@evident-ai/cli 3.4.1-dev.31006db → 3.4.1-dev.48f83ae

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
 import { Command } from "commander";
 
 // src/commands/login.ts
@@ -763,6 +763,13 @@ function toReportedOpenAiWindow(window) {
     resets_at: window.resetsAt
   };
 }
+function toReportedOpenAiSubscription(snapshot) {
+  if (!snapshot.subscription) return null;
+  return {
+    owner_email: snapshot.subscription.ownerEmail,
+    plan_type: snapshot.subscription.planType
+  };
+}
 async function reportOpenAiUsage(agentId, authHeader, snapshot) {
   try {
     const apiUrl = getApiUrlConfig();
@@ -773,7 +780,8 @@ async function reportOpenAiUsage(agentId, authHeader, snapshot) {
         primary: toReportedOpenAiWindow(snapshot.primary),
         secondary: toReportedOpenAiWindow(snapshot.secondary),
         has_credits: snapshot.hasCredits,
-        credits_unlimited: snapshot.creditsUnlimited
+        credits_unlimited: snapshot.creditsUnlimited,
+        subscription: toReportedOpenAiSubscription(snapshot)
       }),
       signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
     });
@@ -1183,9 +1191,9 @@ async function claudeUsage() {
 }
 
 // src/commands/run.ts
-import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { isAbsolute as isAbsolute3, join as join8, parse, resolve as resolvePath2 } from "path";
+import { isAbsolute as isAbsolute3, join as join9, parse, resolve as resolvePath2 } from "path";
 import chalk6 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
@@ -1525,7 +1533,14 @@ function drainSessionDbRecoveryReport({
         skippedLines++;
         return [];
       }
-      return [{ ...value, replication_suspended: value.replication_suspended ?? false }];
+      return [
+        {
+          ...value,
+          provenance_reason: value.provenance_reason ?? null,
+          provenance_migration_delta: value.provenance_migration_delta ?? null,
+          replication_suspended: value.replication_suspended ?? false
+        }
+      ];
     } catch (error2) {
       skippedLines++;
       console.error(
@@ -1628,6 +1643,12 @@ function buildSessionDbRecoveryActivity(record) {
         metadata: withoutContractFields(record),
         message: `This runner did not come online because its damaged session database could not be safely separated from its active backup or proven removed. Backed-up session history remains readable at ${record.quarantine_destination ?? "its original location or the quarantine destination named in the boot logs"}; any local session-database files that remain were left in place and nothing opened or wrote them. See the runner boot logs for SESSION-DB-LOCAL-DISCARD-FAILED details.`
       };
+    case "schema_provenance_mismatch":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: `Session database schema provenance mismatch for ${record.dbPath ?? record.db_path ?? "unknown"}: recorded version=${record.recorded_version ?? "unknown"}, current version=${record.current_version ?? "unknown"}, reason=${record.provenance_reason ?? "unknown"}, migration delta=${record.provenance_migration_delta ?? "unknown"}. Inspect the session database and runner backup before continuing.`
+      };
     default:
       return null;
   }
@@ -1642,7 +1663,8 @@ var OUTCOMES = /* @__PURE__ */ new Set([
   "fresh_session_db",
   "history_rolled_back",
   "restore_misconfigured",
-  "session_db_boot_refused"
+  "session_db_boot_refused",
+  "schema_provenance_mismatch"
 ]);
 var STAGES = /* @__PURE__ */ new Set(["restore", "verify"]);
 var SEVERITIES = /* @__PURE__ */ new Set(["warning", "error"]);
@@ -1660,7 +1682,7 @@ var STRING_OR_NULL_FIELDS = ["quarantine_destination", "verified_restore_point"]
 function isSessionDbRecoveryRecord(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const record = value;
-  return record.v === 1 && record.event === "session_db_recovery" && typeof record.at === "string" && STAGES.has(record.stage) && OUTCOMES.has(record.outcome) && SEVERITIES.has(record.severity) && typeof record.reason === "string" && (record.replication_suspended === void 0 || typeof record.replication_suspended === "boolean") && NUMBER_FIELDS.every((field) => record[field] === null || Number.isInteger(record[field])) && STRING_OR_NULL_FIELDS.every(
+  return record.v === 1 && record.event === "session_db_recovery" && typeof record.at === "string" && STAGES.has(record.stage) && OUTCOMES.has(record.outcome) && SEVERITIES.has(record.severity) && typeof record.reason === "string" && (record.replication_suspended === void 0 || typeof record.replication_suspended === "boolean") && (record.provenance_reason === void 0 || record.provenance_reason === null || typeof record.provenance_reason === "string") && (record.provenance_migration_delta === void 0 || record.provenance_migration_delta === null || Number.isInteger(record.provenance_migration_delta)) && NUMBER_FIELDS.every((field) => record[field] === null || Number.isInteger(record[field])) && STRING_OR_NULL_FIELDS.every(
     (field) => record[field] === null || typeof record[field] === "string"
   );
 }
@@ -1714,10 +1736,14 @@ function runSynchroniser(args, opts) {
     let stderr = "";
     let settled = false;
     const timer = {};
+    let abortListener;
+    let spawnListener;
     const finish = (result) => {
       if (settled) return;
       settled = true;
       if (timer.handle) clearTimeout(timer.handle);
+      if (abortListener) opts.signal?.removeEventListener("abort", abortListener);
+      if (spawnListener) child.removeListener("spawn", spawnListener);
       resolve4(result);
     };
     try {
@@ -1743,6 +1769,25 @@ function runSynchroniser(args, opts) {
     child.once("close", (code) => {
       finish({ code, stdout, stderr, timedOut: false });
     });
+    if (opts.signal) {
+      const killChild = () => {
+        if (child.pid === void 0) {
+          if (!spawnListener) {
+            spawnListener = killChild;
+            child.once("spawn", spawnListener);
+          }
+          return;
+        }
+        child.kill("SIGKILL");
+      };
+      abortListener = killChild;
+      if (opts.signal.aborted) {
+        abortListener();
+      } else {
+        opts.signal.addEventListener("abort", abortListener, { once: true });
+        if (opts.signal.aborted) abortListener();
+      }
+    }
     timer.handle = setTimeout(
       () => {
         child.kill("SIGKILL");
@@ -1780,6 +1825,8 @@ function reportRecord(stage, outcome, reason, litestreamExitCode, options) {
     quarantined_bytes: null,
     verified_restore_point: null,
     restore_points_tried: null,
+    provenance_reason: null,
+    provenance_migration_delta: null,
     replication_suspended: stage === "restore"
   });
 }
@@ -2200,6 +2247,131 @@ async function restoreAndVerifySessionDb(options) {
   return { verifyFatal: await verifySessionDb(options, configPath, env) };
 }
 
+// src/lib/opencode/session-db-provenance.ts
+import { createRequire } from "module";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, join as join3 } from "path";
+var require2 = createRequire(import.meta.url);
+function readSessionDbMigrationIds(dbPath) {
+  let db;
+  try {
+    const { DatabaseSync } = require2("node:sqlite");
+    db = new DatabaseSync(dbPath, { readOnly: true });
+    const columns = db.prepare("PRAGMA table_info(migration)").all();
+    const hasExpectedShape = columns.length === 2 && columns.some(
+      (column) => column.name === "id" && typeof column.type === "string" && column.type.toUpperCase() === "TEXT" && column.pk === 1
+    ) && columns.some(
+      (column) => column.name === "time_completed" && typeof column.type === "string" && column.type.toUpperCase() === "INTEGER" && column.notnull === 1 && column.pk === 0
+    );
+    if (!hasExpectedShape) {
+      console.warn(`[readSessionDbMigrationIds] unsupported migration table shape in ${dbPath}`);
+      return null;
+    }
+    const rows = db.prepare("SELECT id FROM migration ORDER BY id").all();
+    if (rows.some((row) => typeof row.id !== "string")) return null;
+    return rows.map((row) => row.id);
+  } catch (error2) {
+    console.warn(
+      `[readSessionDbMigrationIds] could not read migration history from ${dbPath}: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+    return null;
+  } finally {
+    try {
+      db?.close();
+    } catch (error2) {
+      console.warn(
+        `[readSessionDbMigrationIds] could not close ${dbPath}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+    }
+  }
+}
+function sessionDbProvenanceStatePath(homeDir, env) {
+  const override = env.EVIDENT_SESSION_DB_PROVENANCE_STATE?.trim();
+  return override || join3(homeDir, ".local", "state", "evident", "session-db-provenance.json");
+}
+function loadSessionDbProvenanceState(path) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync3(path, "utf8"));
+  } catch (error2) {
+    if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") return {};
+    console.error(
+      `[session-db-provenance] could not read ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+    return {};
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    console.error(`[session-db-provenance] ignored malformed state in ${path}`);
+    return {};
+  }
+  const state = {};
+  for (const [dbPath, record] of Object.entries(value)) {
+    if (!isSessionDbProvenanceRecord(record)) {
+      console.error(`[session-db-provenance] ignored malformed state in ${path}`);
+      return {};
+    }
+    state[dbPath] = record;
+  }
+  return state;
+}
+function saveSessionDbProvenanceState(path, state) {
+  try {
+    mkdirSync2(dirname3(path), { recursive: true });
+    writeFileSync2(path, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+  } catch (error2) {
+    console.error(
+      `[session-db-provenance] could not write ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+  }
+}
+function evaluateSessionDbProvenance(input) {
+  const { currentVersion, currentIds, previous } = input;
+  if (!previous) return { anomaly: false, reason: null };
+  const current = new Set(currentIds);
+  const prior = new Set(previous.migrationIds);
+  for (const id of prior) {
+    if (!current.has(id)) return { anomaly: true, reason: "migration-history-regressed" };
+  }
+  if (current.size > prior.size && previous.opencodeVersion === currentVersion) {
+    return { anomaly: true, reason: "foreign-version-migrations" };
+  }
+  return { anomaly: false, reason: null };
+}
+function checkSessionDbProvenance(input) {
+  const { dbPath, currentVersion, homeDir, env } = input;
+  const path = sessionDbProvenanceStatePath(homeDir, env);
+  const state = loadSessionDbProvenanceState(path);
+  const previous = state[dbPath];
+  const currentIds = readSessionDbMigrationIds(dbPath);
+  if (currentIds === null) {
+    return {
+      anomaly: false,
+      reason: null,
+      recordedVersion: previous?.opencodeVersion ?? null,
+      migrationDelta: null
+    };
+  }
+  const decision = evaluateSessionDbProvenance({ currentVersion, currentIds, previous });
+  const migrationDelta = previous ? new Set(currentIds).size - new Set(previous.migrationIds).size : null;
+  state[dbPath] = {
+    opencodeVersion: currentVersion,
+    migrationIds: currentIds,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveSessionDbProvenanceState(path, state);
+  return {
+    ...decision,
+    recordedVersion: previous?.opencodeVersion ?? null,
+    migrationDelta
+  };
+}
+function isSessionDbProvenanceRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  return typeof record.opencodeVersion === "string" && Array.isArray(record.migrationIds) && record.migrationIds.every((id) => typeof id === "string") && typeof record.updatedAt === "string";
+}
+
 // src/lib/opencode/opencode-version-gate.ts
 var QUEUE_VALIDATED_OPENCODE_VERSIONS = ["1.17.11", "1.18.3"];
 function isQueueValidatedVersion(version2) {
@@ -3286,10 +3458,10 @@ function resolveSessionCleanupConfig(flags, env = process.env) {
 
 // src/lib/opencode/session-db-size.ts
 import { statSync as statSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var LARGE_DB_THRESHOLD_BYTES = 268435456;
 function statSessionDbBytes(homeDir) {
-  const dbPath = join3(homeDir, ".local", "share", "opencode", "opencode.db");
+  const dbPath = join4(homeDir, ".local", "share", "opencode", "opencode.db");
   try {
     return statSync3(dbPath).size;
   } catch (err) {
@@ -3318,10 +3490,10 @@ function buildSessionStoreSizeWarning(input) {
 
 // src/lib/opencode/session-db-reclaim.ts
 import { statSync as statSync4, statfsSync } from "fs";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname4 } from "path";
 function insufficientSpaceReason(dbPath, requiredBytes) {
   try {
-    const fsStats = statfsSync(dirname3(dbPath));
+    const fsStats = statfsSync(dirname4(dbPath));
     const availableBytes = fsStats.bavail * fsStats.bsize;
     if (availableBytes < requiredBytes) {
       return `only ${availableBytes} bytes free, need ${requiredBytes} for a second copy`;
@@ -3703,8 +3875,8 @@ function connectTunnel(options) {
       try {
         message = JSON.parse(data.toString());
       } catch (error2) {
-        const errorMessage = error2 instanceof Error ? error2.message : "Unknown error";
-        onError?.(`Failed to handle message: ${errorMessage}`);
+        const errorMessage2 = error2 instanceof Error ? error2.message : "Unknown error";
+        onError?.(`Failed to handle message: ${errorMessage2}`);
         return;
       }
       if (isStreamFrame(message)) {
@@ -3847,10 +4019,10 @@ var RunnerConnection = class {
 };
 
 // src/lib/tunnel/ready-marker.ts
-import { writeFileSync as writeFileSync2 } from "fs";
+import { writeFileSync as writeFileSync3 } from "fs";
 function writeTunnelReadyMarker(path, agentId) {
   try {
-    writeFileSync2(path, `${agentId}
+    writeFileSync3(path, `${agentId}
 `);
     return { ok: true };
   } catch (error2) {
@@ -3875,7 +4047,7 @@ async function stopSessionDbReplication(child, timeoutMs) {
 }
 
 // src/lib/process-liveness.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -3890,7 +4062,7 @@ function isProcessAlive(pid) {
   }
   if (process.platform !== "linux") return true;
   try {
-    const status2 = readFileSync3(`/proc/${pid}/status`, "utf8");
+    const status2 = readFileSync4(`/proc/${pid}/status`, "utf8");
     return !/^State:\s+Z(?:\s|$)/m.test(status2);
   } catch (error2) {
     console.error(
@@ -3901,9 +4073,9 @@ function isProcessAlive(pid) {
 }
 
 // src/lib/openai-usage.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 var OPENCODE_AUTH_SEGMENTS = [".local", "share", "opencode", "auth.json"];
 var OpenAiUsageError = class extends Error {
@@ -3917,7 +4089,7 @@ function isLocalCredentialProblem2(err) {
 }
 function readOpenCodeChatGptCredentials() {
   try {
-    const raw = readFileSync4(join4(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
+    const raw = readFileSync5(join5(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -3939,6 +4111,23 @@ function readOpenCodeChatGptCredentials() {
     return null;
   }
 }
+function parseChatGptIdentity(accessToken) {
+  const segments = accessToken.split(".");
+  if (segments.length !== 3) return null;
+  let payload;
+  try {
+    const parsed = JSON.parse(Buffer.from(segments[1], "base64url").toString("utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+    payload = parsed;
+  } catch {
+    return null;
+  }
+  const profile = payload["https://api.openai.com/profile"];
+  const auth = payload["https://api.openai.com/auth"];
+  const ownerEmail = typeof profile?.email === "string" ? profile.email.trim() || null : null;
+  const planType = typeof auth?.chatgpt_plan_type === "string" ? auth.chatgpt_plan_type.trim() || null : null;
+  return ownerEmail === null && planType === null ? null : { ownerEmail, planType };
+}
 function toWindow2(headers, name) {
   const utilizationHeader = headers.get(`x-codex-${name}-used-percent`);
   const windowMinutesHeader = headers.get(`x-codex-${name}-window-minutes`);
@@ -4014,6 +4203,7 @@ async function getOpenAiUsage(port) {
       "credentials_expired"
     );
   }
+  const subscription = parseChatGptIdentity(credentials2.accessToken);
   const models = await resolveProbeModels(port);
   if (models.length === 0) {
     throw new OpenAiUsageError("No supported OpenAI probe model is available.", "no_probe_model");
@@ -4046,7 +4236,7 @@ async function getOpenAiUsage(port) {
             "no_usable_window"
           );
         }
-        return usage;
+        return { ...usage, subscription };
       }
       if (res.status === 401) {
         throw new OpenAiUsageError(
@@ -4293,12 +4483,12 @@ function createResourceUsageCollector(homeDir) {
 import { homedir as homedir4 } from "os";
 
 // src/lib/runner-file-sync.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // src/lib/file-push.ts
 import { randomUUID } from "crypto";
 import { chmod, mkdir, open as open2, realpath, rename, unlink } from "fs/promises";
-import { basename, dirname as dirname4, isAbsolute, join as join5, relative, resolve as resolve2, sep } from "path";
+import { basename, dirname as dirname5, isAbsolute, join as join6, relative, resolve as resolve2, sep } from "path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
 async function writePushedFile(request) {
@@ -4329,9 +4519,9 @@ async function writePushedFile(request) {
   }
   try {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
-      dirname4(candidate)
+      dirname5(candidate)
     );
-    const realTarget = join5(existingAncestor, ...missingSegments, basename(candidate));
+    const realTarget = join6(existingAncestor, ...missingSegments, basename(candidate));
     const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
@@ -4341,8 +4531,8 @@ async function writePushedFile(request) {
     }
     if (missingSegments.length > 0) {
       await createMissingDirectories(existingAncestor, missingSegments);
-      const realParent = await realpath(dirname4(realTarget));
-      if (realParent !== dirname4(realTarget) || !contains(allowedDirectory, realTarget)) {
+      const realParent = await realpath(dirname5(realTarget));
+      if (realParent !== dirname5(realTarget) || !contains(allowedDirectory, realTarget)) {
         return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
           path: realTarget,
           bytes,
@@ -4367,7 +4557,7 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join5(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join6(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
@@ -4385,7 +4575,7 @@ async function resolveNearestExistingAncestor(directory) {
     try {
       return { existingAncestor: await realpath(current), missingSegments };
     } catch (err) {
-      const parent = dirname4(current);
+      const parent = dirname5(current);
       if (err.code !== "ENOENT" || parent === current) {
         throw err;
       }
@@ -4440,13 +4630,13 @@ function contains(realDirectory, realTarget) {
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join5(current, segment);
+    current = join6(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join5(dirname4(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join6(dirname5(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
     handle = await open2(temporaryPath, "wx", FILE_MODE);
@@ -4576,12 +4766,12 @@ var NOT_APPLIED = {
   opencodeAuthApplied: false
 };
 function isClaudeCredentialPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join6(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join6(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join7(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join7(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
 }
 function isOpenCodeAuthPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join6(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join6(homeDir, ...OPENCODE_AUTH_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join7(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join7(homeDir, ...OPENCODE_AUTH_SEGMENTS);
 }
 async function applyOne(options, file) {
   const label = `${file.id.slice(0, 8)} (${file.path})`;
@@ -5108,6 +5298,7 @@ var ChannelDriver = class _ChannelDriver {
    * and stops opencode.
    */
   stopped = false;
+  recycleRequestedFlag = false;
   constructor(config) {
     this.agentId = config.agentId;
     this.port = config.port;
@@ -5213,6 +5404,9 @@ var ChannelDriver = class _ChannelDriver {
     let dispatched = 0;
     try {
       const conversations = await this.getPendingConversations();
+      if (this.recycleRequestedFlag) {
+        this.stop();
+      }
       if (conversations.length > 0) {
         const total = conversations.reduce((sum, c) => sum + (c.pending_message_count ?? 0), 0);
         this.log({
@@ -5341,6 +5535,14 @@ var ChannelDriver = class _ChannelDriver {
   stop() {
     this.stopped = true;
   }
+  /**
+   * The server clears this request when a new MicroVM identity is recorded, so a
+   * same-VM tunnel reconnect does not consume it. This is a plain read rather
+   * than a consume; `run.ts` guards the action once-only.
+   */
+  get recycleRequested() {
+    return this.recycleRequestedFlag;
+  }
   /**
    * Wait (up to `timeoutMs`) for in-flight watcher work to settle during a
    * graceful shutdown, so a turn whose reply is ready — or completes within the
@@ -5478,7 +5680,7 @@ var ChannelDriver = class _ChannelDriver {
           this.signalDispatchNotStarted(conv, message, "session_existence_unknown");
           break;
         }
-        const errorMessage = err instanceof Error ? err.message : String(err);
+        const errorMessage2 = err instanceof Error ? err.message : String(err);
         this.sessions.delete(conv.id);
         this.supersede(conv.id, sessionId);
         this.log({
@@ -5487,7 +5689,7 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
+        await this.markFailed(conv.id, message.id, null, errorMessage2).catch((markErr) => {
           this.log({
             level: "warn",
             message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
@@ -5498,7 +5700,7 @@ var ChannelDriver = class _ChannelDriver {
         });
         this.log({
           level: "error",
-          message: `Message ${message.id.slice(0, 8)} dispatch failed: ${errorMessage}`,
+          message: `Message ${message.id.slice(0, 8)} dispatch failed: ${errorMessage2}`,
           conversation_id: conv.id,
           message_id: message.id
         });
@@ -5519,14 +5721,14 @@ var ChannelDriver = class _ChannelDriver {
         this.unconfirmedDispatchFailures.delete(message.id);
         this.sessions.delete(conv.id);
         this.supersede(conv.id, sessionId);
-        const errorMessage = `OpenCode accepted this message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        const errorMessage2 = `OpenCode accepted this message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
         this.log({
           level: "error",
-          message: errorMessage,
+          message: errorMessage2,
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
+        await this.markFailed(conv.id, message.id, null, errorMessage2).catch((markErr) => {
           this.log({
             level: "warn",
             message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
@@ -7490,14 +7692,14 @@ var ChannelDriver = class _ChannelDriver {
         this.unconfirmedDispatchFailures.delete(row.id);
         this.sessions.delete(readoptConv.id);
         this.supersede(readoptConv.id, sessionId);
-        const errorMessage = `OpenCode accepted this re-dispatched message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        const errorMessage2 = `OpenCode accepted this re-dispatched message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
         this.log({
           level: "error",
-          message: errorMessage,
+          message: errorMessage2,
           conversation_id: row.conversation_id,
           message_id: row.id
         });
-        await this.markFailed(row.conversation_id, row.id, null, errorMessage).catch((markErr) => {
+        await this.markFailed(row.conversation_id, row.id, null, errorMessage2).catch((markErr) => {
           this.log({
             level: "warn",
             message: `markFailed PATCH for message ${row.id.slice(0, 8)} (conversation ${row.conversation_id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
@@ -8112,6 +8314,7 @@ var ChannelDriver = class _ChannelDriver {
       throw new Error(`Failed to get pending conversations: HTTP ${res.status}`);
     }
     const data = await res.json();
+    this.recycleRequestedFlag = data.recycle_requested === true;
     let conversations = data.conversations;
     if (this.conversationFilter) {
       conversations = conversations.filter((c) => c.id === this.conversationFilter);
@@ -8629,7 +8832,7 @@ Port ${port} is already in use.`));
 }
 
 // src/lib/runner-credentials.ts
-import { chmodSync as chmodSync2, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync as chmodSync2, writeFileSync as writeFileSync4 } from "fs";
 import { spawn as spawn5 } from "child_process";
 var RUNNER_SECRET_FETCH_TIMEOUT_MS = 6e4;
 var CREDENTIAL_RESTORE_TIMEOUT_MS = 6e4;
@@ -8870,8 +9073,8 @@ async function configureGitHubAccess({ env, log: log3 }) {
   }
   try {
     env.GIT_CONFIG_GLOBAL = GIT_CONFIG_GLOBAL;
-    writeFileSync3(GIT_CONFIG_GLOBAL, "");
-    writeFileSync3(GIT_CREDENTIAL_HELPER, GIT_CREDENTIAL_HELPER_CONTENT, { mode: 448 });
+    writeFileSync4(GIT_CONFIG_GLOBAL, "");
+    writeFileSync4(GIT_CREDENTIAL_HELPER, GIT_CREDENTIAL_HELPER_CONTENT, { mode: 448 });
     chmodSync2(GIT_CREDENTIAL_HELPER, 448);
     const config = [
       ["user.name", env.GIT_USER_NAME ?? "evident-bot"],
@@ -8904,7 +9107,7 @@ async function configureGitHubAccess({ env, log: log3 }) {
 // src/lib/opencode/config-overlay.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { copyFileSync, existsSync as existsSync2, statSync as statSync5 } from "fs";
-import { isAbsolute as isAbsolute2, join as join7, resolve as resolve3 } from "path";
+import { isAbsolute as isAbsolute2, join as join8, resolve as resolve3 } from "path";
 function isFile(filePath) {
   return existsSync2(filePath) && statSync5(filePath).isFile();
 }
@@ -8918,7 +9121,7 @@ function applyRunnerOpenCodeConfig({
     return;
   }
   const source = isAbsolute2(overlayPath) ? overlayPath : resolve3(cwd, overlayPath);
-  const target = isFile(join7(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
+  const target = isFile(join8(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
   if (!isFile(source)) {
     log3(
       `RUNNER-OPENCODE-CONFIG-MISSING: ${source} is not a file; headless turns will wedge on the first external-directory permission prompt (#563)`,
@@ -8926,7 +9129,7 @@ function applyRunnerOpenCodeConfig({
     );
     return;
   }
-  copyFileSync(source, join7(cwd, target));
+  copyFileSync(source, join8(cwd, target));
   try {
     execFileSync2("git", ["-C", cwd, "update-index", "--skip-worktree", target], {
       stdio: "ignore"
@@ -8935,7 +9138,242 @@ function applyRunnerOpenCodeConfig({
     const detail = error2 instanceof Error ? error2.message : String(error2);
     log3(`could not mark ${target} skip-worktree: ${detail}; it may show as a local change`, "warn");
   }
-  log3(`Applied runner OpenCode config ${source} to ${join7(cwd, target)}`);
+  log3(`Applied runner OpenCode config ${source} to ${join8(cwd, target)}`);
+}
+
+// src/lib/credential-sync.ts
+import { renameSync, writeFileSync as writeFileSync5 } from "fs";
+var CREDENTIAL_SYNC_TICK_TIMEOUT_MS = 3e4;
+var CREDENTIAL_FLUSH_DEADLINE_MS = 8e3;
+var CREDENTIAL_FLUSH_ABORT_GRACE_MS = 500;
+var DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS = 60;
+var STORES = ["claude", "opencode"];
+var MAX_FLUSH_PASSES = 2;
+function outcomesWith(outcome) {
+  return { claude: outcome, opencode: outcome };
+}
+function errorMessage(error2) {
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+function waitForSettlement(promise, timeoutMs) {
+  return new Promise((resolve4) => {
+    let settled = false;
+    const timer = setTimeout(() => finish(false), Math.max(0, timeoutMs));
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve4(value);
+    };
+    promise.then(
+      () => finish(true),
+      () => finish(true)
+    );
+  });
+}
+function writeMarker(markerPath, outcomes, log3) {
+  const body = `${STORES.map((store) => `${store}=${outcomes[store]}`).join("\n")}
+`;
+  const temporaryPath = `${markerPath}.tmp`;
+  try {
+    writeFileSync5(temporaryPath, body, { mode: 384 });
+    renameSync(temporaryPath, markerPath);
+  } catch (error2) {
+    log3(`CREDENTIAL-FLUSH-MARKER-UNWRITABLE: ${markerPath}: ${errorMessage(error2)}`, "warn");
+  }
+}
+function intervalSeconds(env, log3) {
+  const raw = env.CREDS_SYNC_INTERVAL;
+  if (raw === void 0 || /^[1-9][0-9]*$/.test(raw) && Number.isSafeInteger(Number(raw))) {
+    return raw === void 0 ? DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS : Number(raw);
+  }
+  log3(
+    `CREDENTIAL-SYNC-INTERVAL-INVALID: CREDS_SYNC_INTERVAL='${raw}' is not a positive integer; using ${DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS}s`,
+    "warn"
+  );
+  return DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS;
+}
+async function runFlushStore(store, env, synchroniserRunner, log3, deadlineAt) {
+  const remainingMs = deadlineAt - Date.now();
+  if (remainingMs <= 0) return { outcome: "timeout", orphaned: false };
+  const controller = new AbortController();
+  let result;
+  let failed = false;
+  const completion = Promise.resolve().then(
+    () => synchroniserRunner(["sync-once", store], {
+      timeoutMs: remainingMs,
+      env,
+      signal: controller.signal
+    })
+  ).then(
+    (value) => {
+      result = value;
+    },
+    (error2) => {
+      failed = true;
+      log3(`CREDENTIAL-FLUSH-ERROR: ${store}: ${errorMessage(error2)}`, "warn");
+    }
+  );
+  const abortTimer = setTimeout(() => controller.abort(), remainingMs);
+  const settledBeforeDeadline = await waitForSettlement(completion, remainingMs);
+  clearTimeout(abortTimer);
+  if (!settledBeforeDeadline) {
+    controller.abort();
+    const settledAfterAbort = await waitForSettlement(completion, CREDENTIAL_FLUSH_ABORT_GRACE_MS);
+    if (!settledAfterAbort) return { outcome: "timeout", orphaned: true };
+    return { outcome: "timeout", orphaned: false };
+  }
+  if (failed || !result) return { outcome: "failed", orphaned: false };
+  if (result.timedOut || Date.now() >= deadlineAt) {
+    return { outcome: "timeout", orphaned: false };
+  }
+  return { outcome: result.code === 0 ? "ok" : "failed", orphaned: false };
+}
+function createCredentialSync({
+  markerPath,
+  env,
+  log: log3,
+  synchroniserRunner = runSynchroniser
+}) {
+  const persistenceDisabled = !env.PERSISTENCE_BUCKET;
+  let disabled = persistenceDisabled;
+  let armed = false;
+  let stopped = false;
+  let timer;
+  let inFlight;
+  let activeTickAbort;
+  let lastTickFailed;
+  let flushPromise;
+  const scheduleTick = (intervalMs, startTick2) => {
+    if (stopped) return;
+    timer = setTimeout(() => {
+      timer = void 0;
+      startTick2();
+    }, intervalMs);
+  };
+  const startTick = (intervalMs) => {
+    if (stopped) return;
+    const controller = new AbortController();
+    activeTickAbort = controller;
+    const tick = (async () => {
+      const outcomes = {
+        claude: "failed",
+        opencode: "failed"
+      };
+      for (const store of STORES) {
+        if (controller.signal.aborted) break;
+        try {
+          const result = await synchroniserRunner(["sync-once", store], {
+            timeoutMs: CREDENTIAL_SYNC_TICK_TIMEOUT_MS,
+            env,
+            signal: controller.signal
+          });
+          outcomes[store] = !result.timedOut && result.code === 0 ? "ok" : "failed";
+        } catch (error2) {
+          outcomes[store] = "failed";
+          log3(`CREDENTIAL-SYNC-TICK-ERROR: ${store}: ${errorMessage(error2)}`, "debug");
+        }
+      }
+      const failed = STORES.some((store) => outcomes[store] === "failed");
+      log3(
+        `CREDENTIAL-SYNC-TICK: claude=${outcomes.claude}, opencode=${outcomes.opencode}`,
+        "debug"
+      );
+      if (failed && lastTickFailed !== true) {
+        log3(
+          "CREDENTIAL-SYNC-FAILED: an interval credential sync failed; retrying on the next tick",
+          "warn"
+        );
+      } else if (!failed && lastTickFailed === true) {
+        log3("CREDENTIAL-SYNC-RECOVERED: interval credential sync succeeded again", "warn");
+      }
+      lastTickFailed = failed;
+    })().finally(() => {
+      if (activeTickAbort === controller) activeTickAbort = void 0;
+      if (inFlight === tick) inFlight = void 0;
+      scheduleTick(intervalMs, () => startTick(intervalMs));
+    });
+    inFlight = tick;
+  };
+  const performFlush = async () => {
+    stopped = true;
+    if (timer) {
+      clearTimeout(timer);
+      timer = void 0;
+    }
+    const deadlineAt = Date.now() + CREDENTIAL_FLUSH_DEADLINE_MS;
+    if (inFlight) {
+      const settled = await waitForSettlement(inFlight, CREDENTIAL_FLUSH_DEADLINE_MS);
+      if (!settled) {
+        activeTickAbort?.abort();
+        const settledAfterAbort = await waitForSettlement(
+          inFlight,
+          CREDENTIAL_FLUSH_ABORT_GRACE_MS
+        );
+        if (!settledAfterAbort) {
+          log3(
+            "CREDENTIAL-FLUSH-ORPHANED-TICK: a sync-once child could not be proven settled; skipping the boundary flush rather than becoming a second writer",
+            "warn"
+          );
+          return { outcomes: outcomesWith("timeout"), orphaned: true };
+        }
+      }
+    }
+    if (disabled) return { outcomes: outcomesWith("skipped"), orphaned: false };
+    const outcomes = outcomesWith("timeout");
+    for (const store of STORES) {
+      const result = await runFlushStore(store, env, synchroniserRunner, log3, deadlineAt);
+      if (result.orphaned) {
+        log3(
+          "CREDENTIAL-FLUSH-ORPHANED-CHILD: a flush sync-once child could not be proven settled; refusing another flush pass rather than becoming a second writer",
+          "warn"
+        );
+        return { outcomes: outcomesWith("timeout"), orphaned: true };
+      }
+      outcomes[store] = result.outcome;
+    }
+    return { outcomes, orphaned: false };
+  };
+  let flushPasses = 0;
+  let lastFlush;
+  return {
+    arm() {
+      if (stopped || armed) return;
+      armed = true;
+      if (persistenceDisabled) {
+        disabled = true;
+        log3(
+          "CREDENTIAL-SYNC-DISABLED: LITESTREAM_BUCKET/LITESTREAM_PREFIX are not both set; no interval credential sync this boot",
+          "warn"
+        );
+        return;
+      }
+      disabled = false;
+      const intervalMs = intervalSeconds(env, log3) * 1e3;
+      scheduleTick(intervalMs, () => startTick(intervalMs));
+    },
+    async stopAndFlush(publish) {
+      let result;
+      const runningFlush = flushPromise;
+      if (runningFlush) {
+        result = await runningFlush;
+      } else if (flushPasses >= MAX_FLUSH_PASSES || lastFlush?.orphaned) {
+        result = lastFlush ?? { outcomes: outcomesWith("timeout"), orphaned: true };
+      } else {
+        flushPasses++;
+        const currentFlush = performFlush();
+        flushPromise = currentFlush;
+        try {
+          result = await currentFlush;
+          lastFlush = result;
+        } finally {
+          if (flushPromise === currentFlush) flushPromise = void 0;
+        }
+      }
+      if (publish) writeMarker(markerPath, result.outcomes, log3);
+      return result.outcomes;
+    }
+  };
 }
 
 // src/commands/run.ts
@@ -8975,7 +9413,7 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join8(homeDir, trimmed.slice(2)) : trimmed;
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join9(homeDir, trimmed.slice(2)) : trimmed;
     if (!isAbsolute3(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
@@ -9235,6 +9673,10 @@ async function driveChannels(state, driver) {
       consecutiveDrainFailures = 0;
       unreachableMs = 0;
       state.messageCount += processed;
+      if (driver.recycleRequested) {
+        await beginGracefulShutdown(state, "recycle");
+        return;
+      }
       const proxiedActivity = state.lastProxiedActivityAt !== lastSeenProxiedActivityAt;
       lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
       const fileActivitySnapshot = driver.fileSyncActivity();
@@ -9277,8 +9719,8 @@ async function driveChannels(state, driver) {
         state.running = false;
         break;
       }
-      const errorMessage = error2 instanceof Error ? error2.message : String(error2);
-      logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage}` });
+      const errorMessage2 = error2 instanceof Error ? error2.message : String(error2);
+      logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage2}` });
       if (state.interactive) displayStatus(state);
       if (driver.hasInFlightWatchers()) {
         consecutiveDrainFailures = 0;
@@ -9318,7 +9760,43 @@ async function driveChannels(state, driver) {
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
 var SESSION_DB_RECLAIM_MAX_PAGES = 2e3;
 function sessionDbPath() {
-  return join8(homedir5(), ".local", "share", "opencode", "opencode.db");
+  return join9(homedir5(), ".local", "share", "opencode", "opencode.db");
+}
+function logSessionDbProvenanceMismatch(state, provenance, currentVersion, preBootMigrationCount) {
+  const record = {
+    v: 1,
+    event: "session_db_recovery",
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    stage: "verify",
+    outcome: "schema_provenance_mismatch",
+    severity: "error",
+    reason: provenance.reason ?? "schema-provenance-mismatch",
+    litestream_exit_code: null,
+    attempt: null,
+    replica_objects: null,
+    replica_bytes: null,
+    quarantine_destination: null,
+    quarantined_objects: null,
+    quarantine_failed_objects: null,
+    quarantined_bytes: null,
+    verified_restore_point: null,
+    restore_points_tried: null,
+    provenance_reason: provenance.reason,
+    provenance_migration_delta: provenance.migrationDelta,
+    replication_suspended: false,
+    dbPath: sessionDbPath(),
+    recorded_version: provenance.recordedVersion,
+    current_version: currentVersion,
+    provenance_pre_boot_migration_count: preBootMigrationCount
+  };
+  const activity = buildSessionDbRecoveryActivity(record);
+  if (!activity) throw new Error("could not map session-DB provenance activity");
+  logActivity(state, {
+    type: activity.level === "error" ? "error" : "info",
+    level: activity.level,
+    ...activity.level === "error" ? { error: activity.message } : { message: activity.message },
+    metadata: activity.metadata
+  });
 }
 async function runSweep(state, driver, config) {
   const mode = `age=${config.maxAgeMs ?? "\u2014"} count=${config.maxCount ?? "\u2014"}`;
@@ -9365,7 +9843,7 @@ async function runSweep(state, driver, config) {
     const reclaimResult = await reclaimSessionDbSpace({
       dbPath: sessionDbPath(),
       maxPages: SESSION_DB_RECLAIM_MAX_PAGES,
-      allowFullVacuum: protectedNow.size === 0
+      allowFullVacuum: protectedNow.size === 0 && !state.sessionDbProvenanceAnomaly
     });
     if (reclaimResult.ok) {
       const beforeMib = (reclaimResult.beforeBytes / 1024 / 1024).toFixed(1);
@@ -9712,21 +10190,39 @@ async function cleanup(state, opts = {}) {
     clearTimeout(state.resourceUsageTimer);
     state.resourceUsageTimer = null;
   }
+  const credentialSync = state.credentialSync;
+  const flushCredentials = credentialSync ? async (phase, publish) => {
+    await timeShutdownPhase(state, durations, phase, async () => {
+      const outcomes = await credentialSync.stopAndFlush(publish);
+      const level = Object.values(outcomes).every((outcome) => outcome === "ok") ? "info" : "warn";
+      log2(
+        state,
+        `Credential flush: claude=${outcomes.claude}, opencode=${outcomes.opencode}`,
+        level
+      );
+    });
+  } : void 0;
+  let drainSettled = true;
   if (opts.graceful && state.channelDriver) {
     state.channelDriver.stop();
+  }
+  if (flushCredentials) {
+    await flushCredentials("credential_flush", !(opts.graceful && state.channelDriver));
+  }
+  if (opts.graceful && state.channelDriver) {
     log2(state, "Draining in-flight channel work before shutdown...");
     if (state.interactive) {
       logActivity(state, { type: "info", message: "Draining in-flight work before shutdown..." });
       displayStatus(state);
     }
     const driver = state.channelDriver;
-    const settled = await timeShutdownPhase(
+    drainSettled = await timeShutdownPhase(
       state,
       durations,
       "drain",
       () => driver.waitForInFlight(SHUTDOWN_DRAIN_TIMEOUT_MS)
     );
-    if (!settled) {
+    if (!drainSettled) {
       logActivity(state, {
         type: "info",
         message: "Shutdown drain timed out with work still in flight \u2014 leaving it for restart recovery"
@@ -9734,6 +10230,9 @@ async function cleanup(state, opts = {}) {
       if (state.interactive) displayStatus(state);
     }
   }
+  if (opts.graceful && state.channelDriver && flushCredentials && drainSettled) {
+    await flushCredentials("credential_flush_final", true);
+  }
   await timeShutdownPhase(state, durations, "offline_notify", () => notifyOffline(state));
   if (state.connection) {
     const connection = state.connection;
@@ -9769,6 +10268,44 @@ async function cleanup(state, opts = {}) {
   }
   return durations;
 }
+async function beginGracefulShutdown(state, trigger) {
+  if (state.shuttingDown) return;
+  state.shuttingDown = true;
+  const shutdownStartedAt = Date.now();
+  const shutdownMessage = trigger === "recycle" ? "Recycle requested \u2014 finishing in-flight work, then exiting" : "Shutting down...";
+  if (state.interactive) {
+    logActivity(state, { type: "info", message: shutdownMessage });
+    displayStatus(state);
+  } else {
+    log2(state, shutdownMessage);
+  }
+  const durations = await cleanup(state, { graceful: true });
+  const telemetryBudgetMs = Number(process.env.EVIDENT_TELEMETRY_SHUTDOWN_MS) || TELEMETRY_SHUTDOWN_TIMEOUT_MS;
+  await timeShutdownPhase(state, durations, "telemetry_flush", async () => {
+    let timer;
+    const flushed = shutdownTelemetry().then(
+      () => true,
+      (error2) => {
+        log2(
+          state,
+          `Telemetry flush failed during shutdown: ${error2 instanceof Error ? error2.message : String(error2)}`,
+          "warn"
+        );
+        return true;
+      }
+    );
+    const timedOut = new Promise((resolve4) => {
+      timer = setTimeout(() => resolve4(false), telemetryBudgetMs);
+    });
+    if (!await Promise.race([flushed, timedOut])) {
+      log2(state, `Telemetry flush exceeded ${telemetryBudgetMs}ms \u2014 exiting anyway`, "warn");
+    }
+    clearTimeout(timer);
+  });
+  const breakdown = Object.entries(durations).map(([phase, ms]) => `${phase}=${ms}ms`).join(" ");
+  log2(state, `Shutdown complete in ${Date.now() - shutdownStartedAt}ms (${breakdown})`);
+  process.exit(0);
+}
 async function run(options) {
   const interactive = isInteractive(options.json);
   let logLevel;
@@ -9804,6 +10341,7 @@ async function run(options) {
     connected: false,
     opencodeConnected: false,
     opencodeVersion: null,
+    sessionDbProvenanceAnomaly: false,
     opencodeProcess: null,
     litestreamProcess: null,
     connection: null,
@@ -9819,9 +10357,23 @@ async function run(options) {
     openaiUsageTimer: null,
     openaiUsageRearm: null,
     resourceUsageTimer: null,
+    credentialSync: null,
     authHeader: ""
   };
   setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
+  if (options.credentialSyncMarker) {
+    state.credentialSync = createCredentialSync({
+      markerPath: options.credentialSyncMarker,
+      env: process.env,
+      log: (message, level = "info") => {
+        if (level === "error") {
+          logActivity(state, { type: "error", error: message });
+        } else {
+          logActivity(state, { type: "info", level, message });
+        }
+      }
+    });
+  }
   if (fileSyncDirectories.length > 0) {
     log2(state, `File sync enabled for: ${fileSyncDirectories.join(", ")}`);
   } else {
@@ -9847,43 +10399,7 @@ async function run(options) {
       "warn"
     );
   }
-  const handleSignal = async () => {
-    if (state.shuttingDown) return;
-    state.shuttingDown = true;
-    const shutdownStartedAt = Date.now();
-    if (state.interactive) {
-      logActivity(state, { type: "info", message: "Shutting down..." });
-      displayStatus(state);
-    } else {
-      log2(state, "Shutting down...");
-    }
-    const durations = await cleanup(state, { graceful: true });
-    const telemetryBudgetMs = Number(process.env.EVIDENT_TELEMETRY_SHUTDOWN_MS) || TELEMETRY_SHUTDOWN_TIMEOUT_MS;
-    await timeShutdownPhase(state, durations, "telemetry_flush", async () => {
-      let timer;
-      const flushed = shutdownTelemetry().then(
-        () => true,
-        (error2) => {
-          log2(
-            state,
-            `Telemetry flush failed during shutdown: ${error2 instanceof Error ? error2.message : String(error2)}`,
-            "warn"
-          );
-          return true;
-        }
-      );
-      const timedOut = new Promise((resolve4) => {
-        timer = setTimeout(() => resolve4(false), telemetryBudgetMs);
-      });
-      if (!await Promise.race([flushed, timedOut])) {
-        log2(state, `Telemetry flush exceeded ${telemetryBudgetMs}ms \u2014 exiting anyway`, "warn");
-      }
-      clearTimeout(timer);
-    });
-    const breakdown = Object.entries(durations).map(([phase, ms]) => `${phase}=${ms}ms`).join(" ");
-    log2(state, `Shutdown complete in ${Date.now() - shutdownStartedAt}ms (${breakdown})`);
-    process.exit(0);
-  };
+  const handleSignal = () => beginGracefulShutdown(state, "signal");
   process.on("SIGINT", handleSignal);
   process.on("SIGTERM", handleSignal);
   try {
@@ -10029,6 +10545,7 @@ async function run(options) {
       await restoreCredentialStores(credentialContext);
       if (githubTokenPopulated) await configureGitHubAccess(credentialContext);
     }
+    state.credentialSync?.arm();
     let sessionDbVerifyFatal = false;
     if (!options.restoreSessionDb) {
       log2(state, "Skipping session-DB restore: --restore-session-db was not passed", "debug");
@@ -10082,6 +10599,7 @@ async function run(options) {
     for (const warning2 of maxActiveSessionsWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
     }
+    const preBootMigrationIds = readSessionDbMigrationIds(sessionDbPath());
     const ocSpinner = interactive && !state.json ? ora3("Checking OpenCode...").start() : null;
     try {
       const oc = await ensureOpenCodeRunning({
@@ -10097,7 +10615,7 @@ async function run(options) {
       state.opencodeVersion = oc.version;
       if (options.opencodePidFile && oc.process?.pid !== void 0) {
         try {
-          writeFileSync4(options.opencodePidFile, `${oc.process.pid}
+          writeFileSync6(options.opencodePidFile, `${oc.process.pid}
 `, { mode: 384 });
           chmodSync3(options.opencodePidFile, 384);
         } catch (error2) {
@@ -10107,6 +10625,23 @@ async function run(options) {
           });
         }
       }
+      if (state.opencodeVersion !== null) {
+        const provenance = checkSessionDbProvenance({
+          dbPath: sessionDbPath(),
+          currentVersion: state.opencodeVersion,
+          homeDir: homedir5(),
+          env: process.env
+        });
+        if (provenance.anomaly) {
+          state.sessionDbProvenanceAnomaly = true;
+          logSessionDbProvenanceMismatch(
+            state,
+            provenance,
+            state.opencodeVersion,
+            preBootMigrationIds?.length ?? null
+          );
+        }
+      }
       state.opencodeConnected = oc.notReadyReason === null;
       const version2 = state.opencodeVersion ? ` (v${state.opencodeVersion})` : "";
       ocSpinner?.succeed(`OpenCode running on port ${state.port}${version2}`);
@@ -10159,7 +10694,7 @@ async function run(options) {
         let existingPid;
         if (existsSync3(options.litestreamPidFile)) {
           try {
-            const rawPid = readFileSync5(options.litestreamPidFile, "utf8").trim();
+            const rawPid = readFileSync6(options.litestreamPidFile, "utf8").trim();
             const parsedPid = Number(rawPid);
             if (/^\d+$/.test(rawPid) && Number.isSafeInteger(parsedPid) && parsedPid > 0) {
               existingPid = parsedPid;
@@ -10196,7 +10731,7 @@ async function run(options) {
           });
           try {
             if (litestreamProcess.pid !== void 0) {
-              writeFileSync4(options.litestreamPidFile, `${litestreamProcess.pid}
+              writeFileSync6(options.litestreamPidFile, `${litestreamProcess.pid}
 `, {
                 mode: 384
               });
@@ -10402,7 +10937,17 @@ async function run(options) {
       setTimer: (timer) => {
         state.openaiUsageTimer = timer;
       },
-      fetchUsage: () => getOpenAiUsage(state.port),
+      fetchUsage: async () => {
+        const usage = await getOpenAiUsage(state.port);
+        if (usage.subscription === null) {
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: "OpenAI usage subscription could not be identified from the local credential"
+          });
+        }
+        return usage;
+      },
       report: (usage) => reportOpenAiUsage(state.agentId, state.authHeader, usage),
       isLocalCredentialProblem: isLocalCredentialProblem2,
       forcedOnHint: "connect a ChatGPT account to this runner, or run `opencode auth login`",
@@ -10448,7 +10993,7 @@ async function run(options) {
 }
 
 // src/index.ts
-var { version } = createRequire(import.meta.url)("../package.json");
+var { version } = createRequire2(import.meta.url)("../package.json");
 var program = new Command();
 program.name("evident").description("Run OpenCode locally and connect it to Evident").version(version).option(
   "--endpoint <url>",
@@ -10526,6 +11071,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--opencode-config-overlay <path>",
   "Apply this runner-provided OpenCode config before starting OpenCode."
+).option(
+  "--credential-sync-marker <path>",
+  "Own the interval credential sync and write this marker once the shutdown flush has finished, so the runner image's lifecycle hooks can wait on it."
 ).action(
   (options) => {
     run({
@@ -10564,7 +11112,8 @@ program.command("run").description("Connect to Evident and process messages").op
       sessionDbNoReplicateMarker: options.sessionDbNoReplicateMarker,
       restoreSessionDb: options.restoreSessionDb,
       restoreRunnerCredentials: options.restoreRunnerCredentials,
-      opencodeConfigOverlay: options.opencodeConfigOverlay
+      opencodeConfigOverlay: options.opencodeConfigOverlay,
+      credentialSyncMarker: options.credentialSyncMarker
     });
   }
 );