@evident-ai/cli 3.1.1-dev.1b62144 → 3.1.1-dev.1e66164

package/README.md

@@ -98,7 +98,36 @@ Options:
   healthy when the runner starts it itself (default: `180`). On expiry the runner
   warns and comes online anyway rather than failing. Env:
   `EVIDENT_OPENCODE_START_TIMEOUT` (seconds).
+- `--claude-usage-reporting <mode>` — Whether to report the local Claude Code
+  subscription's rate-limit usage to Evident, so it shows on the runner page:
+  `auto` (default) reports it when a usable Claude Code login is found on this
+  machine and stays silent otherwise; `on` forces reporting and warns loudly (and
+  keeps retrying) if no usable login is found; `off` disables it entirely — no
+  Claude credential is ever read. An unrecognized value falls back to `auto` with
+  a warning. Env: `EVIDENT_CLAUDE_USAGE_REPORTING`.
 - `--json` — Output in JSON format (forces non-interactive mode).
+- `--session-cleanup-max-age <duration>` — Delete OpenCode sessions idle longer
+  than this window (format `<number><unit>`, unit one of `s, m, h, d` — e.g.
+  `7d`, `24h`). Setting this (or `--session-cleanup-max-count`) is what enables
+  cleanup — there is no separate on/off flag. An invalid value is warned about
+  and ignored, which can leave cleanup off if it was the only rule set. Env:
+  `EVIDENT_SESSION_CLEANUP_MAX_AGE`.
+- `--session-cleanup-max-count <n>` — Keep only the newest N OpenCode sessions
+  by last activity, deleting the rest. Also enables cleanup; combines with
+  `--session-cleanup-max-age` as OR. A session with a turn actively in progress
+  is never deleted, regardless of either rule. Env:
+  `EVIDENT_SESSION_CLEANUP_MAX_COUNT`.
+- `--session-cleanup-interval <duration>` — How often the cleanup sweep runs
+  (default: `1h`). An invalid value falls back to the default rather than
+  disabling cleanup. Env: `EVIDENT_SESSION_CLEANUP_INTERVAL`.
+- `--enable-file-sync-to <dir>` — Let the runner write files Evident has queued
+  for it into this directory — it collects them as part of the polling it
+  already does, so they land a couple of seconds after you hand them over.
+  Repeatable (up to 16); each value must be absolute once a leading `~` is
+  expanded, and the filesystem root is rejected. Omit it entirely and the
+  runner collects nothing and refuses any queued file, telling you why. Use
+  `--enable-file-sync-to ~/.claude` to connect a Claude subscription from the
+  web — see the website's Model providers doc.
 
 ## Global flags
 
@@ -122,6 +151,18 @@ targets the **production** Evident platform by default.
   keychain login from `evident login`).
 - `EVIDENT_API_URL` — Override the API base URL (equivalent to `--endpoint`).
 - `EVIDENT_TUNNEL_URL` — Override the tunnel relay URL (equivalent to `--tunnel`).
+- `EVIDENT_CLAUDE_USAGE_REPORTING` — Equivalent to `--claude-usage-reporting`; the
+  flag wins if both are set.
+- `EVIDENT_LOG_LEVEL` — Equivalent to `--log-level`; the flag wins if both are
+  set, and `-v`/`--verbose` also outranks this env var.
+- `EVIDENT_OPENCODE_START_TIMEOUT` — Equivalent to `--opencode-start-timeout`
+  (seconds); the flag wins if both are set.
+- `EVIDENT_SESSION_CLEANUP_MAX_AGE` — Equivalent to `--session-cleanup-max-age`;
+  the flag wins if both are set.
+- `EVIDENT_SESSION_CLEANUP_MAX_COUNT` — Equivalent to
+  `--session-cleanup-max-count`; the flag wins if both are set.
+- `EVIDENT_SESSION_CLEANUP_INTERVAL` — Equivalent to
+  `--session-cleanup-interval`; the flag wins if both are set.
 
 Authentication precedence for `run`: `EVIDENT_RUNNER_KEY`/`EVIDENT_AGENT_KEY`
 (tied; `EVIDENT_RUNNER_KEY` wins if both are set) → `EVIDENT_TOKEN` →

package/dist/index.js

@@ -38,11 +38,6 @@ function getApiUrl() {
 function getTunnelUrl() {
   return tunnelOverride ?? process.env.EVIDENT_TUNNEL_URL ?? defaults.tunnelUrl;
 }
-var config = new Conf({
-  projectName: "evident",
-  projectSuffix: "",
-  defaults
-});
 var credentials = new Conf({
   projectName: "evident",
   projectSuffix: "",
@@ -417,8 +412,10 @@ async function deviceFlowLogin(options) {
 }
 async function tokenLogin() {
   console.log("Token login mode.");
-  console.log("Run `evident login` on a machine with a browser to get a token.");
-  console.log("Manage or revoke existing tokens under Settings \u2192 CLI tokens.");
+  console.log("Create a token under Settings \u2192 CLI tokens in the dashboard, then paste it below.");
+  console.log(
+    "(Alternatively, run `evident login` on a machine with a browser, or set EVIDENT_TOKEN for CI.)"
+  );
   blank();
   process.stdout.write("Paste token: ");
   const token = await new Promise((resolve3) => {
@@ -442,13 +439,22 @@ async function tokenLogin() {
     printError("No token provided.");
     process.exit(1);
   }
+  await validateAndStoreToken(token);
+}
+async function validateAndStoreToken(token) {
   const spinner = ora("Validating token...").start();
   try {
-    const result = await api.post("/auth/token/validate", { token });
+    const result = await api.get("/me", {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!result.user) {
+      throw new Error(
+        "This token is not a user login (e.g. a runner key). Paste a CLI token instead."
+      );
+    }
     await storeToken({
       token,
-      user: result.user,
-      expiresAt: result.expires_at
+      user: { email: result.user.email }
     });
     spinner.stop();
     printSuccess(`Logged in as ${chalk2.bold(result.user.email)}`);
@@ -508,7 +514,9 @@ async function whoami() {
   blank();
   console.log(keyValue("Endpoint", apiUrl));
   console.log(keyValue("User", chalk3.bold(credentials2.user.email)));
-  console.log(keyValue("User ID", credentials2.user.id));
+  if (credentials2.user.id) {
+    console.log(keyValue("User ID", credentials2.user.id));
+  }
   if (credentials2.expiresAt) {
     const expiresAt = new Date(credentials2.expiresAt);
     const now = /* @__PURE__ */ new Date();
@@ -524,9 +532,124 @@ async function whoami() {
   blank();
 }
 
+// src/lib/claude-usage.ts
+import { execFileSync } from "child_process";
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+var KEYCHAIN_SERVICE = "Claude Code-credentials";
+function parseClaudeCliCredentials(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const data = parsed.claudeAiOauth ?? parsed;
+  const creds = data;
+  if (typeof creds.accessToken !== "string" || typeof creds.expiresAt !== "number") {
+    return null;
+  }
+  return { accessToken: creds.accessToken, expiresAt: creds.expiresAt };
+}
+function readClaudeCliCredentials() {
+  if (process.platform === "darwin") {
+    try {
+      const raw = execFileSync(
+        "/usr/bin/security",
+        ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"],
+        { encoding: "utf-8", timeout: 2e3, stdio: ["pipe", "pipe", "ignore"] }
+      );
+      return parseClaudeCliCredentials(raw);
+    } catch {
+      return null;
+    }
+  }
+  try {
+    const raw = readFileSync(join(homedir(), ".claude", ".credentials.json"), "utf-8");
+    return parseClaudeCliCredentials(raw);
+  } catch {
+    return null;
+  }
+}
+var ClaudeUsageError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+};
+function isLocalCredentialProblem(err) {
+  return err instanceof ClaudeUsageError && (err.reason === "no_credentials" || err.reason === "credentials_expired");
+}
+function toWindow(value) {
+  if (!value || typeof value !== "object") {
+    return null;
+  }
+  const window = value;
+  if (typeof window.utilization !== "number" || typeof window.resets_at !== "string") {
+    return null;
+  }
+  return { utilization: window.utilization, resetsAt: window.resets_at };
+}
+async function getClaudeUsage() {
+  const credentials2 = readClaudeCliCredentials();
+  if (!credentials2) {
+    throw new ClaudeUsageError(
+      "No local Claude Code login found. Run `claude` once to sign in with your Claude subscription.",
+      "no_credentials"
+    );
+  }
+  if (credentials2.expiresAt < Date.now()) {
+    throw new ClaudeUsageError(
+      "Claude Code credentials have expired. Run `claude` to refresh them.",
+      "credentials_expired"
+    );
+  }
+  const res = await fetch(CLAUDE_USAGE_URL, {
+    headers: {
+      Authorization: `Bearer ${credentials2.accessToken}`,
+      "Content-Type": "application/json",
+      "anthropic-version": "2023-06-01"
+    }
+  });
+  if (!res.ok) {
+    throw new ClaudeUsageError(`Claude usage request failed: HTTP ${res.status}`, "request_failed");
+  }
+  const body = await res.json();
+  return {
+    fiveHour: toWindow(body.five_hour),
+    sevenDay: toWindow(body.seven_day)
+  };
+}
+
+// src/commands/claude-usage.ts
+function formatWindow(label, window) {
+  if (!window) {
+    return keyValue(label, "not available for this plan");
+  }
+  const resetsAt = new Date(window.resetsAt);
+  return keyValue(label, `${window.utilization}% used, resets ${resetsAt.toLocaleString()}`);
+}
+async function claudeUsage() {
+  try {
+    const usage = await getClaudeUsage();
+    blank();
+    console.log(formatWindow("5-hour session", usage.fiveHour));
+    console.log(formatWindow("7-day", usage.sevenDay));
+    blank();
+  } catch (err) {
+    if (err instanceof ClaudeUsageError) {
+      printError(err.message);
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+
 // src/commands/run.ts
-import { homedir as homedir2 } from "os";
-import { isAbsolute as isAbsolute2, join as join2, parse, resolve as resolvePath } from "path";
+import { homedir as homedir3 } from "os";
+import { isAbsolute as isAbsolute2, join as join3, parse, resolve as resolvePath } from "path";
 import chalk6 from "chalk";
 
 // ../../packages/types/src/telemetry/index.ts
@@ -2237,13 +2360,40 @@ function writeTunnelReadyMarker(path, agentId) {
   }
 }
 
+// src/lib/claude-usage-reporting.ts
+var VALID_MODES = ["auto", "on", "off"];
+function resolveClaudeUsageReportingMode(flagValue, env) {
+  const raw = flagValue ?? env.EVIDENT_CLAUDE_USAGE_REPORTING;
+  if (raw === void 0 || raw === "") {
+    return { mode: "auto", warnings: [] };
+  }
+  const normalized = raw.trim().toLowerCase();
+  if (VALID_MODES.includes(normalized)) {
+    return { mode: normalized, warnings: [] };
+  }
+  const source = flagValue !== void 0 ? "--claude-usage-reporting" : "EVIDENT_CLAUDE_USAGE_REPORTING";
+  return {
+    mode: "auto",
+    warnings: [
+      `Ignoring invalid ${source} "${raw}": expected one of ${VALID_MODES.join(", ")}; using auto`
+    ]
+  };
+}
+var BASE_REPORT_DELAY_MS = 10 * 6e4;
+var REPORT_DELAY_JITTER_FRACTION = 0.2;
+function nextReportDelayMs(random = Math.random) {
+  const jitterRangeMs = BASE_REPORT_DELAY_MS * REPORT_DELAY_JITTER_FRACTION;
+  return BASE_REPORT_DELAY_MS - jitterRangeMs + random() * (2 * jitterRangeMs);
+}
+var FIRST_REPORT_DELAY_MS = 5e3 + Math.random() * 1e4;
+
 // src/lib/channels/driver.ts
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 
 // src/lib/file-push.ts
 import { randomUUID } from "crypto";
 import { chmod, mkdir, open as open2, realpath, rename, unlink } from "fs/promises";
-import { basename, dirname as dirname2, isAbsolute, join, relative, resolve as resolve2, sep } from "path";
+import { basename, dirname as dirname2, isAbsolute, join as join2, relative, resolve as resolve2, sep } from "path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
 async function writePushedFile(request) {
@@ -2276,7 +2426,7 @@ async function writePushedFile(request) {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
       dirname2(candidate)
     );
-    const realTarget = join(existingAncestor, ...missingSegments, basename(candidate));
+    const realTarget = join2(existingAncestor, ...missingSegments, basename(candidate));
     const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
@@ -2312,7 +2462,7 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join2(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
@@ -2385,13 +2535,13 @@ function contains(realDirectory, realTarget) {
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join(current, segment);
+    current = join2(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join(dirname2(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join2(dirname2(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
     handle = await open2(temporaryPath, "wx", FILE_MODE);
@@ -2890,23 +3040,23 @@ var ChannelDriver = class _ChannelDriver {
    * and stops opencode.
    */
   stopped = false;
-  constructor(config2) {
-    this.agentId = config2.agentId;
-    this.port = config2.port;
-    this.apiUrl = config2.apiUrl.replace(/\/$/, "");
-    this.getAuthHeader = config2.getAuthHeader;
-    this.conversationFilter = config2.conversationFilter ?? null;
-    this.retry = { ...DEFAULT_RETRY_POLICY, ...config2.retry };
-    this.log = config2.log ?? (() => {
+  constructor(config) {
+    this.agentId = config.agentId;
+    this.port = config.port;
+    this.apiUrl = config.apiUrl.replace(/\/$/, "");
+    this.getAuthHeader = config.getAuthHeader;
+    this.conversationFilter = config.conversationFilter ?? null;
+    this.retry = { ...DEFAULT_RETRY_POLICY, ...config.retry };
+    this.log = config.log ?? (() => {
     });
-    this.fetchImpl = config2.fetchImpl ?? fetch;
-    this.sleep = config2.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-    this.pausedPollIntervalMs = config2.pausedPollIntervalMs ?? DEFAULT_PAUSED_POLL_INTERVAL_MS;
-    this.pausedMaxWaitMs = config2.pausedMaxWaitMs ?? DEFAULT_PAUSED_MAX_WAIT_MS;
-    this.stuckQueuedMs = config2.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
-    this.now = config2.now ?? (() => Date.now());
-    this.fileSyncDirectories = config2.fileSyncDirectories ?? [];
-    this.homeDir = config2.homeDir ?? homedir();
+    this.fetchImpl = config.fetchImpl ?? fetch;
+    this.sleep = config.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.pausedPollIntervalMs = config.pausedPollIntervalMs ?? DEFAULT_PAUSED_POLL_INTERVAL_MS;
+    this.pausedMaxWaitMs = config.pausedMaxWaitMs ?? DEFAULT_PAUSED_MAX_WAIT_MS;
+    this.stuckQueuedMs = config.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
+    this.now = config.now ?? (() => Date.now());
+    this.fileSyncDirectories = config.fileSyncDirectories ?? [];
+    this.homeDir = config.homeDir ?? homedir2();
   }
   /** The IPv4-loopback base URL for the local `opencode serve`. */
   get opencodeBase() {
@@ -3291,7 +3441,12 @@ var ChannelDriver = class _ChannelDriver {
     const directory = await this.resolveOpenCodeDirectory();
     const sessionId = await createOpenCodeSession(this.port, directory);
     this.sessions.set(conversationId, sessionId);
-    await this.persistSession(conversationId, sessionId).catch(() => {
+    await this.persistSession(conversationId, sessionId).catch((err) => {
+      this.log({
+        level: "warn",
+        message: `Persisting the OpenCode session binding ${sessionId.slice(0, 8)} for conversation ${conversationId.slice(0, 8)} failed (best-effort, not retried) \u2014 the completion PATCH also carries opencode_session_id, so the binding is repaired when the turn finishes: ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conversationId
+      });
     });
     return sessionId;
   }
@@ -5549,6 +5704,34 @@ async function reportMicrovmId(agentId, authHeader, microvmId) {
     return { ok: false, error: describeBestEffortError(error2) };
   }
 }
+function toReportedWindow(window) {
+  if (!window) return null;
+  return { utilization: window.utilization, resets_at: window.resetsAt };
+}
+async function reportClaudeUsage(agentId, authHeader, snapshot) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/claude-usage`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        five_hour: toReportedWindow(snapshot.fiveHour),
+        seven_day: toReportedWindow(snapshot.sevenDay)
+      }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
 async function getAgentInfo(agentId, authHeader) {
   const apiUrl = getApiUrlConfig();
   try {
@@ -5627,7 +5810,7 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join2(homeDir, trimmed.slice(2)) : trimmed;
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join3(homeDir, trimmed.slice(2)) : trimmed;
     if (!isAbsolute2(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
@@ -5865,8 +6048,8 @@ async function driveChannels(state, driver) {
   }
 }
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
-async function runSweep(state, driver, config2) {
-  const mode = `age=${config2.maxAgeMs ?? "\u2014"} count=${config2.maxCount ?? "\u2014"}`;
+async function runSweep(state, driver, config) {
+  const mode = `age=${config.maxAgeMs ?? "\u2014"} count=${config.maxCount ?? "\u2014"}`;
   try {
     const sessions = await listSessions(state.port);
     if (sessions === null) {
@@ -5879,8 +6062,8 @@ async function runSweep(state, driver, config2) {
     const toDelete = selectSessionsToDelete(
       sessions.map((s) => ({ id: s.id, lastActivityMs: sessionLastActivityMs(s) })),
       {
-        maxAgeMs: config2.maxAgeMs,
-        maxCount: config2.maxCount,
+        maxAgeMs: config.maxAgeMs,
+        maxCount: config.maxCount,
         nowMs: Date.now(),
         protectedIds: driver.protectedSessionIds()
       }
@@ -5916,7 +6099,7 @@ async function runSweep(state, driver, config2) {
   }
 }
 function scheduleSessionCleanup(state, driver, options) {
-  const config2 = resolveSessionCleanupConfig(
+  const config = resolveSessionCleanupConfig(
     {
       maxAge: options.sessionCleanupMaxAge,
       maxCount: options.sessionCleanupMaxCount,
@@ -5924,21 +6107,109 @@ function scheduleSessionCleanup(state, driver, options) {
     },
     process.env
   );
-  for (const warning2 of config2.warnings) {
+  for (const warning2 of config.warnings) {
     logActivity(state, { type: "info", level: "warn", message: `Session cleanup: ${warning2}` });
   }
-  if (!config2.enabled) return;
+  if (!config.enabled) return;
   logActivity(state, {
     type: "info",
-    message: `Session cleanup enabled (age=${config2.maxAgeMs ?? "\u2014"}, count=${config2.maxCount ?? "\u2014"}, interval=${config2.intervalMs}ms)`
+    message: `Session cleanup enabled (age=${config.maxAgeMs ?? "\u2014"}, count=${config.maxCount ?? "\u2014"}, interval=${config.intervalMs}ms)`
   });
-  const interval = setInterval(() => void runSweep(state, driver, config2), config2.intervalMs);
+  const interval = setInterval(() => void runSweep(state, driver, config), config.intervalMs);
   const firstSweep = setTimeout(
-    () => void runSweep(state, driver, config2),
+    () => void runSweep(state, driver, config),
     SESSION_CLEANUP_FIRST_SWEEP_MS
   );
   state.sessionCleanupTimers.push(interval, firstSweep);
 }
+function scheduleClaudeUsageReporting(state, options) {
+  const { mode, warnings } = resolveClaudeUsageReportingMode(
+    options.claudeUsageReporting,
+    process.env
+  );
+  for (const warning2 of warnings) {
+    logActivity(state, {
+      type: "info",
+      level: "warn",
+      message: `Claude usage reporting: ${warning2}`
+    });
+  }
+  if (mode === "off") {
+    logActivity(state, {
+      type: "info",
+      level: "debug",
+      message: "Claude usage reporting is off (--claude-usage-reporting off)"
+    });
+    return;
+  }
+  let consecutiveFailures = 0;
+  const scheduleNextTick = () => {
+    state.claudeUsageTimer = setTimeout(() => void tick(false), nextReportDelayMs());
+  };
+  const tick = async (isFirst) => {
+    try {
+      const usage = await getClaudeUsage();
+      const result = await reportClaudeUsage(state.agentId, state.authHeader, usage);
+      if (result.ok) {
+        if (consecutiveFailures > 0) {
+          logActivity(state, {
+            type: "info",
+            level: "info",
+            message: "Claude usage reporting recovered"
+          });
+        }
+        consecutiveFailures = 0;
+        logActivity(state, {
+          type: "info",
+          level: "debug",
+          message: "Reported Claude usage to Evident"
+        });
+      } else {
+        consecutiveFailures++;
+        logActivity(state, {
+          type: "info",
+          level: consecutiveFailures === 1 ? "warn" : "debug",
+          message: `Failed to report Claude usage: ${result.error}`
+        });
+      }
+      scheduleNextTick();
+    } catch (error2) {
+      if (error2 instanceof ClaudeUsageError && isLocalCredentialProblem(error2)) {
+        if (mode === "on") {
+          logActivity(state, {
+            type: "info",
+            level: "warn",
+            message: "Claude usage reporting is forced on but no usable Claude Code login was found \u2014 run `claude` to sign in; reporting will keep retrying"
+          });
+          scheduleNextTick();
+        } else if (isFirst) {
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: `Claude usage reporting: ${error2.message}`
+          });
+        } else {
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: `Claude usage reporting: ${error2.message}`
+          });
+          scheduleNextTick();
+        }
+      } else {
+        consecutiveFailures++;
+        const message = error2 instanceof Error ? error2.message : String(error2);
+        logActivity(state, {
+          type: "info",
+          level: consecutiveFailures === 1 ? "warn" : "debug",
+          message: `Claude usage reporting failed: ${message}`
+        });
+        scheduleNextTick();
+      }
+    }
+  };
+  state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+}
 async function notifyOffline(state) {
   if (!state.agentId || !state.authHeader) return;
   if (!state.connected) {
@@ -5974,6 +6245,10 @@ async function cleanup(state, opts = {}) {
     clearTimeout(timer);
   }
   state.sessionCleanupTimers = [];
+  if (state.claudeUsageTimer) {
+    clearTimeout(state.claudeUsageTimer);
+    state.claudeUsageTimer = null;
+  }
   if (opts.graceful && state.channelDriver) {
     state.channelDriver.stop();
     log2(state, "Draining in-flight channel work before shutdown...");
@@ -6021,7 +6296,7 @@ async function run(options) {
   let fileSyncDirectories;
   try {
     logLevel = resolveLogLevel(options);
-    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir2());
+    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir3());
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     if (options.json) {
@@ -6054,6 +6329,7 @@ async function run(options) {
     messageCount: 0,
     lastProxiedActivityAt: null,
     sessionCleanupTimers: [],
+    claudeUsageTimer: null,
     authHeader: ""
   };
   setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
@@ -6308,7 +6584,7 @@ async function run(options) {
       // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
       // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
-      homeDir: homedir2(),
+      homeDir: homedir3(),
       log: (entry) => (
         // Thread the driver's real level straight through so `debug`/`warn`
         // survive the sink filter (they no longer collapse to info). `type`
@@ -6437,6 +6713,7 @@ async function run(options) {
       throw error2;
     }
     scheduleSessionCleanup(state, channelDriver, options);
+    scheduleClaudeUsageReporting(state, options);
     if (!interactive || state.json) {
       log2(state, "Driving channel messages...");
     }
@@ -6491,6 +6768,7 @@ program.name("evident").description("Run OpenCode locally and connect it to Evid
 program.command("login").description("Authenticate with Evident").option("--token", "Use token-based authentication (for CI/CD)").option("--no-browser", "Do not open the browser automatically").action(login);
 program.command("logout").description("Remove stored credentials for the current endpoint").option("--all", "Remove stored credentials for all endpoints").action((options) => logout({ all: options.all }));
 program.command("whoami").description("Show the currently logged in user").action(whoami);
+program.command("claude-usage").description("[spike] Show Claude subscription usage (requires a local `claude login`)").action(claudeUsage);
 program.command("run").description("Connect to Evident and process messages").option("--runner [id]", "Runner ID to connect to (optional when EVIDENT_RUNNER_KEY is set)").option(
   "-a, --agent [id]",
   "Deprecated alias for --runner (still supported; --runner wins if both are given)"
@@ -6509,6 +6787,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--session-cleanup-interval <duration>",
   "How often the cleanup sweep runs (default: 1h). Env: EVIDENT_SESSION_CLEANUP_INTERVAL"
+).option(
+  "--claude-usage-reporting <mode>",
+  "Report Claude subscription usage to Evident: auto | on | off (default: auto). Env: EVIDENT_CLAUDE_USAGE_REPORTING"
 ).option(
   "--enable-file-sync-to <dir>",
   "Allow Evident to write files into this directory (repeatable). Omit to disable file sync entirely.",
@@ -6537,6 +6818,9 @@ program.command("run").description("Connect to Evident and process messages").op
       sessionCleanupMaxAge: options.sessionCleanupMaxAge,
       sessionCleanupMaxCount: options.sessionCleanupMaxCount,
       sessionCleanupInterval: options.sessionCleanupInterval,
+      // Raw string — the resolver in run.ts single-sources parsing
+      // (resolveClaudeUsageReportingMode).
+      claudeUsageReporting: options.claudeUsageReporting,
       // Raw values — expansion/validation is single-sourced in run.ts's
       // resolveFileSyncDirectories.
       enableFileSyncTo: options.enableFileSyncTo,