@vtxmacro/cli 2026.9.50 → 2026.9.52

package/bin/vtx.js

@@ -77,7 +77,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.9.50",
+      package_version: "2026.9.52",
       codex_package_name: "@openai/codex",
       codex_version: "0.153.3",
       copilot_sdk_package_name: "@github/copilot-sdk",
@@ -17580,12 +17580,9 @@ var init_dist = __esm({
   }
 });
 
-// lib/inference-host/mcp-transport.ts
-import { readFileSync } from "node:fs";
-import { X509Certificate } from "node:crypto";
+// lib/inference-host/mcp-transport-config.ts
 import { isIP } from "node:net";
 import { isAbsolute, win32 } from "node:path";
-import { Agent, fetch as undiciFetch } from "undici";
 function resolveInferenceMcpDirectTransport(env) {
   const address = String(env.VTX_INFERENCE_HOST_MCP_CONNECT_ADDRESS || "").trim();
   const caFile = String(env.VTX_INFERENCE_HOST_MCP_CA_FILE || "").trim();
@@ -17595,40 +17592,8 @@ function resolveInferenceMcpDirectTransport(env) {
   }
   return { address, caFile };
 }
-function createInferenceMcpTransport(endpoint, direct, fetchImpl = fetch) {
-  if (!direct) return { fetch: fetchImpl, route: "public", close: async () => void 0 };
-  const canonical = new URL(endpoint);
-  if (canonical.protocol !== "https:" || canonical.username || canonical.password || canonical.pathname !== "/insights/mcp" || canonical.search || canonical.hash || isIP(canonical.hostname) || !isIP(direct.address)) {
-    throw new Error("Direct inference MCP transport requires a canonical HTTPS MCP hostname.");
-  }
-  const ca = readFileSync(direct.caFile, "utf8");
-  new X509Certificate(ca);
-  const agent = new Agent({
-    connect: {
-      ca,
-      rejectUnauthorized: true,
-      servername: canonical.hostname,
-      lookup: (_hostname, options, callback) => {
-        const address = { address: direct.address, family: isIP(direct.address) };
-        if (options.all) callback(null, [address]);
-        else callback(null, address.address, address.family);
-      }
-    }
-  });
-  const dispatchFetch = fetchImpl === fetch ? undiciFetch : fetchImpl;
-  const routedFetch = (input, init2) => {
-    const url2 = new URL(input instanceof Request ? input.url : String(input));
-    if (url2.href !== canonical.href) {
-      return Promise.reject(new Error("Direct inference transport cannot send requests outside its MCP endpoint."));
-    }
-    return dispatchFetch(input, { ...init2, redirect: "error", dispatcher: agent });
-  };
-  return { fetch: routedFetch, route: "direct", close: async () => {
-    await agent.destroy();
-  } };
-}
-var init_mcp_transport = __esm({
-  "lib/inference-host/mcp-transport.ts"() {
+var init_mcp_transport_config = __esm({
+  "lib/inference-host/mcp-transport-config.ts"() {
     "use strict";
     init_define_VTX_EXO_POLICY();
     init_define_VTX_GROK_POLICY();
@@ -17884,7 +17849,7 @@ async function syncInferenceDirectory(path, platform = process.platform) {
 async function replaceAtomicInferencePrivateFile(temporaryPath, destinationPath, options = {}) {
   const platform = options.platform ?? process.platform;
   const renameFile = options.renameFile ?? rename;
-  const sleep4 = options.sleep ?? ((milliseconds) => new Promise((resolve12) => setTimeout(resolve12, milliseconds)));
+  const sleep4 = options.sleep ?? ((milliseconds) => new Promise((resolve13) => setTimeout(resolve13, milliseconds)));
   const maxAttempts = Math.max(1, options.maxAttempts ?? 40);
   const retryDelayMs = Math.max(0, options.retryDelayMs ?? 25);
   for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
@@ -18217,7 +18182,7 @@ var init_config = __esm({
     init_define_VTX_GROK_POLICY();
     init_define_VTX_PI_MODEL_POLICY();
     init_dist();
-    init_mcp_transport();
+    init_mcp_transport_config();
     loadInferenceReceiptDurabilityTimeoutMs = async () => {
       let configured;
       if (true) {
@@ -19001,7 +18966,7 @@ var init_credential_store = __esm({
         }
         return;
       }
-      await new Promise((resolve12) => {
+      await new Promise((resolve13) => {
         const terminator = spawn2(
           "taskkill.exe",
           ["/PID", String(pid), "/T", "/F"],
@@ -19019,21 +18984,21 @@ var init_credential_store = __esm({
         const timer = setTimeout(() => {
           terminator.kill("SIGKILL");
           child.kill("SIGKILL");
-          resolve12();
+          resolve13();
         }, CREDENTIAL_COMMAND_TERMINATION_TIMEOUT_MS);
         terminator.once("error", () => {
           clearTimeout(timer);
           child.kill("SIGKILL");
-          resolve12();
+          resolve13();
         });
         terminator.once("close", () => {
           clearTimeout(timer);
           if (child.exitCode === null) child.kill("SIGKILL");
-          resolve12();
+          resolve13();
         });
       });
     };
-    runCredentialCommand = async (command, options) => await new Promise((resolve12, reject) => {
+    runCredentialCommand = async (command, options) => await new Promise((resolve13, reject) => {
       const timeoutMs = options.timeoutMs ?? DEFAULT_CREDENTIAL_COMMAND_TIMEOUT_MS;
       if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
         reject(new Error("OS credential command timeout must be a positive integer."));
@@ -19092,7 +19057,7 @@ var init_credential_store = __esm({
           const transformedStdout = normalizedExitCode === 0 ? command.transformStdout?.(stdout) ?? stdout : stdout;
           settled = true;
           cleanup();
-          resolve12({
+          resolve13({
             exitCode: normalizedExitCode,
             stdout: transformedStdout
           });
@@ -20249,11 +20214,11 @@ async function revokeInferenceCredential(options) {
   }
 }
 async function listenLoopback(server) {
-  await new Promise((resolve12, reject) => {
+  await new Promise((resolve13, reject) => {
     server.once("error", reject);
     server.listen(0, CALLBACK_HOST, () => {
       server.off("error", reject);
-      resolve12();
+      resolve13();
     });
   });
   const address = server.address();
@@ -20264,7 +20229,7 @@ async function listenLoopback(server) {
 }
 async function closeServer(server) {
   if (!server.listening) return;
-  await new Promise((resolve12) => server.close(() => resolve12()));
+  await new Promise((resolve13) => server.close(() => resolve13()));
 }
 async function beginInferenceOAuthLogin(options) {
   const loginTimeoutMs = options.timeoutMs ?? 6e5;
@@ -20320,7 +20285,7 @@ async function beginInferenceOAuthLogin(options) {
     });
     let settled = false;
     let rejectCompletion;
-    const completion = new Promise((resolve12, reject) => {
+    const completion = new Promise((resolve13, reject) => {
       rejectCompletion = reject;
       handler = async (requestUrl, method, writeResponse) => {
         if (settled) {
@@ -20395,7 +20360,7 @@ async function beginInferenceOAuthLogin(options) {
             '<!doctype html><html><head><meta charset="utf-8"><title>VTX authorization complete</title></head><body><main><h1>VTX authorization complete</h1><p>The VTX CLI received your approval. You can close this tab and return to the terminal.</p></main></body></html>'
           );
           await closeServer(server);
-          resolve12({
+          resolve13({
             accessToken: tokens.accessToken,
             expiresIn: tokens.expiresIn,
             credential,
@@ -20583,6 +20548,8 @@ var init_runtime_policy_generated = __esm({
         service: {
           update_check_interval_ms: 3e5,
           update_registry_timeout_ms: 15e3,
+          bootstrap_readiness_timeout_ms: 6e5,
+          bootstrap_stop_timeout_ms: 1e4,
           startup_max_attempts: 40,
           startup_poll_interval_ms: 250,
           restart_stable_uptime_ms: 6e4,
@@ -20667,6 +20634,53 @@ var init_runtime_policy_generated = __esm({
   }
 });
 
+// lib/inference-host/mcp-transport.ts
+import { readFileSync } from "node:fs";
+import { X509Certificate } from "node:crypto";
+import { isIP as isIP2 } from "node:net";
+import { Agent, fetch as undiciFetch } from "undici";
+function createInferenceMcpTransport(endpoint, direct, fetchImpl = fetch) {
+  if (!direct) return { fetch: fetchImpl, route: "public", close: async () => void 0 };
+  const canonical = new URL(endpoint);
+  if (canonical.protocol !== "https:" || canonical.username || canonical.password || canonical.pathname !== "/insights/mcp" || canonical.search || canonical.hash || isIP2(canonical.hostname) || !isIP2(direct.address)) {
+    throw new Error("Direct inference MCP transport requires a canonical HTTPS MCP hostname.");
+  }
+  const ca = readFileSync(direct.caFile, "utf8");
+  new X509Certificate(ca);
+  const agent = new Agent({
+    connect: {
+      ca,
+      rejectUnauthorized: true,
+      servername: canonical.hostname,
+      lookup: (_hostname, options, callback) => {
+        const address = { address: direct.address, family: isIP2(direct.address) };
+        if (options.all) callback(null, [address]);
+        else callback(null, address.address, address.family);
+      }
+    }
+  });
+  const dispatchFetch = fetchImpl === fetch ? undiciFetch : fetchImpl;
+  const routedFetch = (input, init2) => {
+    const url2 = new URL(input instanceof Request ? input.url : String(input));
+    if (url2.href !== canonical.href) {
+      return Promise.reject(new Error("Direct inference transport cannot send requests outside its MCP endpoint."));
+    }
+    return dispatchFetch(input, { ...init2, redirect: "error", dispatcher: agent });
+  };
+  return { fetch: routedFetch, route: "direct", close: async () => {
+    await agent.destroy();
+  } };
+}
+var init_mcp_transport = __esm({
+  "lib/inference-host/mcp-transport.ts"() {
+    "use strict";
+    init_define_VTX_EXO_POLICY();
+    init_define_VTX_GROK_POLICY();
+    init_define_VTX_PI_MODEL_POLICY();
+    init_mcp_transport_config();
+  }
+});
+
 // lib/inference-host/mcp-client.ts
 var EXTERNAL_INFERENCE_MCP_PROTOCOL_VERSION, EXTERNAL_INFERENCE_AUTOMATED_HOST_TOOLS, EXTERNAL_INFERENCE_OPERATIONAL_TOOLS, ClaimTiming, ExternalInferenceMcpError, DEFAULT_REQUEST_TIMEOUT_MS, MAX_RETRY_AFTER_MS, PUBLIC_TOOL_ERROR_PREFIX, parseRetryAfterMs, identifierSchema2, safeCodeSchema2, publicFailureCodeSchema, publicToolErrorSchema, structuredPublicToolErrorSchema, parsePublicToolError, hostMutationResultSchema, attemptStartResultSchema, agentConnectResultSchema, agentHeartbeatResultSchema, timestampSchema2, positiveGenerationSchema, jsonObjectSchema, agentAssignmentNextArgumentsSchema, agentDataCapabilityDescriptorSchema, agentAssignmentNextResultSchema, agentAssignmentHeartbeatArgumentsSchema, agentAssignmentHeartbeatResultSchema, agentDataCallArgumentsSchema, agentDataCallResultSchema, agentDecisionSubmitArgumentsSchema, agentDecisionSubmitResultSchema, agentDecisionStatusArgumentsSchema, agentDecisionStatusResultSchema, agentAssignmentReleaseArgumentsSchema, agentAssignmentReleaseResultSchema, jobCompletionResultSchema, jobFailureResultSchema, toolContracts, discoveryResultSchema, toolListResultSchema, inlineStructuredContentSchema, protocolMeta, parseJsonDocument, parseSseDocuments, parseResponseDocuments, exactOperationalInventory, exactJson, invalidBoundResult, verifyToolResult, ExternalInferenceMcpClient;
 var init_mcp_client = __esm({
@@ -22492,51 +22506,51 @@ var require_uri_all = __commonJS({
         }
         return uriTokens.join("");
       }
-      function resolveComponents(base2, relative3) {
+      function resolveComponents(base2, relative4) {
         var options = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : {};
         var skipNormalization = arguments[3];
         var target = {};
         if (!skipNormalization) {
           base2 = parse5(serialize(base2, options), options);
-          relative3 = parse5(serialize(relative3, options), options);
+          relative4 = parse5(serialize(relative4, options), options);
         }
         options = options || {};
-        if (!options.tolerant && relative3.scheme) {
-          target.scheme = relative3.scheme;
-          target.userinfo = relative3.userinfo;
-          target.host = relative3.host;
-          target.port = relative3.port;
-          target.path = removeDotSegments(relative3.path || "");
-          target.query = relative3.query;
+        if (!options.tolerant && relative4.scheme) {
+          target.scheme = relative4.scheme;
+          target.userinfo = relative4.userinfo;
+          target.host = relative4.host;
+          target.port = relative4.port;
+          target.path = removeDotSegments(relative4.path || "");
+          target.query = relative4.query;
         } else {
-          if (relative3.userinfo !== void 0 || relative3.host !== void 0 || relative3.port !== void 0) {
-            target.userinfo = relative3.userinfo;
-            target.host = relative3.host;
-            target.port = relative3.port;
-            target.path = removeDotSegments(relative3.path || "");
-            target.query = relative3.query;
+          if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
+            target.userinfo = relative4.userinfo;
+            target.host = relative4.host;
+            target.port = relative4.port;
+            target.path = removeDotSegments(relative4.path || "");
+            target.query = relative4.query;
           } else {
-            if (!relative3.path) {
+            if (!relative4.path) {
               target.path = base2.path;
-              if (relative3.query !== void 0) {
-                target.query = relative3.query;
+              if (relative4.query !== void 0) {
+                target.query = relative4.query;
               } else {
                 target.query = base2.query;
               }
             } else {
-              if (relative3.path.charAt(0) === "/") {
-                target.path = removeDotSegments(relative3.path);
+              if (relative4.path.charAt(0) === "/") {
+                target.path = removeDotSegments(relative4.path);
               } else {
                 if ((base2.userinfo !== void 0 || base2.host !== void 0 || base2.port !== void 0) && !base2.path) {
-                  target.path = "/" + relative3.path;
+                  target.path = "/" + relative4.path;
                 } else if (!base2.path) {
-                  target.path = relative3.path;
+                  target.path = relative4.path;
                 } else {
-                  target.path = base2.path.slice(0, base2.path.lastIndexOf("/") + 1) + relative3.path;
+                  target.path = base2.path.slice(0, base2.path.lastIndexOf("/") + 1) + relative4.path;
                 }
                 target.path = removeDotSegments(target.path);
               }
-              target.query = relative3.query;
+              target.query = relative4.query;
             }
             target.userinfo = base2.userinfo;
             target.host = base2.host;
@@ -22544,10 +22558,10 @@ var require_uri_all = __commonJS({
           }
           target.scheme = base2.scheme;
         }
-        target.fragment = relative3.fragment;
+        target.fragment = relative4.fragment;
         return target;
       }
-      function resolve12(baseURI, relativeURI, options) {
+      function resolve13(baseURI, relativeURI, options) {
         var schemelessOptions = assign({ scheme: "null" }, options);
         return serialize(resolveComponents(parse5(baseURI, schemelessOptions), parse5(relativeURI, schemelessOptions), schemelessOptions, true), schemelessOptions);
       }
@@ -22812,7 +22826,7 @@ var require_uri_all = __commonJS({
       exports2.removeDotSegments = removeDotSegments;
       exports2.serialize = serialize;
       exports2.resolveComponents = resolveComponents;
-      exports2.resolve = resolve12;
+      exports2.resolve = resolve13;
       exports2.normalize = normalize;
       exports2.equal = equal;
       exports2.escapeComponent = escapeComponent;
@@ -23183,18 +23197,18 @@ var require_resolve = __commonJS({
     var util = require_util();
     var SchemaObject = require_schema_obj();
     var traverse = require_json_schema_traverse();
-    module.exports = resolve12;
-    resolve12.normalizeId = normalizeId;
-    resolve12.fullPath = getFullPath;
-    resolve12.url = resolveUrl;
-    resolve12.ids = resolveIds;
-    resolve12.inlineRef = inlineRef;
-    resolve12.schema = resolveSchema;
-    function resolve12(compile, root, ref) {
+    module.exports = resolve13;
+    resolve13.normalizeId = normalizeId;
+    resolve13.fullPath = getFullPath;
+    resolve13.url = resolveUrl;
+    resolve13.ids = resolveIds;
+    resolve13.inlineRef = inlineRef;
+    resolve13.schema = resolveSchema;
+    function resolve13(compile, root, ref) {
       var refVal = this._refs[ref];
       if (typeof refVal == "string") {
         if (this._refs[refVal]) refVal = this._refs[refVal];
-        else return resolve12.call(this, compile, root, refVal);
+        else return resolve13.call(this, compile, root, refVal);
       }
       refVal = refVal || this._schemas[ref];
       if (refVal instanceof SchemaObject) {
@@ -23402,7 +23416,7 @@ var require_error_classes = __commonJS({
     init_define_VTX_EXO_POLICY();
     init_define_VTX_GROK_POLICY();
     init_define_VTX_PI_MODEL_POLICY();
-    var resolve12 = require_resolve();
+    var resolve13 = require_resolve();
     module.exports = {
       Validation: errorSubclass(ValidationError),
       MissingRef: errorSubclass(MissingRefError)
@@ -23417,8 +23431,8 @@ var require_error_classes = __commonJS({
     };
     function MissingRefError(baseId, ref, message) {
       this.message = message || MissingRefError.message(baseId, ref);
-      this.missingRef = resolve12.url(baseId, ref);
-      this.missingSchema = resolve12.normalizeId(resolve12.fullPath(this.missingRef));
+      this.missingRef = resolve13.url(baseId, ref);
+      this.missingSchema = resolve13.normalizeId(resolve13.fullPath(this.missingRef));
     }
     function errorSubclass(Subclass) {
       Subclass.prototype = Object.create(Error.prototype);
@@ -23955,7 +23969,7 @@ var require_compile = __commonJS({
     init_define_VTX_EXO_POLICY();
     init_define_VTX_GROK_POLICY();
     init_define_VTX_PI_MODEL_POLICY();
-    var resolve12 = require_resolve();
+    var resolve13 = require_resolve();
     var util = require_util();
     var errorClasses = require_error_classes();
     var stableStringify = require_fast_json_stable_stringify();
@@ -24017,7 +24031,7 @@ var require_compile = __commonJS({
           RULES,
           validate: validateGenerator,
           util,
-          resolve: resolve12,
+          resolve: resolve13,
           resolveRef: resolveRef2,
           usePattern,
           useDefault,
@@ -24079,7 +24093,7 @@ var require_compile = __commonJS({
         return validate;
       }
       function resolveRef2(baseId2, ref, isRoot) {
-        ref = resolve12.url(baseId2, ref);
+        ref = resolve13.url(baseId2, ref);
         var refIndex = refs[ref];
         var _refVal, refCode;
         if (refIndex !== void 0) {
@@ -24096,11 +24110,11 @@ var require_compile = __commonJS({
           }
         }
         refCode = addLocalRef(ref);
-        var v2 = resolve12.call(self2, localCompile, root, ref);
+        var v2 = resolve13.call(self2, localCompile, root, ref);
         if (v2 === void 0) {
           var localSchema = localRefs && localRefs[ref];
           if (localSchema) {
-            v2 = resolve12.inlineRef(localSchema, opts.inlineRefs) ? localSchema : compile.call(self2, localSchema, root, localRefs, baseId2);
+            v2 = resolve13.inlineRef(localSchema, opts.inlineRefs) ? localSchema : compile.call(self2, localSchema, root, localRefs, baseId2);
           }
         }
         if (v2 === void 0) {
@@ -27816,7 +27830,7 @@ var require_ajv = __commonJS({
     init_define_VTX_GROK_POLICY();
     init_define_VTX_PI_MODEL_POLICY();
     var compileSchema = require_compile();
-    var resolve12 = require_resolve();
+    var resolve13 = require_resolve();
     var Cache = require_cache();
     var SchemaObject = require_schema_obj();
     var stableStringify = require_fast_json_stable_stringify();
@@ -27898,7 +27912,7 @@ var require_ajv = __commonJS({
       var id2 = this._getId(schema);
       if (id2 !== void 0 && typeof id2 != "string")
         throw new Error("schema id must be string");
-      key = resolve12.normalizeId(key || id2);
+      key = resolve13.normalizeId(key || id2);
       checkUnique(this, key);
       this._schemas[key] = this._addSchema(schema, _skipValidation, _meta, true);
       return this;
@@ -27942,7 +27956,7 @@ var require_ajv = __commonJS({
       }
     }
     function _getSchemaFragment(self2, ref) {
-      var res = resolve12.schema.call(self2, { schema: {} }, ref);
+      var res = resolve13.schema.call(self2, { schema: {} }, ref);
       if (res) {
         var schema = res.schema, root = res.root, baseId = res.baseId;
         var v = compileSchema.call(self2, schema, root, void 0, baseId);
@@ -27958,7 +27972,7 @@ var require_ajv = __commonJS({
       }
     }
     function _getSchemaObj(self2, keyRef) {
-      keyRef = resolve12.normalizeId(keyRef);
+      keyRef = resolve13.normalizeId(keyRef);
       return self2._schemas[keyRef] || self2._refs[keyRef] || self2._fragments[keyRef];
     }
     function removeSchema(schemaKeyRef) {
@@ -27985,7 +27999,7 @@ var require_ajv = __commonJS({
           this._cache.del(cacheKey);
           var id2 = this._getId(schemaKeyRef);
           if (id2) {
-            id2 = resolve12.normalizeId(id2);
+            id2 = resolve13.normalizeId(id2);
             delete this._schemas[id2];
             delete this._refs[id2];
           }
@@ -28009,13 +28023,13 @@ var require_ajv = __commonJS({
       var cached2 = this._cache.get(cacheKey);
       if (cached2) return cached2;
       shouldAddSchema = shouldAddSchema || this._opts.addUsedSchema !== false;
-      var id2 = resolve12.normalizeId(this._getId(schema));
+      var id2 = resolve13.normalizeId(this._getId(schema));
       if (id2 && shouldAddSchema) checkUnique(this, id2);
       var willValidate = this._opts.validateSchema !== false && !skipValidation;
       var recursiveMeta;
-      if (willValidate && !(recursiveMeta = id2 && id2 == resolve12.normalizeId(schema.$schema)))
+      if (willValidate && !(recursiveMeta = id2 && id2 == resolve13.normalizeId(schema.$schema)))
         this.validateSchema(schema, true);
-      var localRefs = resolve12.ids.call(this, schema);
+      var localRefs = resolve13.ids.call(this, schema);
       var schemaObj = new SchemaObject({
         id: id2,
         schema,
@@ -28599,7 +28613,7 @@ var init_codex_app_server = __esm({
       };
     };
     killWindowsProcessTree = async (pid) => {
-      await new Promise((resolve12, reject) => {
+      await new Promise((resolve13, reject) => {
         const child = spawn3(
           "taskkill.exe",
           ["/PID", String(pid), "/T", "/F"],
@@ -28624,7 +28638,7 @@ var init_codex_app_server = __esm({
         });
         child.once("close", (code) => {
           clearTimeout(timer);
-          if (code === 0 || code === 128) resolve12();
+          if (code === 0 || code === 128) resolve13();
           else reject(new Error("Windows Codex process-tree cleanup failed."));
         });
       });
@@ -28824,7 +28838,7 @@ child.once('close', async (code, signal) => {
       const platform = options.platform ?? process.platform;
       const renameFile = options.renameFile ?? rename2;
       const removeFile = options.removeFile ?? ((path) => rm2(path, { force: true }));
-      const sleep4 = options.sleep ?? ((milliseconds) => new Promise((resolve12) => setTimeout(resolve12, milliseconds)));
+      const sleep4 = options.sleep ?? ((milliseconds) => new Promise((resolve13) => setTimeout(resolve13, milliseconds)));
       const maxAttempts = Math.max(1, options.maxAttempts ?? 40);
       const retryDelayMs = Math.max(0, options.retryDelayMs ?? 25);
       for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
@@ -28916,7 +28930,7 @@ child.once('close', async (code, signal) => {
             throw new Error("Codex guardian terminated before app-server initialization.");
           }
         }
-        await new Promise((resolve12) => setTimeout(resolve12, 25));
+        await new Promise((resolve13) => setTimeout(resolve13, 25));
       }
       throw new Error(`Codex guardian ${expectedState} state was not confirmed.`);
     };
@@ -29298,8 +29312,8 @@ child.once('close', async (code, signal) => {
             dispatchOutcome: "not_dispatched"
           });
         }
-        return await new Promise((resolve12, reject) => {
-          const pending3 = { resolve: resolve12, reject, timer: null, abortCleanup: null };
+        return await new Promise((resolve13, reject) => {
+          const pending3 = { resolve: resolve13, reject, timer: null, abortCleanup: null };
           pending3.timer = setTimeout(() => {
             this.pending.delete(id2);
             this.retireResponseId(id2, method);
@@ -29974,8 +29988,8 @@ child.once('close', async (code, signal) => {
         const agentWebSearches = [];
         let terminalResolve;
         let terminalReject;
-        const terminalPromise = new Promise((resolve12, reject) => {
-          terminalResolve = resolve12;
+        const terminalPromise = new Promise((resolve13, reject) => {
+          terminalResolve = resolve13;
           terminalReject = reject;
         });
         void terminalPromise.catch(() => void 0);
@@ -30535,15 +30549,15 @@ child.once('close', async (code, signal) => {
           ).catch(() => void 0);
         }
         this.process.stdin.end();
-        const exited = await new Promise((resolve12) => {
+        const exited = await new Promise((resolve13) => {
           if (this.process.exitCode !== null) {
-            resolve12(true);
+            resolve13(true);
             return;
           }
-          const timer = setTimeout(() => resolve12(false), 5e3);
+          const timer = setTimeout(() => resolve13(false), 5e3);
           this.process.once("close", () => {
             clearTimeout(timer);
-            resolve12(true);
+            resolve13(true);
           });
         });
         if (exited) return;
@@ -30554,11 +30568,11 @@ child.once('close', async (code, signal) => {
           else this.process.kill("SIGTERM");
         } catch {
         }
-        const terminated = await new Promise((resolve12) => {
-          const timer = setTimeout(() => resolve12(false), 1e3);
+        const terminated = await new Promise((resolve13) => {
+          const timer = setTimeout(() => resolve13(false), 1e3);
           this.process.once("close", () => {
             clearTimeout(timer);
-            resolve12(true);
+            resolve13(true);
           });
         });
         if (!terminated) {
@@ -30568,15 +30582,15 @@ child.once('close', async (code, signal) => {
             else this.process.kill("SIGKILL");
           } catch {
           }
-          await new Promise((resolve12) => {
+          await new Promise((resolve13) => {
             if (this.process.exitCode !== null) {
-              resolve12();
+              resolve13();
               return;
             }
-            const timer = setTimeout(resolve12, 1e3);
+            const timer = setTimeout(resolve13, 1e3);
             this.process.once("close", () => {
               clearTimeout(timer);
-              resolve12();
+              resolve13();
             });
           });
           if (this.process.exitCode === null) {
@@ -31194,13 +31208,13 @@ var init_runner = __esm({
     };
     defaultSleep = async (milliseconds, signal) => {
       if (signal?.aborted) throw abortError();
-      await new Promise((resolve12, reject) => {
+      await new Promise((resolve13, reject) => {
         const finish = (callback) => {
           signal?.removeEventListener("abort", onAbort);
           callback();
         };
         const timer = setTimeout(
-          () => finish(resolve12),
+          () => finish(resolve13),
           Math.max(MIN_SLEEP_MS, milliseconds)
         );
         const onAbort = () => {
@@ -31226,9 +31240,9 @@ var init_runner = __esm({
       let timer = null;
       const settled = await Promise.race([
         promise2.then(() => true, () => true),
-        new Promise((resolve12) => {
+        new Promise((resolve13) => {
           timer = setTimeout(
-            () => resolve12(false),
+            () => resolve13(false),
             Math.max(MIN_SLEEP_MS, timeoutMs)
           );
         })
@@ -31803,8 +31817,8 @@ var init_runner = __esm({
         };
         let quiesceRequested = Boolean(this.options.quiesceSignal?.aborted);
         let wakeQuiesce;
-        const quiesceWake = new Promise((resolve12) => {
-          wakeQuiesce = resolve12;
+        const quiesceWake = new Promise((resolve13) => {
+          wakeQuiesce = resolve13;
         });
         let drainRequested = false;
         let drainReason = "stopped";
@@ -31827,8 +31841,8 @@ var init_runner = __esm({
         let modelCatalogRefresh = null;
         let providerRateLimitRefresh = null;
         let wakeDrain;
-        const drainSignal = new Promise((resolve12) => {
-          wakeDrain = resolve12;
+        const drainSignal = new Promise((resolve13) => {
+          wakeDrain = resolve13;
         });
         const requestDrain = (reason) => {
           const priority = (value) => {
@@ -31919,7 +31933,7 @@ var init_runner = __esm({
           const metadata = await this.dependencies.discoverOAuth({
             signal: this.options.signal
           });
-          let access5 = null;
+          let access6 = null;
           let accessExpiresAt = 0;
           let refreshPromise = null;
           const refreshAccessToken = async (requestOptions = {}) => {
@@ -31932,7 +31946,7 @@ var init_runner = __esm({
               );
               assertLocalCredentialIdentity(localState, refreshed.credential);
               credential = refreshed.credential;
-              access5 = refreshed;
+              access6 = refreshed;
               accessExpiresAt = now() + refreshed.expiresIn * 1e3;
               return refreshed.accessToken;
             })();
@@ -31945,10 +31959,10 @@ var init_runner = __esm({
           await refreshAccessToken({ signal: this.options.signal });
           const tokenSource = {
             accessToken: async (requestOptions) => {
-              if (!access5 || accessExpiresAt - now() <= 5e3) {
+              if (!access6 || accessExpiresAt - now() <= 5e3) {
                 return refreshAccessToken(requestOptions);
               }
-              return access5.accessToken;
+              return access6.accessToken;
             },
             refreshAccessToken
           };
@@ -32203,8 +32217,8 @@ var init_runner = __esm({
             receipt = result2;
             const revision = receiptRevision + 1;
             receiptRevision = revision;
-            const durable = new Promise((resolve12, reject) => {
-              receiptDurabilityWaiters.push({ revision, resolve: resolve12, reject });
+            const durable = new Promise((resolve13, reject) => {
+              receiptDurabilityWaiters.push({ revision, resolve: resolve13, reject });
             });
             scheduleReceiptWriter();
             await durable;
@@ -32320,8 +32334,8 @@ var init_runner = __esm({
             const tool = receipt.registered ? "inference.host.advertise" : "inference.host.register";
             let result2;
             let releaseAdvertisementHandoff;
-            const currentAdvertisementHandoff = new Promise((resolve12) => {
-              releaseAdvertisementHandoff = resolve12;
+            const currentAdvertisementHandoff = new Promise((resolve13) => {
+              releaseAdvertisementHandoff = resolve13;
             });
             advertisementHandoff = currentAdvertisementHandoff;
             try {
@@ -33538,8 +33552,8 @@ var init_runner = __esm({
         let providerDispatchWatchdog = null;
         let providerDispatchWatchdogExpired = false;
         let resolveProviderDispatchWatchdog;
-        const providerDispatchWatchdogSignal = new Promise((resolve12) => {
-          resolveProviderDispatchWatchdog = resolve12;
+        const providerDispatchWatchdogSignal = new Promise((resolve13) => {
+          resolveProviderDispatchWatchdog = resolve13;
         });
         const clearProviderDispatchWatchdog = () => {
           if (providerDispatchWatchdog !== null) clearTimeout(providerDispatchWatchdog);
@@ -33976,8 +33990,8 @@ var init_runner = __esm({
             });
           }
           let resolveTerminalDispatchOutcome;
-          const terminalDispatchOutcomeSignal = new Promise((resolve12) => {
-            resolveTerminalDispatchOutcome = resolve12;
+          const terminalDispatchOutcomeSignal = new Promise((resolve13) => {
+            resolveTerminalDispatchOutcome = resolve13;
           });
           let terminalDispatchOutcomeObserved = false;
           const adapterAttempt = this.dependencies.codexAdapter.runAttempt({
@@ -35281,7 +35295,7 @@ async function reauthorizeInferenceHost(options) {
     throw new Error("Host reauthorization was rejected; the previous host identity was preserved.");
   }
   let candidate = await store.readRecovery();
-  let access5 = options.authorizedAccess ?? null;
+  let access6 = options.authorizedAccess ?? null;
   if (!candidate) {
     if (transition) {
       if (!transition.remote_committed || options.state.client_id !== transition.client_id) {
@@ -35307,7 +35321,7 @@ async function reauthorizeInferenceHost(options) {
     });
     options.emitAuthorization(pending3.authorizationUrl);
     try {
-      access5 = await pending3.completion;
+      access6 = await pending3.completion;
     } catch (error48) {
       await pending3.cancel().catch(() => void 0);
       throw error48;
@@ -35356,7 +35370,7 @@ async function reauthorizeInferenceHost(options) {
     return runStopped(() => reauthorizeInferenceHost({
       ...options,
       withStoppedHost: void 0,
-      authorizedAccess: access5 ?? void 0
+      authorizedAccess: access6 ?? void 0
     }));
   }
   if (transition.service_prepare_pending) {
@@ -35365,8 +35379,8 @@ async function reauthorizeInferenceHost(options) {
     await save();
   }
   if (!transition.remote_committed) {
-    if (!access5) {
-      access5 = await refreshInferenceCredential({
+    if (!access6) {
+      access6 = await refreshInferenceCredential({
         metadata: await discoverInferenceOAuth(config2.apiUrl),
         credential: candidate.credential,
         store: stagedStore
@@ -35384,7 +35398,7 @@ async function reauthorizeInferenceHost(options) {
     });
     let result2;
     try {
-      result2 = await register(access5, transition.advertisement);
+      result2 = await register(access6, transition.advertisement);
     } catch (error48) {
       if (error48 instanceof ExternalInferenceMcpError && error48.code === "tool_rejected" && !error48.retryable && !error48.definitivelyNotApplied) {
         transition.remote_rejected = true;
@@ -35395,7 +35409,7 @@ async function reauthorizeInferenceHost(options) {
       if (!(error48 instanceof ExternalInferenceMcpError) || !error48.definitivelyNotApplied) throw error48;
       transition.advertisement = freshAdvertisement();
       await save();
-      result2 = await register(access5, transition.advertisement);
+      result2 = await register(access6, transition.advertisement);
     }
     if (result2.host.host_id !== next.host_id || result2.host.host_generation !== next.host_generation || result2.host.key_generation !== next.key_generation || result2.host.advertisement_generation !== transition.advertisement.advertisement_generation) {
       throw new Error("Inference host reauthorization returned a different host identity.");
@@ -35477,7 +35491,7 @@ async function createInferenceAgentMcpSession(options) {
     options.fetchImpl,
     { signal: options.signal, timeoutMs: options.requestTimeoutMs }
   );
-  let access5 = null;
+  let access6 = null;
   let accessExpiresAt = 0;
   let refreshPromise = null;
   const refreshAccessToken = async (requestOptions = {}) => {
@@ -35494,7 +35508,7 @@ async function createInferenceAgentMcpSession(options) {
       });
       assertCredentialMatchesState(localState, refreshed.credential);
       credential = refreshed.credential;
-      access5 = refreshed;
+      access6 = refreshed;
       accessExpiresAt = Date.now() + refreshed.expiresIn * 1e3;
       return refreshed.accessToken;
     })();
@@ -35507,10 +35521,10 @@ async function createInferenceAgentMcpSession(options) {
   await refreshAccessToken({ signal: options.signal });
   const tokenSource = {
     accessToken: async (requestOptions) => {
-      if (!access5 || accessExpiresAt - Date.now() <= 5e3) {
+      if (!access6 || accessExpiresAt - Date.now() <= 5e3) {
         return refreshAccessToken(requestOptions);
       }
-      return access5.accessToken;
+      return access6.accessToken;
     },
     refreshAccessToken
   };
@@ -35598,7 +35612,7 @@ var init_codex_binary = __esm({
         spec.binaryName
       );
     };
-    readCodexVersion = async (binaryPath) => await new Promise((resolve12, reject) => {
+    readCodexVersion = async (binaryPath) => await new Promise((resolve13, reject) => {
       const child = spawn4(binaryPath, ["--version"], {
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,
@@ -35636,7 +35650,7 @@ var init_codex_binary = __esm({
           reject(new Error("Codex version probe failed."));
           return;
         }
-        resolve12(stdout.trim());
+        resolve13(stdout.trim());
       });
     });
     verifyPinnedCodexBinary = async (candidatePath, dependencies = {}) => {
@@ -36545,7 +36559,7 @@ var init_codex_adapter = __esm({
         durableSession.session.requireModelCapability(capabilities, modelName, reasoningEffort);
       }
       async waitForCapabilities(preflight, deadlineAtMs, signal) {
-        return await new Promise((resolve12, reject) => {
+        return await new Promise((resolve13, reject) => {
           let settled = false;
           const finish = (callback) => {
             if (settled) return;
@@ -36572,7 +36586,7 @@ var init_codex_adapter = __esm({
             return;
           }
           void preflight.then(
-            (value) => finish(() => resolve12(value)),
+            (value) => finish(() => resolve13(value)),
             (error48) => finish(() => reject(error48))
           );
         });
@@ -38198,9 +38212,9 @@ var init_deepseek_transport_proxy = __esm({
             response.end();
           }
         });
-        await new Promise((resolve12, reject) => {
+        await new Promise((resolve13, reject) => {
           this.server.once("error", reject);
-          this.server.listen(0, "127.0.0.1", () => resolve12());
+          this.server.listen(0, "127.0.0.1", () => resolve13());
         });
         const address = this.server.address();
         if (!address || typeof address === "string") throw new Error("deepseek_proxy_bind_failed");
@@ -38212,7 +38226,7 @@ var init_deepseek_transport_proxy = __esm({
         this.server = null;
         this.urlValue = null;
         if (!server) return;
-        await new Promise((resolve12) => server.close(() => resolve12()));
+        await new Promise((resolve13) => server.close(() => resolve13()));
       }
     };
   }
@@ -38750,11 +38764,11 @@ ${JSON.stringify(input.outputSchema)}`,
           boundary.signal.throwIfAborted();
           let checkpointReached = false;
           let resolveCheckpoint;
-          const checkpoint = new Promise((resolve12) => {
-            resolveCheckpoint = resolve12;
+          const checkpoint = new Promise((resolve13) => {
+            resolveCheckpoint = resolve13;
           });
-          const dispatchGate = new Promise((resolve12) => {
-            releaseAgentDispatch = resolve12;
+          const dispatchGate = new Promise((resolve13) => {
+            releaseAgentDispatch = resolve13;
           });
           ctx.on("llm/stream", (options, next) => {
             if (String(options.sessionId ?? "") !== String(sessionId)) return next();
@@ -39635,7 +39649,7 @@ var init_grok_binary = __esm({
     decompress = promisify(brotliDecompress);
     pending = /* @__PURE__ */ new Map();
     digest = (bytes3) => createHash7("sha256").update(bytes3).digest("hex");
-    verifyVersion = async (path) => new Promise((resolve12, reject) => {
+    verifyVersion = async (path) => new Promise((resolve13, reject) => {
       const child = spawn6(path, ["--version"], {
         stdio: ["ignore", "pipe", "ignore"],
         windowsHide: true,
@@ -39662,7 +39676,7 @@ var init_grok_binary = __esm({
         clearTimeout(timer);
         if (code !== 0 || /^grok\s+(\S+)/u.exec(stdout.trim())?.[1] !== agent_cli_release_default.grok_version) {
           reject(new Error("Grok runtime version does not match its release."));
-        } else resolve12();
+        } else resolve13();
       });
     });
     resolvePinnedGrokBinary = async (stateRoot) => {
@@ -39882,9 +39896,9 @@ var init_grok_transport_proxy = __esm({
         this.server = createServer3((request, response) => {
           void this.handle(request, response);
         });
-        await new Promise((resolve12, reject) => {
+        await new Promise((resolve13, reject) => {
           this.server.once("error", reject);
-          this.server.listen(0, "127.0.0.1", () => resolve12());
+          this.server.listen(0, "127.0.0.1", () => resolve13());
         });
         const address = this.server.address();
         if (!address || typeof address === "string") throw new Error("grok_proxy_bind_failed");
@@ -40260,7 +40274,7 @@ var init_grok_transport_proxy = __esm({
         this.urlValue = null;
         if (!server) return;
         server.closeAllConnections();
-        await new Promise((resolve12) => server.close(() => resolve12()));
+        await new Promise((resolve13) => server.close(() => resolve13()));
       }
     };
     createGrokTransportProxy = async (options) => {
@@ -40441,11 +40455,11 @@ var init_grok_runtime = __esm({
             this.child.kill();
           }
         });
-        this.exit = new Promise((resolve12) => {
+        this.exit = new Promise((resolve13) => {
           this.child.once("error", () => this.fail(new Error("grok_process_start_failed")));
           this.child.once("close", () => {
             this.fail(new Error("grok_process_closed"));
-            resolve12();
+            resolve13();
           });
         });
       }
@@ -40465,8 +40479,8 @@ var init_grok_runtime = __esm({
         let timer;
         let abort;
         try {
-          return await new Promise((resolve12, reject) => {
-            this.pending.set(id2, { resolve: resolve12, reject });
+          return await new Promise((resolve13, reject) => {
+            this.pending.set(id2, { resolve: resolve13, reject });
             timer = setTimeout(() => reject(new Error("grok_deadline_exceeded")), Math.max(1, deadlineAtMs - Date.now()));
             abort = () => reject(new Error("grok_cancelled"));
             signal?.addEventListener("abort", abort, { once: true });
@@ -40540,9 +40554,9 @@ var init_grok_runtime = __esm({
           response.writeHead(400).end();
         }
       });
-      await new Promise((resolve12, reject) => {
+      await new Promise((resolve13, reject) => {
         server.once("error", reject);
-        server.listen(0, "127.0.0.1", resolve12);
+        server.listen(0, "127.0.0.1", resolve13);
       });
       const address = server.address();
       if (!address || typeof address === "string") throw new Error("grok_mcp_listen_failed");
@@ -40553,7 +40567,7 @@ var init_grok_runtime = __esm({
         descriptor: { type: "http", name: "vtx", url: `http://127.0.0.1:${address.port}/${token}`, headers: [] },
         close: async () => {
           server.closeAllConnections();
-          await new Promise((resolve12) => server.close(() => resolve12()));
+          await new Promise((resolve13) => server.close(() => resolve13()));
         }
       };
     };
@@ -41279,7 +41293,7 @@ var init_grok_auth = __esm({
       await prepareGrokHome(options.grokHome);
       const binary = await resolvePinnedGrokBinary(options.stateRoot);
       options.signal?.throwIfAborted();
-      await new Promise((resolve12, reject) => {
+      await new Promise((resolve13, reject) => {
         const child = spawn8(binary.path, ["--no-auto-update", action, ...action === "login" ? ["--device-auth"] : []], {
           cwd: options.grokHome,
           env: grokRuntimeEnvironment(options.grokHome),
@@ -41341,7 +41355,7 @@ var init_grok_auth = __esm({
         child.once("close", (code) => {
           cleanup();
           if (code !== 0 || failed || options.signal?.aborted) reject(new Error(`Grok ${action} did not complete. Run grok-${action} again.`));
-          else resolve12();
+          else resolve13();
         });
         if (options.signal?.aborted) stop();
       });
@@ -42349,6 +42363,74 @@ var init_durable_adapter = __esm({
   }
 });
 
+// lib/inference-host/service-launcher-state.ts
+import { access as access4, readFile as readFile9, rm as rm10 } from "node:fs/promises";
+import { dirname as dirname12, isAbsolute as isAbsolute5, join as join13, relative as relative3, resolve as resolve10 } from "node:path";
+var launcherSibling, within, launcherSelection, readLauncherSelection, readLauncherState, writeLauncherState, targetForSelection;
+var init_service_launcher_state = __esm({
+  "lib/inference-host/service-launcher-state.ts"() {
+    "use strict";
+    init_define_VTX_EXO_POLICY();
+    init_define_VTX_GROK_POLICY();
+    init_define_VTX_PI_MODEL_POLICY();
+    init_config();
+    launcherSibling = (manifest, suffix) => {
+      if (!manifest.endsWith(".service.json")) throw new Error("Invalid service manifest path.");
+      return `${manifest.slice(0, -".service.json".length)}${suffix}`;
+    };
+    within = (parent, child) => {
+      const part = relative3(resolve10(parent), resolve10(child));
+      return Boolean(part) && !part.startsWith("..") && !isAbsolute5(part);
+    };
+    launcherSelection = (manifest, value) => {
+      if (!value || typeof value !== "object") return null;
+      const r = value;
+      if (r.schema_version !== "vtx_inference_service_release_v1" || r.package_name !== "@vtxmacro/cli" || typeof r.package_version !== "string" || !/^\d{4}\.\d{1,2}\.\d{1,3}$/u.test(r.package_version) || typeof r.integrity !== "string" || typeof r.selected_at !== "string" || !Number.isFinite(Date.parse(r.selected_at)) || typeof r.script !== "string" || !isAbsolute5(r.script) || /[\r\n\0]/u.test(r.script) || !within(launcherSibling(manifest, ".service-releases"), r.script)) return null;
+      return r;
+    };
+    readLauncherSelection = async (manifest) => {
+      try {
+        return launcherSelection(manifest, JSON.parse(await readFile9(launcherSibling(manifest, ".service-release.json"), "utf8")));
+      } catch (error48) {
+        if (error48.code === "ENOENT") return null;
+        throw error48;
+      }
+    };
+    readLauncherState = async (manifest) => {
+      let value;
+      try {
+        value = JSON.parse(await readFile9(launcherSibling(manifest, ".service-launcher.json"), "utf8"));
+      } catch (error48) {
+        if (error48.code === "ENOENT") return null;
+        throw error48;
+      }
+      if (!value || typeof value !== "object") throw new Error("Invalid service launcher state.");
+      const r = value;
+      const target = (v) => {
+        if (!v || typeof v !== "object") return false;
+        const t = v;
+        return typeof t.package_version === "string" && /^\d{4}\.\d{1,2}\.\d{1,3}$/u.test(t.package_version) && typeof t.script === "string" && isAbsolute5(t.script) && !/[\r\n\0]/u.test(t.script) && (within(launcherSibling(manifest, ".service-releases"), t.script) || resolve10(t.script) === resolve10(launcherSibling(manifest, ".service-bootstrap.previous.js"))) && (t.selection === null || (() => {
+          const selected = launcherSelection(manifest, t.selection);
+          return Boolean(selected && selected.package_version === t.package_version && (resolve10(t.script) === resolve10(join13(dirname12(selected.script), "vtx-service-bootstrap.js")) || resolve10(t.script) === resolve10(launcherSibling(manifest, ".service-bootstrap.previous.js"))));
+        })());
+      };
+      if (r.schema_version !== "vtx_inference_service_launcher_v1" || !target(r.active) || r.previous !== null && !target(r.previous) || typeof r.pending !== "boolean") {
+        throw new Error("Invalid service launcher recovery targets.");
+      }
+      return r;
+    };
+    writeLauncherState = async (manifest, state) => {
+      await writeAtomicInferencePrivateFile(launcherSibling(manifest, ".service-launcher.json"), `${JSON.stringify(state)}
+`);
+    };
+    targetForSelection = async (selection) => {
+      const script = join13(dirname12(selection.script), "vtx-service-bootstrap.js");
+      await access4(script);
+      return { package_version: selection.package_version, script, selection };
+    };
+  }
+});
+
 // lib/runtime-policy.generated.json with { type: 'json' }
 var runtime_policy_generated_default2;
 var init_runtime_policy_generated2 = __esm({
@@ -42444,6 +42526,8 @@ var init_runtime_policy_generated2 = __esm({
         service: {
           update_check_interval_ms: 3e5,
           update_registry_timeout_ms: 15e3,
+          bootstrap_readiness_timeout_ms: 6e5,
+          bootstrap_stop_timeout_ms: 1e4,
           startup_max_attempts: 40,
           startup_poll_interval_ms: 250,
           restart_stable_uptime_ms: 6e4,
@@ -42532,16 +42616,17 @@ var init_runtime_policy_generated2 = __esm({
 import { spawn as spawn10 } from "node:child_process";
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { createWriteStream, readFileSync as readFileSync2 } from "node:fs";
-import { access as access4, chmod as chmod3, mkdir as mkdir3, readFile as readFile9, rm as rm10, writeFile as writeFile4 } from "node:fs/promises";
+import { access as access5, chmod as chmod3, mkdir as mkdir3, readFile as readFile10, rm as rm11, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname12, join as join13, resolve as resolve10 } from "node:path";
-var SERVICE_NAME, SYSTEMD_UNIT, LAUNCHD_LABEL, SERVICE_COOPERATIVE_STOP_SECONDS, SERVICE_UPDATE_STARTUP_SECONDS, INFERENCE_HOST_SERVICE_DRAIN_COMMAND, INFERENCE_HOST_SERVICE_QUIESCE_COMMAND, InferenceHostBootstrapRestartRequiredError, inferenceHostServiceChildEnvironment, isWindowsSubsystemForLinux, inferenceHostServiceManifestPath, inferenceHostServiceDesiredPath, inferenceHostServiceLogPath, inferenceHostServiceRuntimePath, xmlEscape, plistEscape, systemdQuote, defaultRunCommand, managerName, assertRuntimeEnvironment, withoutConcurrencyLimit, assertServicePath, manifestGeneration, assertWorker, assertManifest, assertServiceRuntimeState, assertDesiredState, readInferenceHostServiceManifest, readManifestAcrossAtomicReplacement, readInferenceHostServiceRuntime, readRuntimeAcrossAtomicReplacement, readInferenceHostServiceDesired, readDesiredAcrossAtomicReplacement, writeDesired, runtimeEnvironment, serviceBootstrapArguments, windowsOwnedCommandLine, vbScriptString, windowsServiceLauncher, windowsTaskXml, systemdUnit, launchAgentPlist, sameWorker, sameServiceDefinition, sameWorkerSet, InferenceHostServiceManager, appendServiceLog, spawnInferenceHostServiceChild, runInferenceHostServiceSupervisor;
+import { dirname as dirname13, join as join14, resolve as resolve11 } from "node:path";
+var SERVICE_NAME, SYSTEMD_UNIT, LAUNCHD_LABEL, SERVICE_COOPERATIVE_STOP_SECONDS, SERVICE_UPDATE_STARTUP_SECONDS, INFERENCE_HOST_SERVICE_DRAIN_COMMAND, INFERENCE_HOST_SERVICE_QUIESCE_COMMAND, InferenceHostBootstrapRestartRequiredError, inferenceHostServiceChildEnvironment, isWindowsSubsystemForLinux, inferenceHostServiceManifestPath, inferenceHostServiceDesiredPath, inferenceHostServiceLogPath, inferenceHostServiceRuntimePath, xmlEscape, plistEscape, systemdQuote, defaultRunCommand, probeInferenceHostLauncher, managerName, assertRuntimeEnvironment, withoutConcurrencyLimit, assertServicePath, manifestGeneration, assertWorker, assertManifest, assertServiceRuntimeState, assertDesiredState, readInferenceHostServiceManifest, readManifestAcrossAtomicReplacement, readInferenceHostServiceRuntime, readRuntimeAcrossAtomicReplacement, readInferenceHostServiceDesired, readDesiredAcrossAtomicReplacement, writeDesired, runtimeEnvironment, serviceBootstrapArguments, windowsOwnedCommandLine, vbScriptString, windowsServiceLauncher, windowsTaskXml, systemdUnit, launchAgentPlist, sameWorker, sameServiceDefinition, sameWorkerSet, InferenceHostServiceManager, appendServiceLog, spawnInferenceHostServiceChild, runInferenceHostServiceSupervisor;
 var init_service = __esm({
   "lib/inference-host/service.ts"() {
     "use strict";
     init_define_VTX_EXO_POLICY();
     init_define_VTX_GROK_POLICY();
     init_define_VTX_PI_MODEL_POLICY();
+    init_service_launcher_state();
     init_agent_cli_release();
     init_runtime_policy_generated2();
     init_durable_adapter();
@@ -42607,6 +42692,18 @@ var init_service = __esm({
         stderr: Buffer.concat(stderr).toString("utf8")
       }));
     });
+    probeInferenceHostLauncher = async (executable, destination, bytes3, runCommand = defaultRunCommand) => {
+      const probe = `${destination}.${randomUUID9()}.probe.js`;
+      try {
+        await writeAtomicInferencePrivateFile(probe, bytes3);
+        const result2 = await runCommand(executable, [probe]);
+        if (result2.exitCode !== 1 || result2.stdout.trim() || result2.stderr.trim() !== "Internal service manifest and lock paths are required.") {
+          throw new Error("Copied service launcher failed its isolated startup check.");
+        }
+      } finally {
+        await rm11(probe, { force: true });
+      }
+    };
     managerName = (platform) => {
       if (platform === "win32") return "windows-task-scheduler";
       if (platform === "darwin") return "launch-agent";
@@ -42947,10 +43044,10 @@ WantedBy=default.target
         this.config = config2;
         this.platform = dependencies.platform ?? process.platform;
         this.home = dependencies.homedir ?? homedir2();
-        this.executable = resolve10(dependencies.executable ?? process.execPath);
-        this.script = resolve10(dependencies.script ?? process.argv[1] ?? "");
-        this.bootstrapScript = resolve10(
-          dependencies.bootstrapScript ?? join13(dirname12(this.script), "vtx-service-bootstrap.js")
+        this.executable = resolve11(dependencies.executable ?? process.execPath);
+        this.script = resolve11(dependencies.script ?? process.argv[1] ?? "");
+        this.bootstrapScript = resolve11(
+          dependencies.bootstrapScript ?? join14(dirname13(this.script), "vtx-service-launcher.js")
         );
         this.username = dependencies.username ?? ([process.env.USERDOMAIN, process.env.USERNAME].filter(Boolean).join("\\") || process.env.USER || "");
         this.windowsDirectory = (dependencies.windowsDirectory ?? process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows").replace(/[\\/]+$/u, "");
@@ -43036,16 +43133,16 @@ WantedBy=default.target
       }
       definitionPath() {
         if (this.platform === "win32") return `${this.config.supervisorStatePath}.service-task.xml`;
-        if (this.platform === "darwin") return join13(this.home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-        return join13(this.home, ".config", "systemd", "user", SYSTEMD_UNIT);
+        if (this.platform === "darwin") return join14(this.home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+        return join14(this.home, ".config", "systemd", "user", SYSTEMD_UNIT);
       }
       windowsLauncherPath() {
         return `${this.config.supervisorStatePath}.service-launcher.vbs`;
       }
       async hasBootstrapDefinition() {
         try {
-          await access4(this.serviceBootstrapPath());
-          const definition = await readFile9(
+          await access5(this.serviceBootstrapPath());
+          const definition = await readFile10(
             this.platform === "win32" ? this.windowsLauncherPath() : this.definitionPath(),
             "utf8"
           );
@@ -43175,24 +43272,36 @@ ${result2.stderr}`)) {
         );
       }
       async registerManifestUnlocked(manifest, desiredRunning, targetInstanceName) {
-        await access4(this.bootstrapScript);
+        await access5(this.bootstrapScript);
         const args = serviceBootstrapArguments(
           this.serviceBootstrapPath(),
           this.manifestPath(),
           this.serviceBootstrapLockPath()
         );
         const definition = this.platform === "win32" ? windowsTaskXml(this.windowsLauncherPath(), this.windowsDirectory, this.username) : this.platform === "darwin" ? launchAgentPlist(manifest.executable, args, manifest.log_path) : systemdUnit(manifest.executable, args);
+        const existingRecovery = await readLauncherState(this.manifestPath());
         let managerInstallAttempted = false;
         try {
           await writeAtomicInferencePrivateFile(this.manifestPath(), `${JSON.stringify(manifest, null, 2)}
 `);
           await writeDesired(this.desiredPath(), desiredRunning, this.now());
-          await writeAtomicInferencePrivateFile(
-            this.serviceBootstrapPath(),
-            await readFile9(this.bootstrapScript, "utf8")
-          );
+          const launcherBytes = await readFile10(this.bootstrapScript, "utf8");
+          if (this.bootstrapScript.endsWith("vtx-service-launcher.js") && !existingRecovery) {
+            await probeInferenceHostLauncher(manifest.executable, this.serviceBootstrapPath(), launcherBytes, this.runCommand);
+            const core = launcherSibling(this.manifestPath(), ".service-bootstrap.previous.js");
+            const coreBytes = await readFile10(join14(dirname13(this.bootstrapScript), "vtx-service-bootstrap.js"), "utf8");
+            await probeInferenceHostLauncher(manifest.executable, core, coreBytes, this.runCommand);
+            await writeAtomicInferencePrivateFile(core, coreBytes);
+            await writeLauncherState(this.manifestPath(), {
+              schema_version: "vtx_inference_service_launcher_v1",
+              active: { package_version: agent_cli_release_default.package_version, script: core, selection: null },
+              previous: null,
+              pending: false
+            });
+          }
+          if (!existingRecovery) await writeAtomicInferencePrivateFile(this.serviceBootstrapPath(), launcherBytes);
           await chmod3(this.serviceBootstrapPath(), 448);
-          await mkdir3(dirname12(this.definitionPath()), { recursive: true, mode: 448 });
+          await mkdir3(dirname13(this.definitionPath()), { recursive: true, mode: 448 });
           if (this.platform === "win32") {
             await writeAtomicInferencePrivateFile(
               this.windowsLauncherPath(),
@@ -43245,14 +43354,17 @@ ${cleanup.stderr}`)) {
               );
             }
           }
-          await rm10(this.definitionPath(), { force: true }).catch(() => void 0);
+          await rm11(this.definitionPath(), { force: true }).catch(() => void 0);
           if (this.platform === "win32") {
-            await rm10(this.windowsLauncherPath(), { force: true }).catch(() => void 0);
+            await rm11(this.windowsLauncherPath(), { force: true }).catch(() => void 0);
+          }
+          await rm11(this.manifestPath(), { force: true }).catch(() => void 0);
+          await rm11(this.desiredPath(), { force: true }).catch(() => void 0);
+          await rm11(this.runtimePath(), { force: true }).catch(() => void 0);
+          if (!existingRecovery) await rm11(this.serviceBootstrapPath(), { force: true }).catch(() => void 0);
+          for (const suffix of [".service-launcher.json", ".service-bootstrap.previous.js"]) {
+            if (!existingRecovery) await rm11(launcherSibling(this.manifestPath(), suffix), { force: true }).catch(() => void 0);
           }
-          await rm10(this.manifestPath(), { force: true }).catch(() => void 0);
-          await rm10(this.desiredPath(), { force: true }).catch(() => void 0);
-          await rm10(this.runtimePath(), { force: true }).catch(() => void 0);
-          await rm10(this.serviceBootstrapPath(), { force: true }).catch(() => void 0);
           if (this.platform === "linux") {
             await this.runCommand("systemctl", ["--user", "daemon-reload"]).catch(() => void 0);
           }
@@ -43312,7 +43424,7 @@ ${cleanup.stderr}`)) {
         }
         if (previous) {
           try {
-            await this.uninstallUnlocked();
+            await this.uninstallUnlocked(true);
           } catch (error48) {
             throw new Error(
               "Inference-host service reconfiguration could not stop the previous supervisor; its desired state was restored.",
@@ -43378,15 +43490,15 @@ ${cleanup.stderr}`)) {
         }
         if (this.config.credentialFilePath && otherWorkers.some((worker) => {
           const otherPath = worker.runtime_environment.VTX_INFERENCE_HOST_CREDENTIAL_FILE;
-          return otherPath && resolve10(otherPath) === resolve10(this.config.credentialFilePath);
+          return otherPath && resolve11(otherPath) === resolve11(this.config.credentialFilePath);
         })) {
           throw new Error(
             "Each inference-host instance must use a different private credential file."
           );
         }
-        await access4(this.executable);
-        await access4(this.script);
-        await access4(this.bootstrapScript);
+        await access5(this.executable);
+        await access5(this.script);
+        await access5(this.bootstrapScript);
         const maxConcurrency = options.maxConcurrency ?? null;
         const workers = [
           ...existing?.workers.filter((worker) => worker.instance_name !== this.config.instanceName) ?? [],
@@ -43596,7 +43708,7 @@ ${result2.stderr}`)) {
         const manifest = await readInferenceHostServiceManifest(this.manifestPath());
         const path = manifest?.log_path ?? this.logPath();
         try {
-          const contents = await readFile9(path, "utf8");
+          const contents = await readFile10(path, "utf8");
           const logLines = contents.trimEnd().split(/\r?\n/u);
           const filtered = instanceName ? logLines.filter((line) => {
             try {
@@ -43635,7 +43747,7 @@ ${result2.stderr}`)) {
       async uninstall() {
         return await this.withControlLock(async () => await this.uninstallUnlocked());
       }
-      async uninstallUnlocked() {
+      async uninstallUnlocked(preserveRecovery = false) {
         const manifest = await readInferenceHostServiceManifest(this.manifestPath());
         if (!manifest) throw new Error("Inference-host service is not installed.");
         const current = await this.status();
@@ -43649,16 +43761,21 @@ ${result2.stderr}`)) {
 ${result2.stderr}`)) {
           throw new Error(`Background service uninstall failed: ${result2.stderr.trim()}`);
         }
-        await rm10(this.definitionPath(), { force: true });
-        if (this.platform === "win32") await rm10(this.windowsLauncherPath(), { force: true });
+        await rm11(this.definitionPath(), { force: true });
+        if (this.platform === "win32") await rm11(this.windowsLauncherPath(), { force: true });
         if (this.platform === "linux") await this.runCommand("systemctl", ["--user", "daemon-reload"]);
-        await rm10(this.manifestPath(), { force: true });
-        await rm10(this.desiredPath(), { force: true });
-        await rm10(this.runtimePath(), { force: true });
-        await rm10(this.serviceBootstrapPath(), { force: true });
-        await rm10(this.serviceReleasePath(), { force: true });
-        await rm10(this.serviceReleaseRejectionPath(), { force: true });
-        await rm10(this.serviceReleasesPath(), { recursive: true, force: true });
+        await rm11(this.manifestPath(), { force: true });
+        await rm11(this.desiredPath(), { force: true });
+        await rm11(this.runtimePath(), { force: true });
+        if (!preserveRecovery) {
+          await rm11(this.serviceBootstrapPath(), { force: true });
+          for (const suffix of [".service-launcher.json", ".service-bootstrap.previous.js"]) {
+            await rm11(launcherSibling(this.manifestPath(), suffix), { force: true });
+          }
+          await rm11(this.serviceReleasePath(), { force: true });
+          await rm11(this.serviceReleaseRejectionPath(), { force: true });
+          await rm11(this.serviceReleasesPath(), { recursive: true, force: true });
+        }
         return {
           installed: false,
           desired_running: false,
@@ -43672,7 +43789,7 @@ ${result2.stderr}`)) {
       }
     };
     appendServiceLog = async (path, event, fields = {}) => {
-      await mkdir3(dirname12(path), { recursive: true, mode: 448 });
+      await mkdir3(dirname13(path), { recursive: true, mode: 448 });
       const stream = createWriteStream(path, { flags: "a", mode: 384 });
       await new Promise((resolvePromise, reject) => {
         stream.once("error", reject);
@@ -43801,7 +43918,7 @@ ${result2.stderr}`)) {
     runInferenceHostServiceSupervisor = async (manifestPath, options = {}) => {
       const storedInitialManifest = await readInferenceHostServiceManifest(manifestPath);
       if (!storedInitialManifest) throw new Error("Inference-host service manifest is missing.");
-      const serviceScript = options.serviceScript ? resolve10(options.serviceScript) : null;
+      const serviceScript = options.serviceScript ? resolve11(options.serviceScript) : null;
       const withServiceScript = (manifest) => serviceScript ? { ...manifest, script: serviceScript } : manifest;
       const initialManifest = withServiceScript(storedInitialManifest);
       const desiredPath = manifestPath.replace(/\.service\.json$/u, ".service-desired.json");
@@ -43811,6 +43928,21 @@ ${result2.stderr}`)) {
       const quiesceSignal = options.quiesceSignal ? AbortSignal.any([options.quiesceSignal, migrationQuiesce.signal]) : migrationQuiesce.signal;
       let bootstrapRestartRequired = false;
       let bootstrapMigrationErrorReported = false;
+      const priorSelection = await readLauncherSelection(manifestPath);
+      const parentBootstrapVersion = options.bootstrapVersion ?? process.env.VTX_INFERENCE_HOST_BOOTSTRAP_VERSION;
+      if (serviceScript && options.controlLockPath && parentBootstrapVersion && parentBootstrapVersion !== agent_cli_release_default.package_version && process.env.VTX_INFERENCE_HOST_LAUNCHER_PROTOCOL !== "1" && !await readLauncherState(manifestPath) && priorSelection?.package_version === parentBootstrapVersion) {
+        const previousCore = launcherSibling(manifestPath, ".service-bootstrap.previous.js");
+        await writeAtomicInferencePrivateFile(
+          previousCore,
+          await readFile10(launcherSibling(manifestPath, ".service-bootstrap.js"), "utf8")
+        );
+        await writeLauncherState(manifestPath, {
+          schema_version: "vtx_inference_service_launcher_v1",
+          active: { package_version: parentBootstrapVersion, script: previousCore, selection: priorSelection },
+          previous: null,
+          pending: false
+        });
+      }
       const migrateSelectedBootstrap = async () => {
         if (!serviceScript || !options.controlLockPath || bootstrapRestartRequired || (options.bootstrapVersion ?? process.env.VTX_INFERENCE_HOST_BOOTSTRAP_VERSION) === agent_cli_release_default.package_version || quiesceSignal.aborted || signal.aborted) return;
         let controlLock;
@@ -43823,16 +43955,25 @@ ${result2.stderr}`)) {
         try {
           const current = await readManifestAcrossAtomicReplacement(manifestPath);
           if (!current || current.generation !== appliedManifest.generation || !await readDesiredAcrossAtomicReplacement(desiredPath) || signal.aborted) return;
-          let selected;
-          try {
-            selected = JSON.parse(await readFile9(manifestPath.replace(/\.service\.json$/u, ".service-release.json"), "utf8"));
-          } catch (error48) {
-            if (error48.code === "ENOENT") return;
-            throw error48;
+          const selected = await readLauncherSelection(manifestPath);
+          if (!selected || selected.package_version !== agent_cli_release_default.package_version || resolve11(selected.script) !== serviceScript) return;
+          if (process.env.VTX_INFERENCE_HOST_LAUNCHER_PROTOCOL !== "1") {
+            const launcherPath = launcherSibling(manifestPath, ".service-bootstrap.js");
+            const bytes3 = await readFile10(join14(dirname13(serviceScript), "vtx-service-launcher.js"), "utf8");
+            await (options.probeLauncher ?? probeInferenceHostLauncher)(current.executable, launcherPath, bytes3);
+            const existing = await readLauncherState(manifestPath);
+            if (!existing) throw new Error("Previous private service release is unavailable; refusing unsafe launcher migration.");
+            const previous = existing.active.package_version === selected.package_version ? existing.previous : existing.active;
+            if (!previous) throw new Error("Previous service launcher recovery target is unavailable.");
+            await writeLauncherState(manifestPath, {
+              schema_version: "vtx_inference_service_launcher_v1",
+              active: await targetForSelection(selected),
+              previous,
+              pending: false
+            });
+            if (!await readDesiredAcrossAtomicReplacement(desiredPath) || signal.aborted) return;
+            await writeAtomicInferencePrivateFile(launcherPath, bytes3);
           }
-          if (selected.schema_version !== "vtx_inference_service_release_v1" || selected.package_name !== "@vtxmacro/cli" || selected.package_version !== agent_cli_release_default.package_version || typeof selected.script !== "string" || resolve10(selected.script) !== serviceScript) return;
-          const bytes3 = await readFile9(join13(dirname12(serviceScript), "vtx-service-bootstrap.js"), "utf8");
-          await writeAtomicInferencePrivateFile(manifestPath.replace(/\.service\.json$/u, ".service-bootstrap.js"), bytes3);
           bootstrapRestartRequired = true;
           migrationQuiesce.abort();
         } finally {
@@ -44098,9 +44239,9 @@ __export(cli_exports, {
 });
 import { createHash as createHash12, randomUUID as randomUUID10 } from "node:crypto";
 import { spawn as spawn11 } from "node:child_process";
-import { lstat as lstat9, realpath as realpath8, rm as rm11 } from "node:fs/promises";
+import { lstat as lstat9, realpath as realpath8, rm as rm12 } from "node:fs/promises";
 import { hostname as osHostname } from "node:os";
-import { join as join14, resolve as resolve11 } from "node:path";
+import { join as join15, resolve as resolve12 } from "node:path";
 async function runInferenceHostCli(argv2, env = process.env, dependencies = {}) {
   const warnings = [];
   try {
@@ -44488,7 +44629,7 @@ Durable service:
           if (!raw?.trim()) throw new Error(`${argument} requires a value.`);
           if (argument === "--adapter") adapter = raw.trim();
           if (argument === "--provider") providerId = raw.trim();
-          if (argument === "--exo-root") exoRoot = resolve11(raw.trim());
+          if (argument === "--exo-root") exoRoot = resolve12(raw.trim());
           if (argument === "--model") modelId = raw.trim();
           if (argument === "--model-label") modelLabel = raw.trim();
           if (argument === "--effort") reasoningEffort = raw.trim();
@@ -44504,7 +44645,7 @@ Durable service:
               throw new Error("--lines must be an integer from 1 through 10000.");
             }
           }
-          if (argument === "--service-manifest") serviceManifestPath = resolve11(raw.trim());
+          if (argument === "--service-manifest") serviceManifestPath = resolve12(raw.trim());
           if (argument === "--instance") {
             instanceName = raw.trim();
             instanceExplicit = true;
@@ -44597,10 +44738,24 @@ Durable service:
           quiesce?.();
         }
       };
+      let parentLost = false;
+      const onParentLost = () => {
+        if (parentLost) return;
+        parentLost = true;
+        if (quiesce) quiesce();
+        else abort();
+      };
       input.on("data", onControlInput);
+      input.on("end", onParentLost);
+      input.on("close", onParentLost);
+      input.on("error", onParentLost);
       input.resume();
+      if (input.readableEnded || input.destroyed) onParentLost();
       return () => {
         input.off("data", onControlInput);
+        input.off("end", onParentLost);
+        input.off("close", onParentLost);
+        input.off("error", onParentLost);
         input.pause();
       };
     };
@@ -44702,11 +44857,11 @@ Durable service:
       return raw !== null;
     };
     inspectCodexAuthentication = async (config2) => {
-      const path = join14(config2.codexHomePath, "auth.json");
+      const path = join15(config2.codexHomePath, "auth.json");
       try {
         const before = await lstat9(path);
         const canonical = await realpath8(path);
-        const isPrivate = before.isFile() && !before.isSymbolicLink() && canonical === resolve11(path) && before.size <= 8 * 1024 * 1024 && (process.platform === "win32" || (before.mode & 63) === 0 && (typeof process.getuid !== "function" || before.uid === process.getuid()));
+        const isPrivate = before.isFile() && !before.isSymbolicLink() && canonical === resolve12(path) && before.size <= 8 * 1024 * 1024 && (process.platform === "win32" || (before.mode & 63) === 0 && (typeof process.getuid !== "function" || before.uid === process.getuid()));
         return { present: true, private: isPrivate };
       } catch (error48) {
         if (error48.code === "ENOENT") {
@@ -44723,7 +44878,7 @@ Durable service:
         runtimeReceiptPath(config2),
         "Inference host runtime receipt file"
       );
-      await rm11(codexGuardianReceiptRoot(config2), { recursive: true, force: true });
+      await rm12(codexGuardianReceiptRoot(config2), { recursive: true, force: true });
       await clearInferencePrivateFile(
         codexRecoveryPath(config2),
         "Codex attempt recovery file"
@@ -45031,20 +45186,20 @@ Waiting for approval...
           } catch {
           }
         }
-        let access5;
+        let access6;
         try {
-          access5 = await pending3.completion;
+          access6 = await pending3.completion;
         } catch (error48) {
           await pending3.cancel().catch(() => void 0);
           throw error48;
         }
         const state = {
           schema_version: 1,
-          issuer: access5.credential.issuer,
-          client_id: access5.credential.client_id,
-          host_id: access5.credential.host_id,
+          issuer: access6.credential.issuer,
+          client_id: access6.credential.client_id,
+          host_id: access6.credential.host_id,
           host_generation: 1,
-          key_generation: access5.credential.key_generation
+          key_generation: access6.credential.key_generation
         };
         try {
           await writeInferenceHostLocalState(config2.statePath, state);
@@ -45054,7 +45209,7 @@ Waiting for approval...
             const metadata = await (dependencies.discoverOAuth ?? discoverInferenceOAuth)(config2.apiUrl);
             await (dependencies.revokeCredential ?? revokeInferenceCredential)({
               metadata,
-              credential: access5.credential,
+              credential: access6.credential,
               store
             });
             remoteCleanupConfirmed = true;
@@ -45066,8 +45221,8 @@ Waiting for approval...
                 { cause: stateError }
               );
             }
-            await store.writeRecovery(access5.accountKey, access5.credential);
-            await store.remove(access5.accountKey).catch(() => void 0);
+            await store.writeRecovery(access6.accountKey, access6.credential);
+            await store.remove(access6.accountKey).catch(() => void 0);
           }
           if (!remoteCleanupConfirmed) {
             throw new Error(
@@ -45972,7 +46127,7 @@ Waiting for approval...
       const session = await agentSession(config2, dependencies, warnings);
       const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
       const sleep4 = dependencies.sleep ?? (async (milliseconds) => {
-        await new Promise((resolve12) => setTimeout(resolve12, milliseconds));
+        await new Promise((resolve13) => setTimeout(resolve13, milliseconds));
       });
       const stopAt = now().getTime() + parsed.waitSeconds * 1e3;
       let state = await readInferenceForegroundAgentControlState(config2.statePath) ?? foregroundAgentControlState(session.localState.host_id, now().toISOString());
@@ -46509,7 +46664,7 @@ Waiting for approval...
           }
           if (parsed.once && !commandLock) break;
           await (dependencies.sleep ?? (async (milliseconds) => {
-            await new Promise((resolve12) => setTimeout(resolve12, milliseconds));
+            await new Promise((resolve13) => setTimeout(resolve13, milliseconds));
           }))(retryDelayMs);
         }
         return {
@@ -46538,7 +46693,7 @@ Waiting for approval...
       const session = await agentSession(config2, dependencies, warnings);
       const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
       const sleep4 = dependencies.sleep ?? (async (milliseconds) => {
-        await new Promise((resolve12) => setTimeout(resolve12, milliseconds));
+        await new Promise((resolve13) => setTimeout(resolve13, milliseconds));
       });
       const stopAt = now().getTime() + parsed.waitSeconds * 1e3;
       while (true) {
@@ -46855,7 +47010,7 @@ Waiting for approval...
       ) || new Set(record5.cleanup_confirmed_attempt_ids).size !== record5.cleanup_confirmed_attempt_ids.length || [...record5.cleanup_confirmed_attempt_ids].sort().join("\0") !== record5.cleanup_confirmed_attempt_ids.join("\0") || typeof record5.started_at !== "string" || !Number.isFinite(Date.parse(record5.started_at)) || new Date(record5.started_at).toISOString() !== record5.started_at) {
         throw new Error("Inference-host service recovery transaction is invalid.");
       }
-      if (resolve11(record5.recovery_backup_path) !== resolve11(recoveryBackupPath(config2, record5.transaction_id))) {
+      if (resolve12(record5.recovery_backup_path) !== resolve12(recoveryBackupPath(config2, record5.transaction_id))) {
         throw new Error("Inference-host service recovery backup path is invalid.");
       }
       return record5;
@@ -47106,7 +47261,7 @@ Waiting for approval...
               serviceRecoveryTransactionPath(config2),
               "Inference-host service recovery transaction"
             );
-            await rm11(backupPath, { force: true });
+            await rm12(backupPath, { force: true });
           }
         }
       } finally {
@@ -47136,7 +47291,7 @@ Waiting for approval...
             {
               signal: cancellation.signal,
               quiesceSignal: cancellation.quiesceSignal,
-              serviceScript: resolve11(process.argv[1] ?? ""),
+              serviceScript: resolve12(process.argv[1] ?? ""),
               controlLockPath: `${supervisorConfig.supervisorProcessLockPath}.service-control`
             }
           );
@@ -47362,7 +47517,7 @@ Waiting for approval...
         ...selectedEnv,
         ...retainedEnvironment
       });
-      if (resolve11(installedConfig.statePath) !== resolve11(baseConfig.statePath)) {
+      if (resolve12(installedConfig.statePath) !== resolve12(baseConfig.statePath)) {
         throw new Error(
           "Installed inference-host service manifest does not match the requested local state path."
         );
@@ -47381,11 +47536,11 @@ Waiting for approval...
 });
 
 // lib/agent-core/config.ts
-import { mkdir as mkdir5, readFile as readFile10, rm as rm12, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname13, join as join15 } from "node:path";
+import { mkdir as mkdir5, readFile as readFile11, rm as rm13, writeFile as writeFile5 } from "node:fs/promises";
+import { dirname as dirname14, join as join16 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 function defaultBaseDir() {
-  return join15(homedir3(), ".vtx");
+  return join16(homedir3(), ".vtx");
 }
 function resolveAgentCliConfig(env = process.env) {
   const baseDir = String(env.VTX_HOME || "").trim() || defaultBaseDir();
@@ -47393,8 +47548,8 @@ function resolveAgentCliConfig(env = process.env) {
   const parsedProfile = rawProfile ? Number(rawProfile) : NaN;
   return {
     apiUrl: String(env.VTX_API_URL || "http://localhost:8000").replace(/\/+$/, ""),
-    tokenPath: String(env.VTX_TOKEN_PATH || "").trim() || join15(baseDir, "token.json"),
-    statePath: String(env.VTX_RUNTIME_STATE_PATH || "").trim() || join15(baseDir, "runtime-state.json"),
+    tokenPath: String(env.VTX_TOKEN_PATH || "").trim() || join16(baseDir, "token.json"),
+    statePath: String(env.VTX_RUNTIME_STATE_PATH || "").trim() || join16(baseDir, "runtime-state.json"),
     runtimeDeviceId: String(env.VTX_RUNTIME_DEVICE_ID || "").trim() || null,
     activeProfileId: Number.isFinite(parsedProfile) && parsedProfile > 0 ? parsedProfile : null,
     outputJson: String(env.VTX_OUTPUT || "").trim().toLowerCase() === "json"
@@ -47402,7 +47557,7 @@ function resolveAgentCliConfig(env = process.env) {
 }
 async function readStoredAgentAuth(path) {
   try {
-    const raw = await readFile10(path, "utf8");
+    const raw = await readFile11(path, "utf8");
     if (!raw.trim()) {
       throw new Error(`VTX token file is empty at ${path}. Run "vtx auth login" or remove the file and retry.`);
     }
@@ -47420,16 +47575,16 @@ async function readStoredAgentAuth(path) {
   }
 }
 async function writeStoredAgentAuth(path, auth) {
-  await mkdir5(dirname13(path), { recursive: true });
+  await mkdir5(dirname14(path), { recursive: true });
   await writeFile5(path, `${JSON.stringify(auth, null, 2)}
 `, { encoding: "utf8", mode: 384 });
 }
 async function clearStoredAgentAuth(path) {
-  await rm12(path, { force: true });
+  await rm13(path, { force: true });
 }
 async function readRuntimeState(path) {
   try {
-    const raw = await readFile10(path, "utf8");
+    const raw = await readFile11(path, "utf8");
     const parsed = JSON.parse(raw);
     const profileId = Number(parsed.profileId);
     const runtimeSessionId = String(parsed.runtimeSessionId || "").trim();
@@ -47455,12 +47610,12 @@ async function readRuntimeState(path) {
   }
 }
 async function writeRuntimeState(path, state) {
-  await mkdir5(dirname13(path), { recursive: true });
+  await mkdir5(dirname14(path), { recursive: true });
   await writeFile5(path, `${JSON.stringify(state, null, 2)}
 `, { encoding: "utf8", mode: 384 });
 }
 async function clearRuntimeState(path) {
-  await rm12(path, { force: true });
+  await rm13(path, { force: true });
 }
 var init_config2 = __esm({
   "lib/agent-core/config.ts"() {
@@ -47902,7 +48057,7 @@ import {
   writeFileSync
 } from "node:fs";
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { dirname as dirname14 } from "node:path";
+import { dirname as dirname15 } from "node:path";
 var parseStoredValues, FileBackedProtectionStorage, clientRuntimeProtectionStatePath;
 var init_protection_storage = __esm({
   "lib/agent-core/protection-storage.ts"() {
@@ -47958,7 +48113,7 @@ var init_protection_storage = __esm({
         }
       }
       writeValues(values) {
-        mkdirSync(dirname14(this.path), { recursive: true, mode: 448 });
+        mkdirSync(dirname15(this.path), { recursive: true, mode: 448 });
         const serialized = `${JSON.stringify(values)}
 `;
         const temporaryPath = `${this.path}.${process.pid}.${randomUUID12()}.tmp`;
@@ -48411,7 +48566,7 @@ var init_hyperliquid_public_read = __esm({
     checkAbort = (signal) => {
       if (signal?.aborted) throw abortError2(signal);
     };
-    wait = (ms, signal) => new Promise((resolve12, reject) => {
+    wait = (ms, signal) => new Promise((resolve13, reject) => {
       checkAbort(signal);
       const aborted2 = () => {
         clearTimeout(timer);
@@ -48419,7 +48574,7 @@ var init_hyperliquid_public_read = __esm({
       };
       const timer = setTimeout(() => {
         signal?.removeEventListener("abort", aborted2);
-        resolve12();
+        resolve13();
       }, Math.min(ms, 2147483647));
       signal?.addEventListener("abort", aborted2, { once: true });
     });
@@ -48527,7 +48682,7 @@ var init_hyperliquid_public_read = __esm({
           if (existing && Date.now() - existing.fetchedAtMs >= 0 && Date.now() - existing.fetchedAtMs < ttlSeconds * 500) return existing;
           const running = pending2.get(key);
           if (!running) break;
-          await new Promise((resolve12, reject) => {
+          await new Promise((resolve13, reject) => {
             const aborted2 = () => {
               options.signal?.removeEventListener("abort", aborted2);
               reject(abortError2(options.signal));
@@ -48535,15 +48690,15 @@ var init_hyperliquid_public_read = __esm({
             options.signal?.addEventListener("abort", aborted2, { once: true });
             running.then(() => {
               options.signal?.removeEventListener("abort", aborted2);
-              resolve12();
+              resolve13();
             });
           });
           checkAbort(options.signal);
         }
       }
       let settled;
-      if (ttlSeconds) pending2.set(key, new Promise((resolve12) => {
-        settled = resolve12;
+      if (ttlSeconds) pending2.set(key, new Promise((resolve13) => {
+        settled = resolve13;
       }));
       try {
         const reservedKey = JSON.stringify(body);
@@ -50135,12 +50290,12 @@ var init_hyperliquid_account_state_adapter = __esm({
       if (signal.aborted) {
         throw createAbortError(abortMessage);
       }
-      return new Promise((resolve12, reject) => {
+      return new Promise((resolve13, reject) => {
         const onAbort = () => {
           reject(createAbortError(abortMessage));
         };
         signal.addEventListener("abort", onAbort, { once: true });
-        promise2.then(resolve12, reject).finally(() => {
+        promise2.then(resolve13, reject).finally(() => {
           signal.removeEventListener("abort", onAbort);
         });
       });
@@ -51473,7 +51628,7 @@ var init_shared = __esm({
       }
     };
     API_URL = getApiUrl();
-    sleep2 = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
+    sleep2 = (ms) => new Promise((resolve13) => setTimeout(resolve13, ms));
     AUTH_BOOTSTRAP_GET_MAX_ATTEMPTS = runtime_policy_generated_default.ui.auth_bootstrap_retry.max_attempts;
     AUTH_BOOTSTRAP_RETRY_JITTER_MS = runtime_policy_generated_default.ui.auth_bootstrap_retry.jitter_milliseconds;
     parseRetryAfterMs2 = (value) => {
@@ -52632,7 +52787,7 @@ var init_api2 = __esm({
         if (signal.aborted) {
           throw signal.reason ?? new DOMException("Runtime lease recovery aborted.", "AbortError");
         }
-        return await new Promise((resolve12, reject) => {
+        return await new Promise((resolve13, reject) => {
           let settled = false;
           const finish = (callback) => {
             if (settled) {
@@ -52647,7 +52802,7 @@ var init_api2 = __esm({
           ));
           signal.addEventListener("abort", onAbort, { once: true });
           recovery.promise.then(
-            (token) => finish(() => resolve12(token)),
+            (token) => finish(() => resolve13(token)),
             (error48) => finish(() => reject(error48))
           );
         });
@@ -52859,8 +53014,8 @@ var init_exchange_mutation_fence = __esm({
         return operation();
       }
       let markSettled;
-      const settlement = new Promise((resolve12) => {
-        markSettled = resolve12;
+      const settlement = new Promise((resolve13) => {
+        markSettled = resolve13;
       });
       const activeSettlements = activeSettlementsByScope.get(normalizedScope) ?? /* @__PURE__ */ new Set();
       activeSettlements.add(settlement);
@@ -53864,7 +54019,7 @@ function createGetUrl(options) {
       request.write(Buffer.from(body));
     }
     request.end();
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       if (signal) {
         signal.addListener(() => {
           if (abort) {
@@ -53910,7 +54065,7 @@ function createGetUrl(options) {
             if (headers2["content-encoding"] === "gzip" && body2) {
               body2 = getBytes(gunzipSync2(body2));
             }
-            resolve12({ statusCode, statusMessage, headers: headers2, body: body2 });
+            resolve13({ statusCode, statusMessage, headers: headers2, body: body2 });
           } catch (error48) {
             reject(makeError("bad response data", "SERVER_ERROR", {
               request: req,
@@ -53986,7 +54141,7 @@ function unpercent(value) {
   }));
 }
 function wait2(delay2) {
-  return new Promise((resolve12) => setTimeout(resolve12, delay2));
+  return new Promise((resolve13) => setTimeout(resolve13, delay2));
 }
 var MAX_ATTEMPTS, SLOT_INTERVAL, defaultGetUrlFunc, reData, reIpfs, locked, Gateways, fetchSignals, FetchCancelSignal, FetchRequest, FetchResponse;
 var init_fetch = __esm({
@@ -67778,7 +67933,7 @@ var init_provider = __esm({
             return null;
           }
         }
-        const waiter = new Promise((resolve12, reject) => {
+        const waiter = new Promise((resolve13, reject) => {
           const cancellers = [];
           const cancel = () => {
             cancellers.forEach((c) => c());
@@ -67799,7 +67954,7 @@ var init_provider = __esm({
             if (await receipt2.confirmations() >= confirms) {
               cancel();
               try {
-                resolve12(checkReceipt(receipt2));
+                resolve13(checkReceipt(receipt2));
               } catch (error48) {
                 reject(error48);
               }
@@ -68724,12 +68879,12 @@ var init_contract = __esm({
         }
         const provider = getProvider(this.runner);
         assert2(provider != null, "contract runner does not support .provider", "UNSUPPORTED_OPERATION", { operation: "waitForDeployment" });
-        return new Promise((resolve12, reject) => {
+        return new Promise((resolve13, reject) => {
           const checkCode = async () => {
             try {
               const code2 = await this.getDeployedCode();
               if (code2 != null) {
-                return resolve12(this);
+                return resolve13(this);
               }
               provider.once("block", checkCode);
             } catch (error48) {
@@ -71081,7 +71236,7 @@ var init_abstract_provider = __esm({
           return t.toLowerCase();
         });
         const blockHash = "blockHash" in filter ? filter.blockHash : void 0;
-        const resolve12 = (_address, fromBlock2, toBlock2) => {
+        const resolve13 = (_address, fromBlock2, toBlock2) => {
           let address2 = void 0;
           switch (_address.length) {
             case 0:
@@ -71136,10 +71291,10 @@ var init_abstract_provider = __esm({
         }
         if (address.filter((a) => typeof a !== "string").length || fromBlock != null && typeof fromBlock !== "string" || toBlock != null && typeof toBlock !== "string") {
           return Promise.all([Promise.all(address), fromBlock, toBlock]).then((result2) => {
-            return resolve12(result2[0], result2[1], result2[2]);
+            return resolve13(result2[0], result2[1], result2[2]);
           });
         }
-        return resolve12(address, fromBlock, toBlock);
+        return resolve13(address, fromBlock, toBlock);
       }
       /**
        *  Returns or resolves to a transaction for %%request%%, resolving
@@ -71513,14 +71668,14 @@ var init_abstract_provider = __esm({
         if (confirms === 0) {
           return this.getTransactionReceipt(hash4);
         }
-        return new Promise(async (resolve12, reject) => {
+        return new Promise(async (resolve13, reject) => {
           let timer = null;
           const listener = (async (blockNumber) => {
             try {
               const receipt = await this.getTransactionReceipt(hash4);
               if (receipt != null) {
                 if (blockNumber - receipt.blockNumber + 1 >= confirms) {
-                  resolve12(receipt);
+                  resolve13(receipt);
                   if (timer) {
                     clearTimeout(timer);
                     timer = null;
@@ -72291,8 +72446,8 @@ function deepCopy(value) {
   throw new Error(`should not happen: ${value} (${typeof value})`);
 }
 function stall(duration3) {
-  return new Promise((resolve12) => {
-    setTimeout(resolve12, duration3);
+  return new Promise((resolve13) => {
+    setTimeout(resolve13, duration3);
   });
 }
 function getLowerCase(value) {
@@ -72432,14 +72587,14 @@ var init_provider_jsonrpc = __esm({
       async sendTransaction(tx) {
         const blockNumber = await this.provider.getBlockNumber();
         const hash4 = await this.sendUncheckedTransaction(tx);
-        return await new Promise((resolve12, reject) => {
+        return await new Promise((resolve13, reject) => {
           const timeouts = [1e3, 100];
           let invalids = 0;
           const checkTx = async () => {
             try {
               const tx2 = await this.provider.getTransaction(hash4);
               if (tx2 != null) {
-                resolve12(tx2.replaceableTransaction(blockNumber));
+                resolve13(tx2.replaceableTransaction(blockNumber));
                 return;
               }
             } catch (error48) {
@@ -72556,7 +72711,7 @@ var init_provider_jsonrpc = __esm({
               try {
                 const result2 = await this._send(payload);
                 this.emit("debug", { action: "receiveRpcResult", result: result2 });
-                for (const { resolve: resolve12, reject, payload: payload2 } of batch) {
+                for (const { resolve: resolve13, reject, payload: payload2 } of batch) {
                   if (this.destroyed) {
                     reject(makeError("provider destroyed; cancelled request", "UNSUPPORTED_OPERATION", { operation: payload2.method }));
                     continue;
@@ -72575,7 +72730,7 @@ var init_provider_jsonrpc = __esm({
                     reject(this.getRpcError(payload2, resp));
                     continue;
                   }
-                  resolve12(resp.result);
+                  resolve13(resp.result);
                 }
               } catch (error48) {
                 this.emit("debug", { action: "receiveRpcError", error: error48 });
@@ -72596,11 +72751,11 @@ var init_provider_jsonrpc = __esm({
         this.#network = null;
         this.#pendingDetectNetwork = null;
         {
-          let resolve12 = null;
+          let resolve13 = null;
           const promise2 = new Promise((_resolve) => {
-            resolve12 = _resolve;
+            resolve13 = _resolve;
           });
-          this.#notReady = { promise: promise2, resolve: resolve12 };
+          this.#notReady = { promise: promise2, resolve: resolve13 };
         }
         const staticNetwork = this._getOption("staticNetwork");
         if (typeof staticNetwork === "boolean") {
@@ -73013,9 +73168,9 @@ var init_provider_jsonrpc = __esm({
           return Promise.reject(makeError("provider destroyed; cancelled request", "UNSUPPORTED_OPERATION", { operation: method }));
         }
         const id2 = this.#nextId++;
-        const promise2 = new Promise((resolve12, reject) => {
+        const promise2 = new Promise((resolve13, reject) => {
           this.#payloads.push({
-            resolve: resolve12,
+            resolve: resolve13,
             reject,
             payload: { method, params, id: id2, jsonrpc: "2.0" }
           });
@@ -77973,8 +78128,8 @@ var init_provider_socket = __esm({
       }
       async _send(payload) {
         assertArgument(!Array.isArray(payload), "WebSocket does not support batch send", "payload", payload);
-        const promise2 = new Promise((resolve12, reject) => {
-          this.#callbacks.set(payload.id, { payload, resolve: resolve12, reject });
+        const promise2 = new Promise((resolve13, reject) => {
+          this.#callbacks.set(payload.id, { payload, resolve: resolve13, reject });
         });
         await this._waitUntilReady();
         await this._write(JSON.stringify(payload));
@@ -78380,8 +78535,8 @@ function shuffle(array2) {
   }
 }
 function stall2(duration3) {
-  return new Promise((resolve12) => {
-    setTimeout(resolve12, duration3);
+  return new Promise((resolve13) => {
+    setTimeout(resolve13, duration3);
   });
 }
 function getTime3() {
@@ -79263,7 +79418,7 @@ var init_provider_browser = __esm({
         if (timeout === 0) {
           return null;
         }
-        return await new Promise((resolve12, reject) => {
+        return await new Promise((resolve13, reject) => {
           let found = [];
           const addProvider = (event) => {
             found.push(event.detail);
@@ -79277,9 +79432,9 @@ var init_provider_browser = __esm({
               if (options && options.filter) {
                 const filtered = options.filter(found.map((i) => Object.assign({}, i.info)));
                 if (filtered == null) {
-                  resolve12(null);
+                  resolve13(null);
                 } else if (filtered instanceof _BrowserProvider) {
-                  resolve12(filtered);
+                  resolve13(filtered);
                 } else {
                   let match = null;
                   if (filtered.uuid) {
@@ -79288,7 +79443,7 @@ var init_provider_browser = __esm({
                   }
                   if (match) {
                     const { provider, info } = match;
-                    resolve12(new _BrowserProvider(provider, void 0, {
+                    resolve13(new _BrowserProvider(provider, void 0, {
                       providerInfo: info
                     }));
                   } else {
@@ -79299,12 +79454,12 @@ var init_provider_browser = __esm({
                 }
               } else {
                 const { provider, info } = found[0];
-                resolve12(new _BrowserProvider(provider, void 0, {
+                resolve13(new _BrowserProvider(provider, void 0, {
                   providerInfo: info
                 }));
               }
             } else {
-              resolve12(null);
+              resolve13(null);
             }
             context.removeEventListener("eip6963:announceProvider", addProvider);
           };
@@ -80718,9 +80873,9 @@ function decryptKeystoreJsonSync(json2, _password) {
   return getAccount(data4, key);
 }
 function stall3(duration3) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     setTimeout(() => {
-      resolve12();
+      resolve13();
     }, duration3);
   });
 }
@@ -81349,9 +81504,9 @@ var init_json_crowdsale = __esm({
 
 // node_modules/ethers/lib.esm/wallet/wallet.js
 function stall4(duration3) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     setTimeout(() => {
-      resolve12();
+      resolve13();
     }, duration3);
   });
 }
@@ -85297,14 +85452,14 @@ var init_hyperliquid_client = __esm({
                 if (input.signal?.aborted) {
                   throw input.signal.reason instanceof Error ? input.signal.reason : settlementError;
                 }
-                await new Promise((resolve12) => {
+                await new Promise((resolve13) => {
                   let settled = false;
                   const finish = () => {
                     if (settled) return;
                     settled = true;
                     globalThis.clearTimeout(timeoutId);
                     input.signal?.removeEventListener("abort", finish);
-                    resolve12();
+                    resolve13();
                   };
                   const timeoutId = globalThis.setTimeout(finish, 1e3);
                   input.signal?.addEventListener("abort", finish, { once: true });
@@ -85335,12 +85490,12 @@ var init_hyperliquid_client = __esm({
                       captureController.signal,
                       ...durableMutationAuthorityArgs(durableMutation)
                     ).then(() => void 0).catch(() => void 0);
-                    const captureDeadline = new Promise((resolve12) => {
+                    const captureDeadline = new Promise((resolve13) => {
                       captureTimeout = globalThis.setTimeout(() => {
                         captureController.abort(
                           new DOMException("Execution attempt capture timed out.", "TimeoutError")
                         );
-                        resolve12();
+                        resolve13();
                       }, remainingBudgetMs);
                     });
                     await Promise.race([captureRequest, captureDeadline]);
@@ -85844,7 +85999,7 @@ var init_vault = __esm({
       }
       return output3.buffer.slice(output3.byteOffset, output3.byteOffset + output3.byteLength);
     };
-    openVaultDb = async () => new Promise((resolve12, reject) => {
+    openVaultDb = async () => new Promise((resolve13, reject) => {
       const request = indexedDB.open(VAULT_DB_NAME, VAULT_DB_VERSION);
       request.onerror = () => reject(request.error ?? new Error("Failed to open client vault database."));
       request.onupgradeneeded = () => {
@@ -85853,7 +86008,7 @@ var init_vault = __esm({
           database.createObjectStore(VAULT_KEY_STORE);
         }
       };
-      request.onsuccess = () => resolve12(request.result);
+      request.onsuccess = () => resolve13(request.result);
     });
     withVaultStore = async (mode, fn) => {
       const database = await openVaultDb();
@@ -85861,8 +86016,8 @@ var init_vault = __esm({
         const transaction = database.transaction(VAULT_KEY_STORE, mode);
         const store = transaction.objectStore(VAULT_KEY_STORE);
         const result2 = await fn(store);
-        await new Promise((resolve12, reject) => {
-          transaction.oncomplete = () => resolve12();
+        await new Promise((resolve13, reject) => {
+          transaction.oncomplete = () => resolve13();
           transaction.onerror = () => reject(transaction.error ?? new Error("Client vault transaction failed."));
           transaction.onabort = () => reject(transaction.error ?? new Error("Client vault transaction aborted."));
         });
@@ -85877,9 +86032,9 @@ var init_vault = __esm({
       }
       return withVaultStore("readonly", async (store) => {
         const request = store.get(profileId);
-        return await new Promise((resolve12, reject) => {
+        return await new Promise((resolve13, reject) => {
           request.onerror = () => reject(request.error ?? new Error("Failed to read client vault key."));
-          request.onsuccess = () => resolve12(request.result ?? null);
+          request.onsuccess = () => resolve13(request.result ?? null);
         });
       });
     };
@@ -85901,9 +86056,9 @@ var init_vault = __esm({
       );
       await withVaultStore("readwrite", async (store) => {
         const request = store.put(createdKey, profileId);
-        await new Promise((resolve12, reject) => {
+        await new Promise((resolve13, reject) => {
           request.onerror = () => reject(request.error ?? new Error("Failed to persist client vault key."));
-          request.onsuccess = () => resolve12();
+          request.onsuccess = () => resolve13();
         });
       });
       return createdKey;
@@ -85914,9 +86069,9 @@ var init_vault = __esm({
       }
       await withVaultStore("readwrite", async (store) => {
         const request = store.delete(profileId);
-        await new Promise((resolve12, reject) => {
+        await new Promise((resolve13, reject) => {
           request.onerror = () => reject(request.error ?? new Error("Failed to remove client vault key."));
-          request.onsuccess = () => resolve12();
+          request.onsuccess = () => resolve13();
         });
       });
     };
@@ -90677,10 +90832,10 @@ var init_runtime_execution = __esm({
       }
     };
     sleep3 = async (ms, signal) => {
-      await new Promise((resolve12, reject) => {
+      await new Promise((resolve13, reject) => {
         const timer = setTimeout(() => {
           cleanup();
-          resolve12(void 0);
+          resolve13(void 0);
         }, ms);
         const cleanup = () => {
           clearTimeout(timer);
@@ -94080,7 +94235,7 @@ Global options:
       "alibaba_cloud_model_studio_api_key",
       "lightning_api_key"
     ]);
-    delay = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
+    delay = (ms) => new Promise((resolve13) => setTimeout(resolve13, ms));
   }
 });