@vtxmacro/cli 2026.9.29 → 2026.9.31

package/README.md

@@ -16,16 +16,20 @@ verifies the Codex runtime's version and digest before use; it does not borrow a
 Codex binary from PATH or an editor extension.
 For Windows-login auto-start, install and configure the CLI from native Windows;
 a CLI installed only inside WSL cannot start the WSL virtual machine at login.
-New service installations use a private verified launcher. At login and every
-service start, it checks the official npm registry, verifies the exact release
-integrity and installed CLI version in a new versioned directory, starts it as a
-candidate, and selects it only after every configured worker reports ready. A
+New service installations use a private verified launcher. At login, every
+service start, and periodically while running, it checks the official npm registry
+and verifies the exact release integrity and installed CLI version in a new
+versioned directory. Before switching, it stops new admission and lets active
+Provider calls and Agent turns finish while keeping heartbeats alive. It selects
+the candidate only after every configured worker reports ready. A
 failed candidate is rejected and the last working runtime resumes. The service
 keeps only the active release and one rollback release. If the update check is
 unavailable, it keeps the last verified runtime. An intentionally stopped
 service stays stopped and makes no update request. Hosts installed before this
-automatic updater need one final normal npm update and service reinstall to
-adopt it.
+private launcher need one final normal npm update and service reinstall to
+adopt it. Startup-only launchers adopt background checking after their next normal
+start activates a release that includes it; publishing a release cannot replace
+an older process that is already running.
 
 ## Configure
 

package/bin/vtx-service-bootstrap.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 // agent-cli-release.json
 var agent_cli_release_default = {
   package_name: "@vtxmacro/cli",
-  package_version: "2026.9.29",
+  package_version: "2026.9.31",
   codex_package_name: "@openai/codex",
   codex_version: "0.153.3",
   copilot_sdk_package_name: "@github/copilot-sdk",
@@ -115,6 +115,121 @@ var agent_cli_release_default = {
   }
 };
 
+// lib/runtime-policy.generated.json
+var runtime_policy_generated_default = {
+  ui: {
+    auth_bootstrap_retry: {
+      max_attempts: 3,
+      jitter_milliseconds: 750,
+      base_delay_milliseconds: 500,
+      min_delay_milliseconds: 250,
+      max_delay_milliseconds: 1e4
+    }
+  },
+  ai_dashboard: {
+    market_news_bounds: {
+      max_items_min: 1,
+      max_items_max: 100,
+      lookback_hours_min: 1,
+      lookback_hours_max: 168,
+      max_items_steps: [
+        1,
+        2,
+        3,
+        4,
+        5,
+        6,
+        7,
+        8,
+        9,
+        10,
+        15,
+        20,
+        25,
+        30,
+        40,
+        50,
+        60,
+        75,
+        90,
+        100
+      ],
+      lookback_hours_steps: [
+        1,
+        2,
+        4,
+        8,
+        12,
+        24,
+        48,
+        72,
+        168
+      ]
+    }
+  },
+  trading: {
+    engine: {
+      client_runtime: {
+        recovery: {
+          resume_retry_base_delay_ms: 1e3,
+          resume_retry_max_delay_ms: 3e4,
+          transient_load_min_delay_ms: 3e4,
+          transient_load_max_delay_ms: 12e4,
+          rate_limit_buffer_ms: 1e3,
+          rate_limit_max_delay_ms: 3e5,
+          engine_stop_settle_retry_delay_ms: 250,
+          recoverable_reset_settle_retry_delay_ms: 1500,
+          local_ai_preflight_timeout_ms: 3e3,
+          surge_stagger_max_ms: 6e4,
+          surge_stagger_min_ms: 2e3,
+          surge_stagger_min_candidates: 4,
+          stagger_deadline_ttl_ms: 3e5,
+          server_active_reprobe_delay_ms: 6e4,
+          transient_load_jitter_ms: 1e4,
+          cross_host_completed_ttl_ms: 15e3,
+          telemetry_dedupe_ttl_ms: 5e3,
+          browser_presence_heartbeat_interval_ms: 3e4,
+          host_liveness_heartbeat_interval_ms: 3e4,
+          host_liveness_recovery_nudge_ttl_ms: 1e4
+        }
+      }
+    }
+  },
+  external_inference: {
+    service: {
+      update_check_interval_ms: 3e5,
+      update_registry_timeout_ms: 15e3,
+      startup_max_attempts: 40,
+      startup_poll_interval_ms: 250,
+      restart_stable_uptime_ms: 6e4,
+      restart_backoff_base_ms: 1e3,
+      restart_backoff_max_ms: 3e4,
+      restart_exponent_max: 5
+    }
+  },
+  desktop: {
+    runtime_watchdog: {
+      ping_interval_milliseconds: 15e3,
+      telemetry_interval_milliseconds: 3e5
+    }
+  },
+  screener: {
+    resource_scheduler: {
+      client_lock_ttl_milliseconds: 12e4,
+      client_poll_interval_milliseconds: 250
+    }
+  },
+  deployment: {
+    cutover_buffer: {
+      target_timeout_ms: 3e3,
+      retired_timeout_ms: 45e3,
+      max_body_bytes: 33554432,
+      max_inflight: 16,
+      max_queue: 64
+    }
+  }
+};
+
 // lib/inference-host/config.ts
 import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
@@ -983,6 +1098,7 @@ var UPDATE_ATTEMPTS = 3;
 var UPDATE_RETRY_MS = 2e3;
 var CANDIDATE_READINESS_TIMEOUT_MS = 10 * 60 * 1e3;
 var SERVICE_DRAIN_COMMAND = "vtx-inference-host-service-drain-v1";
+var SERVICE_QUIESCE_COMMAND = "vtx-inference-host-service-quiesce-v1";
 var safePath = (value, label) => {
   if (typeof value !== "string" || !value || /[\r\n\0]/u.test(value)) {
     throw new Error(`Inference-host bootstrap ${label} is invalid.`);
@@ -1127,7 +1243,11 @@ var runInferenceHostBootstrapNpmCommand = async (executable, args, platform = pr
 var defaultRunSupervisor = (executable, args) => {
   const child = spawn2(executable, [...args], {
     windowsHide: true,
-    env: { ...process.env, VTX_INFERENCE_HOST_SERVICE_CHILD: "1" },
+    env: {
+      ...process.env,
+      VTX_INFERENCE_HOST_SERVICE_CHILD: "1",
+      VTX_INFERENCE_HOST_BOOTSTRAP_VERSION: agent_cli_release_default.package_version
+    },
     stdio: ["pipe", "inherit", "inherit"]
   });
   const completion = new Promise((resolvePromise, reject) => {
@@ -1139,7 +1259,11 @@ var defaultRunSupervisor = (executable, args) => {
   return {
     completion,
     requestDrain: () => {
-      child.stdin.end(`${SERVICE_DRAIN_COMMAND}
+      child.stdin.write(`${SERVICE_DRAIN_COMMAND}
+`);
+    },
+    requestQuiesce: () => {
+      child.stdin.write(`${SERVICE_QUIESCE_COMMAND}
 `);
     }
   };
@@ -1153,9 +1277,12 @@ var appendBootstrapLog = async (path, event, fields = {}) => {
     { encoding: "utf8", mode: 384 }
   );
 };
-var fetchLatestRelease = async (fetchImpl) => {
+var fetchLatestRelease = async (fetchImpl, signal) => {
   const response = await fetchImpl(`${OFFICIAL_NPM_REGISTRY}/%40vtxmacro%2Fcli/latest`, {
-    signal: AbortSignal.timeout(1e4)
+    signal: AbortSignal.any([
+      AbortSignal.timeout(runtime_policy_generated_default.external_inference.service.update_registry_timeout_ms),
+      ...signal ? [signal] : []
+    ])
   });
   if (!response.ok) throw new Error("registry_request_failed");
   const value = await response.json();
@@ -1323,10 +1450,12 @@ var updateSelection = async (manifestPath, manifest, dependencies) => {
   let lastError = null;
   for (let attempt = 0; attempt < UPDATE_ATTEMPTS; attempt += 1) {
     try {
-      latest = await fetchLatestRelease(dependencies.fetch);
+      if (dependencies.signal?.aborted) throw new Error("service_update_cancelled");
+      latest = await fetchLatestRelease(dependencies.fetch, dependencies.signal);
       break;
     } catch (error) {
       lastError = error;
+      if (dependencies.signal?.aborted) throw error;
       if (attempt + 1 < UPDATE_ATTEMPTS) await dependencies.sleep(UPDATE_RETRY_MS);
     }
   }
@@ -1340,7 +1469,7 @@ var updateSelection = async (manifestPath, manifest, dependencies) => {
   }
   const rejection = await parseRejection(manifestPath);
   if (rejection?.package_version === latest.version) return { active, candidate: null };
-  if (!await readDesired(manifestPath)) return { active, candidate: null };
+  if (dependencies.signal?.aborted || !await readDesired(manifestPath)) return { active, candidate: null };
   return {
     active,
     candidate: await stageRelease(
@@ -1353,21 +1482,23 @@ var updateSelection = async (manifestPath, manifest, dependencies) => {
     )
   };
 };
-var waitForCandidateReadiness = async (manifestPath, manifest, candidate, signal, sleep, timeoutMs) => {
+var waitForCandidateReadiness = async (manifestPath, candidate, signal, timeoutMs) => {
   const deadline = Date.now() + timeoutMs;
   while (!signal.aborted && Date.now() < deadline) {
+    if (!await readDesired(manifestPath)) return "aborted";
     try {
+      const currentManifest = parseManifest(JSON.parse(await readFile2(manifestPath, "utf8")));
       const value = JSON.parse(await readFile2(runtimePathFor(manifestPath), "utf8"));
       if (value && typeof value === "object" && !Array.isArray(value)) {
         const runtime = value;
         const workers = Array.isArray(runtime.workers) ? runtime.workers : [];
         const workerNames = workers.map((worker) => worker && typeof worker === "object" && !Array.isArray(worker) ? String(worker.instance_name ?? "") : "").sort();
         const everyWorkerRunning = workers.every((worker) => worker && typeof worker === "object" && !Array.isArray(worker) && worker.state === "running");
-        if (runtime.schema_version === "vtx_inference_service_runtime_v1" && runtime.manifest_generation === manifest.generation && typeof runtime.updated_at === "string" && Date.parse(runtime.updated_at) >= Date.parse(candidate.selected_at) && JSON.stringify(workerNames) === JSON.stringify(manifest.worker_names) && everyWorkerRunning) return "ready";
+        if (runtime.schema_version === "vtx_inference_service_runtime_v1" && runtime.manifest_generation === currentManifest.generation && typeof runtime.updated_at === "string" && Date.parse(runtime.updated_at) >= Date.parse(candidate.selected_at) && JSON.stringify(workerNames) === JSON.stringify(currentManifest.worker_names) && everyWorkerRunning) return "ready";
       }
     } catch {
     }
-    await sleep(250);
+    await waitForUpdateCheck(250, signal);
   }
   return signal.aborted ? "aborted" : "timeout";
 };
@@ -1399,6 +1530,18 @@ var supervisorArguments = (script, manifestPath) => [
   "--service-manifest",
   manifestPath
 ];
+var waitForUpdateCheck = async (milliseconds, signal) => {
+  if (signal.aborted) return;
+  await new Promise((resolvePromise) => {
+    const finish = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", finish);
+      resolvePromise();
+    };
+    const timer = setTimeout(finish, milliseconds);
+    signal.addEventListener("abort", finish, { once: true });
+  });
+};
 var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies = {}, lockPathValue) => {
   const manifestPath = resolve2(manifestPathValue);
   const lockPath = safePath(
@@ -1406,127 +1549,217 @@ var runInferenceHostServiceBootstrap = async (manifestPathValue, dependencies =
     "lock path"
   );
   const lock = await (dependencies.acquireProcessLock ?? acquireInferenceHostProcessLock)(lockPath);
+  const lifetime = new AbortController();
+  const live = { supervisor: null };
+  const stop = () => {
+    lifetime.abort();
+    try {
+      live.supervisor?.requestDrain();
+    } catch {
+    }
+  };
+  dependencies.signal?.addEventListener("abort", stop, { once: true });
+  process.on("SIGTERM", stop);
+  process.on("SIGINT", stop);
+  if (dependencies.signal?.aborted) stop();
   try {
-    const manifest = parseManifest(JSON.parse(await readFile2(manifestPath, "utf8")));
-    if (!await readDesired(manifestPath)) {
+    let manifest = parseManifest(JSON.parse(await readFile2(manifestPath, "utf8")));
+    const shouldRun = async () => !lifetime.signal.aborted && await readDesired(manifestPath);
+    if (!await shouldRun()) {
       await appendBootstrapLog(manifest.log_path, "service_bootstrap_stopped");
       return 0;
     }
     const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
     const sleep = dependencies.sleep ?? (async (milliseconds) => {
-      await new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
+      await waitForUpdateCheck(milliseconds, lifetime.signal);
     });
     const runSupervisor = dependencies.runSupervisor ?? defaultRunSupervisor;
-    const selectedBeforeUpdate = await parseSelection(manifestPath);
-    let updatePlan = { active: selectedBeforeUpdate, candidate: null };
-    try {
-      updatePlan = await updateSelection(manifestPath, manifest, {
-        fetch: dependencies.fetch ?? fetch,
-        now,
-        platform: dependencies.platform ?? process.platform,
-        runCommand: dependencies.runCommand ?? defaultRunCommand,
-        sleep
-      });
-    } catch (error) {
-      await appendBootstrapLog(manifest.log_path, "service_update_deferred", {
-        reason: error instanceof Error ? error.message.slice(0, 160) : "unknown"
-      });
-    }
-    if (!await readDesired(manifestPath)) {
-      await appendBootstrapLog(manifest.log_path, "service_bootstrap_stopped");
-      return 0;
-    }
+    const updateDependencies = {
+      fetch: dependencies.fetch ?? fetch,
+      now,
+      platform: dependencies.platform ?? process.platform,
+      runCommand: dependencies.runCommand ?? defaultRunCommand,
+      sleep,
+      signal: lifetime.signal
+    };
+    const checkUpdate = async () => {
+      manifest = parseManifest(JSON.parse(await readFile2(manifestPath, "utf8")));
+      const active = await parseSelection(manifestPath);
+      try {
+        return await updateSelection(manifestPath, manifest, updateDependencies);
+      } catch (error) {
+        await appendBootstrapLog(manifest.log_path, "service_update_deferred", {
+          reason: error instanceof Error ? error.message.slice(0, 160) : "unknown"
+        });
+        return { active, candidate: null };
+      }
+    };
     const launch = async (selection) => {
+      manifest = parseManifest(JSON.parse(await readFile2(manifestPath, "utf8")));
       const script = selection?.script ?? manifest.script;
       await access(manifest.executable);
       await access(script);
+      if (!await shouldRun()) return null;
       await appendBootstrapLog(manifest.log_path, "service_bootstrap_launch", {
         package_version: selection?.package_version ?? agent_cli_release_default.package_version
       });
-      return await runSupervisor(
-        manifest.executable,
-        supervisorArguments(script, manifestPath)
-      ).completion;
+      if (!await shouldRun()) return null;
+      live.supervisor = runSupervisor(manifest.executable, supervisorArguments(script, manifestPath));
+      return live.supervisor;
     };
-    if (!updatePlan.candidate) return await launch(updatePlan.active);
-    const candidate = updatePlan.candidate;
-    await appendBootstrapLog(manifest.log_path, "service_release_candidate_started", {
-      package_version: candidate.package_version
-    });
-    let candidateSupervisor = null;
-    let candidateFailure = "candidate_launch_failed";
-    let candidateExitCode = 1;
-    const readinessController = new AbortController();
-    try {
-      candidateSupervisor = runSupervisor(
-        manifest.executable,
-        supervisorArguments(candidate.script, manifestPath)
-      );
-      const first = await Promise.race([
-        candidateSupervisor.completion.then(
-          (exitCode) => ({ kind: "exit", exitCode }),
-          () => ({ kind: "error", exitCode: 1 })
-        ),
-        waitForCandidateReadiness(
-          manifestPath,
-          manifest,
-          candidate,
-          readinessController.signal,
-          sleep,
-          dependencies.readinessTimeoutMs ?? CANDIDATE_READINESS_TIMEOUT_MS
-        ).then((status) => ({ kind: status, exitCode: 1 }))
-      ]);
-      if (first.kind === "ready") {
-        readinessController.abort();
-        await atomicWriteSelection(manifestPath, candidate);
-        await rm2(rejectionPathFor(manifestPath), { force: true }).catch(() => void 0);
-        await prunePrivateReleases(manifestPath, [candidate, updatePlan.active]).catch(
-          async () => await appendBootstrapLog(
-            manifest.log_path,
-            "service_release_cleanup_deferred",
-            { package_version: candidate.package_version }
-          ).catch(() => void 0)
-        );
-        await appendBootstrapLog(manifest.log_path, "service_release_selected", {
+    let updatePlan = await checkUpdate();
+    while (await shouldRun()) {
+      if (updatePlan.candidate) {
+        const candidate = { ...updatePlan.candidate, selected_at: now().toISOString() };
+        await rm2(runtimePathFor(manifestPath), { force: true });
+        await appendBootstrapLog(manifest.log_path, "service_release_candidate_started", {
           package_version: candidate.package_version
-        }).catch(() => void 0);
-        return await candidateSupervisor.completion;
-      }
-      if (first.kind === "timeout") {
-        candidateFailure = "candidate_readiness_timeout";
-        candidateSupervisor.requestDrain();
-        candidateExitCode = await candidateSupervisor.completion.catch(() => 1);
-      } else {
-        candidateFailure = first.kind === "error" ? "candidate_launch_failed" : "candidate_exited_before_readiness";
-        candidateExitCode = first.exitCode;
-      }
-    } catch {
-      candidateFailure = "candidate_launch_failed";
-      candidateExitCode = 1;
-      if (candidateSupervisor) {
+        });
+        let candidateFailure = "candidate_launch_failed";
+        let promoted = false;
+        const readinessController = new AbortController();
+        const abortReadiness = () => readinessController.abort();
+        lifetime.signal.addEventListener("abort", abortReadiness, { once: true });
         try {
-          candidateSupervisor.requestDrain();
+          const candidateSupervisor = await launch(candidate);
+          if (!candidateSupervisor) return 0;
+          const first = await Promise.race([
+            candidateSupervisor.completion.then(
+              (exitCode) => ({ kind: "exit", exitCode }),
+              () => ({ kind: "error", exitCode: 1 })
+            ),
+            waitForCandidateReadiness(
+              manifestPath,
+              candidate,
+              readinessController.signal,
+              dependencies.readinessTimeoutMs ?? CANDIDATE_READINESS_TIMEOUT_MS
+            ).then((status) => ({ kind: status, exitCode: 1 }))
+          ]);
+          if (first.kind === "ready" && await shouldRun()) {
+            await atomicWriteSelection(manifestPath, candidate);
+            await rm2(rejectionPathFor(manifestPath), { force: true }).catch(() => void 0);
+            await prunePrivateReleases(manifestPath, [candidate, updatePlan.active]).catch(
+              async () => await appendBootstrapLog(
+                manifest.log_path,
+                "service_release_cleanup_deferred",
+                { package_version: candidate.package_version }
+              ).catch(() => void 0)
+            );
+            await appendBootstrapLog(manifest.log_path, "service_release_selected", {
+              package_version: candidate.package_version
+            }).catch(() => void 0);
+            updatePlan = { active: candidate, candidate: null };
+            promoted = true;
+          } else {
+            candidateFailure = first.kind === "timeout" ? "candidate_readiness_timeout" : "candidate_exited_before_readiness";
+            if (first.kind !== "exit" && first.kind !== "error") candidateSupervisor.requestDrain();
+            await candidateSupervisor.completion.catch(() => 1);
+            live.supervisor = null;
+          }
         } catch {
+          candidateFailure = "candidate_launch_failed";
+          if (live.supervisor) {
+            live.supervisor.requestDrain();
+            await live.supervisor.completion.catch(() => 1);
+            live.supervisor = null;
+          }
+        } finally {
+          readinessController.abort();
+          lifetime.signal.removeEventListener("abort", abortReadiness);
+        }
+        if (!await shouldRun()) {
+          if (live.supervisor) {
+            live.supervisor.requestDrain();
+            await live.supervisor.completion.catch(() => 1);
+          }
+          return 0;
+        }
+        if (!promoted) {
+          await writeRejection(manifestPath, {
+            schema_version: "vtx_inference_service_release_rejection_v1",
+            package_version: candidate.package_version,
+            rejected_at: now().toISOString(),
+            reason: candidateFailure
+          });
+          await prunePrivateReleases(manifestPath, [updatePlan.active]);
+          await appendBootstrapLog(manifest.log_path, "service_release_rolled_back", {
+            package_version: candidate.package_version,
+            reason: candidateFailure
+          });
+          updatePlan = { active: updatePlan.active, candidate: null };
         }
-        candidateExitCode = await candidateSupervisor.completion.catch(() => 1);
       }
-    } finally {
-      readinessController.abort();
+      const supervisor = live.supervisor ?? await launch(updatePlan.active);
+      if (!supervisor) return 0;
+      let exited = false;
+      const completion = supervisor.completion.then(
+        (exitCode) => {
+          exited = true;
+          return exitCode;
+        },
+        () => {
+          exited = true;
+          return 1;
+        }
+      );
+      while (!exited) {
+        const pollController = new AbortController();
+        const abortPoll = () => pollController.abort();
+        lifetime.signal.addEventListener("abort", abortPoll, { once: true });
+        if (lifetime.signal.aborted) pollController.abort();
+        try {
+          await Promise.race([
+            completion,
+            waitForUpdateCheck(
+              dependencies.updateCheckIntervalMs ?? runtime_policy_generated_default.external_inference.service.update_check_interval_ms,
+              pollController.signal
+            )
+          ]);
+        } finally {
+          pollController.abort();
+          lifetime.signal.removeEventListener("abort", abortPoll);
+        }
+        if (exited) {
+          live.supervisor = null;
+          return await completion;
+        }
+        if (!await shouldRun()) {
+          supervisor.requestDrain();
+          return await completion;
+        }
+        const next = await checkUpdate();
+        if (exited) {
+          live.supervisor = null;
+          return await completion;
+        }
+        if (!await shouldRun()) {
+          supervisor.requestDrain();
+          return await completion;
+        }
+        if (!next.candidate) continue;
+        await appendBootstrapLog(manifest.log_path, "service_release_quiescing", {
+          package_version: next.candidate.package_version
+        });
+        supervisor.requestQuiesce();
+        await completion;
+        live.supervisor = null;
+        updatePlan = next;
+        break;
+      }
     }
-    if (!await readDesired(manifestPath)) return candidateExitCode;
-    await writeRejection(manifestPath, {
-      schema_version: "vtx_inference_service_release_rejection_v1",
-      package_version: candidate.package_version,
-      rejected_at: now().toISOString(),
-      reason: candidateFailure
-    });
-    await prunePrivateReleases(manifestPath, [updatePlan.active]);
-    await appendBootstrapLog(manifest.log_path, "service_release_rolled_back", {
-      package_version: candidate.package_version,
-      reason: candidateFailure
-    });
-    return await launch(updatePlan.active);
+    return 0;
   } finally {
+    lifetime.abort();
+    if (live.supervisor) {
+      try {
+        live.supervisor.requestDrain();
+      } catch {
+      }
+      await live.supervisor.completion.catch(() => 1);
+    }
+    dependencies.signal?.removeEventListener("abort", stop);
+    process.removeListener("SIGTERM", stop);
+    process.removeListener("SIGINT", stop);
     await lock.release();
   }
 };

package/bin/vtx.js

@@ -77,7 +77,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.9.29",
+      package_version: "2026.9.31",
       codex_package_name: "@openai/codex",
       codex_version: "0.153.3",
       copilot_sdk_package_name: "@github/copilot-sdk",
@@ -34407,13 +34407,30 @@ var init_grok_policy = __esm({
 import { createServer as createServer3 } from "node:http";
 import { createHash as createHash6, randomBytes as randomBytes5 } from "node:crypto";
 import { once } from "node:events";
-var record3, count2, effort, safeCode2, GrokTransportProxy, createGrokTransportProxy;
+var diagnosticNames, diagnosticTypes, diagnosticIdentifier, record3, count2, effort, safeCode2, GrokTransportProxy, createGrokTransportProxy;
 var init_grok_transport_proxy = __esm({
   "lib/inference-host/grok-transport-proxy.ts"() {
     "use strict";
     init_define_VTX_EXO_POLICY();
     init_define_VTX_GROK_POLICY();
     init_define_VTX_PI_MODEL_POLICY();
+    diagnosticNames = /* @__PURE__ */ new Set([
+      "search_tool",
+      "use_tool",
+      "bash",
+      "read_file",
+      "write_file",
+      "edit_file",
+      "web_search",
+      "vtx_get_data",
+      "vtx_submit_decision",
+      "vtx_decision_status"
+    ]);
+    diagnosticTypes = /* @__PURE__ */ new Set(["function", "web_search", "web_search_preview", "file_search", "computer_use"]);
+    diagnosticIdentifier = (value, known) => {
+      if (typeof value !== "string") return { label: value == null ? "missing" : "invalid", sha256: null };
+      return known.has(value) ? { label: value, sha256: null } : { label: "redacted", sha256: createHash6("sha256").update(value).digest("hex") };
+    };
     record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
     count2 = (value) => Number.isSafeInteger(value) && Number(value) >= 0 ? Number(value) : null;
     effort = (value) => value == null ? "none" : String(value).toLowerCase();
@@ -34434,6 +34451,7 @@ var init_grok_transport_proxy = __esm({
         this.failureCode = null;
         this.rejectionStatus = null;
         this.terminalFailure = null;
+        this.toolValidationFailure = null;
         const upstream = new URL(options.upstreamBaseUrl);
         if (upstream.protocol !== "https:" || upstream.username || upstream.password || upstream.search || upstream.hash || !options.requestedModel || typeof options.expectedSystemPrompt !== "string" || !Number.isSafeInteger(options.deadlineAtMs) || options.providerDispatchNotAfterMs !== void 0 && !Number.isSafeInteger(options.providerDispatchNotAfterMs) || !Number.isSafeInteger(options.maxRequestBytes) || options.maxRequestBytes < 1 || !Number.isSafeInteger(options.maxResponseBytes) || options.maxResponseBytes < 1 || new Set(options.allowedToolNames).size !== options.allowedToolNames.length || options.allowedToolNames.some((name) => !name)) throw new Error("grok_proxy_invalid_configuration");
       }
@@ -34471,6 +34489,31 @@ var init_grok_transport_proxy = __esm({
           throw new Error("server_account_context_expired_before_provider_dispatch");
         }
       }
+      rejectTools(reason, payload, route) {
+        const tools = Array.isArray(payload.tools) ? payload.tools : null;
+        const diagnostic = {
+          reason,
+          route,
+          tools_shape: tools ? "array" : payload.tools === null ? "null" : typeof payload.tools,
+          tool_count: tools?.length ?? null,
+          expected_tool_count: this.options.allowedToolNames.length,
+          tools: (tools ?? []).slice(0, 8).map((value) => {
+            const tool = record3(value);
+            const type = diagnosticIdentifier(tool.type, diagnosticTypes);
+            const name = diagnosticIdentifier(route === "/responses" ? tool.name : record3(tool.function).name, diagnosticNames);
+            return { type: type.label, name: name.label, type_sha256: type.sha256, name_sha256: name.sha256 };
+          }),
+          tools_truncated: (tools?.length ?? 0) > 8,
+          prior_dispatch: this.dispatched,
+          completed_response_count: this.receiptValues.length
+        };
+        this.toolValidationFailure ??= diagnostic;
+        try {
+          this.options.onToolValidationFailure?.(diagnostic);
+        } catch {
+        }
+        throw new Error(`grok_tool_isolation_${reason}`);
+      }
       validatePayload(payload, route) {
         const requestedEffort = route === "/responses" ? record3(payload.reasoning).effort : payload.reasoning_effort;
         if (payload.model !== this.options.requestedModel || effort(requestedEffort) !== effort(this.options.requestedReasoningEffort)) {
@@ -34482,17 +34525,17 @@ var init_grok_transport_proxy = __esm({
         if (instructions.length !== 1 || instructions[0].role !== "system" || instructions[0].content !== this.options.expectedSystemPrompt || route === "/responses" && payload.instructions != null) {
           throw new Error("grok_system_prompt_mismatch");
         }
-        if (payload.tools != null && !Array.isArray(payload.tools)) throw new Error("grok_tool_isolation_failed");
+        if (payload.tools != null && !Array.isArray(payload.tools)) this.rejectTools("invalid_tools", payload, route);
         const tools = payload.tools ?? [];
         const names2 = tools.map((value) => {
           const tool = record3(value);
-          if (tool.type !== "function") throw new Error("grok_tool_isolation_failed");
+          if (tool.type !== "function") this.rejectTools("invalid_type", payload, route);
           const name = route === "/responses" ? tool.name : record3(tool.function).name;
-          if (typeof name !== "string") throw new Error("grok_tool_isolation_failed");
+          if (typeof name !== "string") this.rejectTools("missing_name", payload, route);
           return name;
         });
         if (names2.sort().join("\0") !== [...this.options.allowedToolNames].sort().join("\0")) {
-          throw new Error("grok_tool_isolation_failed");
+          this.rejectTools("unexpected_tools", payload, route);
         }
       }
       async handle(request, response) {
@@ -34622,8 +34665,15 @@ var init_grok_transport_proxy = __esm({
             if (!this.dispatched) this.pending = false;
           }
           controller.abort();
-          if (!response.headersSent) response.writeHead(502, { "x-should-retry": "false", "content-type": "application/json" });
-          response.end();
+          if (!response.headersSent) {
+            const localValidation = inference && this.toolValidationFailure !== null;
+            response.writeHead(localValidation ? 400 : 502, { "x-should-retry": "false", "content-type": "application/json" });
+            response.end(localValidation ? JSON.stringify({ error: {
+              type: "vtx_host_validation_error",
+              code: this.failureCode,
+              message: "VTX blocked this Grok Build request locally because its tools did not match the allowed tool contract."
+            } }) : void 0);
+          } else response.end();
         } finally {
           clearTimeout(timer);
           this.options.signal?.removeEventListener("abort", abort);
@@ -35534,7 +35584,13 @@ var init_grok_adapter = __esm({
             providerDispatchNotAfterMs: provider?.providerDispatchNotAfterMs,
             onProviderDispatch: provider?.onProviderDispatch,
             signal: input.signal,
-            fetchImpl: this.options.fetchImpl
+            fetchImpl: this.options.fetchImpl,
+            onToolValidationFailure: (diagnostic) => this.options.emitDiagnosticEvent?.({
+              event: "grok_tool_validation_failed",
+              attempt_id: provider?.attemptId ?? null,
+              control_mode: provider ? "provider" : "agent",
+              ...diagnostic
+            })
           });
           input.signal.throwIfAborted();
           session = new GrokAcpSession({
@@ -35647,7 +35703,7 @@ var init_grok_adapter = __esm({
           provider?.onTerminalDispatchOutcome?.(outcome);
           if (error48 instanceof CodexAppServerError) throw error48;
           throw new CodexAppServerError({
-            message: "Grok Build could not complete the inference contract.",
+            message: proxy?.toolValidationFailure ? "VTX blocked an outgoing Grok Build request locally because its tools did not match the allowed tool contract." : "Grok Build could not complete the inference contract.",
             category: input.signal?.aborted ? "cancelled" : Date.now() >= input.deadlineAtMs ? "timeout" : proxy?.rejectionStatus === 401 || proxy?.rejectionStatus === 403 ? "auth" : "adapter",
             code: proxy?.failureCode ?? proxy?.terminalFailure?.code ?? (error48 instanceof Error && /^grok_[a-z0-9_]+$/u.test(error48.message) ? error48.message : "grok_adapter_failure"),
             httpStatusCode: proxy?.rejectionStatus,
@@ -37893,6 +37949,13 @@ var init_runner = __esm({
         };
         let removeAbortListener = () => {
         };
+        let removeQuiesceListener = () => {
+        };
+        let quiesceRequested = Boolean(this.options.quiesceSignal?.aborted);
+        let wakeQuiesce;
+        const quiesceWake = new Promise((resolve12) => {
+          wakeQuiesce = resolve12;
+        });
         let drainRequested = false;
         let drainReason = "stopped";
         let receipt;
@@ -37931,6 +37994,13 @@ var init_runner = __esm({
           wakeDrain();
         };
         try {
+          const onQuiesce = () => {
+            quiesceRequested = true;
+            wakeQuiesce();
+          };
+          this.options.quiesceSignal?.addEventListener("abort", onQuiesce, { once: true });
+          removeQuiesceListener = () => this.options.quiesceSignal?.removeEventListener("abort", onQuiesce);
+          if (quiesceRequested) return { claimed, completed, failed, drain_reason: "service_update" };
           unregisterSignals = (this.dependencies.registerSignalHandlers ?? defaultRegisterSignalHandlers)(requestDrain);
           if (this.options.signal) {
             const onAbort = () => requestDrain("aborted");
@@ -38033,8 +38103,9 @@ var init_runner = __esm({
           await mcp.initialize({ signal: this.options.signal });
           if (settings.agentRuntime) {
             const agentRuntimeSettings = settings.agentRuntime;
+            const agentIdleSignal = this.options.quiesceSignal ? AbortSignal.any([agentAbort.signal, this.options.quiesceSignal]) : agentAbort.signal;
             agentLoop = (async () => {
-              while (!agentAbort.signal.aborted) {
+              while (!agentAbort.signal.aborted && !quiesceRequested) {
                 const existingFence = await readInferenceAgentFailureFence(
                   agentRuntimeSettings.statePath
                 );
@@ -38067,7 +38138,7 @@ var init_runner = __esm({
                       });
                       if (this.options.once) return;
                       try {
-                        await sleep4(Math.max(MIN_SLEEP_MS, retryAtMs - now()), agentAbort.signal);
+                        await sleep4(Math.max(MIN_SLEEP_MS, retryAtMs - now()), agentIdleSignal);
                       } catch {
                         return;
                       }
@@ -38082,7 +38153,8 @@ var init_runner = __esm({
                   statePath: agentRuntimeSettings.statePath,
                   controlClient: createInferenceAgentControlClient(mcp),
                   adapter: agentRuntimeSettings.adapter,
-                  dataRequestTimeoutMs: agentRuntimeSettings.dataRequestTimeoutMs
+                  dataRequestTimeoutMs: agentRuntimeSettings.dataRequestTimeoutMs,
+                  quiesceSignal: this.options.quiesceSignal
                 });
                 try {
                   if (this.options.once) {
@@ -38151,7 +38223,7 @@ var init_runner = __esm({
                       );
                       if (this.options.once || retryAtMs === null) return;
                       try {
-                        await sleep4(Math.max(MIN_SLEEP_MS, retryAtMs - now()), agentAbort.signal);
+                        await sleep4(Math.max(MIN_SLEEP_MS, retryAtMs - now()), agentIdleSignal);
                       } catch {
                         return;
                       }
@@ -38167,7 +38239,9 @@ var init_runner = __esm({
                     const retained = await readInferenceAgentRuntimeState(agentRuntimeSettings.statePath);
                     if (!retained || retained.schema_version !== "vtx_inference_agent_runtime_v3" || !retained.pending_turn?.terminal_receipt) return;
                     if (this.options.once) return;
-                    await sleep4(1e3, agentAbort.signal);
+                    await sleep4(1e3, agentIdleSignal).catch((error49) => {
+                      if (!quiesceRequested) throw error49;
+                    });
                     continue;
                   }
                   if (error48 instanceof InferenceHostRunnerError && error48.code === "agent_terminal_failure_fenced") {
@@ -38179,7 +38253,9 @@ var init_runner = __esm({
                   });
                   if (this.options.once) return;
                   try {
-                    await sleep4(1e3, agentAbort.signal);
+                    await sleep4(1e3, agentIdleSignal).catch((error49) => {
+                      if (!quiesceRequested) throw error49;
+                    });
                   } catch {
                     return;
                   }
@@ -39010,11 +39086,11 @@ var init_runner = __esm({
               )
             });
           }
-          while (!drainRequested && recoveryQueue.length > 0 && (settings.maxConcurrency === null || active.size < settings.maxConcurrency)) {
+          while (!drainRequested && !quiesceRequested && recoveryQueue.length > 0 && (settings.maxConcurrency === null || active.size < settings.maxConcurrency)) {
             const recovery = recoveryQueue.shift();
             launchClaim(recovery.claim, recovery);
           }
-          while (!drainRequested) {
+          while (!drainRequested && !quiesceRequested) {
             const currentTime = now();
             if (providerFailureCooldownReason !== null && currentTime >= providerFailureRetryAtMs) {
               emitDiagnostic("provider_cooldown_cleared", {
@@ -39138,12 +39214,12 @@ var init_runner = __esm({
                 nextClaimAt = Math.max(nextClaimAt, nextAdvertisementAttemptAt);
               }
             }
-            while (recoveryQueue.length > 0 && (settings.maxConcurrency === null || active.size < settings.maxConcurrency)) {
+            while (!quiesceRequested && recoveryQueue.length > 0 && (settings.maxConcurrency === null || active.size < settings.maxConcurrency)) {
               const recovery = recoveryQueue.shift();
               launchClaim(recovery.claim, recovery);
             }
             let claimOpportunities = 0;
-            while (!drainRequested && (!yieldRenewalToClaim || claimOpportunities === 0) && recoveryQueue.length === 0 && (!this.options.once || !onceClaimed) && (settings.maxConcurrency === null || active.size < settings.maxConcurrency) && pendingClaimPromotions === 0 && now() >= Math.max(
+            while (!drainRequested && !quiesceRequested && (!yieldRenewalToClaim || claimOpportunities === 0) && recoveryQueue.length === 0 && (!this.options.once || !onceClaimed) && (settings.maxConcurrency === null || active.size < settings.maxConcurrency) && pendingClaimPromotions === 0 && now() >= Math.max(
               nextClaimAt,
               claimAvailabilityBackoff?.untilMs ?? 0,
               providerRetryAtMs ?? 0,
@@ -39165,6 +39241,7 @@ var init_runner = __esm({
               let claim;
               let claimTiming;
               const claimCallStartedAtMs = now();
+              if (quiesceRequested) break;
               try {
                 claimOpportunities += 1;
                 if (claimPreparation.unsent === request) claimPreparation.unsent = null;
@@ -39415,9 +39492,14 @@ var init_runner = __esm({
             await Promise.race([
               sleep4(Math.max(MIN_SLEEP_MS, wakeAt - now())),
               drainSignal,
+              quiesceWake,
               ...active.values()
             ]);
           }
+          if (quiesceRequested && !drainRequested) {
+            await Promise.race([Promise.allSettled([...active.values(), agentLoop]), drainSignal]);
+            if (!drainRequested) requestDrain("service_update");
+          }
           stopHostHeartbeatLoop();
           if (providerDispatchWatchdogDrainRequested) {
             await settlesWithin(hostHeartbeatLoop, MIN_SLEEP_MS);
@@ -39475,6 +39557,7 @@ var init_runner = __esm({
             await hostHeartbeatLoop;
           }
           removeAbortListener();
+          removeQuiesceListener();
           unregisterSignals();
           try {
             await this.dependencies.codexAdapter.close?.();
@@ -40508,9 +40591,9 @@ var init_runner = __esm({
       async run(signal) {
         let exitedNormally = false;
         try {
-          while (!this.stopped && !signal?.aborted) {
+          while (!this.stopped && !signal?.aborted && !this.options.quiesceSignal?.aborted) {
             const nextWakeAt = await this.runOnce(signal);
-            if (this.stopped || signal?.aborted) break;
+            if (this.stopped || signal?.aborted || this.options.quiesceSignal?.aborted) break;
             await this.waitUntilWake(nextWakeAt, signal);
           }
           exitedNormally = true;
@@ -40533,6 +40616,7 @@ var init_runner = __esm({
       }
       async runOnce(signal) {
         const nowIso = () => new Date(this.now()).toISOString();
+        if (this.options.quiesceSignal?.aborted) return this.now();
         const recoveredState = await readInferenceAgentRuntimeState(this.options.statePath);
         const failureFence = await readInferenceAgentFailureFence(this.options.statePath);
         if (failureFence?.retry_at === null) {
@@ -40588,6 +40672,7 @@ var init_runner = __esm({
           }
         }
         if (!state) {
+          if (this.options.quiesceSignal?.aborted) return this.now();
           const assignment2 = await this.options.controlClient.nextAssignment({
             operation_id: randomUUID7(),
             host_id: this.options.hostId,
@@ -40690,6 +40775,7 @@ var init_runner = __esm({
           await this.handleCancelledAssignment(state, signal);
           return this.now() + (this.options.idlePollMs ?? 5e3);
         }
+        if (this.options.quiesceSignal?.aborted) return this.now();
         assignment = {
           ...assignment,
           lease_expires_at: preTurnHeartbeat.lease_expires_at
@@ -41085,9 +41171,14 @@ var init_runner = __esm({
       }
       async waitUntilWake(nextWakeAtMs, signal) {
         const heartbeatIntervalMs = this.options.heartbeatIntervalMs ?? 3e3;
-        while (!this.stopped && !signal?.aborted && this.now() < nextWakeAtMs) {
-          await this.sleep(Math.min(heartbeatIntervalMs, nextWakeAtMs - this.now()), signal);
-          if (this.stopped || signal?.aborted) return "stopped";
+        while (!this.stopped && !signal?.aborted && !this.options.quiesceSignal?.aborted && this.now() < nextWakeAtMs) {
+          const waitSignal = this.options.quiesceSignal ? AbortSignal.any([this.options.quiesceSignal, ...signal ? [signal] : []]) : signal;
+          try {
+            await this.sleep(Math.min(heartbeatIntervalMs, nextWakeAtMs - this.now()), waitSignal);
+          } catch (error48) {
+            if (!this.options.quiesceSignal?.aborted) throw error48;
+          }
+          if (this.stopped || signal?.aborted || this.options.quiesceSignal?.aborted) return "stopped";
           if (this.now() >= nextWakeAtMs) return "ready";
           const state = await readInferenceAgentRuntimeState(this.options.statePath);
           if (state?.schema_version !== "vtx_inference_agent_runtime_v3" || state.adapter_id !== this.options.adapterId) return "cancelled";
@@ -41112,7 +41203,7 @@ var init_runner = __esm({
             updated_at: requestedAt
           });
         }
-        return this.stopped || signal?.aborted ? "stopped" : "ready";
+        return this.stopped || signal?.aborted || this.options.quiesceSignal?.aborted ? "stopped" : "ready";
       }
       async releaseForHostStop(reasonCode = "host_stopped") {
         const recovered = await readInferenceAgentRuntimeState(this.options.statePath);
@@ -41239,6 +41330,8 @@ var init_runtime_policy_generated = __esm({
       },
       external_inference: {
         service: {
+          update_check_interval_ms: 3e5,
+          update_registry_timeout_ms: 15e3,
           startup_max_attempts: 40,
           startup_poll_interval_ms: 250,
           restart_stable_uptime_ms: 6e4,
@@ -41279,13 +41372,14 @@ import { createWriteStream, readFileSync } from "node:fs";
 import { access as access4, chmod as chmod3, mkdir as mkdir3, readFile as readFile9, rm as rm10, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname12, join as join13, resolve as resolve10 } from "node:path";
-var SERVICE_NAME, SYSTEMD_UNIT, LAUNCHD_LABEL, SERVICE_COOPERATIVE_STOP_SECONDS, SERVICE_UPDATE_STARTUP_SECONDS, INFERENCE_HOST_SERVICE_DRAIN_COMMAND, inferenceHostServiceChildEnvironment, isWindowsSubsystemForLinux, inferenceHostServiceManifestPath, inferenceHostServiceDesiredPath, inferenceHostServiceLogPath, inferenceHostServiceRuntimePath, xmlEscape, plistEscape, systemdQuote, defaultRunCommand, managerName, assertRuntimeEnvironment, withoutConcurrencyLimit, assertServicePath, manifestGeneration, assertWorker, assertManifest, assertServiceRuntimeState, assertDesiredState, readInferenceHostServiceManifest, readManifestAcrossAtomicReplacement, readInferenceHostServiceRuntime, readRuntimeAcrossAtomicReplacement, readInferenceHostServiceDesired, readDesiredAcrossAtomicReplacement, writeDesired, runtimeEnvironment, serviceBootstrapArguments, windowsOwnedCommandLine, vbScriptString, windowsServiceLauncher, windowsTaskXml, systemdUnit, launchAgentPlist, sameWorker, sameServiceDefinition, sameWorkerSet, InferenceHostServiceManager, appendServiceLog, spawnInferenceHostServiceChild, runInferenceHostServiceSupervisor;
+var SERVICE_NAME, SYSTEMD_UNIT, LAUNCHD_LABEL, SERVICE_COOPERATIVE_STOP_SECONDS, SERVICE_UPDATE_STARTUP_SECONDS, INFERENCE_HOST_SERVICE_DRAIN_COMMAND, INFERENCE_HOST_SERVICE_QUIESCE_COMMAND, InferenceHostBootstrapRestartRequiredError, inferenceHostServiceChildEnvironment, isWindowsSubsystemForLinux, inferenceHostServiceManifestPath, inferenceHostServiceDesiredPath, inferenceHostServiceLogPath, inferenceHostServiceRuntimePath, xmlEscape, plistEscape, systemdQuote, defaultRunCommand, managerName, assertRuntimeEnvironment, withoutConcurrencyLimit, assertServicePath, manifestGeneration, assertWorker, assertManifest, assertServiceRuntimeState, assertDesiredState, readInferenceHostServiceManifest, readManifestAcrossAtomicReplacement, readInferenceHostServiceRuntime, readRuntimeAcrossAtomicReplacement, readInferenceHostServiceDesired, readDesiredAcrossAtomicReplacement, writeDesired, runtimeEnvironment, serviceBootstrapArguments, windowsOwnedCommandLine, vbScriptString, windowsServiceLauncher, windowsTaskXml, systemdUnit, launchAgentPlist, sameWorker, sameServiceDefinition, sameWorkerSet, InferenceHostServiceManager, appendServiceLog, spawnInferenceHostServiceChild, runInferenceHostServiceSupervisor;
 var init_service = __esm({
   "lib/inference-host/service.ts"() {
     "use strict";
     init_define_VTX_EXO_POLICY();
     init_define_VTX_GROK_POLICY();
     init_define_VTX_PI_MODEL_POLICY();
+    init_agent_cli_release();
     init_runtime_policy_generated();
     init_durable_adapter();
     init_config();
@@ -41295,6 +41389,12 @@ var init_service = __esm({
     SERVICE_COOPERATIVE_STOP_SECONDS = 75;
     SERVICE_UPDATE_STARTUP_SECONDS = 600;
     INFERENCE_HOST_SERVICE_DRAIN_COMMAND = "vtx-inference-host-service-drain-v1";
+    INFERENCE_HOST_SERVICE_QUIESCE_COMMAND = "vtx-inference-host-service-quiesce-v1";
+    InferenceHostBootstrapRestartRequiredError = class extends Error {
+      constructor() {
+        super("The verified service bootstrap is ready for restart.");
+      }
+    };
     inferenceHostServiceChildEnvironment = (runtimeEnvironment2, inheritedEnvironment = process.env) => {
       const environment = { ...inheritedEnvironment };
       for (const key of Object.keys(environment)) {
@@ -42414,7 +42514,7 @@ ${result2.stderr}`)) {
       });
     };
     spawnInferenceHostServiceChild = async (manifest, worker, signal, onReady = () => {
-    }) => {
+    }, quiesceSignal) => {
       const args = [
         manifest.script,
         "inference-host",
@@ -42476,6 +42576,12 @@ ${result2.stderr}`)) {
         child.stderr.on("data", (chunk) => writeTaggedOutput("stderr", chunk.toString("utf8")));
         child.stdin.on("error", () => {
         });
+        const onQuiesce = () => {
+          child.stdin.write(`${INFERENCE_HOST_SERVICE_QUIESCE_COMMAND}
+`);
+        };
+        if (quiesceSignal?.aborted) onQuiesce();
+        else quiesceSignal?.addEventListener("abort", onQuiesce, { once: true });
         const onAbort = () => {
           child.stdin.end(`${INFERENCE_HOST_SERVICE_DRAIN_COMMAND}
 `);
@@ -42489,6 +42595,7 @@ ${result2.stderr}`)) {
         else signal.addEventListener("abort", onAbort, { once: true });
         child.once("error", (error48) => {
           signal.removeEventListener("abort", onAbort);
+          quiesceSignal?.removeEventListener("abort", onQuiesce);
           if (cooperativeStopTimer) clearTimeout(cooperativeStopTimer);
           writeTaggedOutput("stdout", "", true);
           writeTaggedOutput("stderr", "", true);
@@ -42497,6 +42604,7 @@ ${result2.stderr}`)) {
         });
         child.once("exit", (code) => {
           signal.removeEventListener("abort", onAbort);
+          quiesceSignal?.removeEventListener("abort", onQuiesce);
           if (cooperativeStopTimer) clearTimeout(cooperativeStopTimer);
           writeTaggedOutput("stdout", "", true);
           writeTaggedOutput("stderr", "", true);
@@ -42532,6 +42640,38 @@ ${result2.stderr}`)) {
       const desiredPath = manifestPath.replace(/\.service\.json$/u, ".service-desired.json");
       const runtimePath = manifestPath.replace(/\.service\.json$/u, ".service-runtime.json");
       const signal = options.signal ?? new AbortController().signal;
+      const migrationQuiesce = new AbortController();
+      const quiesceSignal = options.quiesceSignal ? AbortSignal.any([options.quiesceSignal, migrationQuiesce.signal]) : migrationQuiesce.signal;
+      let bootstrapRestartRequired = false;
+      let bootstrapMigrationErrorReported = false;
+      const migrateSelectedBootstrap = async () => {
+        if (!serviceScript || !options.controlLockPath || bootstrapRestartRequired || (options.bootstrapVersion ?? process.env.VTX_INFERENCE_HOST_BOOTSTRAP_VERSION) === agent_cli_release_default.package_version || quiesceSignal.aborted || signal.aborted) return;
+        let controlLock;
+        try {
+          controlLock = await acquireInferenceHostProcessLock(options.controlLockPath);
+        } catch (error48) {
+          if (/already owns/iu.test(error48 instanceof Error ? error48.message : "")) return;
+          throw error48;
+        }
+        try {
+          const current = await readManifestAcrossAtomicReplacement(manifestPath);
+          if (!current || current.generation !== appliedManifest.generation || !await readDesiredAcrossAtomicReplacement(desiredPath) || signal.aborted) return;
+          let selected;
+          try {
+            selected = JSON.parse(await readFile9(manifestPath.replace(/\.service\.json$/u, ".service-release.json"), "utf8"));
+          } catch (error48) {
+            if (error48.code === "ENOENT") return;
+            throw error48;
+          }
+          if (selected.schema_version !== "vtx_inference_service_release_v1" || selected.package_name !== "@vtxmacro/cli" || selected.package_version !== agent_cli_release_default.package_version || typeof selected.script !== "string" || resolve10(selected.script) !== serviceScript) return;
+          const bytes3 = await readFile9(join13(dirname12(serviceScript), "vtx-service-bootstrap.js"), "utf8");
+          await writeAtomicInferencePrivateFile(manifestPath.replace(/\.service\.json$/u, ".service-bootstrap.js"), bytes3);
+          bootstrapRestartRequired = true;
+          migrationQuiesce.abort();
+        } finally {
+          await controlLock.release();
+        }
+      };
       const sleep4 = options.sleep ?? (async (milliseconds) => {
         await new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
       });
@@ -42585,7 +42725,7 @@ ${result2.stderr}`)) {
       };
       const superviseWorker = async (serviceManifest, record4) => {
         let failures = 0;
-        while (!signal.aborted && !record4.controller.signal.aborted && await readDesiredAcrossAtomicReplacement(desiredPath)) {
+        while (!signal.aborted && !quiesceSignal.aborted && !record4.controller.signal.aborted && await readDesiredAcrossAtomicReplacement(desiredPath)) {
           try {
             await updateRecord(record4, "starting");
             const attemptController = new AbortController();
@@ -42610,7 +42750,8 @@ ${result2.stderr}`)) {
                       await updateRecord(record4, "running");
                     }
                   })();
-                }
+                },
+                quiesceSignal
               );
             } finally {
               launchSettled = true;
@@ -42626,7 +42767,7 @@ ${result2.stderr}`)) {
               });
               throw new Error("worker_cooperative_stop_timeout");
             }
-            if (signal.aborted || record4.controller.signal.aborted || !await readDesiredAcrossAtomicReplacement(desiredPath)) break;
+            if (signal.aborted || quiesceSignal.aborted || record4.controller.signal.aborted || !await readDesiredAcrossAtomicReplacement(desiredPath)) break;
             failures = result2.uptimeMs >= runtime_policy_generated_default.external_inference.service.restart_stable_uptime_ms ? 0 : failures + 1;
             const retryAfterMs = Math.min(runtime_policy_generated_default.external_inference.service.restart_backoff_base_ms * 2 ** Math.min(failures, runtime_policy_generated_default.external_inference.service.restart_exponent_max), runtime_policy_generated_default.external_inference.service.restart_backoff_max_ms);
             await updateRecord(record4, "failed", "worker_exited");
@@ -42640,7 +42781,7 @@ ${result2.stderr}`)) {
             await waitRetry(retryAfterMs, record4.controller);
           } catch (error48) {
             if (error48 instanceof Error && error48.message === "worker_cooperative_stop_timeout") throw error48;
-            if (signal.aborted || record4.controller.signal.aborted) break;
+            if (signal.aborted || quiesceSignal.aborted || record4.controller.signal.aborted) break;
             failures += 1;
             const retryAfterMs = Math.min(runtime_policy_generated_default.external_inference.service.restart_backoff_base_ms * 2 ** Math.min(failures, runtime_policy_generated_default.external_inference.service.restart_exponent_max), runtime_policy_generated_default.external_inference.service.restart_backoff_max_ms);
             await updateRecord(record4, "failed", "worker_launch_failed");
@@ -42723,14 +42864,41 @@ ${result2.stderr}`)) {
       };
       await reconcile(initialManifest);
       try {
-        while (!signal.aborted) {
-          while (!signal.aborted && await readDesiredAcrossAtomicReplacement(desiredPath)) {
+        while (!signal.aborted && !quiesceSignal.aborted) {
+          while (!signal.aborted && !quiesceSignal.aborted && await readDesiredAcrossAtomicReplacement(desiredPath)) {
+            try {
+              await migrateSelectedBootstrap();
+            } catch {
+              if (!bootstrapMigrationErrorReported) {
+                bootstrapMigrationErrorReported = true;
+                await appendServiceLog(appliedManifest.log_path, "service_bootstrap_migration_deferred");
+              }
+            }
+            if (quiesceSignal.aborted) break;
             const storedNext = await readManifestAcrossAtomicReplacement(manifestPath);
             if (!storedNext) throw new Error("Inference-host service manifest is missing.");
             const next = withServiceScript(storedNext);
             if (next.generation !== appliedManifest.generation && next.generation !== rejectedManifestGeneration) await reconcile(next);
             await sleep4(250);
           }
+          if (quiesceSignal.aborted && !signal.aborted) {
+            let finished = false;
+            const completion = Promise.allSettled([...workers.values()].map((record4) => record4.promise)).then((results) => {
+              finished = true;
+              return results;
+            });
+            while (!finished && !signal.aborted && await readDesiredAcrossAtomicReplacement(desiredPath)) {
+              await Promise.race([completion, sleep4(250)]);
+            }
+            if (!finished) {
+              await drainWorkers();
+              break;
+            }
+            const settled = await completion;
+            const failure2 = settled.find((result2) => result2.status === "rejected");
+            if (failure2) throw failure2.reason;
+            break;
+          }
           await drainWorkers();
           if (signal.aborted || !await readDesiredAcrossAtomicReplacement(desiredPath)) break;
           const storedRestored = await readManifestAcrossAtomicReplacement(manifestPath);
@@ -42747,6 +42915,9 @@ ${result2.stderr}`)) {
         await runtimeWriteChain;
         await appendServiceLog(appliedManifest.log_path, "service_supervisor_stopped");
       }
+      if (bootstrapRestartRequired && !signal.aborted && await readDesiredAcrossAtomicReplacement(desiredPath)) {
+        throw new InferenceHostBootstrapRestartRequiredError();
+      }
     };
   }
 });
@@ -43242,7 +43413,7 @@ Durable service:
       });
       child.unref();
     };
-    registerInferenceHostServiceControlInput = (input, abort) => {
+    registerInferenceHostServiceControlInput = (input, abort, quiesce) => {
       let pendingControlInput = "";
       const onControlInput = (chunk) => {
         pendingControlInput = `${pendingControlInput}${chunk.toString()}`.slice(-4096);
@@ -43250,6 +43421,8 @@ Durable service:
         pendingControlInput = lines.pop() ?? "";
         if (lines.some((line) => line === INFERENCE_HOST_SERVICE_DRAIN_COMMAND)) {
           abort();
+        } else if (lines.some((line) => line === INFERENCE_HOST_SERVICE_QUIESCE_COMMAND)) {
+          quiesce?.();
         }
       };
       input.on("data", onControlInput);
@@ -43259,13 +43432,13 @@ Durable service:
         input.pause();
       };
     };
-    defaultRegisterLifecycleSignalHandlers = (abort) => {
+    defaultRegisterLifecycleSignalHandlers = (abort, quiesce) => {
       const onSigint = () => abort("SIGINT");
       const onSigterm = () => abort("SIGTERM");
       process.on("SIGINT", onSigint);
       process.on("SIGTERM", onSigterm);
       const serviceChild = process.env.VTX_INFERENCE_HOST_SERVICE_CHILD === "1";
-      const unregisterControlInput = serviceChild ? registerInferenceHostServiceControlInput(process.stdin, onSigterm) : () => {
+      const unregisterControlInput = serviceChild ? registerInferenceHostServiceControlInput(process.stdin, onSigterm, quiesce) : () => {
       };
       return () => {
         process.off("SIGINT", onSigint);
@@ -43275,12 +43448,14 @@ Durable service:
     };
     lifecycleCancellation = (dependencies) => {
       const controller = new AbortController();
+      const quiesceController = new AbortController();
       let unregistered = false;
       const unregisterSignalHandlers = (dependencies.registerLifecycleSignalHandlers ?? defaultRegisterLifecycleSignalHandlers)(() => {
         if (!controller.signal.aborted) controller.abort();
-      });
+      }, () => quiesceController.abort());
       return {
         signal: controller.signal,
+        quiesceSignal: quiesceController.signal,
         unregister: () => {
           if (unregistered) return;
           unregistered = true;
@@ -43486,11 +43661,12 @@ Durable service:
           adapter: agentAdapter,
           dataRequestTimeoutMs: await loadInferenceAgentDataRequestTimeoutMs()
         },
-        signal: options.signal
+        signal: options.signal,
+        quiesceSignal: options.quiesceSignal
       }).run();
     };
-    preparePortableDurableAdapter = async (adapterId, config2, signal) => {
-      const adapter = adapterId === "copilot" ? new CopilotSubscriptionAdapter() : adapterId === "grok-build" ? new GrokBuildAdapter({ stateRoot: `${config2.statePath}.grok`, grokHome: `${config2.statePath}.grok-home` }) : adapterId === "pi" ? new PiAdapter({
+    preparePortableDurableAdapter = async (adapterId, config2, signal, emitDiagnosticEvent) => {
+      const adapter = adapterId === "copilot" ? new CopilotSubscriptionAdapter() : adapterId === "grok-build" ? new GrokBuildAdapter({ stateRoot: `${config2.statePath}.grok`, grokHome: `${config2.statePath}.grok-home`, emitDiagnosticEvent }) : adapterId === "pi" ? new PiAdapter({
         credentialStore: createPiCredentialStore(config2),
         stateRoot: `${config2.statePath}.pi`,
         qualifiedModels: await loadPiModelPolicy()
@@ -43557,7 +43733,8 @@ Durable service:
           adapter: agentAdapter,
           dataRequestTimeoutMs: await loadInferenceAgentDataRequestTimeoutMs()
         },
-        signal: options.signal
+        signal: options.signal,
+        quiesceSignal: options.quiesceSignal
       }).run();
     };
     login = async (config2, parsed, env, dependencies, warnings) => {
@@ -44335,8 +44512,8 @@ Waiting for approval...
         const emitDiagnosticEvent = parsed.json ? (event) => (dependencies.emitStdout ?? ((text) => {
           process.stdout.write(text);
         }))(`${JSON.stringify(event)}
-`) : adapterId === "codex" ? (event) => {
-          if (!["codex_app_server_closed", "codex_app_server_session_started"].includes(
+`) : adapterId === "codex" || adapterId === "grok-build" ? (event) => {
+          if (!["codex_app_server_closed", "codex_app_server_session_started", "grok_tool_validation_failed"].includes(
             String(event.event ?? "")
           )) return;
           (dependencies.emitStderr ?? ((text) => {
@@ -44345,7 +44522,16 @@ Waiting for approval...
 `);
         } : void 0;
         if (adapterId !== "codex") {
-          const prepared = adapterId === "exo" ? await (dependencies.prepareExoAdapter ?? prepareExoAdapter)(config2, parsed.exoRoot, cancellation.signal) : await (dependencies.prepareDurableAdapter ?? preparePortableDurableAdapter)(adapterId, config2, cancellation.signal);
+          const diagnosticState = await readInferenceHostLocalState(config2.statePath);
+          const emitPortableDiagnostic = (event) => emitDiagnosticEvent?.({
+            ...event,
+            schema_version: "vtx_inference_host_diagnostic_v1",
+            at: (/* @__PURE__ */ new Date()).toISOString(),
+            instance_name: config2.instanceName,
+            host_id: diagnosticState?.host_id ?? null,
+            host_runtime_version: INFERENCE_HOST_CLI_VERSION
+          });
+          const prepared = adapterId === "exo" ? await (dependencies.prepareExoAdapter ?? prepareExoAdapter)(config2, parsed.exoRoot, cancellation.signal) : await (dependencies.prepareDurableAdapter ?? preparePortableDurableAdapter)(adapterId, config2, cancellation.signal, emitPortableDiagnostic);
           const summary = await (dependencies.runPortableDurableAdapter ?? defaultRunPortableDurableAdapter)({
             config: config2,
             credentialStore: store,
@@ -44355,7 +44541,8 @@ Waiting for approval...
             once: parsed.once,
             processLock,
             emitDiagnosticEvent,
-            signal: cancellation.signal
+            signal: cancellation.signal,
+            quiesceSignal: cancellation.quiesceSignal
           });
           return {
             exitCode: 0,
@@ -44395,7 +44582,8 @@ Waiting for approval...
             env,
             processLock,
             emitDiagnosticEvent,
-            signal: cancellation.signal
+            signal: cancellation.signal,
+            quiesceSignal: cancellation.quiesceSignal
           });
           return {
             exitCode: 0,
@@ -45719,10 +45907,15 @@ Waiting for approval...
             parsed.serviceManifestPath,
             {
               signal: cancellation.signal,
-              serviceScript: resolve11(process.argv[1] ?? "")
+              quiesceSignal: cancellation.quiesceSignal,
+              serviceScript: resolve11(process.argv[1] ?? ""),
+              controlLockPath: `${supervisorConfig.supervisorProcessLockPath}.service-control`
             }
           );
           return { exitCode: 0, stdout: "", stderr: "" };
+        } catch (error48) {
+          if (error48 instanceof InferenceHostBootstrapRestartRequiredError) return { exitCode: 75, stdout: "", stderr: "" };
+          throw error48;
         } finally {
           cancellation.unregister();
           await serviceLock.release();
@@ -49775,6 +49968,8 @@ var init_runtime_policy_generated2 = __esm({
       },
       external_inference: {
         service: {
+          update_check_interval_ms: 3e5,
+          update_registry_timeout_ms: 15e3,
           startup_max_attempts: 40,
           startup_poll_interval_ms: 250,
           restart_stable_uptime_ms: 6e4,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.9.29",
+  "version": "2026.9.31",
   "description": "VTX Macro CLI, MCP server, and durable external inference host.",
   "type": "module",
   "license": "UNLICENSED",