@evident-ai/cli 0.2.0 → 0.2.1-dev.d55ec9b

package/dist/index.js

@@ -1,12 +1,4 @@
 #!/usr/bin/env node
-import {
-  clearCredentials,
-  getApiUrlConfig,
-  getCredentials,
-  getTunnelUrlConfig,
-  setCredentials,
-  setEnvironment
-} from "./chunk-MWOWXSOP.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -16,6 +8,90 @@ import open from "open";
 import ora from "ora";
 import chalk2 from "chalk";
 
+// src/lib/config.ts
+import Conf from "conf";
+import { homedir } from "os";
+import { join } from "path";
+var environmentPresets = {
+  local: {
+    apiUrl: "http://localhost:3001/v1",
+    tunnelUrl: "ws://localhost:8787"
+  },
+  dev: {
+    apiUrl: "https://api.dev.evident.run/v1",
+    tunnelUrl: "wss://tunnel.dev.evident.run"
+  },
+  production: {
+    // Production URLs also have aliases: api.evident.run, tunnel.evident.run
+    apiUrl: "https://api.production.evident.run/v1",
+    tunnelUrl: "wss://tunnel.production.evident.run"
+  }
+};
+var defaults = environmentPresets.production;
+var currentEnvironment = "production";
+function setEnvironment(env) {
+  currentEnvironment = env;
+}
+function getEnvironment() {
+  const envVar = process.env.EVIDENT_ENV;
+  if (envVar && environmentPresets[envVar]) {
+    return envVar;
+  }
+  return currentEnvironment;
+}
+function getEnvConfig() {
+  return environmentPresets[getEnvironment()];
+}
+function getApiUrl() {
+  return process.env.EVIDENT_API_URL ?? getEnvConfig().apiUrl;
+}
+function getTunnelUrl() {
+  return process.env.EVIDENT_TUNNEL_URL ?? getEnvConfig().tunnelUrl;
+}
+var config = new Conf({
+  projectName: "evident",
+  projectSuffix: "",
+  defaults
+});
+var credentials = new Conf({
+  projectName: "evident",
+  projectSuffix: "",
+  configName: "credentials",
+  defaults: {}
+});
+function getApiUrlConfig() {
+  return getApiUrl();
+}
+function getTunnelUrlConfig() {
+  return getTunnelUrl();
+}
+function getCredentials() {
+  return {
+    token: credentials.get("token"),
+    user: credentials.get("user"),
+    expiresAt: credentials.get("expiresAt")
+  };
+}
+function setCredentials(creds) {
+  if (creds.token) credentials.set("token", creds.token);
+  if (creds.user) credentials.set("user", creds.user);
+  if (creds.expiresAt) credentials.set("expiresAt", creds.expiresAt);
+}
+function clearCredentials() {
+  credentials.clear();
+}
+function getCliName() {
+  const argv1 = process.argv[1] || "";
+  const isNpx = process.env.npm_execpath?.includes("npx") || process.env.npm_command === "exec" || argv1.includes("_npx") || argv1.includes(".npm/_cacache");
+  if (isNpx) {
+    return "npx @evident-ai/cli@latest";
+  }
+  if (argv1.includes("tsx") || argv1.includes("ts-node")) {
+    return "pnpm --filter @evident-ai/cli dev:run";
+  }
+  return "evident";
+}
+
 // src/lib/api.ts
 var ApiClient = class {
   baseUrl;
@@ -123,15 +199,15 @@ async function getKeytar() {
     return null;
   }
 }
-async function storeToken(credentials) {
+async function storeToken(credentials2) {
   const keytar = await getKeytar();
   if (keytar) {
-    await keytar.setPassword(SERVICE_NAME, ACCOUNT_NAME, JSON.stringify(credentials));
+    await keytar.setPassword(SERVICE_NAME, ACCOUNT_NAME, JSON.stringify(credentials2));
   } else {
     setCredentials({
-      token: credentials.token,
-      user: credentials.user,
-      expiresAt: credentials.expiresAt
+      token: credentials2.token,
+      user: credentials2.user,
+      expiresAt: credentials2.expiresAt
     });
   }
 }
@@ -332,8 +408,8 @@ async function login(options) {
 
 // src/commands/logout.ts
 async function logout() {
-  const credentials = await getToken();
-  if (!credentials) {
+  const credentials2 = await getToken();
+  if (!credentials2) {
     printWarning("You are not logged in.");
     return;
   }
@@ -344,16 +420,16 @@ async function logout() {
 // src/commands/whoami.ts
 import chalk3 from "chalk";
 async function whoami() {
-  const credentials = await getToken();
-  if (!credentials) {
+  const credentials2 = await getToken();
+  if (!credentials2) {
     printError("Not logged in. Run the `login` command to authenticate.");
     process.exit(1);
   }
   blank();
-  console.log(keyValue("User", chalk3.bold(credentials.user.email)));
-  console.log(keyValue("User ID", credentials.user.id));
-  if (credentials.expiresAt) {
-    const expiresAt = new Date(credentials.expiresAt);
+  console.log(keyValue("User", chalk3.bold(credentials2.user.email)));
+  console.log(keyValue("User ID", credentials2.user.id));
+  if (credentials2.expiresAt) {
+    const expiresAt = new Date(credentials2.expiresAt);
     const now = /* @__PURE__ */ new Date();
     if (expiresAt < now) {
       console.log(keyValue("Status", chalk3.red("Token expired")));
@@ -367,12 +443,26 @@ async function whoami() {
   blank();
 }
 
-// src/commands/tunnel.ts
-import WebSocket from "ws";
-import chalk4 from "chalk";
+// src/commands/run.ts
+import chalk5 from "chalk";
 import ora2 from "ora";
-import { execSync, spawn } from "child_process";
-import { select } from "@inquirer/prompts";
+import { select as select2 } from "@inquirer/prompts";
+
+// ../../packages/types/src/telemetry/index.ts
+var TelemetryEventTypes = {
+  // Agent activity events (shown in web UI activity log)
+  AGENT_CONNECTED: "agent.connected",
+  AGENT_DISCONNECTED: "agent.disconnected",
+  AGENT_MESSAGE_PROCESSING: "agent.message_processing",
+  AGENT_MESSAGE_DONE: "agent.message_done",
+  AGENT_MESSAGE_FAILED: "agent.message_failed"
+};
+
+// ../../packages/types/src/tunnel/index.ts
+var TUNNEL_CHUNK_THRESHOLD = 512 * 1024;
+var TUNNEL_CHUNK_SIZE = 768 * 1024;
+var TUNNEL_MAX_RESPONSE_SIZE = 50 * 1024 * 1024;
+var TUNNEL_CHUNK_TIMEOUT_MS = 30 * 1e3;
 
 // src/lib/telemetry.ts
 var CLI_VERSION = process.env.npm_package_version || "unknown";
@@ -388,7 +478,7 @@ function logEvent(eventType, options = {}) {
     severity: options.severity || "info",
     message: options.message,
     metadata: options.metadata,
-    sandbox_id: options.sandboxId,
+    agent_id: options.agentId,
     timestamp: (/* @__PURE__ */ new Date()).toISOString()
   };
   eventBuffer.push(event);
@@ -402,10 +492,10 @@ function logEvent(eventType, options = {}) {
   }
 }
 var telemetry = {
-  debug: (eventType, message, metadata, sandboxId) => logEvent(eventType, { severity: "debug", message, metadata, sandboxId }),
-  info: (eventType, message, metadata, sandboxId) => logEvent(eventType, { severity: "info", message, metadata, sandboxId }),
-  warn: (eventType, message, metadata, sandboxId) => logEvent(eventType, { severity: "warning", message, metadata, sandboxId }),
-  error: (eventType, message, metadata, sandboxId) => logEvent(eventType, { severity: "error", message, metadata, sandboxId })
+  debug: (eventType, message, metadata, agentId) => logEvent(eventType, { severity: "debug", message, metadata, agentId }),
+  info: (eventType, message, metadata, agentId) => logEvent(eventType, { severity: "info", message, metadata, agentId }),
+  warn: (eventType, message, metadata, agentId) => logEvent(eventType, { severity: "warning", message, metadata, agentId }),
+  error: (eventType, message, metadata, agentId) => logEvent(eventType, { severity: "error", message, metadata, agentId })
 };
 async function flushEvents() {
   if (eventBuffer.length === 0) return;
@@ -416,25 +506,26 @@ async function flushEvents() {
     flushTimeout = null;
   }
   try {
-    const credentials = await getToken();
-    if (!credentials) {
+    const credentials2 = await getToken();
+    if (!credentials2) {
       return;
     }
     const apiUrl = getApiUrlConfig();
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), FLUSH_TIMEOUT_MS);
     try {
+      const request = {
+        events,
+        client_type: "cli",
+        client_version: CLI_VERSION
+      };
       const response = await fetch(`${apiUrl}/telemetry/events`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${credentials.token}`
+          Authorization: `Bearer ${credentials2.token}`
         },
-        body: JSON.stringify({
-          events,
-          client_type: "cli",
-          client_version: CLI_VERSION
-        }),
+        body: JSON.stringify(request),
         signal: controller.signal
       });
       if (!response.ok) {
@@ -457,6 +548,59 @@ async function shutdownTelemetry() {
   }
   await flushEvents();
 }
+function emitEvent(event) {
+  logEvent(event.event_type, {
+    severity: event.severity,
+    message: event.message,
+    metadata: event.metadata,
+    agentId: event.agent_id
+  });
+}
+function emitAgentConnected(agentId, metadata) {
+  emitEvent({
+    event_type: TelemetryEventTypes.AGENT_CONNECTED,
+    severity: "info",
+    message: "Agent CLI connected",
+    metadata,
+    agent_id: agentId
+  });
+}
+function emitAgentDisconnected(agentId, metadata) {
+  emitEvent({
+    event_type: TelemetryEventTypes.AGENT_DISCONNECTED,
+    severity: "info",
+    message: `Agent CLI disconnected (code: ${metadata.code})`,
+    metadata,
+    agent_id: agentId
+  });
+}
+function emitAgentMessageProcessing(agentId, metadata) {
+  emitEvent({
+    event_type: TelemetryEventTypes.AGENT_MESSAGE_PROCESSING,
+    severity: "info",
+    message: `Processing message ${metadata.message_id.slice(0, 8)}...`,
+    metadata,
+    agent_id: agentId
+  });
+}
+function emitAgentMessageDone(agentId, metadata) {
+  emitEvent({
+    event_type: TelemetryEventTypes.AGENT_MESSAGE_DONE,
+    severity: "info",
+    message: `Message ${metadata.message_id.slice(0, 8)} processed`,
+    metadata,
+    agent_id: agentId
+  });
+}
+function emitAgentMessageFailed(agentId, metadata) {
+  emitEvent({
+    event_type: TelemetryEventTypes.AGENT_MESSAGE_FAILED,
+    severity: "error",
+    message: metadata.error ? `Message ${metadata.message_id.slice(0, 8)} failed: ${metadata.error}` : `Message ${metadata.message_id.slice(0, 8)} ${metadata.reason || "failed"}`,
+    metadata,
+    agent_id: agentId
+  });
+}
 var EventTypes = {
   // Tunnel lifecycle
   TUNNEL_STARTING: "tunnel.starting",
@@ -484,12 +628,71 @@ var EventTypes = {
   CLI_ERROR: "cli.error"
 };
 
-// src/commands/tunnel.ts
-var MAX_RECONNECT_DELAY = 3e4;
-var BASE_RECONNECT_DELAY = 500;
-var MAX_ACTIVITY_LOG_ENTRIES = 10;
-var CHUNK_THRESHOLD = 512 * 1024;
-var CHUNK_SIZE = 768 * 1024;
+// src/lib/auth.ts
+async function getAuthCredentials() {
+  const agentKey = process.env.EVIDENT_AGENT_KEY;
+  if (agentKey) {
+    return { token: agentKey, authType: "agent_key" };
+  }
+  const userToken = process.env.EVIDENT_TOKEN;
+  if (userToken) {
+    return { token: userToken, authType: "bearer" };
+  }
+  const keychainCreds = await getToken();
+  if (keychainCreds) {
+    return {
+      token: keychainCreds.token,
+      authType: "bearer",
+      user: keychainCreds.user
+    };
+  }
+  return null;
+}
+function getAuthHeader(credentials2) {
+  if (credentials2.authType === "agent_key") {
+    return `SandboxKey ${credentials2.token}`;
+  }
+  return `Bearer ${credentials2.token}`;
+}
+function isInteractive(jsonOutput) {
+  if (jsonOutput) return false;
+  if (process.env.CI) return false;
+  if (process.env.GITHUB_ACTIONS) return false;
+  if (!process.stdin.isTTY) return false;
+  return true;
+}
+
+// src/lib/opencode/health.ts
+async function checkOpenCodeHealth(port) {
+  try {
+    const response = await fetch(`http://localhost:${port}/global/health`, {
+      signal: AbortSignal.timeout(2e3)
+      // 2 second timeout
+    });
+    if (!response.ok) {
+      return { healthy: false, error: `HTTP ${response.status}` };
+    }
+    const data = await response.json().catch(() => ({}));
+    return { healthy: true, version: data.version };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { healthy: false, error: message };
+  }
+}
+async function waitForOpenCodeHealth(port, timeoutMs = 3e4) {
+  const startTime = Date.now();
+  while (Date.now() - startTime < timeoutMs) {
+    const health = await checkOpenCodeHealth(port);
+    if (health.healthy) {
+      return health;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 1e3));
+  }
+  return { healthy: false, error: "Timeout waiting for OpenCode to be healthy" };
+}
+
+// src/lib/opencode/process.ts
+import { execSync, spawn } from "child_process";
 var OPENCODE_PORT_RANGE = [4096, 4097, 4098, 4099, 4100];
 function getProcessCwd(pid) {
   const platform = process.platform;
@@ -624,22 +827,6 @@ async function scanPortsForOpenCode() {
   }
   return instances;
 }
-async function checkOpenCodeHealth(port) {
-  try {
-    const response = await fetch(`http://localhost:${port}/health`, {
-      signal: AbortSignal.timeout(2e3)
-      // 2 second timeout
-    });
-    if (!response.ok) {
-      return { healthy: false, error: `HTTP ${response.status}` };
-    }
-    const data = await response.json().catch(() => ({}));
-    return { healthy: true, version: data.version };
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    return { healthy: false, error: message };
-  }
-}
 async function findHealthyOpenCodeInstances() {
   const processes = findOpenCodeProcesses();
   const healthy = [];
@@ -655,356 +842,288 @@ async function findHealthyOpenCodeInstances() {
   }
   return healthy;
 }
-function logActivity(state, entry) {
-  const fullEntry = {
-    ...entry,
-    timestamp: /* @__PURE__ */ new Date()
-  };
-  state.activityLog.push(fullEntry);
-  if (state.activityLog.length > MAX_ACTIVITY_LOG_ENTRIES) {
-    state.activityLog.shift();
+async function startOpenCode(port) {
+  let command = "opencode";
+  let args = ["serve", "--port", port.toString()];
+  try {
+    execSync("which opencode", { stdio: "ignore" });
+  } catch {
+    command = "npx";
+    args = ["opencode", "serve", "--port", port.toString()];
   }
-  state.lastActivity = fullEntry.timestamp;
-}
-function formatActivityEntry(entry, _verbose) {
-  const time = entry.timestamp.toLocaleTimeString("en-US", {
-    hour12: false,
-    hour: "2-digit",
-    minute: "2-digit",
-    second: "2-digit"
+  const child = spawn(command, args, {
+    detached: true,
+    stdio: "ignore",
+    cwd: process.cwd()
   });
-  switch (entry.type) {
-    case "request": {
-      const duration = entry.durationMs ? ` (${entry.durationMs}ms)` : "";
-      const status = entry.status ? ` \u2192 ${colorizeStatus(entry.status)}` : " ...";
-      return `  ${chalk4.dim(`[${time}]`)} ${chalk4.cyan("\u2190")} ${entry.method} ${entry.path}${status}${duration}`;
-    }
-    case "response": {
-      const duration = entry.durationMs ? ` (${entry.durationMs}ms)` : "";
-      return `  ${chalk4.dim(`[${time}]`)} ${chalk4.green("\u2192")} ${entry.method} ${entry.path} ${colorizeStatus(entry.status)}${duration}`;
-    }
-    case "error": {
-      const errorMsg = entry.error || "Unknown error";
-      const path = entry.path ? ` ${entry.method} ${entry.path}` : "";
-      return `  ${chalk4.dim(`[${time}]`)} ${chalk4.red("\u2717")}${path} - ${chalk4.red(errorMsg)}`;
-    }
-    case "info": {
-      return `  ${chalk4.dim(`[${time}]`)} ${chalk4.blue("\u25CF")} ${entry.message}`;
-    }
-    default:
-      return `  ${chalk4.dim(`[${time}]`)} ${entry.message || "Unknown"}`;
-  }
+  return child;
 }
-function colorizeStatus(status) {
-  if (status >= 200 && status < 300) {
-    return chalk4.green(status.toString());
-  } else if (status >= 300 && status < 400) {
-    return chalk4.yellow(status.toString());
-  } else if (status >= 400 && status < 500) {
-    return chalk4.red(status.toString());
-  } else if (status >= 500) {
-    return chalk4.bgRed.white(` ${status} `);
-  }
-  return status.toString();
-}
-var ANSI = {
-  saveCursor: "\x1B[s",
-  restoreCursor: "\x1B[u",
-  clearToEnd: "\x1B[J",
-  moveTo: (row) => `\x1B[${row};1H`,
-  moveUp: (n) => `\x1B[${n}A`
-};
-var STATUS_DISPLAY_HEIGHT = 20;
-function displayStatus(state) {
-  const lines = [];
-  lines.push(chalk4.bold("Evident Tunnel"));
-  lines.push(chalk4.dim("\u2500".repeat(60)));
-  lines.push("");
-  if (state.sandboxName) {
-    lines.push(`  Sandbox:    ${state.sandboxName}`);
+function stopOpenCode(opencodeProcess) {
+  if (!opencodeProcess || !opencodeProcess.pid) {
+    return;
   }
-  lines.push(`  ID:         ${state.sandboxId ?? "Unknown"}`);
-  lines.push("");
-  if (state.connected) {
-    lines.push(`  ${chalk4.green("\u25CF")} Tunnel:    ${chalk4.green("Connected to Evident")}`);
-  } else {
-    if (state.reconnectAttempt > 0) {
-      lines.push(
-        `  ${chalk4.yellow("\u25CB")} Tunnel:    ${chalk4.yellow(`Reconnecting... (attempt ${state.reconnectAttempt})`)}`
-      );
+  try {
+    if (process.platform === "win32") {
+      opencodeProcess.kill("SIGTERM");
     } else {
-      lines.push(`  ${chalk4.yellow("\u25CB")} Tunnel:    ${chalk4.yellow("Connecting...")}`);
-    }
-  }
-  if (state.opencodeConnected) {
-    const version = state.opencodeVersion ? ` (v${state.opencodeVersion})` : "";
-    lines.push(`  ${chalk4.green("\u25CF")} OpenCode:  ${chalk4.green(`Running${version}`)}`);
-  } else {
-    lines.push(`  ${chalk4.red("\u25CB")} OpenCode:  ${chalk4.red("Not connected")}`);
-  }
-  lines.push("");
-  if (state.activityLog.length > 0) {
-    lines.push(chalk4.bold("  Activity:"));
-    for (const entry of state.activityLog) {
-      lines.push(formatActivityEntry(entry, state.verbose));
+      process.kill(-opencodeProcess.pid, "SIGTERM");
     }
-  } else {
-    lines.push(chalk4.dim("  No activity yet. Waiting for requests..."));
-  }
-  lines.push("");
-  lines.push(chalk4.dim("\u2500".repeat(60)));
-  if (state.verbose) {
-    lines.push(chalk4.dim("  Verbose mode: ON (request/response bodies will be logged)"));
-  }
-  lines.push(chalk4.dim("  Press Ctrl+C to disconnect"));
-  while (lines.length < STATUS_DISPLAY_HEIGHT) {
-    lines.push("");
+  } catch {
   }
-  if (!state.displayInitialized) {
-    console.log("");
-    console.log(chalk4.dim("\u2550".repeat(60)));
-    console.log("");
-    for (const line of lines) {
-      console.log(line);
-    }
-    state.displayInitialized = true;
-  } else {
-    process.stdout.write(ANSI.moveUp(STATUS_DISPLAY_HEIGHT + 3));
-    console.log(chalk4.dim("\u2550".repeat(60)));
-    console.log("");
-    for (const line of lines) {
-      process.stdout.write("\x1B[2K");
-      console.log(line);
+}
+
+// src/lib/opencode/install.ts
+import { execSync as execSync2 } from "child_process";
+import chalk4 from "chalk";
+import { select } from "@inquirer/prompts";
+var OPENCODE_INSTALL_URL = "https://opencode.ai";
+function isOpenCodeInstalled() {
+  try {
+    const platform = process.platform;
+    if (platform === "win32") {
+      execSync2("where opencode", { stdio: "ignore" });
+    } else {
+      execSync2("which opencode", { stdio: "ignore" });
     }
+    return true;
+  } catch {
+    return false;
   }
 }
-function displayError(_state, error2, details) {
-  blank();
-  console.log(chalk4.bgRed.white.bold(" ERROR "));
-  console.log(chalk4.red(`  ${error2}`));
-  if (details) {
-    console.log(chalk4.dim(`  ${details}`));
+async function promptOpenCodeInstall(interactive) {
+  if (!interactive) {
+    console.log(
+      JSON.stringify({
+        status: "error",
+        error: "OpenCode is not installed",
+        install_url: OPENCODE_INSTALL_URL,
+        install_commands: {
+          npm: "npm install -g opencode",
+          curl: "curl -fsSL https://opencode.ai/install.sh | sh"
+        }
+      })
+    );
+    return "exit";
   }
   blank();
-}
-async function validateSandbox(token, sandboxId) {
-  const apiUrl = getApiUrlConfig();
-  try {
-    const response = await fetch(`${apiUrl}/sandboxes/${sandboxId}`, {
-      headers: {
-        Authorization: `Bearer ${token}`
+  console.log(chalk4.yellow("OpenCode is not installed on your system."));
+  blank();
+  console.log(chalk4.dim("OpenCode is an AI coding agent that runs locally on your machine."));
+  console.log(chalk4.dim(`Learn more at: ${chalk4.cyan(OPENCODE_INSTALL_URL)}`));
+  blank();
+  const action = await select({
+    message: "How would you like to proceed?",
+    choices: [
+      {
+        name: "Show installation instructions",
+        value: "instructions",
+        description: "Display commands to install OpenCode"
+      },
+      {
+        name: "Continue without OpenCode",
+        value: "continue",
+        description: "Connect anyway (requests will fail until OpenCode is installed)"
+      },
+      {
+        name: "Exit",
+        value: "exit",
+        description: "Exit and install OpenCode manually"
       }
+    ]
+  });
+  if (action === "instructions") {
+    blank();
+    console.log(chalk4.bold("Install OpenCode using one of these methods:"));
+    blank();
+    console.log(chalk4.dim("  # Option 1: Install via npm (recommended)"));
+    console.log(`  ${chalk4.cyan("npm install -g opencode")}`);
+    blank();
+    console.log(chalk4.dim("  # Option 2: Install via curl"));
+    console.log(`  ${chalk4.cyan("curl -fsSL https://opencode.ai/install.sh | sh")}`);
+    blank();
+    console.log(chalk4.dim(`For more options, visit: ${chalk4.cyan(OPENCODE_INSTALL_URL)}`));
+    blank();
+    const afterInstall = await select({
+      message: "After installing, what would you like to do?",
+      choices: [
+        {
+          name: "I installed it - continue",
+          value: "continue",
+          description: "Proceed with the run command"
+        },
+        {
+          name: "Exit",
+          value: "exit",
+          description: "Exit now and run the command again later"
+        }
+      ]
     });
-    if (response.status === 404) {
-      return { valid: false, error: "Sandbox not found" };
-    }
-    if (response.status === 401) {
-      return { valid: false, error: "Authentication failed. Please run `evident login` again." };
-    }
-    if (!response.ok) {
-      return { valid: false, error: `API error: ${response.status}` };
-    }
-    const sandbox = await response.json();
-    if (sandbox.sandbox_type !== "remote") {
-      return {
-        valid: false,
-        error: `Sandbox is type '${sandbox.sandbox_type}', must be 'remote' for tunnel connection`
-      };
+    if (afterInstall === "continue") {
+      if (isOpenCodeInstalled()) {
+        console.log(chalk4.green("\n\u2713 OpenCode detected!"));
+        return "installed";
+      } else {
+        console.log(chalk4.yellow("\nOpenCode still not detected in PATH."));
+        console.log(chalk4.dim("You may need to restart your terminal or add it to your PATH."));
+        const proceed = await select({
+          message: "Continue anyway?",
+          choices: [
+            { name: "Yes, continue", value: "continue" },
+            { name: "No, exit", value: "exit" }
+          ]
+        });
+        return proceed === "continue" ? "continue" : "exit";
+      }
     }
-    return { valid: true, name: sandbox.name };
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    return { valid: false, error: `Failed to validate sandbox: ${message}` };
+    return "exit";
   }
+  return action;
 }
-async function forwardToOpenCode(port, request, requestId, state) {
-  const url = `http://localhost:${port}${request.path}`;
-  const startTime = Date.now();
-  state.pendingRequests.set(requestId, {
-    startTime,
-    method: request.method,
-    path: request.path
-  });
-  logActivity(state, {
-    type: "request",
-    method: request.method,
-    path: request.path,
-    requestId
+
+// src/lib/opencode/session.ts
+async function createOpenCodeSession(port) {
+  const response = await fetch(`http://localhost:${port}/session`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({})
   });
-  displayStatus(state);
-  if (state.verbose && request.body) {
-    console.log(chalk4.dim(`  Request body: ${JSON.stringify(request.body, null, 2)}`));
+  if (!response.ok) {
+    throw new Error(`Failed to create session: HTTP ${response.status}`);
   }
-  telemetry.debug(
-    EventTypes.OPENCODE_REQUEST_FORWARDED,
-    `Forwarding ${request.method} ${request.path}`,
-    {
-      method: request.method,
-      path: request.path,
-      port,
-      requestId
-    },
-    state.sandboxId ?? void 0
-  );
-  try {
-    const response = await fetch(url, {
-      method: request.method,
-      headers: {
-        "Content-Type": "application/json",
-        ...request.headers
-      },
-      body: request.body ? JSON.stringify(request.body) : void 0
-    });
-    let body;
-    const contentType = response.headers.get("Content-Type");
-    const text = await response.text();
-    if (!text || text.length === 0) {
-      body = null;
-    } else if (contentType?.includes("application/json")) {
-      try {
-        body = JSON.parse(text);
-      } catch {
-        body = text;
-      }
-    } else {
-      body = text;
+  const data = await response.json();
+  return data.id;
+}
+async function sendMessageToOpenCode(port, sessionId, content, options, hooks, maxWaitMs = 10 * 60 * 1e3) {
+  const body = {
+    parts: [{ type: "text", text: content }]
+  };
+  if (options?.agent) {
+    body.agent = options.agent;
+  }
+  if (options?.model) {
+    const slashIndex = options.model.indexOf("/");
+    if (slashIndex !== -1) {
+      body.model = {
+        providerID: options.model.substring(0, slashIndex),
+        modelID: options.model.substring(slashIndex + 1)
+      };
     }
-    const durationMs = Date.now() - startTime;
-    state.pendingRequests.delete(requestId);
-    if (!state.opencodeConnected) {
-      state.opencodeConnected = true;
+  }
+  let pollDone = false;
+  const reportedQuestions = /* @__PURE__ */ new Set();
+  const reportedPermissions = /* @__PURE__ */ new Set();
+  const pollInteractive = async () => {
+    while (!pollDone) {
+      await new Promise((resolve) => setTimeout(resolve, 1e3));
+      if (pollDone) break;
+      if (hooks?.onQuestion) {
+        try {
+          const res = await fetch(`http://localhost:${port}/question`);
+          if (res.ok) {
+            const questions = await res.json();
+            for (const q of questions) {
+              if (q.sessionID === sessionId && !reportedQuestions.has(q.id)) {
+                reportedQuestions.add(q.id);
+                await hooks.onQuestion(q);
+              }
+            }
+          }
+        } catch {
+        }
+      }
+      if (hooks?.onPermission) {
+        try {
+          const res = await fetch(`http://localhost:${port}/permission`);
+          if (res.ok) {
+            const permissions = await res.json();
+            for (const p of permissions) {
+              if (p.sessionID === sessionId && !reportedPermissions.has(p.id)) {
+                reportedPermissions.add(p.id);
+                await hooks.onPermission(p);
+              }
+            }
+          }
+        } catch {
+        }
+      }
     }
-    const lastEntry = state.activityLog[state.activityLog.length - 1];
-    if (lastEntry && lastEntry.requestId === requestId) {
-      lastEntry.type = "response";
-      lastEntry.status = response.status;
-      lastEntry.durationMs = durationMs;
-    } else {
-      logActivity(state, {
-        type: "response",
-        method: request.method,
-        path: request.path,
-        status: response.status,
-        durationMs,
-        requestId
+  };
+  const sendMessage = async () => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), maxWaitMs);
+    try {
+      const res = await fetch(`http://localhost:${port}/session/${sessionId}/message`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+        signal: controller.signal
       });
+      if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        throw new Error(`OpenCode message failed: HTTP ${res.status}${text ? `: ${text}` : ""}`);
+      }
+      const sessionRes = await fetch(`http://localhost:${port}/session/${sessionId}`).catch(
+        () => null
+      );
+      const session = sessionRes?.ok ? await sessionRes.json() : null;
+      return { title: session?.title };
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new Error("Message processing timed out");
+      }
+      throw err;
+    } finally {
+      clearTimeout(timer);
+      pollDone = true;
     }
-    displayStatus(state);
-    if (state.verbose && body) {
-      const bodyStr = typeof body === "string" ? body : JSON.stringify(body, null, 2);
-      const truncated = bodyStr.length > 500 ? bodyStr.substring(0, 500) + "..." : bodyStr;
-      console.log(chalk4.dim(`  Response body: ${truncated}`));
-    }
-    telemetry.debug(
-      EventTypes.OPENCODE_RESPONSE_SENT,
-      `Response ${response.status}`,
-      {
-        status: response.status,
-        path: request.path,
-        durationMs,
-        requestId
+  };
+  const [result] = await Promise.all([sendMessage(), pollInteractive()]);
+  return result;
+}
+
+// src/lib/tunnel/connection.ts
+import WebSocket from "ws";
+
+// src/lib/tunnel/forwarding.ts
+var CHUNK_THRESHOLD = 512 * 1024;
+var CHUNK_SIZE = 768 * 1024;
+async function forwardToOpenCode(port, request) {
+  const url = `http://localhost:${port}${request.path}`;
+  try {
+    const response = await fetch(url, {
+      method: request.method,
+      headers: {
+        "Content-Type": "application/json",
+        ...request.headers
       },
-      state.sandboxId ?? void 0
-    );
+      body: request.body ? JSON.stringify(request.body) : void 0
+    });
+    let body;
+    const contentType = response.headers.get("Content-Type");
+    const text = await response.text();
+    if (!text || text.length === 0) {
+      body = null;
+    } else if (contentType?.includes("application/json")) {
+      try {
+        body = JSON.parse(text);
+      } catch {
+        body = text;
+      }
+    } else {
+      body = text;
+    }
     return {
       status: response.status,
       body
     };
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : "Unknown error";
-    const durationMs = Date.now() - startTime;
-    state.pendingRequests.delete(requestId);
-    state.opencodeConnected = false;
-    logActivity(state, {
-      type: "error",
-      method: request.method,
-      path: request.path,
-      error: `OpenCode unreachable: ${message}`,
-      durationMs,
-      requestId
-    });
-    displayStatus(state);
-    telemetry.error(
-      EventTypes.OPENCODE_UNREACHABLE,
-      `Failed to connect to OpenCode: ${message}`,
-      {
-        port,
-        path: request.path,
-        error: message,
-        requestId
-      },
-      state.sandboxId ?? void 0
-    );
     return {
       status: 502,
       body: { error: "Failed to connect to OpenCode", message }
     };
   }
 }
-async function subscribeToOpenCodeEvents(port, subscriptionId, ws, state) {
-  const url = `http://localhost:${port}/event`;
-  logActivity(state, {
-    type: "info",
-    message: `Starting event subscription ${subscriptionId.slice(0, 8)}`
-  });
-  displayStatus(state);
-  const abortController = new AbortController();
-  state.activeEventSubscriptions.set(subscriptionId, abortController);
-  try {
-    const response = await fetch(url, {
-      headers: { Accept: "text/event-stream" },
-      signal: abortController.signal
-    });
-    if (!response.ok) {
-      throw new Error(`Failed to connect to OpenCode events: ${response.status}`);
-    }
-    if (!response.body) {
-      throw new Error("No response body");
-    }
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = "";
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) {
-        ws.send(JSON.stringify({ type: "event_end", id: subscriptionId }));
-        break;
-      }
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split("\n");
-      buffer = lines.pop() || "";
-      for (const line of lines) {
-        if (line.startsWith("data: ")) {
-          try {
-            const event = JSON.parse(line.slice(6));
-            ws.send(JSON.stringify({ type: "event", id: subscriptionId, event }));
-          } catch {
-          }
-        }
-      }
-    }
-  } catch (error2) {
-    if (abortController.signal.aborted) {
-      return;
-    }
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    logActivity(state, {
-      type: "error",
-      error: `Event subscription failed: ${message}`
-    });
-    displayStatus(state);
-    ws.send(JSON.stringify({ type: "event_error", id: subscriptionId, error: message }));
-  } finally {
-    state.activeEventSubscriptions.delete(subscriptionId);
-  }
-}
-function cancelEventSubscription(subscriptionId, state) {
-  const controller = state.activeEventSubscriptions.get(subscriptionId);
-  if (controller) {
-    controller.abort();
-    state.activeEventSubscriptions.delete(subscriptionId);
-  }
-}
 function sendResponse(ws, requestId, response) {
   const bodyStr = JSON.stringify(response.body ?? null);
   const bodyBytes = Buffer.from(bodyStr, "utf-8");
@@ -1058,79 +1177,107 @@ function splitIntoChunks(data, chunkSize) {
   }
   return chunks;
 }
+
+// src/lib/tunnel/events.ts
+async function subscribeToOpenCodeEvents(port, subscriptionId, ws, abortController) {
+  const url = `http://localhost:${port}/event`;
+  try {
+    const response = await fetch(url, {
+      headers: { Accept: "text/event-stream" },
+      signal: abortController.signal
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to connect to OpenCode events: ${response.status}`);
+    }
+    if (!response.body) {
+      throw new Error("No response body");
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        ws.send(JSON.stringify({ type: "event_end", id: subscriptionId }));
+        break;
+      }
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split("\n");
+      buffer = lines.pop() || "";
+      for (const line of lines) {
+        if (line.startsWith("data: ")) {
+          try {
+            const event = JSON.parse(line.slice(6));
+            ws.send(JSON.stringify({ type: "event", id: subscriptionId, event }));
+          } catch {
+          }
+        }
+      }
+    }
+  } catch (error2) {
+    if (abortController.signal.aborted) {
+      return;
+    }
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    ws.send(JSON.stringify({ type: "event_error", id: subscriptionId, error: message }));
+    throw error2;
+  }
+}
+
+// src/lib/tunnel/connection.ts
+var MAX_RECONNECT_DELAY = 3e4;
+var BASE_RECONNECT_DELAY = 500;
 function getReconnectDelay(attempt) {
   const exponentialDelay = BASE_RECONNECT_DELAY * Math.pow(2, attempt);
   const jitter = Math.random() * 1e3;
   return Math.min(exponentialDelay + jitter, MAX_RECONNECT_DELAY);
 }
-async function connect(token, sandboxId, port, state) {
+function connectTunnel(options) {
+  const {
+    agentId,
+    authHeader,
+    port,
+    onConnected,
+    onDisconnected,
+    onError,
+    onRequest,
+    onResponse,
+    onInfo
+  } = options;
   const tunnelUrl = getTunnelUrlConfig();
-  const url = `${tunnelUrl}/tunnel/${sandboxId}/connect`;
-  logActivity(state, {
-    type: "info",
-    message: "Connecting to tunnel relay..."
-  });
-  displayStatus(state);
-  telemetry.info(
-    EventTypes.TUNNEL_STARTING,
-    `Connecting to ${url}`,
-    {
-      sandboxId,
-      port,
-      tunnelUrl
-    },
-    sandboxId
-  );
+  const url = `${tunnelUrl}/tunnel/${agentId}/connect`;
+  const activeEventSubscriptions = /* @__PURE__ */ new Map();
   return new Promise((resolve, reject) => {
     const ws = new WebSocket(url, {
       headers: {
-        Authorization: `Bearer ${token}`
+        Authorization: authHeader
       }
     });
+    const connectionTimeout = setTimeout(() => {
+      ws.close();
+      reject(new Error("Connection timeout"));
+    }, 3e4);
     ws.on("open", () => {
-      state.connected = true;
-      state.reconnectAttempt = 0;
-      logActivity(state, {
-        type: "info",
-        message: "WebSocket connection established"
-      });
-      displayStatus(state);
+      onInfo?.("WebSocket connection established");
     });
     ws.on("message", async (data) => {
       try {
         const message = JSON.parse(data.toString());
         switch (message.type) {
-          case "connected":
-            state.sandboxId = message.sandbox_id ?? sandboxId;
-            logActivity(state, {
-              type: "info",
-              message: `Tunnel connected (sandbox: ${state.sandboxId})`
+          case "connected": {
+            clearTimeout(connectionTimeout);
+            const connectedAgentId = message.agent_id ?? agentId;
+            onConnected?.(connectedAgentId);
+            resolve({
+              ws,
+              close: () => ws.close(1e3, "CLI shutdown"),
+              activeEventSubscriptions
             });
-            telemetry.info(
-              EventTypes.TUNNEL_CONNECTED,
-              `Tunnel connected`,
-              {
-                sandboxId: message.sandbox_id
-              },
-              message.sandbox_id
-            );
-            displayStatus(state);
             break;
+          }
           case "error":
-            logActivity(state, {
-              type: "error",
-              error: message.message || "Unknown tunnel error"
-            });
-            telemetry.error(
-              EventTypes.TUNNEL_ERROR,
-              `Tunnel error: ${message.message}`,
-              {
-                code: message.code,
-                message: message.message
-              },
-              state.sandboxId ?? void 0
-            );
-            displayStatus(state);
+            clearTimeout(connectionTimeout);
+            onError?.(message.message || "Unknown tunnel error");
             if (message.code === "unauthorized") {
               ws.close();
               reject(new Error("Unauthorized"));
@@ -1141,442 +1288,1229 @@ async function connect(token, sandboxId, port, state) {
             break;
           case "request":
             if (message.id && message.payload) {
-              telemetry.debug(
-                EventTypes.OPENCODE_REQUEST_RECEIVED,
-                `Request: ${message.payload.method} ${message.payload.path}`,
-                {
-                  requestId: message.id,
-                  method: message.payload.method,
-                  path: message.payload.path
-                },
-                state.sandboxId ?? void 0
-              );
-              const response = await forwardToOpenCode(port, message.payload, message.id, state);
+              const startTime = Date.now();
+              onRequest?.(message.payload.method, message.payload.path, message.id);
+              const response = await forwardToOpenCode(port, message.payload);
+              const durationMs = Date.now() - startTime;
+              onResponse?.(response.status, durationMs, message.id);
               sendResponse(ws, message.id, response);
             }
             break;
           case "subscribe_events":
             if (message.id) {
-              void subscribeToOpenCodeEvents(port, message.id, ws, state);
+              const abortController = new AbortController();
+              activeEventSubscriptions.set(message.id, abortController);
+              onInfo?.(`Starting event subscription ${message.id.slice(0, 8)}`);
+              subscribeToOpenCodeEvents(port, message.id, ws, abortController).catch((error2) => {
+                if (!abortController.signal.aborted) {
+                  onError?.(`Event subscription failed: ${error2.message}`);
+                }
+              }).finally(() => {
+                activeEventSubscriptions.delete(message.id);
+              });
             }
             break;
           case "unsubscribe_events":
             if (message.id) {
-              cancelEventSubscription(message.id, state);
+              const controller = activeEventSubscriptions.get(message.id);
+              if (controller) {
+                controller.abort();
+                activeEventSubscriptions.delete(message.id);
+              }
             }
             break;
         }
       } catch (error2) {
         const errorMessage = error2 instanceof Error ? error2.message : "Unknown error";
-        logActivity(state, {
-          type: "error",
-          error: `Failed to handle message: ${errorMessage}`
-        });
-        telemetry.error(
-          EventTypes.TUNNEL_ERROR,
-          `Failed to handle message: ${errorMessage}`,
-          {
-            error: errorMessage
-          },
-          state.sandboxId ?? void 0
-        );
-        displayStatus(state);
+        onError?.(`Failed to handle message: ${errorMessage}`);
       }
     });
+    ws.on("error", (error2) => {
+      clearTimeout(connectionTimeout);
+      onError?.(`Connection error: ${error2.message}`);
+      reject(error2);
+    });
     ws.on("close", (code, reason) => {
-      state.connected = false;
       const reasonStr = reason.toString() || "No reason provided";
-      logActivity(state, {
-        type: "info",
-        message: `Disconnected (code: ${code}, reason: ${reasonStr})`
-      });
-      telemetry.info(
-        EventTypes.TUNNEL_DISCONNECTED,
-        "Tunnel disconnected",
-        {
-          sandboxId: state.sandboxId,
-          code,
-          reason: reasonStr
-        },
-        state.sandboxId ?? void 0
-      );
-      displayStatus(state);
-      resolve();
+      onDisconnected?.(code, reasonStr);
+      for (const [, controller] of activeEventSubscriptions) {
+        controller.abort();
+      }
+      activeEventSubscriptions.clear();
     });
-    ws.on("error", (error2) => {
-      state.connected = false;
-      logActivity(state, {
-        type: "error",
-        error: `Connection error: ${error2.message}`
-      });
-      telemetry.error(
-        EventTypes.TUNNEL_ERROR,
-        `Connection error: ${error2.message}`,
-        {
-          error: error2.message
-        },
-        state.sandboxId ?? void 0
-      );
-      displayStatus(state);
+  });
+}
+
+// src/commands/run.ts
+var MAX_ACTIVITY_LOG_ENTRIES = 10;
+var MESSAGE_POLL_INTERVAL_MS = 2e3;
+var MAX_CONSECUTIVE_FETCH_FAILURES = 3;
+var LOCK_HEARTBEAT_INTERVAL_MS = 5 * 60 * 1e3;
+async function resolveAgentIdFromKey(authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/me`, {
+      headers: { Authorization: authHeader }
     });
-    const cleanup = async () => {
-      process.removeAllListeners("SIGINT");
-      process.removeAllListeners("SIGTERM");
-      logActivity(state, {
-        type: "info",
-        message: "Shutting down..."
-      });
-      displayStatus(state);
-      telemetry.info(
-        EventTypes.TUNNEL_DISCONNECTED,
-        "Tunnel stopped by user",
-        {
-          sandboxId: state.sandboxId
-        },
-        state.sandboxId ?? void 0
-      );
-      await shutdownTelemetry();
-      ws.close();
-      process.exit(0);
+    if (!response.ok) {
+      return { error: `Failed to resolve agent from key: HTTP ${response.status}` };
+    }
+    const data = await response.json();
+    if (data.auth_type === "agent_key" && data.agent_id) {
+      return { agent_id: data.agent_id };
+    }
+    return {
+      error: "Cannot resolve agent ID: auth type is not agent_key. Please provide --agent explicitly."
     };
-    process.removeAllListeners("SIGINT");
-    process.removeAllListeners("SIGTERM");
-    process.once("SIGINT", () => void cleanup());
-    process.once("SIGTERM", () => void cleanup());
-  });
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { error: `Failed to resolve agent from key: ${message}` };
+  }
 }
-async function tunnel(options) {
-  const verbose = options.verbose ?? false;
-  const credentials = await getToken();
-  if (!credentials) {
-    const cliName = (await import("./config-J7LPYFVS.js")).getCliName();
-    telemetry.error(EventTypes.CLI_ERROR, "Not logged in", { command: "tunnel" });
-    printError(`Not logged in. Run \`${cliName} login\` first.`);
-    process.exit(1);
+async function getAgentInfo(agentId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/agents/${agentId}`, {
+      headers: { Authorization: authHeader }
+    });
+    if (response.status === 404) {
+      return { valid: false, error: "Agent not found" };
+    }
+    if (response.status === 401) {
+      return { valid: false, error: "Authentication failed", authFailed: true };
+    }
+    if (!response.ok) {
+      return { valid: false, error: `API error: ${response.status}` };
+    }
+    const agent = await response.json();
+    if (agent.sandbox_type !== "local" && agent.sandbox_type !== "github_actions") {
+      return {
+        valid: false,
+        error: `Agent is type '${agent.sandbox_type}', must be 'local' or 'github_actions' for CLI connection`
+      };
+    }
+    return { valid: true, agent };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { valid: false, error: `Failed to validate agent: ${message}` };
   }
-  const port = options.port ?? 4096;
-  const sandboxId = options.sandbox;
-  if (!sandboxId) {
-    const cliName = (await import("./config-J7LPYFVS.js")).getCliName();
-    printError("--sandbox <id> is required");
-    blank();
-    console.log(chalk4.dim("To find your sandbox ID:"));
-    console.log(chalk4.dim("  1. Create a remote sandbox in the Evident web UI"));
-    console.log(chalk4.dim("  2. Copy the sandbox ID from the URL or settings"));
-    console.log(chalk4.dim(`  3. Run: ${cliName} tunnel --sandbox <id>`));
-    blank();
-    telemetry.error(EventTypes.CLI_ERROR, "Missing sandbox ID", { command: "tunnel" });
-    process.exit(1);
+}
+var AuthenticationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthenticationError";
   }
-  const state = {
-    connected: false,
-    opencodeConnected: false,
-    opencodeVersion: null,
-    sandboxId,
-    sandboxName: null,
-    reconnectAttempt: 0,
-    lastActivity: /* @__PURE__ */ new Date(),
-    activityLog: [],
-    pendingRequests: /* @__PURE__ */ new Map(),
-    verbose,
-    displayInitialized: false,
-    activeEventSubscriptions: /* @__PURE__ */ new Map()
-  };
-  telemetry.info(
-    EventTypes.CLI_COMMAND,
-    "Starting tunnel command",
+};
+function checkAuthResponse(response, context) {
+  if (response.status === 401 || response.status === 403) {
+    throw new AuthenticationError(
+      `Authentication failed during ${context}: HTTP ${response.status}. Your session may have expired.`
+    );
+  }
+}
+async function getPendingConversations(agentId, authHeader, conversationFilter) {
+  const apiUrl = getApiUrlConfig();
+  const response = await fetch(`${apiUrl}/agents/${agentId}/conversations/pending`, {
+    headers: { Authorization: authHeader }
+  });
+  checkAuthResponse(response, "fetching pending conversations");
+  if (!response.ok) {
+    throw new Error(`Failed to get pending conversations: HTTP ${response.status}`);
+  }
+  const data = await response.json();
+  let conversations = data.conversations;
+  if (conversationFilter) {
+    conversations = conversations.filter((c) => c.id === conversationFilter);
+  }
+  return conversations;
+}
+async function getPendingMessages(agentId, conversationId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  const response = await fetch(
+    `${apiUrl}/agents/${agentId}/threads/${conversationId}/messages?status=pending`,
+    { headers: { Authorization: authHeader } }
+  );
+  checkAuthResponse(response, "fetching pending messages");
+  if (!response.ok) {
+    throw new Error(`Failed to get messages: HTTP ${response.status}`);
+  }
+  return response.json();
+}
+async function markMessageProcessing(agentId, conversationId, messageId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  const response = await fetch(
+    `${apiUrl}/agents/${agentId}/threads/${conversationId}/messages/${messageId}`,
     {
-      command: "tunnel",
-      port,
-      sandboxId,
-      verbose
-    },
-    sandboxId
+      method: "PATCH",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({ status: "processing" })
+    }
   );
-  logActivity(state, {
-    type: "info",
-    message: `Starting tunnel (port: ${port}, verbose: ${verbose})`
-  });
-  logActivity(state, {
-    type: "info",
-    message: "Validating sandbox..."
-  });
-  const validateSpinner = ora2("Validating sandbox...").start();
-  const validation = await validateSandbox(credentials.token, sandboxId);
-  if (!validation.valid) {
-    validateSpinner.fail(`Sandbox validation failed: ${validation.error}`);
-    logActivity(state, {
-      type: "error",
-      error: `Sandbox validation failed: ${validation.error}`
-    });
-    telemetry.error(EventTypes.CLI_ERROR, `Sandbox validation failed: ${validation.error}`, {
-      command: "tunnel",
-      sandboxId
+  checkAuthResponse(response, "marking message as processing");
+  return response.ok;
+}
+async function reportInteractiveEvent(agentId, conversationId, type, data, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  const response = await fetch(
+    `${apiUrl}/agents/${agentId}/threads/${conversationId}/interactive-event`,
+    {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({ type, data })
+    }
+  );
+  checkAuthResponse(response, "reporting interactive event");
+  if (!response.ok) {
+    throw new Error(`Failed to report interactive event: HTTP ${response.status}`);
+  }
+}
+async function markMessageDone(agentId, conversationId, messageId, authHeader, sessionId) {
+  const apiUrl = getApiUrlConfig();
+  const body = { status: "done" };
+  if (sessionId) {
+    body.opencode_session_id = sessionId;
+  }
+  const response = await fetch(
+    `${apiUrl}/agents/${agentId}/threads/${conversationId}/messages/${messageId}`,
+    {
+      method: "PATCH",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    }
+  );
+  checkAuthResponse(response, "marking message as done");
+}
+async function markMessageFailed(agentId, conversationId, messageId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  const response = await fetch(
+    `${apiUrl}/agents/${agentId}/threads/${conversationId}/messages/${messageId}`,
+    {
+      method: "PATCH",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({ status: "failed" })
+    }
+  );
+  checkAuthResponse(response, "marking message as failed");
+}
+async function acquireConversationLock(agentId, conversationId, correlationId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/agents/${agentId}/threads/${conversationId}/lock`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({ correlation_id: correlationId })
     });
-    displayStatus(state);
-    process.exit(1);
+    checkAuthResponse(response, "acquiring conversation lock");
+    if (response.status === 409) {
+      return { acquired: false, error: "Conversation already locked by another runner" };
+    }
+    if (!response.ok) {
+      return { acquired: false, error: `Failed to acquire lock: HTTP ${response.status}` };
+    }
+    return { acquired: true };
+  } catch (error2) {
+    if (error2 instanceof AuthenticationError) throw error2;
+    return { acquired: false, error: String(error2) };
   }
-  state.sandboxName = validation.name ?? null;
-  validateSpinner.succeed(`Sandbox: ${validation.name || sandboxId}`);
-  logActivity(state, {
-    type: "info",
-    message: `Sandbox validated: ${validation.name || sandboxId}`
+}
+async function extendConversationLock(agentId, conversationId, correlationId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(
+      `${apiUrl}/agents/${agentId}/threads/${conversationId}/lock/extend`,
+      {
+        method: "POST",
+        headers: { Authorization: authHeader, "Content-Type": "application/json" },
+        body: JSON.stringify({ correlation_id: correlationId })
+      }
+    );
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+async function releaseConversationLock(agentId, conversationId, correlationId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    await fetch(
+      `${apiUrl}/agents/${agentId}/threads/${conversationId}/lock?correlation_id=${encodeURIComponent(correlationId)}`,
+      {
+        method: "DELETE",
+        headers: { Authorization: authHeader }
+      }
+    );
+  } catch {
+  }
+}
+async function updateConversationSession(agentId, conversationId, sessionId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  const response = await fetch(`${apiUrl}/agents/${agentId}/threads/${conversationId}`, {
+    method: "PATCH",
+    headers: { Authorization: authHeader, "Content-Type": "application/json" },
+    body: JSON.stringify({ opencode_session_id: sessionId })
   });
-  logActivity(state, {
-    type: "info",
-    message: `Checking OpenCode on port ${port}...`
+  checkAuthResponse(response, "updating conversation session");
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(
+      `Failed to update conversation session: HTTP ${response.status}${text ? `: ${text}` : ""}`
+    );
+  }
+}
+async function updateConversationTitle(agentId, conversationId, title, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  const response = await fetch(`${apiUrl}/agents/${agentId}/threads/${conversationId}`, {
+    method: "PATCH",
+    headers: { Authorization: authHeader, "Content-Type": "application/json" },
+    body: JSON.stringify({ title })
   });
-  const opencodeSpinner = ora2("Checking OpenCode connection...").start();
-  const healthCheck = await checkOpenCodeHealth(port);
-  if (healthCheck.healthy) {
-    state.opencodeConnected = true;
-    state.opencodeVersion = healthCheck.version ?? null;
-    const version = healthCheck.version ? ` (v${healthCheck.version})` : "";
-    telemetry.info(
-      EventTypes.OPENCODE_HEALTH_OK,
-      `OpenCode healthy on port ${port}`,
-      {
-        port,
-        version: healthCheck.version
-      },
-      sandboxId
+  checkAuthResponse(response, "updating conversation title");
+}
+function log(state, message, isError = false) {
+  if (state.json) {
+    console.log(
+      JSON.stringify({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: isError ? "error" : "info",
+        message
+      })
     );
-    opencodeSpinner.succeed(`OpenCode running on port ${port}${version}`);
-    logActivity(state, {
-      type: "info",
-      message: `OpenCode running on port ${port}${version}`
-    });
+  } else if (!state.interactive) {
+    const prefix = isError ? chalk5.red("\u2717") : chalk5.green("\u2022");
+    console.log(`${prefix} ${message}`);
+  }
+}
+function logActivity(state, entry) {
+  const fullEntry = {
+    ...entry,
+    timestamp: /* @__PURE__ */ new Date()
+  };
+  state.activityLog.push(fullEntry);
+  if (state.activityLog.length > MAX_ACTIVITY_LOG_ENTRIES) {
+    state.activityLog.shift();
+  }
+  state.lastActivity = fullEntry.timestamp;
+  if (!state.interactive) {
+    if (entry.type === "error") {
+      log(state, entry.error ?? "Unknown error", true);
+    } else if (entry.type === "info" && entry.message) {
+      log(state, entry.message);
+    }
+  }
+}
+var ANSI = {
+  moveUp: (n) => `\x1B[${n}A`
+};
+var STATUS_DISPLAY_HEIGHT = 22;
+function colorizeStatus(status) {
+  if (status >= 200 && status < 300) {
+    return chalk5.green(status.toString());
+  } else if (status >= 300 && status < 400) {
+    return chalk5.yellow(status.toString());
+  } else if (status >= 400 && status < 500) {
+    return chalk5.red(status.toString());
+  } else if (status >= 500) {
+    return chalk5.bgRed.white(` ${status} `);
+  }
+  return status.toString();
+}
+function formatActivityEntry(entry) {
+  const time = entry.timestamp.toLocaleTimeString("en-US", {
+    hour12: false,
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit"
+  });
+  switch (entry.type) {
+    case "request": {
+      const duration = entry.durationMs ? ` (${entry.durationMs}ms)` : "";
+      const status = entry.status ? ` -> ${colorizeStatus(entry.status)}` : " ...";
+      return `  ${chalk5.dim(`[${time}]`)} ${chalk5.cyan("<-")} ${entry.method} ${entry.path}${status}${duration}`;
+    }
+    case "response": {
+      const duration = entry.durationMs ? ` (${entry.durationMs}ms)` : "";
+      return `  ${chalk5.dim(`[${time}]`)} ${chalk5.green("->")} ${entry.method} ${entry.path} ${colorizeStatus(entry.status)}${duration}`;
+    }
+    case "error": {
+      const errorMsg = entry.error || "Unknown error";
+      const path = entry.path ? ` ${entry.method} ${entry.path}` : "";
+      return `  ${chalk5.dim(`[${time}]`)} ${chalk5.red("x")}${path} - ${chalk5.red(errorMsg)}`;
+    }
+    case "info": {
+      return `  ${chalk5.dim(`[${time}]`)} ${chalk5.blue("*")} ${entry.message}`;
+    }
+    default:
+      return `  ${chalk5.dim(`[${time}]`)} ${entry.message || "Unknown"}`;
+  }
+}
+function displayStatus(state) {
+  if (!state.interactive) return;
+  const lines = [];
+  lines.push(chalk5.bold("Evident"));
+  lines.push(chalk5.dim("-".repeat(60)));
+  lines.push("");
+  if (state.agentName) {
+    lines.push(`  Agent:      ${state.agentName}`);
+  }
+  lines.push(`  ID:         ${state.agentId}`);
+  if (state.conversationFilter) {
+    lines.push(`  Filter:     conversation ${state.conversationFilter.slice(0, 8)}...`);
+  }
+  lines.push("");
+  if (state.connected) {
+    lines.push(`  ${chalk5.green("*")} Tunnel:    ${chalk5.green("Connected to Evident")}`);
   } else {
-    telemetry.warn(
-      EventTypes.OPENCODE_HEALTH_FAILED,
-      `Could not connect to OpenCode: ${healthCheck.error}`,
+    if (state.reconnectAttempt > 0) {
+      lines.push(
+        `  ${chalk5.yellow("o")} Tunnel:    ${chalk5.yellow(`Reconnecting... (attempt ${state.reconnectAttempt})`)}`
+      );
+    } else {
+      lines.push(`  ${chalk5.yellow("o")} Tunnel:    ${chalk5.yellow("Connecting...")}`);
+    }
+  }
+  if (state.opencodeConnected) {
+    const version = state.opencodeVersion ? `, v${state.opencodeVersion}` : "";
+    lines.push(
+      `  ${chalk5.green("*")} OpenCode:  ${chalk5.green(`Running on port ${state.port}${version}`)}`
+    );
+  } else {
+    lines.push(`  ${chalk5.red("o")} OpenCode:  ${chalk5.red(`Not connected (port ${state.port})`)}`);
+  }
+  lines.push("");
+  if (state.messageCount > 0) {
+    lines.push(`  Messages:   ${state.messageCount} processed`);
+    lines.push("");
+  }
+  if (state.activityLog.length > 0) {
+    lines.push(chalk5.bold("  Activity:"));
+    for (const entry of state.activityLog) {
+      lines.push(formatActivityEntry(entry));
+    }
+  } else {
+    lines.push(chalk5.dim("  No activity yet. Waiting for requests..."));
+  }
+  lines.push("");
+  lines.push(chalk5.dim("-".repeat(60)));
+  if (state.verbose) {
+    lines.push(chalk5.dim("  Verbose mode: ON"));
+  }
+  lines.push("");
+  lines.push(
+    chalk5.dim(`  Tip: Run \`opencode attach http://localhost:${state.port}\` to see live activity`)
+  );
+  lines.push(chalk5.dim("  Press Ctrl+C to disconnect"));
+  while (lines.length < STATUS_DISPLAY_HEIGHT) {
+    lines.push("");
+  }
+  if (!state.displayInitialized) {
+    console.log("");
+    console.log(chalk5.dim("=".repeat(60)));
+    console.log("");
+    for (const line of lines) {
+      console.log(line);
+    }
+    state.displayInitialized = true;
+  } else {
+    process.stdout.write(ANSI.moveUp(STATUS_DISPLAY_HEIGHT + 3));
+    console.log(chalk5.dim("=".repeat(60)));
+    console.log("");
+    for (const line of lines) {
+      process.stdout.write("\x1B[2K");
+      console.log(line);
+    }
+  }
+}
+async function promptForLogin(promptMessage, successMessage) {
+  const action = await select2({
+    message: promptMessage,
+    choices: [
       {
-        port,
-        error: healthCheck.error
+        name: "Yes, log me in",
+        value: "login",
+        description: "Opens a browser to authenticate with Evident"
       },
-      sandboxId
-    );
-    opencodeSpinner.warn(`Could not connect to OpenCode on port ${port}`);
-    logActivity(state, {
-      type: "error",
-      error: `OpenCode not reachable on port ${port}: ${healthCheck.error}`
-    });
-    const runningInstances = await findHealthyOpenCodeInstances();
-    if (runningInstances.length > 0) {
-      blank();
-      console.log(chalk4.yellow("Found OpenCode running on different port(s):"));
-      for (const instance of runningInstances) {
-        const ver = instance.version ? ` (v${instance.version})` : "";
-        const cwd = instance.cwd ? ` in ${instance.cwd}` : "";
-        console.log(chalk4.dim(`  \u2022 Port ${instance.port}${ver}${cwd}`));
+      {
+        name: "No, exit",
+        value: "exit",
+        description: "Exit without logging in"
       }
-      blank();
-      if (runningInstances.length === 1) {
-        console.log(chalk4.yellow("Tip: Run with the correct port:"));
-        console.log(
-          chalk4.dim(
-            `  npx @evident-ai/cli@latest tunnel --sandbox ${sandboxId} --port ${runningInstances[0].port}`
-          )
-        );
-      } else {
-        console.log(chalk4.yellow("Tip: Specify which port to use:"));
-        console.log(
-          chalk4.dim(`  npx @evident-ai/cli@latest tunnel --sandbox ${sandboxId} --port <PORT>`)
-        );
+    ]
+  });
+  if (action === "exit") {
+    console.log(chalk5.dim(`
+You can log in later by running: ${getCliName()} login`));
+    process.exit(0);
+  }
+  await login({ noBrowser: false });
+  const credentials2 = await getToken();
+  if (!credentials2) {
+    printError("Login failed. Please try again.");
+    process.exit(1);
+  }
+  blank();
+  console.log(chalk5.green(successMessage));
+  blank();
+  return { token: credentials2.token, authType: "bearer", user: credentials2.user };
+}
+async function ensureOpenCodeRunning(state) {
+  const healthCheck = await checkOpenCodeHealth(state.port);
+  if (healthCheck.healthy) {
+    state.opencodeConnected = true;
+    state.opencodeVersion = healthCheck.version ?? null;
+    return;
+  }
+  const runningInstances = await findHealthyOpenCodeInstances();
+  if (runningInstances.length > 0) {
+    if (!state.interactive) {
+      throw new Error(
+        `OpenCode not found on port ${state.port}, but running on port ${runningInstances[0].port}. Use --port ${runningInstances[0].port}`
+      );
+    }
+    blank();
+    console.log(chalk5.yellow("Found OpenCode running on different port(s):"));
+    for (const instance of runningInstances) {
+      const ver = instance.version ? ` (v${instance.version})` : "";
+      const cwd = instance.cwd ? ` in ${instance.cwd}` : "";
+      console.log(chalk5.dim(`  * Port ${instance.port}${ver}${cwd}`));
+    }
+    blank();
+    if (runningInstances.length === 1) {
+      console.log(chalk5.yellow("Tip: Run with the correct port:"));
+      console.log(
+        chalk5.dim(
+          `  ${getCliName()} run --agent ${state.agentId} --port ${runningInstances[0].port}`
+        )
+      );
+    }
+    blank();
+    throw new Error(`OpenCode not running on port ${state.port}`);
+  }
+  if (!isOpenCodeInstalled()) {
+    if (!state.interactive) {
+      throw new Error("OpenCode is not installed. Install it with: npm install -g opencode");
+    }
+    const result = await promptOpenCodeInstall(true);
+    if (result === "exit") {
+      process.exit(0);
+    }
+    if (result === "installed" || isOpenCodeInstalled()) {
+    } else {
+      throw new Error("OpenCode is not installed");
+    }
+  }
+  if (state.interactive) {
+    let actualPort = state.port;
+    if (isPortInUse(state.port)) {
+      console.log(chalk5.yellow(`
+Port ${state.port} is already in use.`));
+      const alternativePort = findAvailablePort(state.port + 1);
+      if (alternativePort) {
+        const useAlternative = await select2({
+          message: `Use port ${alternativePort} instead?`,
+          choices: [
+            { name: `Yes, use port ${alternativePort}`, value: "yes" },
+            { name: "No, I will free the port manually", value: "no" }
+          ]
+        });
+        if (useAlternative === "yes") {
+          actualPort = alternativePort;
+          state.port = actualPort;
+        } else {
+          throw new Error(`Port ${state.port} is in use`);
+        }
       }
+    }
+    const action = await select2({
+      message: "OpenCode is not running. What would you like to do?",
+      choices: [
+        {
+          name: "Start OpenCode for me",
+          value: "start",
+          description: `Run 'opencode serve --port ${actualPort}'`
+        },
+        {
+          name: "Show me the command",
+          value: "manual",
+          description: "Display the command to run manually"
+        },
+        {
+          name: "Continue without OpenCode",
+          value: "continue",
+          description: "Requests will fail until OpenCode starts"
+        }
+      ]
+    });
+    if (action === "manual") {
       blank();
-    } else {
+      console.log(chalk5.bold("Run this command in another terminal:"));
       blank();
-      const action = await select({
-        message: "OpenCode is not running. What would you like to do?",
-        choices: [
-          {
-            name: "Start OpenCode for me",
-            value: "start",
-            description: `Run 'opencode serve --port ${port}' in a new process`
-          },
-          {
-            name: "Show me the command to run",
-            value: "manual",
-            description: "Display instructions for starting OpenCode manually"
-          },
-          {
-            name: "Continue without OpenCode",
-            value: "continue",
-            description: "Connect the tunnel anyway (requests will fail until OpenCode starts)"
-          }
-        ]
+      console.log(`  ${chalk5.cyan(`opencode serve --port ${actualPort}`)}`);
+      blank();
+      throw new Error("Please start OpenCode manually");
+    }
+    if (action === "start") {
+      const spinner = ora2("Starting OpenCode...").start();
+      state.opencodeProcess = await startOpenCode(actualPort);
+      const health = await waitForOpenCodeHealth(actualPort, 3e4);
+      if (!health.healthy) {
+        spinner.fail("Failed to start OpenCode");
+        throw new Error("OpenCode failed to start");
+      }
+      spinner.succeed(
+        `OpenCode running on port ${actualPort}${health.version ? ` (v${health.version})` : ""}`
+      );
+      state.opencodeConnected = true;
+      state.opencodeVersion = health.version ?? null;
+    }
+  } else {
+    throw new Error(
+      `OpenCode is not running on port ${state.port}. Start it with: opencode serve --port ${state.port}`
+    );
+  }
+}
+var AUTH_EXPIRED_EXIT_CODE = 77;
+async function handleAuthError(state, error2) {
+  logActivity(state, {
+    type: "error",
+    error: error2.message
+  });
+  if (state.interactive) displayStatus(state);
+  if (!state.interactive) {
+    blank();
+    console.log(chalk5.red("Authentication expired"));
+    console.log(chalk5.dim("Your authentication token is no longer valid."));
+    blank();
+    console.log(chalk5.dim("To fix this:"));
+    console.log(chalk5.dim(`  1. Run '${getCliName()} login' to re-authenticate`));
+    console.log(chalk5.dim("  2. Restart this command"));
+    blank();
+    await cleanup(state);
+    await shutdownTelemetry();
+    process.exit(AUTH_EXPIRED_EXIT_CODE);
+    return { success: false };
+  }
+  blank();
+  console.log(chalk5.yellow("Your authentication has expired."));
+  blank();
+  try {
+    const credentials2 = await promptForLogin(
+      "Would you like to log in again?",
+      "Re-authenticated successfully! Resuming..."
+    );
+    const newAuthHeader = getAuthHeader(credentials2);
+    return { success: true, newAuthHeader };
+  } catch {
+    return { success: false };
+  }
+}
+function isNetworkError(error2) {
+  if (error2 instanceof Error) {
+    const message = error2.message.toLowerCase();
+    return message.includes("fetch failed") || message.includes("network") || message.includes("econnrefused") || message.includes("econnreset") || message.includes("etimedout") || message.includes("socket hang up");
+  }
+  return false;
+}
+async function processQueue(state, authHeader, triggerReconnect) {
+  let idleStart = null;
+  let currentAuthHeader = authHeader;
+  while (state.running) {
+    if (state.reconnecting && state.reconnectPromise) {
+      logActivity(state, {
+        type: "info",
+        message: "Waiting for tunnel reconnection..."
       });
-      if (action === "start") {
-        let actualPort = port;
-        if (isPortInUse(port)) {
-          console.log(chalk4.yellow(`
-Port ${port} is already in use by another process.`));
-          const alternativePort = findAvailablePort(port + 1);
-          if (alternativePort) {
-            const useAlternative = await select({
-              message: `Would you like to use port ${alternativePort} instead?`,
-              choices: [
-                { name: `Yes, use port ${alternativePort}`, value: "yes" },
-                { name: "No, I will free up the port manually", value: "no" }
-              ]
-            });
-            if (useAlternative === "yes") {
-              actualPort = alternativePort;
-            } else {
-              console.log(chalk4.dim(`
-Free up port ${port} and run the tunnel command again.`));
-              blank();
-              process.exit(1);
-            }
-          } else {
-            console.log(
-              chalk4.red(
-                `Could not find an available port. Please free up port ${port} and try again.`
-              )
+      if (state.interactive) displayStatus(state);
+      await state.reconnectPromise;
+    }
+    try {
+      const conversations = await getPendingConversations(
+        state.agentId,
+        currentAuthHeader,
+        state.conversationFilter ?? void 0
+      );
+      state.consecutiveFetchFailures = 0;
+      if (conversations.length > 0) {
+        idleStart = null;
+        for (const conv of conversations) {
+          if (!state.running) break;
+          if (!state.lockedConversations.has(conv.id)) {
+            const lockResult = await acquireConversationLock(
+              state.agentId,
+              conv.id,
+              state.lockCorrelationId,
+              currentAuthHeader
             );
-            blank();
-            process.exit(1);
-          }
-        }
-        const opencodeStartSpinner = ora2(`Starting OpenCode on port ${actualPort}...`).start();
-        try {
-          let command = "opencode";
-          let args = ["serve", "--port", actualPort.toString()];
-          try {
-            execSync("which opencode", { stdio: "ignore" });
-          } catch {
-            command = "npx";
-            args = ["opencode", "serve", "--port", actualPort.toString()];
+            if (!lockResult.acquired) {
+              logActivity(state, {
+                type: "info",
+                message: `Conversation ${conv.id.slice(0, 8)} locked by another runner \u2014 skipping`
+              });
+              if (state.interactive) displayStatus(state);
+              continue;
+            }
+            state.lockedConversations.add(conv.id);
+            logActivity(state, {
+              type: "info",
+              message: `Lock acquired on conversation ${conv.id.slice(0, 8)}`
+            });
           }
-          const child = spawn(command, args, {
-            detached: true,
-            stdio: "ignore",
-            cwd: process.cwd()
-            // Start in current working directory
+          logActivity(state, {
+            type: "info",
+            message: `Processing conversation ${conv.id.slice(0, 8)}... (${conv.pending_message_count} pending)`
           });
-          child.unref();
-          const maxRetries = 10;
-          const retryDelayMs = 1e3;
-          let healthy = false;
-          let version;
-          for (let i = 0; i < maxRetries; i++) {
-            await sleep(retryDelayMs);
-            const retryHealth = await checkOpenCodeHealth(actualPort);
-            if (retryHealth.healthy) {
-              healthy = true;
-              version = retryHealth.version;
-              break;
+          if (state.interactive) displayStatus(state);
+          let sessionId = state.sessions.get(conv.id);
+          if (!sessionId) {
+            if (conv.opencode_session_id) {
+              sessionId = conv.opencode_session_id;
+            } else {
+              sessionId = await createOpenCodeSession(state.port);
+              await updateConversationSession(state.agentId, conv.id, sessionId, currentAuthHeader);
+              logActivity(state, {
+                type: "info",
+                message: `Created session ${sessionId.slice(0, 8)}`
+              });
             }
-            opencodeStartSpinner.text = `Starting OpenCode on port ${actualPort}... (${i + 1}/${maxRetries})`;
+            state.sessions.set(conv.id, sessionId);
           }
-          if (healthy) {
-            state.opencodeConnected = true;
-            state.opencodeVersion = version ?? null;
-            const versionStr = version ? ` (v${version})` : "";
-            opencodeStartSpinner.succeed(`OpenCode started on port ${actualPort}${versionStr}`);
+          const messages = await getPendingMessages(state.agentId, conv.id, currentAuthHeader);
+          for (const message of messages) {
+            if (!state.running) break;
             logActivity(state, {
               type: "info",
-              message: `OpenCode started on port ${actualPort}${versionStr}`
+              message: `Processing message ${message.id.slice(0, 8)}...`
             });
-          } else {
-            opencodeStartSpinner.warn(
-              "OpenCode process started but not responding. Check if it started correctly."
+            if (state.interactive) displayStatus(state);
+            const claimed = await markMessageProcessing(
+              state.agentId,
+              conv.id,
+              message.id,
+              currentAuthHeader
             );
+            if (!claimed) {
+              logActivity(state, {
+                type: "info",
+                message: `Message ${message.id.slice(0, 8)} already claimed`
+              });
+              continue;
+            }
+            emitAgentMessageProcessing(state.agentId, {
+              message_id: message.id,
+              conversation_id: conv.id
+            });
+            try {
+              const result = await sendMessageToOpenCode(
+                state.port,
+                sessionId,
+                message.content,
+                {
+                  agent: message.opencode_agent ?? void 0,
+                  model: message.opencode_model ?? void 0
+                },
+                {
+                  onQuestion: async (question) => {
+                    try {
+                      await reportInteractiveEvent(
+                        state.agentId,
+                        conv.id,
+                        "question",
+                        question,
+                        currentAuthHeader
+                      );
+                      logActivity(state, {
+                        type: "info",
+                        message: `Question surfaced to user (id: ${question.id.slice(0, 8)})`
+                      });
+                    } catch (err) {
+                      logActivity(state, {
+                        type: "error",
+                        error: `Failed to surface question: ${err}`
+                      });
+                    }
+                  },
+                  onPermission: async (permission) => {
+                    try {
+                      await reportInteractiveEvent(
+                        state.agentId,
+                        conv.id,
+                        "permission",
+                        permission,
+                        currentAuthHeader
+                      );
+                      logActivity(state, {
+                        type: "info",
+                        message: `Permission request surfaced to user (id: ${permission.id.slice(0, 8)})`
+                      });
+                    } catch (err) {
+                      logActivity(state, {
+                        type: "error",
+                        error: `Failed to surface permission: ${err}`
+                      });
+                    }
+                  }
+                }
+              );
+              if (result.title) {
+                try {
+                  await updateConversationTitle(
+                    state.agentId,
+                    conv.id,
+                    result.title,
+                    currentAuthHeader
+                  );
+                } catch {
+                }
+              }
+              await markMessageDone(
+                state.agentId,
+                conv.id,
+                message.id,
+                currentAuthHeader,
+                sessionId
+              );
+              state.messageCount++;
+              logActivity(state, {
+                type: "info",
+                message: `Message ${message.id.slice(0, 8)} processed`
+              });
+              emitAgentMessageDone(state.agentId, {
+                message_id: message.id,
+                conversation_id: conv.id
+              });
+            } catch (error2) {
+              if (error2 instanceof AuthenticationError) {
+                throw error2;
+              }
+              await markMessageFailed(state.agentId, conv.id, message.id, currentAuthHeader);
+              logActivity(state, {
+                type: "error",
+                error: `Message ${message.id.slice(0, 8)} failed: ${error2}`
+              });
+              emitAgentMessageFailed(state.agentId, {
+                message_id: message.id,
+                conversation_id: conv.id,
+                error: String(error2)
+              });
+            }
+            if (state.interactive) displayStatus(state);
+          }
+        }
+      } else {
+        if (state.idleTimeout !== null) {
+          if (idleStart === null) {
+            idleStart = Date.now();
             logActivity(state, {
               type: "info",
-              message: "OpenCode may still be starting..."
+              message: `Queue empty, waiting (timeout: ${state.idleTimeout}s)...`
             });
-            console.log(chalk4.dim("\nTip: Check for errors by running OpenCode manually:"));
-            console.log(chalk4.dim(`  opencode serve --port ${actualPort}`));
-            blank();
+            if (state.interactive) displayStatus(state);
           }
-        } catch (error2) {
-          const msg = error2 instanceof Error ? error2.message : "Unknown error";
-          opencodeStartSpinner.fail(`Failed to start OpenCode: ${msg}`);
+          if (Date.now() - idleStart > state.idleTimeout * 1e3) {
+            logActivity(state, {
+              type: "info",
+              message: "Idle timeout reached"
+            });
+            if (state.interactive) displayStatus(state);
+            break;
+          }
+        }
+      }
+      await new Promise((resolve) => setTimeout(resolve, MESSAGE_POLL_INTERVAL_MS));
+    } catch (error2) {
+      if (error2 instanceof AuthenticationError) {
+        const result = await handleAuthError(state, error2);
+        if (result.success && result.newAuthHeader) {
+          currentAuthHeader = result.newAuthHeader;
+          state.authHeader = result.newAuthHeader;
           logActivity(state, {
-            type: "error",
-            error: `Failed to start OpenCode: ${msg}`
+            type: "info",
+            message: "Continuing with new credentials..."
           });
-          console.log(chalk4.yellow("\nYou can try starting it manually:"));
-          console.log(chalk4.dim(`  opencode serve --port ${actualPort}`));
-          blank();
+          if (state.interactive) displayStatus(state);
+          continue;
+        } else {
+          state.running = false;
+          break;
+        }
+      }
+      const errorMessage = error2 instanceof Error ? error2.message : String(error2);
+      logActivity(state, {
+        type: "error",
+        error: `Queue processing error: ${errorMessage}`
+      });
+      if (state.interactive) displayStatus(state);
+      if (isNetworkError(error2)) {
+        state.consecutiveFetchFailures++;
+        if (state.consecutiveFetchFailures >= MAX_CONSECUTIVE_FETCH_FAILURES) {
+          logActivity(state, {
+            type: "info",
+            message: `Detected ${state.consecutiveFetchFailures} consecutive fetch failures, triggering reconnection...`
+          });
+          if (state.interactive) displayStatus(state);
+          await triggerReconnect();
+          state.consecutiveFetchFailures = 0;
         }
-      } else if (action === "manual") {
-        blank();
-        console.log(chalk4.yellow("To start OpenCode, run one of these commands:"));
-        blank();
-        console.log(chalk4.dim("  # Start OpenCode in your project directory:"));
-        console.log(chalk4.dim(`  opencode serve --port ${port}`));
-        blank();
-        console.log(chalk4.dim("  # Or if you have OpenCode installed globally:"));
-        console.log(chalk4.dim(`  npx opencode serve --port ${port}`));
-        blank();
-        console.log(
-          chalk4.dim("The tunnel will automatically forward requests once OpenCode is running.")
-        );
-        blank();
       }
+      await new Promise((resolve) => setTimeout(resolve, MESSAGE_POLL_INTERVAL_MS));
     }
   }
-  while (true) {
-    try {
-      await connect(credentials.token, sandboxId, port, state);
-      state.reconnectAttempt++;
-      const delay = getReconnectDelay(state.reconnectAttempt);
+}
+async function cleanup(state, authHeader) {
+  state.running = false;
+  if (state.lockHeartbeatTimer) {
+    clearInterval(state.lockHeartbeatTimer);
+    state.lockHeartbeatTimer = null;
+  }
+  if (authHeader && state.lockedConversations.size > 0) {
+    for (const convId of state.lockedConversations) {
+      await releaseConversationLock(state.agentId, convId, state.lockCorrelationId, authHeader);
+    }
+    if (state.interactive) {
       logActivity(state, {
         type: "info",
-        message: `Reconnecting in ${Math.round(delay / 1e3)}s (attempt ${state.reconnectAttempt})...`
+        message: `Released ${state.lockedConversations.size} lock(s)`
       });
-      telemetry.info(
-        EventTypes.TUNNEL_RECONNECTING,
-        `Reconnecting (attempt ${state.reconnectAttempt})`,
-        {
-          attempt: state.reconnectAttempt,
-          delayMs: delay
-        },
-        state.sandboxId ?? void 0
-      );
       displayStatus(state);
-      await sleep(delay);
-    } catch (error2) {
-      const message = error2 instanceof Error ? error2.message : "Unknown error";
-      if (message === "Unauthorized") {
-        telemetry.error(
-          EventTypes.CLI_ERROR,
-          "Authentication failed",
-          {
-            command: "tunnel",
-            error: message
-          },
-          state.sandboxId ?? void 0
-        );
-        await shutdownTelemetry();
-        displayError(state, "Authentication failed", "Please run `evident login` again.");
+    } else {
+      log(state, `Released ${state.lockedConversations.size} lock(s)`);
+    }
+    state.lockedConversations.clear();
+  }
+  if (state.tunnelConnection) {
+    state.tunnelConnection.close();
+    state.tunnelConnection = null;
+  }
+  if (state.opencodeProcess) {
+    stopOpenCode(state.opencodeProcess);
+    if (state.interactive) {
+      logActivity(state, { type: "info", message: "Stopped OpenCode process" });
+      displayStatus(state);
+    } else {
+      log(state, "Stopped OpenCode process");
+    }
+    state.opencodeProcess = null;
+  }
+}
+async function run(options) {
+  const interactive = isInteractive(options.json);
+  const state = {
+    agentId: options.agent || "",
+    agentName: null,
+    port: options.port ?? 4096,
+    verbose: options.verbose ?? false,
+    conversationFilter: options.conversation ?? null,
+    idleTimeout: options.idleTimeout ?? null,
+    json: options.json ?? false,
+    interactive,
+    connected: false,
+    opencodeConnected: false,
+    opencodeVersion: null,
+    reconnectAttempt: 0,
+    opencodeProcess: null,
+    tunnelConnection: null,
+    running: true,
+    activityLog: [],
+    displayInitialized: false,
+    lastActivity: /* @__PURE__ */ new Date(),
+    pendingRequests: /* @__PURE__ */ new Map(),
+    sessions: /* @__PURE__ */ new Map(),
+    messageCount: 0,
+    lockCorrelationId: `cli-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+    lockedConversations: /* @__PURE__ */ new Set(),
+    lockHeartbeatTimer: null,
+    consecutiveFetchFailures: 0,
+    reconnecting: false,
+    reconnectPromise: null,
+    authHeader: ""
+  };
+  if (state.idleTimeout === null && (process.env.GITHUB_ACTIONS || process.env.CI)) {
+    log(
+      state,
+      "Warning: No --idle-timeout set in CI environment. The runner will poll indefinitely until the job times out. Consider adding --idle-timeout 30 to avoid wasting runner minutes.",
+      false
+    );
+  }
+  const handleSignal = async () => {
+    if (state.interactive) {
+      logActivity(state, { type: "info", message: "Shutting down..." });
+      displayStatus(state);
+    } else {
+      log(state, "Shutting down...");
+    }
+    await cleanup(state, state.authHeader);
+    await shutdownTelemetry();
+    process.exit(0);
+  };
+  process.on("SIGINT", handleSignal);
+  process.on("SIGTERM", handleSignal);
+  try {
+    let credentials2 = await getAuthCredentials();
+    if (!credentials2) {
+      if (!interactive) {
+        printError("Authentication required");
+        blank();
+        console.log(chalk5.dim("Set EVIDENT_AGENT_KEY environment variable for CI"));
+        console.log(chalk5.dim("Or run `evident login` for interactive authentication"));
+        blank();
         process.exit(1);
       }
-      logActivity(state, {
-        type: "error",
-        error: message
-      });
-      telemetry.error(
-        EventTypes.TUNNEL_ERROR,
-        `Tunnel error: ${message}`,
-        {
-          error: message,
-          attempt: state.reconnectAttempt
-        },
-        state.sandboxId ?? void 0
+      blank();
+      console.log(chalk5.yellow("You are not logged in to Evident."));
+      blank();
+      credentials2 = await promptForLogin(
+        "Would you like to log in now?",
+        "Login successful! Continuing..."
       );
-      state.reconnectAttempt++;
-      const delay = getReconnectDelay(state.reconnectAttempt);
-      logActivity(state, {
-        type: "info",
-        message: `Reconnecting in ${Math.round(delay / 1e3)}s (attempt ${state.reconnectAttempt})...`
-      });
+    }
+    state.authHeader = getAuthHeader(credentials2);
+    if (!state.agentId) {
+      if (credentials2.authType === "agent_key") {
+        const resolved = await resolveAgentIdFromKey(state.authHeader);
+        if (resolved.agent_id) {
+          state.agentId = resolved.agent_id;
+          log(state, `Resolved agent ID from key: ${state.agentId}`);
+        } else {
+          printError(resolved.error || "Failed to resolve agent ID from key");
+          process.exit(1);
+        }
+      } else {
+        printError("--agent is required when not using EVIDENT_AGENT_KEY");
+        blank();
+        console.log(chalk5.dim("Either provide --agent <id> or set EVIDENT_AGENT_KEY"));
+        blank();
+        process.exit(1);
+      }
+    }
+    telemetry.info(
+      EventTypes.CLI_COMMAND,
+      "Starting run command",
+      {
+        command: "run",
+        agentId: state.agentId,
+        port: state.port,
+        conversationFilter: state.conversationFilter,
+        interactive
+      },
+      state.agentId
+    );
+    if (interactive && !state.json) {
+      blank();
+      console.log(chalk5.bold("Evident Run"));
+      console.log(chalk5.dim("-".repeat(40)));
+    }
+    const spinner = interactive && !state.json ? ora2("Validating agent...").start() : null;
+    let validation = await getAgentInfo(state.agentId, state.authHeader);
+    if (!validation.valid && validation.authFailed && interactive) {
+      spinner?.fail("Authentication failed");
+      blank();
+      console.log(chalk5.yellow("Your authentication token is invalid or expired."));
+      blank();
+      credentials2 = await promptForLogin(
+        "Would you like to log in again?",
+        "Login successful! Retrying..."
+      );
+      state.authHeader = getAuthHeader(credentials2);
+      spinner?.start("Validating agent...");
+      validation = await getAgentInfo(state.agentId, state.authHeader);
+    }
+    if (!validation.valid) {
+      spinner?.fail(`Agent validation failed: ${validation.error}`);
+      throw new Error(validation.error);
+    }
+    spinner?.succeed(`Agent: ${validation.agent.name || state.agentId}`);
+    state.agentName = validation.agent.name;
+    const ocSpinner = interactive && !state.json ? ora2("Checking OpenCode...").start() : null;
+    try {
+      await ensureOpenCodeRunning(state);
+      const version = state.opencodeVersion ? ` (v${state.opencodeVersion})` : "";
+      ocSpinner?.succeed(`OpenCode running on port ${state.port}${version}`);
+    } catch (error2) {
+      ocSpinner?.fail(error2.message);
+      throw error2;
+    }
+    const tunnelSpinner = interactive && !state.json ? ora2("Connecting tunnel...").start() : null;
+    const connectWithRetry = async (isReconnect = false) => {
+      if (isReconnect && state.reconnecting) {
+        return;
+      }
+      state.reconnecting = true;
+      if (state.tunnelConnection) {
+        try {
+          state.tunnelConnection.close();
+        } catch {
+        }
+        state.tunnelConnection = null;
+      }
+      while (state.running) {
+        try {
+          state.tunnelConnection = await connectTunnel({
+            agentId: state.agentId,
+            authHeader: state.authHeader,
+            port: state.port,
+            onConnected: (agentId) => {
+              state.connected = true;
+              state.reconnectAttempt = 0;
+              state.reconnecting = false;
+              state.consecutiveFetchFailures = 0;
+              state.agentId = agentId;
+              logActivity(state, {
+                type: "info",
+                message: isReconnect ? `Tunnel reconnected (agent: ${agentId})` : `Tunnel connected (agent: ${agentId})`
+              });
+              emitAgentConnected(state.agentId, { port: state.port });
+              if (state.interactive) displayStatus(state);
+            },
+            onDisconnected: (code, reason) => {
+              state.connected = false;
+              logActivity(state, {
+                type: "info",
+                message: `Tunnel disconnected (code: ${code}, reason: ${reason})`
+              });
+              emitAgentDisconnected(state.agentId, { code, reason });
+              if (state.interactive) displayStatus(state);
+              if (state.running && code !== 1e3 && !state.reconnecting) {
+                logActivity(state, {
+                  type: "info",
+                  message: "Attempting automatic reconnection..."
+                });
+                if (state.interactive) displayStatus(state);
+                state.reconnectPromise = connectWithRetry(true).catch((err) => {
+                  logActivity(state, {
+                    type: "error",
+                    error: `Reconnection failed: ${err.message}`
+                  });
+                  if (state.interactive) displayStatus(state);
+                });
+              }
+            },
+            onError: (error2) => {
+              logActivity(state, { type: "error", error: error2 });
+              if (state.interactive) displayStatus(state);
+            },
+            onRequest: (method, path, requestId) => {
+              state.pendingRequests.set(requestId, {
+                startTime: Date.now(),
+                method,
+                path
+              });
+              logActivity(state, { type: "request", method, path, requestId });
+              if (state.interactive) displayStatus(state);
+            },
+            onResponse: (status, durationMs, requestId) => {
+              const pending = state.pendingRequests.get(requestId);
+              state.pendingRequests.delete(requestId);
+              state.opencodeConnected = true;
+              const lastEntry = state.activityLog[state.activityLog.length - 1];
+              if (lastEntry && lastEntry.requestId === requestId) {
+                lastEntry.type = "response";
+                lastEntry.status = status;
+                lastEntry.durationMs = durationMs;
+              } else if (pending) {
+                logActivity(state, {
+                  type: "response",
+                  method: pending.method,
+                  path: pending.path,
+                  status,
+                  durationMs,
+                  requestId
+                });
+              }
+              if (state.interactive) displayStatus(state);
+            },
+            onInfo: (message) => {
+              logActivity(state, { type: "info", message });
+              if (state.interactive) displayStatus(state);
+            }
+          });
+          if (!isReconnect) {
+            tunnelSpinner?.succeed("Tunnel connected");
+          }
+          return;
+        } catch (error2) {
+          state.reconnectAttempt++;
+          const delay = getReconnectDelay(state.reconnectAttempt);
+          if (error2.message === "Unauthorized") {
+            state.reconnecting = false;
+            if (!isReconnect) {
+              tunnelSpinner?.fail("Unauthorized");
+            }
+            throw error2;
+          }
+          logActivity(state, {
+            type: "error",
+            error: `Connection failed, retrying in ${Math.round(delay / 1e3)}s...`
+          });
+          if (state.interactive) displayStatus(state);
+          await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+      }
+      state.reconnecting = false;
+    };
+    const triggerReconnect = async () => {
+      if (!state.reconnecting) {
+        state.reconnectPromise = connectWithRetry(true).catch((err) => {
+          logActivity(state, {
+            type: "error",
+            error: `Reconnection failed: ${err.message}`
+          });
+          if (state.interactive) displayStatus(state);
+        });
+      }
+      if (state.reconnectPromise) {
+        await state.reconnectPromise;
+      }
+    };
+    await connectWithRetry(false);
+    state.lockHeartbeatTimer = setInterval(async () => {
+      for (const convId of state.lockedConversations) {
+        const extended = await extendConversationLock(
+          state.agentId,
+          convId,
+          state.lockCorrelationId,
+          state.authHeader
+        );
+        if (!extended) {
+          logActivity(state, {
+            type: "error",
+            error: `Failed to extend lock on conversation ${convId.slice(0, 8)}`
+          });
+          state.lockedConversations.delete(convId);
+        }
+      }
+    }, LOCK_HEARTBEAT_INTERVAL_MS);
+    if (interactive && !state.json) {
       displayStatus(state);
-      await sleep(delay);
+    } else {
+      log(state, "Processing queue...");
+    }
+    await processQueue(state, state.authHeader, triggerReconnect);
+    await cleanup(state, state.authHeader);
+    if (state.json) {
+      console.log(
+        JSON.stringify({
+          status: "success",
+          messages_processed: state.messageCount
+        })
+      );
+    } else if (!interactive) {
+      log(state, `Completed. Processed ${state.messageCount} message(s).`);
+    }
+    await shutdownTelemetry();
+    process.exit(0);
+  } catch (error2) {
+    await cleanup(state, state.authHeader);
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    if (state.json) {
+      console.log(JSON.stringify({ status: "error", error: message }));
+    } else {
+      printError(message);
     }
+    telemetry.error(EventTypes.CLI_ERROR, `Run command failed: ${message}`, {
+      command: "run",
+      agentId: options.agent
+    });
+    await shutdownTelemetry();
+    process.exit(1);
   }
 }
 
@@ -1591,12 +2525,17 @@ program.name("evident").description("Run OpenCode locally and connect it to Evid
 program.command("login").description("Authenticate with Evident").option("--token", "Use token-based authentication (for CI/CD)").option("--no-browser", "Do not open the browser automatically").action(login);
 program.command("logout").description("Remove stored credentials").action(logout);
 program.command("whoami").description("Show the currently logged in user").action(whoami);
-program.command("tunnel").description("Establish a tunnel to Evident for Local Mode").requiredOption("-s, --sandbox <id>", "Sandbox ID to connect to (required)").option("-p, --port <port>", "OpenCode port (default: 4096)", "4096").option("-v, --verbose", "Show detailed request/response information").action((options) => {
-  tunnel({
-    sandbox: options.sandbox,
-    port: parseInt(options.port, 10),
-    verbose: options.verbose
-  });
-});
+program.command("run").description("Connect to Evident and process messages").requiredOption("-a, --agent <id>", "Agent ID to connect to").option("-p, --port <port>", "OpenCode port (default: 4096)", "4096").option("-v, --verbose", "Show detailed request/response information").option("-c, --conversation <id>", "Process only this specific conversation").option("--idle-timeout <seconds>", "Exit after N seconds idle").option("--json", "Output in JSON format").action(
+  (options) => {
+    run({
+      agent: options.agent,
+      port: parseInt(options.port, 10),
+      verbose: options.verbose,
+      conversation: options.conversation,
+      idleTimeout: options.idleTimeout ? parseInt(options.idleTimeout, 10) : void 0,
+      json: options.json
+    });
+  }
+);
 program.parse();
 //# sourceMappingURL=index.js.map