@evident-ai/cli 3.1.1-dev.8e7adc6 → 3.1.1-dev.8e82a28

package/dist/index.js

@@ -997,6 +997,9 @@ import { homedir as homedir3 } from "os";
 import { isAbsolute as isAbsolute2, join as join3, parse, resolve as resolvePath } from "path";
 import chalk6 from "chalk";
 
+// ../../packages/types/src/agents/index.ts
+var MICROVM_MAX_LIFETIME_MS = 8 * 60 * 6e4;
+
 // ../../packages/types/src/telemetry/index.ts
 var TelemetryEventTypes = {
   // Agent activity events (shown in web UI activity log)
@@ -2086,6 +2089,21 @@ function messageError(messages, userMessageId) {
   }
   return "The agent run failed.";
 }
+function isAbortedTerminalReply(messages, userMessageId) {
+  const reply = findLastAssistantReplyFor(messages, userMessageId);
+  const error2 = errorOf(reply);
+  if (error2 == null) return false;
+  if (typeof error2 === "string") return error2.trim() === "Aborted";
+  if (typeof error2 === "object") {
+    const e = error2;
+    if (e.name === "MessageAbortedError") return true;
+    if (e.name === "AbortError") return true;
+    const dataMessage = e.data?.message;
+    const rendered = typeof dataMessage === "string" ? dataMessage : typeof e.message === "string" ? e.message : null;
+    return rendered != null && rendered.trim() === "Aborted";
+  }
+  return false;
+}
 function messageFailure(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   const error2 = errorOf(reply);
@@ -2688,6 +2706,10 @@ function nextReportDelayMs(random = Math.random) {
   return BASE_REPORT_DELAY_MS - jitterRangeMs + random() * (2 * jitterRangeMs);
 }
 var FIRST_REPORT_DELAY_MS = 5e3 + Math.random() * 1e4;
+var CLAUDE_USAGE_FAILURE_REESCALATION_TICKS = 6;
+function claudeUsageFailureLogLevel(consecutiveFailures) {
+  return consecutiveFailures === 1 || consecutiveFailures % CLAUDE_USAGE_FAILURE_REESCALATION_TICKS === 0 ? "warn" : "debug";
+}
 
 // src/lib/channels/driver.ts
 import { homedir as homedir2 } from "os";
@@ -3119,6 +3141,7 @@ var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
 var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
 var MAX_SUPERSEDED_CONVERSATIONS = 256;
+var MAX_IDENTICAL_REDRIVE_POLL_FAILURES = 5;
 var ChannelAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -3141,6 +3164,10 @@ function backoffDelay(attempt, policy) {
 function isRetryableStatus(status2) {
   return status2 === 429 || status2 >= 500 && status2 <= 599;
 }
+var VOLATILE_BODY_FIELD_PATTERN = /("(?:ref|requestId|request_id|traceId|trace_id)"\s*:\s*)"[^"]*"/gi;
+function normalizeRedrivePollFailureBody(body) {
+  return body.replace(VOLATILE_BODY_FIELD_PATTERN, '$1"<redacted>"').replace(/\s+/g, " ").trim().slice(0, 200);
+}
 var ChannelDriver = class _ChannelDriver {
   agentId;
   port;
@@ -3254,6 +3281,43 @@ var ChannelDriver = class _ChannelDriver {
    * processing list, exactly like `dontRedispatch`/`doneUndeliverable`.
    */
   readoptPollUnresolvedSignalled = /* @__PURE__ */ new Set();
+  /**
+   * "Already emitted `redrive_unresolved` for this row" (#965). Mirrors
+   * `readoptPollUnresolvedSignalled`: `resolveRedrive`'s `unresolved` leaf recurs
+   * every ~2s drain until opencode's status becomes readable, but the
+   * server-visible signal is an OUTCOME, so it fires at most once per row. Cleared
+   * on any non-`unresolved` outcome so the set cannot grow beyond the currently
+   * unresolvable rows.
+   */
+  redriveUnresolvedSignalled = /* @__PURE__ */ new Set();
+  /**
+   * First `now()` a `pending` row's re-drive was observed `unresolved` (#965). A
+   * `pending` row is invisible to every cron arm (all require `status =
+   * 'processing'`), so an indefinitely-`unresolved` row would be stranded with
+   * nothing driving it. Once `now - since >= pausedMaxWaitMs`, `resolveRedrive`
+   * takes `dispatch` instead of `unresolved` (reusing the existing knob — see
+   * ADR-0047's own "unreachable ⇒ bounded" rule). Cleared on any other outcome.
+   */
+  redriveUnresolvedSince = /* @__PURE__ */ new Map();
+  /**
+   * Consecutive-identical-poll-failure streak for the re-drive fence (#1348),
+   * keyed by Evident **message id** (not session) so `clearRedriveUnresolved`
+   * can drop it with the other two trackers and it cannot leak. `sessionId` is
+   * carried inside the entry, not the key: a session change is a different
+   * situation and resets the streak, which gives the `(sessionId, message.id)`
+   * pairing #1348 asks for without a composite map key.
+   */
+  redrivePollFailures = /* @__PURE__ */ new Map();
+  /**
+   * "Already emitted `redrive_outcome_unreported` for THIS (message, outcome)
+   * streak" (Class B, #1340: the runner DECIDED reattach/settle/fail_permanent
+   * but its own PATCH to record it failed — distinct from Class A's
+   * `redrive_poll_failed`, where opencode itself can't be observed). Keyed by
+   * message id, valued by the outcome currently failing to report, so a
+   * change of outcome starts a fresh signal. Cleared by
+   * `clearRedriveUnresolved` the instant either PATCH succeeds.
+   */
+  redriveOutcomeUnreportedSignalled = /* @__PURE__ */ new Map();
   /**
    * "A null-id re-adopt re-dispatch is in flight, awaiting its read-back" (WI-5
    * Task 5.4, High-2). Since we no longer send a caller-supplied id, a re-dispatch
@@ -3593,6 +3657,12 @@ var ChannelDriver = class _ChannelDriver {
         skippedAlreadyDispatched += 1;
         continue;
       }
+      if (message.opencode_message_id) {
+        const outcome = await this.resolveRedrive(conv, sessionId, message, refusedSessionId);
+        if (outcome !== "dispatch") {
+          break;
+        }
+      }
       const options = {
         agent: message.opencode_agent ?? void 0,
         model: message.opencode_model ?? void 0
@@ -3682,6 +3752,338 @@ var ChannelDriver = class _ChannelDriver {
     this.ensureWatcherRunning(sessionId);
     return dispatched;
   }
+  /**
+   * Poll a session's message list for the re-drive fence (#965), via the
+   * INJECTED `fetchImpl` — NOT the imported `getSessionMessages` helper, which
+   * hits the global `fetch` and would bypass the same override every other
+   * opencode poll in this file respects. Mirrors `readoptProcessing`'s own
+   * snapshot fetch (`:3081-3111`).
+   *
+   * Returns `{ ok: true, messages }` on a readable snapshot, or
+   * `{ ok: false, signature }` on failure — `signature` is a string that
+   * repeats across attempts for the SAME underlying fault (used by the
+   * consecutive-identical-failure bound, #1348), or `null` for a thrown
+   * exception, which is NOT countable toward that bound (a network blip / an
+   * opencode restart also throws identically every tick, and must keep
+   * retrying unbounded rather than ever being treated as permanent).
+   */
+  async pollSessionMessagesForRedrive(conv, message, sessionId) {
+    try {
+      const res = await this.fetchImpl(`${this.opencodeBase}/session/${sessionId}/message`);
+      if (!res.ok) {
+        const rawBody = await res.text();
+        const normalized = normalizeRedrivePollFailureBody(rawBody);
+        this.log({
+          level: "warn",
+          message: `Re-drive: polling session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} returned HTTP ${res.status}${normalized ? `: ${normalized}` : ""} \u2014 treating as unreadable this tick`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        return { ok: false, signature: `HTTP ${res.status}${normalized ? `: ${normalized}` : ""}` };
+      }
+      const body = await res.json();
+      if (!Array.isArray(body)) {
+        this.log({
+          level: "warn",
+          message: `Re-drive: polling session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} returned a non-array message body \u2014 treating as unreadable this tick`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        return { ok: false, signature: "non-array message body" };
+      }
+      return { ok: true, messages: body };
+    } catch (err) {
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to poll session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      return { ok: false, signature: null };
+    }
+  }
+  /**
+   * The re-drive fence for a `pending` row that already carries a stored
+   * `opencode_message_id` (#965) — i.e. it has already been handed to opencode at
+   * least once (see the invariant at `QueuedMessage.opencode_message_id`'s doc).
+   * The lifecycle cron can falsely reclaim a `processing` row back to `pending`
+   * mid-turn (a 5-minute liveness-staleness check racing a still-running turn);
+   * without this fence the drain loop would re-`prompt_async` the SAME turn a
+   * second time against live GitHub state. Mirrors `readoptOne`'s job for the
+   * `processing` re-adopt path, but simpler: no b1/b2 preamble cross-check is
+   * needed here because `refusedSessionId` already handles the one case
+   * (#553 abandoned session) that path exists for.
+   *
+   * Only `ChannelAuthError` propagates. A poll that fails identically
+   * `MAX_IDENTICAL_REDRIVE_POLL_FAILURES` times in a row reports the message
+   * failed instead of retrying it (#1348) — SEPARATE from, not a replacement
+   * for, `resolveRedriveUnresolved`'s own `pausedMaxWaitMs` bound below. Every
+   * other failure resolves to `unresolved` and is retried whole on the next
+   * ~2s drain tick.
+   */
+  async resolveRedrive(conv, sessionId, message, refusedSessionId) {
+    const ocId = message.opencode_message_id ?? null;
+    if (refusedSessionId) {
+      this.clearRedriveUnresolved(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_redispatched");
+      return "dispatch";
+    }
+    const polled = await this.pollSessionMessagesForRedrive(conv, message, sessionId);
+    if (!polled.ok) {
+      const streak = this.recordRedrivePollFailure(message.id, sessionId, polled.signature);
+      if (streak >= MAX_IDENTICAL_REDRIVE_POLL_FAILURES && polled.signature !== null) {
+        return this.failRedrivePollPermanent(conv, sessionId, message, polled.signature, streak);
+      }
+      return this.resolveRedriveUnresolved(conv, message);
+    }
+    this.redrivePollFailures.delete(message.id);
+    const messages = polled.messages;
+    if (messages.length === 0) {
+      return this.resolveRedriveUnresolved(conv, message);
+    }
+    const state = messageRunState(messages, ocId ?? "");
+    if (state === "failed" && isAbortedTerminalReply(messages, ocId ?? "")) {
+      const ongoing = await isSessionOngoing(this.port, sessionId);
+      if (ongoing === false) {
+        this.log({
+          level: "info",
+          message: `Re-drive: message ${message.id.slice(0, 8)} carries an abort-shaped terminal error and session ${sessionId.slice(0, 8)} is not-ongoing per GET /session/status \u2014 restart orphan, re-dispatching instead of marking it permanently failed`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        this.clearRedriveUnresolved(message.id);
+        void this.postSignal(conv.id, message.id, "redrive_redispatched");
+        return "dispatch";
+      }
+    }
+    if (state === "done" || state === "failed") {
+      return this.settleRedrive(conv, sessionId, message, ocId, messages, state);
+    }
+    if (state === "running" || state === "queued") {
+      const ongoing = await isSessionOngoing(this.port, sessionId);
+      if (ongoing === true) {
+        return this.reattachRedrive(conv, sessionId, message, ocId);
+      }
+      if (ongoing === false) {
+        this.clearRedriveUnresolved(message.id);
+        void this.postSignal(conv.id, message.id, "redrive_redispatched");
+        return "dispatch";
+      }
+      return this.resolveRedriveUnresolved(conv, message);
+    }
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_redispatched");
+    return "dispatch";
+  }
+  /**
+   * The `reattached` outcome (Task 3.3): the prior turn is STILL ONGOING per
+   * opencode's own status map — undo the false reclaim instead of starting a
+   * second turn.
+   */
+  async reattachRedrive(conv, sessionId, message, ocId) {
+    let anchorMs;
+    const parsed = message.processing_started_at ? Date.parse(message.processing_started_at) : NaN;
+    if (!Number.isNaN(parsed)) {
+      anchorMs = parsed;
+    } else {
+      anchorMs = this.now();
+      this.log({
+        level: "error",
+        message: `Re-drive: message ${message.id.slice(0, 8)} has null/unparseable processing_started_at (${String(message.processing_started_at)}) \u2014 anchoring the watcher's absolute-age ceiling to now (defensive)`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+    }
+    const title = await this.resolveSessionTitle(sessionId, conv.id);
+    try {
+      await this.markProcessing(conv.id, message.id, sessionId, ocId, title);
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to restore message ${message.id.slice(0, 8)} to processing (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      this.signalRedriveOutcomeUnreported(conv, message, "reattach");
+      return "unresolved";
+    }
+    this.clearRedriveUnresolved(message.id);
+    this.registerReadopted(conv, sessionId, message, ocId ?? "", anchorMs);
+    this.dispatched.add(message.id);
+    this.readopted.add(message.id);
+    this.ensureWatcherRunning(sessionId);
+    const watchedForMs = this.now() - anchorMs;
+    void this.postSignal(conv.id, message.id, "redrive_reattached", {
+      watched_for_ms: watchedForMs
+    });
+    this.log({
+      level: "warn",
+      message: `Re-drive: message ${message.id.slice(0, 8)} (session ${sessionId.slice(0, 8)}) was wrongly reclaimed to pending while its turn was still running (watched ${watchedForMs}ms) \u2014 restored to processing instead of re-dispatching`,
+      conversation_id: conv.id,
+      message_id: message.id
+    });
+    return "reattached";
+  }
+  /**
+   * The `settled` outcome (Task 3.2): the prior turn already finished (or
+   * errored) while nobody was watching — deliver/report it instead of re-running.
+   * Mirrors `readoptOne`'s `done`/`failed` branches' error discipline, simplified
+   * (no `doneUndeliverable` park: a terminal PATCH failure here just retries next
+   * drain, same as any other non-auth failure). The restart-abort carve-out that
+   * keeps the two in step for `failed` lives in the caller (`resolveRedrive`, #1310),
+   * so a row reaching this `failed` branch is a GENUINE failure.
+   */
+  async settleRedrive(conv, sessionId, message, ocId, messages, state) {
+    try {
+      if (state === "done") {
+        const title = await this.resolveSessionTitle(sessionId, conv.id);
+        const usage = messageUsage(messages, ocId ?? "");
+        this.log({
+          level: "info",
+          message: `Re-drive: message ${message.id.slice(0, 8)} completed while its row was wrongly reclaimed to pending \u2014 marking done instead of re-dispatching`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        await this.markDone(conv.id, message.id, sessionId, ocId, title, usage);
+      } else {
+        const error2 = messageError(messages, ocId ?? "") ?? void 0;
+        const usage = messageUsage(messages, ocId ?? "");
+        const failure = await this.classifyModelAuthFailure(messages, ocId ?? "");
+        this.log({
+          level: "error",
+          message: `Re-drive: message ${message.id.slice(0, 8)} errored while its row was wrongly reclaimed to pending \u2014 marking failed instead of re-dispatching: ${error2 ?? "(no error text)"}`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        await this.markFailed(conv.id, message.id, sessionId, error2, usage, failure);
+      }
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to report message ${message.id.slice(0, 8)} ${state} (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      this.signalRedriveOutcomeUnreported(conv, message, "settle");
+      return "unresolved";
+    }
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_settled");
+    return "settled";
+  }
+  /**
+   * The permanent-failure outcome (#1348): the fence's own poll of this session
+   * failed with the SAME opencode-answered signature
+   * `MAX_IDENTICAL_REDRIVE_POLL_FAILURES` times in a row — a transient blip
+   * would have varied or eventually cleared (see `pollSessionMessagesForRedrive`
+   * and `recordRedrivePollFailure`), so this is a durable fault (e.g. #1345's
+   * corrupted opencode session) rather than something worth retrying forever.
+   * Mirrors `settleRedrive`'s error discipline: no `usage`/`failure` args to
+   * `markFailed` (no opencode snapshot to extract them from — this poll never
+   * got a readable one).
+   */
+  async failRedrivePollPermanent(conv, sessionId, message, signature, streak) {
+    this.log({
+      level: "error",
+      message: `Re-drive: message ${message.id.slice(0, 8)} (session ${sessionId.slice(0, 8)}) failed to poll with the identical signature "${signature}" ${streak} times in a row \u2014 reporting the message failed instead of retrying forever`,
+      conversation_id: conv.id,
+      message_id: message.id
+    });
+    try {
+      await this.markFailed(
+        conv.id,
+        message.id,
+        sessionId,
+        `The runner could not read this conversation's state from OpenCode (${signature}). The same failure repeated ${streak} times in a row, so the message was not retried further.`
+      );
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to report message ${message.id.slice(0, 8)} permanently failed (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      this.signalRedriveOutcomeUnreported(conv, message, "fail_permanent");
+      return "unresolved";
+    }
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_poll_failed");
+    return "settled";
+  }
+  /**
+   * The bounded `unresolved` outcome (Task 3.4): opencode's state could not be
+   * observed (snapshot unreadable/empty, or `isSessionOngoing` returned `null`).
+   * A `pending` row is invisible to every cron arm (all require `status =
+   * 'processing'`), so an indefinitely-`unresolved` row would be stranded with
+   * nothing driving it — bound it to the existing `pausedMaxWaitMs` window
+   * (reusing the knob, not a new constant) and take `dispatch` once elapsed.
+   */
+  resolveRedriveUnresolved(conv, message) {
+    const now = this.now();
+    const since = this.redriveUnresolvedSince.get(message.id);
+    if (since !== void 0 && now - since >= this.pausedMaxWaitMs) {
+      this.clearRedriveUnresolved(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_redispatched");
+      return "dispatch";
+    }
+    if (since === void 0) {
+      this.redriveUnresolvedSince.set(message.id, now);
+    }
+    if (!this.redriveUnresolvedSignalled.has(message.id)) {
+      this.redriveUnresolvedSignalled.add(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_unresolved");
+    }
+    return "unresolved";
+  }
+  /** Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved` outcome). */
+  clearRedriveUnresolved(messageId) {
+    this.redriveUnresolvedSince.delete(messageId);
+    this.redriveUnresolvedSignalled.delete(messageId);
+    this.redrivePollFailures.delete(messageId);
+    this.redriveOutcomeUnreportedSignalled.delete(messageId);
+  }
+  /**
+   * Class B (#1340): the runner DECIDED an outcome (reattach/settle/fail_permanent)
+   * but its own PATCH to record it failed. Deliberately NOT bounded like
+   * `resolveRedriveUnresolved`, for two load-bearing reasons: (1) the only
+   * remedy is a PATCH to the server — the very call that is failing, so a bound
+   * would act by retrying it; (2) this class is self-clearing by construction
+   * (the next successful PATCH resolves it via `clearRedriveUnresolved`),
+   * unlike #1340's deterministic, permanent shape. Fires at most once per
+   * (message, outcome) streak.
+   */
+  signalRedriveOutcomeUnreported(conv, message, outcome) {
+    if (this.redriveOutcomeUnreportedSignalled.get(message.id) === outcome) return;
+    this.redriveOutcomeUnreportedSignalled.set(message.id, outcome);
+    void this.postSignal(conv.id, message.id, "redrive_outcome_unreported", {
+      attempted_outcome: outcome
+    });
+  }
+  /**
+   * Record one poll outcome toward the re-drive fence's consecutive-identical-
+   * failure streak (#1348) and return the resulting count. `signature === null`
+   * (a thrown exception, H1) always clears the streak and returns `0` — it is
+   * never countable. Otherwise the streak continues only when BOTH the session
+   * and the signature match the previous failure; anything else (a different
+   * session, or the same session failing a DIFFERENT way) starts a fresh streak
+   * at `1`.
+   */
+  recordRedrivePollFailure(messageId, sessionId, signature) {
+    if (signature === null) {
+      this.redrivePollFailures.delete(messageId);
+      return 0;
+    }
+    const existing = this.redrivePollFailures.get(messageId);
+    if (existing && existing.sessionId === sessionId && existing.signature === signature) {
+      existing.count += 1;
+      return existing.count;
+    }
+    this.redrivePollFailures.set(messageId, { sessionId, signature, count: 1 });
+    return 1;
+  }
   /**
    * Record that `sessionId` is no longer a valid binding for `conversationId`
    * (#553). Keyed by conversation and hard-capped, so it cannot grow with the
@@ -3965,9 +4367,10 @@ var ChannelDriver = class _ChannelDriver {
    * opencode reports ACTIVELY `running` is watched to completion (its liveness
    * heartbeat keeps the cron off its row), while a re-adopted turn that is paused
    * awaiting a human — or queued/unreachable — is still bounded by `deadline` and
-   * handed to the cron. The old "the `deadline` must settle before the ~15-min
-   * cron or they double-drive" reasoning is superseded: liveness now settles the
-   * actively-running case; `deadline` settles the rest. `dispatchedAt` stays `now`
+   * handed to the cron. Real invariant (#965): the cron MAY reclaim a row this
+   * runner still holds; a reclaimed row that already ran is never re-dispatched
+   * while opencode reports its turn ongoing (readopt's own gate here, and the
+   * `pending`-row re-drive fence, `resolveRedrive`). `dispatchedAt` stays `now`
    * (only the appear-guard uses it).
    *
    * `evidentMessageId` addresses the SERVER row (for markProcessing/markDone);
@@ -4527,7 +4930,10 @@ var ChannelDriver = class _ChannelDriver {
    * re-dispatched (at most once, see `forceReadoptRun`):
    *   - `done`             → `markDone` now (guarded like the watcher's done branch);
    *   - `failed`           → `markFailed` with the surfaced error (issue #182), so an
-   *                          errored turn is reported failed on restart, NOT re-dispatched;
+   *                          errored turn is reported failed on restart, NOT re-dispatched —
+   *                          EXCEPT a restart-ABORTED turn under a not-ongoing session,
+   *                          which is a restart orphan wearing a terminal error and is
+   *                          re-dispatched instead (issue #1310, see the branch below);
    *   - `running`/`queued` → re-attach a watcher via `registerReadopted` (no re-dispatch),
    *                          tracking the stored id so the reply correlates by it;
    *   - `unknown`/null id  → re-dispatch (opencode assigns a fresh id) + attach a watcher.
@@ -4591,7 +4997,16 @@ var ChannelDriver = class _ChannelDriver {
       void this.postSignal(row.conversation_id, row.id, "readopt_done");
       return;
     }
-    if (state === "failed") {
+    const restartAborted = state === "failed" && sessionOngoing === false && isAbortedTerminalReply(messages, ocId ?? "");
+    if (restartAborted) {
+      this.log({
+        level: "info",
+        message: `Re-adopt: message ${row.id.slice(0, 8)} carries an abort-shaped terminal error and session ${sessionId.slice(0, 8)} is not-ongoing per GET /session/status \u2014 restart orphan, re-dispatching instead of marking it permanently failed`,
+        conversation_id: row.conversation_id,
+        message_id: row.id
+      });
+    }
+    if (state === "failed" && !restartAborted) {
       const error2 = messageError(messages, ocId ?? "") ?? void 0;
       const usage = messageUsage(messages, ocId ?? "");
       const failure = await this.classifyModelAuthFailure(messages, ocId ?? "");
@@ -4869,7 +5284,8 @@ var ChannelDriver = class _ChannelDriver {
       opencode_model: row.opencode_model,
       source_message_id: row.source_message_id,
       slack_user_id: row.slack_user_id,
-      attachments: row.attachments ?? null
+      attachments: row.attachments ?? null,
+      opencode_message_id: row.opencode_message_id
     };
   }
   /**
@@ -6121,10 +6537,15 @@ async function handleAuthError(state, error2) {
 }
 async function driveChannels(state, driver) {
   let idlePolls = 0;
+  let idleMs = 0;
   let consecutiveDrainFailures = 0;
+  let unreachableMs = 0;
   let lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
   while (state.running) {
+    const cycleStartedAtMs = performance.now();
+    let idleThisCycle = false;
+    let unreachableThisCycle = false;
     if (state.connection?.reconnecting && state.connection.reconnectPromise) {
       logActivity(state, { type: "info", message: "Waiting for tunnel reconnection..." });
       if (state.interactive) displayStatus(state);
@@ -6140,17 +6561,22 @@ async function driveChannels(state, driver) {
     try {
       const processed = await driver.drainPending();
       consecutiveDrainFailures = 0;
+      unreachableMs = 0;
       state.messageCount += processed;
       const proxiedActivity = state.lastProxiedActivityAt !== lastSeenProxiedActivityAt;
       lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
       const appliedFiles = driver.fileSyncActivity().appliedFiles;
-      const fileActivity = carriedOverFileSync || appliedFiles !== lastSeenAppliedFiles;
+      const filesApplied = appliedFiles !== lastSeenAppliedFiles;
+      const fileActivity = carriedOverFileSync || filesApplied;
       lastSeenAppliedFiles = appliedFiles;
+      if (filesApplied) state.claudeUsageRearm?.();
       if (processed > 0 || driver.hasInFlightWatchers() || proxiedActivity || fileActivity) {
         idlePolls = 0;
+        idleMs = 0;
         if (processed > 0 && state.interactive) displayStatus(state);
       } else if (state.idleTimeout !== null) {
         idlePolls++;
+        idleThisCycle = true;
         if (idlePolls === 1) {
           logActivity(state, {
             type: "info",
@@ -6176,8 +6602,10 @@ async function driveChannels(state, driver) {
       if (state.interactive) displayStatus(state);
       if (driver.hasInFlightWatchers()) {
         consecutiveDrainFailures = 0;
+        unreachableMs = 0;
       } else if (state.idleTimeout !== null) {
         consecutiveDrainFailures++;
+        unreachableThisCycle = true;
         if (consecutiveDrainFailures === 1) {
           logActivity(state, {
             type: "info",
@@ -6188,25 +6616,22 @@ async function driveChannels(state, driver) {
       }
     }
     await new Promise((resolve3) => setTimeout(resolve3, CHANNEL_POLL_INTERVAL_MS));
-    if (state.idleTimeout !== null && consecutiveDrainFailures >= 2) {
-      const unreachableMs = consecutiveDrainFailures * CHANNEL_POLL_INTERVAL_MS;
-      if (unreachableMs > state.idleTimeout * 1e3) {
-        logActivity(state, {
-          type: "info",
-          level: "warn",
-          message: `Exiting: could not reach Evident for ${consecutiveDrainFailures} consecutive polls (${Math.round(unreachableMs / 1e3)}s)`
-        });
-        if (state.interactive) displayStatus(state);
-        break;
-      }
+    const cycleMs = performance.now() - cycleStartedAtMs;
+    if (idleThisCycle) idleMs += cycleMs;
+    if (unreachableThisCycle) unreachableMs += cycleMs;
+    if (state.idleTimeout !== null && consecutiveDrainFailures >= 2 && unreachableMs > state.idleTimeout * 1e3) {
+      logActivity(state, {
+        type: "info",
+        level: "warn",
+        message: `Exiting: could not reach Evident for ${consecutiveDrainFailures} consecutive polls (${Math.round(unreachableMs / 1e3)}s)`
+      });
+      if (state.interactive) displayStatus(state);
+      break;
     }
-    if (state.idleTimeout !== null && idlePolls >= 2) {
-      const idleMs = idlePolls * CHANNEL_POLL_INTERVAL_MS;
-      if (idleMs > state.idleTimeout * 1e3) {
-        logActivity(state, { type: "info", message: "Idle timeout reached" });
-        if (state.interactive) displayStatus(state);
-        break;
-      }
+    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3) {
+      logActivity(state, { type: "info", message: "Idle timeout reached" });
+      if (state.interactive) displayStatus(state);
+      break;
     }
   }
 }
@@ -6285,6 +6710,9 @@ function scheduleSessionCleanup(state, driver, options) {
   );
   state.sessionCleanupTimers.push(interval, firstSweep);
 }
+function claudeUsageFailureStreakSuffix(consecutiveFailures) {
+  return consecutiveFailures > 1 ? ` (${consecutiveFailures} consecutive failures)` : "";
+}
 function scheduleClaudeUsageReporting(state, options) {
   const { mode, warnings } = resolveClaudeUsageReportingMode(
     options.claudeUsageReporting,
@@ -6303,13 +6731,26 @@ function scheduleClaudeUsageReporting(state, options) {
       level: "debug",
       message: "Claude usage reporting is off (--claude-usage-reporting off)"
     });
-    return;
+    return null;
   }
   let consecutiveFailures = 0;
+  let armed = false;
+  let rearmRequested = false;
   const scheduleNextTick = () => {
+    armed = true;
+    rearmRequested = false;
     state.claudeUsageTimer = setTimeout(() => void tick(false), nextReportDelayMs());
   };
-  const tick = async (isFirst) => {
+  const rearm = () => {
+    if (armed) {
+      rearmRequested = true;
+      return;
+    }
+    rearmRequested = false;
+    armed = true;
+    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  };
+  const tick = async (isProbe) => {
     try {
       const usage = await getClaudeUsage();
       const result = await reportClaudeUsage(state.agentId, state.authHeader, usage);
@@ -6331,8 +6772,8 @@ function scheduleClaudeUsageReporting(state, options) {
         consecutiveFailures++;
         logActivity(state, {
           type: "info",
-          level: consecutiveFailures === 1 ? "warn" : "debug",
-          message: `Failed to report Claude usage: ${result.error}`
+          level: claudeUsageFailureLogLevel(consecutiveFailures),
+          message: `Failed to report Claude usage: ${result.error}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
         });
       }
       scheduleNextTick();
@@ -6345,12 +6786,14 @@ function scheduleClaudeUsageReporting(state, options) {
             message: "Claude usage reporting is forced on but no usable Claude Code login was found \u2014 run `claude` to sign in; reporting will keep retrying"
           });
           scheduleNextTick();
-        } else if (isFirst) {
+        } else if (isProbe) {
           logActivity(state, {
             type: "info",
             level: "debug",
             message: `Claude usage reporting: ${error2.message}`
           });
+          armed = false;
+          if (rearmRequested) rearm();
         } else {
           logActivity(state, {
             type: "info",
@@ -6364,14 +6807,16 @@ function scheduleClaudeUsageReporting(state, options) {
         const message = error2 instanceof Error ? error2.message : String(error2);
         logActivity(state, {
           type: "info",
-          level: consecutiveFailures === 1 ? "warn" : "debug",
-          message: `Claude usage reporting failed: ${message}`
+          level: claudeUsageFailureLogLevel(consecutiveFailures),
+          message: `Claude usage reporting failed: ${message}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
         });
         scheduleNextTick();
       }
     }
   };
+  armed = true;
   state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  return rearm;
 }
 async function notifyOffline(state) {
   if (!state.agentId || !state.authHeader) return;
@@ -6412,6 +6857,7 @@ async function cleanup(state, opts = {}) {
     clearTimeout(state.claudeUsageTimer);
     state.claudeUsageTimer = null;
   }
+  state.claudeUsageRearm = null;
   if (opts.graceful && state.channelDriver) {
     state.channelDriver.stop();
     log2(state, "Draining in-flight channel work before shutdown...");
@@ -6493,6 +6939,7 @@ async function run(options) {
     lastProxiedActivityAt: null,
     sessionCleanupTimers: [],
     claudeUsageTimer: null,
+    claudeUsageRearm: null,
     authHeader: ""
   };
   setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
@@ -6572,6 +7019,7 @@ async function run(options) {
         console.log(chalk6.dim("Or run `evident login` for interactive authentication"));
         blank();
         process.exit(1);
+        return;
       }
       blank();
       console.log(chalk6.yellow("You are not logged in to Evident."));
@@ -6616,6 +7064,7 @@ async function run(options) {
         } else {
           printError(resolved.error || "Failed to resolve runner ID from key");
           process.exit(1);
+          return;
         }
       } else {
         printError(
@@ -6629,6 +7078,7 @@ async function run(options) {
         );
         blank();
         process.exit(1);
+        return;
       }
     }
     telemetry.info(
@@ -6876,7 +7326,7 @@ async function run(options) {
       throw error2;
     }
     scheduleSessionCleanup(state, channelDriver, options);
-    scheduleClaudeUsageReporting(state, options);
+    state.claudeUsageRearm = scheduleClaudeUsageReporting(state, options);
     if (!interactive || state.json) {
       log2(state, "Driving channel messages...");
     }
@@ -6961,7 +7411,7 @@ program.command("run").description("Connect to Evident and process messages").op
   []
 ).option(
   "--tunnel-ready-file <path>",
-  "Path to write once the tunnel is connected (set by the MicroVM hooks; unused on a developer machine)"
+  "Path to write once the tunnel is connected (opt-in; unused unless an operator/image sets it)"
 ).action(
   (options) => {
     run({