@evident-ai/cli 3.5.2-dev.ffa823b → 3.6.1-dev.1a9c5e7

package/dist/index.js

@@ -100,6 +100,26 @@ function clearCredentials() {
   credentials.set("byEndpoint", byEndpoint);
   hardenCredentialsPermissions();
 }
+function getManagedInferenceCredential(runnerId) {
+  hardenCredentialsPermissions();
+  return credentials.get("managedInferenceByEndpoint")?.[credentialsKey()]?.[runnerId];
+}
+function setManagedInferenceCredential(runnerId, credential) {
+  const byEndpoint = credentials.get("managedInferenceByEndpoint") ?? {};
+  byEndpoint[credentialsKey()] ??= {};
+  byEndpoint[credentialsKey()][runnerId] = credential;
+  credentials.set("managedInferenceByEndpoint", byEndpoint);
+  hardenCredentialsPermissions();
+}
+function clearManagedInferenceCredential(runnerId) {
+  const byEndpoint = credentials.get("managedInferenceByEndpoint") ?? {};
+  const runners = byEndpoint[credentialsKey()];
+  if (!runners || !(runnerId in runners)) return;
+  delete runners[runnerId];
+  if (Object.keys(runners).length === 0) delete byEndpoint[credentialsKey()];
+  credentials.set("managedInferenceByEndpoint", byEndpoint);
+  hardenCredentialsPermissions();
+}
 function clearAllCredentials() {
   credentials.clear();
   hardenCredentialsPermissions();
@@ -119,13 +139,13 @@ function getCliName() {
 // src/lib/api.ts
 async function request(path, method, body, headers = {}) {
   const url = `${getApiUrlConfig()}${path}`;
-  const requestHeaders = {
+  const requestHeaders2 = {
     "Content-Type": "application/json",
     ...headers
   };
   const response = await fetch(url, {
     method,
-    headers: requestHeaders,
+    headers: requestHeaders2,
     body: body ? JSON.stringify(body) : void 0
   });
   if (!response.ok) {
@@ -1156,9 +1176,9 @@ async function claudeUsage() {
 }
 
 // src/commands/run.ts
-import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { isAbsolute as isAbsolute4, join as join12, parse, resolve as resolvePath2 } from "node:path";
+import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { isAbsolute as isAbsolute4, join as join13, parse, resolve as resolvePath2 } from "node:path";
 import chalk7 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
@@ -1287,13 +1307,113 @@ var TUNNEL_USAGE_REARM_PING_PATH = "/__evident/usage-rearm";
 var MAX_FILE_PUSH_BYTES = 64 * 1024;
 var MAX_FILE_SYNC_DIRECTORIES = 16;
 
+// ../../packages/types/src/credential-proxy-native-config.ts
+var EVIDENT_PROXY_TOKEN_REFERENCE = "{env:EVIDENT_PROXY_TOKEN}";
+var CLAUDE_PROVIDER = {
+  namespace: "evident-claude",
+  name: "Evident Claude credential proxy",
+  npm: "@ai-sdk/anthropic"
+};
+var NATIVE_PROVIDERS = {
+  claude: CLAUDE_PROVIDER,
+  anthropic: CLAUDE_PROVIDER,
+  codex: {
+    namespace: "evident-codex",
+    name: "Evident Codex credential proxy",
+    npm: "@ai-sdk/openai"
+  },
+  openai: {
+    namespace: "evident-openai",
+    name: "Evident OpenAI credential proxy",
+    npm: "@ai-sdk/openai"
+  },
+  kimi: {
+    namespace: "evident-kimi",
+    name: "Evident Kimi credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-kimi"
+  },
+  antigravity: {
+    namespace: "evident-antigravity",
+    name: "Evident Antigravity credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-antigravity"
+  },
+  xai: {
+    namespace: "evident-xai",
+    name: "Evident xAI credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-xai"
+  },
+  mistral: {
+    namespace: "evident-mistral",
+    name: "Evident Mistral credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-mistral"
+  }
+};
+var CREDENTIAL_PROXY_NATIVE_NAMESPACES = [
+  ...new Set(Object.values(NATIVE_PROVIDERS).map(({ namespace }) => namespace))
+];
+function credentialProxyInferenceUrl(baseUrl) {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  return /\/v1$/i.test(trimmed) ? trimmed : `${trimmed}/v1`;
+}
+function buildCredentialProxyNativeConfig({
+  inferenceBaseUrl,
+  modelDescriptors
+}) {
+  const baseURL = credentialProxyInferenceUrl(inferenceBaseUrl);
+  const providers = {};
+  const unsupportedProviders = /* @__PURE__ */ new Set();
+  for (const descriptor of modelDescriptors) {
+    const definition = NATIVE_PROVIDERS[descriptor.provider.trim().toLowerCase()];
+    if (!definition) {
+      unsupportedProviders.add(descriptor.provider.trim() || descriptor.provider);
+      continue;
+    }
+    providers[definition.namespace] ??= definition.npm === "@ai-sdk/anthropic" ? {
+      name: definition.name,
+      npm: definition.npm,
+      options: { baseURL, authToken: EVIDENT_PROXY_TOKEN_REFERENCE },
+      models: {}
+    } : definition.npm === "@ai-sdk/openai" ? {
+      name: definition.name,
+      npm: definition.npm,
+      options: { baseURL, apiKey: EVIDENT_PROXY_TOKEN_REFERENCE },
+      models: {}
+    } : {
+      name: definition.name,
+      npm: definition.npm,
+      options: {
+        name: definition.sdkName,
+        baseURL,
+        apiKey: EVIDENT_PROXY_TOKEN_REFERENCE
+      },
+      models: {}
+    };
+    providers[definition.namespace].models[descriptor.id] = { name: descriptor.id };
+  }
+  return {
+    unsupportedProviders: [...unsupportedProviders],
+    config: {
+      $schema: "https://opencode.ai/config.json",
+      provider: providers
+    }
+  };
+}
+
 // ../../packages/types/src/logging/index.ts
 var CORRELATION_ID_HEADER = "x-evident-correlation-id";
 var FORWARD_FAILURE_REASON_HEADER = "X-Evident-Failure-Reason";
 function log(level, event, fields) {
   const method = level === "debug" ? "log" : level;
   try {
-    console[method]("[evident]", JSON.stringify({ level, event, ...fields }));
+    const payload = Object.fromEntries(
+      Object.entries({ level, event, ...fields }).filter(([, value]) => value !== void 0)
+    );
+    const secondArgument = globalThis.navigator?.userAgent === "Cloudflare-Workers" ? payload : JSON.stringify(payload);
+    console[method]("[evident]", secondArgument);
   } catch (err) {
     console.error(
       "[evident] log_serialize_failed",
@@ -1322,7 +1442,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.5.2-dev.ffa823b" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.6.1-dev.1a9c5e7" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -1403,7 +1523,7 @@ async function flushEvents() {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), FLUSH_TIMEOUT_MS);
     try {
-      const request2 = {
+      const request3 = {
         events,
         client_type: "cli",
         client_version: CLI_VERSION
@@ -1414,7 +1534,7 @@ async function flushEvents() {
           "Content-Type": "application/json",
           Authorization: authHeader
         },
-        body: JSON.stringify(request2),
+        body: JSON.stringify(request3),
         signal: controller.signal
       });
       if (!response.ok) {
@@ -2071,7 +2191,8 @@ function createDependencyInstallDiagnosticReporter({
 var FORWARDED_LEVELS_BY_SOURCE = {
   "cli.run": /* @__PURE__ */ new Set(["warn", "error"]),
   opencode: /* @__PURE__ */ new Set(["warn", "error"]),
-  "cli.session-cleanup": /* @__PURE__ */ new Set(["info", "warn", "error"])
+  "cli.session-cleanup": /* @__PURE__ */ new Set(["info", "warn", "error"]),
+  "cli.runtime-provenance": /* @__PURE__ */ new Set(["info", "warn", "error"])
 };
 var SEVERITY_BY_LEVEL = {
   info: "info",
@@ -2867,6 +2988,58 @@ async function listAllSessions(port, client) {
   }
   return { sessions };
 }
+var INTERRUPT_NETWORK_CODES = /* @__PURE__ */ new Set([
+  "ABORT_ERR",
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ENETUNREACH",
+  "ENOTFOUND",
+  "ETIMEDOUT",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_SOCKET"
+]);
+function interruptFailureDiagnostic(error2) {
+  const message = error2 instanceof Error ? error2.message : "";
+  const httpStatus = /^OpenCode request failed: HTTP ([1-5]\d{2})(?::|$)/.exec(message)?.[1];
+  if (httpStatus) return `HTTP ${httpStatus}`;
+  const candidates = [error2, error2 instanceof Error ? error2.cause : void 0];
+  for (const candidate of candidates) {
+    if (typeof candidate !== "object" || candidate === null || !("code" in candidate)) continue;
+    const code = candidate.code;
+    if (typeof code === "string" && INTERRUPT_NETWORK_CODES.has(code)) {
+      return redactDiagnosticText(`network ${code}`).slice(0, 120);
+    }
+  }
+  const name = error2 instanceof Error && ["AbortError", "Error", "TimeoutError", "TypeError"].includes(error2.name) ? error2.name : "unknown error";
+  return redactDiagnosticText(`request threw ${name}`).slice(0, 120);
+}
+async function interruptSession(port, id, client) {
+  if (client?.version === "v2") {
+    try {
+      await interruptV2Session(client, id);
+      return { kind: "confirmed_stopped" };
+    } catch (error2) {
+      return { kind: "not_confirmed", diagnostic: interruptFailureDiagnostic(error2) };
+    }
+  }
+  try {
+    const res = await requestWithClient(
+      port,
+      client,
+      `/session/${id}/abort`,
+      { method: "POST" },
+      { allowStatuses: ALL_HTTP_STATUSES }
+    );
+    if (res.status >= 200 && res.status < 300) {
+      return { kind: "confirmed_stopped", status: res.status };
+    }
+    return { kind: "not_confirmed", status: res.status };
+  } catch (error2) {
+    return { kind: "threw", diagnostic: interruptFailureDiagnostic(error2) };
+  }
+}
 async function deleteSession(port, id, client) {
   if (client?.version === "v2") return deleteV2Session(client, id);
   try {
@@ -3036,6 +3209,52 @@ async function getModelAttachmentCapability(port, model, client) {
     return null;
   }
 }
+async function isPinnedProviderLoaded(port, model, client) {
+  if (client?.version === "v2") return null;
+  const { model: baseModel } = splitModelVariant(model);
+  if (!baseModel) return null;
+  const slash = baseModel.indexOf("/");
+  if (slash <= 0) return null;
+  const providerId = baseModel.slice(0, slash);
+  try {
+    const res = await requestWithClient(port, client, "/config/providers");
+    if (!res.ok) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers returned HTTP ${res.status} (port ${port})`
+      );
+      return null;
+    }
+    const body = await res.json();
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers body was not a plain object (port ${port})`
+      );
+      return null;
+    }
+    const providers = body.providers;
+    if (!Array.isArray(providers)) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers body had no providers array (port ${port})`
+      );
+      return null;
+    }
+    const providerIds = providers.filter(
+      (provider) => provider !== null && typeof provider === "object" && typeof provider.id === "string"
+    ).map((provider) => provider.id);
+    if (providerIds.length === 0) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers had no provider entries with string ids (port ${port})`
+      );
+      return null;
+    }
+    return providerIds.includes(providerId);
+  } catch (err) {
+    console.error(
+      `[isPinnedProviderLoaded] GET /config/providers failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+    );
+    return null;
+  }
+}
 async function buildFileParts(attachments, capable) {
   const outcomes = [];
   const parts = [];
@@ -3518,19 +3737,32 @@ function isAbortedTerminalReply(messages, userMessageId) {
   }
   return false;
 }
+var CLAUDE_AUTH_EXPIRY_MESSAGES = Object.freeze([
+  "Claude Code credentials are unavailable or expired. Run `claude` to refresh them."
+]);
+function extractReplyErrorShape(reply) {
+  const error2 = errorOf(reply);
+  if (error2 == null || typeof error2 !== "object") {
+    return { name: null, statusCode: null };
+  }
+  const e = error2;
+  const name = typeof e.name === "string" ? e.name.slice(0, 100) : null;
+  const data = e.data;
+  const statusCode = typeof data?.statusCode === "number" && Number.isFinite(data.statusCode) ? data.statusCode : null;
+  return { name, statusCode };
+}
 function classifyReplyAuthError(reply) {
   const error2 = errorOf(reply);
   if (error2 == null || typeof error2 !== "object") return null;
   const e = error2;
   const replyProviderId = reply?.info?.providerID ?? null;
   const replyModelId = reply?.info?.modelID ?? null;
+  const data = e.data;
   if (e.name === "ProviderAuthError") {
-    const data = e.data;
     const providerId = typeof data?.providerID === "string" && data.providerID || replyProviderId;
     return { kind: "model_auth", providerId, modelId: replyModelId, reason: "missing" };
   }
   if (e.name === "APIError") {
-    const data = e.data;
     const statusCode = data?.statusCode;
     if (statusCode === 401 || statusCode === 403) {
       return {
@@ -3541,11 +3773,23 @@ function classifyReplyAuthError(reply) {
       };
     }
   }
+  const errorMessage3 = typeof data?.message === "string" ? data.message : typeof e.message === "string" ? e.message : null;
+  if (errorMessage3 !== null && CLAUDE_AUTH_EXPIRY_MESSAGES.some((knownMessage) => errorMessage3.includes(knownMessage))) {
+    return {
+      kind: "model_auth",
+      providerId: typeof data?.providerID === "string" && data.providerID || replyProviderId,
+      modelId: replyModelId,
+      reason: "rejected"
+    };
+  }
   return null;
 }
 function messageFailure(messages, userMessageId) {
   return classifyReplyAuthError(findLastAssistantReplyFor(messages, userMessageId));
 }
+function isProviderModelNotFoundError(reason) {
+  return reason.includes("Model not found:");
+}
 function findLatestSubagentAuthOutcome(messages, sinceMs) {
   if (!messages || messages.length === 0) return null;
   for (let i = messages.length - 1; i >= 0; i--) {
@@ -3754,23 +3998,49 @@ async function readSessionErrorStream(port, options, client) {
     if (reader) void reader.cancel().catch(() => void 0);
   }
 }
-async function reloadProviderCache(port, client) {
-  if (client?.version === "v2") return;
+async function disposeAndReloadProviderConfig(port, client) {
+  if (client?.version === "v2") return { outcome: "skipped_v2" };
   try {
-    const res = await requestWithClient(port, client, "/config", {
-      method: "PATCH",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({})
-    });
+    const res = await requestWithClient(
+      port,
+      client,
+      "/config",
+      {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({})
+      },
+      { allowStatuses: ALL_HTTP_STATUSES }
+    );
     if (!res.ok) {
       console.error(
-        `[reloadProviderCache] PATCH /config returned HTTP ${res.status} (port ${port})`
+        `[disposeAndReloadProviderConfig] PATCH /config returned HTTP ${res.status} (port ${port})`
       );
+      return { outcome: "failed", status: res.status, detail: null };
     }
+    return { outcome: "reloaded" };
   } catch (err) {
     console.error(
-      `[reloadProviderCache] PATCH /config failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+      `[disposeAndReloadProviderConfig] PATCH /config failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
     );
+    return {
+      outcome: "failed",
+      status: null,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function probeOpenCodeRequestReadiness(port, client) {
+  try {
+    const res = await requestWithClient(port, client, "/config", void 0, {
+      allowStatuses: ALL_HTTP_STATUSES
+    });
+    const body = await res.text();
+    return { ok: res.ok, status: res.status, bodyEmpty: body.trim().length === 0, detail: null };
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    console.error(`[probeOpenCodeRequestReadiness] GET /config failed (port ${port}): ${detail}`);
+    return { ok: false, status: null, bodyEmpty: null, detail };
   }
 }
 
@@ -4166,6 +4436,11 @@ async function listV2Permissions(client, sessionId) {
     return null;
   }
 }
+async function interruptV2Session(client, sessionId) {
+  await client.request(`/api/session/${encodeURIComponent(sessionId)}/interrupt`, {
+    method: "POST"
+  });
+}
 async function getV2ActiveSessions(client) {
   try {
     const body = await readJson(await client.request("/api/session/active"));
@@ -4568,11 +4843,11 @@ function failureMessage(status2) {
 function isRetryableStatus(status2) {
   return CONNECT_KEY_RETRY_STATUSES.includes(status2);
 }
-async function importOneCredential(request2, credential, sleepForRetry, log3) {
+async function importOneCredential(request3, credential, sleepForRetry, log3) {
   const path = `/api/integration/${encodeURIComponent(credential.integrationId)}/connect/key`;
   for (let attempt = 1; attempt <= CONNECT_KEY_MAX_ATTEMPTS; attempt += 1) {
     try {
-      const response = await request2(
+      const response = await request3(
         path,
         {
           method: "POST",
@@ -4607,7 +4882,7 @@ async function importOneCredential(request2, credential, sleepForRetry, log3) {
   throw new Error("OpenCode credential import retry loop did not return");
 }
 async function importOpenCodeCredentials({
-  request: request2,
+  request: request3,
   classified,
   connectedIntegrationIds,
   sleepForRetry = sleep2,
@@ -4619,7 +4894,7 @@ async function importOpenCodeCredentials({
       result.alreadyConnected.push(credential.integrationId);
       continue;
     }
-    const outcome = await importOneCredential(request2, credential, sleepForRetry, log3);
+    const outcome = await importOneCredential(request3, credential, sleepForRetry, log3);
     if (outcome.ok) result.imported.push(credential.integrationId);
     else result.failed.push(outcome.failure);
   }
@@ -4637,7 +4912,7 @@ function parseIntegrationList(value) {
   return { integrationIds, hasData: value.data.length > 0 };
 }
 async function getConnectedOpenCodeIntegrationIds({
-  request: request2,
+  request: request3,
   directory,
   sleepForRetry = sleep2,
   log: log3
@@ -4645,7 +4920,7 @@ async function getConnectedOpenCodeIntegrationIds({
   const path = `/api/integration?location%5Bdirectory%5D=${encodeURIComponent(directory)}`;
   for (let attempt = 1; attempt <= INTEGRATION_LIST_MAX_READS; attempt += 1) {
     try {
-      const response = await request2(path);
+      const response = await request3(path);
       const parsed = parseIntegrationList(await response.json());
       if (parsed === null) {
         log3(
@@ -4674,7 +4949,7 @@ async function getConnectedOpenCodeIntegrationIds({
   return null;
 }
 async function importOpenCodeV2Credentials({
-  request: request2,
+  request: request3,
   homeDir,
   directory,
   sleepForRetry = sleep2,
@@ -4692,7 +4967,7 @@ async function importOpenCodeV2Credentials({
     const classified = classifyOpenCodeCredentials(credentials2);
     if (classified.importable.length === 0) return emptyResult(classified.unsupported);
     const connectedIntegrationIds = await getConnectedOpenCodeIntegrationIds({
-      request: request2,
+      request: request3,
       directory,
       sleepForRetry,
       log: log3
@@ -4701,7 +4976,7 @@ async function importOpenCodeV2Credentials({
       return emptyResult(classified.unsupported, "connection-list-unavailable");
     }
     return importOpenCodeCredentials({
-      request: request2,
+      request: request3,
       classified,
       connectedIntegrationIds,
       sleepForRetry,
@@ -5392,7 +5667,11 @@ function isSessionDbProvenanceRecord(value) {
 var OPENCODE2_PACKAGE_SPEC = "@opencode-ai/cli@0.0.0-beta-17823";
 
 // src/lib/opencode/opencode-version-gate.ts
-var QUEUE_VALIDATED_OPENCODE_VERSIONS = ["1.17.11", "1.18.3"];
+var QUEUE_VALIDATED_OPENCODE_VERSIONS = [
+  "1.17.11",
+  "1.18.3",
+  "1.18.35"
+];
 function isQueueValidatedVersion(version2) {
   if (!version2) return false;
   return QUEUE_VALIDATED_OPENCODE_VERSIONS.includes(version2);
@@ -6437,6 +6716,7 @@ function connectTunnel(options) {
     }, 3e4);
     let relaySilenceTimeout;
     let relaySilenceTimedOut = false;
+    let relayConnectionId;
     const clearRelaySilenceTimeout = () => {
       if (relaySilenceTimeout === void 0) return;
       clearTimeout(relaySilenceTimeout);
@@ -6522,7 +6802,8 @@ function connectTunnel(options) {
           armRelaySilenceTimeout();
           forwarder.setBinaryFramesSupported(message.binary_frames === true);
           const connectedAgentId = message.agent_id ?? agentId;
-          onConnected?.(connectedAgentId);
+          relayConnectionId = message.connection_id;
+          onConnected?.(connectedAgentId, relayConnectionId);
           resolve5({
             ws,
             close: () => ws.close(1e3, "CLI shutdown")
@@ -6559,7 +6840,7 @@ function connectTunnel(options) {
       clearRelaySilenceTimeout();
       const reasonStr = (relaySilenceTimedOut ? "no relay heartbeat for 90s \u2014 reconnecting" : void 0) || reason.toString() || upgradeRejection || (code === 1006 ? "abnormal closure" : "No reason provided");
       forwarder.abortAll();
-      onDisconnected?.(code, reasonStr);
+      onDisconnected?.(code, reasonStr, relayConnectionId);
     });
   });
 }
@@ -6622,7 +6903,7 @@ var RunnerConnection = class _RunnerConnection {
           authHeader: this.opts.getAuthHeader(),
           port: this.opts.port,
           openCodePassword: this.opts.openCodePassword,
-          onConnected: (agentId) => {
+          onConnected: (agentId, relayConnectionId) => {
             const attempt = this.reconnectAttempt + 1;
             this.reconnectAttempt = 0;
             this.reconnecting = false;
@@ -6632,13 +6913,17 @@ var RunnerConnection = class _RunnerConnection {
             this.disconnectedAtMs = null;
             events.onConnected(agentId, isReconnect, {
               generation: this.generation,
+              relayConnectionId: relayConnectionId ?? null,
               attempt,
               downtimeMs
             });
           },
-          onDisconnected: (code, reason) => {
+          onDisconnected: (code, reason, relayConnectionId) => {
             this.disconnectedAtMs = this.now();
-            events.onDisconnected(code, reason, { generation: this.generation });
+            events.onDisconnected(code, reason, {
+              generation: this.generation,
+              relayConnectionId: relayConnectionId ?? null
+            });
             const relayRequestedReconnect = code === 1e3 && _RunnerConnection.RELAY_RECONNECT_CLOSE_REASONS.has(reason);
             if (this.opts.isRunning() && (code !== 1e3 || relayRequestedReconnect) && !this.reconnecting) {
               this.reconnectPromise = this.connectWithRetry(true).catch((err) => {
@@ -7086,8 +7371,8 @@ import { chmod, mkdir, open as open3, realpath, rename, unlink } from "node:fs/p
 import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join9, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
-async function writePushedFile(request2) {
-  const { requestedPath, content, allowedDirectories, homeDir } = request2;
+async function writePushedFile(request3) {
+  const { requestedPath, content, allowedDirectories, homeDir } = request3;
   const bytes = content.byteLength;
   if (allowedDirectories.length === 0) {
     return refuse("file_sync_disabled", "File sync is not enabled on this runner.", {
@@ -7537,7 +7822,7 @@ var SESSION_ERROR_BUFFER_TTL_MS = SESSION_ERROR_STREAM_HEALTHY_MS;
 var MAX_BUFFERED_SESSION_ERRORS = 256;
 var SESSION_ERROR_RETENTION_TTL_MS = 6e4;
 var SESSION_STORE_UNWRITABLE_ERROR = "The runner session database could not be written, so this turn did not finish. Nothing was lost from the queue. Clear disk space and retry.";
-var SESSION_ERROR_RETAINED_DETAIL = "The runner's session database could not be written, so this turn stopped part-way. Runner-observed session error: ";
+var SESSION_ERROR_RETAINED_DETAIL = "Runner-observed OpenCode session error: ";
 var SESSION_ERROR_OBSERVED_CAUSE = "Runner-observed OpenCode session-store cause: ";
 var DEFAULT_PAUSED_POLL_INTERVAL_MS = 2e3;
 var DEFAULT_PAUSED_MAX_WAIT_MS = 10 * 60 * 1e3;
@@ -7661,12 +7946,15 @@ var ChannelDriver = class _ChannelDriver {
   /**
    * Per-conversation throttle state for the #183 recurrence warning (#1618
    * WI-4) — see `reportWedgedConversation`'s doc comment for why this exists.
-   * `firstWedgedAt` anchors `stuck_for_ms`; `lastWarnedAt` throttles both the
-   * log line and the `dispatch_wedged` signal to at most once per
-   * `wedgeWarningIntervalMs`; `consecutiveTicks` is reported in the log text
-   * so the operator sees magnitude, not repetition. Cleared the moment the
-   * conversation dispatches anything (a fresh wedge, if it recurs, is a new
-   * incident). Bounded FIFO, mirroring `supersededSessions`
+   * `firstWedgedAt` anchors `stuck_for_ms`; `warnAnchorAt` is the throttle
+   * anchor from first detection through the first warning, then from each
+   * warning onward; `consecutiveTicks` is reported in the log text so the
+   * operator sees magnitude, not repetition. Cleared the moment the
+   * conversation dispatches anything, or when it drops off the pending list
+   * (`runDrain`'s prune, the dominant real-world path — a wedge normally ends
+   * with its message completing, not a fresh dispatch on the same
+   * conversation) — either way a fresh wedge, if it recurs, is a new
+   * incident. Bounded FIFO, mirroring `supersededSessions`
    * (`MAX_WEDGED_CONVERSATIONS`).
    */
   wedgeWarnings = /* @__PURE__ */ new Map();
@@ -7896,6 +8184,7 @@ var ChannelDriver = class _ChannelDriver {
   subagentInvocationPrefetches = /* @__PURE__ */ new Map();
   /** Serialises drains so a reconnect during a drain doesn't double-process. */
   draining = false;
+  pendingProviderRegistryRepair = null;
   /**
    * Serialises runner-file syncs (#559) so the ~2s poll tick and a concurrent
    * drain ping don't download, write and ack the same file twice.
@@ -8081,8 +8370,33 @@ var ChannelDriver = class _ChannelDriver {
   async runDrain() {
     let dispatched = 0;
     try {
+      const pendingRepair = this.pendingProviderRegistryRepair;
+      if (pendingRepair && this.protectedSessionIds().size === 0) {
+        try {
+          await this.issueProviderRegistryReload(
+            pendingRepair.conversationId,
+            pendingRepair.messageId
+          );
+        } catch (err) {
+          this.log({
+            level: "error",
+            message: `Provider registry repair adoption failed for message ${pendingRepair.messageId.slice(0, 8)}: ${err instanceof Error ? err.message : String(err)}`,
+            conversation_id: pendingRepair.conversationId,
+            message_id: pendingRepair.messageId
+          });
+        }
+        return 0;
+      }
       this.pendingMessageIds.clear();
       const conversations = await this.getPendingConversations();
+      if (this.wedgeWarnings.size > 0) {
+        const pendingConversationIds = new Set(conversations.map(({ id }) => id));
+        for (const conversationId of this.wedgeWarnings.keys()) {
+          if (!pendingConversationIds.has(conversationId)) {
+            this.wedgeWarnings.delete(conversationId);
+          }
+        }
+      }
       if (this.recycleRequestedFlag) {
         this.stop();
       }
@@ -8454,6 +8768,47 @@ var ChannelDriver = class _ChannelDriver {
         agent: message.opencode_agent ?? void 0,
         model: message.opencode_model ?? void 0
       };
+      const pinnedProviderLoaded = await isPinnedProviderLoaded(
+        this.port,
+        options.model,
+        this.openCodeClient
+      );
+      if (pinnedProviderLoaded === false) {
+        const dispatchedModel = message.opencode_model;
+        const separator = dispatchedModel?.indexOf("/") ?? -1;
+        const hasProviderAndModel = dispatchedModel !== null && separator > 0 && separator < dispatchedModel.length - 1;
+        const providerId = hasProviderAndModel ? dispatchedModel.slice(0, separator) : null;
+        const modelId = hasProviderAndModel ? dispatchedModel.slice(separator + 1) : null;
+        const errorMessage3 = `Provider namespace not loaded on this runner: ${message.opencode_model}. Refused before dispatch; no turn was started.`;
+        this.log({
+          level: "error",
+          message: `Refusing message ${message.id.slice(0, 8)} in conversation ${conv.id.slice(0, 8)}: provider namespace ${providerId ?? "(unknown)"} is not loaded; no turn was started`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        try {
+          await this.markFailed(conv.id, message.id, sessionId, errorMessage3, void 0, {
+            classification: {
+              kind: "model_auth",
+              providerId,
+              modelId,
+              reason: "missing"
+            },
+            errorShape: { name: null, statusCode: null }
+          });
+          this.signalDispatchNotStarted(conv, message, "model_provider_absent");
+        } catch (markErr) {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for refused message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed: ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          this.signalDispatchNotStarted(conv, message, "failure_unreported");
+        }
+        await this.repairProviderRegistry(conv.id, message.id);
+        break;
+      }
       let opencodeMessageId;
       let preDispatchUserIds = null;
       try {
@@ -8619,14 +8974,13 @@ var ChannelDriver = class _ChannelDriver {
    * skip-because-already-`dispatched`, the exact signature of a message stuck
    * acknowledged-but-never-worked.
    *
-   * Unthrottled, this fired every ~6s drain tick for as long as a wedge lasted
-   * (52,843 occurrences observed in one incident) — burning the GLOBAL
-   * 30-events/60s `runner-activity-telemetry.ts` budget that was itself
-   * suppressing the diagnostics needed to debug the wedge. The `warn` log (and
-   * the `dispatch_wedged` signal once the wedge has persisted past the same
-   * interval) fire at most once per `wedgeWarningIntervalMs` per conversation,
-   * naming the consecutive-tick count so the operator sees magnitude rather
-   * than repetition.
+   * The first detection starts the clock and emits a local `debug` entry. The
+   * `warn` log and paired `dispatch_wedged` signal fire once the wedge has
+   * lasted `wedgeWarningIntervalMs`, then at most once per interval, naming the
+   * consecutive-tick count so the operator sees magnitude rather than repetition.
+   * A watcher stall that the loop-liveness watchdog recovers is expected and is
+   * already reported by its `watcher_recovered` signal, so it does not reach an
+   * operator through this warning.
    *
    * Deliberately does NOT trigger a release: WI-1's `reconcileWatchers` runs
    * unconditionally on this same tick and is already recovering anything it
@@ -8638,36 +8992,41 @@ var ChannelDriver = class _ChannelDriver {
     const existing = this.wedgeWarnings.get(conv.id);
     const firstWedgedAt = existing?.firstWedgedAt ?? now;
     const consecutiveTicks = (existing?.consecutiveTicks ?? 0) + 1;
-    const dueForWarn = !existing || now - existing.lastWarnedAt >= this.wedgeWarningIntervalMs;
-    if (!dueForWarn) {
-      this.wedgeWarnings.delete(conv.id);
-      this.wedgeWarnings.set(conv.id, {
-        firstWedgedAt,
-        lastWarnedAt: existing.lastWarnedAt,
-        consecutiveTicks
+    const warnAnchorAt = existing?.warnAnchorAt ?? now;
+    const dueForWarn = now - warnAnchorAt >= this.wedgeWarningIntervalMs;
+    if (!existing) {
+      this.log({
+        level: "debug",
+        message: `Detected a possible wedge for conversation ${conv.id.slice(0, 8)} with ${messages.length} pending message(s); it will be reported only if it outlasts the watchdog's recovery.`,
+        conversation_id: conv.id
+      });
+    }
+    let untracked = 0;
+    if (dueForWarn) {
+      const stuckForMs = now - firstWedgedAt;
+      untracked = this.countUntrackedIds(messages);
+      this.log({
+        level: "warn",
+        message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode for ${consecutiveTicks} consecutive tick(s) now (${Math.round(stuckForMs / 1e3)}s stuck). ` + (untracked > 0 ? `${untracked} of these id(s) are tracked by NO watcher \u2014 the dispatched/in-flight pairing invariant is violated for this conversation, which will NOT self-heal and needs a runner restart.` : `A watcher is tracking this work; the loop-liveness watchdog is already recovering it.`),
+        conversation_id: conv.id
       });
-      return;
     }
-    const stuckForMs = now - firstWedgedAt;
-    const untracked = this.countUntrackedIds(messages);
-    this.log({
-      level: "warn",
-      message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode for ${consecutiveTicks} consecutive tick(s) now (${stuckForMs}ms stuck). ` + (untracked > 0 ? `${untracked} of these id(s) are tracked by NO watcher \u2014 the dispatched/in-flight pairing invariant is violated for this conversation, which will NOT self-heal and needs a runner restart.` : `A watcher is tracking this work; the loop-liveness watchdog is already recovering it.`),
-      conversation_id: conv.id
-    });
     this.wedgeWarnings.delete(conv.id);
-    this.wedgeWarnings.set(conv.id, { firstWedgedAt, lastWarnedAt: now, consecutiveTicks });
+    this.wedgeWarnings.set(conv.id, {
+      firstWedgedAt,
+      warnAnchorAt: dueForWarn ? now : warnAnchorAt,
+      consecutiveTicks
+    });
     while (this.wedgeWarnings.size > MAX_WEDGED_CONVERSATIONS) {
       const oldest = this.wedgeWarnings.keys().next().value;
       if (oldest === void 0) break;
       this.wedgeWarnings.delete(oldest);
     }
-    if (stuckForMs >= this.wedgeWarningIntervalMs) {
-      void this.postSignal(conv.id, messages[0].id, "dispatch_wedged", {
-        stuck_for_ms: stuckForMs,
-        untracked
-      });
-    }
+    if (!dueForWarn) return;
+    void this.postSignal(conv.id, messages[0].id, "dispatch_wedged", {
+      stuck_for_ms: now - firstWedgedAt,
+      untracked
+    });
   }
   /**
    * How many of `messages`' ids are tracked by NO watcher's `inFlight` (#1618
@@ -8803,6 +9162,34 @@ var ChannelDriver = class _ChannelDriver {
     if (state === "failed" && isAbortedTerminalReply(messages, ocId ?? "")) {
       const ongoing = await this.isSessionOngoing(sessionId);
       if (ongoing === false) {
+        const age = this.absoluteAgeForRow(message.processing_started_at);
+        if (age.tripped && age.anchorMs !== null) {
+          try {
+            await this.markFailed(
+              conv.id,
+              message.id,
+              sessionId,
+              this.absoluteCeilingError(message.id, sessionId, age.anchorMs),
+              void 0,
+              {
+                classification: null,
+                errorShape: extractReplyErrorShape(findLastAssistantReplyFor(messages, ocId ?? ""))
+              }
+            );
+          } catch (err) {
+            if (err instanceof ChannelAuthError) throw err;
+            this.log({
+              level: "warn",
+              message: `Re-drive: failed to report past-ceiling restart orphan ${message.id.slice(0, 8)} terminal; refusing to re-dispatch: ${err instanceof Error ? err.message : String(err)}`,
+              conversation_id: conv.id,
+              message_id: message.id
+            });
+            return "unresolved";
+          }
+          this.clearRedriveUnresolved(message.id);
+          void this.postSignal(conv.id, message.id, "redrive_ceiling_refused");
+          return "settled";
+        }
         this.log({
           level: "info",
           message: `Re-drive: message ${message.id.slice(0, 8)} carries an abort-shaped terminal error and session ${sessionId.slice(0, 8)} is not-ongoing per the active-session status check \u2014 restart orphan, re-dispatching instead of marking it permanently failed`,
@@ -8873,6 +9260,29 @@ var ChannelDriver = class _ChannelDriver {
         message_id: message.id
       });
     }
+    if (this.absoluteAgeForRow(message.processing_started_at).tripped) {
+      try {
+        await this.markFailed(
+          conv.id,
+          message.id,
+          sessionId,
+          this.absoluteCeilingError(message.id, sessionId, anchorMs)
+        );
+      } catch (err) {
+        if (err instanceof ChannelAuthError) throw err;
+        this.log({
+          level: "warn",
+          message: `Re-drive: failed to report past-ceiling message ${message.id.slice(0, 8)} terminal; refusing to re-attach: ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        const bound = await this.boundRedriveOutcome(conv, message, "reattach");
+        return bound === "abandoned" ? "abandoned" : "unresolved";
+      }
+      this.clearRedriveUnresolved(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_ceiling_refused");
+      return "abandoned";
+    }
     const title = await this.resolveSessionTitle(sessionId, conv.id);
     try {
       await this.markProcessing(conv.id, message.id, sessionId, ocId, title);
@@ -9139,8 +9549,7 @@ var ChannelDriver = class _ChannelDriver {
     const since = this.redriveOutcomeFailingSince.get(message.id);
     if (since === void 0) this.redriveOutcomeFailingSince.set(message.id, now);
     const durationTripped = now - (since ?? now) >= this.pausedMaxWaitMs;
-    const parsed = message.processing_started_at ? Date.parse(message.processing_started_at) : NaN;
-    const absoluteAgeTripped = !Number.isNaN(parsed) && now - parsed >= ABSOLUTE_MAX_PROCESSING_MS;
+    const absoluteAgeTripped = this.absoluteAgeForRow(message.processing_started_at).tripped;
     if (!durationTripped && !absoluteAgeTripped) {
       this.signalRedriveOutcomeUnreported(conv, message, outcome);
       return "retry";
@@ -9179,6 +9588,15 @@ var ChannelDriver = class _ChannelDriver {
     });
     return "abandoned";
   }
+  /** Row-level guards use the durable server stamp; in-flight guards use processingAnchorMs. */
+  absoluteAgeForRow(stamp) {
+    const anchorMs = stamp ? Date.parse(stamp) : NaN;
+    return Number.isNaN(anchorMs) ? { tripped: false, anchorMs: null } : { tripped: this.now() - anchorMs >= ABSOLUTE_MAX_PROCESSING_MS, anchorMs };
+  }
+  absoluteCeilingError(messageId, sessionId, anchorMs, retainedReason = this.readRetainedSessionError(sessionId)) {
+    const baseError = `Message ${messageId.slice(0, 8)} exceeded the absolute processing ceiling (${Math.round((this.now() - anchorMs) / 6e4)}min, session ${sessionId}) while still actively running.`;
+    return retainedReason ? `${baseError} ${SESSION_ERROR_RETAINED_DETAIL}${retainedReason}` : baseError;
+  }
   /**
    * Record one poll outcome toward the re-drive fence's consecutive-identical-
    * failure streak (#1348) and return the resulting count. `signature === null`
@@ -9620,10 +10038,7 @@ var ChannelDriver = class _ChannelDriver {
       opencodeMessageId,
       message,
       dispatchedAt: this.now(),
-      // Anchor the absolute-age ceiling to the SERVER-SIDE `processed_at`, NOT
-      // `dispatchedAt` — so a re-adopted zombie's age reflects the real turn duration
-      // and the ceiling fires on the ORIGINAL turn.
-      processingAnchorMs: processedAtMs,
+      processingAnchorMs: this.absoluteAgeForRow(message.processing_started_at).anchorMs ?? processedAtMs,
       deadline: watchDeadlineAnchorMs + this.pausedMaxWaitMs,
       // The server row is ALREADY `processing`; do not re-fire markProcessing.
       started: true,
@@ -9933,14 +10348,40 @@ var ChannelDriver = class _ChannelDriver {
         conversation_id: watcher.conv.id,
         message_id: inFlight.evidentMessageId
       });
-      await this.markFailed(
-        watcher.conv.id,
-        inFlight.evidentMessageId,
-        event.sessionId,
-        `OpenCode could not run this turn: ${event.reason}`
-      );
+      const isMissingProvider = isProviderModelNotFoundError(event.reason);
+      if (isMissingProvider) {
+        const dispatchedModel = inFlight.message.opencode_model;
+        const separator = dispatchedModel?.indexOf("/") ?? -1;
+        const hasProviderAndModel = dispatchedModel !== null && separator > 0 && separator < dispatchedModel.length - 1;
+        await this.markFailed(
+          watcher.conv.id,
+          inFlight.evidentMessageId,
+          event.sessionId,
+          `OpenCode could not run this turn: ${event.reason}`,
+          void 0,
+          {
+            classification: {
+              kind: "model_auth",
+              providerId: hasProviderAndModel ? dispatchedModel.slice(0, separator) : null,
+              modelId: hasProviderAndModel ? dispatchedModel.slice(separator + 1) : null,
+              reason: "missing"
+            },
+            errorShape: { name: null, statusCode: null }
+          }
+        );
+      } else {
+        await this.markFailed(
+          watcher.conv.id,
+          inFlight.evidentMessageId,
+          event.sessionId,
+          `OpenCode could not run this turn: ${event.reason}`
+        );
+      }
       inFlight.done = true;
       this.removeInFlight(watcher, inFlight.evidentMessageId);
+      if (isMissingProvider) {
+        await this.repairProviderRegistry(watcher.conv.id, inFlight.evidentMessageId);
+      }
     } catch (err) {
       if (err instanceof ChannelAuthError) {
         this.log({
@@ -9961,6 +10402,44 @@ var ChannelDriver = class _ChannelDriver {
       this.sessionErrorHandled.delete(inFlight.evidentMessageId);
     }
   }
+  async repairProviderRegistry(conversationId, messageId) {
+    if (this.isV2) {
+      void this.postSignal(conversationId, messageId, "provider_registry_reload_unsupported");
+      return;
+    }
+    const activeSessions = this.protectedSessionIds().size;
+    if (activeSessions > 0 || this.draining) {
+      this.pendingProviderRegistryRepair = { conversationId, messageId };
+      void this.postSignal(conversationId, messageId, "provider_registry_repair_deferred", {
+        active_sessions: activeSessions
+      });
+      this.log({
+        level: "warn",
+        message: `Provider registry repair deferred until a lifecycle-safe point; ${activeSessions} active session(s) protected`,
+        conversation_id: conversationId,
+        message_id: messageId
+      });
+      return;
+    }
+    await this.issueProviderRegistryReload(conversationId, messageId);
+  }
+  async issueProviderRegistryReload(conversationId, messageId) {
+    this.pendingProviderRegistryRepair = null;
+    const result = await disposeAndReloadProviderConfig(this.port, this.openCodeClient);
+    if (result.outcome === "failed") {
+      const failure = result.status === null ? `transport failure${result.detail ? `: ${result.detail}` : ""}` : `HTTP ${result.status}`;
+      this.log({
+        level: "warn",
+        message: `Provider registry reload failed (${failure})`,
+        conversation_id: conversationId,
+        message_id: messageId
+      });
+    }
+    const repairOutcome = result.outcome === "reloaded" ? "reloaded" : "reload_failed";
+    void this.postSignal(conversationId, messageId, "provider_registry_reload_issued", {
+      repair_outcome: repairOutcome
+    });
+  }
   /**
    * The per-session polling loop (WI-3). Once per tick it:
    *   1. polls `GET /session/:id/message` once and, per in-flight message,
@@ -10010,7 +10489,9 @@ var ChannelDriver = class _ChannelDriver {
         }
         const { openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk } = await this.pollInteractions(sessionId, watcher, messages);
         if (watcher.generation !== generation) return;
+        const ceilingAttemptsThisTick = /* @__PURE__ */ new Set();
         for (const inFlight of [...watcher.inFlight.values()]) {
+          if (ceilingAttemptsThisTick.has(inFlight.evidentMessageId)) continue;
           await this.serviceInFlightMessage(
             sessionId,
             watcher,
@@ -10019,7 +10500,8 @@ var ChannelDriver = class _ChannelDriver {
             openQuestions,
             openPermissions,
             questionsPolledOk,
-            permissionsPolledOk
+            permissionsPolledOk,
+            ceilingAttemptsThisTick
           );
         }
       }
@@ -10060,35 +10542,139 @@ var ChannelDriver = class _ChannelDriver {
       inFlight.deadline = this.now() + this.pausedMaxWaitMs;
     }
   }
-  /**
-   * Drive ONE in-flight message's lifecycle from the tick's message snapshot.
-   * Fires markProcessing on queued→running and markDone on done (each once),
-   * applies the idle-path re-dispatch guard, and removes the message from the
-   * in-flight set on completion or timeout.
-   */
-  async serviceInFlightMessage(sessionId, watcher, inFlight, messages, openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk) {
-    const conv = watcher.conv;
-    const state = messageRunState(messages, inFlight.opencodeMessageId);
-    const id = inFlight.evidentMessageId;
-    if (state === "running" || state === "done" || state === "failed") {
-      this.neverStartedAttempts.delete(id);
-    }
-    if (inFlight.sessionStoreFailurePending) {
-      await this.settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight);
-      return;
-    }
-    if (inFlight.neverStartedResolved) {
-      if (state === "running" || state === "done" || state === "failed") {
-        inFlight.neverStartedResolved = false;
-      } else {
-        await this.settleMessageNeverStarted(
-          sessionId,
-          watcher,
-          inFlight,
-          this.neverStartedAttempts.get(id)?.count ?? MAX_NEVER_STARTED_ATTEMPTS
-        );
-        return;
-      }
+  async settleAbsoluteCeiling(sessionId, watcher, messages, ceilingAttemptsThisTick) {
+    const entries = [...watcher.inFlight.values()];
+    const pastCeiling = entries.filter(
+      (entry) => this.now() - entry.processingAnchorMs >= ABSOLUTE_MAX_PROCESSING_MS
+    );
+    const healthySiblings = entries.length - pastCeiling.length;
+    const landed = [];
+    let allRecordsLanded = true;
+    const retainedReason = this.readRetainedSessionError(sessionId);
+    for (const entry of pastCeiling) {
+      if (!watcher.inFlight.has(entry.evidentMessageId)) continue;
+      ceilingAttemptsThisTick.add(entry.evidentMessageId);
+      const error2 = this.absoluteCeilingError(
+        entry.evidentMessageId,
+        sessionId,
+        entry.processingAnchorMs,
+        retainedReason
+      );
+      this.log({
+        level: "warn",
+        message: error2,
+        conversation_id: watcher.conv.id,
+        message_id: entry.evidentMessageId
+      });
+      try {
+        await this.markFailed(
+          watcher.conv.id,
+          entry.evidentMessageId,
+          sessionId,
+          error2,
+          void 0,
+          {
+            classification: null,
+            errorShape: extractReplyErrorShape(
+              findLastAssistantReplyFor(messages, entry.opencodeMessageId)
+            )
+          }
+        );
+      } catch (err) {
+        if (err instanceof ChannelAuthError) throw err;
+        allRecordsLanded = false;
+        const watched_for_ms = this.now() - entry.processingAnchorMs;
+        if (err instanceof ChannelTerminalError) {
+          void this.postSignal(watcher.conv.id, entry.evidentMessageId, "gave_up", {
+            watched_for_ms,
+            interrupt_outcome: "record_terminal"
+          });
+          this.removeInFlight(watcher, entry.evidentMessageId);
+          continue;
+        }
+        if (this.now() >= entry.deadline) {
+          void this.postSignal(watcher.conv.id, entry.evidentMessageId, "gave_up", {
+            watched_for_ms,
+            interrupt_outcome: "record_deadline"
+          });
+          this.removeInFlight(watcher, entry.evidentMessageId);
+          continue;
+        }
+        void this.postSignal(watcher.conv.id, entry.evidentMessageId, "gave_up", {
+          watched_for_ms,
+          interrupt_outcome: "record_retry"
+        });
+        this.log({
+          level: "warn",
+          message: `Failed to record the absolute-ceiling failure for message ${entry.evidentMessageId.slice(0, 8)}; leaving its running turn untouched and retrying next tick: ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: watcher.conv.id,
+          message_id: entry.evidentMessageId
+        });
+        continue;
+      }
+      entry.done = true;
+      landed.push(entry);
+    }
+    if (!allRecordsLanded) {
+      for (const entry of landed) this.removeInFlight(watcher, entry.evidentMessageId);
+      return;
+    }
+    if (healthySiblings > 0) {
+      for (const entry of landed) {
+        void this.postSignal(watcher.conv.id, entry.evidentMessageId, "gave_up", {
+          watched_for_ms: this.now() - entry.processingAnchorMs,
+          interrupt_outcome: "deferred_for_healthy_sibling",
+          healthy_siblings: healthySiblings
+        });
+        this.removeInFlight(watcher, entry.evidentMessageId);
+      }
+      return;
+    }
+    const interrupt = await interruptSession(this.port, sessionId, this.openCodeClient);
+    for (const entry of landed) {
+      void this.postSignal(watcher.conv.id, entry.evidentMessageId, "gave_up", {
+        watched_for_ms: this.now() - entry.processingAnchorMs,
+        interrupt_outcome: interrupt.kind
+      });
+      this.removeInFlight(watcher, entry.evidentMessageId);
+    }
+    if (interrupt.kind !== "confirmed_stopped") {
+      this.log({
+        level: "warn",
+        message: `Absolute-ceiling records landed for session ${sessionId}, but OpenCode interruption was ${interrupt.kind}${interrupt.diagnostic ? ` (${interrupt.diagnostic})` : "status" in interrupt && typeof interrupt.status === "number" ? ` (HTTP ${interrupt.status})` : ""}; the rows are terminal and released, while the session may still be running`,
+        conversation_id: watcher.conv.id
+      });
+    }
+  }
+  /**
+   * Drive ONE in-flight message's lifecycle from the tick's message snapshot.
+   * Fires markProcessing on queued→running and markDone on done (each once),
+   * applies the idle-path re-dispatch guard, and removes the message from the
+   * in-flight set on completion or timeout.
+   */
+  async serviceInFlightMessage(sessionId, watcher, inFlight, messages, openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk, ceilingAttemptsThisTick) {
+    const conv = watcher.conv;
+    const state = messageRunState(messages, inFlight.opencodeMessageId);
+    const id = inFlight.evidentMessageId;
+    if (state === "running" || state === "done" || state === "failed") {
+      this.neverStartedAttempts.delete(id);
+    }
+    if (inFlight.sessionStoreFailurePending) {
+      await this.settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight);
+      return;
+    }
+    if (inFlight.neverStartedResolved) {
+      if (state === "running" || state === "done" || state === "failed") {
+        inFlight.neverStartedResolved = false;
+      } else {
+        await this.settleMessageNeverStarted(
+          sessionId,
+          watcher,
+          inFlight,
+          this.neverStartedAttempts.get(id)?.count ?? MAX_NEVER_STARTED_ATTEMPTS
+        );
+        return;
+      }
     }
     if (messages && collectTaskCalls(messages, inFlight.opencodeMessageId).length > 0 && !this.subagentInvocationPrefetches.has(id)) {
       void this.resolveSubagentInvocations(
@@ -10152,7 +10738,7 @@ var ChannelDriver = class _ChannelDriver {
       if (!inFlight.done) {
         const messageErrorText = messageError(messages, inFlight.opencodeMessageId);
         const retainedReason = this.readRetainedSessionError(sessionId);
-        const retainedError = retainedReason === null ? null : `${SESSION_ERROR_RETAINED_DETAIL}${retainedReason}`;
+        const retainedError = retainedReason === null || messageErrorText !== null && messageErrorText.includes(retainedReason) ? null : `${SESSION_ERROR_RETAINED_DETAIL}${retainedReason}`;
         const observedCause = this.sessionStoreHealth?.readCause(sessionId);
         const causeError = observedCause === null || observedCause === void 0 ? null : `${SESSION_ERROR_OBSERVED_CAUSE}${observedCause}`;
         const storeError = this.sessionStoreHealth?.isUnwritable() ? SESSION_STORE_UNWRITABLE_ERROR : null;
@@ -10410,17 +10996,8 @@ var ChannelDriver = class _ChannelDriver {
         return;
       }
     }
-    if (activelyRunning && this.now() - inFlight.processingAnchorMs >= ABSOLUTE_MAX_PROCESSING_MS) {
-      this.log({
-        level: "warn",
-        message: `Message ${inFlight.evidentMessageId.slice(0, 8)} exceeded the absolute processing ceiling (${Math.round((this.now() - inFlight.processingAnchorMs) / 6e4)}min, session ${sessionId}) while still actively running \u2014 releasing so the cron can reclaim it`,
-        conversation_id: conv.id,
-        message_id: inFlight.evidentMessageId
-      });
-      void this.postSignal(conv.id, inFlight.evidentMessageId, "gave_up", {
-        watched_for_ms: this.now() - inFlight.processingAnchorMs
-      });
-      this.removeInFlight(watcher, inFlight.evidentMessageId);
+    if (watcher.inFlight.has(inFlight.evidentMessageId) && activelyRunning && this.now() - inFlight.processingAnchorMs >= ABSOLUTE_MAX_PROCESSING_MS) {
+      await this.settleAbsoluteCeiling(sessionId, watcher, messages, ceilingAttemptsThisTick);
       return;
     }
     const heartbeatDue = activelyRunning && !inFlight.awaitingHumanLatched && !inFlight.aliveInFlight && this.now() - inFlight.lastAliveAt >= HEARTBEAT_MS;
@@ -10648,7 +11225,8 @@ var ChannelDriver = class _ChannelDriver {
         usage,
         void 0,
         usageAgentName,
-        subagentInvocations
+        subagentInvocations,
+        true
       );
     } catch (err) {
       if (err instanceof ChannelAuthError) throw err;
@@ -11042,6 +11620,33 @@ var ChannelDriver = class _ChannelDriver {
     }
     const restartAborted = state === "failed" && sessionOngoing === false && isAbortedTerminalReply(messages, ocId ?? "");
     if (restartAborted) {
+      const age = this.absoluteAgeForRow(row.processing_started_at);
+      if (age.tripped && age.anchorMs !== null) {
+        try {
+          await this.markFailed(
+            row.conversation_id,
+            row.id,
+            sessionId,
+            this.absoluteCeilingError(row.id, sessionId, age.anchorMs),
+            void 0,
+            {
+              classification: null,
+              errorShape: extractReplyErrorShape(findLastAssistantReplyFor(messages, ocId ?? ""))
+            }
+          );
+        } catch (err) {
+          if (err instanceof ChannelAuthError) throw err;
+          this.log({
+            level: "warn",
+            message: `Re-adopt: failed to report past-ceiling restart orphan ${row.id.slice(0, 8)} terminal; refusing to re-dispatch: ${err instanceof Error ? err.message : String(err)}`,
+            conversation_id: row.conversation_id,
+            message_id: row.id
+          });
+          return;
+        }
+        void this.postSignal(row.conversation_id, row.id, "redrive_ceiling_refused");
+        return;
+      }
       this.log({
         level: "info",
         message: `Re-adopt: message ${row.id.slice(0, 8)} carries an abort-shaped terminal error and session ${sessionId.slice(0, 8)} is not-ongoing per the active-session status check \u2014 restart orphan, re-dispatching instead of marking it permanently failed`,
@@ -11587,7 +12192,8 @@ var ChannelDriver = class _ChannelDriver {
       source_message_id: row.source_message_id,
       slack_user_id: row.slack_user_id,
       attachments: row.attachments ?? null,
-      opencode_message_id: row.opencode_message_id
+      opencode_message_id: row.opencode_message_id,
+      processing_started_at: row.processing_started_at
     };
   }
   /**
@@ -12494,7 +13100,7 @@ var ChannelDriver = class _ChannelDriver {
    *     exists but is wedged, so the next attempt must get a fresh one
    *     instead of reusing it — see WI-1's server-side null-clearing PATCH).
    */
-  async markFailed(conversationId, messageId, sessionId, error2, usage, failure, usageAgentName, subagentInvocations) {
+  async markFailed(conversationId, messageId, sessionId, error2, usage, failure, usageAgentName, subagentInvocations, abandonedWithoutAnswer) {
     const body = { status: "failed" };
     if (sessionId === null) {
       body.opencode_session_id = null;
@@ -12507,12 +13113,19 @@ var ChannelDriver = class _ChannelDriver {
     if (subagentInvocations && subagentInvocations.length > 0) {
       body.subagent_invocations = subagentInvocations;
     }
-    if (failure) {
-      body.failure_kind = failure.kind;
-      body.failure_provider_id = failure.providerId;
-      body.failure_model_id = failure.modelId;
-      body.failure_reason = failure.reason;
+    if (failure && failure.errorShape.name !== null) {
+      body.failure_error_name = failure.errorShape.name;
     }
+    if (failure && failure.errorShape.statusCode !== null) {
+      body.failure_status_code = failure.errorShape.statusCode;
+    }
+    if (failure?.classification) {
+      body.failure_kind = failure.classification.kind;
+      body.failure_provider_id = failure.classification.providerId;
+      body.failure_model_id = failure.classification.modelId;
+      body.failure_reason = failure.classification.reason;
+    }
+    if (abandonedWithoutAnswer) body.abandoned_without_answer = true;
     try {
       await this.callWithRetry(
         "marking message as failed",
@@ -12532,27 +13145,28 @@ var ChannelDriver = class _ChannelDriver {
     this.clearSubagentInvocationCaches(messageId);
   }
   /**
-   * Classify an errored turn as a model-auth failure (#736 P1-4), for `markFailed`.
+   * Classify an errored turn and extract its bounded error shape for `markFailed`.
    *
    * `messageFailure` alone (structured OpenCode error → `model_auth`) covers
    * most cases; when it returns `null` on this ALREADY-FAILED turn, fall back
    * to the P1-2b zero-provider check — one extra loopback call to
    * `hasAnyConfiguredProvider`, only reached when the structured classifier
    * couldn't place it. Fails open (never throws): a fallback probe failure
-   * (`null`/indeterminate) leaves the classification `null`, which produces
-   * today's byte-identical PATCH body via `markFailed`'s `if (failure)` guard.
+   * (`null`/indeterminate) leaves the classification `null`; the raw error shape
+   * is still retained for diagnostics.
    */
   async classifyModelAuthFailure(messages, userMessageId) {
-    const classified = messageFailure(messages, userMessageId);
-    if (classified != null) return classified;
     const reply = findLastAssistantReplyFor(messages, userMessageId);
-    const hasProvider = await this.hasAnyConfiguredProvider();
-    return applyZeroProviderFallback(
+    const errorShape = extractReplyErrorShape(reply);
+    const classified = messageFailure(messages, userMessageId);
+    if (classified != null) return { classification: classified, errorShape };
+    const classification = applyZeroProviderFallback(
       classified,
-      hasProvider,
+      await this.hasAnyConfiguredProvider(),
       reply?.info?.providerID ?? null,
       reply?.info?.modelID ?? null
     );
+    return { classification, errorShape };
   }
   async recordSubagentModelAuthFailure(failure, conversationId, messageId) {
     const providerId = failure.providerId ?? "(unknown)";
@@ -13377,6 +13991,22 @@ async function configureGitHubAccess({ env, log: log3 }) {
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { copyFileSync, existsSync as existsSync2, statSync as statSync6 } from "node:fs";
 import { isAbsolute as isAbsolute3, join as join11, resolve as resolve4 } from "node:path";
+function parseConfigContent(content) {
+  if (!content?.trim()) return {};
+  const parsed = JSON.parse(content);
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("OPENCODE_CONFIG_CONTENT must contain a JSON object");
+  }
+  return parsed;
+}
+function mergeManagedOpenCodeConfigContent(content, managedProviders) {
+  const config = parseConfigContent(content);
+  const provider = typeof config.provider === "object" && config.provider !== null && !Array.isArray(config.provider) ? { ...config.provider } : {};
+  for (const namespace of CREDENTIAL_PROXY_NATIVE_NAMESPACES) {
+    delete provider[namespace];
+  }
+  return JSON.stringify({ ...config, provider: { ...provider, ...managedProviders } });
+}
 function isFile(filePath) {
   return existsSync2(filePath) && statSync6(filePath).isFile();
 }
@@ -13410,6 +14040,159 @@ function applyRunnerOpenCodeConfig({
   log3(`Applied runner OpenCode config ${source} to ${join11(cwd, target)}`);
 }
 
+// src/lib/opencode/runtime-provenance.ts
+import { readFileSync as readFileSync7, readdirSync } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join12 } from "node:path";
+var PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i;
+var REGISTRY_SPEC = /^[a-z0-9.*+^~<>=|-]+$/i;
+function errorKind(error2) {
+  if (!(error2 instanceof Error)) return "unknown error";
+  const code = "code" in error2 && typeof error2.code === "string" ? ` (${error2.code})` : "";
+  return `${error2.name}${code}`;
+}
+function parseRegistryPluginSpec(value) {
+  const separator = value.lastIndexOf("@");
+  if (separator <= 0) return null;
+  const name = value.slice(0, separator);
+  const spec = value.slice(separator + 1);
+  if (!PACKAGE_NAME.test(name) || !REGISTRY_SPEC.test(spec)) return null;
+  return { name, spec };
+}
+function parseJsonc(value) {
+  let output = "";
+  let inString = false;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = 0; index < value.length; index++) {
+    const character = value[index];
+    const next = value[index + 1];
+    if (lineComment) {
+      if (character === "\n") {
+        lineComment = false;
+        output += character;
+      }
+      continue;
+    }
+    if (blockComment) {
+      if (character === "*" && next === "/") {
+        blockComment = false;
+        index++;
+      } else if (character === "\n") {
+        output += character;
+      }
+      continue;
+    }
+    if (inString) {
+      output += character;
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === '"') inString = false;
+      continue;
+    }
+    if (character === '"') {
+      inString = true;
+      output += character;
+    } else if (character === "/" && next === "/") {
+      lineComment = true;
+      index++;
+    } else if (character === "/" && next === "*") {
+      blockComment = true;
+      index++;
+    } else if (character === ",") {
+      let lookahead = index + 1;
+      while (/\s/.test(value[lookahead] ?? "")) lookahead++;
+      if (value[lookahead] !== "]" && value[lookahead] !== "}") output += character;
+    } else {
+      output += character;
+    }
+  }
+  return JSON.parse(output);
+}
+function openCodeCacheRoot(env = process.env, homeDir = homedir7()) {
+  return join12(env.XDG_CACHE_HOME ?? join12(homeDir, ".cache"), "opencode");
+}
+function readConfiguredPluginSpecs({
+  cwd = process.cwd(),
+  log: log3
+}) {
+  let config;
+  try {
+    try {
+      config = parseJsonc(readFileSync7(join12(cwd, "opencode.jsonc"), "utf8"));
+    } catch (error2) {
+      if (!("code" in Object(error2)) || Object(error2).code !== "ENOENT") throw error2;
+      config = parseJsonc(readFileSync7(join12(cwd, "opencode.json"), "utf8"));
+    }
+  } catch (error2) {
+    log3(`Could not read OpenCode plugin configuration: ${errorKind(error2)}`);
+    return [];
+  }
+  if (typeof config !== "object" || config === null || !("plugin" in config)) return [];
+  const plugins = config.plugin;
+  if (!Array.isArray(plugins)) {
+    log3("Could not read OpenCode plugin configuration: plugin is not an array");
+    return [];
+  }
+  const configured = plugins.filter(
+    (plugin) => typeof plugin === "string" && parseRegistryPluginSpec(plugin) !== null
+  );
+  if (configured.length !== plugins.length) {
+    log3(
+      `Skipped ${plugins.length - configured.length} non-registry OpenCode plugin spec(s); their values were not recorded`
+    );
+  }
+  return configured;
+}
+function resolveInstalledPluginVersions({
+  cacheRoot,
+  env = process.env,
+  homeDir = homedir7(),
+  log: log3
+}) {
+  const packagesRoot = join12(cacheRoot ?? openCodeCacheRoot(env, homeDir), "packages");
+  let directories;
+  try {
+    directories = readdirSync(packagesRoot, { withFileTypes: true });
+  } catch (error2) {
+    if ("code" in Object(error2) && Object(error2).code === "ENOENT") return [];
+    log3(`Could not inspect the OpenCode plugin cache: ${errorKind(error2)}`);
+    return [];
+  }
+  const plugins = [];
+  let skipped = 0;
+  for (const directory of directories) {
+    if (!directory.isDirectory()) continue;
+    const parsed = parseRegistryPluginSpec(directory.name);
+    if (parsed === null) {
+      skipped++;
+      continue;
+    }
+    let resolvedVersion = null;
+    try {
+      const packageJson = JSON.parse(
+        readFileSync7(
+          join12(packagesRoot, directory.name, "node_modules", parsed.name, "package.json"),
+          "utf8"
+        )
+      );
+      if (typeof packageJson.version === "string" && REGISTRY_SPEC.test(packageJson.version)) {
+        resolvedVersion = packageJson.version;
+      } else {
+        log3(`Could not resolve OpenCode plugin ${parsed.name}@${parsed.spec}: invalid version`);
+      }
+    } catch (error2) {
+      log3(`Could not resolve OpenCode plugin ${parsed.name}@${parsed.spec}: ${errorKind(error2)}`);
+    }
+    plugins.push({ ...parsed, resolvedVersion });
+  }
+  if (skipped > 0) {
+    log3(`Skipped ${skipped} non-registry OpenCode package cache entry; its value was not recorded`);
+  }
+  return plugins;
+}
+
 // src/lib/credential-sync.ts
 import { renameSync, writeFileSync as writeFileSync5 } from "node:fs";
 var CREDENTIAL_SYNC_TICK_TIMEOUT_MS = 3e4;
@@ -13645,10 +14428,261 @@ function createCredentialSync({
   };
 }
 
+// src/lib/managed-inference-setup.ts
+var defaultStore = {
+  get: getManagedInferenceCredential,
+  set: setManagedInferenceCredential,
+  clear: clearManagedInferenceCredential
+};
+function endpoint(options, operation) {
+  return `${options.apiUrl}/runners/${options.agentId}/managed-credentials/${operation}`;
+}
+function requestHeaders(options) {
+  return { Authorization: options.getAuthHeader(), "Content-Type": "application/json" };
+}
+function request2(options) {
+  return withRequestTimeout(options.fetchImpl ?? fetch, REQUEST_TIMEOUT_MS);
+}
+function safeFailure(operation, status2) {
+  return status2 === void 0 ? `${operation} could not reach the managed credential service` : `${operation} returned HTTP ${status2}`;
+}
+function logTransportFailure(options, operation, error2, authorization) {
+  let detail = error2 instanceof Error ? error2.message : String(error2);
+  const credential = authorization.split(/\s+/, 2)[1];
+  for (const secret of [authorization, credential]) {
+    if (secret) detail = detail.replaceAll(secret, "[redacted]");
+  }
+  options.log(
+    `MANAGED-INFERENCE-TRANSPORT-FAILED: operation=${operation} detail=${redactDiagnosticText(detail)}`,
+    "debug"
+  );
+}
+async function responseJson(response) {
+  try {
+    const value = await response.json();
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  } catch (error2) {
+    return null;
+  }
+}
+function readSetup(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const setup = value;
+  if (typeof setup.runner_id !== "string" || typeof setup.generation !== "string" || typeof setup.status !== "string" || setup.token_id !== null && typeof setup.token_id !== "string" || typeof setup.acknowledged_at !== "string" && setup.acknowledged_at !== null) {
+    return null;
+  }
+  return setup;
+}
+function clearLocalSetup(options) {
+  const env = options.env ?? process.env;
+  const store = options.store ?? defaultStore;
+  const stored = store.get(options.agentId);
+  store.clear(options.agentId);
+  const token = env.EVIDENT_PROXY_TOKEN;
+  if (token !== void 0 && token === stored?.token) {
+    delete env.EVIDENT_PROXY_TOKEN;
+  } else if (token !== void 0) {
+    options.log(
+      `MANAGED-INFERENCE-CLEANUP-PRESERVED-EXTERNAL-TOKEN: runner=${options.agentId}`,
+      "debug"
+    );
+  }
+}
+async function discoverManagedInferenceSetup(options) {
+  const headers = requestHeaders(options);
+  let response;
+  try {
+    response = await request2(options)(endpoint(options, "current"), {
+      headers
+    });
+  } catch (error2) {
+    logTransportFailure(options, "discovery", error2, headers.Authorization);
+    return { kind: "failed", reason: safeFailure("Managed setup discovery") };
+  }
+  if (response.status === 404) {
+    clearLocalSetup(options);
+    return { kind: "none" };
+  }
+  if (!response.ok) {
+    return { kind: "failed", reason: safeFailure("Managed setup discovery", response.status) };
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed setup discovery returned an invalid response" };
+}
+async function enrollManagedInferenceSetup(options) {
+  const response = await post(options, "enroll", {});
+  if (!response) {
+    return { kind: "failed", reason: safeFailure("Managed credential enrollment") };
+  }
+  if (response.status === 404) {
+    return { kind: "none" };
+  }
+  const body = await responseJson(response);
+  if (!response.ok) {
+    const serverError = body?.error;
+    return {
+      kind: "failed",
+      reason: typeof serverError === "string" && serverError.trim() ? redactDiagnosticText(serverError).slice(0, 500) : safeFailure("Managed credential enrollment", response.status)
+    };
+  }
+  const setup = readSetup(body?.setup);
+  return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed credential enrollment returned an invalid response" };
+}
+async function post(options, operation, body) {
+  const headers = requestHeaders(options);
+  try {
+    return await request2(options)(endpoint(options, operation), {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+  } catch (error2) {
+    logTransportFailure(options, operation, error2, headers.Authorization);
+    return null;
+  }
+}
+function applyCredential(options, credential) {
+  const env = options.env ?? process.env;
+  let merged;
+  if (options.autoConfigureCredentialsProxy) {
+    const { config, unsupportedProviders } = buildCredentialProxyNativeConfig({
+      inferenceBaseUrl: credential.inferenceBaseUrl,
+      modelDescriptors: credential.modelDescriptors
+    });
+    if (unsupportedProviders.length > 0 || Object.keys(config.provider).length === 0) {
+      return "Managed setup contains unsupported provider descriptors";
+    }
+    try {
+      merged = mergeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT, config.provider);
+    } catch (error2) {
+      return "OPENCODE_CONFIG_CONTENT is malformed; managed providers were not installed";
+    }
+  }
+  try {
+    (options.store ?? defaultStore).set(options.agentId, credential);
+  } catch (error2) {
+    const detail = (error2 instanceof Error ? error2.message : String(error2)).replaceAll(
+      credential.token,
+      "[redacted]"
+    );
+    options.log(
+      `MANAGED-INFERENCE-STORE-FAILED: runner=${options.agentId} generation=${credential.generation} detail=${redactDiagnosticText(detail)}`,
+      "warn"
+    );
+    return "Managed credentials could not be written to the protected store";
+  }
+  env.EVIDENT_PROXY_TOKEN = credential.token;
+  if (merged !== void 0) env.OPENCODE_CONFIG_CONTENT = merged;
+  return null;
+}
+async function reportManagedInferenceApplyFailure(options, failure) {
+  const response = await post(options, "report-failure", {
+    generation: failure.generation,
+    token_id: failure.tokenId
+  });
+  if (!response?.ok) {
+    options.log(
+      `MANAGED-INFERENCE-REPORT-FAILED: runner=${options.agentId} generation=${failure.generation}${response ? ` status=${response.status}` : ""}`,
+      "warn"
+    );
+  }
+}
+async function reaffirmStored(options, credential) {
+  const response = await post(options, "reaffirm", {
+    generation: credential.generation,
+    token_id: credential.tokenId
+  });
+  if (!response?.ok) {
+    return {
+      kind: "failed",
+      reason: response?.status === 409 ? "Stored managed credential no longer matches this setup; restart required" : response ? safeFailure("Managed credential reaffirmation", response.status) : safeFailure("Managed credential reaffirmation")
+    };
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  if (!setup || setup.generation !== credential.generation || setup.token_id !== credential.tokenId) {
+    return { kind: "failed", reason: "Managed credential reaffirmation returned a mismatch" };
+  }
+  const failure = applyCredential(options, credential);
+  return failure ? { kind: "failed", reason: failure } : { kind: "ready", generation: credential.generation, tokenId: credential.tokenId };
+}
+async function prepareManagedInferenceSetup(options, discovery, health) {
+  if (health.authFailed) {
+    return {
+      kind: "failed",
+      reason: "OpenCode authentication failed; managed credentials were not rotated"
+    };
+  }
+  const stored = (options.store ?? defaultStore).get(options.agentId);
+  if (health.healthy) {
+    if (!stored) {
+      return {
+        kind: "failed",
+        reason: "Managed credentials are missing for the serving OpenCode process; restart required"
+      };
+    }
+    return reaffirmStored(options, stored);
+  }
+  if (discovery.setup.acknowledged_at !== null && stored?.generation === discovery.setup.generation && stored.tokenId === discovery.setup.token_id) {
+    return reaffirmStored(options, stored);
+  }
+  const response = await post(options, "bootstrap", { generation: discovery.setup.generation });
+  if (!response?.ok) {
+    return {
+      kind: "failed",
+      reason: response ? safeFailure("Managed credential bootstrap", response.status) : safeFailure("Managed credential bootstrap")
+    };
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  const token = body?.inference_token;
+  const inferenceBaseUrl = body?.inference_base_url;
+  const modelDescriptors = body?.model_descriptors;
+  if (!setup || setup.generation !== discovery.setup.generation || typeof setup.token_id !== "string" || typeof token !== "string" || typeof inferenceBaseUrl !== "string" || !Array.isArray(modelDescriptors) || !modelDescriptors.every(
+    (descriptor) => typeof descriptor === "object" && descriptor !== null && typeof descriptor.id === "string" && typeof descriptor.provider === "string"
+  )) {
+    return { kind: "failed", reason: "Managed credential bootstrap returned an invalid response" };
+  }
+  const credential = {
+    generation: setup.generation,
+    tokenId: setup.token_id,
+    token,
+    inferenceBaseUrl,
+    modelDescriptors
+  };
+  const failure = applyCredential(options, credential);
+  if (failure) {
+    await reportManagedInferenceApplyFailure(options, credential);
+    return { kind: "failed", reason: failure };
+  }
+  return { kind: "ready", generation: credential.generation, tokenId: credential.tokenId };
+}
+async function acknowledgeManagedInferenceSetup(options, preparation) {
+  const response = await post(options, "acknowledge", {
+    generation: preparation.generation,
+    token_id: preparation.tokenId,
+    config_validated: options.autoConfigureCredentialsProxy === true
+  });
+  if (!response?.ok) {
+    throw new Error(
+      response ? safeFailure("Managed credential acknowledgment", response.status) : safeFailure("Managed credential acknowledgment")
+    );
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  if (!setup || setup.generation !== preparation.generation || setup.token_id !== preparation.tokenId) {
+    throw new Error("Managed credential acknowledgment returned a mismatch");
+  }
+  return response.status === 200 && setup.status === "acknowledged" ? "acknowledged" : "pending";
+}
+
 // src/commands/run.ts
 var MAX_ACTIVITY_LOG_ENTRIES = 10;
 var MAX_DISCONNECT_REASON_LENGTH = 200;
 var CHANNEL_POLL_INTERVAL_MS = Number(process.env.EVIDENT_CHANNEL_POLL_INTERVAL_MS) || 2e3;
+var CREDENTIAL_ADOPTION_PROBE_ATTEMPTS = 3;
+var CREDENTIAL_ADOPTION_PROBE_INTERVAL_MS = 1e3;
 var CHANNEL_STUCK_QUEUED_MS = Number(process.env.EVIDENT_STUCK_QUEUED_MS) || void 0;
 var SHUTDOWN_DRAIN_TIMEOUT_MS = Number(process.env.EVIDENT_SHUTDOWN_DRAIN_MS) || 25e3;
 var TELEMETRY_SHUTDOWN_TIMEOUT_MS = 5e3;
@@ -13683,7 +14717,7 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join12(homeDir, trimmed.slice(2)) : trimmed;
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join13(homeDir, trimmed.slice(2)) : trimmed;
     if (!isAbsolute4(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
@@ -13838,7 +14872,7 @@ function logActivity(state, entry) {
 }
 function reportSessionDbRecovery(state) {
   try {
-    const report = drainSessionDbRecoveryReport({ homeDir: homedir7(), env: process.env });
+    const report = drainSessionDbRecoveryReport({ homeDir: homedir8(), env: process.env });
     for (const record of report.records) {
       const activity = buildSessionDbRecoveryActivity(record);
       if (!activity) throw new Error("could not map session-DB recovery record");
@@ -13919,7 +14953,7 @@ async function importOpenCodeV2CredentialsForState(state) {
   }
   const result = await importOpenCodeV2Credentials({
     request: client.request,
-    homeDir: homedir7(),
+    homeDir: homedir8(),
     directory,
     guard: state.opencodeV2CredentialImportGuard,
     log: (message, level = "info") => logActivity(state, { type: "info", level, message })
@@ -13996,6 +15030,125 @@ async function handleAuthError(state, error2) {
     return { success: false };
   }
 }
+function logCredentialAdoptionActivity(state, activity, level) {
+  const message = (() => {
+    switch (activity.outcome) {
+      case "deferred":
+        return `CREDENTIAL-ADOPTION: deferred generation ${activity.generation} with ${activity.active_sessions} active session(s)`;
+      case "reloaded_ready":
+        return `CREDENTIAL-ADOPTION: adopted generation ${activity.generation} with ${activity.active_sessions} active session(s); readiness probe succeeded after ${activity.probe_attempts} attempt(s)`;
+      case "reloaded_interrupted": {
+        const response = activity.probe_status === null ? "without an HTTP response" : `with HTTP ${activity.probe_status} and ${activity.probe_body_empty ? "an empty" : "a non-empty"} body`;
+        return `CREDENTIAL-ADOPTION: generation ${activity.generation} with ${activity.active_sessions} active session(s); replacement instance answered ${response} after ${activity.probe_attempts} probe attempt(s)`;
+      }
+      case "reload_failed":
+        return `CREDENTIAL-ADOPTION: failed to adopt generation ${activity.generation} with ${activity.active_sessions} active session(s)`;
+      case "skipped_v2":
+        return `CREDENTIAL-ADOPTION: skipped generation ${activity.generation} with ${activity.active_sessions} active session(s) on OpenCode V2`;
+    }
+  })();
+  logActivity(state, {
+    type: level === "error" ? "error" : "info",
+    level,
+    ...level === "error" ? { error: message } : { message },
+    metadata: {
+      ...activity,
+      opencode_version: state.opencodeVersion,
+      port: state.port
+    }
+  });
+}
+async function adoptCredentialGeneration(state, generation, adoption, activeSessions, deferredForMs) {
+  const reload = await disposeAndReloadProviderConfig(
+    state.port,
+    state.opencodeClient ?? void 0
+  );
+  if (reload.outcome === "failed") {
+    logCredentialAdoptionActivity(
+      state,
+      {
+        outcome: "reload_failed",
+        generation,
+        active_sessions: activeSessions,
+        adoption,
+        deferred_for_ms: deferredForMs,
+        reload_status: reload.status,
+        reload_detail: reload.detail,
+        probe_attempts: null,
+        probe_status: null,
+        probe_body_empty: null,
+        probe_detail: null
+      },
+      "error"
+    );
+    return;
+  }
+  if (reload.outcome === "skipped_v2") {
+    logCredentialAdoptionActivity(
+      state,
+      {
+        outcome: "skipped_v2",
+        generation,
+        active_sessions: activeSessions,
+        adoption,
+        deferred_for_ms: deferredForMs,
+        reload_status: null,
+        reload_detail: null,
+        probe_attempts: null,
+        probe_status: null,
+        probe_body_empty: null,
+        probe_detail: null
+      },
+      "debug"
+    );
+    return;
+  }
+  let lastProbe = null;
+  let attempts = 0;
+  for (attempts = 1; attempts <= CREDENTIAL_ADOPTION_PROBE_ATTEMPTS; attempts++) {
+    lastProbe = await probeOpenCodeRequestReadiness(state.port, state.opencodeClient ?? void 0);
+    if (lastProbe.ok) {
+      logCredentialAdoptionActivity(
+        state,
+        {
+          outcome: "reloaded_ready",
+          generation,
+          active_sessions: activeSessions,
+          adoption,
+          deferred_for_ms: deferredForMs,
+          reload_status: null,
+          reload_detail: null,
+          probe_attempts: attempts,
+          probe_status: lastProbe.status,
+          probe_body_empty: lastProbe.bodyEmpty,
+          probe_detail: lastProbe.detail
+        },
+        "warn"
+      );
+      return;
+    }
+    if (attempts < CREDENTIAL_ADOPTION_PROBE_ATTEMPTS) {
+      await new Promise((resolve5) => setTimeout(resolve5, CREDENTIAL_ADOPTION_PROBE_INTERVAL_MS));
+    }
+  }
+  logCredentialAdoptionActivity(
+    state,
+    {
+      outcome: "reloaded_interrupted",
+      generation,
+      active_sessions: activeSessions,
+      adoption,
+      deferred_for_ms: deferredForMs,
+      reload_status: null,
+      reload_detail: null,
+      probe_attempts: CREDENTIAL_ADOPTION_PROBE_ATTEMPTS,
+      probe_status: lastProbe?.status ?? null,
+      probe_body_empty: lastProbe?.bodyEmpty ?? null,
+      probe_detail: lastProbe?.detail ?? null
+    },
+    "error"
+  );
+}
 async function driveChannels(state, driver) {
   let idlePolls = 0;
   let idleMs = 0;
@@ -14005,6 +15158,15 @@ async function driveChannels(state, driver) {
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
   let lastSeenClaudeApplies = driver.fileSyncActivity().claudeCredentialApplies;
   let lastSeenOpencodeAuthApplies = driver.fileSyncActivity().opencodeAuthApplyCount;
+  const credentialAdoption = {
+    generation: 0,
+    pendingGeneration: null,
+    pendingSinceMs: null,
+    deferredGeneration: null,
+    adoption: 0
+  };
+  const stayAwakeHolds = () => state.stayAwakeUntilMs !== null && Date.now() < state.stayAwakeUntilMs;
+  let stayAwakeSuppressionLogged = false;
   while (state.running) {
     const cycleStartedAtMs = performance.now();
     let idleThisCycle = false;
@@ -14046,12 +15208,30 @@ async function driveChannels(state, driver) {
       lastSeenOpencodeAuthApplies = opencodeAuthApplies;
       if (opencodeAuthApplied) state.openaiUsageRearm?.();
       if (claudeCredentialApplied || opencodeAuthApplied) {
-        void reloadProviderCache(state.port, state.opencodeClient ?? void 0).catch(
-          (error2) => logActivity(state, {
-            type: "error",
-            error: `OpenCode provider cache reload failed on port ${state.port}: ${error2 instanceof Error ? error2.message : String(error2)}`
-          })
-        );
+        credentialAdoption.generation++;
+        if (state.opencodeApiVersion === "v2") {
+          logCredentialAdoptionActivity(
+            state,
+            {
+              outcome: "skipped_v2",
+              generation: credentialAdoption.generation,
+              active_sessions: driver.protectedSessionIds().size,
+              adoption: null,
+              deferred_for_ms: null,
+              reload_status: null,
+              reload_detail: null,
+              probe_attempts: null,
+              probe_status: null,
+              probe_body_empty: null,
+              probe_detail: null
+            },
+            "debug"
+          );
+        } else {
+          credentialAdoption.pendingGeneration = credentialAdoption.generation;
+          credentialAdoption.pendingSinceMs = Date.now();
+          credentialAdoption.deferredGeneration = null;
+        }
       }
       if (opencodeAuthApplied && state.opencodeApiVersion === "v2") {
         void importOpenCodeV2CredentialsForState(state).catch(
@@ -14106,6 +15286,49 @@ async function driveChannels(state, driver) {
         }
       }
     }
+    if (credentialAdoption.pendingGeneration !== null) {
+      const activeSessions = driver.protectedSessionIds();
+      const generation = credentialAdoption.pendingGeneration;
+      if (activeSessions.size > 0) {
+        if (credentialAdoption.deferredGeneration !== generation) {
+          credentialAdoption.deferredGeneration = generation;
+          logCredentialAdoptionActivity(
+            state,
+            {
+              outcome: "deferred",
+              generation,
+              active_sessions: activeSessions.size,
+              adoption: null,
+              deferred_for_ms: null,
+              reload_status: null,
+              reload_detail: null,
+              probe_attempts: null,
+              probe_status: null,
+              probe_body_empty: null,
+              probe_detail: null
+            },
+            "warn"
+          );
+        }
+      } else {
+        const deferredForMs = credentialAdoption.deferredGeneration === generation && credentialAdoption.pendingSinceMs !== null ? Math.max(0, Date.now() - credentialAdoption.pendingSinceMs) : null;
+        credentialAdoption.pendingGeneration = null;
+        credentialAdoption.pendingSinceMs = null;
+        credentialAdoption.adoption++;
+        void adoptCredentialGeneration(
+          state,
+          generation,
+          credentialAdoption.adoption,
+          activeSessions.size,
+          deferredForMs
+        ).catch(
+          (error2) => logActivity(state, {
+            type: "error",
+            error: `CREDENTIAL-ADOPTION: adoption failed for generation ${generation} with ${activeSessions.size} active session(s) on port ${state.port}: ${error2 instanceof Error ? error2.message : String(error2)}`
+          })
+        );
+      }
+    }
     await new Promise((resolve5) => setTimeout(resolve5, CHANNEL_POLL_INTERVAL_MS));
     const cycleMs = performance.now() - cycleStartedAtMs;
     if (idleThisCycle) idleMs += cycleMs;
@@ -14119,11 +15342,20 @@ async function driveChannels(state, driver) {
       if (state.interactive) displayStatus(state);
       break;
     }
-    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3) {
+    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3 && !stayAwakeHolds()) {
       logActivity(state, { type: "info", message: "Idle timeout reached" });
       if (state.interactive) displayStatus(state);
       break;
     }
+    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3 && stayAwakeHolds()) {
+      if (!stayAwakeSuppressionLogged) {
+        stayAwakeSuppressionLogged = true;
+        logActivity(state, {
+          type: "info",
+          message: "Idle, but staying awake until the requested minimum passes"
+        });
+      }
+    }
   }
 }
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
@@ -14141,7 +15373,7 @@ function shouldWarnForReclaimSkip(reason) {
   return major > 22 || major === 22 && (minor > 13 || minor === 13 && patch >= 0);
 }
 function sessionDbPath() {
-  return join12(homedir7(), ".local", "share", "opencode", "opencode.db");
+  return join13(homedir8(), ".local", "share", "opencode", "opencode.db");
 }
 function logSessionCleanupActivity(state, phase, entry) {
   logActivity(state, {
@@ -14385,7 +15617,7 @@ function scheduleSessionCleanup(state, driver, options) {
   for (const warning2 of config.warnings) {
     logActivity(state, { type: "info", level: "warn", message: `Session cleanup: ${warning2}` });
   }
-  const dbBytes = statSessionDbBytes(homedir7());
+  const dbBytes = statSessionDbBytes(homedir8());
   void (async () => {
     const reclaimAvailability = dbBytes !== null && config.enabled ? await probeReclaimAvailability({ dbPath: sessionDbPath(), requiredBytes: dbBytes }) : null;
     if (reclaimAvailability !== null) {
@@ -14452,10 +15684,12 @@ function scheduleUsageReporting(state, params) {
   let phase = "dormant";
   let rearmRequested = false;
   const armProbe = () => {
+    if (!state.running) return;
     phase = "probe-pending";
     params.setTimer(setTimeout(() => void tick(true), params.firstDelayMs()));
   };
   const scheduleNextTick = () => {
+    if (!state.running) return;
     if (rearmRequested) {
       rearmRequested = false;
       armProbe();
@@ -14489,6 +15723,7 @@ function scheduleUsageReporting(state, params) {
     phase = "tick-in-flight";
     try {
       const usage = await params.fetchUsage();
+      if (!state.running) return;
       const result = await params.report(usage);
       if (result.ok) {
         if (consecutiveFailures > 0) {
@@ -14601,7 +15836,7 @@ function scheduleResourceUsageReporting(state, options) {
     });
     return;
   }
-  const { collect, stop } = createResourceUsageCollector(homedir7());
+  const { collect, stop } = createResourceUsageCollector(homedir8());
   state.stopResourceUsageSampling = stop;
   let consecutiveFailures = 0;
   const tick = async () => {
@@ -14627,6 +15862,7 @@ function scheduleResourceUsageReporting(state, options) {
           message: lowDiskDecision.warning
         });
       }
+      if (!state.running) return;
       const result = await reportResourceUsage(state.agentId, state.authHeader, usage);
       if (result.ok) {
         if (consecutiveFailures > 0) {
@@ -14659,7 +15895,9 @@ function scheduleResourceUsageReporting(state, options) {
         message: `Resource usage reporting failed: ${message}${failureStreakSuffix(consecutiveFailures)}`
       });
     } finally {
-      state.resourceUsageTimer = setTimeout(() => void tick(), usageReportDelayMs());
+      if (state.running) {
+        state.resourceUsageTimer = setTimeout(() => void tick(), usageReportDelayMs());
+      }
     }
   };
   state.resourceUsageTimer = setTimeout(() => void tick(), firstReportDelayMs());
@@ -14839,7 +16077,7 @@ async function run(options) {
   let fileSyncDirectories;
   try {
     logLevel = resolveLogLevel(options);
-    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir7());
+    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir8());
     if (options.restoreSessionDb && !options.sessionDbNoReplicateMarker) {
       throw new Error(
         "--restore-session-db requires --session-db-no-replicate-marker <path>; restore failures must block Litestream replication"
@@ -14862,6 +16100,8 @@ async function run(options) {
     port: options.port ?? 4096,
     conversationFilter: options.conversation ?? null,
     idleTimeout: options.idleTimeout ?? null,
+    stayAwakeSeconds: null,
+    stayAwakeUntilMs: null,
     json: options.json ?? false,
     interactive,
     logLevel,
@@ -15051,6 +16291,17 @@ async function run(options) {
     }
     spinner?.succeed(`Runner: ${validation.agent.name || state.agentId}`);
     state.agentName = validation.agent.name;
+    const requestedStayAwakeSeconds = validation.agent?.wake_stay_awake_seconds;
+    if (typeof requestedStayAwakeSeconds === "number" && Number.isFinite(requestedStayAwakeSeconds) && requestedStayAwakeSeconds > 0) {
+      state.stayAwakeSeconds = requestedStayAwakeSeconds;
+    } else if (requestedStayAwakeSeconds !== void 0 && requestedStayAwakeSeconds !== null) {
+      state.stayAwakeSeconds = null;
+      log2(
+        state,
+        `Ignoring invalid wake_stay_awake_seconds (type: ${typeof requestedStayAwakeSeconds})`,
+        "warn"
+      );
+    }
     const microvmId = process.env.MICROVM_ID?.trim();
     if (microvmId) {
       const reported = await reportMicrovmId(state.agentId, state.authHeader, microvmId);
@@ -15112,7 +16363,7 @@ async function run(options) {
     state.credentialSync?.arm();
     const dependencyInstallDiagnosticReporter = createDependencyInstallDiagnosticReporter({
       context: {
-        homeDir: homedir7(),
+        homeDir: homedir8(),
         cwd: process.cwd(),
         microvmId: process.env.MICROVM_ID?.trim(),
         euid: process.getuid?.(),
@@ -15135,7 +16386,7 @@ async function run(options) {
       dependencyInstallDiagnosticReporter
     );
     const openCodeLogTail = tailOpenCodeLogFile(
-      resolveOpenCodeLogPath(homedir7(), process.env),
+      resolveOpenCodeLogPath(homedir8(), process.env),
       openCodeActivityForwarder
     );
     state.stopOpenCodeLogTail = () => {
@@ -15210,6 +16461,44 @@ async function run(options) {
     for (const warning2 of opencodeVersionWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
     }
+    const managedSetupOptions = {
+      agentId: state.agentId,
+      apiUrl: getApiUrlConfig(),
+      getAuthHeader: () => state.authHeader,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
+      log: (message, level = "info") => logActivity(state, {
+        type: level === "error" ? "error" : "info",
+        level,
+        ...level === "error" ? { error: message } : { message }
+      })
+    };
+    let managedDiscovery = await discoverManagedInferenceSetup(managedSetupOptions);
+    if (managedDiscovery.kind === "none") {
+      managedDiscovery = await enrollManagedInferenceSetup(managedSetupOptions);
+    }
+    let managedPreparation = { kind: "none" };
+    if (managedDiscovery.kind === "failed") {
+      managedPreparation = managedDiscovery;
+      managedSetupOptions.log(`MANAGED-INFERENCE-NOT-READY: ${managedDiscovery.reason}`, "warn");
+    } else if (managedDiscovery.kind === "setup") {
+      const managedHealth = opencodeVersion === "v2" ? await checkOpenCode2Health(state.port) : await checkOpenCodeHealth(state.port);
+      managedPreparation = await prepareManagedInferenceSetup(
+        managedSetupOptions,
+        managedDiscovery,
+        managedHealth
+      );
+      if (managedPreparation.kind === "failed") {
+        managedSetupOptions.log(
+          `MANAGED-INFERENCE-NOT-READY: ${managedPreparation.reason}`,
+          "warn"
+        );
+      } else if (managedPreparation.kind === "ready") {
+        managedSetupOptions.log(
+          `MANAGED-INFERENCE-PREPARED: runner=${state.agentId} generation=${managedPreparation.generation}`,
+          "info"
+        );
+      }
+    }
     const { value: maxActiveSessions, warnings: maxActiveSessionsWarnings } = resolveMaxActiveSessions(options, process.env);
     for (const warning2 of maxActiveSessionsWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
@@ -15236,6 +16525,32 @@ async function run(options) {
       state.opencodeProcess = options.opencodePidFile ? null : oc.process;
       state.opencodeVersion = oc.version;
       state.opencodeApiVersion = opencodeVersion;
+      let configuredPlugins = [];
+      let resolvedPlugins = [];
+      try {
+        const provenanceLog = (message) => logActivity(state, { type: "info", level: "warn", message });
+        configuredPlugins = readConfiguredPluginSpecs({ log: provenanceLog });
+        resolvedPlugins = resolveInstalledPluginVersions({ log: provenanceLog });
+      } catch (error2) {
+        const kind = error2 instanceof Error ? error2.name : "unknown error";
+        logActivity(state, {
+          type: "info",
+          level: "warn",
+          message: `Could not collect OpenCode runtime provenance: ${kind}`
+        });
+      }
+      logActivity(state, {
+        type: "info",
+        level: "info",
+        message: "OpenCode runtime provenance",
+        metadata: {
+          opencode_version: state.opencodeVersion,
+          opencode_api_version: state.opencodeApiVersion,
+          configured_plugins: JSON.stringify(configuredPlugins),
+          resolved_plugins: JSON.stringify(resolvedPlugins)
+        },
+        source: "cli.runtime-provenance"
+      });
       let opencodePassword = null;
       if (opencodeVersion === "v2" && "password" in oc) {
         const value = oc.password;
@@ -15264,7 +16579,7 @@ async function run(options) {
         const provenance = checkSessionDbProvenance({
           dbPath: sessionDbPath(),
           currentVersion: state.opencodeVersion,
-          homeDir: homedir7(),
+          homeDir: homedir8(),
           env: process.env
         });
         if (provenance.anomaly) {
@@ -15278,6 +16593,30 @@ async function run(options) {
         }
       }
       state.opencodeConnected = oc.notReadyReason === null;
+      if (managedPreparation.kind === "ready" && oc.notReadyReason === null) {
+        try {
+          const acknowledgement = await acknowledgeManagedInferenceSetup(
+            managedSetupOptions,
+            managedPreparation
+          );
+          if (acknowledgement === "acknowledged") {
+            managedSetupOptions.log(
+              `MANAGED-INFERENCE-ACKNOWLEDGED: runner=${state.agentId} generation=${managedPreparation.generation}`,
+              "info"
+            );
+          } else {
+            managedSetupOptions.log(
+              `MANAGED-INFERENCE-NOT-READY: policy refresh is pending for runner=${state.agentId} generation=${managedPreparation.generation}`,
+              "warn"
+            );
+          }
+        } catch (error2) {
+          managedSetupOptions.log(
+            `MANAGED-INFERENCE-NOT-READY: ${error2 instanceof Error ? error2.message : String(error2)}`,
+            "warn"
+          );
+        }
+      }
       const version2 = state.opencodeVersion ? ` (v${state.opencodeVersion})` : "";
       ocSpinner?.succeed(`OpenCode running on port ${state.port}${version2}`);
       if (!state.interactive && oc.notReadyReason !== null) {
@@ -15294,7 +16633,7 @@ async function run(options) {
             logActivity(state, { type: "info", level: "warn", message: versionWarning });
           }
         }
-        await reloadProviderCache(state.port, state.opencodeClient ?? void 0);
+        await disposeAndReloadProviderConfig(state.port, state.opencodeClient ?? void 0);
         if (state.opencodeApiVersion === "v2" && state.opencodeClient !== null) {
           await importOpenCodeV2CredentialsForState(state);
         }
@@ -15336,7 +16675,7 @@ async function run(options) {
         let existingPid;
         if (existsSync3(options.litestreamPidFile)) {
           try {
-            const rawPid = readFileSync7(options.litestreamPidFile, "utf8").trim();
+            const rawPid = readFileSync8(options.litestreamPidFile, "utf8").trim();
             const parsedPid = Number(rawPid);
             if (/^\d+$/.test(rawPid) && Number.isSafeInteger(parsedPid) && parsedPid > 0) {
               existingPid = parsedPid;
@@ -15435,7 +16774,7 @@ async function run(options) {
       // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
       // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
-      homeDir: homedir7(),
+      homeDir: homedir8(),
       maxActiveSessions,
       log: (entry) => (
         // Thread the driver's real level straight through so `debug`/`warn`
@@ -15460,11 +16799,18 @@ async function run(options) {
         onConnected: (agentId, isReconnect, transition) => {
           state.connected = true;
           state.agentId = agentId;
-          const connectionMessage = isReconnect ? `Tunnel reconnected (runner: ${agentId}, generation: ${transition.generation}, attempt: ${transition.attempt}, offline for ${transition.downtimeMs}ms)` : `Tunnel connected (runner: ${agentId}, generation: ${transition.generation})`;
+          const connectionMessage = isReconnect ? `Tunnel reconnected (runner: ${agentId}, generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"}, attempt: ${transition.attempt}, offline for ${transition.downtimeMs}ms)` : `Tunnel connected (runner: ${agentId}, generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"})`;
           logActivity(state, {
             type: "info",
             message: connectionMessage
           });
+          if (!isReconnect && state.stayAwakeSeconds !== null && state.stayAwakeUntilMs === null) {
+            state.stayAwakeUntilMs = Date.now() + state.stayAwakeSeconds * 1e3;
+            logActivity(state, {
+              type: "info",
+              message: `Staying awake for at least ${state.stayAwakeSeconds}s as requested by the wake`
+            });
+          }
           if (options.tunnelReadyFile) {
             const marker = writeTunnelReadyMarker(options.tunnelReadyFile, agentId);
             if (marker.ok) {
@@ -15486,6 +16832,7 @@ async function run(options) {
               connected: state.opencodeConnected
             }),
             connection_generation: transition.generation,
+            ...transition.relayConnectionId !== null ? { relay_connection_id: transition.relayConnectionId } : {},
             ...isReconnect && transition.downtimeMs !== null ? {
               reconnect_attempt: transition.attempt,
               downtime_ms: transition.downtimeMs
@@ -15516,12 +16863,13 @@ async function run(options) {
           const safeReason2 = redactDiagnosticText(reason).slice(0, MAX_DISCONNECT_REASON_LENGTH);
           logActivity(state, {
             type: "info",
-            message: `Tunnel disconnected (generation: ${transition.generation}, code: ${code}, reason: ${safeReason2})`
+            message: `Tunnel disconnected (generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"}, code: ${code}, reason: ${safeReason2})`
           });
           emitAgentDisconnected(state.agentId, {
             code,
             reason: safeReason2,
-            connection_generation: transition.generation
+            connection_generation: transition.generation,
+            ...transition.relayConnectionId !== null ? { relay_connection_id: transition.relayConnectionId } : {}
           });
           if (state.interactive) displayStatus(state);
         },
@@ -15599,6 +16947,7 @@ async function run(options) {
       if (error2.message === "Unauthorized") tunnelSpinner?.fail("Unauthorized");
       throw error2;
     }
+    if (!state.running) return;
     scheduleSessionCleanup(state, channelDriver, options);
     state.claudeUsageRearm = scheduleClaudeUsageReporting(state, options);
     state.openaiUsageRearm = scheduleUsageReporting(state, {
@@ -15671,9 +17020,9 @@ program.name("evident").description("Run OpenCode locally and connect it to Evid
   "--endpoint <url>",
   "Evident API base URL (default: production; e.g. http://localhost:3001)"
 ).option("--tunnel <url>", "Tunnel WebSocket URL (default: production; e.g. ws://localhost:8787)").hook("preAction", (thisCommand) => {
-  const { endpoint, tunnel } = thisCommand.opts();
-  if (endpoint) {
-    setEndpoint(endpoint);
+  const { endpoint: endpoint2, tunnel } = thisCommand.opts();
+  if (endpoint2) {
+    setEndpoint(endpoint2);
   }
   if (tunnel) {
     setTunnelUrl(tunnel);
@@ -15747,6 +17096,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--opencode-config-overlay <path>",
   "Apply this runner-provided OpenCode config before starting OpenCode."
+).option(
+  "--auto-configure-credentials-proxy",
+  "Install Evident's generated OpenCode providers for the runner's credential pool (off by default)."
 ).option(
   "--credential-sync-marker <path>",
   "Own the interval credential sync and write this marker once the shutdown flush has finished, so the runner image's lifecycle hooks can wait on it."
@@ -15790,6 +17142,7 @@ program.command("run").description("Connect to Evident and process messages").op
       restoreSessionDb: options.restoreSessionDb,
       restoreRunnerCredentials: options.restoreRunnerCredentials,
       opencodeConfigOverlay: options.opencodeConfigOverlay,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
       credentialSyncMarker: options.credentialSyncMarker
     });
   }