@evident-ai/cli 3.6.1-dev.2fd7890 → 3.6.1-dev.391e5fd

package/README.md

@@ -125,6 +125,10 @@ Options:
 - `--opencode-config-overlay <path>` — Apply a runner-provided OpenCode config
   before starting OpenCode. Relative paths are resolved from the working directory;
   an existing `opencode.jsonc` is replaced before `opencode.json`.
+- `--auto-configure-credentials-proxy` — Install Evident's generated `evident-*`
+  OpenCode provider entries for the runner's credential pool. This is off by default;
+  without it, the CLI only delivers `EVIDENT_PROXY_TOKEN` and leaves provider
+  configuration to you.
 - `--credential-sync-marker <path>` — Own the interval credential sync and write
   this marker once the shutdown flush has finished, so the runner image's lifecycle
   hooks can wait on it.

package/dist/index.js

@@ -1442,7 +1442,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.6.1-dev.2fd7890" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.6.1-dev.391e5fd" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -5621,7 +5621,11 @@ function isSessionDbProvenanceRecord(value) {
 var OPENCODE2_PACKAGE_SPEC = "@opencode-ai/cli@0.0.0-beta-17823";
 
 // src/lib/opencode/opencode-version-gate.ts
-var QUEUE_VALIDATED_OPENCODE_VERSIONS = ["1.17.11", "1.18.3"];
+var QUEUE_VALIDATED_OPENCODE_VERSIONS = [
+  "1.17.11",
+  "1.18.3",
+  "1.18.35"
+];
 function isQueueValidatedVersion(version2) {
   if (!version2) return false;
   return QUEUE_VALIDATED_OPENCODE_VERSIONS.includes(version2);
@@ -6666,6 +6670,7 @@ function connectTunnel(options) {
     }, 3e4);
     let relaySilenceTimeout;
     let relaySilenceTimedOut = false;
+    let relayConnectionId;
     const clearRelaySilenceTimeout = () => {
       if (relaySilenceTimeout === void 0) return;
       clearTimeout(relaySilenceTimeout);
@@ -6751,7 +6756,8 @@ function connectTunnel(options) {
           armRelaySilenceTimeout();
           forwarder.setBinaryFramesSupported(message.binary_frames === true);
           const connectedAgentId = message.agent_id ?? agentId;
-          onConnected?.(connectedAgentId);
+          relayConnectionId = message.connection_id;
+          onConnected?.(connectedAgentId, relayConnectionId);
           resolve5({
             ws,
             close: () => ws.close(1e3, "CLI shutdown")
@@ -6788,7 +6794,7 @@ function connectTunnel(options) {
       clearRelaySilenceTimeout();
       const reasonStr = (relaySilenceTimedOut ? "no relay heartbeat for 90s \u2014 reconnecting" : void 0) || reason.toString() || upgradeRejection || (code === 1006 ? "abnormal closure" : "No reason provided");
       forwarder.abortAll();
-      onDisconnected?.(code, reasonStr);
+      onDisconnected?.(code, reasonStr, relayConnectionId);
     });
   });
 }
@@ -6851,7 +6857,7 @@ var RunnerConnection = class _RunnerConnection {
           authHeader: this.opts.getAuthHeader(),
           port: this.opts.port,
           openCodePassword: this.opts.openCodePassword,
-          onConnected: (agentId) => {
+          onConnected: (agentId, relayConnectionId) => {
             const attempt = this.reconnectAttempt + 1;
             this.reconnectAttempt = 0;
             this.reconnecting = false;
@@ -6861,13 +6867,17 @@ var RunnerConnection = class _RunnerConnection {
             this.disconnectedAtMs = null;
             events.onConnected(agentId, isReconnect, {
               generation: this.generation,
+              relayConnectionId: relayConnectionId ?? null,
               attempt,
               downtimeMs
             });
           },
-          onDisconnected: (code, reason) => {
+          onDisconnected: (code, reason, relayConnectionId) => {
             this.disconnectedAtMs = this.now();
-            events.onDisconnected(code, reason, { generation: this.generation });
+            events.onDisconnected(code, reason, {
+              generation: this.generation,
+              relayConnectionId: relayConnectionId ?? null
+            });
             const relayRequestedReconnect = code === 1e3 && _RunnerConnection.RELAY_RECONNECT_CLOSE_REASONS.has(reason);
             if (this.opts.isRunning() && (code !== 1e3 || relayRequestedReconnect) && !this.reconnecting) {
               this.reconnectPromise = this.connectWithRetry(true).catch((err) => {
@@ -13910,22 +13920,6 @@ function mergeManagedOpenCodeConfigContent(content, managedProviders) {
   }
   return JSON.stringify({ ...config, provider: { ...provider, ...managedProviders } });
 }
-function removeManagedOpenCodeConfigContent(content) {
-  if (!content?.trim()) return content;
-  const config = parseConfigContent(content);
-  if (typeof config.provider !== "object" || config.provider === null || Array.isArray(config.provider)) {
-    return content;
-  }
-  const provider = { ...config.provider };
-  let changed = false;
-  for (const namespace of CREDENTIAL_PROXY_NATIVE_NAMESPACES) {
-    if (namespace in provider) {
-      delete provider[namespace];
-      changed = true;
-    }
-  }
-  return changed ? JSON.stringify({ ...config, provider }) : content;
-}
 function isFile(filePath) {
   return existsSync2(filePath) && statSync6(filePath).isFile();
 }
@@ -14387,7 +14381,7 @@ async function responseJson(response) {
 function readSetup(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
   const setup = value;
-  if (typeof setup.runner_id !== "string" || typeof setup.generation !== "string" || typeof setup.status !== "string" || setup.token_id !== null && typeof setup.token_id !== "string") {
+  if (typeof setup.runner_id !== "string" || typeof setup.generation !== "string" || typeof setup.status !== "string" || setup.token_id !== null && typeof setup.token_id !== "string" || typeof setup.acknowledged_at !== "string" && setup.acknowledged_at !== null) {
     return null;
   }
   return setup;
@@ -14396,16 +14390,6 @@ function clearLocalSetup(options) {
   const env = options.env ?? process.env;
   (options.store ?? defaultStore).clear(options.agentId);
   delete env.EVIDENT_PROXY_TOKEN;
-  try {
-    const content = removeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT);
-    if (content === void 0) delete env.OPENCODE_CONFIG_CONTENT;
-    else env.OPENCODE_CONFIG_CONTENT = content;
-  } catch (error2) {
-    options.log(
-      "MANAGED-INFERENCE-CLEANUP-PARTIAL: stored credentials were removed, but malformed OPENCODE_CONFIG_CONTENT could not be inspected",
-      "warn"
-    );
-  }
 }
 async function discoverManagedInferenceSetup(options) {
   const headers = requestHeaders(options);
@@ -14429,6 +14413,25 @@ async function discoverManagedInferenceSetup(options) {
   const setup = readSetup(body?.setup);
   return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed setup discovery returned an invalid response" };
 }
+async function enrollManagedInferenceSetup(options) {
+  const response = await post(options, "enroll", {});
+  if (!response) {
+    return { kind: "failed", reason: safeFailure("Managed credential enrollment") };
+  }
+  if (response.status === 404) {
+    return { kind: "none" };
+  }
+  const body = await responseJson(response);
+  if (!response.ok) {
+    const serverError = body?.error;
+    return {
+      kind: "failed",
+      reason: typeof serverError === "string" && serverError.trim() ? redactDiagnosticText(serverError).slice(0, 500) : safeFailure("Managed credential enrollment", response.status)
+    };
+  }
+  const setup = readSetup(body?.setup);
+  return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed credential enrollment returned an invalid response" };
+}
 async function post(options, operation, body) {
   const headers = requestHeaders(options);
   try {
@@ -14443,31 +14446,37 @@ async function post(options, operation, body) {
   }
 }
 function applyCredential(options, credential) {
-  const { config, unsupportedProviders } = buildCredentialProxyNativeConfig({
-    inferenceBaseUrl: credential.inferenceBaseUrl,
-    modelDescriptors: credential.modelDescriptors
-  });
-  if (unsupportedProviders.length > 0 || Object.keys(config.provider).length === 0) {
-    return "Managed setup contains unsupported provider descriptors";
-  }
   const env = options.env ?? process.env;
   let merged;
-  try {
-    merged = mergeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT, config.provider);
-  } catch (error2) {
-    return "OPENCODE_CONFIG_CONTENT is malformed; managed providers were not installed";
+  if (options.autoConfigureCredentialsProxy) {
+    const { config, unsupportedProviders } = buildCredentialProxyNativeConfig({
+      inferenceBaseUrl: credential.inferenceBaseUrl,
+      modelDescriptors: credential.modelDescriptors
+    });
+    if (unsupportedProviders.length > 0 || Object.keys(config.provider).length === 0) {
+      return "Managed setup contains unsupported provider descriptors";
+    }
+    try {
+      merged = mergeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT, config.provider);
+    } catch (error2) {
+      return "OPENCODE_CONFIG_CONTENT is malformed; managed providers were not installed";
+    }
   }
   try {
     (options.store ?? defaultStore).set(options.agentId, credential);
   } catch (error2) {
+    const detail = (error2 instanceof Error ? error2.message : String(error2)).replaceAll(
+      credential.token,
+      "[redacted]"
+    );
     options.log(
-      `MANAGED-INFERENCE-STORE-FAILED: runner=${options.agentId} generation=${credential.generation}`,
+      `MANAGED-INFERENCE-STORE-FAILED: runner=${options.agentId} generation=${credential.generation} detail=${redactDiagnosticText(detail)}`,
       "warn"
     );
     return "Managed credentials could not be written to the protected store";
   }
   env.EVIDENT_PROXY_TOKEN = credential.token;
-  env.OPENCODE_CONFIG_CONTENT = merged;
+  if (merged !== void 0) env.OPENCODE_CONFIG_CONTENT = merged;
   return null;
 }
 async function reportManagedInferenceApplyFailure(options, failure) {
@@ -14518,7 +14527,7 @@ async function prepareManagedInferenceSetup(options, discovery, health) {
     }
     return reaffirmStored(options, stored);
   }
-  if (discovery.setup.status === "acknowledged" && stored?.generation === discovery.setup.generation && stored.tokenId === discovery.setup.token_id) {
+  if (discovery.setup.acknowledged_at !== null && stored?.generation === discovery.setup.generation && stored.tokenId === discovery.setup.token_id) {
     return reaffirmStored(options, stored);
   }
   const response = await post(options, "bootstrap", { generation: discovery.setup.generation });
@@ -14556,7 +14565,7 @@ async function acknowledgeManagedInferenceSetup(options, preparation) {
   const response = await post(options, "acknowledge", {
     generation: preparation.generation,
     token_id: preparation.tokenId,
-    config_validated: true
+    config_validated: options.autoConfigureCredentialsProxy === true
   });
   if (!response?.ok) {
     throw new Error(
@@ -16359,13 +16368,17 @@ async function run(options) {
       agentId: state.agentId,
       apiUrl: getApiUrlConfig(),
       getAuthHeader: () => state.authHeader,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
       log: (message, level = "info") => logActivity(state, {
         type: level === "error" ? "error" : "info",
         level,
         ...level === "error" ? { error: message } : { message }
       })
     };
-    const managedDiscovery = await discoverManagedInferenceSetup(managedSetupOptions);
+    let managedDiscovery = await discoverManagedInferenceSetup(managedSetupOptions);
+    if (managedDiscovery.kind === "none") {
+      managedDiscovery = await enrollManagedInferenceSetup(managedSetupOptions);
+    }
     let managedPreparation = { kind: "none" };
     if (managedDiscovery.kind === "failed") {
       managedPreparation = managedDiscovery;
@@ -16689,7 +16702,7 @@ async function run(options) {
         onConnected: (agentId, isReconnect, transition) => {
           state.connected = true;
           state.agentId = agentId;
-          const connectionMessage = isReconnect ? `Tunnel reconnected (runner: ${agentId}, generation: ${transition.generation}, attempt: ${transition.attempt}, offline for ${transition.downtimeMs}ms)` : `Tunnel connected (runner: ${agentId}, generation: ${transition.generation})`;
+          const connectionMessage = isReconnect ? `Tunnel reconnected (runner: ${agentId}, generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"}, attempt: ${transition.attempt}, offline for ${transition.downtimeMs}ms)` : `Tunnel connected (runner: ${agentId}, generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"})`;
           logActivity(state, {
             type: "info",
             message: connectionMessage
@@ -16722,6 +16735,7 @@ async function run(options) {
               connected: state.opencodeConnected
             }),
             connection_generation: transition.generation,
+            ...transition.relayConnectionId !== null ? { relay_connection_id: transition.relayConnectionId } : {},
             ...isReconnect && transition.downtimeMs !== null ? {
               reconnect_attempt: transition.attempt,
               downtime_ms: transition.downtimeMs
@@ -16752,12 +16766,13 @@ async function run(options) {
           const safeReason2 = redactDiagnosticText(reason).slice(0, MAX_DISCONNECT_REASON_LENGTH);
           logActivity(state, {
             type: "info",
-            message: `Tunnel disconnected (generation: ${transition.generation}, code: ${code}, reason: ${safeReason2})`
+            message: `Tunnel disconnected (generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"}, code: ${code}, reason: ${safeReason2})`
           });
           emitAgentDisconnected(state.agentId, {
             code,
             reason: safeReason2,
-            connection_generation: transition.generation
+            connection_generation: transition.generation,
+            ...transition.relayConnectionId !== null ? { relay_connection_id: transition.relayConnectionId } : {}
           });
           if (state.interactive) displayStatus(state);
         },
@@ -16984,6 +16999,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--opencode-config-overlay <path>",
   "Apply this runner-provided OpenCode config before starting OpenCode."
+).option(
+  "--auto-configure-credentials-proxy",
+  "Install Evident's generated OpenCode providers for the runner's credential pool (off by default)."
 ).option(
   "--credential-sync-marker <path>",
   "Own the interval credential sync and write this marker once the shutdown flush has finished, so the runner image's lifecycle hooks can wait on it."
@@ -17027,6 +17045,7 @@ program.command("run").description("Connect to Evident and process messages").op
       restoreSessionDb: options.restoreSessionDb,
       restoreRunnerCredentials: options.restoreRunnerCredentials,
       opencodeConfigOverlay: options.opencodeConfigOverlay,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
       credentialSyncMarker: options.credentialSyncMarker
     });
   }