@evident-ai/cli 3.6.1-dev.37d1a87 → 3.6.1-dev.409b23d

package/dist/index.js

@@ -100,6 +100,26 @@ function clearCredentials() {
   credentials.set("byEndpoint", byEndpoint);
   hardenCredentialsPermissions();
 }
+function getManagedInferenceCredential(runnerId) {
+  hardenCredentialsPermissions();
+  return credentials.get("managedInferenceByEndpoint")?.[credentialsKey()]?.[runnerId];
+}
+function setManagedInferenceCredential(runnerId, credential) {
+  const byEndpoint = credentials.get("managedInferenceByEndpoint") ?? {};
+  byEndpoint[credentialsKey()] ??= {};
+  byEndpoint[credentialsKey()][runnerId] = credential;
+  credentials.set("managedInferenceByEndpoint", byEndpoint);
+  hardenCredentialsPermissions();
+}
+function clearManagedInferenceCredential(runnerId) {
+  const byEndpoint = credentials.get("managedInferenceByEndpoint") ?? {};
+  const runners = byEndpoint[credentialsKey()];
+  if (!runners || !(runnerId in runners)) return;
+  delete runners[runnerId];
+  if (Object.keys(runners).length === 0) delete byEndpoint[credentialsKey()];
+  credentials.set("managedInferenceByEndpoint", byEndpoint);
+  hardenCredentialsPermissions();
+}
 function clearAllCredentials() {
   credentials.clear();
   hardenCredentialsPermissions();
@@ -119,13 +139,13 @@ function getCliName() {
 // src/lib/api.ts
 async function request(path, method, body, headers = {}) {
   const url = `${getApiUrlConfig()}${path}`;
-  const requestHeaders = {
+  const requestHeaders2 = {
     "Content-Type": "application/json",
     ...headers
   };
   const response = await fetch(url, {
     method,
-    headers: requestHeaders,
+    headers: requestHeaders2,
     body: body ? JSON.stringify(body) : void 0
   });
   if (!response.ok) {
@@ -1287,6 +1307,102 @@ var TUNNEL_USAGE_REARM_PING_PATH = "/__evident/usage-rearm";
 var MAX_FILE_PUSH_BYTES = 64 * 1024;
 var MAX_FILE_SYNC_DIRECTORIES = 16;
 
+// ../../packages/types/src/credential-proxy-native-config.ts
+var EVIDENT_PROXY_TOKEN_REFERENCE = "{env:EVIDENT_PROXY_TOKEN}";
+var CLAUDE_PROVIDER = {
+  namespace: "evident-claude",
+  name: "Evident Claude credential proxy",
+  npm: "@ai-sdk/anthropic"
+};
+var NATIVE_PROVIDERS = {
+  claude: CLAUDE_PROVIDER,
+  anthropic: CLAUDE_PROVIDER,
+  codex: {
+    namespace: "evident-codex",
+    name: "Evident Codex credential proxy",
+    npm: "@ai-sdk/openai"
+  },
+  openai: {
+    namespace: "evident-openai",
+    name: "Evident OpenAI credential proxy",
+    npm: "@ai-sdk/openai"
+  },
+  kimi: {
+    namespace: "evident-kimi",
+    name: "Evident Kimi credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-kimi"
+  },
+  antigravity: {
+    namespace: "evident-antigravity",
+    name: "Evident Antigravity credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-antigravity"
+  },
+  xai: {
+    namespace: "evident-xai",
+    name: "Evident xAI credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-xai"
+  },
+  mistral: {
+    namespace: "evident-mistral",
+    name: "Evident Mistral credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-mistral"
+  }
+};
+var CREDENTIAL_PROXY_NATIVE_NAMESPACES = [
+  ...new Set(Object.values(NATIVE_PROVIDERS).map(({ namespace }) => namespace))
+];
+function credentialProxyInferenceUrl(baseUrl) {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  return /\/v1$/i.test(trimmed) ? trimmed : `${trimmed}/v1`;
+}
+function buildCredentialProxyNativeConfig({
+  inferenceBaseUrl,
+  modelDescriptors
+}) {
+  const baseURL = credentialProxyInferenceUrl(inferenceBaseUrl);
+  const providers = {};
+  const unsupportedProviders = /* @__PURE__ */ new Set();
+  for (const descriptor of modelDescriptors) {
+    const definition = NATIVE_PROVIDERS[descriptor.provider.trim().toLowerCase()];
+    if (!definition) {
+      unsupportedProviders.add(descriptor.provider.trim() || descriptor.provider);
+      continue;
+    }
+    providers[definition.namespace] ??= definition.npm === "@ai-sdk/anthropic" ? {
+      name: definition.name,
+      npm: definition.npm,
+      options: { baseURL, authToken: EVIDENT_PROXY_TOKEN_REFERENCE },
+      models: {}
+    } : definition.npm === "@ai-sdk/openai" ? {
+      name: definition.name,
+      npm: definition.npm,
+      options: { baseURL, apiKey: EVIDENT_PROXY_TOKEN_REFERENCE },
+      models: {}
+    } : {
+      name: definition.name,
+      npm: definition.npm,
+      options: {
+        name: definition.sdkName,
+        baseURL,
+        apiKey: EVIDENT_PROXY_TOKEN_REFERENCE
+      },
+      models: {}
+    };
+    providers[definition.namespace].models[descriptor.id] = { name: descriptor.id };
+  }
+  return {
+    unsupportedProviders: [...unsupportedProviders],
+    config: {
+      $schema: "https://opencode.ai/config.json",
+      provider: providers
+    }
+  };
+}
+
 // ../../packages/types/src/logging/index.ts
 var CORRELATION_ID_HEADER = "x-evident-correlation-id";
 var FORWARD_FAILURE_REASON_HEADER = "X-Evident-Failure-Reason";
@@ -1326,7 +1442,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.6.1-dev.37d1a87" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.6.1-dev.409b23d" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -1407,7 +1523,7 @@ async function flushEvents() {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), FLUSH_TIMEOUT_MS);
     try {
-      const request2 = {
+      const request3 = {
         events,
         client_type: "cli",
         client_version: CLI_VERSION
@@ -1418,7 +1534,7 @@ async function flushEvents() {
           "Content-Type": "application/json",
           Authorization: authHeader
         },
-        body: JSON.stringify(request2),
+        body: JSON.stringify(request3),
         signal: controller.signal
       });
       if (!response.ok) {
@@ -3093,6 +3209,52 @@ async function getModelAttachmentCapability(port, model, client) {
     return null;
   }
 }
+async function isPinnedProviderLoaded(port, model, client) {
+  if (client?.version === "v2") return null;
+  const { model: baseModel } = splitModelVariant(model);
+  if (!baseModel) return null;
+  const slash = baseModel.indexOf("/");
+  if (slash <= 0) return null;
+  const providerId = baseModel.slice(0, slash);
+  try {
+    const res = await requestWithClient(port, client, "/config/providers");
+    if (!res.ok) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers returned HTTP ${res.status} (port ${port})`
+      );
+      return null;
+    }
+    const body = await res.json();
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers body was not a plain object (port ${port})`
+      );
+      return null;
+    }
+    const providers = body.providers;
+    if (!Array.isArray(providers)) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers body had no providers array (port ${port})`
+      );
+      return null;
+    }
+    const providerIds = providers.filter(
+      (provider) => provider !== null && typeof provider === "object" && typeof provider.id === "string"
+    ).map((provider) => provider.id);
+    if (providerIds.length === 0) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers had no provider entries with string ids (port ${port})`
+      );
+      return null;
+    }
+    return providerIds.includes(providerId);
+  } catch (err) {
+    console.error(
+      `[isPinnedProviderLoaded] GET /config/providers failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+    );
+    return null;
+  }
+}
 async function buildFileParts(attachments, capable) {
   const outcomes = [];
   const parts = [];
@@ -4681,11 +4843,11 @@ function failureMessage(status2) {
 function isRetryableStatus(status2) {
   return CONNECT_KEY_RETRY_STATUSES.includes(status2);
 }
-async function importOneCredential(request2, credential, sleepForRetry, log3) {
+async function importOneCredential(request3, credential, sleepForRetry, log3) {
   const path = `/api/integration/${encodeURIComponent(credential.integrationId)}/connect/key`;
   for (let attempt = 1; attempt <= CONNECT_KEY_MAX_ATTEMPTS; attempt += 1) {
     try {
-      const response = await request2(
+      const response = await request3(
         path,
         {
           method: "POST",
@@ -4720,7 +4882,7 @@ async function importOneCredential(request2, credential, sleepForRetry, log3) {
   throw new Error("OpenCode credential import retry loop did not return");
 }
 async function importOpenCodeCredentials({
-  request: request2,
+  request: request3,
   classified,
   connectedIntegrationIds,
   sleepForRetry = sleep2,
@@ -4732,7 +4894,7 @@ async function importOpenCodeCredentials({
       result.alreadyConnected.push(credential.integrationId);
       continue;
     }
-    const outcome = await importOneCredential(request2, credential, sleepForRetry, log3);
+    const outcome = await importOneCredential(request3, credential, sleepForRetry, log3);
     if (outcome.ok) result.imported.push(credential.integrationId);
     else result.failed.push(outcome.failure);
   }
@@ -4750,7 +4912,7 @@ function parseIntegrationList(value) {
   return { integrationIds, hasData: value.data.length > 0 };
 }
 async function getConnectedOpenCodeIntegrationIds({
-  request: request2,
+  request: request3,
   directory,
   sleepForRetry = sleep2,
   log: log3
@@ -4758,7 +4920,7 @@ async function getConnectedOpenCodeIntegrationIds({
   const path = `/api/integration?location%5Bdirectory%5D=${encodeURIComponent(directory)}`;
   for (let attempt = 1; attempt <= INTEGRATION_LIST_MAX_READS; attempt += 1) {
     try {
-      const response = await request2(path);
+      const response = await request3(path);
       const parsed = parseIntegrationList(await response.json());
       if (parsed === null) {
         log3(
@@ -4787,7 +4949,7 @@ async function getConnectedOpenCodeIntegrationIds({
   return null;
 }
 async function importOpenCodeV2Credentials({
-  request: request2,
+  request: request3,
   homeDir,
   directory,
   sleepForRetry = sleep2,
@@ -4805,7 +4967,7 @@ async function importOpenCodeV2Credentials({
     const classified = classifyOpenCodeCredentials(credentials2);
     if (classified.importable.length === 0) return emptyResult(classified.unsupported);
     const connectedIntegrationIds = await getConnectedOpenCodeIntegrationIds({
-      request: request2,
+      request: request3,
       directory,
       sleepForRetry,
       log: log3
@@ -4814,7 +4976,7 @@ async function importOpenCodeV2Credentials({
       return emptyResult(classified.unsupported, "connection-list-unavailable");
     }
     return importOpenCodeCredentials({
-      request: request2,
+      request: request3,
       classified,
       connectedIntegrationIds,
       sleepForRetry,
@@ -5505,7 +5667,11 @@ function isSessionDbProvenanceRecord(value) {
 var OPENCODE2_PACKAGE_SPEC = "@opencode-ai/cli@0.0.0-beta-17823";
 
 // src/lib/opencode/opencode-version-gate.ts
-var QUEUE_VALIDATED_OPENCODE_VERSIONS = ["1.17.11", "1.18.3"];
+var QUEUE_VALIDATED_OPENCODE_VERSIONS = [
+  "1.17.11",
+  "1.18.3",
+  "1.18.35"
+];
 function isQueueValidatedVersion(version2) {
   if (!version2) return false;
   return QUEUE_VALIDATED_OPENCODE_VERSIONS.includes(version2);
@@ -6550,6 +6716,7 @@ function connectTunnel(options) {
     }, 3e4);
     let relaySilenceTimeout;
     let relaySilenceTimedOut = false;
+    let relayConnectionId;
     const clearRelaySilenceTimeout = () => {
       if (relaySilenceTimeout === void 0) return;
       clearTimeout(relaySilenceTimeout);
@@ -6635,7 +6802,8 @@ function connectTunnel(options) {
           armRelaySilenceTimeout();
           forwarder.setBinaryFramesSupported(message.binary_frames === true);
           const connectedAgentId = message.agent_id ?? agentId;
-          onConnected?.(connectedAgentId);
+          relayConnectionId = message.connection_id;
+          onConnected?.(connectedAgentId, relayConnectionId);
           resolve5({
             ws,
             close: () => ws.close(1e3, "CLI shutdown")
@@ -6672,7 +6840,7 @@ function connectTunnel(options) {
       clearRelaySilenceTimeout();
       const reasonStr = (relaySilenceTimedOut ? "no relay heartbeat for 90s \u2014 reconnecting" : void 0) || reason.toString() || upgradeRejection || (code === 1006 ? "abnormal closure" : "No reason provided");
       forwarder.abortAll();
-      onDisconnected?.(code, reasonStr);
+      onDisconnected?.(code, reasonStr, relayConnectionId);
     });
   });
 }
@@ -6735,7 +6903,7 @@ var RunnerConnection = class _RunnerConnection {
           authHeader: this.opts.getAuthHeader(),
           port: this.opts.port,
           openCodePassword: this.opts.openCodePassword,
-          onConnected: (agentId) => {
+          onConnected: (agentId, relayConnectionId) => {
             const attempt = this.reconnectAttempt + 1;
             this.reconnectAttempt = 0;
             this.reconnecting = false;
@@ -6745,13 +6913,17 @@ var RunnerConnection = class _RunnerConnection {
             this.disconnectedAtMs = null;
             events.onConnected(agentId, isReconnect, {
               generation: this.generation,
+              relayConnectionId: relayConnectionId ?? null,
               attempt,
               downtimeMs
             });
           },
-          onDisconnected: (code, reason) => {
+          onDisconnected: (code, reason, relayConnectionId) => {
             this.disconnectedAtMs = this.now();
-            events.onDisconnected(code, reason, { generation: this.generation });
+            events.onDisconnected(code, reason, {
+              generation: this.generation,
+              relayConnectionId: relayConnectionId ?? null
+            });
             const relayRequestedReconnect = code === 1e3 && _RunnerConnection.RELAY_RECONNECT_CLOSE_REASONS.has(reason);
             if (this.opts.isRunning() && (code !== 1e3 || relayRequestedReconnect) && !this.reconnecting) {
               this.reconnectPromise = this.connectWithRetry(true).catch((err) => {
@@ -7199,8 +7371,8 @@ import { chmod, mkdir, open as open3, realpath, rename, unlink } from "node:fs/p
 import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join9, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
-async function writePushedFile(request2) {
-  const { requestedPath, content, allowedDirectories, homeDir } = request2;
+async function writePushedFile(request3) {
+  const { requestedPath, content, allowedDirectories, homeDir } = request3;
   const bytes = content.byteLength;
   if (allowedDirectories.length === 0) {
     return refuse("file_sync_disabled", "File sync is not enabled on this runner.", {
@@ -8596,6 +8768,47 @@ var ChannelDriver = class _ChannelDriver {
         agent: message.opencode_agent ?? void 0,
         model: message.opencode_model ?? void 0
       };
+      const pinnedProviderLoaded = await isPinnedProviderLoaded(
+        this.port,
+        options.model,
+        this.openCodeClient
+      );
+      if (pinnedProviderLoaded === false) {
+        const dispatchedModel = message.opencode_model;
+        const separator = dispatchedModel?.indexOf("/") ?? -1;
+        const hasProviderAndModel = dispatchedModel !== null && separator > 0 && separator < dispatchedModel.length - 1;
+        const providerId = hasProviderAndModel ? dispatchedModel.slice(0, separator) : null;
+        const modelId = hasProviderAndModel ? dispatchedModel.slice(separator + 1) : null;
+        const errorMessage3 = `Provider namespace not loaded on this runner: ${message.opencode_model}. Refused before dispatch; no turn was started.`;
+        this.log({
+          level: "error",
+          message: `Refusing message ${message.id.slice(0, 8)} in conversation ${conv.id.slice(0, 8)}: provider namespace ${providerId ?? "(unknown)"} is not loaded; no turn was started`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        try {
+          await this.markFailed(conv.id, message.id, sessionId, errorMessage3, void 0, {
+            classification: {
+              kind: "model_auth",
+              providerId,
+              modelId,
+              reason: "missing"
+            },
+            errorShape: { name: null, statusCode: null }
+          });
+          this.signalDispatchNotStarted(conv, message, "model_provider_absent");
+        } catch (markErr) {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for refused message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed: ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          this.signalDispatchNotStarted(conv, message, "failure_unreported");
+        }
+        await this.repairProviderRegistry(conv.id, message.id);
+        break;
+      }
       let opencodeMessageId;
       let preDispatchUserIds = null;
       try {
@@ -13778,6 +13991,22 @@ async function configureGitHubAccess({ env, log: log3 }) {
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { copyFileSync, existsSync as existsSync2, statSync as statSync6 } from "node:fs";
 import { isAbsolute as isAbsolute3, join as join11, resolve as resolve4 } from "node:path";
+function parseConfigContent(content) {
+  if (!content?.trim()) return {};
+  const parsed = JSON.parse(content);
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("OPENCODE_CONFIG_CONTENT must contain a JSON object");
+  }
+  return parsed;
+}
+function mergeManagedOpenCodeConfigContent(content, managedProviders) {
+  const config = parseConfigContent(content);
+  const provider = typeof config.provider === "object" && config.provider !== null && !Array.isArray(config.provider) ? { ...config.provider } : {};
+  for (const namespace of CREDENTIAL_PROXY_NATIVE_NAMESPACES) {
+    delete provider[namespace];
+  }
+  return JSON.stringify({ ...config, provider: { ...provider, ...managedProviders } });
+}
 function isFile(filePath) {
   return existsSync2(filePath) && statSync6(filePath).isFile();
 }
@@ -14199,6 +14428,255 @@ function createCredentialSync({
   };
 }
 
+// src/lib/managed-inference-setup.ts
+var defaultStore = {
+  get: getManagedInferenceCredential,
+  set: setManagedInferenceCredential,
+  clear: clearManagedInferenceCredential
+};
+function endpoint(options, operation) {
+  return `${options.apiUrl}/runners/${options.agentId}/managed-credentials/${operation}`;
+}
+function requestHeaders(options) {
+  return { Authorization: options.getAuthHeader(), "Content-Type": "application/json" };
+}
+function request2(options) {
+  return withRequestTimeout(options.fetchImpl ?? fetch, REQUEST_TIMEOUT_MS);
+}
+function safeFailure(operation, status2) {
+  return status2 === void 0 ? `${operation} could not reach the managed credential service` : `${operation} returned HTTP ${status2}`;
+}
+function logTransportFailure(options, operation, error2, authorization) {
+  let detail = error2 instanceof Error ? error2.message : String(error2);
+  const credential = authorization.split(/\s+/, 2)[1];
+  for (const secret of [authorization, credential]) {
+    if (secret) detail = detail.replaceAll(secret, "[redacted]");
+  }
+  options.log(
+    `MANAGED-INFERENCE-TRANSPORT-FAILED: operation=${operation} detail=${redactDiagnosticText(detail)}`,
+    "debug"
+  );
+}
+async function responseJson(response) {
+  try {
+    const value = await response.json();
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  } catch (error2) {
+    return null;
+  }
+}
+function readSetup(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const setup = value;
+  if (typeof setup.runner_id !== "string" || typeof setup.generation !== "string" || typeof setup.status !== "string" || setup.token_id !== null && typeof setup.token_id !== "string" || typeof setup.acknowledged_at !== "string" && setup.acknowledged_at !== null) {
+    return null;
+  }
+  return setup;
+}
+function clearLocalSetup(options) {
+  const env = options.env ?? process.env;
+  const store = options.store ?? defaultStore;
+  const stored = store.get(options.agentId);
+  store.clear(options.agentId);
+  const token = env.EVIDENT_PROXY_TOKEN;
+  if (token !== void 0 && token === stored?.token) {
+    delete env.EVIDENT_PROXY_TOKEN;
+  } else if (token !== void 0) {
+    options.log(
+      `MANAGED-INFERENCE-CLEANUP-PRESERVED-EXTERNAL-TOKEN: runner=${options.agentId}`,
+      "debug"
+    );
+  }
+}
+async function discoverManagedInferenceSetup(options) {
+  const headers = requestHeaders(options);
+  let response;
+  try {
+    response = await request2(options)(endpoint(options, "current"), {
+      headers
+    });
+  } catch (error2) {
+    logTransportFailure(options, "discovery", error2, headers.Authorization);
+    return { kind: "failed", reason: safeFailure("Managed setup discovery") };
+  }
+  if (response.status === 404) {
+    clearLocalSetup(options);
+    return { kind: "none" };
+  }
+  if (!response.ok) {
+    return { kind: "failed", reason: safeFailure("Managed setup discovery", response.status) };
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed setup discovery returned an invalid response" };
+}
+async function enrollManagedInferenceSetup(options) {
+  const response = await post(options, "enroll", {});
+  if (!response) {
+    return { kind: "failed", reason: safeFailure("Managed credential enrollment") };
+  }
+  if (response.status === 404) {
+    return { kind: "none" };
+  }
+  const body = await responseJson(response);
+  if (!response.ok) {
+    const serverError = body?.error;
+    return {
+      kind: "failed",
+      reason: typeof serverError === "string" && serverError.trim() ? redactDiagnosticText(serverError).slice(0, 500) : safeFailure("Managed credential enrollment", response.status)
+    };
+  }
+  const setup = readSetup(body?.setup);
+  return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed credential enrollment returned an invalid response" };
+}
+async function post(options, operation, body) {
+  const headers = requestHeaders(options);
+  try {
+    return await request2(options)(endpoint(options, operation), {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+  } catch (error2) {
+    logTransportFailure(options, operation, error2, headers.Authorization);
+    return null;
+  }
+}
+function applyCredential(options, credential) {
+  const env = options.env ?? process.env;
+  let merged;
+  if (options.autoConfigureCredentialsProxy) {
+    const { config, unsupportedProviders } = buildCredentialProxyNativeConfig({
+      inferenceBaseUrl: credential.inferenceBaseUrl,
+      modelDescriptors: credential.modelDescriptors
+    });
+    if (unsupportedProviders.length > 0 || Object.keys(config.provider).length === 0) {
+      return "Managed setup contains unsupported provider descriptors";
+    }
+    try {
+      merged = mergeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT, config.provider);
+    } catch (error2) {
+      return "OPENCODE_CONFIG_CONTENT is malformed; managed providers were not installed";
+    }
+  }
+  try {
+    (options.store ?? defaultStore).set(options.agentId, credential);
+  } catch (error2) {
+    const detail = (error2 instanceof Error ? error2.message : String(error2)).replaceAll(
+      credential.token,
+      "[redacted]"
+    );
+    options.log(
+      `MANAGED-INFERENCE-STORE-FAILED: runner=${options.agentId} generation=${credential.generation} detail=${redactDiagnosticText(detail)}`,
+      "warn"
+    );
+    return "Managed credentials could not be written to the protected store";
+  }
+  env.EVIDENT_PROXY_TOKEN = credential.token;
+  if (merged !== void 0) env.OPENCODE_CONFIG_CONTENT = merged;
+  return null;
+}
+async function reportManagedInferenceApplyFailure(options, failure) {
+  const response = await post(options, "report-failure", {
+    generation: failure.generation,
+    token_id: failure.tokenId
+  });
+  if (!response?.ok) {
+    options.log(
+      `MANAGED-INFERENCE-REPORT-FAILED: runner=${options.agentId} generation=${failure.generation}${response ? ` status=${response.status}` : ""}`,
+      "warn"
+    );
+  }
+}
+async function reaffirmStored(options, credential) {
+  const response = await post(options, "reaffirm", {
+    generation: credential.generation,
+    token_id: credential.tokenId
+  });
+  if (!response?.ok) {
+    return {
+      kind: "failed",
+      reason: response?.status === 409 ? "Stored managed credential no longer matches this setup; restart required" : response ? safeFailure("Managed credential reaffirmation", response.status) : safeFailure("Managed credential reaffirmation")
+    };
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  if (!setup || setup.generation !== credential.generation || setup.token_id !== credential.tokenId) {
+    return { kind: "failed", reason: "Managed credential reaffirmation returned a mismatch" };
+  }
+  const failure = applyCredential(options, credential);
+  return failure ? { kind: "failed", reason: failure } : { kind: "ready", generation: credential.generation, tokenId: credential.tokenId };
+}
+async function prepareManagedInferenceSetup(options, discovery, health) {
+  if (health.authFailed) {
+    return {
+      kind: "failed",
+      reason: "OpenCode authentication failed; managed credentials were not rotated"
+    };
+  }
+  const stored = (options.store ?? defaultStore).get(options.agentId);
+  if (health.healthy) {
+    if (!stored) {
+      return {
+        kind: "failed",
+        reason: "Managed credentials are missing for the serving OpenCode process; restart required"
+      };
+    }
+    return reaffirmStored(options, stored);
+  }
+  if (discovery.setup.acknowledged_at !== null && stored?.generation === discovery.setup.generation && stored.tokenId === discovery.setup.token_id) {
+    return reaffirmStored(options, stored);
+  }
+  const response = await post(options, "bootstrap", { generation: discovery.setup.generation });
+  if (!response?.ok) {
+    return {
+      kind: "failed",
+      reason: response ? safeFailure("Managed credential bootstrap", response.status) : safeFailure("Managed credential bootstrap")
+    };
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  const token = body?.inference_token;
+  const inferenceBaseUrl = body?.inference_base_url;
+  const modelDescriptors = body?.model_descriptors;
+  if (!setup || setup.generation !== discovery.setup.generation || typeof setup.token_id !== "string" || typeof token !== "string" || typeof inferenceBaseUrl !== "string" || !Array.isArray(modelDescriptors) || !modelDescriptors.every(
+    (descriptor) => typeof descriptor === "object" && descriptor !== null && typeof descriptor.id === "string" && typeof descriptor.provider === "string"
+  )) {
+    return { kind: "failed", reason: "Managed credential bootstrap returned an invalid response" };
+  }
+  const credential = {
+    generation: setup.generation,
+    tokenId: setup.token_id,
+    token,
+    inferenceBaseUrl,
+    modelDescriptors
+  };
+  const failure = applyCredential(options, credential);
+  if (failure) {
+    await reportManagedInferenceApplyFailure(options, credential);
+    return { kind: "failed", reason: failure };
+  }
+  return { kind: "ready", generation: credential.generation, tokenId: credential.tokenId };
+}
+async function acknowledgeManagedInferenceSetup(options, preparation) {
+  const response = await post(options, "acknowledge", {
+    generation: preparation.generation,
+    token_id: preparation.tokenId,
+    config_validated: options.autoConfigureCredentialsProxy === true
+  });
+  if (!response?.ok) {
+    throw new Error(
+      response ? safeFailure("Managed credential acknowledgment", response.status) : safeFailure("Managed credential acknowledgment")
+    );
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  if (!setup || setup.generation !== preparation.generation || setup.token_id !== preparation.tokenId) {
+    throw new Error("Managed credential acknowledgment returned a mismatch");
+  }
+  return response.status === 200 && setup.status === "acknowledged" ? "acknowledged" : "pending";
+}
+
 // src/commands/run.ts
 var MAX_ACTIVITY_LOG_ENTRIES = 10;
 var MAX_DISCONNECT_REASON_LENGTH = 200;
@@ -15983,6 +16461,44 @@ async function run(options) {
     for (const warning2 of opencodeVersionWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
     }
+    const managedSetupOptions = {
+      agentId: state.agentId,
+      apiUrl: getApiUrlConfig(),
+      getAuthHeader: () => state.authHeader,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
+      log: (message, level = "info") => logActivity(state, {
+        type: level === "error" ? "error" : "info",
+        level,
+        ...level === "error" ? { error: message } : { message }
+      })
+    };
+    let managedDiscovery = await discoverManagedInferenceSetup(managedSetupOptions);
+    if (managedDiscovery.kind === "none") {
+      managedDiscovery = await enrollManagedInferenceSetup(managedSetupOptions);
+    }
+    let managedPreparation = { kind: "none" };
+    if (managedDiscovery.kind === "failed") {
+      managedPreparation = managedDiscovery;
+      managedSetupOptions.log(`MANAGED-INFERENCE-NOT-READY: ${managedDiscovery.reason}`, "warn");
+    } else if (managedDiscovery.kind === "setup") {
+      const managedHealth = opencodeVersion === "v2" ? await checkOpenCode2Health(state.port) : await checkOpenCodeHealth(state.port);
+      managedPreparation = await prepareManagedInferenceSetup(
+        managedSetupOptions,
+        managedDiscovery,
+        managedHealth
+      );
+      if (managedPreparation.kind === "failed") {
+        managedSetupOptions.log(
+          `MANAGED-INFERENCE-NOT-READY: ${managedPreparation.reason}`,
+          "warn"
+        );
+      } else if (managedPreparation.kind === "ready") {
+        managedSetupOptions.log(
+          `MANAGED-INFERENCE-PREPARED: runner=${state.agentId} generation=${managedPreparation.generation}`,
+          "info"
+        );
+      }
+    }
     const { value: maxActiveSessions, warnings: maxActiveSessionsWarnings } = resolveMaxActiveSessions(options, process.env);
     for (const warning2 of maxActiveSessionsWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
@@ -16077,6 +16593,30 @@ async function run(options) {
         }
       }
       state.opencodeConnected = oc.notReadyReason === null;
+      if (managedPreparation.kind === "ready" && oc.notReadyReason === null) {
+        try {
+          const acknowledgement = await acknowledgeManagedInferenceSetup(
+            managedSetupOptions,
+            managedPreparation
+          );
+          if (acknowledgement === "acknowledged") {
+            managedSetupOptions.log(
+              `MANAGED-INFERENCE-ACKNOWLEDGED: runner=${state.agentId} generation=${managedPreparation.generation}`,
+              "info"
+            );
+          } else {
+            managedSetupOptions.log(
+              `MANAGED-INFERENCE-NOT-READY: policy refresh is pending for runner=${state.agentId} generation=${managedPreparation.generation}`,
+              "warn"
+            );
+          }
+        } catch (error2) {
+          managedSetupOptions.log(
+            `MANAGED-INFERENCE-NOT-READY: ${error2 instanceof Error ? error2.message : String(error2)}`,
+            "warn"
+          );
+        }
+      }
       const version2 = state.opencodeVersion ? ` (v${state.opencodeVersion})` : "";
       ocSpinner?.succeed(`OpenCode running on port ${state.port}${version2}`);
       if (!state.interactive && oc.notReadyReason !== null) {
@@ -16259,7 +16799,7 @@ async function run(options) {
         onConnected: (agentId, isReconnect, transition) => {
           state.connected = true;
           state.agentId = agentId;
-          const connectionMessage = isReconnect ? `Tunnel reconnected (runner: ${agentId}, generation: ${transition.generation}, attempt: ${transition.attempt}, offline for ${transition.downtimeMs}ms)` : `Tunnel connected (runner: ${agentId}, generation: ${transition.generation})`;
+          const connectionMessage = isReconnect ? `Tunnel reconnected (runner: ${agentId}, generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"}, attempt: ${transition.attempt}, offline for ${transition.downtimeMs}ms)` : `Tunnel connected (runner: ${agentId}, generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"})`;
           logActivity(state, {
             type: "info",
             message: connectionMessage
@@ -16292,6 +16832,7 @@ async function run(options) {
               connected: state.opencodeConnected
             }),
             connection_generation: transition.generation,
+            ...transition.relayConnectionId !== null ? { relay_connection_id: transition.relayConnectionId } : {},
             ...isReconnect && transition.downtimeMs !== null ? {
               reconnect_attempt: transition.attempt,
               downtime_ms: transition.downtimeMs
@@ -16322,12 +16863,13 @@ async function run(options) {
           const safeReason2 = redactDiagnosticText(reason).slice(0, MAX_DISCONNECT_REASON_LENGTH);
           logActivity(state, {
             type: "info",
-            message: `Tunnel disconnected (generation: ${transition.generation}, code: ${code}, reason: ${safeReason2})`
+            message: `Tunnel disconnected (generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"}, code: ${code}, reason: ${safeReason2})`
           });
           emitAgentDisconnected(state.agentId, {
             code,
             reason: safeReason2,
-            connection_generation: transition.generation
+            connection_generation: transition.generation,
+            ...transition.relayConnectionId !== null ? { relay_connection_id: transition.relayConnectionId } : {}
           });
           if (state.interactive) displayStatus(state);
         },
@@ -16478,9 +17020,9 @@ program.name("evident").description("Run OpenCode locally and connect it to Evid
   "--endpoint <url>",
   "Evident API base URL (default: production; e.g. http://localhost:3001)"
 ).option("--tunnel <url>", "Tunnel WebSocket URL (default: production; e.g. ws://localhost:8787)").hook("preAction", (thisCommand) => {
-  const { endpoint, tunnel } = thisCommand.opts();
-  if (endpoint) {
-    setEndpoint(endpoint);
+  const { endpoint: endpoint2, tunnel } = thisCommand.opts();
+  if (endpoint2) {
+    setEndpoint(endpoint2);
   }
   if (tunnel) {
     setTunnelUrl(tunnel);
@@ -16554,6 +17096,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--opencode-config-overlay <path>",
   "Apply this runner-provided OpenCode config before starting OpenCode."
+).option(
+  "--auto-configure-credentials-proxy",
+  "Install Evident's generated OpenCode providers for the runner's credential pool (off by default)."
 ).option(
   "--credential-sync-marker <path>",
   "Own the interval credential sync and write this marker once the shutdown flush has finished, so the runner image's lifecycle hooks can wait on it."
@@ -16597,6 +17142,7 @@ program.command("run").description("Connect to Evident and process messages").op
       restoreSessionDb: options.restoreSessionDb,
       restoreRunnerCredentials: options.restoreRunnerCredentials,
       opencodeConfigOverlay: options.opencodeConfigOverlay,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
       credentialSyncMarker: options.credentialSyncMarker
     });
   }