@evident-ai/cli 3.4.1-dev.31006db → 3.4.1-dev.38181ff

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
 import { Command } from "commander";
 
 // src/commands/login.ts
@@ -11,8 +11,8 @@ import chalk2 from "chalk";
 
 // src/lib/config.ts
 import Conf from "conf";
-import { chmodSync, existsSync, statSync } from "fs";
-import { dirname } from "path";
+import { chmodSync, existsSync, statSync } from "node:fs";
+import { dirname } from "node:path";
 var PRODUCTION_API_URL = "https://api.production.evident.run/v1";
 var PRODUCTION_TUNNEL_URL = "wss://tunnel.production.evident.run";
 var defaults = {
@@ -623,6 +623,19 @@ function isInteractive(jsonOutput) {
   return true;
 }
 
+// src/lib/subscription-usage-report.ts
+function toReportedSubscription(collected) {
+  if (!collected) return null;
+  if (collected.ownerEmail === null && collected.planType === null && collected.organizationName === null) {
+    return null;
+  }
+  return {
+    owner_email: collected.ownerEmail,
+    plan_type: collected.planType,
+    organization_name: collected.organizationName
+  };
+}
+
 // src/commands/agent-lookup.ts
 async function readErrorMessage(response) {
   const text = await response.text().catch(() => "");
@@ -670,12 +683,15 @@ async function resolveAgentIdFromKey(authHeader) {
   }
 }
 var BEST_EFFORT_NOTIFY_TIMEOUT_MS = 2e3;
-async function notifyAgentDisconnected(agentId, authHeader) {
-  const apiUrl = getApiUrlConfig();
+async function postBestEffort(path, authHeader, body) {
   try {
-    const response = await fetch(`${apiUrl}/runners/${agentId}/disconnect`, {
+    const apiUrl = getApiUrlConfig();
+    const headers = { Authorization: authHeader };
+    if (body !== void 0) headers["Content-Type"] = "application/json";
+    const response = await fetch(`${apiUrl}${path}`, {
       method: "POST",
-      headers: { Authorization: authHeader },
+      headers,
+      body: body !== void 0 ? JSON.stringify(body) : void 0,
       signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
     });
     if (!response.ok) {
@@ -687,73 +703,32 @@ async function notifyAgentDisconnected(agentId, authHeader) {
     }
     return { ok: true };
   } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
+    return { ok: false, error: describeTimeoutError(error2, BEST_EFFORT_NOTIFY_TIMEOUT_MS) };
   }
 }
-function describeBestEffortError(error2) {
+function describeTimeoutError(error2, timeoutMs) {
   const name = error2?.name;
   if (name === "TimeoutError" || name === "AbortError") {
-    return `timed out after ${BEST_EFFORT_NOTIFY_TIMEOUT_MS}ms`;
+    return `timed out after ${timeoutMs}ms`;
   }
   return error2 instanceof Error ? error2.message : String(error2);
 }
+async function notifyAgentDisconnected(agentId, authHeader) {
+  return postBestEffort(`/runners/${agentId}/disconnect`, authHeader);
+}
 async function reportMicrovmId(agentId, authHeader, microvmId) {
-  try {
-    const apiUrl = getApiUrlConfig();
-    const response = await fetch(`${apiUrl}/runners/${agentId}/microvm`, {
-      method: "POST",
-      headers: { Authorization: authHeader, "Content-Type": "application/json" },
-      body: JSON.stringify({ microvm_id: microvmId }),
-      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
-  }
+  return postBestEffort(`/runners/${agentId}/microvm`, authHeader, { microvm_id: microvmId });
 }
 function toReportedWindow(window) {
   if (!window) return null;
   return { utilization: window.utilization, resets_at: window.resetsAt };
 }
-function toReportedOwner(snapshot) {
-  if (!snapshot.owner) return null;
-  return {
-    email: snapshot.owner.email,
-    organization_name: snapshot.owner.organizationName,
-    rate_limit_tier: snapshot.owner.rateLimitTier
-  };
-}
 async function reportClaudeUsage(agentId, authHeader, snapshot) {
-  try {
-    const apiUrl = getApiUrlConfig();
-    const response = await fetch(`${apiUrl}/runners/${agentId}/claude-usage`, {
-      method: "POST",
-      headers: { Authorization: authHeader, "Content-Type": "application/json" },
-      body: JSON.stringify({
-        five_hour: toReportedWindow(snapshot.fiveHour),
-        seven_day: toReportedWindow(snapshot.sevenDay),
-        owner: toReportedOwner(snapshot)
-      }),
-      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
-  }
+  return postBestEffort(`/runners/${agentId}/claude-usage`, authHeader, {
+    five_hour: toReportedWindow(snapshot.fiveHour),
+    seven_day: toReportedWindow(snapshot.sevenDay),
+    subscription: toReportedSubscription(snapshot.subscription)
+  });
 }
 function toReportedOpenAiWindow(window) {
   if (!window) return null;
@@ -764,59 +739,25 @@ function toReportedOpenAiWindow(window) {
   };
 }
 async function reportOpenAiUsage(agentId, authHeader, snapshot) {
-  try {
-    const apiUrl = getApiUrlConfig();
-    const response = await fetch(`${apiUrl}/runners/${agentId}/openai-usage`, {
-      method: "POST",
-      headers: { Authorization: authHeader, "Content-Type": "application/json" },
-      body: JSON.stringify({
-        primary: toReportedOpenAiWindow(snapshot.primary),
-        secondary: toReportedOpenAiWindow(snapshot.secondary),
-        has_credits: snapshot.hasCredits,
-        credits_unlimited: snapshot.creditsUnlimited
-      }),
-      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
-  }
+  return postBestEffort(`/runners/${agentId}/openai-usage`, authHeader, {
+    primary: toReportedOpenAiWindow(snapshot.primary),
+    secondary: toReportedOpenAiWindow(snapshot.secondary),
+    has_credits: snapshot.hasCredits,
+    credits_unlimited: snapshot.creditsUnlimited,
+    subscription: toReportedSubscription(snapshot.subscription)
+  });
 }
 async function reportResourceUsage(agentId, authHeader, usage) {
-  try {
-    const apiUrl = getApiUrlConfig();
-    const response = await fetch(`${apiUrl}/runners/${agentId}/resource-usage`, {
-      method: "POST",
-      headers: { Authorization: authHeader, "Content-Type": "application/json" },
-      body: JSON.stringify({
-        cpu_percent: usage.cpuPercent,
-        cpu_count: usage.cpuCount,
-        memory_total_bytes: usage.memoryTotalBytes,
-        memory_available_bytes: usage.memoryAvailableBytes,
-        disk_total_bytes: usage.diskTotalBytes,
-        disk_free_bytes: usage.diskFreeBytes,
-        opencode_db_bytes: usage.opencodeDbBytes
-      }),
-      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
-  }
+  return postBestEffort(`/runners/${agentId}/resource-usage`, authHeader, {
+    cpu_percent: usage.cpuPercent,
+    cpu_peak_percent: usage.cpuPeakPercent,
+    cpu_count: usage.cpuCount,
+    memory_total_bytes: usage.memoryTotalBytes,
+    memory_available_bytes: usage.memoryAvailableBytes,
+    disk_total_bytes: usage.diskTotalBytes,
+    disk_free_bytes: usage.diskFreeBytes,
+    opencode_db_bytes: usage.opencodeDbBytes
+  });
 }
 async function getAgentInfo(agentId, authHeader) {
   const apiUrl = getApiUrlConfig();
@@ -868,13 +809,6 @@ function authLabelFor(credentials2) {
   }
   return "user token";
 }
-function describeFetchError(error2) {
-  const name = error2?.name;
-  if (name === "TimeoutError" || name === "AbortError") {
-    return `timed out after ${STATUS_TIMEOUT_MS}ms waiting for a response`;
-  }
-  return error2 instanceof Error ? error2.message : String(error2);
-}
 async function checkStatus(jsonMode) {
   const apiUrl = getApiUrlConfig();
   const credentials2 = await getAuthCredentials();
@@ -902,7 +836,7 @@ async function checkStatus(jsonMode) {
       endpoint: apiUrl,
       authLabel: authLabelFor(credentials2),
       reason: "unreachable",
-      error: `Could not reach ${apiUrl}: ${describeFetchError(error2)}. The credentials were NOT validated.`,
+      error: `Could not reach ${apiUrl}: ${describeTimeoutError(error2, STATUS_TIMEOUT_MS)}. The credentials were NOT validated.`,
       exitCode: 75
     };
   }
@@ -1000,10 +934,10 @@ async function status(options = {}) {
 }
 
 // src/lib/claude-usage.ts
-import { execFileSync } from "child_process";
-import { readFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 var CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var CLAUDE_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
 var CLAUDE_PROFILE_TIMEOUT_MS = 2e3;
@@ -1088,7 +1022,7 @@ function ownerLookupFailure(error2) {
 }
 async function getClaudeUsageOwner(accessToken) {
   if (cachedOwner?.accessToken === accessToken) {
-    return { owner: cachedOwner.owner, ownerLookupError: null };
+    return { subscription: cachedOwner.owner, ownerLookupError: null };
   }
   try {
     const response = await fetch(CLAUDE_PROFILE_URL, {
@@ -1100,27 +1034,27 @@ async function getClaudeUsageOwner(accessToken) {
       signal: AbortSignal.timeout(CLAUDE_PROFILE_TIMEOUT_MS)
     });
     if (!response.ok) {
-      return { owner: null, ownerLookupError: `HTTP ${response.status}` };
+      return { subscription: null, ownerLookupError: `HTTP ${response.status}` };
     }
     let body;
     try {
       body = await response.json();
     } catch (error2) {
-      return { owner: null, ownerLookupError: "malformed response" };
+      return { subscription: null, ownerLookupError: "malformed response" };
     }
     const profile = body;
     if (typeof profile.account?.email !== "string" || !profile.account.email.trim()) {
-      return { owner: null, ownerLookupError: "malformed response" };
+      return { subscription: null, ownerLookupError: "malformed response" };
     }
-    const owner = {
-      email: profile.account.email,
+    const subscription = {
+      ownerEmail: profile.account.email,
       organizationName: typeof profile.organization?.name === "string" && profile.organization.name.trim() ? profile.organization.name.trim() : null,
-      rateLimitTier: typeof profile.organization?.rate_limit_tier === "string" && profile.organization.rate_limit_tier.trim() ? profile.organization.rate_limit_tier.trim() : null
+      planType: typeof profile.organization?.rate_limit_tier === "string" && profile.organization.rate_limit_tier.trim() ? profile.organization.rate_limit_tier.trim() : null
     };
-    cachedOwner = { accessToken, owner };
-    return { owner, ownerLookupError: null };
+    cachedOwner = { accessToken, owner: subscription };
+    return { subscription, ownerLookupError: null };
   } catch (error2) {
-    return { owner: null, ownerLookupError: ownerLookupFailure(error2) };
+    return { subscription: null, ownerLookupError: ownerLookupFailure(error2) };
   }
 }
 async function getClaudeUsage() {
@@ -1149,11 +1083,11 @@ async function getClaudeUsage() {
     throw new ClaudeUsageError(`Claude usage request failed: HTTP ${res.status}`, "request_failed");
   }
   const body = await res.json();
-  const { owner, ownerLookupError } = await getClaudeUsageOwner(credentials2.accessToken);
+  const { subscription, ownerLookupError } = await getClaudeUsageOwner(credentials2.accessToken);
   return {
     fiveHour: toWindow(body.five_hour),
     sevenDay: toWindow(body.seven_day),
-    owner,
+    subscription,
     ownerLookupError
   };
 }
@@ -1183,10 +1117,10 @@ async function claudeUsage() {
 }
 
 // src/commands/run.ts
-import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir5 } from "os";
-import { isAbsolute as isAbsolute3, join as join8, parse, resolve as resolvePath2 } from "path";
-import chalk6 from "chalk";
+import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { isAbsolute as isAbsolute3, join as join10, parse, resolve as resolvePath2 } from "node:path";
+import chalk7 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
 var MICROVM_MAX_LIFETIME_MS = 8 * 60 * 6e4;
@@ -1207,6 +1141,7 @@ var TelemetryEventTypes = {
 // ../../packages/types/src/tunnel/index.ts
 var MAX_FRAME_BYTES = 256 * 1024;
 var TUNNEL_DRAIN_PING_PATH = "/__evident/drain";
+var TUNNEL_USAGE_REARM_PING_PATH = "/__evident/usage-rearm";
 
 // ../../packages/types/src/runner-files.ts
 var MAX_FILE_PUSH_BYTES = 64 * 1024;
@@ -1244,10 +1179,10 @@ function stripQuery(url) {
 
 // src/commands/run.ts
 import ora3 from "ora";
-import { select as select3 } from "@inquirer/prompts";
+import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.0.0" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.4.1-dev.38181ff" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -1417,12 +1352,50 @@ var SEVERITY_BY_LEVEL = {
   warn: "warning",
   error: "error"
 };
+function parseOpenCodeLogLine(line) {
+  const normalisedLine = line.replace(/\r$/, "");
+  const levelMatch = normalisedLine.match(/(?:^|\s)level=(\w+)/i);
+  if (!levelMatch) return null;
+  const level = levelMatch[1].toUpperCase();
+  if (level !== "WARN" && level !== "ERROR") return null;
+  const sessionMatch = normalisedLine.match(/(?:^|\s)sessionID=(\S+)/);
+  return { level: level === "WARN" ? "warn" : "error", sessionID: sessionMatch?.[1] };
+}
+var MAX_LINE_BUFFER_BYTES = 16 * 1024;
+function createOpenCodeActivityForwarder(getContext) {
+  let buffer = Buffer.alloc(0);
+  const flushLine = (line) => {
+    const parsed = parseOpenCodeLogLine(line);
+    if (!parsed) return;
+    forwardRunnerActivity(
+      {
+        level: parsed.level,
+        error: line,
+        metadata: parsed.sessionID ? { sessionID: parsed.sessionID } : void 0,
+        source: "opencode"
+      },
+      getContext()
+    );
+  };
+  return (chunk) => {
+    buffer = Buffer.concat([buffer, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, "utf-8")]);
+    let newlineIndex;
+    while ((newlineIndex = buffer.indexOf(10)) !== -1) {
+      flushLine(buffer.subarray(0, newlineIndex).toString("utf-8").replace(/\r$/, ""));
+      buffer = buffer.subarray(newlineIndex + 1);
+    }
+    if (buffer.length > MAX_LINE_BUFFER_BYTES) {
+      flushLine(buffer.toString("utf-8"));
+      buffer = Buffer.alloc(0);
+    }
+  };
+}
 var MAX_MESSAGE_LENGTH = 500;
 var MAX_METADATA_VALUE_LENGTH = 200;
 var MAX_METADATA_ENTRIES = 20;
 var TRUNCATION_MARKER = "\u2026";
 function redact(message) {
-  return message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/https?:\/\/\S+/g, "<url>");
+  return message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/(?<![A-Za-z0-9_-])sk-ant-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-ant-***").replace(/(?<![A-Za-z0-9_-])sk-proj-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-proj-***").replace(/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "sk-***").replace(/(?<![A-Za-z0-9_-])(gh[oprsu])_[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "$1_***").replace(/(?<![A-Za-z0-9_-])github_pat_[A-Za-z0-9_]{20,}(?![A-Za-z0-9_-])/g, "github_pat_***").replace(/https?:\/\/\S+/g, "<url>");
 }
 function truncate(message) {
   if (message.length <= MAX_MESSAGE_LENGTH) return message;
@@ -1448,43 +1421,47 @@ function sanitiseMetadata(metadata) {
 }
 var RATE_LIMIT_WINDOW_MS = 6e4;
 var RATE_LIMIT_MAX_EVENTS = 30;
-var windowStartedAt = 0;
-var windowCount = 0;
-var windowDroppedCount = 0;
-function admitUnderRateLimit(now) {
-  if (now - windowStartedAt >= RATE_LIMIT_WINDOW_MS) {
-    if (windowDroppedCount > 0) {
+var rateWindows = /* @__PURE__ */ new Map();
+function admitUnderRateLimit(source, now) {
+  let window = rateWindows.get(source);
+  if (!window) {
+    window = { windowStartedAt: 0, windowCount: 0, windowDroppedCount: 0 };
+    rateWindows.set(source, window);
+  }
+  if (now - window.windowStartedAt >= RATE_LIMIT_WINDOW_MS) {
+    if (window.windowDroppedCount > 0) {
       console.error(
-        `[runner-activity-telemetry] rate cap reached: dropped ${windowDroppedCount} ${windowDroppedCount === 1 ? "entry" : "entries"} in the last ${RATE_LIMIT_WINDOW_MS / 1e3}s (cap ${RATE_LIMIT_MAX_EVENTS}/min)`
+        `[runner-activity-telemetry] rate cap reached: dropped ${window.windowDroppedCount} ${window.windowDroppedCount === 1 ? "entry" : "entries"} in the last ${RATE_LIMIT_WINDOW_MS / 1e3}s (cap ${RATE_LIMIT_MAX_EVENTS}/min) for source "${source}"`
       );
     }
-    windowStartedAt = now;
-    windowCount = 0;
-    windowDroppedCount = 0;
+    window.windowStartedAt = now;
+    window.windowCount = 0;
+    window.windowDroppedCount = 0;
   }
-  if (windowCount >= RATE_LIMIT_MAX_EVENTS) {
-    windowDroppedCount++;
-    if (windowDroppedCount === 1) {
+  if (window.windowCount >= RATE_LIMIT_MAX_EVENTS) {
+    window.windowDroppedCount++;
+    if (window.windowDroppedCount === 1) {
       console.error(
-        `[runner-activity-telemetry] rate cap reached (${RATE_LIMIT_MAX_EVENTS} per ${RATE_LIMIT_WINDOW_MS / 1e3}s) \u2014 dropping further entries this window`
+        `[runner-activity-telemetry] rate cap reached (${RATE_LIMIT_MAX_EVENTS} per ${RATE_LIMIT_WINDOW_MS / 1e3}s) \u2014 dropping further entries this window for source "${source}"`
       );
     }
     return false;
   }
-  windowCount++;
+  window.windowCount++;
   return true;
 }
 function forwardRunnerActivity(entry, context) {
   try {
     if (!FORWARDED_LEVELS.has(entry.level)) return;
     if (!context.agentId || !context.authHeader) return;
-    if (!admitUnderRateLimit(Date.now())) return;
+    const source = entry.source ?? "cli.run";
+    if (!admitUnderRateLimit(source, Date.now())) return;
     const rawMessage = entry.error ?? entry.message ?? "";
     const message = truncate(redact(rawMessage));
     logEvent(TelemetryEventTypes.RUNNER_ACTIVITY, {
       severity: SEVERITY_BY_LEVEL[entry.level],
       message,
-      metadata: { ...sanitiseMetadata(entry.metadata), source: "cli.run" },
+      metadata: { ...sanitiseMetadata(entry.metadata), source },
       agentId: context.agentId
     });
   } catch (err) {
@@ -1495,8 +1472,8 @@ function forwardRunnerActivity(entry, context) {
 }
 
 // src/lib/opencode/session-db-recovery-report.ts
-import { readFileSync as readFileSync2, unlinkSync } from "fs";
-import { join as join2 } from "path";
+import { readFileSync as readFileSync2, unlinkSync } from "node:fs";
+import { join as join2 } from "node:path";
 function sessionDbRecoveryReportPath(homeDir, env) {
   const override = env.EVIDENT_SESSION_DB_RECOVERY_REPORT?.trim();
   return override || join2(homeDir, ".local", "state", "evident", "session-db-recovery.jsonl");
@@ -1525,7 +1502,14 @@ function drainSessionDbRecoveryReport({
         skippedLines++;
         return [];
       }
-      return [{ ...value, replication_suspended: value.replication_suspended ?? false }];
+      return [
+        {
+          ...value,
+          provenance_reason: value.provenance_reason ?? null,
+          provenance_migration_delta: value.provenance_migration_delta ?? null,
+          replication_suspended: value.replication_suspended ?? false
+        }
+      ];
     } catch (error2) {
       skippedLines++;
       console.error(
@@ -1628,6 +1612,12 @@ function buildSessionDbRecoveryActivity(record) {
         metadata: withoutContractFields(record),
         message: `This runner did not come online because its damaged session database could not be safely separated from its active backup or proven removed. Backed-up session history remains readable at ${record.quarantine_destination ?? "its original location or the quarantine destination named in the boot logs"}; any local session-database files that remain were left in place and nothing opened or wrote them. See the runner boot logs for SESSION-DB-LOCAL-DISCARD-FAILED details.`
       };
+    case "schema_provenance_mismatch":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: `Session database schema provenance mismatch for ${record.dbPath ?? record.db_path ?? "unknown"}: recorded version=${record.recorded_version ?? "unknown"}, current version=${record.current_version ?? "unknown"}, reason=${record.provenance_reason ?? "unknown"}, migration delta=${record.provenance_migration_delta ?? "unknown"}. Inspect the session database and runner backup before continuing.`
+      };
     default:
       return null;
   }
@@ -1642,7 +1632,8 @@ var OUTCOMES = /* @__PURE__ */ new Set([
   "fresh_session_db",
   "history_rolled_back",
   "restore_misconfigured",
-  "session_db_boot_refused"
+  "session_db_boot_refused",
+  "schema_provenance_mismatch"
 ]);
 var STAGES = /* @__PURE__ */ new Set(["restore", "verify"]);
 var SEVERITIES = /* @__PURE__ */ new Set(["warning", "error"]);
@@ -1660,7 +1651,7 @@ var STRING_OR_NULL_FIELDS = ["quarantine_destination", "verified_restore_point"]
 function isSessionDbRecoveryRecord(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const record = value;
-  return record.v === 1 && record.event === "session_db_recovery" && typeof record.at === "string" && STAGES.has(record.stage) && OUTCOMES.has(record.outcome) && SEVERITIES.has(record.severity) && typeof record.reason === "string" && (record.replication_suspended === void 0 || typeof record.replication_suspended === "boolean") && NUMBER_FIELDS.every((field) => record[field] === null || Number.isInteger(record[field])) && STRING_OR_NULL_FIELDS.every(
+  return record.v === 1 && record.event === "session_db_recovery" && typeof record.at === "string" && STAGES.has(record.stage) && OUTCOMES.has(record.outcome) && SEVERITIES.has(record.severity) && typeof record.reason === "string" && (record.replication_suspended === void 0 || typeof record.replication_suspended === "boolean") && (record.provenance_reason === void 0 || record.provenance_reason === null || typeof record.provenance_reason === "string") && (record.provenance_migration_delta === void 0 || record.provenance_migration_delta === null || Number.isInteger(record.provenance_migration_delta)) && NUMBER_FIELDS.every((field) => record[field] === null || Number.isInteger(record[field])) && STRING_OR_NULL_FIELDS.every(
     (field) => record[field] === null || typeof record[field] === "string"
   );
 }
@@ -1695,13 +1686,13 @@ async function waitForOpenCodeHealth(port, timeoutMs = 3e4) {
 }
 
 // src/lib/opencode/session-db-boot.ts
-import { spawn as spawn2 } from "child_process";
-import { mkdirSync, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, resolve as resolvePath } from "path";
+import { spawn as spawn2 } from "node:child_process";
+import { mkdirSync, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, resolve as resolvePath } from "node:path";
 
 // src/lib/runner-synchroniser.ts
-import { spawn } from "child_process";
+import { spawn } from "node:child_process";
 function appendError(stderr, error2) {
   const message = error2 instanceof Error ? error2.message : String(error2);
   return stderr === "" ? message : `${stderr}
@@ -1714,10 +1705,14 @@ function runSynchroniser(args, opts) {
     let stderr = "";
     let settled = false;
     const timer = {};
+    let abortListener;
+    let spawnListener;
     const finish = (result) => {
       if (settled) return;
       settled = true;
       if (timer.handle) clearTimeout(timer.handle);
+      if (abortListener) opts.signal?.removeEventListener("abort", abortListener);
+      if (spawnListener) child.removeListener("spawn", spawnListener);
       resolve4(result);
     };
     try {
@@ -1743,6 +1738,25 @@ function runSynchroniser(args, opts) {
     child.once("close", (code) => {
       finish({ code, stdout, stderr, timedOut: false });
     });
+    if (opts.signal) {
+      const killChild = () => {
+        if (child.pid === void 0) {
+          if (!spawnListener) {
+            spawnListener = killChild;
+            child.once("spawn", spawnListener);
+          }
+          return;
+        }
+        child.kill("SIGKILL");
+      };
+      abortListener = killChild;
+      if (opts.signal.aborted) {
+        abortListener();
+      } else {
+        opts.signal.addEventListener("abort", abortListener, { once: true });
+        if (opts.signal.aborted) abortListener();
+      }
+    }
     timer.handle = setTimeout(
       () => {
         child.kill("SIGKILL");
@@ -1780,6 +1794,8 @@ function reportRecord(stage, outcome, reason, litestreamExitCode, options) {
     quarantined_bytes: null,
     verified_restore_point: null,
     restore_points_tried: null,
+    provenance_reason: null,
+    provenance_migration_delta: null,
     replication_suspended: stage === "restore"
   });
 }
@@ -2200,6 +2216,131 @@ async function restoreAndVerifySessionDb(options) {
   return { verifyFatal: await verifySessionDb(options, configPath, env) };
 }
 
+// src/lib/opencode/session-db-provenance.ts
+import { createRequire } from "node:module";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
+var require2 = createRequire(import.meta.url);
+function readSessionDbMigrationIds(dbPath) {
+  let db;
+  try {
+    const { DatabaseSync } = require2("node:sqlite");
+    db = new DatabaseSync(dbPath, { readOnly: true });
+    const columns = db.prepare("PRAGMA table_info(migration)").all();
+    const hasExpectedShape = columns.length === 2 && columns.some(
+      (column) => column.name === "id" && typeof column.type === "string" && column.type.toUpperCase() === "TEXT" && column.pk === 1
+    ) && columns.some(
+      (column) => column.name === "time_completed" && typeof column.type === "string" && column.type.toUpperCase() === "INTEGER" && column.notnull === 1 && column.pk === 0
+    );
+    if (!hasExpectedShape) {
+      console.warn(`[readSessionDbMigrationIds] unsupported migration table shape in ${dbPath}`);
+      return null;
+    }
+    const rows = db.prepare("SELECT id FROM migration ORDER BY id").all();
+    if (rows.some((row) => typeof row.id !== "string")) return null;
+    return rows.map((row) => row.id);
+  } catch (error2) {
+    console.warn(
+      `[readSessionDbMigrationIds] could not read migration history from ${dbPath}: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+    return null;
+  } finally {
+    try {
+      db?.close();
+    } catch (error2) {
+      console.warn(
+        `[readSessionDbMigrationIds] could not close ${dbPath}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+    }
+  }
+}
+function sessionDbProvenanceStatePath(homeDir, env) {
+  const override = env.EVIDENT_SESSION_DB_PROVENANCE_STATE?.trim();
+  return override || join3(homeDir, ".local", "state", "evident", "session-db-provenance.json");
+}
+function loadSessionDbProvenanceState(path) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync3(path, "utf8"));
+  } catch (error2) {
+    if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") return {};
+    console.error(
+      `[session-db-provenance] could not read ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+    return {};
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    console.error(`[session-db-provenance] ignored malformed state in ${path}`);
+    return {};
+  }
+  const state = {};
+  for (const [dbPath, record] of Object.entries(value)) {
+    if (!isSessionDbProvenanceRecord(record)) {
+      console.error(`[session-db-provenance] ignored malformed state in ${path}`);
+      return {};
+    }
+    state[dbPath] = record;
+  }
+  return state;
+}
+function saveSessionDbProvenanceState(path, state) {
+  try {
+    mkdirSync2(dirname3(path), { recursive: true });
+    writeFileSync2(path, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+  } catch (error2) {
+    console.error(
+      `[session-db-provenance] could not write ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+  }
+}
+function evaluateSessionDbProvenance(input) {
+  const { currentVersion, currentIds, previous } = input;
+  if (!previous) return { anomaly: false, reason: null };
+  const current = new Set(currentIds);
+  const prior = new Set(previous.migrationIds);
+  for (const id of prior) {
+    if (!current.has(id)) return { anomaly: true, reason: "migration-history-regressed" };
+  }
+  if (current.size > prior.size && previous.opencodeVersion === currentVersion) {
+    return { anomaly: true, reason: "foreign-version-migrations" };
+  }
+  return { anomaly: false, reason: null };
+}
+function checkSessionDbProvenance(input) {
+  const { dbPath, currentVersion, homeDir, env } = input;
+  const path = sessionDbProvenanceStatePath(homeDir, env);
+  const state = loadSessionDbProvenanceState(path);
+  const previous = state[dbPath];
+  const currentIds = readSessionDbMigrationIds(dbPath);
+  if (currentIds === null) {
+    return {
+      anomaly: false,
+      reason: null,
+      recordedVersion: previous?.opencodeVersion ?? null,
+      migrationDelta: null
+    };
+  }
+  const decision = evaluateSessionDbProvenance({ currentVersion, currentIds, previous });
+  const migrationDelta = previous ? new Set(currentIds).size - new Set(previous.migrationIds).size : null;
+  state[dbPath] = {
+    opencodeVersion: currentVersion,
+    migrationIds: currentIds,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveSessionDbProvenanceState(path, state);
+  return {
+    ...decision,
+    recordedVersion: previous?.opencodeVersion ?? null,
+    migrationDelta
+  };
+}
+function isSessionDbProvenanceRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  return typeof record.opencodeVersion === "string" && Array.isArray(record.migrationIds) && record.migrationIds.every((id) => typeof id === "string") && typeof record.updatedAt === "string";
+}
+
 // src/lib/opencode/opencode-version-gate.ts
 var QUEUE_VALIDATED_OPENCODE_VERSIONS = ["1.17.11", "1.18.3"];
 function isQueueValidatedVersion(version2) {
@@ -2272,6 +2413,17 @@ async function stopProcessAndWait(child, timeoutMs, sendTerm, sendKill) {
 
 // src/lib/opencode/process.ts
 var OPENCODE_PORT_RANGE = [4096, 4097, 4098, 4099, 4100];
+var VALID_OPENCODE_LOG_LEVELS = /* @__PURE__ */ new Set(["DEBUG", "INFO", "WARN", "ERROR"]);
+function resolveOpenCodeLogLevel(env) {
+  const raw = env.OPENCODE_LOG_LEVEL;
+  if (!raw) return "INFO";
+  const upper = raw.toUpperCase();
+  if (VALID_OPENCODE_LOG_LEVELS.has(upper)) return upper;
+  console.warn(
+    `startOpenCode: ignoring invalid OPENCODE_LOG_LEVEL "${raw}" (expected DEBUG|INFO|WARN|ERROR) \u2014 using INFO`
+  );
+  return "INFO";
+}
 function getProcessCwd(pid) {
   const platform = process.platform;
   try {
@@ -2320,14 +2472,14 @@ function findAvailablePort(startPort, maxAttempts = 10) {
   }
   return null;
 }
-function findOpenCodeProcesses() {
+function findProcessesByPattern(pgrepPattern, psPattern) {
   const instances = [];
   try {
     const platform = process.platform;
     if (platform === "darwin" || platform === "linux") {
       let pids = [];
       try {
-        const pgrepOutput = execSync('pgrep -f "opencode serve|opencode-serve"', {
+        const pgrepOutput = execSync(`pgrep -f "${pgrepPattern}"`, {
           encoding: "utf-8",
           stdio: ["pipe", "pipe", "pipe"]
         }).trim();
@@ -2336,7 +2488,7 @@ function findOpenCodeProcesses() {
         }
       } catch {
         try {
-          const psOutput = execSync('ps aux | grep -E "opencode (serve|--port)" | grep -v grep', {
+          const psOutput = execSync(`ps aux | grep -E "${psPattern}" | grep -v grep`, {
             encoding: "utf-8",
             stdio: ["pipe", "pipe", "pipe"]
           }).trim();
@@ -2382,6 +2534,9 @@ function findOpenCodeProcesses() {
   }
   return instances;
 }
+function findOpenCodeProcesses() {
+  return findProcessesByPattern("opencode serve|opencode-serve", "opencode (serve|--port)");
+}
 async function scanPortsForOpenCode() {
   const instances = [];
   const checks = OPENCODE_PORT_RANGE.map(async (port) => {
@@ -2428,7 +2583,7 @@ async function findHealthyOpenCodeInstances() {
 }
 async function startOpenCode(port, options = {}) {
   let command = "opencode";
-  const printLogs = options.inheritStdio ? ["--print-logs"] : [];
+  const printLogs = options.inheritStdio ? ["--print-logs", "--log-level", resolveOpenCodeLogLevel(process.env)] : [];
   let args = ["serve", "--port", port.toString(), "--hostname", "127.0.0.1", ...printLogs];
   try {
     execSync("which opencode", { stdio: "ignore" });
@@ -2485,6 +2640,19 @@ function isOpenCodeInstalled() {
     return false;
   }
 }
+function isOpenCode2Installed() {
+  try {
+    const platform = process.platform;
+    if (platform === "win32") {
+      execSync2("where opencode2", { stdio: "ignore" });
+    } else {
+      execSync2("which opencode2", { stdio: "ignore" });
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function promptOpenCodeInstall(interactive) {
   if (!interactive) {
     console.log(
@@ -2494,7 +2662,11 @@ async function promptOpenCodeInstall(interactive) {
         install_url: OPENCODE_INSTALL_URL,
         install_commands: {
           npm: "npm install -g opencode-ai",
-          curl: "curl -fsSL https://opencode.ai/install.sh | sh"
+          curl: "curl -fsSL https://opencode.ai/install.sh | sh",
+          v2: {
+            npm: "npm install -g @opencode-ai/cli@beta",
+            curl: "curl -fsSL https://opencode.ai/v2/install | bash"
+          }
         }
       })
     );
@@ -2978,21 +3150,112 @@ function findLastAssistantReplyFor(messages, userMessageId) {
   }
   return lastOk ?? last;
 }
-function messageUsage(messages, userMessageId) {
-  if (!messages || messages.length === 0) return null;
-  const byParentAll = messages.filter(
-    (m) => roleOf(m) === "assistant" && parentIdOf(m) === userMessageId
+function collectSubagentSessions(messages, userMessageId) {
+  if (!messages || messages.length === 0) return [];
+  const byParent = messages.filter(
+    (message) => roleOf(message) === "assistant" && parentIdOf(message) === userMessageId
   );
-  const byParentNonErrored = byParentAll.filter((m) => errorOf(m) == null);
-  const byParent = byParentNonErrored.length > 0 ? byParentNonErrored : byParentAll;
-  let correlated;
-  if (byParent.length > 0) {
-    correlated = byParent;
-  } else {
-    const reply = findAssistantReplyAfter(messages, userMessageId);
-    correlated = reply ? [reply] : [];
+  const assistants = byParent.length > 0 ? byParent : [];
+  if (assistants.length === 0) {
+    const userIndex = messages.findIndex((message) => idOf(message) === userMessageId);
+    if (userIndex === -1) return [];
+    for (let i = userIndex + 1; i < messages.length; i++) {
+      const message = messages[i];
+      if (roleOf(message) === "user") break;
+      if (roleOf(message) === "assistant") assistants.push(message);
+    }
+  }
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const message of assistants) {
+    const parts = Array.isArray(message.parts) ? message.parts : [];
+    for (const part of parts) {
+      if (!part || typeof part !== "object" || part.type !== "tool" || part.tool !== "task")
+        continue;
+      const state = part.state;
+      if (!state || typeof state !== "object") continue;
+      const metadata = state.metadata;
+      if (!metadata || typeof metadata !== "object") continue;
+      const sessionId = metadata.sessionId;
+      if (typeof sessionId !== "string" || sessionId.length === 0 || seen.has(sessionId)) continue;
+      seen.add(sessionId);
+      const start = state.time?.start;
+      refs.push({
+        sessionId,
+        startedAtMs: typeof start === "number" && Number.isFinite(start) ? start : null
+      });
+    }
   }
-  if (correlated.length === 0) return null;
+  return refs;
+}
+function finiteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function taskCallModel(value) {
+  if (!value || typeof value !== "object") return null;
+  const model = value;
+  const modelID = typeof model.modelID === "string" ? model.modelID : void 0;
+  const providerID = typeof model.providerID === "string" ? model.providerID : void 0;
+  return modelID || providerID ? { modelID, providerID } : null;
+}
+function collectTaskCalls(messages, userMessageId) {
+  if (!messages || messages.length === 0) return [];
+  const calls = [];
+  for (const message of messages) {
+    if (roleOf(message) !== "assistant" || parentIdOf(message) !== userMessageId) continue;
+    for (const part of message.parts ?? []) {
+      if (part.tool !== "task" || !part.callID || !part.state || part.state.status === "pending") {
+        continue;
+      }
+      const rawName = part.state.input?.subagent_type;
+      const subagentName = typeof rawName === "string" && rawName.trim().length > 0 ? rawName : rawName === void 0 ? "general" : "unknown";
+      const metadata = part.state.metadata;
+      calls.push({
+        callID: part.callID,
+        subagentName,
+        childSessionId: typeof metadata?.sessionId === "string" ? metadata.sessionId : null,
+        parentSessionId: typeof metadata?.parentSessionId === "string" ? metadata.parentSessionId : null,
+        model: taskCallModel(metadata?.model),
+        status: part.state.status ?? "unknown",
+        timeStart: finiteNumber(part.state.time?.start),
+        timeEnd: finiteNumber(part.state.time?.end)
+      });
+    }
+  }
+  return calls;
+}
+function attributeTaskCallUsage(messages, windows) {
+  const eligibleWindows = windows.filter(
+    (window) => window.timeStart !== null && Number.isFinite(window.timeStart)
+  );
+  const assignments = /* @__PURE__ */ new Map();
+  for (const window of eligibleWindows) assignments.set(window.callID, []);
+  const unattributed = [];
+  for (const message of messages ?? []) {
+    if (roleOf(message) !== "assistant") continue;
+    const created = finiteNumber(createdOf(message));
+    const matching = created === null ? [] : eligibleWindows.filter(
+      (window) => window.timeStart <= created && (window.timeEnd === null || window.timeEnd === void 0 || created <= window.timeEnd)
+    );
+    if (matching.length === 0) {
+      unattributed.push(message);
+      continue;
+    }
+    matching.sort((a, b) => a.timeStart - b.timeStart);
+    assignments.get(matching[0].callID)?.push(message);
+  }
+  return {
+    invocations: eligibleWindows.map((window) => {
+      const assigned = assignments.get(window.callID) ?? [];
+      return { callID: window.callID, messages: assigned, usage: sumAssistantUsage(assigned) };
+    }),
+    unattributed
+  };
+}
+function sumAssistantUsage(messages) {
+  if (!messages || messages.length === 0) return null;
+  const nonErrored = messages.filter((message) => errorOf(message) == null);
+  const selected = nonErrored.length > 0 ? nonErrored : messages;
   let sawAnyUsage = false;
   let inputSum = 0;
   let outputSum = 0;
@@ -3003,7 +3266,7 @@ function messageUsage(messages, userMessageId) {
   let sawCost = false;
   let modelId = null;
   let providerId = null;
-  for (const m of correlated) {
+  for (const m of selected) {
     const info = m.info;
     if (!info) continue;
     const tokens = info.tokens;
@@ -3038,12 +3301,28 @@ function messageUsage(messages, userMessageId) {
     usage_tokens_reasoning: reasoningSum,
     usage_tokens_cache_read: cacheReadSum,
     usage_tokens_cache_write: cacheWriteSum,
-    // NULL means "OpenCode never reported a cost" (never inferred from
-    // tokens) — distinct from a genuine 0-cost turn, which would set
-    // `sawCost` true with `costSum === 0`.
+    // NULL means OpenCode never reported a cost; it is distinct from a genuine
+    // zero-cost message, which sets `sawCost` with `costSum === 0`.
     usage_cost_usd: sawCost ? costSum : null
   };
 }
+function messageUsage(messages, userMessageId) {
+  if (!messages || messages.length === 0) return null;
+  const byParentAll = messages.filter(
+    (m) => roleOf(m) === "assistant" && parentIdOf(m) === userMessageId
+  );
+  const byParentNonErrored = byParentAll.filter((m) => errorOf(m) == null);
+  const byParent = byParentNonErrored.length > 0 ? byParentNonErrored : byParentAll;
+  let correlated;
+  if (byParent.length > 0) {
+    correlated = byParent;
+  } else {
+    const reply = findAssistantReplyAfter(messages, userMessageId);
+    correlated = reply ? [reply] : [];
+  }
+  if (correlated.length === 0) return null;
+  return sumAssistantUsage(correlated);
+}
 function messageRunState(messages, userMessageId) {
   if (!messages || messages.length === 0) return "unknown";
   const hasUser = messages.some((m) => idOf(m) === userMessageId);
@@ -3106,8 +3385,7 @@ function isAbortedTerminalReply(messages, userMessageId) {
   }
   return false;
 }
-function messageFailure(messages, userMessageId) {
-  const reply = findLastAssistantReplyFor(messages, userMessageId);
+function classifyReplyAuthError(reply) {
   const error2 = errorOf(reply);
   if (error2 == null || typeof error2 !== "object") return null;
   const e = error2;
@@ -3132,6 +3410,32 @@ function messageFailure(messages, userMessageId) {
   }
   return null;
 }
+function messageFailure(messages, userMessageId) {
+  return classifyReplyAuthError(findLastAssistantReplyFor(messages, userMessageId));
+}
+function findLatestSubagentAuthOutcome(messages, sinceMs) {
+  if (!messages || messages.length === 0) return null;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (roleOf(message) !== "assistant") continue;
+    const created = createdOf(message);
+    if (sinceMs !== null && typeof created === "number" && created < sinceMs) continue;
+    const failure = classifyReplyAuthError(message);
+    if (failure) {
+      if (!failure.providerId) return null;
+      return { providerId: failure.providerId, outcome: "failed", failure };
+    }
+    const providerId = message.info?.providerID;
+    if (errorOf(message) == null && typeof providerId === "string" && providerId.length > 0) {
+      return { providerId, outcome: "succeeded" };
+    }
+    return null;
+  }
+  return null;
+}
+function findSubagentAuthOutcome(messages, sinceMs) {
+  return findLatestSubagentAuthOutcome(messages, sinceMs);
+}
 function applyZeroProviderFallback(classified, hasConfiguredProvider, replyProviderId, replyModelId = null) {
   if (classified != null) return classified;
   if (hasConfiguredProvider !== false) return null;
@@ -3148,6 +3452,28 @@ function hasRunningAssistantExcept(messages, exceptUserMessageId) {
     (m) => roleOf(m) === "assistant" && parentIdOf(m) !== exceptUserMessageId && isAssistantInFlight(m)
   );
 }
+function hasLaterSiblingTurnStarted(messages, userMessageId, siblingUserMessageIds) {
+  if (!messages || messages.length === 0) return false;
+  const userIndex = messages.findIndex((message) => idOf(message) === userMessageId);
+  if (userIndex === -1) return false;
+  let hasLaterUser = false;
+  let hasStartedLaterUser = false;
+  for (let i = userIndex + 1; i < messages.length; i++) {
+    const message = messages[i];
+    if (roleOf(message) !== "user") continue;
+    hasLaterUser = true;
+    const laterUserMessageId = idOf(message);
+    if (laterUserMessageId === void 0 || !siblingUserMessageIds.has(laterUserMessageId)) {
+      return false;
+    }
+    if (messages.some(
+      (candidate) => roleOf(candidate) === "assistant" && parentIdOf(candidate) === laterUserMessageId
+    )) {
+      hasStartedLaterUser = true;
+    }
+  }
+  return hasLaterUser && hasStartedLaterUser;
+}
 async function hasAnyConfiguredProvider(port) {
   try {
     const res = await timedFetch(`${opencodeBase(port)}/config/providers`);
@@ -3179,16 +3505,104 @@ async function hasAnyConfiguredProvider(port) {
     return null;
   }
 }
-
-// src/lib/opencode/session-cleanup.ts
-var DURATION_UNIT_MS = {
-  s: 1e3,
-  m: 60 * 1e3,
-  h: 60 * 60 * 1e3,
-  d: 24 * 60 * 60 * 1e3
-};
-function parseDurationMs(input) {
-  const trimmed = input.trim();
+function sessionErrorReason(error2) {
+  const record = typeof error2 === "object" && error2 !== null ? error2 : null;
+  const data = record?.data;
+  const dataRecord = typeof data === "object" && data !== null ? data : null;
+  const rawReason = typeof dataRecord?.message === "string" && dataRecord.message || typeof record?.message === "string" && record.message || typeof error2 === "string" && error2 || typeof record?.name === "string" && record.name || "OpenCode reported a session error with no details";
+  const reason = rawReason.replace(/\s+/g, " ").trim().slice(0, 500);
+  return reason || "OpenCode reported a session error with no details";
+}
+function parseSessionErrorFrame(data) {
+  let parsed;
+  try {
+    parsed = JSON.parse(data);
+  } catch (error2) {
+    void error2;
+    return null;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const parsedRecord = parsed;
+  const payload = parsedRecord.payload;
+  const event = payload !== null && typeof payload === "object" && !Array.isArray(payload) ? payload : parsedRecord;
+  if (event.type !== "session.error") return null;
+  const properties = event.properties;
+  if (properties === null || typeof properties !== "object" || Array.isArray(properties)) {
+    return null;
+  }
+  const propertiesRecord = properties;
+  const sessionId = propertiesRecord.sessionID;
+  if (typeof sessionId !== "string" || sessionId.length === 0) return null;
+  return {
+    sessionId,
+    reason: sessionErrorReason(propertiesRecord.error)
+  };
+}
+async function readSessionErrorStream(port, options) {
+  let reader = null;
+  try {
+    const response = await fetch(`${opencodeBase(port)}/event`, {
+      headers: { accept: "text/event-stream" },
+      signal: options.signal
+    });
+    if (!response.ok || !response.body) {
+      return { reason: "unavailable", detail: `HTTP ${response.status}` };
+    }
+    reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    const processLine = (line) => {
+      const trimmed = line.trimEnd();
+      if (!trimmed.startsWith("data:")) return;
+      const event = parseSessionErrorFrame(trimmed.slice("data:".length).replace(/^ /, ""));
+      if (event) options.onSessionError(event);
+    };
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) return { reason: "ended" };
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) processLine(line);
+    }
+  } catch (err) {
+    if (options.signal.aborted) return { reason: "aborted" };
+    return {
+      reason: "unavailable",
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  } finally {
+    if (reader) void reader.cancel().catch(() => void 0);
+  }
+}
+async function reloadProviderCache(port) {
+  try {
+    const res = await timedFetch(`${opencodeBase(port)}/config`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({})
+    });
+    if (!res.ok) {
+      console.error(
+        `[reloadProviderCache] PATCH /config returned HTTP ${res.status} (port ${port})`
+      );
+    }
+  } catch (err) {
+    console.error(
+      `[reloadProviderCache] PATCH /config failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+
+// src/lib/opencode/session-cleanup.ts
+var DURATION_UNIT_MS = {
+  s: 1e3,
+  m: 60 * 1e3,
+  h: 60 * 60 * 1e3,
+  d: 24 * 60 * 60 * 1e3
+};
+function parseDurationMs(input) {
+  const trimmed = input.trim();
   const match = /^(\d+)([smhd])$/.exec(trimmed);
   if (!match) {
     throw new Error(
@@ -3285,11 +3699,11 @@ function resolveSessionCleanupConfig(flags, env = process.env) {
 }
 
 // src/lib/opencode/session-db-size.ts
-import { statSync as statSync3 } from "fs";
-import { join as join3 } from "path";
+import { statSync as statSync3 } from "node:fs";
+import { join as join4 } from "node:path";
 var LARGE_DB_THRESHOLD_BYTES = 268435456;
 function statSessionDbBytes(homeDir) {
-  const dbPath = join3(homeDir, ".local", "share", "opencode", "opencode.db");
+  const dbPath = join4(homeDir, ".local", "share", "opencode", "opencode.db");
   try {
     return statSync3(dbPath).size;
   } catch (err) {
@@ -3316,12 +3730,99 @@ function buildSessionStoreSizeWarning(input) {
   return null;
 }
 
+// src/lib/opencode/log-tail.ts
+import { statSync as statSync4 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join5 } from "node:path";
+import { open as open2, stat } from "node:fs/promises";
+var DEFAULT_POLL_INTERVAL_MS = 1e3;
+function resolveOpenCodeLogPath(homeDir = homedir3(), env = process.env) {
+  const dataDir = env.XDG_DATA_HOME || join5(homeDir, ".local", "share");
+  return join5(dataDir, "opencode", "log", "opencode.log");
+}
+function isEnoent(error2) {
+  return error2?.code === "ENOENT";
+}
+function reportFailure(operation, logPath, error2) {
+  console.error(
+    `[opencode-log-tail] ${operation} failed for ${logPath}: ${error2 instanceof Error ? error2.message : String(error2)}`
+  );
+}
+function tailOpenCodeLogFile(logPath, onChunk, opts = {}) {
+  const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  let offset = 0;
+  let inode = null;
+  let baselineReady = true;
+  try {
+    const initial = statSync4(logPath);
+    offset = initial.size;
+    inode = initial.ino;
+  } catch (error2) {
+    if (!isEnoent(error2)) {
+      reportFailure("initial stat", logPath, error2);
+      baselineReady = false;
+    }
+  }
+  let polling = false;
+  let stopped = false;
+  const poll = async () => {
+    if (polling || stopped) return;
+    polling = true;
+    try {
+      let current;
+      try {
+        current = await stat(logPath);
+      } catch (error2) {
+        if (!isEnoent(error2)) reportFailure("stat", logPath, error2);
+        return;
+      }
+      if (!baselineReady) {
+        offset = current.size;
+        inode = current.ino;
+        baselineReady = true;
+        return;
+      }
+      if (inode !== null && current.ino !== inode || current.size < offset) {
+        offset = 0;
+      }
+      inode = current.ino;
+      if (current.size === offset) return;
+      const length = current.size - offset;
+      const fh = await open2(logPath, "r");
+      try {
+        const buf = Buffer.alloc(length);
+        const { bytesRead } = await fh.read(buf, 0, length, offset);
+        offset += bytesRead;
+        if (bytesRead > 0) onChunk(buf.subarray(0, bytesRead));
+      } finally {
+        await fh.close();
+      }
+    } catch (error2) {
+      if (!isEnoent(error2)) reportFailure("poll", logPath, error2);
+    } finally {
+      polling = false;
+    }
+  };
+  const interval = setInterval(() => void poll(), pollIntervalMs);
+  void poll();
+  return {
+    stop: () => {
+      stopped = true;
+      clearInterval(interval);
+    }
+  };
+}
+
 // src/lib/opencode/session-db-reclaim.ts
-import { statSync as statSync4, statfsSync } from "fs";
-import { dirname as dirname3 } from "path";
+import { statSync as statSync5, statfsSync } from "node:fs";
+import { dirname as dirname4 } from "node:path";
+function errorMessage(error2) {
+  if (!(error2 instanceof Error)) return String(error2);
+  return error2.cause instanceof Error ? error2.cause.message : error2.message;
+}
 function insufficientSpaceReason(dbPath, requiredBytes) {
   try {
-    const fsStats = statfsSync(dirname3(dbPath));
+    const fsStats = statfsSync(dirname4(dbPath));
     const availableBytes = fsStats.bavail * fsStats.bsize;
     if (availableBytes < requiredBytes) {
       return `only ${availableBytes} bytes free, need ${requiredBytes} for a second copy`;
@@ -3344,17 +3845,17 @@ async function probeReclaimAvailability(input) {
   const { dbPath, requiredBytes } = input;
   let sqlite;
   try {
-    sqlite = await import("sqlite");
+    sqlite = await import("node:sqlite");
   } catch (err) {
-    console.warn(
-      `[probeReclaimAvailability] node:sqlite unavailable for ${dbPath}: ${err instanceof Error ? err.message : String(err)}`
-    );
-    return "sqlite-unavailable";
+    const detail = `Node ${process.version}: ${errorMessage(err)}`;
+    console.warn(`[probeReclaimAvailability] node:sqlite unavailable for ${dbPath}: ` + detail);
+    return { reason: "sqlite-unavailable", detail };
   }
   let autoVacuum = null;
   try {
     const db = new sqlite.DatabaseSync(dbPath, { readOnly: true });
     try {
+      db.exec("PRAGMA busy_timeout=5000");
       autoVacuum = db.prepare("PRAGMA auto_vacuum").get().auto_vacuum;
     } finally {
       db.close();
@@ -3365,23 +3866,25 @@ async function probeReclaimAvailability(input) {
     );
   }
   if (autoVacuum !== 0) return null;
-  return insufficientSpaceReason(dbPath, requiredBytes) !== null ? "insufficient-disk-space" : null;
+  return insufficientSpaceReason(dbPath, requiredBytes) !== null ? { reason: "insufficient-disk-space" } : null;
 }
 async function reclaimSessionDbSpace(input) {
   const { dbPath, maxPages, allowFullVacuum = true } = input;
   let sqlite;
   try {
-    sqlite = await import("sqlite");
+    sqlite = await import("node:sqlite");
   } catch (err) {
+    const detail = `Node ${process.version}: ${errorMessage(err)}`;
     console.warn(
-      `[reclaimSessionDbSpace] node:sqlite unavailable (need Node >=22.5, >=22.13 unflagged) for ${dbPath}: ${err instanceof Error ? err.message : String(err)}`
+      `[reclaimSessionDbSpace] node:sqlite unavailable (need Node >=22.5, >=22.13 unflagged) for ${dbPath}: ${detail}`
     );
-    return { ok: false, skipped: "sqlite-unavailable" };
+    return { ok: false, skipped: "sqlite-unavailable", detail };
   }
   const { DatabaseSync } = sqlite;
   let db;
   try {
     db = new DatabaseSync(dbPath);
+    db.exec("PRAGMA busy_timeout=5000");
     const autoVacuum = db.prepare("PRAGMA auto_vacuum").get().auto_vacuum;
     if (autoVacuum === 0) {
       if (!allowFullVacuum) {
@@ -3390,7 +3893,7 @@ async function reclaimSessionDbSpace(input) {
         );
         return { ok: false, skipped: "full-vacuum-blocked" };
       }
-      const fileBytesForGuard = statSync4(dbPath).size;
+      const fileBytesForGuard = statSync5(dbPath).size;
       const skipReason = insufficientSpaceReason(dbPath, fileBytesForGuard);
       if (skipReason !== null) {
         console.warn(
@@ -3418,10 +3921,12 @@ async function reclaimSessionDbSpace(input) {
     );
     return { ok: false, skipped: "auto-vacuum-not-applicable" };
   } catch (err) {
-    console.error(
-      `[reclaimSessionDbSpace] reclaim failed for ${dbPath}: ${err instanceof Error ? err.message : String(err)}`
-    );
-    return { ok: false, skipped: "reclaim-error" };
+    console.error(`[reclaimSessionDbSpace] reclaim failed for ${dbPath}: ` + errorMessage(err));
+    return {
+      ok: false,
+      skipped: "reclaim-error",
+      detail: errorMessage(err)
+    };
   } finally {
     db?.close();
   }
@@ -3462,7 +3967,6 @@ var StreamForwarder = class {
   handleFrame(frame) {
     switch (frame.type) {
       case "open":
-        this.callbacks.onOpen?.(frame.sid, frame.method, frame.path);
         void this.handleOpen(frame);
         break;
       case "req_data":
@@ -3498,12 +4002,21 @@ var StreamForwarder = class {
     const { sid, method, path, headers, has_body } = frame;
     const correlationId = headers?.[CORRELATION_ID_HEADER];
     const startedAt = Date.now();
+    if (path !== TUNNEL_DRAIN_PING_PATH && path !== TUNNEL_USAGE_REARM_PING_PATH) {
+      this.callbacks.onOpen?.(sid, method, path);
+    }
     if (path === TUNNEL_DRAIN_PING_PATH) {
       this.callbacks.onDrainPing?.();
       this.send({ type: "head", sid, status: 204, headers: {} });
       this.send({ type: "res_end", sid });
       return;
     }
+    if (path === TUNNEL_USAGE_REARM_PING_PATH) {
+      this.callbacks.onUsageRearmPing?.();
+      this.send({ type: "head", sid, status: 204, headers: {} });
+      this.send({ type: "res_end", sid });
+      return;
+    }
     if (process.env.DEBUG) {
       log("debug", "agent_request", {
         correlation_id: correlationId,
@@ -3648,7 +4161,8 @@ function connectTunnel(options) {
     onResponse,
     onInfo,
     onWarning,
-    onDrainPing
+    onDrainPing,
+    onUsageRearmPing
   } = options;
   const tunnelUrl = getTunnelUrlConfig();
   const url = `${tunnelUrl}/tunnel/${agentId}/connect`;
@@ -3660,7 +4174,8 @@ function connectTunnel(options) {
     });
     const forwarder = new StreamForwarder(ws, port, {
       onHead: () => onResponse?.(),
-      onDrainPing: () => onDrainPing?.()
+      onDrainPing: () => onDrainPing?.(),
+      onUsageRearmPing: () => onUsageRearmPing?.()
     });
     const connectionTimeout = setTimeout(() => {
       ws.close();
@@ -3703,8 +4218,8 @@ function connectTunnel(options) {
       try {
         message = JSON.parse(data.toString());
       } catch (error2) {
-        const errorMessage = error2 instanceof Error ? error2.message : "Unknown error";
-        onError?.(`Failed to handle message: ${errorMessage}`);
+        const errorMessage3 = error2 instanceof Error ? error2.message : "Unknown error";
+        onError?.(`Failed to handle message: ${errorMessage3}`);
         return;
       }
       if (isStreamFrame(message)) {
@@ -3821,6 +4336,7 @@ var RunnerConnection = class {
           onError: (error2) => events.onError?.(error2),
           onResponse: () => events.onResponse?.(),
           onDrainPing: () => events.onDrainPing?.(),
+          onUsageRearmPing: () => events.onUsageRearmPing?.(),
           onInfo: (message) => events.onInfo?.(message),
           onWarning: (message) => events.onWarning?.(message)
         });
@@ -3847,10 +4363,10 @@ var RunnerConnection = class {
 };
 
 // src/lib/tunnel/ready-marker.ts
-import { writeFileSync as writeFileSync2 } from "fs";
+import { writeFileSync as writeFileSync3 } from "node:fs";
 function writeTunnelReadyMarker(path, agentId) {
   try {
-    writeFileSync2(path, `${agentId}
+    writeFileSync3(path, `${agentId}
 `);
     return { ok: true };
   } catch (error2) {
@@ -3859,7 +4375,7 @@ function writeTunnelReadyMarker(path, agentId) {
 }
 
 // src/lib/replication.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn4 } from "node:child_process";
 function startSessionDbReplication(configPath) {
   return spawn4("litestream", ["replicate", "-config", configPath], {
     stdio: "inherit"
@@ -3875,7 +4391,7 @@ async function stopSessionDbReplication(child, timeoutMs) {
 }
 
 // src/lib/process-liveness.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -3890,7 +4406,7 @@ function isProcessAlive(pid) {
   }
   if (process.platform !== "linux") return true;
   try {
-    const status2 = readFileSync3(`/proc/${pid}/status`, "utf8");
+    const status2 = readFileSync4(`/proc/${pid}/status`, "utf8");
     return !/^State:\s+Z(?:\s|$)/m.test(status2);
   } catch (error2) {
     console.error(
@@ -3901,9 +4417,9 @@ function isProcessAlive(pid) {
 }
 
 // src/lib/openai-usage.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join6 } from "node:path";
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 var OPENCODE_AUTH_SEGMENTS = [".local", "share", "opencode", "auth.json"];
 var OpenAiUsageError = class extends Error {
@@ -3917,7 +4433,7 @@ function isLocalCredentialProblem2(err) {
 }
 function readOpenCodeChatGptCredentials() {
   try {
-    const raw = readFileSync4(join4(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
+    const raw = readFileSync5(join6(homedir4(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -3939,6 +4455,23 @@ function readOpenCodeChatGptCredentials() {
     return null;
   }
 }
+function parseChatGptIdentity(accessToken) {
+  const segments = accessToken.split(".");
+  if (segments.length !== 3) return null;
+  let payload;
+  try {
+    const parsed = JSON.parse(Buffer.from(segments[1], "base64url").toString("utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+    payload = parsed;
+  } catch {
+    return null;
+  }
+  const profile = payload["https://api.openai.com/profile"];
+  const auth = payload["https://api.openai.com/auth"];
+  const ownerEmail = typeof profile?.email === "string" ? profile.email.trim() || null : null;
+  const planType = typeof auth?.chatgpt_plan_type === "string" ? auth.chatgpt_plan_type.trim() || null : null;
+  return ownerEmail === null && planType === null ? null : { ownerEmail, planType, organizationName: null };
+}
 function toWindow2(headers, name) {
   const utilizationHeader = headers.get(`x-codex-${name}-used-percent`);
   const windowMinutesHeader = headers.get(`x-codex-${name}-window-minutes`);
@@ -4014,6 +4547,7 @@ async function getOpenAiUsage(port) {
       "credentials_expired"
     );
   }
+  const subscription = parseChatGptIdentity(credentials2.accessToken);
   const models = await resolveProbeModels(port);
   if (models.length === 0) {
     throw new OpenAiUsageError("No supported OpenAI probe model is available.", "no_probe_model");
@@ -4046,7 +4580,7 @@ async function getOpenAiUsage(port) {
             "no_usable_window"
           );
         }
-        return usage;
+        return { ...usage, subscription };
       }
       if (res.status === 401) {
         throw new OpenAiUsageError(
@@ -4118,13 +4652,6 @@ function resolveClaudeUsageReportingMode(flagValue, env) {
     envVar: "EVIDENT_CLAUDE_USAGE_REPORTING"
   });
 }
-function nextReportDelayMs(random = Math.random) {
-  return usageReportDelayMs(random);
-}
-var FIRST_REPORT_DELAY_MS = firstReportDelayMs();
-function claudeUsageFailureLogLevel(consecutiveFailures) {
-  return usageReportFailureLogLevel(consecutiveFailures);
-}
 
 // src/lib/openai-usage-reporting.ts
 function resolveOpenAiUsageReportingMode(flagValue, env) {
@@ -4161,8 +4688,8 @@ function resolveResourceUsageReportingEnabled(flagValue, env) {
 }
 
 // src/lib/resource-usage.ts
-import { cpus, totalmem, freemem } from "os";
-import { statfsSync as statfsSync2 } from "fs";
+import { cpus, totalmem, freemem } from "node:os";
+import { statfsSync as statfsSync2 } from "node:fs";
 
 // src/lib/ecs-task-metadata.ts
 var ECS_METADATA_TIMEOUT_MS = 2e3;
@@ -4247,58 +4774,97 @@ function readDisk(homeDir) {
     };
   }
 }
-function createResourceUsageCollector(homeDir) {
-  let previous = readCpuSample();
-  return async () => {
+var CPU_PEAK_WINDOW_MS = 6e4;
+var CPU_PEAK_WINDOW_SAMPLE_COUNT = 4;
+var CPU_PEAK_SAMPLE_INTERVAL_MS = CPU_PEAK_WINDOW_MS / CPU_PEAK_WINDOW_SAMPLE_COUNT;
+function createCpuPeakSampler() {
+  const sampleHistory = new Array(CPU_PEAK_WINDOW_SAMPLE_COUNT);
+  sampleHistory[0] = readCpuSample();
+  let nextSampleIndex = 1;
+  let sampleCount = 1;
+  let peak = null;
+  const timer = setInterval(() => {
     const current = readCpuSample();
-    const hostCpuPercent = cpuPercentBetween(previous, current);
-    const hostCpuCount = cpus().length;
-    previous = current;
-    const disk = readDisk(homeDir);
-    const opencodeDbBytes = statSessionDbBytes(homeDir);
-    const { limits, warning: ecsWarning } = await readEcsTaskLimits(process.env);
-    const warnings = [];
-    if (disk.warning) warnings.push(disk.warning);
-    if (ecsWarning) warnings.push(ecsWarning);
-    let cpuPercent = hostCpuPercent;
-    let cpuCount = hostCpuCount;
-    let memoryTotalBytes = totalmem();
-    let memoryAvailableBytes = freemem();
-    if (limits !== null) {
-      cpuCount = limits.cpuCount;
-      memoryTotalBytes = limits.memoryTotalBytes;
-      memoryAvailableBytes = clamp(
-        limits.memoryTotalBytes - (totalmem() - freemem()),
-        0,
-        limits.memoryTotalBytes
-      );
-      cpuPercent = hostCpuPercent === null ? null : clamp(round2(hostCpuPercent * hostCpuCount / limits.cpuCount), 0, 100);
+    const sampleFromWindowAgo = sampleCount === CPU_PEAK_WINDOW_SAMPLE_COUNT ? sampleHistory[nextSampleIndex] : void 0;
+    if (sampleFromWindowAgo !== void 0) {
+      const percentage = cpuPercentBetween(sampleFromWindowAgo, current);
+      if (percentage !== null) {
+        peak = peak === null ? percentage : Math.max(peak, percentage);
+      }
     }
-    return {
-      usage: {
-        cpuPercent,
-        cpuCount,
-        memoryTotalBytes,
-        memoryAvailableBytes,
-        diskTotalBytes: disk.totalBytes,
-        diskFreeBytes: disk.freeBytes,
-        opencodeDbBytes
-      },
-      warnings
-    };
+    sampleHistory[nextSampleIndex] = current;
+    nextSampleIndex = (nextSampleIndex + 1) % CPU_PEAK_WINDOW_SAMPLE_COUNT;
+    sampleCount = Math.min(sampleCount + 1, CPU_PEAK_WINDOW_SAMPLE_COUNT);
+  }, CPU_PEAK_SAMPLE_INTERVAL_MS);
+  return {
+    takeAndReset: () => {
+      const currentPeak = peak;
+      peak = null;
+      return currentPeak;
+    },
+    stop: () => clearInterval(timer)
+  };
+}
+function createResourceUsageCollector(homeDir) {
+  let previous = readCpuSample();
+  const cpuPeakSampler = createCpuPeakSampler();
+  return {
+    collect: async () => {
+      const current = readCpuSample();
+      const hostCpuPercent = cpuPercentBetween(previous, current);
+      const hostCpuPeakPercent = cpuPeakSampler.takeAndReset();
+      const hostCpuCount = cpus().length;
+      previous = current;
+      const disk = readDisk(homeDir);
+      const opencodeDbBytes = statSessionDbBytes(homeDir);
+      const { limits, warning: ecsWarning } = await readEcsTaskLimits(process.env);
+      const warnings = [];
+      if (disk.warning) warnings.push(disk.warning);
+      if (ecsWarning) warnings.push(ecsWarning);
+      let cpuPercent = hostCpuPercent;
+      let cpuPeakPercent = hostCpuPeakPercent;
+      let cpuCount = hostCpuCount;
+      let memoryTotalBytes = totalmem();
+      let memoryAvailableBytes = freemem();
+      if (limits !== null) {
+        cpuCount = limits.cpuCount;
+        memoryTotalBytes = limits.memoryTotalBytes;
+        memoryAvailableBytes = clamp(
+          limits.memoryTotalBytes - (totalmem() - freemem()),
+          0,
+          limits.memoryTotalBytes
+        );
+        cpuPercent = hostCpuPercent === null ? null : clamp(round2(hostCpuPercent * hostCpuCount / limits.cpuCount), 0, 100);
+        cpuPeakPercent = hostCpuPeakPercent === null ? null : clamp(round2(hostCpuPeakPercent * hostCpuCount / limits.cpuCount), 0, 100);
+      }
+      return {
+        usage: {
+          cpuPercent,
+          cpuPeakPercent,
+          cpuCount,
+          memoryTotalBytes,
+          memoryAvailableBytes,
+          diskTotalBytes: disk.totalBytes,
+          diskFreeBytes: disk.freeBytes,
+          opencodeDbBytes
+        },
+        warnings
+      };
+    },
+    stop: cpuPeakSampler.stop
   };
 }
 
 // src/lib/channels/driver.ts
-import { homedir as homedir4 } from "os";
+import { homedir as homedir5 } from "node:os";
 
 // src/lib/runner-file-sync.ts
-import { join as join6 } from "path";
+import { join as join8 } from "node:path";
 
 // src/lib/file-push.ts
-import { randomUUID } from "crypto";
-import { chmod, mkdir, open as open2, realpath, rename, unlink } from "fs/promises";
-import { basename, dirname as dirname4, isAbsolute, join as join5, relative, resolve as resolve2, sep } from "path";
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, open as open3, realpath, rename, unlink } from "node:fs/promises";
+import { basename, dirname as dirname5, isAbsolute, join as join7, relative, resolve as resolve2, sep } from "node:path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
 async function writePushedFile(request) {
@@ -4329,9 +4895,9 @@ async function writePushedFile(request) {
   }
   try {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
-      dirname4(candidate)
+      dirname5(candidate)
     );
-    const realTarget = join5(existingAncestor, ...missingSegments, basename(candidate));
+    const realTarget = join7(existingAncestor, ...missingSegments, basename(candidate));
     const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
@@ -4341,8 +4907,8 @@ async function writePushedFile(request) {
     }
     if (missingSegments.length > 0) {
       await createMissingDirectories(existingAncestor, missingSegments);
-      const realParent = await realpath(dirname4(realTarget));
-      if (realParent !== dirname4(realTarget) || !contains(allowedDirectory, realTarget)) {
+      const realParent = await realpath(dirname5(realTarget));
+      if (realParent !== dirname5(realTarget) || !contains(allowedDirectory, realTarget)) {
         return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
           path: realTarget,
           bytes,
@@ -4367,7 +4933,7 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join5(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join7(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
@@ -4385,7 +4951,7 @@ async function resolveNearestExistingAncestor(directory) {
     try {
       return { existingAncestor: await realpath(current), missingSegments };
     } catch (err) {
-      const parent = dirname4(current);
+      const parent = dirname5(current);
       if (err.code !== "ENOENT" || parent === current) {
         throw err;
       }
@@ -4440,16 +5006,16 @@ function contains(realDirectory, realTarget) {
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join5(current, segment);
+    current = join7(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join5(dirname4(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join7(dirname5(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
-    handle = await open2(temporaryPath, "wx", FILE_MODE);
+    handle = await open3(temporaryPath, "wx", FILE_MODE);
     await handle.writeFile(content);
     await handle.chmod(FILE_MODE);
     await handle.close();
@@ -4576,12 +5142,12 @@ var NOT_APPLIED = {
   opencodeAuthApplied: false
 };
 function isClaudeCredentialPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join6(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join6(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join8(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join8(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
 }
 function isOpenCodeAuthPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join6(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join6(homeDir, ...OPENCODE_AUTH_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join8(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join8(homeDir, ...OPENCODE_AUTH_SEGMENTS);
 }
 async function applyOne(options, file) {
   const label = `${file.id.slice(0, 8)} (${file.path})`;
@@ -4741,6 +5307,10 @@ var DEFAULT_RETRY_POLICY = {
   baseDelayMs: 500,
   maxDelayMs: 3e4
 };
+var SUBAGENT_TELEMETRY_FETCH_TIMEOUT_MS = 2e3;
+var SESSION_ERROR_STREAM_HEALTHY_MS = 5e3;
+var SESSION_ERROR_BUFFER_TTL_MS = SESSION_ERROR_STREAM_HEALTHY_MS;
+var MAX_BUFFERED_SESSION_ERRORS = 256;
 var DEFAULT_PAUSED_POLL_INTERVAL_MS = 2e3;
 var DEFAULT_PAUSED_MAX_WAIT_MS = 10 * 60 * 1e3;
 var DEFAULT_STUCK_QUEUED_MS = 6e4;
@@ -4881,6 +5451,17 @@ var ChannelDriver = class _ChannelDriver {
    * message; it is removed once its in-flight set empties.
    */
   watchers = /* @__PURE__ */ new Map();
+  sessionErrorStream = null;
+  /**
+   * Session-error failures currently being reported; entries are empty at rest
+   * because each handoff deletes its id in `finally`.
+   */
+  sessionErrorHandled = /* @__PURE__ */ new Set();
+  /**
+   * Session errors that arrived before their dispatch was registered. Bounded FIFO
+   * with a short TTL so an unmatched session cannot retain an event indefinitely.
+   */
+  bufferedSessionErrors = /* @__PURE__ */ new Map();
   /**
    * AUTHORITATIVE local dedup (WI-3): Evident message ids that have been
    * dispatched and are still in-flight. A message in this set is never
@@ -5064,6 +5645,13 @@ var ChannelDriver = class _ChannelDriver {
    * no watcher) can resolve the title.
    */
   sessionTitles = /* @__PURE__ */ new Map();
+  /** One best-effort terminal subagent collection per Evident message id. */
+  subagentInvocationCollections = /* @__PURE__ */ new Map();
+  /**
+   * Early snapshots are only liveness hints; they must not become the terminal
+   * collection when the task parts or child transcript have advanced.
+   */
+  subagentInvocationPrefetches = /* @__PURE__ */ new Map();
   /** Serialises drains so a reconnect during a drain doesn't double-process. */
   draining = false;
   /**
@@ -5108,6 +5696,7 @@ var ChannelDriver = class _ChannelDriver {
    * and stops opencode.
    */
   stopped = false;
+  recycleRequestedFlag = false;
   constructor(config) {
     this.agentId = config.agentId;
     this.port = config.port;
@@ -5127,7 +5716,7 @@ var ChannelDriver = class _ChannelDriver {
     this.stuckQueuedMs = config.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
     this.now = config.now ?? (() => Date.now());
     this.fileSyncDirectories = config.fileSyncDirectories ?? [];
-    this.homeDir = config.homeDir ?? homedir4();
+    this.homeDir = config.homeDir ?? homedir5();
     this.maxActiveSessions = config.maxActiveSessions;
     this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
     this.wedgeWarningIntervalMs = config.wedgeWarningIntervalMs ?? WEDGE_WARNING_INTERVAL_MS;
@@ -5213,6 +5802,9 @@ var ChannelDriver = class _ChannelDriver {
     let dispatched = 0;
     try {
       const conversations = await this.getPendingConversations();
+      if (this.recycleRequestedFlag) {
+        this.stop();
+      }
       if (conversations.length > 0) {
         const total = conversations.reduce((sum, c) => sum + (c.pending_message_count ?? 0), 0);
         this.log({
@@ -5274,6 +5866,21 @@ var ChannelDriver = class _ChannelDriver {
     }
     return ids;
   }
+  /**
+   * OpenCode user-message ids tracked for other Evident messages in a session.
+   * Excluding this message makes an unattributed later row fail safe; a missing
+   * watcher yields no attributions, per `hasLaterSiblingTurnStarted`'s docblock.
+   */
+  siblingOpencodeMessageIds(watcher, ownEvidentMessageId) {
+    const ids = /* @__PURE__ */ new Set();
+    if (!watcher) return ids;
+    for (const inFlight of watcher.inFlight.values()) {
+      if (inFlight.evidentMessageId !== ownEvidentMessageId) {
+        ids.add(inFlight.opencodeMessageId);
+      }
+    }
+    return ids;
+  }
   /**
    * File-pull work, for `run.ts`'s idle accounting (#559).
    *
@@ -5340,6 +5947,16 @@ var ChannelDriver = class _ChannelDriver {
    */
   stop() {
     this.stopped = true;
+    this.sessionErrorStream?.abort.abort();
+    this.sessionErrorStream = null;
+  }
+  /**
+   * The server clears this request when a new MicroVM identity is recorded, so a
+   * same-VM tunnel reconnect does not consume it. This is a plain read rather
+   * than a consume; `run.ts` guards the action once-only.
+   */
+  get recycleRequested() {
+    return this.recycleRequestedFlag;
   }
   /**
    * Wait (up to `timeoutMs`) for in-flight watcher work to settle during a
@@ -5406,6 +6023,7 @@ var ChannelDriver = class _ChannelDriver {
    */
   async processConversation(conv) {
     const { sessionId, refusedSessionId, created: sessionCreated } = await this.ensureSession(conv);
+    this.ensureSessionErrorStream();
     const messages = await this.getPendingMessages(conv.id);
     let dispatched = 0;
     let skippedAlreadyDispatched = 0;
@@ -5478,7 +6096,7 @@ var ChannelDriver = class _ChannelDriver {
           this.signalDispatchNotStarted(conv, message, "session_existence_unknown");
           break;
         }
-        const errorMessage = err instanceof Error ? err.message : String(err);
+        const errorMessage3 = err instanceof Error ? err.message : String(err);
         this.sessions.delete(conv.id);
         this.supersede(conv.id, sessionId);
         this.log({
@@ -5487,7 +6105,7 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
+        await this.markFailed(conv.id, message.id, null, errorMessage3).catch((markErr) => {
           this.log({
             level: "warn",
             message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
@@ -5498,7 +6116,7 @@ var ChannelDriver = class _ChannelDriver {
         });
         this.log({
           level: "error",
-          message: `Message ${message.id.slice(0, 8)} dispatch failed: ${errorMessage}`,
+          message: `Message ${message.id.slice(0, 8)} dispatch failed: ${errorMessage3}`,
           conversation_id: conv.id,
           message_id: message.id
         });
@@ -5519,14 +6137,14 @@ var ChannelDriver = class _ChannelDriver {
         this.unconfirmedDispatchFailures.delete(message.id);
         this.sessions.delete(conv.id);
         this.supersede(conv.id, sessionId);
-        const errorMessage = `OpenCode accepted this message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        const errorMessage3 = `OpenCode accepted this message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
         this.log({
           level: "error",
-          message: errorMessage,
+          message: errorMessage3,
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
+        await this.markFailed(conv.id, message.id, null, errorMessage3).catch((markErr) => {
           this.log({
             level: "warn",
             message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
@@ -5752,6 +6370,23 @@ var ChannelDriver = class _ChannelDriver {
     if (state === "running" || state === "queued") {
       const ongoing = await isSessionOngoing(this.port, sessionId);
       if (ongoing === true) {
+        if (state === "queued") {
+          const siblingOcIds = this.siblingOpencodeMessageIds(
+            this.watchers.get(sessionId),
+            message.id
+          );
+          if (hasLaterSiblingTurnStarted(messages, ocId ?? "", siblingOcIds)) {
+            this.log({
+              level: "warn",
+              message: `Re-drive: OpenCode already served a later, different Evident message's turn in session ${sessionId.slice(0, 8)} while message ${message.id.slice(0, 8)} produced no reply \u2014 re-dispatching instead of reattaching to someone else's turn`,
+              conversation_id: conv.id,
+              message_id: message.id
+            });
+            this.clearRedriveUnresolved(message.id);
+            void this.postSignal(conv.id, message.id, "redrive_redispatched");
+            return "dispatch";
+          }
+        }
         return this.reattachRedrive(conv, sessionId, message, ocId);
       }
       if (ongoing === false) {
@@ -5841,16 +6476,37 @@ var ChannelDriver = class _ChannelDriver {
       if (state === "done") {
         const title = await this.resolveSessionTitle(sessionId, conv.id);
         const usage = messageUsage(messages, ocId ?? "");
+        const usageAgentName = this.usageAgentName(messages, ocId ?? "");
+        const subagentInvocations = await this.resolveSubagentInvocations(
+          messages,
+          ocId ?? "",
+          message.id
+        );
         this.log({
           level: "info",
           message: `Re-drive: message ${message.id.slice(0, 8)} completed while its row was wrongly reclaimed to pending \u2014 marking done instead of re-dispatching`,
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markDone(conv.id, message.id, sessionId, ocId, title, usage);
+        await this.markDone(
+          conv.id,
+          message.id,
+          sessionId,
+          ocId,
+          title,
+          usage,
+          usageAgentName,
+          subagentInvocations
+        );
       } else {
         const error2 = messageError(messages, ocId ?? "") ?? void 0;
         const usage = messageUsage(messages, ocId ?? "");
+        const usageAgentName = this.usageAgentName(messages, ocId ?? "");
+        const subagentInvocations = await this.resolveSubagentInvocations(
+          messages,
+          ocId ?? "",
+          message.id
+        );
         const failure = await this.classifyModelAuthFailure(messages, ocId ?? "");
         this.log({
           level: "error",
@@ -5858,7 +6514,19 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markFailed(conv.id, message.id, sessionId, error2, usage, failure);
+        await this.markFailed(
+          conv.id,
+          message.id,
+          sessionId,
+          error2,
+          usage,
+          failure,
+          usageAgentName,
+          subagentInvocations
+        );
+      }
+      if (ocId !== null) {
+        await this.reportSubagentAuthFailures(conv.id, ocId, message.id, messages);
       }
     } catch (err) {
       if (err instanceof ChannelAuthError) throw err;
@@ -6399,6 +7067,24 @@ var ChannelDriver = class _ChannelDriver {
       ambiguousPinnedSinceMs: 0,
       ambiguousResolved: false
     });
+    const buffered = this.bufferedSessionErrors.get(sessionId);
+    if (!buffered) return;
+    this.bufferedSessionErrors.delete(sessionId);
+    if (this.now() - buffered.receivedAt < SESSION_ERROR_BUFFER_TTL_MS) {
+      this.handleSessionError(buffered.event);
+    }
+  }
+  bufferSessionError(event) {
+    this.bufferedSessionErrors.delete(event.sessionId);
+    this.bufferedSessionErrors.set(event.sessionId, {
+      event,
+      receivedAt: this.now()
+    });
+    while (this.bufferedSessionErrors.size > MAX_BUFFERED_SESSION_ERRORS) {
+      const oldest = this.bufferedSessionErrors.keys().next().value;
+      if (typeof oldest !== "string") break;
+      this.bufferedSessionErrors.delete(oldest);
+    }
   }
   /**
    * Build a fresh `SessionWatcher`. Seeds `lastTickAt`/`lastObservedTickAt`
@@ -6603,6 +7289,7 @@ var ChannelDriver = class _ChannelDriver {
   ensureWatcherRunning(sessionId) {
     const watcher = this.watchers.get(sessionId);
     if (!watcher) return;
+    this.ensureSessionErrorStream();
     if (watcher.loop) return;
     if (watcher.inFlight.size === 0) {
       this.watchers.delete(sessionId);
@@ -6618,6 +7305,154 @@ var ChannelDriver = class _ChannelDriver {
     });
     watcher.loop = loop;
   }
+  ensureSessionErrorStream() {
+    if (this.sessionErrorStream || this.stopped) return;
+    const abort = new AbortController();
+    const loop = this.runSessionErrorStream(abort.signal);
+    this.sessionErrorStream = { abort, loop };
+  }
+  async runSessionErrorStream(signal) {
+    let attempt = 0;
+    let warned = false;
+    while (!this.stopped && !signal.aborted) {
+      const openedAt = this.now();
+      try {
+        const outcome = await readSessionErrorStream(this.port, {
+          signal,
+          onSessionError: (event) => this.handleSessionError(event)
+        });
+        if (outcome.reason === "aborted" || signal.aborted) return;
+        const healthy = this.now() - openedAt >= SESSION_ERROR_STREAM_HEALTHY_MS;
+        if (outcome.reason === "unavailable" || outcome.reason === "ended") {
+          if (!healthy) {
+            const detail = outcome.reason === "unavailable" ? outcome.detail : "stream ended";
+            this.log({
+              level: warned ? "debug" : "warn",
+              message: `OpenCode session-error stream ${warned ? "still unavailable" : "unavailable"} (${detail}); transcript polling remains the evidence path`
+            });
+            warned = true;
+          }
+        }
+        if (healthy) {
+          if (warned) {
+            this.log({
+              level: "info",
+              message: "OpenCode session-error stream reconnected; transcript polling remains the evidence path"
+            });
+            warned = false;
+          }
+          attempt = 0;
+        } else {
+          attempt += 1;
+        }
+        if (this.stopped || signal.aborted) return;
+        await this.sleep(backoffDelay(healthy ? 0 : attempt - 1, this.retry));
+      } catch (err) {
+        if (this.stopped || signal.aborted) return;
+        this.log({
+          level: "error",
+          message: `OpenCode session-error stream failed unexpectedly: ${err instanceof Error ? err.message : String(err)}`
+        });
+        const healthy = this.now() - openedAt >= SESSION_ERROR_STREAM_HEALTHY_MS;
+        const delayAttempt = healthy ? 0 : attempt;
+        attempt = healthy ? 0 : attempt + 1;
+        try {
+          await this.sleep(backoffDelay(delayAttempt, this.retry));
+        } catch (sleepErr) {
+          this.log({
+            level: "error",
+            message: `OpenCode session-error stream backoff failed unexpectedly: ${sleepErr instanceof Error ? sleepErr.message : String(sleepErr)}`
+          });
+        }
+      }
+    }
+  }
+  handleSessionError(event) {
+    try {
+      const watcher = this.watchers.get(event.sessionId);
+      if (!watcher) {
+        this.bufferSessionError(event);
+        this.log({
+          level: "debug",
+          message: `Ignoring session error for unknown session ${event.sessionId.slice(0, 8)}`
+        });
+        return;
+      }
+      if ([...watcher.inFlight.values()].some((message) => message.started && !message.done)) {
+        this.log({
+          level: "debug",
+          message: `A turn is already running in session ${event.sessionId.slice(0, 8)} \u2014 deferring to transcript polling`,
+          conversation_id: watcher.conv.id
+        });
+        return;
+      }
+      const inFlight = [...watcher.inFlight.values()].filter((message) => !message.started && !message.done).sort((a, b) => a.dispatchedAt - b.dispatchedAt)[0];
+      if (!inFlight) {
+        this.bufferSessionError(event);
+        this.log({
+          level: "debug",
+          message: `No queued in-flight turn to correlate with session error in ${event.sessionId.slice(0, 8)}`,
+          conversation_id: watcher.conv.id
+        });
+        return;
+      }
+      if (this.sessionErrorHandled.has(inFlight.evidentMessageId)) return;
+      this.sessionErrorHandled.add(inFlight.evidentMessageId);
+      void this.failFromSessionError(watcher, event, inFlight);
+    } catch (err) {
+      this.log({
+        level: "error",
+        message: `Failed to handle OpenCode session error for ${event.sessionId.slice(0, 8)}: ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
+  }
+  async failFromSessionError(watcher, event, inFlight) {
+    try {
+      const messages = await getSessionMessages(this.port, event.sessionId);
+      const state = messageRunState(messages, inFlight.opencodeMessageId);
+      if (state !== "queued") {
+        this.log({
+          level: "debug",
+          message: `Session error for message ${inFlight.evidentMessageId.slice(0, 8)} observed state ${state}; leaving it to transcript polling`,
+          conversation_id: watcher.conv.id,
+          message_id: inFlight.evidentMessageId
+        });
+        return;
+      }
+      this.log({
+        level: "error",
+        message: `OpenCode could not run message ${inFlight.evidentMessageId.slice(0, 8)} in session ${event.sessionId.slice(0, 8)}: ${event.reason}`,
+        conversation_id: watcher.conv.id,
+        message_id: inFlight.evidentMessageId
+      });
+      await this.markFailed(
+        watcher.conv.id,
+        inFlight.evidentMessageId,
+        event.sessionId,
+        `OpenCode could not run this turn: ${event.reason}`
+      );
+      inFlight.done = true;
+      this.removeInFlight(watcher, inFlight.evidentMessageId);
+    } catch (err) {
+      if (err instanceof ChannelAuthError) {
+        this.log({
+          level: "warn",
+          message: `OpenCode session error could not mark message ${inFlight.evidentMessageId.slice(0, 8)} failed because authentication failed: ${err.message}; leaving it to transcript polling / the existing give-up path`,
+          conversation_id: watcher.conv.id,
+          message_id: inFlight.evidentMessageId
+        });
+      } else {
+        this.log({
+          level: "warn",
+          message: `OpenCode session error could not mark message ${inFlight.evidentMessageId.slice(0, 8)} failed: ${err instanceof Error ? err.message : String(err)}; leaving it to transcript polling / the existing give-up path`,
+          conversation_id: watcher.conv.id,
+          message_id: inFlight.evidentMessageId
+        });
+      }
+    } finally {
+      this.sessionErrorHandled.delete(inFlight.evidentMessageId);
+    }
+  }
   /**
    * The per-session polling loop (WI-3). Once per tick it:
    *   1. polls `GET /session/:id/message` once and, per in-flight message,
@@ -6730,6 +7565,21 @@ var ChannelDriver = class _ChannelDriver {
     const conv = watcher.conv;
     const state = messageRunState(messages, inFlight.opencodeMessageId);
     const id = inFlight.evidentMessageId;
+    if (messages && collectTaskCalls(messages, inFlight.opencodeMessageId).length > 0 && !this.subagentInvocationPrefetches.has(id)) {
+      void this.resolveSubagentInvocations(
+        messages,
+        inFlight.opencodeMessageId,
+        id,
+        "prefetch"
+      ).catch((err) => {
+        this.log({
+          level: "warn",
+          message: `Best-effort subagent usage prefetch failed for message ${id.slice(0, 8)} \u2014 omitting invocation telemetry: ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: conv.id,
+          message_id: id
+        });
+      });
+    }
     if (openQuestions.has(id)) inFlight.pausedOnQuestion = true;
     else if (questionsPolledOk) inFlight.pausedOnQuestion = false;
     if (openPermissions.has(id)) inFlight.pausedOnPermission = true;
@@ -6783,6 +7633,12 @@ var ChannelDriver = class _ChannelDriver {
           message_id: inFlight.evidentMessageId
         });
         const usage = messageUsage(messages, inFlight.opencodeMessageId);
+        const usageAgentName = this.usageAgentName(messages ?? [], inFlight.opencodeMessageId);
+        const subagentInvocations = await this.resolveSubagentInvocations(
+          messages,
+          inFlight.opencodeMessageId,
+          inFlight.evidentMessageId
+        );
         const failure = await this.classifyModelAuthFailure(messages, inFlight.opencodeMessageId);
         try {
           await this.markFailed(
@@ -6791,7 +7647,9 @@ var ChannelDriver = class _ChannelDriver {
             sessionId,
             error2,
             usage,
-            failure
+            failure,
+            usageAgentName,
+            subagentInvocations
           );
         } catch (err) {
           if (err instanceof ChannelAuthError) throw err;
@@ -6824,13 +7682,21 @@ var ChannelDriver = class _ChannelDriver {
           return;
         }
         inFlight.done = true;
+        await this.reportSubagentAuthFailures(
+          watcher.conv.id,
+          inFlight.opencodeMessageId,
+          inFlight.evidentMessageId,
+          messages
+        );
       }
       this.removeInFlight(watcher, inFlight.evidentMessageId);
       return;
     }
+    const siblingOcIds = this.siblingOpencodeMessageIds(watcher, inFlight.evidentMessageId);
+    const skippedByOpencode = state === "queued" && hasLaterSiblingTurnStarted(messages, inFlight.opencodeMessageId, siblingOcIds);
     const pastStuckBound = this.now() - inFlight.dispatchedAt >= this.stuckQueuedMs;
     const sessionIdle = state === "queued" && !hasRunningAssistantExcept(messages, inFlight.opencodeMessageId);
-    if (state === "queued" && pastStuckBound && sessionIdle && !inFlight.stuckReported) {
+    if (state === "queued" && pastStuckBound && (sessionIdle || skippedByOpencode) && !inFlight.stuckReported) {
       inFlight.stuckReported = true;
       void this.postSignal(conv.id, inFlight.evidentMessageId, "stuck_queued", {
         stuck_for_ms: this.now() - inFlight.dispatchedAt
@@ -6991,7 +7857,7 @@ var ChannelDriver = class _ChannelDriver {
     const hasActivelyRunningSibling = [...watcher.inFlight.values()].some(
       (sib) => sib.evidentMessageId !== inFlight.evidentMessageId && messageRunState(messages, sib.opencodeMessageId) === "running" && !siblingPaused(sib)
     );
-    const queuedBehindRunningSibling = state === "queued" && hasActivelyRunningSibling;
+    const queuedBehindRunningSibling = state === "queued" && hasActivelyRunningSibling && !skippedByOpencode;
     if (!activelyRunning && !queuedBehindRunningSibling && this.now() >= inFlight.deadline) {
       this.log({
         level: "debug",
@@ -7026,6 +7892,12 @@ var ChannelDriver = class _ChannelDriver {
       });
       const title = await this.resolveSessionTitle(sessionId, watcher.conv.id);
       const usage = messageUsage(messages, inFlight.opencodeMessageId);
+      const usageAgentName = this.usageAgentName(messages ?? [], inFlight.opencodeMessageId);
+      const subagentInvocations = await this.resolveSubagentInvocations(
+        messages,
+        inFlight.opencodeMessageId,
+        inFlight.evidentMessageId
+      );
       try {
         await this.markDone(
           conv.id,
@@ -7033,7 +7905,9 @@ var ChannelDriver = class _ChannelDriver {
           sessionId,
           inFlight.opencodeMessageId,
           title,
-          usage
+          usage,
+          usageAgentName,
+          subagentInvocations
         );
       } catch (err) {
         if (err instanceof ChannelAuthError) throw err;
@@ -7066,6 +7940,12 @@ var ChannelDriver = class _ChannelDriver {
         return;
       }
       inFlight.done = true;
+      await this.reportSubagentAuthFailures(
+        watcher.conv.id,
+        inFlight.opencodeMessageId,
+        inFlight.evidentMessageId,
+        messages
+      );
     }
     this.removeInFlight(watcher, inFlight.evidentMessageId);
   }
@@ -7206,6 +8086,12 @@ var ChannelDriver = class _ChannelDriver {
     if (state === "failed" && !restartAborted) {
       const error2 = messageError(messages, ocId ?? "") ?? void 0;
       const usage = messageUsage(messages, ocId ?? "");
+      const usageAgentName = this.usageAgentName(messages, ocId ?? "");
+      const subagentInvocations = await this.resolveSubagentInvocations(
+        messages,
+        ocId ?? "",
+        row.id
+      );
       const failure = await this.classifyModelAuthFailure(messages, ocId ?? "");
       this.log({
         level: "error",
@@ -7214,7 +8100,16 @@ var ChannelDriver = class _ChannelDriver {
         message_id: row.id
       });
       try {
-        await this.markFailed(row.conversation_id, row.id, sessionId, error2, usage, failure);
+        await this.markFailed(
+          row.conversation_id,
+          row.id,
+          sessionId,
+          error2,
+          usage,
+          failure,
+          usageAgentName,
+          subagentInvocations
+        );
       } catch (err) {
         if (err instanceof ChannelAuthError) throw err;
         if (err instanceof ChannelTerminalError) {
@@ -7236,6 +8131,7 @@ var ChannelDriver = class _ChannelDriver {
         });
         return;
       }
+      await this.reportSubagentAuthFailures(row.conversation_id, ocId ?? "", row.id, messages);
       this.dontRedispatch.delete(row.id);
       void this.postSignal(row.conversation_id, row.id, "readopt_failed");
       return;
@@ -7375,7 +8271,22 @@ var ChannelDriver = class _ChannelDriver {
     try {
       const title = await this.resolveSessionTitle(sessionId, row.conversation_id);
       const usage = messageUsage(messages, ocId ?? "");
-      await this.markDone(row.conversation_id, row.id, sessionId, ocId, title, usage);
+      const usageAgentName = this.usageAgentName(messages, ocId ?? "");
+      const subagentInvocations = await this.resolveSubagentInvocations(
+        messages,
+        ocId ?? "",
+        row.id
+      );
+      await this.markDone(
+        row.conversation_id,
+        row.id,
+        sessionId,
+        ocId,
+        title,
+        usage,
+        usageAgentName,
+        subagentInvocations
+      );
     } catch (err) {
       if (err instanceof ChannelAuthError) throw err;
       if (err instanceof ChannelTerminalError) {
@@ -7397,6 +8308,9 @@ var ChannelDriver = class _ChannelDriver {
       });
       return;
     }
+    if (ocId !== null) {
+      await this.reportSubagentAuthFailures(row.conversation_id, ocId, row.id, messages);
+    }
     this.dontRedispatch.delete(row.id);
     void this.postSignal(row.conversation_id, row.id, "readopt_done");
   }
@@ -7490,14 +8404,14 @@ var ChannelDriver = class _ChannelDriver {
         this.unconfirmedDispatchFailures.delete(row.id);
         this.sessions.delete(readoptConv.id);
         this.supersede(readoptConv.id, sessionId);
-        const errorMessage = `OpenCode accepted this re-dispatched message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        const errorMessage3 = `OpenCode accepted this re-dispatched message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
         this.log({
           level: "error",
-          message: errorMessage,
+          message: errorMessage3,
           conversation_id: row.conversation_id,
           message_id: row.id
         });
-        await this.markFailed(row.conversation_id, row.id, null, errorMessage).catch((markErr) => {
+        await this.markFailed(row.conversation_id, row.id, null, errorMessage3).catch((markErr) => {
           this.log({
             level: "warn",
             message: `markFailed PATCH for message ${row.id.slice(0, 8)} (conversation ${row.conversation_id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
@@ -7776,11 +8690,171 @@ var ChannelDriver = class _ChannelDriver {
     if (parent !== void 0) this.sessionParents.set(sessionId, parent);
     return parent;
   }
-  /**
-   * OpenCode's synchronous default session title (e.g.
-   * `"New session - 1737800000000"`), assigned immediately when a session is
-   * created — before OpenCode's async LLM-based auto-titling later renames it
-   * mid-turn (#549). Matched by this literal, case-sensitive prefix only; the
+  usageAgentName(messages, userMessageId) {
+    const reply = findLastAssistantReplyFor(messages, userMessageId);
+    const mode = reply?.info?.mode;
+    if (typeof mode === "string" && mode.length > 0) return mode;
+    const agent = reply?.info?.agent;
+    return typeof agent === "string" && agent.length > 0 ? agent : null;
+  }
+  async resolveSubagentInvocations(messages, userMessageId, messageId, phase = "terminal") {
+    if (!messages) return void 0;
+    const cache = phase === "prefetch" ? this.subagentInvocationPrefetches : this.subagentInvocationCollections;
+    const cached = cache.get(messageId);
+    if (cached) return cached;
+    const collection = this.buildSubagentInvocations(messages, userMessageId, messageId).catch(
+      (err) => {
+        this.log({
+          level: "warn",
+          message: `Best-effort subagent usage collection failed for message ${messageId.slice(0, 8)} \u2014 omitting invocation telemetry: ${err instanceof Error ? err.message : String(err)}`,
+          message_id: messageId
+        });
+        return void 0;
+      }
+    );
+    cache.set(messageId, collection);
+    const result = await collection;
+    if (result === void 0 && cache.get(messageId) === collection) cache.delete(messageId);
+    return result;
+  }
+  clearSubagentInvocationCaches(messageId) {
+    this.subagentInvocationCollections.delete(messageId);
+    this.subagentInvocationPrefetches.delete(messageId);
+  }
+  async buildSubagentInvocations(messages, userMessageId, messageId) {
+    const rootCalls = collectTaskCalls(messages, userMessageId);
+    if (rootCalls.length === 0) return void 0;
+    const childMessages = /* @__PURE__ */ new Map();
+    const seenCallIds = new Set(rootCalls.map((call) => call.callID));
+    const work = rootCalls.map((call) => ({
+      call,
+      depth: 1
+    }));
+    const payload = [];
+    const fetchChildMessages = (sessionId) => {
+      const cached = childMessages.get(sessionId);
+      if (cached) return cached;
+      const pending = (async () => {
+        try {
+          const res = await this.fetchImpl(`${this.opencodeBase}/session/${sessionId}/message`);
+          if (!res.ok) {
+            this.log({
+              level: "warn",
+              message: `Best-effort subagent session fetch for message ${messageId.slice(0, 8)} and child session ${sessionId.slice(0, 8)} returned HTTP ${res.status} \u2014 omitting invocation telemetry`,
+              message_id: messageId
+            });
+            return null;
+          }
+          const body = await res.json();
+          if (!Array.isArray(body)) throw new Error("response body was not a message array");
+          return body;
+        } catch (err) {
+          this.log({
+            level: "warn",
+            message: `Best-effort subagent session fetch failed for message ${messageId.slice(0, 8)} and child session ${sessionId.slice(0, 8)} \u2014 omitting invocation telemetry: ${err instanceof Error ? err.message : String(err)}`,
+            message_id: messageId
+          });
+          return null;
+        }
+      })();
+      childMessages.set(sessionId, pending);
+      return pending;
+    };
+    const fetchChildWithoutBlocking = async (sessionId) => {
+      const pending = fetchChildMessages(sessionId);
+      let timer;
+      const timeout = new Promise((resolve4) => {
+        timer = setTimeout(() => {
+          this.log({
+            level: "warn",
+            message: `Best-effort subagent session fetch for message ${messageId.slice(0, 8)} and child session ${sessionId.slice(0, 8)} was slow \u2014 omitting invocation telemetry without delaying completion`,
+            message_id: messageId
+          });
+          resolve4(null);
+        }, SUBAGENT_TELEMETRY_FETCH_TIMEOUT_MS);
+      });
+      try {
+        return await Promise.race([pending, timeout]);
+      } finally {
+        if (timer !== void 0) clearTimeout(timer);
+      }
+    };
+    while (work.length > 0) {
+      const groups = /* @__PURE__ */ new Map();
+      for (const item of work.splice(0)) {
+        const group = groups.get(item.call.childSessionId) ?? [];
+        group.push(item);
+        groups.set(item.call.childSessionId, group);
+      }
+      const groupResults = await Promise.all(
+        [...groups].map(async ([sessionId, items]) => ({
+          sessionId,
+          items,
+          messages: sessionId === null ? [] : await fetchChildWithoutBlocking(sessionId)
+        }))
+      );
+      for (const { sessionId, items, messages: child } of groupResults) {
+        if (sessionId !== null && child === null) continue;
+        const attribution = sessionId === null ? { invocations: [], unattributed: [] } : attributeTaskCallUsage(
+          child,
+          items.map(({ call }) => ({
+            callID: call.callID,
+            timeStart: call.timeStart,
+            timeEnd: call.timeEnd
+          }))
+        );
+        if (sessionId !== null && attribution.unattributed.length > 0) {
+          this.log({
+            level: "warn",
+            message: `Omitted ${attribution.unattributed.length} unattributable assistant message(s) from subagent usage for message ${messageId.slice(0, 8)} and child session ${sessionId.slice(0, 8)} \u2014 assigned to no invocation window`,
+            message_id: messageId
+          });
+        }
+        const usageByCall = new Map(
+          attribution.invocations.map((invocation) => [invocation.callID, invocation.usage])
+        );
+        const messagesByCall = new Map(
+          attribution.invocations.map((invocation) => [invocation.callID, invocation.messages])
+        );
+        for (const { call, depth } of items) {
+          const usage = usageByCall.get(call.callID) ?? null;
+          payload.push({
+            tool_call_id: call.callID,
+            agent_name: call.subagentName,
+            opencode_session_id: call.childSessionId,
+            parent_opencode_session_id: call.parentSessionId,
+            depth,
+            status: call.status,
+            started_at: call.timeStart === null ? null : new Date(call.timeStart).toISOString(),
+            ended_at: call.timeEnd === null ? null : new Date(call.timeEnd).toISOString(),
+            usage_provider_id: usage?.usage_provider_id ?? call.model?.providerID ?? null,
+            usage_model_id: usage?.usage_model_id ?? call.model?.modelID ?? null,
+            usage_tokens_input: usage?.usage_tokens_input ?? null,
+            usage_tokens_output: usage?.usage_tokens_output ?? null,
+            usage_tokens_reasoning: usage?.usage_tokens_reasoning ?? null,
+            usage_tokens_cache_read: usage?.usage_tokens_cache_read ?? null,
+            usage_tokens_cache_write: usage?.usage_tokens_cache_write ?? null,
+            usage_cost_usd: usage?.usage_cost_usd ?? null
+          });
+          for (const assigned of messagesByCall.get(call.callID) ?? []) {
+            const parentId = assigned.info?.parentID ?? assigned.parentID;
+            if (!parentId) continue;
+            for (const nested of collectTaskCalls([assigned], parentId)) {
+              if (seenCallIds.has(nested.callID)) continue;
+              seenCallIds.add(nested.callID);
+              work.push({ call: nested, depth: depth + 1 });
+            }
+          }
+        }
+      }
+    }
+    return payload.length > 0 ? payload : void 0;
+  }
+  /**
+   * OpenCode's synchronous default session title (e.g.
+   * `"New session - 1737800000000"`), assigned immediately when a session is
+   * created — before OpenCode's async LLM-based auto-titling later renames it
+   * mid-turn (#549). Matched by this literal, case-sensitive prefix only; the
    * timestamp suffix's exact format is deliberately NOT matched, since the prefix
    * alone is the stable, cheap signal and over-anchoring on the timestamp
    * representation risks silently breaking if OpenCode ever changes it. Accepted
@@ -8112,6 +9186,7 @@ var ChannelDriver = class _ChannelDriver {
       throw new Error(`Failed to get pending conversations: HTTP ${res.status}`);
     }
     const data = await res.json();
+    this.recycleRequestedFlag = data.recycle_requested === true;
     let conversations = data.conversations;
     if (this.conversationFilter) {
       conversations = conversations.filter((c) => c.id === this.conversationFilter);
@@ -8258,7 +9333,7 @@ var ChannelDriver = class _ChannelDriver {
    *                                    watcher retries next tick within the
    *                                    deadline, Finding 4).
    */
-  async markDone(conversationId, messageId, sessionId, opencodeMessageId, title, usage) {
+  async markDone(conversationId, messageId, sessionId, opencodeMessageId, title, usage, usageAgentName, subagentInvocations) {
     const res = await this.fetchImpl(
       `${this.apiUrl}/runners/${this.agentId}/threads/${conversationId}/messages/${messageId}`,
       {
@@ -8274,15 +9349,21 @@ var ChannelDriver = class _ChannelDriver {
           opencode_session_id: sessionId,
           ...opencodeMessageId ? { opencode_message_id: opencodeMessageId } : {},
           ...title ? { title } : {},
-          ...usage ? usage : {}
+          ...usage ? usage : {},
+          ...usageAgentName ? { usage_agent_name: usageAgentName } : {},
+          ...subagentInvocations && subagentInvocations.length > 0 ? { subagent_invocations: subagentInvocations } : {}
         })
       }
     );
     this.assertAuth(res, "marking message as done");
-    if (res.ok) return;
+    if (res.ok) {
+      this.clearSubagentInvocationCaches(messageId);
+      return;
+    }
     if (isRetryableStatus(res.status)) {
       throw new Error(`marking message as done: HTTP ${res.status}`);
     }
+    this.clearSubagentInvocationCaches(messageId);
     throw new ChannelTerminalError(`marking message as done: HTTP ${res.status}`, res.status);
   }
   /**
@@ -8297,7 +9378,7 @@ var ChannelDriver = class _ChannelDriver {
    *     exists but is wedged, so the next attempt must get a fresh one
    *     instead of reusing it — see WI-1's server-side null-clearing PATCH).
    */
-  async markFailed(conversationId, messageId, sessionId, error2, usage, failure) {
+  async markFailed(conversationId, messageId, sessionId, error2, usage, failure, usageAgentName, subagentInvocations) {
     const body = { status: "failed" };
     if (sessionId === null) {
       body.opencode_session_id = null;
@@ -8306,23 +9387,33 @@ var ChannelDriver = class _ChannelDriver {
     }
     if (error2 !== void 0) body.error = error2;
     if (usage) Object.assign(body, usage);
+    if (usageAgentName) body.usage_agent_name = usageAgentName;
+    if (subagentInvocations && subagentInvocations.length > 0) {
+      body.subagent_invocations = subagentInvocations;
+    }
     if (failure) {
       body.failure_kind = failure.kind;
       body.failure_provider_id = failure.providerId;
       body.failure_model_id = failure.modelId;
       body.failure_reason = failure.reason;
     }
-    await this.callWithRetry(
-      "marking message as failed",
-      () => this.fetchImpl(
-        `${this.apiUrl}/runners/${this.agentId}/threads/${conversationId}/messages/${messageId}`,
-        {
-          method: "PATCH",
-          headers: { Authorization: this.getAuthHeader(), "Content-Type": "application/json" },
-          body: JSON.stringify(body)
-        }
-      )
-    );
+    try {
+      await this.callWithRetry(
+        "marking message as failed",
+        () => this.fetchImpl(
+          `${this.apiUrl}/runners/${this.agentId}/threads/${conversationId}/messages/${messageId}`,
+          {
+            method: "PATCH",
+            headers: { Authorization: this.getAuthHeader(), "Content-Type": "application/json" },
+            body: JSON.stringify(body)
+          }
+        )
+      );
+    } catch (err) {
+      if (err instanceof ChannelTerminalError) this.clearSubagentInvocationCaches(messageId);
+      throw err;
+    }
+    this.clearSubagentInvocationCaches(messageId);
   }
   /**
    * Classify an errored turn as a model-auth failure (#736 P1-4), for `markFailed`.
@@ -8347,6 +9438,111 @@ var ChannelDriver = class _ChannelDriver {
       reply?.info?.modelID ?? null
     );
   }
+  async recordSubagentModelAuthFailure(failure, conversationId, messageId) {
+    const providerId = failure.providerId ?? "(unknown)";
+    try {
+      const res = await this.fetchImpl(
+        `${this.apiUrl}/runners/${this.agentId}/model-auth-failures`,
+        {
+          method: "POST",
+          headers: { Authorization: this.getAuthHeader(), "Content-Type": "application/json" },
+          body: JSON.stringify({
+            provider_id: failure.providerId,
+            model_id: failure.modelId,
+            reason: failure.reason
+          })
+        }
+      );
+      if (!res.ok) {
+        this.log({
+          level: "warn",
+          message: `Sub-agent model-auth report for provider ${providerId} (${failure.reason}) returned HTTP ${res.status} (conversation ${conversationId.slice(0, 8)}, message ${messageId.slice(0, 8)})`,
+          conversation_id: conversationId,
+          message_id: messageId
+        });
+      }
+    } catch (err) {
+      this.log({
+        level: "warn",
+        message: `Sub-agent model-auth report for provider ${providerId} (${failure.reason}) failed with status network-error (conversation ${conversationId.slice(0, 8)}, message ${messageId.slice(0, 8)}): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conversationId,
+        message_id: messageId
+      });
+    }
+  }
+  async clearSubagentModelAuthFailure(providerId, conversationId, messageId) {
+    try {
+      const res = await this.fetchImpl(
+        `${this.apiUrl}/runners/${this.agentId}/model-auth-failures/${encodeURIComponent(providerId)}`,
+        {
+          method: "DELETE",
+          headers: { Authorization: this.getAuthHeader() }
+        }
+      );
+      if (!res.ok) {
+        this.log({
+          level: "warn",
+          message: `Sub-agent model-auth clear for provider ${providerId} returned HTTP ${res.status} (conversation ${conversationId.slice(0, 8)}, message ${messageId.slice(0, 8)})`,
+          conversation_id: conversationId,
+          message_id: messageId
+        });
+      }
+    } catch (err) {
+      this.log({
+        level: "warn",
+        message: `Sub-agent model-auth clear for provider ${providerId} failed with status network-error (conversation ${conversationId.slice(0, 8)}, message ${messageId.slice(0, 8)}): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conversationId,
+        message_id: messageId
+      });
+    }
+  }
+  async reportSubagentAuthFailures(conversationId, opencodeMessageId, evidentMessageId, messages) {
+    const refs = collectSubagentSessions(messages, opencodeMessageId);
+    if (refs.length === 0) return;
+    const failedProviders = /* @__PURE__ */ new Map();
+    const succeededProviders = /* @__PURE__ */ new Set();
+    for (const ref of refs) {
+      try {
+        const childMessages = await getSessionMessages(this.port, ref.sessionId);
+        if (childMessages === null) {
+          this.log({
+            level: "debug",
+            message: `Could not read sub-agent session ${ref.sessionId} while checking credential failures \u2014 skipping it`,
+            conversation_id: conversationId,
+            message_id: evidentMessageId
+          });
+          continue;
+        }
+        const outcome = findSubagentAuthOutcome(childMessages, ref.startedAtMs);
+        if (!outcome) continue;
+        if (outcome.outcome === "failed") {
+          failedProviders.set(outcome.providerId, outcome.failure);
+        } else {
+          succeededProviders.add(outcome.providerId);
+        }
+      } catch (err) {
+        this.log({
+          level: "warn",
+          message: `Failed to inspect sub-agent session ${ref.sessionId} for credential failures (conversation ${conversationId.slice(0, 8)}, message ${evidentMessageId.slice(0, 8)}): ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: conversationId,
+          message_id: evidentMessageId
+        });
+      }
+    }
+    for (const [providerId, failure] of failedProviders) {
+      this.log({
+        level: "warn",
+        message: `Sub-agent turn failed on provider ${providerId} (${failure.reason}) \u2014 recording credential evidence`,
+        conversation_id: conversationId,
+        message_id: evidentMessageId
+      });
+      await this.recordSubagentModelAuthFailure(failure, conversationId, evidentMessageId);
+    }
+    for (const providerId of succeededProviders) {
+      if (failedProviders.has(providerId)) continue;
+      await this.clearSubagentModelAuthFailure(providerId, conversationId, evidentMessageId);
+    }
+  }
   /**
    * Best-effort, SINGLE-ATTEMPT runner→server telemetry ping
    * (queued-followup-redrive). `POST .../messages/:id/signal {signal, ...extra}`
@@ -8500,6 +9696,13 @@ import chalk5 from "chalk";
 import ora2 from "ora";
 import { select as select2 } from "@inquirer/prompts";
 var INTERACTIVE_START_TIMEOUT_MS = 3e4;
+function checkNonInteractivePortConflict(port, isPortInUseFn) {
+  if (isPortInUseFn(port)) {
+    throw new Error(
+      `Port ${port} is already in use by a non-OpenCode process. Free it or pass --port.`
+    );
+  }
+}
 async function ensureOpenCodeRunning(ctx) {
   const healthCheck = await checkOpenCodeHealth(ctx.port);
   if (healthCheck.healthy) {
@@ -8547,6 +9750,7 @@ async function ensureOpenCodeRunning(ctx) {
     }
   }
   if (!ctx.interactive) {
+    checkNonInteractivePortConflict(ctx.port, isPortInUse);
     ctx.log(`OpenCode is not running on port ${ctx.port}. Starting it automatically...`);
     const proc = await startOpenCode(ctx.port, { inheritStdio: ctx.inheritStdio });
     const health = await waitForOpenCodeHealth(ctx.port, ctx.startTimeoutMs);
@@ -8628,9 +9832,119 @@ Port ${port} is already in use.`));
   return { port, process: null, version: null, notReadyReason: "you chose to continue without it" };
 }
 
+// src/commands/ensure-opencode-v2.ts
+import chalk6 from "chalk";
+import { select as select3 } from "@inquirer/prompts";
+async function probeOpenCode2WithoutPassword(port) {
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/global/health`, {
+      signal: AbortSignal.timeout(2e3)
+    });
+    if (response.status === 401) {
+      return { healthy: false, authFailed: true, error: "HTTP 401" };
+    }
+    if (!response.ok) {
+      return { healthy: false, error: `HTTP ${response.status}` };
+    }
+    return { healthy: true };
+  } catch (error2) {
+    return {
+      healthy: false,
+      error: error2 instanceof Error ? error2.message : "Unknown error"
+    };
+  }
+}
+function unknownPasswordError(port) {
+  return new Error(
+    `OpenCode V2 (opencode2) is already running on port ${port} with a password this runner doesn't know. Free the port or pass --port.`
+  );
+}
+function v2SessionSupportIncompleteError() {
+  return new Error(
+    "OpenCode V2 (opencode2) session support is incomplete \u2014 see https://github.com/sroze/evident/issues/2075. Not starting a new opencode2 process."
+  );
+}
+async function ensureOpenCode2Running(ctx) {
+  const initialHealth = await probeOpenCode2WithoutPassword(ctx.port);
+  if (initialHealth.authFailed) {
+    throw unknownPasswordError(ctx.port);
+  }
+  if (initialHealth.healthy) {
+    return {
+      port: ctx.port,
+      process: null,
+      version: null,
+      notReadyReason: null,
+      password: null
+    };
+  }
+  if (!isOpenCode2Installed()) {
+    throw new Error(
+      "OpenCode V2 (opencode2) is not installed. Install it with: npm install -g @opencode-ai/cli@beta"
+    );
+  }
+  let port = ctx.port;
+  if (!ctx.interactive) {
+    checkNonInteractivePortConflict(port, isPortInUse);
+  } else if (isPortInUse(port)) {
+    console.log(chalk6.yellow(`
+Port ${port} is already in use.`));
+    const alternativePort = findAvailablePort(port + 1);
+    if (alternativePort) {
+      const useAlternative = await select3({
+        message: `Use port ${alternativePort} instead?`,
+        choices: [
+          { name: `Yes, use port ${alternativePort}`, value: "yes" },
+          { name: "No, I will free the port manually", value: "no" }
+        ]
+      });
+      if (useAlternative === "yes") {
+        port = alternativePort;
+      } else {
+        throw new Error(`Port ${ctx.port} is in use`);
+      }
+    }
+  }
+  if (!ctx.interactive) {
+    throw v2SessionSupportIncompleteError();
+  }
+  console.log(chalk6.yellow(`
+${v2SessionSupportIncompleteError().message}`));
+  const action = await select3({
+    message: "OpenCode V2 is not running. What would you like to do?",
+    choices: [
+      {
+        name: "Show me the command",
+        value: "manual",
+        description: "Display the command to run manually"
+      },
+      {
+        name: "Continue without OpenCode V2",
+        value: "continue",
+        description: "Requests will fail until OpenCode V2 starts"
+      }
+    ]
+  });
+  if (action === "manual") {
+    blank();
+    console.log(chalk6.bold("Run this command in another terminal:"));
+    blank();
+    console.log(`  ${chalk6.cyan(`opencode2 serve --port ${port}`)}`);
+    blank();
+    throw new Error("Please start OpenCode V2 manually");
+  }
+  return {
+    port,
+    process: null,
+    version: null,
+    notReadyReason: "you chose to continue without OpenCode V2",
+    password: null
+  };
+}
+
 // src/lib/runner-credentials.ts
-import { chmodSync as chmodSync2, writeFileSync as writeFileSync3 } from "fs";
-import { spawn as spawn5 } from "child_process";
+import { chmodSync as chmodSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { spawn as spawn5 } from "node:child_process";
 var RUNNER_SECRET_FETCH_TIMEOUT_MS = 6e4;
 var CREDENTIAL_RESTORE_TIMEOUT_MS = 6e4;
 var GITHUB_PROBE_TIMEOUT_MS = 1e4;
@@ -8870,8 +10184,8 @@ async function configureGitHubAccess({ env, log: log3 }) {
   }
   try {
     env.GIT_CONFIG_GLOBAL = GIT_CONFIG_GLOBAL;
-    writeFileSync3(GIT_CONFIG_GLOBAL, "");
-    writeFileSync3(GIT_CREDENTIAL_HELPER, GIT_CREDENTIAL_HELPER_CONTENT, { mode: 448 });
+    writeFileSync4(GIT_CONFIG_GLOBAL, "");
+    writeFileSync4(GIT_CREDENTIAL_HELPER, GIT_CREDENTIAL_HELPER_CONTENT, { mode: 448 });
     chmodSync2(GIT_CREDENTIAL_HELPER, 448);
     const config = [
       ["user.name", env.GIT_USER_NAME ?? "evident-bot"],
@@ -8902,11 +10216,11 @@ async function configureGitHubAccess({ env, log: log3 }) {
 }
 
 // src/lib/opencode/config-overlay.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import { copyFileSync, existsSync as existsSync2, statSync as statSync5 } from "fs";
-import { isAbsolute as isAbsolute2, join as join7, resolve as resolve3 } from "path";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { copyFileSync, existsSync as existsSync2, statSync as statSync6 } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join9, resolve as resolve3 } from "node:path";
 function isFile(filePath) {
-  return existsSync2(filePath) && statSync5(filePath).isFile();
+  return existsSync2(filePath) && statSync6(filePath).isFile();
 }
 function applyRunnerOpenCodeConfig({
   overlayPath,
@@ -8918,7 +10232,7 @@ function applyRunnerOpenCodeConfig({
     return;
   }
   const source = isAbsolute2(overlayPath) ? overlayPath : resolve3(cwd, overlayPath);
-  const target = isFile(join7(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
+  const target = isFile(join9(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
   if (!isFile(source)) {
     log3(
       `RUNNER-OPENCODE-CONFIG-MISSING: ${source} is not a file; headless turns will wedge on the first external-directory permission prompt (#563)`,
@@ -8926,7 +10240,7 @@ function applyRunnerOpenCodeConfig({
     );
     return;
   }
-  copyFileSync(source, join7(cwd, target));
+  copyFileSync(source, join9(cwd, target));
   try {
     execFileSync2("git", ["-C", cwd, "update-index", "--skip-worktree", target], {
       stdio: "ignore"
@@ -8935,7 +10249,242 @@ function applyRunnerOpenCodeConfig({
     const detail = error2 instanceof Error ? error2.message : String(error2);
     log3(`could not mark ${target} skip-worktree: ${detail}; it may show as a local change`, "warn");
   }
-  log3(`Applied runner OpenCode config ${source} to ${join7(cwd, target)}`);
+  log3(`Applied runner OpenCode config ${source} to ${join9(cwd, target)}`);
+}
+
+// src/lib/credential-sync.ts
+import { renameSync, writeFileSync as writeFileSync5 } from "node:fs";
+var CREDENTIAL_SYNC_TICK_TIMEOUT_MS = 3e4;
+var CREDENTIAL_FLUSH_DEADLINE_MS = 8e3;
+var CREDENTIAL_FLUSH_ABORT_GRACE_MS = 500;
+var DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS = 60;
+var STORES = ["claude", "opencode"];
+var MAX_FLUSH_PASSES = 2;
+function outcomesWith(outcome) {
+  return { claude: outcome, opencode: outcome };
+}
+function errorMessage2(error2) {
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+function waitForSettlement(promise, timeoutMs) {
+  return new Promise((resolve4) => {
+    let settled = false;
+    const timer = setTimeout(() => finish(false), Math.max(0, timeoutMs));
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve4(value);
+    };
+    promise.then(
+      () => finish(true),
+      () => finish(true)
+    );
+  });
+}
+function writeMarker(markerPath, outcomes, log3) {
+  const body = `${STORES.map((store) => `${store}=${outcomes[store]}`).join("\n")}
+`;
+  const temporaryPath = `${markerPath}.tmp`;
+  try {
+    writeFileSync5(temporaryPath, body, { mode: 384 });
+    renameSync(temporaryPath, markerPath);
+  } catch (error2) {
+    log3(`CREDENTIAL-FLUSH-MARKER-UNWRITABLE: ${markerPath}: ${errorMessage2(error2)}`, "warn");
+  }
+}
+function intervalSeconds(env, log3) {
+  const raw = env.CREDS_SYNC_INTERVAL;
+  if (raw === void 0 || /^[1-9][0-9]*$/.test(raw) && Number.isSafeInteger(Number(raw))) {
+    return raw === void 0 ? DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS : Number(raw);
+  }
+  log3(
+    `CREDENTIAL-SYNC-INTERVAL-INVALID: CREDS_SYNC_INTERVAL='${raw}' is not a positive integer; using ${DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS}s`,
+    "warn"
+  );
+  return DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS;
+}
+async function runFlushStore(store, env, synchroniserRunner, log3, deadlineAt) {
+  const remainingMs = deadlineAt - Date.now();
+  if (remainingMs <= 0) return { outcome: "timeout", orphaned: false };
+  const controller = new AbortController();
+  let result;
+  let failed = false;
+  const completion = Promise.resolve().then(
+    () => synchroniserRunner(["sync-once", store], {
+      timeoutMs: remainingMs,
+      env,
+      signal: controller.signal
+    })
+  ).then(
+    (value) => {
+      result = value;
+    },
+    (error2) => {
+      failed = true;
+      log3(`CREDENTIAL-FLUSH-ERROR: ${store}: ${errorMessage2(error2)}`, "warn");
+    }
+  );
+  const abortTimer = setTimeout(() => controller.abort(), remainingMs);
+  const settledBeforeDeadline = await waitForSettlement(completion, remainingMs);
+  clearTimeout(abortTimer);
+  if (!settledBeforeDeadline) {
+    controller.abort();
+    const settledAfterAbort = await waitForSettlement(completion, CREDENTIAL_FLUSH_ABORT_GRACE_MS);
+    if (!settledAfterAbort) return { outcome: "timeout", orphaned: true };
+    return { outcome: "timeout", orphaned: false };
+  }
+  if (failed || !result) return { outcome: "failed", orphaned: false };
+  if (result.timedOut || Date.now() >= deadlineAt) {
+    return { outcome: "timeout", orphaned: false };
+  }
+  return { outcome: result.code === 0 ? "ok" : "failed", orphaned: false };
+}
+function createCredentialSync({
+  markerPath,
+  env,
+  log: log3,
+  synchroniserRunner = runSynchroniser
+}) {
+  const persistenceDisabled = !env.PERSISTENCE_BUCKET;
+  let disabled = persistenceDisabled;
+  let armed = false;
+  let stopped = false;
+  let timer;
+  let inFlight;
+  let activeTickAbort;
+  let lastTickFailed;
+  let flushPromise;
+  const scheduleTick = (intervalMs, startTick2) => {
+    if (stopped) return;
+    timer = setTimeout(() => {
+      timer = void 0;
+      startTick2();
+    }, intervalMs);
+  };
+  const startTick = (intervalMs) => {
+    if (stopped) return;
+    const controller = new AbortController();
+    activeTickAbort = controller;
+    const tick = (async () => {
+      const outcomes = {
+        claude: "failed",
+        opencode: "failed"
+      };
+      for (const store of STORES) {
+        if (controller.signal.aborted) break;
+        try {
+          const result = await synchroniserRunner(["sync-once", store], {
+            timeoutMs: CREDENTIAL_SYNC_TICK_TIMEOUT_MS,
+            env,
+            signal: controller.signal
+          });
+          outcomes[store] = !result.timedOut && result.code === 0 ? "ok" : "failed";
+        } catch (error2) {
+          outcomes[store] = "failed";
+          log3(`CREDENTIAL-SYNC-TICK-ERROR: ${store}: ${errorMessage2(error2)}`, "debug");
+        }
+      }
+      const failed = STORES.some((store) => outcomes[store] === "failed");
+      log3(
+        `CREDENTIAL-SYNC-TICK: claude=${outcomes.claude}, opencode=${outcomes.opencode}`,
+        "debug"
+      );
+      if (failed && lastTickFailed !== true) {
+        log3(
+          "CREDENTIAL-SYNC-FAILED: an interval credential sync failed; retrying on the next tick",
+          "warn"
+        );
+      } else if (!failed && lastTickFailed === true) {
+        log3("CREDENTIAL-SYNC-RECOVERED: interval credential sync succeeded again", "warn");
+      }
+      lastTickFailed = failed;
+    })().finally(() => {
+      if (activeTickAbort === controller) activeTickAbort = void 0;
+      if (inFlight === tick) inFlight = void 0;
+      scheduleTick(intervalMs, () => startTick(intervalMs));
+    });
+    inFlight = tick;
+  };
+  const performFlush = async () => {
+    stopped = true;
+    if (timer) {
+      clearTimeout(timer);
+      timer = void 0;
+    }
+    const deadlineAt = Date.now() + CREDENTIAL_FLUSH_DEADLINE_MS;
+    if (inFlight) {
+      const settled = await waitForSettlement(inFlight, CREDENTIAL_FLUSH_DEADLINE_MS);
+      if (!settled) {
+        activeTickAbort?.abort();
+        const settledAfterAbort = await waitForSettlement(
+          inFlight,
+          CREDENTIAL_FLUSH_ABORT_GRACE_MS
+        );
+        if (!settledAfterAbort) {
+          log3(
+            "CREDENTIAL-FLUSH-ORPHANED-TICK: a sync-once child could not be proven settled; skipping the boundary flush rather than becoming a second writer",
+            "warn"
+          );
+          return { outcomes: outcomesWith("timeout"), orphaned: true };
+        }
+      }
+    }
+    if (disabled) return { outcomes: outcomesWith("skipped"), orphaned: false };
+    const outcomes = outcomesWith("timeout");
+    for (const store of STORES) {
+      const result = await runFlushStore(store, env, synchroniserRunner, log3, deadlineAt);
+      if (result.orphaned) {
+        log3(
+          "CREDENTIAL-FLUSH-ORPHANED-CHILD: a flush sync-once child could not be proven settled; refusing another flush pass rather than becoming a second writer",
+          "warn"
+        );
+        return { outcomes: outcomesWith("timeout"), orphaned: true };
+      }
+      outcomes[store] = result.outcome;
+    }
+    return { outcomes, orphaned: false };
+  };
+  let flushPasses = 0;
+  let lastFlush;
+  return {
+    arm() {
+      if (stopped || armed) return;
+      armed = true;
+      if (persistenceDisabled) {
+        disabled = true;
+        log3(
+          "CREDENTIAL-SYNC-DISABLED: LITESTREAM_BUCKET/LITESTREAM_PREFIX are not both set; no interval credential sync this boot",
+          "warn"
+        );
+        return;
+      }
+      disabled = false;
+      const intervalMs = intervalSeconds(env, log3) * 1e3;
+      scheduleTick(intervalMs, () => startTick(intervalMs));
+    },
+    async stopAndFlush(publish) {
+      let result;
+      const runningFlush = flushPromise;
+      if (runningFlush) {
+        result = await runningFlush;
+      } else if (flushPasses >= MAX_FLUSH_PASSES || lastFlush?.orphaned) {
+        result = lastFlush ?? { outcomes: outcomesWith("timeout"), orphaned: true };
+      } else {
+        flushPasses++;
+        const currentFlush = performFlush();
+        flushPromise = currentFlush;
+        try {
+          result = await currentFlush;
+          lastFlush = result;
+        } finally {
+          if (flushPromise === currentFlush) flushPromise = void 0;
+        }
+      }
+      if (publish) writeMarker(markerPath, result.outcomes, log3);
+      return result.outcomes;
+    }
+  };
 }
 
 // src/commands/run.ts
@@ -8975,7 +10524,7 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join8(homeDir, trimmed.slice(2)) : trimmed;
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join10(homeDir, trimmed.slice(2)) : trimmed;
     if (!isAbsolute3(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
@@ -8999,6 +10548,28 @@ function resolveFileSyncDirectories(raw, homeDir) {
 var DEFAULT_OPENCODE_START_TIMEOUT_SECONDS = 180;
 var MAX_OPENCODE_START_TIMEOUT_SECONDS = 3600;
 var OPENCODE_START_TIMEOUT_ENV = "EVIDENT_OPENCODE_START_TIMEOUT";
+var OPENCODE_VERSION_ENV = "EVIDENT_OPENCODE_VERSION";
+function resolveOpenCodeVersion(options, env = process.env) {
+  let raw;
+  let source;
+  if (options.opencodeVersion !== void 0) {
+    raw = options.opencodeVersion;
+    source = "--opencode-version";
+  } else if (env[OPENCODE_VERSION_ENV] !== void 0 && env[OPENCODE_VERSION_ENV] !== "") {
+    raw = env[OPENCODE_VERSION_ENV];
+    source = OPENCODE_VERSION_ENV;
+  } else {
+    return { version: "v1", warnings: [] };
+  }
+  const normalized = raw.trim().toLowerCase();
+  if (normalized !== "v1" && normalized !== "v2") {
+    return {
+      version: "v1",
+      warnings: [`Ignoring invalid ${source} "${raw}": expected v1 or v2; using the default v1`]
+    };
+  }
+  return { version: normalized, warnings: [] };
+}
 function resolveOpenCodeStartTimeoutMs(options, env = process.env) {
   const defaultMs = DEFAULT_OPENCODE_START_TIMEOUT_SECONDS * 1e3;
   let raw;
@@ -9065,7 +10636,7 @@ function log2(state, message, level = "info") {
       })
     );
   } else if (!state.interactive) {
-    const prefix = level === "error" ? chalk6.red("\u2717") : level === "warn" ? chalk6.yellow("!") : level === "debug" ? chalk6.dim("\xB7") : chalk6.green("\u2022");
+    const prefix = level === "error" ? chalk7.red("\u2717") : level === "warn" ? chalk7.yellow("!") : level === "debug" ? chalk7.dim("\xB7") : chalk7.green("\u2022");
     console.log(`${prefix} ${message}`);
   }
 }
@@ -9095,7 +10666,7 @@ function logActivity(state, entry) {
 }
 function reportSessionDbRecovery(state) {
   try {
-    const report = drainSessionDbRecoveryReport({ homeDir: homedir5(), env: process.env });
+    const report = drainSessionDbRecoveryReport({ homeDir: homedir6(), env: process.env });
     for (const record of report.records) {
       const activity = buildSessionDbRecoveryActivity(record);
       if (!activity) throw new Error("could not map session-DB recovery record");
@@ -9126,18 +10697,18 @@ function reportSessionDbRecoveryRecord(state, record) {
 function displayStatus(state) {
   if (!state.interactive) return;
   const attempt = state.connection?.reconnectAttempt ?? 0;
-  const tunnel = state.connected ? chalk6.green("tunnel: connected") : attempt > 0 ? chalk6.yellow(`tunnel: reconnecting (#${attempt})`) : chalk6.yellow("tunnel: connecting");
-  const opencode = state.opencodeConnected ? chalk6.green(`opencode: :${state.port}`) : chalk6.red(`opencode: :${state.port} (down)`);
-  const messages = state.messageCount > 0 ? chalk6.dim(` \xB7 ${state.messageCount} processed`) : "";
+  const tunnel = state.connected ? chalk7.green("tunnel: connected") : attempt > 0 ? chalk7.yellow(`tunnel: reconnecting (#${attempt})`) : chalk7.yellow("tunnel: connecting");
+  const opencode = state.opencodeConnected ? chalk7.green(`opencode: :${state.port}`) : chalk7.red(`opencode: :${state.port} (down)`);
+  const messages = state.messageCount > 0 ? chalk7.dim(` \xB7 ${state.messageCount} processed`) : "";
   const last = state.activityLog[state.activityLog.length - 1];
-  const detail = last ? chalk6.dim(` \xB7 ${last.type === "error" ? last.error ?? "" : last.message ?? ""}`) : "";
+  const detail = last ? chalk7.dim(` \xB7 ${last.type === "error" ? last.error ?? "" : last.message ?? ""}`) : "";
   const agent = state.agentName ?? state.agentId;
   console.log(
-    `${chalk6.bold("Evident")} ${chalk6.dim(agent)}  ${tunnel}  ${opencode}${messages}${detail}`
+    `${chalk7.bold("Evident")} ${chalk7.dim(agent)}  ${tunnel}  ${opencode}${messages}${detail}`
   );
 }
 async function promptForLogin(promptMessage, successMessage) {
-  const action = await select3({
+  const action = await select4({
     message: promptMessage,
     choices: [
       {
@@ -9153,7 +10724,7 @@ async function promptForLogin(promptMessage, successMessage) {
     ]
   });
   if (action === "exit") {
-    console.log(chalk6.dim(`
+    console.log(chalk7.dim(`
 You can log in later by running: ${getCliName()} login`));
     process.exit(0);
   }
@@ -9164,7 +10735,7 @@ You can log in later by running: ${getCliName()} login`));
     process.exit(1);
   }
   blank();
-  console.log(chalk6.green(successMessage));
+  console.log(chalk7.green(successMessage));
   blank();
   return { token: credentials2.token, authType: "bearer", user: credentials2.user };
 }
@@ -9177,12 +10748,12 @@ async function handleAuthError(state, error2) {
   if (state.interactive) displayStatus(state);
   if (!state.interactive) {
     blank();
-    console.log(chalk6.red("Authentication expired"));
-    console.log(chalk6.dim("Your authentication token is no longer valid."));
+    console.log(chalk7.red("Authentication expired"));
+    console.log(chalk7.dim("Your authentication token is no longer valid."));
     blank();
-    console.log(chalk6.dim("To fix this:"));
-    console.log(chalk6.dim(`  1. Run '${getCliName()} login' to re-authenticate`));
-    console.log(chalk6.dim("  2. Restart this command"));
+    console.log(chalk7.dim("To fix this:"));
+    console.log(chalk7.dim(`  1. Run '${getCliName()} login' to re-authenticate`));
+    console.log(chalk7.dim("  2. Restart this command"));
     blank();
     await cleanup(state);
     await shutdownTelemetry();
@@ -9190,7 +10761,7 @@ async function handleAuthError(state, error2) {
     return { success: false };
   }
   blank();
-  console.log(chalk6.yellow("Your authentication has expired."));
+  console.log(chalk7.yellow("Your authentication has expired."));
   blank();
   try {
     const credentials2 = await promptForLogin(
@@ -9235,6 +10806,10 @@ async function driveChannels(state, driver) {
       consecutiveDrainFailures = 0;
       unreachableMs = 0;
       state.messageCount += processed;
+      if (driver.recycleRequested) {
+        await beginGracefulShutdown(state, "recycle");
+        return;
+      }
       const proxiedActivity = state.lastProxiedActivityAt !== lastSeenProxiedActivityAt;
       lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
       const fileActivitySnapshot = driver.fileSyncActivity();
@@ -9250,6 +10825,14 @@ async function driveChannels(state, driver) {
       const opencodeAuthApplied = opencodeAuthApplies !== lastSeenOpencodeAuthApplies;
       lastSeenOpencodeAuthApplies = opencodeAuthApplies;
       if (opencodeAuthApplied) state.openaiUsageRearm?.();
+      if (claudeCredentialApplied || opencodeAuthApplied) {
+        void reloadProviderCache(state.port).catch(
+          (error2) => logActivity(state, {
+            type: "error",
+            error: `OpenCode provider cache reload failed on port ${state.port}: ${error2 instanceof Error ? error2.message : String(error2)}`
+          })
+        );
+      }
       if (processed > 0 || driver.hasInFlightWatchers() || proxiedActivity || fileActivity) {
         idlePolls = 0;
         idleMs = 0;
@@ -9277,8 +10860,8 @@ async function driveChannels(state, driver) {
         state.running = false;
         break;
       }
-      const errorMessage = error2 instanceof Error ? error2.message : String(error2);
-      logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage}` });
+      const errorMessage3 = error2 instanceof Error ? error2.message : String(error2);
+      logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage3}` });
       if (state.interactive) displayStatus(state);
       if (driver.hasInFlightWatchers()) {
         consecutiveDrainFailures = 0;
@@ -9316,9 +10899,54 @@ async function driveChannels(state, driver) {
   }
 }
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
-var SESSION_DB_RECLAIM_MAX_PAGES = 2e3;
+var SESSION_DB_RECLAIM_MAX_PAGES = 2e4;
+function shouldWarnForReclaimSkip(reason) {
+  if (reason !== "sqlite-unavailable") return false;
+  const version2 = /^v(\d+)\.(\d+)\.(\d+)$/.exec(process.version);
+  if (!version2) return false;
+  const major = Number(version2[1]);
+  const minor = Number(version2[2]);
+  const patch = Number(version2[3]);
+  return major > 22 || major === 22 && (minor > 13 || minor === 13 && patch >= 0);
+}
 function sessionDbPath() {
-  return join8(homedir5(), ".local", "share", "opencode", "opencode.db");
+  return join10(homedir6(), ".local", "share", "opencode", "opencode.db");
+}
+function logSessionDbProvenanceMismatch(state, provenance, currentVersion, preBootMigrationCount) {
+  const record = {
+    v: 1,
+    event: "session_db_recovery",
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    stage: "verify",
+    outcome: "schema_provenance_mismatch",
+    severity: "error",
+    reason: provenance.reason ?? "schema-provenance-mismatch",
+    litestream_exit_code: null,
+    attempt: null,
+    replica_objects: null,
+    replica_bytes: null,
+    quarantine_destination: null,
+    quarantined_objects: null,
+    quarantine_failed_objects: null,
+    quarantined_bytes: null,
+    verified_restore_point: null,
+    restore_points_tried: null,
+    provenance_reason: provenance.reason,
+    provenance_migration_delta: provenance.migrationDelta,
+    replication_suspended: false,
+    dbPath: sessionDbPath(),
+    recorded_version: provenance.recordedVersion,
+    current_version: currentVersion,
+    provenance_pre_boot_migration_count: preBootMigrationCount
+  };
+  const activity = buildSessionDbRecoveryActivity(record);
+  if (!activity) throw new Error("could not map session-DB provenance activity");
+  logActivity(state, {
+    type: activity.level === "error" ? "error" : "info",
+    level: activity.level,
+    ...activity.level === "error" ? { error: activity.message } : { message: activity.message },
+    metadata: activity.metadata
+  });
 }
 async function runSweep(state, driver, config) {
   const mode = `age=${config.maxAgeMs ?? "\u2014"} count=${config.maxCount ?? "\u2014"}`;
@@ -9365,7 +10993,7 @@ async function runSweep(state, driver, config) {
     const reclaimResult = await reclaimSessionDbSpace({
       dbPath: sessionDbPath(),
       maxPages: SESSION_DB_RECLAIM_MAX_PAGES,
-      allowFullVacuum: protectedNow.size === 0
+      allowFullVacuum: protectedNow.size === 0 && !state.sessionDbProvenanceAnomaly
     });
     if (reclaimResult.ok) {
       const beforeMib = (reclaimResult.beforeBytes / 1024 / 1024).toFixed(1);
@@ -9378,7 +11006,7 @@ async function runSweep(state, driver, config) {
     } else {
       logActivity(state, {
         type: "info",
-        message: `Session cleanup: session-db space reclaim skipped (${reclaimResult.skipped})`
+        message: `Session cleanup: session-db space reclaim skipped (${reclaimResult.skipped})` + (reclaimResult.detail ? `: ${reclaimResult.detail}` : "")
       });
     }
   } catch (error2) {
@@ -9401,13 +11029,20 @@ function scheduleSessionCleanup(state, driver, options) {
   for (const warning2 of config.warnings) {
     logActivity(state, { type: "info", level: "warn", message: `Session cleanup: ${warning2}` });
   }
-  const dbBytes = statSessionDbBytes(homedir5());
+  const dbBytes = statSessionDbBytes(homedir6());
   void (async () => {
-    const reclaimSkipReason = dbBytes !== null && config.enabled ? await probeReclaimAvailability({ dbPath: sessionDbPath(), requiredBytes: dbBytes }) : null;
+    const reclaimAvailability = dbBytes !== null && config.enabled ? await probeReclaimAvailability({ dbPath: sessionDbPath(), requiredBytes: dbBytes }) : null;
+    if (reclaimAvailability !== null) {
+      logActivity(state, {
+        type: "info",
+        level: shouldWarnForReclaimSkip(reclaimAvailability.reason) ? "warn" : "info",
+        message: `Session cleanup: reclaim preflight skipped (${reclaimAvailability.reason})` + (reclaimAvailability.detail ? `: ${reclaimAvailability.detail}` : "")
+      });
+    }
     const sizeWarning = buildSessionStoreSizeWarning({
       dbBytes,
       cleanupEnabled: config.enabled,
-      reclaimSkipReason
+      reclaimSkipReason: reclaimAvailability?.reason ?? null
     });
     if (sizeWarning !== null) {
       logActivity(state, { type: "info", level: "warn", message: sizeWarning });
@@ -9574,14 +11209,11 @@ function scheduleClaudeUsageReporting(state, options) {
     report: (usage) => reportClaudeUsage(state.agentId, state.authHeader, usage),
     isLocalCredentialProblem,
     forcedOnHint: "run `claude` to sign in",
-    firstDelayMs: () => FIRST_REPORT_DELAY_MS,
-    nextDelayMs: nextReportDelayMs,
-    failureLogLevel: claudeUsageFailureLogLevel
+    firstDelayMs: firstReportDelayMs,
+    nextDelayMs: usageReportDelayMs,
+    failureLogLevel: usageReportFailureLogLevel
   });
 }
-var RESOURCE_USAGE_BASE_REPORT_DELAY_MS = 10 * 6e4;
-var RESOURCE_USAGE_REPORT_DELAY_JITTER_FRACTION = 0.2;
-var RESOURCE_USAGE_FAILURE_REESCALATION_TICKS = 6;
 function scheduleResourceUsageReporting(state, options) {
   const { enabled, warnings } = resolveResourceUsageReportingEnabled(
     options.resourceUsageReporting,
@@ -9602,7 +11234,8 @@ function scheduleResourceUsageReporting(state, options) {
     });
     return;
   }
-  const collect = createResourceUsageCollector(homedir5());
+  const { collect, stop } = createResourceUsageCollector(homedir6());
+  state.stopResourceUsageSampling = stop;
   let consecutiveFailures = 0;
   const tick = async () => {
     try {
@@ -9633,10 +11266,7 @@ function scheduleResourceUsageReporting(state, options) {
         consecutiveFailures++;
         logActivity(state, {
           type: "info",
-          level: reportFailureLogLevel(
-            consecutiveFailures,
-            RESOURCE_USAGE_FAILURE_REESCALATION_TICKS
-          ),
+          level: usageReportFailureLogLevel(consecutiveFailures),
           message: `Failed to report resource usage: ${result.error}${failureStreakSuffix(consecutiveFailures)}`
         });
       }
@@ -9645,20 +11275,11 @@ function scheduleResourceUsageReporting(state, options) {
       const message = error2 instanceof Error ? error2.message : String(error2);
       logActivity(state, {
         type: "info",
-        level: reportFailureLogLevel(
-          consecutiveFailures,
-          RESOURCE_USAGE_FAILURE_REESCALATION_TICKS
-        ),
+        level: usageReportFailureLogLevel(consecutiveFailures),
         message: `Resource usage reporting failed: ${message}${failureStreakSuffix(consecutiveFailures)}`
       });
     } finally {
-      state.resourceUsageTimer = setTimeout(
-        () => void tick(),
-        jitteredDelayMs(
-          RESOURCE_USAGE_BASE_REPORT_DELAY_MS,
-          RESOURCE_USAGE_REPORT_DELAY_JITTER_FRACTION
-        )
-      );
+      state.resourceUsageTimer = setTimeout(() => void tick(), usageReportDelayMs());
     }
   };
   state.resourceUsageTimer = setTimeout(() => void tick(), firstReportDelayMs());
@@ -9698,6 +11319,8 @@ async function cleanup(state, opts = {}) {
     clearTimeout(timer);
   }
   state.sessionCleanupTimers = [];
+  state.stopOpenCodeLogTail?.();
+  state.stopOpenCodeLogTail = null;
   if (state.claudeUsageTimer) {
     clearTimeout(state.claudeUsageTimer);
     state.claudeUsageTimer = null;
@@ -9712,21 +11335,41 @@ async function cleanup(state, opts = {}) {
     clearTimeout(state.resourceUsageTimer);
     state.resourceUsageTimer = null;
   }
+  state.stopResourceUsageSampling?.();
+  state.stopResourceUsageSampling = null;
+  const credentialSync = state.credentialSync;
+  const flushCredentials = credentialSync ? async (phase, publish) => {
+    await timeShutdownPhase(state, durations, phase, async () => {
+      const outcomes = await credentialSync.stopAndFlush(publish);
+      const level = Object.values(outcomes).every((outcome) => outcome === "ok") ? "info" : "warn";
+      log2(
+        state,
+        `Credential flush: claude=${outcomes.claude}, opencode=${outcomes.opencode}`,
+        level
+      );
+    });
+  } : void 0;
+  let drainSettled = true;
   if (opts.graceful && state.channelDriver) {
     state.channelDriver.stop();
+  }
+  if (flushCredentials) {
+    await flushCredentials("credential_flush", !(opts.graceful && state.channelDriver));
+  }
+  if (opts.graceful && state.channelDriver) {
     log2(state, "Draining in-flight channel work before shutdown...");
     if (state.interactive) {
       logActivity(state, { type: "info", message: "Draining in-flight work before shutdown..." });
       displayStatus(state);
     }
     const driver = state.channelDriver;
-    const settled = await timeShutdownPhase(
+    drainSettled = await timeShutdownPhase(
       state,
       durations,
       "drain",
       () => driver.waitForInFlight(SHUTDOWN_DRAIN_TIMEOUT_MS)
     );
-    if (!settled) {
+    if (!drainSettled) {
       logActivity(state, {
         type: "info",
         message: "Shutdown drain timed out with work still in flight \u2014 leaving it for restart recovery"
@@ -9734,6 +11377,9 @@ async function cleanup(state, opts = {}) {
       if (state.interactive) displayStatus(state);
     }
   }
+  if (opts.graceful && state.channelDriver && flushCredentials && drainSettled) {
+    await flushCredentials("credential_flush_final", true);
+  }
   await timeShutdownPhase(state, durations, "offline_notify", () => notifyOffline(state));
   if (state.connection) {
     const connection = state.connection;
@@ -9769,13 +11415,51 @@ async function cleanup(state, opts = {}) {
   }
   return durations;
 }
+async function beginGracefulShutdown(state, trigger) {
+  if (state.shuttingDown) return;
+  state.shuttingDown = true;
+  const shutdownStartedAt = Date.now();
+  const shutdownMessage = trigger === "recycle" ? "Recycle requested \u2014 finishing in-flight work, then exiting" : "Shutting down...";
+  if (state.interactive) {
+    logActivity(state, { type: "info", message: shutdownMessage });
+    displayStatus(state);
+  } else {
+    log2(state, shutdownMessage);
+  }
+  const durations = await cleanup(state, { graceful: true });
+  const telemetryBudgetMs = Number(process.env.EVIDENT_TELEMETRY_SHUTDOWN_MS) || TELEMETRY_SHUTDOWN_TIMEOUT_MS;
+  await timeShutdownPhase(state, durations, "telemetry_flush", async () => {
+    let timer;
+    const flushed = shutdownTelemetry().then(
+      () => true,
+      (error2) => {
+        log2(
+          state,
+          `Telemetry flush failed during shutdown: ${error2 instanceof Error ? error2.message : String(error2)}`,
+          "warn"
+        );
+        return true;
+      }
+    );
+    const timedOut = new Promise((resolve4) => {
+      timer = setTimeout(() => resolve4(false), telemetryBudgetMs);
+    });
+    if (!await Promise.race([flushed, timedOut])) {
+      log2(state, `Telemetry flush exceeded ${telemetryBudgetMs}ms \u2014 exiting anyway`, "warn");
+    }
+    clearTimeout(timer);
+  });
+  const breakdown = Object.entries(durations).map(([phase, ms]) => `${phase}=${ms}ms`).join(" ");
+  log2(state, `Shutdown complete in ${Date.now() - shutdownStartedAt}ms (${breakdown})`);
+  process.exit(0);
+}
 async function run(options) {
   const interactive = isInteractive(options.json);
   let logLevel;
   let fileSyncDirectories;
   try {
     logLevel = resolveLogLevel(options);
-    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir5());
+    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir6());
     if (options.restoreSessionDb && !options.sessionDbNoReplicateMarker) {
       throw new Error(
         "--restore-session-db requires --session-db-no-replicate-marker <path>; restore failures must block Litestream replication"
@@ -9804,7 +11488,9 @@ async function run(options) {
     connected: false,
     opencodeConnected: false,
     opencodeVersion: null,
+    sessionDbProvenanceAnomaly: false,
     opencodeProcess: null,
+    stopOpenCodeLogTail: null,
     litestreamProcess: null,
     connection: null,
     channelDriver: null,
@@ -9819,9 +11505,24 @@ async function run(options) {
     openaiUsageTimer: null,
     openaiUsageRearm: null,
     resourceUsageTimer: null,
+    stopResourceUsageSampling: null,
+    credentialSync: null,
     authHeader: ""
   };
   setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
+  if (options.credentialSyncMarker) {
+    state.credentialSync = createCredentialSync({
+      markerPath: options.credentialSyncMarker,
+      env: process.env,
+      log: (message, level = "info") => {
+        if (level === "error") {
+          logActivity(state, { type: "error", error: message });
+        } else {
+          logActivity(state, { type: "info", level, message });
+        }
+      }
+    });
+  }
   if (fileSyncDirectories.length > 0) {
     log2(state, `File sync enabled for: ${fileSyncDirectories.join(", ")}`);
   } else {
@@ -9847,43 +11548,7 @@ async function run(options) {
       "warn"
     );
   }
-  const handleSignal = async () => {
-    if (state.shuttingDown) return;
-    state.shuttingDown = true;
-    const shutdownStartedAt = Date.now();
-    if (state.interactive) {
-      logActivity(state, { type: "info", message: "Shutting down..." });
-      displayStatus(state);
-    } else {
-      log2(state, "Shutting down...");
-    }
-    const durations = await cleanup(state, { graceful: true });
-    const telemetryBudgetMs = Number(process.env.EVIDENT_TELEMETRY_SHUTDOWN_MS) || TELEMETRY_SHUTDOWN_TIMEOUT_MS;
-    await timeShutdownPhase(state, durations, "telemetry_flush", async () => {
-      let timer;
-      const flushed = shutdownTelemetry().then(
-        () => true,
-        (error2) => {
-          log2(
-            state,
-            `Telemetry flush failed during shutdown: ${error2 instanceof Error ? error2.message : String(error2)}`,
-            "warn"
-          );
-          return true;
-        }
-      );
-      const timedOut = new Promise((resolve4) => {
-        timer = setTimeout(() => resolve4(false), telemetryBudgetMs);
-      });
-      if (!await Promise.race([flushed, timedOut])) {
-        log2(state, `Telemetry flush exceeded ${telemetryBudgetMs}ms \u2014 exiting anyway`, "warn");
-      }
-      clearTimeout(timer);
-    });
-    const breakdown = Object.entries(durations).map(([phase, ms]) => `${phase}=${ms}ms`).join(" ");
-    log2(state, `Shutdown complete in ${Date.now() - shutdownStartedAt}ms (${breakdown})`);
-    process.exit(0);
-  };
+  const handleSignal = () => beginGracefulShutdown(state, "signal");
   process.on("SIGINT", handleSignal);
   process.on("SIGTERM", handleSignal);
   try {
@@ -9893,15 +11558,15 @@ async function run(options) {
         printError("Authentication required");
         blank();
         console.log(
-          chalk6.dim("Set EVIDENT_RUNNER_KEY (or EVIDENT_AGENT_KEY) environment variable for CI")
+          chalk7.dim("Set EVIDENT_RUNNER_KEY (or EVIDENT_AGENT_KEY) environment variable for CI")
         );
-        console.log(chalk6.dim("Or run `evident login` for interactive authentication"));
+        console.log(chalk7.dim("Or run `evident login` for interactive authentication"));
         blank();
         process.exit(1);
         return;
       }
       blank();
-      console.log(chalk6.yellow("You are not logged in to Evident."));
+      console.log(chalk7.yellow("You are not logged in to Evident."));
       blank();
       credentials2 = await promptForLogin(
         "Would you like to log in now?",
@@ -9951,7 +11616,7 @@ async function run(options) {
         );
         blank();
         console.log(
-          chalk6.dim(
+          chalk7.dim(
             "Either provide --runner/--agent <id> or set EVIDENT_RUNNER_KEY/EVIDENT_AGENT_KEY"
           )
         );
@@ -9974,15 +11639,15 @@ async function run(options) {
     );
     if (interactive && !state.json) {
       blank();
-      console.log(chalk6.bold("Evident Run"));
-      console.log(chalk6.dim("-".repeat(40)));
+      console.log(chalk7.bold("Evident Run"));
+      console.log(chalk7.dim("-".repeat(40)));
     }
     const spinner = interactive && !state.json ? ora3("Validating runner...").start() : null;
     let validation = await getAgentInfo(state.agentId, state.authHeader);
     if (!validation.valid && validation.authFailed && interactive) {
       spinner?.fail("Authentication failed");
       blank();
-      console.log(chalk6.yellow("Your authentication token is invalid or expired."));
+      console.log(chalk7.yellow("Your authentication token is invalid or expired."));
       blank();
       credentials2 = await promptForLogin(
         "Would you like to log in again?",
@@ -10029,6 +11694,14 @@ async function run(options) {
       await restoreCredentialStores(credentialContext);
       if (githubTokenPopulated) await configureGitHubAccess(credentialContext);
     }
+    state.credentialSync?.arm();
+    state.stopOpenCodeLogTail = tailOpenCodeLogFile(
+      resolveOpenCodeLogPath(homedir6(), process.env),
+      createOpenCodeActivityForwarder(() => ({
+        agentId: state.agentId,
+        authHeader: state.authHeader
+      }))
+    ).stop;
     let sessionDbVerifyFatal = false;
     if (!options.restoreSessionDb) {
       log2(state, "Skipping session-DB restore: --restore-session-db was not passed", "debug");
@@ -10078,13 +11751,28 @@ async function run(options) {
     for (const warning2 of opencodeStartTimeoutWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
     }
+    const { version: opencodeVersion, warnings: opencodeVersionWarnings } = resolveOpenCodeVersion(
+      options,
+      process.env
+    );
+    for (const warning2 of opencodeVersionWarnings) {
+      logActivity(state, { type: "info", level: "warn", message: warning2 });
+    }
     const { value: maxActiveSessions, warnings: maxActiveSessionsWarnings } = resolveMaxActiveSessions(options, process.env);
     for (const warning2 of maxActiveSessionsWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
     }
+    const preBootMigrationIds = readSessionDbMigrationIds(sessionDbPath());
     const ocSpinner = interactive && !state.json ? ora3("Checking OpenCode...").start() : null;
     try {
-      const oc = await ensureOpenCodeRunning({
+      const oc = opencodeVersion === "v2" ? await ensureOpenCode2Running({
+        port: state.port,
+        interactive: state.interactive,
+        agentId: state.agentId,
+        log: (message) => log2(state, message),
+        startTimeoutMs: opencodeStartTimeoutMs,
+        inheritStdio: Boolean(options.opencodePidFile)
+      }) : await ensureOpenCodeRunning({
         port: state.port,
         interactive: state.interactive,
         agentId: state.agentId,
@@ -10097,7 +11785,7 @@ async function run(options) {
       state.opencodeVersion = oc.version;
       if (options.opencodePidFile && oc.process?.pid !== void 0) {
         try {
-          writeFileSync4(options.opencodePidFile, `${oc.process.pid}
+          writeFileSync6(options.opencodePidFile, `${oc.process.pid}
 `, { mode: 384 });
           chmodSync3(options.opencodePidFile, 384);
         } catch (error2) {
@@ -10107,6 +11795,23 @@ async function run(options) {
           });
         }
       }
+      if (state.opencodeVersion !== null) {
+        const provenance = checkSessionDbProvenance({
+          dbPath: sessionDbPath(),
+          currentVersion: state.opencodeVersion,
+          homeDir: homedir6(),
+          env: process.env
+        });
+        if (provenance.anomaly) {
+          state.sessionDbProvenanceAnomaly = true;
+          logSessionDbProvenanceMismatch(
+            state,
+            provenance,
+            state.opencodeVersion,
+            preBootMigrationIds?.length ?? null
+          );
+        }
+      }
       state.opencodeConnected = oc.notReadyReason === null;
       const version2 = state.opencodeVersion ? ` (v${state.opencodeVersion})` : "";
       ocSpinner?.succeed(`OpenCode running on port ${state.port}${version2}`);
@@ -10121,6 +11826,7 @@ async function run(options) {
             logActivity(state, { type: "info", level: "warn", message: versionWarning });
           }
         }
+        await reloadProviderCache(state.port);
         const noProviderWarning = buildNoProviderWarning(
           await hasAnyConfiguredProvider(state.port)
         );
@@ -10129,10 +11835,10 @@ async function run(options) {
           if (state.interactive && !state.json) {
             logActivity(state, { type: "info", level: "warn", message: noProviderWarning });
             blank();
-            console.log(chalk6.yellow("\u26A0 No OpenCode model provider is configured."));
+            console.log(chalk7.yellow("\u26A0 No OpenCode model provider is configured."));
             console.log(
-              chalk6.dim(
-                `Run ${chalk6.cyan("opencode auth login")} to set one up \u2014 messages will fail until then.`
+              chalk7.dim(
+                `Run ${chalk7.cyan("opencode auth login")} to set one up \u2014 messages will fail until then.`
               )
             );
             blank();
@@ -10159,7 +11865,7 @@ async function run(options) {
         let existingPid;
         if (existsSync3(options.litestreamPidFile)) {
           try {
-            const rawPid = readFileSync5(options.litestreamPidFile, "utf8").trim();
+            const rawPid = readFileSync6(options.litestreamPidFile, "utf8").trim();
             const parsedPid = Number(rawPid);
             if (/^\d+$/.test(rawPid) && Number.isSafeInteger(parsedPid) && parsedPid > 0) {
               existingPid = parsedPid;
@@ -10196,7 +11902,7 @@ async function run(options) {
           });
           try {
             if (litestreamProcess.pid !== void 0) {
-              writeFileSync4(options.litestreamPidFile, `${litestreamProcess.pid}
+              writeFileSync6(options.litestreamPidFile, `${litestreamProcess.pid}
 `, {
                 mode: 384
               });
@@ -10256,7 +11962,7 @@ async function run(options) {
       // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
       // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
-      homeDir: homedir5(),
+      homeDir: homedir6(),
       maxActiveSessions,
       log: (entry) => (
         // Thread the driver's real level straight through so `debug`/`warn`
@@ -10382,6 +12088,18 @@ async function run(options) {
             if (state.interactive) displayStatus(state);
           });
         },
+        // Both loops are rearmed because `rearm()` is idempotent for the
+        // provider that did not just connect, and is a no-op when reporting is off.
+        onUsageRearmPing: () => {
+          if (!state.running) return;
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: "Usage rearm ping received"
+          });
+          state.claudeUsageRearm?.();
+          state.openaiUsageRearm?.();
+        },
         onInfo: (message) => logActivity(state, { type: "info", message })
       }
     });
@@ -10402,7 +12120,17 @@ async function run(options) {
       setTimer: (timer) => {
         state.openaiUsageTimer = timer;
       },
-      fetchUsage: () => getOpenAiUsage(state.port),
+      fetchUsage: async () => {
+        const usage = await getOpenAiUsage(state.port);
+        if (usage.subscription === null) {
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: "OpenAI usage subscription could not be identified from the local credential"
+          });
+        }
+        return usage;
+      },
       report: (usage) => reportOpenAiUsage(state.agentId, state.authHeader, usage),
       isLocalCredentialProblem: isLocalCredentialProblem2,
       forcedOnHint: "connect a ChatGPT account to this runner, or run `opencode auth login`",
@@ -10448,7 +12176,7 @@ async function run(options) {
 }
 
 // src/index.ts
-var { version } = createRequire(import.meta.url)("../package.json");
+var { version } = createRequire2(import.meta.url)("../package.json");
 var program = new Command();
 program.name("evident").description("Run OpenCode locally and connect it to Evident").version(version).option(
   "--endpoint <url>",
@@ -10476,6 +12204,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option("-v, --verbose", "Alias for --log-level debug (ignored if --log-level is set)").option("-c, --conversation <id>", "Process only this specific conversation").option("--idle-timeout <seconds>", "Exit after N seconds idle").option(
   "--opencode-start-timeout <seconds>",
   "Seconds to wait for OpenCode to become healthy when the runner starts it (default: 180). Env: EVIDENT_OPENCODE_START_TIMEOUT"
+).option(
+  "--opencode-version <v1|v2>",
+  "Which OpenCode major version to launch: v1 or v2 (default: v1). Env: EVIDENT_OPENCODE_VERSION"
 ).option("--json", "Output in JSON format").option(
   "--session-cleanup-max-age <duration>",
   "Delete OpenCode sessions idle longer than this (e.g. 7d, 24h). Enables cleanup. Env: EVIDENT_SESSION_CLEANUP_MAX_AGE"
@@ -10526,6 +12257,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--opencode-config-overlay <path>",
   "Apply this runner-provided OpenCode config before starting OpenCode."
+).option(
+  "--credential-sync-marker <path>",
+  "Own the interval credential sync and write this marker once the shutdown flush has finished, so the runner image's lifecycle hooks can wait on it."
 ).action(
   (options) => {
     run({
@@ -10541,6 +12275,7 @@ program.command("run").description("Connect to Evident and process messages").op
       // Raw string — validation/precedence is single-sourced in run.ts's
       // resolveOpenCodeStartTimeoutMs (flag > EVIDENT_OPENCODE_START_TIMEOUT > 180s default).
       opencodeStartTimeout: options.opencodeStartTimeout,
+      opencodeVersion: options.opencodeVersion,
       json: options.json,
       // Raw strings — the resolver in run.ts single-sources parsing (M1).
       sessionCleanupMaxAge: options.sessionCleanupMaxAge,
@@ -10564,7 +12299,8 @@ program.command("run").description("Connect to Evident and process messages").op
       sessionDbNoReplicateMarker: options.sessionDbNoReplicateMarker,
       restoreSessionDb: options.restoreSessionDb,
       restoreRunnerCredentials: options.restoreRunnerCredentials,
-      opencodeConfigOverlay: options.opencodeConfigOverlay
+      opencodeConfigOverlay: options.opencodeConfigOverlay,
+      credentialSyncMarker: options.credentialSyncMarker
     });
   }
 );