@evident-ai/cli 3.3.1-dev.e98fa27 → 3.4.1-dev.15755a4

package/dist/index.js

@@ -746,6 +746,69 @@ async function reportClaudeUsage(agentId, authHeader, snapshot) {
     return { ok: false, error: describeBestEffortError(error2) };
   }
 }
+function toReportedOpenAiWindow(window) {
+  if (!window) return null;
+  return {
+    utilization: window.utilization,
+    window_minutes: window.windowMinutes,
+    resets_at: window.resetsAt
+  };
+}
+async function reportOpenAiUsage(agentId, authHeader, snapshot) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/openai-usage`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        primary: toReportedOpenAiWindow(snapshot.primary),
+        secondary: toReportedOpenAiWindow(snapshot.secondary),
+        has_credits: snapshot.hasCredits,
+        credits_unlimited: snapshot.creditsUnlimited
+      }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+async function reportResourceUsage(agentId, authHeader, usage) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/resource-usage`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        cpu_percent: usage.cpuPercent,
+        cpu_count: usage.cpuCount,
+        memory_total_bytes: usage.memoryTotalBytes,
+        memory_available_bytes: usage.memoryAvailableBytes,
+        disk_total_bytes: usage.diskTotalBytes,
+        disk_free_bytes: usage.diskFreeBytes,
+        opencode_db_bytes: usage.opencodeDbBytes
+      }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
 async function getAgentInfo(agentId, authHeader) {
   const apiUrl = getApiUrlConfig();
   try {
@@ -934,6 +997,7 @@ import { homedir } from "os";
 import { join } from "path";
 var CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var KEYCHAIN_SERVICE = "Claude Code-credentials";
+var CLAUDE_CREDENTIALS_SEGMENTS = [".claude", ".credentials.json"];
 function parseClaudeCliCredentials(raw) {
   let parsed;
   try {
@@ -967,7 +1031,7 @@ function readClaudeCliCredentials() {
     }
   }
   try {
-    const raw = readFileSync(join(homedir(), ".claude", ".credentials.json"), "utf-8");
+    const raw = readFileSync(join(homedir(), ...CLAUDE_CREDENTIALS_SEGMENTS), "utf-8");
     return parseClaudeCliCredentials(raw);
   } catch (err) {
     const code = err.code;
@@ -1062,8 +1126,8 @@ async function claudeUsage() {
 }
 
 // src/commands/run.ts
-import { homedir as homedir3 } from "os";
-import { isAbsolute as isAbsolute2, join as join4, parse, resolve as resolvePath } from "path";
+import { homedir as homedir4 } from "os";
+import { isAbsolute as isAbsolute2, join as join7, parse, resolve as resolvePath } from "path";
 import chalk6 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
@@ -1296,6 +1360,8 @@ var SEVERITY_BY_LEVEL = {
   error: "error"
 };
 var MAX_MESSAGE_LENGTH = 500;
+var MAX_METADATA_VALUE_LENGTH = 200;
+var MAX_METADATA_ENTRIES = 20;
 var TRUNCATION_MARKER = "\u2026";
 function redact(message) {
   return message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/https?:\/\/\S+/g, "<url>");
@@ -1304,6 +1370,24 @@ function truncate(message) {
   if (message.length <= MAX_MESSAGE_LENGTH) return message;
   return message.slice(0, MAX_MESSAGE_LENGTH - TRUNCATION_MARKER.length) + TRUNCATION_MARKER;
 }
+function sanitiseMetadata(metadata) {
+  if (!metadata) return {};
+  const entries = Object.entries(metadata).slice(0, MAX_METADATA_ENTRIES);
+  if (Object.keys(metadata).length > entries.length) {
+    console.error(
+      `[runner-activity-telemetry] dropped ${Object.keys(metadata).length - entries.length} metadata entries`
+    );
+  }
+  const sanitised = [];
+  for (const [key, value] of entries) {
+    if (typeof value === "string") {
+      sanitised.push([key, truncate(redact(value).slice(0, MAX_METADATA_VALUE_LENGTH))]);
+    } else if (value === null || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) {
+      sanitised.push([key, value]);
+    }
+  }
+  return Object.fromEntries(sanitised);
+}
 var RATE_LIMIT_WINDOW_MS = 6e4;
 var RATE_LIMIT_MAX_EVENTS = 30;
 var windowStartedAt = 0;
@@ -1342,7 +1426,7 @@ function forwardRunnerActivity(entry, context) {
     logEvent(TelemetryEventTypes.RUNNER_ACTIVITY, {
       severity: SEVERITY_BY_LEVEL[entry.level],
       message,
-      metadata: { source: "cli.run" },
+      metadata: { ...sanitiseMetadata(entry.metadata), source: "cli.run" },
       agentId: context.agentId
     });
   } catch (err) {
@@ -1352,6 +1436,150 @@ function forwardRunnerActivity(entry, context) {
   }
 }
 
+// src/lib/opencode/session-db-recovery-report.ts
+import { readFileSync as readFileSync2, unlinkSync } from "fs";
+import { join as join2 } from "path";
+function sessionDbRecoveryReportPath(homeDir, env) {
+  const override = env.EVIDENT_SESSION_DB_RECOVERY_REPORT?.trim();
+  return override || join2(homeDir, ".local", "state", "evident", "session-db-recovery.jsonl");
+}
+function drainSessionDbRecoveryReport({
+  homeDir,
+  env
+}) {
+  const path = sessionDbRecoveryReportPath(homeDir, env);
+  let content;
+  try {
+    content = readFileSync2(path, "utf8");
+  } catch (error2) {
+    if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT")
+      return { path, records: [], skippedLines: 0, readError: null };
+    const readError = error2 instanceof Error ? error2.message : String(error2);
+    console.error(`[session-db-recovery-report] could not read ${path}: ${readError}`);
+    return { path, records: [], skippedLines: 0, readError };
+  }
+  let skippedLines = 0;
+  const records = content.split("\n").flatMap((line) => {
+    if (!line.trim()) return [];
+    try {
+      const value = JSON.parse(line);
+      if (!isSessionDbRecoveryRecord(value)) {
+        skippedLines++;
+        return [];
+      }
+      return [value];
+    } catch (error2) {
+      skippedLines++;
+      console.error(
+        `[session-db-recovery-report] skipped malformed record in ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+      return [];
+    }
+  });
+  return { path, records, skippedLines, readError: null };
+}
+function acknowledgeSessionDbRecoveryReport(path) {
+  try {
+    unlinkSync(path);
+  } catch (error2) {
+    if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") return;
+    console.error(
+      `[session-db-recovery-report] could not remove ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+  }
+}
+function buildSessionDbRecoveryActivity(record) {
+  const level = record.severity === "warning" ? "warn" : record.severity === "error" ? "error" : null;
+  if (!level) return null;
+  const noVerifiedPoint = record.verified_restore_point ? ` The verified restore point is ${record.verified_restore_point}.` : " No verified restore point is known.";
+  switch (record.outcome) {
+    case "fresh_session_db":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: `This runner started with a fresh session database. Earlier sessions are unavailable, and queued conversation or session references from before this start may no longer resolve.${noVerifiedPoint} Review the runner's backup configuration before relying on restored session history.`
+      };
+    case "restore_retried":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: "The initial session database restore failed; the runner will retry it. Monitor the runner backup for another restore failure."
+      };
+    case "replica_recovered":
+      if (record.reason === "quarantine")
+        return {
+          level,
+          metadata: withoutContractFields(record),
+          message: `Session database recovery quarantined ${record.quarantined_objects ?? "unknown"} objects (${record.quarantined_bytes ?? "unknown"} bytes); ${record.quarantine_failed_objects ?? "unknown"} moves failed. Review the preserved backup at ${record.quarantine_destination ?? "an unknown destination"} before deleting it.`
+        };
+      if (record.reason === "prune")
+        return {
+          level,
+          metadata: withoutContractFields(record),
+          message: "Session database recovery discarded a damaged newest backup and retried. Sessions recorded after the previous backup point may be unavailable. Review the runner backup for another restore failure."
+        };
+      if (record.reason === "clear")
+        return {
+          level,
+          metadata: withoutContractFields(record),
+          message: "Session database recovery deleted the damaged backup and prior session history is unavailable. Review the runner backup configuration before relying on restored session history."
+        };
+      return null;
+    case "history_rolled_back":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: `Session history was rolled back to verified restore point ${record.verified_restore_point ?? "unknown"}; everything after it is unavailable. Review the runner backup for another restore failure.`
+      };
+    case "restore_misconfigured":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: "This runner started with a fresh session database because it could not verify where its session history is backed up. Nothing in the backup was changed; check the runner backup configuration and permissions."
+      };
+    case "session_db_boot_refused":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: `This runner did not come online because its damaged session database could not be safely separated from its active backup or proven removed. Backed-up session history remains readable at ${record.quarantine_destination ?? "its original location or the quarantine destination named in the boot logs"}; any local session-database files that remain were left in place and nothing opened or wrote them. See the runner boot logs for SESSION-DB-LOCAL-DISCARD-FAILED details.`
+      };
+    default:
+      return null;
+  }
+}
+function withoutContractFields(record) {
+  const { v: _v, event: _event, ...metadata } = record;
+  return metadata;
+}
+var OUTCOMES = /* @__PURE__ */ new Set([
+  "replica_recovered",
+  "restore_retried",
+  "fresh_session_db",
+  "history_rolled_back",
+  "restore_misconfigured",
+  "session_db_boot_refused"
+]);
+var STAGES = /* @__PURE__ */ new Set(["restore", "verify"]);
+var SEVERITIES = /* @__PURE__ */ new Set(["warning", "error"]);
+var NUMBER_FIELDS = [
+  "litestream_exit_code",
+  "attempt",
+  "replica_objects",
+  "replica_bytes",
+  "quarantined_objects",
+  "quarantine_failed_objects",
+  "quarantined_bytes",
+  "restore_points_tried"
+];
+var STRING_OR_NULL_FIELDS = ["quarantine_destination", "verified_restore_point"];
+function isSessionDbRecoveryRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  return record.v === 1 && record.event === "session_db_recovery" && typeof record.at === "string" && STAGES.has(record.stage) && OUTCOMES.has(record.outcome) && SEVERITIES.has(record.severity) && typeof record.reason === "string" && NUMBER_FIELDS.every((field) => record[field] === null || Number.isInteger(record[field])) && STRING_OR_NULL_FIELDS.every(
+    (field) => record[field] === null || typeof record[field] === "string"
+  );
+}
+
 // src/lib/opencode/health.ts
 async function checkOpenCodeHealth(port) {
   try {
@@ -1700,13 +1928,22 @@ function buildNoProviderWarning(hasProvider) {
   return "Warning: opencode has no authenticated model provider configured, so it won't be able to answer prompts. Run `opencode auth login` to set one up (see https://opencode.ai for details).";
 }
 
+// src/lib/http-timeout.ts
+var REQUEST_TIMEOUT_MS = 6e4;
+function withRequestTimeout(fetchImpl, timeoutMs) {
+  return ((input, init) => fetchImpl(input, { ...init, signal: AbortSignal.timeout(timeoutMs) }));
+}
+
 // src/lib/opencode/session.ts
+function timedFetch(input, init) {
+  return withRequestTimeout(fetch, REQUEST_TIMEOUT_MS)(input, init);
+}
 function opencodeBase(port) {
   return `http://127.0.0.1:${port}`;
 }
 async function getOpenCodeDirectory(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/path`);
+    const res = await timedFetch(`${opencodeBase(port)}/path`);
     if (!res.ok) return null;
     const body = await res.json();
     const dir = typeof body.directory === "string" && body.directory || typeof body.worktree === "string" && body.worktree || typeof body.path?.cwd === "string" && body.path.cwd || typeof body.path?.directory === "string" && body.path.directory || null;
@@ -1757,7 +1994,7 @@ function isAssistantInFlight(m) {
 }
 async function getSessionMessages(port, sessionId) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${sessionId}/message`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/${sessionId}/message`);
     if (!res.ok) return null;
     const body = await res.json();
     return Array.isArray(body) ? body : null;
@@ -1787,7 +2024,7 @@ function sessionLastActivityMs(session) {
 }
 async function listSessions(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session`);
+    const res = await timedFetch(`${opencodeBase(port)}/session`);
     if (!res.ok) return null;
     const body = await res.json();
     return Array.isArray(body) ? body : null;
@@ -1797,7 +2034,7 @@ async function listSessions(port) {
 }
 async function deleteSession(port, id) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${id}`, { method: "DELETE" });
+    const res = await timedFetch(`${opencodeBase(port)}/session/${id}`, { method: "DELETE" });
     return res.status >= 200 && res.status < 300;
   } catch {
     return false;
@@ -1805,7 +2042,7 @@ async function deleteSession(port, id) {
 }
 async function sessionExists(port, id) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${id}`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/${id}`);
     if (res.status >= 200 && res.status < 300) return true;
     if (res.status === 404) return false;
     return null;
@@ -1815,7 +2052,7 @@ async function sessionExists(port, id) {
 }
 async function getSessionStatuses(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/status`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/status`);
     if (!res.ok) {
       console.error(
         `[getSessionStatuses] GET /session/status returned HTTP ${res.status} (port ${port})`
@@ -1848,7 +2085,7 @@ async function createOpenCodeSession(port, directory) {
   if (directory && directory.trim()) {
     url.searchParams.set("directory", directory.trim());
   }
-  const response = await fetch(url, {
+  const response = await timedFetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({})
@@ -1862,7 +2099,7 @@ async function createOpenCodeSession(port, directory) {
 }
 async function getModelAttachmentCapability(port, model) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/config/providers`);
+    const res = await timedFetch(`${opencodeBase(port)}/config/providers`);
     if (!res.ok) {
       console.error(
         `[getModelAttachmentCapability] GET /config/providers returned HTTP ${res.status} (port ${port})`
@@ -1995,7 +2232,7 @@ async function sendPromptAsync(port, sessionId, content, options, attachments) {
       };
     }
   }
-  const res = await fetch(`${opencodeBase(port)}/session/${sessionId}/prompt_async`, {
+  const res = await timedFetch(`${opencodeBase(port)}/session/${sessionId}/prompt_async`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(body)
@@ -2244,7 +2481,7 @@ function hasRunningAssistantExcept(messages, exceptUserMessageId) {
 }
 async function hasAnyConfiguredProvider(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/config/providers`);
+    const res = await timedFetch(`${opencodeBase(port)}/config/providers`);
     if (!res.ok) {
       console.error(
         `[hasAnyConfiguredProvider] GET /config/providers returned HTTP ${res.status} (port ${port})`
@@ -2380,10 +2617,10 @@ function resolveSessionCleanupConfig(flags, env = process.env) {
 
 // src/lib/opencode/session-db-size.ts
 import { statSync as statSync2 } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 var LARGE_DB_THRESHOLD_BYTES = 268435456;
 function statSessionDbBytes(homeDir) {
-  const dbPath = join2(homeDir, ".local", "share", "opencode", "opencode.db");
+  const dbPath = join3(homeDir, ".local", "share", "opencode", "opencode.db");
   try {
     return statSync2(dbPath).size;
   } catch (err) {
@@ -2952,44 +3189,405 @@ function writeTunnelReadyMarker(path, agentId) {
   }
 }
 
-// src/lib/claude-usage-reporting.ts
-var VALID_MODES = ["auto", "on", "off"];
-function resolveClaudeUsageReportingMode(flagValue, env) {
-  const raw = flagValue ?? env.EVIDENT_CLAUDE_USAGE_REPORTING;
-  if (raw === void 0 || raw === "") {
-    return { mode: "auto", warnings: [] };
+// src/lib/openai-usage.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join4 } from "path";
+var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
+var OPENCODE_AUTH_SEGMENTS = [".local", "share", "opencode", "auth.json"];
+var OpenAiUsageError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+};
+function isLocalCredentialProblem2(err) {
+  return err instanceof OpenAiUsageError && (err.reason === "no_credentials" || err.reason === "credentials_expired");
+}
+function readOpenCodeChatGptCredentials() {
+  try {
+    const raw = readFileSync3(join4(homedir2(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    const entry = parsed.openai;
+    if (entry?.type !== "oauth" || typeof entry.access !== "string" || !entry.access || typeof entry.expires !== "number") {
+      return null;
+    }
+    return { accessToken: entry.access, expiresAt: entry.expires };
+  } catch (err) {
+    const code = err.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR") {
+      console.warn(
+        `readOpenCodeChatGptCredentials: reading auth.json failed (${code ?? "unknown"})`
+      );
+    }
+    return null;
+  }
+}
+function toWindow2(headers, name) {
+  const utilizationHeader = headers.get(`x-codex-${name}-used-percent`);
+  const windowMinutesHeader = headers.get(`x-codex-${name}-window-minutes`);
+  if (utilizationHeader == null || utilizationHeader === "" || windowMinutesHeader == null) {
+    return null;
+  }
+  const utilization = Number(utilizationHeader);
+  const windowMinutes = Number(windowMinutesHeader);
+  if (!Number.isFinite(utilization) || !Number.isFinite(windowMinutes) || windowMinutes <= 0) {
+    return null;
+  }
+  const resetAtHeader = headers.get(`x-codex-${name}-reset-at`);
+  const resetSeconds = resetAtHeader == null || resetAtHeader === "" ? NaN : Number(resetAtHeader);
+  const resetsAt = Number.isFinite(resetSeconds) ? new Date(resetSeconds * 1e3).toISOString() : null;
+  return { utilization: Math.min(100, Math.max(0, utilization)), windowMinutes, resetsAt };
+}
+function parseCodexUsageHeaders(headers) {
+  return {
+    primary: toWindow2(headers, "primary"),
+    secondary: toWindow2(headers, "secondary"),
+    hasCredits: headers.has("x-codex-credits-has-credits") ? headers.get("x-codex-credits-has-credits")?.toLowerCase() === "true" : null,
+    creditsUnlimited: headers.has("x-codex-credits-unlimited") ? headers.get("x-codex-credits-unlimited")?.toLowerCase() === "true" : null
+  };
+}
+function normalizeProbeModel(model) {
+  return model.endsWith("-fast") ? model.slice(0, -"-fast".length) : model;
+}
+async function resolveProbeModels(port) {
+  try {
+    const res = await withRequestTimeout(
+      fetch,
+      REQUEST_TIMEOUT_MS
+    )(`${opencodeBase(port)}/config/providers`);
+    if (!res.ok) {
+      console.error(
+        `[resolveProbeModels] GET /config/providers returned HTTP ${res.status} (port ${port})`
+      );
+      return [];
+    }
+    const body = await res.json();
+    const provider = body?.providers?.find((candidate) => candidate?.id === "openai");
+    if (!provider || !provider.models || typeof provider.models !== "object") return [];
+    const candidates = [
+      ...typeof body?.default?.openai === "string" ? [body.default.openai] : [],
+      ...Object.keys(provider.models)
+    ].map(normalizeProbeModel);
+    return [...new Set(candidates)].slice(0, 4);
+  } catch (err) {
+    console.error(
+      `[resolveProbeModels] GET /config/providers failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+    );
+    return [];
+  }
+}
+function hasPrimaryHeaders(headers) {
+  return [
+    "x-codex-primary-used-percent",
+    "x-codex-primary-window-minutes",
+    "x-codex-primary-reset-at"
+  ].some((name) => headers.has(name));
+}
+async function getOpenAiUsage(port) {
+  const credentials2 = readOpenCodeChatGptCredentials();
+  if (!credentials2) {
+    throw new OpenAiUsageError(
+      "No ChatGPT login found. Connect a ChatGPT account to this runner, or run `opencode auth login`.",
+      "no_credentials"
+    );
+  }
+  if (credentials2.expiresAt < Date.now()) {
+    throw new OpenAiUsageError(
+      "ChatGPT credentials have expired. Run `opencode auth login` to refresh them.",
+      "credentials_expired"
+    );
+  }
+  const models = await resolveProbeModels(port);
+  if (models.length === 0) {
+    throw new OpenAiUsageError("No supported OpenAI probe model is available.", "no_probe_model");
   }
+  let lastStatus;
+  for (const model of models) {
+    let res;
+    try {
+      res = await withRequestTimeout(fetch, REQUEST_TIMEOUT_MS)(CODEX_RESPONSES_URL, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${credentials2.accessToken}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ model, store: false, stream: true })
+      });
+    } catch (err) {
+      throw new OpenAiUsageError(
+        `OpenAI usage probe request failed: ${err instanceof Error ? err.message : String(err)}.`,
+        "request_failed"
+      );
+    }
+    try {
+      lastStatus = res.status;
+      if (hasPrimaryHeaders(res.headers)) {
+        const usage = parseCodexUsageHeaders(res.headers);
+        if (!usage.primary && !usage.secondary) {
+          throw new OpenAiUsageError(
+            `OpenAI usage probe returned no usable window (HTTP ${res.status}).`,
+            "no_usable_window"
+          );
+        }
+        return usage;
+      }
+      if (res.status === 401) {
+        throw new OpenAiUsageError(
+          "ChatGPT credentials have expired (HTTP 401).",
+          "credentials_expired"
+        );
+      }
+      if (res.status === 403 || res.status === 429) {
+        throw new OpenAiUsageError(
+          `OpenAI usage probe was blocked (HTTP ${res.status}).`,
+          "probe_blocked"
+        );
+      }
+    } finally {
+      await res.body?.cancel().catch(() => {
+      });
+    }
+  }
+  throw new OpenAiUsageError(
+    `OpenAI usage probe failed: HTTP ${lastStatus ?? "unknown"}.`,
+    "request_failed"
+  );
+}
+
+// src/lib/reporting-schedule.ts
+function jitteredDelayMs(baseMs, jitterFraction, random = Math.random) {
+  const jitterRangeMs = baseMs * jitterFraction;
+  return baseMs - jitterRangeMs + random() * (2 * jitterRangeMs);
+}
+function firstReportDelayMs(random = Math.random) {
+  return 5e3 + random() * 1e4;
+}
+var VALID_USAGE_REPORTING_MODES = ["auto", "on", "off"];
+function resolveUsageReportingMode(flagValue, env, names) {
+  const raw = flagValue ?? env[names.envVar];
+  if (raw === void 0 || raw === "") return { mode: "auto", warnings: [] };
   const normalized = raw.trim().toLowerCase();
-  if (VALID_MODES.includes(normalized)) {
+  if (VALID_USAGE_REPORTING_MODES.includes(normalized)) {
     return { mode: normalized, warnings: [] };
   }
-  const source = flagValue !== void 0 ? "--claude-usage-reporting" : "EVIDENT_CLAUDE_USAGE_REPORTING";
+  const source = flagValue !== void 0 ? names.flagName : names.envVar;
   return {
     mode: "auto",
     warnings: [
-      `Ignoring invalid ${source} "${raw}": expected one of ${VALID_MODES.join(", ")}; using auto`
+      `Ignoring invalid ${source} "${raw}": expected one of ${VALID_USAGE_REPORTING_MODES.join(", ")}; using auto`
     ]
   };
 }
-var BASE_REPORT_DELAY_MS = 10 * 6e4;
-var REPORT_DELAY_JITTER_FRACTION = 0.2;
+var BASE_USAGE_REPORT_DELAY_MS = 10 * 6e4;
+var USAGE_REPORT_DELAY_JITTER_FRACTION = 0.2;
+function usageReportDelayMs(random = Math.random) {
+  return jitteredDelayMs(BASE_USAGE_REPORT_DELAY_MS, USAGE_REPORT_DELAY_JITTER_FRACTION, random);
+}
+var USAGE_REPORT_FAILURE_REESCALATION_TICKS = 6;
+function usageReportFailureLogLevel(consecutiveFailures) {
+  return reportFailureLogLevel(consecutiveFailures, USAGE_REPORT_FAILURE_REESCALATION_TICKS);
+}
+function reportFailureLogLevel(consecutiveFailures, reescalationTicks) {
+  return consecutiveFailures === 1 || consecutiveFailures % reescalationTicks === 0 ? "warn" : "debug";
+}
+function failureStreakSuffix(consecutiveFailures) {
+  return consecutiveFailures > 1 ? ` (${consecutiveFailures} consecutive failures)` : "";
+}
+
+// src/lib/claude-usage-reporting.ts
+function resolveClaudeUsageReportingMode(flagValue, env) {
+  return resolveUsageReportingMode(flagValue, env, {
+    flagName: "--claude-usage-reporting",
+    envVar: "EVIDENT_CLAUDE_USAGE_REPORTING"
+  });
+}
 function nextReportDelayMs(random = Math.random) {
-  const jitterRangeMs = BASE_REPORT_DELAY_MS * REPORT_DELAY_JITTER_FRACTION;
-  return BASE_REPORT_DELAY_MS - jitterRangeMs + random() * (2 * jitterRangeMs);
+  return usageReportDelayMs(random);
 }
-var FIRST_REPORT_DELAY_MS = 5e3 + Math.random() * 1e4;
-var CLAUDE_USAGE_FAILURE_REESCALATION_TICKS = 6;
+var FIRST_REPORT_DELAY_MS = firstReportDelayMs();
 function claudeUsageFailureLogLevel(consecutiveFailures) {
-  return consecutiveFailures === 1 || consecutiveFailures % CLAUDE_USAGE_FAILURE_REESCALATION_TICKS === 0 ? "warn" : "debug";
+  return usageReportFailureLogLevel(consecutiveFailures);
+}
+
+// src/lib/openai-usage-reporting.ts
+function resolveOpenAiUsageReportingMode(flagValue, env) {
+  return resolveUsageReportingMode(flagValue, env, {
+    flagName: "--openai-usage-reporting",
+    envVar: "EVIDENT_OPENAI_USAGE_REPORTING"
+  });
+}
+
+// src/lib/resource-usage-reporting.ts
+var ENABLED_VALUES = /* @__PURE__ */ new Set(["on", "true", "1"]);
+var DISABLED_VALUES = /* @__PURE__ */ new Set(["off", "false", "0"]);
+function resolveResourceUsageReportingEnabled(flagValue, env) {
+  if (flagValue === false) {
+    return { enabled: false, warnings: [] };
+  }
+  const raw = env.EVIDENT_RESOURCE_USAGE_REPORTING;
+  if (raw === void 0 || raw === "") {
+    return { enabled: true, warnings: [] };
+  }
+  const normalized = raw.trim().toLowerCase();
+  if (DISABLED_VALUES.has(normalized)) {
+    return { enabled: false, warnings: [] };
+  }
+  if (ENABLED_VALUES.has(normalized)) {
+    return { enabled: true, warnings: [] };
+  }
+  return {
+    enabled: true,
+    warnings: [
+      `Ignoring invalid EVIDENT_RESOURCE_USAGE_REPORTING "${raw}": expected on or off; leaving reporting on`
+    ]
+  };
+}
+
+// src/lib/resource-usage.ts
+import { cpus, totalmem, freemem } from "os";
+import { statfsSync as statfsSync2 } from "fs";
+
+// src/lib/ecs-task-metadata.ts
+var ECS_METADATA_TIMEOUT_MS = 2e3;
+function parseEcsTaskLimits(payload) {
+  if (typeof payload !== "object" || payload === null) return null;
+  const limits = payload.Limits;
+  if (typeof limits !== "object" || limits === null) return null;
+  const cpu = limits.CPU;
+  const memory = limits.Memory;
+  if (typeof cpu !== "number" || !Number.isFinite(cpu) || cpu <= 0) return null;
+  if (typeof memory !== "number" || !Number.isFinite(memory) || memory <= 0) return null;
+  return {
+    cpuCount: Math.max(1, Math.round(cpu)),
+    memoryTotalBytes: memory * 1024 * 1024
+  };
+}
+async function readEcsTaskLimits(env) {
+  const uri = env.ECS_CONTAINER_METADATA_URI_V4;
+  if (!uri) {
+    return { limits: null };
+  }
+  const url = `${uri}/task`;
+  try {
+    const response = await fetch(url, { signal: AbortSignal.timeout(ECS_METADATA_TIMEOUT_MS) });
+    if (!response.ok) {
+      return {
+        limits: null,
+        warning: `ECS task metadata fetch (${url}) returned HTTP ${response.status}`
+      };
+    }
+    const payload = await response.json();
+    const limits = parseEcsTaskLimits(payload);
+    if (limits === null) {
+      return {
+        limits: null,
+        warning: `ECS task metadata fetch (${url}) returned an unexpected payload`
+      };
+    }
+    return { limits };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    return { limits: null, warning: `ECS task metadata fetch (${url}) failed: ${message}` };
+  }
+}
+
+// src/lib/resource-usage.ts
+function readCpuSample() {
+  let busyMs = 0;
+  let idleMs = 0;
+  for (const cpu of cpus()) {
+    busyMs += cpu.times.user + cpu.times.nice + cpu.times.sys + cpu.times.irq;
+    idleMs += cpu.times.idle;
+  }
+  return { busyMs, idleMs };
+}
+function cpuPercentBetween(previous, current) {
+  const deltaBusy = current.busyMs - previous.busyMs;
+  const deltaIdle = current.idleMs - previous.idleMs;
+  const total = deltaBusy + deltaIdle;
+  if (total === 0) return null;
+  return Math.round((deltaBusy / total * 100 + Number.EPSILON) * 100) / 100;
+}
+function clamp(value, min, max) {
+  return Math.min(Math.max(value, min), max);
+}
+function round2(value) {
+  return Math.round((value + Number.EPSILON) * 100) / 100;
+}
+function readDisk(homeDir) {
+  try {
+    const stats = statfsSync2(homeDir);
+    return {
+      totalBytes: stats.bsize * stats.blocks,
+      freeBytes: stats.bsize * stats.bavail
+    };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    return {
+      totalBytes: null,
+      freeBytes: null,
+      warning: `Could not read disk usage for ${homeDir}: ${message}`
+    };
+  }
+}
+function createResourceUsageCollector(homeDir) {
+  let previous = readCpuSample();
+  return async () => {
+    const current = readCpuSample();
+    const hostCpuPercent = cpuPercentBetween(previous, current);
+    const hostCpuCount = cpus().length;
+    previous = current;
+    const disk = readDisk(homeDir);
+    const opencodeDbBytes = statSessionDbBytes(homeDir);
+    const { limits, warning: ecsWarning } = await readEcsTaskLimits(process.env);
+    const warnings = [];
+    if (disk.warning) warnings.push(disk.warning);
+    if (ecsWarning) warnings.push(ecsWarning);
+    let cpuPercent = hostCpuPercent;
+    let cpuCount = hostCpuCount;
+    let memoryTotalBytes = totalmem();
+    let memoryAvailableBytes = freemem();
+    if (limits !== null) {
+      cpuCount = limits.cpuCount;
+      memoryTotalBytes = limits.memoryTotalBytes;
+      memoryAvailableBytes = clamp(
+        limits.memoryTotalBytes - (totalmem() - freemem()),
+        0,
+        limits.memoryTotalBytes
+      );
+      cpuPercent = hostCpuPercent === null ? null : clamp(round2(hostCpuPercent * hostCpuCount / limits.cpuCount), 0, 100);
+    }
+    return {
+      usage: {
+        cpuPercent,
+        cpuCount,
+        memoryTotalBytes,
+        memoryAvailableBytes,
+        diskTotalBytes: disk.totalBytes,
+        diskFreeBytes: disk.freeBytes,
+        opencodeDbBytes
+      },
+      warnings
+    };
+  };
 }
 
 // src/lib/channels/driver.ts
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
+
+// src/lib/runner-file-sync.ts
+import { join as join6 } from "path";
 
 // src/lib/file-push.ts
 import { randomUUID } from "crypto";
 import { chmod, mkdir, open as open2, realpath, rename, unlink } from "fs/promises";
-import { basename, dirname as dirname3, isAbsolute, join as join3, relative, resolve as resolve2, sep } from "path";
+import { basename, dirname as dirname3, isAbsolute, join as join5, relative, resolve as resolve2, sep } from "path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
 async function writePushedFile(request) {
@@ -3022,7 +3620,7 @@ async function writePushedFile(request) {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
       dirname3(candidate)
     );
-    const realTarget = join3(existingAncestor, ...missingSegments, basename(candidate));
+    const realTarget = join5(existingAncestor, ...missingSegments, basename(candidate));
     const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
@@ -3058,7 +3656,7 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join3(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join5(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
@@ -3131,13 +3729,13 @@ function contains(realDirectory, realTarget) {
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join3(current, segment);
+    current = join5(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join3(dirname3(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join5(dirname3(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
     handle = await open2(temporaryPath, "wx", FILE_MODE);
@@ -3179,17 +3777,28 @@ async function syncPendingRunnerFiles(options) {
   for (const id of options.ackFailures.keys()) {
     if (!pendingIds.has(id)) options.ackFailures.delete(id);
   }
-  if (pending.length === 0) return 0;
+  if (pending.length === 0) {
+    return { applied: 0, claudeCredentialApplied: false, opencodeAuthApplied: false };
+  }
   options.log({
     level: "info",
     message: `Runner file sync: ${pending.length} file(s) queued for this runner`
   });
   let applied = 0;
+  let claudeCredentialApplied = false;
+  let opencodeAuthApplied = false;
   for (const file of pending) {
     if ((options.ackFailures.get(file.id) ?? 0) >= MAX_ACK_ATTEMPTS) continue;
-    if (await applyOne(options, file)) applied += 1;
+    const outcome = await applyOne(options, file);
+    if (outcome.applied) applied += 1;
+    if (outcome.claudeCredentialApplied) claudeCredentialApplied = true;
+    if (outcome.opencodeAuthApplied) opencodeAuthApplied = true;
   }
-  return applied;
+  return {
+    applied,
+    claudeCredentialApplied,
+    opencodeAuthApplied
+  };
 }
 async function listPendingFiles(options) {
   let res;
@@ -3250,6 +3859,19 @@ function asPendingFile(entry) {
   if (typeof size !== "number" || !Number.isFinite(size) || size < 0) return null;
   return { id, path, size };
 }
+var NOT_APPLIED = {
+  applied: false,
+  claudeCredentialApplied: false,
+  opencodeAuthApplied: false
+};
+function isClaudeCredentialPath(requestedPath, homeDir) {
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join6(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join6(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+}
+function isOpenCodeAuthPath(requestedPath, homeDir) {
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join6(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join6(homeDir, ...OPENCODE_AUTH_SEGMENTS);
+}
 async function applyOne(options, file) {
   const label = `${file.id.slice(0, 8)} (${file.path})`;
   if (options.allowedDirectories.length === 0) {
@@ -3258,7 +3880,7 @@ async function applyOne(options, file) {
       message: `Runner file ${label} rejected: file sync is not enabled on this runner (start it with --enable-file-sync-to)`
     });
     await ack(options, file, "rejected", "file_sync_disabled");
-    return false;
+    return NOT_APPLIED;
   }
   if (file.size > MAX_FILE_PUSH_BYTES) {
     options.log({
@@ -3266,12 +3888,12 @@ async function applyOne(options, file) {
       message: `Runner file ${label} rejected: declared ${file.size} bytes, the limit is ${MAX_FILE_PUSH_BYTES}`
     });
     await ack(options, file, "rejected", "file_too_large");
-    return false;
+    return NOT_APPLIED;
   }
   const download = await downloadContent(options, file, label);
   if (!download.ok) {
     if (download.terminal) await ack(options, file, "rejected", download.code);
-    return false;
+    return NOT_APPLIED;
   }
   let outcome;
   try {
@@ -3287,7 +3909,7 @@ async function applyOne(options, file) {
       message: `Runner file ${label} could not be written: ${describe(err)}`
     });
     await ack(options, file, "rejected", "write_failed");
-    return false;
+    return NOT_APPLIED;
   }
   if (!outcome.ok) {
     options.log({
@@ -3295,14 +3917,18 @@ async function applyOne(options, file) {
       message: `Runner file ${label} rejected (${outcome.code}): ${outcome.message}`
     });
     await ack(options, file, "rejected", outcome.code);
-    return false;
+    return NOT_APPLIED;
   }
   options.log({
     level: "info",
     message: `Runner file ${label} applied (${download.content.byteLength} bytes)`
   });
   await ack(options, file, "applied");
-  return true;
+  return {
+    applied: true,
+    claudeCredentialApplied: isClaudeCredentialPath(file.path, options.homeDir),
+    opencodeAuthApplied: isOpenCodeAuthPath(file.path, options.homeDir)
+  };
 }
 function durableDownloadCode(status2) {
   return status2 === 413 ? "file_too_large" : "write_failed";
@@ -3413,8 +4039,13 @@ var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
 var AMBIGUOUS_FINISH_MAX_PINNED_MS = 3 * 6e4;
 var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
+var WATCHER_STALL_MS = 3 * POLL_MISS_GRACE_MS;
+var MAX_WATCHER_STALL_RESTARTS = 3;
+var MAX_RELEASED_OPENCODE_IDS = 256;
 var MAX_SUPERSEDED_CONVERSATIONS = 256;
 var MAX_IDENTICAL_REDRIVE_POLL_FAILURES = 5;
+var WEDGE_WARNING_INTERVAL_MS = 5 * 60 * 1e3;
+var MAX_WEDGED_CONVERSATIONS = 256;
 var ChannelAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -3458,6 +4089,8 @@ var ChannelDriver = class _ChannelDriver {
   fileSyncDirectories;
   homeDir;
   maxActiveSessions;
+  watcherStallMs;
+  wedgeWarningIntervalMs;
   /** Cache of conversationId → opencode sessionId. */
   sessions = /* @__PURE__ */ new Map();
   /**
@@ -3488,6 +4121,40 @@ var ChannelDriver = class _ChannelDriver {
    * bounded cost.
    */
   supersededSessions = /* @__PURE__ */ new Map();
+  /**
+   * Local re-drive fence for a message force-released by the stall watchdog
+   * (#1618, `reconcileWatchers`'s `unrecoverable_released` arm — the only writer,
+   * see `recordReleasedOpencodeId`). The row's server-side `opencode_message_id`
+   * is `null` for exactly this shape (its `markProcessing` never landed), so
+   * without a local record of the id the driver last knew, the next drain's
+   * `if (message.opencode_message_id)` re-drive-fence check at
+   * `processConversation` would not engage and it would blind-`prompt_async`
+   * a turn that may still be running in opencode — the one duplicate-turn
+   * hazard this whole design exists to close (§3/D1 of the drain-wedge plan).
+   * `processConversation` reads `message.opencode_message_id ?? this
+   * .releasedOpencodeIds.get(id)?.opencodeMessageId` as the EFFECTIVE id and
+   * threads it into `resolveRedrive`, which asks opencode itself whether the
+   * turn is still ongoing before ever dispatching.
+   *
+   * Bounded FIFO, mirroring `supersededSessions` above (`MAX_RELEASED_OPENCODE_IDS`,
+   * `recordReleasedOpencodeId`). Cleared by `clearRedriveUnresolved` (every
+   * non-`unresolved` `resolveRedrive` outcome fires it, including a fresh
+   * dispatch) and at the top-level fresh-dispatch site, so it does not outlive
+   * the row it was recorded for.
+   */
+  releasedOpencodeIds = /* @__PURE__ */ new Map();
+  /**
+   * Per-conversation throttle state for the #183 recurrence warning (#1618
+   * WI-4) — see `reportWedgedConversation`'s doc comment for why this exists.
+   * `firstWedgedAt` anchors `stuck_for_ms`; `lastWarnedAt` throttles both the
+   * log line and the `dispatch_wedged` signal to at most once per
+   * `wedgeWarningIntervalMs`; `consecutiveTicks` is reported in the log text
+   * so the operator sees magnitude, not repetition. Cleared the moment the
+   * conversation dispatches anything (a fresh wedge, if it recurs, is a new
+   * incident). Bounded FIFO, mirroring `supersededSessions`
+   * (`MAX_WEDGED_CONVERSATIONS`).
+   */
+  wedgeWarnings = /* @__PURE__ */ new Map();
   /**
    * Per-opencode-session dispatch lock (Task 2.1a). `sendPromptAsync` is no
    * longer idempotent (no caller-supplied `messageID`), and its read-back picks
@@ -3706,6 +4373,15 @@ var ChannelDriver = class _ChannelDriver {
    * same trick `lastProxiedActivityAt` uses.
    */
   appliedFileCount = 0;
+  /**
+   * Generation counter, NOT a tally (#1656): advances by exactly one per sync
+   * batch that applied the Claude CLI credential file, not by how many
+   * credential files were in that batch. `run.ts` only ever tests inequality
+   * against the value it saw last cycle, so magnitude is meaningless — keep it
+   * that way rather than "fixing" it into a count.
+   */
+  claudeCredentialApplyCount = 0;
+  opencodeAuthApplyCount = 0;
   /**
    * The currently-executing `drainPending()` promise, or null when idle. Lets a
    * graceful shutdown (`waitForInFlight`) await an in-progress drain so a turn it
@@ -3730,15 +4406,20 @@ var ChannelDriver = class _ChannelDriver {
     this.retry = { ...DEFAULT_RETRY_POLICY, ...config.retry };
     this.log = config.log ?? (() => {
     });
-    this.fetchImpl = config.fetchImpl ?? fetch;
+    this.fetchImpl = withRequestTimeout(
+      config.fetchImpl ?? fetch,
+      config.requestTimeoutMs ?? REQUEST_TIMEOUT_MS
+    );
     this.sleep = config.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.pausedPollIntervalMs = config.pausedPollIntervalMs ?? DEFAULT_PAUSED_POLL_INTERVAL_MS;
     this.pausedMaxWaitMs = config.pausedMaxWaitMs ?? DEFAULT_PAUSED_MAX_WAIT_MS;
     this.stuckQueuedMs = config.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
     this.now = config.now ?? (() => Date.now());
     this.fileSyncDirectories = config.fileSyncDirectories ?? [];
-    this.homeDir = config.homeDir ?? homedir2();
+    this.homeDir = config.homeDir ?? homedir3();
     this.maxActiveSessions = config.maxActiveSessions;
+    this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
+    this.wedgeWarningIntervalMs = config.wedgeWarningIntervalMs ?? WEDGE_WARNING_INTERVAL_MS;
   }
   /** The IPv4-loopback base URL for the local `opencode serve`. */
   get opencodeBase() {
@@ -3752,6 +4433,14 @@ var ChannelDriver = class _ChannelDriver {
    * @returns the number of messages NEWLY dispatched to opencode's native queue.
    */
   async drainPending() {
+    try {
+      this.reconcileWatchers();
+    } catch (err) {
+      this.log({
+        level: "error",
+        message: `Watchdog: reconcileWatchers threw unexpectedly (drain continues): ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
     if (this.stopped) return 0;
     if (this.draining) return 0;
     this.draining = true;
@@ -3785,7 +4474,7 @@ var ChannelDriver = class _ChannelDriver {
     if (this.syncingFiles) return 0;
     this.syncingFiles = true;
     try {
-      const applied = await syncPendingRunnerFiles({
+      const result = await syncPendingRunnerFiles({
         agentId: this.agentId,
         apiUrl: this.apiUrl,
         getAuthHeader: this.getAuthHeader,
@@ -3795,8 +4484,10 @@ var ChannelDriver = class _ChannelDriver {
         ackFailures: this.fileAckFailures,
         log: this.log
       });
-      this.appliedFileCount += applied;
-      return applied;
+      this.appliedFileCount += result.applied;
+      if (result.claudeCredentialApplied) this.claudeCredentialApplyCount += 1;
+      if (result.opencodeAuthApplied) this.opencodeAuthApplyCount += 1;
+      return result.applied;
     } catch (err) {
       this.log({
         level: "error",
@@ -3887,12 +4578,25 @@ var ChannelDriver = class _ChannelDriver {
    * `appliedFiles` is monotonic so a pull that started AND finished between two
    * idle checks still shows up as an advance.
    *
+   * A THIRD signal, `claudeCredentialApplies`, is a separate re-arm trigger
+   * (#1656), not idle accounting: `run.ts` gates re-probing Claude usage
+   * reporting on it advancing, so an unrelated file sync can never disturb a
+   * healthy reporting cadence (#1627) — it never even reaches that trigger, let
+   * alone gets declined by it. Keep this narrower signal OUT of `appliedFiles`,
+   * whose consumer is idle-timeout suppression and must key on ANY file, not
+   * just a Claude credential.
+   *
    * CALLER CONTRACT: sample `inFlight` BEFORE calling `syncPendingFiles()` for
    * the cycle. `syncPendingFiles` sets the flag synchronously, so a caller that
    * samples afterwards reads `true` every single cycle and can never idle out.
    */
   fileSyncActivity() {
-    return { appliedFiles: this.appliedFileCount, inFlight: this.syncingFiles };
+    return {
+      appliedFiles: this.appliedFileCount,
+      inFlight: this.syncingFiles,
+      claudeCredentialApplies: this.claudeCredentialApplyCount,
+      opencodeAuthApplyCount: this.opencodeAuthApplyCount
+    };
   }
   /**
    * OpenCode session ids the session-cleanup sweep (issue #190) must NOT delete:
@@ -4005,8 +4709,15 @@ var ChannelDriver = class _ChannelDriver {
         skippedAlreadyDispatched += 1;
         continue;
       }
-      if (message.opencode_message_id) {
-        const outcome = await this.resolveRedrive(conv, sessionId, message, sessionCreated);
+      const effectiveOpencodeMessageId = message.opencode_message_id ?? this.releasedOpencodeIds.get(message.id)?.opencodeMessageId ?? null;
+      if (effectiveOpencodeMessageId) {
+        const outcome = await this.resolveRedrive(
+          conv,
+          sessionId,
+          message,
+          sessionCreated,
+          effectiveOpencodeMessageId
+        );
         if (outcome === "abandoned") {
           continue;
         }
@@ -4117,21 +4828,102 @@ var ChannelDriver = class _ChannelDriver {
       }
       this.unconfirmedDispatchFailures.delete(message.id);
       this.dispatchNotStartedSignalled.delete(message.id);
+      this.releasedOpencodeIds.delete(message.id);
       this.dispatched.add(message.id);
       this.registerInFlight(conv, sessionId, message, opencodeMessageId);
       dispatched += 1;
       void this.postSignal(conv.id, message.id, "dispatched");
     }
     if (messages.length > 0 && dispatched === 0 && skippedAlreadyDispatched === messages.length) {
-      this.log({
-        level: "warn",
-        message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode this tick. If this repeats, a message may be stuck acknowledged-but-never-dispatched (its watcher never settled).`,
-        conversation_id: conv.id
-      });
+      this.reportWedgedConversation(conv, messages);
+    } else if (dispatched > 0) {
+      this.wedgeWarnings.delete(conv.id);
     }
     this.ensureWatcherRunning(sessionId);
     return dispatched;
   }
+  /**
+   * The #183 "eyes but nothing sent" recurrence for `conv`, throttled and
+   * escalated (#1618 WI-4). `messages` is the conversation's full pending list
+   * on THIS tick — the caller has already confirmed every one of them is a
+   * skip-because-already-`dispatched`, the exact signature of a message stuck
+   * acknowledged-but-never-worked.
+   *
+   * Unthrottled, this fired every ~6s drain tick for as long as a wedge lasted
+   * (52,843 occurrences observed in one incident) — burning the GLOBAL
+   * 30-events/60s `runner-activity-telemetry.ts` budget that was itself
+   * suppressing the diagnostics needed to debug the wedge. The `warn` log (and
+   * the `dispatch_wedged` signal once the wedge has persisted past the same
+   * interval) fire at most once per `wedgeWarningIntervalMs` per conversation,
+   * naming the consecutive-tick count so the operator sees magnitude rather
+   * than repetition.
+   *
+   * Deliberately does NOT trigger a release: WI-1's `reconcileWatchers` runs
+   * unconditionally on this same tick and is already recovering anything it
+   * can see. This is reporting only — see `countUntrackedIds`'s doc for the
+   * one case it recovers nothing FOR (§3/D5 of the drain-wedge plan).
+   */
+  reportWedgedConversation(conv, messages) {
+    const now = this.now();
+    const existing = this.wedgeWarnings.get(conv.id);
+    const firstWedgedAt = existing?.firstWedgedAt ?? now;
+    const consecutiveTicks = (existing?.consecutiveTicks ?? 0) + 1;
+    const dueForWarn = !existing || now - existing.lastWarnedAt >= this.wedgeWarningIntervalMs;
+    if (!dueForWarn) {
+      this.wedgeWarnings.delete(conv.id);
+      this.wedgeWarnings.set(conv.id, {
+        firstWedgedAt,
+        lastWarnedAt: existing.lastWarnedAt,
+        consecutiveTicks
+      });
+      return;
+    }
+    const stuckForMs = now - firstWedgedAt;
+    const untracked = this.countUntrackedIds(messages);
+    this.log({
+      level: "warn",
+      message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode for ${consecutiveTicks} consecutive tick(s) now (${stuckForMs}ms stuck). ` + (untracked > 0 ? `${untracked} of these id(s) are tracked by NO watcher \u2014 the dispatched/in-flight pairing invariant is violated for this conversation, which will NOT self-heal and needs a runner restart.` : `A watcher is tracking this work; the loop-liveness watchdog is already recovering it.`),
+      conversation_id: conv.id
+    });
+    this.wedgeWarnings.delete(conv.id);
+    this.wedgeWarnings.set(conv.id, { firstWedgedAt, lastWarnedAt: now, consecutiveTicks });
+    while (this.wedgeWarnings.size > MAX_WEDGED_CONVERSATIONS) {
+      const oldest = this.wedgeWarnings.keys().next().value;
+      if (oldest === void 0) break;
+      this.wedgeWarnings.delete(oldest);
+    }
+    if (stuckForMs >= this.wedgeWarningIntervalMs) {
+      void this.postSignal(conv.id, messages[0].id, "dispatch_wedged", {
+        stuck_for_ms: stuckForMs,
+        untracked
+      });
+    }
+  }
+  /**
+   * How many of `messages`' ids are tracked by NO watcher's `inFlight` (#1618
+   * WI-4) — the §3/D5 orphan discriminator. `reconcileWatchers` proves the
+   * `dispatched`/`inFlight` pairing invariant holds by construction across
+   * every `dispatched.add` site (see its own doc comment), so `> 0` here means
+   * that invariant has actually been violated for this conversation: there is
+   * no watcher for WI-1's watchdog to restart, so it will NOT self-heal.
+   * `=== 0` means an ordinary stalled/exited watcher, which WI-1 is already
+   * recovering. One pass over `this.watchers`, called only when the throttled
+   * warning above is due to fire — not every tick.
+   */
+  countUntrackedIds(messages) {
+    let untracked = 0;
+    for (const message of messages) {
+      let tracked = false;
+      for (const watcher of this.watchers.values()) {
+        if (watcher.inFlight.has(message.id)) {
+          tracked = true;
+          break;
+        }
+      }
+      if (!tracked) untracked += 1;
+    }
+    return untracked;
+  }
   /**
    * Poll a session's message list for the re-drive fence (#965), via the
    * INJECTED `fetchImpl` — NOT the imported `getSessionMessages` helper, which
@@ -4200,9 +4992,16 @@ var ChannelDriver = class _ChannelDriver {
    * for, `resolveRedriveUnresolved`'s own `pausedMaxWaitMs` bound below. Every
    * other failure resolves to `unresolved` and is retried whole on the next
    * ~2s drain tick.
+   *
+   * `effectiveOpencodeMessageId` (#1618) is the caller-resolved id: the real
+   * server `opencode_message_id` when present, else the stall watchdog's local
+   * `releasedOpencodeIds` fence. Read it here rather than re-deriving it from
+   * `message` so every line below — and the signals this method posts —
+   * keeps reporting the REAL server row; a shadow-copied `message` would
+   * silently diverge from it.
    */
-  async resolveRedrive(conv, sessionId, message, sessionCreated) {
-    const ocId = message.opencode_message_id ?? null;
+  async resolveRedrive(conv, sessionId, message, sessionCreated, effectiveOpencodeMessageId) {
+    const ocId = effectiveOpencodeMessageId;
     if (sessionCreated) {
       this.clearRedriveUnresolved(message.id);
       void this.postSignal(conv.id, message.id, "redrive_redispatched");
@@ -4432,7 +5231,13 @@ var ChannelDriver = class _ChannelDriver {
     }
     return "unresolved";
   }
-  /** Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved` outcome). */
+  /**
+   * Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved`
+   * outcome) — including the stall watchdog's local re-drive fence (#1618): once
+   * `resolveRedrive` has resolved to dispatch/reattach/settle, the row either has
+   * a real server-side `opencode_message_id` again or is no longer pending, so
+   * the fence entry is no longer needed.
+   */
   clearRedriveUnresolved(messageId) {
     this.redriveUnresolvedSince.delete(messageId);
     this.redriveUnresolvedSignalled.delete(messageId);
@@ -4440,6 +5245,7 @@ var ChannelDriver = class _ChannelDriver {
     this.redriveOutcomeUnreportedSignalled.delete(messageId);
     this.redriveOutcomeFailingSince.delete(messageId);
     this.redriveOutcomeAbandonedSignalled.delete(messageId);
+    this.releasedOpencodeIds.delete(messageId);
   }
   /**
    * #1340: the dispatch loop reached a message and did NOT start a turn. Fires at
@@ -4594,6 +5400,21 @@ var ChannelDriver = class _ChannelDriver {
       this.supersededSessions.delete(oldest);
     }
   }
+  /**
+   * Record the local re-drive fence for a message force-released without
+   * completing (#1618) — see the `releasedOpencodeIds` field doc. Call BEFORE
+   * `removeInFlight`, which is about to drop the `InFlightMessage` this reads
+   * `opencodeMessageId` from. Hard-capped FIFO, same shape as `supersede`.
+   */
+  recordReleasedOpencodeId(evidentMessageId, sessionId, opencodeMessageId) {
+    this.releasedOpencodeIds.delete(evidentMessageId);
+    this.releasedOpencodeIds.set(evidentMessageId, { sessionId, opencodeMessageId });
+    while (this.releasedOpencodeIds.size > MAX_RELEASED_OPENCODE_IDS) {
+      const oldest = this.releasedOpencodeIds.keys().next().value;
+      if (oldest === void 0) return;
+      this.releasedOpencodeIds.delete(oldest);
+    }
+  }
   /** Whether `sessionId` is the session this conversation has abandoned (#553). */
   isSuperseded(conversationId, sessionId) {
     return this.supersededSessions.get(conversationId) === sessionId;
@@ -4635,6 +5456,17 @@ var ChannelDriver = class _ChannelDriver {
           message: `OpenCode session ${bound} for conversation ${conv.id.slice(0, 8)} no longer exists (deleted or DB reset) \u2014 creating a fresh session and rebinding.`,
           conversation_id: conv.id
         });
+        const watcher = this.watchers.get(bound);
+        if (watcher) {
+          for (const [evidentMessageId, inFlight] of [...watcher.inFlight]) {
+            this.recordReleasedOpencodeId(evidentMessageId, bound, inFlight.opencodeMessageId);
+            this.removeInFlight(watcher, evidentMessageId);
+            void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+              recovery: "session_gone_released"
+            });
+          }
+          this.watchers.delete(bound);
+        }
         this.sessions.delete(conv.id);
         return { sessionId: await this.createAndBindSession(conv.id), created: true };
       }
@@ -4825,15 +5657,7 @@ var ChannelDriver = class _ChannelDriver {
   registerInFlight(conv, sessionId, message, opencodeMessageId) {
     let watcher = this.watchers.get(sessionId);
     if (!watcher) {
-      watcher = {
-        conv,
-        inFlight: /* @__PURE__ */ new Map(),
-        loop: null,
-        reportedQuestions: /* @__PURE__ */ new Set(),
-        reportedPermissions: /* @__PURE__ */ new Set(),
-        lastGoodPollAt: this.now(),
-        hadUsablePoll: false
-      };
+      watcher = this.newSessionWatcher(conv);
       this.watchers.set(sessionId, watcher);
     }
     const now = this.now();
@@ -4864,6 +5688,27 @@ var ChannelDriver = class _ChannelDriver {
       ambiguousResolved: false
     });
   }
+  /**
+   * Build a fresh `SessionWatcher`. Seeds `lastTickAt`/`lastObservedTickAt`
+   * EQUAL (#1618) so a watcher whose loop has not started ticking yet is never
+   * misread as stalled by the very first reconciliation that sees it.
+   */
+  newSessionWatcher(conv) {
+    const now = this.now();
+    return {
+      conv,
+      inFlight: /* @__PURE__ */ new Map(),
+      loop: null,
+      reportedQuestions: /* @__PURE__ */ new Set(),
+      reportedPermissions: /* @__PURE__ */ new Set(),
+      lastGoodPollAt: now,
+      hadUsablePoll: false,
+      generation: 0,
+      lastTickAt: now,
+      lastObservedTickAt: now,
+      consecutiveStallRestarts: 0
+    };
+  }
   /**
    * Register a RE-ADOPTED `processing` message with its session watcher
    * (ADR-0046, WI-4). Mirrors `registerInFlight` but anchors the give-up
@@ -4893,15 +5738,7 @@ var ChannelDriver = class _ChannelDriver {
   registerReadopted(conv, sessionId, message, opencodeMessageId, processedAtMs) {
     let watcher = this.watchers.get(sessionId);
     if (!watcher) {
-      watcher = {
-        conv,
-        inFlight: /* @__PURE__ */ new Map(),
-        loop: null,
-        reportedQuestions: /* @__PURE__ */ new Set(),
-        reportedPermissions: /* @__PURE__ */ new Set(),
-        lastGoodPollAt: this.now(),
-        hadUsablePoll: false
-      };
+      watcher = this.newSessionWatcher(conv);
       this.watchers.set(sessionId, watcher);
     }
     watcher.inFlight.set(message.id, {
@@ -4945,12 +5782,110 @@ var ChannelDriver = class _ChannelDriver {
       ambiguousResolved: false
     });
   }
+  /**
+   * Loop-liveness watchdog (#1618). Runs once per `drainPending()` tick and
+   * restarts any per-session watcher whose loop has exited or stopped ticking
+   * — escalating to a bounded force-release only once
+   * `MAX_WATCHER_STALL_RESTARTS` consecutive restarts have failed to recover
+   * it. Fully synchronous: it only inspects in-memory state and calls the
+   * synchronous `ensureWatcherRunning`/`removeInFlight`, which is what lets it
+   * run from the very top of `drainPending()` — ahead of the un-timed
+   * `getPendingConversations()` await that would otherwise be able to disable
+   * it (`run.ts`'s poll loop is sequential, so a hung fetch there stops
+   * `drainPending()` from being CALLED again at all, not just from finishing).
+   *
+   * Restarts the loop rather than releasing messages directly: a blind release
+   * would let the next drain re-`prompt_async` a turn that may still be
+   * running (ADR-0047; see `releasedOpencodeIds`'s doc). A restarted loop
+   * re-polls with each message's `opencodeMessageId` still in hand and lets
+   * the existing, audited `!activelyRunning` give-up decide, same as it always
+   * has.
+   *
+   * Deliberately does NOT sweep `this.dispatched` for an id no watcher tracks:
+   * that shape has no in-flight entry and therefore no `opencodeMessageId` to
+   * fence a release with, so releasing it here would blind-re-POST a possibly-
+   * running turn — and there is no conversation id in hand to signal with
+   * either. Detection for that shape lives on WI-4's `dispatch_wedged` signal
+   * instead, where a conversation id already exists. If you find yourself
+   * wanting to add a `dispatched` sweep here, don't — read the drain-wedge
+   * plan's §3/D5 first.
+   */
+  reconcileWatchers() {
+    const now = this.now();
+    for (const [sessionId, watcher] of [...this.watchers]) {
+      if (watcher.lastTickAt !== watcher.lastObservedTickAt) {
+        watcher.consecutiveStallRestarts = 0;
+      }
+      watcher.lastObservedTickAt = watcher.lastTickAt;
+      if (watcher.inFlight.size === 0 && watcher.loop === null) {
+        this.watchers.delete(sessionId);
+        continue;
+      }
+      if (watcher.loop === null && watcher.inFlight.size > 0) {
+        if (now - watcher.lastTickAt < this.watcherStallMs) continue;
+        this.log({
+          level: "warn",
+          message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop had exited with ${watcher.inFlight.size} message(s) still in flight (idle ${now - watcher.lastTickAt}ms) \u2014 restarting`,
+          conversation_id: watcher.conv.id
+        });
+        this.ensureWatcherRunning(sessionId);
+        for (const evidentMessageId of watcher.inFlight.keys()) {
+          void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+            recovery: "loop_exited"
+          });
+        }
+        continue;
+      }
+      if (watcher.loop !== null && now - watcher.lastTickAt >= this.watcherStallMs) {
+        const stalledForMs = now - watcher.lastTickAt;
+        watcher.consecutiveStallRestarts += 1;
+        if (watcher.consecutiveStallRestarts > MAX_WATCHER_STALL_RESTARTS) {
+          this.log({
+            level: "error",
+            message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop stalled through ${watcher.consecutiveStallRestarts} restarts (last stall ${stalledForMs}ms) \u2014 releasing its ${watcher.inFlight.size} in-flight message(s)`,
+            conversation_id: watcher.conv.id
+          });
+          for (const [evidentMessageId, inFlight] of [...watcher.inFlight]) {
+            this.recordReleasedOpencodeId(evidentMessageId, sessionId, inFlight.opencodeMessageId);
+            this.removeInFlight(watcher, evidentMessageId);
+            void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+              recovery: "unrecoverable_released"
+            });
+          }
+          watcher.generation += 1;
+          this.watchers.delete(sessionId);
+          continue;
+        }
+        watcher.generation += 1;
+        watcher.loop = null;
+        watcher.lastGoodPollAt = now;
+        watcher.lastTickAt = now;
+        watcher.lastObservedTickAt = watcher.lastTickAt;
+        this.ensureWatcherRunning(sessionId);
+        this.log({
+          level: "warn",
+          message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop had not ticked in ${stalledForMs}ms \u2014 restarted under generation ${watcher.generation} (${watcher.consecutiveStallRestarts}/${MAX_WATCHER_STALL_RESTARTS})`,
+          conversation_id: watcher.conv.id
+        });
+        for (const evidentMessageId of watcher.inFlight.keys()) {
+          void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+            recovery: "loop_stalled"
+          });
+        }
+      }
+    }
+  }
   /**
    * Start (but do NOT await) the per-session watcher loop if it has in-flight
    * work and is not already running. Single-flight per session. The loop is
    * tracked on the watcher and cleared when it settles; it never rejects (fully
    * guarded), so a failed poll/callback can never crash the run loop — the cron
    * stays as the safety net.
+   *
+   * The generation started here (#1618) is captured in the `.finally` closure
+   * so a RETIRED loop settling late — after `reconcileWatchers` has already
+   * restarted this watcher under a newer generation — can neither null the new
+   * loop's handle nor delete a watcher that still has live work.
    */
   ensureWatcherRunning(sessionId) {
     const watcher = this.watchers.get(sessionId);
@@ -4960,7 +5895,9 @@ var ChannelDriver = class _ChannelDriver {
       this.watchers.delete(sessionId);
       return;
     }
-    const loop = this.runWatcherLoop(sessionId, watcher).finally(() => {
+    const generation = watcher.generation;
+    const loop = this.runWatcherLoop(sessionId, watcher, generation).finally(() => {
+      if (watcher.generation !== generation) return;
       watcher.loop = null;
       if (watcher.inFlight.size === 0) {
         this.watchers.delete(sessionId);
@@ -4980,11 +5917,25 @@ var ChannelDriver = class _ChannelDriver {
    *      `source_message_id`;
    *   4. drops messages that completed or timed out from the in-flight set.
    * Exits when the in-flight set empties. Never throws.
+   *
+   * `generation` (#1618) is the incarnation this call was started under.
+   * `reconcileWatchers` can restart a stalled loop by bumping
+   * `watcher.generation` and starting a NEW `runWatcherLoop` over the same
+   * `SessionWatcher` object — the stalled promise itself cannot be cancelled,
+   * so this loop instead checks at the top of every iteration, right after
+   * waking from `sleep`, and right before servicing any message, and quietly
+   * retires (returns without touching anything) the moment it is no longer the
+   * watcher's current generation. Retiring mid-tick can still let ONE
+   * `serviceInFlightMessage` pass complete first — acceptable, since that
+   * method contains no non-idempotent action.
    */
-  async runWatcherLoop(sessionId, watcher) {
+  async runWatcherLoop(sessionId, watcher, generation) {
     try {
       while (watcher.inFlight.size > 0) {
+        if (watcher.generation !== generation) return;
+        watcher.lastTickAt = this.now();
         await this.sleep(this.pausedPollIntervalMs);
+        if (watcher.generation !== generation) return;
         let messages = null;
         try {
           const res = await this.fetchImpl(`${this.opencodeBase}/session/${sessionId}/message`);
@@ -5005,6 +5956,7 @@ var ChannelDriver = class _ChannelDriver {
           }
         }
         const { openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk } = await this.pollInteractions(sessionId, watcher, messages);
+        if (watcher.generation !== generation) return;
         for (const inFlight of [...watcher.inFlight.values()]) {
           await this.serviceInFlightMessage(
             sessionId,
@@ -6980,7 +7932,7 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join4(homeDir, trimmed.slice(2)) : trimmed;
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join7(homeDir, trimmed.slice(2)) : trimmed;
     if (!isAbsolute2(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
@@ -7078,7 +8030,7 @@ function logActivity(state, entry) {
   const level = entry.level ?? (entry.type === "error" ? "error" : "info");
   if (!meetsThreshold(state, level)) return;
   forwardRunnerActivity(
-    { level, message: entry.message, error: entry.error },
+    { level, message: entry.message, error: entry.error, metadata: entry.metadata },
     { agentId: state.agentId, authHeader: state.authHeader }
   );
   const fullEntry = {
@@ -7098,6 +8050,26 @@ function logActivity(state, entry) {
     }
   }
 }
+function reportSessionDbRecovery(state) {
+  try {
+    const report = drainSessionDbRecoveryReport({ homeDir: homedir4(), env: process.env });
+    for (const record of report.records) {
+      const activity = buildSessionDbRecoveryActivity(record);
+      if (!activity) throw new Error("could not map session-DB recovery record");
+      logActivity(state, {
+        type: activity.level === "error" ? "error" : "info",
+        level: activity.level,
+        ...activity.level === "error" ? { error: activity.message } : { message: activity.message },
+        metadata: activity.metadata
+      });
+    }
+    acknowledgeSessionDbRecoveryReport(report.path);
+  } catch (error2) {
+    console.error(
+      `[run] could not report session-DB recovery activity: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+  }
+}
 function displayStatus(state) {
   if (!state.interactive) return;
   const attempt = state.connection?.reconnectAttempt ?? 0;
@@ -7187,6 +8159,8 @@ async function driveChannels(state, driver) {
   let unreachableMs = 0;
   let lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
+  let lastSeenClaudeApplies = driver.fileSyncActivity().claudeCredentialApplies;
+  let lastSeenOpencodeAuthApplies = driver.fileSyncActivity().opencodeAuthApplyCount;
   while (state.running) {
     const cycleStartedAtMs = performance.now();
     let idleThisCycle = false;
@@ -7210,11 +8184,19 @@ async function driveChannels(state, driver) {
       state.messageCount += processed;
       const proxiedActivity = state.lastProxiedActivityAt !== lastSeenProxiedActivityAt;
       lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
-      const appliedFiles = driver.fileSyncActivity().appliedFiles;
+      const fileActivitySnapshot = driver.fileSyncActivity();
+      const appliedFiles = fileActivitySnapshot.appliedFiles;
       const filesApplied = appliedFiles !== lastSeenAppliedFiles;
       const fileActivity = carriedOverFileSync || filesApplied;
       lastSeenAppliedFiles = appliedFiles;
-      if (filesApplied) state.claudeUsageRearm?.();
+      const claudeCredentialApplies = fileActivitySnapshot.claudeCredentialApplies;
+      const claudeCredentialApplied = claudeCredentialApplies !== lastSeenClaudeApplies;
+      lastSeenClaudeApplies = claudeCredentialApplies;
+      if (claudeCredentialApplied) state.claudeUsageRearm?.();
+      const opencodeAuthApplies = fileActivitySnapshot.opencodeAuthApplyCount;
+      const opencodeAuthApplied = opencodeAuthApplies !== lastSeenOpencodeAuthApplies;
+      lastSeenOpencodeAuthApplies = opencodeAuthApplies;
+      if (opencodeAuthApplied) state.openaiUsageRearm?.();
       if (processed > 0 || driver.hasInFlightWatchers() || proxiedActivity || fileActivity) {
         idlePolls = 0;
         idleMs = 0;
@@ -7283,7 +8265,7 @@ async function driveChannels(state, driver) {
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
 var SESSION_DB_RECLAIM_MAX_PAGES = 2e3;
 function sessionDbPath() {
-  return join4(homedir3(), ".local", "share", "opencode", "opencode.db");
+  return join7(homedir4(), ".local", "share", "opencode", "opencode.db");
 }
 async function runSweep(state, driver, config) {
   const mode = `age=${config.maxAgeMs ?? "\u2014"} count=${config.maxCount ?? "\u2014"}`;
@@ -7366,7 +8348,7 @@ function scheduleSessionCleanup(state, driver, options) {
   for (const warning2 of config.warnings) {
     logActivity(state, { type: "info", level: "warn", message: `Session cleanup: ${warning2}` });
   }
-  const dbBytes = statSessionDbBytes(homedir3());
+  const dbBytes = statSessionDbBytes(homedir4());
   void (async () => {
     const reclaimSkipReason = dbBytes !== null && config.enabled ? await probeReclaimAvailability({ dbPath: sessionDbPath(), requiredBytes: dbBytes }) : null;
     const sizeWarning = buildSessionStoreSizeWarning({
@@ -7394,95 +8376,110 @@ function scheduleSessionCleanup(state, driver, options) {
   );
   state.sessionCleanupTimers.push(interval, firstSweep);
 }
-function claudeUsageFailureStreakSuffix(consecutiveFailures) {
-  return consecutiveFailures > 1 ? ` (${consecutiveFailures} consecutive failures)` : "";
-}
-function scheduleClaudeUsageReporting(state, options) {
-  const { mode, warnings } = resolveClaudeUsageReportingMode(
-    options.claudeUsageReporting,
-    process.env
-  );
+function scheduleUsageReporting(state, params) {
+  const { mode, warnings } = params.resolved;
   for (const warning2 of warnings) {
     logActivity(state, {
       type: "info",
       level: "warn",
-      message: `Claude usage reporting: ${warning2}`
+      message: `${params.label} usage reporting: ${warning2}`
     });
   }
   if (mode === "off") {
     logActivity(state, {
       type: "info",
       level: "debug",
-      message: "Claude usage reporting is off (--claude-usage-reporting off)"
+      message: `${params.label} usage reporting is off (${params.offFlagHint})`
     });
     return null;
   }
   let consecutiveFailures = 0;
-  let armed = false;
+  let phase = "dormant";
   let rearmRequested = false;
+  const armProbe = () => {
+    phase = "probe-pending";
+    params.setTimer(setTimeout(() => void tick(true), params.firstDelayMs()));
+  };
   const scheduleNextTick = () => {
-    armed = true;
-    rearmRequested = false;
-    state.claudeUsageTimer = setTimeout(() => void tick(false), nextReportDelayMs());
+    if (rearmRequested) {
+      rearmRequested = false;
+      armProbe();
+      return;
+    }
+    phase = "steady-pending";
+    params.setTimer(setTimeout(() => void tick(false), params.nextDelayMs()));
   };
   const rearm = () => {
-    if (armed) {
-      rearmRequested = true;
-      return;
+    switch (phase) {
+      case "tick-in-flight":
+        rearmRequested = true;
+        return;
+      case "probe-pending":
+        return;
+      case "steady-pending":
+        if (params.getTimer()) {
+          clearTimeout(params.getTimer());
+          params.setTimer(null);
+        }
+        rearmRequested = false;
+        armProbe();
+        return;
+      case "dormant":
+        rearmRequested = false;
+        armProbe();
+        return;
     }
-    rearmRequested = false;
-    armed = true;
-    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
   };
   const tick = async (isProbe) => {
+    phase = "tick-in-flight";
     try {
-      const usage = await getClaudeUsage();
-      const result = await reportClaudeUsage(state.agentId, state.authHeader, usage);
+      const usage = await params.fetchUsage();
+      const result = await params.report(usage);
       if (result.ok) {
         if (consecutiveFailures > 0) {
           logActivity(state, {
             type: "info",
             level: "info",
-            message: "Claude usage reporting recovered"
+            message: `${params.label} usage reporting recovered`
           });
         }
         consecutiveFailures = 0;
         logActivity(state, {
           type: "info",
           level: "debug",
-          message: "Reported Claude usage to Evident"
+          message: `Reported ${params.label} usage to Evident`
         });
       } else {
         consecutiveFailures++;
         logActivity(state, {
           type: "info",
-          level: claudeUsageFailureLogLevel(consecutiveFailures),
-          message: `Failed to report Claude usage: ${result.error}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
+          level: params.failureLogLevel(consecutiveFailures),
+          message: `Failed to report ${params.label} usage: ${result.error}${failureStreakSuffix(consecutiveFailures)}`
         });
       }
       scheduleNextTick();
     } catch (error2) {
-      if (error2 instanceof ClaudeUsageError && isLocalCredentialProblem(error2)) {
+      if (params.isLocalCredentialProblem(error2)) {
         if (mode === "on") {
           logActivity(state, {
             type: "info",
             level: "warn",
-            message: "Claude usage reporting is forced on but no usable Claude Code login was found \u2014 run `claude` to sign in; reporting will keep retrying"
+            message: `${params.label} usage reporting is forced on but no usable login was found \u2014 ${params.forcedOnHint}; reporting will keep retrying`
           });
           scheduleNextTick();
         } else if (isProbe) {
           logActivity(state, {
             type: "info",
             level: "debug",
-            message: `Claude usage reporting: ${error2.message}`
+            message: `${params.label} usage reporting: ${error2 instanceof Error ? error2.message : String(error2)}`
           });
-          armed = false;
+          phase = "dormant";
           if (rearmRequested) rearm();
         } else {
           logActivity(state, {
             type: "info",
             level: "debug",
-            message: `Claude usage reporting: ${error2.message}`
+            message: `${params.label} usage reporting: ${error2 instanceof Error ? error2.message : String(error2)}`
           });
           scheduleNextTick();
         }
@@ -7491,17 +8488,118 @@ function scheduleClaudeUsageReporting(state, options) {
         const message = error2 instanceof Error ? error2.message : String(error2);
         logActivity(state, {
           type: "info",
-          level: claudeUsageFailureLogLevel(consecutiveFailures),
-          message: `Claude usage reporting failed: ${message}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
+          level: params.failureLogLevel(consecutiveFailures),
+          message: `${params.label} usage reporting failed: ${message}${failureStreakSuffix(consecutiveFailures)}`
         });
         scheduleNextTick();
       }
     }
   };
-  armed = true;
-  state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  armProbe();
   return rearm;
 }
+function scheduleClaudeUsageReporting(state, options) {
+  return scheduleUsageReporting(state, {
+    label: "Claude",
+    resolved: resolveClaudeUsageReportingMode(options.claudeUsageReporting, process.env),
+    offFlagHint: "--claude-usage-reporting off",
+    getTimer: () => state.claudeUsageTimer,
+    setTimer: (timer) => {
+      state.claudeUsageTimer = timer;
+    },
+    fetchUsage: getClaudeUsage,
+    report: (usage) => reportClaudeUsage(state.agentId, state.authHeader, usage),
+    isLocalCredentialProblem,
+    forcedOnHint: "run `claude` to sign in",
+    firstDelayMs: () => FIRST_REPORT_DELAY_MS,
+    nextDelayMs: nextReportDelayMs,
+    failureLogLevel: claudeUsageFailureLogLevel
+  });
+}
+var RESOURCE_USAGE_BASE_REPORT_DELAY_MS = 10 * 6e4;
+var RESOURCE_USAGE_REPORT_DELAY_JITTER_FRACTION = 0.2;
+var RESOURCE_USAGE_FAILURE_REESCALATION_TICKS = 6;
+function scheduleResourceUsageReporting(state, options) {
+  const { enabled, warnings } = resolveResourceUsageReportingEnabled(
+    options.resourceUsageReporting,
+    process.env
+  );
+  for (const warning2 of warnings) {
+    logActivity(state, {
+      type: "info",
+      level: "warn",
+      message: `Resource usage reporting: ${warning2}`
+    });
+  }
+  if (!enabled) {
+    logActivity(state, {
+      type: "info",
+      level: "debug",
+      message: "Resource usage reporting is off (--no-resource-usage-reporting)"
+    });
+    return;
+  }
+  const collect = createResourceUsageCollector(homedir4());
+  let consecutiveFailures = 0;
+  const tick = async () => {
+    try {
+      const { usage, warnings: collectWarnings } = await collect();
+      for (const warning2 of collectWarnings) {
+        logActivity(state, {
+          type: "info",
+          level: "debug",
+          message: `Resource usage collection: ${warning2}`
+        });
+      }
+      const result = await reportResourceUsage(state.agentId, state.authHeader, usage);
+      if (result.ok) {
+        if (consecutiveFailures > 0) {
+          logActivity(state, {
+            type: "info",
+            level: "info",
+            message: "Resource usage reporting recovered"
+          });
+        }
+        consecutiveFailures = 0;
+        logActivity(state, {
+          type: "info",
+          level: "debug",
+          message: "Reported resource usage to Evident"
+        });
+      } else {
+        consecutiveFailures++;
+        logActivity(state, {
+          type: "info",
+          level: reportFailureLogLevel(
+            consecutiveFailures,
+            RESOURCE_USAGE_FAILURE_REESCALATION_TICKS
+          ),
+          message: `Failed to report resource usage: ${result.error}${failureStreakSuffix(consecutiveFailures)}`
+        });
+      }
+    } catch (error2) {
+      consecutiveFailures++;
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      logActivity(state, {
+        type: "info",
+        level: reportFailureLogLevel(
+          consecutiveFailures,
+          RESOURCE_USAGE_FAILURE_REESCALATION_TICKS
+        ),
+        message: `Resource usage reporting failed: ${message}${failureStreakSuffix(consecutiveFailures)}`
+      });
+    } finally {
+      state.resourceUsageTimer = setTimeout(
+        () => void tick(),
+        jitteredDelayMs(
+          RESOURCE_USAGE_BASE_REPORT_DELAY_MS,
+          RESOURCE_USAGE_REPORT_DELAY_JITTER_FRACTION
+        )
+      );
+    }
+  };
+  state.resourceUsageTimer = setTimeout(() => void tick(), firstReportDelayMs());
+}
 async function notifyOffline(state) {
   if (!state.agentId || !state.authHeader) return;
   if (!state.connected) {
@@ -7542,6 +8640,15 @@ async function cleanup(state, opts = {}) {
     state.claudeUsageTimer = null;
   }
   state.claudeUsageRearm = null;
+  if (state.openaiUsageTimer) {
+    clearTimeout(state.openaiUsageTimer);
+    state.openaiUsageTimer = null;
+  }
+  state.openaiUsageRearm = null;
+  if (state.resourceUsageTimer) {
+    clearTimeout(state.resourceUsageTimer);
+    state.resourceUsageTimer = null;
+  }
   if (opts.graceful && state.channelDriver) {
     state.channelDriver.stop();
     log2(state, "Draining in-flight channel work before shutdown...");
@@ -7589,7 +8696,7 @@ async function run(options) {
   let fileSyncDirectories;
   try {
     logLevel = resolveLogLevel(options);
-    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir3());
+    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir4());
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     if (options.json) {
@@ -7624,6 +8731,9 @@ async function run(options) {
     sessionCleanupTimers: [],
     claudeUsageTimer: null,
     claudeUsageRearm: null,
+    openaiUsageTimer: null,
+    openaiUsageRearm: null,
+    resourceUsageTimer: null,
     authHeader: ""
   };
   setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
@@ -7818,6 +8928,7 @@ async function run(options) {
     } else {
       log2(state, "Not running in a MicroVM (MICROVM_ID unset) \u2014 nothing to report", "debug");
     }
+    reportSessionDbRecovery(state);
     const { timeoutMs: opencodeStartTimeoutMs, warnings: opencodeStartTimeoutWarnings } = resolveOpenCodeStartTimeoutMs(options, process.env);
     for (const warning2 of opencodeStartTimeoutWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
@@ -7885,7 +8996,7 @@ async function run(options) {
       // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
       // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
-      homeDir: homedir3(),
+      homeDir: homedir4(),
       maxActiveSessions,
       log: (entry) => (
         // Thread the driver's real level straight through so `debug`/`warn`
@@ -8023,6 +9134,23 @@ async function run(options) {
     }
     scheduleSessionCleanup(state, channelDriver, options);
     state.claudeUsageRearm = scheduleClaudeUsageReporting(state, options);
+    state.openaiUsageRearm = scheduleUsageReporting(state, {
+      label: "OpenAI",
+      resolved: resolveOpenAiUsageReportingMode(options.openaiUsageReporting, process.env),
+      offFlagHint: "--openai-usage-reporting off",
+      getTimer: () => state.openaiUsageTimer,
+      setTimer: (timer) => {
+        state.openaiUsageTimer = timer;
+      },
+      fetchUsage: () => getOpenAiUsage(state.port),
+      report: (usage) => reportOpenAiUsage(state.agentId, state.authHeader, usage),
+      isLocalCredentialProblem: isLocalCredentialProblem2,
+      forcedOnHint: "connect a ChatGPT account to this runner, or run `opencode auth login`",
+      firstDelayMs: firstReportDelayMs,
+      nextDelayMs: usageReportDelayMs,
+      failureLogLevel: usageReportFailureLogLevel
+    });
+    scheduleResourceUsageReporting(state, options);
     if (!interactive || state.json) {
       log2(state, "Driving channel messages...");
     }
@@ -8103,6 +9231,12 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--claude-usage-reporting <mode>",
   "Report Claude subscription usage to Evident: auto | on | off (default: auto). Env: EVIDENT_CLAUDE_USAGE_REPORTING"
+).option(
+  "--openai-usage-reporting <mode>",
+  "Report OpenAI plan usage to Evident: auto | on | off (default: auto). Env: EVIDENT_OPENAI_USAGE_REPORTING"
+).option(
+  "--no-resource-usage-reporting",
+  "Don't report this machine's CPU and memory usage to Evident (reporting is on by default). Env: EVIDENT_RESOURCE_USAGE_REPORTING=off"
 ).option(
   "--enable-file-sync-to <dir>",
   "Allow Evident to write files into this directory (repeatable). Omit to disable file sync entirely.",
@@ -8135,6 +9269,10 @@ program.command("run").description("Connect to Evident and process messages").op
       // Raw string — the resolver in run.ts single-sources parsing
       // (resolveClaudeUsageReportingMode).
       claudeUsageReporting: options.claudeUsageReporting,
+      openaiUsageReporting: options.openaiUsageReporting,
+      // Raw value — resolution is single-sourced in run.ts's
+      // resolveResourceUsageReportingEnabled.
+      resourceUsageReporting: options.resourceUsageReporting,
       // Raw values — expansion/validation is single-sourced in run.ts's
       // resolveFileSyncDirectories.
       enableFileSyncTo: options.enableFileSyncTo,