@evident-ai/cli 3.1.0 → 3.1.1-dev.098bf94

package/dist/index.js

@@ -267,16 +267,28 @@ async function getToken() {
   }
   return null;
 }
+function toError(err) {
+  return err instanceof Error ? err : new Error(String(err));
+}
 async function deleteToken(options = {}) {
   const keytar = await getKeytar();
+  const failures = [];
   if (keytar) {
     if (options.all) {
-      const all = await keytar.findCredentials(SERVICE_NAME).catch(() => []);
+      let accounts = [];
+      try {
+        accounts = await keytar.findCredentials(SERVICE_NAME);
+      } catch (err) {
+        failures.push({ type: "enumerate", error: toError(err) });
+      }
       await Promise.all(
-        all.map(
-          (entry) => keytar.deletePassword(SERVICE_NAME, entry.account).catch(() => {
-          })
-        )
+        accounts.map(async (entry) => {
+          try {
+            await keytar.deletePassword(SERVICE_NAME, entry.account);
+          } catch (err) {
+            failures.push({ type: "delete", account: entry.account, error: toError(err) });
+          }
+        })
       );
     } else {
       await keytar.deletePassword(SERVICE_NAME, keychainAccount());
@@ -287,6 +299,7 @@ async function deleteToken(options = {}) {
   } else {
     clearCredentials();
   }
+  return { failures };
 }
 
 // src/utils/ui.ts
@@ -404,8 +417,10 @@ async function deviceFlowLogin(options) {
 }
 async function tokenLogin() {
   console.log("Token login mode.");
-  console.log("Run `evident login` on a machine with a browser to get a token.");
-  console.log("Manage or revoke existing tokens under Settings \u2192 CLI tokens.");
+  console.log("Create a token under Settings \u2192 CLI tokens in the dashboard, then paste it below.");
+  console.log(
+    "(Alternatively, run `evident login` on a machine with a browser, or set EVIDENT_TOKEN for CI.)"
+  );
   blank();
   process.stdout.write("Paste token: ");
   const token = await new Promise((resolve3) => {
@@ -429,13 +444,22 @@ async function tokenLogin() {
     printError("No token provided.");
     process.exit(1);
   }
+  await validateAndStoreToken(token);
+}
+async function validateAndStoreToken(token) {
   const spinner = ora("Validating token...").start();
   try {
-    const result = await api.post("/auth/token/validate", { token });
+    const result = await api.get("/me", {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!result.user) {
+      throw new Error(
+        "This token is not a user login (e.g. a runner key). Paste a CLI token instead."
+      );
+    }
     await storeToken({
       token,
-      user: result.user,
-      expiresAt: result.expires_at
+      user: { email: result.user.email }
     });
     spinner.stop();
     printSuccess(`Logged in as ${chalk2.bold(result.user.email)}`);
@@ -455,9 +479,22 @@ async function login(options) {
 }
 
 // src/commands/logout.ts
+function describeFailure(failure) {
+  if (failure.type === "enumerate") {
+    return `could not list stored keychain entries (${failure.error.message})`;
+  }
+  return `${failure.account} (${failure.error.message})`;
+}
 async function logout(options = {}) {
   if (options.all) {
-    await deleteToken({ all: true });
+    const result = await deleteToken({ all: true });
+    if (result.failures.length > 0) {
+      printError(
+        `Failed to fully clear your keychain: ${result.failures.map(describeFailure).join("; ")}. Your local credentials file was cleared, but stale keychain entries may remain \u2014 run \`evident logout --all\` again, or remove them manually from your OS keychain / credential manager.`
+      );
+      process.exitCode = 1;
+      return;
+    }
     printSuccess("Logged out of all endpoints.");
     return;
   }
@@ -482,7 +519,9 @@ async function whoami() {
   blank();
   console.log(keyValue("Endpoint", apiUrl));
   console.log(keyValue("User", chalk3.bold(credentials2.user.email)));
-  console.log(keyValue("User ID", credentials2.user.id));
+  if (credentials2.user.id) {
+    console.log(keyValue("User ID", credentials2.user.id));
+  }
   if (credentials2.expiresAt) {
     const expiresAt = new Date(credentials2.expiresAt);
     const now = /* @__PURE__ */ new Date();
@@ -498,9 +537,124 @@ async function whoami() {
   blank();
 }
 
+// src/lib/claude-usage.ts
+import { execFileSync } from "child_process";
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+var KEYCHAIN_SERVICE = "Claude Code-credentials";
+function parseClaudeCliCredentials(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const data = parsed.claudeAiOauth ?? parsed;
+  const creds = data;
+  if (typeof creds.accessToken !== "string" || typeof creds.expiresAt !== "number") {
+    return null;
+  }
+  return { accessToken: creds.accessToken, expiresAt: creds.expiresAt };
+}
+function readClaudeCliCredentials() {
+  if (process.platform === "darwin") {
+    try {
+      const raw = execFileSync(
+        "/usr/bin/security",
+        ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"],
+        { encoding: "utf-8", timeout: 2e3, stdio: ["pipe", "pipe", "ignore"] }
+      );
+      return parseClaudeCliCredentials(raw);
+    } catch {
+      return null;
+    }
+  }
+  try {
+    const raw = readFileSync(join(homedir(), ".claude", ".credentials.json"), "utf-8");
+    return parseClaudeCliCredentials(raw);
+  } catch {
+    return null;
+  }
+}
+var ClaudeUsageError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+};
+function isLocalCredentialProblem(err) {
+  return err instanceof ClaudeUsageError && (err.reason === "no_credentials" || err.reason === "credentials_expired");
+}
+function toWindow(value) {
+  if (!value || typeof value !== "object") {
+    return null;
+  }
+  const window = value;
+  if (typeof window.utilization !== "number" || typeof window.resets_at !== "string") {
+    return null;
+  }
+  return { utilization: window.utilization, resetsAt: window.resets_at };
+}
+async function getClaudeUsage() {
+  const credentials2 = readClaudeCliCredentials();
+  if (!credentials2) {
+    throw new ClaudeUsageError(
+      "No local Claude Code login found. Run `claude` once to sign in with your Claude subscription.",
+      "no_credentials"
+    );
+  }
+  if (credentials2.expiresAt < Date.now()) {
+    throw new ClaudeUsageError(
+      "Claude Code credentials have expired. Run `claude` to refresh them.",
+      "credentials_expired"
+    );
+  }
+  const res = await fetch(CLAUDE_USAGE_URL, {
+    headers: {
+      Authorization: `Bearer ${credentials2.accessToken}`,
+      "Content-Type": "application/json",
+      "anthropic-version": "2023-06-01"
+    }
+  });
+  if (!res.ok) {
+    throw new ClaudeUsageError(`Claude usage request failed: HTTP ${res.status}`, "request_failed");
+  }
+  const body = await res.json();
+  return {
+    fiveHour: toWindow(body.five_hour),
+    sevenDay: toWindow(body.seven_day)
+  };
+}
+
+// src/commands/claude-usage.ts
+function formatWindow(label, window) {
+  if (!window) {
+    return keyValue(label, "not available for this plan");
+  }
+  const resetsAt = new Date(window.resetsAt);
+  return keyValue(label, `${window.utilization}% used, resets ${resetsAt.toLocaleString()}`);
+}
+async function claudeUsage() {
+  try {
+    const usage = await getClaudeUsage();
+    blank();
+    console.log(formatWindow("5-hour session", usage.fiveHour));
+    console.log(formatWindow("7-day", usage.sevenDay));
+    blank();
+  } catch (err) {
+    if (err instanceof ClaudeUsageError) {
+      printError(err.message);
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+
 // src/commands/run.ts
-import { homedir as homedir2 } from "os";
-import { isAbsolute as isAbsolute2, join as join2, parse, resolve as resolvePath } from "path";
+import { homedir as homedir3 } from "os";
+import { isAbsolute as isAbsolute2, join as join3, parse, resolve as resolvePath } from "path";
 import chalk6 from "chalk";
 
 // ../../packages/types/src/telemetry/index.ts
@@ -510,7 +664,10 @@ var TelemetryEventTypes = {
   AGENT_DISCONNECTED: "agent.disconnected",
   AGENT_MESSAGE_PROCESSING: "agent.message_processing",
   AGENT_MESSAGE_DONE: "agent.message_done",
-  AGENT_MESSAGE_FAILED: "agent.message_failed"
+  AGENT_MESSAGE_FAILED: "agent.message_failed",
+  // A `warn`/`error` runner-side log line forwarded server-side for
+  // observability (issue #916) — see `apps/cli/src/lib/runner-activity-telemetry.ts`.
+  RUNNER_ACTIVITY: "runner.activity"
 };
 
 // ../../packages/types/src/tunnel/index.ts
@@ -565,6 +722,13 @@ var isShuttingDown = false;
 var FLUSH_INTERVAL_MS = 5e3;
 var MAX_BUFFER_SIZE = 50;
 var FLUSH_TIMEOUT_MS = 3e3;
+var authProvider = null;
+function setTelemetryAuthProvider(provider) {
+  authProvider = provider;
+}
+var FLUSH_FAILURE_LOG_INTERVAL_MS = 6e4;
+var lastFlushFailureLoggedAt = 0;
+var suppressedFlushFailureCount = 0;
 function logEvent(eventType, options = {}) {
   const event = {
     event_type: eventType,
@@ -599,9 +763,16 @@ async function flushEvents() {
     flushTimeout = null;
   }
   try {
-    const credentials2 = await getToken();
-    if (!credentials2) {
-      return;
+    const providerContext = authProvider?.();
+    let authHeader;
+    if (providerContext?.authHeader) {
+      authHeader = providerContext.authHeader;
+    } else {
+      const credentials2 = await getToken();
+      if (!credentials2) {
+        return;
+      }
+      authHeader = `Bearer ${credentials2.token}`;
     }
     const apiUrl = getApiUrlConfig();
     const controller = new AbortController();
@@ -616,7 +787,7 @@ async function flushEvents() {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${credentials2.token}`
+          Authorization: authHeader
         },
         body: JSON.stringify(request),
         signal: controller.signal
@@ -628,8 +799,15 @@ async function flushEvents() {
       clearTimeout(timeout);
     }
   } catch (error2) {
-    if (process.env.DEBUG) {
-      console.error("Telemetry error:", error2);
+    const now = Date.now();
+    if (now - lastFlushFailureLoggedAt >= FLUSH_FAILURE_LOG_INTERVAL_MS) {
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      const suffix = suppressedFlushFailureCount > 0 ? ` (${suppressedFlushFailureCount} more suppressed in the last ${FLUSH_FAILURE_LOG_INTERVAL_MS / 1e3}s)` : "";
+      console.error(`Telemetry flush error: ${message}${suffix}`);
+      lastFlushFailureLoggedAt = now;
+      suppressedFlushFailureCount = 0;
+    } else {
+      suppressedFlushFailureCount++;
     }
   }
 }
@@ -698,6 +876,69 @@ var EventTypes = {
   DEPRECATED_AGENT_KEY_ENV_USED: "cli.deprecated_agent_key_env_used"
 };
 
+// src/lib/runner-activity-telemetry.ts
+var FORWARDED_LEVELS = /* @__PURE__ */ new Set(["warn", "error"]);
+var SEVERITY_BY_LEVEL = {
+  warn: "warning",
+  error: "error"
+};
+var MAX_MESSAGE_LENGTH = 500;
+var TRUNCATION_MARKER = "\u2026";
+function redact(message) {
+  return message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/https?:\/\/\S+/g, "<url>");
+}
+function truncate(message) {
+  if (message.length <= MAX_MESSAGE_LENGTH) return message;
+  return message.slice(0, MAX_MESSAGE_LENGTH - TRUNCATION_MARKER.length) + TRUNCATION_MARKER;
+}
+var RATE_LIMIT_WINDOW_MS = 6e4;
+var RATE_LIMIT_MAX_EVENTS = 30;
+var windowStartedAt = 0;
+var windowCount = 0;
+var windowDroppedCount = 0;
+function admitUnderRateLimit(now) {
+  if (now - windowStartedAt >= RATE_LIMIT_WINDOW_MS) {
+    if (windowDroppedCount > 0) {
+      console.error(
+        `[runner-activity-telemetry] rate cap reached: dropped ${windowDroppedCount} ${windowDroppedCount === 1 ? "entry" : "entries"} in the last ${RATE_LIMIT_WINDOW_MS / 1e3}s (cap ${RATE_LIMIT_MAX_EVENTS}/min)`
+      );
+    }
+    windowStartedAt = now;
+    windowCount = 0;
+    windowDroppedCount = 0;
+  }
+  if (windowCount >= RATE_LIMIT_MAX_EVENTS) {
+    windowDroppedCount++;
+    if (windowDroppedCount === 1) {
+      console.error(
+        `[runner-activity-telemetry] rate cap reached (${RATE_LIMIT_MAX_EVENTS} per ${RATE_LIMIT_WINDOW_MS / 1e3}s) \u2014 dropping further entries this window`
+      );
+    }
+    return false;
+  }
+  windowCount++;
+  return true;
+}
+function forwardRunnerActivity(entry, context) {
+  try {
+    if (!FORWARDED_LEVELS.has(entry.level)) return;
+    if (!context.agentId || !context.authHeader) return;
+    if (!admitUnderRateLimit(Date.now())) return;
+    const rawMessage = entry.error ?? entry.message ?? "";
+    const message = truncate(redact(rawMessage));
+    logEvent(TelemetryEventTypes.RUNNER_ACTIVITY, {
+      severity: SEVERITY_BY_LEVEL[entry.level],
+      message,
+      metadata: { source: "cli.run" },
+      agentId: context.agentId
+    });
+  } catch (err) {
+    console.error(
+      `[runner-activity-telemetry] failed to forward runner activity: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+
 // src/lib/auth.ts
 async function getAuthCredentials() {
   const runnerKey = process.env.EVIDENT_RUNNER_KEY;
@@ -1548,6 +1789,42 @@ function messageError(messages, userMessageId) {
   }
   return "The agent run failed.";
 }
+function messageFailure(messages, userMessageId) {
+  const reply = findLastAssistantReplyFor(messages, userMessageId);
+  const error2 = errorOf(reply);
+  if (error2 == null || typeof error2 !== "object") return null;
+  const e = error2;
+  const replyProviderId = reply?.info?.providerID ?? null;
+  const replyModelId = reply?.info?.modelID ?? null;
+  if (e.name === "ProviderAuthError") {
+    const data = e.data;
+    const providerId = typeof data?.providerID === "string" && data.providerID || replyProviderId;
+    return { kind: "model_auth", providerId, modelId: replyModelId, reason: "missing" };
+  }
+  if (e.name === "APIError") {
+    const data = e.data;
+    const statusCode = data?.statusCode;
+    if (statusCode === 401 || statusCode === 403) {
+      return {
+        kind: "model_auth",
+        providerId: replyProviderId,
+        modelId: replyModelId,
+        reason: "rejected"
+      };
+    }
+  }
+  return null;
+}
+function applyZeroProviderFallback(classified, hasConfiguredProvider, replyProviderId, replyModelId = null) {
+  if (classified != null) return classified;
+  if (hasConfiguredProvider !== false) return null;
+  return {
+    kind: "model_auth",
+    providerId: replyProviderId,
+    modelId: replyModelId,
+    reason: "missing"
+  };
+}
 function hasRunningAssistantExcept(messages, exceptUserMessageId) {
   if (!messages || messages.length === 0) return false;
   return messages.some(
@@ -2076,13 +2353,52 @@ var RunnerConnection = class {
   }
 };
 
+// src/lib/tunnel/ready-marker.ts
+import { writeFileSync } from "fs";
+function writeTunnelReadyMarker(path, agentId) {
+  try {
+    writeFileSync(path, `${agentId}
+`);
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: error2 instanceof Error ? error2.message : String(error2) };
+  }
+}
+
+// src/lib/claude-usage-reporting.ts
+var VALID_MODES = ["auto", "on", "off"];
+function resolveClaudeUsageReportingMode(flagValue, env) {
+  const raw = flagValue ?? env.EVIDENT_CLAUDE_USAGE_REPORTING;
+  if (raw === void 0 || raw === "") {
+    return { mode: "auto", warnings: [] };
+  }
+  const normalized = raw.trim().toLowerCase();
+  if (VALID_MODES.includes(normalized)) {
+    return { mode: normalized, warnings: [] };
+  }
+  const source = flagValue !== void 0 ? "--claude-usage-reporting" : "EVIDENT_CLAUDE_USAGE_REPORTING";
+  return {
+    mode: "auto",
+    warnings: [
+      `Ignoring invalid ${source} "${raw}": expected one of ${VALID_MODES.join(", ")}; using auto`
+    ]
+  };
+}
+var BASE_REPORT_DELAY_MS = 10 * 6e4;
+var REPORT_DELAY_JITTER_FRACTION = 0.2;
+function nextReportDelayMs(random = Math.random) {
+  const jitterRangeMs = BASE_REPORT_DELAY_MS * REPORT_DELAY_JITTER_FRACTION;
+  return BASE_REPORT_DELAY_MS - jitterRangeMs + random() * (2 * jitterRangeMs);
+}
+var FIRST_REPORT_DELAY_MS = 5e3 + Math.random() * 1e4;
+
 // src/lib/channels/driver.ts
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 
 // src/lib/file-push.ts
 import { randomUUID } from "crypto";
 import { chmod, mkdir, open as open2, realpath, rename, unlink } from "fs/promises";
-import { basename, dirname as dirname2, isAbsolute, join, relative, resolve as resolve2, sep } from "path";
+import { basename, dirname as dirname2, isAbsolute, join as join2, relative, resolve as resolve2, sep } from "path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
 async function writePushedFile(request) {
@@ -2115,7 +2431,7 @@ async function writePushedFile(request) {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
       dirname2(candidate)
     );
-    const realTarget = join(existingAncestor, ...missingSegments, basename(candidate));
+    const realTarget = join2(existingAncestor, ...missingSegments, basename(candidate));
     const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
@@ -2151,7 +2467,7 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join2(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
@@ -2224,13 +2540,13 @@ function contains(realDirectory, realTarget) {
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join(current, segment);
+    current = join2(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join(dirname2(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join2(dirname2(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
     handle = await open2(temporaryPath, "wx", FILE_MODE);
@@ -2745,7 +3061,7 @@ var ChannelDriver = class _ChannelDriver {
     this.stuckQueuedMs = config2.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
     this.now = config2.now ?? (() => Date.now());
     this.fileSyncDirectories = config2.fileSyncDirectories ?? [];
-    this.homeDir = config2.homeDir ?? homedir();
+    this.homeDir = config2.homeDir ?? homedir2();
   }
   /** The IPv4-loopback base URL for the local `opencode serve`. */
   get opencodeBase() {
@@ -3130,7 +3446,12 @@ var ChannelDriver = class _ChannelDriver {
     const directory = await this.resolveOpenCodeDirectory();
     const sessionId = await createOpenCodeSession(this.port, directory);
     this.sessions.set(conversationId, sessionId);
-    await this.persistSession(conversationId, sessionId).catch(() => {
+    await this.persistSession(conversationId, sessionId).catch((err) => {
+      this.log({
+        level: "warn",
+        message: `Persisting the OpenCode session binding ${sessionId.slice(0, 8)} for conversation ${conversationId.slice(0, 8)} failed (best-effort, not retried) \u2014 the completion PATCH also carries opencode_session_id, so the binding is repaired when the turn finishes: ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conversationId
+      });
     });
     return sessionId;
   }
@@ -3586,8 +3907,16 @@ var ChannelDriver = class _ChannelDriver {
           message_id: inFlight.evidentMessageId
         });
         const usage = messageUsage(messages, inFlight.opencodeMessageId);
+        const failure = await this.classifyModelAuthFailure(messages, inFlight.opencodeMessageId);
         try {
-          await this.markFailed(conv.id, inFlight.evidentMessageId, sessionId, error2, usage);
+          await this.markFailed(
+            conv.id,
+            inFlight.evidentMessageId,
+            sessionId,
+            error2,
+            usage,
+            failure
+          );
         } catch (err) {
           if (err instanceof ChannelAuthError) throw err;
           if (err instanceof ChannelTerminalError) {
@@ -3968,6 +4297,7 @@ var ChannelDriver = class _ChannelDriver {
     if (state === "failed") {
       const error2 = messageError(messages, ocId ?? "") ?? void 0;
       const usage = messageUsage(messages, ocId ?? "");
+      const failure = await this.classifyModelAuthFailure(messages, ocId ?? "");
       this.log({
         level: "error",
         message: `Re-adopt: message ${row.id.slice(0, 8)} errored while unwatched \u2014 marking failed: ${error2 ?? "(no error text)"}`,
@@ -3975,7 +4305,7 @@ var ChannelDriver = class _ChannelDriver {
         message_id: row.id
       });
       try {
-        await this.markFailed(row.conversation_id, row.id, sessionId, error2, usage);
+        await this.markFailed(row.conversation_id, row.id, sessionId, error2, usage, failure);
       } catch (err) {
         if (err instanceof ChannelAuthError) throw err;
         if (err instanceof ChannelTerminalError) {
@@ -4953,7 +5283,7 @@ var ChannelDriver = class _ChannelDriver {
    *     exists but is wedged, so the next attempt must get a fresh one
    *     instead of reusing it — see WI-1's server-side null-clearing PATCH).
    */
-  async markFailed(conversationId, messageId, sessionId, error2, usage) {
+  async markFailed(conversationId, messageId, sessionId, error2, usage, failure) {
     const body = { status: "failed" };
     if (sessionId === null) {
       body.opencode_session_id = null;
@@ -4962,6 +5292,12 @@ var ChannelDriver = class _ChannelDriver {
     }
     if (error2 !== void 0) body.error = error2;
     if (usage) Object.assign(body, usage);
+    if (failure) {
+      body.failure_kind = failure.kind;
+      body.failure_provider_id = failure.providerId;
+      body.failure_model_id = failure.modelId;
+      body.failure_reason = failure.reason;
+    }
     await this.callWithRetry(
       "marking message as failed",
       () => this.fetchImpl(
@@ -4974,6 +5310,29 @@ var ChannelDriver = class _ChannelDriver {
       )
     );
   }
+  /**
+   * Classify an errored turn as a model-auth failure (#736 P1-4), for `markFailed`.
+   *
+   * `messageFailure` alone (structured OpenCode error → `model_auth`) covers
+   * most cases; when it returns `null` on this ALREADY-FAILED turn, fall back
+   * to the P1-2b zero-provider check — one extra loopback call to
+   * `hasAnyConfiguredProvider`, only reached when the structured classifier
+   * couldn't place it. Fails open (never throws): a fallback probe failure
+   * (`null`/indeterminate) leaves the classification `null`, which produces
+   * today's byte-identical PATCH body via `markFailed`'s `if (failure)` guard.
+   */
+  async classifyModelAuthFailure(messages, userMessageId) {
+    const classified = messageFailure(messages, userMessageId);
+    if (classified != null) return classified;
+    const reply = findLastAssistantReplyFor(messages, userMessageId);
+    const hasProvider = await hasAnyConfiguredProvider(this.port);
+    return applyZeroProviderFallback(
+      classified,
+      hasProvider,
+      reply?.info?.providerID ?? null,
+      reply?.info?.modelID ?? null
+    );
+  }
   /**
    * Best-effort, SINGLE-ATTEMPT runner→server telemetry ping
    * (queued-followup-redrive). `POST .../messages/:id/signal {signal, ...extra}`
@@ -5126,10 +5485,16 @@ var ChannelDriver = class _ChannelDriver {
 import chalk5 from "chalk";
 import ora2 from "ora";
 import { select as select2 } from "@inquirer/prompts";
+var INTERACTIVE_START_TIMEOUT_MS = 3e4;
 async function ensureOpenCodeRunning(ctx) {
   const healthCheck = await checkOpenCodeHealth(ctx.port);
   if (healthCheck.healthy) {
-    return { port: ctx.port, process: null, version: healthCheck.version ?? null };
+    return {
+      port: ctx.port,
+      process: null,
+      version: healthCheck.version ?? null,
+      notReadyReason: null
+    };
   }
   const runningInstances = await findHealthyOpenCodeInstances();
   if (runningInstances.length > 0) {
@@ -5150,7 +5515,7 @@ async function ensureOpenCodeRunning(ctx) {
       console.log(chalk5.yellow("Tip: Run with the correct port:"));
       console.log(
         chalk5.dim(
-          `  ${getCliName()} run --agent ${ctx.agentId} --port ${runningInstances[0].port}`
+          `  ${getCliName()} run --runner ${ctx.agentId} --port ${runningInstances[0].port}`
         )
       );
     }
@@ -5170,14 +5535,22 @@ async function ensureOpenCodeRunning(ctx) {
   if (!ctx.interactive) {
     ctx.log(`OpenCode is not running on port ${ctx.port}. Starting it automatically...`);
     const proc = await startOpenCode(ctx.port);
-    const health = await waitForOpenCodeHealth(ctx.port, 3e4);
+    const health = await waitForOpenCodeHealth(ctx.port, ctx.startTimeoutMs);
     if (!health.healthy) {
-      throw new Error(
-        `OpenCode failed to start on port ${ctx.port}. Install with: npm install -g opencode-ai`
-      );
+      return {
+        port: ctx.port,
+        process: proc,
+        version: null,
+        notReadyReason: `it did not become healthy within ${Math.round(ctx.startTimeoutMs / 1e3)}s`
+      };
     }
     ctx.log(`OpenCode started on port ${ctx.port}${health.version ? ` (v${health.version})` : ""}`);
-    return { port: ctx.port, process: proc, version: health.version ?? null };
+    return {
+      port: ctx.port,
+      process: proc,
+      version: health.version ?? null,
+      notReadyReason: null
+    };
   }
   let port = ctx.port;
   if (isPortInUse(port)) {
@@ -5230,15 +5603,15 @@ Port ${port} is already in use.`));
   if (action === "start") {
     const spinner = ora2("Starting OpenCode...").start();
     const proc = await startOpenCode(port);
-    const health = await waitForOpenCodeHealth(port, 3e4);
+    const health = await waitForOpenCodeHealth(port, INTERACTIVE_START_TIMEOUT_MS);
     if (!health.healthy) {
       spinner.fail("Failed to start OpenCode");
       throw new Error("OpenCode failed to start");
     }
     spinner.stop();
-    return { port, process: proc, version: health.version ?? null };
+    return { port, process: proc, version: health.version ?? null, notReadyReason: null };
   }
-  return { port, process: null, version: null };
+  return { port, process: null, version: null, notReadyReason: "you chose to continue without it" };
 }
 
 // src/commands/agent-lookup.ts
@@ -5280,7 +5653,7 @@ async function resolveAgentIdFromKey(authHeader) {
       return { agent_id: data.agent_id };
     }
     return {
-      error: "Cannot resolve runner ID: auth type is not agent_key. Please provide --agent explicitly."
+      error: "Cannot resolve runner ID: auth type is not agent_key. Please provide --runner explicitly."
     };
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : "Unknown error";
@@ -5336,6 +5709,34 @@ async function reportMicrovmId(agentId, authHeader, microvmId) {
     return { ok: false, error: describeBestEffortError(error2) };
   }
 }
+function toReportedWindow(window) {
+  if (!window) return null;
+  return { utilization: window.utilization, resets_at: window.resetsAt };
+}
+async function reportClaudeUsage(agentId, authHeader, snapshot) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/claude-usage`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        five_hour: toReportedWindow(snapshot.fiveHour),
+        seven_day: toReportedWindow(snapshot.sevenDay)
+      }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
 async function getAgentInfo(agentId, authHeader) {
   const apiUrl = getApiUrlConfig();
   try {
@@ -5414,7 +5815,7 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join2(homeDir, trimmed.slice(2)) : trimmed;
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join3(homeDir, trimmed.slice(2)) : trimmed;
     if (!isAbsolute2(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
@@ -5435,6 +5836,35 @@ function resolveFileSyncDirectories(raw, homeDir) {
   }
   return directories;
 }
+var DEFAULT_OPENCODE_START_TIMEOUT_SECONDS = 180;
+var MAX_OPENCODE_START_TIMEOUT_SECONDS = 3600;
+var OPENCODE_START_TIMEOUT_ENV = "EVIDENT_OPENCODE_START_TIMEOUT";
+function resolveOpenCodeStartTimeoutMs(options, env = process.env) {
+  const defaultMs = DEFAULT_OPENCODE_START_TIMEOUT_SECONDS * 1e3;
+  let raw;
+  let source;
+  if (options.opencodeStartTimeout !== void 0) {
+    raw = options.opencodeStartTimeout;
+    source = "--opencode-start-timeout";
+  } else if (env[OPENCODE_START_TIMEOUT_ENV] !== void 0 && env[OPENCODE_START_TIMEOUT_ENV] !== "") {
+    raw = env[OPENCODE_START_TIMEOUT_ENV];
+    source = OPENCODE_START_TIMEOUT_ENV;
+  } else {
+    return { timeoutMs: defaultMs, warnings: [] };
+  }
+  const trimmed = raw.trim();
+  const seconds = Number(trimmed);
+  const isPositiveInteger = /^\d+$/.test(trimmed) && Number.isInteger(seconds) && seconds > 0;
+  if (!isPositiveInteger || seconds > MAX_OPENCODE_START_TIMEOUT_SECONDS) {
+    return {
+      timeoutMs: defaultMs,
+      warnings: [
+        `Ignoring invalid ${source} "${raw}": expected a positive integer number of seconds (at most ${MAX_OPENCODE_START_TIMEOUT_SECONDS}); using the default ${DEFAULT_OPENCODE_START_TIMEOUT_SECONDS}s`
+      ]
+    };
+  }
+  return { timeoutMs: seconds * 1e3, warnings: [] };
+}
 function meetsThreshold(state, level) {
   return LOG_LEVELS[level] >= LOG_LEVELS[state.logLevel];
 }
@@ -5456,6 +5886,10 @@ function log2(state, message, level = "info") {
 function logActivity(state, entry) {
   const level = entry.level ?? (entry.type === "error" ? "error" : "info");
   if (!meetsThreshold(state, level)) return;
+  forwardRunnerActivity(
+    { level, message: entry.message, error: entry.error },
+    { agentId: state.agentId, authHeader: state.authHeader }
+  );
   const fullEntry = {
     ...entry,
     level,
@@ -5693,6 +6127,94 @@ function scheduleSessionCleanup(state, driver, options) {
   );
   state.sessionCleanupTimers.push(interval, firstSweep);
 }
+function scheduleClaudeUsageReporting(state, options) {
+  const { mode, warnings } = resolveClaudeUsageReportingMode(
+    options.claudeUsageReporting,
+    process.env
+  );
+  for (const warning2 of warnings) {
+    logActivity(state, {
+      type: "info",
+      level: "warn",
+      message: `Claude usage reporting: ${warning2}`
+    });
+  }
+  if (mode === "off") {
+    logActivity(state, {
+      type: "info",
+      level: "debug",
+      message: "Claude usage reporting is off (--claude-usage-reporting off)"
+    });
+    return;
+  }
+  let consecutiveFailures = 0;
+  const scheduleNextTick = () => {
+    state.claudeUsageTimer = setTimeout(() => void tick(false), nextReportDelayMs());
+  };
+  const tick = async (isFirst) => {
+    try {
+      const usage = await getClaudeUsage();
+      const result = await reportClaudeUsage(state.agentId, state.authHeader, usage);
+      if (result.ok) {
+        if (consecutiveFailures > 0) {
+          logActivity(state, {
+            type: "info",
+            level: "info",
+            message: "Claude usage reporting recovered"
+          });
+        }
+        consecutiveFailures = 0;
+        logActivity(state, {
+          type: "info",
+          level: "debug",
+          message: "Reported Claude usage to Evident"
+        });
+      } else {
+        consecutiveFailures++;
+        logActivity(state, {
+          type: "info",
+          level: consecutiveFailures === 1 ? "warn" : "debug",
+          message: `Failed to report Claude usage: ${result.error}`
+        });
+      }
+      scheduleNextTick();
+    } catch (error2) {
+      if (error2 instanceof ClaudeUsageError && isLocalCredentialProblem(error2)) {
+        if (mode === "on") {
+          logActivity(state, {
+            type: "info",
+            level: "warn",
+            message: "Claude usage reporting is forced on but no usable Claude Code login was found \u2014 run `claude` to sign in; reporting will keep retrying"
+          });
+          scheduleNextTick();
+        } else if (isFirst) {
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: `Claude usage reporting: ${error2.message}`
+          });
+        } else {
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: `Claude usage reporting: ${error2.message}`
+          });
+          scheduleNextTick();
+        }
+      } else {
+        consecutiveFailures++;
+        const message = error2 instanceof Error ? error2.message : String(error2);
+        logActivity(state, {
+          type: "info",
+          level: consecutiveFailures === 1 ? "warn" : "debug",
+          message: `Claude usage reporting failed: ${message}`
+        });
+        scheduleNextTick();
+      }
+    }
+  };
+  state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+}
 async function notifyOffline(state) {
   if (!state.agentId || !state.authHeader) return;
   if (!state.connected) {
@@ -5728,6 +6250,10 @@ async function cleanup(state, opts = {}) {
     clearTimeout(timer);
   }
   state.sessionCleanupTimers = [];
+  if (state.claudeUsageTimer) {
+    clearTimeout(state.claudeUsageTimer);
+    state.claudeUsageTimer = null;
+  }
   if (opts.graceful && state.channelDriver) {
     state.channelDriver.stop();
     log2(state, "Draining in-flight channel work before shutdown...");
@@ -5775,7 +6301,7 @@ async function run(options) {
   let fileSyncDirectories;
   try {
     logLevel = resolveLogLevel(options);
-    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir2());
+    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir3());
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     if (options.json) {
@@ -5808,8 +6334,10 @@ async function run(options) {
     messageCount: 0,
     lastProxiedActivityAt: null,
     sessionCleanupTimers: [],
+    claudeUsageTimer: null,
     authHeader: ""
   };
+  setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
   if (fileSyncDirectories.length > 0) {
     log2(state, `File sync enabled for: ${fileSyncDirectories.join(", ")}`);
   } else {
@@ -5998,40 +6526,52 @@ async function run(options) {
     } else {
       log2(state, "Not running in a MicroVM (MICROVM_ID unset) \u2014 nothing to report", "debug");
     }
+    const { timeoutMs: opencodeStartTimeoutMs, warnings: opencodeStartTimeoutWarnings } = resolveOpenCodeStartTimeoutMs(options, process.env);
+    for (const warning2 of opencodeStartTimeoutWarnings) {
+      logActivity(state, { type: "info", level: "warn", message: warning2 });
+    }
     const ocSpinner = interactive && !state.json ? ora3("Checking OpenCode...").start() : null;
     try {
       const oc = await ensureOpenCodeRunning({
         port: state.port,
         interactive: state.interactive,
         agentId: state.agentId,
-        log: (message) => log2(state, message)
+        log: (message) => log2(state, message),
+        startTimeoutMs: opencodeStartTimeoutMs
       });
       state.port = oc.port;
       state.opencodeProcess = oc.process;
       state.opencodeVersion = oc.version;
-      state.opencodeConnected = oc.process !== null || oc.version !== null;
+      state.opencodeConnected = oc.notReadyReason === null;
       const version2 = state.opencodeVersion ? ` (v${state.opencodeVersion})` : "";
       ocSpinner?.succeed(`OpenCode running on port ${state.port}${version2}`);
-      const versionWarning = buildOpenCodeVersionWarning(state.opencodeVersion);
-      if (versionWarning) {
-        log2(state, versionWarning, "warn");
-        if (state.interactive && !state.json) {
-          logActivity(state, { type: "info", level: "warn", message: versionWarning });
+      if (!state.interactive && oc.notReadyReason !== null) {
+        const message = `OpenCode is not ready on port ${state.port}: ${oc.notReadyReason}. The runner will still come online, but messages will fail until opencode answers \u2014 raise the wait with --opencode-start-timeout <seconds> (env ${OPENCODE_START_TIMEOUT_ENV}).`;
+        logActivity(state, { type: "info", level: "warn", message });
+      } else {
+        const versionWarning = buildOpenCodeVersionWarning(state.opencodeVersion);
+        if (versionWarning) {
+          log2(state, versionWarning, "warn");
+          if (state.interactive && !state.json) {
+            logActivity(state, { type: "info", level: "warn", message: versionWarning });
+          }
         }
-      }
-      const noProviderWarning = buildNoProviderWarning(await hasAnyConfiguredProvider(state.port));
-      if (noProviderWarning) {
-        log2(state, noProviderWarning, "warn");
-        if (state.interactive && !state.json) {
-          logActivity(state, { type: "info", level: "warn", message: noProviderWarning });
-          blank();
-          console.log(chalk6.yellow("\u26A0 No OpenCode model provider is configured."));
-          console.log(
-            chalk6.dim(
-              `Run ${chalk6.cyan("opencode auth login")} to set one up \u2014 messages will fail until then.`
-            )
-          );
-          blank();
+        const noProviderWarning = buildNoProviderWarning(
+          await hasAnyConfiguredProvider(state.port)
+        );
+        if (noProviderWarning) {
+          log2(state, noProviderWarning, "warn");
+          if (state.interactive && !state.json) {
+            logActivity(state, { type: "info", level: "warn", message: noProviderWarning });
+            blank();
+            console.log(chalk6.yellow("\u26A0 No OpenCode model provider is configured."));
+            console.log(
+              chalk6.dim(
+                `Run ${chalk6.cyan("opencode auth login")} to set one up \u2014 messages will fail until then.`
+              )
+            );
+            blank();
+          }
         }
       }
     } catch (error2) {
@@ -6049,7 +6589,7 @@ async function run(options) {
       // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
       // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
-      homeDir: homedir2(),
+      homeDir: homedir3(),
       log: (entry) => (
         // Thread the driver's real level straight through so `debug`/`warn`
         // survive the sink filter (they no longer collapse to info). `type`
@@ -6076,6 +6616,18 @@ async function run(options) {
             type: "info",
             message: `Tunnel ${isReconnect ? "reconnected" : "connected"} (runner: ${agentId})`
           });
+          if (options.tunnelReadyFile) {
+            const marker = writeTunnelReadyMarker(options.tunnelReadyFile, agentId);
+            if (marker.ok) {
+              log2(state, `Wrote tunnel readiness marker to ${options.tunnelReadyFile}`, "debug");
+            } else {
+              log2(
+                state,
+                `Failed to write tunnel readiness marker to ${options.tunnelReadyFile}: ${marker.error}`,
+                "error"
+              );
+            }
+          }
           emitAgentConnected(state.agentId, {
             port: state.port,
             cli_version: getCliVersion(),
@@ -6166,6 +6718,7 @@ async function run(options) {
       throw error2;
     }
     scheduleSessionCleanup(state, channelDriver, options);
+    scheduleClaudeUsageReporting(state, options);
     if (!interactive || state.json) {
       log2(state, "Driving channel messages...");
     }
@@ -6220,13 +6773,17 @@ program.name("evident").description("Run OpenCode locally and connect it to Evid
 program.command("login").description("Authenticate with Evident").option("--token", "Use token-based authentication (for CI/CD)").option("--no-browser", "Do not open the browser automatically").action(login);
 program.command("logout").description("Remove stored credentials for the current endpoint").option("--all", "Remove stored credentials for all endpoints").action((options) => logout({ all: options.all }));
 program.command("whoami").description("Show the currently logged in user").action(whoami);
+program.command("claude-usage").description("[spike] Show Claude subscription usage (requires a local `claude login`)").action(claudeUsage);
 program.command("run").description("Connect to Evident and process messages").option("--runner [id]", "Runner ID to connect to (optional when EVIDENT_RUNNER_KEY is set)").option(
   "-a, --agent [id]",
   "Deprecated alias for --runner (still supported; --runner wins if both are given)"
 ).option("-p, --port <port>", "OpenCode port (default: 4096)", "4096").option(
   "--log-level <level>",
   "Log verbosity: debug | info | warn | error (default: info). Env: EVIDENT_LOG_LEVEL"
-).option("-v, --verbose", "Alias for --log-level debug (ignored if --log-level is set)").option("-c, --conversation <id>", "Process only this specific conversation").option("--idle-timeout <seconds>", "Exit after N seconds idle").option("--json", "Output in JSON format").option(
+).option("-v, --verbose", "Alias for --log-level debug (ignored if --log-level is set)").option("-c, --conversation <id>", "Process only this specific conversation").option("--idle-timeout <seconds>", "Exit after N seconds idle").option(
+  "--opencode-start-timeout <seconds>",
+  "Seconds to wait for OpenCode to become healthy when the runner starts it (default: 180). Env: EVIDENT_OPENCODE_START_TIMEOUT"
+).option("--json", "Output in JSON format").option(
   "--session-cleanup-max-age <duration>",
   "Delete OpenCode sessions idle longer than this (e.g. 7d, 24h). Enables cleanup. Env: EVIDENT_SESSION_CLEANUP_MAX_AGE"
 ).option(
@@ -6235,11 +6792,17 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--session-cleanup-interval <duration>",
   "How often the cleanup sweep runs (default: 1h). Env: EVIDENT_SESSION_CLEANUP_INTERVAL"
+).option(
+  "--claude-usage-reporting <mode>",
+  "Report Claude subscription usage to Evident: auto | on | off (default: auto). Env: EVIDENT_CLAUDE_USAGE_REPORTING"
 ).option(
   "--enable-file-sync-to <dir>",
   "Allow Evident to write files into this directory (repeatable). Omit to disable file sync entirely.",
   (value, previous) => previous.concat([value]),
   []
+).option(
+  "--tunnel-ready-file <path>",
+  "Path to write once the tunnel is connected (set by the MicroVM hooks; unused on a developer machine)"
 ).action(
   (options) => {
     run({
@@ -6252,14 +6815,21 @@ program.command("run").description("Connect to Evident and process messages").op
       verbose: options.verbose,
       conversation: options.conversation,
       idleTimeout: options.idleTimeout ? parseInt(options.idleTimeout, 10) : void 0,
+      // Raw string — validation/precedence is single-sourced in run.ts's
+      // resolveOpenCodeStartTimeoutMs (flag > EVIDENT_OPENCODE_START_TIMEOUT > 180s default).
+      opencodeStartTimeout: options.opencodeStartTimeout,
       json: options.json,
       // Raw strings — the resolver in run.ts single-sources parsing (M1).
       sessionCleanupMaxAge: options.sessionCleanupMaxAge,
       sessionCleanupMaxCount: options.sessionCleanupMaxCount,
       sessionCleanupInterval: options.sessionCleanupInterval,
+      // Raw string — the resolver in run.ts single-sources parsing
+      // (resolveClaudeUsageReportingMode).
+      claudeUsageReporting: options.claudeUsageReporting,
       // Raw values — expansion/validation is single-sourced in run.ts's
       // resolveFileSyncDirectories.
-      enableFileSyncTo: options.enableFileSyncTo
+      enableFileSyncTo: options.enableFileSyncTo,
+      tunnelReadyFile: options.tunnelReadyFile
     });
   }
 );