@evident-ai/cli 3.2.1-dev.fa69368 → 3.3.1-dev.28c2528

package/dist/index.js

@@ -212,51 +212,80 @@ var api = {
 
 // src/lib/keychain.ts
 var SERVICE_NAME = "evident-cli";
-var keytarWarned = false;
-async function getKeytar() {
+var PROBE_SERVICE_NAME = "evident-cli-probe";
+var keychainWarned = false;
+function warnUnavailable(err) {
+  if (!keychainWarned) {
+    keychainWarned = true;
+    console.warn(
+      `System keychain unavailable, falling back to file-based credential storage: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+var keychain;
+async function probeKeychain() {
   try {
-    const keytar = await import("keytar");
+    const keytar = await import("@napi-rs/keyring/keytar.js");
     if (typeof keytar.setPassword !== "function") {
       return null;
     }
+    await keytar.findCredentials(PROBE_SERVICE_NAME);
     return keytar;
   } catch (err) {
-    if (!keytarWarned) {
-      keytarWarned = true;
-      console.warn(
-        `System keychain unavailable, falling back to file-based credential storage: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
+    warnUnavailable(err);
     return null;
   }
 }
+function resolveKeychain() {
+  if (!keychain) {
+    keychain = probeKeychain();
+  }
+  return keychain;
+}
 function keychainAccount() {
   return getApiUrlConfig();
 }
+function storeInFileFallback(credentials2) {
+  setCredentials({
+    token: credentials2.token,
+    user: credentials2.user,
+    expiresAt: credentials2.expiresAt
+  });
+}
 async function storeToken(credentials2) {
-  const keytar = await getKeytar();
+  const keytar = await resolveKeychain();
   if (keytar) {
-    await keytar.setPassword(SERVICE_NAME, keychainAccount(), JSON.stringify(credentials2));
-  } else {
-    setCredentials({
-      token: credentials2.token,
-      user: credentials2.user,
-      expiresAt: credentials2.expiresAt
-    });
+    try {
+      await keytar.setPassword(SERVICE_NAME, keychainAccount(), JSON.stringify(credentials2));
+      return;
+    } catch (err) {
+      warnUnavailable(err);
+    }
   }
+  storeInFileFallback(credentials2);
 }
 async function getToken() {
-  const keytar = await getKeytar();
+  const keytar = await resolveKeychain();
   if (keytar) {
     const account = keychainAccount();
-    const stored = await keytar.getPassword(SERVICE_NAME, account);
-    if (stored) {
-      try {
-        return JSON.parse(stored);
-      } catch {
-        await keytar.deletePassword(SERVICE_NAME, account);
-        return null;
+    try {
+      const stored = await keytar.getPassword(SERVICE_NAME, account);
+      if (stored) {
+        try {
+          return JSON.parse(stored);
+        } catch {
+          try {
+            await keytar.deletePassword(SERVICE_NAME, account);
+          } catch (err) {
+            console.warn(
+              `Failed to clear invalid keychain entry for ${account}: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+          return null;
+        }
       }
+    } catch (err) {
+      warnUnavailable(err);
     }
   }
   const creds = getCredentials();
@@ -273,7 +302,7 @@ function toError(err) {
   return err instanceof Error ? err : new Error(String(err));
 }
 async function deleteToken(options = {}) {
-  const keytar = await getKeytar();
+  const keytar = await resolveKeychain();
   const failures = [];
   if (keytar) {
     if (options.all) {
@@ -286,14 +315,25 @@ async function deleteToken(options = {}) {
       await Promise.all(
         accounts.map(async (entry) => {
           try {
-            await keytar.deletePassword(SERVICE_NAME, entry.account);
+            const deleted = await keytar.deletePassword(SERVICE_NAME, entry.account);
+            if (!deleted) {
+              failures.push({
+                type: "delete",
+                account: entry.account,
+                error: new Error("deletePassword resolved false")
+              });
+            }
           } catch (err) {
             failures.push({ type: "delete", account: entry.account, error: toError(err) });
           }
         })
       );
     } else {
-      await keytar.deletePassword(SERVICE_NAME, keychainAccount());
+      try {
+        await keytar.deletePassword(SERVICE_NAME, keychainAccount());
+      } catch (err) {
+        warnUnavailable(err);
+      }
     }
   }
   if (options.all) {
@@ -706,6 +746,32 @@ async function reportClaudeUsage(agentId, authHeader, snapshot) {
     return { ok: false, error: describeBestEffortError(error2) };
   }
 }
+async function reportResourceUsage(agentId, authHeader, usage) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/resource-usage`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        cpu_percent: usage.cpuPercent,
+        cpu_count: usage.cpuCount,
+        memory_total_bytes: usage.memoryTotalBytes,
+        memory_available_bytes: usage.memoryAvailableBytes
+      }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
 async function getAgentInfo(agentId, authHeader) {
   const apiUrl = getApiUrlConfig();
   try {
@@ -894,6 +960,7 @@ import { homedir } from "os";
 import { join } from "path";
 var CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var KEYCHAIN_SERVICE = "Claude Code-credentials";
+var CLAUDE_CREDENTIALS_SEGMENTS = [".claude", ".credentials.json"];
 function parseClaudeCliCredentials(raw) {
   let parsed;
   try {
@@ -927,7 +994,7 @@ function readClaudeCliCredentials() {
     }
   }
   try {
-    const raw = readFileSync(join(homedir(), ".claude", ".credentials.json"), "utf-8");
+    const raw = readFileSync(join(homedir(), ...CLAUDE_CREDENTIALS_SEGMENTS), "utf-8");
     return parseClaudeCliCredentials(raw);
   } catch (err) {
     const code = err.code;
@@ -1023,7 +1090,7 @@ async function claudeUsage() {
 
 // src/commands/run.ts
 import { homedir as homedir3 } from "os";
-import { isAbsolute as isAbsolute2, join as join4, parse, resolve as resolvePath } from "path";
+import { isAbsolute as isAbsolute2, join as join5, parse, resolve as resolvePath } from "path";
 import chalk6 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
@@ -1052,6 +1119,7 @@ var MAX_FILE_SYNC_DIRECTORIES = 16;
 
 // ../../packages/types/src/logging/index.ts
 var CORRELATION_ID_HEADER = "x-evident-correlation-id";
+var FORWARD_FAILURE_REASON_HEADER = "X-Evident-Failure-Reason";
 function log(level, event, fields) {
   const method = level === "debug" ? "log" : level;
   try {
@@ -1659,13 +1727,22 @@ function buildNoProviderWarning(hasProvider) {
   return "Warning: opencode has no authenticated model provider configured, so it won't be able to answer prompts. Run `opencode auth login` to set one up (see https://opencode.ai for details).";
 }
 
+// src/lib/http-timeout.ts
+var REQUEST_TIMEOUT_MS = 6e4;
+function withRequestTimeout(fetchImpl, timeoutMs) {
+  return ((input, init) => fetchImpl(input, { ...init, signal: AbortSignal.timeout(timeoutMs) }));
+}
+
 // src/lib/opencode/session.ts
+function timedFetch(input, init) {
+  return withRequestTimeout(fetch, REQUEST_TIMEOUT_MS)(input, init);
+}
 function opencodeBase(port) {
   return `http://127.0.0.1:${port}`;
 }
 async function getOpenCodeDirectory(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/path`);
+    const res = await timedFetch(`${opencodeBase(port)}/path`);
     if (!res.ok) return null;
     const body = await res.json();
     const dir = typeof body.directory === "string" && body.directory || typeof body.worktree === "string" && body.worktree || typeof body.path?.cwd === "string" && body.path.cwd || typeof body.path?.directory === "string" && body.path.directory || null;
@@ -1716,7 +1793,7 @@ function isAssistantInFlight(m) {
 }
 async function getSessionMessages(port, sessionId) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${sessionId}/message`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/${sessionId}/message`);
     if (!res.ok) return null;
     const body = await res.json();
     return Array.isArray(body) ? body : null;
@@ -1746,7 +1823,7 @@ function sessionLastActivityMs(session) {
 }
 async function listSessions(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session`);
+    const res = await timedFetch(`${opencodeBase(port)}/session`);
     if (!res.ok) return null;
     const body = await res.json();
     return Array.isArray(body) ? body : null;
@@ -1756,7 +1833,7 @@ async function listSessions(port) {
 }
 async function deleteSession(port, id) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${id}`, { method: "DELETE" });
+    const res = await timedFetch(`${opencodeBase(port)}/session/${id}`, { method: "DELETE" });
     return res.status >= 200 && res.status < 300;
   } catch {
     return false;
@@ -1764,7 +1841,7 @@ async function deleteSession(port, id) {
 }
 async function sessionExists(port, id) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${id}`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/${id}`);
     if (res.status >= 200 && res.status < 300) return true;
     if (res.status === 404) return false;
     return null;
@@ -1774,7 +1851,7 @@ async function sessionExists(port, id) {
 }
 async function getSessionStatuses(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/status`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/status`);
     if (!res.ok) {
       console.error(
         `[getSessionStatuses] GET /session/status returned HTTP ${res.status} (port ${port})`
@@ -1807,7 +1884,7 @@ async function createOpenCodeSession(port, directory) {
   if (directory && directory.trim()) {
     url.searchParams.set("directory", directory.trim());
   }
-  const response = await fetch(url, {
+  const response = await timedFetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({})
@@ -1821,7 +1898,7 @@ async function createOpenCodeSession(port, directory) {
 }
 async function getModelAttachmentCapability(port, model) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/config/providers`);
+    const res = await timedFetch(`${opencodeBase(port)}/config/providers`);
     if (!res.ok) {
       console.error(
         `[getModelAttachmentCapability] GET /config/providers returned HTTP ${res.status} (port ${port})`
@@ -1954,7 +2031,7 @@ async function sendPromptAsync(port, sessionId, content, options, attachments) {
       };
     }
   }
-  const res = await fetch(`${opencodeBase(port)}/session/${sessionId}/prompt_async`, {
+  const res = await timedFetch(`${opencodeBase(port)}/session/${sessionId}/prompt_async`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(body)
@@ -2203,7 +2280,7 @@ function hasRunningAssistantExcept(messages, exceptUserMessageId) {
 }
 async function hasAnyConfiguredProvider(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/config/providers`);
+    const res = await timedFetch(`${opencodeBase(port)}/config/providers`);
     if (!res.ok) {
       console.error(
         `[hasAnyConfiguredProvider] GET /config/providers returned HTTP ${res.status} (port ${port})`
@@ -2645,6 +2722,17 @@ var StreamForwarder = class {
 };
 
 // src/lib/tunnel/connection.ts
+var FAILURE_REASON_HEADER_LC = FORWARD_FAILURE_REASON_HEADER.toLowerCase();
+var TunnelUpgradeRejectedError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+};
+function classifyUpgradeRejection(headers) {
+  const value = headers[FAILURE_REASON_HEADER_LC];
+  return value === "do_code_updated" ? "do_code_updated" : "unknown";
+}
 var MAX_RECONNECT_DELAY = 3e4;
 var BASE_RECONNECT_DELAY = 500;
 function getReconnectDelay(attempt) {
@@ -2689,6 +2777,7 @@ function connectTunnel(options) {
     onError,
     onResponse,
     onInfo,
+    onWarning,
     onDrainPing
   } = options;
   const tunnelUrl = getTunnelUrlConfig();
@@ -2708,8 +2797,11 @@ function connectTunnel(options) {
       reject(new Error("Connection timeout"));
     }, 3e4);
     let upgradeRejection = null;
+    let upgradeRejectionReason = null;
     ws.on("unexpected-response", (_req, res) => {
       clearTimeout(connectionTimeout);
+      const reason = classifyUpgradeRejection(res.headers);
+      upgradeRejectionReason = reason;
       const chunks = [];
       res.on("data", (chunk) => chunks.push(chunk));
       res.on("end", () => {
@@ -2723,8 +2815,14 @@ function connectTunnel(options) {
         }
         const statusLine = `HTTP ${res.statusCode}${res.statusMessage ? ` ${res.statusMessage}` : ""}`;
         upgradeRejection = detail ? `${statusLine}: ${detail}` : statusLine;
-        onError?.(`Tunnel refused by relay (${upgradeRejection})`);
-        reject(new Error(`Tunnel handshake rejected: ${upgradeRejection}`));
+        if (reason === "do_code_updated") {
+          onWarning?.("Relay redeployed \u2014 reconnecting");
+        } else {
+          onError?.(`Tunnel refused by relay (${upgradeRejection})`);
+        }
+        reject(
+          new TunnelUpgradeRejectedError(`Tunnel handshake rejected: ${upgradeRejection}`, reason)
+        );
       });
     });
     ws.on("open", () => {
@@ -2770,8 +2868,14 @@ function connectTunnel(options) {
     ws.on("error", (error2) => {
       clearTimeout(connectionTimeout);
       const detail = upgradeRejection ?? describeSocketError(error2, url);
-      onError?.(`Connection error: ${detail}`);
-      reject(upgradeRejection ? new Error(upgradeRejection) : new Error(detail));
+      if (upgradeRejectionReason === "do_code_updated") {
+        onWarning?.("Relay redeployed \u2014 reconnecting");
+      } else {
+        onError?.(`Connection error: ${detail}`);
+      }
+      reject(
+        upgradeRejectionReason !== null ? new TunnelUpgradeRejectedError(detail, upgradeRejectionReason) : new Error(detail)
+      );
     });
     ws.on("close", (code, reason) => {
       const reasonStr = reason.toString() || upgradeRejection || (code === 1006 ? "abnormal closure" : "No reason provided");
@@ -2847,7 +2951,8 @@ var RunnerConnection = class {
           onError: (error2) => events.onError?.(error2),
           onResponse: () => events.onResponse?.(),
           onDrainPing: () => events.onDrainPing?.(),
-          onInfo: (message) => events.onInfo?.(message)
+          onInfo: (message) => events.onInfo?.(message),
+          onWarning: (message) => events.onWarning?.(message)
         });
         return;
       } catch (error2) {
@@ -2858,7 +2963,12 @@ var RunnerConnection = class {
         }
         const delay = getReconnectDelay(this.reconnectAttempt);
         events.onReconnecting?.(this.reconnectAttempt);
-        events.onError?.(`Connection failed, retrying in ${Math.round(delay / 1e3)}s...`);
+        const retryMessage = `Connection failed, retrying in ${Math.round(delay / 1e3)}s...`;
+        if (error2 instanceof TunnelUpgradeRejectedError && error2.reason === "do_code_updated") {
+          events.onWarning?.(retryMessage);
+        } else {
+          events.onError?.(retryMessage);
+        }
         await this.sleep(delay);
       }
     }
@@ -2878,6 +2988,21 @@ function writeTunnelReadyMarker(path, agentId) {
   }
 }
 
+// src/lib/reporting-schedule.ts
+function jitteredDelayMs(baseMs, jitterFraction, random = Math.random) {
+  const jitterRangeMs = baseMs * jitterFraction;
+  return baseMs - jitterRangeMs + random() * (2 * jitterRangeMs);
+}
+function firstReportDelayMs(random = Math.random) {
+  return 5e3 + random() * 1e4;
+}
+function reportFailureLogLevel(consecutiveFailures, reescalationTicks) {
+  return consecutiveFailures === 1 || consecutiveFailures % reescalationTicks === 0 ? "warn" : "debug";
+}
+function failureStreakSuffix(consecutiveFailures) {
+  return consecutiveFailures > 1 ? ` (${consecutiveFailures} consecutive failures)` : "";
+}
+
 // src/lib/claude-usage-reporting.ts
 var VALID_MODES = ["auto", "on", "off"];
 function resolveClaudeUsageReportingMode(flagValue, env) {
@@ -2900,18 +3025,79 @@ function resolveClaudeUsageReportingMode(flagValue, env) {
 var BASE_REPORT_DELAY_MS = 10 * 6e4;
 var REPORT_DELAY_JITTER_FRACTION = 0.2;
 function nextReportDelayMs(random = Math.random) {
-  const jitterRangeMs = BASE_REPORT_DELAY_MS * REPORT_DELAY_JITTER_FRACTION;
-  return BASE_REPORT_DELAY_MS - jitterRangeMs + random() * (2 * jitterRangeMs);
+  return jitteredDelayMs(BASE_REPORT_DELAY_MS, REPORT_DELAY_JITTER_FRACTION, random);
 }
-var FIRST_REPORT_DELAY_MS = 5e3 + Math.random() * 1e4;
+var FIRST_REPORT_DELAY_MS = firstReportDelayMs();
 var CLAUDE_USAGE_FAILURE_REESCALATION_TICKS = 6;
 function claudeUsageFailureLogLevel(consecutiveFailures) {
-  return consecutiveFailures === 1 || consecutiveFailures % CLAUDE_USAGE_FAILURE_REESCALATION_TICKS === 0 ? "warn" : "debug";
+  return reportFailureLogLevel(consecutiveFailures, CLAUDE_USAGE_FAILURE_REESCALATION_TICKS);
+}
+
+// src/lib/resource-usage-reporting.ts
+var ENABLED_VALUES = /* @__PURE__ */ new Set(["on", "true", "1"]);
+var DISABLED_VALUES = /* @__PURE__ */ new Set(["off", "false", "0"]);
+function resolveResourceUsageReportingEnabled(flagValue, env) {
+  if (flagValue === false) {
+    return { enabled: false, warnings: [] };
+  }
+  const raw = env.EVIDENT_RESOURCE_USAGE_REPORTING;
+  if (raw === void 0 || raw === "") {
+    return { enabled: true, warnings: [] };
+  }
+  const normalized = raw.trim().toLowerCase();
+  if (DISABLED_VALUES.has(normalized)) {
+    return { enabled: false, warnings: [] };
+  }
+  if (ENABLED_VALUES.has(normalized)) {
+    return { enabled: true, warnings: [] };
+  }
+  return {
+    enabled: true,
+    warnings: [
+      `Ignoring invalid EVIDENT_RESOURCE_USAGE_REPORTING "${raw}": expected on or off; leaving reporting on`
+    ]
+  };
+}
+
+// src/lib/resource-usage.ts
+import { cpus, totalmem, freemem } from "os";
+function readCpuSample() {
+  let busyMs = 0;
+  let idleMs = 0;
+  for (const cpu of cpus()) {
+    busyMs += cpu.times.user + cpu.times.nice + cpu.times.sys + cpu.times.irq;
+    idleMs += cpu.times.idle;
+  }
+  return { busyMs, idleMs };
+}
+function cpuPercentBetween(previous, current) {
+  const deltaBusy = current.busyMs - previous.busyMs;
+  const deltaIdle = current.idleMs - previous.idleMs;
+  const total = deltaBusy + deltaIdle;
+  if (total === 0) return null;
+  return Math.round((deltaBusy / total * 100 + Number.EPSILON) * 100) / 100;
+}
+function createResourceUsageCollector() {
+  let previous = readCpuSample();
+  return () => {
+    const current = readCpuSample();
+    const cpuPercent = cpuPercentBetween(previous, current);
+    previous = current;
+    return {
+      cpuPercent,
+      cpuCount: cpus().length,
+      memoryTotalBytes: totalmem(),
+      memoryAvailableBytes: freemem()
+    };
+  };
 }
 
 // src/lib/channels/driver.ts
 import { homedir as homedir2 } from "os";
 
+// src/lib/runner-file-sync.ts
+import { join as join4 } from "path";
+
 // src/lib/file-push.ts
 import { randomUUID } from "crypto";
 import { chmod, mkdir, open as open2, realpath, rename, unlink } from "fs/promises";
@@ -3105,17 +3291,20 @@ async function syncPendingRunnerFiles(options) {
   for (const id of options.ackFailures.keys()) {
     if (!pendingIds.has(id)) options.ackFailures.delete(id);
   }
-  if (pending.length === 0) return 0;
+  if (pending.length === 0) return { applied: 0, claudeCredentialApplied: false };
   options.log({
     level: "info",
     message: `Runner file sync: ${pending.length} file(s) queued for this runner`
   });
   let applied = 0;
+  let claudeCredentialApplied = false;
   for (const file of pending) {
     if ((options.ackFailures.get(file.id) ?? 0) >= MAX_ACK_ATTEMPTS) continue;
-    if (await applyOne(options, file)) applied += 1;
+    const outcome = await applyOne(options, file);
+    if (outcome.applied) applied += 1;
+    if (outcome.claudeCredentialApplied) claudeCredentialApplied = true;
   }
-  return applied;
+  return { applied, claudeCredentialApplied };
 }
 async function listPendingFiles(options) {
   let res;
@@ -3176,6 +3365,11 @@ function asPendingFile(entry) {
   if (typeof size !== "number" || !Number.isFinite(size) || size < 0) return null;
   return { id, path, size };
 }
+var NOT_APPLIED = { applied: false, claudeCredentialApplied: false };
+function isClaudeCredentialPath(requestedPath, homeDir) {
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join4(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join4(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+}
 async function applyOne(options, file) {
   const label = `${file.id.slice(0, 8)} (${file.path})`;
   if (options.allowedDirectories.length === 0) {
@@ -3184,7 +3378,7 @@ async function applyOne(options, file) {
       message: `Runner file ${label} rejected: file sync is not enabled on this runner (start it with --enable-file-sync-to)`
     });
     await ack(options, file, "rejected", "file_sync_disabled");
-    return false;
+    return NOT_APPLIED;
   }
   if (file.size > MAX_FILE_PUSH_BYTES) {
     options.log({
@@ -3192,12 +3386,12 @@ async function applyOne(options, file) {
       message: `Runner file ${label} rejected: declared ${file.size} bytes, the limit is ${MAX_FILE_PUSH_BYTES}`
     });
     await ack(options, file, "rejected", "file_too_large");
-    return false;
+    return NOT_APPLIED;
   }
   const download = await downloadContent(options, file, label);
   if (!download.ok) {
     if (download.terminal) await ack(options, file, "rejected", download.code);
-    return false;
+    return NOT_APPLIED;
   }
   let outcome;
   try {
@@ -3213,7 +3407,7 @@ async function applyOne(options, file) {
       message: `Runner file ${label} could not be written: ${describe(err)}`
     });
     await ack(options, file, "rejected", "write_failed");
-    return false;
+    return NOT_APPLIED;
   }
   if (!outcome.ok) {
     options.log({
@@ -3221,14 +3415,17 @@ async function applyOne(options, file) {
       message: `Runner file ${label} rejected (${outcome.code}): ${outcome.message}`
     });
     await ack(options, file, "rejected", outcome.code);
-    return false;
+    return NOT_APPLIED;
   }
   options.log({
     level: "info",
     message: `Runner file ${label} applied (${download.content.byteLength} bytes)`
   });
   await ack(options, file, "applied");
-  return true;
+  return {
+    applied: true,
+    claudeCredentialApplied: isClaudeCredentialPath(file.path, options.homeDir)
+  };
 }
 function durableDownloadCode(status2) {
   return status2 === 413 ? "file_too_large" : "write_failed";
@@ -3339,8 +3536,13 @@ var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
 var AMBIGUOUS_FINISH_MAX_PINNED_MS = 3 * 6e4;
 var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
+var WATCHER_STALL_MS = 3 * POLL_MISS_GRACE_MS;
+var MAX_WATCHER_STALL_RESTARTS = 3;
+var MAX_RELEASED_OPENCODE_IDS = 256;
 var MAX_SUPERSEDED_CONVERSATIONS = 256;
 var MAX_IDENTICAL_REDRIVE_POLL_FAILURES = 5;
+var WEDGE_WARNING_INTERVAL_MS = 5 * 60 * 1e3;
+var MAX_WEDGED_CONVERSATIONS = 256;
 var ChannelAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -3384,6 +3586,8 @@ var ChannelDriver = class _ChannelDriver {
   fileSyncDirectories;
   homeDir;
   maxActiveSessions;
+  watcherStallMs;
+  wedgeWarningIntervalMs;
   /** Cache of conversationId → opencode sessionId. */
   sessions = /* @__PURE__ */ new Map();
   /**
@@ -3414,6 +3618,40 @@ var ChannelDriver = class _ChannelDriver {
    * bounded cost.
    */
   supersededSessions = /* @__PURE__ */ new Map();
+  /**
+   * Local re-drive fence for a message force-released by the stall watchdog
+   * (#1618, `reconcileWatchers`'s `unrecoverable_released` arm — the only writer,
+   * see `recordReleasedOpencodeId`). The row's server-side `opencode_message_id`
+   * is `null` for exactly this shape (its `markProcessing` never landed), so
+   * without a local record of the id the driver last knew, the next drain's
+   * `if (message.opencode_message_id)` re-drive-fence check at
+   * `processConversation` would not engage and it would blind-`prompt_async`
+   * a turn that may still be running in opencode — the one duplicate-turn
+   * hazard this whole design exists to close (§3/D1 of the drain-wedge plan).
+   * `processConversation` reads `message.opencode_message_id ?? this
+   * .releasedOpencodeIds.get(id)?.opencodeMessageId` as the EFFECTIVE id and
+   * threads it into `resolveRedrive`, which asks opencode itself whether the
+   * turn is still ongoing before ever dispatching.
+   *
+   * Bounded FIFO, mirroring `supersededSessions` above (`MAX_RELEASED_OPENCODE_IDS`,
+   * `recordReleasedOpencodeId`). Cleared by `clearRedriveUnresolved` (every
+   * non-`unresolved` `resolveRedrive` outcome fires it, including a fresh
+   * dispatch) and at the top-level fresh-dispatch site, so it does not outlive
+   * the row it was recorded for.
+   */
+  releasedOpencodeIds = /* @__PURE__ */ new Map();
+  /**
+   * Per-conversation throttle state for the #183 recurrence warning (#1618
+   * WI-4) — see `reportWedgedConversation`'s doc comment for why this exists.
+   * `firstWedgedAt` anchors `stuck_for_ms`; `lastWarnedAt` throttles both the
+   * log line and the `dispatch_wedged` signal to at most once per
+   * `wedgeWarningIntervalMs`; `consecutiveTicks` is reported in the log text
+   * so the operator sees magnitude, not repetition. Cleared the moment the
+   * conversation dispatches anything (a fresh wedge, if it recurs, is a new
+   * incident). Bounded FIFO, mirroring `supersededSessions`
+   * (`MAX_WEDGED_CONVERSATIONS`).
+   */
+  wedgeWarnings = /* @__PURE__ */ new Map();
   /**
    * Per-opencode-session dispatch lock (Task 2.1a). `sendPromptAsync` is no
    * longer idempotent (no caller-supplied `messageID`), and its read-back picks
@@ -3632,6 +3870,14 @@ var ChannelDriver = class _ChannelDriver {
    * same trick `lastProxiedActivityAt` uses.
    */
   appliedFileCount = 0;
+  /**
+   * Generation counter, NOT a tally (#1656): advances by exactly one per sync
+   * batch that applied the Claude CLI credential file, not by how many
+   * credential files were in that batch. `run.ts` only ever tests inequality
+   * against the value it saw last cycle, so magnitude is meaningless — keep it
+   * that way rather than "fixing" it into a count.
+   */
+  claudeCredentialApplyCount = 0;
   /**
    * The currently-executing `drainPending()` promise, or null when idle. Lets a
    * graceful shutdown (`waitForInFlight`) await an in-progress drain so a turn it
@@ -3656,7 +3902,10 @@ var ChannelDriver = class _ChannelDriver {
     this.retry = { ...DEFAULT_RETRY_POLICY, ...config.retry };
     this.log = config.log ?? (() => {
     });
-    this.fetchImpl = config.fetchImpl ?? fetch;
+    this.fetchImpl = withRequestTimeout(
+      config.fetchImpl ?? fetch,
+      config.requestTimeoutMs ?? REQUEST_TIMEOUT_MS
+    );
     this.sleep = config.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.pausedPollIntervalMs = config.pausedPollIntervalMs ?? DEFAULT_PAUSED_POLL_INTERVAL_MS;
     this.pausedMaxWaitMs = config.pausedMaxWaitMs ?? DEFAULT_PAUSED_MAX_WAIT_MS;
@@ -3665,6 +3914,8 @@ var ChannelDriver = class _ChannelDriver {
     this.fileSyncDirectories = config.fileSyncDirectories ?? [];
     this.homeDir = config.homeDir ?? homedir2();
     this.maxActiveSessions = config.maxActiveSessions;
+    this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
+    this.wedgeWarningIntervalMs = config.wedgeWarningIntervalMs ?? WEDGE_WARNING_INTERVAL_MS;
   }
   /** The IPv4-loopback base URL for the local `opencode serve`. */
   get opencodeBase() {
@@ -3678,6 +3929,14 @@ var ChannelDriver = class _ChannelDriver {
    * @returns the number of messages NEWLY dispatched to opencode's native queue.
    */
   async drainPending() {
+    try {
+      this.reconcileWatchers();
+    } catch (err) {
+      this.log({
+        level: "error",
+        message: `Watchdog: reconcileWatchers threw unexpectedly (drain continues): ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
     if (this.stopped) return 0;
     if (this.draining) return 0;
     this.draining = true;
@@ -3711,7 +3970,7 @@ var ChannelDriver = class _ChannelDriver {
     if (this.syncingFiles) return 0;
     this.syncingFiles = true;
     try {
-      const applied = await syncPendingRunnerFiles({
+      const result = await syncPendingRunnerFiles({
         agentId: this.agentId,
         apiUrl: this.apiUrl,
         getAuthHeader: this.getAuthHeader,
@@ -3721,8 +3980,9 @@ var ChannelDriver = class _ChannelDriver {
         ackFailures: this.fileAckFailures,
         log: this.log
       });
-      this.appliedFileCount += applied;
-      return applied;
+      this.appliedFileCount += result.applied;
+      if (result.claudeCredentialApplied) this.claudeCredentialApplyCount += 1;
+      return result.applied;
     } catch (err) {
       this.log({
         level: "error",
@@ -3813,12 +4073,24 @@ var ChannelDriver = class _ChannelDriver {
    * `appliedFiles` is monotonic so a pull that started AND finished between two
    * idle checks still shows up as an advance.
    *
+   * A THIRD signal, `claudeCredentialApplies`, is a separate re-arm trigger
+   * (#1656), not idle accounting: `run.ts` gates re-probing Claude usage
+   * reporting on it advancing, so an unrelated file sync can never disturb a
+   * healthy reporting cadence (#1627) — it never even reaches that trigger, let
+   * alone gets declined by it. Keep this narrower signal OUT of `appliedFiles`,
+   * whose consumer is idle-timeout suppression and must key on ANY file, not
+   * just a Claude credential.
+   *
    * CALLER CONTRACT: sample `inFlight` BEFORE calling `syncPendingFiles()` for
    * the cycle. `syncPendingFiles` sets the flag synchronously, so a caller that
    * samples afterwards reads `true` every single cycle and can never idle out.
    */
   fileSyncActivity() {
-    return { appliedFiles: this.appliedFileCount, inFlight: this.syncingFiles };
+    return {
+      appliedFiles: this.appliedFileCount,
+      inFlight: this.syncingFiles,
+      claudeCredentialApplies: this.claudeCredentialApplyCount
+    };
   }
   /**
    * OpenCode session ids the session-cleanup sweep (issue #190) must NOT delete:
@@ -3931,8 +4203,15 @@ var ChannelDriver = class _ChannelDriver {
         skippedAlreadyDispatched += 1;
         continue;
       }
-      if (message.opencode_message_id) {
-        const outcome = await this.resolveRedrive(conv, sessionId, message, sessionCreated);
+      const effectiveOpencodeMessageId = message.opencode_message_id ?? this.releasedOpencodeIds.get(message.id)?.opencodeMessageId ?? null;
+      if (effectiveOpencodeMessageId) {
+        const outcome = await this.resolveRedrive(
+          conv,
+          sessionId,
+          message,
+          sessionCreated,
+          effectiveOpencodeMessageId
+        );
         if (outcome === "abandoned") {
           continue;
         }
@@ -4043,21 +4322,102 @@ var ChannelDriver = class _ChannelDriver {
       }
       this.unconfirmedDispatchFailures.delete(message.id);
       this.dispatchNotStartedSignalled.delete(message.id);
+      this.releasedOpencodeIds.delete(message.id);
       this.dispatched.add(message.id);
       this.registerInFlight(conv, sessionId, message, opencodeMessageId);
       dispatched += 1;
       void this.postSignal(conv.id, message.id, "dispatched");
     }
     if (messages.length > 0 && dispatched === 0 && skippedAlreadyDispatched === messages.length) {
-      this.log({
-        level: "warn",
-        message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode this tick. If this repeats, a message may be stuck acknowledged-but-never-dispatched (its watcher never settled).`,
-        conversation_id: conv.id
-      });
+      this.reportWedgedConversation(conv, messages);
+    } else if (dispatched > 0) {
+      this.wedgeWarnings.delete(conv.id);
     }
     this.ensureWatcherRunning(sessionId);
     return dispatched;
   }
+  /**
+   * The #183 "eyes but nothing sent" recurrence for `conv`, throttled and
+   * escalated (#1618 WI-4). `messages` is the conversation's full pending list
+   * on THIS tick — the caller has already confirmed every one of them is a
+   * skip-because-already-`dispatched`, the exact signature of a message stuck
+   * acknowledged-but-never-worked.
+   *
+   * Unthrottled, this fired every ~6s drain tick for as long as a wedge lasted
+   * (52,843 occurrences observed in one incident) — burning the GLOBAL
+   * 30-events/60s `runner-activity-telemetry.ts` budget that was itself
+   * suppressing the diagnostics needed to debug the wedge. The `warn` log (and
+   * the `dispatch_wedged` signal once the wedge has persisted past the same
+   * interval) fire at most once per `wedgeWarningIntervalMs` per conversation,
+   * naming the consecutive-tick count so the operator sees magnitude rather
+   * than repetition.
+   *
+   * Deliberately does NOT trigger a release: WI-1's `reconcileWatchers` runs
+   * unconditionally on this same tick and is already recovering anything it
+   * can see. This is reporting only — see `countUntrackedIds`'s doc for the
+   * one case it recovers nothing FOR (§3/D5 of the drain-wedge plan).
+   */
+  reportWedgedConversation(conv, messages) {
+    const now = this.now();
+    const existing = this.wedgeWarnings.get(conv.id);
+    const firstWedgedAt = existing?.firstWedgedAt ?? now;
+    const consecutiveTicks = (existing?.consecutiveTicks ?? 0) + 1;
+    const dueForWarn = !existing || now - existing.lastWarnedAt >= this.wedgeWarningIntervalMs;
+    if (!dueForWarn) {
+      this.wedgeWarnings.delete(conv.id);
+      this.wedgeWarnings.set(conv.id, {
+        firstWedgedAt,
+        lastWarnedAt: existing.lastWarnedAt,
+        consecutiveTicks
+      });
+      return;
+    }
+    const stuckForMs = now - firstWedgedAt;
+    const untracked = this.countUntrackedIds(messages);
+    this.log({
+      level: "warn",
+      message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode for ${consecutiveTicks} consecutive tick(s) now (${stuckForMs}ms stuck). ` + (untracked > 0 ? `${untracked} of these id(s) are tracked by NO watcher \u2014 the dispatched/in-flight pairing invariant is violated for this conversation, which will NOT self-heal and needs a runner restart.` : `A watcher is tracking this work; the loop-liveness watchdog is already recovering it.`),
+      conversation_id: conv.id
+    });
+    this.wedgeWarnings.delete(conv.id);
+    this.wedgeWarnings.set(conv.id, { firstWedgedAt, lastWarnedAt: now, consecutiveTicks });
+    while (this.wedgeWarnings.size > MAX_WEDGED_CONVERSATIONS) {
+      const oldest = this.wedgeWarnings.keys().next().value;
+      if (oldest === void 0) break;
+      this.wedgeWarnings.delete(oldest);
+    }
+    if (stuckForMs >= this.wedgeWarningIntervalMs) {
+      void this.postSignal(conv.id, messages[0].id, "dispatch_wedged", {
+        stuck_for_ms: stuckForMs,
+        untracked
+      });
+    }
+  }
+  /**
+   * How many of `messages`' ids are tracked by NO watcher's `inFlight` (#1618
+   * WI-4) — the §3/D5 orphan discriminator. `reconcileWatchers` proves the
+   * `dispatched`/`inFlight` pairing invariant holds by construction across
+   * every `dispatched.add` site (see its own doc comment), so `> 0` here means
+   * that invariant has actually been violated for this conversation: there is
+   * no watcher for WI-1's watchdog to restart, so it will NOT self-heal.
+   * `=== 0` means an ordinary stalled/exited watcher, which WI-1 is already
+   * recovering. One pass over `this.watchers`, called only when the throttled
+   * warning above is due to fire — not every tick.
+   */
+  countUntrackedIds(messages) {
+    let untracked = 0;
+    for (const message of messages) {
+      let tracked = false;
+      for (const watcher of this.watchers.values()) {
+        if (watcher.inFlight.has(message.id)) {
+          tracked = true;
+          break;
+        }
+      }
+      if (!tracked) untracked += 1;
+    }
+    return untracked;
+  }
   /**
    * Poll a session's message list for the re-drive fence (#965), via the
    * INJECTED `fetchImpl` — NOT the imported `getSessionMessages` helper, which
@@ -4126,9 +4486,16 @@ var ChannelDriver = class _ChannelDriver {
    * for, `resolveRedriveUnresolved`'s own `pausedMaxWaitMs` bound below. Every
    * other failure resolves to `unresolved` and is retried whole on the next
    * ~2s drain tick.
+   *
+   * `effectiveOpencodeMessageId` (#1618) is the caller-resolved id: the real
+   * server `opencode_message_id` when present, else the stall watchdog's local
+   * `releasedOpencodeIds` fence. Read it here rather than re-deriving it from
+   * `message` so every line below — and the signals this method posts —
+   * keeps reporting the REAL server row; a shadow-copied `message` would
+   * silently diverge from it.
    */
-  async resolveRedrive(conv, sessionId, message, sessionCreated) {
-    const ocId = message.opencode_message_id ?? null;
+  async resolveRedrive(conv, sessionId, message, sessionCreated, effectiveOpencodeMessageId) {
+    const ocId = effectiveOpencodeMessageId;
     if (sessionCreated) {
       this.clearRedriveUnresolved(message.id);
       void this.postSignal(conv.id, message.id, "redrive_redispatched");
@@ -4358,7 +4725,13 @@ var ChannelDriver = class _ChannelDriver {
     }
     return "unresolved";
   }
-  /** Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved` outcome). */
+  /**
+   * Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved`
+   * outcome) — including the stall watchdog's local re-drive fence (#1618): once
+   * `resolveRedrive` has resolved to dispatch/reattach/settle, the row either has
+   * a real server-side `opencode_message_id` again or is no longer pending, so
+   * the fence entry is no longer needed.
+   */
   clearRedriveUnresolved(messageId) {
     this.redriveUnresolvedSince.delete(messageId);
     this.redriveUnresolvedSignalled.delete(messageId);
@@ -4366,6 +4739,7 @@ var ChannelDriver = class _ChannelDriver {
     this.redriveOutcomeUnreportedSignalled.delete(messageId);
     this.redriveOutcomeFailingSince.delete(messageId);
     this.redriveOutcomeAbandonedSignalled.delete(messageId);
+    this.releasedOpencodeIds.delete(messageId);
   }
   /**
    * #1340: the dispatch loop reached a message and did NOT start a turn. Fires at
@@ -4520,6 +4894,21 @@ var ChannelDriver = class _ChannelDriver {
       this.supersededSessions.delete(oldest);
     }
   }
+  /**
+   * Record the local re-drive fence for a message force-released without
+   * completing (#1618) — see the `releasedOpencodeIds` field doc. Call BEFORE
+   * `removeInFlight`, which is about to drop the `InFlightMessage` this reads
+   * `opencodeMessageId` from. Hard-capped FIFO, same shape as `supersede`.
+   */
+  recordReleasedOpencodeId(evidentMessageId, sessionId, opencodeMessageId) {
+    this.releasedOpencodeIds.delete(evidentMessageId);
+    this.releasedOpencodeIds.set(evidentMessageId, { sessionId, opencodeMessageId });
+    while (this.releasedOpencodeIds.size > MAX_RELEASED_OPENCODE_IDS) {
+      const oldest = this.releasedOpencodeIds.keys().next().value;
+      if (oldest === void 0) return;
+      this.releasedOpencodeIds.delete(oldest);
+    }
+  }
   /** Whether `sessionId` is the session this conversation has abandoned (#553). */
   isSuperseded(conversationId, sessionId) {
     return this.supersededSessions.get(conversationId) === sessionId;
@@ -4561,6 +4950,17 @@ var ChannelDriver = class _ChannelDriver {
           message: `OpenCode session ${bound} for conversation ${conv.id.slice(0, 8)} no longer exists (deleted or DB reset) \u2014 creating a fresh session and rebinding.`,
           conversation_id: conv.id
         });
+        const watcher = this.watchers.get(bound);
+        if (watcher) {
+          for (const [evidentMessageId, inFlight] of [...watcher.inFlight]) {
+            this.recordReleasedOpencodeId(evidentMessageId, bound, inFlight.opencodeMessageId);
+            this.removeInFlight(watcher, evidentMessageId);
+            void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+              recovery: "session_gone_released"
+            });
+          }
+          this.watchers.delete(bound);
+        }
         this.sessions.delete(conv.id);
         return { sessionId: await this.createAndBindSession(conv.id), created: true };
       }
@@ -4751,15 +5151,7 @@ var ChannelDriver = class _ChannelDriver {
   registerInFlight(conv, sessionId, message, opencodeMessageId) {
     let watcher = this.watchers.get(sessionId);
     if (!watcher) {
-      watcher = {
-        conv,
-        inFlight: /* @__PURE__ */ new Map(),
-        loop: null,
-        reportedQuestions: /* @__PURE__ */ new Set(),
-        reportedPermissions: /* @__PURE__ */ new Set(),
-        lastGoodPollAt: this.now(),
-        hadUsablePoll: false
-      };
+      watcher = this.newSessionWatcher(conv);
       this.watchers.set(sessionId, watcher);
     }
     const now = this.now();
@@ -4790,6 +5182,27 @@ var ChannelDriver = class _ChannelDriver {
       ambiguousResolved: false
     });
   }
+  /**
+   * Build a fresh `SessionWatcher`. Seeds `lastTickAt`/`lastObservedTickAt`
+   * EQUAL (#1618) so a watcher whose loop has not started ticking yet is never
+   * misread as stalled by the very first reconciliation that sees it.
+   */
+  newSessionWatcher(conv) {
+    const now = this.now();
+    return {
+      conv,
+      inFlight: /* @__PURE__ */ new Map(),
+      loop: null,
+      reportedQuestions: /* @__PURE__ */ new Set(),
+      reportedPermissions: /* @__PURE__ */ new Set(),
+      lastGoodPollAt: now,
+      hadUsablePoll: false,
+      generation: 0,
+      lastTickAt: now,
+      lastObservedTickAt: now,
+      consecutiveStallRestarts: 0
+    };
+  }
   /**
    * Register a RE-ADOPTED `processing` message with its session watcher
    * (ADR-0046, WI-4). Mirrors `registerInFlight` but anchors the give-up
@@ -4819,15 +5232,7 @@ var ChannelDriver = class _ChannelDriver {
   registerReadopted(conv, sessionId, message, opencodeMessageId, processedAtMs) {
     let watcher = this.watchers.get(sessionId);
     if (!watcher) {
-      watcher = {
-        conv,
-        inFlight: /* @__PURE__ */ new Map(),
-        loop: null,
-        reportedQuestions: /* @__PURE__ */ new Set(),
-        reportedPermissions: /* @__PURE__ */ new Set(),
-        lastGoodPollAt: this.now(),
-        hadUsablePoll: false
-      };
+      watcher = this.newSessionWatcher(conv);
       this.watchers.set(sessionId, watcher);
     }
     watcher.inFlight.set(message.id, {
@@ -4871,12 +5276,110 @@ var ChannelDriver = class _ChannelDriver {
       ambiguousResolved: false
     });
   }
+  /**
+   * Loop-liveness watchdog (#1618). Runs once per `drainPending()` tick and
+   * restarts any per-session watcher whose loop has exited or stopped ticking
+   * — escalating to a bounded force-release only once
+   * `MAX_WATCHER_STALL_RESTARTS` consecutive restarts have failed to recover
+   * it. Fully synchronous: it only inspects in-memory state and calls the
+   * synchronous `ensureWatcherRunning`/`removeInFlight`, which is what lets it
+   * run from the very top of `drainPending()` — ahead of the un-timed
+   * `getPendingConversations()` await that would otherwise be able to disable
+   * it (`run.ts`'s poll loop is sequential, so a hung fetch there stops
+   * `drainPending()` from being CALLED again at all, not just from finishing).
+   *
+   * Restarts the loop rather than releasing messages directly: a blind release
+   * would let the next drain re-`prompt_async` a turn that may still be
+   * running (ADR-0047; see `releasedOpencodeIds`'s doc). A restarted loop
+   * re-polls with each message's `opencodeMessageId` still in hand and lets
+   * the existing, audited `!activelyRunning` give-up decide, same as it always
+   * has.
+   *
+   * Deliberately does NOT sweep `this.dispatched` for an id no watcher tracks:
+   * that shape has no in-flight entry and therefore no `opencodeMessageId` to
+   * fence a release with, so releasing it here would blind-re-POST a possibly-
+   * running turn — and there is no conversation id in hand to signal with
+   * either. Detection for that shape lives on WI-4's `dispatch_wedged` signal
+   * instead, where a conversation id already exists. If you find yourself
+   * wanting to add a `dispatched` sweep here, don't — read the drain-wedge
+   * plan's §3/D5 first.
+   */
+  reconcileWatchers() {
+    const now = this.now();
+    for (const [sessionId, watcher] of [...this.watchers]) {
+      if (watcher.lastTickAt !== watcher.lastObservedTickAt) {
+        watcher.consecutiveStallRestarts = 0;
+      }
+      watcher.lastObservedTickAt = watcher.lastTickAt;
+      if (watcher.inFlight.size === 0 && watcher.loop === null) {
+        this.watchers.delete(sessionId);
+        continue;
+      }
+      if (watcher.loop === null && watcher.inFlight.size > 0) {
+        if (now - watcher.lastTickAt < this.watcherStallMs) continue;
+        this.log({
+          level: "warn",
+          message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop had exited with ${watcher.inFlight.size} message(s) still in flight (idle ${now - watcher.lastTickAt}ms) \u2014 restarting`,
+          conversation_id: watcher.conv.id
+        });
+        this.ensureWatcherRunning(sessionId);
+        for (const evidentMessageId of watcher.inFlight.keys()) {
+          void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+            recovery: "loop_exited"
+          });
+        }
+        continue;
+      }
+      if (watcher.loop !== null && now - watcher.lastTickAt >= this.watcherStallMs) {
+        const stalledForMs = now - watcher.lastTickAt;
+        watcher.consecutiveStallRestarts += 1;
+        if (watcher.consecutiveStallRestarts > MAX_WATCHER_STALL_RESTARTS) {
+          this.log({
+            level: "error",
+            message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop stalled through ${watcher.consecutiveStallRestarts} restarts (last stall ${stalledForMs}ms) \u2014 releasing its ${watcher.inFlight.size} in-flight message(s)`,
+            conversation_id: watcher.conv.id
+          });
+          for (const [evidentMessageId, inFlight] of [...watcher.inFlight]) {
+            this.recordReleasedOpencodeId(evidentMessageId, sessionId, inFlight.opencodeMessageId);
+            this.removeInFlight(watcher, evidentMessageId);
+            void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+              recovery: "unrecoverable_released"
+            });
+          }
+          watcher.generation += 1;
+          this.watchers.delete(sessionId);
+          continue;
+        }
+        watcher.generation += 1;
+        watcher.loop = null;
+        watcher.lastGoodPollAt = now;
+        watcher.lastTickAt = now;
+        watcher.lastObservedTickAt = watcher.lastTickAt;
+        this.ensureWatcherRunning(sessionId);
+        this.log({
+          level: "warn",
+          message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop had not ticked in ${stalledForMs}ms \u2014 restarted under generation ${watcher.generation} (${watcher.consecutiveStallRestarts}/${MAX_WATCHER_STALL_RESTARTS})`,
+          conversation_id: watcher.conv.id
+        });
+        for (const evidentMessageId of watcher.inFlight.keys()) {
+          void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+            recovery: "loop_stalled"
+          });
+        }
+      }
+    }
+  }
   /**
    * Start (but do NOT await) the per-session watcher loop if it has in-flight
    * work and is not already running. Single-flight per session. The loop is
    * tracked on the watcher and cleared when it settles; it never rejects (fully
    * guarded), so a failed poll/callback can never crash the run loop — the cron
    * stays as the safety net.
+   *
+   * The generation started here (#1618) is captured in the `.finally` closure
+   * so a RETIRED loop settling late — after `reconcileWatchers` has already
+   * restarted this watcher under a newer generation — can neither null the new
+   * loop's handle nor delete a watcher that still has live work.
    */
   ensureWatcherRunning(sessionId) {
     const watcher = this.watchers.get(sessionId);
@@ -4886,7 +5389,9 @@ var ChannelDriver = class _ChannelDriver {
       this.watchers.delete(sessionId);
       return;
     }
-    const loop = this.runWatcherLoop(sessionId, watcher).finally(() => {
+    const generation = watcher.generation;
+    const loop = this.runWatcherLoop(sessionId, watcher, generation).finally(() => {
+      if (watcher.generation !== generation) return;
       watcher.loop = null;
       if (watcher.inFlight.size === 0) {
         this.watchers.delete(sessionId);
@@ -4906,11 +5411,25 @@ var ChannelDriver = class _ChannelDriver {
    *      `source_message_id`;
    *   4. drops messages that completed or timed out from the in-flight set.
    * Exits when the in-flight set empties. Never throws.
+   *
+   * `generation` (#1618) is the incarnation this call was started under.
+   * `reconcileWatchers` can restart a stalled loop by bumping
+   * `watcher.generation` and starting a NEW `runWatcherLoop` over the same
+   * `SessionWatcher` object — the stalled promise itself cannot be cancelled,
+   * so this loop instead checks at the top of every iteration, right after
+   * waking from `sleep`, and right before servicing any message, and quietly
+   * retires (returns without touching anything) the moment it is no longer the
+   * watcher's current generation. Retiring mid-tick can still let ONE
+   * `serviceInFlightMessage` pass complete first — acceptable, since that
+   * method contains no non-idempotent action.
    */
-  async runWatcherLoop(sessionId, watcher) {
+  async runWatcherLoop(sessionId, watcher, generation) {
     try {
       while (watcher.inFlight.size > 0) {
+        if (watcher.generation !== generation) return;
+        watcher.lastTickAt = this.now();
         await this.sleep(this.pausedPollIntervalMs);
+        if (watcher.generation !== generation) return;
         let messages = null;
         try {
           const res = await this.fetchImpl(`${this.opencodeBase}/session/${sessionId}/message`);
@@ -4931,6 +5450,7 @@ var ChannelDriver = class _ChannelDriver {
           }
         }
         const { openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk } = await this.pollInteractions(sessionId, watcher, messages);
+        if (watcher.generation !== generation) return;
         for (const inFlight of [...watcher.inFlight.values()]) {
           await this.serviceInFlightMessage(
             sessionId,
@@ -6906,7 +7426,7 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join4(homeDir, trimmed.slice(2)) : trimmed;
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join5(homeDir, trimmed.slice(2)) : trimmed;
     if (!isAbsolute2(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
@@ -7113,6 +7633,7 @@ async function driveChannels(state, driver) {
   let unreachableMs = 0;
   let lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
+  let lastSeenClaudeApplies = driver.fileSyncActivity().claudeCredentialApplies;
   while (state.running) {
     const cycleStartedAtMs = performance.now();
     let idleThisCycle = false;
@@ -7136,11 +7657,15 @@ async function driveChannels(state, driver) {
       state.messageCount += processed;
       const proxiedActivity = state.lastProxiedActivityAt !== lastSeenProxiedActivityAt;
       lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
-      const appliedFiles = driver.fileSyncActivity().appliedFiles;
+      const fileActivitySnapshot = driver.fileSyncActivity();
+      const appliedFiles = fileActivitySnapshot.appliedFiles;
       const filesApplied = appliedFiles !== lastSeenAppliedFiles;
       const fileActivity = carriedOverFileSync || filesApplied;
       lastSeenAppliedFiles = appliedFiles;
-      if (filesApplied) state.claudeUsageRearm?.();
+      const claudeCredentialApplies = fileActivitySnapshot.claudeCredentialApplies;
+      const claudeCredentialApplied = claudeCredentialApplies !== lastSeenClaudeApplies;
+      lastSeenClaudeApplies = claudeCredentialApplies;
+      if (claudeCredentialApplied) state.claudeUsageRearm?.();
       if (processed > 0 || driver.hasInFlightWatchers() || proxiedActivity || fileActivity) {
         idlePolls = 0;
         idleMs = 0;
@@ -7209,7 +7734,7 @@ async function driveChannels(state, driver) {
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
 var SESSION_DB_RECLAIM_MAX_PAGES = 2e3;
 function sessionDbPath() {
-  return join4(homedir3(), ".local", "share", "opencode", "opencode.db");
+  return join5(homedir3(), ".local", "share", "opencode", "opencode.db");
 }
 async function runSweep(state, driver, config) {
   const mode = `age=${config.maxAgeMs ?? "\u2014"} count=${config.maxCount ?? "\u2014"}`;
@@ -7320,9 +7845,6 @@ function scheduleSessionCleanup(state, driver, options) {
   );
   state.sessionCleanupTimers.push(interval, firstSweep);
 }
-function claudeUsageFailureStreakSuffix(consecutiveFailures) {
-  return consecutiveFailures > 1 ? ` (${consecutiveFailures} consecutive failures)` : "";
-}
 function scheduleClaudeUsageReporting(state, options) {
   const { mode, warnings } = resolveClaudeUsageReportingMode(
     options.claudeUsageReporting,
@@ -7344,23 +7866,44 @@ function scheduleClaudeUsageReporting(state, options) {
     return null;
   }
   let consecutiveFailures = 0;
-  let armed = false;
+  let phase = "dormant";
   let rearmRequested = false;
+  const armProbe = () => {
+    phase = "probe-pending";
+    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  };
   const scheduleNextTick = () => {
-    armed = true;
-    rearmRequested = false;
+    if (rearmRequested) {
+      rearmRequested = false;
+      armProbe();
+      return;
+    }
+    phase = "steady-pending";
     state.claudeUsageTimer = setTimeout(() => void tick(false), nextReportDelayMs());
   };
   const rearm = () => {
-    if (armed) {
-      rearmRequested = true;
-      return;
+    switch (phase) {
+      case "tick-in-flight":
+        rearmRequested = true;
+        return;
+      case "probe-pending":
+        return;
+      case "steady-pending":
+        if (state.claudeUsageTimer) {
+          clearTimeout(state.claudeUsageTimer);
+          state.claudeUsageTimer = null;
+        }
+        rearmRequested = false;
+        armProbe();
+        return;
+      case "dormant":
+        rearmRequested = false;
+        armProbe();
+        return;
     }
-    rearmRequested = false;
-    armed = true;
-    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
   };
   const tick = async (isProbe) => {
+    phase = "tick-in-flight";
     try {
       const usage = await getClaudeUsage();
       const result = await reportClaudeUsage(state.agentId, state.authHeader, usage);
@@ -7383,7 +7926,7 @@ function scheduleClaudeUsageReporting(state, options) {
         logActivity(state, {
           type: "info",
           level: claudeUsageFailureLogLevel(consecutiveFailures),
-          message: `Failed to report Claude usage: ${result.error}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
+          message: `Failed to report Claude usage: ${result.error}${failureStreakSuffix(consecutiveFailures)}`
         });
       }
       scheduleNextTick();
@@ -7402,7 +7945,7 @@ function scheduleClaudeUsageReporting(state, options) {
             level: "debug",
             message: `Claude usage reporting: ${error2.message}`
           });
-          armed = false;
+          phase = "dormant";
           if (rearmRequested) rearm();
         } else {
           logActivity(state, {
@@ -7418,16 +7961,92 @@ function scheduleClaudeUsageReporting(state, options) {
         logActivity(state, {
           type: "info",
           level: claudeUsageFailureLogLevel(consecutiveFailures),
-          message: `Claude usage reporting failed: ${message}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
+          message: `Claude usage reporting failed: ${message}${failureStreakSuffix(consecutiveFailures)}`
         });
         scheduleNextTick();
       }
     }
   };
-  armed = true;
-  state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  armProbe();
   return rearm;
 }
+var RESOURCE_USAGE_BASE_REPORT_DELAY_MS = 10 * 6e4;
+var RESOURCE_USAGE_REPORT_DELAY_JITTER_FRACTION = 0.2;
+var RESOURCE_USAGE_FAILURE_REESCALATION_TICKS = 6;
+function scheduleResourceUsageReporting(state, options) {
+  const { enabled, warnings } = resolveResourceUsageReportingEnabled(
+    options.resourceUsageReporting,
+    process.env
+  );
+  for (const warning2 of warnings) {
+    logActivity(state, {
+      type: "info",
+      level: "warn",
+      message: `Resource usage reporting: ${warning2}`
+    });
+  }
+  if (!enabled) {
+    logActivity(state, {
+      type: "info",
+      level: "debug",
+      message: "Resource usage reporting is off (--no-resource-usage-reporting)"
+    });
+    return;
+  }
+  const collect = createResourceUsageCollector();
+  let consecutiveFailures = 0;
+  const tick = async () => {
+    try {
+      const usage = collect();
+      const result = await reportResourceUsage(state.agentId, state.authHeader, usage);
+      if (result.ok) {
+        if (consecutiveFailures > 0) {
+          logActivity(state, {
+            type: "info",
+            level: "info",
+            message: "Resource usage reporting recovered"
+          });
+        }
+        consecutiveFailures = 0;
+        logActivity(state, {
+          type: "info",
+          level: "debug",
+          message: "Reported resource usage to Evident"
+        });
+      } else {
+        consecutiveFailures++;
+        logActivity(state, {
+          type: "info",
+          level: reportFailureLogLevel(
+            consecutiveFailures,
+            RESOURCE_USAGE_FAILURE_REESCALATION_TICKS
+          ),
+          message: `Failed to report resource usage: ${result.error}${failureStreakSuffix(consecutiveFailures)}`
+        });
+      }
+    } catch (error2) {
+      consecutiveFailures++;
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      logActivity(state, {
+        type: "info",
+        level: reportFailureLogLevel(
+          consecutiveFailures,
+          RESOURCE_USAGE_FAILURE_REESCALATION_TICKS
+        ),
+        message: `Resource usage reporting failed: ${message}${failureStreakSuffix(consecutiveFailures)}`
+      });
+    } finally {
+      state.resourceUsageTimer = setTimeout(
+        () => void tick(),
+        jitteredDelayMs(
+          RESOURCE_USAGE_BASE_REPORT_DELAY_MS,
+          RESOURCE_USAGE_REPORT_DELAY_JITTER_FRACTION
+        )
+      );
+    }
+  };
+  state.resourceUsageTimer = setTimeout(() => void tick(), firstReportDelayMs());
+}
 async function notifyOffline(state) {
   if (!state.agentId || !state.authHeader) return;
   if (!state.connected) {
@@ -7468,6 +8087,10 @@ async function cleanup(state, opts = {}) {
     state.claudeUsageTimer = null;
   }
   state.claudeUsageRearm = null;
+  if (state.resourceUsageTimer) {
+    clearTimeout(state.resourceUsageTimer);
+    state.resourceUsageTimer = null;
+  }
   if (opts.graceful && state.channelDriver) {
     state.channelDriver.stop();
     log2(state, "Draining in-flight channel work before shutdown...");
@@ -7550,6 +8173,7 @@ async function run(options) {
     sessionCleanupTimers: [],
     claudeUsageTimer: null,
     claudeUsageRearm: null,
+    resourceUsageTimer: null,
     authHeader: ""
   };
   setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
@@ -7889,6 +8513,13 @@ async function run(options) {
           logActivity(state, { type: "error", error: error2 });
           if (state.interactive) displayStatus(state);
         },
+        // `warn`, not `info`: `forwardRunnerActivity`'s FORWARDED_LEVELS floor is
+        // {'warn','error'}, so an `info` entry would never leave the machine and
+        // an operator couldn't correlate a reconnect storm with a relay deploy.
+        onWarning: (message) => {
+          logActivity(state, { type: "info", level: "warn", message });
+          if (state.interactive) displayStatus(state);
+        },
         // Web traffic is proxied transparently; note opencode is live and stamp
         // proxied activity so the idle loop treats interactive proxy use as work.
         // Fires per forwarded response head (incl. every SSE open) and excludes
@@ -7942,6 +8573,7 @@ async function run(options) {
     }
     scheduleSessionCleanup(state, channelDriver, options);
     state.claudeUsageRearm = scheduleClaudeUsageReporting(state, options);
+    scheduleResourceUsageReporting(state, options);
     if (!interactive || state.json) {
       log2(state, "Driving channel messages...");
     }
@@ -8022,6 +8654,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--claude-usage-reporting <mode>",
   "Report Claude subscription usage to Evident: auto | on | off (default: auto). Env: EVIDENT_CLAUDE_USAGE_REPORTING"
+).option(
+  "--no-resource-usage-reporting",
+  "Don't report this machine's CPU and memory usage to Evident (reporting is on by default). Env: EVIDENT_RESOURCE_USAGE_REPORTING=off"
 ).option(
   "--enable-file-sync-to <dir>",
   "Allow Evident to write files into this directory (repeatable). Omit to disable file sync entirely.",
@@ -8054,6 +8689,9 @@ program.command("run").description("Connect to Evident and process messages").op
       // Raw string — the resolver in run.ts single-sources parsing
       // (resolveClaudeUsageReportingMode).
       claudeUsageReporting: options.claudeUsageReporting,
+      // Raw value — resolution is single-sourced in run.ts's
+      // resolveResourceUsageReportingEnabled.
+      resourceUsageReporting: options.resourceUsageReporting,
       // Raw values — expansion/validation is single-sourced in run.ts's
       // resolveFileSyncDirectories.
       enableFileSyncTo: options.enableFileSyncTo,