@evident-ai/cli 3.1.1-dev.94145fb → 3.1.1-dev.9513dc6

package/dist/index.js

@@ -1532,6 +1532,9 @@ function isPreamblePinnedRunning(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   return completedOf(reply) != null && finishOf(reply) === "tool-calls";
 }
+function isB2AbandonmentConfirmed(params) {
+  return params.pinnedForMs >= params.minPinnedMs && params.descendantOngoing === false;
+}
 function messageError(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   const error2 = errorOf(reply);
@@ -2073,6 +2076,18 @@ var RunnerConnection = class {
   }
 };
 
+// src/lib/tunnel/ready-marker.ts
+import { writeFileSync } from "fs";
+function writeTunnelReadyMarker(path, agentId) {
+  try {
+    writeFileSync(path, `${agentId}
+`);
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: error2 instanceof Error ? error2.message : String(error2) };
+  }
+}
+
 // src/lib/channels/driver.ts
 import { homedir } from "os";
 
@@ -2499,6 +2514,8 @@ var DEFAULT_PAUSED_MAX_WAIT_MS = 10 * 60 * 1e3;
 var DEFAULT_STUCK_QUEUED_MS = 6e4;
 var HEARTBEAT_MS = 6e4;
 var ABSOLUTE_MAX_PROCESSING_MS = 6 * 60 * 60 * 1e3;
+var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
+var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
 var MAX_SUPERSEDED_CONVERSATIONS = 256;
 var ChannelAuthError = class extends Error {
@@ -3317,12 +3334,17 @@ var ChannelDriver = class _ChannelDriver {
       stuckReported: false,
       lastAliveAt: 0,
       aliveInFlight: false,
+      titleSynced: false,
+      titleSyncInFlight: false,
       awaitingHumanLatched: false,
       pausedOnQuestion: false,
       pausedOnPermission: false,
       pausedClearConfirmed: false,
       pausedInFlight: false,
-      deliveryDeadlineAnchored: false
+      deliveryDeadlineAnchored: false,
+      b2PinnedSinceMs: 0,
+      b2LastDescendantCheckMs: 0,
+      b2AbandonedSignalled: false
     });
   }
   /**
@@ -3390,12 +3412,17 @@ var ChannelDriver = class _ChannelDriver {
       // with no extra `re_adopted` signal needed (folds old WI-6).
       lastAliveAt: 0,
       aliveInFlight: false,
+      titleSynced: false,
+      titleSyncInFlight: false,
       awaitingHumanLatched: false,
       pausedOnQuestion: false,
       pausedOnPermission: false,
       pausedClearConfirmed: false,
       pausedInFlight: false,
-      deliveryDeadlineAnchored: false
+      deliveryDeadlineAnchored: false,
+      b2PinnedSinceMs: 0,
+      b2LastDescendantCheckMs: 0,
+      b2AbandonedSignalled: false
     });
   }
   /**
@@ -3557,58 +3584,7 @@ var ChannelDriver = class _ChannelDriver {
       }
     }
     if (state === "done") {
-      this.anchorDeliveryDeadline(inFlight);
-      if (!inFlight.done) {
-        this.log({
-          level: "info",
-          message: `Message ${inFlight.evidentMessageId.slice(0, 8)} completed \u2014 marking done`,
-          conversation_id: conv.id,
-          message_id: inFlight.evidentMessageId
-        });
-        const title = await this.resolveSessionTitle(sessionId, watcher.conv.id);
-        const usage = messageUsage(messages, inFlight.opencodeMessageId);
-        try {
-          await this.markDone(
-            conv.id,
-            inFlight.evidentMessageId,
-            sessionId,
-            inFlight.opencodeMessageId,
-            title,
-            usage
-          );
-        } catch (err) {
-          if (err instanceof ChannelAuthError) throw err;
-          if (err instanceof ChannelTerminalError) {
-            this.log({
-              level: "warn",
-              message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done (terminal HTTP ${err.status}) \u2014 leaving for the cron safety net: ${err.message}`,
-              conversation_id: conv.id,
-              message_id: inFlight.evidentMessageId
-            });
-            this.removeInFlight(watcher, inFlight.evidentMessageId);
-            return;
-          }
-          if (this.now() >= inFlight.deadline) {
-            this.log({
-              level: "warn",
-              message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done within the watch window \u2014 leaving for the cron safety net: ${err instanceof Error ? err.message : String(err)}`,
-              conversation_id: conv.id,
-              message_id: inFlight.evidentMessageId
-            });
-            this.removeInFlight(watcher, inFlight.evidentMessageId);
-            return;
-          }
-          this.log({
-            level: "warn",
-            message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done (will retry next tick): ${err instanceof Error ? err.message : String(err)}`,
-            conversation_id: conv.id,
-            message_id: inFlight.evidentMessageId
-          });
-          return;
-        }
-        inFlight.done = true;
-      }
-      this.removeInFlight(watcher, inFlight.evidentMessageId);
+      await this.settleMessageDone(sessionId, watcher, inFlight, messages);
       return;
     }
     if (state === "failed") {
@@ -3668,6 +3644,44 @@ var ChannelDriver = class _ChannelDriver {
       });
     }
     const activelyRunning = state === "running" && !awaitingHuman;
+    const pinnedNow = activelyRunning && isPreamblePinnedRunning(messages, inFlight.opencodeMessageId);
+    const snapshotReadable = messages != null && messages.length > 0;
+    if (!pinnedNow) {
+      if (snapshotReadable) {
+        inFlight.b2PinnedSinceMs = 0;
+        inFlight.b2LastDescendantCheckMs = 0;
+        inFlight.b2AbandonedSignalled = false;
+      }
+    } else {
+      if (inFlight.b2AbandonedSignalled) {
+        await this.settleMessageDone(sessionId, watcher, inFlight, messages);
+        return;
+      }
+      if (inFlight.b2PinnedSinceMs === 0) inFlight.b2PinnedSinceMs = this.now();
+      const pinnedForMs = this.now() - inFlight.b2PinnedSinceMs;
+      if (pinnedForMs >= B2_ABANDONMENT_MIN_PINNED_MS && this.now() - inFlight.b2LastDescendantCheckMs >= B2_ABANDONMENT_RECHECK_MS) {
+        inFlight.b2LastDescendantCheckMs = this.now();
+        const descendantOngoing = await this.isAnyDescendantSessionOngoing(sessionId);
+        if (isB2AbandonmentConfirmed({
+          pinnedForMs,
+          minPinnedMs: B2_ABANDONMENT_MIN_PINNED_MS,
+          descendantOngoing
+        })) {
+          inFlight.b2AbandonedSignalled = true;
+          this.log({
+            level: "warn",
+            message: `Message ${id.slice(0, 8)} b2-pinned for ${Math.round(pinnedForMs / 1e3)}s with no ongoing descendant sub-agent session (status-map confirmed) \u2014 treating the delegated/tool turn as abandoned, resolving done`,
+            conversation_id: conv.id,
+            message_id: id
+          });
+          void this.postSignal(conv.id, id, "b2_abandoned_resolved", {
+            watched_for_ms: pinnedForMs
+          });
+          await this.settleMessageDone(sessionId, watcher, inFlight, messages);
+          return;
+        }
+      }
+    }
     if (activelyRunning && this.now() - inFlight.processingAnchorMs >= ABSOLUTE_MAX_PROCESSING_MS) {
       this.log({
         level: "warn",
@@ -3687,6 +3701,18 @@ var ChannelDriver = class _ChannelDriver {
         inFlight.aliveInFlight = false;
         if (ok) inFlight.lastAliveAt = this.now();
       });
+      if (!inFlight.titleSynced && !inFlight.titleSyncInFlight) {
+        inFlight.titleSyncInFlight = true;
+        void this.resolveSessionTitle(sessionId, conv.id).then(async (title) => {
+          if (!title) {
+            inFlight.titleSyncInFlight = false;
+            return;
+          }
+          const ok = await this.patchConversationTitle(conv.id, title);
+          inFlight.titleSyncInFlight = false;
+          if (ok) inFlight.titleSynced = true;
+        });
+      }
     }
     if (awaitingHuman) {
       if (!inFlight.awaitingHumanLatched) {
@@ -3724,6 +3750,70 @@ var ChannelDriver = class _ChannelDriver {
       this.removeInFlight(watcher, inFlight.evidentMessageId);
     }
   }
+  /**
+   * Settle a message whose run-state has resolved `'done'` — extracted verbatim
+   * (pure refactor, no behavior change) from `serviceInFlightMessage`'s former
+   * inline `state === 'done'` branch body, so a SECOND caller (the #721
+   * b2-abandonment resolution) can reach the exact same completion behavior
+   * (delivery-deadline anchoring, title resolution, usage extraction, and
+   * `markDone`'s auth/terminal/transient-retry discipline) without duplicating it
+   * and risking the two copies silently drifting apart.
+   */
+  async settleMessageDone(sessionId, watcher, inFlight, messages) {
+    const conv = watcher.conv;
+    this.anchorDeliveryDeadline(inFlight);
+    if (!inFlight.done) {
+      this.log({
+        level: "info",
+        message: `Message ${inFlight.evidentMessageId.slice(0, 8)} completed \u2014 marking done`,
+        conversation_id: conv.id,
+        message_id: inFlight.evidentMessageId
+      });
+      const title = await this.resolveSessionTitle(sessionId, watcher.conv.id);
+      const usage = messageUsage(messages, inFlight.opencodeMessageId);
+      try {
+        await this.markDone(
+          conv.id,
+          inFlight.evidentMessageId,
+          sessionId,
+          inFlight.opencodeMessageId,
+          title,
+          usage
+        );
+      } catch (err) {
+        if (err instanceof ChannelAuthError) throw err;
+        if (err instanceof ChannelTerminalError) {
+          this.log({
+            level: "warn",
+            message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done (terminal HTTP ${err.status}) \u2014 leaving for the cron safety net: ${err.message}`,
+            conversation_id: conv.id,
+            message_id: inFlight.evidentMessageId
+          });
+          this.removeInFlight(watcher, inFlight.evidentMessageId);
+          return;
+        }
+        if (this.now() >= inFlight.deadline) {
+          this.log({
+            level: "warn",
+            message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done within the watch window \u2014 leaving for the cron safety net: ${err instanceof Error ? err.message : String(err)}`,
+            conversation_id: conv.id,
+            message_id: inFlight.evidentMessageId
+          });
+          this.removeInFlight(watcher, inFlight.evidentMessageId);
+          return;
+        }
+        this.log({
+          level: "warn",
+          message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done (will retry next tick): ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: conv.id,
+          message_id: inFlight.evidentMessageId
+        });
+        return;
+      }
+      inFlight.done = true;
+    }
+    this.removeInFlight(watcher, inFlight.evidentMessageId);
+  }
   // Restart recovery: re-adopt `processing` messages (ADR-0046, WI-3/4/5)
   /**
    * Re-adopt this agent's `processing` messages on drain (ADR-0046 Decision §1).
@@ -4303,6 +4393,47 @@ var ChannelDriver = class _ChannelDriver {
     }
     return false;
   }
+  /**
+   * Tri-state variant of the upward parentID membership walk (#721), used ONLY
+   * by `isAnyDescendantSessionOngoing`. Walks the SAME cached
+   * `resolveSessionParent` chain `sessionBelongsTo` uses above, but — unlike
+   * `sessionBelongsTo`, which deliberately collapses "confirmed not a
+   * descendant" and "the walk's fetch failed" into the same `false` (safe for
+   * its OTHER callers: interaction attribution and the recovery-path
+   * `isAnyDescendantSessionAlive`, both of which just retry next tick with no
+   * safety consequence either way) — this variant keeps those two outcomes
+   * SEPARATE, because `isAnyDescendantSessionOngoing`'s caller
+   * (`isB2AbandonmentConfirmed`) must never treat "couldn't tell" as "confirmed
+   * not ongoing".
+   *
+   * Return contract:
+   *  - `true`  → the walk reached `rootSessionId` — `sessionId` IS a descendant.
+   *  - `false` → the walk reached a definitive, parent-less root session
+   *              WITHOUT ever matching `rootSessionId` — `sessionId` is
+   *              CONFIRMED NOT a descendant of it.
+   *  - `null`  → INDETERMINATE: a `GET /session/:id` fetch failed partway
+   *              through the walk (`resolveSessionParent` returned `undefined`),
+   *              or the depth cap (32) was hit without a definitive answer (a
+   *              pathological/cyclic chain proves nothing either way). NEVER
+   *              treat this the same as `false` — see `sessionBelongsTo`'s own
+   *              doc comment above for why that collapse is safe THERE but not
+   *              here.
+   *
+   * `sessionBelongsTo` itself is UNCHANGED — this is an additive helper scoped
+   * to the live-path descendant check, not a modification of shared code used
+   * by interaction attribution or the recovery path.
+   */
+  async resolveSessionMembership(sessionId, rootSessionId) {
+    let current = sessionId;
+    for (let depth = 0; current && depth < 32; depth++) {
+      if (current === rootSessionId) return true;
+      const parent = await this.resolveSessionParent(current);
+      if (parent === void 0) return null;
+      if (parent === null) return false;
+      current = parent;
+    }
+    return null;
+  }
   /**
    * Resolve (and cache) a session's `parentID` via `GET /session/:id`. Returns
    * `null` for a root session (no parent) and `undefined` when opencode is
@@ -4387,6 +4518,54 @@ var ChannelDriver = class _ChannelDriver {
     }
     return null;
   }
+  /**
+   * Best-effort mid-turn title sync (#711 follow-up): PATCH a resolved OpenCode
+   * session title onto the conversation via the PLAIN conversation-update
+   * endpoint (`PATCH /runners/:agentId/conversations/:conversationId`) — NOT the
+   * message-status endpoint `markProcessing`/`markDone` use. Deliberately a
+   * separate, lighter call: it carries no `status`, so it cannot re-trigger the
+   * `processing`/`done` transition side effects (Slack notices, activity-log
+   * rows, delivery jobs) those PATCHes gate on `transitioned` — this call only
+   * ever touches `conversations.title`. That route (`routes/conversations.ts`)
+   * skips a title write matching the stored value, so a redundant call with the
+   * same title is a real no-op — it does not bump `updated_at`, which the
+   * conversation list sorts and paginates on. (Note this is a DIFFERENT guard
+   * from `threads.ts`'s "non-empty AND changed" one, which only covers the
+   * message-status PATCH; the non-empty half is enforced here instead, by
+   * `resolveSessionTitle` never returning an empty/placeholder title.)
+   *
+   * Telemetry-only / never blocks the caller, mirroring `postSignal`: a failure
+   * is logged and the title is simply retried on the next heartbeat tick (the
+   * caller only latches `titleSynced` on `true`).
+   */
+  async patchConversationTitle(conversationId, title) {
+    try {
+      const res = await this.fetchImpl(
+        `${this.apiUrl}/runners/${this.agentId}/conversations/${conversationId}`,
+        {
+          method: "PATCH",
+          headers: { Authorization: this.getAuthHeader(), "Content-Type": "application/json" },
+          body: JSON.stringify({ title })
+        }
+      );
+      if (!res.ok) {
+        this.log({
+          level: "debug",
+          message: `Mid-turn title sync PATCH for conversation ${conversationId.slice(0, 8)} returned HTTP ${res.status} (best-effort, will retry next heartbeat)`,
+          conversation_id: conversationId
+        });
+        return false;
+      }
+      return true;
+    } catch (err) {
+      this.log({
+        level: "debug",
+        message: `Best-effort mid-turn title sync PATCH failed for conversation ${conversationId.slice(0, 8)} (will retry next heartbeat): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conversationId
+      });
+      return false;
+    }
+  }
   /**
    * DEFENSIVE cross-check for the restart-recovery path (WI-2): is any descendant
    * (`task` sub-agent) session under `rootSessionId` still genuinely doing work?
@@ -4445,6 +4624,84 @@ var ChannelDriver = class _ChannelDriver {
     }
     return false;
   }
+  /**
+   * LIVE-PATH descendant-liveness check (#721): is any descendant (`task`
+   * sub-agent) session under `rootSessionId` currently ONGOING per OpenCode's own
+   * in-memory status map (`isSessionOngoing` — `busy`/`retry`)?
+   *
+   * Deliberately NOT `isAnyDescendantSessionAlive` (the RECOVERY-path
+   * cross-check above): that method judges liveness from the child's OWN
+   * TRANSCRIPT (`isSessionActivelyGenerating`), which is the right (only) option
+   * on the recovery path because a restart WIPES `SessionStatus`. On the LIVE
+   * path the local opencode server IS running, so its in-memory status map is
+   * live and authoritative — and per ADR-0047 §4a ("the child has its own entry
+   * [in the map]"), a `task` descendant's OWN busy/retry entry reflects its
+   * ENTIRE turn (including any tool call it is itself executing), not a
+   * per-message transcript snapshot. This sidesteps the "child's own tool is
+   * executing, between its step's completion and the next generation step"
+   * transcript gap that a transcript-based check would need a second,
+   * sustained-window bound to guard against — it is simply not derived from
+   * message timestamps at all.
+   *
+   * Why not just check `isSessionOngoing(port, rootSessionId)` (the ROOT's own
+   * status, as the recovery path does per §4a)? Because on the LIVE path the
+   * root session can be shared: a SECOND, unrelated user message can land on the
+   * SAME session (issue #721's own root cause) and keep the root `busy` for a
+   * reason that has nothing to do with THIS message's delegation. A `task`
+   * descendant session is spawned for exactly one delegated turn and never
+   * reused, so its OWN status-map entry is unambiguous evidence about that one
+   * delegation — which the root's status is not.
+   *
+   * Why membership is checked via `resolveSessionMembership`, NOT
+   * `sessionBelongsTo`: `sessionBelongsTo` collapses a transient
+   * `GET /session/:id` fetch failure into "not a descendant", which would
+   * silently drop a genuinely-live candidate from consideration on the one
+   * unlucky tick its membership-walk fetch hiccups (#721).
+   * `resolveSessionMembership` keeps that failure mode as a distinct `null`
+   * (indeterminate) so it is folded into THIS method's own `indeterminate` flag
+   * instead.
+   *
+   * Return contract (note the DIFFERENT judge vs. `isAnyDescendantSessionAlive`):
+   *  - `true`  → some descendant session is `busy`/`retry` (genuinely ongoing).
+   *  - `false` → enumeration succeeded, EVERY candidate's MEMBERSHIP was
+   *              confirmed either way (`resolveSessionMembership` never
+   *              returned `null`), and every CONFIRMED descendant's status read
+   *              succeeded and is not ongoing (includes "no descendant session
+   *              exists at all" — e.g. a plain, non-`task` tool call).
+   *  - `null`  → INDETERMINATE: `listSessions` failed, OR at least one
+   *              candidate's MEMBERSHIP could not be confirmed
+   *              (`resolveSessionMembership` returned `null` — a fetch failure
+   *              or pathological chain partway through the parent walk), OR at
+   *              least one CONFIRMED descendant's `isSessionOngoing` read
+   *              failed — and no OTHER candidate was already confirmed `true`.
+   *              The caller MUST NOT treat `null` the same as `false` here
+   *              (unlike the recovery cross-check's contract) — see
+   *              `isB2AbandonmentConfirmed`.
+   */
+  async isAnyDescendantSessionOngoing(rootSessionId) {
+    const sessions = await listSessions(this.port);
+    if (!sessions) {
+      this.log({
+        level: "warn",
+        message: `Could not enumerate sessions to check descendant liveness for root ${rootSessionId} (listSessions failed) \u2014 treating descendant liveness as indeterminate`
+      });
+      return null;
+    }
+    let indeterminate = false;
+    for (const candidate of sessions) {
+      if (!candidate?.id || candidate.id === rootSessionId) continue;
+      const membership = await this.resolveSessionMembership(candidate.id, rootSessionId);
+      if (membership === null) {
+        indeterminate = true;
+        continue;
+      }
+      if (membership === false) continue;
+      const ongoing = await isSessionOngoing(this.port, candidate.id);
+      if (ongoing === true) return true;
+      if (ongoing === null) indeterminate = true;
+    }
+    return indeterminate ? null : false;
+  }
   /**
    * Cheap decision-telemetry label for a running row's LAST correlated reply
    * (WI-2 Task 2.2): which running SHAPE it is, for the status-gated recovery log.
@@ -4905,7 +5162,7 @@ async function ensureOpenCodeRunning(ctx) {
       console.log(chalk5.yellow("Tip: Run with the correct port:"));
       console.log(
         chalk5.dim(
-          `  ${getCliName()} run --agent ${ctx.agentId} --port ${runningInstances[0].port}`
+          `  ${getCliName()} run --runner ${ctx.agentId} --port ${runningInstances[0].port}`
         )
       );
     }
@@ -5035,21 +5292,21 @@ async function resolveAgentIdFromKey(authHeader) {
       return { agent_id: data.agent_id };
     }
     return {
-      error: "Cannot resolve runner ID: auth type is not agent_key. Please provide --agent explicitly."
+      error: "Cannot resolve runner ID: auth type is not agent_key. Please provide --runner explicitly."
     };
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : "Unknown error";
     return { error: `Failed to resolve runner from key: ${message}` };
   }
 }
-var OFFLINE_NOTIFY_TIMEOUT_MS = 2e3;
+var BEST_EFFORT_NOTIFY_TIMEOUT_MS = 2e3;
 async function notifyAgentDisconnected(agentId, authHeader) {
   const apiUrl = getApiUrlConfig();
   try {
     const response = await fetch(`${apiUrl}/runners/${agentId}/disconnect`, {
       method: "POST",
       headers: { Authorization: authHeader },
-      signal: AbortSignal.timeout(OFFLINE_NOTIFY_TIMEOUT_MS)
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
     });
     if (!response.ok) {
       const serverMessage = await readErrorMessage(response);
@@ -5060,11 +5317,35 @@ async function notifyAgentDisconnected(agentId, authHeader) {
     }
     return { ok: true };
   } catch (error2) {
-    const name = error2?.name;
-    if (name === "TimeoutError" || name === "AbortError") {
-      return { ok: false, error: `timed out after ${OFFLINE_NOTIFY_TIMEOUT_MS}ms` };
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+function describeBestEffortError(error2) {
+  const name = error2?.name;
+  if (name === "TimeoutError" || name === "AbortError") {
+    return `timed out after ${BEST_EFFORT_NOTIFY_TIMEOUT_MS}ms`;
+  }
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+async function reportMicrovmId(agentId, authHeader, microvmId) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/microvm`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({ microvm_id: microvmId }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
     }
-    return { ok: false, error: error2 instanceof Error ? error2.message : String(error2) };
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
   }
 }
 async function getAgentInfo(agentId, authHeader) {
@@ -5714,6 +5995,21 @@ async function run(options) {
     }
     spinner?.succeed(`Runner: ${validation.agent.name || state.agentId}`);
     state.agentName = validation.agent.name;
+    const microvmId = process.env.MICROVM_ID?.trim();
+    if (microvmId) {
+      const reported = await reportMicrovmId(state.agentId, state.authHeader, microvmId);
+      if (reported.ok) {
+        log2(state, "Reported MicroVM identity so this runner can be resumed rather than restarted");
+      } else {
+        const message = `Could not report MicroVM identity (future wakes will cold-start): ${reported.error}`;
+        log2(state, message, "warn");
+        if (state.interactive && !state.json) {
+          logActivity(state, { type: "info", level: "warn", message });
+        }
+      }
+    } else {
+      log2(state, "Not running in a MicroVM (MICROVM_ID unset) \u2014 nothing to report", "debug");
+    }
     const ocSpinner = interactive && !state.json ? ora3("Checking OpenCode...").start() : null;
     try {
       const oc = await ensureOpenCodeRunning({
@@ -5792,6 +6088,18 @@ async function run(options) {
             type: "info",
             message: `Tunnel ${isReconnect ? "reconnected" : "connected"} (runner: ${agentId})`
           });
+          if (options.tunnelReadyFile) {
+            const marker = writeTunnelReadyMarker(options.tunnelReadyFile, agentId);
+            if (marker.ok) {
+              log2(state, `Wrote tunnel readiness marker to ${options.tunnelReadyFile}`, "debug");
+            } else {
+              log2(
+                state,
+                `Failed to write tunnel readiness marker to ${options.tunnelReadyFile}: ${marker.error}`,
+                "error"
+              );
+            }
+          }
           emitAgentConnected(state.agentId, {
             port: state.port,
             cli_version: getCliVersion(),
@@ -5956,6 +6264,9 @@ program.command("run").description("Connect to Evident and process messages").op
   "Allow Evident to write files into this directory (repeatable). Omit to disable file sync entirely.",
   (value, previous) => previous.concat([value]),
   []
+).option(
+  "--tunnel-ready-file <path>",
+  "Path to write once the tunnel is connected (set by the MicroVM hooks; unused on a developer machine)"
 ).action(
   (options) => {
     run({
@@ -5975,7 +6286,8 @@ program.command("run").description("Connect to Evident and process messages").op
       sessionCleanupInterval: options.sessionCleanupInterval,
       // Raw values — expansion/validation is single-sourced in run.ts's
       // resolveFileSyncDirectories.
-      enableFileSyncTo: options.enableFileSyncTo
+      enableFileSyncTo: options.enableFileSyncTo,
+      tunnelReadyFile: options.tunnelReadyFile
     });
   }
 );