@evident-ai/cli 3.6.1-dev.69de1a0 → 3.6.1-dev.6dfa784

package/README.md

@@ -125,6 +125,10 @@ Options:
 - `--opencode-config-overlay <path>` — Apply a runner-provided OpenCode config
   before starting OpenCode. Relative paths are resolved from the working directory;
   an existing `opencode.jsonc` is replaced before `opencode.json`.
+- `--auto-configure-credentials-proxy` — Install Evident's generated `evident-*`
+  OpenCode provider entries for the runner's credential pool. This is off by default;
+  without it, the CLI only delivers `EVIDENT_PROXY_TOKEN` and leaves provider
+  configuration to you.
 - `--credential-sync-marker <path>` — Own the interval credential sync and write
   this marker once the shutdown flush has finished, so the runner image's lifecycle
   hooks can wait on it.

package/dist/index.js

@@ -1442,7 +1442,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.6.1-dev.69de1a0" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.6.1-dev.6dfa784" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -3209,6 +3209,52 @@ async function getModelAttachmentCapability(port, model, client) {
     return null;
   }
 }
+async function isPinnedProviderLoaded(port, model, client) {
+  if (client?.version === "v2") return null;
+  const { model: baseModel } = splitModelVariant(model);
+  if (!baseModel) return null;
+  const slash = baseModel.indexOf("/");
+  if (slash <= 0) return null;
+  const providerId = baseModel.slice(0, slash);
+  try {
+    const res = await requestWithClient(port, client, "/config/providers");
+    if (!res.ok) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers returned HTTP ${res.status} (port ${port})`
+      );
+      return null;
+    }
+    const body = await res.json();
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers body was not a plain object (port ${port})`
+      );
+      return null;
+    }
+    const providers = body.providers;
+    if (!Array.isArray(providers)) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers body had no providers array (port ${port})`
+      );
+      return null;
+    }
+    const providerIds = providers.filter(
+      (provider) => provider !== null && typeof provider === "object" && typeof provider.id === "string"
+    ).map((provider) => provider.id);
+    if (providerIds.length === 0) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers had no provider entries with string ids (port ${port})`
+      );
+      return null;
+    }
+    return providerIds.includes(providerId);
+  } catch (err) {
+    console.error(
+      `[isPinnedProviderLoaded] GET /config/providers failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+    );
+    return null;
+  }
+}
 async function buildFileParts(attachments, capable) {
   const outcomes = [];
   const parts = [];
@@ -7742,6 +7788,211 @@ function describe(err) {
   return err instanceof Error ? err.message : String(err);
 }
 
+// src/lib/vault-file-sync.ts
+import { createHash } from "node:crypto";
+async function syncVaultFiles(options) {
+  const files = await listVaultFiles(options);
+  if (files === null) return { applied: 0 };
+  const listedIds = new Set(files.map((file) => file.id));
+  for (const fileId of options.outcomes.keys()) {
+    if (!listedIds.has(fileId)) options.outcomes.delete(fileId);
+  }
+  let applied = 0;
+  for (const file of files) {
+    try {
+      if (await reconcileVaultFile(options, file)) applied += 1;
+    } catch (err) {
+      options.log({
+        level: "error",
+        message: `Vault file ${file.id} reconciliation failed unexpectedly (message processing is unaffected): ${describe2(err)}`
+      });
+    }
+  }
+  return { applied };
+}
+async function listVaultFiles(options) {
+  let response;
+  try {
+    response = await options.fetchImpl(`${options.apiUrl}/runners/${options.agentId}/vault-files`, {
+      headers: { Authorization: options.getAuthHeader() }
+    });
+  } catch (err) {
+    options.log({
+      level: "warn",
+      message: `Could not list vault files \u2014 retrying on the next drain: ${describe2(err)}`
+    });
+    return null;
+  }
+  if (!response.ok) {
+    options.log({
+      level: response.status === 404 ? "debug" : "warn",
+      message: `Listing vault files returned HTTP ${response.status} \u2014 retrying on the next drain`
+    });
+    return null;
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    options.log({
+      level: "warn",
+      message: `Vault file list was not readable JSON \u2014 retrying on the next drain: ${describe2(err)}`
+    });
+    return null;
+  }
+  if (body === null || typeof body !== "object" || !Array.isArray(body.files)) {
+    options.log({
+      level: "warn",
+      message: "Vault file list was not an object with a files array \u2014 ignoring it for this drain"
+    });
+    return null;
+  }
+  const files = [];
+  for (const entry of body.files) {
+    const file = asVaultFile(entry);
+    if (file === null) {
+      options.log({
+        level: "warn",
+        message: "Ignoring a malformed vault file entry"
+      });
+      continue;
+    }
+    files.push(file);
+  }
+  return files;
+}
+function asVaultFile(entry) {
+  if (entry === null || typeof entry !== "object") return null;
+  const value = entry;
+  if (typeof value.id !== "string" || value.id === "" || typeof value.destination_path !== "string" || value.destination_path === "" || typeof value.size_bytes !== "number" || !Number.isFinite(value.size_bytes) || value.size_bytes < 0 || typeof value.content_sha256 !== "string" || value.content_sha256 === "" || typeof value.created_at !== "string" || typeof value.updated_at !== "string") {
+    return null;
+  }
+  return {
+    id: value.id,
+    destination_path: value.destination_path,
+    size_bytes: value.size_bytes,
+    content_sha256: value.content_sha256,
+    created_at: value.created_at,
+    updated_at: value.updated_at
+  };
+}
+async function reconcileVaultFile(options, file) {
+  const existing = options.outcomes.get(file.id);
+  if (existing?.sha256 === file.content_sha256) {
+    if (existing.reported || existing.reportAttempts >= MAX_ACK_ATTEMPTS) return false;
+    await reportOutcome(options, file, existing);
+    return false;
+  }
+  const content = await downloadVaultFile(options, file);
+  if (content === null) return false;
+  const actualSha256 = createHash("sha256").update(content).digest("hex");
+  if (actualSha256 !== file.content_sha256) {
+    options.log({
+      level: "warn",
+      message: `Vault file ${file.id} content hash mismatch: expected ${file.content_sha256}, received ${actualSha256} \u2014 retrying on the next drain`
+    });
+    return false;
+  }
+  const outcome = await applyVaultFile(options, file, content);
+  const entry = {
+    sha256: file.content_sha256,
+    outcome: outcome.ok ? "applied" : "refused",
+    reason: outcome.ok ? null : outcome.code,
+    reported: false,
+    reportAttempts: 0
+  };
+  options.outcomes.set(file.id, entry);
+  await reportOutcome(options, file, entry);
+  return outcome.ok;
+}
+async function downloadVaultFile(options, file) {
+  try {
+    const response = await options.fetchImpl(
+      `${options.apiUrl}/runners/${options.agentId}/vault-files/${file.id}/content`,
+      { headers: { Authorization: options.getAuthHeader() } }
+    );
+    if (!response.ok) {
+      options.log({
+        level: "warn",
+        message: `Downloading vault file ${file.id} returned HTTP ${response.status} \u2014 retrying on the next drain`
+      });
+      return null;
+    }
+    return Buffer.from(await response.arrayBuffer());
+  } catch (err) {
+    options.log({
+      level: "warn",
+      message: `Downloading vault file ${file.id} failed \u2014 retrying on the next drain: ${describe2(err)}`
+    });
+    return null;
+  }
+}
+async function applyVaultFile(options, file, content) {
+  try {
+    const outcome = await writePushedFile({
+      requestedPath: file.destination_path,
+      content,
+      allowedDirectories: options.allowedDirectories,
+      homeDir: options.homeDir
+    });
+    if (!outcome.ok) {
+      options.log({
+        level: "warn",
+        message: `Vault file ${file.id} refused (${outcome.code}): ${outcome.message}`
+      });
+    } else {
+      options.log({
+        level: "info",
+        message: `Vault file ${file.id} applied (${content.byteLength} bytes)`
+      });
+    }
+    return outcome;
+  } catch (err) {
+    options.log({
+      level: "error",
+      message: `Vault file ${file.id} could not be written: ${describe2(err)}`
+    });
+    return { ok: false, code: "write_failed", message: "The runner could not write the file." };
+  }
+}
+async function reportOutcome(options, file, entry) {
+  const body = {
+    status: entry.outcome === "applied" ? "applied" : "rejected",
+    reported_sha256: entry.sha256
+  };
+  if (entry.outcome === "refused" && entry.reason !== null) body.reason = entry.reason;
+  try {
+    const response = await options.fetchImpl(
+      `${options.apiUrl}/runners/${options.agentId}/vault-files/${file.id}/status`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: options.getAuthHeader(),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      }
+    );
+    if (response.ok) {
+      entry.reported = true;
+      return;
+    }
+    recordReportFailure(options, file, entry, `HTTP ${response.status}`);
+  } catch (err) {
+    recordReportFailure(options, file, entry, describe2(err));
+  }
+}
+function recordReportFailure(options, file, entry, reason) {
+  entry.reportAttempts += 1;
+  options.log({
+    level: "error",
+    message: entry.reportAttempts >= MAX_ACK_ATTEMPTS ? `Reporting vault file ${file.id} as ${entry.outcome} failed (${reason}) \u2014 giving up after ${entry.reportAttempts} attempts` : `Reporting vault file ${file.id} as ${entry.outcome} failed (${reason}) \u2014 retrying on the next drain (attempt ${entry.reportAttempts} of ${MAX_ACK_ATTEMPTS})`
+  });
+}
+function describe2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
 // src/lib/channels/driver.ts
 function messageIdOf(m) {
   if (!m || typeof m !== "object") return void 0;
@@ -8150,6 +8401,7 @@ var ChannelDriver = class _ChannelDriver {
    * re-downloaded and re-written every ~2s until the server expires it.
    */
   fileAckFailures = /* @__PURE__ */ new Map();
+  vaultFileOutcomes = /* @__PURE__ */ new Map();
   /**
    * Monotonic count of files this runner has pulled and written (#559). Only
    * ever increases, so `run.ts` detects work by comparing it against the value
@@ -8307,10 +8559,21 @@ var ChannelDriver = class _ChannelDriver {
         ackFailures: this.fileAckFailures,
         log: this.log
       });
-      this.appliedFileCount += result.applied;
+      const vaultResult = await syncVaultFiles({
+        agentId: this.agentId,
+        apiUrl: this.apiUrl,
+        getAuthHeader: this.getAuthHeader,
+        fetchImpl: this.fetchImpl,
+        allowedDirectories: this.fileSyncDirectories,
+        homeDir: this.homeDir,
+        outcomes: this.vaultFileOutcomes,
+        log: this.log
+      });
+      const applied = result.applied + vaultResult.applied;
+      this.appliedFileCount += applied;
       if (result.claudeCredentialApplied) this.claudeCredentialApplyCount += 1;
       if (result.opencodeAuthApplied) this.opencodeAuthApplyCount += 1;
-      return result.applied;
+      return applied;
     } catch (err) {
       this.log({
         level: "error",
@@ -8722,6 +8985,47 @@ var ChannelDriver = class _ChannelDriver {
         agent: message.opencode_agent ?? void 0,
         model: message.opencode_model ?? void 0
       };
+      const pinnedProviderLoaded = await isPinnedProviderLoaded(
+        this.port,
+        options.model,
+        this.openCodeClient
+      );
+      if (pinnedProviderLoaded === false) {
+        const dispatchedModel = message.opencode_model;
+        const separator = dispatchedModel?.indexOf("/") ?? -1;
+        const hasProviderAndModel = dispatchedModel !== null && separator > 0 && separator < dispatchedModel.length - 1;
+        const providerId = hasProviderAndModel ? dispatchedModel.slice(0, separator) : null;
+        const modelId = hasProviderAndModel ? dispatchedModel.slice(separator + 1) : null;
+        const errorMessage3 = `Provider namespace not loaded on this runner: ${message.opencode_model}. Refused before dispatch; no turn was started.`;
+        this.log({
+          level: "error",
+          message: `Refusing message ${message.id.slice(0, 8)} in conversation ${conv.id.slice(0, 8)}: provider namespace ${providerId ?? "(unknown)"} is not loaded; no turn was started`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        try {
+          await this.markFailed(conv.id, message.id, sessionId, errorMessage3, void 0, {
+            classification: {
+              kind: "model_auth",
+              providerId,
+              modelId,
+              reason: "missing"
+            },
+            errorShape: { name: null, statusCode: null }
+          });
+          this.signalDispatchNotStarted(conv, message, "model_provider_absent");
+        } catch (markErr) {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for refused message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed: ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          this.signalDispatchNotStarted(conv, message, "failure_unreported");
+        }
+        await this.repairProviderRegistry(conv.id, message.id);
+        break;
+      }
       let opencodeMessageId;
       let preDispatchUserIds = null;
       try {
@@ -13920,22 +14224,6 @@ function mergeManagedOpenCodeConfigContent(content, managedProviders) {
   }
   return JSON.stringify({ ...config, provider: { ...provider, ...managedProviders } });
 }
-function removeManagedOpenCodeConfigContent(content) {
-  if (!content?.trim()) return content;
-  const config = parseConfigContent(content);
-  if (typeof config.provider !== "object" || config.provider === null || Array.isArray(config.provider)) {
-    return content;
-  }
-  const provider = { ...config.provider };
-  let changed = false;
-  for (const namespace of CREDENTIAL_PROXY_NATIVE_NAMESPACES) {
-    if (namespace in provider) {
-      delete provider[namespace];
-      changed = true;
-    }
-  }
-  return changed ? JSON.stringify({ ...config, provider }) : content;
-}
 function isFile(filePath) {
   return existsSync2(filePath) && statSync6(filePath).isFile();
 }
@@ -14397,23 +14685,23 @@ async function responseJson(response) {
 function readSetup(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
   const setup = value;
-  if (typeof setup.runner_id !== "string" || typeof setup.generation !== "string" || typeof setup.status !== "string" || setup.token_id !== null && typeof setup.token_id !== "string") {
+  if (typeof setup.runner_id !== "string" || typeof setup.generation !== "string" || typeof setup.status !== "string" || setup.token_id !== null && typeof setup.token_id !== "string" || typeof setup.acknowledged_at !== "string" && setup.acknowledged_at !== null) {
     return null;
   }
   return setup;
 }
 function clearLocalSetup(options) {
   const env = options.env ?? process.env;
-  (options.store ?? defaultStore).clear(options.agentId);
-  delete env.EVIDENT_PROXY_TOKEN;
-  try {
-    const content = removeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT);
-    if (content === void 0) delete env.OPENCODE_CONFIG_CONTENT;
-    else env.OPENCODE_CONFIG_CONTENT = content;
-  } catch (error2) {
+  const store = options.store ?? defaultStore;
+  const stored = store.get(options.agentId);
+  store.clear(options.agentId);
+  const token = env.EVIDENT_PROXY_TOKEN;
+  if (token !== void 0 && token === stored?.token) {
+    delete env.EVIDENT_PROXY_TOKEN;
+  } else if (token !== void 0) {
     options.log(
-      "MANAGED-INFERENCE-CLEANUP-PARTIAL: stored credentials were removed, but malformed OPENCODE_CONFIG_CONTENT could not be inspected",
-      "warn"
+      `MANAGED-INFERENCE-CLEANUP-PRESERVED-EXTERNAL-TOKEN: runner=${options.agentId}`,
+      "debug"
     );
   }
 }
@@ -14439,6 +14727,25 @@ async function discoverManagedInferenceSetup(options) {
   const setup = readSetup(body?.setup);
   return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed setup discovery returned an invalid response" };
 }
+async function enrollManagedInferenceSetup(options) {
+  const response = await post(options, "enroll", {});
+  if (!response) {
+    return { kind: "failed", reason: safeFailure("Managed credential enrollment") };
+  }
+  if (response.status === 404) {
+    return { kind: "none" };
+  }
+  const body = await responseJson(response);
+  if (!response.ok) {
+    const serverError = body?.error;
+    return {
+      kind: "failed",
+      reason: typeof serverError === "string" && serverError.trim() ? redactDiagnosticText(serverError).slice(0, 500) : safeFailure("Managed credential enrollment", response.status)
+    };
+  }
+  const setup = readSetup(body?.setup);
+  return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed credential enrollment returned an invalid response" };
+}
 async function post(options, operation, body) {
   const headers = requestHeaders(options);
   try {
@@ -14453,31 +14760,37 @@ async function post(options, operation, body) {
   }
 }
 function applyCredential(options, credential) {
-  const { config, unsupportedProviders } = buildCredentialProxyNativeConfig({
-    inferenceBaseUrl: credential.inferenceBaseUrl,
-    modelDescriptors: credential.modelDescriptors
-  });
-  if (unsupportedProviders.length > 0 || Object.keys(config.provider).length === 0) {
-    return "Managed setup contains unsupported provider descriptors";
-  }
   const env = options.env ?? process.env;
   let merged;
-  try {
-    merged = mergeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT, config.provider);
-  } catch (error2) {
-    return "OPENCODE_CONFIG_CONTENT is malformed; managed providers were not installed";
+  if (options.autoConfigureCredentialsProxy) {
+    const { config, unsupportedProviders } = buildCredentialProxyNativeConfig({
+      inferenceBaseUrl: credential.inferenceBaseUrl,
+      modelDescriptors: credential.modelDescriptors
+    });
+    if (unsupportedProviders.length > 0 || Object.keys(config.provider).length === 0) {
+      return "Managed setup contains unsupported provider descriptors";
+    }
+    try {
+      merged = mergeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT, config.provider);
+    } catch (error2) {
+      return "OPENCODE_CONFIG_CONTENT is malformed; managed providers were not installed";
+    }
   }
   try {
     (options.store ?? defaultStore).set(options.agentId, credential);
   } catch (error2) {
+    const detail = (error2 instanceof Error ? error2.message : String(error2)).replaceAll(
+      credential.token,
+      "[redacted]"
+    );
     options.log(
-      `MANAGED-INFERENCE-STORE-FAILED: runner=${options.agentId} generation=${credential.generation}`,
+      `MANAGED-INFERENCE-STORE-FAILED: runner=${options.agentId} generation=${credential.generation} detail=${redactDiagnosticText(detail)}`,
       "warn"
     );
     return "Managed credentials could not be written to the protected store";
   }
   env.EVIDENT_PROXY_TOKEN = credential.token;
-  env.OPENCODE_CONFIG_CONTENT = merged;
+  if (merged !== void 0) env.OPENCODE_CONFIG_CONTENT = merged;
   return null;
 }
 async function reportManagedInferenceApplyFailure(options, failure) {
@@ -14528,7 +14841,7 @@ async function prepareManagedInferenceSetup(options, discovery, health) {
     }
     return reaffirmStored(options, stored);
   }
-  if (discovery.setup.status === "acknowledged" && stored?.generation === discovery.setup.generation && stored.tokenId === discovery.setup.token_id) {
+  if (discovery.setup.acknowledged_at !== null && stored?.generation === discovery.setup.generation && stored.tokenId === discovery.setup.token_id) {
     return reaffirmStored(options, stored);
   }
   const response = await post(options, "bootstrap", { generation: discovery.setup.generation });
@@ -14566,7 +14879,7 @@ async function acknowledgeManagedInferenceSetup(options, preparation) {
   const response = await post(options, "acknowledge", {
     generation: preparation.generation,
     token_id: preparation.tokenId,
-    config_validated: true
+    config_validated: options.autoConfigureCredentialsProxy === true
   });
   if (!response?.ok) {
     throw new Error(
@@ -16369,13 +16682,17 @@ async function run(options) {
       agentId: state.agentId,
       apiUrl: getApiUrlConfig(),
       getAuthHeader: () => state.authHeader,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
       log: (message, level = "info") => logActivity(state, {
         type: level === "error" ? "error" : "info",
         level,
         ...level === "error" ? { error: message } : { message }
       })
     };
-    const managedDiscovery = await discoverManagedInferenceSetup(managedSetupOptions);
+    let managedDiscovery = await discoverManagedInferenceSetup(managedSetupOptions);
+    if (managedDiscovery.kind === "none") {
+      managedDiscovery = await enrollManagedInferenceSetup(managedSetupOptions);
+    }
     let managedPreparation = { kind: "none" };
     if (managedDiscovery.kind === "failed") {
       managedPreparation = managedDiscovery;
@@ -16996,6 +17313,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--opencode-config-overlay <path>",
   "Apply this runner-provided OpenCode config before starting OpenCode."
+).option(
+  "--auto-configure-credentials-proxy",
+  "Install Evident's generated OpenCode providers for the runner's credential pool (off by default)."
 ).option(
   "--credential-sync-marker <path>",
   "Own the interval credential sync and write this marker once the shutdown flush has finished, so the runner image's lifecycle hooks can wait on it."
@@ -17039,6 +17359,7 @@ program.command("run").description("Connect to Evident and process messages").op
       restoreSessionDb: options.restoreSessionDb,
       restoreRunnerCredentials: options.restoreRunnerCredentials,
       opencodeConfigOverlay: options.opencodeConfigOverlay,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
       credentialSyncMarker: options.credentialSyncMarker
     });
   }