
+    const pending = this.pending;
+    this.pending = null;
+    if (pending) {
+      clearTimeout(pending.timer);
+      pending.reject(error);
+    }
+    child.kill("SIGKILL");
+  }
+  acceptLine(child, line) {
+    const pending = this.pending;
+    if (!pending || !line || line.length > 4096) {
+      this.failChild(child, new Error("Windows private ACL broker returned malformed output."));
+      return;
+    }
+    let response;
+    try {
+      const parsed = JSON.parse(line);
+      const status = String(parsed.status);
+      const expectedKeys = status === "error" ? "error_code\0id\0status" : "id\0status";
+      if (Object.keys(parsed).sort().join("\0") !== expectedKeys || parsed.id !== pending.id || !["ok", "missing", "error"].includes(status) || status === "error" && ![
+        "request_validation",
+        "path_lookup",
+        "principal_resolution",
+        "acl_read",
+        "owner_validation",
+        "acl_mutation",
+        "acl_write",
+        "acl_readback",
+        "acl_verification"
+      ].includes(String(parsed.error_code))) throw new Error("invalid response");
+      response = parsed;
+    } catch {
+      this.failChild(child, new Error("Windows private ACL broker returned malformed output."));
+      return;
+    }
+    this.pending = null;
+    clearTimeout(pending.timer);
+    if (response.status === "ok") {
+      pending.resolve();
+    } else if (response.status === "missing") {
+      const error = new Error("Windows private path no longer exists.");
+      error.code = "ENOENT";
+      pending.reject(error);
+    } else {
+      pending.reject(new Error(
+        `Windows private ACL ${pending.mode} failed (${response.error_code}).`
+      ));
+    }
+    this.scheduleIdleShutdown();
+  }
+  ensureChild() {
+    if (this.child && this.child.exitCode === null && !this.child.killed) {
+      return { child: this.child, startedNow: false };
+    }
+    const child = this.spawnProcess();
+    this.child = child;
+    this.outputBuffer = "";
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      if (this.child !== child) return;
+      this.outputBuffer += chunk;
+      if (this.outputBuffer.length > 65536) {
+        this.failChild(child, new Error("Windows private ACL broker exceeded its output limit."));
+        return;
+      }
+      while (this.child === child) {
+        const newline = this.outputBuffer.indexOf("\n");
+        if (newline < 0) break;
+        const line = this.outputBuffer.slice(0, newline).trim();
+        this.outputBuffer = this.outputBuffer.slice(newline + 1);
+        this.acceptLine(child, line);
+      }
+    });
+    child.stderr.on("data", () => void 0);
+    child.once("error", () => {
+      this.failChild(child, new Error("Windows private ACL broker failed to start."));
+    });
+    child.once("exit", () => {
+      this.failChild(child, new Error("Windows private ACL broker exited before confirmation."));
+    });
+    child.unref();
+    for (const stream of [child.stdin, child.stdout, child.stderr]) {
+      stream.unref?.();
+    }
+    return { child, startedNow: true };
+  }
+  async dispatch(path, kind, mode) {
+    if (this.idleTimer) {
+      clearTimeout(this.idleTimer);
+      this.idleTimer = null;
+    }
+    const id = ++this.requestSequence;
+    const request = `${JSON.stringify({
+      id,
+      kind,
+      mode,
+      path_b64: Buffer.from(path, "utf8").toString("base64")
+    })}
+`;
+    if (Buffer.byteLength(request, "utf8") > 65536) {
+      throw new Error("Windows private ACL broker request exceeds its input limit.");
+    }
+    const { child, startedNow } = this.ensureChild();
+    const timeoutMs = startedNow ? this.startupRequestTimeoutMs : this.requestTimeoutMs;
+    await new Promise((resolvePromise, reject) => {
+      const timer = setTimeout(() => {
+        this.failChild(child, new Error("Windows private ACL broker request timed out."));
+      }, timeoutMs);
+      this.pending = { id, mode, resolve: resolvePromise, reject, timer };
+      child.stdin.write(request, "utf8", (error) => {
+        if (error) {
+          this.failChild(child, new Error("Windows private ACL broker request failed."));
+        }
+      });
+    });
+  }
+  close() {
+    if (this.idleTimer) clearTimeout(this.idleTimer);
+    this.idleTimer = null;
+    const child = this.child;
+    this.child = null;
+    this.outputBuffer = "";
+    if (child) child.stdin.end();
+  }
+};
+var defaultWindowsPrivateAclBroker = new WindowsPrivateAclBroker();
+var runWindowsPrivateAcl = async (path, kind, mode) => await defaultWindowsPrivateAclBroker.run(path, kind, mode);
+var windowsAclCache = /* @__PURE__ */ new Map();
+var windowsAclIdentity = async (path) => {
+  const metadata = await lstat(path, { bigint: true });
+  return {
+    dev: metadata.dev,
+    ino: metadata.ino,
+    ctimeNs: metadata.ctimeNs,
+    mtimeNs: metadata.mtimeNs,
+    mode: metadata.mode,
+    size: metadata.size
+  };
+};
+var aclCacheKey = (path, kind, mode) => `${kind}:${mode}:${resolve(path)}`;
+var secureWindowsPrivatePath = async (path, kind, mode, platform = process.platform, runner = runWindowsPrivateAcl) => {
+  if (platform !== "win32") return;
+  const key = aclCacheKey(path, kind, mode);
+  const before = await windowsAclIdentity(path);
+  const cached = windowsAclCache.get(key);
+  if (cached && cached.dev === before.dev && cached.ino === before.ino && cached.ctimeNs === before.ctimeNs && cached.mtimeNs === before.mtimeNs && cached.mode === before.mode && cached.size === before.size) return;
+  await runner(path, kind, mode);
+  windowsAclCache.set(key, await windowsAclIdentity(path));
+};
+var invalidateWindowsAclCache = (path) => {
+  for (const kind of ["file", "directory"]) {
+    for (const mode of ["harden", "verify", "verify-owner"]) {
+      windowsAclCache.delete(aclCacheKey(path, kind, mode));
+    }
+  }
+};
+var rebindHardenedWindowsAclAfterRename = async (source, destination, kind, expected) => {
+  const resolvedSource = resolve(source);
+  const resolvedDestination = resolve(destination);
+  if (resolvedSource === resolvedDestination || dirname(resolvedSource) !== dirname(resolvedDestination)) {
+    throw new Error("Windows private ACL cache rename boundary is invalid.");
+  }
+  const published = await windowsAclIdentity(destination);
+  if (published.dev !== expected.dev || published.ino !== expected.ino || published.mode !== expected.mode || published.mtimeNs !== expected.mtimeNs || published.size !== expected.size) {
+    invalidateWindowsAclCache(source);
+    invalidateWindowsAclCache(destination);
+    throw new Error("Windows private file identity changed during atomic publication.");
+  }
+  invalidateWindowsAclCache(source);
+  invalidateWindowsAclCache(destination);
+  for (const mode of ["harden", "verify", "verify-owner"]) {
+    windowsAclCache.set(aclCacheKey(destination, kind, mode), published);
+  }
+};
+var rebindHardenedWindowsDirectoryAfterOwnedMutation = async (path, expected) => {
+  const current = await windowsAclIdentity(path);
+  if (current.dev !== expected.dev || current.ino !== expected.ino || current.mode !== expected.mode) {
+    invalidateWindowsAclCache(path);
+    throw new Error("Windows private directory identity changed during atomic publication.");
+  }
+  invalidateWindowsAclCache(path);
+  for (const mode of ["harden", "verify", "verify-owner"]) {
+    windowsAclCache.set(aclCacheKey(path, "directory", mode), current);
+  }
+};
+var isDefaultWindowsPrivatePath = (path, root = resolve(homedir(), ".vtx", "inference-host")) => {
+  const child = relative(root, resolve(path));
+  return child === "" || !child.startsWith("..") && !child.includes(":");
+};
+var secureExistingWindowsPath = async (path, kind, platform = process.platform, runner = runWindowsPrivateAcl, defaultRoot = resolve(homedir(), ".vtx", "inference-host")) => {
+  if (platform !== "win32") return;
+  if (!isDefaultWindowsPrivatePath(path, defaultRoot)) {
+    await secureWindowsPrivatePath(path, kind, "verify", platform, runner);
+    return;
+  }
+  await secureWindowsPrivatePath(path, kind, "harden", platform, runner);
+};
+var linuxProcessIdentity = async (pid) => {
+  try {
+    const [bootId, statLine] = await Promise.all([
+      readFile("/proc/sys/kernel/random/boot_id", "utf8"),
+      readFile(`/proc/${pid}/stat`, "utf8")
+    ]);
+    const fields = statLine.slice(statLine.lastIndexOf(")") + 2).trim().split(/\s+/u);
+    const startTicks = fields[19];
+    return startTicks ? `linux:${bootId.trim()}:${startTicks}` : null;
+  } catch {
+    return null;
+  }
+};
+var windowsProcessIdentityInvocation = (pid) => {
+  const script = `$ErrorActionPreference='Stop';$p=[Diagnostics.Process]::GetProcessById([int]$env:VTX_PROCESS_PID);[Console]::Out.Write($p.StartTime.ToUniversalTime().ToFileTimeUtc())`;
+  return {
+    args: [
+      "-NoLogo",
+      "-NoProfile",
+      "-NonInteractive",
+      "-EncodedCommand",
+      Buffer.from(script, "utf16le").toString("base64")
+    ],
+    env: windowsPowerShellEnvironment({ VTX_PROCESS_PID: String(pid) }),
+    timeoutMs: WINDOWS_IDENTITY_COMMAND_TIMEOUT_MS
+  };
+};
+var windowsBootIdentityInvocation = () => {
+  const script = `$ErrorActionPreference='Stop';$s=[System.Management.ManagementObjectSearcher]::new('SELECT LastBootUpTime FROM Win32_OperatingSystem');try{$c=$s.Get();$e=$c.GetEnumerator();if(-not $e.MoveNext()){throw 'boot identity unavailable'};$raw=[string]$e.Current['LastBootUpTime'];$v=[System.Management.ManagementDateTimeConverter]::ToDateTime($raw).ToUniversalTime().ToFileTimeUtc();[Console]::Out.Write($v)}finally{if($c){$c.Dispose()};$s.Dispose()}`;
+  return {
+    args: [
+      "-NoLogo",
+      "-NoProfile",
+      "-NonInteractive",
+      "-EncodedCommand",
+      Buffer.from(script, "utf16le").toString("base64")
+    ],
+    env: windowsPowerShellEnvironment(),
+    timeoutMs: WINDOWS_IDENTITY_COMMAND_TIMEOUT_MS
+  };
+};
+var windowsProcessIdentity = async (pid) => await new Promise((resolvePromise) => {
+  const invocation = windowsProcessIdentityInvocation(pid);
+  const child = spawn("powershell.exe", [...invocation.args], {
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "ignore"],
+    env: invocation.env
+  });
+  const output = [];
+  let settled = false;
+  const settle = (value) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    resolvePromise(value);
+  };
+  const timer = setTimeout(() => {
+    child.kill("SIGKILL");
+    settle(null);
+  }, invocation.timeoutMs);
+  child.stdout.on("data", (chunk) => {
+    if (output.reduce((total, item) => total + item.byteLength, 0) + Buffer.byteLength(chunk) > 1024) {
+      child.kill("SIGKILL");
+      settle(null);
+      return;
+    }
+    output.push(Buffer.from(chunk));
+  });
+  child.once("error", () => settle(null));
+  child.once("exit", (code) => {
+    const started = Buffer.concat(output).toString("utf8").trim();
+    settle(code === 0 && /^\d+$/u.test(started) ? `win32:${started}` : null);
+  });
+});
+var darwinProcessIdentity = async (pid) => await new Promise((resolvePromise) => {
+  const child = spawn("ps", ["-p", String(pid), "-o", "lstart="], {
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  const output = [];
+  let settled = false;
+  const settle = (value) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    resolvePromise(value);
+  };
+  const timer = setTimeout(() => {
+    child.kill("SIGKILL");
+    settle(null);
+  }, 5e3);
+  child.stdout.on("data", (chunk) => output.push(Buffer.from(chunk)));
+  child.once("error", () => settle(null));
+  child.once("exit", (code) => {
+    const started = Date.parse(Buffer.concat(output).toString("utf8").trim());
+    settle(code === 0 && Number.isFinite(started) ? `darwin:${Math.floor(started / 1e3)}` : null);
+  });
+});
+var runSmallIdentityCommand = async (command, args, env, timeoutMs = SMALL_IDENTITY_COMMAND_TIMEOUT_MS) => await new Promise((resolvePromise) => {
+  const child = spawn(command, [...args], {
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "ignore"],
+    env
+  });
+  const output = [];
+  let bytes = 0;
+  let settled = false;
+  const settle = (value) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    resolvePromise(value);
+  };
+  const timer = setTimeout(() => {
+    child.kill("SIGKILL");
+    settle(null);
+  }, timeoutMs);
+  child.stdout.on("data", (chunk) => {
+    bytes += Buffer.byteLength(chunk);
+    if (bytes > 4096) {
+      child.kill("SIGKILL");
+      settle(null);
+      return;
+    }
+    output.push(Buffer.from(chunk));
+  });
+  child.once("error", () => settle(null));
+  child.once("exit", (code) => settle(
+    code === 0 ? Buffer.concat(output).toString("utf8").trim() || null : null
+  ));
+});
+var cachedSystemBootIdentity = null;
+var readInferenceSystemBootIdentity = async (platform = process.platform) => {
+  if (platform === process.platform && cachedSystemBootIdentity) {
+    return await cachedSystemBootIdentity;
+  }
+  const read = async () => {
+    let identity = null;
+    if (platform === "linux") {
+      try {
+        identity = (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
+      } catch {
+        identity = null;
+      }
+    } else if (platform === "win32") {
+      const invocation = windowsBootIdentityInvocation();
+      identity = await runSmallIdentityCommand(
+        "powershell.exe",
+        invocation.args,
+        invocation.env,
+        invocation.timeoutMs
+      );
+    } else if (platform === "darwin") {
+      identity = await runSmallIdentityCommand("sysctl", ["-n", "kern.boottime"], void 0);
+    }
+    if (!identity || /[\r\n\0]/u.test(identity)) {
+      throw new Error("Inference host could not establish the current system boot identity.");
+    }
+    return `${platform}:${identity}`;
+  };
+  const pending = read();
+  if (platform === process.platform) cachedSystemBootIdentity = pending;
+  try {
+    return await pending;
+  } catch (error) {
+    if (platform === process.platform) cachedSystemBootIdentity = null;
+    throw error;
+  }
+};
+var defaultProcessIdentity = async (pid) => {
+  if (process.platform === "linux") return await linuxProcessIdentity(pid);
+  if (process.platform === "win32") return await windowsProcessIdentity(pid);
+  if (process.platform === "darwin") return await darwinProcessIdentity(pid);
+  return null;
+};
+var defaultCurrentProcessIdentity = async () => {
+  const identity = await defaultProcessIdentity(process.pid);
+  if (!identity) throw new Error("Inference host could not establish its process-start identity.");
+  return identity;
+};
+var processLockObservationCache = /* @__PURE__ */ new Map();
+var inferenceProcessIdentitiesMatch = (stored, observed) => stored === observed;
+async function ensureInferencePrivateDirectory(path, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  const runner = dependencies.runner ?? runWindowsPrivateAcl;
+  const defaultRoot = dependencies.defaultRoot ?? resolve(homedir(), ".vtx", "inference-host");
+  let created = false;
+  try {
+    const before = await lstat(path);
+    if (before.isSymbolicLink() || !before.isDirectory()) {
+      throw new Error("Inference host state directory is unsafe.");
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    await mkdir(path, { recursive: true, mode: 448 });
+    created = true;
+  }
+  const after = await lstat(path);
+  if (after.isSymbolicLink() || !after.isDirectory()) {
+    throw new Error("Inference host state directory is unsafe.");
+  }
+  if (platform === "win32") {
+    if (created) {
+      await secureWindowsPrivatePath(path, "directory", "harden", platform, runner);
+    } else {
+      await secureExistingWindowsPath(
+        path,
+        "directory",
+        platform,
+        runner,
+        defaultRoot
+      );
+    }
+    return;
+  }
+  if ((after.mode & 63) !== 0) {
+    throw new Error("Inference host state directory must have mode 0700.");
+  }
+  if (typeof process.getuid === "function" && after.uid !== process.getuid()) {
+    throw new Error("Inference host state directory must be owned by the current user.");
+  }
+  const canonical = await realpath(path);
+  if (canonical !== resolve(path)) {
+    throw new Error("Inference host state directory may not traverse symbolic links.");
+  }
+}
+async function syncInferenceDirectory(path, platform = process.platform) {
+  if (platform === "win32") return;
+  const handle = await open(path, constants.O_RDONLY | constants.O_DIRECTORY);
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+var WINDOWS_PRIVATE_FILE_REPLACE_ERROR_CODES = /* @__PURE__ */ new Set([
+  "EACCES",
+  "EBUSY",
+  "EEXIST",
+  "ENOTEMPTY",
+  "EPERM"
+]);
+async function replaceAtomicInferencePrivateFile(temporaryPath, destinationPath, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const renameFile = options.renameFile ?? rename;
+  const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds)));
+  const maxAttempts = Math.max(1, options.maxAttempts ?? 40);
+  const retryDelayMs = Math.max(0, options.retryDelayMs ?? 25);
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    try {
+      await renameFile(temporaryPath, destinationPath);
+      return;
+    } catch (error) {
+      const code = String(error.code ?? "");
+      if (platform !== "win32" || !WINDOWS_PRIVATE_FILE_REPLACE_ERROR_CODES.has(code) || attempt === maxAttempts - 1) {
+        throw error;
+      }
+      await sleep(retryDelayMs);
+    }
+  }
+}
+async function writeAtomicInferencePrivateFile(path, contents, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  const runner = dependencies.runner ?? runWindowsPrivateAcl;
+  const defaultRoot = dependencies.defaultRoot ?? resolve(homedir(), ".vtx", "inference-host");
+  const directory = dirname(path);
+  await ensureInferencePrivateDirectory(directory, dependencies);
+  const hardenedDirectoryIdentity = platform === "win32" && isDefaultWindowsPrivatePath(directory, defaultRoot) ? windowsAclCache.get(aclCacheKey(directory, "directory", "harden")) : void 0;
+  if (platform === "win32" && isDefaultWindowsPrivatePath(directory, defaultRoot) && !hardenedDirectoryIdentity) {
+    throw new Error("Windows private directory ACL hardening was not durably verified.");
+  }
+  const temporary = join(
+    directory,
+    `.${process.pid}.${randomBytes(12).toString("hex")}.tmp`
+  );
+  const handle = await open(
+    temporary,
+    constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW,
+    384
+  );
+  try {
+    await handle.writeFile(contents, "utf8");
+    await handle.sync();
+  } catch (error) {
+    await handle.close().catch(() => void 0);
+    await rm(temporary, { force: true }).catch(() => void 0);
+    throw error;
+  }
+  await handle.close();
+  await secureWindowsPrivatePath(temporary, "file", "harden", platform, runner);
+  const hardenedIdentity = platform === "win32" ? windowsAclCache.get(aclCacheKey(temporary, "file", "harden")) : void 0;
+  if (platform === "win32" && !hardenedIdentity) {
+    await rm(temporary, { force: true }).catch(() => void 0);
+    throw new Error("Windows private ACL hardening was not durably verified.");
+  }
+  try {
+    invalidateWindowsAclCache(path);
+    await replaceAtomicInferencePrivateFile(temporary, path, {
+      platform,
+      renameFile: dependencies.renameFile,
+      sleep: dependencies.sleep,
+      maxAttempts: dependencies.replaceMaxAttempts,
+      retryDelayMs: dependencies.replaceRetryDelayMs
+    });
+    if (platform === "win32" && hardenedIdentity) {
+      await rebindHardenedWindowsAclAfterRename(
+        temporary,
+        path,
+        "file",
+        hardenedIdentity
+      );
+    } else {
+      invalidateWindowsAclCache(temporary);
+    }
+    await syncInferenceDirectory(directory, platform);
+    if (platform === "win32" && hardenedDirectoryIdentity) {
+      await rebindHardenedWindowsDirectoryAfterOwnedMutation(
+        directory,
+        hardenedDirectoryIdentity
+      );
+    }
+  } catch (error) {
+    await rm(temporary, { force: true }).catch(() => void 0);
+    invalidateWindowsAclCache(temporary);
+    throw error;
+  }
+}
+async function acquireInferenceHostProcessLock(path, dependencies = {}) {
+  const directory = dirname(path);
+  await ensureInferencePrivateDirectory(directory);
+  const ownerToken = randomBytes(24).toString("base64url");
+  const observeIdentity = dependencies.processIdentity ?? defaultProcessIdentity;
+  const currentBootIdentity = dependencies.currentBootIdentity ?? (() => readInferenceSystemBootIdentity());
+  const isProcessAlive = dependencies.processAlive ?? ((pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (error) {
+      if (error.code === "ESRCH") return false;
+      throw error;
+    }
+  });
+  let handle;
+  for (let acquisition = 0; acquisition < 2; acquisition += 1) {
+    try {
+      handle = await open(
+        path,
+        constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW,
+        384
+      );
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (acquisition > 0) {
+        throw new Error("Another inference host process already owns this local host.");
+      }
+      let before;
+      try {
+        before = await lstat(path);
+      } catch (error2) {
+        if (error2.code === "ENOENT") continue;
+        throw error2;
+      }
+      if (before.isSymbolicLink() || !before.isFile() || process.platform !== "win32" && (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
+        throw new Error("Inference host process lock is unsafe.");
+      }
+      const reclaimPublicationResidue = async () => {
+        let current2;
+        try {
+          current2 = await lstat(path);
+        } catch (error2) {
+          if (error2.code === "ENOENT") return false;
+          throw error2;
+        }
+        if (current2.isSymbolicLink() || !current2.isFile() || current2.dev !== before.dev || current2.ino !== before.ino || process.platform !== "win32" && (current2.mode & 63) !== 0 || typeof process.getuid === "function" && current2.uid !== process.getuid()) {
+          throw new Error("Inference host process lock publication residue changed or is unsafe.");
+        }
+        try {
+          await rm(path);
+        } catch (error2) {
+          if (error2.code === "ENOENT") return false;
+          throw error2;
+        }
+        processLockObservationCache.delete(resolve(path));
+        await syncInferenceDirectory(directory);
+        return true;
+      };
+      try {
+        await secureExistingWindowsPath(path, "file");
+      } catch (error2) {
+        if (error2.code === "ENOENT") continue;
+        throw error2;
+      }
+      let staleOwner;
+      try {
+        staleOwner = JSON.parse(await readFile(path, "utf8"));
+      } catch (error2) {
+        if (error2.code === "ENOENT") continue;
+        if (Date.now() - before.mtimeMs < 1e4) {
+          throw new Error("Another inference host process already owns this local host.");
+        }
+        await reclaimPublicationResidue();
+        continue;
+      }
+      if (staleOwner.schema_version !== 2 || !Number.isSafeInteger(staleOwner.pid) || Number(staleOwner.pid) < 1 || typeof staleOwner.owner_token !== "string" || !staleOwner.owner_token || typeof staleOwner.process_identity !== "string" || !staleOwner.process_identity || typeof staleOwner.boot_identity !== "string" || !staleOwner.boot_identity) {
+        if (Date.now() - before.mtimeMs < 1e4) {
+          throw new Error("Another inference host process already owns this local host.");
+        }
+        await reclaimPublicationResidue();
+        continue;
+      }
+      const stalePid = Number(staleOwner.pid);
+      const bootIdentity2 = await currentBootIdentity();
+      if (bootIdentity2 === staleOwner.boot_identity && isProcessAlive(stalePid)) {
+        const cached = processLockObservationCache.get(resolve(path));
+        const observedIdentity = cached && cached.dev === before.dev && cached.ino === before.ino && cached.pid === stalePid && cached.storedIdentity === staleOwner.process_identity && Date.now() - cached.observedAtMs < 5e3 ? cached.observedIdentity : await observeIdentity(stalePid);
+        if (!observedIdentity) {
+          throw new Error("Inference host could not verify the existing lock owner identity.");
+        }
+        processLockObservationCache.set(resolve(path), {
+          dev: before.dev,
+          ino: before.ino,
+          pid: stalePid,
+          storedIdentity: staleOwner.process_identity,
+          observedIdentity,
+          observedAtMs: Date.now()
+        });
+        if (inferenceProcessIdentitiesMatch(staleOwner.process_identity, observedIdentity)) {
+          throw new Error("Another inference host process already owns this local host.");
+        }
+      }
+      let current;
+      try {
+        current = await lstat(path);
+      } catch (error2) {
+        if (error2.code === "ENOENT") continue;
+        throw error2;
+      }
+      if (current.dev !== before.dev || current.ino !== before.ino) {
+        throw new Error("Inference host process lock ownership changed.");
+      }
+      await rm(path);
+      processLockObservationCache.delete(resolve(path));
+      await syncInferenceDirectory(directory);
+    }
+  }
+  if (!handle) throw new Error("Inference host process lock could not be acquired.");
+  let ownerIdentity;
+  let bootIdentity;
+  try {
+    [ownerIdentity, bootIdentity] = await Promise.all([
+      (dependencies.currentProcessIdentity ?? defaultCurrentProcessIdentity)(),
+      currentBootIdentity()
+    ]);
+  } catch (error) {
+    await handle.close().catch(() => void 0);
+    await rm(path, { force: true }).catch(() => void 0);
+    throw error;
+  }
+  await handle.writeFile(
+    `${JSON.stringify({
+      schema_version: 2,
+      pid: process.pid,
+      owner_token: ownerToken,
+      process_identity: ownerIdentity,
+      boot_identity: bootIdentity
+    })}
+`,
+    "utf8"
+  );
+  await handle.sync();
+  await handle.close();
+  await secureWindowsPrivatePath(path, "file", "harden");
+  await syncInferenceDirectory(directory);
+  let released = false;
+  return {
+    path,
+    ownerToken,
+    release: async () => {
+      if (released) return;
+      const metadata = await lstat(path);
+      if (metadata.isSymbolicLink() || !metadata.isFile()) {
+        throw new Error("Inference host process lock is unsafe.");
+      }
+      const parsed = JSON.parse(await readFile(path, "utf8"));
+      if (parsed.owner_token !== ownerToken) {
+        throw new Error("Inference host process lock ownership changed.");
+      }
+      await rm(path);
+      processLockObservationCache.delete(resolve(path));
+      await syncInferenceDirectory(directory);
+      released = true;
+    }
+  };
+}
+
+// lib/inference-host/service-bootstrap.ts
+var OFFICIAL_NPM_REGISTRY = "https://registry.npmjs.org";
+var PACKAGE_NAME = "@vtxmacro/cli";
+var UPDATE_ATTEMPTS = 3;
+var UPDATE_RETRY_MS = 2e3;
+var CANDIDATE_READINESS_TIMEOUT_MS = 10 * 60 * 1e3;
+var SERVICE_DRAIN_COMMAND = "vtx-inference-host-service-drain-v1";
+var safePath = (value, label) => {
+  if (typeof value !== "string" || !value || /[\r\n\0]/u.test(value)) {
+    throw new Error(`Inference-host bootstrap ${label} is invalid.`);
+  }
+  return resolve2(value);
+};
+var parseManifest = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Inference-host bootstrap manifest is invalid.");
+  }
+  const record = value;
+  if (!["vtx_inference_service_v1", "vtx_inference_service_v2", "vtx_inference_service_v3"].includes(String(record.schema_version))) {
+    throw new Error("Inference-host bootstrap manifest version is unsupported.");
+  }
+  return {
+    generation: typeof record.generation === "string" && record.generation ? record.generation : `legacy:${String(record.installed_at ?? "")}`,
+    executable: safePath(record.executable, "executable"),
+    script: safePath(record.script, "script"),
+    log_path: safePath(record.log_path, "log path"),
+    worker_names: Array.isArray(record.workers) ? record.workers.map((worker) => {
+      if (!worker || typeof worker !== "object" || Array.isArray(worker)) {
+        throw new Error("Inference-host bootstrap worker is invalid.");
+      }
+      const instanceName = worker.instance_name;
+      if (typeof instanceName !== "string" || !instanceName) {
+        throw new Error("Inference-host bootstrap worker is invalid.");
+      }
+      return instanceName;
+    }).sort() : ["default"]
+  };
+};
+var serviceSiblingPath = (manifestPath, suffix) => {
+  if (!manifestPath.endsWith(".service.json")) {
+    throw new Error("Inference-host bootstrap manifest path is invalid.");
+  }
+  return `${manifestPath.slice(0, -".service.json".length)}${suffix}`;
+};
+var desiredPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-desired.json");
+var selectionPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-release.json");
+var releasesPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-releases");
+var rejectionPathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-release-rejection.json");
+var runtimePathFor = (manifestPath) => serviceSiblingPath(manifestPath, ".service-runtime.json");
+var readDesired = async (manifestPath) => {
+  const value = JSON.parse(await readFile2(desiredPathFor(manifestPath), "utf8"));
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Inference-host bootstrap desired state is invalid.");
+  }
+  const record = value;
+  if (record.schema_version !== "vtx_inference_service_desired_v1" || typeof record.desired_running !== "boolean") {
+    throw new Error("Inference-host bootstrap desired state is invalid.");
+  }
+  return record.desired_running;
+};
+var parseVersion = (value) => {
+  const match = /^(\d{4})\.(\d{1,2})\.(\d{1,3})$/u.exec(value);
+  if (!match) return null;
+  const values = match.slice(1).map(Number);
+  if (values.some((entry) => !Number.isSafeInteger(entry) || entry < 0)) return null;
+  return values;
+};
+var compareInferenceHostReleaseVersions = (left, right) => {
+  const leftParts = parseVersion(left);
+  const rightParts = parseVersion(right);
+  if (!leftParts || !rightParts) {
+    throw new Error("Inference-host release version is invalid.");
+  }
+  for (let index = 0; index < leftParts.length; index += 1) {
+    const difference = leftParts[index] - rightParts[index];
+    if (difference !== 0) return difference;
+  }
+  return 0;
+};
+var isPathWithin = (parent, child) => {
+  const childRelative = relative2(resolve2(parent), resolve2(child));
+  return childRelative !== "" && !childRelative.startsWith("..") && !isAbsolute2(childRelative);
+};
+var parseSelection = async (manifestPath) => {
+  try {
+    const value = JSON.parse(await readFile2(selectionPathFor(manifestPath), "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const record = value;
+    const script = safePath(record.script, "selected script");
+    if (record.schema_version !== "vtx_inference_service_release_v1" || record.package_name !== PACKAGE_NAME || typeof record.package_version !== "string" || !parseVersion(record.package_version) || typeof record.integrity !== "string" || typeof record.selected_at !== "string" || !Number.isFinite(Date.parse(record.selected_at)) || !isPathWithin(releasesPathFor(manifestPath), script)) return null;
+    await access(script);
+    return record;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    return null;
+  }
+};
+var parseRejection = async (manifestPath) => {
+  try {
+    const value = JSON.parse(await readFile2(rejectionPathFor(manifestPath), "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const record = value;
+    if (record.schema_version !== "vtx_inference_service_release_rejection_v1" || typeof record.package_version !== "string" || !parseVersion(record.package_version) || typeof record.rejected_at !== "string" || !Number.isFinite(Date.parse(record.rejected_at)) || typeof record.reason !== "string" || !/^[a-z0-9_]{1,96}$/u.test(record.reason)) return null;
+    return record;
+  } catch {
+    return null;
+  }
+};
+var writeRejection = async (manifestPath, rejection) => {
+  await writeAtomicInferencePrivateFile(
+    rejectionPathFor(manifestPath),
+    `${JSON.stringify(rejection, null, 2)}
+`
+  );
+};
+var defaultRunCommand = async (command, args) => await new Promise((resolvePromise) => {
+  const child = spawn2(command, [...args], {
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const stdout = [];
+  const stderr = [];
+  let settled = false;
+  const settle = (result) => {
+    if (settled) return;
+    settled = true;
+    resolvePromise(result);
+  };
+  child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
+  child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
+  child.once("error", (error) => settle({ exitCode: 1, stdout: "", stderr: error.message }));
+  child.once("exit", (code) => settle({
+    exitCode: code ?? 1,
+    stdout: Buffer.concat(stdout).toString("utf8"),
+    stderr: Buffer.concat(stderr).toString("utf8")
+  }));
+});
+var encodedPowerShell = (script) => [
+  "-NoLogo",
+  "-NoProfile",
+  "-NonInteractive",
+  "-EncodedCommand",
+  Buffer.from(script, "utf16le").toString("base64")
+];
+var runInferenceHostBootstrapNpmCommand = async (executable, args, platform = process.platform, runCommand = defaultRunCommand) => {
+  const npmPath = platform === "win32" ? windowsPath2.join(windowsPath2.dirname(executable), "npm.cmd") : join2(dirname2(executable), "npm");
+  if (platform !== "win32") return await runCommand(npmPath, args);
+  const payload = Buffer.from(JSON.stringify({ command: npmPath, args }), "utf16le").toString("base64");
+  const script = [
+    "$ErrorActionPreference='Stop'",
+    `$payload='${payload}'`,
+    "$request=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($payload)) | ConvertFrom-Json",
+    "& ([string]$request.command) @($request.args | ForEach-Object { [string]$_ })",
+    "$code=$LASTEXITCODE",
+    "if($null -eq $code){$code=1}",
+    "exit $code"
+  ].join(";");
+  return await runCommand("powershell.exe", encodedPowerShell(script));
+};
+var defaultRunSupervisor = (executable, args) => {
+  const child = spawn2(executable, [...args], {
+    windowsHide: true,
+    env: { ...process.env, VTX_INFERENCE_HOST_SERVICE_CHILD: "1" },
+    stdio: ["pipe", "inherit", "inherit"]
+  });
+  const completion = new Promise((resolvePromise, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code) => resolvePromise(code ?? 1));
+  });
+  child.stdin.on("error", () => {
+  });
+  return {
+    completion,
+    requestDrain: () => {
+      child.stdin.end(`${SERVICE_DRAIN_COMMAND}
+`);
+    }
+  };
+};
+var appendBootstrapLog = async (path, event, fields = {}) => {
+  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+  await appendFile(
+    path,
+    `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), event, ...fields })}
+`,
+    { encoding: "utf8", mode: 384 }
+  );
+};
+var fetchLatestRelease = async (fetchImpl) => {
+  const response = await fetchImpl(`${OFFICIAL_NPM_REGISTRY}/%40vtxmacro%2Fcli/latest`, {
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!response.ok) throw new Error("registry_request_failed");
+  const value = await response.json();
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("registry_metadata_invalid");
+  }
+  const record = value;
+  const distribution = record.dist;
+  if (record.name !== PACKAGE_NAME || typeof record.version !== "string" || !parseVersion(record.version) || !distribution || typeof distribution !== "object" || Array.isArray(distribution) || typeof distribution.integrity !== "string") throw new Error("registry_metadata_invalid");
+  return {
+    version: record.version,
+    integrity: distribution.integrity
+  };
+};
+var verifyIntegrity = async (tarballPath, integrity) => {
+  const candidates = integrity.split(/\s+/u).map((entry) => {
+    const separator = entry.indexOf("-");
+    return separator > 0 ? { algorithm: entry.slice(0, separator), digest: entry.slice(separator + 1) } : null;
+  }).filter((entry) => entry !== null);
+  const supported = ["sha512", "sha384", "sha256"].map((algorithm) => candidates.find((candidate) => candidate.algorithm === algorithm)).find(Boolean);
+  if (!supported) throw new Error("release_integrity_unsupported");
+  const actual = createHash(supported.algorithm).update(await readFile2(tarballPath)).digest("base64");
+  if (actual !== supported.digest) throw new Error("release_integrity_mismatch");
+};
+var atomicWriteSelection = async (manifestPath, selection) => {
+  await writeAtomicInferencePrivateFile(
+    selectionPathFor(manifestPath),
+    `${JSON.stringify(selection, null, 2)}
+`
+  );
+};
+var verifyInstalledRelease = async (prefix, targetVersion, executable, platform, runCommand) => {
+  const rootResult = await runInferenceHostBootstrapNpmCommand(
+    executable,
+    ["root", "--global", "--prefix", prefix],
+    platform,
+    runCommand
+  );
+  if (rootResult.exitCode !== 0 || !rootResult.stdout.trim()) {
+    throw new Error("release_install_invalid");
+  }
+  const packagePath = resolve2(rootResult.stdout.trim(), PACKAGE_NAME);
+  if (!isPathWithin(prefix, packagePath)) throw new Error("release_install_invalid");
+  const packageJson = JSON.parse(await readFile2(join2(packagePath, "package.json"), "utf8"));
+  if (!packageJson || typeof packageJson !== "object" || Array.isArray(packageJson)) {
+    throw new Error("release_install_invalid");
+  }
+  const packageRecord = packageJson;
+  const bin = packageRecord.bin;
+  const binPath = bin && typeof bin === "object" && !Array.isArray(bin) ? bin.vtx : null;
+  if (packageRecord.name !== PACKAGE_NAME || packageRecord.version !== targetVersion || typeof binPath !== "string") throw new Error("release_install_invalid");
+  const script = resolve2(packagePath, binPath);
+  if (!isPathWithin(packagePath, script)) throw new Error("release_install_invalid");
+  await access(script);
+  const verified = await runCommand(executable, [script, "--version"]);
+  if (verified.exitCode !== 0 || verified.stdout.trim() !== targetVersion) {
+    throw new Error("release_version_verification_failed");
+  }
+  return script;
+};
+var cleanupInterruptedReleaseStaging = async (releasesPath) => {
+  const entries = await readdir(releasesPath, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory() && /^\.(?:staging|download)-\d{4}\.\d{1,2}\.\d{1,3}-[0-9a-f-]{36}$/u.test(entry.name)) {
+      await rm2(resolve2(releasesPath, entry.name), { recursive: true, force: true });
+    }
+  }
+};
+var stageRelease = async (manifestPath, target, executable, platform, runCommand, now) => {
+  const releasesPath = releasesPathFor(manifestPath);
+  const finalPath = join2(releasesPath, target.version);
+  const stagingPath = join2(releasesPath, `.staging-${target.version}-${randomUUID()}`);
+  const downloadPath = join2(releasesPath, `.download-${target.version}-${randomUUID()}`);
+  await mkdir2(releasesPath, { recursive: true, mode: 448 });
+  await cleanupInterruptedReleaseStaging(releasesPath);
+  try {
+    await access(finalPath);
+    const existingScript = await verifyInstalledRelease(
+      finalPath,
+      target.version,
+      executable,
+      platform,
+      runCommand
+    );
+    const existingSelection = {
+      schema_version: "vtx_inference_service_release_v1",
+      package_name: PACKAGE_NAME,
+      package_version: target.version,
+      integrity: target.integrity,
+      script: existingScript,
+      selected_at: now().toISOString()
+    };
+    return existingSelection;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  await mkdir2(stagingPath, { recursive: true, mode: 448 });
+  await mkdir2(downloadPath, { recursive: true, mode: 448 });
+  try {
+    const packed = await runInferenceHostBootstrapNpmCommand(executable, [
+      "pack",
+      `${PACKAGE_NAME}@${target.version}`,
+      "--pack-destination",
+      downloadPath,
+      "--registry",
+      OFFICIAL_NPM_REGISTRY,
+      "--json"
+    ], platform, runCommand);
+    if (packed.exitCode !== 0) throw new Error("release_download_failed");
+    let filename;
+    try {
+      const parsed = JSON.parse(packed.stdout);
+      filename = String(parsed[0]?.filename ?? "");
+    } catch {
+      throw new Error("release_download_invalid");
+    }
+    const tarballPath = resolve2(downloadPath, filename);
+    if (!filename || !isPathWithin(downloadPath, tarballPath)) {
+      throw new Error("release_download_invalid");
+    }
+    await verifyIntegrity(tarballPath, target.integrity);
+    const installed = await runInferenceHostBootstrapNpmCommand(executable, [
+      "install",
+      "--global",
+      "--prefix",
+      stagingPath,
+      tarballPath,
+      "--no-audit",
+      "--no-fund",
+      "--registry",
+      OFFICIAL_NPM_REGISTRY
+    ], platform, runCommand);
+    if (installed.exitCode !== 0) throw new Error("release_install_failed");
+    const stagedScript = await verifyInstalledRelease(
+      stagingPath,
+      target.version,
+      executable,
+      platform,
+      runCommand
+    );
+    try {
+      await rename2(stagingPath, finalPath);
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      throw new Error("release_path_already_exists");
+    }
+    const finalScript = resolve2(finalPath, relative2(stagingPath, stagedScript));
+    const selection = {
+      schema_version: "vtx_inference_service_release_v1",
+      package_name: PACKAGE_NAME,
+      package_version: target.version,
+      integrity: target.integrity,
+      script: finalScript,
+      selected_at: now().toISOString()
+    };
+    return selection;
+  } finally {
+    await rm2(stagingPath, { recursive: true, force: true }).catch(() => void 0);
+    await rm2(downloadPath, { recursive: true, force: true }).catch(() => void 0);
+  }
+};
+var updateSelection = async (manifestPath, manifest, dependencies) => {
+  const active = await parseSelection(manifestPath);
+  let latest = null;
+  let lastError = null;
+  for (let attempt = 0; attempt < UPDATE_ATTEMPTS; attempt += 1) {
+    try {
+      latest = await fetchLatestRelease(dependencies.fetch);
+      break;
+    } catch (error) {
+      lastError = error;
+      if (attempt + 1 < UPDATE_ATTEMPTS) await dependencies.sleep(UPDATE_RETRY_MS);
+    }
+  }
+  if (!latest) throw lastError ?? new Error("registry_request_failed");
+  const installedVersion = active?.package_version ?? agent_cli_release_default.package_version;
+  if (compareInferenceHostReleaseVersions(latest.version, installedVersion) < 0) {
+    return { active, candidate: null };
+  }
+  if (active && latest.version === active.package_version) {
+    return { active, candidate: null };
+  }
+  const rejection = await parseRejection(manifestPath);
+  if (rejection?.package_version === latest.version) return { active, candidate: null };
+  if (!await readDesired(manifestPath)) return { active, candidate: null };
+  return {
+    active,
+    candidate: await stageRelease(
+      manifestPath,
+      latest,
+      manifest.executable,
+      dependencies.platform,
+      dependencies.runCommand,
+      dependencies.now
+    )
+  };
+};
+var waitForCandidateReadiness = async (manifestPath, manifest, candidate, signal, sleep, timeoutMs) => {
+  const deadline = Date.now() + timeoutMs;
+  while (!signal.aborted && Date.now() < deadline) {
+    try {
+      const value = JSON.parse(await readFile2(runtimePathFor(manifestPath), "utf8"));
+      if (value && typeof value === "object" && !Array.isArray(value)) {
+        const runtime = value;
+        const workers = Array.isArray(runtime.workers) ? runtime.workers : [];
+        const workerNames = workers.map((worker) => worker && typeof worker === "object" && !Array.isArray(worker) ? String(worker.instance_name ?? "") : "").sort();
+        const everyWorkerRunning = workers.every((worker) => worker && typeof worker === "object" && !Array.isArray(worker) && worker.state === "running");
+        if (runtime.schema_version === "vtx_inference_service_runtime_v1" && runtime.manifest_generation === manifest.generation && typeof runtime.updated_at === "string" && Date.parse(runtime.updated_at) >= Date.parse(candidate.selected_at) && JSON.stringify(workerNames) === JSON.stringify(manifest.worker_names) && everyWorkerRunning) return "ready";
+      }
+    } catch {
+    }
+    await sleep(250);
+  }
+  return signal.aborted ? "aborted" : "timeout";
+};
+var prunePrivateReleases = async (manifestPath, keep) => {
+  const releasesPath = releasesPathFor(manifestPath);
+  const keepPaths = new Set(
+    keep.filter((item) => item !== null).map((item) => resolve2(item.script)).filter((script) => isPathWithin(releasesPath, script)).map((script) => resolve2(releasesPath, relative2(releasesPath, script).split(/[\\/]/u)[0]))
+  );
+  let entries;
+  try {
+    entries = await readdir(releasesPath, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !parseVersion(entry.name)) continue;
+    const releasePath = resolve2(releasesPath, entry.name);
+    if (!keepPaths.has(releasePath)) {
+      await rm2(releasePath, { recursive: true, force: true });
+    }
+  }
+};
+var supervisorArguments = (script, manifestPath) => [
+  script,
+  "inference-host",
+  "service",
+  "run-internal",
+  "--service-manifest",
+  manifestPath
+];
+var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies = {}, lockPathValue) => {
+  const manifestPath = resolve2(manifestPathValue);
+  const lockPath = safePath(
+    lockPathValue ?? serviceSiblingPath(manifestPath, ".service-bootstrap.lock"),
+    "lock path"
+  );
+  const lock = await (dependencies.acquireProcessLock ?? acquireInferenceHostProcessLock)(lockPath);
+  try {
+    const manifest = parseManifest(JSON.parse(await readFile2(manifestPath, "utf8")));
+    if (!await readDesired(manifestPath)) {
+      await appendBootstrapLog(manifest.log_path, "service_bootstrap_stopped");
+      return 0;
+    }
+    const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
+    const sleep = dependencies.sleep ?? (async (milliseconds) => {
+      await new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
+    });
+    const runSupervisor = dependencies.runSupervisor ?? defaultRunSupervisor;
+    const selectedBeforeUpdate = await parseSelection(manifestPath);
+    let updatePlan = { active: selectedBeforeUpdate, candidate: null };
+    try {
+      updatePlan = await updateSelection(manifestPath, manifest, {
+        fetch: dependencies.fetch ?? fetch,
+        now,
+        platform: dependencies.platform ?? process.platform,
+        runCommand: dependencies.runCommand ?? defaultRunCommand,
+        sleep
+      });
+    } catch (error) {
+      await appendBootstrapLog(manifest.log_path, "service_update_deferred", {
+        reason: error instanceof Error ? error.message.slice(0, 160) : "unknown"
+      });
+    }
+    if (!await readDesired(manifestPath)) {
+      await appendBootstrapLog(manifest.log_path, "service_bootstrap_stopped");
+      return 0;
+    }
+    const launch = async (selection) => {
+      const script = selection?.script ?? manifest.script;
+      await access(manifest.executable);
+      await access(script);
+      await appendBootstrapLog(manifest.log_path, "service_bootstrap_launch", {
+        package_version: selection?.package_version ?? agent_cli_release_default.package_version
+      });
+      return await runSupervisor(
+        manifest.executable,
+        supervisorArguments(script, manifestPath)
+      ).completion;
+    };
+    if (!updatePlan.candidate) return await launch(updatePlan.active);
+    const candidate = updatePlan.candidate;
+    await appendBootstrapLog(manifest.log_path, "service_release_candidate_started", {
+      package_version: candidate.package_version
+    });
+    let candidateSupervisor = null;
+    let candidateFailure = "candidate_launch_failed";
+    let candidateExitCode = 1;
+    const readinessController = new AbortController();
+    try {
+      candidateSupervisor = runSupervisor(
+        manifest.executable,
+        supervisorArguments(candidate.script, manifestPath)
+      );
+      const first = await Promise.race([
+        candidateSupervisor.completion.then(
+          (exitCode) => ({ kind: "exit", exitCode }),
+          () => ({ kind: "error", exitCode: 1 })
+        ),
+        waitForCandidateReadiness(
+          manifestPath,
+          manifest,
+          candidate,
+          readinessController.signal,
+          sleep,
+          dependencies.readinessTimeoutMs ?? CANDIDATE_READINESS_TIMEOUT_MS
+        ).then((status) => ({ kind: status, exitCode: 1 }))
+      ]);
+      if (first.kind === "ready") {
+        readinessController.abort();
+        await atomicWriteSelection(manifestPath, candidate);
+        await rm2(rejectionPathFor(manifestPath), { force: true }).catch(() => void 0);
+        await prunePrivateReleases(manifestPath, [candidate, updatePlan.active]).catch(
+          async () => await appendBootstrapLog(
+            manifest.log_path,
+            "service_release_cleanup_deferred",
+            { package_version: candidate.package_version }
+          ).catch(() => void 0)
+        );
+        await appendBootstrapLog(manifest.log_path, "service_release_selected", {
+          package_version: candidate.package_version
+        }).catch(() => void 0);
+        return await candidateSupervisor.completion;
+      }
+      if (first.kind === "timeout") {
+        candidateFailure = "candidate_readiness_timeout";
+        candidateSupervisor.requestDrain();
+        candidateExitCode = await candidateSupervisor.completion.catch(() => 1);
+      } else {
+        candidateFailure = first.kind === "error" ? "candidate_launch_failed" : "candidate_exited_before_readiness";
+        candidateExitCode = first.exitCode;
+      }
+    } catch {
+      candidateFailure = "candidate_launch_failed";
+      candidateExitCode = 1;
+      if (candidateSupervisor) {
+        try {
+          candidateSupervisor.requestDrain();
+        } catch {
+        }
+        candidateExitCode = await candidateSupervisor.completion.catch(() => 1);
+      }
+    } finally {
+      readinessController.abort();
+    }
+    if (!await readDesired(manifestPath)) return candidateExitCode;
+    await writeRejection(manifestPath, {
+      schema_version: "vtx_inference_service_release_rejection_v1",
+      package_version: candidate.package_version,
+      rejected_at: now().toISOString(),
+      reason: candidateFailure
+    });
+    await prunePrivateReleases(manifestPath, [updatePlan.active]);
+    await appendBootstrapLog(manifest.log_path, "service_release_rolled_back", {
+      package_version: candidate.package_version,
+      reason: candidateFailure
+    });
+    return await launch(updatePlan.active);
+  } finally {
+    await lock.release();
+  }
+};
+var invokedPath = process.argv[1] ? resolve2(process.argv[1]) : "";
+if (invokedPath === fileURLToPath(import.meta.url)) {
+  const manifestIndex = process.argv.indexOf("--service-manifest");
+  const lockIndex = process.argv.indexOf("--service-lock");
+  const manifestPath = manifestIndex >= 0 ? process.argv[manifestIndex + 1] : null;
+  const lockPath = lockIndex >= 0 ? process.argv[lockIndex + 1] : null;
+  if (!manifestPath || !lockPath) {
+    process.stderr.write("Internal service manifest and lock paths are required.\n");
+    process.exitCode = 1;
+  } else {
+    process.exitCode = await runInferenceHostServiceBootstrap(manifestPath, {}, lockPath).catch((error) => {
+      process.stderr.write(`${error instanceof Error ? error.message : "Inference-host bootstrap failed."}
+`);
+      return 1;
+    });
+  }
+}
+export {
+  compareInferenceHostReleaseVersions,
+  runInferenceHostBootstrapNpmCommand,
+  runInferenceHostServiceBootstrap
+};