@evident-ai/cli 3.4.1-dev.8fa4d29 → 3.4.1-dev.aa71e9a

package/dist/index.js

@@ -746,6 +746,40 @@ async function reportClaudeUsage(agentId, authHeader, snapshot) {
     return { ok: false, error: describeBestEffortError(error2) };
   }
 }
+function toReportedOpenAiWindow(window) {
+  if (!window) return null;
+  return {
+    utilization: window.utilization,
+    window_minutes: window.windowMinutes,
+    resets_at: window.resetsAt
+  };
+}
+async function reportOpenAiUsage(agentId, authHeader, snapshot) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/openai-usage`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        primary: toReportedOpenAiWindow(snapshot.primary),
+        secondary: toReportedOpenAiWindow(snapshot.secondary),
+        has_credits: snapshot.hasCredits,
+        credits_unlimited: snapshot.creditsUnlimited
+      }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
 async function reportResourceUsage(agentId, authHeader, usage) {
   try {
     const apiUrl = getApiUrlConfig();
@@ -1092,8 +1126,8 @@ async function claudeUsage() {
 }
 
 // src/commands/run.ts
-import { homedir as homedir3 } from "os";
-import { isAbsolute as isAbsolute2, join as join5, parse, resolve as resolvePath } from "path";
+import { homedir as homedir4 } from "os";
+import { isAbsolute as isAbsolute2, join as join7, parse, resolve as resolvePath } from "path";
 import chalk6 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
@@ -1326,6 +1360,8 @@ var SEVERITY_BY_LEVEL = {
   error: "error"
 };
 var MAX_MESSAGE_LENGTH = 500;
+var MAX_METADATA_VALUE_LENGTH = 200;
+var MAX_METADATA_ENTRIES = 20;
 var TRUNCATION_MARKER = "\u2026";
 function redact(message) {
   return message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/https?:\/\/\S+/g, "<url>");
@@ -1334,6 +1370,24 @@ function truncate(message) {
   if (message.length <= MAX_MESSAGE_LENGTH) return message;
   return message.slice(0, MAX_MESSAGE_LENGTH - TRUNCATION_MARKER.length) + TRUNCATION_MARKER;
 }
+function sanitiseMetadata(metadata) {
+  if (!metadata) return {};
+  const entries = Object.entries(metadata).slice(0, MAX_METADATA_ENTRIES);
+  if (Object.keys(metadata).length > entries.length) {
+    console.error(
+      `[runner-activity-telemetry] dropped ${Object.keys(metadata).length - entries.length} metadata entries`
+    );
+  }
+  const sanitised = [];
+  for (const [key, value] of entries) {
+    if (typeof value === "string") {
+      sanitised.push([key, truncate(redact(value).slice(0, MAX_METADATA_VALUE_LENGTH))]);
+    } else if (value === null || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) {
+      sanitised.push([key, value]);
+    }
+  }
+  return Object.fromEntries(sanitised);
+}
 var RATE_LIMIT_WINDOW_MS = 6e4;
 var RATE_LIMIT_MAX_EVENTS = 30;
 var windowStartedAt = 0;
@@ -1372,7 +1426,7 @@ function forwardRunnerActivity(entry, context) {
     logEvent(TelemetryEventTypes.RUNNER_ACTIVITY, {
       severity: SEVERITY_BY_LEVEL[entry.level],
       message,
-      metadata: { source: "cli.run" },
+      metadata: { ...sanitiseMetadata(entry.metadata), source: "cli.run" },
       agentId: context.agentId
     });
   } catch (err) {
@@ -1382,6 +1436,143 @@ function forwardRunnerActivity(entry, context) {
   }
 }
 
+// src/lib/opencode/session-db-recovery-report.ts
+import { readFileSync as readFileSync2, unlinkSync } from "fs";
+import { join as join2 } from "path";
+function sessionDbRecoveryReportPath(homeDir, env) {
+  const override = env.EVIDENT_SESSION_DB_RECOVERY_REPORT?.trim();
+  return override || join2(homeDir, ".local", "state", "evident", "session-db-recovery.jsonl");
+}
+function drainSessionDbRecoveryReport({
+  homeDir,
+  env
+}) {
+  const path = sessionDbRecoveryReportPath(homeDir, env);
+  let content;
+  try {
+    content = readFileSync2(path, "utf8");
+  } catch (error2) {
+    if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT")
+      return { path, records: [], skippedLines: 0, readError: null };
+    const readError = error2 instanceof Error ? error2.message : String(error2);
+    console.error(`[session-db-recovery-report] could not read ${path}: ${readError}`);
+    return { path, records: [], skippedLines: 0, readError };
+  }
+  let skippedLines = 0;
+  const records = content.split("\n").flatMap((line) => {
+    if (!line.trim()) return [];
+    try {
+      const value = JSON.parse(line);
+      if (!isSessionDbRecoveryRecord(value)) {
+        skippedLines++;
+        return [];
+      }
+      return [value];
+    } catch (error2) {
+      skippedLines++;
+      console.error(
+        `[session-db-recovery-report] skipped malformed record in ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+      return [];
+    }
+  });
+  return { path, records, skippedLines, readError: null };
+}
+function acknowledgeSessionDbRecoveryReport(path) {
+  try {
+    unlinkSync(path);
+  } catch (error2) {
+    if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") return;
+    console.error(
+      `[session-db-recovery-report] could not remove ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+  }
+}
+function buildSessionDbRecoveryActivity(record) {
+  const level = record.severity === "warning" ? "warn" : record.severity === "error" ? "error" : null;
+  if (!level) return null;
+  const noVerifiedPoint = record.verified_restore_point ? ` The verified restore point is ${record.verified_restore_point}.` : " No verified restore point is known.";
+  switch (record.outcome) {
+    case "fresh_session_db":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: `This runner started with a fresh session database. Earlier sessions are unavailable, and queued conversation or session references from before this start may no longer resolve.${noVerifiedPoint} Review the runner's backup configuration before relying on restored session history.`
+      };
+    case "restore_retried":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: "The initial session database restore failed; the runner will retry it. Monitor the runner backup for another restore failure."
+      };
+    case "replica_recovered":
+      if (record.reason === "quarantine")
+        return {
+          level,
+          metadata: withoutContractFields(record),
+          message: `Session database recovery quarantined ${record.quarantined_objects ?? "unknown"} objects (${record.quarantined_bytes ?? "unknown"} bytes); ${record.quarantine_failed_objects ?? "unknown"} moves failed. Review the preserved backup at ${record.quarantine_destination ?? "an unknown destination"} before deleting it.`
+        };
+      if (record.reason === "prune")
+        return {
+          level,
+          metadata: withoutContractFields(record),
+          message: "Session database recovery discarded a damaged newest backup and retried. Sessions recorded after the previous backup point may be unavailable. Review the runner backup for another restore failure."
+        };
+      if (record.reason === "clear")
+        return {
+          level,
+          metadata: withoutContractFields(record),
+          message: "Session database recovery deleted the damaged backup and prior session history is unavailable. Review the runner backup configuration before relying on restored session history."
+        };
+      return null;
+    case "history_rolled_back":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: `Session history was rolled back to verified restore point ${record.verified_restore_point ?? "unknown"}; everything after it is unavailable. Review the runner backup for another restore failure.`
+      };
+    case "restore_misconfigured":
+      return {
+        level,
+        metadata: withoutContractFields(record),
+        message: "This runner started with a fresh session database because it could not verify where its session history is backed up. Nothing in the backup was changed; check the runner backup configuration and permissions."
+      };
+    default:
+      return null;
+  }
+}
+function withoutContractFields(record) {
+  const { v: _v, event: _event, ...metadata } = record;
+  return metadata;
+}
+var OUTCOMES = /* @__PURE__ */ new Set([
+  "replica_recovered",
+  "restore_retried",
+  "fresh_session_db",
+  "history_rolled_back",
+  "restore_misconfigured"
+]);
+var STAGES = /* @__PURE__ */ new Set(["restore", "verify"]);
+var SEVERITIES = /* @__PURE__ */ new Set(["warning", "error"]);
+var NUMBER_FIELDS = [
+  "litestream_exit_code",
+  "attempt",
+  "replica_objects",
+  "replica_bytes",
+  "quarantined_objects",
+  "quarantine_failed_objects",
+  "quarantined_bytes",
+  "restore_points_tried"
+];
+var STRING_OR_NULL_FIELDS = ["quarantine_destination", "verified_restore_point"];
+function isSessionDbRecoveryRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  return record.v === 1 && record.event === "session_db_recovery" && typeof record.at === "string" && STAGES.has(record.stage) && OUTCOMES.has(record.outcome) && SEVERITIES.has(record.severity) && typeof record.reason === "string" && NUMBER_FIELDS.every((field) => record[field] === null || Number.isInteger(record[field])) && STRING_OR_NULL_FIELDS.every(
+    (field) => record[field] === null || typeof record[field] === "string"
+  );
+}
+
 // src/lib/opencode/health.ts
 async function checkOpenCodeHealth(port) {
   try {
@@ -2419,10 +2610,10 @@ function resolveSessionCleanupConfig(flags, env = process.env) {
 
 // src/lib/opencode/session-db-size.ts
 import { statSync as statSync2 } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 var LARGE_DB_THRESHOLD_BYTES = 268435456;
 function statSessionDbBytes(homeDir) {
-  const dbPath = join2(homeDir, ".local", "share", "opencode", "opencode.db");
+  const dbPath = join3(homeDir, ".local", "share", "opencode", "opencode.db");
   try {
     return statSync2(dbPath).size;
   } catch (err) {
@@ -2991,6 +3182,177 @@ function writeTunnelReadyMarker(path, agentId) {
   }
 }
 
+// src/lib/openai-usage.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join4 } from "path";
+var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
+var OPENCODE_AUTH_SEGMENTS = [".local", "share", "opencode", "auth.json"];
+var OpenAiUsageError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+};
+function isLocalCredentialProblem2(err) {
+  return err instanceof OpenAiUsageError && (err.reason === "no_credentials" || err.reason === "credentials_expired");
+}
+function readOpenCodeChatGptCredentials() {
+  try {
+    const raw = readFileSync3(join4(homedir2(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    const entry = parsed.openai;
+    if (entry?.type !== "oauth" || typeof entry.access !== "string" || !entry.access || typeof entry.expires !== "number") {
+      return null;
+    }
+    return { accessToken: entry.access, expiresAt: entry.expires };
+  } catch (err) {
+    const code = err.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR") {
+      console.warn(
+        `readOpenCodeChatGptCredentials: reading auth.json failed (${code ?? "unknown"})`
+      );
+    }
+    return null;
+  }
+}
+function toWindow2(headers, name) {
+  const utilizationHeader = headers.get(`x-codex-${name}-used-percent`);
+  const windowMinutesHeader = headers.get(`x-codex-${name}-window-minutes`);
+  if (utilizationHeader == null || utilizationHeader === "" || windowMinutesHeader == null) {
+    return null;
+  }
+  const utilization = Number(utilizationHeader);
+  const windowMinutes = Number(windowMinutesHeader);
+  if (!Number.isFinite(utilization) || !Number.isFinite(windowMinutes) || windowMinutes <= 0) {
+    return null;
+  }
+  const resetAtHeader = headers.get(`x-codex-${name}-reset-at`);
+  const resetSeconds = resetAtHeader == null || resetAtHeader === "" ? NaN : Number(resetAtHeader);
+  const resetsAt = Number.isFinite(resetSeconds) ? new Date(resetSeconds * 1e3).toISOString() : null;
+  return { utilization: Math.min(100, Math.max(0, utilization)), windowMinutes, resetsAt };
+}
+function parseCodexUsageHeaders(headers) {
+  return {
+    primary: toWindow2(headers, "primary"),
+    secondary: toWindow2(headers, "secondary"),
+    hasCredits: headers.has("x-codex-credits-has-credits") ? headers.get("x-codex-credits-has-credits")?.toLowerCase() === "true" : null,
+    creditsUnlimited: headers.has("x-codex-credits-unlimited") ? headers.get("x-codex-credits-unlimited")?.toLowerCase() === "true" : null
+  };
+}
+function normalizeProbeModel(model) {
+  return model.endsWith("-fast") ? model.slice(0, -"-fast".length) : model;
+}
+async function resolveProbeModels(port) {
+  try {
+    const res = await withRequestTimeout(
+      fetch,
+      REQUEST_TIMEOUT_MS
+    )(`${opencodeBase(port)}/config/providers`);
+    if (!res.ok) {
+      console.error(
+        `[resolveProbeModels] GET /config/providers returned HTTP ${res.status} (port ${port})`
+      );
+      return [];
+    }
+    const body = await res.json();
+    const provider = body?.providers?.find((candidate) => candidate?.id === "openai");
+    if (!provider || !provider.models || typeof provider.models !== "object") return [];
+    const candidates = [
+      ...typeof body?.default?.openai === "string" ? [body.default.openai] : [],
+      ...Object.keys(provider.models)
+    ].map(normalizeProbeModel);
+    return [...new Set(candidates)].slice(0, 4);
+  } catch (err) {
+    console.error(
+      `[resolveProbeModels] GET /config/providers failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+    );
+    return [];
+  }
+}
+function hasPrimaryHeaders(headers) {
+  return [
+    "x-codex-primary-used-percent",
+    "x-codex-primary-window-minutes",
+    "x-codex-primary-reset-at"
+  ].some((name) => headers.has(name));
+}
+async function getOpenAiUsage(port) {
+  const credentials2 = readOpenCodeChatGptCredentials();
+  if (!credentials2) {
+    throw new OpenAiUsageError(
+      "No ChatGPT login found. Connect a ChatGPT account to this runner, or run `opencode auth login`.",
+      "no_credentials"
+    );
+  }
+  if (credentials2.expiresAt < Date.now()) {
+    throw new OpenAiUsageError(
+      "ChatGPT credentials have expired. Run `opencode auth login` to refresh them.",
+      "credentials_expired"
+    );
+  }
+  const models = await resolveProbeModels(port);
+  if (models.length === 0) {
+    throw new OpenAiUsageError("No supported OpenAI probe model is available.", "no_probe_model");
+  }
+  let lastStatus;
+  for (const model of models) {
+    let res;
+    try {
+      res = await withRequestTimeout(fetch, REQUEST_TIMEOUT_MS)(CODEX_RESPONSES_URL, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${credentials2.accessToken}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ model, store: false, stream: true })
+      });
+    } catch (err) {
+      throw new OpenAiUsageError(
+        `OpenAI usage probe request failed: ${err instanceof Error ? err.message : String(err)}.`,
+        "request_failed"
+      );
+    }
+    try {
+      lastStatus = res.status;
+      if (hasPrimaryHeaders(res.headers)) {
+        const usage = parseCodexUsageHeaders(res.headers);
+        if (!usage.primary && !usage.secondary) {
+          throw new OpenAiUsageError(
+            `OpenAI usage probe returned no usable window (HTTP ${res.status}).`,
+            "no_usable_window"
+          );
+        }
+        return usage;
+      }
+      if (res.status === 401) {
+        throw new OpenAiUsageError(
+          "ChatGPT credentials have expired (HTTP 401).",
+          "credentials_expired"
+        );
+      }
+      if (res.status === 403 || res.status === 429) {
+        throw new OpenAiUsageError(
+          `OpenAI usage probe was blocked (HTTP ${res.status}).`,
+          "probe_blocked"
+        );
+      }
+    } finally {
+      await res.body?.cancel().catch(() => {
+      });
+    }
+  }
+  throw new OpenAiUsageError(
+    `OpenAI usage probe failed: HTTP ${lastStatus ?? "unknown"}.`,
+    "request_failed"
+  );
+}
+
 // src/lib/reporting-schedule.ts
 function jitteredDelayMs(baseMs, jitterFraction, random = Math.random) {
   const jitterRangeMs = baseMs * jitterFraction;
@@ -2999,6 +3361,31 @@ function jitteredDelayMs(baseMs, jitterFraction, random = Math.random) {
 function firstReportDelayMs(random = Math.random) {
   return 5e3 + random() * 1e4;
 }
+var VALID_USAGE_REPORTING_MODES = ["auto", "on", "off"];
+function resolveUsageReportingMode(flagValue, env, names) {
+  const raw = flagValue ?? env[names.envVar];
+  if (raw === void 0 || raw === "") return { mode: "auto", warnings: [] };
+  const normalized = raw.trim().toLowerCase();
+  if (VALID_USAGE_REPORTING_MODES.includes(normalized)) {
+    return { mode: normalized, warnings: [] };
+  }
+  const source = flagValue !== void 0 ? names.flagName : names.envVar;
+  return {
+    mode: "auto",
+    warnings: [
+      `Ignoring invalid ${source} "${raw}": expected one of ${VALID_USAGE_REPORTING_MODES.join(", ")}; using auto`
+    ]
+  };
+}
+var BASE_USAGE_REPORT_DELAY_MS = 10 * 6e4;
+var USAGE_REPORT_DELAY_JITTER_FRACTION = 0.2;
+function usageReportDelayMs(random = Math.random) {
+  return jitteredDelayMs(BASE_USAGE_REPORT_DELAY_MS, USAGE_REPORT_DELAY_JITTER_FRACTION, random);
+}
+var USAGE_REPORT_FAILURE_REESCALATION_TICKS = 6;
+function usageReportFailureLogLevel(consecutiveFailures) {
+  return reportFailureLogLevel(consecutiveFailures, USAGE_REPORT_FAILURE_REESCALATION_TICKS);
+}
 function reportFailureLogLevel(consecutiveFailures, reescalationTicks) {
   return consecutiveFailures === 1 || consecutiveFailures % reescalationTicks === 0 ? "warn" : "debug";
 }
@@ -3007,33 +3394,26 @@ function failureStreakSuffix(consecutiveFailures) {
 }
 
 // src/lib/claude-usage-reporting.ts
-var VALID_MODES = ["auto", "on", "off"];
 function resolveClaudeUsageReportingMode(flagValue, env) {
-  const raw = flagValue ?? env.EVIDENT_CLAUDE_USAGE_REPORTING;
-  if (raw === void 0 || raw === "") {
-    return { mode: "auto", warnings: [] };
-  }
-  const normalized = raw.trim().toLowerCase();
-  if (VALID_MODES.includes(normalized)) {
-    return { mode: normalized, warnings: [] };
-  }
-  const source = flagValue !== void 0 ? "--claude-usage-reporting" : "EVIDENT_CLAUDE_USAGE_REPORTING";
-  return {
-    mode: "auto",
-    warnings: [
-      `Ignoring invalid ${source} "${raw}": expected one of ${VALID_MODES.join(", ")}; using auto`
-    ]
-  };
+  return resolveUsageReportingMode(flagValue, env, {
+    flagName: "--claude-usage-reporting",
+    envVar: "EVIDENT_CLAUDE_USAGE_REPORTING"
+  });
 }
-var BASE_REPORT_DELAY_MS = 10 * 6e4;
-var REPORT_DELAY_JITTER_FRACTION = 0.2;
 function nextReportDelayMs(random = Math.random) {
-  return jitteredDelayMs(BASE_REPORT_DELAY_MS, REPORT_DELAY_JITTER_FRACTION, random);
+  return usageReportDelayMs(random);
 }
 var FIRST_REPORT_DELAY_MS = firstReportDelayMs();
-var CLAUDE_USAGE_FAILURE_REESCALATION_TICKS = 6;
 function claudeUsageFailureLogLevel(consecutiveFailures) {
-  return reportFailureLogLevel(consecutiveFailures, CLAUDE_USAGE_FAILURE_REESCALATION_TICKS);
+  return usageReportFailureLogLevel(consecutiveFailures);
+}
+
+// src/lib/openai-usage-reporting.ts
+function resolveOpenAiUsageReportingMode(flagValue, env) {
+  return resolveUsageReportingMode(flagValue, env, {
+    flagName: "--openai-usage-reporting",
+    envVar: "EVIDENT_OPENAI_USAGE_REPORTING"
+  });
 }
 
 // src/lib/resource-usage-reporting.ts
@@ -3192,15 +3572,15 @@ function createResourceUsageCollector(homeDir) {
 }
 
 // src/lib/channels/driver.ts
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 
 // src/lib/runner-file-sync.ts
-import { join as join4 } from "path";
+import { join as join6 } from "path";
 
 // src/lib/file-push.ts
 import { randomUUID } from "crypto";
 import { chmod, mkdir, open as open2, realpath, rename, unlink } from "fs/promises";
-import { basename, dirname as dirname3, isAbsolute, join as join3, relative, resolve as resolve2, sep } from "path";
+import { basename, dirname as dirname3, isAbsolute, join as join5, relative, resolve as resolve2, sep } from "path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
 async function writePushedFile(request) {
@@ -3233,7 +3613,7 @@ async function writePushedFile(request) {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
       dirname3(candidate)
     );
-    const realTarget = join3(existingAncestor, ...missingSegments, basename(candidate));
+    const realTarget = join5(existingAncestor, ...missingSegments, basename(candidate));
     const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
@@ -3269,7 +3649,7 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join3(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join5(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
@@ -3342,13 +3722,13 @@ function contains(realDirectory, realTarget) {
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join3(current, segment);
+    current = join5(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join3(dirname3(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join5(dirname3(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
     handle = await open2(temporaryPath, "wx", FILE_MODE);
@@ -3390,20 +3770,28 @@ async function syncPendingRunnerFiles(options) {
   for (const id of options.ackFailures.keys()) {
     if (!pendingIds.has(id)) options.ackFailures.delete(id);
   }
-  if (pending.length === 0) return { applied: 0, claudeCredentialApplied: false };
+  if (pending.length === 0) {
+    return { applied: 0, claudeCredentialApplied: false, opencodeAuthApplied: false };
+  }
   options.log({
     level: "info",
     message: `Runner file sync: ${pending.length} file(s) queued for this runner`
   });
   let applied = 0;
   let claudeCredentialApplied = false;
+  let opencodeAuthApplied = false;
   for (const file of pending) {
     if ((options.ackFailures.get(file.id) ?? 0) >= MAX_ACK_ATTEMPTS) continue;
     const outcome = await applyOne(options, file);
     if (outcome.applied) applied += 1;
     if (outcome.claudeCredentialApplied) claudeCredentialApplied = true;
+    if (outcome.opencodeAuthApplied) opencodeAuthApplied = true;
   }
-  return { applied, claudeCredentialApplied };
+  return {
+    applied,
+    claudeCredentialApplied,
+    opencodeAuthApplied
+  };
 }
 async function listPendingFiles(options) {
   let res;
@@ -3464,10 +3852,18 @@ function asPendingFile(entry) {
   if (typeof size !== "number" || !Number.isFinite(size) || size < 0) return null;
   return { id, path, size };
 }
-var NOT_APPLIED = { applied: false, claudeCredentialApplied: false };
+var NOT_APPLIED = {
+  applied: false,
+  claudeCredentialApplied: false,
+  opencodeAuthApplied: false
+};
 function isClaudeCredentialPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join4(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join4(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join6(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join6(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+}
+function isOpenCodeAuthPath(requestedPath, homeDir) {
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join6(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join6(homeDir, ...OPENCODE_AUTH_SEGMENTS);
 }
 async function applyOne(options, file) {
   const label = `${file.id.slice(0, 8)} (${file.path})`;
@@ -3523,7 +3919,8 @@ async function applyOne(options, file) {
   await ack(options, file, "applied");
   return {
     applied: true,
-    claudeCredentialApplied: isClaudeCredentialPath(file.path, options.homeDir)
+    claudeCredentialApplied: isClaudeCredentialPath(file.path, options.homeDir),
+    opencodeAuthApplied: isOpenCodeAuthPath(file.path, options.homeDir)
   };
 }
 function durableDownloadCode(status2) {
@@ -3977,6 +4374,7 @@ var ChannelDriver = class _ChannelDriver {
    * that way rather than "fixing" it into a count.
    */
   claudeCredentialApplyCount = 0;
+  opencodeAuthApplyCount = 0;
   /**
    * The currently-executing `drainPending()` promise, or null when idle. Lets a
    * graceful shutdown (`waitForInFlight`) await an in-progress drain so a turn it
@@ -4011,7 +4409,7 @@ var ChannelDriver = class _ChannelDriver {
     this.stuckQueuedMs = config.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
     this.now = config.now ?? (() => Date.now());
     this.fileSyncDirectories = config.fileSyncDirectories ?? [];
-    this.homeDir = config.homeDir ?? homedir2();
+    this.homeDir = config.homeDir ?? homedir3();
     this.maxActiveSessions = config.maxActiveSessions;
     this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
     this.wedgeWarningIntervalMs = config.wedgeWarningIntervalMs ?? WEDGE_WARNING_INTERVAL_MS;
@@ -4081,6 +4479,7 @@ var ChannelDriver = class _ChannelDriver {
       });
       this.appliedFileCount += result.applied;
       if (result.claudeCredentialApplied) this.claudeCredentialApplyCount += 1;
+      if (result.opencodeAuthApplied) this.opencodeAuthApplyCount += 1;
       return result.applied;
     } catch (err) {
       this.log({
@@ -4188,7 +4587,8 @@ var ChannelDriver = class _ChannelDriver {
     return {
       appliedFiles: this.appliedFileCount,
       inFlight: this.syncingFiles,
-      claudeCredentialApplies: this.claudeCredentialApplyCount
+      claudeCredentialApplies: this.claudeCredentialApplyCount,
+      opencodeAuthApplyCount: this.opencodeAuthApplyCount
     };
   }
   /**
@@ -7525,7 +7925,7 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join5(homeDir, trimmed.slice(2)) : trimmed;
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join7(homeDir, trimmed.slice(2)) : trimmed;
     if (!isAbsolute2(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
@@ -7623,7 +8023,7 @@ function logActivity(state, entry) {
   const level = entry.level ?? (entry.type === "error" ? "error" : "info");
   if (!meetsThreshold(state, level)) return;
   forwardRunnerActivity(
-    { level, message: entry.message, error: entry.error },
+    { level, message: entry.message, error: entry.error, metadata: entry.metadata },
     { agentId: state.agentId, authHeader: state.authHeader }
   );
   const fullEntry = {
@@ -7643,6 +8043,26 @@ function logActivity(state, entry) {
     }
   }
 }
+function reportSessionDbRecovery(state) {
+  try {
+    const report = drainSessionDbRecoveryReport({ homeDir: homedir4(), env: process.env });
+    for (const record of report.records) {
+      const activity = buildSessionDbRecoveryActivity(record);
+      if (!activity) throw new Error("could not map session-DB recovery record");
+      logActivity(state, {
+        type: activity.level === "error" ? "error" : "info",
+        level: activity.level,
+        ...activity.level === "error" ? { error: activity.message } : { message: activity.message },
+        metadata: activity.metadata
+      });
+    }
+    acknowledgeSessionDbRecoveryReport(report.path);
+  } catch (error2) {
+    console.error(
+      `[run] could not report session-DB recovery activity: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+  }
+}
 function displayStatus(state) {
   if (!state.interactive) return;
   const attempt = state.connection?.reconnectAttempt ?? 0;
@@ -7733,6 +8153,7 @@ async function driveChannels(state, driver) {
   let lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
   let lastSeenClaudeApplies = driver.fileSyncActivity().claudeCredentialApplies;
+  let lastSeenOpencodeAuthApplies = driver.fileSyncActivity().opencodeAuthApplyCount;
   while (state.running) {
     const cycleStartedAtMs = performance.now();
     let idleThisCycle = false;
@@ -7765,6 +8186,10 @@ async function driveChannels(state, driver) {
       const claudeCredentialApplied = claudeCredentialApplies !== lastSeenClaudeApplies;
       lastSeenClaudeApplies = claudeCredentialApplies;
       if (claudeCredentialApplied) state.claudeUsageRearm?.();
+      const opencodeAuthApplies = fileActivitySnapshot.opencodeAuthApplyCount;
+      const opencodeAuthApplied = opencodeAuthApplies !== lastSeenOpencodeAuthApplies;
+      lastSeenOpencodeAuthApplies = opencodeAuthApplies;
+      if (opencodeAuthApplied) state.openaiUsageRearm?.();
       if (processed > 0 || driver.hasInFlightWatchers() || proxiedActivity || fileActivity) {
         idlePolls = 0;
         idleMs = 0;
@@ -7833,7 +8258,7 @@ async function driveChannels(state, driver) {
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
 var SESSION_DB_RECLAIM_MAX_PAGES = 2e3;
 function sessionDbPath() {
-  return join5(homedir3(), ".local", "share", "opencode", "opencode.db");
+  return join7(homedir4(), ".local", "share", "opencode", "opencode.db");
 }
 async function runSweep(state, driver, config) {
   const mode = `age=${config.maxAgeMs ?? "\u2014"} count=${config.maxCount ?? "\u2014"}`;
@@ -7916,7 +8341,7 @@ function scheduleSessionCleanup(state, driver, options) {
   for (const warning2 of config.warnings) {
     logActivity(state, { type: "info", level: "warn", message: `Session cleanup: ${warning2}` });
   }
-  const dbBytes = statSessionDbBytes(homedir3());
+  const dbBytes = statSessionDbBytes(homedir4());
   void (async () => {
     const reclaimSkipReason = dbBytes !== null && config.enabled ? await probeReclaimAvailability({ dbPath: sessionDbPath(), requiredBytes: dbBytes }) : null;
     const sizeWarning = buildSessionStoreSizeWarning({
@@ -7944,23 +8369,20 @@ function scheduleSessionCleanup(state, driver, options) {
   );
   state.sessionCleanupTimers.push(interval, firstSweep);
 }
-function scheduleClaudeUsageReporting(state, options) {
-  const { mode, warnings } = resolveClaudeUsageReportingMode(
-    options.claudeUsageReporting,
-    process.env
-  );
+function scheduleUsageReporting(state, params) {
+  const { mode, warnings } = params.resolved;
   for (const warning2 of warnings) {
     logActivity(state, {
       type: "info",
       level: "warn",
-      message: `Claude usage reporting: ${warning2}`
+      message: `${params.label} usage reporting: ${warning2}`
     });
   }
   if (mode === "off") {
     logActivity(state, {
       type: "info",
       level: "debug",
-      message: "Claude usage reporting is off (--claude-usage-reporting off)"
+      message: `${params.label} usage reporting is off (${params.offFlagHint})`
     });
     return null;
   }
@@ -7969,7 +8391,7 @@ function scheduleClaudeUsageReporting(state, options) {
   let rearmRequested = false;
   const armProbe = () => {
     phase = "probe-pending";
-    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+    params.setTimer(setTimeout(() => void tick(true), params.firstDelayMs()));
   };
   const scheduleNextTick = () => {
     if (rearmRequested) {
@@ -7978,7 +8400,7 @@ function scheduleClaudeUsageReporting(state, options) {
       return;
     }
     phase = "steady-pending";
-    state.claudeUsageTimer = setTimeout(() => void tick(false), nextReportDelayMs());
+    params.setTimer(setTimeout(() => void tick(false), params.nextDelayMs()));
   };
   const rearm = () => {
     switch (phase) {
@@ -7988,9 +8410,9 @@ function scheduleClaudeUsageReporting(state, options) {
       case "probe-pending":
         return;
       case "steady-pending":
-        if (state.claudeUsageTimer) {
-          clearTimeout(state.claudeUsageTimer);
-          state.claudeUsageTimer = null;
+        if (params.getTimer()) {
+          clearTimeout(params.getTimer());
+          params.setTimer(null);
         }
         rearmRequested = false;
         armProbe();
@@ -8004,45 +8426,45 @@ function scheduleClaudeUsageReporting(state, options) {
   const tick = async (isProbe) => {
     phase = "tick-in-flight";
     try {
-      const usage = await getClaudeUsage();
-      const result = await reportClaudeUsage(state.agentId, state.authHeader, usage);
+      const usage = await params.fetchUsage();
+      const result = await params.report(usage);
       if (result.ok) {
         if (consecutiveFailures > 0) {
           logActivity(state, {
             type: "info",
             level: "info",
-            message: "Claude usage reporting recovered"
+            message: `${params.label} usage reporting recovered`
           });
         }
         consecutiveFailures = 0;
         logActivity(state, {
           type: "info",
           level: "debug",
-          message: "Reported Claude usage to Evident"
+          message: `Reported ${params.label} usage to Evident`
         });
       } else {
         consecutiveFailures++;
         logActivity(state, {
           type: "info",
-          level: claudeUsageFailureLogLevel(consecutiveFailures),
-          message: `Failed to report Claude usage: ${result.error}${failureStreakSuffix(consecutiveFailures)}`
+          level: params.failureLogLevel(consecutiveFailures),
+          message: `Failed to report ${params.label} usage: ${result.error}${failureStreakSuffix(consecutiveFailures)}`
         });
       }
       scheduleNextTick();
     } catch (error2) {
-      if (error2 instanceof ClaudeUsageError && isLocalCredentialProblem(error2)) {
+      if (params.isLocalCredentialProblem(error2)) {
         if (mode === "on") {
           logActivity(state, {
             type: "info",
             level: "warn",
-            message: "Claude usage reporting is forced on but no usable Claude Code login was found \u2014 run `claude` to sign in; reporting will keep retrying"
+            message: `${params.label} usage reporting is forced on but no usable login was found \u2014 ${params.forcedOnHint}; reporting will keep retrying`
           });
           scheduleNextTick();
         } else if (isProbe) {
           logActivity(state, {
             type: "info",
             level: "debug",
-            message: `Claude usage reporting: ${error2.message}`
+            message: `${params.label} usage reporting: ${error2 instanceof Error ? error2.message : String(error2)}`
           });
           phase = "dormant";
           if (rearmRequested) rearm();
@@ -8050,7 +8472,7 @@ function scheduleClaudeUsageReporting(state, options) {
           logActivity(state, {
             type: "info",
             level: "debug",
-            message: `Claude usage reporting: ${error2.message}`
+            message: `${params.label} usage reporting: ${error2 instanceof Error ? error2.message : String(error2)}`
           });
           scheduleNextTick();
         }
@@ -8059,8 +8481,8 @@ function scheduleClaudeUsageReporting(state, options) {
         const message = error2 instanceof Error ? error2.message : String(error2);
         logActivity(state, {
           type: "info",
-          level: claudeUsageFailureLogLevel(consecutiveFailures),
-          message: `Claude usage reporting failed: ${message}${failureStreakSuffix(consecutiveFailures)}`
+          level: params.failureLogLevel(consecutiveFailures),
+          message: `${params.label} usage reporting failed: ${message}${failureStreakSuffix(consecutiveFailures)}`
         });
         scheduleNextTick();
       }
@@ -8069,6 +8491,24 @@ function scheduleClaudeUsageReporting(state, options) {
   armProbe();
   return rearm;
 }
+function scheduleClaudeUsageReporting(state, options) {
+  return scheduleUsageReporting(state, {
+    label: "Claude",
+    resolved: resolveClaudeUsageReportingMode(options.claudeUsageReporting, process.env),
+    offFlagHint: "--claude-usage-reporting off",
+    getTimer: () => state.claudeUsageTimer,
+    setTimer: (timer) => {
+      state.claudeUsageTimer = timer;
+    },
+    fetchUsage: getClaudeUsage,
+    report: (usage) => reportClaudeUsage(state.agentId, state.authHeader, usage),
+    isLocalCredentialProblem,
+    forcedOnHint: "run `claude` to sign in",
+    firstDelayMs: () => FIRST_REPORT_DELAY_MS,
+    nextDelayMs: nextReportDelayMs,
+    failureLogLevel: claudeUsageFailureLogLevel
+  });
+}
 var RESOURCE_USAGE_BASE_REPORT_DELAY_MS = 10 * 6e4;
 var RESOURCE_USAGE_REPORT_DELAY_JITTER_FRACTION = 0.2;
 var RESOURCE_USAGE_FAILURE_REESCALATION_TICKS = 6;
@@ -8092,7 +8532,7 @@ function scheduleResourceUsageReporting(state, options) {
     });
     return;
   }
-  const collect = createResourceUsageCollector(homedir3());
+  const collect = createResourceUsageCollector(homedir4());
   let consecutiveFailures = 0;
   const tick = async () => {
     try {
@@ -8193,6 +8633,11 @@ async function cleanup(state, opts = {}) {
     state.claudeUsageTimer = null;
   }
   state.claudeUsageRearm = null;
+  if (state.openaiUsageTimer) {
+    clearTimeout(state.openaiUsageTimer);
+    state.openaiUsageTimer = null;
+  }
+  state.openaiUsageRearm = null;
   if (state.resourceUsageTimer) {
     clearTimeout(state.resourceUsageTimer);
     state.resourceUsageTimer = null;
@@ -8244,7 +8689,7 @@ async function run(options) {
   let fileSyncDirectories;
   try {
     logLevel = resolveLogLevel(options);
-    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir3());
+    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir4());
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     if (options.json) {
@@ -8279,6 +8724,8 @@ async function run(options) {
     sessionCleanupTimers: [],
     claudeUsageTimer: null,
     claudeUsageRearm: null,
+    openaiUsageTimer: null,
+    openaiUsageRearm: null,
     resourceUsageTimer: null,
     authHeader: ""
   };
@@ -8474,6 +8921,7 @@ async function run(options) {
     } else {
       log2(state, "Not running in a MicroVM (MICROVM_ID unset) \u2014 nothing to report", "debug");
     }
+    reportSessionDbRecovery(state);
     const { timeoutMs: opencodeStartTimeoutMs, warnings: opencodeStartTimeoutWarnings } = resolveOpenCodeStartTimeoutMs(options, process.env);
     for (const warning2 of opencodeStartTimeoutWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
@@ -8541,7 +8989,7 @@ async function run(options) {
       // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
       // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
-      homeDir: homedir3(),
+      homeDir: homedir4(),
       maxActiveSessions,
       log: (entry) => (
         // Thread the driver's real level straight through so `debug`/`warn`
@@ -8679,6 +9127,22 @@ async function run(options) {
     }
     scheduleSessionCleanup(state, channelDriver, options);
     state.claudeUsageRearm = scheduleClaudeUsageReporting(state, options);
+    state.openaiUsageRearm = scheduleUsageReporting(state, {
+      label: "OpenAI",
+      resolved: resolveOpenAiUsageReportingMode(options.openaiUsageReporting, process.env),
+      offFlagHint: "--openai-usage-reporting off",
+      getTimer: () => state.openaiUsageTimer,
+      setTimer: (timer) => {
+        state.openaiUsageTimer = timer;
+      },
+      fetchUsage: () => getOpenAiUsage(state.port),
+      report: (usage) => reportOpenAiUsage(state.agentId, state.authHeader, usage),
+      isLocalCredentialProblem: isLocalCredentialProblem2,
+      forcedOnHint: "connect a ChatGPT account to this runner, or run `opencode auth login`",
+      firstDelayMs: firstReportDelayMs,
+      nextDelayMs: usageReportDelayMs,
+      failureLogLevel: usageReportFailureLogLevel
+    });
     scheduleResourceUsageReporting(state, options);
     if (!interactive || state.json) {
       log2(state, "Driving channel messages...");
@@ -8760,6 +9224,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--claude-usage-reporting <mode>",
   "Report Claude subscription usage to Evident: auto | on | off (default: auto). Env: EVIDENT_CLAUDE_USAGE_REPORTING"
+).option(
+  "--openai-usage-reporting <mode>",
+  "Report OpenAI plan usage to Evident: auto | on | off (default: auto). Env: EVIDENT_OPENAI_USAGE_REPORTING"
 ).option(
   "--no-resource-usage-reporting",
   "Don't report this machine's CPU and memory usage to Evident (reporting is on by default). Env: EVIDENT_RESOURCE_USAGE_REPORTING=off"
@@ -8795,6 +9262,7 @@ program.command("run").description("Connect to Evident and process messages").op
       // Raw string — the resolver in run.ts single-sources parsing
       // (resolveClaudeUsageReportingMode).
       claudeUsageReporting: options.claudeUsageReporting,
+      openaiUsageReporting: options.openaiUsageReporting,
       // Raw value — resolution is single-sourced in run.ts's
       // resolveResourceUsageReportingEnabled.
       resourceUsageReporting: options.resourceUsageReporting,