@evident-ai/cli 3.1.1-dev.1e66164 → 3.1.1-dev.2aaaa4d

package/dist/index.js

@@ -532,6 +532,343 @@ async function whoami() {
   blank();
 }
 
+// src/lib/auth.ts
+async function getAuthCredentials() {
+  const runnerKey = process.env.EVIDENT_RUNNER_KEY;
+  const agentKey = process.env.EVIDENT_AGENT_KEY;
+  if (runnerKey) {
+    return {
+      token: runnerKey,
+      authType: "agent_key",
+      keySource: "runner_key",
+      notice: agentKey ? "Both EVIDENT_RUNNER_KEY and EVIDENT_AGENT_KEY are set; using EVIDENT_RUNNER_KEY." : void 0
+    };
+  }
+  if (agentKey) {
+    return { token: agentKey, authType: "agent_key", keySource: "agent_key" };
+  }
+  const userToken = process.env.EVIDENT_TOKEN;
+  if (userToken) {
+    return { token: userToken, authType: "bearer" };
+  }
+  const keychainCreds = await getToken();
+  if (keychainCreds) {
+    return {
+      token: keychainCreds.token,
+      authType: "bearer",
+      user: keychainCreds.user
+    };
+  }
+  return null;
+}
+function getAuthHeader(credentials2) {
+  if (credentials2.authType === "agent_key") {
+    return `SandboxKey ${credentials2.token}`;
+  }
+  return `Bearer ${credentials2.token}`;
+}
+function isInteractive(jsonOutput) {
+  if (jsonOutput) return false;
+  if (process.env.CI) return false;
+  if (process.env.GITHUB_ACTIONS) return false;
+  if (!process.stdin.isTTY) return false;
+  return true;
+}
+
+// src/commands/agent-lookup.ts
+async function readErrorMessage(response) {
+  const text = await response.text().catch(() => "");
+  if (!text) return response.statusText || void 0;
+  try {
+    const data = JSON.parse(text);
+    const message = data.message ?? data.error;
+    if (typeof message === "string" && message.trim()) {
+      return message;
+    }
+  } catch {
+  }
+  return text.trim() || response.statusText || void 0;
+}
+function authFailureHint(apiUrl, serverMessage) {
+  const reason = serverMessage ? `: ${serverMessage}` : "";
+  return `Authentication failed${reason}. Your credentials were rejected by ${apiUrl}. This usually means you logged in against a different environment, or your session expired \u2014 log in again pointing at this endpoint and retry.`;
+}
+async function resolveAgentIdFromKey(authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/me`, {
+      headers: { Authorization: authHeader }
+    });
+    if (response.status === 401) {
+      const serverMessage = await readErrorMessage(response);
+      return { error: authFailureHint(apiUrl, serverMessage), authFailed: true };
+    }
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        error: `Failed to resolve runner from key (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    const data = await response.json();
+    if (data.auth_type === "agent_key" && data.agent_id) {
+      return { agent_id: data.agent_id };
+    }
+    return {
+      error: "Cannot resolve runner ID: auth type is not agent_key. Please provide --runner explicitly."
+    };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { error: `Failed to resolve runner from key: ${message}` };
+  }
+}
+var BEST_EFFORT_NOTIFY_TIMEOUT_MS = 2e3;
+async function notifyAgentDisconnected(agentId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/runners/${agentId}/disconnect`, {
+      method: "POST",
+      headers: { Authorization: authHeader },
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+function describeBestEffortError(error2) {
+  const name = error2?.name;
+  if (name === "TimeoutError" || name === "AbortError") {
+    return `timed out after ${BEST_EFFORT_NOTIFY_TIMEOUT_MS}ms`;
+  }
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+async function reportMicrovmId(agentId, authHeader, microvmId) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/microvm`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({ microvm_id: microvmId }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+function toReportedWindow(window) {
+  if (!window) return null;
+  return { utilization: window.utilization, resets_at: window.resetsAt };
+}
+async function reportClaudeUsage(agentId, authHeader, snapshot) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/claude-usage`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        five_hour: toReportedWindow(snapshot.fiveHour),
+        seven_day: toReportedWindow(snapshot.sevenDay)
+      }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+async function getAgentInfo(agentId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/runners/${agentId}`, {
+      headers: { Authorization: authHeader }
+    });
+    if (response.status === 401) {
+      const serverMessage = await readErrorMessage(response);
+      return { valid: false, error: authFailureHint(apiUrl, serverMessage), authFailed: true };
+    }
+    if (response.status === 403) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        valid: false,
+        error: serverMessage ?? "You do not have access to this runner (it may belong to a different team or organization)."
+      };
+    }
+    if (response.status === 404) {
+      const serverMessage = await readErrorMessage(response);
+      return { valid: false, error: serverMessage ?? `Runner ${agentId} not found` };
+    }
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        valid: false,
+        error: `API error (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    const agent = await response.json();
+    if (agent.agent_type !== "local") {
+      return {
+        valid: false,
+        error: `Runner is type '${agent.agent_type}', must be 'local' for CLI connection`
+      };
+    }
+    return { valid: true, agent };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { valid: false, error: `Failed to validate runner: ${message}` };
+  }
+}
+
+// src/commands/status.ts
+var STATUS_TIMEOUT_MS = 1e4;
+function authLabelFor(credentials2) {
+  if (credentials2.authType === "agent_key") {
+    return credentials2.keySource === "agent_key" ? "runner key (EVIDENT_AGENT_KEY)" : "runner key (EVIDENT_RUNNER_KEY)";
+  }
+  return "user token";
+}
+function describeFetchError(error2) {
+  const name = error2?.name;
+  if (name === "TimeoutError" || name === "AbortError") {
+    return `timed out after ${STATUS_TIMEOUT_MS}ms waiting for a response`;
+  }
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+async function checkStatus(jsonMode) {
+  const apiUrl = getApiUrlConfig();
+  const credentials2 = await getAuthCredentials();
+  if (!credentials2) {
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      reason: "no_credentials",
+      error: "No credentials configured. Set EVIDENT_RUNNER_KEY (or EVIDENT_AGENT_KEY), or EVIDENT_TOKEN, or run `evident login`.",
+      exitCode: 1
+    };
+  }
+  if (credentials2.notice && !jsonMode) {
+    printWarning(credentials2.notice);
+  }
+  let response;
+  try {
+    response = await fetch(`${apiUrl}/me`, {
+      headers: { Authorization: getAuthHeader(credentials2) },
+      signal: AbortSignal.timeout(STATUS_TIMEOUT_MS)
+    });
+  } catch (error2) {
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "unreachable",
+      error: `Could not reach ${apiUrl}: ${describeFetchError(error2)}. The credentials were NOT validated.`,
+      exitCode: 75
+    };
+  }
+  if (response.status === 401) {
+    const serverMessage = await readErrorMessage(response);
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "unauthorized",
+      error: authFailureHint(apiUrl, serverMessage),
+      exitCode: 1
+    };
+  }
+  if (response.status >= 500) {
+    const serverMessage = await readErrorMessage(response);
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "unreachable",
+      error: `${apiUrl} returned HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}. The credentials were NOT validated.`,
+      exitCode: 75
+    };
+  }
+  if (!response.ok) {
+    const serverMessage = await readErrorMessage(response);
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "http_error",
+      error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`,
+      exitCode: 1
+    };
+  }
+  const data = await response.json();
+  return {
+    ok: true,
+    endpoint: apiUrl,
+    authType: data.auth_type,
+    authLabel: authLabelFor(credentials2),
+    runnerId: data.auth_type === "agent_key" ? data.agent_id : void 0,
+    reason: "ok",
+    exitCode: 0
+  };
+}
+function printJson(result) {
+  const payload = {
+    ok: result.ok,
+    endpoint: result.endpoint
+  };
+  if (result.authType) payload.auth_type = result.authType;
+  if (result.runnerId) payload.runner_id = result.runnerId;
+  if (result.reason) payload.reason = result.reason;
+  if (result.error) payload.error = result.error;
+  console.log(JSON.stringify(payload));
+}
+function printHuman(result) {
+  blank();
+  console.log(keyValue("Endpoint", result.endpoint));
+  if (result.ok) {
+    console.log(keyValue("Auth", result.authLabel ?? "\u2014"));
+    if (result.runnerId) {
+      console.log(keyValue("Runner", result.runnerId));
+    }
+    console.log(keyValue("Status", "OK \u2014 credentials accepted"));
+    blank();
+    return;
+  }
+  if (result.authLabel) {
+    console.log(keyValue("Auth", result.authLabel));
+  }
+  blank();
+  printError(result.error ?? "Unknown error");
+}
+async function status(options = {}) {
+  const result = await checkStatus(Boolean(options.json));
+  if (options.json) {
+    printJson(result);
+  } else {
+    printHuman(result);
+  }
+  process.exit(result.exitCode);
+}
+
 // src/lib/claude-usage.ts
 import { execFileSync } from "child_process";
 import { readFileSync } from "fs";
@@ -582,6 +919,10 @@ var ClaudeUsageError = class extends Error {
 function isLocalCredentialProblem(err) {
   return err instanceof ClaudeUsageError && (err.reason === "no_credentials" || err.reason === "credentials_expired");
 }
+function normalizeResetsAt(value) {
+  const ms = Date.parse(value);
+  return Number.isNaN(ms) ? null : new Date(ms).toISOString();
+}
 function toWindow(value) {
   if (!value || typeof value !== "object") {
     return null;
@@ -590,7 +931,11 @@ function toWindow(value) {
   if (typeof window.utilization !== "number" || typeof window.resets_at !== "string") {
     return null;
   }
-  return { utilization: window.utilization, resetsAt: window.resets_at };
+  const resetsAt = normalizeResetsAt(window.resets_at);
+  if (resetsAt === null) {
+    return null;
+  }
+  return { utilization: window.utilization, resetsAt };
 }
 async function getClaudeUsage() {
   const credentials2 = readClaudeCliCredentials();
@@ -934,49 +1279,6 @@ function forwardRunnerActivity(entry, context) {
   }
 }
 
-// src/lib/auth.ts
-async function getAuthCredentials() {
-  const runnerKey = process.env.EVIDENT_RUNNER_KEY;
-  const agentKey = process.env.EVIDENT_AGENT_KEY;
-  if (runnerKey) {
-    return {
-      token: runnerKey,
-      authType: "agent_key",
-      keySource: "runner_key",
-      notice: agentKey ? "Both EVIDENT_RUNNER_KEY and EVIDENT_AGENT_KEY are set; using EVIDENT_RUNNER_KEY." : void 0
-    };
-  }
-  if (agentKey) {
-    return { token: agentKey, authType: "agent_key", keySource: "agent_key" };
-  }
-  const userToken = process.env.EVIDENT_TOKEN;
-  if (userToken) {
-    return { token: userToken, authType: "bearer" };
-  }
-  const keychainCreds = await getToken();
-  if (keychainCreds) {
-    return {
-      token: keychainCreds.token,
-      authType: "bearer",
-      user: keychainCreds.user
-    };
-  }
-  return null;
-}
-function getAuthHeader(credentials2) {
-  if (credentials2.authType === "agent_key") {
-    return `SandboxKey ${credentials2.token}`;
-  }
-  return `Bearer ${credentials2.token}`;
-}
-function isInteractive(jsonOutput) {
-  if (jsonOutput) return false;
-  if (process.env.CI) return false;
-  if (process.env.GITHUB_ACTIONS) return false;
-  if (!process.stdin.isTTY) return false;
-  return true;
-}
-
 // src/lib/opencode/health.ts
 async function checkOpenCodeHealth(port) {
   try {
@@ -2386,6 +2688,10 @@ function nextReportDelayMs(random = Math.random) {
   return BASE_REPORT_DELAY_MS - jitterRangeMs + random() * (2 * jitterRangeMs);
 }
 var FIRST_REPORT_DELAY_MS = 5e3 + Math.random() * 1e4;
+var CLAUDE_USAGE_FAILURE_REESCALATION_TICKS = 6;
+function claudeUsageFailureLogLevel(consecutiveFailures) {
+  return consecutiveFailures === 1 || consecutiveFailures % CLAUDE_USAGE_FAILURE_REESCALATION_TICKS === 0 ? "warn" : "debug";
+}
 
 // src/lib/channels/driver.ts
 import { homedir as homedir2 } from "os";
@@ -2708,8 +3014,8 @@ async function applyOne(options, file) {
   await ack(options, file, "applied");
   return true;
 }
-function durableDownloadCode(status) {
-  return status === 413 ? "file_too_large" : "write_failed";
+function durableDownloadCode(status2) {
+  return status2 === 413 ? "file_too_large" : "write_failed";
 }
 async function downloadContent(options, file, label) {
   try {
@@ -2742,8 +3048,8 @@ async function downloadContent(options, file, label) {
     return { ok: false, terminal: false };
   }
 }
-async function ack(options, file, status, reason) {
-  const outcome = `${status}${reason ? ` (${reason})` : ""}`;
+async function ack(options, file, status2, reason) {
+  const outcome = `${status2}${reason ? ` (${reason})` : ""}`;
   try {
     const res = await options.fetchImpl(
       `${options.apiUrl}/runners/${options.agentId}/files/${file.id}/ack`,
@@ -2753,7 +3059,7 @@ async function ack(options, file, status, reason) {
           Authorization: options.getAuthHeader(),
           "Content-Type": "application/json"
         },
-        body: JSON.stringify(reason ? { status, reason } : { status })
+        body: JSON.stringify(reason ? { status: status2, reason } : { status: status2 })
       }
     );
     if (!res.ok) {
@@ -2825,10 +3131,10 @@ var ChannelAuthError = class extends Error {
 };
 var ChannelTerminalError = class extends Error {
   status;
-  constructor(message, status) {
+  constructor(message, status2) {
     super(message);
     this.name = "ChannelTerminalError";
-    this.status = status;
+    this.status = status2;
   }
 };
 function backoffDelay(attempt, policy) {
@@ -2836,8 +3142,8 @@ function backoffDelay(attempt, policy) {
   const capped = Math.min(policy.maxDelayMs, exp);
   return Math.floor(Math.random() * capped);
 }
-function isRetryableStatus(status) {
-  return status === 429 || status >= 500 && status <= 599;
+function isRetryableStatus(status2) {
+  return status2 === 429 || status2 >= 500 && status2 <= 599;
 }
 var ChannelDriver = class _ChannelDriver {
   agentId;
@@ -5159,11 +5465,11 @@ var ChannelDriver = class _ChannelDriver {
    * `ensureSession` guard, not this suppression, is what makes the self-heal
    * stick.
    */
-  sessionIdBody(sessionId, conversationId, messageId, status) {
+  sessionIdBody(sessionId, conversationId, messageId, status2) {
     if (!this.isSuperseded(conversationId, sessionId)) return { opencode_session_id: sessionId };
     this.log({
       level: "debug",
-      message: `Omitting the abandoned OpenCode session ${sessionId.slice(0, 8)} from the '${status}' update for message ${messageId.slice(0, 8)} so it is not re-bound to conversation ${conversationId.slice(0, 8)}`,
+      message: `Omitting the abandoned OpenCode session ${sessionId.slice(0, 8)} from the '${status2}' update for message ${messageId.slice(0, 8)} so it is not re-bound to conversation ${conversationId.slice(0, 8)}`,
       conversation_id: conversationId,
       message_id: messageId
     });
@@ -5609,171 +5915,6 @@ Port ${port} is already in use.`));
   return { port, process: null, version: null, notReadyReason: "you chose to continue without it" };
 }
 
-// src/commands/agent-lookup.ts
-async function readErrorMessage(response) {
-  const text = await response.text().catch(() => "");
-  if (!text) return response.statusText || void 0;
-  try {
-    const data = JSON.parse(text);
-    const message = data.message ?? data.error;
-    if (typeof message === "string" && message.trim()) {
-      return message;
-    }
-  } catch {
-  }
-  return text.trim() || response.statusText || void 0;
-}
-function authFailureHint(apiUrl, serverMessage) {
-  const reason = serverMessage ? `: ${serverMessage}` : "";
-  return `Authentication failed${reason}. Your credentials were rejected by ${apiUrl}. This usually means you logged in against a different environment, or your session expired \u2014 log in again pointing at this endpoint and retry.`;
-}
-async function resolveAgentIdFromKey(authHeader) {
-  const apiUrl = getApiUrlConfig();
-  try {
-    const response = await fetch(`${apiUrl}/me`, {
-      headers: { Authorization: authHeader }
-    });
-    if (response.status === 401) {
-      const serverMessage = await readErrorMessage(response);
-      return { error: authFailureHint(apiUrl, serverMessage), authFailed: true };
-    }
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        error: `Failed to resolve runner from key (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    const data = await response.json();
-    if (data.auth_type === "agent_key" && data.agent_id) {
-      return { agent_id: data.agent_id };
-    }
-    return {
-      error: "Cannot resolve runner ID: auth type is not agent_key. Please provide --runner explicitly."
-    };
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    return { error: `Failed to resolve runner from key: ${message}` };
-  }
-}
-var BEST_EFFORT_NOTIFY_TIMEOUT_MS = 2e3;
-async function notifyAgentDisconnected(agentId, authHeader) {
-  const apiUrl = getApiUrlConfig();
-  try {
-    const response = await fetch(`${apiUrl}/runners/${agentId}/disconnect`, {
-      method: "POST",
-      headers: { Authorization: authHeader },
-      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
-  }
-}
-function describeBestEffortError(error2) {
-  const name = error2?.name;
-  if (name === "TimeoutError" || name === "AbortError") {
-    return `timed out after ${BEST_EFFORT_NOTIFY_TIMEOUT_MS}ms`;
-  }
-  return error2 instanceof Error ? error2.message : String(error2);
-}
-async function reportMicrovmId(agentId, authHeader, microvmId) {
-  try {
-    const apiUrl = getApiUrlConfig();
-    const response = await fetch(`${apiUrl}/runners/${agentId}/microvm`, {
-      method: "POST",
-      headers: { Authorization: authHeader, "Content-Type": "application/json" },
-      body: JSON.stringify({ microvm_id: microvmId }),
-      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
-  }
-}
-function toReportedWindow(window) {
-  if (!window) return null;
-  return { utilization: window.utilization, resets_at: window.resetsAt };
-}
-async function reportClaudeUsage(agentId, authHeader, snapshot) {
-  try {
-    const apiUrl = getApiUrlConfig();
-    const response = await fetch(`${apiUrl}/runners/${agentId}/claude-usage`, {
-      method: "POST",
-      headers: { Authorization: authHeader, "Content-Type": "application/json" },
-      body: JSON.stringify({
-        five_hour: toReportedWindow(snapshot.fiveHour),
-        seven_day: toReportedWindow(snapshot.sevenDay)
-      }),
-      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
-  }
-}
-async function getAgentInfo(agentId, authHeader) {
-  const apiUrl = getApiUrlConfig();
-  try {
-    const response = await fetch(`${apiUrl}/runners/${agentId}`, {
-      headers: { Authorization: authHeader }
-    });
-    if (response.status === 401) {
-      const serverMessage = await readErrorMessage(response);
-      return { valid: false, error: authFailureHint(apiUrl, serverMessage), authFailed: true };
-    }
-    if (response.status === 403) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        valid: false,
-        error: serverMessage ?? "You do not have access to this runner (it may belong to a different team or organization)."
-      };
-    }
-    if (response.status === 404) {
-      const serverMessage = await readErrorMessage(response);
-      return { valid: false, error: serverMessage ?? `Runner ${agentId} not found` };
-    }
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        valid: false,
-        error: `API error (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    const agent = await response.json();
-    if (agent.agent_type !== "local") {
-      return {
-        valid: false,
-        error: `Runner is type '${agent.agent_type}', must be 'local' for CLI connection`
-      };
-    }
-    return { valid: true, agent };
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    return { valid: false, error: `Failed to validate runner: ${message}` };
-  }
-}
-
 // src/commands/run.ts
 var MAX_ACTIVITY_LOG_ENTRIES = 10;
 var CHANNEL_POLL_INTERVAL_MS = Number(process.env.EVIDENT_CHANNEL_POLL_INTERVAL_MS) || 2e3;
@@ -5984,6 +6125,7 @@ async function handleAuthError(state, error2) {
 }
 async function driveChannels(state, driver) {
   let idlePolls = 0;
+  let consecutiveDrainFailures = 0;
   let lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
   while (state.running) {
@@ -6001,6 +6143,7 @@ async function driveChannels(state, driver) {
     );
     try {
       const processed = await driver.drainPending();
+      consecutiveDrainFailures = 0;
       state.messageCount += processed;
       const proxiedActivity = state.lastProxiedActivityAt !== lastSeenProxiedActivityAt;
       lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
@@ -6035,8 +6178,32 @@ async function driveChannels(state, driver) {
       const errorMessage = error2 instanceof Error ? error2.message : String(error2);
       logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage}` });
       if (state.interactive) displayStatus(state);
+      if (driver.hasInFlightWatchers()) {
+        consecutiveDrainFailures = 0;
+      } else if (state.idleTimeout !== null) {
+        consecutiveDrainFailures++;
+        if (consecutiveDrainFailures === 1) {
+          logActivity(state, {
+            type: "info",
+            message: `Cannot reach Evident, will exit if this persists past the idle timeout (timeout: ${state.idleTimeout}s)...`
+          });
+          if (state.interactive) displayStatus(state);
+        }
+      }
     }
     await new Promise((resolve3) => setTimeout(resolve3, CHANNEL_POLL_INTERVAL_MS));
+    if (state.idleTimeout !== null && consecutiveDrainFailures >= 2) {
+      const unreachableMs = consecutiveDrainFailures * CHANNEL_POLL_INTERVAL_MS;
+      if (unreachableMs > state.idleTimeout * 1e3) {
+        logActivity(state, {
+          type: "info",
+          level: "warn",
+          message: `Exiting: could not reach Evident for ${consecutiveDrainFailures} consecutive polls (${Math.round(unreachableMs / 1e3)}s)`
+        });
+        if (state.interactive) displayStatus(state);
+        break;
+      }
+    }
     if (state.idleTimeout !== null && idlePolls >= 2) {
       const idleMs = idlePolls * CHANNEL_POLL_INTERVAL_MS;
       if (idleMs > state.idleTimeout * 1e3) {
@@ -6122,6 +6289,9 @@ function scheduleSessionCleanup(state, driver, options) {
   );
   state.sessionCleanupTimers.push(interval, firstSweep);
 }
+function claudeUsageFailureStreakSuffix(consecutiveFailures) {
+  return consecutiveFailures > 1 ? ` (${consecutiveFailures} consecutive failures)` : "";
+}
 function scheduleClaudeUsageReporting(state, options) {
   const { mode, warnings } = resolveClaudeUsageReportingMode(
     options.claudeUsageReporting,
@@ -6168,8 +6338,8 @@ function scheduleClaudeUsageReporting(state, options) {
         consecutiveFailures++;
         logActivity(state, {
           type: "info",
-          level: consecutiveFailures === 1 ? "warn" : "debug",
-          message: `Failed to report Claude usage: ${result.error}`
+          level: claudeUsageFailureLogLevel(consecutiveFailures),
+          message: `Failed to report Claude usage: ${result.error}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
         });
       }
       scheduleNextTick();
@@ -6201,8 +6371,8 @@ function scheduleClaudeUsageReporting(state, options) {
         const message = error2 instanceof Error ? error2.message : String(error2);
         logActivity(state, {
           type: "info",
-          level: consecutiveFailures === 1 ? "warn" : "debug",
-          message: `Claude usage reporting failed: ${message}`
+          level: claudeUsageFailureLogLevel(consecutiveFailures),
+          message: `Claude usage reporting failed: ${message}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
         });
         scheduleNextTick();
       }
@@ -6409,6 +6579,7 @@ async function run(options) {
         console.log(chalk6.dim("Or run `evident login` for interactive authentication"));
         blank();
         process.exit(1);
+        return;
       }
       blank();
       console.log(chalk6.yellow("You are not logged in to Evident."));
@@ -6453,6 +6624,7 @@ async function run(options) {
         } else {
           printError(resolved.error || "Failed to resolve runner ID from key");
           process.exit(1);
+          return;
         }
       } else {
         printError(
@@ -6466,6 +6638,7 @@ async function run(options) {
         );
         blank();
         process.exit(1);
+        return;
       }
     }
     telemetry.info(
@@ -6768,6 +6941,7 @@ program.name("evident").description("Run OpenCode locally and connect it to Evid
 program.command("login").description("Authenticate with Evident").option("--token", "Use token-based authentication (for CI/CD)").option("--no-browser", "Do not open the browser automatically").action(login);
 program.command("logout").description("Remove stored credentials for the current endpoint").option("--all", "Remove stored credentials for all endpoints").action((options) => logout({ all: options.all }));
 program.command("whoami").description("Show the currently logged in user").action(whoami);
+program.command("status").description("Check whether the configured credentials can reach Evident").option("--json", "Output in JSON format").action((options) => status({ json: options.json }));
 program.command("claude-usage").description("[spike] Show Claude subscription usage (requires a local `claude login`)").action(claudeUsage);
 program.command("run").description("Connect to Evident and process messages").option("--runner [id]", "Runner ID to connect to (optional when EVIDENT_RUNNER_KEY is set)").option(
   "-a, --agent [id]",