@evident-ai/cli 3.6.1-dev.4db2683 → 3.6.1-dev.5d5fa2a

package/dist/index.js

@@ -1179,9 +1179,9 @@ async function claudeUsage() {
 }
 
 // src/commands/run.ts
-import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { isAbsolute as isAbsolute4, join as join14, parse, resolve as resolvePath2 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join16, parse, resolve as resolvePath2 } from "node:path";
 import chalk7 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
@@ -1256,6 +1256,36 @@ function effectiveCorrelatedRun(messages, userMessageId) {
 function extractReplyTextForMessage(messages, opencodeUserMessageId) {
   return lastText(effectiveCorrelatedRun(messages, opencodeUserMessageId));
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function projectV2ToolContent(content) {
+  if (!isRecord(content) || content.type !== "tool" || typeof content.name !== "string" || !isRecord(content.state)) {
+    return null;
+  }
+  const { state } = content;
+  const status2 = state.status;
+  if (status2 !== "streaming" && status2 !== "running" && status2 !== "completed" && status2 !== "error") {
+    return null;
+  }
+  const projectedState = {
+    status: status2 === "streaming" ? "pending" : status2
+  };
+  if (status2 !== "streaming" && isRecord(state.input)) projectedState.input = state.input;
+  const output = Array.isArray(state.content) ? state.content.filter(
+    (entry) => isRecord(entry) && entry.type === "text" && typeof entry.text === "string"
+  ).map((entry) => entry.text) : [];
+  if (output.length > 0) projectedState.output = output.join("\n");
+  if (status2 === "error" && isRecord(state.error) && typeof state.error.message === "string") {
+    projectedState.error = state.error.message;
+  }
+  return {
+    type: "tool",
+    tool: content.name,
+    ...typeof content.id === "string" ? { callID: content.id } : {},
+    state: projectedState
+  };
+}
 
 // ../../packages/types/src/telemetry/index.ts
 var TelemetryEventTypes = {
@@ -1445,7 +1475,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.6.1-dev.4db2683" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.6.1-dev.5d5fa2a" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -2195,6 +2225,7 @@ var FORWARDED_LEVELS_BY_SOURCE = {
   "cli.run": /* @__PURE__ */ new Set(["warn", "error"]),
   opencode: /* @__PURE__ */ new Set(["warn", "error"]),
   "cli.session-cleanup": /* @__PURE__ */ new Set(["info", "warn", "error"]),
+  "cli.session-archive": /* @__PURE__ */ new Set(["info", "warn", "error"]),
   "cli.runtime-provenance": /* @__PURE__ */ new Set(["info", "warn", "error"])
 };
 var SEVERITY_BY_LEVEL = {
@@ -2757,153 +2788,1347 @@ function boundedError(error2) {
   return message.slice(0, MAX_DIAGNOSTIC_LENGTH);
 }
 
-// src/lib/opencode/auth.ts
-function buildOpenCodeBasicAuthHeader(password) {
-  return `Basic ${Buffer.from(["opencode", password].join(":")).toString("base64")}`;
+// src/lib/opencode/session-binding-ledger.ts
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname5, join as join5 } from "node:path";
+var SESSION_BINDING_LEDGER_MAX_RECORDS = 1e3;
+var MAX_DIAGNOSTIC_LENGTH2 = 200;
+function sessionBindingLedgerPath(homeDir, env) {
+  const override = env.EVIDENT_SESSION_BINDING_LEDGER?.trim();
+  return override || join5(homeDir, ".local", "state", "evident", "session-bindings.jsonl");
+}
+function appendSessionBinding(path, record, log3) {
+  mkdirSync2(dirname5(path), { recursive: true });
+  const current = readSessionBindingRecords(path, log3);
+  if (current.readError !== null) {
+    throw new Error(`cannot enforce the ledger limit after reading ${path}: ${current.readError}`);
+  }
+  if (current.records.some(
+    (existing) => existing.conversation_id === record.conversation_id && existing.opencode_session_id === record.opencode_session_id
+  )) {
+    return;
+  }
+  const kept = [...current.records, record].slice(-SESSION_BINDING_LEDGER_MAX_RECORDS);
+  if (kept.length > current.records.length) {
+    appendFileSync2(path, `${JSON.stringify(record)}
+`, "utf8");
+  } else {
+    writeFileSync2(path, `${kept.map((entry) => JSON.stringify(entry)).join("\n")}
+`, "utf8");
+  }
 }
-
-// src/lib/opencode/health.ts
-async function checkOpenCodeHealth(port) {
+function readSessionBindings(path, log3) {
+  const result = readSessionBindingRecords(path, log3);
+  if (result.readError !== null) {
+    log3(`[session-binding-ledger] could not read ${path}: ${result.readError}`);
+  }
+  return new Map(
+    result.records.map((record) => [record.opencode_session_id, record.conversation_id])
+  );
+}
+function readSessionBindingRecords(path, log3) {
+  let content;
   try {
-    const response = await fetch(`http://127.0.0.1:${port}/global/health`, {
-      signal: AbortSignal.timeout(2e3)
-      // 2 second timeout
-    });
-    if (response.status === 401) {
-      return { healthy: false, authFailed: true, error: "HTTP 401" };
-    }
-    if (!response.ok) {
-      return { healthy: false, error: `HTTP ${response.status}` };
-    }
-    const data = await response.json().catch(() => ({}));
-    return { healthy: true, version: data.version };
+    content = readFileSync4(path, "utf8");
   } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    return { healthy: false, error: message };
+    if (isMissingFile2(error2)) return { records: [], readError: null };
+    const readError = boundedError2(error2);
+    return { records: [], readError };
   }
+  const records = content.split("\n").flatMap((line) => {
+    if (!line.trim()) return [];
+    const record = parseRecord2(line, path, log3);
+    return record ? [record] : [];
+  });
+  return { records, readError: null };
 }
-function bodyExcerpt(body) {
-  const excerpt = body.replace(/\s+/g, " ").trim().slice(0, 160);
-  return excerpt ? ` (body="${excerpt}")` : " (empty body)";
-}
-async function checkOpenCode2Health(port, password) {
+function parseRecord2(line, path, log3) {
   try {
-    const headers = {};
-    if (password !== void 0) {
-      headers.Authorization = buildOpenCodeBasicAuthHeader(password);
-    }
-    const response = await fetch(`http://127.0.0.1:${port}/api/health`, {
-      headers,
-      signal: AbortSignal.timeout(2e3)
-    });
-    if (response.status === 401) {
-      return { healthy: false, authFailed: true, error: "HTTP 401" };
-    }
-    if (!response.ok) {
-      return { healthy: false, error: `HTTP ${response.status}` };
-    }
-    const body = await response.text();
-    const excerpt = bodyExcerpt(body);
-    let data;
-    try {
-      data = JSON.parse(body);
-    } catch (error2) {
-      return {
-        healthy: false,
-        error: `Invalid JSON health response${excerpt}: ${error2 instanceof Error ? error2.message : String(error2)}`
-      };
-    }
-    if (typeof data !== "object" || data === null || Array.isArray(data)) {
-      return {
-        healthy: false,
-        error: `Invalid health response${excerpt}: expected healthy=true`
-      };
-    }
-    const health = data;
-    if (health.healthy !== true) {
-      return {
-        healthy: false,
-        error: `Invalid health response${excerpt}: expected healthy=true`
-      };
-    }
-    return typeof health.version === "string" ? { healthy: true, version: health.version } : { healthy: true };
+    const value = JSON.parse(line);
+    if (isSessionBindingRecord(value)) return value;
+    log3(`[session-binding-ledger] skipped malformed record in ${path}: invalid shape`);
   } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    return { healthy: false, error: message };
+    log3(`[session-binding-ledger] skipped malformed record in ${path}: ${boundedError2(error2)}`);
   }
+  return null;
 }
-async function waitForOpenCodeHealth(port, timeoutMs = 3e4) {
-  const startTime = Date.now();
-  while (Date.now() - startTime < timeoutMs) {
-    const health = await checkOpenCodeHealth(port);
-    if (health.healthy || health.authFailed) {
-      return health;
-    }
-    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+function isSessionBindingRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  return typeof record.conversation_id === "string" && record.conversation_id.length > 0 && typeof record.opencode_session_id === "string" && record.opencode_session_id.length > 0 && typeof record.observed_at === "string";
+}
+function isMissingFile2(error2) {
+  return error2 instanceof Error && "code" in error2 && error2.code === "ENOENT";
+}
+function boundedError2(error2) {
+  const message = error2 instanceof Error ? error2.message : String(error2);
+  return message.slice(0, MAX_DIAGNOSTIC_LENGTH2);
+}
+
+// src/lib/opencode/session-archive-config.ts
+import { readFileSync as readFileSync5 } from "node:fs";
+
+// src/lib/opencode/session-cleanup.ts
+var DURATION_UNIT_MS = {
+  s: 1e3,
+  m: 60 * 1e3,
+  h: 60 * 60 * 1e3,
+  d: 24 * 60 * 60 * 1e3
+};
+function parseDurationMs(input) {
+  const trimmed = input.trim();
+  const match = /^(\d+)([smhd])$/.exec(trimmed);
+  if (!match) {
+    throw new Error(
+      `Invalid duration "${input}": expected <number><unit> where unit is one of s, m, h, d (e.g. "7d", "24h", "30m", "90s").`
+    );
   }
-  return { healthy: false, error: "Timeout waiting for OpenCode to be healthy" };
+  const value = Number(match[1]);
+  if (value <= 0) {
+    throw new Error(`Invalid duration "${input}": must be a positive value.`);
+  }
+  return value * DURATION_UNIT_MS[match[2]];
 }
-async function waitForOpenCode2Health(port, password, timeoutMs = 3e4) {
-  const startTime = Date.now();
-  while (Date.now() - startTime < timeoutMs) {
-    const health = await checkOpenCode2Health(port, password);
-    if (health.healthy || health.authFailed) {
-      return health;
+function selectSessionsToDelete(sessions, opts) {
+  const { maxAgeMs, maxCount, nowMs, protectedIds } = opts;
+  if (maxAgeMs === void 0 && maxCount === void 0) return [];
+  const ageEligible = (s) => {
+    if (maxAgeMs === void 0) return false;
+    if (s.lastActivityMs === null) return true;
+    return nowMs - s.lastActivityMs > maxAgeMs;
+  };
+  const countEligibleIds = /* @__PURE__ */ new Set();
+  if (maxCount !== void 0) {
+    const byActivityDesc = [...sessions].sort(
+      (a, b) => (b.lastActivityMs ?? -Infinity) - (a.lastActivityMs ?? -Infinity)
+    );
+    for (const s of byActivityDesc.slice(maxCount)) {
+      countEligibleIds.add(s.id);
     }
-    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
   }
-  return { healthy: false, error: "Timeout waiting for OpenCode to be healthy" };
+  const toDelete = [];
+  for (const s of sessions) {
+    if (protectedIds.has(s.id)) continue;
+    if (ageEligible(s) || countEligibleIds.has(s.id)) {
+      toDelete.push(s.id);
+    }
+  }
+  const activityById = new Map(sessions.map((session) => [session.id, session.lastActivityMs]));
+  return toDelete.sort(
+    (a, b) => (activityById.get(a) ?? -Infinity) - (activityById.get(b) ?? -Infinity)
+  );
 }
-
-// src/lib/http-timeout.ts
-var REQUEST_TIMEOUT_MS = 6e4;
-var RequestTimeoutError = class extends Error {
-  constructor(operation, timeoutMs, elapsedMs) {
-    super(`${operation} timed out after ${elapsedMs}ms (limit ${timeoutMs}ms)`);
-    this.operation = operation;
-    this.timeoutMs = timeoutMs;
-    this.elapsedMs = elapsedMs;
-    this.name = "TimeoutError";
+var DEFAULT_INTERVAL = "1h";
+function resolve2(flag, envValue, fallback) {
+  return flag ?? envValue ?? fallback;
+}
+function parseMaxCount(input) {
+  const trimmed = input.trim();
+  if (!/^\d+$/.test(trimmed)) {
+    throw new Error(`Invalid max-count "${input}": expected a positive integer.`);
   }
-};
-function describeRequestOperation(input, init) {
-  const method = (init?.method ?? input.method ?? "GET").toUpperCase();
-  const rawUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-  let path;
-  try {
-    path = new URL(rawUrl).pathname;
-  } catch (error2) {
-    if (!(error2 instanceof TypeError)) throw error2;
-    path = rawUrl.split(/[?#]/, 1)[0];
+  const value = Number(trimmed);
+  if (value <= 0) {
+    throw new Error(`Invalid max-count "${input}": must be greater than 0.`);
   }
-  const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  const prefixedIdentifier = /^[a-z]+_[A-Za-z0-9_-]{10,}$/;
-  const maskedPath = path.split("/").map((segment) => uuid.test(segment) || prefixedIdentifier.test(segment) ? ":id" : segment).join("/");
-  return `${method} ${maskedPath}`;
+  return value;
 }
-function withRequestTimeout(fetchImpl, timeoutMs) {
-  return (async (input, init) => {
-    const startedAt = Date.now();
+function resolveSessionCleanupConfig(flags, env = process.env) {
+  const warnings = [];
+  const maxAgeRaw = resolve2(flags.maxAge, env.EVIDENT_SESSION_CLEANUP_MAX_AGE);
+  const maxCountRaw = resolve2(flags.maxCount, env.EVIDENT_SESSION_CLEANUP_MAX_COUNT);
+  const intervalRaw = resolve2(
+    flags.interval,
+    env.EVIDENT_SESSION_CLEANUP_INTERVAL,
+    DEFAULT_INTERVAL
+  );
+  let maxAgeMs;
+  if (maxAgeRaw !== void 0) {
     try {
-      return await fetchImpl(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });
-    } catch (error2) {
-      if (error2?.name === "TimeoutError") {
-        throw new RequestTimeoutError(
-          describeRequestOperation(input, init),
-          timeoutMs,
-          Date.now() - startedAt
-        );
-      }
-      throw error2;
+      maxAgeMs = parseDurationMs(maxAgeRaw);
+    } catch (err) {
+      warnings.push(
+        `Ignoring invalid --session-cleanup-max-age: ${err instanceof Error ? err.message : String(err)}`
+      );
     }
-  });
+  }
+  let maxCount;
+  if (maxCountRaw !== void 0) {
+    try {
+      maxCount = parseMaxCount(maxCountRaw);
+    } catch (err) {
+      warnings.push(
+        `Ignoring invalid --session-cleanup-max-count: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  let intervalMs;
+  try {
+    intervalMs = parseDurationMs(intervalRaw ?? DEFAULT_INTERVAL);
+  } catch (err) {
+    warnings.push(
+      `Ignoring invalid --session-cleanup-interval, using default ${DEFAULT_INTERVAL}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    intervalMs = parseDurationMs(DEFAULT_INTERVAL);
+  }
+  const enabled = maxAgeMs !== void 0 || maxCount !== void 0;
+  return { enabled, maxAgeMs, maxCount, intervalMs, warnings };
 }
 
-// src/lib/opencode/client.ts
-function redactPassword(message, password) {
-  return message.replaceAll(password, "[redacted]");
+// src/lib/opencode/session-archive-config.ts
+var DEFAULT_INTERVAL2 = "1h";
+var DEFAULT_FLUSH_BUDGET_MS = 2e3;
+var MAX_SESSION_ARCHIVE_TIMER_DELAY_MS = 2147483647;
+var STATE_PREFIX_FILE = "/dev/shm/evident-state-prefix";
+var ENABLED_VALUES = /* @__PURE__ */ new Set(["on", "true", "1"]);
+var DISABLED_VALUES = /* @__PURE__ */ new Set(["off", "false", "0"]);
+function nonEmpty(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+function parseFlushBudgetMs(value) {
+  const trimmed = value.trim();
+  const budgetMs = Number(trimmed);
+  if (!/^\d+$/.test(trimmed) || !Number.isSafeInteger(budgetMs) || budgetMs <= 0 || budgetMs > MAX_SESSION_ARCHIVE_TIMER_DELAY_MS) {
+    throw new Error(
+      `Invalid flush budget "${value}": expected a positive integer number of milliseconds no greater than ${MAX_SESSION_ARCHIVE_TIMER_DELAY_MS}.`
+    );
+  }
+  return budgetMs;
 }
-function createOpenCodeClient(options) {
+function resolveSessionArchiveConfig(flags, env = process.env) {
+  const warnings = [];
+  const archiveRaw = env.EVIDENT_SESSION_ARCHIVE;
+  let enabled = flags.enabled ?? false;
+  if (flags.enabled === void 0 && archiveRaw !== void 0 && archiveRaw.trim() !== "") {
+    const normalized = archiveRaw.trim().toLowerCase();
+    if (ENABLED_VALUES.has(normalized)) {
+      enabled = true;
+    } else if (DISABLED_VALUES.has(normalized)) {
+      enabled = false;
+    } else {
+      warnings.push(
+        `Ignoring invalid EVIDENT_SESSION_ARCHIVE "${archiveRaw}": expected on or off; session archiving remains off.`
+      );
+    }
+  }
+  let intervalMs;
+  const intervalRaw = flags.interval ?? env.EVIDENT_SESSION_ARCHIVE_INTERVAL ?? DEFAULT_INTERVAL2;
+  try {
+    intervalMs = parseDurationMs(intervalRaw);
+    if (intervalMs > MAX_SESSION_ARCHIVE_TIMER_DELAY_MS) {
+      throw new Error(
+        `Duration "${intervalRaw}" exceeds Node's maximum timer delay of ${MAX_SESSION_ARCHIVE_TIMER_DELAY_MS}ms.`
+      );
+    }
+  } catch (err) {
+    warnings.push(
+      `Ignoring invalid session archive interval, using default ${DEFAULT_INTERVAL2}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    intervalMs = parseDurationMs(DEFAULT_INTERVAL2);
+  }
+  let flushBudgetMs;
+  const flushBudgetRaw = env.EVIDENT_SESSION_ARCHIVE_FLUSH_MS ?? String(DEFAULT_FLUSH_BUDGET_MS);
+  try {
+    flushBudgetMs = parseFlushBudgetMs(flushBudgetRaw);
+  } catch (err) {
+    warnings.push(
+      `Ignoring invalid EVIDENT_SESSION_ARCHIVE_FLUSH_MS, using default ${DEFAULT_FLUSH_BUDGET_MS}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    flushBudgetMs = DEFAULT_FLUSH_BUDGET_MS;
+  }
+  const bucket = nonEmpty(env.PERSISTENCE_BUCKET);
+  let keyPrefix = nonEmpty(env.LITESTREAM_PREFIX);
+  if (enabled && bucket === null) {
+    warnings.push("Session archiving is off because PERSISTENCE_BUCKET is unset or empty.");
+    enabled = false;
+  }
+  if (enabled && keyPrefix === null) {
+    let fallbackReadError = null;
+    try {
+      keyPrefix = nonEmpty(readFileSync5(STATE_PREFIX_FILE, "utf8"));
+    } catch (err) {
+      fallbackReadError = err instanceof Error ? err.message : String(err);
+    }
+    if (keyPrefix === null) {
+      const readFailure = fallbackReadError ? ` Could not read ${STATE_PREFIX_FILE}: ${fallbackReadError}.` : "";
+      warnings.push(
+        `Session archiving is off because neither LITESTREAM_PREFIX nor ${STATE_PREFIX_FILE} contains a prefix.${readFailure}`
+      );
+      enabled = false;
+    }
+  }
+  return { enabled, bucket, keyPrefix, intervalMs, flushBudgetMs, warnings };
+}
+
+// src/lib/opencode/session-archive-snapshot.ts
+import { createHash } from "node:crypto";
+var SessionArchiveExportError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SessionArchiveExportError";
+  }
+};
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (typeof value !== "object" || value === null) return value;
+  return Object.fromEntries(
+    Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, nested]) => [key, canonicalize(nested)])
+  );
+}
+function contentForFingerprint(archive) {
+  return JSON.stringify(
+    canonicalize({
+      opencode_api_version: archive.opencode_api_version,
+      opencode_session_id: archive.opencode_session_id,
+      evident_conversation_id: archive.evident_conversation_id,
+      messages: archive.messages
+    })
+  );
+}
+function fingerprintArchive(archive) {
+  return createHash("sha256").update(contentForFingerprint(archive)).digest("hex");
+}
+function buildSessionArchive(input) {
+  const archive = {
+    schema_version: 1,
+    opencode_api_version: input.apiVersion,
+    opencode_session_id: input.session.id,
+    evident_conversation_id: input.conversationId,
+    evident_runner_id: input.runnerId,
+    binding_source: input.bindingSource,
+    session: input.session,
+    messages: input.messages,
+    message_count: input.messages.length,
+    archived_at: input.archivedAt
+  };
+  return { ...archive, content_fingerprint: fingerprintArchive(archive) };
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function errorMessage2(error2) {
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+function invalidResponse(version2, sessionId, path, reason) {
+  return new SessionArchiveExportError(
+    "invalid-response",
+    `OpenCode ${version2} session ${sessionId} returned an invalid response from GET ${path}: ${reason}`
+  );
+}
+async function requestPage(client, sessionId, path, signal) {
+  let response;
+  try {
+    response = await client.request(path, signal ? { signal } : void 0, {
+      allowStatuses: Array.from({ length: 500 }, (_, index) => index + 100)
+    });
+  } catch (error2) {
+    throw new SessionArchiveExportError(
+      "request-failed",
+      `OpenCode ${client.version} session ${sessionId} request GET ${path} failed: ${errorMessage2(error2)}`
+    );
+  }
+  if (response.status === 404) {
+    throw new SessionArchiveExportError(
+      "not-found",
+      `OpenCode ${client.version} session ${sessionId} was not found at GET ${path} (HTTP 404)`
+    );
+  }
+  if (!response.ok) {
+    throw new SessionArchiveExportError(
+      "request-failed",
+      `OpenCode ${client.version} session ${sessionId} request GET ${path} returned HTTP ${response.status}`
+    );
+  }
+  let bodyText;
+  try {
+    bodyText = await response.text();
+  } catch (error2) {
+    throw new SessionArchiveExportError(
+      "request-failed",
+      `OpenCode ${client.version} session ${sessionId} response body from GET ${path} could not be read: ${errorMessage2(error2)}`
+    );
+  }
+  try {
+    return { response, body: JSON.parse(bodyText) };
+  } catch (error2) {
+    if (!(error2 instanceof SyntaxError)) throw error2;
+    const contentType = response.headers.get("content-type") ?? "";
+    const looksLikeHtml = contentType.toLowerCase().includes("text/html") || /^\s*<!doctype\s+html|^\s*<html/i.test(bodyText);
+    throw invalidResponse(
+      client.version,
+      sessionId,
+      path,
+      looksLikeHtml ? "received text/html, expected JSON" : "received non-JSON content, expected JSON"
+    );
+  }
+}
+function v1NextCursor(response, sessionId, path) {
+  const headerCursor = response.headers.get("x-next-cursor")?.trim() || null;
+  const linkHeader = response.headers.get("link");
+  const nextLink = linkHeader?.split(",").map((link) => link.trim()).find((link) => /;\s*rel\s*=\s*"?next"?/i.test(link));
+  let linkCursor = null;
+  if (nextLink) {
+    const target = nextLink.match(/<([^>]+)>/)?.[1];
+    if (!target) {
+      throw new SessionArchiveExportError(
+        "pagination-failed",
+        `OpenCode v1 session ${sessionId} returned a next Link without a URL for GET ${path}`
+      );
+    }
+    try {
+      linkCursor = new URL(target, "http://127.0.0.1").searchParams.get("before");
+    } catch (error2) {
+      throw new SessionArchiveExportError(
+        "pagination-failed",
+        `OpenCode v1 session ${sessionId} returned an invalid next Link for GET ${path}: ${errorMessage2(error2)}`
+      );
+    }
+  }
+  if (headerCursor && linkCursor && headerCursor !== linkCursor) {
+    throw new SessionArchiveExportError(
+      "pagination-failed",
+      `OpenCode v1 session ${sessionId} returned conflicting next cursors for GET ${path}`
+    );
+  }
+  const cursor = headerCursor ?? linkCursor;
+  if ((headerCursor || nextLink) && !cursor) {
+    throw new SessionArchiveExportError(
+      "pagination-failed",
+      `OpenCode v1 session ${sessionId} returned a next page without a usable cursor for GET ${path}`
+    );
+  }
+  return cursor;
+}
+function v1Messages(body, sessionId, path) {
+  if (!Array.isArray(body)) {
+    throw invalidResponse("v1", sessionId, path, "expected an array of messages");
+  }
+  return body;
+}
+async function exportV1SessionMessages(client, sessionId, signal) {
+  const basePath = `/session/${encodeURIComponent(sessionId)}/message`;
+  const firstPage = await requestPage(client, sessionId, basePath, signal);
+  let messages = v1Messages(firstPage.body, sessionId, basePath);
+  let cursor = v1NextCursor(firstPage.response, sessionId, basePath);
+  const seenCursors = /* @__PURE__ */ new Set();
+  while (cursor !== null) {
+    if (seenCursors.has(cursor)) {
+      throw new SessionArchiveExportError(
+        "pagination-failed",
+        `OpenCode v1 session ${sessionId} repeated cursor while reading GET ${basePath}`
+      );
+    }
+    seenCursors.add(cursor);
+    const path = `${basePath}?${new URLSearchParams({ before: cursor }).toString()}`;
+    const page = await requestPage(client, sessionId, path, signal);
+    messages = [...v1Messages(page.body, sessionId, path), ...messages];
+    cursor = v1NextCursor(page.response, sessionId, path);
+  }
+  return messages;
+}
+async function exportV2SessionMessages(client, sessionId, signal) {
+  const basePath = `/api/session/${encodeURIComponent(sessionId)}/message`;
+  const messages = [];
+  const seenCursors = /* @__PURE__ */ new Set();
+  let cursor;
+  let hasNextPage = true;
+  while (hasNextPage) {
+    const params = new URLSearchParams({ limit: "100" });
+    if (cursor === void 0) {
+      params.set("order", "asc");
+    } else {
+      params.set("cursor", cursor);
+    }
+    const path = `${basePath}?${params.toString()}`;
+    const { body } = await requestPage(client, sessionId, path, signal);
+    if (!isRecord2(body) || !Array.isArray(body.data) || !isRecord2(body.cursor)) {
+      throw invalidResponse("v2", sessionId, path, "expected a {data: [], cursor: {\u2026}} envelope");
+    }
+    messages.push(...body.data);
+    const next = body.cursor.next;
+    if (next === void 0 || next === null) {
+      hasNextPage = false;
+      continue;
+    }
+    if (typeof next !== "string" || next.length === 0 || seenCursors.has(next)) {
+      throw new SessionArchiveExportError(
+        "pagination-failed",
+        `OpenCode v2 session ${sessionId} returned an invalid or repeated cursor from GET ${path}`
+      );
+    }
+    seenCursors.add(next);
+    cursor = next;
+  }
+  return messages;
+}
+async function exportSessionMessages(client, sessionId, signal) {
+  if (client.version === "v1") return exportV1SessionMessages(client, sessionId, signal);
+  if (client.version === "v2") return exportV2SessionMessages(client, sessionId, signal);
+  throw new SessionArchiveExportError(
+    "unsupported-dialect",
+    `OpenCode session ${sessionId} cannot be archived: unsupported API dialect ${String(client.version)}`
+  );
+}
+
+// src/lib/opencode/session-archive-watermarks.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname6, join as join6 } from "node:path";
+function sessionArchiveWatermarkPath(homeDir, env) {
+  const override = env.EVIDENT_SESSION_ARCHIVE_WATERMARK?.trim();
+  return override || join6(homeDir, ".local", "state", "evident", "session-archive-watermarks.json");
+}
+function readWatermarks(path, log3) {
+  let content;
+  try {
+    content = readFileSync6(path, "utf8");
+  } catch (error2) {
+    if (isMissingFile3(error2)) return /* @__PURE__ */ new Map();
+    log3(`[session-archive-watermarks] could not read ${path}; treating every session as changed`);
+    return /* @__PURE__ */ new Map();
+  }
+  try {
+    const parsed = JSON.parse(content);
+    if (!isRecord3(parsed)) throw new Error("invalid watermark object");
+    const entries = Object.entries(parsed);
+    if (!entries.every(([sessionId, value]) => sessionId.length > 0 && isWatermark(value))) {
+      throw new Error("invalid watermark entry");
+    }
+    return new Map(entries);
+  } catch (error2) {
+    log3(`[session-archive-watermarks] could not parse ${path}; treating every session as changed`);
+    return /* @__PURE__ */ new Map();
+  }
+}
+function recordUpload(path, sessionId, entry, watermarks) {
+  const updated = new Map(watermarks);
+  updated.set(sessionId, entry);
+  mkdirSync3(dirname6(path), { recursive: true });
+  writeFileSync3(path, `${JSON.stringify(Object.fromEntries(updated))}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  watermarks.clear();
+  for (const [id, watermark] of updated) watermarks.set(id, watermark);
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isWatermark(value) {
+  if (!isRecord3(value)) return false;
+  return typeof value.fingerprint === "string" && typeof value.uploaded_at === "string" && typeof value.key === "string" && (!("conversation_id" in value) || value.conversation_id === null || typeof value.conversation_id === "string");
+}
+function isMissingFile3(error2) {
+  return error2 instanceof Error && "code" in error2 && error2.code === "ENOENT";
+}
+
+// src/lib/runner-synchroniser.ts
+import { spawn } from "node:child_process";
+
+// ../../runner/synchroniser/src/shell-contract.json
+var shell_contract_default = {
+  commands: [
+    "env",
+    "litestream-config",
+    "restore",
+    "sync-once",
+    "model-auth-ready",
+    "self-stop",
+    "session-db-classify",
+    "session-db-verify",
+    "archive-put"
+  ],
+  archiveStdinMaxBytes: 33554432
+};
+
+// src/lib/runner-synchroniser.ts
+var MAX_ARCHIVE_STDIN_BYTES = shell_contract_default.archiveStdinMaxBytes;
+var ERROR_CLOSE_FALLBACK_MS = 1e3;
+function isPipeClosed(error2) {
+  return typeof error2 === "object" && error2 !== null && "code" in error2 && error2.code === "EPIPE";
+}
+function appendError(stderr, error2) {
+  const message = error2 instanceof Error ? error2.message : String(error2);
+  return stderr === "" ? message : `${stderr}
+${message}`;
+}
+function runSynchroniser(args, opts) {
+  return new Promise((resolve5) => {
+    let child;
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    let shuttingDown = false;
+    let timedOut = false;
+    let stdinFailure;
+    let childFailure;
+    const timer = {};
+    const closeFallbackTimer = {};
+    let abortListener;
+    let spawnListener;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      if (timer.handle) clearTimeout(timer.handle);
+      if (closeFallbackTimer.handle) clearTimeout(closeFallbackTimer.handle);
+      if (abortListener) opts.signal?.removeEventListener("abort", abortListener);
+      if (spawnListener) child.removeListener("spawn", spawnListener);
+      resolve5(result);
+    };
+    const armErrorCloseFallback = () => {
+      if (closeFallbackTimer.handle) return;
+      closeFallbackTimer.handle = setTimeout(() => {
+        const failure = stdinFailure ?? childFailure;
+        finish({
+          code: null,
+          stdout,
+          stderr: failure === void 0 ? stderr : appendError(stderr, failure),
+          timedOut
+        });
+      }, ERROR_CLOSE_FALLBACK_MS);
+    };
+    const terminateChild = () => {
+      if (!shuttingDown) {
+        shuttingDown = true;
+        child.stdin?.destroy();
+      }
+      if (child.pid !== void 0) {
+        child.kill("SIGKILL");
+      } else if (!spawnListener) {
+        spawnListener = () => {
+          if (child.pid !== void 0) child.kill("SIGKILL");
+        };
+        child.once("spawn", spawnListener);
+      }
+    };
+    try {
+      child = spawn("runner-synchroniser", args, {
+        env: opts.env ?? process.env,
+        stdio: [opts.stdin === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
+      });
+    } catch (error2) {
+      finish({ code: null, stdout, stderr: appendError(stderr, error2), timedOut: false });
+      return;
+    }
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.once("error", (error2) => {
+      childFailure = error2;
+      if (child.pid !== void 0) terminateChild();
+      armErrorCloseFallback();
+    });
+    child.once("close", (code) => {
+      const failure = stdinFailure ?? childFailure;
+      finish({
+        code: failure === void 0 ? code : null,
+        stdout,
+        stderr: failure === void 0 ? stderr : appendError(stderr, failure),
+        timedOut
+      });
+    });
+    const stdin = child.stdin;
+    const failStdin = (error2) => {
+      if (settled || shuttingDown || isPipeClosed(error2)) return;
+      stdinFailure = error2;
+      terminateChild();
+      armErrorCloseFallback();
+    };
+    stdin?.once("error", failStdin);
+    if (opts.stdin !== void 0 && stdin === null) {
+      failStdin(new Error("synchroniser stdin is unavailable"));
+    } else if (opts.stdin !== void 0 && stdin !== null) {
+      const drained = stdin.write(opts.stdin, (error2) => {
+        if (error2) failStdin(error2);
+      });
+      if (!drained) {
+        stdin.once("drain", () => stdin.end());
+      } else {
+        stdin.end();
+      }
+    }
+    if (opts.signal) {
+      const killChild = () => {
+        terminateChild();
+      };
+      abortListener = killChild;
+      if (opts.signal.aborted) {
+        abortListener();
+      } else {
+        opts.signal.addEventListener("abort", abortListener, { once: true });
+        if (opts.signal.aborted) abortListener();
+      }
+    }
+    timer.handle = setTimeout(
+      () => {
+        timedOut = true;
+        terminateChild();
+      },
+      Math.max(0, opts.timeoutMs)
+    );
+  });
+}
+
+// src/lib/opencode/session-archive-upload.ts
+var MAX_SESSION_ARCHIVE_BYTES = MAX_ARCHIVE_STDIN_BYTES;
+var EXIT_ARCHIVE_CONFIG_MISSING = 50;
+var EXIT_ARCHIVE_ACCESS_DENIED = 51;
+function transportFailure(bytes, reason, exitCode) {
+  const message = reason === "missing-executable" ? "runner-synchroniser is unavailable; session archival requires a hosted runner." : reason === "timeout" ? "runner-synchroniser timed out before the archive upload completed." : "session archive upload did not complete.";
+  return {
+    kind: "transport-failed",
+    bytes,
+    reason,
+    message,
+    ...exitCode !== void 0 ? { exitCode } : {}
+  };
+}
+function isJson(body) {
+  try {
+    JSON.parse(body.toString("utf8"));
+    return true;
+  } catch (error2) {
+    void error2;
+    return false;
+  }
+}
+async function uploadSessionArchive(key, body, options) {
+  const bytes = Buffer.from(body);
+  if (bytes.byteLength > MAX_SESSION_ARCHIVE_BYTES) {
+    return transportFailure(bytes.byteLength, "too-large");
+  }
+  if (!isJson(bytes)) return transportFailure(bytes.byteLength, "invalid-json");
+  const run2 = options.runSynchroniser ?? runSynchroniser;
+  let result;
+  try {
+    result = await run2(["archive-put", key], {
+      timeoutMs: options.timeoutMs,
+      env: options.env,
+      signal: options.signal,
+      stdin: bytes
+    });
+  } catch (error2) {
+    return transportFailure(
+      bytes.byteLength,
+      error2 instanceof Error && /ENOENT|runner-synchroniser/i.test(error2.message) ? "missing-executable" : "spawn-failed"
+    );
+  }
+  if (result.timedOut) return transportFailure(bytes.byteLength, "timeout");
+  if (result.code === 0) return { kind: "ok", bytes: bytes.byteLength };
+  if (result.code === EXIT_ARCHIVE_CONFIG_MISSING) {
+    return { kind: "config-missing", bytes: bytes.byteLength };
+  }
+  if (result.code === EXIT_ARCHIVE_ACCESS_DENIED) {
+    return { kind: "access-denied", bytes: bytes.byteLength };
+  }
+  if (result.code === null && /ENOENT|runner-synchroniser/i.test(result.stderr)) {
+    return transportFailure(bytes.byteLength, "missing-executable");
+  }
+  return transportFailure(
+    bytes.byteLength,
+    result.code === null ? "spawn-failed" : "process-failed",
+    result.code ?? void 0
+  );
+}
+
+// src/lib/opencode/session-binding-resolution.ts
+var SESSION_BINDING_PROJECTION_CHUNK_SIZE = 500;
+var SESSION_BINDING_PROJECTION_TIMEOUT_MS = 1e4;
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isProjectionSource(value) {
+  return value === "current" || value === "invocation" || value === "history";
+}
+function emptySessionBindingProjection() {
+  return {
+    current: /* @__PURE__ */ new Map(),
+    invocation: /* @__PURE__ */ new Map(),
+    history: /* @__PURE__ */ new Map(),
+    conflicts: /* @__PURE__ */ new Set()
+  };
+}
+function requestedSessionIds(sessions) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const session of sessions) {
+    if (session.id.length > 0) ids.add(session.id);
+    if (typeof session.parentID === "string" && session.parentID.length > 0) {
+      ids.add(session.parentID);
+    }
+  }
+  return [...ids];
+}
+function parseProjectionResponse(value, requestedIds) {
+  if (!isRecord4(value) || !Array.isArray(value.bindings) || !Array.isArray(value.conflicts)) {
+    return null;
+  }
+  const projection = emptySessionBindingProjection();
+  for (const candidate of value.bindings) {
+    if (!isRecord4(candidate) || typeof candidate.opencode_session_id !== "string" || typeof candidate.conversation_id !== "string" || !isProjectionSource(candidate.source) || !requestedIds.has(candidate.opencode_session_id) || projection.conflicts.has(candidate.opencode_session_id)) {
+      return null;
+    }
+    const bindings = projection[candidate.source];
+    if (bindings.has(candidate.opencode_session_id)) return null;
+    bindings.set(candidate.opencode_session_id, candidate.conversation_id);
+  }
+  for (const conflict of value.conflicts) {
+    if (typeof conflict !== "string" || !requestedIds.has(conflict) || projection.conflicts.has(conflict) || projection.current.has(conflict) || projection.invocation.has(conflict) || projection.history.has(conflict)) {
+      return null;
+    }
+    projection.conflicts.add(conflict);
+  }
+  return projection;
+}
+async function fetchSessionBindingProjection({
+  apiUrl,
+  runnerId,
+  authHeader,
+  sessions,
+  signal,
+  fetchImpl = fetch
+}) {
+  const ids = requestedSessionIds(sessions);
+  const projection = emptySessionBindingProjection();
+  const failures = [];
+  if (ids.length === 0) return { projection, complete: true, failures };
+  for (let offset = 0; offset < ids.length; offset += SESSION_BINDING_PROJECTION_CHUNK_SIZE) {
+    const chunk = ids.slice(offset, offset + SESSION_BINDING_PROJECTION_CHUNK_SIZE);
+    const chunkIndex = Math.floor(offset / SESSION_BINDING_PROJECTION_CHUNK_SIZE) + 1;
+    try {
+      const response = await fetchImpl(
+        `${apiUrl}/runners/${runnerId}/conversations/session-bindings`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: authHeader,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({ opencode_session_ids: chunk }),
+          signal: signal ?? AbortSignal.timeout(SESSION_BINDING_PROJECTION_TIMEOUT_MS)
+        }
+      );
+      if (!response.ok) {
+        failures.push({ chunk: chunkIndex, kind: "http", status: response.status });
+        continue;
+      }
+      const result = parseProjectionResponse(await response.json(), new Set(chunk));
+      if (result === null) {
+        failures.push({ chunk: chunkIndex, kind: "invalid-response" });
+        continue;
+      }
+      for (const source of ["current", "invocation", "history"]) {
+        for (const [sessionId, conversationId] of result[source]) {
+          projection[source].set(sessionId, conversationId);
+        }
+      }
+      for (const conflict of result.conflicts) projection.conflicts.add(conflict);
+    } catch (error2) {
+      failures.push({
+        chunk: chunkIndex,
+        kind: "network",
+        message: error2 instanceof Error ? error2.message : String(error2)
+      });
+    }
+  }
+  return { projection, complete: failures.length === 0, failures };
+}
+function directResolution(sessionId, sources) {
+  const localBinding = sources.ledger.get(sessionId);
+  if (localBinding) return { conversation_id: localBinding, source: "ledger" };
+  const watermarkedBinding = sources.watermarks.get(sessionId)?.conversation_id;
+  if (typeof watermarkedBinding === "string" && watermarkedBinding.length > 0) {
+    return { conversation_id: watermarkedBinding, source: "watermark" };
+  }
+  if (sources.projection.conflicts.has(sessionId)) return { reason: "conflict" };
+  for (const source of ["current", "invocation", "history"]) {
+    const conversationId = sources.projection[source].get(sessionId);
+    if (conversationId) return { conversation_id: conversationId, source };
+  }
+  return null;
+}
+function isResolved(resolution) {
+  return "conversation_id" in resolution;
+}
+function resolveSessionBindings(sessions, sources) {
+  const resolutions = /* @__PURE__ */ new Map();
+  for (const session of sessions) {
+    resolutions.set(session.id, directResolution(session.id, sources) ?? { reason: "unmapped" });
+  }
+  let assignedParent = true;
+  while (assignedParent) {
+    assignedParent = false;
+    for (const session of sessions) {
+      const resolution = resolutions.get(session.id);
+      if (isResolved(resolution) || resolution.reason !== "unmapped") continue;
+      if (typeof session.parentID !== "string" || session.parentID.length === 0) continue;
+      const parent = resolutions.get(session.parentID) ?? directResolution(session.parentID, sources) ?? { reason: "unmapped" };
+      if (isResolved(parent)) {
+        resolutions.set(session.id, {
+          conversation_id: parent.conversation_id,
+          source: "parent"
+        });
+        assignedParent = true;
+      } else if (parent.reason === "conflict" || parent.reason === "parent-conflict") {
+        resolutions.set(session.id, { reason: "parent-conflict" });
+        assignedParent = true;
+      }
+    }
+  }
+  return resolutions;
+}
+
+// src/lib/opencode/session-archive-run.ts
+var SESSION_ARCHIVE_UPLOAD_TIMEOUT_MS = 6e4;
+function updatedAt(session) {
+  const updated = session.time?.updated;
+  return typeof updated === "number" && Number.isFinite(updated) ? updated : -Infinity;
+}
+function sessionArchiveKey(prefix, sessionId) {
+  return `${prefix.replace(/\/+$/, "")}/conversation-archives/${encodeURIComponent(sessionId)}.json`;
+}
+function failureMessage(error2) {
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+function countMessageParts(messages) {
+  return messages.reduce((count, message) => {
+    if (typeof message !== "object" || message === null || !("parts" in message)) return count;
+    return count + (Array.isArray(message.parts) ? message.parts.length : 0);
+  }, 0);
+}
+function isBudgetExpired(deadline, now, signal) {
+  return signal?.aborted === true || now() >= deadline;
+}
+function createBudgetSignal(parent, timeoutMs) {
+  const controller = new AbortController();
+  const forwardAbort = () => controller.abort(parent?.reason);
+  if (parent?.aborted) forwardAbort();
+  else parent?.addEventListener("abort", forwardAbort, { once: true });
+  const timer = setTimeout(
+    () => controller.abort(new Error("session archive budget exceeded")),
+    timeoutMs
+  );
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      clearTimeout(timer);
+      parent?.removeEventListener("abort", forwardAbort);
+    }
+  };
+}
+async function runSessionArchive({
+  sessions,
+  deps,
+  budgetMs,
+  now = Date.now
+}) {
+  const startedAt = now();
+  const deadline = startedAt + Math.max(0, budgetMs);
+  const summary = {
+    inspected: sessions.length,
+    uploaded: 0,
+    unchanged: 0,
+    failed: 0,
+    uploadAttempts: 0,
+    uploadFailures: 0,
+    skippedBudget: 0,
+    skippedBudgetIds: [],
+    neverWatermarkedFailures: 0,
+    unmappedIds: [],
+    conflictedIds: [],
+    unresolved: 0,
+    conflicts: 0,
+    reconciliationComplete: deps.reconciliationComplete ?? true,
+    reconciliationIncomplete: 0,
+    bindingSourceCounts: {
+      ledger: 0,
+      watermark: 0,
+      current: 0,
+      invocation: 0,
+      history: 0,
+      parent: 0
+    },
+    archivedSessionIds: [],
+    failures: [],
+    staleSince: null
+  };
+  const ordered = [...sessions].sort((left, right) => updatedAt(right) - updatedAt(left));
+  const upload = deps.upload ?? uploadSessionArchive;
+  const exportMessages = deps.exportMessages ?? exportSessionMessages;
+  const writeWatermark = deps.recordWatermark ?? recordUpload;
+  const resolutions = resolveSessionBindings(sessions, {
+    ledger: deps.bindings,
+    watermarks: deps.watermarks,
+    projection: deps.projection ?? emptySessionBindingProjection()
+  });
+  for (const [sessionId, resolution] of resolutions) {
+    if ("conversation_id" in resolution) {
+      summary.bindingSourceCounts[resolution.source]++;
+    } else if (resolution.reason === "conflict" || resolution.reason === "parent-conflict") {
+      summary.conflictedIds.push(sessionId);
+    } else {
+      summary.unmappedIds.push(sessionId);
+    }
+  }
+  summary.unresolved = summary.unmappedIds.length + summary.conflictedIds.length;
+  summary.conflicts = summary.conflictedIds.length;
+  const failedWatermarks = [];
+  const recordFailedWatermark = (watermark) => {
+    if (watermark) failedWatermarks.push(watermark.uploaded_at);
+    else summary.neverWatermarkedFailures++;
+  };
+  for (let index = 0; index < ordered.length; index++) {
+    const session = ordered[index];
+    const remainingMs = Math.floor(deadline - now());
+    if (remainingMs <= 0 || deps.signal?.aborted) {
+      summary.skippedBudgetIds.push(...ordered.slice(index).map(({ id }) => id));
+      summary.skippedBudget = summary.skippedBudgetIds.length;
+      break;
+    }
+    const resolution = resolutions.get(session.id) ?? { reason: "unmapped" };
+    const resolved = "conversation_id" in resolution;
+    const conversationId = resolved ? resolution.conversation_id : null;
+    const bindingSource = resolved ? resolution.source : "unmapped";
+    if (!resolved && !summary.reconciliationComplete) {
+      summary.failed++;
+      summary.reconciliationIncomplete++;
+      summary.failures.push({
+        sessionId: session.id,
+        outcome: "reconciliation-incomplete",
+        reason: resolution.reason,
+        archived: false
+      });
+      recordFailedWatermark(deps.watermarks.get(session.id));
+      continue;
+    }
+    const exportBudget = createBudgetSignal(deps.signal, remainingMs);
+    let messages;
+    try {
+      messages = await exportMessages(deps.client, session.id, exportBudget.signal);
+    } catch (error2) {
+      if (isBudgetExpired(deadline, now, deps.signal) || exportBudget.signal.aborted) {
+        summary.skippedBudgetIds.push(...ordered.slice(index).map(({ id }) => id));
+        summary.skippedBudget = summary.skippedBudgetIds.length;
+        break;
+      }
+      summary.failed++;
+      const reason = error2 instanceof SessionArchiveExportError ? error2.code : "export-failed";
+      summary.failures.push({
+        sessionId: session.id,
+        outcome: "export-failed",
+        reason,
+        message: failureMessage(error2),
+        archived: false
+      });
+      recordFailedWatermark(deps.watermarks.get(session.id));
+      continue;
+    } finally {
+      exportBudget.dispose();
+    }
+    if (isBudgetExpired(deadline, now, deps.signal) || exportBudget.signal.aborted) {
+      summary.skippedBudgetIds.push(...ordered.slice(index).map(({ id }) => id));
+      summary.skippedBudget = summary.skippedBudgetIds.length;
+      break;
+    }
+    try {
+      const archivedAt = new Date(now()).toISOString();
+      const snapshot = buildSessionArchive({
+        session,
+        messages,
+        apiVersion: deps.client.version,
+        conversationId,
+        bindingSource,
+        runnerId: deps.runnerId,
+        archivedAt
+      });
+      const key = sessionArchiveKey(deps.keyPrefix, session.id);
+      const existing = deps.watermarks.get(session.id);
+      if (existing?.fingerprint === snapshot.content_fingerprint) {
+        summary.unchanged++;
+        summary.archivedSessionIds.push(session.id);
+        continue;
+      }
+      const uploadRemainingMs = Math.floor(deadline - now());
+      if (uploadRemainingMs <= 0 || deps.signal?.aborted) {
+        summary.skippedBudgetIds.push(...ordered.slice(index).map(({ id }) => id));
+        summary.skippedBudget = summary.skippedBudgetIds.length;
+        break;
+      }
+      summary.uploadAttempts++;
+      const uploadBudget = createBudgetSignal(deps.signal, uploadRemainingMs);
+      let outcome;
+      try {
+        outcome = await upload(key, JSON.stringify(snapshot), {
+          timeoutMs: Math.min(uploadRemainingMs, SESSION_ARCHIVE_UPLOAD_TIMEOUT_MS),
+          signal: uploadBudget.signal
+        });
+      } finally {
+        uploadBudget.dispose();
+      }
+      if (outcome.kind !== "ok") {
+        summary.failed++;
+        summary.uploadFailures++;
+        const reason = "reason" in outcome ? outcome.reason : void 0;
+        summary.failures.push({
+          sessionId: session.id,
+          outcome: outcome.kind,
+          ...reason !== void 0 ? { reason } : {},
+          ..."message" in outcome ? { message: outcome.message } : {},
+          bytes: outcome.bytes,
+          byteLimit: MAX_SESSION_ARCHIVE_BYTES,
+          messageCount: messages.length,
+          partCount: countMessageParts(messages),
+          ..."exitCode" in outcome && outcome.exitCode !== void 0 ? { exitCode: outcome.exitCode } : {},
+          archived: false
+        });
+        recordFailedWatermark(existing);
+        if (uploadBudget.signal.aborted) {
+          summary.skippedBudgetIds.push(...ordered.slice(index + 1).map(({ id }) => id));
+          summary.skippedBudget = summary.skippedBudgetIds.length;
+          break;
+        }
+        continue;
+      }
+      summary.uploaded++;
+      summary.archivedSessionIds.push(session.id);
+      const watermark = {
+        fingerprint: snapshot.content_fingerprint,
+        uploaded_at: new Date(now()).toISOString(),
+        key,
+        conversation_id: conversationId
+      };
+      try {
+        writeWatermark(deps.watermarkPath, session.id, watermark, deps.watermarks);
+      } catch (error2) {
+        summary.failures.push({
+          sessionId: session.id,
+          outcome: "watermark-write-failed",
+          message: failureMessage(error2),
+          archived: true
+        });
+      }
+    } catch (error2) {
+      if (isBudgetExpired(deadline, now, deps.signal)) {
+        summary.skippedBudgetIds.push(...ordered.slice(index).map(({ id }) => id));
+        summary.skippedBudget = summary.skippedBudgetIds.length;
+        break;
+      }
+      summary.failed++;
+      summary.failures.push({
+        sessionId: session.id,
+        outcome: "archive-failed",
+        message: failureMessage(error2),
+        archived: false
+      });
+      recordFailedWatermark(deps.watermarks.get(session.id));
+    }
+  }
+  summary.staleSince = failedWatermarks.sort()[0] ?? null;
+  return summary;
+}
+
+// src/lib/opencode/auth.ts
+function buildOpenCodeBasicAuthHeader(password) {
+  return `Basic ${Buffer.from(["opencode", password].join(":")).toString("base64")}`;
+}
+
+// src/lib/opencode/health.ts
+async function checkOpenCodeHealth(port) {
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/global/health`, {
+      signal: AbortSignal.timeout(2e3)
+      // 2 second timeout
+    });
+    if (response.status === 401) {
+      return { healthy: false, authFailed: true, error: "HTTP 401" };
+    }
+    if (!response.ok) {
+      return { healthy: false, error: `HTTP ${response.status}` };
+    }
+    const body = await response.text();
+    let data;
+    try {
+      data = JSON.parse(body);
+    } catch (error2) {
+      return {
+        healthy: false,
+        okWithNonJsonBody: true,
+        error: `HTTP ${response.status}: invalid JSON health response${bodyExcerpt(body)}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      };
+    }
+    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+      return {
+        healthy: false,
+        okWithNonJsonBody: true,
+        error: `HTTP ${response.status}: invalid health response${bodyExcerpt(body)}: expected JSON object`
+      };
+    }
+    const version2 = data.version;
+    return typeof version2 === "string" ? { healthy: true, version: version2 } : { healthy: true };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { healthy: false, error: message };
+  }
+}
+function bodyExcerpt(body) {
+  const excerpt = body.replace(/\s+/g, " ").trim().slice(0, 160);
+  return excerpt ? ` (body="${excerpt}")` : " (empty body)";
+}
+async function checkOpenCode2Health(port, password) {
+  try {
+    const headers = {};
+    if (password !== void 0) {
+      headers.Authorization = buildOpenCodeBasicAuthHeader(password);
+    }
+    let response = await fetch(`http://127.0.0.1:${port}/api/info`, {
+      headers,
+      signal: AbortSignal.timeout(2e3)
+    });
+    const usesHealthFallback = response.status === 404;
+    if (usesHealthFallback) {
+      response = await fetch(`http://127.0.0.1:${port}/api/health`, {
+        headers,
+        signal: AbortSignal.timeout(2e3)
+      });
+    }
+    if (response.status === 401) {
+      return { healthy: false, authFailed: true, error: "HTTP 401" };
+    }
+    if (!response.ok) {
+      return { healthy: false, error: `HTTP ${response.status}` };
+    }
+    const body = await response.text();
+    const excerpt = bodyExcerpt(body);
+    let data;
+    try {
+      data = JSON.parse(body);
+    } catch (error2) {
+      return {
+        healthy: false,
+        error: `HTTP ${response.status}: invalid JSON health response${excerpt}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      };
+    }
+    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+      return {
+        healthy: false,
+        error: `HTTP ${response.status}: invalid health response${excerpt}: expected healthy=true`
+      };
+    }
+    const bodyObject = data;
+    if (usesHealthFallback && bodyObject.healthy !== true) {
+      return {
+        healthy: false,
+        error: `Invalid health response${excerpt}: expected healthy=true`
+      };
+    }
+    if (!usesHealthFallback) {
+      return typeof bodyObject.version === "string" && bodyObject.version.length > 0 ? { healthy: true, version: bodyObject.version } : {
+        healthy: false,
+        error: `HTTP ${response.status}: invalid info response${excerpt}: expected a non-empty version`
+      };
+    }
+    return typeof bodyObject.version === "string" ? { healthy: true, version: bodyObject.version } : { healthy: true };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { healthy: false, error: message };
+  }
+}
+async function waitForOpenCodeHealth(port, timeoutMs = 3e4) {
+  const startTime = Date.now();
+  while (Date.now() - startTime < timeoutMs) {
+    const health = await checkOpenCodeHealth(port);
+    if (health.healthy || health.authFailed) {
+      return health;
+    }
+    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+  }
+  return { healthy: false, error: "Timeout waiting for OpenCode to be healthy" };
+}
+async function waitForOpenCode2Health(port, password, timeoutMs = 3e4) {
+  const startTime = Date.now();
+  while (Date.now() - startTime < timeoutMs) {
+    const health = await checkOpenCode2Health(port, password);
+    if (health.healthy || health.authFailed) {
+      return health;
+    }
+    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+  }
+  return { healthy: false, error: "Timeout waiting for OpenCode to be healthy" };
+}
+
+// src/lib/http-timeout.ts
+var REQUEST_TIMEOUT_MS = 6e4;
+var RequestTimeoutError = class extends Error {
+  constructor(operation, timeoutMs, elapsedMs) {
+    super(`${operation} timed out after ${elapsedMs}ms (limit ${timeoutMs}ms)`);
+    this.operation = operation;
+    this.timeoutMs = timeoutMs;
+    this.elapsedMs = elapsedMs;
+    this.name = "TimeoutError";
+  }
+};
+function describeRequestOperation(input, init) {
+  const method = (init?.method ?? input.method ?? "GET").toUpperCase();
+  const rawUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+  let path;
+  try {
+    path = new URL(rawUrl).pathname;
+  } catch (error2) {
+    if (!(error2 instanceof TypeError)) throw error2;
+    path = rawUrl.split(/[?#]/, 1)[0];
+  }
+  const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  const prefixedIdentifier = /^[a-z]+_[A-Za-z0-9_-]{10,}$/;
+  const maskedPath = path.split("/").map((segment) => uuid.test(segment) || prefixedIdentifier.test(segment) ? ":id" : segment).join("/");
+  return `${method} ${maskedPath}`;
+}
+function withRequestTimeout(fetchImpl, timeoutMs) {
+  return (async (input, init) => {
+    const startedAt = Date.now();
+    const controller = new AbortController();
+    const abortFromCaller = () => controller.abort(init?.signal?.reason);
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    const abortFromTimeout = () => controller.abort(timeoutSignal.reason);
+    if (init?.signal?.aborted) abortFromCaller();
+    else init?.signal?.addEventListener("abort", abortFromCaller, { once: true });
+    if (timeoutSignal.aborted) abortFromTimeout();
+    else timeoutSignal.addEventListener("abort", abortFromTimeout, { once: true });
+    try {
+      return await fetchImpl(input, { ...init, signal: controller.signal });
+    } catch (error2) {
+      if (timeoutSignal.aborted) {
+        throw new RequestTimeoutError(
+          describeRequestOperation(input, init),
+          timeoutMs,
+          Date.now() - startedAt
+        );
+      }
+      throw error2;
+    } finally {
+      init?.signal?.removeEventListener("abort", abortFromCaller);
+      timeoutSignal.removeEventListener("abort", abortFromTimeout);
+    }
+  });
+}
+
+// src/lib/opencode/client.ts
+var OpenCodeRequestError = class extends Error {
+  constructor(statusCode, message) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = "OpenCodeRequestError";
+  }
+};
+function redactPassword(message, password) {
+  return message.replaceAll(password, "[redacted]");
+}
+function createOpenCodeClient(options) {
   const password = options.password ?? null;
   const fetchImpl = withRequestTimeout(options.fetchImpl ?? fetch, REQUEST_TIMEOUT_MS);
   const baseUrl = `http://127.0.0.1:${options.port}`;
@@ -2921,7 +4146,8 @@ function createOpenCodeClient(options) {
         const response = await fetchImpl(`${baseUrl}${path}`, requestInit);
         if (!response.ok && !requestOptions?.allowStatuses?.includes(response.status)) {
           const body = await response.text();
-          throw new Error(
+          throw new OpenCodeRequestError(
+            response.status,
             `OpenCode request failed: HTTP ${response.status}${body ? `: ${body}` : ""}`
           );
         }
@@ -2929,7 +4155,11 @@ function createOpenCodeClient(options) {
       } catch (error2) {
         if (options.version === "v2" && password !== null) {
           const message = error2 instanceof Error ? error2.message : String(error2);
-          throw new Error(redactPassword(message, password));
+          const redactedMessage = redactPassword(message, password);
+          if (error2 instanceof OpenCodeRequestError) {
+            throw new OpenCodeRequestError(error2.statusCode, redactedMessage);
+          }
+          throw new Error(redactedMessage);
         }
         throw error2;
       }
@@ -3078,28 +4308,38 @@ function sessionListPath(options) {
 async function listSessionPage(port, client, options) {
   const path = sessionListPath(options);
   try {
-    const res = await requestWithClient(port, client, path);
-    if (!res.ok) return null;
+    const res = await requestWithClient(
+      port,
+      client,
+      path,
+      options?.signal ? { signal: options.signal } : void 0,
+      { allowStatuses: ALL_HTTP_STATUSES }
+    );
+    if (!res.ok) {
+      console.error(`[listSessionPage] GET ${path} returned HTTP ${res.status} (port ${port})`);
+      return null;
+    }
     const body = await res.json();
     return Array.isArray(body) ? body : null;
   } catch (error2) {
-    console.error(
-      `[listSessionPage] GET ${path} failed: ${error2 instanceof Error ? error2.message : String(error2)}`
-    );
+    if (options?.signal?.aborted) return null;
+    const errorName = error2 instanceof Error && ["AbortError", "Error", "TimeoutError", "TypeError"].includes(error2.name) ? error2.name : "unknown error";
+    console.error(`[listSessionPage] GET ${path} failed (port ${port}): ${errorName}`);
     return null;
   }
 }
 async function listSessions(port, client, options) {
-  if (client?.version === "v2") return listV2Sessions(client);
+  if (client?.version === "v2") return listV2Sessions(client, options?.signal);
   return listSessionPage(port, client, options);
 }
-async function listAllSessions(port, client) {
+async function listAllSessions(port, client, signal) {
   if (client?.version === "v2") {
-    const sessions2 = await listV2Sessions(client);
+    const sessions2 = await listV2Sessions(client, signal);
     return sessions2 === null ? { sessions: null, reason: "opencode-unreachable" } : { sessions: sessions2 };
   }
   const sessions = await listSessionPage(port, client, {
-    limit: FULL_SESSION_ENUMERATION_MAX_SESSIONS
+    limit: FULL_SESSION_ENUMERATION_MAX_SESSIONS,
+    signal
   });
   if (sessions === null) return { sessions: null, reason: "opencode-unreachable" };
   if (sessions.length >= FULL_SESSION_ENUMERATION_MAX_SESSIONS) {
@@ -3595,28 +4835,38 @@ function findLastAssistantReplyFor(messages, userMessageId) {
   }
   return last;
 }
+function assistantMessagesInTurnBlock(messages, userMessageId) {
+  const userIndex = messages.findIndex((message) => idOf2(message) === userMessageId);
+  if (userIndex === -1) return [];
+  const assistants = [];
+  for (let i = userIndex + 1; i < messages.length; i++) {
+    const message = messages[i];
+    const role = roleOf2(message);
+    if (role === "user") break;
+    if (role === "assistant") assistants.push(message);
+  }
+  return assistants;
+}
 function collectSubagentSessions(messages, userMessageId) {
   if (!messages || messages.length === 0) return [];
   const byParent = messages.filter(
     (message) => roleOf2(message) === "assistant" && parentIdOf2(message) === userMessageId
   );
-  const assistants = byParent.length > 0 ? byParent : [];
-  if (assistants.length === 0) {
-    const userIndex = messages.findIndex((message) => idOf2(message) === userMessageId);
-    if (userIndex === -1) return [];
-    for (let i = userIndex + 1; i < messages.length; i++) {
-      const message = messages[i];
-      if (roleOf2(message) === "user") break;
-      if (roleOf2(message) === "assistant") assistants.push(message);
-    }
-  }
+  const assistants = byParent.length > 0 ? byParent : assistantMessagesInTurnBlock(messages, userMessageId);
   const refs = [];
   const seen = /* @__PURE__ */ new Set();
   for (const message of assistants) {
     const parts = Array.isArray(message.parts) ? message.parts : [];
     for (const part of parts) {
-      if (!part || typeof part !== "object" || part.type !== "tool" || part.tool !== "task")
+      if (!part || typeof part !== "object" || part.type !== "tool") continue;
+      const childSession = part.childSession;
+      if (childSession) {
+        if (seen.has(childSession.sessionId)) continue;
+        seen.add(childSession.sessionId);
+        refs.push(childSession);
         continue;
+      }
+      if (part.tool !== "task") continue;
       const state = part.state;
       if (!state || typeof state !== "object") continue;
       const metadata = state.metadata;
@@ -3764,8 +5014,7 @@ function messageUsage(messages, userMessageId) {
   if (byParentAll.length > 0) {
     correlated = byParentAll;
   } else {
-    const reply = findAssistantReplyAfter(messages, userMessageId);
-    correlated = reply ? [reply] : [];
+    correlated = assistantMessagesInTurnBlock(messages, userMessageId);
   }
   if (correlated.length === 0) return null;
   return sumAssistantUsage(correlated);
@@ -3900,8 +5149,8 @@ function classifyReplyAuthError(reply) {
       };
     }
   }
-  const errorMessage3 = typeof data?.message === "string" ? data.message : typeof e.message === "string" ? e.message : null;
-  if (errorMessage3 !== null && CLAUDE_AUTH_EXPIRY_MESSAGES.some((knownMessage) => errorMessage3.includes(knownMessage))) {
+  const errorMessage4 = typeof data?.message === "string" ? data.message : typeof e.message === "string" ? e.message : null;
+  if (errorMessage4 !== null && CLAUDE_AUTH_EXPIRY_MESSAGES.some((knownMessage) => errorMessage4.includes(knownMessage))) {
     return {
       kind: "model_auth",
       providerId: typeof data?.providerID === "string" && data.providerID || replyProviderId,
@@ -3987,39 +5236,85 @@ async function hasAnyConfiguredProvider(port, client) {
       );
       return null;
     }
-    const path = `/api/integration?location%5Bdirectory%5D=${encodeURIComponent(directory)}`;
+    const query = `?location%5Bdirectory%5D=${encodeURIComponent(directory)}`;
+    const integrationPath = `/api/integration${query}`;
+    let integrationReady = null;
     try {
-      const res = await client.request(path);
+      const res = await client.request(integrationPath);
       if (!res.ok) {
         console.error(
-          `[hasAnyConfiguredProvider] GET ${path} returned HTTP ${res.status} (port ${port})`
+          `[hasAnyConfiguredProvider] GET ${integrationPath} returned HTTP ${res.status} (port ${port})`
         );
-        return null;
+      } else {
+        const body = await res.json();
+        if (!body || typeof body !== "object" || Array.isArray(body) || !Array.isArray(body.data)) {
+          console.error(
+            `[hasAnyConfiguredProvider] GET ${integrationPath} body had no integration data array (port ${port})`
+          );
+        } else {
+          let valid = true;
+          for (const integration of body.data) {
+            if (!integration || typeof integration !== "object" || Array.isArray(integration) || typeof integration.id !== "string" || !Array.isArray(integration.connections)) {
+              console.error(
+                `[hasAnyConfiguredProvider] GET ${integrationPath} body contained an invalid integration (port ${port})`
+              );
+              valid = false;
+              break;
+            }
+          }
+          if (valid) {
+            integrationReady = body.data.some(
+              (integration) => integration.connections.length > 0
+            );
+          }
+        }
       }
-      const body = await res.json();
-      if (!body || typeof body !== "object" || Array.isArray(body) || !Array.isArray(body.data)) {
+    } catch (error2) {
+      console.error(
+        `[hasAnyConfiguredProvider] GET ${integrationPath} failed (port ${port}): ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+    }
+    if (integrationReady === true) return true;
+    const providerPath = `/api/provider${query}`;
+    let providerReady = null;
+    try {
+      const res = await client.request(providerPath);
+      if (!res.ok) {
         console.error(
-          `[hasAnyConfiguredProvider] GET ${path} body had no integration data array (port ${port})`
+          `[hasAnyConfiguredProvider] GET ${providerPath} returned HTTP ${res.status} (port ${port})`
         );
-        return null;
-      }
-      for (const integration of body.data) {
-        if (!integration || typeof integration !== "object" || Array.isArray(integration) || typeof integration.id !== "string" || !Array.isArray(integration.connections)) {
+      } else {
+        const body = await res.json();
+        if (!body || typeof body !== "object" || Array.isArray(body) || !Array.isArray(body.data)) {
           console.error(
-            `[hasAnyConfiguredProvider] GET ${path} body contained an invalid integration (port ${port})`
+            `[hasAnyConfiguredProvider] GET ${providerPath} body had no provider data array (port ${port})`
           );
-          return null;
+        } else {
+          let valid = true;
+          for (const provider of body.data) {
+            if (!provider || typeof provider !== "object" || Array.isArray(provider) || typeof provider.id !== "string") {
+              console.error(
+                `[hasAnyConfiguredProvider] GET ${providerPath} body contained an invalid provider (port ${port})`
+              );
+              valid = false;
+              break;
+            }
+          }
+          if (valid) {
+            providerReady = body.data.some(
+              (provider) => provider.activation === "enabled"
+            );
+          }
         }
       }
-      return body.data.some(
-        (integration) => Array.isArray(integration.connections) && integration.connections.length > 0
-      );
     } catch (error2) {
       console.error(
-        `[hasAnyConfiguredProvider] GET ${path} failed (port ${port}): ${error2 instanceof Error ? error2.message : String(error2)}`
+        `[hasAnyConfiguredProvider] GET ${providerPath} failed (port ${port}): ${error2 instanceof Error ? error2.message : String(error2)}`
       );
-      return null;
     }
+    if (providerReady === true) return true;
+    if (integrationReady === null || providerReady === null) return null;
+    return false;
   }
   try {
     const res = await requestWithClient(port, client, "/config/providers");
@@ -4172,14 +5467,15 @@ async function probeOpenCodeRequestReadiness(port, client) {
 }
 
 // src/lib/opencode/session-v2.ts
-function isRecord(value) {
+var ALL_HTTP_STATUSES2 = Array.from({ length: 500 }, (_, index) => index + 100);
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function finiteNumber2(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function adaptTime(value) {
-  if (!isRecord(value)) return void 0;
+  if (!isRecord5(value)) return void 0;
   const created = finiteNumber2(value.created);
   const completed = finiteNumber2(value.completed);
   if (created === void 0 && completed === void 0) return void 0;
@@ -4189,11 +5485,11 @@ function adaptTime(value) {
   };
 }
 function adaptTokens(value) {
-  if (!isRecord(value)) return void 0;
+  if (!isRecord5(value)) return void 0;
   const input = finiteNumber2(value.input);
   const output = finiteNumber2(value.output);
   const reasoning = finiteNumber2(value.reasoning);
-  const cache = isRecord(value.cache) ? {
+  const cache = isRecord5(value.cache) ? {
     ...finiteNumber2(value.cache.read) !== void 0 ? { read: finiteNumber2(value.cache.read) } : {},
     ...finiteNumber2(value.cache.write) !== void 0 ? { write: finiteNumber2(value.cache.write) } : {}
   } : void 0;
@@ -4217,7 +5513,7 @@ function adaptMessageInfo(value, role) {
   if (typeof value.finish === "string") info.finish = value.finish;
   if ("error" in value) info.error = value.error;
   if (typeof value.agent === "string") info.agent = value.agent;
-  if (isRecord(value.model)) {
+  if (isRecord5(value.model)) {
     if (typeof value.model.id === "string") info.modelID = value.model.id;
     if (typeof value.model.providerID === "string") info.providerID = value.model.providerID;
   }
@@ -4226,8 +5522,16 @@ function adaptMessageInfo(value, role) {
   if (tokens) info.tokens = tokens;
   return info;
 }
+function v2ChildSessionEvidence(content) {
+  const state = isRecord5(content.state) ? content.state : null;
+  const metadata = state && isRecord5(state.metadata) ? state.metadata : null;
+  const sessionId = typeof metadata?.sessionID === "string" && metadata.sessionID.length > 0 ? metadata.sessionID : typeof metadata?.sessionId === "string" && metadata.sessionId.length > 0 ? metadata.sessionId : null;
+  if (sessionId === null) return null;
+  const time = isRecord5(content.time) ? content.time : null;
+  return { sessionId, startedAtMs: finiteNumber2(time?.created) ?? null };
+}
 function adaptV2Message(value) {
-  if (!isRecord(value) || typeof value.id !== "string" || typeof value.type !== "string") {
+  if (!isRecord5(value) || typeof value.id !== "string" || typeof value.type !== "string") {
     return null;
   }
   if (value.type === "user") {
@@ -4240,7 +5544,13 @@ function adaptV2Message(value) {
   if (value.type !== "assistant" || !Array.isArray(value.content)) return null;
   const parts = [];
   for (const content of value.content) {
-    if (!isRecord(content) || typeof content.type !== "string") return null;
+    if (!isRecord5(content) || typeof content.type !== "string") return null;
+    const toolPart = projectV2ToolContent(content);
+    if (toolPart) {
+      const childSession = v2ChildSessionEvidence(content);
+      parts.push(childSession ? { ...toolPart, childSession } : toolPart);
+      continue;
+    }
     if (content.type === "text") {
       if (typeof content.text !== "string") return null;
       parts.push({ type: "text", text: content.text });
@@ -4254,23 +5564,23 @@ function adaptV2Message(value) {
   };
 }
 function adaptFormTool(value) {
-  if (!isRecord(value) || typeof value.messageID !== "string" || typeof value.id !== "string") {
+  if (!isRecord5(value) || typeof value.messageID !== "string" || typeof value.id !== "string") {
     return void 0;
   }
   return { messageID: value.messageID, callID: value.id };
 }
 function adaptV2FormWire(value) {
-  if (!isRecord(value) || typeof value.id !== "string" || typeof value.sessionID !== "string") {
+  if (!isRecord5(value) || typeof value.id !== "string" || typeof value.sessionID !== "string") {
     return null;
   }
   return value;
 }
 function adaptV2FormField(value, header) {
-  if (!isRecord(value)) return null;
+  if (!isRecord5(value)) return null;
   const question = typeof value.title === "string" ? value.title : typeof value.question === "string" ? value.question : typeof value.key === "string" ? value.key : null;
   if (!question) return null;
   const options = Array.isArray(value.options) ? value.options.flatMap((option) => {
-    if (!isRecord(option)) return [];
+    if (!isRecord5(option)) return [];
     const label = typeof option.label === "string" ? option.label : typeof option.value === "string" ? option.value : null;
     if (!label) return [];
     return [
@@ -4288,7 +5598,7 @@ function adaptV2Form(value) {
   const header = typeof form.title === "string" ? form.title : "";
   const questions = form.fields.map((field) => adaptV2FormField(field, header)).filter((question) => question !== null);
   if (questions.length === 0) return null;
-  const tool = isRecord(form.metadata) ? adaptFormTool(form.metadata.tool) : void 0;
+  const tool = isRecord5(form.metadata) ? adaptFormTool(form.metadata.tool) : void 0;
   return {
     id: form.id,
     sessionID: form.sessionID,
@@ -4298,7 +5608,7 @@ function adaptV2Form(value) {
   };
 }
 function adaptV2FormList(value) {
-  if (!isRecord(value) || !Array.isArray(value.data)) return null;
+  if (!isRecord5(value) || !Array.isArray(value.data)) return null;
   return value.data.map(adaptV2Form).filter((form) => form !== null);
 }
 function adaptPattern(value) {
@@ -4309,7 +5619,7 @@ function adaptPattern(value) {
   return void 0;
 }
 function adaptV2PermissionWire(value) {
-  if (!isRecord(value) || typeof value.id !== "string" || typeof value.sessionID !== "string") {
+  if (!isRecord5(value) || typeof value.id !== "string" || typeof value.sessionID !== "string") {
     return null;
   }
   if (typeof value.permission !== "string" && typeof value.action !== "string") return null;
@@ -4321,12 +5631,12 @@ function adaptV2Permission(value) {
   const type = permission.permission ?? permission.action;
   if (!type) return null;
   const pattern = adaptPattern(permission.pattern) ?? adaptPattern(permission.patterns) ?? adaptPattern(permission.resources);
-  const time = isRecord(permission.time) ? finiteNumber2(permission.time.created) !== void 0 ? { created: finiteNumber2(permission.time.created) } : void 0 : void 0;
+  const time = isRecord5(permission.time) ? finiteNumber2(permission.time.created) !== void 0 ? { created: finiteNumber2(permission.time.created) } : void 0 : void 0;
   return {
     id: permission.id,
     type,
     sessionID: permission.sessionID,
-    metadata: isRecord(permission.metadata) ? permission.metadata : {},
+    metadata: isRecord5(permission.metadata) ? permission.metadata : {},
     raw: permission,
     ...pattern !== void 0 ? { pattern } : {},
     ...typeof permission.messageID === "string" ? { messageID: permission.messageID } : {},
@@ -4336,12 +5646,12 @@ function adaptV2Permission(value) {
   };
 }
 function adaptV2PermissionList(value) {
-  if (!isRecord(value) || !Array.isArray(value.data)) return null;
+  if (!isRecord5(value) || !Array.isArray(value.data)) return null;
   return value.data.map(adaptV2Permission).filter((permission) => permission !== null);
 }
 function adaptV2Session(value) {
-  if (!isRecord(value) || typeof value.id !== "string" || value.id.length === 0) return null;
-  const time = isRecord(value.time) ? {
+  if (!isRecord5(value) || typeof value.id !== "string" || value.id.length === 0) return null;
+  const time = isRecord5(value.time) ? {
     ...finiteNumber2(value.time.created) !== void 0 ? { created: finiteNumber2(value.time.created) } : {},
     ...finiteNumber2(value.time.updated) !== void 0 ? { updated: finiteNumber2(value.time.updated) } : {}
   } : void 0;
@@ -4353,7 +5663,7 @@ function adaptV2Session(value) {
   };
 }
 function adaptV2SessionList(value) {
-  if (!isRecord(value) || !Array.isArray(value.data) || !isRecord(value.cursor)) return null;
+  if (!isRecord5(value) || !Array.isArray(value.data) || !isRecord5(value.cursor)) return null;
   return {
     data: value.data.map(adaptV2Session).filter((session) => session !== null),
     cursor: value.cursor
@@ -4362,18 +5672,18 @@ function adaptV2SessionList(value) {
 function adaptV2Location(value) {
   const candidates = [
     value,
-    isRecord(value) ? value.data : void 0,
-    isRecord(value) ? value.location : void 0
+    isRecord5(value) ? value.data : void 0,
+    isRecord5(value) ? value.location : void 0
   ];
   for (const candidate of candidates) {
-    if (!isRecord(candidate) || typeof candidate.directory !== "string") continue;
+    if (!isRecord5(candidate) || typeof candidate.directory !== "string") continue;
     const directory = candidate.directory.trim();
     if (directory) return directory;
   }
   return null;
 }
 function adaptV2Messages(value) {
-  if (!isRecord(value) || !Array.isArray(value.data)) return [];
+  if (!isRecord5(value) || !Array.isArray(value.data)) return [];
   return value.data.slice().reverse().map(adaptV2Message).filter((message) => message !== null);
 }
 async function readJson(response) {
@@ -4388,7 +5698,7 @@ async function readJson(response) {
 async function readData(client, path, init) {
   const response = await client.request(path, init);
   const body = await readJson(response);
-  if (!isRecord(body) || !("data" in body)) {
+  if (!isRecord5(body) || !("data" in body)) {
     throw new Error(`OpenCode V2 response for ${path} was missing its data envelope`);
   }
   return body.data;
@@ -4399,6 +5709,14 @@ var OpenCodeV2PromptAckError = class extends Error {
     this.name = "OpenCodeV2PromptAckError";
   }
 };
+var OpenCodeV2ModelSwitchError = class extends Error {
+  statusCode;
+  constructor(error2) {
+    super(error2 instanceof Error ? error2.message : String(error2));
+    this.name = "OpenCodeV2ModelSwitchError";
+    this.statusCode = error2 instanceof OpenCodeRequestError ? error2.statusCode : null;
+  }
+};
 async function getOpenCodeDirectoryV2(client) {
   try {
     return adaptV2Location(await readJson(await client.request("/api/location")));
@@ -4415,7 +5733,7 @@ async function createV2Session(client, directory) {
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ location: { directory } })
   });
-  if (!isRecord(data) || typeof data.id !== "string" || data.id.length === 0) {
+  if (!isRecord5(data) || typeof data.id !== "string" || data.id.length === 0) {
     throw new Error("OpenCode V2 create session response was missing data.id");
   }
   return data.id;
@@ -4426,25 +5744,35 @@ async function getV2Session(client, sessionId) {
   if (!session) throw new Error("OpenCode V2 get session response contained an invalid session");
   return session;
 }
-async function listV2SessionPage(client, cursor) {
+async function listV2SessionPage(client, cursor, signal) {
+  const operation = cursor ? "GET /api/session (next page)" : "GET /api/session";
   const path = cursor ? `/api/session?cursor=${encodeURIComponent(cursor)}` : "/api/session";
   try {
-    return adaptV2SessionList(await readJson(await client.request(path)));
+    const response = await client.request(path, signal ? { signal } : void 0, {
+      allowStatuses: ALL_HTTP_STATUSES2
+    });
+    if (!response.ok) {
+      console.error(
+        `[listV2SessionPage] ${operation} returned HTTP ${response.status} (port ${client.port})`
+      );
+      return null;
+    }
+    return adaptV2SessionList(await readJson(response));
   } catch (error2) {
-    console.error(
-      `[listV2SessionPage] GET ${path} failed: ${error2 instanceof Error ? error2.message : String(error2)}`
-    );
+    if (signal?.aborted) return null;
+    const errorName = error2 instanceof Error && ["AbortError", "Error", "TimeoutError", "TypeError"].includes(error2.name) ? error2.name : "unknown error";
+    console.error(`[listV2SessionPage] ${operation} failed (port ${client.port}): ${errorName}`);
     return null;
   }
 }
-async function listV2Sessions(client) {
+async function listV2Sessions(client, signal) {
   const sessions = [];
   const seenCursors = /* @__PURE__ */ new Set();
   let cursor;
   let hasNextPage = true;
   try {
     while (hasNextPage) {
-      const page = await listV2SessionPage(client, cursor);
+      const page = await listV2SessionPage(client, cursor, signal);
       if (!page) return null;
       sessions.push(...page.data);
       const next = page.cursor.next;
@@ -4460,8 +5788,9 @@ async function listV2Sessions(client) {
     }
     return sessions;
   } catch (error2) {
+    const errorName = error2 instanceof Error && ["AbortError", "Error", "TimeoutError", "TypeError"].includes(error2.name) ? error2.name : "unknown error";
     console.error(
-      `[listV2Sessions] session pagination failed: ${error2 instanceof Error ? error2.message : String(error2)}`
+      `[listV2Sessions] GET /api/session pagination failed (port ${client.port}): ${errorName}`
     );
     return null;
   }
@@ -4471,7 +5800,7 @@ async function deleteV2Session(client, sessionId) {
     const response = await client.request(
       `/api/session/${encodeURIComponent(sessionId)}`,
       { method: "DELETE" },
-      { allowStatuses: Array.from({ length: 500 }, (_, index) => index + 100) }
+      { allowStatuses: ALL_HTTP_STATUSES2 }
     );
     if (response.status >= 200 && response.status < 300) {
       return { ok: true, status: response.status };
@@ -4507,7 +5836,34 @@ async function v2SessionExists(client, sessionId) {
     return null;
   }
 }
-async function sendV2Prompt(client, sessionId, text) {
+async function sendV2Prompt(client, sessionId, text, options, onInvalidModelSelection) {
+  const modelSelection = options?.model?.trim();
+  const { model, variant } = splitModelVariant(modelSelection);
+  const separator = model?.indexOf("/") ?? -1;
+  const modelReference = model && separator > 0 && separator < model.length - 1 ? {
+    id: model.slice(separator + 1),
+    providerID: model.slice(0, separator),
+    ...variant ? { variant } : {}
+  } : void 0;
+  if (modelSelection && !modelReference) onInvalidModelSelection?.();
+  if (options?.agent) {
+    await client.request(`/api/session/${encodeURIComponent(sessionId)}/agent`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ agent: options.agent })
+    });
+  }
+  if (modelReference) {
+    try {
+      await client.request(`/api/session/${encodeURIComponent(sessionId)}/model`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ model: modelReference })
+      });
+    } catch (error2) {
+      throw new OpenCodeV2ModelSwitchError(error2);
+    }
+  }
   const path = `/api/session/${encodeURIComponent(sessionId)}/prompt`;
   const response = await client.request(path, {
     method: "POST",
@@ -4522,8 +5878,8 @@ async function sendV2Prompt(client, sessionId, text) {
       `OpenCode V2 prompt response could not be read: ${error2 instanceof Error ? error2.message : String(error2)}`
     );
   }
-  const data = isRecord(body) && "data" in body ? body.data : void 0;
-  if (!isRecord(data) || typeof data.id !== "string" || data.id.length === 0) {
+  const data = isRecord5(body) && "data" in body ? body.data : void 0;
+  if (!isRecord5(data) || typeof data.id !== "string" || data.id.length === 0) {
     throw new OpenCodeV2PromptAckError("OpenCode V2 prompt response was missing data.id");
   }
   return data.id;
@@ -4532,7 +5888,7 @@ async function getV2SessionMessages(client, sessionId) {
   const path = `/api/session/${encodeURIComponent(sessionId)}/message?order=desc&limit=200`;
   try {
     const body = await readJson(await client.request(path));
-    if (!isRecord(body) || !Array.isArray(body.data) || !isRecord(body.cursor)) return null;
+    if (!isRecord5(body) || !Array.isArray(body.data) || !isRecord5(body.cursor)) return null;
     return adaptV2Messages(body);
   } catch (error2) {
     console.error(
@@ -4571,7 +5927,7 @@ async function interruptV2Session(client, sessionId) {
 async function getV2ActiveSessions(client) {
   try {
     const body = await readJson(await client.request("/api/session/active"));
-    if (!isRecord(body) || !isRecord(body.data)) return null;
+    if (!isRecord5(body) || !isRecord5(body.data)) return null;
     return body.data;
   } catch (error2) {
     console.error(
@@ -4587,8 +5943,8 @@ async function isV2SessionOngoing(client, sessionId) {
 }
 function sessionErrorReason2(value) {
   if (typeof value === "string" && value.trim()) return value.trim().slice(0, 500);
-  if (isRecord(value)) {
-    const data = isRecord(value.data) ? value.data : void 0;
+  if (isRecord5(value)) {
+    const data = isRecord5(value.data) ? value.data : void 0;
     const reason = typeof data?.message === "string" && data.message || typeof value.message === "string" && value.message || typeof value.name === "string" && value.name;
     if (reason) return reason.replace(/\s+/g, " ").trim().slice(0, 500);
   }
@@ -4604,17 +5960,17 @@ function adaptV2SessionErrorEvent(value) {
       return null;
     }
   }
-  if (!isRecord(parsed)) return null;
+  if (!isRecord5(parsed)) return null;
   try {
     const establishedShape = parseSessionErrorFrame(JSON.stringify(parsed));
     if (establishedShape) return establishedShape;
   } catch (error2) {
     void error2;
   }
-  const candidates = [parsed, parsed.payload, parsed.data].filter(isRecord);
+  const candidates = [parsed, parsed.payload, parsed.data].filter(isRecord5);
   for (const event of candidates) {
     if (event.type !== "session.error") continue;
-    const properties = [event.properties, event.data, event].find(isRecord);
+    const properties = [event.properties, event.data, event].find(isRecord5);
     if (!properties) continue;
     const sessionId = typeof properties.sessionID === "string" && properties.sessionID || typeof properties.sessionId === "string" && properties.sessionId;
     if (!sessionId) continue;
@@ -4664,13 +6020,13 @@ async function readV2SessionErrorStream(client, options) {
 }
 
 // src/lib/opencode/credential-import-v2.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import { join as join6 } from "node:path";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { join as join8 } from "node:path";
 
 // src/lib/openai-usage.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join7 } from "node:path";
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 var OPENCODE_AUTH_SEGMENTS = [".local", "share", "opencode", "auth.json"];
 var OpenAiUsageError = class extends Error {
@@ -4684,7 +6040,7 @@ function isLocalCredentialProblem2(err) {
 }
 function readOpenCodeChatGptCredentials() {
   try {
-    const raw = readFileSync4(join5(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
+    const raw = readFileSync7(join7(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -4750,7 +6106,7 @@ function parseCodexUsageHeaders(headers) {
 function normalizeProbeModel(model) {
   return model.endsWith("-fast") ? model.slice(0, -"-fast".length) : model;
 }
-function isRecord2(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function unsupportedProbeModels(reason, port) {
@@ -4761,14 +6117,14 @@ async function resolveV1ProbeModels(client, port) {
   try {
     const response = await client.request("/config/providers");
     const body = await response.json();
-    if (!isRecord2(body) || !Array.isArray(body.providers)) {
+    if (!isRecord6(body) || !Array.isArray(body.providers)) {
       return unsupportedProbeModels("V1 provider response did not contain a providers array", port);
     }
     const provider = body.providers.find(
-      (candidate) => isRecord2(candidate) && candidate.id === "openai"
+      (candidate) => isRecord6(candidate) && candidate.id === "openai"
     );
-    if (!provider || !isRecord2(provider.models)) return { status: "supported", models: [] };
-    const defaults2 = isRecord2(body.default) ? body.default : void 0;
+    if (!provider || !isRecord6(provider.models)) return { status: "supported", models: [] };
+    const defaults2 = isRecord6(body.default) ? body.default : void 0;
     const candidates = [
       ...typeof defaults2?.openai === "string" ? [defaults2.openai] : [],
       ...Object.keys(provider.models)
@@ -4790,14 +6146,14 @@ async function resolveV2ProbeModels(client, port) {
   try {
     const response = await client.request(path);
     const body = await response.json();
-    if (!isRecord2(body) || !Array.isArray(body.data)) {
+    if (!isRecord6(body) || !Array.isArray(body.data)) {
       return unsupportedProbeModels(`V2 GET ${path} did not contain a provider data array`, port);
     }
     const provider = body.data.find(
-      (candidate) => isRecord2(candidate) && candidate.id === "openai"
+      (candidate) => isRecord6(candidate) && candidate.id === "openai"
     );
     if (!provider) return { status: "supported", models: [] };
-    if (!isRecord2(provider.models)) {
+    if (!isRecord6(provider.models)) {
       return unsupportedProbeModels(
         "V2 provider response has no safe OpenAI model catalogue",
         port
@@ -4907,7 +6263,7 @@ var CONNECT_KEY_MAX_ATTEMPTS = 3;
 var CONNECT_KEY_RETRY_DELAY_MS = 250;
 var INTEGRATION_LIST_MAX_READS = 10;
 var INTEGRATION_LIST_RETRY_DELAY_MS = 1e3;
-function isRecord3(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var sleep2 = (milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds));
@@ -4916,14 +6272,14 @@ function emptyResult(unsupported = [], outcome = "completed") {
 }
 function readOpenCodeCredentials(homeDir, log3) {
   try {
-    const raw = readFileSync5(join6(homeDir, ...OPENCODE_AUTH_SEGMENTS), "utf8");
+    const raw = readFileSync8(join8(homeDir, ...OPENCODE_AUTH_SEGMENTS), "utf8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
     } catch (error2) {
       return null;
     }
-    return isRecord3(parsed) ? parsed : null;
+    return isRecord7(parsed) ? parsed : null;
   } catch (error2) {
     const code = error2.code;
     if (code !== "ENOENT" && code !== "ENOTDIR") {
@@ -4936,7 +6292,7 @@ function classifyOpenCodeCredentials(credentials2) {
   const importable = [];
   const unsupported = [];
   for (const [integrationId, value] of Object.entries(credentials2)) {
-    if (!isRecord3(value) || typeof value.type !== "string") {
+    if (!isRecord7(value) || typeof value.type !== "string") {
       unsupported.push({ integrationId, reason: "unrecognised credential entry" });
       continue;
     }
@@ -4951,7 +6307,7 @@ function classifyOpenCodeCredentials(credentials2) {
       unsupported.push({ integrationId, reason: "unrecognised credential entry" });
       continue;
     }
-    if (value.metadata === void 0 || isRecord3(value.metadata) && Object.keys(value.metadata).length === 0) {
+    if (value.metadata === void 0 || isRecord7(value.metadata) && Object.keys(value.metadata).length === 0) {
       importable.push({ integrationId, key: value.key });
     } else {
       unsupported.push({ integrationId, reason: "needs the interactive connect flow" });
@@ -4964,7 +6320,7 @@ function statusFromRequestError(error2) {
   const match = /^OpenCode request failed: HTTP (\d{3})/.exec(error2.message);
   return match ? Number(match[1]) : void 0;
 }
-function failureMessage(status2) {
+function failureMessage2(status2) {
   return status2 === void 0 ? "OpenCode credential import request failed" : `OpenCode credential import request failed with HTTP ${status2}`;
 }
 function isRetryableStatus(status2) {
@@ -4991,18 +6347,18 @@ async function importOneCredential(request3, credential, sleepForRetry, log3) {
       const failure = {
         integrationId: credential.integrationId,
         status: response.status,
-        message: failureMessage(response.status)
+        message: failureMessage2(response.status)
       };
-      log3(`${failureMessage(failure.status)} for ${failure.integrationId}`, "warn");
+      log3(`${failureMessage2(failure.status)} for ${failure.integrationId}`, "warn");
       return { ok: false, failure };
     } catch (error2) {
       const status2 = statusFromRequestError(error2);
       const failure = {
         integrationId: credential.integrationId,
         ...status2 === void 0 ? {} : { status: status2 },
-        message: failureMessage(status2)
+        message: failureMessage2(status2)
       };
-      log3(`${failureMessage(status2)} for ${failure.integrationId}`, "warn");
+      log3(`${failureMessage2(status2)} for ${failure.integrationId}`, "warn");
       return { ok: false, failure };
     }
   }
@@ -5028,10 +6384,10 @@ async function importOpenCodeCredentials({
   return result;
 }
 function parseIntegrationList(value) {
-  if (!isRecord3(value) || !Array.isArray(value.data)) return null;
+  if (!isRecord7(value) || !Array.isArray(value.data)) return null;
   const integrationIds = /* @__PURE__ */ new Set();
   for (const integration of value.data) {
-    if (!isRecord3(integration) || typeof integration.id !== "string" || !Array.isArray(integration.connections)) {
+    if (!isRecord7(integration) || typeof integration.id !== "string" || !Array.isArray(integration.connections)) {
       return null;
     }
     if (integration.connections.length > 0) integrationIds.add(integration.id);
@@ -5116,87 +6472,9 @@ async function importOpenCodeV2Credentials({
 
 // src/lib/opencode/session-db-boot.ts
 import { spawn as spawn2 } from "node:child_process";
-import { mkdirSync as mkdirSync2, statSync as statSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync4, statSync as statSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname5, resolve as resolvePath } from "node:path";
-
-// src/lib/runner-synchroniser.ts
-import { spawn } from "node:child_process";
-function appendError(stderr, error2) {
-  const message = error2 instanceof Error ? error2.message : String(error2);
-  return stderr === "" ? message : `${stderr}
-${message}`;
-}
-function runSynchroniser(args, opts) {
-  return new Promise((resolve5) => {
-    let child;
-    let stdout = "";
-    let stderr = "";
-    let settled = false;
-    const timer = {};
-    let abortListener;
-    let spawnListener;
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      if (timer.handle) clearTimeout(timer.handle);
-      if (abortListener) opts.signal?.removeEventListener("abort", abortListener);
-      if (spawnListener) child.removeListener("spawn", spawnListener);
-      resolve5(result);
-    };
-    try {
-      child = spawn("runner-synchroniser", args, {
-        env: opts.env ?? process.env,
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-    } catch (error2) {
-      finish({ code: null, stdout, stderr: appendError(stderr, error2), timedOut: false });
-      return;
-    }
-    child.stdout?.setEncoding("utf8");
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk;
-    });
-    child.stderr?.setEncoding("utf8");
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk;
-    });
-    child.once("error", (error2) => {
-      finish({ code: null, stdout, stderr: appendError(stderr, error2), timedOut: false });
-    });
-    child.once("close", (code) => {
-      finish({ code, stdout, stderr, timedOut: false });
-    });
-    if (opts.signal) {
-      const killChild = () => {
-        if (child.pid === void 0) {
-          if (!spawnListener) {
-            spawnListener = killChild;
-            child.once("spawn", spawnListener);
-          }
-          return;
-        }
-        child.kill("SIGKILL");
-      };
-      abortListener = killChild;
-      if (opts.signal.aborted) {
-        abortListener();
-      } else {
-        opts.signal.addEventListener("abort", abortListener, { once: true });
-        if (opts.signal.aborted) abortListener();
-      }
-    }
-    timer.handle = setTimeout(
-      () => {
-        child.kill("SIGKILL");
-        finish({ code: null, stdout, stderr, timedOut: true });
-      },
-      Math.max(0, opts.timeoutMs)
-    );
-  });
-}
-
-// src/lib/opencode/session-db-boot.ts
+import { dirname as dirname7, resolve as resolvePath } from "node:path";
 var SESSION_DB_RESTORE_TIMEOUT_MS = 3e5;
 var SESSION_DB_VERIFY_TIMEOUT_MS = 36e4;
 var SESSION_DB_SYNCHRONISER_TIMEOUT_MS = 12e4;
@@ -5246,8 +6524,8 @@ function clearMarker(options) {
 function markNoReplicate(options, message) {
   if (options.noReplicateMarker) {
     try {
-      mkdirSync2(dirname5(options.noReplicateMarker), { recursive: true });
-      writeFileSync2(options.noReplicateMarker, "");
+      mkdirSync4(dirname7(options.noReplicateMarker), { recursive: true });
+      writeFileSync4(options.noReplicateMarker, "");
     } catch (error2) {
       options.log(
         `Could not write session-DB no-replicate marker ${options.noReplicateMarker}: ${error2 instanceof Error ? error2.message : String(error2)}`,
@@ -5401,8 +6679,8 @@ async function ensureLitestreamConfig(options, env) {
     return null;
   }
   try {
-    mkdirSync2(dirname5(configPath), { recursive: true });
-    writeFileSync2(configPath, rendered.stdout);
+    mkdirSync4(dirname7(configPath), { recursive: true });
+    writeFileSync4(configPath, rendered.stdout);
   } catch (error2) {
     options.log(
       `Could not write ${configPath}: ${error2 instanceof Error ? error2.message : String(error2)}`,
@@ -5667,8 +6945,8 @@ async function restoreAndVerifySessionDb(options) {
 
 // src/lib/opencode/session-db-provenance.ts
 import { createRequire } from "node:module";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname6, join as join7 } from "node:path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname8, join as join9 } from "node:path";
 var require2 = createRequire(import.meta.url);
 function readSessionDbMigrationIds(dbPath) {
   let db;
@@ -5705,12 +6983,12 @@ function readSessionDbMigrationIds(dbPath) {
 }
 function sessionDbProvenanceStatePath(homeDir, env) {
   const override = env.EVIDENT_SESSION_DB_PROVENANCE_STATE?.trim();
-  return override || join7(homeDir, ".local", "state", "evident", "session-db-provenance.json");
+  return override || join9(homeDir, ".local", "state", "evident", "session-db-provenance.json");
 }
 function loadSessionDbProvenanceState(path) {
   let value;
   try {
-    value = JSON.parse(readFileSync6(path, "utf8"));
+    value = JSON.parse(readFileSync9(path, "utf8"));
   } catch (error2) {
     if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") return {};
     console.error(
@@ -5734,8 +7012,8 @@ function loadSessionDbProvenanceState(path) {
 }
 function saveSessionDbProvenanceState(path, state) {
   try {
-    mkdirSync3(dirname6(path), { recursive: true });
-    writeFileSync3(path, `${JSON.stringify(state, null, 2)}
+    mkdirSync5(dirname8(path), { recursive: true });
+    writeFileSync5(path, `${JSON.stringify(state, null, 2)}
 `, "utf8");
   } catch (error2) {
     console.error(
@@ -5790,6 +7068,26 @@ function isSessionDbProvenanceRecord(value) {
   return typeof record.opencodeVersion === "string" && Array.isArray(record.migrationIds) && record.migrationIds.every((id) => typeof id === "string") && typeof record.updatedAt === "string";
 }
 
+// src/lib/opencode/detect.ts
+function describeProbe(route, result) {
+  if (result.error?.startsWith("HTTP ")) return `${route}: ${result.error}`;
+  if (result.error) return `${route}: no HTTP response (${result.error})`;
+  return `${route}: ${result.healthy ? "healthy" : "no response detail"}`;
+}
+async function classifyRunningOpenCode(port) {
+  const v1 = await checkOpenCodeHealth(port);
+  if (v1.healthy) return { kind: "v1", version: v1.version ?? null };
+  const v2 = await checkOpenCode2Health(port);
+  if (v2.healthy) return { kind: "v2", version: v2.version ?? null };
+  const detail = [
+    describeProbe("V1 /global/health", v1),
+    describeProbe("V2 /api/info (or /api/health fallback)", v2)
+  ].join("; ");
+  if (v1.okWithNonJsonBody && v2.authFailed) return { kind: "v2", version: null };
+  if (v1.authFailed && v2.authFailed) return { kind: "authenticated-unknown", detail };
+  return { kind: "no-server-identified", detail };
+}
+
 // src/lib/opencode/opencode2-package.ts
 var OPENCODE2_PACKAGE_SPEC = "@opencode-ai/cli@0.0.0-beta-17823";
 
@@ -6098,26 +7396,28 @@ async function startOpenCode(port, options = {}) {
 }
 async function startOpenCode2(port, options = {}) {
   const password = randomBytes(24).toString("hex");
-  let command = "opencode2";
+  let command = options.command ?? "opencode2";
   const logLevel = options.inheritStdio ? ["--log-level", resolveOpenCode2LogLevel(process.env)] : [];
   let args = ["serve", "--port", port.toString(), "--hostname", "127.0.0.1", ...logLevel];
-  try {
-    execSync("which opencode2", { stdio: "ignore" });
-  } catch {
-    command = "npx";
-    args = [
-      "-y",
-      "-p",
-      OPENCODE2_PACKAGE_SPEC,
-      "--",
-      "opencode2",
-      "serve",
-      "--port",
-      port.toString(),
-      "--hostname",
-      "127.0.0.1",
-      ...logLevel
-    ];
+  if (options.command === void 0) {
+    try {
+      execSync("which opencode2", { stdio: "ignore" });
+    } catch {
+      command = "npx";
+      args = [
+        "-y",
+        "-p",
+        OPENCODE2_PACKAGE_SPEC,
+        "--",
+        "opencode2",
+        "serve",
+        "--port",
+        port.toString(),
+        "--hostname",
+        "127.0.0.1",
+        ...logLevel
+      ];
+    }
   }
   const child = spawn3(command, args, {
     env: { ...process.env, OPENCODE_SERVER_PASSWORD: password },
@@ -6174,6 +7474,56 @@ function isOpenCode2Installed() {
     return false;
   }
 }
+function readVersionOutput(command) {
+  try {
+    return execSync2(`${command} --version`, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch (error2) {
+    const output = typeof error2 === "object" && error2 !== null ? [
+      "stdout" in error2 ? String(error2.stdout ?? "").trim() : "",
+      "stderr" in error2 ? String(error2.stderr ?? "").trim() : ""
+    ].filter(Boolean).join("\n") : "";
+    return output || (error2 instanceof Error ? error2.message : String(error2));
+  }
+}
+function parseOpenCodeVersion(rawVersion) {
+  const output = rawVersion.trim();
+  const prefix = output.match(/^(opencode2|opencode)\s+/i)?.[1]?.toLowerCase();
+  const version2 = (prefix ? output.slice(prefix.length).trim() : output).replace(/^v/i, "");
+  if (prefix === "opencode2") return { major: "v2", version: version2 };
+  const major = version2.match(/^(\d+)(?:\.\d+)*(?:[-+][0-9A-Za-z.-]+)?$/)?.[1];
+  if (!major) return null;
+  if (Number(major) === 1) return { major: "v1", version: version2 };
+  if (Number(major) >= 2) return { major: "v2", version: version2 };
+  return null;
+}
+function resolveInstalledOpenCode() {
+  let opencode2Available = false;
+  if (isOpenCodeInstalled()) {
+    const rawVersion = readVersionOutput("opencode");
+    const parsed = parseOpenCodeVersion(rawVersion);
+    if (parsed?.major === "v1") {
+      return { kind: "installed", major: "v1", command: "opencode", version: parsed.version };
+    }
+    if (parsed?.major === "v2") {
+      return { kind: "installed", major: "v2", command: "opencode", version: parsed.version };
+    }
+    opencode2Available = isOpenCode2Installed();
+    if (!opencode2Available) return { kind: "unknown", command: "opencode", rawVersion };
+  }
+  if (opencode2Available || isOpenCode2Installed()) {
+    const parsed = parseOpenCodeVersion(readVersionOutput("opencode2"));
+    return {
+      kind: "installed",
+      major: "v2",
+      command: "opencode2",
+      version: parsed?.version
+    };
+  }
+  return { kind: "none" };
+}
 async function promptOpenCodeInstall(interactive) {
   if (!interactive) {
     console.log(
@@ -6274,124 +7624,17 @@ function buildNoProviderWarning(hasProvider) {
   return "Warning: opencode has no authenticated model provider configured, so it won't be able to answer prompts. Run `opencode auth login` to set one up (see https://opencode.ai for details).";
 }
 
-// src/lib/opencode/session-cleanup.ts
-var DURATION_UNIT_MS = {
-  s: 1e3,
-  m: 60 * 1e3,
-  h: 60 * 60 * 1e3,
-  d: 24 * 60 * 60 * 1e3
-};
-function parseDurationMs(input) {
-  const trimmed = input.trim();
-  const match = /^(\d+)([smhd])$/.exec(trimmed);
-  if (!match) {
-    throw new Error(
-      `Invalid duration "${input}": expected <number><unit> where unit is one of s, m, h, d (e.g. "7d", "24h", "30m", "90s").`
-    );
-  }
-  const value = Number(match[1]);
-  if (value <= 0) {
-    throw new Error(`Invalid duration "${input}": must be a positive value.`);
-  }
-  return value * DURATION_UNIT_MS[match[2]];
-}
-function selectSessionsToDelete(sessions, opts) {
-  const { maxAgeMs, maxCount, nowMs, protectedIds } = opts;
-  if (maxAgeMs === void 0 && maxCount === void 0) return [];
-  const ageEligible = (s) => {
-    if (maxAgeMs === void 0) return false;
-    if (s.lastActivityMs === null) return true;
-    return nowMs - s.lastActivityMs > maxAgeMs;
-  };
-  const countEligibleIds = /* @__PURE__ */ new Set();
-  if (maxCount !== void 0) {
-    const byActivityDesc = [...sessions].sort(
-      (a, b) => (b.lastActivityMs ?? -Infinity) - (a.lastActivityMs ?? -Infinity)
-    );
-    for (const s of byActivityDesc.slice(maxCount)) {
-      countEligibleIds.add(s.id);
-    }
-  }
-  const toDelete = [];
-  for (const s of sessions) {
-    if (protectedIds.has(s.id)) continue;
-    if (ageEligible(s) || countEligibleIds.has(s.id)) {
-      toDelete.push(s.id);
-    }
-  }
-  const activityById = new Map(sessions.map((session) => [session.id, session.lastActivityMs]));
-  return toDelete.sort(
-    (a, b) => (activityById.get(a) ?? -Infinity) - (activityById.get(b) ?? -Infinity)
-  );
-}
-var DEFAULT_INTERVAL = "1h";
-function resolve2(flag, envValue, fallback) {
-  return flag ?? envValue ?? fallback;
-}
-function parseMaxCount(input) {
-  const trimmed = input.trim();
-  if (!/^\d+$/.test(trimmed)) {
-    throw new Error(`Invalid max-count "${input}": expected a positive integer.`);
-  }
-  const value = Number(trimmed);
-  if (value <= 0) {
-    throw new Error(`Invalid max-count "${input}": must be greater than 0.`);
-  }
-  return value;
-}
-function resolveSessionCleanupConfig(flags, env = process.env) {
-  const warnings = [];
-  const maxAgeRaw = resolve2(flags.maxAge, env.EVIDENT_SESSION_CLEANUP_MAX_AGE);
-  const maxCountRaw = resolve2(flags.maxCount, env.EVIDENT_SESSION_CLEANUP_MAX_COUNT);
-  const intervalRaw = resolve2(
-    flags.interval,
-    env.EVIDENT_SESSION_CLEANUP_INTERVAL,
-    DEFAULT_INTERVAL
-  );
-  let maxAgeMs;
-  if (maxAgeRaw !== void 0) {
-    try {
-      maxAgeMs = parseDurationMs(maxAgeRaw);
-    } catch (err) {
-      warnings.push(
-        `Ignoring invalid --session-cleanup-max-age: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-  }
-  let maxCount;
-  if (maxCountRaw !== void 0) {
-    try {
-      maxCount = parseMaxCount(maxCountRaw);
-    } catch (err) {
-      warnings.push(
-        `Ignoring invalid --session-cleanup-max-count: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-  }
-  let intervalMs;
-  try {
-    intervalMs = parseDurationMs(intervalRaw ?? DEFAULT_INTERVAL);
-  } catch (err) {
-    warnings.push(
-      `Ignoring invalid --session-cleanup-interval, using default ${DEFAULT_INTERVAL}: ${err instanceof Error ? err.message : String(err)}`
-    );
-    intervalMs = parseDurationMs(DEFAULT_INTERVAL);
-  }
-  const enabled = maxAgeMs !== void 0 || maxCount !== void 0;
-  return { enabled, maxAgeMs, maxCount, intervalMs, warnings };
-}
-
 // src/lib/opencode/session-db-size.ts
 import { statSync as statSync4 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join10 } from "node:path";
 var LARGE_DB_THRESHOLD_BYTES = 268435456;
 function statSessionDbBytes(homeDir) {
-  const dbPath = join8(homeDir, ".local", "share", "opencode", "opencode.db");
+  const dbPath = join10(homeDir, ".local", "share", "opencode", "opencode.db");
   try {
     return statSync4(dbPath).size;
   } catch (err) {
-    const isMissingFile2 = err instanceof Error && "code" in err && err.code === "ENOENT";
-    if (!isMissingFile2) {
+    const isMissingFile4 = err instanceof Error && "code" in err && err.code === "ENOENT";
+    if (!isMissingFile4) {
       console.error(
         `[statSessionDbBytes] could not stat ${dbPath}: ${err instanceof Error ? err.message : String(err)}`
       );
@@ -6416,12 +7659,12 @@ function buildSessionStoreSizeWarning(input) {
 // src/lib/opencode/log-tail.ts
 import { statSync as statSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join11 } from "node:path";
 import { open as open2, stat } from "node:fs/promises";
 var DEFAULT_POLL_INTERVAL_MS = 1e3;
 function resolveOpenCodeLogPath(homeDir = homedir5(), env = process.env) {
-  const dataDir = env.XDG_DATA_HOME || join9(homeDir, ".local", "share");
-  return join9(dataDir, "opencode", "log", "opencode.log");
+  const dataDir = env.XDG_DATA_HOME || join11(homeDir, ".local", "share");
+  return join11(dataDir, "opencode", "log", "opencode.log");
 }
 function isEnoent(error2) {
   return error2?.code === "ENOENT";
@@ -6906,8 +8149,8 @@ function connectTunnel(options) {
           }
           forwarder.handleBinaryBodyFrame(frame.sid, frame.payload);
         } catch (error2) {
-          const errorMessage3 = error2 instanceof Error ? error2.message : "Unknown error";
-          onError?.(`Failed to handle binary message: ${errorMessage3}`);
+          const errorMessage4 = error2 instanceof Error ? error2.message : "Unknown error";
+          onError?.(`Failed to handle binary message: ${errorMessage4}`);
         }
         return;
       }
@@ -6915,8 +8158,8 @@ function connectTunnel(options) {
       try {
         message = JSON.parse(data.toString());
       } catch (error2) {
-        const errorMessage3 = error2 instanceof Error ? error2.message : "Unknown error";
-        onError?.(`Failed to handle message: ${errorMessage3}`);
+        const errorMessage4 = error2 instanceof Error ? error2.message : "Unknown error";
+        onError?.(`Failed to handle message: ${errorMessage4}`);
         return;
       }
       if (isStreamFrame(message)) {
@@ -7088,10 +8331,10 @@ var RunnerConnection = class _RunnerConnection {
 };
 
 // src/lib/tunnel/ready-marker.ts
-import { writeFileSync as writeFileSync4 } from "node:fs";
+import { writeFileSync as writeFileSync6 } from "node:fs";
 function writeTunnelReadyMarker(path, agentId) {
   try {
-    writeFileSync4(path, `${agentId}
+    writeFileSync6(path, `${agentId}
 `);
     return { ok: true };
   } catch (error2) {
@@ -7116,7 +8359,7 @@ async function stopSessionDbReplication(child, timeoutMs) {
 }
 
 // src/lib/process-liveness.ts
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -7131,7 +8374,7 @@ function isProcessAlive(pid) {
   }
   if (process.platform !== "linux") return true;
   try {
-    const status2 = readFileSync7(`/proc/${pid}/status`, "utf8");
+    const status2 = readFileSync10(`/proc/${pid}/status`, "utf8");
     return !/^State:\s+Z(?:\s|$)/m.test(status2);
   } catch (error2) {
     console.error(
@@ -7198,8 +8441,8 @@ function resolveOpenAiUsageReportingMode(flagValue, env) {
 }
 
 // src/lib/resource-usage-reporting.ts
-var ENABLED_VALUES = /* @__PURE__ */ new Set(["on", "true", "1"]);
-var DISABLED_VALUES = /* @__PURE__ */ new Set(["off", "false", "0"]);
+var ENABLED_VALUES2 = /* @__PURE__ */ new Set(["on", "true", "1"]);
+var DISABLED_VALUES2 = /* @__PURE__ */ new Set(["off", "false", "0"]);
 function resolveResourceUsageReportingEnabled(flagValue, env) {
   if (flagValue === false) {
     return { enabled: false, warnings: [] };
@@ -7209,10 +8452,10 @@ function resolveResourceUsageReportingEnabled(flagValue, env) {
     return { enabled: true, warnings: [] };
   }
   const normalized = raw.trim().toLowerCase();
-  if (DISABLED_VALUES.has(normalized)) {
+  if (DISABLED_VALUES2.has(normalized)) {
     return { enabled: false, warnings: [] };
   }
-  if (ENABLED_VALUES.has(normalized)) {
+  if (ENABLED_VALUES2.has(normalized)) {
     return { enabled: true, warnings: [] };
   }
   return {
@@ -7490,18 +8733,18 @@ function createSessionStoreHealth(options = {}) {
 import { homedir as homedir6 } from "node:os";
 
 // src/lib/runner-file-sync.ts
-import { join as join11 } from "node:path";
+import { join as join13 } from "node:path";
 
 // src/lib/file-push.ts
 import { randomUUID } from "node:crypto";
 import { chmod, mkdir, open as open3, realpath, rename, unlink } from "node:fs/promises";
-import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute2, join as join10, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { basename as basename2, dirname as dirname9, isAbsolute as isAbsolute2, join as join12, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
 async function writePushedFile(request3) {
-  const { requestedPath, content, allowedDirectories, homeDir } = request3;
+  const { requestedPath, content, allowedDirectories, allowedFiles, homeDir } = request3;
   const bytes = content.byteLength;
-  if (allowedDirectories.length === 0) {
+  if (allowedDirectories.length === 0 && allowedFiles.length === 0) {
     return refuse("file_sync_disabled", "File sync is not enabled on this runner.", {
       path: requestedPath,
       bytes
@@ -7526,10 +8769,10 @@ async function writePushedFile(request3) {
   }
   try {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
-      dirname7(candidate)
+      dirname9(candidate)
     );
-    const realTarget = join10(existingAncestor, ...missingSegments, basename2(candidate));
-    const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
+    const realTarget = join12(existingAncestor, ...missingSegments, basename2(candidate));
+    const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget) ?? await findMatchingAllowedFile(allowedFiles, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
         path: realTarget,
@@ -7538,8 +8781,8 @@ async function writePushedFile(request3) {
     }
     if (missingSegments.length > 0) {
       await createMissingDirectories(existingAncestor, missingSegments);
-      const realParent = await realpath(dirname7(realTarget));
-      if (realParent !== dirname7(realTarget) || !contains(allowedDirectory, realTarget)) {
+      const realParent = await realpath(dirname9(realTarget));
+      if (realParent !== dirname9(realTarget) || !contains(allowedDirectory, realTarget)) {
         return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
           path: realTarget,
           bytes,
@@ -7564,7 +8807,7 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join10(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join12(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
@@ -7582,7 +8825,7 @@ async function resolveNearestExistingAncestor(directory) {
     try {
       return { existingAncestor: await realpath(current), missingSegments };
     } catch (err) {
-      const parent = dirname7(current);
+      const parent = dirname9(current);
       if (err.code !== "ENOENT" || parent === current) {
         throw err;
       }
@@ -7597,9 +8840,25 @@ async function findContainingAllowedDirectory(allowedDirectories, realTarget) {
       log("warn", "file_push_allowed_directory_skipped", { directory, reason: "not_absolute" });
       continue;
     }
-    const realDirectory = await realpathCreatingIfMissing(directory);
-    if (realDirectory !== null && contains(realDirectory, realTarget)) {
-      return realDirectory;
+    const realDirectory = await realpathCreatingIfMissing(directory);
+    if (realDirectory !== null && contains(realDirectory, realTarget)) {
+      return realDirectory;
+    }
+  }
+  return null;
+}
+async function findMatchingAllowedFile(allowedFiles, realTarget) {
+  for (const entry of allowedFiles) {
+    if (!isAbsolute2(entry)) {
+      log("warn", "file_push_allowed_directory_skipped", {
+        directory: entry,
+        reason: "not_absolute_file"
+      });
+      continue;
+    }
+    const realParent = await realpathCreatingIfMissing(dirname9(entry));
+    if (realParent !== null && join12(realParent, basename2(entry)) === realTarget) {
+      return realParent;
     }
   }
   return null;
@@ -7637,13 +8896,13 @@ function contains(realDirectory, realTarget) {
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join10(current, segment);
+    current = join12(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join10(dirname7(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join12(dirname9(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
     handle = await open3(temporaryPath, "wx", FILE_MODE);
@@ -7773,16 +9032,16 @@ var NOT_APPLIED = {
   opencodeAuthApplied: false
 };
 function isClaudeCredentialPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join11(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join11(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join13(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join13(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
 }
 function isOpenCodeAuthPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join11(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join11(homeDir, ...OPENCODE_AUTH_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join13(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join13(homeDir, ...OPENCODE_AUTH_SEGMENTS);
 }
 async function applyOne(options, file) {
   const label = `${file.id.slice(0, 8)} (${file.path})`;
-  if (options.allowedDirectories.length === 0) {
+  if (options.allowedDirectories.length === 0 && options.allowedFiles.length === 0) {
     options.log({
       level: "warn",
       message: `Runner file ${label} rejected: file sync is not enabled on this runner (start it with --enable-file-sync-to)`
@@ -7809,6 +9068,7 @@ async function applyOne(options, file) {
       requestedPath: file.path,
       content: download.content,
       allowedDirectories: options.allowedDirectories,
+      allowedFiles: options.allowedFiles,
       homeDir: options.homeDir
     });
   } catch (err) {
@@ -7916,7 +9176,7 @@ function describe(err) {
 }
 
 // src/lib/vault-file-sync.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 async function syncVaultFiles(options) {
   const files = await listVaultFiles(options);
   if (files === null) return { applied: 0 };
@@ -8012,7 +9272,7 @@ async function reconcileVaultFile(options, file) {
   }
   const content = await downloadVaultFile(options, file);
   if (content === null) return false;
-  const actualSha256 = createHash("sha256").update(content).digest("hex");
+  const actualSha256 = createHash2("sha256").update(content).digest("hex");
   if (actualSha256 !== file.content_sha256) {
     options.log({
       level: "warn",
@@ -8060,6 +9320,7 @@ async function applyVaultFile(options, file, content) {
       requestedPath: file.destination_path,
       content,
       allowedDirectories: options.allowedDirectories,
+      allowedFiles: options.allowedFiles,
       homeDir: options.homeDir
     });
     if (!outcome.ok) {
@@ -8212,6 +9473,7 @@ var ChannelDriver = class _ChannelDriver {
   conversationFilter;
   retry;
   log;
+  recordBinding;
   fetchImpl;
   sleep;
   pausedPollIntervalMs;
@@ -8219,6 +9481,7 @@ var ChannelDriver = class _ChannelDriver {
   stuckQueuedMs;
   now;
   fileSyncDirectories;
+  fileSyncExactFiles;
   homeDir;
   maxActiveSessions;
   watcherStallMs;
@@ -8573,6 +9836,7 @@ var ChannelDriver = class _ChannelDriver {
     this.retry = { ...DEFAULT_RETRY_POLICY, ...config.retry };
     this.log = config.log ?? (() => {
     });
+    this.recordBinding = config.recordBinding;
     this.fetchImpl = withRequestTimeout(
       config.fetchImpl ?? fetch,
       config.requestTimeoutMs ?? REQUEST_TIMEOUT_MS
@@ -8588,6 +9852,7 @@ var ChannelDriver = class _ChannelDriver {
     this.stuckQueuedMs = config.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
     this.now = config.now ?? (() => Date.now());
     this.fileSyncDirectories = config.fileSyncDirectories ?? [];
+    this.fileSyncExactFiles = config.fileSyncExactFiles ?? [];
     this.homeDir = config.homeDir ?? homedir6();
     this.maxActiveSessions = config.maxActiveSessions;
     this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
@@ -8685,6 +9950,7 @@ var ChannelDriver = class _ChannelDriver {
         getAuthHeader: this.getAuthHeader,
         fetchImpl: this.fetchImpl,
         allowedDirectories: this.fileSyncDirectories,
+        allowedFiles: this.fileSyncExactFiles,
         homeDir: this.homeDir,
         ackFailures: this.fileAckFailures,
         log: this.log
@@ -8695,6 +9961,7 @@ var ChannelDriver = class _ChannelDriver {
         getAuthHeader: this.getAuthHeader,
         fetchImpl: this.fetchImpl,
         allowedDirectories: this.fileSyncDirectories,
+        allowedFiles: this.fileSyncExactFiles,
         homeDir: this.homeDir,
         outcomes: this.vaultFileOutcomes,
         log: this.log
@@ -8757,6 +10024,9 @@ var ChannelDriver = class _ChannelDriver {
       let cappedSkips = 0;
       for (const conv of conversations) {
         if (this.stopped) break;
+        if (conv.opencode_session_id) {
+          this.recordSessionBinding(conv.id, conv.opencode_session_id);
+        }
         if (this.maxActiveSessions !== void 0) {
           const activeSessionIds = this.activeSessionIdsForCap();
           const resolvedSessionId = this.sessions.get(conv.id) ?? conv.opencode_session_id;
@@ -8839,12 +10109,12 @@ var ChannelDriver = class _ChannelDriver {
     this.sessions.delete(conversationId);
     this.supersede(conversationId, sessionId);
     const dispatchDescription = source === "readopt" ? "re-dispatched message" : "message";
-    const errorMessage3 = `OpenCode accepted this ${dispatchDescription} once, but its assigned id was never confirmed after ${attempts} attempts to match it up \u2014 the message was deliberately not sent again, so no duplicate turn was created; session ${sessionId.slice(0, 8)} was abandoned; a fresh one is used for further messages.`;
-    this.untrackableAck.set(messageId, errorMessage3);
+    const errorMessage4 = `OpenCode accepted this ${dispatchDescription} once, but its assigned id was never confirmed after ${attempts} attempts to match it up \u2014 the message was deliberately not sent again, so no duplicate turn was created; session ${sessionId.slice(0, 8)} was abandoned; a fresh one is used for further messages.`;
+    this.untrackableAck.set(messageId, errorMessage4);
     this.untrackableAckSessionIds.set(messageId, null);
     this.log({
       level: "error",
-      message: errorMessage3,
+      message: errorMessage4,
       conversation_id: conversationId,
       message_id: messageId
     });
@@ -8852,7 +10122,7 @@ var ChannelDriver = class _ChannelDriver {
       conversationId,
       messageId,
       null,
-      errorMessage3
+      errorMessage4
     );
     if (reportError !== null) {
       this.log({
@@ -9033,12 +10303,12 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: conv.id,
           message_id: message.id
         });
-        const errorMessage3 = this.untrackableAck.get(message.id);
+        const errorMessage4 = this.untrackableAck.get(message.id);
         const reportError = await this.reportUntrackableAck(
           conv.id,
           message.id,
           null,
-          errorMessage3
+          errorMessage4
         );
         if (reportError === null) {
           continue;
@@ -9126,7 +10396,7 @@ var ChannelDriver = class _ChannelDriver {
         const hasProviderAndModel = dispatchedModel !== null && separator > 0 && separator < dispatchedModel.length - 1;
         const providerId = hasProviderAndModel ? dispatchedModel.slice(0, separator) : null;
         const modelId = hasProviderAndModel ? dispatchedModel.slice(separator + 1) : null;
-        const errorMessage3 = `Provider namespace not loaded on this runner: ${message.opencode_model}. Refused before dispatch; no turn was started.`;
+        const errorMessage4 = `Provider namespace not loaded on this runner: ${message.opencode_model}. Refused before dispatch; no turn was started.`;
         this.log({
           level: "error",
           message: `Refusing message ${message.id.slice(0, 8)} in conversation ${conv.id.slice(0, 8)}: provider namespace ${providerId ?? "(unknown)"} is not loaded; no turn was started`,
@@ -9134,7 +10404,7 @@ var ChannelDriver = class _ChannelDriver {
           message_id: message.id
         });
         try {
-          await this.markFailed(conv.id, message.id, sessionId, errorMessage3, void 0, {
+          await this.markFailed(conv.id, message.id, sessionId, errorMessage4, void 0, {
             classification: {
               kind: "model_auth",
               providerId,
@@ -9179,7 +10449,13 @@ var ChannelDriver = class _ChannelDriver {
             false
           );
         }
-        opencodeMessageId = this.isV2 ? await sendV2Prompt(this.openCodeClient, sessionId, message.content) : await this.dispatchLocked(
+        opencodeMessageId = this.isV2 ? await sendV2Prompt(
+          this.openCodeClient,
+          sessionId,
+          message.content,
+          options,
+          () => this.logInvalidV2ModelSelection(conv.id, message.id)
+        ) : await this.dispatchLocked(
           sessionId,
           () => sendPromptAsync(
             this.port,
@@ -9206,12 +10482,12 @@ var ChannelDriver = class _ChannelDriver {
       } catch (err) {
         if (err instanceof ChannelAuthError) throw err;
         if (this.isV2 && err instanceof OpenCodeV2PromptAckError) {
-          const errorMessage4 = err instanceof Error ? err.message : String(err);
-          this.untrackableAck.set(message.id, errorMessage4);
+          const errorMessage5 = err instanceof Error ? err.message : String(err);
+          this.untrackableAck.set(message.id, errorMessage5);
           this.untrackableAckSessionIds.set(message.id, null);
           this.log({
             level: "error",
-            message: `V2 prompt dispatch for message ${message.id.slice(0, 8)} failed after a positive ack with no usable id: ${errorMessage4}`,
+            message: `V2 prompt dispatch for message ${message.id.slice(0, 8)} failed after a positive ack with no usable id: ${errorMessage5}`,
             conversation_id: conv.id,
             message_id: message.id
           });
@@ -9219,7 +10495,7 @@ var ChannelDriver = class _ChannelDriver {
             conv.id,
             message.id,
             null,
-            errorMessage4
+            errorMessage5
           );
           if (markError !== null) {
             this.log({
@@ -9254,7 +10530,11 @@ var ChannelDriver = class _ChannelDriver {
           this.signalDispatchNotStarted(conv, message, "session_existence_unknown");
           break;
         }
-        const errorMessage3 = err instanceof Error ? err.message : String(err);
+        if (this.isV2 && err instanceof OpenCodeV2ModelSwitchError) {
+          await this.failV2ModelSwitch(conv, message, sessionId, err);
+          break;
+        }
+        const errorMessage4 = err instanceof Error ? err.message : String(err);
         this.sessions.delete(conv.id);
         this.supersede(conv.id, sessionId);
         this.log({
@@ -9263,7 +10543,7 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markFailed(conv.id, message.id, null, errorMessage3).catch((markErr) => {
+        await this.markFailed(conv.id, message.id, null, errorMessage4).catch((markErr) => {
           this.log({
             level: "warn",
             message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
@@ -9274,7 +10554,7 @@ var ChannelDriver = class _ChannelDriver {
         });
         this.log({
           level: "error",
-          message: `Message ${message.id.slice(0, 8)} dispatch failed: ${errorMessage3}`,
+          message: `Message ${message.id.slice(0, 8)} dispatch failed: ${errorMessage4}`,
           conversation_id: conv.id,
           message_id: message.id
         });
@@ -9847,6 +11127,14 @@ var ChannelDriver = class _ChannelDriver {
     this.dispatchNotStartedSignalled.set(message.id, branch);
     void this.postSignal(conv.id, message.id, "dispatch_not_started", { branch });
   }
+  logInvalidV2ModelSelection(conversationId, messageId) {
+    this.log({
+      level: "warn",
+      message: `Skipping an invalid OpenCode V2 model selection for message ${messageId.slice(0, 8)}; expected provider/model format`,
+      conversation_id: conversationId,
+      message_id: messageId
+    });
+  }
   /**
    * Class B (#1340): the runner DECIDED an outcome (reattach/settle/fail_permanent)
    * but its own PATCH to record it failed. Fires at most once per (message,
@@ -10061,6 +11349,7 @@ var ChannelDriver = class _ChannelDriver {
         return { sessionId: await this.createAndBindSession(conv.id), created: true };
       }
       this.sessions.set(conv.id, bound);
+      this.recordSessionBinding(conv.id, bound);
       return { sessionId: bound, created: false };
     }
     return { sessionId: await this.createAndBindSession(conv.id), created: true };
@@ -10074,6 +11363,7 @@ var ChannelDriver = class _ChannelDriver {
     const directory = await this.resolveOpenCodeDirectory();
     const sessionId = await this.createOpenCodeSession(directory);
     this.sessions.set(conversationId, sessionId);
+    this.recordSessionBinding(conversationId, sessionId);
     await this.persistSession(conversationId, sessionId).catch((err) => {
       this.log({
         level: "warn",
@@ -10083,6 +11373,18 @@ var ChannelDriver = class _ChannelDriver {
     });
     return sessionId;
   }
+  recordSessionBinding(conversationId, sessionId) {
+    if (!this.recordBinding) return;
+    try {
+      this.recordBinding(conversationId, sessionId);
+    } catch (error2) {
+      this.log({
+        level: "warn",
+        message: `Recording OpenCode session ${sessionId.slice(0, 8)} for conversation ${conversationId.slice(0, 8)} failed (best-effort): ${error2 instanceof Error ? error2.message : String(error2)}`,
+        conversation_id: conversationId
+      });
+    }
+  }
   /**
    * Lazily resolve (and cache) opencode's root directory via the selected client's
    * location lookup.
@@ -12183,12 +13485,12 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: row.conversation_id,
           message_id: row.id
         });
-        const errorMessage3 = this.untrackableAck.get(row.id);
+        const errorMessage4 = this.untrackableAck.get(row.id);
         const reportError = await this.reportUntrackableAck(
           row.conversation_id,
           row.id,
           this.untrackableAckSessionIds.get(row.id) ?? null,
-          errorMessage3
+          errorMessage4
         );
         if (reportError !== null) {
           this.log({
@@ -12473,7 +13775,13 @@ var ChannelDriver = class _ChannelDriver {
     let ocId;
     let preDispatchUserIds = null;
     try {
-      ocId = this.isV2 ? await sendV2Prompt(this.openCodeClient, sessionId, row.content) : await this.dispatchLocked(
+      ocId = this.isV2 ? await sendV2Prompt(
+        this.openCodeClient,
+        sessionId,
+        row.content,
+        options,
+        () => this.logInvalidV2ModelSelection(row.conversation_id, row.id)
+      ) : await this.dispatchLocked(
         sessionId,
         () => sendPromptAsync(
           this.port,
@@ -12501,14 +13809,14 @@ var ChannelDriver = class _ChannelDriver {
       this.awaitingReadopt.delete(row.id);
       if (err instanceof ChannelAuthError) throw err;
       if (this.isV2) {
-        const errorMessage3 = err instanceof Error ? err.message : String(err);
+        const errorMessage4 = err instanceof Error ? err.message : String(err);
         const invalidPromptAck = err instanceof OpenCodeV2PromptAckError;
         if (!invalidPromptAck) {
           const exists = await this.sessionExists(sessionId);
           if (exists === false) {
             this.log({
               level: "warn",
-              message: `Re-adopt: message ${row.id.slice(0, 8)} dispatch hit a session (${sessionId.slice(0, 8)}) that was deleted mid-dispatch \u2014 deferring to the next drain: ${errorMessage3}`,
+              message: `Re-adopt: message ${row.id.slice(0, 8)} dispatch hit a session (${sessionId.slice(0, 8)}) that was deleted mid-dispatch \u2014 deferring to the next drain: ${errorMessage4}`,
               conversation_id: row.conversation_id,
               message_id: row.id
             });
@@ -12518,7 +13826,7 @@ var ChannelDriver = class _ChannelDriver {
           if (exists === null) {
             this.log({
               level: "warn",
-              message: `Re-adopt: message ${row.id.slice(0, 8)} dispatch failed and session (${sessionId.slice(0, 8)}) existence could not be confirmed \u2014 deferring to the next drain: ${errorMessage3}`,
+              message: `Re-adopt: message ${row.id.slice(0, 8)} dispatch failed and session (${sessionId.slice(0, 8)}) existence could not be confirmed \u2014 deferring to the next drain: ${errorMessage4}`,
               conversation_id: row.conversation_id,
               message_id: row.id
             });
@@ -12526,12 +13834,16 @@ var ChannelDriver = class _ChannelDriver {
             return;
           }
         } else {
-          this.untrackableAck.set(row.id, errorMessage3);
+          this.untrackableAck.set(row.id, errorMessage4);
           this.untrackableAckSessionIds.set(row.id, sessionId);
         }
+        if (err instanceof OpenCodeV2ModelSwitchError) {
+          await this.failV2ModelSwitch(readoptConv, readoptMessage, sessionId, err);
+          return;
+        }
         this.log({
           level: "error",
-          message: `V2 re-adopt dispatch for message ${row.id.slice(0, 8)} failed: ${errorMessage3}`,
+          message: `V2 re-adopt dispatch for message ${row.id.slice(0, 8)} failed: ${errorMessage4}`,
           conversation_id: row.conversation_id,
           message_id: row.id
         });
@@ -12540,7 +13852,7 @@ var ChannelDriver = class _ChannelDriver {
             row.conversation_id,
             row.id,
             sessionId,
-            errorMessage3
+            errorMessage4
           );
           if (markError !== null) {
             this.log({
@@ -12551,7 +13863,7 @@ var ChannelDriver = class _ChannelDriver {
             });
           }
         } else {
-          await this.markFailed(row.conversation_id, row.id, sessionId, errorMessage3).catch(
+          await this.markFailed(row.conversation_id, row.id, sessionId, errorMessage4).catch(
             (markErr) => {
               this.log({
                 level: "warn",
@@ -13535,9 +14847,9 @@ var ChannelDriver = class _ChannelDriver {
    * trackable. Callers use the returned error to keep their path-specific logging
    * while the same report payload can be retried on a later drain.
    */
-  async reportUntrackableAck(conversationId, messageId, sessionId, errorMessage3) {
+  async reportUntrackableAck(conversationId, messageId, sessionId, errorMessage4) {
     try {
-      await this.markFailed(conversationId, messageId, sessionId, errorMessage3);
+      await this.markFailed(conversationId, messageId, sessionId, errorMessage4);
       return null;
     } catch (err) {
       this.signalUntrackableAck(conversationId, messageId);
@@ -13606,6 +14918,38 @@ var ChannelDriver = class _ChannelDriver {
     }
     this.clearSubagentInvocationCaches(messageId);
   }
+  async failV2ModelSwitch(conv, message, sessionId, error2) {
+    const { model } = splitModelVariant(message.opencode_model ?? void 0);
+    const separator = model?.indexOf("/") ?? -1;
+    const classification = error2.statusCode === 404 && model && separator > 0 && separator < model.length - 1 ? {
+      kind: "model_auth",
+      providerId: model.slice(0, separator),
+      modelId: model.slice(separator + 1),
+      reason: "missing"
+    } : null;
+    this.log({
+      level: "error",
+      message: `OpenCode could not apply the selected model for message ${message.id.slice(0, 8)}: ${error2.message}`,
+      conversation_id: conv.id,
+      message_id: message.id
+    });
+    try {
+      await this.markFailed(conv.id, message.id, sessionId, error2.message, void 0, {
+        classification,
+        errorShape: { name: null, statusCode: error2.statusCode }
+      });
+    } catch (markErr) {
+      this.log({
+        level: "warn",
+        message: `markFailed PATCH for V2 model switch failure on message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed: ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      this.signalDispatchNotStarted(conv, message, "failure_unreported");
+      return;
+    }
+    if (classification) await this.repairProviderRegistry(conv.id, message.id);
+  }
   /**
    * Classify an errored turn and extract its bounded error shape for `markFailed`.
    *
@@ -14049,7 +15393,7 @@ import ora3 from "ora";
 import { select as select3 } from "@inquirer/prompts";
 function unknownPasswordError2(port) {
   return new Error(
-    `OpenCode V2 (opencode2) is already running on port ${port} with a password this runner doesn't know. Free the port or pass --port.`
+    `An assistant on port ${port} requires credentials this runner does not have. Released OpenCode V2 generates a server password even when none is configured. This CLI has no option to supply the password for an already-running server, so it will not join one you started. Free port ${port} so Evident can start its own, or pass --port to choose another.`
   );
 }
 var INTERACTIVE_START_TIMEOUT_MS2 = 3e4;
@@ -14067,9 +15411,9 @@ async function ensureOpenCode2Running(ctx) {
       password: null
     };
   }
-  if (!isOpenCode2Installed()) {
+  if (!ctx.command && !isOpenCode2Installed()) {
     throw new Error(
-      `OpenCode V2 (opencode2) is not installed. Install it with: npm install -g ${OPENCODE2_PACKAGE_SPEC}`
+      "OpenCode V2 is not installed. Install it with `npm install -g @opencode/cli` or `curl -fsSL https://opencode.ai/v2/install | bash`."
     );
   }
   let port = ctx.port;
@@ -14097,7 +15441,8 @@ Port ${port} is already in use.`));
   if (!ctx.interactive) {
     ctx.log(`OpenCode V2 is not running on port ${port}. Starting it automatically...`);
     const { child: proc, password } = await startOpenCode2(port, {
-      inheritStdio: ctx.inheritStdio
+      inheritStdio: ctx.inheritStdio,
+      command: ctx.command
     });
     const health = await waitForOpenCode2Health(port, password, ctx.startTimeoutMs);
     if (!health.healthy) {
@@ -14118,13 +15463,14 @@ Port ${port} is already in use.`));
       password
     };
   }
+  const command = ctx.command ?? "opencode2";
   const action = await select3({
     message: "OpenCode V2 is not running. What would you like to do?",
     choices: [
       {
         name: "Start OpenCode V2 for me",
         value: "start",
-        description: `Run 'opencode2 serve --port ${port}'`
+        description: `Run '${command} serve --port ${port}'`
       },
       {
         name: "Show me the command",
@@ -14142,14 +15488,15 @@ Port ${port} is already in use.`));
     blank();
     console.log(chalk6.bold("Run this command in another terminal:"));
     blank();
-    console.log(`  ${chalk6.cyan(`opencode2 serve --port ${port}`)}`);
+    console.log(`  ${chalk6.cyan(`${command} serve --port ${port}`)}`);
     blank();
     throw new Error("Please start OpenCode V2 manually");
   }
   if (action === "start") {
     const spinner = ora3("Starting OpenCode V2...").start();
     const { child: proc, password } = await startOpenCode2(port, {
-      inheritStdio: ctx.inheritStdio
+      inheritStdio: ctx.inheritStdio,
+      command: ctx.command
     });
     const health = await waitForOpenCode2Health(port, password, INTERACTIVE_START_TIMEOUT_MS2);
     if (!health.healthy) {
@@ -14175,7 +15522,7 @@ Port ${port} is already in use.`));
 }
 
 // src/lib/runner-credentials.ts
-import { chmodSync as chmodSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { chmodSync as chmodSync2, writeFileSync as writeFileSync7 } from "node:fs";
 import { spawn as spawn5 } from "node:child_process";
 var RUNNER_SECRET_FETCH_TIMEOUT_MS = 6e4;
 var CREDENTIAL_RESTORE_TIMEOUT_MS = 6e4;
@@ -14418,8 +15765,8 @@ async function configureGitHubAccess({ env, log: log3 }) {
   }
   try {
     env.GIT_CONFIG_GLOBAL = GIT_CONFIG_GLOBAL;
-    writeFileSync5(GIT_CONFIG_GLOBAL, "");
-    writeFileSync5(GIT_CREDENTIAL_HELPER, GIT_CREDENTIAL_HELPER_CONTENT, { mode: 448 });
+    writeFileSync7(GIT_CONFIG_GLOBAL, "");
+    writeFileSync7(GIT_CREDENTIAL_HELPER, GIT_CREDENTIAL_HELPER_CONTENT, { mode: 448 });
     chmodSync2(GIT_CREDENTIAL_HELPER, 448);
     const config = [
       ["user.name", env.GIT_USER_NAME ?? "evident-bot"],
@@ -14452,7 +15799,7 @@ async function configureGitHubAccess({ env, log: log3 }) {
 // src/lib/opencode/config-overlay.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { copyFileSync, existsSync as existsSync2, statSync as statSync6 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join12, resolve as resolve4 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join14, resolve as resolve4 } from "node:path";
 function parseConfigContent(content) {
   if (!content?.trim()) return {};
   const parsed = JSON.parse(content);
@@ -14482,7 +15829,7 @@ function applyRunnerOpenCodeConfig({
     return;
   }
   const source = isAbsolute3(overlayPath) ? overlayPath : resolve4(cwd, overlayPath);
-  const target = isFile(join12(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
+  const target = isFile(join14(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
   if (!isFile(source)) {
     log3(
       `RUNNER-OPENCODE-CONFIG-MISSING: ${source} is not a file; headless turns will wedge on the first external-directory permission prompt (#563)`,
@@ -14490,7 +15837,7 @@ function applyRunnerOpenCodeConfig({
     );
     return;
   }
-  copyFileSync(source, join12(cwd, target));
+  copyFileSync(source, join14(cwd, target));
   try {
     execFileSync2("git", ["-C", cwd, "update-index", "--skip-worktree", target], {
       stdio: "ignore"
@@ -14499,13 +15846,13 @@ function applyRunnerOpenCodeConfig({
     const detail = error2 instanceof Error ? error2.message : String(error2);
     log3(`could not mark ${target} skip-worktree: ${detail}; it may show as a local change`, "warn");
   }
-  log3(`Applied runner OpenCode config ${source} to ${join12(cwd, target)}`);
+  log3(`Applied runner OpenCode config ${source} to ${join14(cwd, target)}`);
 }
 
 // src/lib/opencode/runtime-provenance.ts
-import { readFileSync as readFileSync8, readdirSync } from "node:fs";
+import { readFileSync as readFileSync11, readdirSync } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join15 } from "node:path";
 var PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i;
 var REGISTRY_SPEC = /^[a-z0-9.*+^~<>=|-]+$/i;
 function errorKind(error2) {
@@ -14573,7 +15920,7 @@ function parseJsonc(value) {
   return JSON.parse(output);
 }
 function openCodeCacheRoot(env = process.env, homeDir = homedir7()) {
-  return join13(env.XDG_CACHE_HOME ?? join13(homeDir, ".cache"), "opencode");
+  return join15(env.XDG_CACHE_HOME ?? join15(homeDir, ".cache"), "opencode");
 }
 function readConfiguredPluginSpecs({
   cwd = process.cwd(),
@@ -14582,10 +15929,10 @@ function readConfiguredPluginSpecs({
   let config;
   try {
     try {
-      config = parseJsonc(readFileSync8(join13(cwd, "opencode.jsonc"), "utf8"));
+      config = parseJsonc(readFileSync11(join15(cwd, "opencode.jsonc"), "utf8"));
     } catch (error2) {
       if (!("code" in Object(error2)) || Object(error2).code !== "ENOENT") throw error2;
-      config = parseJsonc(readFileSync8(join13(cwd, "opencode.json"), "utf8"));
+      config = parseJsonc(readFileSync11(join15(cwd, "opencode.json"), "utf8"));
     }
   } catch (error2) {
     log3(`Could not read OpenCode plugin configuration: ${errorKind(error2)}`);
@@ -14613,7 +15960,7 @@ function resolveInstalledPluginVersions({
   homeDir = homedir7(),
   log: log3
 }) {
-  const packagesRoot = join13(cacheRoot ?? openCodeCacheRoot(env, homeDir), "packages");
+  const packagesRoot = join15(cacheRoot ?? openCodeCacheRoot(env, homeDir), "packages");
   let directories;
   try {
     directories = readdirSync(packagesRoot, { withFileTypes: true });
@@ -14634,8 +15981,8 @@ function resolveInstalledPluginVersions({
     let resolvedVersion = null;
     try {
       const packageJson = JSON.parse(
-        readFileSync8(
-          join13(packagesRoot, directory.name, "node_modules", parsed.name, "package.json"),
+        readFileSync11(
+          join15(packagesRoot, directory.name, "node_modules", parsed.name, "package.json"),
           "utf8"
         )
       );
@@ -14656,7 +16003,7 @@ function resolveInstalledPluginVersions({
 }
 
 // src/lib/credential-sync.ts
-import { renameSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { renameSync, writeFileSync as writeFileSync8 } from "node:fs";
 var CREDENTIAL_SYNC_TICK_TIMEOUT_MS = 3e4;
 var CREDENTIAL_FLUSH_DEADLINE_MS = 8e3;
 var CREDENTIAL_FLUSH_ABORT_GRACE_MS = 500;
@@ -14666,7 +16013,7 @@ var MAX_FLUSH_PASSES = 2;
 function outcomesWith(outcome) {
   return { claude: outcome, opencode: outcome };
 }
-function errorMessage2(error2) {
+function errorMessage3(error2) {
   return error2 instanceof Error ? error2.message : String(error2);
 }
 function waitForSettlement(promise, timeoutMs) {
@@ -14690,10 +16037,10 @@ function writeMarker(markerPath, outcomes, log3) {
 `;
   const temporaryPath = `${markerPath}.tmp`;
   try {
-    writeFileSync6(temporaryPath, body, { mode: 384 });
+    writeFileSync8(temporaryPath, body, { mode: 384 });
     renameSync(temporaryPath, markerPath);
   } catch (error2) {
-    log3(`CREDENTIAL-FLUSH-MARKER-UNWRITABLE: ${markerPath}: ${errorMessage2(error2)}`, "warn");
+    log3(`CREDENTIAL-FLUSH-MARKER-UNWRITABLE: ${markerPath}: ${errorMessage3(error2)}`, "warn");
   }
 }
 function intervalSeconds(env, log3) {
@@ -14725,7 +16072,7 @@ async function runFlushStore(store, env, synchroniserRunner, log3, deadlineAt) {
     },
     (error2) => {
       failed = true;
-      log3(`CREDENTIAL-FLUSH-ERROR: ${store}: ${errorMessage2(error2)}`, "warn");
+      log3(`CREDENTIAL-FLUSH-ERROR: ${store}: ${errorMessage3(error2)}`, "warn");
     }
   );
   const abortTimer = setTimeout(() => controller.abort(), remainingMs);
@@ -14785,7 +16132,7 @@ function createCredentialSync({
           outcomes[store] = !result.timedOut && result.code === 0 ? "ok" : "failed";
         } catch (error2) {
           outcomes[store] = "failed";
-          log3(`CREDENTIAL-SYNC-TICK-ERROR: ${store}: ${errorMessage2(error2)}`, "debug");
+          log3(`CREDENTIAL-SYNC-TICK-ERROR: ${store}: ${errorMessage3(error2)}`, "debug");
         }
       }
       const failed = STORES.some((store) => outcomes[store] === "failed");
@@ -14908,14 +16255,21 @@ function request2(options) {
 function safeFailure(operation, status2) {
   return status2 === void 0 ? `${operation} could not reach the managed credential service` : `${operation} returned HTTP ${status2}`;
 }
-function logTransportFailure(options, operation, error2, authorization) {
-  let detail = error2 instanceof Error ? error2.message : String(error2);
+function redactAuthorizedText(message, authorization) {
+  let redacted = message;
   const credential = authorization.split(/\s+/, 2)[1];
   for (const secret of [authorization, credential]) {
-    if (secret) detail = detail.replaceAll(secret, "[redacted]");
+    if (secret) redacted = redacted.replaceAll(secret, "[redacted]");
   }
+  return redactDiagnosticText(redacted);
+}
+function logTransportFailure(options, operation, error2, authorization) {
+  const detail = redactAuthorizedText(
+    error2 instanceof Error ? error2.message : String(error2),
+    authorization
+  );
   options.log(
-    `MANAGED-INFERENCE-TRANSPORT-FAILED: operation=${operation} detail=${redactDiagnosticText(detail)}`,
+    `MANAGED-INFERENCE-TRANSPORT-FAILED: operation=${operation} detail=${detail}`,
     "debug"
   );
 }
@@ -14935,6 +16289,18 @@ function readSetup(value) {
   }
   return setup;
 }
+function readModelDescriptors(value) {
+  if (!Array.isArray(value)) return null;
+  return value.every(
+    (descriptor) => typeof descriptor === "object" && descriptor !== null && typeof descriptor.id === "string" && typeof descriptor.provider === "string"
+  ) ? value : null;
+}
+function logDescriptorRefreshFallback(options, branch, generation) {
+  options.log(
+    `MANAGED-INFERENCE-DESCRIPTORS-${branch}: runner=${options.agentId} generation=${generation}`,
+    "warn"
+  );
+}
 function clearLocalSetup(options) {
   const env = options.env ?? process.env;
   const store = options.store ?? defaultStore;
@@ -14966,7 +16332,14 @@ async function discoverManagedInferenceSetup(options) {
     return { kind: "none" };
   }
   if (!response.ok) {
-    return { kind: "failed", reason: safeFailure("Managed setup discovery", response.status) };
+    const body2 = await responseJson(response);
+    const serverMessage = typeof body2?.error === "string" && body2.error.trim() ? redactAuthorizedText(body2.error.trim(), headers.Authorization).slice(0, 500) : void 0;
+    const failure = serverMessage ? `Managed setup discovery returned HTTP ${response.status}: ${serverMessage}` : safeFailure("Managed setup discovery", response.status);
+    const runnerKeyGuidance = response.status === 401 || response.status === 403 ? "Authenticate as this runner with its runner key (EVIDENT_RUNNER_KEY)." : void 0;
+    return {
+      kind: "failed",
+      reason: runnerKeyGuidance ? `${failure}. ${runnerKeyGuidance}` : failure
+    };
   }
   const body = await responseJson(response);
   const setup = readSetup(body?.setup);
@@ -15066,7 +16439,27 @@ async function reaffirmStored(options, credential) {
   if (!setup || setup.generation !== credential.generation || setup.token_id !== credential.tokenId) {
     return { kind: "failed", reason: "Managed credential reaffirmation returned a mismatch" };
   }
-  const failure = applyCredential(options, credential);
+  const descriptorsValue = body?.model_descriptors;
+  const refreshedDescriptors = readModelDescriptors(descriptorsValue);
+  let credentialToApply = credential;
+  if (descriptorsValue === void 0 || descriptorsValue === null) {
+    logDescriptorRefreshFallback(options, "UNAVAILABLE", credential.generation);
+  } else if (refreshedDescriptors === null) {
+    logDescriptorRefreshFallback(options, "MALFORMED", credential.generation);
+  } else if (refreshedDescriptors.length === 0) {
+    logDescriptorRefreshFallback(options, "EMPTY", credential.generation);
+  } else {
+    const { config, unsupportedProviders } = buildCredentialProxyNativeConfig({
+      inferenceBaseUrl: credential.inferenceBaseUrl,
+      modelDescriptors: refreshedDescriptors
+    });
+    if (unsupportedProviders.length > 0 || Object.keys(config.provider).length === 0) {
+      logDescriptorRefreshFallback(options, "UNSUPPORTED-PROVIDER", credential.generation);
+    } else {
+      credentialToApply = { ...credential, modelDescriptors: refreshedDescriptors };
+    }
+  }
+  const failure = applyCredential(options, credentialToApply);
   return failure ? { kind: "failed", reason: failure } : { kind: "ready", generation: credential.generation, tokenId: credential.tokenId };
 }
 async function prepareManagedInferenceSetup(options, discovery, health) {
@@ -15100,10 +16493,8 @@ async function prepareManagedInferenceSetup(options, discovery, health) {
   const setup = readSetup(body?.setup);
   const token = body?.inference_token;
   const inferenceBaseUrl = body?.inference_base_url;
-  const modelDescriptors = body?.model_descriptors;
-  if (!setup || setup.generation !== discovery.setup.generation || typeof setup.token_id !== "string" || typeof token !== "string" || typeof inferenceBaseUrl !== "string" || !Array.isArray(modelDescriptors) || !modelDescriptors.every(
-    (descriptor) => typeof descriptor === "object" && descriptor !== null && typeof descriptor.id === "string" && typeof descriptor.provider === "string"
-  )) {
+  const modelDescriptors = readModelDescriptors(body?.model_descriptors);
+  if (!setup || setup.generation !== discovery.setup.generation || typeof setup.token_id !== "string" || typeof token !== "string" || typeof inferenceBaseUrl !== "string" || modelDescriptors === null) {
     return { kind: "failed", reason: "Managed credential bootstrap returned an invalid response" };
   }
   const credential = {
@@ -15172,33 +16563,49 @@ function resolveLogLevel(options) {
   }
   return "info";
 }
-function resolveFileSyncDirectories(raw, homeDir) {
-  const directories = [];
+function resolveFileSyncEntry(entry, homeDir, flagName, labels) {
+  const trimmed = entry.trim();
+  if (trimmed === "") {
+    throw new Error(`${flagName} requires a ${labels.noun} path (got an empty value)`);
+  }
+  const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join16(homeDir, trimmed.slice(2)) : trimmed;
+  if (!isAbsolute4(expanded)) {
+    throw new Error(`${flagName} requires an absolute ${labels.noun} path; got "${entry}"`);
+  }
+  const normalized = resolvePath2(expanded);
+  if (parse(normalized).root === normalized) {
+    throw new Error(
+      `${flagName} will not allow-list the filesystem root ("${entry}"); name the specific ${labels.noun} the credentials belong in (for example ${labels.rootExample})`
+    );
+  }
+  return normalized;
+}
+function resolveFileSyncAllowList(raw, homeDir, flagName, labels) {
+  const paths = [];
   for (const entry of raw ?? []) {
-    const trimmed = entry.trim();
-    if (trimmed === "") {
-      throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
-    }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join14(homeDir, trimmed.slice(2)) : trimmed;
-    if (!isAbsolute4(expanded)) {
-      throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
-    }
-    const normalized = resolvePath2(expanded);
-    if (parse(normalized).root === normalized) {
-      throw new Error(
-        `--enable-file-sync-to will not allow-list the filesystem root ("${entry}"); name the specific directory the credentials belong in (for example ~/.claude)`
-      );
-    }
-    if (!directories.includes(normalized)) {
-      directories.push(normalized);
-    }
+    const normalized = resolveFileSyncEntry(entry, homeDir, flagName, labels);
+    if (!paths.includes(normalized)) paths.push(normalized);
   }
-  if (directories.length > MAX_FILE_SYNC_DIRECTORIES) {
+  if (paths.length > MAX_FILE_SYNC_DIRECTORIES) {
     throw new Error(
-      `--enable-file-sync-to accepts at most ${MAX_FILE_SYNC_DIRECTORIES} directories; got ${directories.length}`
+      `${flagName} accepts at most ${MAX_FILE_SYNC_DIRECTORIES} ${labels.plural}; got ${paths.length}`
     );
   }
-  return directories;
+  return paths;
+}
+function resolveFileSyncDirectories(raw, homeDir) {
+  return resolveFileSyncAllowList(raw, homeDir, "--enable-file-sync-to", {
+    noun: "directory",
+    plural: "directories",
+    rootExample: "~/.claude"
+  });
+}
+function resolveFileSyncExactFiles(raw, homeDir) {
+  return resolveFileSyncAllowList(raw, homeDir, "--enable-file-sync-to-exact-file", {
+    noun: "file",
+    plural: "files",
+    rootExample: "~/.local/share/opencode/mcp-auth.json"
+  });
 }
 var DEFAULT_OPENCODE_START_TIMEOUT_SECONDS = 180;
 var MAX_OPENCODE_START_TIMEOUT_SECONDS = 3600;
@@ -15214,13 +16621,13 @@ function resolveOpenCodeVersion(options, env = process.env) {
     raw = env[OPENCODE_VERSION_ENV];
     source = OPENCODE_VERSION_ENV;
   } else {
-    return { version: "v1", warnings: [] };
+    return { version: "auto", warnings: [] };
   }
   const normalized = raw.trim().toLowerCase();
-  if (normalized !== "v1" && normalized !== "v2") {
+  if (normalized !== "v1" && normalized !== "v2" && normalized !== "auto") {
     return {
-      version: "v1",
-      warnings: [`Ignoring invalid ${source} "${raw}": expected v1 or v2; using the default v1`]
+      version: "auto",
+      warnings: [`Ignoring invalid ${source} "${raw}": expected v1, v2, or auto; using auto`]
     };
   }
   return { version: normalized, warnings: [] };
@@ -15730,8 +17137,8 @@ async function driveChannels(state, driver) {
         state.running = false;
         break;
       }
-      const errorMessage3 = error2 instanceof Error ? error2.message : String(error2);
-      logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage3}` });
+      const errorMessage4 = error2 instanceof Error ? error2.message : String(error2);
+      logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage4}` });
       if (state.interactive) displayStatus(state);
       if (driver.hasInFlightWatchers()) {
         consecutiveDrainFailures = 0;
@@ -15821,6 +17228,7 @@ async function driveChannels(state, driver) {
   }
 }
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
+var SESSION_ARCHIVE_FIRST_RUN_MS = SESSION_CLEANUP_FIRST_SWEEP_MS + 1e3;
 var SESSION_CLEANUP_MAX_DELETES_PER_SWEEP = 100;
 var SESSION_CLEANUP_MAX_ISOLATED_DELETE_FAILURES = 2;
 var SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES = 2;
@@ -15835,7 +17243,7 @@ function shouldWarnForReclaimSkip(reason) {
   return major > 22 || major === 22 && (minor > 13 || minor === 13 && patch >= 0);
 }
 function sessionDbPath() {
-  return join14(homedir8(), ".local", "share", "opencode", "opencode.db");
+  return join16(homedir8(), ".local", "share", "opencode", "opencode.db");
 }
 function logSessionCleanupActivity(state, phase, entry) {
   logActivity(state, {
@@ -15844,6 +17252,93 @@ function logSessionCleanupActivity(state, phase, entry) {
     metadata: { ...entry.metadata, phase }
   });
 }
+function logSessionArchiveActivity(state, phase, entry) {
+  logActivity(state, {
+    ...entry,
+    source: "cli.session-archive",
+    metadata: { ...entry.metadata, phase }
+  });
+}
+function logSessionArchiveSummary(state, phase, summary) {
+  const everyUploadFailed = summary.uploadAttempts > 0 && summary.uploadFailures === summary.uploadAttempts;
+  const staleSince = everyUploadFailed && summary.staleSince !== null ? `; archive stale since ${summary.staleSince}` : "";
+  const neverWatermarked = summary.neverWatermarkedFailures > 0 ? `; ${summary.neverWatermarkedFailures} failed session(s) had no prior successful upload` : "";
+  const warning2 = summary.failed > 0 || summary.failures.length > 0 || everyUploadFailed || !summary.reconciliationComplete;
+  logSessionArchiveActivity(state, phase, {
+    type: "info",
+    level: warning2 ? "warn" : "info",
+    message: `Session archive: inspected ${summary.inspected}, uploaded ${summary.uploaded}, unchanged ${summary.unchanged}, failed ${summary.failed}, skipped budget ${summary.skippedBudget}, unmapped ${summary.unmappedIds.length}, conflicts ${summary.conflicts}, reconciliation incomplete ${summary.reconciliationIncomplete}; bindings ledger ${summary.bindingSourceCounts.ledger}, watermark ${summary.bindingSourceCounts.watermark}, current ${summary.bindingSourceCounts.current}, invocation ${summary.bindingSourceCounts.invocation}, history ${summary.bindingSourceCounts.history}, parent ${summary.bindingSourceCounts.parent}` + staleSince + neverWatermarked,
+    metadata: {
+      outcome: "archive-run-complete",
+      sessions_inspected: summary.inspected,
+      sessions_uploaded: summary.uploaded,
+      sessions_unchanged: summary.unchanged,
+      sessions_failed: summary.failed,
+      uploads_attempted: summary.uploadAttempts,
+      uploads_failed: summary.uploadFailures,
+      sessions_skipped_budget: summary.skippedBudget,
+      sessions_unmapped: summary.unmappedIds.length,
+      sessions_unresolved: summary.unresolved,
+      sessions_conflicted: summary.conflicts,
+      sessions_reconciliation_incomplete: summary.reconciliationIncomplete,
+      binding_reconciliation_complete: summary.reconciliationComplete,
+      bindings_from_ledger: summary.bindingSourceCounts.ledger,
+      bindings_from_watermark: summary.bindingSourceCounts.watermark,
+      bindings_from_current: summary.bindingSourceCounts.current,
+      bindings_from_invocation: summary.bindingSourceCounts.invocation,
+      bindings_from_history: summary.bindingSourceCounts.history,
+      bindings_from_parent: summary.bindingSourceCounts.parent,
+      sessions_without_prior_watermark: summary.neverWatermarkedFailures,
+      ...everyUploadFailed && summary.staleSince !== null ? { stale_since: summary.staleSince } : {}
+    }
+  });
+  for (const failure of summary.failures) {
+    const permanentSizeFailure = failure.reason === "too-large";
+    const hasPayloadDetails = failure.bytes !== void 0 && failure.byteLimit !== void 0 && failure.messageCount !== void 0 && failure.partCount !== void 0;
+    const payloadDetails = hasPayloadDetails ? `; payload bytes=${failure.bytes} limit=${failure.byteLimit} messages=${failure.messageCount} parts=${failure.partCount}` : "";
+    const safeMessage = !hasPayloadDetails && failure.message ? `: ${redactDiagnosticText(failure.message).slice(0, 200)}` : "";
+    logSessionArchiveActivity(state, phase, {
+      type: "info",
+      level: "warn",
+      message: `Session archive: session ${failure.sessionId} ` + (permanentSizeFailure ? "failed permanently (too-large payload)" : `failed (${failure.outcome}`) + (permanentSizeFailure ? "" : failure.reason ? `, reason=${failure.reason})` : ")") + payloadDetails + (failure.exitCode !== void 0 ? `; child exit code=${failure.exitCode}` : "") + safeMessage,
+      metadata: {
+        outcome: failure.outcome,
+        session_id: failure.sessionId,
+        archived: failure.archived,
+        ...failure.reason !== void 0 ? { reason: failure.reason } : {},
+        ...failure.exitCode !== void 0 ? { child_exit_code: failure.exitCode } : {},
+        ...hasPayloadDetails ? {
+          payload_bytes: failure.bytes,
+          payload_limit_bytes: failure.byteLimit,
+          message_count: failure.messageCount,
+          part_count: failure.partCount
+        } : {}
+      }
+    });
+  }
+  if (summary.unmappedIds.length > 0) {
+    logSessionArchiveActivity(state, phase, {
+      type: "info",
+      level: "warn",
+      message: `Session archive: ${summary.unmappedIds.length} unmapped session(s): ` + summary.unmappedIds.join(", "),
+      metadata: {
+        outcome: "unmapped-sessions",
+        sessions_unmapped: summary.unmappedIds.length
+      }
+    });
+  }
+  if (summary.conflictedIds.length > 0) {
+    logSessionArchiveActivity(state, phase, {
+      type: "info",
+      level: "warn",
+      message: `Session archive: ${summary.conflictedIds.length} session(s) have conflicting conversation identities: ${summary.conflictedIds.join(", ")}`,
+      metadata: {
+        outcome: "conflicted-session-bindings",
+        sessions_conflicted: summary.conflicts
+      }
+    });
+  }
+}
 async function drainSessionDeletionReports(state) {
   const path = sessionDeletionReportPath(homedir8(), process.env);
   let delivered = 0;
@@ -15941,6 +17436,7 @@ async function runSweep(state, driver, config) {
     let failedOtherStatus = 0;
     let failedThrew = 0;
     let skippedNewlyActive = 0;
+    let skippedArchive = 0;
     let remaining = 0;
     const deletionRecords = [];
     let protectedNow = driver.protectedSessionIds();
@@ -15952,6 +17448,7 @@ async function runSweep(state, driver, config) {
       const lastActivityById = new Map(
         snapshots.map(({ id, lastActivityMs }) => [id, lastActivityMs])
       );
+      const sessionById = new Map(sessions.map((session) => [session.id, session]));
       const toDelete = selectSessionsToDelete(snapshots, {
         maxAgeMs: config.maxAgeMs,
         maxCount: config.maxCount,
@@ -15974,6 +17471,42 @@ async function runSweep(state, driver, config) {
           });
           continue;
         }
+        if (state.sessionArchiveConfig.enabled) {
+          const candidate = sessionById.get(id);
+          const archiveConfig = state.sessionArchiveConfig;
+          const archiveBudgetMs = Math.min(
+            archiveConfig.intervalMs + SESSION_ARCHIVE_UPLOAD_TIMEOUT_MS,
+            MAX_SESSION_ARCHIVE_TIMER_DELAY_MS
+          );
+          const archived = candidate ? await runSessionArchiveTask(
+            state,
+            "sweep",
+            archiveBudgetMs,
+            (signal) => runSessionArchiveBatch(state, "sweep", [candidate], archiveBudgetMs, signal)
+          ) : null;
+          if (!archived?.archivedSessionIds.includes(id)) {
+            skippedArchive++;
+            logSessionArchiveActivity(state, "sweep", {
+              type: "info",
+              level: "warn",
+              message: `Session cleanup: retaining session ${id}; deletion is held back pending successful archival`,
+              metadata: {
+                outcome: "deletion-held-for-archive",
+                session_id: id
+              }
+            });
+            continue;
+          }
+          protectedNow = driver.protectedSessionIds();
+          if (protectedNow.has(id)) {
+            skippedNewlyActive++;
+            logActivity(state, {
+              type: "info",
+              message: `Session cleanup: skipping ${id} \u2014 became active/bound during archival (${mode})`
+            });
+            continue;
+          }
+        }
         const outcome = await deleteSession(state.port, id, state.opencodeClient ?? void 0);
         if (outcome.ok) {
           deleted++;
@@ -16037,10 +17570,11 @@ async function runSweep(state, driver, config) {
       }
       const failedNote = failed > 0 ? `, failed ${failed}` : "";
       const skippedNote = skippedNewlyActive > 0 ? `, skipped ${skippedNewlyActive} newly-active` : "";
+      const archiveHeldNote = skippedArchive > 0 ? `, archive held ${skippedArchive}` : "";
       const remainingNote = remaining > 0 ? `, remaining ${remaining}` : "";
       logActivity(state, {
         type: "info",
-        message: `Session cleanup: inspected ${sessions.length}, deleted ${deleted}${failedNote}${skippedNote}${remainingNote} (${mode})`
+        message: `Session cleanup: inspected ${sessions.length}, deleted ${deleted}${failedNote}${skippedNote}${archiveHeldNote}${remainingNote} (${mode})`
       });
     }
     if (deletionRecords.length > 0) {
@@ -16078,6 +17612,7 @@ async function runSweep(state, driver, config) {
       sessions_failed_other: failedOtherStatus,
       sessions_failed_threw: failedThrew,
       sessions_skipped_active: skippedNewlyActive,
+      sessions_archive_held: skippedArchive,
       sessions_remaining: remaining,
       ...enumerationReason !== null ? { session_enumeration_reason: enumerationReason } : {}
     };
@@ -16209,6 +17744,213 @@ function scheduleSessionCleanup(state, driver, options) {
   );
   state.sessionCleanupTimers.push(interval, firstSweep);
 }
+function runSessionArchiveTask(state, phase, budgetMs, work) {
+  if (state.sessionArchiveInFlight) {
+    logSessionArchiveActivity(state, phase, {
+      type: "info",
+      level: "debug",
+      message: "Session archive skipped \u2014 previous archive run still in progress",
+      metadata: { outcome: "skipped-in-flight" }
+    });
+    return Promise.resolve(null);
+  }
+  const controller = new AbortController();
+  state.sessionArchiveAbortController = controller;
+  const timeout = setTimeout(() => {
+    controller.abort();
+    logSessionArchiveActivity(state, phase, {
+      type: "info",
+      level: "warn",
+      message: `Session archive exceeded ${budgetMs}ms; remaining sessions were not confirmed archived`,
+      metadata: { outcome: "archive-budget-exceeded", budget_ms: budgetMs }
+    });
+  }, budgetMs);
+  const task = Promise.resolve().then(() => work(controller.signal)).catch((error2) => {
+    logSessionArchiveActivity(state, phase, {
+      type: "info",
+      level: "warn",
+      message: `Session archive run failed: ${redactDiagnosticText(error2 instanceof Error ? error2.message : String(error2)).slice(0, 200)}`,
+      metadata: { outcome: "archive-run-failed" }
+    });
+    return null;
+  }).finally(() => {
+    clearTimeout(timeout);
+    if (state.sessionArchiveInFlight === task) {
+      state.sessionArchiveInFlight = null;
+      state.sessionArchiveAbortController = null;
+    }
+  });
+  state.sessionArchiveInFlight = task;
+  return task;
+}
+async function runSessionArchiveBatch(state, phase, sessions, budgetMs, signal) {
+  const config = state.sessionArchiveConfig;
+  const client = state.opencodeClient;
+  const watermarkPath = state.sessionArchiveWatermarkPath;
+  if (!client || !config.keyPrefix || !watermarkPath || !state.agentId) {
+    logSessionArchiveActivity(state, phase, {
+      type: "info",
+      level: "warn",
+      message: "Session archive skipped because runner identity or archive configuration is unavailable",
+      metadata: { outcome: "archive-configuration-unavailable" }
+    });
+    return null;
+  }
+  const bindings = readSessionBindings(
+    sessionBindingLedgerPath(homedir8(), process.env),
+    (message) => logSessionArchiveActivity(state, phase, {
+      type: "info",
+      level: "warn",
+      message: redactDiagnosticText(message),
+      metadata: { outcome: "binding-ledger-read-failed" }
+    })
+  );
+  const reconciliation = await fetchSessionBindingProjection({
+    apiUrl: getApiUrlConfig(),
+    runnerId: state.agentId,
+    authHeader: state.authHeader,
+    sessions,
+    signal
+  });
+  if (!reconciliation.complete) {
+    const failure = reconciliation.failures[0];
+    const detail = failure.kind === "http" ? `HTTP ${failure.status} for chunk ${failure.chunk}` : failure.kind === "network" ? `network failure for chunk ${failure.chunk}: ${redactDiagnosticText(failure.message ?? "unknown error").slice(0, 200)}` : `invalid response for chunk ${failure.chunk}`;
+    logSessionArchiveActivity(state, phase, {
+      type: "info",
+      level: "warn",
+      message: `Session archive: binding reconciliation incomplete for runner ${state.agentId}; ${reconciliation.failures.length} chunk(s) failed (${detail}), unresolved sessions will not replace existing archives`,
+      metadata: {
+        outcome: "binding-reconciliation-incomplete",
+        runner_id: state.agentId,
+        failed_chunks: reconciliation.failures.length,
+        first_failed_chunk: failure.chunk,
+        first_failure_kind: failure.kind,
+        ...failure.status !== void 0 ? { http_status: failure.status } : {}
+      }
+    });
+  }
+  const summary = await runSessionArchive({
+    sessions,
+    deps: {
+      client,
+      runnerId: state.agentId,
+      keyPrefix: config.keyPrefix,
+      bindings,
+      projection: reconciliation.projection,
+      reconciliationComplete: reconciliation.complete,
+      watermarks: state.sessionArchiveWatermarks,
+      watermarkPath,
+      signal,
+      upload: uploadSessionArchive,
+      exportMessages: exportSessionMessages,
+      recordWatermark: recordUpload
+    },
+    budgetMs
+  });
+  logSessionArchiveSummary(state, phase, summary);
+  return summary;
+}
+async function runSessionArchiveFleet(state, phase, budgetMs, signal) {
+  const startedAt = Date.now();
+  const enumeration = await listAllSessions(state.port, state.opencodeClient ?? void 0, signal);
+  if (enumeration.sessions === null) {
+    const interrupted = signal.aborted;
+    logSessionArchiveActivity(state, phase, {
+      type: "info",
+      level: "warn",
+      message: interrupted ? "Session archive: enumeration was interrupted before the complete store was known; no session was marked archived" : `Session archive: could not enumerate the complete session store (${enumeration.reason}); no session was marked archived`,
+      metadata: {
+        outcome: interrupted ? "enumeration-interrupted" : "enumeration-refused",
+        ...!interrupted ? { reason: enumeration.reason } : {}
+      }
+    });
+    return null;
+  }
+  return runSessionArchiveBatch(
+    state,
+    phase,
+    enumeration.sessions,
+    Math.max(0, budgetMs - (Date.now() - startedAt)),
+    signal
+  );
+}
+async function runSessionArchiveShutdownFlush(state, budgetMs) {
+  const deadline = Date.now() + budgetMs;
+  const previousRun = state.sessionArchiveInFlight;
+  if (previousRun) {
+    state.sessionArchiveAbortController?.abort(
+      new Error("graceful shutdown archive flush requested")
+    );
+    let timeout;
+    const settled = await Promise.race([
+      previousRun.then(() => true),
+      new Promise((resolve5) => {
+        timeout = setTimeout(() => resolve5(false), budgetMs);
+      })
+    ]);
+    if (timeout) clearTimeout(timeout);
+    if (!settled) {
+      state.sessionArchiveAbortController?.abort(new Error("session archive flush budget expired"));
+      logSessionArchiveActivity(state, "shutdown", {
+        type: "info",
+        level: "warn",
+        message: `Session archive exceeded ${budgetMs}ms while stopping a prior run; remaining sessions were not confirmed archived`,
+        metadata: { outcome: "archive-budget-exceeded", budget_ms: budgetMs }
+      });
+      return null;
+    }
+  }
+  const remainingMs = Math.floor(deadline - Date.now());
+  if (remainingMs <= 0) {
+    logSessionArchiveActivity(state, "shutdown", {
+      type: "info",
+      level: "warn",
+      message: `Session archive exceeded ${budgetMs}ms while stopping a prior run; remaining sessions were not confirmed archived`,
+      metadata: { outcome: "archive-budget-exceeded", budget_ms: budgetMs }
+    });
+    return null;
+  }
+  return runSessionArchiveTask(
+    state,
+    "shutdown",
+    remainingMs,
+    (signal) => runSessionArchiveFleet(state, "shutdown", remainingMs, signal)
+  );
+}
+function scheduleSessionArchive(state) {
+  const config = state.sessionArchiveConfig;
+  if (!config.enabled) return;
+  state.sessionArchiveWatermarkPath = sessionArchiveWatermarkPath(homedir8(), process.env);
+  state.sessionArchiveWatermarks = readWatermarks(
+    state.sessionArchiveWatermarkPath,
+    (message) => logSessionArchiveActivity(state, "startup", {
+      type: "info",
+      level: "warn",
+      message: redactDiagnosticText(message),
+      metadata: { outcome: "watermark-read-failed" }
+    })
+  );
+  logSessionArchiveActivity(state, "startup", {
+    type: "info",
+    message: `Session archive enabled (interval=${config.intervalMs}ms)`,
+    metadata: { outcome: "armed", interval_ms: config.intervalMs }
+  });
+  const cycleBudgetMs = Math.min(
+    config.intervalMs + SESSION_ARCHIVE_UPLOAD_TIMEOUT_MS,
+    MAX_SESSION_ARCHIVE_TIMER_DELAY_MS
+  );
+  const run2 = (phase = "scheduled") => {
+    void runSessionArchiveTask(
+      state,
+      phase,
+      cycleBudgetMs,
+      (signal) => runSessionArchiveFleet(state, phase, cycleBudgetMs, signal)
+    );
+  };
+  const interval = setInterval(run2, config.intervalMs);
+  const firstRun = setTimeout(() => run2(), SESSION_ARCHIVE_FIRST_RUN_MS);
+  state.sessionArchiveTimers.push(interval, firstRun);
+}
 function scheduleUsageReporting(state, params) {
   const { mode, warnings } = params.resolved;
   for (const warning2 of warnings) {
@@ -16483,6 +18225,12 @@ async function cleanup(state, opts = {}) {
     clearTimeout(timer);
   }
   state.sessionCleanupTimers = [];
+  for (const timer of state.sessionArchiveTimers) {
+    clearInterval(timer);
+    clearTimeout(timer);
+  }
+  state.sessionArchiveTimers = [];
+  state.sessionArchiveAbortController?.abort(new Error("runner cleanup started"));
   state.stopOpenCodeLogTail?.();
   state.stopOpenCodeLogTail = null;
   if (state.claudeUsageTimer) {
@@ -16550,6 +18298,15 @@ async function cleanup(state, opts = {}) {
     await timeShutdownPhase(state, durations, "tunnel_close", () => connection.close());
     state.connection = null;
   }
+  if (opts.graceful && state.sessionArchiveConfig.enabled) {
+    const budgetMs = state.sessionArchiveConfig.flushBudgetMs;
+    await timeShutdownPhase(
+      state,
+      durations,
+      "session_archive_flush",
+      () => runSessionArchiveShutdownFlush(state, budgetMs)
+    );
+  }
   if (state.opencodeProcess) {
     const opencodeProcess = state.opencodeProcess;
     const result = await timeShutdownPhase(
@@ -16621,9 +18378,11 @@ async function run(options) {
   const interactive = isInteractive(options.json);
   let logLevel;
   let fileSyncDirectories;
+  let fileSyncExactFiles;
   try {
     logLevel = resolveLogLevel(options);
     fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir8());
+    fileSyncExactFiles = resolveFileSyncExactFiles(options.enableFileSyncToExactFile, homedir8());
     if (options.restoreSessionDb && !options.sessionDbNoReplicateMarker) {
       throw new Error(
         "--restore-session-db requires --session-db-no-replicate-marker <path>; restore failures must block Litestream replication"
@@ -16671,6 +18430,18 @@ async function run(options) {
     messageCount: 0,
     lastProxiedActivityAt: null,
     sessionCleanupTimers: [],
+    sessionArchiveConfig: resolveSessionArchiveConfig(
+      {
+        enabled: options.sessionArchive,
+        interval: options.sessionArchiveInterval
+      },
+      process.env
+    ),
+    sessionArchiveTimers: [],
+    sessionArchiveWatermarks: /* @__PURE__ */ new Map(),
+    sessionArchiveWatermarkPath: null,
+    sessionArchiveInFlight: null,
+    sessionArchiveAbortController: null,
     sessionDeleteFailures: /* @__PURE__ */ new Map(),
     claudeUsageTimer: null,
     claudeUsageRearm: null,
@@ -16684,6 +18455,14 @@ async function run(options) {
   };
   setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
   setTelemetryDiagnosticsReporter((message) => log2(state, message, "warn"));
+  for (const warning2 of state.sessionArchiveConfig.warnings) {
+    logSessionArchiveActivity(state, "startup", {
+      type: "info",
+      level: "warn",
+      message: `Session archive: ${warning2}`,
+      metadata: { outcome: "configuration-warning" }
+    });
+  }
   if (options.credentialSyncMarker) {
     state.credentialSync = createCredentialSync({
       markerPath: options.credentialSyncMarker,
@@ -16699,7 +18478,11 @@ async function run(options) {
   }
   if (fileSyncDirectories.length > 0) {
     log2(state, `File sync enabled for: ${fileSyncDirectories.join(", ")}`);
-  } else {
+  }
+  if (fileSyncExactFiles.length > 0) {
+    log2(state, `File sync exact files enabled for: ${fileSyncExactFiles.join(", ")}`);
+  }
+  if (fileSyncDirectories.length === 0 && fileSyncExactFiles.length === 0) {
     log2(state, "File sync is disabled (no --enable-file-sync-to given)", "debug");
   }
   if (!options.runner && options.agent) {
@@ -17001,13 +18784,75 @@ async function run(options) {
     for (const warning2 of opencodeStartTimeoutWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
     }
-    const { version: opencodeVersion, warnings: opencodeVersionWarnings } = resolveOpenCodeVersion(
-      options,
-      process.env
-    );
+    const { version: opencodeVersionSelection, warnings: opencodeVersionWarnings } = resolveOpenCodeVersion(options, process.env);
     for (const warning2 of opencodeVersionWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
     }
+    let opencodeMajor;
+    let opencodeV2Command;
+    let opencodeDetectionSource;
+    let opencodeDetectionLevel = "info";
+    let opencodeDetectionMessage;
+    if (opencodeVersionSelection === "v1") {
+      opencodeMajor = "v1";
+      opencodeDetectionSource = "explicit";
+      opencodeDetectionMessage = "OpenCode V1 was selected explicitly.";
+    } else if (opencodeVersionSelection === "v2") {
+      const installed = resolveInstalledOpenCode();
+      opencodeMajor = "v2";
+      opencodeDetectionSource = "explicit";
+      if (installed.kind === "installed" && installed.major === "v2") {
+        opencodeV2Command = installed.command;
+        opencodeDetectionMessage = `OpenCode V2 was selected explicitly; using ${installed.command}${installed.version ? ` (${installed.version})` : ""}.`;
+      } else if (installed.kind === "unknown") {
+        opencodeDetectionMessage = `OpenCode V2 was selected explicitly; ${installed.command} reported ${JSON.stringify(installed.rawVersion)}, but no V2 command was resolved.`;
+      } else if (installed.kind === "installed") {
+        opencodeDetectionMessage = `OpenCode V2 was selected explicitly; ${installed.command} reported V1 ${installed.version ?? "with an unknown version"}, so no V2 command was resolved.`;
+      } else {
+        opencodeDetectionMessage = "OpenCode V2 was selected explicitly, but no V2 command was resolved.";
+      }
+    } else {
+      const running = await classifyRunningOpenCode(state.port);
+      if (running.kind === "v1") {
+        opencodeMajor = "v1";
+        opencodeDetectionSource = "running-server";
+        opencodeDetectionMessage = `OpenCode detection: found V1 on port ${state.port}${running.version ? ` (${running.version})` : " (version unknown)"}.`;
+      } else if (running.kind === "v2") {
+        opencodeMajor = "v2";
+        opencodeDetectionSource = "running-server";
+        opencodeDetectionMessage = `OpenCode detection: found V2 on port ${state.port}${running.version ? ` (${running.version})` : " (version unknown)"}.`;
+      } else if (running.kind === "authenticated-unknown") {
+        const message = `A server on port ${state.port} requires credentials this runner does not have. This can be a password-protected V1 or a V2 server, so the protocol cannot be established. Select it explicitly with --opencode-version v1 or --opencode-version v2.`;
+        logActivity(state, {
+          type: "info",
+          level: "warn",
+          message: `OpenCode detection: authenticated-unknown on port ${state.port}; ${running.detail}. ${message}`
+        });
+        throw new Error(message);
+      } else {
+        const installed = resolveInstalledOpenCode();
+        opencodeDetectionLevel = "warn";
+        if (installed.kind === "installed") {
+          opencodeMajor = installed.major;
+          opencodeDetectionSource = "installed-binary";
+          if (installed.major === "v2") opencodeV2Command = installed.command;
+          opencodeDetectionMessage = `OpenCode detection: no server identified on port ${state.port} (${running.detail}); using installed ${installed.major} command ${installed.command}${installed.version ? ` (${installed.version})` : " with an unknown version"}.`;
+        } else if (installed.kind === "unknown") {
+          opencodeMajor = "v1";
+          opencodeDetectionSource = "fallback-v1";
+          opencodeDetectionMessage = `OpenCode detection: no server identified on port ${state.port} (${running.detail}); ${installed.command} reported ${JSON.stringify(installed.rawVersion)}, so assuming V1. Use --opencode-version v2 to select V2 explicitly.`;
+        } else {
+          opencodeMajor = "v1";
+          opencodeDetectionSource = "fallback-v1";
+          opencodeDetectionMessage = `OpenCode detection: no server identified on port ${state.port} (${running.detail}); no recognizable OpenCode binary is installed, so continuing into the V1 install flow.`;
+        }
+      }
+    }
+    logActivity(state, {
+      type: "info",
+      level: opencodeDetectionLevel,
+      message: opencodeDetectionMessage
+    });
     const managedSetupOptions = {
       agentId: state.agentId,
       apiUrl: getApiUrlConfig(),
@@ -17028,7 +18873,7 @@ async function run(options) {
       managedPreparation = managedDiscovery;
       managedSetupOptions.log(`MANAGED-INFERENCE-NOT-READY: ${managedDiscovery.reason}`, "warn");
     } else if (managedDiscovery.kind === "setup") {
-      const managedHealth = opencodeVersion === "v2" ? await checkOpenCode2Health(state.port) : await checkOpenCodeHealth(state.port);
+      const managedHealth = opencodeMajor === "v2" ? await checkOpenCode2Health(state.port) : await checkOpenCodeHealth(state.port);
       managedPreparation = await prepareManagedInferenceSetup(
         managedSetupOptions,
         managedDiscovery,
@@ -17053,13 +18898,14 @@ async function run(options) {
     const preBootMigrationIds = readSessionDbMigrationIds(sessionDbPath());
     const ocSpinner = interactive && !state.json ? ora4("Checking OpenCode...").start() : null;
     try {
-      const oc = opencodeVersion === "v2" ? await ensureOpenCode2Running({
+      const oc = opencodeMajor === "v2" ? await ensureOpenCode2Running({
         port: state.port,
         interactive: state.interactive,
         agentId: state.agentId,
         log: (message) => log2(state, message),
         startTimeoutMs: opencodeStartTimeoutMs,
-        inheritStdio: Boolean(options.opencodePidFile)
+        inheritStdio: Boolean(options.opencodePidFile),
+        command: opencodeV2Command
       }) : await ensureOpenCodeRunning({
         port: state.port,
         interactive: state.interactive,
@@ -17071,7 +18917,7 @@ async function run(options) {
       state.port = oc.port;
       state.opencodeProcess = options.opencodePidFile ? null : oc.process;
       state.opencodeVersion = oc.version;
-      state.opencodeApiVersion = opencodeVersion;
+      state.opencodeApiVersion = opencodeMajor;
       let configuredPlugins = [];
       let resolvedPlugins = [];
       try {
@@ -17093,13 +18939,14 @@ async function run(options) {
         metadata: {
           opencode_version: state.opencodeVersion,
           opencode_api_version: state.opencodeApiVersion,
+          opencode_detection_source: opencodeDetectionSource,
           configured_plugins: JSON.stringify(configuredPlugins),
           resolved_plugins: JSON.stringify(resolvedPlugins)
         },
         source: "cli.runtime-provenance"
       });
       let opencodePassword = null;
-      if (opencodeVersion === "v2" && "password" in oc) {
+      if (opencodeMajor === "v2" && "password" in oc) {
         const value = oc.password;
         if (typeof value === "string" || value === null) opencodePassword = value;
       }
@@ -17112,7 +18959,7 @@ async function run(options) {
       state.opencodeClient = openCodeClient;
       if (options.opencodePidFile && oc.process?.pid !== void 0) {
         try {
-          writeFileSync7(options.opencodePidFile, `${oc.process.pid}
+          writeFileSync9(options.opencodePidFile, `${oc.process.pid}
 `, { mode: 384 });
           chmodSync3(options.opencodePidFile, 384);
         } catch (error2) {
@@ -17222,7 +19069,7 @@ async function run(options) {
         let existingPid;
         if (existsSync3(options.litestreamPidFile)) {
           try {
-            const rawPid = readFileSync9(options.litestreamPidFile, "utf8").trim();
+            const rawPid = readFileSync12(options.litestreamPidFile, "utf8").trim();
             const parsedPid = Number(rawPid);
             if (/^\d+$/.test(rawPid) && Number.isSafeInteger(parsedPid) && parsedPid > 0) {
               existingPid = parsedPid;
@@ -17259,7 +19106,7 @@ async function run(options) {
           });
           try {
             if (litestreamProcess.pid !== void 0) {
-              writeFileSync7(options.litestreamPidFile, `${litestreamProcess.pid}
+              writeFileSync9(options.litestreamPidFile, `${litestreamProcess.pid}
 `, {
                 mode: 384
               });
@@ -17309,6 +19156,15 @@ async function run(options) {
       log2(state, `Started litestream replication with config ${options.litestreamConfig}`);
     }
     const tunnelSpinner = interactive && !state.json ? ora4("Connecting tunnel...").start() : null;
+    const recordBinding = state.sessionArchiveConfig.enabled ? (conversationId, sessionId) => appendSessionBinding(
+      sessionBindingLedgerPath(homedir8(), process.env),
+      {
+        conversation_id: conversationId,
+        opencode_session_id: sessionId,
+        observed_at: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      (message) => logActivity(state, { type: "info", level: "warn", message })
+    ) : void 0;
     const channelDriver = new ChannelDriver({
       agentId: state.agentId,
       port: state.port,
@@ -17318,9 +19174,11 @@ async function run(options) {
       conversationFilter: state.conversationFilter,
       stuckQueuedMs: CHANNEL_STUCK_QUEUED_MS,
       sessionStoreHealth: state.sessionStoreHealth,
-      // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
-      // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
+      recordBinding,
+      // #559: the file-sync allow-lists. Empty ⇒ pending files are REJECTED with
+      // `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
+      fileSyncExactFiles,
       homeDir: homedir8(),
       maxActiveSessions,
       log: (entry) => (
@@ -17496,6 +19354,7 @@ async function run(options) {
     }
     if (!state.running) return;
     scheduleSessionCleanup(state, channelDriver, options);
+    scheduleSessionArchive(state);
     state.claudeUsageRearm = scheduleClaudeUsageReporting(state, options);
     state.openaiUsageRearm = scheduleUsageReporting(state, {
       label: "OpenAI",
@@ -17591,8 +19450,8 @@ program.command("run").description("Connect to Evident and process messages").op
   "--opencode-start-timeout <seconds>",
   "Seconds to wait for OpenCode to become healthy when the runner starts it (default: 180). Env: EVIDENT_OPENCODE_START_TIMEOUT"
 ).option(
-  "--opencode-version <v1|v2>",
-  "Which OpenCode major version to launch: v1 or v2 (default: v1). Env: EVIDENT_OPENCODE_VERSION"
+  "--opencode-version <v1|v2|auto>",
+  "OpenCode major version: auto (default) detects the running server, then installed binary; v1 and v2 skip server-protocol detection. Env: EVIDENT_OPENCODE_VERSION"
 ).option("--json", "Output in JSON format").option(
   "--session-cleanup-max-age <duration>",
   "Delete OpenCode sessions idle longer than this (e.g. 7d, 24h). Enables cleanup. Env: EVIDENT_SESSION_CLEANUP_MAX_AGE"
@@ -17605,6 +19464,12 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--session-cleanup-interval <duration>",
   "How often the cleanup sweep runs (default: 1h). Env: EVIDENT_SESSION_CLEANUP_INTERVAL"
+).option(
+  "--session-archive",
+  "Upload full OpenCode transcripts to the runner archive (off by default). Env: EVIDENT_SESSION_ARCHIVE"
+).option(
+  "--session-archive-interval <duration>",
+  "How often session archives are uploaded (default: 1h). Env: EVIDENT_SESSION_ARCHIVE_INTERVAL"
 ).option(
   "--claude-usage-reporting <mode>",
   "Report Claude subscription usage to Evident: auto | on | off (default: auto). Env: EVIDENT_CLAUDE_USAGE_REPORTING"
@@ -17619,6 +19484,11 @@ program.command("run").description("Connect to Evident and process messages").op
   "Allow Evident to write files into this directory (repeatable). Omit to disable file sync entirely.",
   (value, previous) => previous.concat([value]),
   []
+).option(
+  "--enable-file-sync-to-exact-file <path>",
+  "Allow Evident to write files to exactly this path (repeatable).",
+  (value, previous) => previous.concat([value]),
+  []
 ).option(
   "--tunnel-ready-file <path>",
   "Path to write once the tunnel is connected (opt-in; unused unless an operator/image sets it)"
@@ -17671,6 +19541,8 @@ program.command("run").description("Connect to Evident and process messages").op
       sessionCleanupMaxCount: options.sessionCleanupMaxCount,
       maxActiveSessions: options.maxActiveSessions,
       sessionCleanupInterval: options.sessionCleanupInterval,
+      sessionArchive: options.sessionArchive,
+      sessionArchiveInterval: options.sessionArchiveInterval,
       // Raw string — the resolver in run.ts single-sources parsing
       // (resolveClaudeUsageReportingMode).
       claudeUsageReporting: options.claudeUsageReporting,
@@ -17681,6 +19553,9 @@ program.command("run").description("Connect to Evident and process messages").op
       // Raw values — expansion/validation is single-sourced in run.ts's
       // resolveFileSyncDirectories.
       enableFileSyncTo: options.enableFileSyncTo,
+      // Raw values — expansion/validation is single-sourced in run.ts's
+      // resolveFileSyncExactFiles.
+      enableFileSyncToExactFile: options.enableFileSyncToExactFile,
       tunnelReadyFile: options.tunnelReadyFile,
       litestreamConfig: options.litestreamConfig,
       opencodePidFile: options.opencodePidFile,