@evident-ai/cli 3.4.1-dev.c03b461 → 3.4.1-dev.c138c09

package/dist/index.js

@@ -763,6 +763,13 @@ function toReportedOpenAiWindow(window) {
     resets_at: window.resetsAt
   };
 }
+function toReportedOpenAiSubscription(snapshot) {
+  if (!snapshot.subscription) return null;
+  return {
+    owner_email: snapshot.subscription.ownerEmail,
+    plan_type: snapshot.subscription.planType
+  };
+}
 async function reportOpenAiUsage(agentId, authHeader, snapshot) {
   try {
     const apiUrl = getApiUrlConfig();
@@ -773,7 +780,8 @@ async function reportOpenAiUsage(agentId, authHeader, snapshot) {
         primary: toReportedOpenAiWindow(snapshot.primary),
         secondary: toReportedOpenAiWindow(snapshot.secondary),
         has_credits: snapshot.hasCredits,
-        credits_unlimited: snapshot.creditsUnlimited
+        credits_unlimited: snapshot.creditsUnlimited,
+        subscription: toReportedOpenAiSubscription(snapshot)
       }),
       signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
     });
@@ -797,6 +805,7 @@ async function reportResourceUsage(agentId, authHeader, usage) {
       headers: { Authorization: authHeader, "Content-Type": "application/json" },
       body: JSON.stringify({
         cpu_percent: usage.cpuPercent,
+        cpu_peak_percent: usage.cpuPeakPercent,
         cpu_count: usage.cpuCount,
         memory_total_bytes: usage.memoryTotalBytes,
         memory_available_bytes: usage.memoryAvailableBytes,
@@ -1183,7 +1192,7 @@ async function claudeUsage() {
 }
 
 // src/commands/run.ts
-import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir5 } from "os";
 import { isAbsolute as isAbsolute3, join as join9, parse, resolve as resolvePath2 } from "path";
 import chalk6 from "chalk";
@@ -1207,6 +1216,7 @@ var TelemetryEventTypes = {
 // ../../packages/types/src/tunnel/index.ts
 var MAX_FRAME_BYTES = 256 * 1024;
 var TUNNEL_DRAIN_PING_PATH = "/__evident/drain";
+var TUNNEL_USAGE_REARM_PING_PATH = "/__evident/usage-rearm";
 
 // ../../packages/types/src/runner-files.ts
 var MAX_FILE_PUSH_BYTES = 64 * 1024;
@@ -1728,10 +1738,14 @@ function runSynchroniser(args, opts) {
     let stderr = "";
     let settled = false;
     const timer = {};
+    let abortListener;
+    let spawnListener;
     const finish = (result) => {
       if (settled) return;
       settled = true;
       if (timer.handle) clearTimeout(timer.handle);
+      if (abortListener) opts.signal?.removeEventListener("abort", abortListener);
+      if (spawnListener) child.removeListener("spawn", spawnListener);
       resolve4(result);
     };
     try {
@@ -1757,6 +1771,25 @@ function runSynchroniser(args, opts) {
     child.once("close", (code) => {
       finish({ code, stdout, stderr, timedOut: false });
     });
+    if (opts.signal) {
+      const killChild = () => {
+        if (child.pid === void 0) {
+          if (!spawnListener) {
+            spawnListener = killChild;
+            child.once("spawn", spawnListener);
+          }
+          return;
+        }
+        child.kill("SIGKILL");
+      };
+      abortListener = killChild;
+      if (opts.signal.aborted) {
+        abortListener();
+      } else {
+        opts.signal.addEventListener("abort", abortListener, { once: true });
+        if (opts.signal.aborted) abortListener();
+      }
+    }
     timer.handle = setTimeout(
       () => {
         child.kill("SIGKILL");
@@ -3119,6 +3152,44 @@ function findLastAssistantReplyFor(messages, userMessageId) {
   }
   return lastOk ?? last;
 }
+function collectSubagentSessions(messages, userMessageId) {
+  if (!messages || messages.length === 0) return [];
+  const byParent = messages.filter(
+    (message) => roleOf(message) === "assistant" && parentIdOf(message) === userMessageId
+  );
+  const assistants = byParent.length > 0 ? byParent : [];
+  if (assistants.length === 0) {
+    const userIndex = messages.findIndex((message) => idOf(message) === userMessageId);
+    if (userIndex === -1) return [];
+    for (let i = userIndex + 1; i < messages.length; i++) {
+      const message = messages[i];
+      if (roleOf(message) === "user") break;
+      if (roleOf(message) === "assistant") assistants.push(message);
+    }
+  }
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const message of assistants) {
+    const parts = Array.isArray(message.parts) ? message.parts : [];
+    for (const part of parts) {
+      if (!part || typeof part !== "object" || part.type !== "tool" || part.tool !== "task")
+        continue;
+      const state = part.state;
+      if (!state || typeof state !== "object") continue;
+      const metadata = state.metadata;
+      if (!metadata || typeof metadata !== "object") continue;
+      const sessionId = metadata.sessionId;
+      if (typeof sessionId !== "string" || sessionId.length === 0 || seen.has(sessionId)) continue;
+      seen.add(sessionId);
+      const start = state.time?.start;
+      refs.push({
+        sessionId,
+        startedAtMs: typeof start === "number" && Number.isFinite(start) ? start : null
+      });
+    }
+  }
+  return refs;
+}
 function messageUsage(messages, userMessageId) {
   if (!messages || messages.length === 0) return null;
   const byParentAll = messages.filter(
@@ -3247,8 +3318,7 @@ function isAbortedTerminalReply(messages, userMessageId) {
   }
   return false;
 }
-function messageFailure(messages, userMessageId) {
-  const reply = findLastAssistantReplyFor(messages, userMessageId);
+function classifyReplyAuthError(reply) {
   const error2 = errorOf(reply);
   if (error2 == null || typeof error2 !== "object") return null;
   const e = error2;
@@ -3273,6 +3343,32 @@ function messageFailure(messages, userMessageId) {
   }
   return null;
 }
+function messageFailure(messages, userMessageId) {
+  return classifyReplyAuthError(findLastAssistantReplyFor(messages, userMessageId));
+}
+function findLatestSubagentAuthOutcome(messages, sinceMs) {
+  if (!messages || messages.length === 0) return null;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (roleOf(message) !== "assistant") continue;
+    const created = createdOf(message);
+    if (sinceMs !== null && typeof created === "number" && created < sinceMs) continue;
+    const failure = classifyReplyAuthError(message);
+    if (failure) {
+      if (!failure.providerId) return null;
+      return { providerId: failure.providerId, outcome: "failed", failure };
+    }
+    const providerId = message.info?.providerID;
+    if (errorOf(message) == null && typeof providerId === "string" && providerId.length > 0) {
+      return { providerId, outcome: "succeeded" };
+    }
+    return null;
+  }
+  return null;
+}
+function findSubagentAuthOutcome(messages, sinceMs) {
+  return findLatestSubagentAuthOutcome(messages, sinceMs);
+}
 function applyZeroProviderFallback(classified, hasConfiguredProvider, replyProviderId, replyModelId = null) {
   if (classified != null) return classified;
   if (hasConfiguredProvider !== false) return null;
@@ -3603,7 +3699,6 @@ var StreamForwarder = class {
   handleFrame(frame) {
     switch (frame.type) {
       case "open":
-        this.callbacks.onOpen?.(frame.sid, frame.method, frame.path);
         void this.handleOpen(frame);
         break;
       case "req_data":
@@ -3639,12 +3734,21 @@ var StreamForwarder = class {
     const { sid, method, path, headers, has_body } = frame;
     const correlationId = headers?.[CORRELATION_ID_HEADER];
     const startedAt = Date.now();
+    if (path !== TUNNEL_DRAIN_PING_PATH && path !== TUNNEL_USAGE_REARM_PING_PATH) {
+      this.callbacks.onOpen?.(sid, method, path);
+    }
     if (path === TUNNEL_DRAIN_PING_PATH) {
       this.callbacks.onDrainPing?.();
       this.send({ type: "head", sid, status: 204, headers: {} });
       this.send({ type: "res_end", sid });
       return;
     }
+    if (path === TUNNEL_USAGE_REARM_PING_PATH) {
+      this.callbacks.onUsageRearmPing?.();
+      this.send({ type: "head", sid, status: 204, headers: {} });
+      this.send({ type: "res_end", sid });
+      return;
+    }
     if (process.env.DEBUG) {
       log("debug", "agent_request", {
         correlation_id: correlationId,
@@ -3789,7 +3893,8 @@ function connectTunnel(options) {
     onResponse,
     onInfo,
     onWarning,
-    onDrainPing
+    onDrainPing,
+    onUsageRearmPing
   } = options;
   const tunnelUrl = getTunnelUrlConfig();
   const url = `${tunnelUrl}/tunnel/${agentId}/connect`;
@@ -3801,7 +3906,8 @@ function connectTunnel(options) {
     });
     const forwarder = new StreamForwarder(ws, port, {
       onHead: () => onResponse?.(),
-      onDrainPing: () => onDrainPing?.()
+      onDrainPing: () => onDrainPing?.(),
+      onUsageRearmPing: () => onUsageRearmPing?.()
     });
     const connectionTimeout = setTimeout(() => {
       ws.close();
@@ -3844,8 +3950,8 @@ function connectTunnel(options) {
       try {
         message = JSON.parse(data.toString());
       } catch (error2) {
-        const errorMessage = error2 instanceof Error ? error2.message : "Unknown error";
-        onError?.(`Failed to handle message: ${errorMessage}`);
+        const errorMessage2 = error2 instanceof Error ? error2.message : "Unknown error";
+        onError?.(`Failed to handle message: ${errorMessage2}`);
         return;
       }
       if (isStreamFrame(message)) {
@@ -3962,6 +4068,7 @@ var RunnerConnection = class {
           onError: (error2) => events.onError?.(error2),
           onResponse: () => events.onResponse?.(),
           onDrainPing: () => events.onDrainPing?.(),
+          onUsageRearmPing: () => events.onUsageRearmPing?.(),
           onInfo: (message) => events.onInfo?.(message),
           onWarning: (message) => events.onWarning?.(message)
         });
@@ -4080,6 +4187,23 @@ function readOpenCodeChatGptCredentials() {
     return null;
   }
 }
+function parseChatGptIdentity(accessToken) {
+  const segments = accessToken.split(".");
+  if (segments.length !== 3) return null;
+  let payload;
+  try {
+    const parsed = JSON.parse(Buffer.from(segments[1], "base64url").toString("utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+    payload = parsed;
+  } catch {
+    return null;
+  }
+  const profile = payload["https://api.openai.com/profile"];
+  const auth = payload["https://api.openai.com/auth"];
+  const ownerEmail = typeof profile?.email === "string" ? profile.email.trim() || null : null;
+  const planType = typeof auth?.chatgpt_plan_type === "string" ? auth.chatgpt_plan_type.trim() || null : null;
+  return ownerEmail === null && planType === null ? null : { ownerEmail, planType };
+}
 function toWindow2(headers, name) {
   const utilizationHeader = headers.get(`x-codex-${name}-used-percent`);
   const windowMinutesHeader = headers.get(`x-codex-${name}-window-minutes`);
@@ -4155,6 +4279,7 @@ async function getOpenAiUsage(port) {
       "credentials_expired"
     );
   }
+  const subscription = parseChatGptIdentity(credentials2.accessToken);
   const models = await resolveProbeModels(port);
   if (models.length === 0) {
     throw new OpenAiUsageError("No supported OpenAI probe model is available.", "no_probe_model");
@@ -4187,7 +4312,7 @@ async function getOpenAiUsage(port) {
             "no_usable_window"
           );
         }
-        return usage;
+        return { ...usage, subscription };
       }
       if (res.status === 401) {
         throw new OpenAiUsageError(
@@ -4388,45 +4513,84 @@ function readDisk(homeDir) {
     };
   }
 }
-function createResourceUsageCollector(homeDir) {
-  let previous = readCpuSample();
-  return async () => {
+var CPU_PEAK_WINDOW_MS = 6e4;
+var CPU_PEAK_WINDOW_SAMPLE_COUNT = 4;
+var CPU_PEAK_SAMPLE_INTERVAL_MS = CPU_PEAK_WINDOW_MS / CPU_PEAK_WINDOW_SAMPLE_COUNT;
+function createCpuPeakSampler() {
+  const sampleHistory = new Array(CPU_PEAK_WINDOW_SAMPLE_COUNT);
+  sampleHistory[0] = readCpuSample();
+  let nextSampleIndex = 1;
+  let sampleCount = 1;
+  let peak = null;
+  const timer = setInterval(() => {
     const current = readCpuSample();
-    const hostCpuPercent = cpuPercentBetween(previous, current);
-    const hostCpuCount = cpus().length;
-    previous = current;
-    const disk = readDisk(homeDir);
-    const opencodeDbBytes = statSessionDbBytes(homeDir);
-    const { limits, warning: ecsWarning } = await readEcsTaskLimits(process.env);
-    const warnings = [];
-    if (disk.warning) warnings.push(disk.warning);
-    if (ecsWarning) warnings.push(ecsWarning);
-    let cpuPercent = hostCpuPercent;
-    let cpuCount = hostCpuCount;
-    let memoryTotalBytes = totalmem();
-    let memoryAvailableBytes = freemem();
-    if (limits !== null) {
-      cpuCount = limits.cpuCount;
-      memoryTotalBytes = limits.memoryTotalBytes;
-      memoryAvailableBytes = clamp(
-        limits.memoryTotalBytes - (totalmem() - freemem()),
-        0,
-        limits.memoryTotalBytes
-      );
-      cpuPercent = hostCpuPercent === null ? null : clamp(round2(hostCpuPercent * hostCpuCount / limits.cpuCount), 0, 100);
+    const sampleFromWindowAgo = sampleCount === CPU_PEAK_WINDOW_SAMPLE_COUNT ? sampleHistory[nextSampleIndex] : void 0;
+    if (sampleFromWindowAgo !== void 0) {
+      const percentage = cpuPercentBetween(sampleFromWindowAgo, current);
+      if (percentage !== null) {
+        peak = peak === null ? percentage : Math.max(peak, percentage);
+      }
     }
-    return {
-      usage: {
-        cpuPercent,
-        cpuCount,
-        memoryTotalBytes,
-        memoryAvailableBytes,
-        diskTotalBytes: disk.totalBytes,
-        diskFreeBytes: disk.freeBytes,
-        opencodeDbBytes
-      },
-      warnings
-    };
+    sampleHistory[nextSampleIndex] = current;
+    nextSampleIndex = (nextSampleIndex + 1) % CPU_PEAK_WINDOW_SAMPLE_COUNT;
+    sampleCount = Math.min(sampleCount + 1, CPU_PEAK_WINDOW_SAMPLE_COUNT);
+  }, CPU_PEAK_SAMPLE_INTERVAL_MS);
+  return {
+    takeAndReset: () => {
+      const currentPeak = peak;
+      peak = null;
+      return currentPeak;
+    },
+    stop: () => clearInterval(timer)
+  };
+}
+function createResourceUsageCollector(homeDir) {
+  let previous = readCpuSample();
+  const cpuPeakSampler = createCpuPeakSampler();
+  return {
+    collect: async () => {
+      const current = readCpuSample();
+      const hostCpuPercent = cpuPercentBetween(previous, current);
+      const hostCpuPeakPercent = cpuPeakSampler.takeAndReset();
+      const hostCpuCount = cpus().length;
+      previous = current;
+      const disk = readDisk(homeDir);
+      const opencodeDbBytes = statSessionDbBytes(homeDir);
+      const { limits, warning: ecsWarning } = await readEcsTaskLimits(process.env);
+      const warnings = [];
+      if (disk.warning) warnings.push(disk.warning);
+      if (ecsWarning) warnings.push(ecsWarning);
+      let cpuPercent = hostCpuPercent;
+      let cpuPeakPercent = hostCpuPeakPercent;
+      let cpuCount = hostCpuCount;
+      let memoryTotalBytes = totalmem();
+      let memoryAvailableBytes = freemem();
+      if (limits !== null) {
+        cpuCount = limits.cpuCount;
+        memoryTotalBytes = limits.memoryTotalBytes;
+        memoryAvailableBytes = clamp(
+          limits.memoryTotalBytes - (totalmem() - freemem()),
+          0,
+          limits.memoryTotalBytes
+        );
+        cpuPercent = hostCpuPercent === null ? null : clamp(round2(hostCpuPercent * hostCpuCount / limits.cpuCount), 0, 100);
+        cpuPeakPercent = hostCpuPeakPercent === null ? null : clamp(round2(hostCpuPeakPercent * hostCpuCount / limits.cpuCount), 0, 100);
+      }
+      return {
+        usage: {
+          cpuPercent,
+          cpuPeakPercent,
+          cpuCount,
+          memoryTotalBytes,
+          memoryAvailableBytes,
+          diskTotalBytes: disk.totalBytes,
+          diskFreeBytes: disk.freeBytes,
+          opencodeDbBytes
+        },
+        warnings
+      };
+    },
+    stop: cpuPeakSampler.stop
   };
 }
 
@@ -5249,6 +5413,7 @@ var ChannelDriver = class _ChannelDriver {
    * and stops opencode.
    */
   stopped = false;
+  recycleRequestedFlag = false;
   constructor(config) {
     this.agentId = config.agentId;
     this.port = config.port;
@@ -5354,6 +5519,9 @@ var ChannelDriver = class _ChannelDriver {
     let dispatched = 0;
     try {
       const conversations = await this.getPendingConversations();
+      if (this.recycleRequestedFlag) {
+        this.stop();
+      }
       if (conversations.length > 0) {
         const total = conversations.reduce((sum, c) => sum + (c.pending_message_count ?? 0), 0);
         this.log({
@@ -5482,6 +5650,14 @@ var ChannelDriver = class _ChannelDriver {
   stop() {
     this.stopped = true;
   }
+  /**
+   * The server clears this request when a new MicroVM identity is recorded, so a
+   * same-VM tunnel reconnect does not consume it. This is a plain read rather
+   * than a consume; `run.ts` guards the action once-only.
+   */
+  get recycleRequested() {
+    return this.recycleRequestedFlag;
+  }
   /**
    * Wait (up to `timeoutMs`) for in-flight watcher work to settle during a
    * graceful shutdown, so a turn whose reply is ready — or completes within the
@@ -5619,7 +5795,7 @@ var ChannelDriver = class _ChannelDriver {
           this.signalDispatchNotStarted(conv, message, "session_existence_unknown");
           break;
         }
-        const errorMessage = err instanceof Error ? err.message : String(err);
+        const errorMessage2 = err instanceof Error ? err.message : String(err);
         this.sessions.delete(conv.id);
         this.supersede(conv.id, sessionId);
         this.log({
@@ -5628,7 +5804,7 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
+        await this.markFailed(conv.id, message.id, null, errorMessage2).catch((markErr) => {
           this.log({
             level: "warn",
             message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
@@ -5639,7 +5815,7 @@ var ChannelDriver = class _ChannelDriver {
         });
         this.log({
           level: "error",
-          message: `Message ${message.id.slice(0, 8)} dispatch failed: ${errorMessage}`,
+          message: `Message ${message.id.slice(0, 8)} dispatch failed: ${errorMessage2}`,
           conversation_id: conv.id,
           message_id: message.id
         });
@@ -5660,14 +5836,14 @@ var ChannelDriver = class _ChannelDriver {
         this.unconfirmedDispatchFailures.delete(message.id);
         this.sessions.delete(conv.id);
         this.supersede(conv.id, sessionId);
-        const errorMessage = `OpenCode accepted this message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        const errorMessage2 = `OpenCode accepted this message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
         this.log({
           level: "error",
-          message: errorMessage,
+          message: errorMessage2,
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
+        await this.markFailed(conv.id, message.id, null, errorMessage2).catch((markErr) => {
           this.log({
             level: "warn",
             message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
@@ -6001,6 +6177,9 @@ var ChannelDriver = class _ChannelDriver {
         });
         await this.markFailed(conv.id, message.id, sessionId, error2, usage, failure);
       }
+      if (ocId !== null) {
+        await this.reportSubagentAuthFailures(conv.id, ocId, message.id, messages);
+      }
     } catch (err) {
       if (err instanceof ChannelAuthError) throw err;
       this.log({
@@ -6965,6 +7144,12 @@ var ChannelDriver = class _ChannelDriver {
           return;
         }
         inFlight.done = true;
+        await this.reportSubagentAuthFailures(
+          watcher.conv.id,
+          inFlight.opencodeMessageId,
+          inFlight.evidentMessageId,
+          messages
+        );
       }
       this.removeInFlight(watcher, inFlight.evidentMessageId);
       return;
@@ -7207,6 +7392,12 @@ var ChannelDriver = class _ChannelDriver {
         return;
       }
       inFlight.done = true;
+      await this.reportSubagentAuthFailures(
+        watcher.conv.id,
+        inFlight.opencodeMessageId,
+        inFlight.evidentMessageId,
+        messages
+      );
     }
     this.removeInFlight(watcher, inFlight.evidentMessageId);
   }
@@ -7377,6 +7568,7 @@ var ChannelDriver = class _ChannelDriver {
         });
         return;
       }
+      await this.reportSubagentAuthFailures(row.conversation_id, ocId ?? "", row.id, messages);
       this.dontRedispatch.delete(row.id);
       void this.postSignal(row.conversation_id, row.id, "readopt_failed");
       return;
@@ -7538,6 +7730,9 @@ var ChannelDriver = class _ChannelDriver {
       });
       return;
     }
+    if (ocId !== null) {
+      await this.reportSubagentAuthFailures(row.conversation_id, ocId, row.id, messages);
+    }
     this.dontRedispatch.delete(row.id);
     void this.postSignal(row.conversation_id, row.id, "readopt_done");
   }
@@ -7631,14 +7826,14 @@ var ChannelDriver = class _ChannelDriver {
         this.unconfirmedDispatchFailures.delete(row.id);
         this.sessions.delete(readoptConv.id);
         this.supersede(readoptConv.id, sessionId);
-        const errorMessage = `OpenCode accepted this re-dispatched message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        const errorMessage2 = `OpenCode accepted this re-dispatched message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
         this.log({
           level: "error",
-          message: errorMessage,
+          message: errorMessage2,
           conversation_id: row.conversation_id,
           message_id: row.id
         });
-        await this.markFailed(row.conversation_id, row.id, null, errorMessage).catch((markErr) => {
+        await this.markFailed(row.conversation_id, row.id, null, errorMessage2).catch((markErr) => {
           this.log({
             level: "warn",
             message: `markFailed PATCH for message ${row.id.slice(0, 8)} (conversation ${row.conversation_id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
@@ -8253,6 +8448,7 @@ var ChannelDriver = class _ChannelDriver {
       throw new Error(`Failed to get pending conversations: HTTP ${res.status}`);
     }
     const data = await res.json();
+    this.recycleRequestedFlag = data.recycle_requested === true;
     let conversations = data.conversations;
     if (this.conversationFilter) {
       conversations = conversations.filter((c) => c.id === this.conversationFilter);
@@ -8488,6 +8684,111 @@ var ChannelDriver = class _ChannelDriver {
       reply?.info?.modelID ?? null
     );
   }
+  async recordSubagentModelAuthFailure(failure, conversationId, messageId) {
+    const providerId = failure.providerId ?? "(unknown)";
+    try {
+      const res = await this.fetchImpl(
+        `${this.apiUrl}/runners/${this.agentId}/model-auth-failures`,
+        {
+          method: "POST",
+          headers: { Authorization: this.getAuthHeader(), "Content-Type": "application/json" },
+          body: JSON.stringify({
+            provider_id: failure.providerId,
+            model_id: failure.modelId,
+            reason: failure.reason
+          })
+        }
+      );
+      if (!res.ok) {
+        this.log({
+          level: "warn",
+          message: `Sub-agent model-auth report for provider ${providerId} (${failure.reason}) returned HTTP ${res.status} (conversation ${conversationId.slice(0, 8)}, message ${messageId.slice(0, 8)})`,
+          conversation_id: conversationId,
+          message_id: messageId
+        });
+      }
+    } catch (err) {
+      this.log({
+        level: "warn",
+        message: `Sub-agent model-auth report for provider ${providerId} (${failure.reason}) failed with status network-error (conversation ${conversationId.slice(0, 8)}, message ${messageId.slice(0, 8)}): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conversationId,
+        message_id: messageId
+      });
+    }
+  }
+  async clearSubagentModelAuthFailure(providerId, conversationId, messageId) {
+    try {
+      const res = await this.fetchImpl(
+        `${this.apiUrl}/runners/${this.agentId}/model-auth-failures/${encodeURIComponent(providerId)}`,
+        {
+          method: "DELETE",
+          headers: { Authorization: this.getAuthHeader() }
+        }
+      );
+      if (!res.ok) {
+        this.log({
+          level: "warn",
+          message: `Sub-agent model-auth clear for provider ${providerId} returned HTTP ${res.status} (conversation ${conversationId.slice(0, 8)}, message ${messageId.slice(0, 8)})`,
+          conversation_id: conversationId,
+          message_id: messageId
+        });
+      }
+    } catch (err) {
+      this.log({
+        level: "warn",
+        message: `Sub-agent model-auth clear for provider ${providerId} failed with status network-error (conversation ${conversationId.slice(0, 8)}, message ${messageId.slice(0, 8)}): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conversationId,
+        message_id: messageId
+      });
+    }
+  }
+  async reportSubagentAuthFailures(conversationId, opencodeMessageId, evidentMessageId, messages) {
+    const refs = collectSubagentSessions(messages, opencodeMessageId);
+    if (refs.length === 0) return;
+    const failedProviders = /* @__PURE__ */ new Map();
+    const succeededProviders = /* @__PURE__ */ new Set();
+    for (const ref of refs) {
+      try {
+        const childMessages = await getSessionMessages(this.port, ref.sessionId);
+        if (childMessages === null) {
+          this.log({
+            level: "debug",
+            message: `Could not read sub-agent session ${ref.sessionId} while checking credential failures \u2014 skipping it`,
+            conversation_id: conversationId,
+            message_id: evidentMessageId
+          });
+          continue;
+        }
+        const outcome = findSubagentAuthOutcome(childMessages, ref.startedAtMs);
+        if (!outcome) continue;
+        if (outcome.outcome === "failed") {
+          failedProviders.set(outcome.providerId, outcome.failure);
+        } else {
+          succeededProviders.add(outcome.providerId);
+        }
+      } catch (err) {
+        this.log({
+          level: "warn",
+          message: `Failed to inspect sub-agent session ${ref.sessionId} for credential failures (conversation ${conversationId.slice(0, 8)}, message ${evidentMessageId.slice(0, 8)}): ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: conversationId,
+          message_id: evidentMessageId
+        });
+      }
+    }
+    for (const [providerId, failure] of failedProviders) {
+      this.log({
+        level: "warn",
+        message: `Sub-agent turn failed on provider ${providerId} (${failure.reason}) \u2014 recording credential evidence`,
+        conversation_id: conversationId,
+        message_id: evidentMessageId
+      });
+      await this.recordSubagentModelAuthFailure(failure, conversationId, evidentMessageId);
+    }
+    for (const providerId of succeededProviders) {
+      if (failedProviders.has(providerId)) continue;
+      await this.clearSubagentModelAuthFailure(providerId, conversationId, evidentMessageId);
+    }
+  }
   /**
    * Best-effort, SINGLE-ATTEMPT runner→server telemetry ping
    * (queued-followup-redrive). `POST .../messages/:id/signal {signal, ...extra}`
@@ -9079,6 +9380,241 @@ function applyRunnerOpenCodeConfig({
   log3(`Applied runner OpenCode config ${source} to ${join8(cwd, target)}`);
 }
 
+// src/lib/credential-sync.ts
+import { renameSync, writeFileSync as writeFileSync5 } from "fs";
+var CREDENTIAL_SYNC_TICK_TIMEOUT_MS = 3e4;
+var CREDENTIAL_FLUSH_DEADLINE_MS = 8e3;
+var CREDENTIAL_FLUSH_ABORT_GRACE_MS = 500;
+var DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS = 60;
+var STORES = ["claude", "opencode"];
+var MAX_FLUSH_PASSES = 2;
+function outcomesWith(outcome) {
+  return { claude: outcome, opencode: outcome };
+}
+function errorMessage(error2) {
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+function waitForSettlement(promise, timeoutMs) {
+  return new Promise((resolve4) => {
+    let settled = false;
+    const timer = setTimeout(() => finish(false), Math.max(0, timeoutMs));
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve4(value);
+    };
+    promise.then(
+      () => finish(true),
+      () => finish(true)
+    );
+  });
+}
+function writeMarker(markerPath, outcomes, log3) {
+  const body = `${STORES.map((store) => `${store}=${outcomes[store]}`).join("\n")}
+`;
+  const temporaryPath = `${markerPath}.tmp`;
+  try {
+    writeFileSync5(temporaryPath, body, { mode: 384 });
+    renameSync(temporaryPath, markerPath);
+  } catch (error2) {
+    log3(`CREDENTIAL-FLUSH-MARKER-UNWRITABLE: ${markerPath}: ${errorMessage(error2)}`, "warn");
+  }
+}
+function intervalSeconds(env, log3) {
+  const raw = env.CREDS_SYNC_INTERVAL;
+  if (raw === void 0 || /^[1-9][0-9]*$/.test(raw) && Number.isSafeInteger(Number(raw))) {
+    return raw === void 0 ? DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS : Number(raw);
+  }
+  log3(
+    `CREDENTIAL-SYNC-INTERVAL-INVALID: CREDS_SYNC_INTERVAL='${raw}' is not a positive integer; using ${DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS}s`,
+    "warn"
+  );
+  return DEFAULT_CREDENTIAL_SYNC_INTERVAL_SECONDS;
+}
+async function runFlushStore(store, env, synchroniserRunner, log3, deadlineAt) {
+  const remainingMs = deadlineAt - Date.now();
+  if (remainingMs <= 0) return { outcome: "timeout", orphaned: false };
+  const controller = new AbortController();
+  let result;
+  let failed = false;
+  const completion = Promise.resolve().then(
+    () => synchroniserRunner(["sync-once", store], {
+      timeoutMs: remainingMs,
+      env,
+      signal: controller.signal
+    })
+  ).then(
+    (value) => {
+      result = value;
+    },
+    (error2) => {
+      failed = true;
+      log3(`CREDENTIAL-FLUSH-ERROR: ${store}: ${errorMessage(error2)}`, "warn");
+    }
+  );
+  const abortTimer = setTimeout(() => controller.abort(), remainingMs);
+  const settledBeforeDeadline = await waitForSettlement(completion, remainingMs);
+  clearTimeout(abortTimer);
+  if (!settledBeforeDeadline) {
+    controller.abort();
+    const settledAfterAbort = await waitForSettlement(completion, CREDENTIAL_FLUSH_ABORT_GRACE_MS);
+    if (!settledAfterAbort) return { outcome: "timeout", orphaned: true };
+    return { outcome: "timeout", orphaned: false };
+  }
+  if (failed || !result) return { outcome: "failed", orphaned: false };
+  if (result.timedOut || Date.now() >= deadlineAt) {
+    return { outcome: "timeout", orphaned: false };
+  }
+  return { outcome: result.code === 0 ? "ok" : "failed", orphaned: false };
+}
+function createCredentialSync({
+  markerPath,
+  env,
+  log: log3,
+  synchroniserRunner = runSynchroniser
+}) {
+  const persistenceDisabled = !env.PERSISTENCE_BUCKET;
+  let disabled = persistenceDisabled;
+  let armed = false;
+  let stopped = false;
+  let timer;
+  let inFlight;
+  let activeTickAbort;
+  let lastTickFailed;
+  let flushPromise;
+  const scheduleTick = (intervalMs, startTick2) => {
+    if (stopped) return;
+    timer = setTimeout(() => {
+      timer = void 0;
+      startTick2();
+    }, intervalMs);
+  };
+  const startTick = (intervalMs) => {
+    if (stopped) return;
+    const controller = new AbortController();
+    activeTickAbort = controller;
+    const tick = (async () => {
+      const outcomes = {
+        claude: "failed",
+        opencode: "failed"
+      };
+      for (const store of STORES) {
+        if (controller.signal.aborted) break;
+        try {
+          const result = await synchroniserRunner(["sync-once", store], {
+            timeoutMs: CREDENTIAL_SYNC_TICK_TIMEOUT_MS,
+            env,
+            signal: controller.signal
+          });
+          outcomes[store] = !result.timedOut && result.code === 0 ? "ok" : "failed";
+        } catch (error2) {
+          outcomes[store] = "failed";
+          log3(`CREDENTIAL-SYNC-TICK-ERROR: ${store}: ${errorMessage(error2)}`, "debug");
+        }
+      }
+      const failed = STORES.some((store) => outcomes[store] === "failed");
+      log3(
+        `CREDENTIAL-SYNC-TICK: claude=${outcomes.claude}, opencode=${outcomes.opencode}`,
+        "debug"
+      );
+      if (failed && lastTickFailed !== true) {
+        log3(
+          "CREDENTIAL-SYNC-FAILED: an interval credential sync failed; retrying on the next tick",
+          "warn"
+        );
+      } else if (!failed && lastTickFailed === true) {
+        log3("CREDENTIAL-SYNC-RECOVERED: interval credential sync succeeded again", "warn");
+      }
+      lastTickFailed = failed;
+    })().finally(() => {
+      if (activeTickAbort === controller) activeTickAbort = void 0;
+      if (inFlight === tick) inFlight = void 0;
+      scheduleTick(intervalMs, () => startTick(intervalMs));
+    });
+    inFlight = tick;
+  };
+  const performFlush = async () => {
+    stopped = true;
+    if (timer) {
+      clearTimeout(timer);
+      timer = void 0;
+    }
+    const deadlineAt = Date.now() + CREDENTIAL_FLUSH_DEADLINE_MS;
+    if (inFlight) {
+      const settled = await waitForSettlement(inFlight, CREDENTIAL_FLUSH_DEADLINE_MS);
+      if (!settled) {
+        activeTickAbort?.abort();
+        const settledAfterAbort = await waitForSettlement(
+          inFlight,
+          CREDENTIAL_FLUSH_ABORT_GRACE_MS
+        );
+        if (!settledAfterAbort) {
+          log3(
+            "CREDENTIAL-FLUSH-ORPHANED-TICK: a sync-once child could not be proven settled; skipping the boundary flush rather than becoming a second writer",
+            "warn"
+          );
+          return { outcomes: outcomesWith("timeout"), orphaned: true };
+        }
+      }
+    }
+    if (disabled) return { outcomes: outcomesWith("skipped"), orphaned: false };
+    const outcomes = outcomesWith("timeout");
+    for (const store of STORES) {
+      const result = await runFlushStore(store, env, synchroniserRunner, log3, deadlineAt);
+      if (result.orphaned) {
+        log3(
+          "CREDENTIAL-FLUSH-ORPHANED-CHILD: a flush sync-once child could not be proven settled; refusing another flush pass rather than becoming a second writer",
+          "warn"
+        );
+        return { outcomes: outcomesWith("timeout"), orphaned: true };
+      }
+      outcomes[store] = result.outcome;
+    }
+    return { outcomes, orphaned: false };
+  };
+  let flushPasses = 0;
+  let lastFlush;
+  return {
+    arm() {
+      if (stopped || armed) return;
+      armed = true;
+      if (persistenceDisabled) {
+        disabled = true;
+        log3(
+          "CREDENTIAL-SYNC-DISABLED: LITESTREAM_BUCKET/LITESTREAM_PREFIX are not both set; no interval credential sync this boot",
+          "warn"
+        );
+        return;
+      }
+      disabled = false;
+      const intervalMs = intervalSeconds(env, log3) * 1e3;
+      scheduleTick(intervalMs, () => startTick(intervalMs));
+    },
+    async stopAndFlush(publish) {
+      let result;
+      const runningFlush = flushPromise;
+      if (runningFlush) {
+        result = await runningFlush;
+      } else if (flushPasses >= MAX_FLUSH_PASSES || lastFlush?.orphaned) {
+        result = lastFlush ?? { outcomes: outcomesWith("timeout"), orphaned: true };
+      } else {
+        flushPasses++;
+        const currentFlush = performFlush();
+        flushPromise = currentFlush;
+        try {
+          result = await currentFlush;
+          lastFlush = result;
+        } finally {
+          if (flushPromise === currentFlush) flushPromise = void 0;
+        }
+      }
+      if (publish) writeMarker(markerPath, result.outcomes, log3);
+      return result.outcomes;
+    }
+  };
+}
+
 // src/commands/run.ts
 var MAX_ACTIVITY_LOG_ENTRIES = 10;
 var CHANNEL_POLL_INTERVAL_MS = Number(process.env.EVIDENT_CHANNEL_POLL_INTERVAL_MS) || 2e3;
@@ -9376,6 +9912,10 @@ async function driveChannels(state, driver) {
       consecutiveDrainFailures = 0;
       unreachableMs = 0;
       state.messageCount += processed;
+      if (driver.recycleRequested) {
+        await beginGracefulShutdown(state, "recycle");
+        return;
+      }
       const proxiedActivity = state.lastProxiedActivityAt !== lastSeenProxiedActivityAt;
       lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
       const fileActivitySnapshot = driver.fileSyncActivity();
@@ -9418,8 +9958,8 @@ async function driveChannels(state, driver) {
         state.running = false;
         break;
       }
-      const errorMessage = error2 instanceof Error ? error2.message : String(error2);
-      logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage}` });
+      const errorMessage2 = error2 instanceof Error ? error2.message : String(error2);
+      logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage2}` });
       if (state.interactive) displayStatus(state);
       if (driver.hasInFlightWatchers()) {
         consecutiveDrainFailures = 0;
@@ -9779,7 +10319,8 @@ function scheduleResourceUsageReporting(state, options) {
     });
     return;
   }
-  const collect = createResourceUsageCollector(homedir5());
+  const { collect, stop } = createResourceUsageCollector(homedir5());
+  state.stopResourceUsageSampling = stop;
   let consecutiveFailures = 0;
   const tick = async () => {
     try {
@@ -9889,21 +10430,41 @@ async function cleanup(state, opts = {}) {
     clearTimeout(state.resourceUsageTimer);
     state.resourceUsageTimer = null;
   }
+  state.stopResourceUsageSampling?.();
+  state.stopResourceUsageSampling = null;
+  const credentialSync = state.credentialSync;
+  const flushCredentials = credentialSync ? async (phase, publish) => {
+    await timeShutdownPhase(state, durations, phase, async () => {
+      const outcomes = await credentialSync.stopAndFlush(publish);
+      const level = Object.values(outcomes).every((outcome) => outcome === "ok") ? "info" : "warn";
+      log2(
+        state,
+        `Credential flush: claude=${outcomes.claude}, opencode=${outcomes.opencode}`,
+        level
+      );
+    });
+  } : void 0;
+  let drainSettled = true;
   if (opts.graceful && state.channelDriver) {
     state.channelDriver.stop();
+  }
+  if (flushCredentials) {
+    await flushCredentials("credential_flush", !(opts.graceful && state.channelDriver));
+  }
+  if (opts.graceful && state.channelDriver) {
     log2(state, "Draining in-flight channel work before shutdown...");
     if (state.interactive) {
       logActivity(state, { type: "info", message: "Draining in-flight work before shutdown..." });
       displayStatus(state);
     }
     const driver = state.channelDriver;
-    const settled = await timeShutdownPhase(
+    drainSettled = await timeShutdownPhase(
       state,
       durations,
       "drain",
       () => driver.waitForInFlight(SHUTDOWN_DRAIN_TIMEOUT_MS)
     );
-    if (!settled) {
+    if (!drainSettled) {
       logActivity(state, {
         type: "info",
         message: "Shutdown drain timed out with work still in flight \u2014 leaving it for restart recovery"
@@ -9911,6 +10472,9 @@ async function cleanup(state, opts = {}) {
       if (state.interactive) displayStatus(state);
     }
   }
+  if (opts.graceful && state.channelDriver && flushCredentials && drainSettled) {
+    await flushCredentials("credential_flush_final", true);
+  }
   await timeShutdownPhase(state, durations, "offline_notify", () => notifyOffline(state));
   if (state.connection) {
     const connection = state.connection;
@@ -9946,6 +10510,44 @@ async function cleanup(state, opts = {}) {
   }
   return durations;
 }
+async function beginGracefulShutdown(state, trigger) {
+  if (state.shuttingDown) return;
+  state.shuttingDown = true;
+  const shutdownStartedAt = Date.now();
+  const shutdownMessage = trigger === "recycle" ? "Recycle requested \u2014 finishing in-flight work, then exiting" : "Shutting down...";
+  if (state.interactive) {
+    logActivity(state, { type: "info", message: shutdownMessage });
+    displayStatus(state);
+  } else {
+    log2(state, shutdownMessage);
+  }
+  const durations = await cleanup(state, { graceful: true });
+  const telemetryBudgetMs = Number(process.env.EVIDENT_TELEMETRY_SHUTDOWN_MS) || TELEMETRY_SHUTDOWN_TIMEOUT_MS;
+  await timeShutdownPhase(state, durations, "telemetry_flush", async () => {
+    let timer;
+    const flushed = shutdownTelemetry().then(
+      () => true,
+      (error2) => {
+        log2(
+          state,
+          `Telemetry flush failed during shutdown: ${error2 instanceof Error ? error2.message : String(error2)}`,
+          "warn"
+        );
+        return true;
+      }
+    );
+    const timedOut = new Promise((resolve4) => {
+      timer = setTimeout(() => resolve4(false), telemetryBudgetMs);
+    });
+    if (!await Promise.race([flushed, timedOut])) {
+      log2(state, `Telemetry flush exceeded ${telemetryBudgetMs}ms \u2014 exiting anyway`, "warn");
+    }
+    clearTimeout(timer);
+  });
+  const breakdown = Object.entries(durations).map(([phase, ms]) => `${phase}=${ms}ms`).join(" ");
+  log2(state, `Shutdown complete in ${Date.now() - shutdownStartedAt}ms (${breakdown})`);
+  process.exit(0);
+}
 async function run(options) {
   const interactive = isInteractive(options.json);
   let logLevel;
@@ -9997,9 +10599,24 @@ async function run(options) {
     openaiUsageTimer: null,
     openaiUsageRearm: null,
     resourceUsageTimer: null,
+    stopResourceUsageSampling: null,
+    credentialSync: null,
     authHeader: ""
   };
   setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
+  if (options.credentialSyncMarker) {
+    state.credentialSync = createCredentialSync({
+      markerPath: options.credentialSyncMarker,
+      env: process.env,
+      log: (message, level = "info") => {
+        if (level === "error") {
+          logActivity(state, { type: "error", error: message });
+        } else {
+          logActivity(state, { type: "info", level, message });
+        }
+      }
+    });
+  }
   if (fileSyncDirectories.length > 0) {
     log2(state, `File sync enabled for: ${fileSyncDirectories.join(", ")}`);
   } else {
@@ -10025,43 +10642,7 @@ async function run(options) {
       "warn"
     );
   }
-  const handleSignal = async () => {
-    if (state.shuttingDown) return;
-    state.shuttingDown = true;
-    const shutdownStartedAt = Date.now();
-    if (state.interactive) {
-      logActivity(state, { type: "info", message: "Shutting down..." });
-      displayStatus(state);
-    } else {
-      log2(state, "Shutting down...");
-    }
-    const durations = await cleanup(state, { graceful: true });
-    const telemetryBudgetMs = Number(process.env.EVIDENT_TELEMETRY_SHUTDOWN_MS) || TELEMETRY_SHUTDOWN_TIMEOUT_MS;
-    await timeShutdownPhase(state, durations, "telemetry_flush", async () => {
-      let timer;
-      const flushed = shutdownTelemetry().then(
-        () => true,
-        (error2) => {
-          log2(
-            state,
-            `Telemetry flush failed during shutdown: ${error2 instanceof Error ? error2.message : String(error2)}`,
-            "warn"
-          );
-          return true;
-        }
-      );
-      const timedOut = new Promise((resolve4) => {
-        timer = setTimeout(() => resolve4(false), telemetryBudgetMs);
-      });
-      if (!await Promise.race([flushed, timedOut])) {
-        log2(state, `Telemetry flush exceeded ${telemetryBudgetMs}ms \u2014 exiting anyway`, "warn");
-      }
-      clearTimeout(timer);
-    });
-    const breakdown = Object.entries(durations).map(([phase, ms]) => `${phase}=${ms}ms`).join(" ");
-    log2(state, `Shutdown complete in ${Date.now() - shutdownStartedAt}ms (${breakdown})`);
-    process.exit(0);
-  };
+  const handleSignal = () => beginGracefulShutdown(state, "signal");
   process.on("SIGINT", handleSignal);
   process.on("SIGTERM", handleSignal);
   try {
@@ -10207,6 +10788,7 @@ async function run(options) {
       await restoreCredentialStores(credentialContext);
       if (githubTokenPopulated) await configureGitHubAccess(credentialContext);
     }
+    state.credentialSync?.arm();
     let sessionDbVerifyFatal = false;
     if (!options.restoreSessionDb) {
       log2(state, "Skipping session-DB restore: --restore-session-db was not passed", "debug");
@@ -10276,7 +10858,7 @@ async function run(options) {
       state.opencodeVersion = oc.version;
       if (options.opencodePidFile && oc.process?.pid !== void 0) {
         try {
-          writeFileSync5(options.opencodePidFile, `${oc.process.pid}
+          writeFileSync6(options.opencodePidFile, `${oc.process.pid}
 `, { mode: 384 });
           chmodSync3(options.opencodePidFile, 384);
         } catch (error2) {
@@ -10392,7 +10974,7 @@ async function run(options) {
           });
           try {
             if (litestreamProcess.pid !== void 0) {
-              writeFileSync5(options.litestreamPidFile, `${litestreamProcess.pid}
+              writeFileSync6(options.litestreamPidFile, `${litestreamProcess.pid}
 `, {
                 mode: 384
               });
@@ -10578,6 +11160,18 @@ async function run(options) {
             if (state.interactive) displayStatus(state);
           });
         },
+        // Both loops are rearmed because `rearm()` is idempotent for the
+        // provider that did not just connect, and is a no-op when reporting is off.
+        onUsageRearmPing: () => {
+          if (!state.running) return;
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: "Usage rearm ping received"
+          });
+          state.claudeUsageRearm?.();
+          state.openaiUsageRearm?.();
+        },
         onInfo: (message) => logActivity(state, { type: "info", message })
       }
     });
@@ -10598,7 +11192,17 @@ async function run(options) {
       setTimer: (timer) => {
         state.openaiUsageTimer = timer;
       },
-      fetchUsage: () => getOpenAiUsage(state.port),
+      fetchUsage: async () => {
+        const usage = await getOpenAiUsage(state.port);
+        if (usage.subscription === null) {
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: "OpenAI usage subscription could not be identified from the local credential"
+          });
+        }
+        return usage;
+      },
       report: (usage) => reportOpenAiUsage(state.agentId, state.authHeader, usage),
       isLocalCredentialProblem: isLocalCredentialProblem2,
       forcedOnHint: "connect a ChatGPT account to this runner, or run `opencode auth login`",
@@ -10722,6 +11326,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--opencode-config-overlay <path>",
   "Apply this runner-provided OpenCode config before starting OpenCode."
+).option(
+  "--credential-sync-marker <path>",
+  "Own the interval credential sync and write this marker once the shutdown flush has finished, so the runner image's lifecycle hooks can wait on it."
 ).action(
   (options) => {
     run({
@@ -10760,7 +11367,8 @@ program.command("run").description("Connect to Evident and process messages").op
       sessionDbNoReplicateMarker: options.sessionDbNoReplicateMarker,
       restoreSessionDb: options.restoreSessionDb,
       restoreRunnerCredentials: options.restoreRunnerCredentials,
-      opencodeConfigOverlay: options.opencodeConfigOverlay
+      opencodeConfigOverlay: options.opencodeConfigOverlay,
+      credentialSyncMarker: options.credentialSyncMarker
     });
   }
 );