@evident-ai/cli 3.3.1-dev.d288a4b → 3.3.1-dev.dd703c3

package/dist/index.js

@@ -934,6 +934,7 @@ import { homedir } from "os";
 import { join } from "path";
 var CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var KEYCHAIN_SERVICE = "Claude Code-credentials";
+var CLAUDE_CREDENTIALS_SEGMENTS = [".claude", ".credentials.json"];
 function parseClaudeCliCredentials(raw) {
   let parsed;
   try {
@@ -967,7 +968,7 @@ function readClaudeCliCredentials() {
     }
   }
   try {
-    const raw = readFileSync(join(homedir(), ".claude", ".credentials.json"), "utf-8");
+    const raw = readFileSync(join(homedir(), ...CLAUDE_CREDENTIALS_SEGMENTS), "utf-8");
     return parseClaudeCliCredentials(raw);
   } catch (err) {
     const code = err.code;
@@ -1063,7 +1064,7 @@ async function claudeUsage() {
 
 // src/commands/run.ts
 import { homedir as homedir3 } from "os";
-import { isAbsolute as isAbsolute2, join as join4, parse, resolve as resolvePath } from "path";
+import { isAbsolute as isAbsolute2, join as join5, parse, resolve as resolvePath } from "path";
 import chalk6 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
@@ -1700,13 +1701,22 @@ function buildNoProviderWarning(hasProvider) {
   return "Warning: opencode has no authenticated model provider configured, so it won't be able to answer prompts. Run `opencode auth login` to set one up (see https://opencode.ai for details).";
 }
 
+// src/lib/http-timeout.ts
+var REQUEST_TIMEOUT_MS = 6e4;
+function withRequestTimeout(fetchImpl, timeoutMs) {
+  return ((input, init) => fetchImpl(input, { ...init, signal: AbortSignal.timeout(timeoutMs) }));
+}
+
 // src/lib/opencode/session.ts
+function timedFetch(input, init) {
+  return withRequestTimeout(fetch, REQUEST_TIMEOUT_MS)(input, init);
+}
 function opencodeBase(port) {
   return `http://127.0.0.1:${port}`;
 }
 async function getOpenCodeDirectory(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/path`);
+    const res = await timedFetch(`${opencodeBase(port)}/path`);
     if (!res.ok) return null;
     const body = await res.json();
     const dir = typeof body.directory === "string" && body.directory || typeof body.worktree === "string" && body.worktree || typeof body.path?.cwd === "string" && body.path.cwd || typeof body.path?.directory === "string" && body.path.directory || null;
@@ -1757,7 +1767,7 @@ function isAssistantInFlight(m) {
 }
 async function getSessionMessages(port, sessionId) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${sessionId}/message`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/${sessionId}/message`);
     if (!res.ok) return null;
     const body = await res.json();
     return Array.isArray(body) ? body : null;
@@ -1787,7 +1797,7 @@ function sessionLastActivityMs(session) {
 }
 async function listSessions(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session`);
+    const res = await timedFetch(`${opencodeBase(port)}/session`);
     if (!res.ok) return null;
     const body = await res.json();
     return Array.isArray(body) ? body : null;
@@ -1797,7 +1807,7 @@ async function listSessions(port) {
 }
 async function deleteSession(port, id) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${id}`, { method: "DELETE" });
+    const res = await timedFetch(`${opencodeBase(port)}/session/${id}`, { method: "DELETE" });
     return res.status >= 200 && res.status < 300;
   } catch {
     return false;
@@ -1805,7 +1815,7 @@ async function deleteSession(port, id) {
 }
 async function sessionExists(port, id) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${id}`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/${id}`);
     if (res.status >= 200 && res.status < 300) return true;
     if (res.status === 404) return false;
     return null;
@@ -1815,7 +1825,7 @@ async function sessionExists(port, id) {
 }
 async function getSessionStatuses(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/status`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/status`);
     if (!res.ok) {
       console.error(
         `[getSessionStatuses] GET /session/status returned HTTP ${res.status} (port ${port})`
@@ -1848,7 +1858,7 @@ async function createOpenCodeSession(port, directory) {
   if (directory && directory.trim()) {
     url.searchParams.set("directory", directory.trim());
   }
-  const response = await fetch(url, {
+  const response = await timedFetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({})
@@ -1862,7 +1872,7 @@ async function createOpenCodeSession(port, directory) {
 }
 async function getModelAttachmentCapability(port, model) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/config/providers`);
+    const res = await timedFetch(`${opencodeBase(port)}/config/providers`);
     if (!res.ok) {
       console.error(
         `[getModelAttachmentCapability] GET /config/providers returned HTTP ${res.status} (port ${port})`
@@ -1995,7 +2005,7 @@ async function sendPromptAsync(port, sessionId, content, options, attachments) {
       };
     }
   }
-  const res = await fetch(`${opencodeBase(port)}/session/${sessionId}/prompt_async`, {
+  const res = await timedFetch(`${opencodeBase(port)}/session/${sessionId}/prompt_async`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(body)
@@ -2244,7 +2254,7 @@ function hasRunningAssistantExcept(messages, exceptUserMessageId) {
 }
 async function hasAnyConfiguredProvider(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/config/providers`);
+    const res = await timedFetch(`${opencodeBase(port)}/config/providers`);
     if (!res.ok) {
       console.error(
         `[hasAnyConfiguredProvider] GET /config/providers returned HTTP ${res.status} (port ${port})`
@@ -2986,6 +2996,9 @@ function claudeUsageFailureLogLevel(consecutiveFailures) {
 // src/lib/channels/driver.ts
 import { homedir as homedir2 } from "os";
 
+// src/lib/runner-file-sync.ts
+import { join as join4 } from "path";
+
 // src/lib/file-push.ts
 import { randomUUID } from "crypto";
 import { chmod, mkdir, open as open2, realpath, rename, unlink } from "fs/promises";
@@ -3179,17 +3192,20 @@ async function syncPendingRunnerFiles(options) {
   for (const id of options.ackFailures.keys()) {
     if (!pendingIds.has(id)) options.ackFailures.delete(id);
   }
-  if (pending.length === 0) return 0;
+  if (pending.length === 0) return { applied: 0, claudeCredentialApplied: false };
   options.log({
     level: "info",
     message: `Runner file sync: ${pending.length} file(s) queued for this runner`
   });
   let applied = 0;
+  let claudeCredentialApplied = false;
   for (const file of pending) {
     if ((options.ackFailures.get(file.id) ?? 0) >= MAX_ACK_ATTEMPTS) continue;
-    if (await applyOne(options, file)) applied += 1;
+    const outcome = await applyOne(options, file);
+    if (outcome.applied) applied += 1;
+    if (outcome.claudeCredentialApplied) claudeCredentialApplied = true;
   }
-  return applied;
+  return { applied, claudeCredentialApplied };
 }
 async function listPendingFiles(options) {
   let res;
@@ -3250,6 +3266,11 @@ function asPendingFile(entry) {
   if (typeof size !== "number" || !Number.isFinite(size) || size < 0) return null;
   return { id, path, size };
 }
+var NOT_APPLIED = { applied: false, claudeCredentialApplied: false };
+function isClaudeCredentialPath(requestedPath, homeDir) {
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join4(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join4(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+}
 async function applyOne(options, file) {
   const label = `${file.id.slice(0, 8)} (${file.path})`;
   if (options.allowedDirectories.length === 0) {
@@ -3258,7 +3279,7 @@ async function applyOne(options, file) {
       message: `Runner file ${label} rejected: file sync is not enabled on this runner (start it with --enable-file-sync-to)`
     });
     await ack(options, file, "rejected", "file_sync_disabled");
-    return false;
+    return NOT_APPLIED;
   }
   if (file.size > MAX_FILE_PUSH_BYTES) {
     options.log({
@@ -3266,12 +3287,12 @@ async function applyOne(options, file) {
       message: `Runner file ${label} rejected: declared ${file.size} bytes, the limit is ${MAX_FILE_PUSH_BYTES}`
     });
     await ack(options, file, "rejected", "file_too_large");
-    return false;
+    return NOT_APPLIED;
   }
   const download = await downloadContent(options, file, label);
   if (!download.ok) {
     if (download.terminal) await ack(options, file, "rejected", download.code);
-    return false;
+    return NOT_APPLIED;
   }
   let outcome;
   try {
@@ -3287,7 +3308,7 @@ async function applyOne(options, file) {
       message: `Runner file ${label} could not be written: ${describe(err)}`
     });
     await ack(options, file, "rejected", "write_failed");
-    return false;
+    return NOT_APPLIED;
   }
   if (!outcome.ok) {
     options.log({
@@ -3295,14 +3316,17 @@ async function applyOne(options, file) {
       message: `Runner file ${label} rejected (${outcome.code}): ${outcome.message}`
     });
     await ack(options, file, "rejected", outcome.code);
-    return false;
+    return NOT_APPLIED;
   }
   options.log({
     level: "info",
     message: `Runner file ${label} applied (${download.content.byteLength} bytes)`
   });
   await ack(options, file, "applied");
-  return true;
+  return {
+    applied: true,
+    claudeCredentialApplied: isClaudeCredentialPath(file.path, options.homeDir)
+  };
 }
 function durableDownloadCode(status2) {
   return status2 === 413 ? "file_too_large" : "write_failed";
@@ -3413,8 +3437,13 @@ var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
 var AMBIGUOUS_FINISH_MAX_PINNED_MS = 3 * 6e4;
 var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
+var WATCHER_STALL_MS = 3 * POLL_MISS_GRACE_MS;
+var MAX_WATCHER_STALL_RESTARTS = 3;
+var MAX_RELEASED_OPENCODE_IDS = 256;
 var MAX_SUPERSEDED_CONVERSATIONS = 256;
 var MAX_IDENTICAL_REDRIVE_POLL_FAILURES = 5;
+var WEDGE_WARNING_INTERVAL_MS = 5 * 60 * 1e3;
+var MAX_WEDGED_CONVERSATIONS = 256;
 var ChannelAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -3458,6 +3487,8 @@ var ChannelDriver = class _ChannelDriver {
   fileSyncDirectories;
   homeDir;
   maxActiveSessions;
+  watcherStallMs;
+  wedgeWarningIntervalMs;
   /** Cache of conversationId → opencode sessionId. */
   sessions = /* @__PURE__ */ new Map();
   /**
@@ -3488,6 +3519,40 @@ var ChannelDriver = class _ChannelDriver {
    * bounded cost.
    */
   supersededSessions = /* @__PURE__ */ new Map();
+  /**
+   * Local re-drive fence for a message force-released by the stall watchdog
+   * (#1618, `reconcileWatchers`'s `unrecoverable_released` arm — the only writer,
+   * see `recordReleasedOpencodeId`). The row's server-side `opencode_message_id`
+   * is `null` for exactly this shape (its `markProcessing` never landed), so
+   * without a local record of the id the driver last knew, the next drain's
+   * `if (message.opencode_message_id)` re-drive-fence check at
+   * `processConversation` would not engage and it would blind-`prompt_async`
+   * a turn that may still be running in opencode — the one duplicate-turn
+   * hazard this whole design exists to close (§3/D1 of the drain-wedge plan).
+   * `processConversation` reads `message.opencode_message_id ?? this
+   * .releasedOpencodeIds.get(id)?.opencodeMessageId` as the EFFECTIVE id and
+   * threads it into `resolveRedrive`, which asks opencode itself whether the
+   * turn is still ongoing before ever dispatching.
+   *
+   * Bounded FIFO, mirroring `supersededSessions` above (`MAX_RELEASED_OPENCODE_IDS`,
+   * `recordReleasedOpencodeId`). Cleared by `clearRedriveUnresolved` (every
+   * non-`unresolved` `resolveRedrive` outcome fires it, including a fresh
+   * dispatch) and at the top-level fresh-dispatch site, so it does not outlive
+   * the row it was recorded for.
+   */
+  releasedOpencodeIds = /* @__PURE__ */ new Map();
+  /**
+   * Per-conversation throttle state for the #183 recurrence warning (#1618
+   * WI-4) — see `reportWedgedConversation`'s doc comment for why this exists.
+   * `firstWedgedAt` anchors `stuck_for_ms`; `lastWarnedAt` throttles both the
+   * log line and the `dispatch_wedged` signal to at most once per
+   * `wedgeWarningIntervalMs`; `consecutiveTicks` is reported in the log text
+   * so the operator sees magnitude, not repetition. Cleared the moment the
+   * conversation dispatches anything (a fresh wedge, if it recurs, is a new
+   * incident). Bounded FIFO, mirroring `supersededSessions`
+   * (`MAX_WEDGED_CONVERSATIONS`).
+   */
+  wedgeWarnings = /* @__PURE__ */ new Map();
   /**
    * Per-opencode-session dispatch lock (Task 2.1a). `sendPromptAsync` is no
    * longer idempotent (no caller-supplied `messageID`), and its read-back picks
@@ -3706,6 +3771,14 @@ var ChannelDriver = class _ChannelDriver {
    * same trick `lastProxiedActivityAt` uses.
    */
   appliedFileCount = 0;
+  /**
+   * Generation counter, NOT a tally (#1656): advances by exactly one per sync
+   * batch that applied the Claude CLI credential file, not by how many
+   * credential files were in that batch. `run.ts` only ever tests inequality
+   * against the value it saw last cycle, so magnitude is meaningless — keep it
+   * that way rather than "fixing" it into a count.
+   */
+  claudeCredentialApplyCount = 0;
   /**
    * The currently-executing `drainPending()` promise, or null when idle. Lets a
    * graceful shutdown (`waitForInFlight`) await an in-progress drain so a turn it
@@ -3730,7 +3803,10 @@ var ChannelDriver = class _ChannelDriver {
     this.retry = { ...DEFAULT_RETRY_POLICY, ...config.retry };
     this.log = config.log ?? (() => {
     });
-    this.fetchImpl = config.fetchImpl ?? fetch;
+    this.fetchImpl = withRequestTimeout(
+      config.fetchImpl ?? fetch,
+      config.requestTimeoutMs ?? REQUEST_TIMEOUT_MS
+    );
     this.sleep = config.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.pausedPollIntervalMs = config.pausedPollIntervalMs ?? DEFAULT_PAUSED_POLL_INTERVAL_MS;
     this.pausedMaxWaitMs = config.pausedMaxWaitMs ?? DEFAULT_PAUSED_MAX_WAIT_MS;
@@ -3739,6 +3815,8 @@ var ChannelDriver = class _ChannelDriver {
     this.fileSyncDirectories = config.fileSyncDirectories ?? [];
     this.homeDir = config.homeDir ?? homedir2();
     this.maxActiveSessions = config.maxActiveSessions;
+    this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
+    this.wedgeWarningIntervalMs = config.wedgeWarningIntervalMs ?? WEDGE_WARNING_INTERVAL_MS;
   }
   /** The IPv4-loopback base URL for the local `opencode serve`. */
   get opencodeBase() {
@@ -3752,6 +3830,14 @@ var ChannelDriver = class _ChannelDriver {
    * @returns the number of messages NEWLY dispatched to opencode's native queue.
    */
   async drainPending() {
+    try {
+      this.reconcileWatchers();
+    } catch (err) {
+      this.log({
+        level: "error",
+        message: `Watchdog: reconcileWatchers threw unexpectedly (drain continues): ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
     if (this.stopped) return 0;
     if (this.draining) return 0;
     this.draining = true;
@@ -3785,7 +3871,7 @@ var ChannelDriver = class _ChannelDriver {
     if (this.syncingFiles) return 0;
     this.syncingFiles = true;
     try {
-      const applied = await syncPendingRunnerFiles({
+      const result = await syncPendingRunnerFiles({
         agentId: this.agentId,
         apiUrl: this.apiUrl,
         getAuthHeader: this.getAuthHeader,
@@ -3795,8 +3881,9 @@ var ChannelDriver = class _ChannelDriver {
         ackFailures: this.fileAckFailures,
         log: this.log
       });
-      this.appliedFileCount += applied;
-      return applied;
+      this.appliedFileCount += result.applied;
+      if (result.claudeCredentialApplied) this.claudeCredentialApplyCount += 1;
+      return result.applied;
     } catch (err) {
       this.log({
         level: "error",
@@ -3887,12 +3974,24 @@ var ChannelDriver = class _ChannelDriver {
    * `appliedFiles` is monotonic so a pull that started AND finished between two
    * idle checks still shows up as an advance.
    *
+   * A THIRD signal, `claudeCredentialApplies`, is a separate re-arm trigger
+   * (#1656), not idle accounting: `run.ts` gates re-probing Claude usage
+   * reporting on it advancing, so an unrelated file sync can never disturb a
+   * healthy reporting cadence (#1627) — it never even reaches that trigger, let
+   * alone gets declined by it. Keep this narrower signal OUT of `appliedFiles`,
+   * whose consumer is idle-timeout suppression and must key on ANY file, not
+   * just a Claude credential.
+   *
    * CALLER CONTRACT: sample `inFlight` BEFORE calling `syncPendingFiles()` for
    * the cycle. `syncPendingFiles` sets the flag synchronously, so a caller that
    * samples afterwards reads `true` every single cycle and can never idle out.
    */
   fileSyncActivity() {
-    return { appliedFiles: this.appliedFileCount, inFlight: this.syncingFiles };
+    return {
+      appliedFiles: this.appliedFileCount,
+      inFlight: this.syncingFiles,
+      claudeCredentialApplies: this.claudeCredentialApplyCount
+    };
   }
   /**
    * OpenCode session ids the session-cleanup sweep (issue #190) must NOT delete:
@@ -4005,8 +4104,15 @@ var ChannelDriver = class _ChannelDriver {
         skippedAlreadyDispatched += 1;
         continue;
       }
-      if (message.opencode_message_id) {
-        const outcome = await this.resolveRedrive(conv, sessionId, message, sessionCreated);
+      const effectiveOpencodeMessageId = message.opencode_message_id ?? this.releasedOpencodeIds.get(message.id)?.opencodeMessageId ?? null;
+      if (effectiveOpencodeMessageId) {
+        const outcome = await this.resolveRedrive(
+          conv,
+          sessionId,
+          message,
+          sessionCreated,
+          effectiveOpencodeMessageId
+        );
         if (outcome === "abandoned") {
           continue;
         }
@@ -4117,21 +4223,102 @@ var ChannelDriver = class _ChannelDriver {
       }
       this.unconfirmedDispatchFailures.delete(message.id);
       this.dispatchNotStartedSignalled.delete(message.id);
+      this.releasedOpencodeIds.delete(message.id);
       this.dispatched.add(message.id);
       this.registerInFlight(conv, sessionId, message, opencodeMessageId);
       dispatched += 1;
       void this.postSignal(conv.id, message.id, "dispatched");
     }
     if (messages.length > 0 && dispatched === 0 && skippedAlreadyDispatched === messages.length) {
-      this.log({
-        level: "warn",
-        message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode this tick. If this repeats, a message may be stuck acknowledged-but-never-dispatched (its watcher never settled).`,
-        conversation_id: conv.id
-      });
+      this.reportWedgedConversation(conv, messages);
+    } else if (dispatched > 0) {
+      this.wedgeWarnings.delete(conv.id);
     }
     this.ensureWatcherRunning(sessionId);
     return dispatched;
   }
+  /**
+   * The #183 "eyes but nothing sent" recurrence for `conv`, throttled and
+   * escalated (#1618 WI-4). `messages` is the conversation's full pending list
+   * on THIS tick — the caller has already confirmed every one of them is a
+   * skip-because-already-`dispatched`, the exact signature of a message stuck
+   * acknowledged-but-never-worked.
+   *
+   * Unthrottled, this fired every ~6s drain tick for as long as a wedge lasted
+   * (52,843 occurrences observed in one incident) — burning the GLOBAL
+   * 30-events/60s `runner-activity-telemetry.ts` budget that was itself
+   * suppressing the diagnostics needed to debug the wedge. The `warn` log (and
+   * the `dispatch_wedged` signal once the wedge has persisted past the same
+   * interval) fire at most once per `wedgeWarningIntervalMs` per conversation,
+   * naming the consecutive-tick count so the operator sees magnitude rather
+   * than repetition.
+   *
+   * Deliberately does NOT trigger a release: WI-1's `reconcileWatchers` runs
+   * unconditionally on this same tick and is already recovering anything it
+   * can see. This is reporting only — see `countUntrackedIds`'s doc for the
+   * one case it recovers nothing FOR (§3/D5 of the drain-wedge plan).
+   */
+  reportWedgedConversation(conv, messages) {
+    const now = this.now();
+    const existing = this.wedgeWarnings.get(conv.id);
+    const firstWedgedAt = existing?.firstWedgedAt ?? now;
+    const consecutiveTicks = (existing?.consecutiveTicks ?? 0) + 1;
+    const dueForWarn = !existing || now - existing.lastWarnedAt >= this.wedgeWarningIntervalMs;
+    if (!dueForWarn) {
+      this.wedgeWarnings.delete(conv.id);
+      this.wedgeWarnings.set(conv.id, {
+        firstWedgedAt,
+        lastWarnedAt: existing.lastWarnedAt,
+        consecutiveTicks
+      });
+      return;
+    }
+    const stuckForMs = now - firstWedgedAt;
+    const untracked = this.countUntrackedIds(messages);
+    this.log({
+      level: "warn",
+      message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode for ${consecutiveTicks} consecutive tick(s) now (${stuckForMs}ms stuck). ` + (untracked > 0 ? `${untracked} of these id(s) are tracked by NO watcher \u2014 the dispatched/in-flight pairing invariant is violated for this conversation, which will NOT self-heal and needs a runner restart.` : `A watcher is tracking this work; the loop-liveness watchdog is already recovering it.`),
+      conversation_id: conv.id
+    });
+    this.wedgeWarnings.delete(conv.id);
+    this.wedgeWarnings.set(conv.id, { firstWedgedAt, lastWarnedAt: now, consecutiveTicks });
+    while (this.wedgeWarnings.size > MAX_WEDGED_CONVERSATIONS) {
+      const oldest = this.wedgeWarnings.keys().next().value;
+      if (oldest === void 0) break;
+      this.wedgeWarnings.delete(oldest);
+    }
+    if (stuckForMs >= this.wedgeWarningIntervalMs) {
+      void this.postSignal(conv.id, messages[0].id, "dispatch_wedged", {
+        stuck_for_ms: stuckForMs,
+        untracked
+      });
+    }
+  }
+  /**
+   * How many of `messages`' ids are tracked by NO watcher's `inFlight` (#1618
+   * WI-4) — the §3/D5 orphan discriminator. `reconcileWatchers` proves the
+   * `dispatched`/`inFlight` pairing invariant holds by construction across
+   * every `dispatched.add` site (see its own doc comment), so `> 0` here means
+   * that invariant has actually been violated for this conversation: there is
+   * no watcher for WI-1's watchdog to restart, so it will NOT self-heal.
+   * `=== 0` means an ordinary stalled/exited watcher, which WI-1 is already
+   * recovering. One pass over `this.watchers`, called only when the throttled
+   * warning above is due to fire — not every tick.
+   */
+  countUntrackedIds(messages) {
+    let untracked = 0;
+    for (const message of messages) {
+      let tracked = false;
+      for (const watcher of this.watchers.values()) {
+        if (watcher.inFlight.has(message.id)) {
+          tracked = true;
+          break;
+        }
+      }
+      if (!tracked) untracked += 1;
+    }
+    return untracked;
+  }
   /**
    * Poll a session's message list for the re-drive fence (#965), via the
    * INJECTED `fetchImpl` — NOT the imported `getSessionMessages` helper, which
@@ -4200,9 +4387,16 @@ var ChannelDriver = class _ChannelDriver {
    * for, `resolveRedriveUnresolved`'s own `pausedMaxWaitMs` bound below. Every
    * other failure resolves to `unresolved` and is retried whole on the next
    * ~2s drain tick.
+   *
+   * `effectiveOpencodeMessageId` (#1618) is the caller-resolved id: the real
+   * server `opencode_message_id` when present, else the stall watchdog's local
+   * `releasedOpencodeIds` fence. Read it here rather than re-deriving it from
+   * `message` so every line below — and the signals this method posts —
+   * keeps reporting the REAL server row; a shadow-copied `message` would
+   * silently diverge from it.
    */
-  async resolveRedrive(conv, sessionId, message, sessionCreated) {
-    const ocId = message.opencode_message_id ?? null;
+  async resolveRedrive(conv, sessionId, message, sessionCreated, effectiveOpencodeMessageId) {
+    const ocId = effectiveOpencodeMessageId;
     if (sessionCreated) {
       this.clearRedriveUnresolved(message.id);
       void this.postSignal(conv.id, message.id, "redrive_redispatched");
@@ -4432,7 +4626,13 @@ var ChannelDriver = class _ChannelDriver {
     }
     return "unresolved";
   }
-  /** Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved` outcome). */
+  /**
+   * Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved`
+   * outcome) — including the stall watchdog's local re-drive fence (#1618): once
+   * `resolveRedrive` has resolved to dispatch/reattach/settle, the row either has
+   * a real server-side `opencode_message_id` again or is no longer pending, so
+   * the fence entry is no longer needed.
+   */
   clearRedriveUnresolved(messageId) {
     this.redriveUnresolvedSince.delete(messageId);
     this.redriveUnresolvedSignalled.delete(messageId);
@@ -4440,6 +4640,7 @@ var ChannelDriver = class _ChannelDriver {
     this.redriveOutcomeUnreportedSignalled.delete(messageId);
     this.redriveOutcomeFailingSince.delete(messageId);
     this.redriveOutcomeAbandonedSignalled.delete(messageId);
+    this.releasedOpencodeIds.delete(messageId);
   }
   /**
    * #1340: the dispatch loop reached a message and did NOT start a turn. Fires at
@@ -4594,6 +4795,21 @@ var ChannelDriver = class _ChannelDriver {
       this.supersededSessions.delete(oldest);
     }
   }
+  /**
+   * Record the local re-drive fence for a message force-released without
+   * completing (#1618) — see the `releasedOpencodeIds` field doc. Call BEFORE
+   * `removeInFlight`, which is about to drop the `InFlightMessage` this reads
+   * `opencodeMessageId` from. Hard-capped FIFO, same shape as `supersede`.
+   */
+  recordReleasedOpencodeId(evidentMessageId, sessionId, opencodeMessageId) {
+    this.releasedOpencodeIds.delete(evidentMessageId);
+    this.releasedOpencodeIds.set(evidentMessageId, { sessionId, opencodeMessageId });
+    while (this.releasedOpencodeIds.size > MAX_RELEASED_OPENCODE_IDS) {
+      const oldest = this.releasedOpencodeIds.keys().next().value;
+      if (oldest === void 0) return;
+      this.releasedOpencodeIds.delete(oldest);
+    }
+  }
   /** Whether `sessionId` is the session this conversation has abandoned (#553). */
   isSuperseded(conversationId, sessionId) {
     return this.supersededSessions.get(conversationId) === sessionId;
@@ -4825,15 +5041,7 @@ var ChannelDriver = class _ChannelDriver {
   registerInFlight(conv, sessionId, message, opencodeMessageId) {
     let watcher = this.watchers.get(sessionId);
     if (!watcher) {
-      watcher = {
-        conv,
-        inFlight: /* @__PURE__ */ new Map(),
-        loop: null,
-        reportedQuestions: /* @__PURE__ */ new Set(),
-        reportedPermissions: /* @__PURE__ */ new Set(),
-        lastGoodPollAt: this.now(),
-        hadUsablePoll: false
-      };
+      watcher = this.newSessionWatcher(conv);
       this.watchers.set(sessionId, watcher);
     }
     const now = this.now();
@@ -4864,6 +5072,27 @@ var ChannelDriver = class _ChannelDriver {
       ambiguousResolved: false
     });
   }
+  /**
+   * Build a fresh `SessionWatcher`. Seeds `lastTickAt`/`lastObservedTickAt`
+   * EQUAL (#1618) so a watcher whose loop has not started ticking yet is never
+   * misread as stalled by the very first reconciliation that sees it.
+   */
+  newSessionWatcher(conv) {
+    const now = this.now();
+    return {
+      conv,
+      inFlight: /* @__PURE__ */ new Map(),
+      loop: null,
+      reportedQuestions: /* @__PURE__ */ new Set(),
+      reportedPermissions: /* @__PURE__ */ new Set(),
+      lastGoodPollAt: now,
+      hadUsablePoll: false,
+      generation: 0,
+      lastTickAt: now,
+      lastObservedTickAt: now,
+      consecutiveStallRestarts: 0
+    };
+  }
   /**
    * Register a RE-ADOPTED `processing` message with its session watcher
    * (ADR-0046, WI-4). Mirrors `registerInFlight` but anchors the give-up
@@ -4893,15 +5122,7 @@ var ChannelDriver = class _ChannelDriver {
   registerReadopted(conv, sessionId, message, opencodeMessageId, processedAtMs) {
     let watcher = this.watchers.get(sessionId);
     if (!watcher) {
-      watcher = {
-        conv,
-        inFlight: /* @__PURE__ */ new Map(),
-        loop: null,
-        reportedQuestions: /* @__PURE__ */ new Set(),
-        reportedPermissions: /* @__PURE__ */ new Set(),
-        lastGoodPollAt: this.now(),
-        hadUsablePoll: false
-      };
+      watcher = this.newSessionWatcher(conv);
       this.watchers.set(sessionId, watcher);
     }
     watcher.inFlight.set(message.id, {
@@ -4945,12 +5166,110 @@ var ChannelDriver = class _ChannelDriver {
       ambiguousResolved: false
     });
   }
+  /**
+   * Loop-liveness watchdog (#1618). Runs once per `drainPending()` tick and
+   * restarts any per-session watcher whose loop has exited or stopped ticking
+   * — escalating to a bounded force-release only once
+   * `MAX_WATCHER_STALL_RESTARTS` consecutive restarts have failed to recover
+   * it. Fully synchronous: it only inspects in-memory state and calls the
+   * synchronous `ensureWatcherRunning`/`removeInFlight`, which is what lets it
+   * run from the very top of `drainPending()` — ahead of the un-timed
+   * `getPendingConversations()` await that would otherwise be able to disable
+   * it (`run.ts`'s poll loop is sequential, so a hung fetch there stops
+   * `drainPending()` from being CALLED again at all, not just from finishing).
+   *
+   * Restarts the loop rather than releasing messages directly: a blind release
+   * would let the next drain re-`prompt_async` a turn that may still be
+   * running (ADR-0047; see `releasedOpencodeIds`'s doc). A restarted loop
+   * re-polls with each message's `opencodeMessageId` still in hand and lets
+   * the existing, audited `!activelyRunning` give-up decide, same as it always
+   * has.
+   *
+   * Deliberately does NOT sweep `this.dispatched` for an id no watcher tracks:
+   * that shape has no in-flight entry and therefore no `opencodeMessageId` to
+   * fence a release with, so releasing it here would blind-re-POST a possibly-
+   * running turn — and there is no conversation id in hand to signal with
+   * either. Detection for that shape lives on WI-4's `dispatch_wedged` signal
+   * instead, where a conversation id already exists. If you find yourself
+   * wanting to add a `dispatched` sweep here, don't — read the drain-wedge
+   * plan's §3/D5 first.
+   */
+  reconcileWatchers() {
+    const now = this.now();
+    for (const [sessionId, watcher] of [...this.watchers]) {
+      if (watcher.lastTickAt !== watcher.lastObservedTickAt) {
+        watcher.consecutiveStallRestarts = 0;
+      }
+      watcher.lastObservedTickAt = watcher.lastTickAt;
+      if (watcher.inFlight.size === 0 && watcher.loop === null) {
+        this.watchers.delete(sessionId);
+        continue;
+      }
+      if (watcher.loop === null && watcher.inFlight.size > 0) {
+        if (now - watcher.lastTickAt < this.watcherStallMs) continue;
+        this.log({
+          level: "warn",
+          message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop had exited with ${watcher.inFlight.size} message(s) still in flight (idle ${now - watcher.lastTickAt}ms) \u2014 restarting`,
+          conversation_id: watcher.conv.id
+        });
+        this.ensureWatcherRunning(sessionId);
+        for (const evidentMessageId of watcher.inFlight.keys()) {
+          void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+            recovery: "loop_exited"
+          });
+        }
+        continue;
+      }
+      if (watcher.loop !== null && now - watcher.lastTickAt >= this.watcherStallMs) {
+        const stalledForMs = now - watcher.lastTickAt;
+        watcher.consecutiveStallRestarts += 1;
+        if (watcher.consecutiveStallRestarts > MAX_WATCHER_STALL_RESTARTS) {
+          this.log({
+            level: "error",
+            message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop stalled through ${watcher.consecutiveStallRestarts} restarts (last stall ${stalledForMs}ms) \u2014 releasing its ${watcher.inFlight.size} in-flight message(s)`,
+            conversation_id: watcher.conv.id
+          });
+          for (const [evidentMessageId, inFlight] of [...watcher.inFlight]) {
+            this.recordReleasedOpencodeId(evidentMessageId, sessionId, inFlight.opencodeMessageId);
+            this.removeInFlight(watcher, evidentMessageId);
+            void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+              recovery: "unrecoverable_released"
+            });
+          }
+          watcher.generation += 1;
+          this.watchers.delete(sessionId);
+          continue;
+        }
+        watcher.generation += 1;
+        watcher.loop = null;
+        watcher.lastGoodPollAt = now;
+        watcher.lastTickAt = now;
+        watcher.lastObservedTickAt = watcher.lastTickAt;
+        this.ensureWatcherRunning(sessionId);
+        this.log({
+          level: "warn",
+          message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop had not ticked in ${stalledForMs}ms \u2014 restarted under generation ${watcher.generation} (${watcher.consecutiveStallRestarts}/${MAX_WATCHER_STALL_RESTARTS})`,
+          conversation_id: watcher.conv.id
+        });
+        for (const evidentMessageId of watcher.inFlight.keys()) {
+          void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+            recovery: "loop_stalled"
+          });
+        }
+      }
+    }
+  }
   /**
    * Start (but do NOT await) the per-session watcher loop if it has in-flight
    * work and is not already running. Single-flight per session. The loop is
    * tracked on the watcher and cleared when it settles; it never rejects (fully
    * guarded), so a failed poll/callback can never crash the run loop — the cron
    * stays as the safety net.
+   *
+   * The generation started here (#1618) is captured in the `.finally` closure
+   * so a RETIRED loop settling late — after `reconcileWatchers` has already
+   * restarted this watcher under a newer generation — can neither null the new
+   * loop's handle nor delete a watcher that still has live work.
    */
   ensureWatcherRunning(sessionId) {
     const watcher = this.watchers.get(sessionId);
@@ -4960,7 +5279,9 @@ var ChannelDriver = class _ChannelDriver {
       this.watchers.delete(sessionId);
       return;
     }
-    const loop = this.runWatcherLoop(sessionId, watcher).finally(() => {
+    const generation = watcher.generation;
+    const loop = this.runWatcherLoop(sessionId, watcher, generation).finally(() => {
+      if (watcher.generation !== generation) return;
       watcher.loop = null;
       if (watcher.inFlight.size === 0) {
         this.watchers.delete(sessionId);
@@ -4980,11 +5301,25 @@ var ChannelDriver = class _ChannelDriver {
    *      `source_message_id`;
    *   4. drops messages that completed or timed out from the in-flight set.
    * Exits when the in-flight set empties. Never throws.
+   *
+   * `generation` (#1618) is the incarnation this call was started under.
+   * `reconcileWatchers` can restart a stalled loop by bumping
+   * `watcher.generation` and starting a NEW `runWatcherLoop` over the same
+   * `SessionWatcher` object — the stalled promise itself cannot be cancelled,
+   * so this loop instead checks at the top of every iteration, right after
+   * waking from `sleep`, and right before servicing any message, and quietly
+   * retires (returns without touching anything) the moment it is no longer the
+   * watcher's current generation. Retiring mid-tick can still let ONE
+   * `serviceInFlightMessage` pass complete first — acceptable, since that
+   * method contains no non-idempotent action.
    */
-  async runWatcherLoop(sessionId, watcher) {
+  async runWatcherLoop(sessionId, watcher, generation) {
     try {
       while (watcher.inFlight.size > 0) {
+        if (watcher.generation !== generation) return;
+        watcher.lastTickAt = this.now();
         await this.sleep(this.pausedPollIntervalMs);
+        if (watcher.generation !== generation) return;
         let messages = null;
         try {
           const res = await this.fetchImpl(`${this.opencodeBase}/session/${sessionId}/message`);
@@ -5005,6 +5340,7 @@ var ChannelDriver = class _ChannelDriver {
           }
         }
         const { openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk } = await this.pollInteractions(sessionId, watcher, messages);
+        if (watcher.generation !== generation) return;
         for (const inFlight of [...watcher.inFlight.values()]) {
           await this.serviceInFlightMessage(
             sessionId,
@@ -6980,7 +7316,7 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join4(homeDir, trimmed.slice(2)) : trimmed;
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join5(homeDir, trimmed.slice(2)) : trimmed;
     if (!isAbsolute2(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
@@ -7187,6 +7523,7 @@ async function driveChannels(state, driver) {
   let unreachableMs = 0;
   let lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
+  let lastSeenClaudeApplies = driver.fileSyncActivity().claudeCredentialApplies;
   while (state.running) {
     const cycleStartedAtMs = performance.now();
     let idleThisCycle = false;
@@ -7210,11 +7547,15 @@ async function driveChannels(state, driver) {
       state.messageCount += processed;
       const proxiedActivity = state.lastProxiedActivityAt !== lastSeenProxiedActivityAt;
       lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
-      const appliedFiles = driver.fileSyncActivity().appliedFiles;
+      const fileActivitySnapshot = driver.fileSyncActivity();
+      const appliedFiles = fileActivitySnapshot.appliedFiles;
       const filesApplied = appliedFiles !== lastSeenAppliedFiles;
       const fileActivity = carriedOverFileSync || filesApplied;
       lastSeenAppliedFiles = appliedFiles;
-      if (filesApplied) state.claudeUsageRearm?.();
+      const claudeCredentialApplies = fileActivitySnapshot.claudeCredentialApplies;
+      const claudeCredentialApplied = claudeCredentialApplies !== lastSeenClaudeApplies;
+      lastSeenClaudeApplies = claudeCredentialApplies;
+      if (claudeCredentialApplied) state.claudeUsageRearm?.();
       if (processed > 0 || driver.hasInFlightWatchers() || proxiedActivity || fileActivity) {
         idlePolls = 0;
         idleMs = 0;
@@ -7283,7 +7624,7 @@ async function driveChannels(state, driver) {
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
 var SESSION_DB_RECLAIM_MAX_PAGES = 2e3;
 function sessionDbPath() {
-  return join4(homedir3(), ".local", "share", "opencode", "opencode.db");
+  return join5(homedir3(), ".local", "share", "opencode", "opencode.db");
 }
 async function runSweep(state, driver, config) {
   const mode = `age=${config.maxAgeMs ?? "\u2014"} count=${config.maxCount ?? "\u2014"}`;
@@ -7418,23 +7759,44 @@ function scheduleClaudeUsageReporting(state, options) {
     return null;
   }
   let consecutiveFailures = 0;
-  let armed = false;
+  let phase = "dormant";
   let rearmRequested = false;
+  const armProbe = () => {
+    phase = "probe-pending";
+    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  };
   const scheduleNextTick = () => {
-    armed = true;
-    rearmRequested = false;
+    if (rearmRequested) {
+      rearmRequested = false;
+      armProbe();
+      return;
+    }
+    phase = "steady-pending";
     state.claudeUsageTimer = setTimeout(() => void tick(false), nextReportDelayMs());
   };
   const rearm = () => {
-    if (armed) {
-      rearmRequested = true;
-      return;
+    switch (phase) {
+      case "tick-in-flight":
+        rearmRequested = true;
+        return;
+      case "probe-pending":
+        return;
+      case "steady-pending":
+        if (state.claudeUsageTimer) {
+          clearTimeout(state.claudeUsageTimer);
+          state.claudeUsageTimer = null;
+        }
+        rearmRequested = false;
+        armProbe();
+        return;
+      case "dormant":
+        rearmRequested = false;
+        armProbe();
+        return;
     }
-    rearmRequested = false;
-    armed = true;
-    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
   };
   const tick = async (isProbe) => {
+    phase = "tick-in-flight";
     try {
       const usage = await getClaudeUsage();
       const result = await reportClaudeUsage(state.agentId, state.authHeader, usage);
@@ -7476,7 +7838,7 @@ function scheduleClaudeUsageReporting(state, options) {
             level: "debug",
             message: `Claude usage reporting: ${error2.message}`
           });
-          armed = false;
+          phase = "dormant";
           if (rearmRequested) rearm();
         } else {
           logActivity(state, {
@@ -7498,8 +7860,7 @@ function scheduleClaudeUsageReporting(state, options) {
       }
     }
   };
-  armed = true;
-  state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  armProbe();
   return rearm;
 }
 async function notifyOffline(state) {