@evident-ai/cli 3.5.2-dev.60daa5f → 3.5.2-dev.678bfa4

package/dist/index.js

@@ -315,14 +315,14 @@ function blank() {
   console.log();
 }
 function waitForEnter(prompt = "Press Enter to continue...") {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     process.stdout.write(chalk.dim(prompt));
     const handler = () => {
       process.stdin.removeListener("data", handler);
       process.stdin.setRawMode?.(false);
       process.stdin.pause();
       console.log();
-      resolve4();
+      resolve5();
     };
     if (process.stdin.isTTY) {
       process.stdin.setRawMode?.(true);
@@ -332,7 +332,7 @@ function waitForEnter(prompt = "Press Enter to continue...") {
   });
 }
 function sleep(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 
 // src/commands/login.ts
@@ -410,19 +410,19 @@ async function tokenLogin() {
   );
   blank();
   process.stdout.write("Paste token: ");
-  const token = await new Promise((resolve4) => {
+  const token = await new Promise((resolve5) => {
     let data = "";
     process.stdin.setEncoding("utf8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
     process.stdin.on("end", () => {
-      resolve4(data.trim());
+      resolve5(data.trim());
     });
     if (process.stdin.isTTY) {
       process.stdin.once("data", (chunk) => {
         process.stdin.pause();
-        resolve4(chunk.toString().trim());
+        resolve5(chunk.toString().trim());
       });
       process.stdin.resume();
     }
@@ -703,6 +703,31 @@ async function reportResourceUsage(agentId, authHeader, usage) {
     opencode_db_bytes: usage.opencodeDbBytes
   });
 }
+async function getRunnerCredentialVault(agentId, authHeader) {
+  const empty = { prefix: null, vaultId: null, source: null };
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/credential-vault`, {
+      headers: { Authorization: authHeader },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ...empty,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    const data = await response.json();
+    return {
+      prefix: data.credential_vault_prefix,
+      vaultId: data.vault_id,
+      source: data.source
+    };
+  } catch (error2) {
+    return { ...empty, error: describeTimeoutError(error2, 1e4) };
+  }
+}
 async function getAgentInfo(agentId, authHeader) {
   const apiUrl = getApiUrlConfig();
   try {
@@ -877,6 +902,76 @@ async function status(options = {}) {
   process.exit(result.exitCode);
 }
 
+// src/commands/credential-vault-env.ts
+function shellQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function printAssignment(prefix) {
+  console.log(`CREDENTIAL_VAULT_PREFIX=${shellQuote(prefix ?? "")}`);
+}
+function safeReason(reason, credentials2, authHeader) {
+  let safe = reason;
+  for (const secret of [
+    authHeader,
+    credentials2?.token,
+    process.env.EVIDENT_RUNNER_KEY,
+    process.env.EVIDENT_AGENT_KEY,
+    process.env.EVIDENT_TOKEN
+  ]) {
+    if (secret) safe = safe.replaceAll(secret, "[redacted]");
+  }
+  return safe.replace(/[\r\n]+/g, " ");
+}
+function printFallback(reason, credentials2, authHeader) {
+  printAssignment(null);
+  console.error(
+    `WARNING: ${safeReason(reason, credentials2, authHeader)}; using this runner's own credential prefix.`
+  );
+}
+async function credentialVaultEnv() {
+  let credentials2 = null;
+  let authHeader;
+  try {
+    credentials2 = await getAuthCredentials();
+    if (!credentials2) {
+      printFallback("no runner credentials are configured");
+      return;
+    }
+    authHeader = getAuthHeader(credentials2);
+    const runner = await resolveAgentIdFromKey(authHeader);
+    if (!runner.agent_id) {
+      printFallback(
+        runner.error ?? "the runner identity could not be resolved",
+        credentials2,
+        authHeader
+      );
+      return;
+    }
+    const lookup = await getRunnerCredentialVault(runner.agent_id, authHeader);
+    if (lookup.error) {
+      printFallback(`credential vault lookup failed: ${lookup.error}`, credentials2, authHeader);
+      return;
+    }
+    if (lookup.prefix === null) {
+      printFallback("this runner is not linked to a credential vault", credentials2, authHeader);
+      return;
+    }
+    if (/[\r\n]/.test(lookup.prefix)) {
+      printFallback("credential vault lookup returned an invalid prefix", credentials2, authHeader);
+      return;
+    }
+    printAssignment(lookup.prefix);
+    console.error(
+      `VAULT-MODE: credential stores use vault=${lookup.vaultId} source=${lookup.source} prefix=${lookup.prefix}.`
+    );
+  } catch (error2) {
+    const detail = credentials2 === null ? "credential resolution failed" : `credential vault lookup could not be completed: ${error2 instanceof Error ? error2.message : String(error2)}`;
+    printFallback(detail, credentials2, authHeader);
+  } finally {
+    process.exitCode = 0;
+  }
+}
+
 // src/lib/claude-usage.ts
 import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
@@ -1063,7 +1158,7 @@ async function claudeUsage() {
 // src/commands/run.ts
 import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { isAbsolute as isAbsolute3, join as join11, parse, resolve as resolvePath2 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join12, parse, resolve as resolvePath2 } from "node:path";
 import chalk7 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
@@ -1227,7 +1322,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.5.2-dev.60daa5f" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.5.2-dev.678bfa4" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -1388,20 +1483,47 @@ var EventTypes = {
   DEPRECATED_AGENT_KEY_ENV_USED: "cli.deprecated_agent_key_env_used"
 };
 
-// src/lib/runner-activity-telemetry.ts
-import { homedir as homedir2 } from "node:os";
-
 // src/lib/opencode/session-db-reclaim.ts
 import { statSync as statSync2, statfsSync } from "node:fs";
 import { dirname as dirname2 } from "node:path";
-var SESSION_DB_RECLAIM_CHUNK_PAGES = 2e3;
+
+// src/lib/diagnostic-redaction.ts
+import { homedir as homedir2 } from "node:os";
+function redactHomeDirectory(message) {
+  const home = homedir2();
+  if (!home || home === "/") {
+    return message;
+  }
+  const pathSegmentCharacters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-";
+  let result = "";
+  let searchFrom = 0;
+  let homeIndex;
+  while ((homeIndex = message.indexOf(home, searchFrom)) !== -1) {
+    const homeEnd = homeIndex + home.length;
+    const previousCharacter = message[homeIndex - 1];
+    const nextCharacter = message[homeEnd];
+    const atPathBoundary = (!previousCharacter || !pathSegmentCharacters.includes(previousCharacter)) && (!nextCharacter || !pathSegmentCharacters.includes(nextCharacter));
+    result += message.slice(searchFrom, homeIndex);
+    result += atPathBoundary ? "~" : home;
+    searchFrom = homeEnd;
+  }
+  return result + message.slice(searchFrom);
+}
+function redactDiagnosticText(message) {
+  const redacted = message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/(?<![A-Za-z0-9_-])sk-ant-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-ant-***").replace(/(?<![A-Za-z0-9_-])sk-proj-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-proj-***").replace(/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "sk-***").replace(/(?<![A-Za-z0-9_-])(gh[oprsu])_[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "$1_***").replace(/(?<![A-Za-z0-9_-])github_pat_[A-Za-z0-9_]{20,}(?![A-Za-z0-9_-])/g, "github_pat_***").replace(/https?:\/\/\S+/g, "<url>");
+  return redactHomeDirectory(redacted);
+}
+
+// src/lib/opencode/session-db-reclaim.ts
+var SESSION_DB_RECLAIM_CHUNK_PAGES = 100;
 var SESSION_DB_RECLAIM_TIME_BUDGET_MS = 500;
 var SESSION_DB_RECLAIM_PAGE_CEILING = 4e4;
+var SESSION_DB_RECLAIM_BUSY_TIMEOUT_MS = 5e3;
 function errorMessage(error2) {
   if (!(error2 instanceof Error)) return String(error2);
   return error2.cause instanceof Error ? error2.cause.message : error2.message;
 }
-function isSessionStoreWriteFailure(error2) {
+function errorMessages(error2) {
   const messages = [];
   const visited = /* @__PURE__ */ new Set();
   let current = error2;
@@ -1425,12 +1547,81 @@ function isSessionStoreWriteFailure(error2) {
     }
     break;
   }
-  return messages.some(
+  return messages;
+}
+function isSessionStoreWriteFailure(error2) {
+  return errorMessages(error2).some(
     (message) => /(?:database or disk is full|disk is full|no space left on device|SQLITE_(?:FULL|IOERR)(?:\b|_))/i.test(
       message
     )
   );
 }
+var SQLITE_CAUSE_TOKEN = /(?:^|cause:\s+)(SQLiteError:\s+[A-Za-z][A-Za-z0-9]*(?:\s+[A-Za-z][A-Za-z0-9]*){0,7})(?=\s*(?:[)\]"',;]|$))/i;
+var EFFECT_SQL_CAUSE_TOKEN = /(?:^|cause:\s+)(effect\/sql\/SqlError\/[A-Za-z][A-Za-z0-9_]*)/i;
+var PARAMS_FIELD = /\bparams\s*(?:=|:)/i;
+function isCauseBearingText(text) {
+  return /^(?:SQLiteError:\s+|effect\/sql\/SqlError\/)/i.test(text.trim()) || /(?:^|\s)cause:\s+(?:SQLiteError:\s+|effect\/sql\/SqlError\/)/i.test(text);
+}
+function structuredLogFields(line) {
+  const fields = [];
+  for (let index = 0; index < line.length; index++) {
+    if (line[index] === '"') {
+      index++;
+      while (index < line.length) {
+        if (line[index] === "\\") {
+          index++;
+        } else if (line[index] === '"') {
+          break;
+        }
+        index++;
+      }
+      continue;
+    }
+    const atFieldBoundary = index === 0 || /\s/.test(line[index - 1]);
+    const key = line.startsWith("error=", index) ? "error=" : line.startsWith("cause=", index) ? "cause=" : null;
+    if (!atFieldBoundary || key === null) continue;
+    const valueStart = index + key.length;
+    if (line[valueStart] !== '"') {
+      const valueEnd2 = line.indexOf(" ", valueStart);
+      fields.push(line.slice(valueStart, valueEnd2 === -1 ? line.length : valueEnd2));
+      index = valueEnd2 === -1 ? line.length : valueEnd2;
+      continue;
+    }
+    let valueEnd = valueStart + 1;
+    for (; valueEnd < line.length; valueEnd++) {
+      if (line[valueEnd] === "\\") {
+        valueEnd++;
+      } else if (line[valueEnd] === '"') {
+        break;
+      }
+    }
+    fields.push(line.slice(valueStart + 1, valueEnd));
+    index = valueEnd;
+  }
+  return fields;
+}
+function structuredCauseMessages(text) {
+  const fields = structuredLogFields(text);
+  if (fields.length > 0) return fields;
+  return isCauseBearingText(text) ? [text] : [];
+}
+function causeTokenFromText(text) {
+  const paramsIndex = text.search(PARAMS_FIELD);
+  for (const pattern of [SQLITE_CAUSE_TOKEN, EFFECT_SQL_CAUSE_TOKEN]) {
+    const match = pattern.exec(text);
+    if (match?.[1] && (paramsIndex === -1 || match.index < paramsIndex)) {
+      return match[1];
+    }
+  }
+  return null;
+}
+function sessionStoreCauseToken(value) {
+  for (const message of structuredCauseMessages(value)) {
+    const token = causeTokenFromText(message);
+    if (token !== null) return redactDiagnosticText(token).slice(0, 120);
+  }
+  return null;
+}
 function insufficientSpaceReason(dbPath, requiredBytes) {
   try {
     const fsStats = statfsSync(dirname2(dbPath));
@@ -1452,6 +1643,7 @@ function readFreelistCount(db) {
   return db.prepare("PRAGMA freelist_count").get().freelist_count;
 }
 function readCheckpointResult(db) {
+  db.exec("PRAGMA busy_timeout=0");
   const row = db.prepare("PRAGMA wal_checkpoint(TRUNCATE)").get();
   return { busy: row.busy !== 0, log: row.log, checkpointed: row.checkpointed };
 }
@@ -1469,7 +1661,7 @@ async function probeReclaimAvailability(input) {
   try {
     const db = new sqlite.DatabaseSync(dbPath, { readOnly: true });
     try {
-      db.exec("PRAGMA busy_timeout=5000");
+      db.exec(`PRAGMA busy_timeout=${SESSION_DB_RECLAIM_BUSY_TIMEOUT_MS}`);
       autoVacuum = db.prepare("PRAGMA auto_vacuum").get().auto_vacuum;
     } finally {
       db.close();
@@ -1489,7 +1681,8 @@ async function reclaimSessionDbSpace(input) {
     timeBudgetMs = SESSION_DB_RECLAIM_TIME_BUDGET_MS,
     chunkPages = SESSION_DB_RECLAIM_CHUNK_PAGES,
     now = () => performance.now(),
-    allowFullVacuum = true
+    hasLiveTurn = false,
+    hasProvenanceAnomaly = false
   } = input;
   let sqlite;
   try {
@@ -1505,17 +1698,19 @@ async function reclaimSessionDbSpace(input) {
   let db;
   try {
     db = new DatabaseSync(dbPath);
-    db.exec("PRAGMA busy_timeout=5000");
+    db.exec(`PRAGMA busy_timeout=${SESSION_DB_RECLAIM_BUSY_TIMEOUT_MS}`);
     const autoVacuum = db.prepare("PRAGMA auto_vacuum").get().auto_vacuum;
     if (autoVacuum === 0) {
-      if (!allowFullVacuum) {
-        console.warn(
-          `[reclaimSessionDbSpace] skipping VACUUM conversion of ${dbPath}: a session turn is live`
-        );
+      if (hasLiveTurn || hasProvenanceAnomaly) {
+        const detail = [
+          ...hasLiveTurn ? ["a session turn is live"] : [],
+          ...hasProvenanceAnomaly ? ["session-DB provenance is anomalous"] : []
+        ].join(" and ");
+        console.warn(`[reclaimSessionDbSpace] skipping VACUUM conversion of ${dbPath}: ${detail}`);
         return {
           ok: false,
           skipped: "full-vacuum-blocked",
-          detail: "a session turn is live"
+          detail
         };
       }
       const fileBytesForGuard = statSync2(dbPath).size;
@@ -1533,7 +1728,9 @@ async function reclaimSessionDbSpace(input) {
       db.exec("VACUUM");
       const afterBytes = readLogicalBytes(db);
       const freelistAfter = readFreelistCount(db);
+      const checkpointStartedAt = now();
       const checkpoint = readCheckpointResult(db);
+      const checkpointElapsedMs = Math.max(0, now() - checkpointStartedAt);
       return {
         ok: true,
         mode: "convert",
@@ -1544,10 +1741,18 @@ async function reclaimSessionDbSpace(input) {
         pagesReclaimed: Math.max(0, freelistBefore - freelistAfter),
         stoppedBy: "freelist-drained",
         elapsedMs: Math.max(0, now() - startedAt),
+        checkpointElapsedMs,
         checkpoint
       };
     }
     if (autoVacuum === 2) {
+      if (hasLiveTurn) {
+        const detail = "a session turn is live";
+        console.warn(
+          `[reclaimSessionDbSpace] skipping incremental reclaim of ${dbPath}: ${detail}`
+        );
+        return { ok: false, skipped: "live-turn", detail };
+      }
       const beforeBytes = readLogicalBytes(db);
       const freelistBefore = readFreelistCount(db);
       const startedAt = now();
@@ -1572,7 +1777,9 @@ async function reclaimSessionDbSpace(input) {
         freelistAfter = readFreelistCount(db);
       }
       const afterBytes = readLogicalBytes(db);
+      const checkpointStartedAt = now();
       const checkpoint = readCheckpointResult(db);
+      const checkpointElapsedMs = Math.max(0, now() - checkpointStartedAt);
       return {
         ok: true,
         mode: "incremental",
@@ -1583,6 +1790,7 @@ async function reclaimSessionDbSpace(input) {
         pagesReclaimed: Math.max(0, freelistBefore - freelistAfter),
         stoppedBy,
         elapsedMs: Math.max(0, now() - startedAt),
+        checkpointElapsedMs,
         checkpoint
       };
     }
@@ -1602,6 +1810,263 @@ async function reclaimSessionDbSpace(input) {
   }
 }
 
+// src/lib/opencode/dependency-install-diagnostic.ts
+import { lstatSync, realpathSync } from "node:fs";
+import { basename, dirname as dirname3, isAbsolute, join as join2, relative, resolve, sep } from "node:path";
+var DEPENDENCY_INSTALL_FAILURE_MESSAGE = "background dependency install failed";
+var MAX_DISTINCT_DIAGNOSTICS = 32;
+var EFFECT = "OpenCode could not install background dependencies for this scope; its plugins and tools may be unavailable";
+function readOpenCodeLogField(line, key) {
+  const match = line.match(new RegExp(`(?:^|\\s)${key}=(?:"((?:\\\\.|[^"])*)"|(\\S+))`));
+  if (!match) return void 0;
+  if (match[1] === void 0) return match[2];
+  return match[1].replace(/\\(["\\n])/g, (_match, escaped) => {
+    return escaped === "n" ? "\n" : escaped;
+  });
+}
+function parseTrigger(line) {
+  if (readOpenCodeLogField(line, "message") !== DEPENDENCY_INSTALL_FAILURE_MESSAGE) {
+    return null;
+  }
+  const error2 = readOpenCodeLogField(line, "error");
+  if (!error2 || !/\bEACCES\b/.test(error2)) return null;
+  const errnoMatch = error2.match(/\bEACCES:\s*permission denied,\s*([a-z_]+)\s+'([^']*)'/);
+  const capturedPath = errnoMatch?.[2];
+  return {
+    dir: readOpenCodeLogField(line, "dir"),
+    op: errnoMatch?.[1],
+    path: capturedPath && isAbsolute(capturedPath) ? capturedPath : void 0
+  };
+}
+function getErrorCode(error2) {
+  if (typeof error2 === "object" && error2 !== null && "code" in error2) {
+    const code = error2.code;
+    if (typeof code === "string") return code;
+  }
+  return "UNKNOWN";
+}
+function isWithin(path, root) {
+  const candidate = resolve(path);
+  const resolvedRoot = resolve(root);
+  return candidate === resolvedRoot || candidate.startsWith(`${resolvedRoot}${sep}`);
+}
+function rootSpecs(context) {
+  return [
+    { token: "~", configured: resolve(context.homeDir) },
+    { token: "$WORKSPACE", configured: resolve(context.cwd) }
+  ];
+}
+function resolveRoots(context) {
+  const resolved = [];
+  const unresolved = [];
+  for (const spec of rootSpecs(context)) {
+    try {
+      resolved.push({ ...spec, real: realpathSync(spec.configured) });
+    } catch (_error) {
+      unresolved.push(spec);
+    }
+  }
+  return { resolved, unresolved };
+}
+function resolveNearestAncestor(failingPath, remaining, error2) {
+  let ancestor = dirname3(failingPath);
+  const suffix = [basename(failingPath), ...remaining];
+  while (ancestor) {
+    try {
+      return {
+        path: resolve(realpathSync(ancestor), ...suffix),
+        failure: { path: resolve(failingPath), error: error2 }
+      };
+    } catch (ancestorError) {
+      if (ancestor === dirname3(ancestor) || !getErrorCode(ancestorError).startsWith("E")) {
+        return null;
+      }
+      suffix.unshift(basename(ancestor));
+      ancestor = dirname3(ancestor);
+    }
+  }
+  return null;
+}
+function resolveExistingPath(absolutePath) {
+  if (!isAbsolute(absolutePath)) return null;
+  const candidate = resolve(absolutePath);
+  const remaining = [];
+  let current = candidate;
+  while (current) {
+    try {
+      const stat2 = lstatSync(current);
+      if (stat2.isSymbolicLink()) {
+        if (remaining.length === 0) {
+          return { path: join2(realpathSync(dirname3(current)), basename(current)) };
+        }
+        return { path: resolve(realpathSync(current), ...remaining) };
+      }
+      return { path: resolve(realpathSync(current), ...remaining) };
+    } catch (error2) {
+      const code = getErrorCode(error2);
+      if (code !== "ENOENT" && code !== "ENOTDIR") {
+        return resolveNearestAncestor(current, remaining, error2);
+      }
+    }
+    if (current === dirname3(current)) return null;
+    remaining.unshift(basename(current));
+    current = dirname3(current);
+  }
+  return null;
+}
+function tokenise(absolutePath, roots) {
+  const pathResolution = resolveExistingPath(absolutePath);
+  if (!pathResolution) return null;
+  const root = roots.reduce((selected, candidate) => {
+    if (!isWithin(pathResolution.path, candidate.real)) return selected;
+    if (!selected || candidate.real.length > selected.real.length || candidate.real.length === selected.real.length && candidate.token === "$WORKSPACE") {
+      return candidate;
+    }
+    return selected;
+  }, null);
+  if (!root) return null;
+  const suffix = relative(root.real, pathResolution.path);
+  return {
+    value: suffix ? `${root.token}/${suffix.split(sep).join("/")}` : root.token,
+    root,
+    resolutionFailure: pathResolution.failure
+  };
+}
+function classifyScope(dir, roots) {
+  if (!dir) return "other";
+  const tokenisedDir = tokenise(dir, roots.resolved);
+  if (tokenisedDir) return tokenisedDir.root.token === "$WORKSPACE" ? "workspace" : "global";
+  for (const spec of roots.unresolved) {
+    if (isWithin(dir, spec.configured)) {
+      return spec.token === "$WORKSPACE" ? "workspace" : "global";
+    }
+  }
+  return "other";
+}
+function unresolvedRootForPath(path, unresolved) {
+  return unresolved.find((spec) => isWithin(path, spec.configured));
+}
+function statType(stat2) {
+  if (stat2.isDirectory()) return "d";
+  if (stat2.isFile()) return "f";
+  if (stat2.isSymbolicLink()) return "l";
+  return "o";
+}
+function renderStat(name, stat2) {
+  const mode = (stat2.mode & 4095).toString(8).padStart(4, "0");
+  return `${name}:${statType(stat2)}:${stat2.uid}:${stat2.gid}:${mode}`;
+}
+function renderStatError(name, error2) {
+  const code = getErrorCode(error2);
+  return `${name}:${renderErrorCode(code)}`;
+}
+function renderErrorCode(code) {
+  if (code === "ENOENT") return "missing";
+  return code.startsWith("E") ? code : `E${code}`;
+}
+function inspectChain(rootReal, rootToken, absolutePath, resolutionFailure) {
+  const target = resolve(absolutePath);
+  const relativePath = relative(rootReal, target);
+  const components = relativePath ? relativePath.split(sep) : [];
+  const entries = [];
+  let current = rootReal;
+  let status2 = "complete";
+  let finalStat;
+  for (const name of [rootToken, ...components]) {
+    if (name !== rootToken) current = join2(current, name);
+    if (resolutionFailure && resolve(current) === resolve(resolutionFailure.path)) {
+      entries.push(renderStatError(name, resolutionFailure.error));
+      status2 = "stat_failed";
+      break;
+    }
+    try {
+      const stat2 = lstatSync(current);
+      entries.push(renderStat(name, stat2));
+      finalStat = stat2;
+    } catch (error2) {
+      entries.push(renderStatError(name, error2));
+      if (getErrorCode(error2) !== "ENOENT") status2 = "stat_failed";
+      break;
+    }
+  }
+  let symlinkTarget;
+  let symlinkMeta;
+  if (finalStat?.isSymbolicLink() && entries.length === components.length + 1) {
+    try {
+      symlinkTarget = realpathSync(current);
+      try {
+        symlinkMeta = renderStat("", lstatSync(symlinkTarget)).slice(1);
+      } catch (error2) {
+        symlinkMeta = renderErrorCode(getErrorCode(error2));
+        status2 = "stat_failed";
+      }
+    } catch (error2) {
+      symlinkTarget = "<unresolved>";
+      symlinkMeta = renderErrorCode(getErrorCode(error2));
+      status2 = "stat_failed";
+    }
+  }
+  return { status: status2, chain: entries.join(","), symlinkTarget, symlinkMeta };
+}
+function buildDiagnostic(line, context) {
+  const trigger = parseTrigger(line);
+  if (!trigger) return null;
+  const roots = resolveRoots(context);
+  const scope = classifyScope(trigger.dir, roots);
+  const pathSource = trigger.path ? "error" : trigger.dir ? "dir" : "none";
+  const inspectedPath = trigger.path ?? trigger.dir;
+  const microvmId = context.microvmId?.trim() || "unknown";
+  const euid = context.euid === void 0 ? "unavailable" : String(context.euid);
+  const egid = context.egid === void 0 ? "unavailable" : String(context.egid);
+  const op = trigger.op ?? "unknown";
+  if (!inspectedPath) {
+    return {
+      event: `OPENCODE-DEPENDENCY-INSTALL-EACCES: status=no_path path_source=${pathSource} scope=${scope} microvm_id=${microvmId} op=${op} path=unknown cli_euid=${euid} cli_egid=${egid} effect="${EFFECT}" chain=unavailable`,
+      localDetail: null
+    };
+  }
+  const tokenisedPath = tokenise(inspectedPath, roots.resolved);
+  if (!tokenisedPath) {
+    const unresolvedRoot = unresolvedRootForPath(inspectedPath, roots.unresolved);
+    if (unresolvedRoot) {
+      return {
+        event: `OPENCODE-DEPENDENCY-INSTALL-EACCES: status=root_unresolved path_source=${pathSource} scope=${scope} microvm_id=${microvmId} op=${op} path=unknown cli_euid=${euid} cli_egid=${egid} effect="${EFFECT}" chain=unavailable`,
+        localDetail: null
+      };
+    }
+    return {
+      event: `OPENCODE-DEPENDENCY-INSTALL-EACCES: status=outside_roots path_source=${pathSource} scope=${scope} microvm_id=${microvmId} op=${op} path=<outside-approved-roots> cli_euid=${euid} cli_egid=${egid} effect="${EFFECT}" chain=unavailable`,
+      localDetail: `OPENCODE-DEPENDENCY-INSTALL-EACCES (local only): outside approved roots: ${inspectedPath}`
+    };
+  }
+  const inspection = inspectChain(
+    tokenisedPath.root.real,
+    tokenisedPath.root.token,
+    inspectedPath,
+    tokenisedPath.resolutionFailure
+  );
+  const optionalSymlinkFields = inspection.symlinkTarget ? ` symlink_target=${tokenise(inspection.symlinkTarget, roots.resolved)?.value ?? "<outside-approved-roots>"}` + (inspection.symlinkMeta ? ` symlink_meta=${inspection.symlinkMeta}` : "") : "";
+  return {
+    event: `OPENCODE-DEPENDENCY-INSTALL-EACCES: status=${inspection.status} path_source=${pathSource} scope=${scope} microvm_id=${microvmId} op=${op} path=${tokenisedPath.value} cli_euid=${euid} cli_egid=${egid} effect="${EFFECT}" chain=${inspection.chain}${optionalSymlinkFields}`,
+    localDetail: null
+  };
+}
+function createDependencyInstallDiagnosticReporter({
+  context,
+  emitEvent: emitEvent2,
+  emitLocal
+}) {
+  const emittedEvents = /* @__PURE__ */ new Set();
+  return (line) => {
+    const diagnostic = buildDiagnostic(line, context);
+    if (!diagnostic || emittedEvents.has(diagnostic.event)) return;
+    if (emittedEvents.size >= MAX_DISTINCT_DIAGNOSTICS) return;
+    emittedEvents.add(diagnostic.event);
+    emitEvent2(diagnostic.event);
+    if (diagnostic.localDetail) emitLocal(diagnostic.localDetail);
+  };
+}
+
 // src/lib/runner-activity-telemetry.ts
 var FORWARDED_LEVELS_BY_SOURCE = {
   "cli.run": /* @__PURE__ */ new Set(["warn", "error"]),
@@ -1633,7 +2098,17 @@ function parseOpenCodeLogLine(line) {
 }
 var MAX_LINE_BUFFER_BYTES = 16 * 1024;
 var REPEAT_SUPPRESSION_WINDOW_MS = 6e4;
-function createOpenCodeActivityForwarder(getContext, onSessionStoreWriteFailure) {
+function sanitiseDependencyInstallWarning(line) {
+  const withoutDirectory = line.replace(
+    /((?:^|\s)dir=)(?:"(?:\\.|[^"])*"|\/[^\s)"']+|\S+)/g,
+    "$1<path>"
+  );
+  return withoutDirectory.replace(
+    /((?:^|\s)error=)"((?:\\.|[^"])*)"/,
+    (_match, prefix, error2) => `${prefix}"${error2.replace(/'\/[^']*'/g, "'<path>'")}"`
+  );
+}
+function createOpenCodeActivityForwarder(getContext, onSessionStoreWriteFailure, onDependencyInstallFailure) {
   let buffer = Buffer.alloc(0);
   const repeatStates = /* @__PURE__ */ new Map();
   const forwardLine = (line, parsed, repeatsSuppressed = 0) => {
@@ -1645,7 +2120,7 @@ function createOpenCodeActivityForwarder(getContext, onSessionStoreWriteFailure)
     forwardRunnerActivity(
       {
         level: parsed.level,
-        error: line,
+        error: parsed.message === DEPENDENCY_INSTALL_FAILURE_MESSAGE ? sanitiseDependencyInstallWarning(line) : line,
         metadata: Object.keys(metadata).length > 0 ? metadata : void 0,
         source: "opencode"
       },
@@ -1663,18 +2138,7 @@ function createOpenCodeActivityForwarder(getContext, onSessionStoreWriteFailure)
       repeatStates.delete(key);
     }
   };
-  const flushLine = (line) => {
-    if (onSessionStoreWriteFailure && isSessionStoreWriteFailure(line)) {
-      try {
-        onSessionStoreWriteFailure();
-      } catch (err) {
-        reportTelemetryDiagnostic(
-          `Runner activity telemetry could not record session-store write failure: ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-    }
-    const parsed = parseOpenCodeLogLine(line);
-    if (!parsed) return;
+  const forwardWithRepeatSuppression = (line, parsed) => {
     const now = Date.now();
     const key = parsed.message === void 0 ? void 0 : `${parsed.level}\0${parsed.message}\0${parsed.sessionID ?? ""}\0${parsed.messageID ?? ""}`;
     expireRepeatStates(now, key);
@@ -1697,6 +2161,35 @@ function createOpenCodeActivityForwarder(getContext, onSessionStoreWriteFailure)
     previous.parsed = parsed;
     previous.repeatsSuppressed++;
   };
+  const flushLine = (line) => {
+    const parsed = parseOpenCodeLogLine(line);
+    const isDiskFailure = isSessionStoreWriteFailure(line);
+    const cause = sessionStoreCauseToken(line);
+    if (onSessionStoreWriteFailure && (isDiskFailure || cause !== null)) {
+      try {
+        onSessionStoreWriteFailure({
+          isDiskFailure,
+          sessionId: parsed?.sessionID ?? null,
+          cause
+        });
+      } catch (err) {
+        reportTelemetryDiagnostic(
+          `Runner activity telemetry could not record session-store write failure: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    if (!parsed) return;
+    forwardWithRepeatSuppression(line, parsed);
+    if (onDependencyInstallFailure && parsed.message === DEPENDENCY_INSTALL_FAILURE_MESSAGE) {
+      try {
+        onDependencyInstallFailure(line);
+      } catch (err) {
+        reportTelemetryDiagnostic(
+          `Runner activity telemetry could not record dependency-install failure diagnostic: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+  };
   const forward = ((chunk) => {
     buffer = Buffer.concat([buffer, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, "utf-8")]);
     let newlineIndex;
@@ -1722,34 +2215,38 @@ function createOpenCodeActivityForwarder(getContext, onSessionStoreWriteFailure)
 var MAX_MESSAGE_LENGTH = 500;
 var MAX_METADATA_VALUE_LENGTH = 200;
 var MAX_METADATA_ENTRIES = 20;
-var TRUNCATION_MARKER = "\u2026";
-function redactHomeDirectory(message) {
-  const home = homedir2();
-  if (!home || home === "/") {
-    return message;
-  }
-  const pathSegmentCharacters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-";
-  let result = "";
-  let searchFrom = 0;
-  let homeIndex;
-  while ((homeIndex = message.indexOf(home, searchFrom)) !== -1) {
-    const homeEnd = homeIndex + home.length;
-    const previousCharacter = message[homeIndex - 1];
-    const nextCharacter = message[homeEnd];
-    const atPathBoundary = home === "/" || (!previousCharacter || !pathSegmentCharacters.includes(previousCharacter)) && (!nextCharacter || !pathSegmentCharacters.includes(nextCharacter));
-    result += message.slice(searchFrom, homeIndex);
-    result += atPathBoundary ? "~" : home;
-    searchFrom = homeEnd;
-  }
-  return result + message.slice(searchFrom);
-}
-function redactDiagnosticText(message) {
-  const redacted = message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/(?<![A-Za-z0-9_-])sk-ant-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-ant-***").replace(/(?<![A-Za-z0-9_-])sk-proj-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-proj-***").replace(/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "sk-***").replace(/(?<![A-Za-z0-9_-])(gh[oprsu])_[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "$1_***").replace(/(?<![A-Za-z0-9_-])github_pat_[A-Za-z0-9_]{20,}(?![A-Za-z0-9_-])/g, "github_pat_***").replace(/https?:\/\/\S+/g, "<url>");
-  return redactHomeDirectory(redacted);
-}
 function truncate(message) {
   if (message.length <= MAX_MESSAGE_LENGTH) return message;
-  return message.slice(0, MAX_MESSAGE_LENGTH - TRUNCATION_MARKER.length) + TRUNCATION_MARKER;
+  let dropped = message.length - MAX_MESSAGE_LENGTH;
+  let marker = `\u2026${dropped} chars omitted\u2026`;
+  let previousDropped = -1;
+  while (dropped !== previousDropped) {
+    previousDropped = dropped;
+    const nextDropped = message.length - MAX_MESSAGE_LENGTH + marker.length;
+    dropped = nextDropped;
+    marker = `\u2026${dropped} chars omitted\u2026`;
+  }
+  const remaining = MAX_MESSAGE_LENGTH - marker.length;
+  const headLength = Math.ceil(remaining * 0.6);
+  const tailLength = remaining - headLength;
+  const effectMatch = message.startsWith("OPENCODE-DEPENDENCY-INSTALL-EACCES:") ? message.match(/ effect="[^"]*"/) : null;
+  if (effectMatch?.index !== void 0) {
+    const effectEnd = effectMatch.index + effectMatch[0].length;
+    if (effectEnd > headLength && effectEnd < message.length) {
+      const effectLength = effectMatch[0].length;
+      const nonEffectLength = remaining - effectLength;
+      const preservedTailLength = Math.min(
+        message.length - effectEnd,
+        nonEffectLength - Math.min(effectMatch.index, Math.ceil(nonEffectLength * 0.6))
+      );
+      const preservedHeadLength = Math.min(
+        effectMatch.index,
+        nonEffectLength - preservedTailLength
+      );
+      return message.slice(0, preservedHeadLength) + marker + message.slice(effectMatch.index, effectEnd) + message.slice(message.length - preservedTailLength);
+    }
+  }
+  return message.slice(0, headLength) + marker + message.slice(message.length - tailLength);
 }
 function sanitiseMetadata(metadata) {
   if (!metadata) return {};
@@ -1826,10 +2323,10 @@ function forwardRunnerActivity(entry, context) {
 
 // src/lib/opencode/session-db-recovery-report.ts
 import { readFileSync as readFileSync2, unlinkSync } from "node:fs";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 function sessionDbRecoveryReportPath(homeDir, env) {
   const override = env.EVIDENT_SESSION_DB_RECOVERY_REPORT?.trim();
-  return override || join2(homeDir, ".local", "state", "evident", "session-db-recovery.jsonl");
+  return override || join3(homeDir, ".local", "state", "evident", "session-db-recovery.jsonl");
 }
 function drainSessionDbRecoveryReport({
   homeDir,
@@ -1959,12 +2456,23 @@ function buildSessionDbRecoveryActivity(record) {
         metadata: withoutContractFields(record),
         message: `This runner started without restoring session history because it could not verify where its session history is backed up. Nothing in the backup was changed; check the runner backup configuration and permissions.${replication}`
       };
-    case "session_db_boot_refused":
-      return {
-        level,
-        metadata: withoutContractFields(record),
-        message: `This runner did not come online because its damaged session database could not be safely separated from its active backup or proven removed. Backed-up session history remains readable at ${record.quarantine_destination ?? "its original location or the quarantine destination named in the boot logs"}; any local session-database files that remain were left in place and nothing opened or wrote them. See the runner boot logs for SESSION-DB-LOCAL-DISCARD-FAILED details.`
-      };
+    case "session_db_boot_refused": {
+      const message = (() => {
+        switch (record.reason) {
+          case "local_discard_failed":
+            return `This runner did not come online because its damaged session database could not be safely separated from its active backup or proven removed. Backed-up session history remains readable at ${record.quarantine_destination ?? "its original location or the quarantine destination named in the boot logs"}; any local session-database files that remain were left in place and nothing opened or wrote them. See the runner boot logs for SESSION-DB-LOCAL-DISCARD-FAILED details.`;
+          case "replica_separation_unproven":
+            return `This runner did not come online because its damaged session database could not be safely separated from its active backup. The SESSION-DB-REPLICA-SEPARATION-UNVERIFIED boot log contains the partial-quarantine moved and remaining counts. Backed-up session history remains readable at ${record.quarantine_destination ?? "its original location or the quarantine destination named in the boot logs"}; any local session-database files that remain were left in place and nothing opened or wrote them.`;
+          case "verification_timeout_before_separation":
+            return "This runner did not come online because session database verification timed out after detecting corruption, before replica separation was attempted. No replica progress is claimed. See SESSION-DB-VERIFY-TIMEOUT in the runner boot logs before retrying.";
+          case "verification_timeout_during_separation":
+            return "This runner did not come online because session database verification timed out while replica separation was in progress. Separation completion and object removal were not proven. See SESSION-DB-VERIFY-TIMEOUT in the runner boot logs before retrying.";
+          default:
+            return "This runner did not come online because session database recovery could not be completed. Inspect the runner boot logs for the refusal reason before retrying.";
+        }
+      })();
+      return { level, metadata: withoutContractFields(record), message };
+    }
     case "schema_provenance_mismatch":
       return {
         level,
@@ -2091,7 +2599,7 @@ async function waitForOpenCodeHealth(port, timeoutMs = 3e4) {
     if (health.healthy || health.authFailed) {
       return health;
     }
-    await new Promise((resolve4) => setTimeout(resolve4, 1e3));
+    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
   }
   return { healthy: false, error: "Timeout waiting for OpenCode to be healthy" };
 }
@@ -2102,7 +2610,7 @@ async function waitForOpenCode2Health(port, password, timeoutMs = 3e4) {
     if (health.healthy || health.authFailed) {
       return health;
     }
-    await new Promise((resolve4) => setTimeout(resolve4, 1e3));
+    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
   }
   return { healthy: false, error: "Timeout waiting for OpenCode to be healthy" };
 }
@@ -2250,8 +2758,12 @@ function errorOf(m) {
   if (!m || typeof m !== "object") return void 0;
   return m.info?.error ?? m.error;
 }
+function isTerminalStopAnswer(m) {
+  return completedOf(m) != null && errorOf(m) == null && finishOf(m) === "stop";
+}
 function isAssistantInFlight(m) {
   if (completedOf(m) == null) return true;
+  if (errorOf(m) != null) return false;
   return finishOf(m) === "tool-calls";
 }
 async function getSessionMessages(port, sessionId, client) {
@@ -2365,7 +2877,18 @@ async function deleteSession(port, id, client) {
       { method: "DELETE" },
       { allowStatuses: ALL_HTTP_STATUSES }
     );
-    return { ok: res.status >= 200 && res.status < 300, status: res.status };
+    if (res.status >= 200 && res.status < 300) {
+      return { ok: true, status: res.status };
+    }
+    try {
+      const body = await res.text();
+      return body ? { ok: false, status: res.status, body } : { ok: false, status: res.status };
+    } catch (error2) {
+      console.error(
+        `[deleteSession] DELETE /session/${id} response body read failed for HTTP ${res.status}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+      return { ok: false, status: res.status };
+    }
   } catch (error2) {
     console.error(
       `[deleteSession] DELETE /session/${id} failed: ${error2 instanceof Error ? error2.message : String(error2)}`
@@ -2677,7 +3200,7 @@ async function sendPromptAsync(port, sessionId, content, options, attachments, c
       return dispatchedUserMessageId;
     }
     if (attempt < READ_BACK_ATTEMPTS - 1) {
-      await new Promise((resolve4) => setTimeout(resolve4, READ_BACK_DELAY_MS));
+      await new Promise((resolve5) => setTimeout(resolve5, READ_BACK_DELAY_MS));
     }
   }
   return null;
@@ -2698,30 +3221,41 @@ function findAssistantReplyAfter(messages, userMessageId) {
 function findLastAssistantReplyFor(messages, userMessageId) {
   if (!messages || messages.length === 0) return null;
   let lastCorrelated = null;
-  let lastNonErrored = null;
   for (let i = messages.length - 1; i >= 0; i--) {
     const m = messages[i];
     if (roleOf2(m) !== "assistant" || parentIdOf2(m) !== userMessageId) continue;
-    if (lastCorrelated === null) lastCorrelated = m;
-    if (errorOf(m) == null) {
-      lastNonErrored = m;
-      break;
+    lastCorrelated = m;
+    break;
+  }
+  if (lastCorrelated) {
+    if (errorOf(lastCorrelated) == null) return lastCorrelated;
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const m = messages[i];
+      if (roleOf2(m) === "assistant" && parentIdOf2(m) === userMessageId && isTerminalStopAnswer(m)) {
+        return m;
+      }
     }
+    return lastCorrelated;
   }
-  if (lastCorrelated) return lastNonErrored ?? lastCorrelated;
   const userIndex = messages.findIndex((m) => idOf2(m) === userMessageId);
   if (userIndex === -1) return null;
   let last = null;
-  let lastOk = null;
+  let lastAssistantIndex = -1;
   for (let i = userIndex + 1; i < messages.length; i++) {
     const role = roleOf2(messages[i]);
     if (role === "user") break;
     if (role === "assistant") {
       last = messages[i];
-      if (errorOf(messages[i]) == null) lastOk = messages[i];
+      lastAssistantIndex = i;
     }
   }
-  return lastOk ?? last;
+  if (last === null || errorOf(last) == null) return last;
+  for (let i = lastAssistantIndex; i > userIndex; i--) {
+    const m = messages[i];
+    if (roleOf2(m) === "user") break;
+    if (roleOf2(m) === "assistant" && isTerminalStopAnswer(m)) return m;
+  }
+  return last;
 }
 function collectSubagentSessions(messages, userMessageId) {
   if (!messages || messages.length === 0) return [];
@@ -2827,8 +3361,9 @@ function attributeTaskCallUsage(messages, windows) {
 }
 function sumAssistantUsage(messages) {
   if (!messages || messages.length === 0) return null;
-  const nonErrored = messages.filter((message) => errorOf(message) == null);
-  const selected = nonErrored.length > 0 ? nonErrored : messages;
+  const hasTrailingError = errorOf(messages[messages.length - 1]) != null;
+  const hasTerminalStopAnswer = messages.some(isTerminalStopAnswer);
+  const selected = hasTrailingError && hasTerminalStopAnswer ? messages.filter((message) => errorOf(message) == null) : messages;
   let sawAnyUsage = false;
   let inputSum = 0;
   let outputSum = 0;
@@ -2837,9 +3372,11 @@ function sumAssistantUsage(messages) {
   let cacheWriteSum = 0;
   let costSum = 0;
   let sawCost = false;
+  let toolCallCount = 0;
   let modelId = null;
   let providerId = null;
   for (const m of selected) {
+    toolCallCount += m.parts?.filter((part) => part.type === "tool").length ?? 0;
     const info = m.info;
     if (!info) continue;
     const tokens = info.tokens;
@@ -2876,7 +3413,8 @@ function sumAssistantUsage(messages) {
     usage_tokens_cache_write: cacheWriteSum,
     // NULL means OpenCode never reported a cost; it is distinct from a genuine
     // zero-cost message, which sets `sawCost` with `costSum === 0`.
-    usage_cost_usd: sawCost ? costSum : null
+    usage_cost_usd: sawCost ? costSum : null,
+    turn_tool_calls: toolCallCount
   };
 }
 function messageUsage(messages, userMessageId) {
@@ -2884,11 +3422,9 @@ function messageUsage(messages, userMessageId) {
   const byParentAll = messages.filter(
     (m) => roleOf2(m) === "assistant" && parentIdOf2(m) === userMessageId
   );
-  const byParentNonErrored = byParentAll.filter((m) => errorOf(m) == null);
-  const byParent = byParentNonErrored.length > 0 ? byParentNonErrored : byParentAll;
   let correlated;
-  if (byParent.length > 0) {
-    correlated = byParent;
+  if (byParentAll.length > 0) {
+    correlated = byParentAll;
   } else {
     const reply = findAssistantReplyAfter(messages, userMessageId);
     correlated = reply ? [reply] : [];
@@ -2934,14 +3470,38 @@ function messageError(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   const error2 = errorOf(reply);
   if (error2 == null) return null;
-  if (typeof error2 === "string") return error2;
-  if (typeof error2 === "object") {
+  let rendered;
+  if (typeof error2 === "string") {
+    rendered = error2;
+  } else if (typeof error2 === "object") {
     const e = error2;
     const dataMessage = e.data?.message;
-    if (typeof dataMessage === "string") return dataMessage;
-    if (typeof e.message === "string") return e.message;
+    if (typeof dataMessage === "string") {
+      rendered = dataMessage;
+    } else if (typeof e.message === "string") {
+      rendered = e.message;
+    } else {
+      rendered = "The agent run failed.";
+    }
+  } else {
+    rendered = "The agent run failed.";
   }
-  return "The agent run failed.";
+  const toolPart = Array.isArray(reply?.parts) ? reply.parts.find(
+    (part) => part && typeof part === "object" && part.type === "tool" && part.state?.status === "error"
+  ) : void 0;
+  return typeof toolPart?.tool === "string" && toolPart.tool.length > 0 ? `${rendered} (tool "${toolPart.tool}")` : rendered;
+}
+function describeAbandonedReplyShape(messages, userMessageId) {
+  const reply = findLastAssistantReplyFor(messages, userMessageId);
+  if (!reply) return null;
+  const parts = Array.isArray(reply.parts) ? reply.parts : [];
+  const lastTool = [...parts].reverse().find((part) => part?.type === "tool");
+  return {
+    partTypes: parts.slice(-12).map((part) => typeof part?.type === "string" ? part.type : "(unknown)"),
+    droppedPartCount: Math.max(0, parts.length - 12),
+    lastToolName: typeof lastTool?.tool === "string" && lastTool.tool.length > 0 ? lastTool.tool : null,
+    lastToolStatus: typeof lastTool?.state?.status === "string" && lastTool.state.status.length > 0 ? lastTool.state.status : null
+  };
 }
 function isAbortedTerminalReply(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
@@ -2958,19 +3518,32 @@ function isAbortedTerminalReply(messages, userMessageId) {
   }
   return false;
 }
+var CLAUDE_AUTH_EXPIRY_MESSAGES = Object.freeze([
+  "Claude Code credentials are unavailable or expired. Run `claude` to refresh them."
+]);
+function extractReplyErrorShape(reply) {
+  const error2 = errorOf(reply);
+  if (error2 == null || typeof error2 !== "object") {
+    return { name: null, statusCode: null };
+  }
+  const e = error2;
+  const name = typeof e.name === "string" ? e.name.slice(0, 100) : null;
+  const data = e.data;
+  const statusCode = typeof data?.statusCode === "number" && Number.isFinite(data.statusCode) ? data.statusCode : null;
+  return { name, statusCode };
+}
 function classifyReplyAuthError(reply) {
   const error2 = errorOf(reply);
   if (error2 == null || typeof error2 !== "object") return null;
   const e = error2;
   const replyProviderId = reply?.info?.providerID ?? null;
   const replyModelId = reply?.info?.modelID ?? null;
+  const data = e.data;
   if (e.name === "ProviderAuthError") {
-    const data = e.data;
     const providerId = typeof data?.providerID === "string" && data.providerID || replyProviderId;
     return { kind: "model_auth", providerId, modelId: replyModelId, reason: "missing" };
   }
   if (e.name === "APIError") {
-    const data = e.data;
     const statusCode = data?.statusCode;
     if (statusCode === 401 || statusCode === 403) {
       return {
@@ -2981,11 +3554,23 @@ function classifyReplyAuthError(reply) {
       };
     }
   }
+  const errorMessage3 = typeof data?.message === "string" ? data.message : typeof e.message === "string" ? e.message : null;
+  if (errorMessage3 !== null && CLAUDE_AUTH_EXPIRY_MESSAGES.some((knownMessage) => errorMessage3.includes(knownMessage))) {
+    return {
+      kind: "model_auth",
+      providerId: typeof data?.providerID === "string" && data.providerID || replyProviderId,
+      modelId: replyModelId,
+      reason: "rejected"
+    };
+  }
   return null;
 }
 function messageFailure(messages, userMessageId) {
   return classifyReplyAuthError(findLastAssistantReplyFor(messages, userMessageId));
 }
+function isProviderModelNotFoundError(reason) {
+  return reason.includes("Model not found:");
+}
 function findLatestSubagentAuthOutcome(messages, sinceMs) {
   if (!messages || messages.length === 0) return null;
   for (let i = messages.length - 1; i >= 0; i--) {
@@ -3516,7 +4101,18 @@ async function deleteV2Session(client, sessionId) {
       { method: "DELETE" },
       { allowStatuses: Array.from({ length: 500 }, (_, index) => index + 100) }
     );
-    return { ok: response.status >= 200 && response.status < 300, status: response.status };
+    if (response.status >= 200 && response.status < 300) {
+      return { ok: true, status: response.status };
+    }
+    try {
+      const body = await response.text();
+      return body ? { ok: false, status: response.status, body } : { ok: false, status: response.status };
+    } catch (error2) {
+      console.error(
+        `[deleteV2Session] DELETE /api/session/${sessionId} response body read failed for HTTP ${response.status}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+      return { ok: false, status: response.status };
+    }
   } catch (error2) {
     console.error(
       `[deleteV2Session] DELETE /api/session/${sessionId} failed: ${error2 instanceof Error ? error2.message : String(error2)}`
@@ -3692,12 +4288,12 @@ async function readV2SessionErrorStream(client, options) {
 
 // src/lib/opencode/credential-import-v2.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 
 // src/lib/openai-usage.ts
 import { readFileSync as readFileSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 var OPENCODE_AUTH_SEGMENTS = [".local", "share", "opencode", "auth.json"];
 var OpenAiUsageError = class extends Error {
@@ -3711,7 +4307,7 @@ function isLocalCredentialProblem2(err) {
 }
 function readOpenCodeChatGptCredentials() {
   try {
-    const raw = readFileSync3(join3(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
+    const raw = readFileSync3(join4(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -3937,13 +4533,13 @@ var INTEGRATION_LIST_RETRY_DELAY_MS = 1e3;
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var sleep2 = (milliseconds) => new Promise((resolve4) => setTimeout(resolve4, milliseconds));
+var sleep2 = (milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds));
 function emptyResult(unsupported = [], outcome = "completed") {
   return { outcome, imported: [], alreadyConnected: [], unsupported, failed: [] };
 }
 function readOpenCodeCredentials(homeDir, log3) {
   try {
-    const raw = readFileSync4(join4(homeDir, ...OPENCODE_AUTH_SEGMENTS), "utf8");
+    const raw = readFileSync4(join5(homeDir, ...OPENCODE_AUTH_SEGMENTS), "utf8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -4145,7 +4741,7 @@ async function importOpenCodeV2Credentials({
 import { spawn as spawn2 } from "node:child_process";
 import { mkdirSync, statSync as statSync3, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname3, resolve as resolvePath } from "node:path";
+import { dirname as dirname4, resolve as resolvePath } from "node:path";
 
 // src/lib/runner-synchroniser.ts
 import { spawn } from "node:child_process";
@@ -4155,7 +4751,7 @@ function appendError(stderr, error2) {
 ${message}`;
 }
 function runSynchroniser(args, opts) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let child;
     let stdout = "";
     let stderr = "";
@@ -4169,7 +4765,7 @@ function runSynchroniser(args, opts) {
       if (timer.handle) clearTimeout(timer.handle);
       if (abortListener) opts.signal?.removeEventListener("abort", abortListener);
       if (spawnListener) child.removeListener("spawn", spawnListener);
-      resolve4(result);
+      resolve5(result);
     };
     try {
       child = spawn("runner-synchroniser", args, {
@@ -4225,9 +4821,12 @@ function runSynchroniser(args, opts) {
 
 // src/lib/opencode/session-db-boot.ts
 var SESSION_DB_RESTORE_TIMEOUT_MS = 3e5;
-var SESSION_DB_VERIFY_TIMEOUT_MS = 12e4;
+var SESSION_DB_VERIFY_TIMEOUT_MS = 36e4;
 var SESSION_DB_SYNCHRONISER_TIMEOUT_MS = 12e4;
-var SESSION_DB_VERIFY_WALKBACK_BUDGET_SECONDS = 120;
+var SESSION_DB_VERIFY_WALKBACK_BUDGET_SECONDS = 40;
+var SESSION_DB_VERIFY_RESTORE_POINTS_TIMEOUT_SECONDS = 30;
+var SESSION_DB_VERIFY_RESTORE_CANDIDATE_TIMEOUT_SECONDS = 120;
+var SESSION_DB_VERIFY_DISPOSAL_BUDGET_SECONDS = 90;
 function commandError(result) {
   return result.stderr.trim() || `process exited with code ${result.code ?? "null"}`;
 }
@@ -4270,7 +4869,7 @@ function clearMarker(options) {
 function markNoReplicate(options, message) {
   if (options.noReplicateMarker) {
     try {
-      mkdirSync(dirname3(options.noReplicateMarker), { recursive: true });
+      mkdirSync(dirname4(options.noReplicateMarker), { recursive: true });
       writeFileSync(options.noReplicateMarker, "");
     } catch (error2) {
       options.log(
@@ -4329,7 +4928,7 @@ function parseSynchroniserEnv(stdout) {
   return values;
 }
 function runCommand(command, args, options) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let child;
     let stdout = "";
     let stderr = "";
@@ -4338,7 +4937,7 @@ function runCommand(command, args, options) {
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
-      resolve4(result);
+      resolve5(result);
     };
     try {
       child = spawn2(command, args, {
@@ -4346,7 +4945,7 @@ function runCommand(command, args, options) {
         stdio: ["ignore", "pipe", "pipe"]
       });
     } catch (error2) {
-      resolve4({
+      resolve5({
         code: null,
         stdout,
         stderr: error2 instanceof Error ? error2.message : String(error2),
@@ -4425,7 +5024,7 @@ async function ensureLitestreamConfig(options, env) {
     return null;
   }
   try {
-    mkdirSync(dirname3(configPath), { recursive: true });
+    mkdirSync(dirname4(configPath), { recursive: true });
     writeFileSync(configPath, rendered.stdout);
   } catch (error2) {
     options.log(
@@ -4538,20 +5137,37 @@ async function verifySessionDb(options, configPath, env) {
       timeoutMs: SESSION_DB_VERIFY_TIMEOUT_MS,
       env: {
         ...env,
-        // The synchroniser reads this value in SECONDS. Keep this at 120, not
-        // 120_000, so the walkback gives up before the outer process bound.
+        // The synchroniser reads all four values in SECONDS.
         EVIDENT_SESSION_DB_WALKBACK_BUDGET_SECONDS: String(
           SESSION_DB_VERIFY_WALKBACK_BUDGET_SECONDS
+        ),
+        EVIDENT_SESSION_DB_RESTORE_POINTS_TIMEOUT_SECONDS: String(
+          SESSION_DB_VERIFY_RESTORE_POINTS_TIMEOUT_SECONDS
+        ),
+        EVIDENT_SESSION_DB_RESTORE_CANDIDATE_TIMEOUT_SECONDS: String(
+          SESSION_DB_VERIFY_RESTORE_CANDIDATE_TIMEOUT_SECONDS
+        ),
+        EVIDENT_SESSION_DB_DISPOSAL_BUDGET_SECONDS: String(
+          SESSION_DB_VERIFY_DISPOSAL_BUDGET_SECONDS
         )
       }
     });
     logSynchroniserDiagnostics(result, options);
     if (result.timedOut || result.code === 124 || result.code === 137) {
+      if (result.stderr.includes("SESSION-DB-INTEGRITY-FAILED")) {
+        const reason = result.stderr.includes("SESSION-DB-REPLICA-SIZE") ? "verification_timeout_during_separation" : "verification_timeout_before_separation";
+        options.log(
+          `SESSION-DB-VERIFY-TIMEOUT: verification did not finish within its ${SESSION_DB_VERIFY_TIMEOUT_MS}ms deadline; refusing to start with the restored opencode.db (${reason})`,
+          "error"
+        );
+        reportRecord("verify", "session_db_boot_refused", reason, null, options);
+        return { verifyFatal: true, verifyFatalReason: reason };
+      }
       options.log(
         `SESSION-DB-VERIFY-TIMEOUT: verification did not finish within its ${SESSION_DB_VERIFY_TIMEOUT_MS}ms deadline; continuing with the restored opencode.db as-is, unverified`,
         "warn"
       );
-      return false;
+      return { verifyFatal: false };
     }
     if (result.code === 34) {
       reportRecord(
@@ -4561,14 +5177,14 @@ async function verifySessionDb(options, configPath, env) {
         null,
         options
       );
-      return true;
+      return { verifyFatal: true };
     }
     if (result.code === 33) {
       options.log(
         "SESSION-DB-INTEGRITY-EXHAUSTED: booting continues and litestream still replicates, starting an empty backup chain after the corrupt replica was separated.",
         "warn"
       );
-      return false;
+      return { verifyFatal: false };
     }
     if (result.code !== 0) {
       options.log(
@@ -4576,13 +5192,13 @@ async function verifySessionDb(options, configPath, env) {
         "warn"
       );
     }
-    return false;
+    return { verifyFatal: false };
   }
   options.log(
     "skipping session-DB verification: this boot's session DB was not proven safe to replicate",
     "debug"
   );
-  return false;
+  return { verifyFatal: false };
 }
 function fileExists(path) {
   try {
@@ -4669,13 +5285,13 @@ async function restoreAndVerifySessionDb(options) {
   if (options.noReplicateMarker && fileExists(options.noReplicateMarker)) {
     return { verifyFatal: false };
   }
-  return { verifyFatal: await verifySessionDb(options, configPath, env) };
+  return verifySessionDb(options, configPath, env);
 }
 
 // src/lib/opencode/session-db-provenance.ts
 import { createRequire } from "node:module";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname4, join as join5 } from "node:path";
+import { dirname as dirname5, join as join6 } from "node:path";
 var require2 = createRequire(import.meta.url);
 function readSessionDbMigrationIds(dbPath) {
   let db;
@@ -4712,7 +5328,7 @@ function readSessionDbMigrationIds(dbPath) {
 }
 function sessionDbProvenanceStatePath(homeDir, env) {
   const override = env.EVIDENT_SESSION_DB_PROVENANCE_STATE?.trim();
-  return override || join5(homeDir, ".local", "state", "evident", "session-db-provenance.json");
+  return override || join6(homeDir, ".local", "state", "evident", "session-db-provenance.json");
 }
 function loadSessionDbProvenanceState(path) {
   let value;
@@ -4741,7 +5357,7 @@ function loadSessionDbProvenanceState(path) {
 }
 function saveSessionDbProvenanceState(path, state) {
   try {
-    mkdirSync2(dirname4(path), { recursive: true });
+    mkdirSync2(dirname5(path), { recursive: true });
     writeFileSync2(path, `${JSON.stringify(state, null, 2)}
 `, "utf8");
   } catch (error2) {
@@ -4832,7 +5448,7 @@ async function stopProcessAndWait(child, timeoutMs, sendTerm, sendKill) {
   if (child.exitCode !== null || child.signalCode !== null) {
     return { outcome: "exited", code: child.exitCode, signal: child.signalCode };
   }
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let forced = false;
     let settled = false;
     const timer = setTimeout(() => {
@@ -4852,7 +5468,7 @@ async function stopProcessAndWait(child, timeoutMs, sendTerm, sendKill) {
       settled = true;
       clearTimeout(timer);
       child.removeListener("exit", onExit);
-      resolve4(result);
+      resolve5(result);
     };
     const fail = (error2) => {
       if (settled) return;
@@ -5328,7 +5944,7 @@ function selectSessionsToDelete(sessions, opts) {
   );
 }
 var DEFAULT_INTERVAL = "1h";
-function resolve(flag, envValue, fallback) {
+function resolve2(flag, envValue, fallback) {
   return flag ?? envValue ?? fallback;
 }
 function parseMaxCount(input) {
@@ -5344,9 +5960,9 @@ function parseMaxCount(input) {
 }
 function resolveSessionCleanupConfig(flags, env = process.env) {
   const warnings = [];
-  const maxAgeRaw = resolve(flags.maxAge, env.EVIDENT_SESSION_CLEANUP_MAX_AGE);
-  const maxCountRaw = resolve(flags.maxCount, env.EVIDENT_SESSION_CLEANUP_MAX_COUNT);
-  const intervalRaw = resolve(
+  const maxAgeRaw = resolve2(flags.maxAge, env.EVIDENT_SESSION_CLEANUP_MAX_AGE);
+  const maxCountRaw = resolve2(flags.maxCount, env.EVIDENT_SESSION_CLEANUP_MAX_COUNT);
+  const intervalRaw = resolve2(
     flags.interval,
     env.EVIDENT_SESSION_CLEANUP_INTERVAL,
     DEFAULT_INTERVAL
@@ -5386,10 +6002,10 @@ function resolveSessionCleanupConfig(flags, env = process.env) {
 
 // src/lib/opencode/session-db-size.ts
 import { statSync as statSync4 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 var LARGE_DB_THRESHOLD_BYTES = 268435456;
 function statSessionDbBytes(homeDir) {
-  const dbPath = join6(homeDir, ".local", "share", "opencode", "opencode.db");
+  const dbPath = join7(homeDir, ".local", "share", "opencode", "opencode.db");
   try {
     return statSync4(dbPath).size;
   } catch (err) {
@@ -5419,12 +6035,12 @@ function buildSessionStoreSizeWarning(input) {
 // src/lib/opencode/log-tail.ts
 import { statSync as statSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 import { open as open2, stat } from "node:fs/promises";
 var DEFAULT_POLL_INTERVAL_MS = 1e3;
 function resolveOpenCodeLogPath(homeDir = homedir5(), env = process.env) {
-  const dataDir = env.XDG_DATA_HOME || join7(homeDir, ".local", "share");
-  return join7(dataDir, "opencode", "log", "opencode.log");
+  const dataDir = env.XDG_DATA_HOME || join8(homeDir, ".local", "share");
+  return join8(dataDir, "opencode", "log", "opencode.log");
 }
 function isEnoent(error2) {
   return error2?.code === "ENOENT";
@@ -5579,8 +6195,8 @@ var StreamForwarder = class {
   pauseStream(sid, stream) {
     if (!stream.paused) {
       stream.paused = true;
-      stream.pausePromise = new Promise((resolve4) => {
-        stream.resume = resolve4;
+      stream.pausePromise = new Promise((resolve5) => {
+        stream.resume = resolve5;
       });
     }
     if (stream.pauseTimer !== null) clearTimeout(stream.pauseTimer);
@@ -5647,12 +6263,12 @@ var StreamForwarder = class {
     let endBody;
     if (has_body) {
       const chunks = [];
-      bodyPromise = new Promise((resolve4) => {
+      bodyPromise = new Promise((resolve5) => {
         pushBody = (buf) => {
           chunks.push(buf);
         };
         endBody = () => {
-          resolve4(Buffer.concat(chunks));
+          resolve5(Buffer.concat(chunks));
         };
       });
     }
@@ -5823,7 +6439,7 @@ function connectTunnel(options) {
   } = options;
   const tunnelUrl = getTunnelUrlConfig();
   const url = `${tunnelUrl}/tunnel/${agentId}/connect`;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const ws = new WebSocket2(url, {
       headers: {
         Authorization: authHeader,
@@ -5932,7 +6548,7 @@ function connectTunnel(options) {
           forwarder.setBinaryFramesSupported(message.binary_frames === true);
           const connectedAgentId = message.agent_id ?? agentId;
           onConnected?.(connectedAgentId);
-          resolve4({
+          resolve5({
             ws,
             close: () => ws.close(1e3, "CLI shutdown")
           });
@@ -6450,6 +7066,7 @@ function createSessionStoreHealth(options = {}) {
   const stalenessMs = Math.max(0, options.stalenessMs ?? SESSION_STORE_HEALTH_STALENESS_MS);
   let lastUnwritableAt = null;
   let lastWritableAt = null;
+  const causes = /* @__PURE__ */ new Map();
   return {
     observeUnwritable: () => {
       lastUnwritableAt = now();
@@ -6461,6 +7078,23 @@ function createSessionStoreHealth(options = {}) {
       if (lastUnwritableAt === null) return false;
       if (lastWritableAt !== null && lastWritableAt >= lastUnwritableAt) return false;
       return now() - lastUnwritableAt < stalenessMs;
+    },
+    observeCause: (sessionId, cause) => {
+      if (sessionId === null) return;
+      causes.delete(sessionId);
+      causes.set(sessionId, { cause, observedAt: now() });
+      while (causes.size > 256) {
+        const oldest = causes.keys().next().value;
+        if (typeof oldest !== "string") break;
+        causes.delete(oldest);
+      }
+    },
+    readCause: (sessionId) => {
+      const observed = causes.get(sessionId);
+      if (!observed) return null;
+      causes.delete(sessionId);
+      if (now() - observed.observedAt >= stalenessMs) return null;
+      return observed.cause;
     }
   };
 }
@@ -6469,12 +7103,12 @@ function createSessionStoreHealth(options = {}) {
 import { homedir as homedir6 } from "node:os";
 
 // src/lib/runner-file-sync.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 
 // src/lib/file-push.ts
 import { randomUUID } from "node:crypto";
 import { chmod, mkdir, open as open3, realpath, rename, unlink } from "node:fs/promises";
-import { basename, dirname as dirname5, isAbsolute, join as join8, relative, resolve as resolve2, sep } from "node:path";
+import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join9, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
 async function writePushedFile(request2) {
@@ -6505,9 +7139,9 @@ async function writePushedFile(request2) {
   }
   try {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
-      dirname5(candidate)
+      dirname6(candidate)
     );
-    const realTarget = join8(existingAncestor, ...missingSegments, basename(candidate));
+    const realTarget = join9(existingAncestor, ...missingSegments, basename2(candidate));
     const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
@@ -6517,8 +7151,8 @@ async function writePushedFile(request2) {
     }
     if (missingSegments.length > 0) {
       await createMissingDirectories(existingAncestor, missingSegments);
-      const realParent = await realpath(dirname5(realTarget));
-      if (realParent !== dirname5(realTarget) || !contains(allowedDirectory, realTarget)) {
+      const realParent = await realpath(dirname6(realTarget));
+      if (realParent !== dirname6(realTarget) || !contains(allowedDirectory, realTarget)) {
         return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
           path: realTarget,
           bytes,
@@ -6543,15 +7177,15 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join8(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join9(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
-  if (!isAbsolute(expanded)) {
+  if (!isAbsolute2(expanded)) {
     return null;
   }
-  const candidate = resolve2(expanded);
-  const name = basename(candidate);
+  const candidate = resolve3(expanded);
+  const name = basename2(candidate);
   return name === "" || name === "." || name === ".." ? null : candidate;
 }
 async function resolveNearestExistingAncestor(directory) {
@@ -6561,18 +7195,18 @@ async function resolveNearestExistingAncestor(directory) {
     try {
       return { existingAncestor: await realpath(current), missingSegments };
     } catch (err) {
-      const parent = dirname5(current);
+      const parent = dirname6(current);
       if (err.code !== "ENOENT" || parent === current) {
         throw err;
       }
-      missingSegments.unshift(basename(current));
+      missingSegments.unshift(basename2(current));
       current = parent;
     }
   }
 }
 async function findContainingAllowedDirectory(allowedDirectories, realTarget) {
   for (const directory of allowedDirectories) {
-    if (!isAbsolute(directory)) {
+    if (!isAbsolute2(directory)) {
       log("warn", "file_push_allowed_directory_skipped", { directory, reason: "not_absolute" });
       continue;
     }
@@ -6610,19 +7244,19 @@ async function realpathCreatingIfMissing(directory) {
   }
 }
 function contains(realDirectory, realTarget) {
-  const rel = relative(realDirectory, realTarget);
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+  const rel = relative2(realDirectory, realTarget);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute2(rel);
 }
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join8(current, segment);
+    current = join9(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join8(dirname5(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join9(dirname6(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
     handle = await open3(temporaryPath, "wx", FILE_MODE);
@@ -6752,12 +7386,12 @@ var NOT_APPLIED = {
   opencodeAuthApplied: false
 };
 function isClaudeCredentialPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join9(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join9(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join10(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join10(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
 }
 function isOpenCodeAuthPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join9(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join9(homeDir, ...OPENCODE_AUTH_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join10(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join10(homeDir, ...OPENCODE_AUTH_SEGMENTS);
 }
 async function applyOne(options, file) {
   const label = `${file.id.slice(0, 8)} (${file.path})`;
@@ -6901,6 +7535,11 @@ function messageIdOf(m) {
   const infoId = m.info?.id;
   return typeof infoId === "string" ? infoId : void 0;
 }
+function composeAbandonmentNote(finish, replyShape, outcome) {
+  const base = `OpenCode ended this turn after a tool call (finish="${finish ?? "(unknown)"}") ` + (outcome === "without-answer" ? "without writing an answer, and confirmed it is no longer working on this conversation. Evident is reporting the run as failed so the failure and its reason are visible in failed runs." : "after writing only part of an answer, and confirmed it is no longer working on this conversation. Evident delivered what was written and is reporting the run as finished.");
+  if (replyShape === null) return base;
+  return `${base} ${replyShape.lastToolName === null ? "No tool call was recorded" : `The last tool call was "${replyShape.lastToolName}" with status "${replyShape.lastToolStatus ?? "(unknown)"}"`}; the reply's final part types were [${replyShape.partTypes.join(", ")}]${replyShape.droppedPartCount > 0 ? ` (${replyShape.droppedPartCount} earlier part types omitted)` : ""}.`;
+}
 function cleanImageMime(contentType) {
   if (!contentType) return null;
   const media = contentType.split(";")[0].trim().toLowerCase();
@@ -6921,6 +7560,10 @@ var SUBAGENT_TELEMETRY_FETCH_TIMEOUT_MS = 2e3;
 var SESSION_ERROR_STREAM_HEALTHY_MS = 5e3;
 var SESSION_ERROR_BUFFER_TTL_MS = SESSION_ERROR_STREAM_HEALTHY_MS;
 var MAX_BUFFERED_SESSION_ERRORS = 256;
+var SESSION_ERROR_RETENTION_TTL_MS = 6e4;
+var SESSION_STORE_UNWRITABLE_ERROR = "The runner session database could not be written, so this turn did not finish. Nothing was lost from the queue. Clear disk space and retry.";
+var SESSION_ERROR_RETAINED_DETAIL = "Runner-observed OpenCode session error: ";
+var SESSION_ERROR_OBSERVED_CAUSE = "Runner-observed OpenCode session-store cause: ";
 var DEFAULT_PAUSED_POLL_INTERVAL_MS = 2e3;
 var DEFAULT_PAUSED_MAX_WAIT_MS = 10 * 60 * 1e3;
 var DRIVER_SESSION_ENUMERATION_LIMIT = 20;
@@ -7078,6 +7721,7 @@ var ChannelDriver = class _ChannelDriver {
    * with a short TTL so an unmatched session cannot retain an event indefinitely.
    */
   bufferedSessionErrors = /* @__PURE__ */ new Map();
+  retainedSessionErrors = /* @__PURE__ */ new Map();
   /**
    * AUTHORITATIVE local dedup (WI-3): Evident message ids that have been
    * dispatched and are still in-flight. A message in this set is never
@@ -8918,6 +9562,28 @@ var ChannelDriver = class _ChannelDriver {
       this.bufferedSessionErrors.delete(oldest);
     }
   }
+  retainSessionError(event) {
+    this.retainedSessionErrors.delete(event.sessionId);
+    this.retainedSessionErrors.set(event.sessionId, {
+      reason: event.reason,
+      observedAt: this.now()
+    });
+    while (this.retainedSessionErrors.size > MAX_BUFFERED_SESSION_ERRORS) {
+      const oldest = this.retainedSessionErrors.keys().next().value;
+      if (typeof oldest !== "string") break;
+      this.retainedSessionErrors.delete(oldest);
+    }
+  }
+  readRetainedSessionError(sessionId) {
+    const retained = this.retainedSessionErrors.get(sessionId);
+    if (!retained) return null;
+    if (this.now() - retained.observedAt >= SESSION_ERROR_RETENTION_TTL_MS) {
+      this.retainedSessionErrors.delete(sessionId);
+      return null;
+    }
+    this.retainedSessionErrors.delete(sessionId);
+    return retained.reason;
+  }
   /**
    * Build a fresh `SessionWatcher`. Seeds `lastTickAt`/`lastObservedTickAt`
    * EQUAL (#1618) so a watcher whose loop has not started ticking yet is never
@@ -9244,9 +9910,10 @@ var ChannelDriver = class _ChannelDriver {
         return;
       }
       if ([...watcher.inFlight.values()].some((message) => message.started && !message.done)) {
+        this.retainSessionError(event);
         this.log({
-          level: "debug",
-          message: `A turn is already running in session ${event.sessionId.slice(0, 8)} \u2014 deferring to transcript polling`,
+          level: "warn",
+          message: `A turn is already running in session ${event.sessionId.slice(0, 8)} \u2014 retaining the session error and deferring to transcript polling: ${event.reason}`,
           conversation_id: watcher.conv.id
         });
         return;
@@ -9276,9 +9943,10 @@ var ChannelDriver = class _ChannelDriver {
       const messages = await this.getSessionMessages(event.sessionId);
       const state = messageRunState(messages, inFlight.opencodeMessageId);
       if (state !== "queued") {
+        this.retainSessionError(event);
         this.log({
-          level: "debug",
-          message: `Session error for message ${inFlight.evidentMessageId.slice(0, 8)} observed state ${state}; leaving it to transcript polling`,
+          level: "warn",
+          message: `Session error for message ${inFlight.evidentMessageId.slice(0, 8)} in session ${event.sessionId.slice(0, 8)} observed state ${state}; retaining the reason for transcript polling: ${event.reason}`,
           conversation_id: watcher.conv.id,
           message_id: inFlight.evidentMessageId
         });
@@ -9290,14 +9958,53 @@ var ChannelDriver = class _ChannelDriver {
         conversation_id: watcher.conv.id,
         message_id: inFlight.evidentMessageId
       });
-      await this.markFailed(
-        watcher.conv.id,
-        inFlight.evidentMessageId,
-        event.sessionId,
-        `OpenCode could not run this turn: ${event.reason}`
-      );
+      const isMissingProvider = isProviderModelNotFoundError(event.reason);
+      if (isMissingProvider) {
+        const dispatchedModel = inFlight.message.opencode_model;
+        const separator = dispatchedModel?.indexOf("/") ?? -1;
+        const hasProviderAndModel = dispatchedModel !== null && separator > 0 && separator < dispatchedModel.length - 1;
+        await this.markFailed(
+          watcher.conv.id,
+          inFlight.evidentMessageId,
+          event.sessionId,
+          `OpenCode could not run this turn: ${event.reason}`,
+          void 0,
+          {
+            classification: {
+              kind: "model_auth",
+              providerId: hasProviderAndModel ? dispatchedModel.slice(0, separator) : null,
+              modelId: hasProviderAndModel ? dispatchedModel.slice(separator + 1) : null,
+              reason: "missing"
+            },
+            errorShape: { name: null, statusCode: null }
+          }
+        );
+      } else {
+        await this.markFailed(
+          watcher.conv.id,
+          inFlight.evidentMessageId,
+          event.sessionId,
+          `OpenCode could not run this turn: ${event.reason}`
+        );
+      }
       inFlight.done = true;
       this.removeInFlight(watcher, inFlight.evidentMessageId);
+      if (isMissingProvider) {
+        if (this.isV2) {
+          void this.postSignal(
+            watcher.conv.id,
+            inFlight.evidentMessageId,
+            "provider_registry_reload_unsupported"
+          );
+        } else {
+          await reloadProviderCache(this.port, this.openCodeClient);
+          void this.postSignal(
+            watcher.conv.id,
+            inFlight.evidentMessageId,
+            "provider_registry_reload_issued"
+          );
+        }
+      }
     } catch (err) {
       if (err instanceof ChannelAuthError) {
         this.log({
@@ -9507,7 +10214,16 @@ var ChannelDriver = class _ChannelDriver {
     if (state === "failed") {
       this.anchorDeliveryDeadline(inFlight);
       if (!inFlight.done) {
-        const error2 = messageError(messages, inFlight.opencodeMessageId) ?? void 0;
+        const messageErrorText = messageError(messages, inFlight.opencodeMessageId);
+        const retainedReason = this.readRetainedSessionError(sessionId);
+        const retainedError = retainedReason === null || messageErrorText !== null && messageErrorText.includes(retainedReason) ? null : `${SESSION_ERROR_RETAINED_DETAIL}${retainedReason}`;
+        const observedCause = this.sessionStoreHealth?.readCause(sessionId);
+        const causeError = observedCause === null || observedCause === void 0 ? null : `${SESSION_ERROR_OBSERVED_CAUSE}${observedCause}`;
+        const storeError = this.sessionStoreHealth?.isUnwritable() ? SESSION_STORE_UNWRITABLE_ERROR : null;
+        const runnerDetails = [retainedError, causeError, storeError].filter(
+          (detail) => detail !== null
+        );
+        const error2 = messageErrorText === null ? runnerDetails.length === 0 ? void 0 : runnerDetails.join(" ") : [messageErrorText, ...runnerDetails].join(" ");
         this.log({
           level: "error",
           message: `Message ${inFlight.evidentMessageId.slice(0, 8)} errored \u2014 marking failed: ${error2 ?? "(no error text)"}`,
@@ -9597,17 +10313,28 @@ var ChannelDriver = class _ChannelDriver {
       }
     } else {
       if (inFlight.b2AbandonedSignalled) {
+        const reply = findLastAssistantReplyFor(messages, inFlight.opencodeMessageId);
+        const finish = reply?.info?.finish ?? reply?.finish;
         if (inFlight.b2AbandonedWithoutAnswer) {
-          const reply = findLastAssistantReplyFor(messages, inFlight.opencodeMessageId);
           await this.settleMessageAbandonedWithoutAnswer(
             sessionId,
             watcher,
             inFlight,
             messages,
-            reply?.info?.finish ?? reply?.finish
+            finish
           );
         } else {
-          await this.settleMessageDone(sessionId, watcher, inFlight, messages);
+          await this.settleMessageDone(
+            sessionId,
+            watcher,
+            inFlight,
+            messages,
+            composeAbandonmentNote(
+              finish,
+              describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+              "with-answer"
+            )
+          );
         }
         return;
       }
@@ -9670,7 +10397,17 @@ var ChannelDriver = class _ChannelDriver {
             ...descendantOngoing != null ? { descendant_ongoing: descendantOngoing } : {},
             opencode_message_id: inFlight.opencodeMessageId
           });
-          await this.settleMessageDone(sessionId, watcher, inFlight, messages);
+          await this.settleMessageDone(
+            sessionId,
+            watcher,
+            inFlight,
+            messages,
+            composeAbandonmentNote(
+              finish,
+              describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+              "with-answer"
+            )
+          );
           return;
         }
         if (rootOngoing === true && !inFlight.b2RootOngoingHeldLogged) {
@@ -9870,15 +10607,11 @@ var ChannelDriver = class _ChannelDriver {
     }
   }
   /**
-   * Settle a message whose run-state has resolved `'done'` — extracted verbatim
-   * (pure refactor, no behavior change) from `serviceInFlightMessage`'s former
-   * inline `state === 'done'` branch body, so a SECOND caller (the #721
-   * b2-abandonment resolution) can reach the exact same completion behavior
-   * (delivery-deadline anchoring, title resolution, usage extraction, and
-   * `markDone`'s auth/terminal/transient-retry discipline) without duplicating it
-   * and risking the two copies silently drifting apart.
+   * Settle a message whose run-state has resolved `'done'`. Normal completion and
+   * confirmed b2 abandonment share the same delivery, usage, and terminal handling.
+   * Normal completions omit the optional terminal diagnostic.
    */
-  async settleMessageDone(sessionId, watcher, inFlight, messages) {
+  async settleMessageDone(sessionId, watcher, inFlight, messages, note) {
     const conv = watcher.conv;
     this.anchorDeliveryDeadline(inFlight);
     if (!inFlight.done) {
@@ -9905,7 +10638,8 @@ var ChannelDriver = class _ChannelDriver {
           title,
           usage,
           usageAgentName,
-          subagentInvocations
+          subagentInvocations,
+          note
         );
       } catch (err) {
         if (err instanceof ChannelAuthError) throw err;
@@ -9950,7 +10684,11 @@ var ChannelDriver = class _ChannelDriver {
   /** Report a confirmed b2 abandonment that produced no answer text. */
   async settleMessageAbandonedWithoutAnswer(sessionId, watcher, inFlight, messages, finish) {
     const conv = watcher.conv;
-    const error2 = `OpenCode ended this turn after a tool call (finish="${finish ?? "(unknown)"}") without writing an answer, and confirmed it is no longer working on this conversation. Evident is reporting the run as failed so the failure and its reason are visible in failed runs.`;
+    const error2 = composeAbandonmentNote(
+      finish,
+      describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+      "without-answer"
+    );
     this.anchorDeliveryDeadline(inFlight);
     this.log({
       level: "warn",
@@ -10077,7 +10815,7 @@ var ChannelDriver = class _ChannelDriver {
    */
   async settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight) {
     const conv = watcher.conv;
-    const error2 = "The runner session database could not be written, so this turn did not finish. Nothing was lost from the queue. Clear disk space and retry.";
+    const error2 = SESSION_STORE_UNWRITABLE_ERROR;
     this.log({
       level: "error",
       message: `Message ${inFlight.evidentMessageId.slice(0, 8)} was not resolved as done: ${error2}`,
@@ -11187,14 +11925,14 @@ var ChannelDriver = class _ChannelDriver {
     const fetchChildWithoutBlocking = async (sessionId) => {
       const pending = fetchChildMessages(sessionId);
       let timer;
-      const timeout = new Promise((resolve4) => {
+      const timeout = new Promise((resolve5) => {
         timer = setTimeout(() => {
           this.log({
             level: "warn",
             message: `Best-effort subagent session fetch for message ${messageId.slice(0, 8)} and child session ${sessionId.slice(0, 8)} was slow \u2014 omitting invocation telemetry without delaying completion`,
             message_id: messageId
           });
-          resolve4(null);
+          resolve5(null);
         }, SUBAGENT_TELEMETRY_FETCH_TIMEOUT_MS);
       });
       try {
@@ -11754,7 +12492,7 @@ var ChannelDriver = class _ChannelDriver {
    *                                    watcher retries next tick within the
    *                                    deadline, Finding 4).
    */
-  async markDone(conversationId, messageId, sessionId, opencodeMessageId, title, usage, usageAgentName, subagentInvocations) {
+  async markDone(conversationId, messageId, sessionId, opencodeMessageId, title, usage, usageAgentName, subagentInvocations, error2) {
     const res = await this.fetchImpl(
       `${this.apiUrl}/runners/${this.agentId}/threads/${conversationId}/messages/${messageId}`,
       {
@@ -11772,7 +12510,8 @@ var ChannelDriver = class _ChannelDriver {
           ...title ? { title } : {},
           ...usage ? usage : {},
           ...usageAgentName ? { usage_agent_name: usageAgentName } : {},
-          ...subagentInvocations && subagentInvocations.length > 0 ? { subagent_invocations: subagentInvocations } : {}
+          ...subagentInvocations && subagentInvocations.length > 0 ? { subagent_invocations: subagentInvocations } : {},
+          ...error2 ? { error: error2 } : {}
         })
       }
     );
@@ -11832,11 +12571,17 @@ var ChannelDriver = class _ChannelDriver {
     if (subagentInvocations && subagentInvocations.length > 0) {
       body.subagent_invocations = subagentInvocations;
     }
-    if (failure) {
-      body.failure_kind = failure.kind;
-      body.failure_provider_id = failure.providerId;
-      body.failure_model_id = failure.modelId;
-      body.failure_reason = failure.reason;
+    if (failure && failure.errorShape.name !== null) {
+      body.failure_error_name = failure.errorShape.name;
+    }
+    if (failure && failure.errorShape.statusCode !== null) {
+      body.failure_status_code = failure.errorShape.statusCode;
+    }
+    if (failure?.classification) {
+      body.failure_kind = failure.classification.kind;
+      body.failure_provider_id = failure.classification.providerId;
+      body.failure_model_id = failure.classification.modelId;
+      body.failure_reason = failure.classification.reason;
     }
     try {
       await this.callWithRetry(
@@ -11857,27 +12602,28 @@ var ChannelDriver = class _ChannelDriver {
     this.clearSubagentInvocationCaches(messageId);
   }
   /**
-   * Classify an errored turn as a model-auth failure (#736 P1-4), for `markFailed`.
+   * Classify an errored turn and extract its bounded error shape for `markFailed`.
    *
    * `messageFailure` alone (structured OpenCode error → `model_auth`) covers
    * most cases; when it returns `null` on this ALREADY-FAILED turn, fall back
    * to the P1-2b zero-provider check — one extra loopback call to
    * `hasAnyConfiguredProvider`, only reached when the structured classifier
    * couldn't place it. Fails open (never throws): a fallback probe failure
-   * (`null`/indeterminate) leaves the classification `null`, which produces
-   * today's byte-identical PATCH body via `markFailed`'s `if (failure)` guard.
+   * (`null`/indeterminate) leaves the classification `null`; the raw error shape
+   * is still retained for diagnostics.
    */
   async classifyModelAuthFailure(messages, userMessageId) {
-    const classified = messageFailure(messages, userMessageId);
-    if (classified != null) return classified;
     const reply = findLastAssistantReplyFor(messages, userMessageId);
-    const hasProvider = await this.hasAnyConfiguredProvider();
-    return applyZeroProviderFallback(
+    const errorShape = extractReplyErrorShape(reply);
+    const classified = messageFailure(messages, userMessageId);
+    if (classified != null) return { classification: classified, errorShape };
+    const classification = applyZeroProviderFallback(
       classified,
-      hasProvider,
+      await this.hasAnyConfiguredProvider(),
       reply?.info?.providerID ?? null,
       reply?.info?.modelID ?? null
     );
+    return { classification, errorShape };
   }
   async recordSubagentModelAuthFailure(failure, conversationId, messageId) {
     const providerId = failure.providerId ?? "(unknown)";
@@ -12435,7 +13181,7 @@ function commandError2(result) {
   return result.stderr.trim() || `process exited with code ${result.code ?? "null"}`;
 }
 var runCommand2 = (command, args, opts) => {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let child;
     let stdout = "";
     let stderr = "";
@@ -12445,7 +13191,7 @@ var runCommand2 = (command, args, opts) => {
       if (settled) return;
       settled = true;
       if (timer.handle) clearTimeout(timer.handle);
-      resolve4(result);
+      resolve5(result);
     };
     try {
       child = spawn5(command, args, { env: opts.env, stdio: ["ignore", "pipe", "pipe"] });
@@ -12500,7 +13246,9 @@ async function installRunnerSecret({
 }) {
   const arn = env.RUNNER_SECRET_ARN?.trim();
   if (!arn) {
-    log3("runner secret is not configured; continuing without GitHub and MCP credentials");
+    if (!env.GH_TOKEN) {
+      log3("runner secret is not configured; continuing without GitHub and MCP credentials");
+    }
     return false;
   }
   const result = await (commandRunner ?? runCommand2)(
@@ -12699,7 +13447,7 @@ async function configureGitHubAccess({ env, log: log3 }) {
 // src/lib/opencode/config-overlay.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { copyFileSync, existsSync as existsSync2, statSync as statSync6 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join10, resolve as resolve3 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join11, resolve as resolve4 } from "node:path";
 function isFile(filePath) {
   return existsSync2(filePath) && statSync6(filePath).isFile();
 }
@@ -12712,8 +13460,8 @@ function applyRunnerOpenCodeConfig({
     log3("runner OpenCode config is not configured; using the baked project config", "debug");
     return;
   }
-  const source = isAbsolute2(overlayPath) ? overlayPath : resolve3(cwd, overlayPath);
-  const target = isFile(join10(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
+  const source = isAbsolute3(overlayPath) ? overlayPath : resolve4(cwd, overlayPath);
+  const target = isFile(join11(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
   if (!isFile(source)) {
     log3(
       `RUNNER-OPENCODE-CONFIG-MISSING: ${source} is not a file; headless turns will wedge on the first external-directory permission prompt (#563)`,
@@ -12721,7 +13469,7 @@ function applyRunnerOpenCodeConfig({
     );
     return;
   }
-  copyFileSync(source, join10(cwd, target));
+  copyFileSync(source, join11(cwd, target));
   try {
     execFileSync2("git", ["-C", cwd, "update-index", "--skip-worktree", target], {
       stdio: "ignore"
@@ -12730,7 +13478,7 @@ function applyRunnerOpenCodeConfig({
     const detail = error2 instanceof Error ? error2.message : String(error2);
     log3(`could not mark ${target} skip-worktree: ${detail}; it may show as a local change`, "warn");
   }
-  log3(`Applied runner OpenCode config ${source} to ${join10(cwd, target)}`);
+  log3(`Applied runner OpenCode config ${source} to ${join11(cwd, target)}`);
 }
 
 // src/lib/credential-sync.ts
@@ -12748,14 +13496,14 @@ function errorMessage2(error2) {
   return error2 instanceof Error ? error2.message : String(error2);
 }
 function waitForSettlement(promise, timeoutMs) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let settled = false;
     const timer = setTimeout(() => finish(false), Math.max(0, timeoutMs));
     const finish = (value) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve4(value);
+      resolve5(value);
     };
     promise.then(
       () => finish(true),
@@ -13006,8 +13754,8 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join11(homeDir, trimmed.slice(2)) : trimmed;
-    if (!isAbsolute3(expanded)) {
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join12(homeDir, trimmed.slice(2)) : trimmed;
+    if (!isAbsolute4(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
     const normalized = resolvePath2(expanded);
@@ -13107,8 +13855,7 @@ function resolveMaxActiveSessions(options, env = process.env) {
 function meetsThreshold(state, level) {
   return LOG_LEVELS[level] >= LOG_LEVELS[state.logLevel];
 }
-function log2(state, message, level = "info") {
-  if (!meetsThreshold(state, level)) return;
+function writeConsoleLog(state, message, level) {
   if (state.json) {
     console.log(
       JSON.stringify({
@@ -13117,10 +13864,18 @@ function log2(state, message, level = "info") {
         message
       })
     );
-  } else if (!state.interactive) {
-    const prefix = level === "error" ? chalk7.red("\u2717") : level === "warn" ? chalk7.yellow("!") : level === "debug" ? chalk7.dim("\xB7") : chalk7.green("\u2022");
-    console.log(`${prefix} ${message}`);
+    return;
   }
+  const prefix = level === "error" ? chalk7.red("\u2717") : level === "warn" ? chalk7.yellow("!") : level === "debug" ? chalk7.dim("\xB7") : chalk7.green("\u2022");
+  console.log(`${prefix} ${message}`);
+}
+function log2(state, message, level = "info") {
+  if (!meetsThreshold(state, level)) return;
+  if (state.json || !state.interactive) writeConsoleLog(state, message, level);
+}
+function logLocalOnly(state, message, level = "info") {
+  if (!meetsThreshold(state, level)) return;
+  writeConsoleLog(state, message, level);
 }
 function logActivity(state, entry) {
   const level = entry.level ?? (entry.type === "error" ? "error" : "info");
@@ -13321,6 +14076,8 @@ async function driveChannels(state, driver) {
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
   let lastSeenClaudeApplies = driver.fileSyncActivity().claudeCredentialApplies;
   let lastSeenOpencodeAuthApplies = driver.fileSyncActivity().opencodeAuthApplyCount;
+  const stayAwakeHolds = () => state.stayAwakeUntilMs !== null && Date.now() < state.stayAwakeUntilMs;
+  let stayAwakeSuppressionLogged = false;
   while (state.running) {
     const cycleStartedAtMs = performance.now();
     let idleThisCycle = false;
@@ -13422,7 +14179,7 @@ async function driveChannels(state, driver) {
         }
       }
     }
-    await new Promise((resolve4) => setTimeout(resolve4, CHANNEL_POLL_INTERVAL_MS));
+    await new Promise((resolve5) => setTimeout(resolve5, CHANNEL_POLL_INTERVAL_MS));
     const cycleMs = performance.now() - cycleStartedAtMs;
     if (idleThisCycle) idleMs += cycleMs;
     if (unreachableThisCycle) unreachableMs += cycleMs;
@@ -13435,15 +14192,27 @@ async function driveChannels(state, driver) {
       if (state.interactive) displayStatus(state);
       break;
     }
-    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3) {
+    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3 && !stayAwakeHolds()) {
       logActivity(state, { type: "info", message: "Idle timeout reached" });
       if (state.interactive) displayStatus(state);
       break;
     }
+    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3 && stayAwakeHolds()) {
+      if (!stayAwakeSuppressionLogged) {
+        stayAwakeSuppressionLogged = true;
+        logActivity(state, {
+          type: "info",
+          message: "Idle, but staying awake until the requested minimum passes"
+        });
+      }
+    }
   }
 }
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
 var SESSION_CLEANUP_MAX_DELETES_PER_SWEEP = 100;
+var SESSION_CLEANUP_MAX_ISOLATED_DELETE_FAILURES = 2;
+var SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES = 2;
+var MAX_SESSION_DELETE_BODY_LENGTH = 200;
 function shouldWarnForReclaimSkip(reason) {
   if (reason !== "sqlite-unavailable" && reason !== "disk-exhaustion") return false;
   const version2 = /^v(\d+)\.(\d+)\.(\d+)$/.exec(process.version);
@@ -13454,7 +14223,7 @@ function shouldWarnForReclaimSkip(reason) {
   return major > 22 || major === 22 && (minor > 13 || minor === 13 && patch >= 0);
 }
 function sessionDbPath() {
-  return join11(homedir7(), ".local", "share", "opencode", "opencode.db");
+  return join12(homedir7(), ".local", "share", "opencode", "opencode.db");
 }
 function logSessionCleanupActivity(state, phase, entry) {
   logActivity(state, {
@@ -13531,8 +14300,12 @@ async function runSweep(state, driver, config) {
           protectedIds: protectedNow
         }
       );
-      const deleteCandidates = toDelete.slice(0, SESSION_CLEANUP_MAX_DELETES_PER_SWEEP);
-      remaining = toDelete.length - deleteCandidates.length;
+      const eligibleToDelete = toDelete.filter(
+        (id) => (state.sessionDeleteFailures.get(id)?.isolatedFailures ?? 0) < SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES
+      );
+      const deleteCandidates = eligibleToDelete.slice(0, SESSION_CLEANUP_MAX_DELETES_PER_SWEEP);
+      remaining = eligibleToDelete.length - deleteCandidates.length;
+      const answeredFailures = [];
       protectedNow = driver.protectedSessionIds();
       for (const id of deleteCandidates) {
         if (protectedNow.has(id)) {
@@ -13555,8 +14328,44 @@ async function runSweep(state, driver, config) {
           if (statusClass === 4) failed4xx++;
           else if (statusClass === 5) failed5xx++;
           else failedOtherStatus++;
+          answeredFailures.push({
+            id,
+            status: outcome.status,
+            ...outcome.body !== void 0 ? { body: outcome.body } : {}
+          });
         }
       }
+      const givenUpFailures = [];
+      if (failed > SESSION_CLEANUP_MAX_ISOLATED_DELETE_FAILURES) {
+        for (const { id } of answeredFailures) state.sessionDeleteFailures.delete(id);
+      } else {
+        for (const failure of answeredFailures) {
+          const previous = state.sessionDeleteFailures.get(failure.id);
+          const record = previous?.status === failure.status ? { status: failure.status, isolatedFailures: previous.isolatedFailures + 1 } : { status: failure.status, isolatedFailures: 1 };
+          state.sessionDeleteFailures.set(failure.id, record);
+          if (record.isolatedFailures >= SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES) {
+            givenUpFailures.push(failure);
+          }
+        }
+      }
+      for (const failure of givenUpFailures) {
+        const excerpt = redactDiagnosticText(failure.body ?? "(no response body)").slice(
+          0,
+          MAX_SESSION_DELETE_BODY_LENGTH
+        );
+        logSessionCleanupActivity(state, "sweep", {
+          type: "info",
+          level: "warn",
+          message: `Session cleanup: gave up on session ${failure.id} after ${SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES} isolated delete failures (status ${failure.status}): ${excerpt}`,
+          metadata: {
+            outcome: "session-delete-given-up",
+            session_id: failure.id,
+            status: failure.status,
+            body_excerpt: excerpt,
+            given_up_count: givenUpFailures.length
+          }
+        });
+      }
       const failedNote = failed > 0 ? `, failed ${failed}` : "";
       const skippedNote = skippedNewlyActive > 0 ? `, skipped ${skippedNewlyActive} newly-active` : "";
       const remainingNote = remaining > 0 ? `, remaining ${remaining}` : "";
@@ -13577,21 +14386,31 @@ async function runSweep(state, driver, config) {
       sessions_remaining: remaining,
       ...enumerationReason !== null ? { session_enumeration_reason: enumerationReason } : {}
     };
+    const protectedForReclaim = driver.protectedSessionIds();
     const reclaimResult = await reclaimSessionDbSpace({
       dbPath: sessionDbPath(),
       chunkPages: SESSION_DB_RECLAIM_CHUNK_PAGES,
       pageCeiling: SESSION_DB_RECLAIM_PAGE_CEILING,
       timeBudgetMs: SESSION_DB_RECLAIM_TIME_BUDGET_MS,
-      allowFullVacuum: protectedNow.size === 0 && !state.sessionDbProvenanceAnomaly
+      hasLiveTurn: protectedForReclaim.size > 0,
+      hasProvenanceAnomaly: state.sessionDbProvenanceAnomaly
     });
     if (reclaimResult.ok) {
       state.sessionStoreHealth.observeWritable();
       const beforeMib = (reclaimResult.beforeBytes / 1024 / 1024).toFixed(1);
       const afterMib = (reclaimResult.afterBytes / 1024 / 1024).toFixed(1);
       const checkpointNote = reclaimResult.checkpoint.busy ? ` (on-disk file truncation deferred: checkpoint busy, ${reclaimResult.checkpoint.log} WAL frames pending)` : "";
+      const loopElapsedMs = Math.max(
+        0,
+        reclaimResult.elapsedMs - reclaimResult.checkpointElapsedMs
+      );
+      const reclaimIsSlow = reclaimResult.elapsedMs >= 4 * SESSION_DB_RECLAIM_TIME_BUDGET_MS;
+      const perPageNote = reclaimResult.pagesReclaimed > 0 ? `, per-page ${(loopElapsedMs / reclaimResult.pagesReclaimed).toFixed(2)} ms/page` : "";
+      const slowReclaimNote = reclaimIsSlow ? ` (slow reclaim: total elapsed ${reclaimResult.elapsedMs} ms, checkpoint ${reclaimResult.checkpointElapsedMs} ms, loop ${loopElapsedMs} ms, budget ${SESSION_DB_RECLAIM_TIME_BUDGET_MS} ms${perPageNote})` : "";
       logSessionCleanupActivity(state, "sweep", {
         type: "info",
-        message: `Session cleanup: reclaimed session-db space (${reclaimResult.mode}): ${beforeMib} MiB -> ${afterMib} MiB (stopped by ${reclaimResult.stoppedBy}; freelist ${reclaimResult.freelistBefore} -> ${reclaimResult.freelistAfter} pages)` + checkpointNote,
+        level: reclaimIsSlow ? "warn" : "info",
+        message: `Session cleanup: reclaimed session-db space (${reclaimResult.mode}): ${beforeMib} MiB -> ${afterMib} MiB (stopped by ${reclaimResult.stoppedBy}; freelist ${reclaimResult.freelistBefore} -> ${reclaimResult.freelistAfter} pages)` + checkpointNote + slowReclaimNote,
         metadata: {
           outcome: "reclaimed",
           mode: reclaimResult.mode,
@@ -13604,6 +14423,7 @@ async function runSweep(state, driver, config) {
           freelist_after: reclaimResult.freelistAfter,
           pages_reclaimed: reclaimResult.pagesReclaimed,
           reclaim_elapsed_ms: reclaimResult.elapsedMs,
+          checkpoint_elapsed_ms: reclaimResult.checkpointElapsedMs,
           ...sessionMetadata
         }
       });
@@ -13714,10 +14534,12 @@ function scheduleUsageReporting(state, params) {
   let phase = "dormant";
   let rearmRequested = false;
   const armProbe = () => {
+    if (!state.running) return;
     phase = "probe-pending";
     params.setTimer(setTimeout(() => void tick(true), params.firstDelayMs()));
   };
   const scheduleNextTick = () => {
+    if (!state.running) return;
     if (rearmRequested) {
       rearmRequested = false;
       armProbe();
@@ -13751,6 +14573,7 @@ function scheduleUsageReporting(state, params) {
     phase = "tick-in-flight";
     try {
       const usage = await params.fetchUsage();
+      if (!state.running) return;
       const result = await params.report(usage);
       if (result.ok) {
         if (consecutiveFailures > 0) {
@@ -13889,6 +14712,7 @@ function scheduleResourceUsageReporting(state, options) {
           message: lowDiskDecision.warning
         });
       }
+      if (!state.running) return;
       const result = await reportResourceUsage(state.agentId, state.authHeader, usage);
       if (result.ok) {
         if (consecutiveFailures > 0) {
@@ -13921,7 +14745,9 @@ function scheduleResourceUsageReporting(state, options) {
         message: `Resource usage reporting failed: ${message}${failureStreakSuffix(consecutiveFailures)}`
       });
     } finally {
-      state.resourceUsageTimer = setTimeout(() => void tick(), usageReportDelayMs());
+      if (state.running) {
+        state.resourceUsageTimer = setTimeout(() => void tick(), usageReportDelayMs());
+      }
     }
   };
   state.resourceUsageTimer = setTimeout(() => void tick(), firstReportDelayMs());
@@ -14083,8 +14909,8 @@ async function beginGracefulShutdown(state, trigger) {
         return true;
       }
     );
-    const timedOut = new Promise((resolve4) => {
-      timer = setTimeout(() => resolve4(false), telemetryBudgetMs);
+    const timedOut = new Promise((resolve5) => {
+      timer = setTimeout(() => resolve5(false), telemetryBudgetMs);
     });
     if (!await Promise.race([flushed, timedOut])) {
       log2(state, `Telemetry flush exceeded ${telemetryBudgetMs}ms \u2014 exiting anyway`, "warn");
@@ -14124,6 +14950,8 @@ async function run(options) {
     port: options.port ?? 4096,
     conversationFilter: options.conversation ?? null,
     idleTimeout: options.idleTimeout ?? null,
+    stayAwakeSeconds: null,
+    stayAwakeUntilMs: null,
     json: options.json ?? false,
     interactive,
     logLevel,
@@ -14147,6 +14975,7 @@ async function run(options) {
     messageCount: 0,
     lastProxiedActivityAt: null,
     sessionCleanupTimers: [],
+    sessionDeleteFailures: /* @__PURE__ */ new Map(),
     claudeUsageTimer: null,
     claudeUsageRearm: null,
     openaiUsageTimer: null,
@@ -14312,6 +15141,17 @@ async function run(options) {
     }
     spinner?.succeed(`Runner: ${validation.agent.name || state.agentId}`);
     state.agentName = validation.agent.name;
+    const requestedStayAwakeSeconds = validation.agent?.wake_stay_awake_seconds;
+    if (typeof requestedStayAwakeSeconds === "number" && Number.isFinite(requestedStayAwakeSeconds) && requestedStayAwakeSeconds > 0) {
+      state.stayAwakeSeconds = requestedStayAwakeSeconds;
+    } else if (requestedStayAwakeSeconds !== void 0 && requestedStayAwakeSeconds !== null) {
+      state.stayAwakeSeconds = null;
+      log2(
+        state,
+        `Ignoring invalid wake_stay_awake_seconds (type: ${typeof requestedStayAwakeSeconds})`,
+        "warn"
+      );
+    }
     const microvmId = process.env.MICROVM_ID?.trim();
     if (microvmId) {
       const reported = await reportMicrovmId(state.agentId, state.authHeader, microvmId);
@@ -14327,29 +15167,73 @@ async function run(options) {
     } else {
       log2(state, "Not running in a MicroVM (MICROVM_ID unset) \u2014 nothing to report", "debug");
     }
-    if (options.restoreRunnerCredentials) {
-      log2(state, "Restoring runner credentials before starting OpenCode");
-      const credentialContext = {
-        env: process.env,
-        log: (message, level = "info") => {
-          if (level === "error") {
-            logActivity(state, { type: "error", error: message });
-          } else {
-            logActivity(state, { type: "info", level, message });
-          }
+    if (options.restoreRunnerCredentials || options.credentialSyncMarker) {
+      const logCredentialVaultResolution = (message, level) => {
+        log2(state, message, level);
+        if (state.interactive && !state.json) {
+          logActivity(state, { type: "info", level, message });
         }
       };
-      const githubTokenPopulated = await installRunnerSecret(credentialContext);
+      const vaultResolution = await getRunnerCredentialVault(state.agentId, state.authHeader);
+      if (vaultResolution.error) {
+        delete process.env.CREDENTIAL_VAULT_PREFIX;
+        logCredentialVaultResolution(
+          `CREDENTIAL-VAULT-LOOKUP-FAILED: ${vaultResolution.error}; credentials will be read from and written to this runner's own prefix this boot`,
+          "warn"
+        );
+      } else if (vaultResolution.prefix !== null && vaultResolution.vaultId !== null && vaultResolution.source !== null) {
+        process.env.CREDENTIAL_VAULT_PREFIX = vaultResolution.prefix;
+        logCredentialVaultResolution(
+          `CREDENTIAL-VAULT: source=${vaultResolution.source} vault=${vaultResolution.vaultId} prefix=${vaultResolution.prefix}`,
+          "info"
+        );
+      } else {
+        delete process.env.CREDENTIAL_VAULT_PREFIX;
+        logCredentialVaultResolution(
+          "CREDENTIAL-VAULT-NONE: this runner is not linked to a credential vault; using its own prefix",
+          "debug"
+        );
+      }
+    }
+    const credentialContext = {
+      env: process.env,
+      log: (message, level = "info") => {
+        if (level === "error") {
+          logActivity(state, { type: "error", error: message });
+        } else {
+          logActivity(state, { type: "info", level, message });
+        }
+      }
+    };
+    const githubTokenPopulated = await installRunnerSecret(credentialContext);
+    if (options.restoreRunnerCredentials) {
       await restoreCredentialStores(credentialContext);
-      if (githubTokenPopulated) await configureGitHubAccess(credentialContext);
     }
+    if (githubTokenPopulated) await configureGitHubAccess(credentialContext);
     state.credentialSync?.arm();
+    const dependencyInstallDiagnosticReporter = createDependencyInstallDiagnosticReporter({
+      context: {
+        homeDir: homedir7(),
+        cwd: process.cwd(),
+        microvmId: process.env.MICROVM_ID?.trim(),
+        euid: process.getuid?.(),
+        egid: process.getgid?.()
+      },
+      emitEvent: (message) => logActivity(state, { type: "info", level: "warn", message }),
+      emitLocal: (message) => logLocalOnly(state, message, "warn")
+    });
     const openCodeActivityForwarder = createOpenCodeActivityForwarder(
       () => ({
         agentId: state.agentId,
         authHeader: state.authHeader
       }),
-      state.sessionStoreHealth.observeUnwritable
+      ({ isDiskFailure, sessionId, cause }) => {
+        if (isDiskFailure) state.sessionStoreHealth.observeUnwritable();
+        if (cause !== null && sessionId !== null) {
+          state.sessionStoreHealth.observeCause(sessionId, cause);
+        }
+      },
+      dependencyInstallDiagnosticReporter
     );
     const openCodeLogTail = tailOpenCodeLogFile(
       resolveOpenCodeLogPath(homedir7(), process.env),
@@ -14360,22 +15244,27 @@ async function run(options) {
       openCodeLogTail.stop();
     };
     let sessionDbVerifyFatal = false;
+    let sessionDbVerifyFatalReason;
     if (!options.restoreSessionDb) {
-      log2(state, "Skipping session-DB restore: --restore-session-db was not passed", "debug");
+      logActivity(state, {
+        type: "info",
+        level: "warn",
+        message: "SESSION-DB-VERIFY-SKIPPED: reason=flag-absent \u2014 Skipping session-DB restore: --restore-session-db was not passed"
+      });
     } else {
       const health = await checkOpenCodeHealth(state.port);
       if (health.healthy) {
-        log2(
-          state,
-          "Skipping session-DB restore: OpenCode is already serving this database",
-          "debug"
-        );
+        logActivity(state, {
+          type: "info",
+          level: "warn",
+          message: "SESSION-DB-VERIFY-SKIPPED: reason=opencode-serving \u2014 Skipping session-DB restore: OpenCode is already serving this database"
+        });
       } else if (health.authFailed) {
-        log2(
-          state,
-          "Skipping session-DB restore: OpenCode answered with an authentication challenge; assuming this database is in use",
-          "debug"
-        );
+        logActivity(state, {
+          type: "info",
+          level: "warn",
+          message: "SESSION-DB-VERIFY-SKIPPED: reason=opencode-auth-challenge \u2014 Skipping session-DB restore: OpenCode answered with an authentication challenge; assuming this database is in use"
+        });
       } else {
         const result = await restoreAndVerifySessionDb({
           dbPath: sessionDbPath(),
@@ -14392,12 +15281,13 @@ async function run(options) {
           reportRecovery: (record) => reportSessionDbRecoveryRecord(state, record)
         });
         sessionDbVerifyFatal = result.verifyFatal;
+        sessionDbVerifyFatalReason = result.verifyFatalReason;
       }
     }
     reportSessionDbRecovery(state);
     if (sessionDbVerifyFatal) {
       throw new Error(
-        "SESSION-DB-INTEGRITY-EXHAUSTED: the corrupt session DB could not be proven separated from the active backup prefix or removed from disk"
+        sessionDbVerifyFatalReason === void 0 ? "SESSION-DB-INTEGRITY-EXHAUSTED: the corrupt session DB could not be proven separated from the active backup prefix or removed from disk" : `SESSION-DB-VERIFY-TIMEOUT: session DB verification timed out (${sessionDbVerifyFatalReason}); refusing to start`
       );
     }
     applyRunnerOpenCodeConfig({
@@ -14676,6 +15566,13 @@ async function run(options) {
             type: "info",
             message: connectionMessage
           });
+          if (!isReconnect && state.stayAwakeSeconds !== null && state.stayAwakeUntilMs === null) {
+            state.stayAwakeUntilMs = Date.now() + state.stayAwakeSeconds * 1e3;
+            logActivity(state, {
+              type: "info",
+              message: `Staying awake for at least ${state.stayAwakeSeconds}s as requested by the wake`
+            });
+          }
           if (options.tunnelReadyFile) {
             const marker = writeTunnelReadyMarker(options.tunnelReadyFile, agentId);
             if (marker.ok) {
@@ -14724,14 +15621,14 @@ async function run(options) {
         },
         onDisconnected: (code, reason, transition) => {
           state.connected = false;
-          const safeReason = redactDiagnosticText(reason).slice(0, MAX_DISCONNECT_REASON_LENGTH);
+          const safeReason2 = redactDiagnosticText(reason).slice(0, MAX_DISCONNECT_REASON_LENGTH);
           logActivity(state, {
             type: "info",
-            message: `Tunnel disconnected (generation: ${transition.generation}, code: ${code}, reason: ${safeReason})`
+            message: `Tunnel disconnected (generation: ${transition.generation}, code: ${code}, reason: ${safeReason2})`
           });
           emitAgentDisconnected(state.agentId, {
             code,
-            reason: safeReason,
+            reason: safeReason2,
             connection_generation: transition.generation
           });
           if (state.interactive) displayStatus(state);
@@ -14810,6 +15707,7 @@ async function run(options) {
       if (error2.message === "Unauthorized") tunnelSpinner?.fail("Unauthorized");
       throw error2;
     }
+    if (!state.running) return;
     scheduleSessionCleanup(state, channelDriver, options);
     state.claudeUsageRearm = scheduleClaudeUsageReporting(state, options);
     state.openaiUsageRearm = scheduleUsageReporting(state, {
@@ -14894,6 +15792,7 @@ program.command("login").description("Authenticate with Evident").option("--toke
 program.command("logout").description("Remove stored credentials for the current endpoint").option("--all", "Remove stored credentials for all endpoints").action((options) => logout({ all: options.all }));
 program.command("whoami").description("Show the currently logged in user").action(whoami);
 program.command("status").description("Check whether the configured credentials can reach Evident").option("--json", "Output in JSON format").action((options) => status({ json: options.json }));
+program.command("credential-vault-env").description("Print the shell assignment a runner image evals before starting the synchroniser").action(credentialVaultEnv);
 program.command("claude-usage").description("[spike] Show Claude subscription usage (requires a local `claude login`)").action(claudeUsage);
 program.command("run").description("Connect to Evident and process messages").option("--runner [id]", "Runner ID to connect to (optional when EVIDENT_RUNNER_KEY is set)").option(
   "-a, --agent [id]",