@evident-ai/cli 3.5.1-dev.bf9e537 → 3.5.2-dev.2828873

package/dist/index.js

@@ -1063,7 +1063,7 @@ async function claudeUsage() {
 
 // src/commands/run.ts
 import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 import { isAbsolute as isAbsolute3, join as join11, parse, resolve as resolvePath2 } from "node:path";
 import chalk7 from "chalk";
 
@@ -1158,7 +1158,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.5.1-dev.bf9e537" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.5.2-dev.2828873" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -1172,6 +1172,23 @@ var authProvider = null;
 function setTelemetryAuthProvider(provider) {
   authProvider = provider;
 }
+var diagnosticsReporter = null;
+function setTelemetryDiagnosticsReporter(reporter) {
+  diagnosticsReporter = reporter;
+}
+function reportTelemetryDiagnostic(message) {
+  if (!diagnosticsReporter) {
+    console.error(message);
+    return;
+  }
+  try {
+    diagnosticsReporter(message);
+  } catch (error2) {
+    console.error(
+      `Telemetry diagnostics reporter failed: ${error2 instanceof Error ? error2.message : String(error2)}; original diagnostic: ${message}`
+    );
+  }
+}
 var FLUSH_FAILURE_LOG_INTERVAL_MS = 6e4;
 var lastFlushFailureLoggedAt = 0;
 var suppressedFlushFailureCount = 0;
@@ -1237,7 +1254,9 @@ async function flushEvents() {
         signal: controller.signal
       });
       if (!response.ok) {
-        console.error(`Telemetry flush failed: ${response.status}`);
+        reportTelemetryDiagnostic(
+          `Telemetry could not send events (HTTP ${response.status}); runner and OpenCode are unaffected`
+        );
       }
     } finally {
       clearTimeout(timeout);
@@ -1247,7 +1266,9 @@ async function flushEvents() {
     if (now - lastFlushFailureLoggedAt >= FLUSH_FAILURE_LOG_INTERVAL_MS) {
       const message = error2 instanceof Error ? error2.message : String(error2);
       const suffix = suppressedFlushFailureCount > 0 ? ` (${suppressedFlushFailureCount} more suppressed in the last ${FLUSH_FAILURE_LOG_INTERVAL_MS / 1e3}s)` : "";
-      console.error(`Telemetry flush error: ${message}${suffix}`);
+      reportTelemetryDiagnostic(
+        `Telemetry flush failed: ${message}; runner and OpenCode are unaffected${suffix}`
+      );
       lastFlushFailureLoggedAt = now;
       suppressedFlushFailureCount = 0;
     } else {
@@ -1299,8 +1320,14 @@ var EventTypes = {
 };
 
 // src/lib/runner-activity-telemetry.ts
-var FORWARDED_LEVELS = /* @__PURE__ */ new Set(["warn", "error"]);
+import { homedir as homedir2 } from "node:os";
+var FORWARDED_LEVELS_BY_SOURCE = {
+  "cli.run": /* @__PURE__ */ new Set(["warn", "error"]),
+  opencode: /* @__PURE__ */ new Set(["warn", "error"]),
+  "cli.session-cleanup": /* @__PURE__ */ new Set(["info", "warn", "error"])
+};
 var SEVERITY_BY_LEVEL = {
+  info: "info",
   warn: "warning",
   error: "error"
 };
@@ -1311,25 +1338,72 @@ function parseOpenCodeLogLine(line) {
   const level = levelMatch[1].toUpperCase();
   if (level !== "WARN" && level !== "ERROR") return null;
   const sessionMatch = normalisedLine.match(/(?:^|\s)sessionID=(\S+)/);
-  return { level: level === "WARN" ? "warn" : "error", sessionID: sessionMatch?.[1] };
+  const messageMatch = normalisedLine.match(/(?:^|\s)message=(?:"((?:\\.|[^"])*)"|(\S+))/);
+  const parsed = {
+    level: level === "WARN" ? "warn" : "error",
+    sessionID: sessionMatch?.[1]
+  };
+  const message = messageMatch?.[1] ?? messageMatch?.[2];
+  if (message !== void 0) parsed.message = message;
+  return parsed;
 }
 var MAX_LINE_BUFFER_BYTES = 16 * 1024;
+var REPEAT_SUPPRESSION_WINDOW_MS = 6e4;
 function createOpenCodeActivityForwarder(getContext) {
   let buffer = Buffer.alloc(0);
-  const flushLine = (line) => {
-    const parsed = parseOpenCodeLogLine(line);
-    if (!parsed) return;
+  const repeatStates = /* @__PURE__ */ new Map();
+  const forwardLine = (line, parsed, repeatsSuppressed = 0) => {
+    const metadata = {
+      ...parsed.sessionID ? { sessionID: parsed.sessionID } : {},
+      ...repeatsSuppressed > 0 ? { repeats_suppressed: repeatsSuppressed } : {}
+    };
     forwardRunnerActivity(
       {
         level: parsed.level,
         error: line,
-        metadata: parsed.sessionID ? { sessionID: parsed.sessionID } : void 0,
+        metadata: Object.keys(metadata).length > 0 ? metadata : void 0,
         source: "opencode"
       },
       getContext()
     );
   };
-  return (chunk) => {
+  const expireRepeatStates = (now, currentKey) => {
+    for (const [key, state] of repeatStates) {
+      if (key === currentKey || now - state.lastForwardedAt < REPEAT_SUPPRESSION_WINDOW_MS) {
+        continue;
+      }
+      if (state.repeatsSuppressed > 0) {
+        forwardLine(state.line, state.parsed, state.repeatsSuppressed);
+      }
+      repeatStates.delete(key);
+    }
+  };
+  const flushLine = (line) => {
+    const parsed = parseOpenCodeLogLine(line);
+    if (!parsed) return;
+    const now = Date.now();
+    const key = parsed.message === void 0 ? void 0 : `${parsed.level}\0${parsed.message}`;
+    expireRepeatStates(now, key);
+    if (key === void 0) {
+      forwardLine(line, parsed);
+      return;
+    }
+    const previous = repeatStates.get(key);
+    if (!previous || now - previous.lastForwardedAt >= REPEAT_SUPPRESSION_WINDOW_MS) {
+      forwardLine(line, parsed, previous?.repeatsSuppressed ?? 0);
+      repeatStates.set(key, {
+        line,
+        parsed,
+        lastForwardedAt: now,
+        repeatsSuppressed: 0
+      });
+      return;
+    }
+    previous.line = line;
+    previous.parsed = parsed;
+    previous.repeatsSuppressed++;
+  };
+  const forward = ((chunk) => {
     buffer = Buffer.concat([buffer, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, "utf-8")]);
     let newlineIndex;
     while ((newlineIndex = buffer.indexOf(10)) !== -1) {
@@ -1340,14 +1414,44 @@ function createOpenCodeActivityForwarder(getContext) {
       flushLine(buffer.toString("utf-8"));
       buffer = Buffer.alloc(0);
     }
+  });
+  forward.flush = () => {
+    for (const state of repeatStates.values()) {
+      if (state.repeatsSuppressed > 0) {
+        forwardLine(state.line, state.parsed, state.repeatsSuppressed);
+      }
+    }
+    repeatStates.clear();
   };
+  return forward;
 }
 var MAX_MESSAGE_LENGTH = 500;
 var MAX_METADATA_VALUE_LENGTH = 200;
 var MAX_METADATA_ENTRIES = 20;
 var TRUNCATION_MARKER = "\u2026";
+function redactHomeDirectory(message) {
+  const home = homedir2();
+  if (!home || home === "/") {
+    return message;
+  }
+  const pathSegmentCharacters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-";
+  let result = "";
+  let searchFrom = 0;
+  let homeIndex;
+  while ((homeIndex = message.indexOf(home, searchFrom)) !== -1) {
+    const homeEnd = homeIndex + home.length;
+    const previousCharacter = message[homeIndex - 1];
+    const nextCharacter = message[homeEnd];
+    const atPathBoundary = home === "/" || (!previousCharacter || !pathSegmentCharacters.includes(previousCharacter)) && (!nextCharacter || !pathSegmentCharacters.includes(nextCharacter));
+    result += message.slice(searchFrom, homeIndex);
+    result += atPathBoundary ? "~" : home;
+    searchFrom = homeEnd;
+  }
+  return result + message.slice(searchFrom);
+}
 function redact(message) {
-  return message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/(?<![A-Za-z0-9_-])sk-ant-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-ant-***").replace(/(?<![A-Za-z0-9_-])sk-proj-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-proj-***").replace(/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "sk-***").replace(/(?<![A-Za-z0-9_-])(gh[oprsu])_[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "$1_***").replace(/(?<![A-Za-z0-9_-])github_pat_[A-Za-z0-9_]{20,}(?![A-Za-z0-9_-])/g, "github_pat_***").replace(/https?:\/\/\S+/g, "<url>");
+  const redacted = message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/(?<![A-Za-z0-9_-])sk-ant-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-ant-***").replace(/(?<![A-Za-z0-9_-])sk-proj-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-proj-***").replace(/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "sk-***").replace(/(?<![A-Za-z0-9_-])(gh[oprsu])_[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "$1_***").replace(/(?<![A-Za-z0-9_-])github_pat_[A-Za-z0-9_]{20,}(?![A-Za-z0-9_-])/g, "github_pat_***").replace(/https?:\/\/\S+/g, "<url>");
+  return redactHomeDirectory(redacted);
 }
 function truncate(message) {
   if (message.length <= MAX_MESSAGE_LENGTH) return message;
@@ -1357,8 +1461,8 @@ function sanitiseMetadata(metadata) {
   if (!metadata) return {};
   const entries = Object.entries(metadata).slice(0, MAX_METADATA_ENTRIES);
   if (Object.keys(metadata).length > entries.length) {
-    console.error(
-      `[runner-activity-telemetry] dropped ${Object.keys(metadata).length - entries.length} metadata entries`
+    reportTelemetryDiagnostic(
+      `Runner activity telemetry dropped ${Object.keys(metadata).length - entries.length} metadata entries; those entries were not sent`
     );
   }
   const sanitised = [];
@@ -1382,8 +1486,8 @@ function admitUnderRateLimit(source, now) {
   }
   if (now - window.windowStartedAt >= RATE_LIMIT_WINDOW_MS) {
     if (window.windowDroppedCount > 0) {
-      console.error(
-        `[runner-activity-telemetry] rate cap reached: dropped ${window.windowDroppedCount} ${window.windowDroppedCount === 1 ? "entry" : "entries"} in the last ${RATE_LIMIT_WINDOW_MS / 1e3}s (cap ${RATE_LIMIT_MAX_EVENTS}/min) for source "${source}"`
+      reportTelemetryDiagnostic(
+        `Runner activity telemetry rate cap reached: dropped ${window.windowDroppedCount} ${window.windowDroppedCount === 1 ? "entry" : "entries"} in the last ${RATE_LIMIT_WINDOW_MS / 1e3}s (limit ${RATE_LIMIT_MAX_EVENTS}/min); those entries were not sent for source "${source}"`
       );
     }
     window.windowStartedAt = now;
@@ -1393,8 +1497,8 @@ function admitUnderRateLimit(source, now) {
   if (window.windowCount >= RATE_LIMIT_MAX_EVENTS) {
     window.windowDroppedCount++;
     if (window.windowDroppedCount === 1) {
-      console.error(
-        `[runner-activity-telemetry] rate cap reached (${RATE_LIMIT_MAX_EVENTS} per ${RATE_LIMIT_WINDOW_MS / 1e3}s) \u2014 dropping further entries this window for source "${source}"`
+      reportTelemetryDiagnostic(
+        `Runner activity telemetry rate cap reached (${RATE_LIMIT_MAX_EVENTS} entries per ${RATE_LIMIT_WINDOW_MS / 1e3}s limit; further entries were not sent for source "${source}"`
       );
     }
     return false;
@@ -1404,9 +1508,9 @@ function admitUnderRateLimit(source, now) {
 }
 function forwardRunnerActivity(entry, context) {
   try {
-    if (!FORWARDED_LEVELS.has(entry.level)) return;
-    if (!context.agentId || !context.authHeader) return;
     const source = entry.source ?? "cli.run";
+    if (!FORWARDED_LEVELS_BY_SOURCE[source].has(entry.level)) return;
+    if (!context.agentId || !context.authHeader) return;
     if (!admitUnderRateLimit(source, Date.now())) return;
     const rawMessage = entry.error ?? entry.message ?? "";
     const message = truncate(redact(rawMessage));
@@ -1417,8 +1521,8 @@ function forwardRunnerActivity(entry, context) {
       agentId: context.agentId
     });
   } catch (err) {
-    console.error(
-      `[runner-activity-telemetry] failed to forward runner activity: ${err instanceof Error ? err.message : String(err)}`
+    reportTelemetryDiagnostic(
+      `Runner activity telemetry failed to forward runner activity: ${err instanceof Error ? err.message : String(err)}`
     );
   }
 }
@@ -1620,6 +1724,9 @@ async function checkOpenCodeHealth(port) {
       signal: AbortSignal.timeout(2e3)
       // 2 second timeout
     });
+    if (response.status === 401) {
+      return { healthy: false, authFailed: true, error: "HTTP 401" };
+    }
     if (!response.ok) {
       return { healthy: false, error: `HTTP ${response.status}` };
     }
@@ -1684,7 +1791,7 @@ async function waitForOpenCodeHealth(port, timeoutMs = 3e4) {
   const startTime = Date.now();
   while (Date.now() - startTime < timeoutMs) {
     const health = await checkOpenCodeHealth(port);
-    if (health.healthy) {
+    if (health.healthy || health.authFailed) {
       return health;
     }
     await new Promise((resolve4) => setTimeout(resolve4, 1e3));
@@ -3211,7 +3318,7 @@ import { join as join4 } from "node:path";
 
 // src/lib/openai-usage.ts
 import { readFileSync as readFileSync3 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 import { join as join3 } from "node:path";
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 var OPENCODE_AUTH_SEGMENTS = [".local", "share", "opencode", "auth.json"];
@@ -3226,7 +3333,7 @@ function isLocalCredentialProblem2(err) {
 }
 function readOpenCodeChatGptCredentials() {
   try {
-    const raw = readFileSync3(join3(homedir2(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
+    const raw = readFileSync3(join3(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -3367,16 +3474,17 @@ function hasPrimaryHeaders(headers) {
   ].some((name) => headers.has(name));
 }
 async function getOpenAiUsage(port, client) {
+  const openCodeVersion = client?.version ?? "v1";
   const credentials2 = readOpenCodeChatGptCredentials();
   if (!credentials2) {
     throw new OpenAiUsageError(
-      "No ChatGPT login found. Connect a ChatGPT account to this runner, or run `opencode auth login`.",
+      openCodeVersion === "v2" ? "OpenAI usage reporting is not available on OpenCode V2 because V2 keeps a connected ChatGPT login in a store Evident cannot read." : "No ChatGPT login found. Connect a ChatGPT account to this runner, or run `opencode auth login`.",
       "no_credentials"
     );
   }
   if (credentials2.expiresAt < Date.now()) {
     throw new OpenAiUsageError(
-      "ChatGPT credentials have expired. Run `opencode auth login` to refresh them.",
+      openCodeVersion === "v2" ? "The delivered ChatGPT login has expired. OpenCode V2 cannot be given a replacement by file; connect the account again from the runner's page in Evident." : "ChatGPT credentials have expired. Run `opencode auth login` to refresh them.",
       "credentials_expired"
     );
   }
@@ -3658,7 +3766,7 @@ async function importOpenCodeV2Credentials({
 // src/lib/opencode/session-db-boot.ts
 import { spawn as spawn2 } from "node:child_process";
 import { mkdirSync, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 import { dirname as dirname2, resolve as resolvePath } from "node:path";
 
 // src/lib/runner-synchroniser.ts
@@ -4014,14 +4122,14 @@ async function restoreSessionDb(options, configPath, env) {
     case 0:
       return;
     case 31:
-      acknowledgeSessionDbRecoveryReport(sessionDbRecoveryReportPath(homedir3(), env));
+      acknowledgeSessionDbRecoveryReport(sessionDbRecoveryReportPath(homedir4(), env));
       options.log(
         "SESSION-DB-REPLICA-UNUSABLE: booting with a fresh opencode.db and replicating into the existing prefix this boot",
         "warn"
       );
       return;
     case 32:
-      acknowledgeSessionDbRecoveryReport(sessionDbRecoveryReportPath(homedir3(), env));
+      acknowledgeSessionDbRecoveryReport(sessionDbRecoveryReportPath(homedir4(), env));
       discardSessionDbDebris(options);
       markNoReplicate(
         options,
@@ -4110,7 +4218,7 @@ function fileExists(path) {
 async function restoreAndVerifySessionDb(options) {
   const env = options.env ?? process.env;
   clearMarker(options);
-  acknowledgeSessionDbRecoveryReport(sessionDbRecoveryReportPath(homedir3(), env));
+  acknowledgeSessionDbRecoveryReport(sessionDbRecoveryReportPath(homedir4(), env));
   const synchroniserEnv = await runSynchroniser(["env"], {
     timeoutMs: SESSION_DB_SYNCHRONISER_TIMEOUT_MS,
     env
@@ -4311,6 +4419,9 @@ function isSessionDbProvenanceRecord(value) {
   return typeof record.opencodeVersion === "string" && Array.isArray(record.migrationIds) && record.migrationIds.every((id) => typeof id === "string") && typeof record.updatedAt === "string";
 }
 
+// src/lib/opencode/opencode2-package.ts
+var OPENCODE2_PACKAGE_SPEC = "@opencode-ai/cli@0.0.0-beta-17823";
+
 // src/lib/opencode/opencode-version-gate.ts
 var QUEUE_VALIDATED_OPENCODE_VERSIONS = ["1.17.11", "1.18.3"];
 function isQueueValidatedVersion(version2) {
@@ -4487,12 +4598,15 @@ function findProcessesByPattern(pgrepPattern, psPattern) {
         }
       } catch {
         try {
-          const psOutput = execSync(`ps aux | grep -E "${psPattern}" | grep -v grep`, {
+          const psOutput = execSync("ps aux", {
             encoding: "utf-8",
-            stdio: ["pipe", "pipe", "pipe"]
+            stdio: ["pipe", "pipe", "pipe"],
+            // The whole table reaches Node; the 1 MiB default would surface a spurious failure.
+            maxBuffer: 16 * 1024 * 1024
           }).trim();
           if (psOutput) {
             for (const line of psOutput.split("\n")) {
+              if (!psPattern.test(line)) continue;
               const parts = line.trim().split(/\s+/);
               if (parts.length >= 2) {
                 const pid = parseInt(parts[1], 10);
@@ -4501,8 +4615,9 @@ function findProcessesByPattern(pgrepPattern, psPattern) {
             }
           }
         } catch (err) {
+          const reason = (typeof err === "object" && err !== null && "stderr" in err && typeof err.stderr === "string" ? err.stderr : "").split("\n").map((line) => line.trim()).find(Boolean) ?? (err instanceof Error ? err.message : String(err)).split("\n").map((line) => line.trim()).find(Boolean) ?? "no error detail available";
           console.warn(
-            `findOpenCodeProcesses: ps fallback failed: ${err instanceof Error ? err.message : String(err)}`
+            `Could not list running processes, so an already-running OpenCode may not be detected: ${reason}`
           );
         }
       }
@@ -4534,7 +4649,7 @@ function findProcessesByPattern(pgrepPattern, psPattern) {
   return instances;
 }
 function findOpenCodeProcesses() {
-  return findProcessesByPattern("opencode serve|opencode-serve", "opencode (serve|--port)");
+  return findProcessesByPattern("opencode serve|opencode-serve", /opencode (serve|--port)/);
 }
 async function scanPortsForOpenCode() {
   const instances = [];
@@ -4601,7 +4716,8 @@ async function startOpenCode(port, options = {}) {
   const child = spawn3(command, args, {
     detached: true,
     stdio: options.inheritStdio ? "inherit" : "ignore",
-    cwd: process.cwd()
+    cwd: process.cwd(),
+    env: { ...process.env, OPENCODE_SERVER_PASSWORD: void 0 }
   });
   return child;
 }
@@ -4617,7 +4733,7 @@ async function startOpenCode2(port, options = {}) {
     args = [
       "-y",
       "-p",
-      "@opencode-ai/cli@beta",
+      OPENCODE2_PACKAGE_SPEC,
       "--",
       "opencode2",
       "serve",
@@ -4694,7 +4810,7 @@ async function promptOpenCodeInstall(interactive) {
           npm: "npm install -g opencode-ai",
           curl: "curl -fsSL https://opencode.ai/install.sh | sh",
           v2: {
-            npm: "npm install -g @opencode-ai/cli@beta",
+            npm: `npm install -g ${OPENCODE2_PACKAGE_SPEC}`,
             curl: "curl -fsSL https://opencode.ai/v2/install | bash"
           }
         }
@@ -4921,11 +5037,11 @@ function buildSessionStoreSizeWarning(input) {
 
 // src/lib/opencode/log-tail.ts
 import { statSync as statSync4 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 import { join as join7 } from "node:path";
 import { open as open2, stat } from "node:fs/promises";
 var DEFAULT_POLL_INTERVAL_MS = 1e3;
-function resolveOpenCodeLogPath(homeDir = homedir4(), env = process.env) {
+function resolveOpenCodeLogPath(homeDir = homedir5(), env = process.env) {
   const dataDir = env.XDG_DATA_HOME || join7(homeDir, ".local", "share");
   return join7(dataDir, "opencode", "log", "opencode.log");
 }
@@ -5080,7 +5196,11 @@ async function reclaimSessionDbSpace(input) {
         console.warn(
           `[reclaimSessionDbSpace] skipping VACUUM conversion of ${dbPath}: a session turn is live`
         );
-        return { ok: false, skipped: "full-vacuum-blocked" };
+        return {
+          ok: false,
+          skipped: "full-vacuum-blocked",
+          detail: "a session turn is live"
+        };
       }
       const fileBytesForGuard = statSync5(dbPath).size;
       const skipReason = insufficientSpaceReason(dbPath, fileBytesForGuard);
@@ -5088,7 +5208,7 @@ async function reclaimSessionDbSpace(input) {
         console.warn(
           `[reclaimSessionDbSpace] skipping VACUUM conversion of ${dbPath}: ${skipReason}`
         );
-        return { ok: false, skipped: "insufficient-disk-space" };
+        return { ok: false, skipped: "insufficient-disk-space", detail: skipReason };
       }
       const beforeBytes = readLogicalBytes(db);
       db.exec("PRAGMA auto_vacuum=INCREMENTAL");
@@ -5969,7 +6089,7 @@ function createResourceUsageCollector(homeDir) {
 }
 
 // src/lib/channels/driver.ts
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 
 // src/lib/runner-file-sync.ts
 import { join as join9 } from "node:path";
@@ -6852,7 +6972,7 @@ var ChannelDriver = class _ChannelDriver {
     this.stuckQueuedMs = config.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
     this.now = config.now ?? (() => Date.now());
     this.fileSyncDirectories = config.fileSyncDirectories ?? [];
-    this.homeDir = config.homeDir ?? homedir5();
+    this.homeDir = config.homeDir ?? homedir6();
     this.maxActiveSessions = config.maxActiveSessions;
     this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
     this.wedgeWarningIntervalMs = config.wedgeWarningIntervalMs ?? WEDGE_WARNING_INTERVAL_MS;
@@ -11279,8 +11399,16 @@ function checkNonInteractivePortConflict(port, isPortInUseFn) {
     );
   }
 }
+function unknownPasswordError(port) {
+  return new Error(
+    `OpenCode is already running on port ${port}, but this runner cannot authenticate to it. It may have been started with OPENCODE_SERVER_PASSWORD set in its environment. Free the port or pass --port.`
+  );
+}
 async function ensureOpenCodeRunning(ctx) {
   const healthCheck = await checkOpenCodeHealth(ctx.port);
+  if (healthCheck.authFailed) {
+    throw unknownPasswordError(ctx.port);
+  }
   if (healthCheck.healthy) {
     return {
       port: ctx.port,
@@ -11331,6 +11459,14 @@ async function ensureOpenCodeRunning(ctx) {
     const proc = await startOpenCode(ctx.port, { inheritStdio: ctx.inheritStdio });
     const health = await waitForOpenCodeHealth(ctx.port, ctx.startTimeoutMs);
     if (!health.healthy) {
+      if (health.authFailed) {
+        return {
+          port: ctx.port,
+          process: proc,
+          version: null,
+          notReadyReason: "it is answering with an authentication challenge, likely because OPENCODE_SERVER_PASSWORD is set in the environment of the process that started it; a longer start timeout will not resolve this"
+        };
+      }
       return {
         port: ctx.port,
         process: proc,
@@ -11400,6 +11536,9 @@ Port ${port} is already in use.`));
     const health = await waitForOpenCodeHealth(port, INTERACTIVE_START_TIMEOUT_MS);
     if (!health.healthy) {
       spinner.fail("Failed to start OpenCode");
+      if (health.authFailed) {
+        throw unknownPasswordError(port);
+      }
       throw new Error("OpenCode failed to start");
     }
     spinner.stop();
@@ -11412,7 +11551,7 @@ Port ${port} is already in use.`));
 import chalk6 from "chalk";
 import ora3 from "ora";
 import { select as select3 } from "@inquirer/prompts";
-function unknownPasswordError(port) {
+function unknownPasswordError2(port) {
   return new Error(
     `OpenCode V2 (opencode2) is already running on port ${port} with a password this runner doesn't know. Free the port or pass --port.`
   );
@@ -11421,7 +11560,7 @@ var INTERACTIVE_START_TIMEOUT_MS2 = 3e4;
 async function ensureOpenCode2Running(ctx) {
   const initialHealth = await checkOpenCode2Health(ctx.port);
   if (initialHealth.authFailed) {
-    throw unknownPasswordError(ctx.port);
+    throw unknownPasswordError2(ctx.port);
   }
   if (initialHealth.healthy) {
     return {
@@ -11434,7 +11573,7 @@ async function ensureOpenCode2Running(ctx) {
   }
   if (!isOpenCode2Installed()) {
     throw new Error(
-      "OpenCode V2 (opencode2) is not installed. Install it with: npm install -g @opencode-ai/cli@beta"
+      `OpenCode V2 (opencode2) is not installed. Install it with: npm install -g ${OPENCODE2_PACKAGE_SPEC}`
     );
   }
   let port = ctx.port;
@@ -12241,7 +12380,13 @@ function logActivity(state, entry) {
   const level = entry.level ?? (entry.type === "error" ? "error" : "info");
   if (!meetsThreshold(state, level)) return;
   forwardRunnerActivity(
-    { level, message: entry.message, error: entry.error, metadata: entry.metadata },
+    {
+      level,
+      message: entry.message,
+      error: entry.error,
+      metadata: entry.metadata,
+      ...entry.source ? { source: entry.source } : {}
+    },
     { agentId: state.agentId, authHeader: state.authHeader }
   );
   const fullEntry = {
@@ -12263,7 +12408,7 @@ function logActivity(state, entry) {
 }
 function reportSessionDbRecovery(state) {
   try {
-    const report = drainSessionDbRecoveryReport({ homeDir: homedir6(), env: process.env });
+    const report = drainSessionDbRecoveryReport({ homeDir: homedir7(), env: process.env });
     for (const record of report.records) {
       const activity = buildSessionDbRecoveryActivity(record);
       if (!activity) throw new Error("could not map session-DB recovery record");
@@ -12317,7 +12462,7 @@ function reportOpenCodeV2CredentialImport(state, result) {
     logActivity(state, {
       type: "info",
       level: "warn",
-      message: `OpenCode V2 saved login(s) for ${integrationIds} on this machine, but OpenCode V2 will not use them. See #2251 for importing existing logins.`
+      message: `OpenCode V2 saved login(s) for ${integrationIds} on this machine, but OpenCode V2 will not use them. Connect the provider again from the runner's page in Evident; no shell on this machine is needed.`
     });
   }
   if (result.imported.length === 0 && result.unsupported.length === 0 && result.failed.length === 0) {
@@ -12342,7 +12487,7 @@ async function importOpenCodeV2CredentialsForState(state) {
   }
   const result = await importOpenCodeV2Credentials({
     request: client.request,
-    homeDir: homedir6(),
+    homeDir: homedir7(),
     directory,
     guard: state.opencodeV2CredentialImportGuard,
     log: (message, level = "info") => logActivity(state, { type: "info", level, message })
@@ -12561,7 +12706,14 @@ function shouldWarnForReclaimSkip(reason) {
   return major > 22 || major === 22 && (minor > 13 || minor === 13 && patch >= 0);
 }
 function sessionDbPath() {
-  return join11(homedir6(), ".local", "share", "opencode", "opencode.db");
+  return join11(homedir7(), ".local", "share", "opencode", "opencode.db");
+}
+function logSessionCleanupActivity(state, phase, entry) {
+  logActivity(state, {
+    ...entry,
+    source: "cli.session-cleanup",
+    metadata: { ...entry.metadata, phase }
+  });
 }
 function logSessionDbProvenanceMismatch(state, provenance, currentVersion, preBootMigrationCount) {
   const record = {
@@ -12604,9 +12756,13 @@ async function runSweep(state, driver, config) {
   try {
     const sessions = await listSessions(state.port, state.opencodeClient ?? void 0);
     if (sessions === null) {
-      logActivity(state, {
+      logSessionCleanupActivity(state, "sweep", {
         type: "info",
-        message: `Session cleanup: could not list sessions (opencode unreachable); skipping this sweep (${mode})`
+        message: `Session cleanup: could not list sessions (opencode unreachable); skipping this sweep (${mode})`,
+        metadata: {
+          outcome: "sweep-skipped",
+          reason: "opencode-unreachable"
+        }
       });
       return;
     }
@@ -12650,21 +12806,47 @@ async function runSweep(state, driver, config) {
       const beforeMib = (reclaimResult.beforeBytes / 1024 / 1024).toFixed(1);
       const afterMib = (reclaimResult.afterBytes / 1024 / 1024).toFixed(1);
       const checkpointNote = reclaimResult.checkpoint.busy ? ` (on-disk file truncation deferred: checkpoint busy, ${reclaimResult.checkpoint.log} WAL frames pending)` : "";
-      logActivity(state, {
+      logSessionCleanupActivity(state, "sweep", {
         type: "info",
-        message: `Session cleanup: reclaimed session-db space (${reclaimResult.mode}): ${beforeMib} MiB -> ${afterMib} MiB${checkpointNote}`
+        message: `Session cleanup: reclaimed session-db space (${reclaimResult.mode}): ${beforeMib} MiB -> ${afterMib} MiB${checkpointNote}`,
+        metadata: {
+          outcome: "reclaimed",
+          mode: reclaimResult.mode,
+          before_bytes: reclaimResult.beforeBytes,
+          after_bytes: reclaimResult.afterBytes,
+          checkpoint_busy: reclaimResult.checkpoint.busy,
+          wal_frames_pending: reclaimResult.checkpoint.log,
+          sessions_inspected: sessions.length,
+          sessions_deleted: deleted,
+          sessions_failed: failed,
+          sessions_skipped_active: skippedNewlyActive
+        }
       });
     } else {
-      logActivity(state, {
+      logSessionCleanupActivity(state, "sweep", {
         type: "info",
-        message: `Session cleanup: session-db space reclaim skipped (${reclaimResult.skipped})` + (reclaimResult.detail ? `: ${reclaimResult.detail}` : "")
+        level: reclaimResult.skipped === "reclaim-error" || reclaimResult.skipped === "insufficient-disk-space" ? "warn" : "info",
+        message: `Session cleanup: session-db space reclaim skipped (${reclaimResult.skipped})` + (reclaimResult.detail ? `: ${reclaimResult.detail}` : ""),
+        metadata: {
+          outcome: "reclaim-skipped",
+          reason: reclaimResult.skipped,
+          ...reclaimResult.detail !== void 0 ? { detail: reclaimResult.detail } : {},
+          sessions_inspected: sessions.length,
+          sessions_deleted: deleted,
+          sessions_failed: failed,
+          sessions_skipped_active: skippedNewlyActive
+        }
       });
     }
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);
-    logActivity(state, {
+    logSessionCleanupActivity(state, "sweep", {
       type: "error",
-      error: `Session cleanup sweep failed (non-fatal, ${mode}): ${message}`
+      error: `Session cleanup sweep failed (non-fatal, ${mode}): ${message}`,
+      metadata: {
+        outcome: "sweep-failed",
+        reason: "sweep-error"
+      }
     });
   }
 }
@@ -12680,14 +12862,19 @@ function scheduleSessionCleanup(state, driver, options) {
   for (const warning2 of config.warnings) {
     logActivity(state, { type: "info", level: "warn", message: `Session cleanup: ${warning2}` });
   }
-  const dbBytes = statSessionDbBytes(homedir6());
+  const dbBytes = statSessionDbBytes(homedir7());
   void (async () => {
     const reclaimAvailability = dbBytes !== null && config.enabled ? await probeReclaimAvailability({ dbPath: sessionDbPath(), requiredBytes: dbBytes }) : null;
     if (reclaimAvailability !== null) {
-      logActivity(state, {
+      logSessionCleanupActivity(state, "startup", {
         type: "info",
         level: shouldWarnForReclaimSkip(reclaimAvailability.reason) ? "warn" : "info",
-        message: `Session cleanup: reclaim preflight skipped (${reclaimAvailability.reason})` + (reclaimAvailability.detail ? `: ${reclaimAvailability.detail}` : "")
+        message: `Session cleanup: reclaim preflight skipped (${reclaimAvailability.reason})` + (reclaimAvailability.detail ? `: ${reclaimAvailability.detail}` : ""),
+        metadata: {
+          outcome: "preflight-skipped",
+          reason: reclaimAvailability.reason,
+          ...reclaimAvailability.detail !== void 0 ? { detail: reclaimAvailability.detail } : {}
+        }
       });
     }
     const sizeWarning = buildSessionStoreSizeWarning({
@@ -12704,9 +12891,15 @@ function scheduleSessionCleanup(state, driver, options) {
     );
   });
   if (!config.enabled) return;
-  logActivity(state, {
+  logSessionCleanupActivity(state, "startup", {
     type: "info",
-    message: `Session cleanup enabled (age=${config.maxAgeMs ?? "\u2014"}, count=${config.maxCount ?? "\u2014"}, interval=${config.intervalMs}ms)`
+    message: `Session cleanup enabled (age=${config.maxAgeMs ?? "\u2014"}, count=${config.maxCount ?? "\u2014"}, interval=${config.intervalMs}ms)`,
+    metadata: {
+      outcome: "armed",
+      interval_ms: config.intervalMs,
+      max_age_ms: config.maxAgeMs ?? null,
+      max_count: config.maxCount ?? null
+    }
   });
   const interval = setInterval(() => void runSweep(state, driver, config), config.intervalMs);
   const firstSweep = setTimeout(
@@ -12885,7 +13078,7 @@ function scheduleResourceUsageReporting(state, options) {
     });
     return;
   }
-  const { collect, stop } = createResourceUsageCollector(homedir6());
+  const { collect, stop } = createResourceUsageCollector(homedir7());
   state.stopResourceUsageSampling = stop;
   let consecutiveFailures = 0;
   const tick = async () => {
@@ -13110,7 +13303,7 @@ async function run(options) {
   let fileSyncDirectories;
   try {
     logLevel = resolveLogLevel(options);
-    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir6());
+    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir7());
     if (options.restoreSessionDb && !options.sessionDbNoReplicateMarker) {
       throw new Error(
         "--restore-session-db requires --session-db-no-replicate-marker <path>; restore failures must block Litestream replication"
@@ -13165,6 +13358,7 @@ async function run(options) {
     authHeader: ""
   };
   setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
+  setTelemetryDiagnosticsReporter((message) => log2(state, message, "warn"));
   if (options.credentialSyncMarker) {
     state.credentialSync = createCredentialSync({
       markerPath: options.credentialSyncMarker,
@@ -13350,13 +13544,18 @@ async function run(options) {
       if (githubTokenPopulated) await configureGitHubAccess(credentialContext);
     }
     state.credentialSync?.arm();
-    state.stopOpenCodeLogTail = tailOpenCodeLogFile(
-      resolveOpenCodeLogPath(homedir6(), process.env),
-      createOpenCodeActivityForwarder(() => ({
-        agentId: state.agentId,
-        authHeader: state.authHeader
-      }))
-    ).stop;
+    const openCodeActivityForwarder = createOpenCodeActivityForwarder(() => ({
+      agentId: state.agentId,
+      authHeader: state.authHeader
+    }));
+    const openCodeLogTail = tailOpenCodeLogFile(
+      resolveOpenCodeLogPath(homedir7(), process.env),
+      openCodeActivityForwarder
+    );
+    state.stopOpenCodeLogTail = () => {
+      openCodeActivityForwarder.flush();
+      openCodeLogTail.stop();
+    };
     let sessionDbVerifyFatal = false;
     if (!options.restoreSessionDb) {
       log2(state, "Skipping session-DB restore: --restore-session-db was not passed", "debug");
@@ -13368,6 +13567,12 @@ async function run(options) {
           "Skipping session-DB restore: OpenCode is already serving this database",
           "debug"
         );
+      } else if (health.authFailed) {
+        log2(
+          state,
+          "Skipping session-DB restore: OpenCode answered with an authentication challenge; assuming this database is in use",
+          "debug"
+        );
       } else {
         const result = await restoreAndVerifySessionDb({
           dbPath: sessionDbPath(),
@@ -13467,7 +13672,7 @@ async function run(options) {
         const provenance = checkSessionDbProvenance({
           dbPath: sessionDbPath(),
           currentVersion: state.opencodeVersion,
-          homeDir: homedir6(),
+          homeDir: homedir7(),
           env: process.env
         });
         if (provenance.anomaly) {
@@ -13637,7 +13842,7 @@ async function run(options) {
       // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
       // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
-      homeDir: homedir6(),
+      homeDir: homedir7(),
       maxActiveSessions,
       log: (entry) => (
         // Thread the driver's real level straight through so `debug`/`warn`
@@ -13813,7 +14018,7 @@ async function run(options) {
       },
       report: (usage) => reportOpenAiUsage(state.agentId, state.authHeader, usage),
       isLocalCredentialProblem: isLocalCredentialProblem2,
-      forcedOnHint: "connect a ChatGPT account to this runner, or run `opencode auth login`",
+      forcedOnHint: state.opencodeApiVersion === "v2" ? "OpenCode V2 keeps its connected ChatGPT login in a store Evident cannot read" : "connect a ChatGPT account to this runner, or run `opencode auth login`",
       firstDelayMs: firstReportDelayMs,
       nextDelayMs: usageReportDelayMs,
       failureLogLevel: usageReportFailureLogLevel