@evident-ai/cli 3.6.1-dev.bbdfbd6 → 3.6.1-dev.c852a6f

package/dist/index.js

@@ -723,6 +723,9 @@ async function reportResourceUsage(agentId, authHeader, usage) {
     opencode_db_bytes: usage.opencodeDbBytes
   });
 }
+async function reportSessionDeletions(agentId, authHeader, deletions) {
+  return postBestEffort(`/runners/${agentId}/session-deletions`, authHeader, { deletions });
+}
 async function getRunnerCredentialVault(agentId, authHeader) {
   const empty = { prefix: null, vaultId: null, source: null };
   try {
@@ -1176,9 +1179,9 @@ async function claudeUsage() {
 }
 
 // src/commands/run.ts
-import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { isAbsolute as isAbsolute4, join as join13, parse, resolve as resolvePath2 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join14, parse, resolve as resolvePath2 } from "node:path";
 import chalk7 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
@@ -1442,7 +1445,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.6.1-dev.bbdfbd6" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.6.1-dev.c852a6f" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -2638,6 +2641,122 @@ function isSessionDbRecoveryRecord(value) {
   );
 }
 
+// src/lib/opencode/session-deletion-report.ts
+import { appendFileSync, mkdirSync, readFileSync as readFileSync3, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
+import { dirname as dirname4, join as join4 } from "node:path";
+var SESSION_DELETION_SPOOL_MAX_RECORDS = 1e3;
+var MAX_DIAGNOSTIC_LENGTH = 200;
+function sessionDeletionReportPath(homeDir, env) {
+  const override = env.EVIDENT_SESSION_DELETION_REPORT?.trim();
+  return override || join4(homeDir, ".local", "state", "evident", "session-deletions.jsonl");
+}
+function appendSessionDeletionRecords(path, records) {
+  if (records.length === 0) return 0;
+  mkdirSync(dirname4(path), { recursive: true });
+  const current = readSessionDeletionRecords(path);
+  if (current.readError !== null) {
+    throw new Error(`cannot enforce the spool limit after reading ${path}: ${current.readError}`);
+  }
+  const combined = [...current.records, ...records];
+  const kept = combined.slice(-SESSION_DELETION_SPOOL_MAX_RECORDS);
+  const dropped = combined.length - kept.length;
+  if (dropped > 0) {
+    writeFileSync(path, `${kept.map((record) => JSON.stringify(record)).join("\n")}
+`, "utf8");
+  } else {
+    appendFileSync(path, `${records.map((record) => JSON.stringify(record)).join("\n")}
+`, "utf8");
+  }
+  return dropped;
+}
+function readSessionDeletionRecords(path) {
+  let content;
+  try {
+    content = readFileSync3(path, "utf8");
+  } catch (error2) {
+    if (isMissingFile(error2)) return { records: [], skippedLines: 0, readError: null };
+    const readError = boundedError(error2);
+    console.error(`[session-deletion-report] could not read ${path}: ${readError}`);
+    return { records: [], skippedLines: 0, readError };
+  }
+  let skippedLines = 0;
+  const records = content.split("\n").flatMap((line) => {
+    if (!line.trim()) return [];
+    const record = parseRecord(line, path);
+    if (record) return [record];
+    skippedLines++;
+    return [];
+  });
+  return { records, skippedLines, readError: null };
+}
+function removeDeliveredSessionDeletionRecords(path, delivered) {
+  let content;
+  try {
+    content = readFileSync3(path, "utf8");
+  } catch (error2) {
+    if (isMissingFile(error2)) return;
+    console.error(
+      `[session-deletion-report] could not read ${path} before removing delivered records: ${boundedError(error2)}`
+    );
+    throw error2;
+  }
+  const toRemove = /* @__PURE__ */ new Map();
+  for (const record of delivered) {
+    toRemove.set(record.opencode_session_id, (toRemove.get(record.opencode_session_id) ?? 0) + 1);
+  }
+  const remaining = [];
+  for (const line of content.split("\n")) {
+    if (!line.trim()) continue;
+    const record = parseRecord(line, path);
+    const count = record ? toRemove.get(record.opencode_session_id) ?? 0 : 0;
+    if (record && count > 0) {
+      if (count === 1) toRemove.delete(record.opencode_session_id);
+      else toRemove.set(record.opencode_session_id, count - 1);
+    } else {
+      remaining.push(line);
+    }
+  }
+  try {
+    if (remaining.length === 0) unlinkSync2(path);
+    else writeFileSync(path, `${remaining.join("\n")}
+`, "utf8");
+  } catch (error2) {
+    if (isMissingFile(error2)) return;
+    console.error(
+      `[session-deletion-report] could not write ${path} after removing delivered records: ${boundedError(error2)}`
+    );
+    throw error2;
+  }
+}
+function parseRecord(line, path) {
+  try {
+    const value = JSON.parse(line);
+    if (isSessionDeletionRecord(value)) return value;
+    console.error(`[session-deletion-report] skipped malformed record in ${path}: invalid shape`);
+    return null;
+  } catch (error2) {
+    console.error(
+      `[session-deletion-report] skipped malformed record in ${path}: ${boundedError(error2)}`
+    );
+    return null;
+  }
+}
+function isSessionDeletionRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  const policy = record.policy;
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) return false;
+  const fields = policy;
+  return typeof record.opencode_session_id === "string" && record.opencode_session_id.length > 0 && typeof record.deleted_at === "string" && record.reason === "auto_cleanup" && (fields.max_age_ms === null || typeof fields.max_age_ms === "number") && (fields.max_count === null || typeof fields.max_count === "number") && (fields.last_activity_at === null || typeof fields.last_activity_at === "string");
+}
+function isMissingFile(error2) {
+  return error2 instanceof Error && "code" in error2 && error2.code === "ENOENT";
+}
+function boundedError(error2) {
+  const message = error2 instanceof Error ? error2.message : String(error2);
+  return message.slice(0, MAX_DIAGNOSTIC_LENGTH);
+}
+
 // src/lib/opencode/auth.ts
 function buildOpenCodeBasicAuthHeader(password) {
   return `Basic ${Buffer.from(["opencode", password].join(":")).toString("base64")}`;
@@ -2656,8 +2775,26 @@ async function checkOpenCodeHealth(port) {
     if (!response.ok) {
       return { healthy: false, error: `HTTP ${response.status}` };
     }
-    const data = await response.json().catch(() => ({}));
-    return { healthy: true, version: data.version };
+    const body = await response.text();
+    let data;
+    try {
+      data = JSON.parse(body);
+    } catch (error2) {
+      return {
+        healthy: false,
+        okWithNonJsonBody: true,
+        error: `HTTP ${response.status}: invalid JSON health response${bodyExcerpt(body)}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      };
+    }
+    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+      return {
+        healthy: false,
+        okWithNonJsonBody: true,
+        error: `HTTP ${response.status}: invalid health response${bodyExcerpt(body)}: expected JSON object`
+      };
+    }
+    const version2 = data.version;
+    return typeof version2 === "string" ? { healthy: true, version: version2 } : { healthy: true };
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : "Unknown error";
     return { healthy: false, error: message };
@@ -2673,10 +2810,17 @@ async function checkOpenCode2Health(port, password) {
     if (password !== void 0) {
       headers.Authorization = buildOpenCodeBasicAuthHeader(password);
     }
-    const response = await fetch(`http://127.0.0.1:${port}/api/health`, {
+    let response = await fetch(`http://127.0.0.1:${port}/api/info`, {
       headers,
       signal: AbortSignal.timeout(2e3)
     });
+    const usesHealthFallback = response.status === 404;
+    if (usesHealthFallback) {
+      response = await fetch(`http://127.0.0.1:${port}/api/health`, {
+        headers,
+        signal: AbortSignal.timeout(2e3)
+      });
+    }
     if (response.status === 401) {
       return { healthy: false, authFailed: true, error: "HTTP 401" };
     }
@@ -2691,23 +2835,29 @@ async function checkOpenCode2Health(port, password) {
     } catch (error2) {
       return {
         healthy: false,
-        error: `Invalid JSON health response${excerpt}: ${error2 instanceof Error ? error2.message : String(error2)}`
+        error: `HTTP ${response.status}: invalid JSON health response${excerpt}: ${error2 instanceof Error ? error2.message : String(error2)}`
       };
     }
     if (typeof data !== "object" || data === null || Array.isArray(data)) {
       return {
         healthy: false,
-        error: `Invalid health response${excerpt}: expected healthy=true`
+        error: `HTTP ${response.status}: invalid health response${excerpt}: expected healthy=true`
       };
     }
-    const health = data;
-    if (health.healthy !== true) {
+    const bodyObject = data;
+    if (usesHealthFallback && bodyObject.healthy !== true) {
       return {
         healthy: false,
         error: `Invalid health response${excerpt}: expected healthy=true`
       };
     }
-    return typeof health.version === "string" ? { healthy: true, version: health.version } : { healthy: true };
+    if (!usesHealthFallback) {
+      return typeof bodyObject.version === "string" && bodyObject.version.length > 0 ? { healthy: true, version: bodyObject.version } : {
+        healthy: false,
+        error: `HTTP ${response.status}: invalid info response${excerpt}: expected a non-empty version`
+      };
+    }
+    return typeof bodyObject.version === "string" ? { healthy: true, version: bodyObject.version } : { healthy: true };
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : "Unknown error";
     return { healthy: false, error: message };
@@ -3209,6 +3359,52 @@ async function getModelAttachmentCapability(port, model, client) {
     return null;
   }
 }
+async function isPinnedProviderLoaded(port, model, client) {
+  if (client?.version === "v2") return null;
+  const { model: baseModel } = splitModelVariant(model);
+  if (!baseModel) return null;
+  const slash = baseModel.indexOf("/");
+  if (slash <= 0) return null;
+  const providerId = baseModel.slice(0, slash);
+  try {
+    const res = await requestWithClient(port, client, "/config/providers");
+    if (!res.ok) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers returned HTTP ${res.status} (port ${port})`
+      );
+      return null;
+    }
+    const body = await res.json();
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers body was not a plain object (port ${port})`
+      );
+      return null;
+    }
+    const providers = body.providers;
+    if (!Array.isArray(providers)) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers body had no providers array (port ${port})`
+      );
+      return null;
+    }
+    const providerIds = providers.filter(
+      (provider) => provider !== null && typeof provider === "object" && typeof provider.id === "string"
+    ).map((provider) => provider.id);
+    if (providerIds.length === 0) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers had no provider entries with string ids (port ${port})`
+      );
+      return null;
+    }
+    return providerIds.includes(providerId);
+  } catch (err) {
+    console.error(
+      `[isPinnedProviderLoaded] GET /config/providers failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+    );
+    return null;
+  }
+}
 async function buildFileParts(attachments, capable) {
   const outcomes = [];
   const parts = [];
@@ -3623,9 +3819,17 @@ function isPreamblePinnedRunning(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   return completedOf(reply) != null && finishOf(reply) === "tool-calls";
 }
+function isMidFlightPinnedRunning(messages, userMessageId) {
+  if (messageRunState(messages, userMessageId) !== "running") return false;
+  const reply = findLastAssistantReplyFor(messages, userMessageId);
+  return reply !== null && isAssistantInFlight(reply) && completedOf(reply) == null;
+}
 function isB2AbandonmentConfirmed(params) {
   return params.pinnedForMs >= params.minPinnedMs && params.descendantOngoing === false && params.rootOngoing === false;
 }
+function isMidFlightOrphanConfirmed(params) {
+  return params.pinnedForMs >= params.minPinnedMs && params.notOngoingStreak >= params.minNotOngoingStreak;
+}
 function isAmbiguousTerminalFinish(m) {
   if (completedOf(m) == null) return false;
   if (errorOf(m) != null) return false;
@@ -4491,13 +4695,13 @@ async function readV2SessionErrorStream(client, options) {
 }
 
 // src/lib/opencode/credential-import-v2.ts
-import { readFileSync as readFileSync4 } from "node:fs";
-import { join as join5 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { join as join6 } from "node:path";
 
 // src/lib/openai-usage.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 var OPENCODE_AUTH_SEGMENTS = [".local", "share", "opencode", "auth.json"];
 var OpenAiUsageError = class extends Error {
@@ -4511,7 +4715,7 @@ function isLocalCredentialProblem2(err) {
 }
 function readOpenCodeChatGptCredentials() {
   try {
-    const raw = readFileSync3(join4(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
+    const raw = readFileSync4(join5(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -4743,7 +4947,7 @@ function emptyResult(unsupported = [], outcome = "completed") {
 }
 function readOpenCodeCredentials(homeDir, log3) {
   try {
-    const raw = readFileSync4(join5(homeDir, ...OPENCODE_AUTH_SEGMENTS), "utf8");
+    const raw = readFileSync5(join6(homeDir, ...OPENCODE_AUTH_SEGMENTS), "utf8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -4943,9 +5147,9 @@ async function importOpenCodeV2Credentials({
 
 // src/lib/opencode/session-db-boot.ts
 import { spawn as spawn2 } from "node:child_process";
-import { mkdirSync, statSync as statSync3, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
+import { mkdirSync as mkdirSync2, statSync as statSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname4, resolve as resolvePath } from "node:path";
+import { dirname as dirname5, resolve as resolvePath } from "node:path";
 
 // src/lib/runner-synchroniser.ts
 import { spawn } from "node:child_process";
@@ -5061,7 +5265,7 @@ function reportRecord(stage, outcome, reason, litestreamExitCode, options) {
 function clearMarker(options) {
   if (!options.noReplicateMarker) return;
   try {
-    unlinkSync2(options.noReplicateMarker);
+    unlinkSync3(options.noReplicateMarker);
   } catch (error2) {
     if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") return;
     options.log(
@@ -5073,8 +5277,8 @@ function clearMarker(options) {
 function markNoReplicate(options, message) {
   if (options.noReplicateMarker) {
     try {
-      mkdirSync(dirname4(options.noReplicateMarker), { recursive: true });
-      writeFileSync(options.noReplicateMarker, "");
+      mkdirSync2(dirname5(options.noReplicateMarker), { recursive: true });
+      writeFileSync2(options.noReplicateMarker, "");
     } catch (error2) {
       options.log(
         `Could not write session-DB no-replicate marker ${options.noReplicateMarker}: ${error2 instanceof Error ? error2.message : String(error2)}`,
@@ -5087,7 +5291,7 @@ function markNoReplicate(options, message) {
 function discardSessionDbDebris(options) {
   for (const path of [options.dbPath, `${options.dbPath}-wal`, `${options.dbPath}-shm`]) {
     try {
-      unlinkSync2(path);
+      unlinkSync3(path);
     } catch (error2) {
       if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") continue;
       options.log(
@@ -5228,8 +5432,8 @@ async function ensureLitestreamConfig(options, env) {
     return null;
   }
   try {
-    mkdirSync(dirname4(configPath), { recursive: true });
-    writeFileSync(configPath, rendered.stdout);
+    mkdirSync2(dirname5(configPath), { recursive: true });
+    writeFileSync2(configPath, rendered.stdout);
   } catch (error2) {
     options.log(
       `Could not write ${configPath}: ${error2 instanceof Error ? error2.message : String(error2)}`,
@@ -5494,8 +5698,8 @@ async function restoreAndVerifySessionDb(options) {
 
 // src/lib/opencode/session-db-provenance.ts
 import { createRequire } from "node:module";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname5, join as join6 } from "node:path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname6, join as join7 } from "node:path";
 var require2 = createRequire(import.meta.url);
 function readSessionDbMigrationIds(dbPath) {
   let db;
@@ -5532,12 +5736,12 @@ function readSessionDbMigrationIds(dbPath) {
 }
 function sessionDbProvenanceStatePath(homeDir, env) {
   const override = env.EVIDENT_SESSION_DB_PROVENANCE_STATE?.trim();
-  return override || join6(homeDir, ".local", "state", "evident", "session-db-provenance.json");
+  return override || join7(homeDir, ".local", "state", "evident", "session-db-provenance.json");
 }
 function loadSessionDbProvenanceState(path) {
   let value;
   try {
-    value = JSON.parse(readFileSync5(path, "utf8"));
+    value = JSON.parse(readFileSync6(path, "utf8"));
   } catch (error2) {
     if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") return {};
     console.error(
@@ -5561,8 +5765,8 @@ function loadSessionDbProvenanceState(path) {
 }
 function saveSessionDbProvenanceState(path, state) {
   try {
-    mkdirSync2(dirname5(path), { recursive: true });
-    writeFileSync2(path, `${JSON.stringify(state, null, 2)}
+    mkdirSync3(dirname6(path), { recursive: true });
+    writeFileSync3(path, `${JSON.stringify(state, null, 2)}
 `, "utf8");
   } catch (error2) {
     console.error(
@@ -5617,6 +5821,26 @@ function isSessionDbProvenanceRecord(value) {
   return typeof record.opencodeVersion === "string" && Array.isArray(record.migrationIds) && record.migrationIds.every((id) => typeof id === "string") && typeof record.updatedAt === "string";
 }
 
+// src/lib/opencode/detect.ts
+function describeProbe(route, result) {
+  if (result.error?.startsWith("HTTP ")) return `${route}: ${result.error}`;
+  if (result.error) return `${route}: no HTTP response (${result.error})`;
+  return `${route}: ${result.healthy ? "healthy" : "no response detail"}`;
+}
+async function classifyRunningOpenCode(port) {
+  const v1 = await checkOpenCodeHealth(port);
+  if (v1.healthy) return { kind: "v1", version: v1.version ?? null };
+  const v2 = await checkOpenCode2Health(port);
+  if (v2.healthy) return { kind: "v2", version: v2.version ?? null };
+  const detail = [
+    describeProbe("V1 /global/health", v1),
+    describeProbe("V2 /api/info (or /api/health fallback)", v2)
+  ].join("; ");
+  if (v1.okWithNonJsonBody && v2.authFailed) return { kind: "v2", version: null };
+  if (v1.authFailed && v2.authFailed) return { kind: "authenticated-unknown", detail };
+  return { kind: "no-server-identified", detail };
+}
+
 // src/lib/opencode/opencode2-package.ts
 var OPENCODE2_PACKAGE_SPEC = "@opencode-ai/cli@0.0.0-beta-17823";
 
@@ -5925,26 +6149,28 @@ async function startOpenCode(port, options = {}) {
 }
 async function startOpenCode2(port, options = {}) {
   const password = randomBytes(24).toString("hex");
-  let command = "opencode2";
+  let command = options.command ?? "opencode2";
   const logLevel = options.inheritStdio ? ["--log-level", resolveOpenCode2LogLevel(process.env)] : [];
   let args = ["serve", "--port", port.toString(), "--hostname", "127.0.0.1", ...logLevel];
-  try {
-    execSync("which opencode2", { stdio: "ignore" });
-  } catch {
-    command = "npx";
-    args = [
-      "-y",
-      "-p",
-      OPENCODE2_PACKAGE_SPEC,
-      "--",
-      "opencode2",
-      "serve",
-      "--port",
-      port.toString(),
-      "--hostname",
-      "127.0.0.1",
-      ...logLevel
-    ];
+  if (options.command === void 0) {
+    try {
+      execSync("which opencode2", { stdio: "ignore" });
+    } catch {
+      command = "npx";
+      args = [
+        "-y",
+        "-p",
+        OPENCODE2_PACKAGE_SPEC,
+        "--",
+        "opencode2",
+        "serve",
+        "--port",
+        port.toString(),
+        "--hostname",
+        "127.0.0.1",
+        ...logLevel
+      ];
+    }
   }
   const child = spawn3(command, args, {
     env: { ...process.env, OPENCODE_SERVER_PASSWORD: password },
@@ -6001,6 +6227,56 @@ function isOpenCode2Installed() {
     return false;
   }
 }
+function readVersionOutput(command) {
+  try {
+    return execSync2(`${command} --version`, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch (error2) {
+    const output = typeof error2 === "object" && error2 !== null ? [
+      "stdout" in error2 ? String(error2.stdout ?? "").trim() : "",
+      "stderr" in error2 ? String(error2.stderr ?? "").trim() : ""
+    ].filter(Boolean).join("\n") : "";
+    return output || (error2 instanceof Error ? error2.message : String(error2));
+  }
+}
+function parseOpenCodeVersion(rawVersion) {
+  const output = rawVersion.trim();
+  const prefix = output.match(/^(opencode2|opencode)\s+/i)?.[1]?.toLowerCase();
+  const version2 = (prefix ? output.slice(prefix.length).trim() : output).replace(/^v/i, "");
+  if (prefix === "opencode2") return { major: "v2", version: version2 };
+  const major = version2.match(/^(\d+)(?:\.\d+)*(?:[-+][0-9A-Za-z.-]+)?$/)?.[1];
+  if (!major) return null;
+  if (Number(major) === 1) return { major: "v1", version: version2 };
+  if (Number(major) >= 2) return { major: "v2", version: version2 };
+  return null;
+}
+function resolveInstalledOpenCode() {
+  let opencode2Available = false;
+  if (isOpenCodeInstalled()) {
+    const rawVersion = readVersionOutput("opencode");
+    const parsed = parseOpenCodeVersion(rawVersion);
+    if (parsed?.major === "v1") {
+      return { kind: "installed", major: "v1", command: "opencode", version: parsed.version };
+    }
+    if (parsed?.major === "v2") {
+      return { kind: "installed", major: "v2", command: "opencode", version: parsed.version };
+    }
+    opencode2Available = isOpenCode2Installed();
+    if (!opencode2Available) return { kind: "unknown", command: "opencode", rawVersion };
+  }
+  if (opencode2Available || isOpenCode2Installed()) {
+    const parsed = parseOpenCodeVersion(readVersionOutput("opencode2"));
+    return {
+      kind: "installed",
+      major: "v2",
+      command: "opencode2",
+      version: parsed?.version
+    };
+  }
+  return { kind: "none" };
+}
 async function promptOpenCodeInstall(interactive) {
   if (!interactive) {
     console.log(
@@ -6210,15 +6486,15 @@ function resolveSessionCleanupConfig(flags, env = process.env) {
 
 // src/lib/opencode/session-db-size.ts
 import { statSync as statSync4 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 var LARGE_DB_THRESHOLD_BYTES = 268435456;
 function statSessionDbBytes(homeDir) {
-  const dbPath = join7(homeDir, ".local", "share", "opencode", "opencode.db");
+  const dbPath = join8(homeDir, ".local", "share", "opencode", "opencode.db");
   try {
     return statSync4(dbPath).size;
   } catch (err) {
-    const isMissingFile = err instanceof Error && "code" in err && err.code === "ENOENT";
-    if (!isMissingFile) {
+    const isMissingFile2 = err instanceof Error && "code" in err && err.code === "ENOENT";
+    if (!isMissingFile2) {
       console.error(
         `[statSessionDbBytes] could not stat ${dbPath}: ${err instanceof Error ? err.message : String(err)}`
       );
@@ -6243,12 +6519,12 @@ function buildSessionStoreSizeWarning(input) {
 // src/lib/opencode/log-tail.ts
 import { statSync as statSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 import { open as open2, stat } from "node:fs/promises";
 var DEFAULT_POLL_INTERVAL_MS = 1e3;
 function resolveOpenCodeLogPath(homeDir = homedir5(), env = process.env) {
-  const dataDir = env.XDG_DATA_HOME || join8(homeDir, ".local", "share");
-  return join8(dataDir, "opencode", "log", "opencode.log");
+  const dataDir = env.XDG_DATA_HOME || join9(homeDir, ".local", "share");
+  return join9(dataDir, "opencode", "log", "opencode.log");
 }
 function isEnoent(error2) {
   return error2?.code === "ENOENT";
@@ -6915,10 +7191,10 @@ var RunnerConnection = class _RunnerConnection {
 };
 
 // src/lib/tunnel/ready-marker.ts
-import { writeFileSync as writeFileSync3 } from "node:fs";
+import { writeFileSync as writeFileSync4 } from "node:fs";
 function writeTunnelReadyMarker(path, agentId) {
   try {
-    writeFileSync3(path, `${agentId}
+    writeFileSync4(path, `${agentId}
 `);
     return { ok: true };
   } catch (error2) {
@@ -6943,7 +7219,7 @@ async function stopSessionDbReplication(child, timeoutMs) {
 }
 
 // src/lib/process-liveness.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -6958,7 +7234,7 @@ function isProcessAlive(pid) {
   }
   if (process.platform !== "linux") return true;
   try {
-    const status2 = readFileSync6(`/proc/${pid}/status`, "utf8");
+    const status2 = readFileSync7(`/proc/${pid}/status`, "utf8");
     return !/^State:\s+Z(?:\s|$)/m.test(status2);
   } catch (error2) {
     console.error(
@@ -7317,18 +7593,18 @@ function createSessionStoreHealth(options = {}) {
 import { homedir as homedir6 } from "node:os";
 
 // src/lib/runner-file-sync.ts
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 
 // src/lib/file-push.ts
 import { randomUUID } from "node:crypto";
 import { chmod, mkdir, open as open3, realpath, rename, unlink } from "node:fs/promises";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join9, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute2, join as join10, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
 async function writePushedFile(request3) {
-  const { requestedPath, content, allowedDirectories, homeDir } = request3;
+  const { requestedPath, content, allowedDirectories, allowedFiles, homeDir } = request3;
   const bytes = content.byteLength;
-  if (allowedDirectories.length === 0) {
+  if (allowedDirectories.length === 0 && allowedFiles.length === 0) {
     return refuse("file_sync_disabled", "File sync is not enabled on this runner.", {
       path: requestedPath,
       bytes
@@ -7353,10 +7629,10 @@ async function writePushedFile(request3) {
   }
   try {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
-      dirname6(candidate)
+      dirname7(candidate)
     );
-    const realTarget = join9(existingAncestor, ...missingSegments, basename2(candidate));
-    const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
+    const realTarget = join10(existingAncestor, ...missingSegments, basename2(candidate));
+    const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget) ?? await findMatchingAllowedFile(allowedFiles, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
         path: realTarget,
@@ -7365,8 +7641,8 @@ async function writePushedFile(request3) {
     }
     if (missingSegments.length > 0) {
       await createMissingDirectories(existingAncestor, missingSegments);
-      const realParent = await realpath(dirname6(realTarget));
-      if (realParent !== dirname6(realTarget) || !contains(allowedDirectory, realTarget)) {
+      const realParent = await realpath(dirname7(realTarget));
+      if (realParent !== dirname7(realTarget) || !contains(allowedDirectory, realTarget)) {
         return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
           path: realTarget,
           bytes,
@@ -7391,7 +7667,7 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join9(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join10(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
@@ -7409,7 +7685,7 @@ async function resolveNearestExistingAncestor(directory) {
     try {
       return { existingAncestor: await realpath(current), missingSegments };
     } catch (err) {
-      const parent = dirname6(current);
+      const parent = dirname7(current);
       if (err.code !== "ENOENT" || parent === current) {
         throw err;
       }
@@ -7431,6 +7707,22 @@ async function findContainingAllowedDirectory(allowedDirectories, realTarget) {
   }
   return null;
 }
+async function findMatchingAllowedFile(allowedFiles, realTarget) {
+  for (const entry of allowedFiles) {
+    if (!isAbsolute2(entry)) {
+      log("warn", "file_push_allowed_directory_skipped", {
+        directory: entry,
+        reason: "not_absolute_file"
+      });
+      continue;
+    }
+    const realParent = await realpathCreatingIfMissing(dirname7(entry));
+    if (realParent !== null && join10(realParent, basename2(entry)) === realTarget) {
+      return realParent;
+    }
+  }
+  return null;
+}
 async function realpathCreatingIfMissing(directory) {
   try {
     return await realpath(directory);
@@ -7464,13 +7756,13 @@ function contains(realDirectory, realTarget) {
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join9(current, segment);
+    current = join10(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join9(dirname6(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join10(dirname7(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
     handle = await open3(temporaryPath, "wx", FILE_MODE);
@@ -7600,16 +7892,16 @@ var NOT_APPLIED = {
   opencodeAuthApplied: false
 };
 function isClaudeCredentialPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join10(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join10(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join11(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join11(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
 }
 function isOpenCodeAuthPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join10(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join10(homeDir, ...OPENCODE_AUTH_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join11(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join11(homeDir, ...OPENCODE_AUTH_SEGMENTS);
 }
 async function applyOne(options, file) {
   const label = `${file.id.slice(0, 8)} (${file.path})`;
-  if (options.allowedDirectories.length === 0) {
+  if (options.allowedDirectories.length === 0 && options.allowedFiles.length === 0) {
     options.log({
       level: "warn",
       message: `Runner file ${label} rejected: file sync is not enabled on this runner (start it with --enable-file-sync-to)`
@@ -7636,6 +7928,7 @@ async function applyOne(options, file) {
       requestedPath: file.path,
       content: download.content,
       allowedDirectories: options.allowedDirectories,
+      allowedFiles: options.allowedFiles,
       homeDir: options.homeDir
     });
   } catch (err) {
@@ -7742,6 +8035,212 @@ function describe(err) {
   return err instanceof Error ? err.message : String(err);
 }
 
+// src/lib/vault-file-sync.ts
+import { createHash } from "node:crypto";
+async function syncVaultFiles(options) {
+  const files = await listVaultFiles(options);
+  if (files === null) return { applied: 0 };
+  const listedIds = new Set(files.map((file) => file.id));
+  for (const fileId of options.outcomes.keys()) {
+    if (!listedIds.has(fileId)) options.outcomes.delete(fileId);
+  }
+  let applied = 0;
+  for (const file of files) {
+    try {
+      if (await reconcileVaultFile(options, file)) applied += 1;
+    } catch (err) {
+      options.log({
+        level: "error",
+        message: `Vault file ${file.id} reconciliation failed unexpectedly (message processing is unaffected): ${describe2(err)}`
+      });
+    }
+  }
+  return { applied };
+}
+async function listVaultFiles(options) {
+  let response;
+  try {
+    response = await options.fetchImpl(`${options.apiUrl}/runners/${options.agentId}/vault-files`, {
+      headers: { Authorization: options.getAuthHeader() }
+    });
+  } catch (err) {
+    options.log({
+      level: "warn",
+      message: `Could not list vault files \u2014 retrying on the next drain: ${describe2(err)}`
+    });
+    return null;
+  }
+  if (!response.ok) {
+    options.log({
+      level: response.status === 404 ? "debug" : "warn",
+      message: `Listing vault files returned HTTP ${response.status} \u2014 retrying on the next drain`
+    });
+    return null;
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    options.log({
+      level: "warn",
+      message: `Vault file list was not readable JSON \u2014 retrying on the next drain: ${describe2(err)}`
+    });
+    return null;
+  }
+  if (body === null || typeof body !== "object" || !Array.isArray(body.files)) {
+    options.log({
+      level: "warn",
+      message: "Vault file list was not an object with a files array \u2014 ignoring it for this drain"
+    });
+    return null;
+  }
+  const files = [];
+  for (const entry of body.files) {
+    const file = asVaultFile(entry);
+    if (file === null) {
+      options.log({
+        level: "warn",
+        message: "Ignoring a malformed vault file entry"
+      });
+      continue;
+    }
+    files.push(file);
+  }
+  return files;
+}
+function asVaultFile(entry) {
+  if (entry === null || typeof entry !== "object") return null;
+  const value = entry;
+  if (typeof value.id !== "string" || value.id === "" || typeof value.destination_path !== "string" || value.destination_path === "" || typeof value.size_bytes !== "number" || !Number.isFinite(value.size_bytes) || value.size_bytes < 0 || typeof value.content_sha256 !== "string" || value.content_sha256 === "" || typeof value.created_at !== "string" || typeof value.updated_at !== "string") {
+    return null;
+  }
+  return {
+    id: value.id,
+    destination_path: value.destination_path,
+    size_bytes: value.size_bytes,
+    content_sha256: value.content_sha256,
+    created_at: value.created_at,
+    updated_at: value.updated_at
+  };
+}
+async function reconcileVaultFile(options, file) {
+  const existing = options.outcomes.get(file.id);
+  if (existing?.sha256 === file.content_sha256) {
+    if (existing.reported || existing.reportAttempts >= MAX_ACK_ATTEMPTS) return false;
+    await reportOutcome(options, file, existing);
+    return false;
+  }
+  const content = await downloadVaultFile(options, file);
+  if (content === null) return false;
+  const actualSha256 = createHash("sha256").update(content).digest("hex");
+  if (actualSha256 !== file.content_sha256) {
+    options.log({
+      level: "warn",
+      message: `Vault file ${file.id} content hash mismatch: expected ${file.content_sha256}, received ${actualSha256} \u2014 retrying on the next drain`
+    });
+    return false;
+  }
+  const outcome = await applyVaultFile(options, file, content);
+  const entry = {
+    sha256: file.content_sha256,
+    outcome: outcome.ok ? "applied" : "refused",
+    reason: outcome.ok ? null : outcome.code,
+    reported: false,
+    reportAttempts: 0
+  };
+  options.outcomes.set(file.id, entry);
+  await reportOutcome(options, file, entry);
+  return outcome.ok;
+}
+async function downloadVaultFile(options, file) {
+  try {
+    const response = await options.fetchImpl(
+      `${options.apiUrl}/runners/${options.agentId}/vault-files/${file.id}/content`,
+      { headers: { Authorization: options.getAuthHeader() } }
+    );
+    if (!response.ok) {
+      options.log({
+        level: "warn",
+        message: `Downloading vault file ${file.id} returned HTTP ${response.status} \u2014 retrying on the next drain`
+      });
+      return null;
+    }
+    return Buffer.from(await response.arrayBuffer());
+  } catch (err) {
+    options.log({
+      level: "warn",
+      message: `Downloading vault file ${file.id} failed \u2014 retrying on the next drain: ${describe2(err)}`
+    });
+    return null;
+  }
+}
+async function applyVaultFile(options, file, content) {
+  try {
+    const outcome = await writePushedFile({
+      requestedPath: file.destination_path,
+      content,
+      allowedDirectories: options.allowedDirectories,
+      allowedFiles: options.allowedFiles,
+      homeDir: options.homeDir
+    });
+    if (!outcome.ok) {
+      options.log({
+        level: "warn",
+        message: `Vault file ${file.id} refused (${outcome.code}): ${outcome.message}`
+      });
+    } else {
+      options.log({
+        level: "info",
+        message: `Vault file ${file.id} applied (${content.byteLength} bytes)`
+      });
+    }
+    return outcome;
+  } catch (err) {
+    options.log({
+      level: "error",
+      message: `Vault file ${file.id} could not be written: ${describe2(err)}`
+    });
+    return { ok: false, code: "write_failed", message: "The runner could not write the file." };
+  }
+}
+async function reportOutcome(options, file, entry) {
+  const body = {
+    status: entry.outcome === "applied" ? "applied" : "rejected",
+    reported_sha256: entry.sha256
+  };
+  if (entry.outcome === "refused" && entry.reason !== null) body.reason = entry.reason;
+  try {
+    const response = await options.fetchImpl(
+      `${options.apiUrl}/runners/${options.agentId}/vault-files/${file.id}/status`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: options.getAuthHeader(),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      }
+    );
+    if (response.ok) {
+      entry.reported = true;
+      return;
+    }
+    recordReportFailure(options, file, entry, `HTTP ${response.status}`);
+  } catch (err) {
+    recordReportFailure(options, file, entry, describe2(err));
+  }
+}
+function recordReportFailure(options, file, entry, reason) {
+  entry.reportAttempts += 1;
+  options.log({
+    level: "error",
+    message: entry.reportAttempts >= MAX_ACK_ATTEMPTS ? `Reporting vault file ${file.id} as ${entry.outcome} failed (${reason}) \u2014 giving up after ${entry.reportAttempts} attempts` : `Reporting vault file ${file.id} as ${entry.outcome} failed (${reason}) \u2014 retrying on the next drain (attempt ${entry.reportAttempts} of ${MAX_ACK_ATTEMPTS})`
+  });
+}
+function describe2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
 // src/lib/channels/driver.ts
 function messageIdOf(m) {
   if (!m || typeof m !== "object") return void 0;
@@ -7750,7 +8249,7 @@ function messageIdOf(m) {
   return typeof infoId === "string" ? infoId : void 0;
 }
 function composeAbandonmentNote(finish, replyShape, outcome) {
-  const base = `OpenCode ended this turn after a tool call (finish="${finish ?? "(unknown)"}") ` + (outcome === "without-answer" ? "without writing an answer, and confirmed it is no longer working on this conversation. Evident is reporting the run as failed so the failure and its reason are visible in failed runs." : "after writing only part of an answer, and confirmed it is no longer working on this conversation. Evident delivered what was written and is reporting the run as finished.");
+  const base = outcome === "midflight-without-answer" || outcome === "midflight-with-answer" ? "OpenCode stopped this turn without ever finishing, and confirmed the session is no longer running. " + (outcome === "midflight-without-answer" ? "Evident is reporting the run as failed so the failure and its reason are visible in failed runs." : "Evident delivered what was written and is reporting the run as finished.") : `OpenCode ended this turn after a tool call (finish="${finish ?? "(unknown)"}") ` + (outcome === "without-answer" ? "without writing an answer, and confirmed it is no longer working on this conversation. Evident is reporting the run as failed so the failure and its reason are visible in failed runs." : "after writing only part of an answer, and confirmed it is no longer working on this conversation. Evident delivered what was written and is reporting the run as finished.");
   if (replyShape === null) return base;
   return `${base} ${replyShape.lastToolName === null ? "No tool call was recorded" : `The last tool call was "${replyShape.lastToolName}" with status "${replyShape.lastToolStatus ?? "(unknown)"}"`}; the reply's final part types were [${replyShape.partTypes.join(", ")}]${replyShape.droppedPartCount > 0 ? ` (${replyShape.droppedPartCount} earlier part types omitted)` : ""}.`;
 }
@@ -7787,6 +8286,9 @@ var ALIVE_WITHHELD_THRESHOLD_MS = 3 * HEARTBEAT_MS;
 var ABSOLUTE_MAX_PROCESSING_MS = 6 * 60 * 60 * 1e3;
 var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
 var AMBIGUOUS_FINISH_MAX_PINNED_MS = 3 * 6e4;
+var MIDFLIGHT_ORPHAN_MIN_PINNED_MS = 3 * 6e4;
+var MIDFLIGHT_ORPHAN_RECHECK_MS = 6e4;
+var MIDFLIGHT_ORPHAN_MIN_NOT_ONGOING_STREAK = 2;
 var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
 var WATCHER_STALL_MS = 3 * POLL_MISS_GRACE_MS;
@@ -7838,6 +8340,7 @@ var ChannelDriver = class _ChannelDriver {
   stuckQueuedMs;
   now;
   fileSyncDirectories;
+  fileSyncExactFiles;
   homeDir;
   maxActiveSessions;
   watcherStallMs;
@@ -8150,6 +8653,7 @@ var ChannelDriver = class _ChannelDriver {
    * re-downloaded and re-written every ~2s until the server expires it.
    */
   fileAckFailures = /* @__PURE__ */ new Map();
+  vaultFileOutcomes = /* @__PURE__ */ new Map();
   /**
    * Monotonic count of files this runner has pulled and written (#559). Only
    * ever increases, so `run.ts` detects work by comparing it against the value
@@ -8206,6 +8710,7 @@ var ChannelDriver = class _ChannelDriver {
     this.stuckQueuedMs = config.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
     this.now = config.now ?? (() => Date.now());
     this.fileSyncDirectories = config.fileSyncDirectories ?? [];
+    this.fileSyncExactFiles = config.fileSyncExactFiles ?? [];
     this.homeDir = config.homeDir ?? homedir6();
     this.maxActiveSessions = config.maxActiveSessions;
     this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
@@ -8303,14 +8808,27 @@ var ChannelDriver = class _ChannelDriver {
         getAuthHeader: this.getAuthHeader,
         fetchImpl: this.fetchImpl,
         allowedDirectories: this.fileSyncDirectories,
+        allowedFiles: this.fileSyncExactFiles,
         homeDir: this.homeDir,
         ackFailures: this.fileAckFailures,
         log: this.log
       });
-      this.appliedFileCount += result.applied;
+      const vaultResult = await syncVaultFiles({
+        agentId: this.agentId,
+        apiUrl: this.apiUrl,
+        getAuthHeader: this.getAuthHeader,
+        fetchImpl: this.fetchImpl,
+        allowedDirectories: this.fileSyncDirectories,
+        allowedFiles: this.fileSyncExactFiles,
+        homeDir: this.homeDir,
+        outcomes: this.vaultFileOutcomes,
+        log: this.log
+      });
+      const applied = result.applied + vaultResult.applied;
+      this.appliedFileCount += applied;
       if (result.claudeCredentialApplied) this.claudeCredentialApplyCount += 1;
       if (result.opencodeAuthApplied) this.opencodeAuthApplyCount += 1;
-      return result.applied;
+      return applied;
     } catch (err) {
       this.log({
         level: "error",
@@ -8722,6 +9240,47 @@ var ChannelDriver = class _ChannelDriver {
         agent: message.opencode_agent ?? void 0,
         model: message.opencode_model ?? void 0
       };
+      const pinnedProviderLoaded = await isPinnedProviderLoaded(
+        this.port,
+        options.model,
+        this.openCodeClient
+      );
+      if (pinnedProviderLoaded === false) {
+        const dispatchedModel = message.opencode_model;
+        const separator = dispatchedModel?.indexOf("/") ?? -1;
+        const hasProviderAndModel = dispatchedModel !== null && separator > 0 && separator < dispatchedModel.length - 1;
+        const providerId = hasProviderAndModel ? dispatchedModel.slice(0, separator) : null;
+        const modelId = hasProviderAndModel ? dispatchedModel.slice(separator + 1) : null;
+        const errorMessage3 = `Provider namespace not loaded on this runner: ${message.opencode_model}. Refused before dispatch; no turn was started.`;
+        this.log({
+          level: "error",
+          message: `Refusing message ${message.id.slice(0, 8)} in conversation ${conv.id.slice(0, 8)}: provider namespace ${providerId ?? "(unknown)"} is not loaded; no turn was started`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        try {
+          await this.markFailed(conv.id, message.id, sessionId, errorMessage3, void 0, {
+            classification: {
+              kind: "model_auth",
+              providerId,
+              modelId,
+              reason: "missing"
+            },
+            errorShape: { name: null, statusCode: null }
+          });
+          this.signalDispatchNotStarted(conv, message, "model_provider_absent");
+        } catch (markErr) {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for refused message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed: ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          this.signalDispatchNotStarted(conv, message, "failure_unreported");
+        }
+        await this.repairProviderRegistry(conv.id, message.id);
+        break;
+      }
       let opencodeMessageId;
       let preDispatchUserIds = null;
       try {
@@ -9846,6 +10405,12 @@ var ChannelDriver = class _ChannelDriver {
       b2AbandonedWithoutAnswer: false,
       ambiguousPinnedSinceMs: 0,
       ambiguousResolved: false,
+      midFlightPinnedSinceMs: 0,
+      midFlightNotOngoingStreak: 0,
+      midFlightLastStatusCheckMs: 0,
+      midFlightOrphanSignalled: false,
+      midFlightOrphanWithoutAnswer: false,
+      midFlightHeldLogged: false,
       sessionStoreFailurePending: false,
       neverStartedResolved: false
     });
@@ -9985,6 +10550,12 @@ var ChannelDriver = class _ChannelDriver {
       b2AbandonedWithoutAnswer: false,
       ambiguousPinnedSinceMs: 0,
       ambiguousResolved: false,
+      midFlightPinnedSinceMs: 0,
+      midFlightNotOngoingStreak: 0,
+      midFlightLastStatusCheckMs: 0,
+      midFlightOrphanSignalled: false,
+      midFlightOrphanWithoutAnswer: false,
+      midFlightHeldLogged: false,
       sessionStoreFailurePending: false,
       neverStartedResolved: false
     });
@@ -10756,7 +11327,11 @@ var ChannelDriver = class _ChannelDriver {
             watcher,
             inFlight,
             messages,
-            finish
+            composeAbandonmentNote(
+              finish,
+              describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+              "without-answer"
+            )
           );
         } else {
           await this.settleMessageDone(
@@ -10815,7 +11390,11 @@ var ChannelDriver = class _ChannelDriver {
               watcher,
               inFlight,
               messages,
-              finish
+              composeAbandonmentNote(
+                finish,
+                describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+                "without-answer"
+              )
             );
             return;
           }
@@ -10909,6 +11488,106 @@ var ChannelDriver = class _ChannelDriver {
         return;
       }
     }
+    const midFlightPinnedNow = activelyRunning && isMidFlightPinnedRunning(messages, inFlight.opencodeMessageId);
+    if (!midFlightPinnedNow) {
+      if (snapshotReadable) {
+        inFlight.midFlightPinnedSinceMs = 0;
+        inFlight.midFlightNotOngoingStreak = 0;
+        inFlight.midFlightLastStatusCheckMs = 0;
+        inFlight.midFlightOrphanSignalled = false;
+        inFlight.midFlightOrphanWithoutAnswer = false;
+        inFlight.midFlightHeldLogged = false;
+      }
+    } else {
+      if (inFlight.midFlightOrphanSignalled) {
+        const note = composeAbandonmentNote(
+          void 0,
+          describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+          inFlight.midFlightOrphanWithoutAnswer ? "midflight-without-answer" : "midflight-with-answer"
+        );
+        if (inFlight.midFlightOrphanWithoutAnswer) {
+          await this.settleMessageAbandonedWithoutAnswer(
+            sessionId,
+            watcher,
+            inFlight,
+            messages,
+            note
+          );
+        } else {
+          await this.settleMessageDone(sessionId, watcher, inFlight, messages, note);
+        }
+        return;
+      }
+      if (inFlight.midFlightPinnedSinceMs === 0) {
+        inFlight.midFlightPinnedSinceMs = this.now();
+      }
+      const pinnedForMs = this.now() - inFlight.midFlightPinnedSinceMs;
+      if (pinnedForMs >= MIDFLIGHT_ORPHAN_MIN_PINNED_MS && this.now() - inFlight.midFlightLastStatusCheckMs >= MIDFLIGHT_ORPHAN_RECHECK_MS) {
+        inFlight.midFlightLastStatusCheckMs = this.now();
+        const rootOngoing = await this.isSessionOngoing(sessionId);
+        inFlight.midFlightNotOngoingStreak = rootOngoing === false ? inFlight.midFlightNotOngoingStreak + 1 : 0;
+        if (isMidFlightOrphanConfirmed({
+          pinnedForMs,
+          minPinnedMs: MIDFLIGHT_ORPHAN_MIN_PINNED_MS,
+          notOngoingStreak: inFlight.midFlightNotOngoingStreak,
+          minNotOngoingStreak: MIDFLIGHT_ORPHAN_MIN_NOT_ONGOING_STREAK
+        })) {
+          if (this.sessionStoreHealth?.isUnwritable()) {
+            inFlight.sessionStoreFailurePending = true;
+            void this.postSignal(conv.id, id, "midflight_orphan_resolved", {
+              watched_for_ms: pinnedForMs,
+              ...rootOngoing != null ? { root_ongoing: rootOngoing } : {},
+              opencode_message_id: inFlight.opencodeMessageId,
+              run_state: "failed"
+            });
+            await this.settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight);
+            return;
+          }
+          inFlight.midFlightOrphanSignalled = true;
+          const noteOutcome = extractReplyTextForMessage(messages, inFlight.opencodeMessageId) === null ? "midflight-without-answer" : "midflight-with-answer";
+          inFlight.midFlightOrphanWithoutAnswer = noteOutcome === "midflight-without-answer";
+          void this.postSignal(conv.id, id, "midflight_orphan_resolved", {
+            watched_for_ms: pinnedForMs,
+            ...rootOngoing != null ? { root_ongoing: rootOngoing } : {},
+            opencode_message_id: inFlight.opencodeMessageId,
+            ...inFlight.midFlightOrphanWithoutAnswer ? { run_state: "failed" } : {}
+          });
+          const note = composeAbandonmentNote(
+            void 0,
+            describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+            noteOutcome
+          );
+          this.log({
+            level: "warn",
+            message: `Message ${id.slice(0, 8)} was pinned mid-flight for ${Math.round(pinnedForMs / 1e3)}s with root_ongoing=${rootOngoing} \u2014 resolving the orphaned turn`,
+            conversation_id: conv.id,
+            message_id: id
+          });
+          if (inFlight.midFlightOrphanWithoutAnswer) {
+            await this.settleMessageAbandonedWithoutAnswer(
+              sessionId,
+              watcher,
+              inFlight,
+              messages,
+              note
+            );
+          } else {
+            await this.settleMessageDone(sessionId, watcher, inFlight, messages, note);
+          }
+          return;
+        }
+        if (rootOngoing === true && !inFlight.midFlightHeldLogged) {
+          inFlight.midFlightHeldLogged = true;
+          const replyShape = describeAbandonedReplyShape(messages, inFlight.opencodeMessageId);
+          this.log({
+            level: "warn",
+            message: `Message ${id.slice(0, 8)} was pinned mid-flight for ${Math.round(pinnedForMs / 1e3)}s with root_ongoing=true \u2014 holding; last tool ${replyShape?.lastToolName ?? "(unknown)"} status ${replyShape?.lastToolStatus ?? "(unknown)"}`,
+            conversation_id: conv.id,
+            message_id: id
+          });
+        }
+      }
+    }
     if (watcher.inFlight.has(inFlight.evidentMessageId) && activelyRunning && this.now() - inFlight.processingAnchorMs >= ABSOLUTE_MAX_PROCESSING_MS) {
       await this.settleAbsoluteCeiling(sessionId, watcher, messages, ceilingAttemptsThisTick);
       return;
@@ -11108,13 +11787,8 @@ var ChannelDriver = class _ChannelDriver {
     this.removeInFlight(watcher, inFlight.evidentMessageId);
   }
   /** Report a confirmed b2 abandonment that produced no answer text. */
-  async settleMessageAbandonedWithoutAnswer(sessionId, watcher, inFlight, messages, finish) {
+  async settleMessageAbandonedWithoutAnswer(sessionId, watcher, inFlight, messages, error2) {
     const conv = watcher.conv;
-    const error2 = composeAbandonmentNote(
-      finish,
-      describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
-      "without-answer"
-    );
     this.anchorDeliveryDeadline(inFlight);
     this.log({
       level: "warn",
@@ -13500,7 +14174,7 @@ import ora3 from "ora";
 import { select as select3 } from "@inquirer/prompts";
 function unknownPasswordError2(port) {
   return new Error(
-    `OpenCode V2 (opencode2) is already running on port ${port} with a password this runner doesn't know. Free the port or pass --port.`
+    `An assistant on port ${port} requires credentials this runner does not have. Released OpenCode V2 generates a server password even when none is configured. This CLI has no option to supply the password for an already-running server, so it will not join one you started. Free port ${port} so Evident can start its own, or pass --port to choose another.`
   );
 }
 var INTERACTIVE_START_TIMEOUT_MS2 = 3e4;
@@ -13518,9 +14192,9 @@ async function ensureOpenCode2Running(ctx) {
       password: null
     };
   }
-  if (!isOpenCode2Installed()) {
+  if (!ctx.command && !isOpenCode2Installed()) {
     throw new Error(
-      `OpenCode V2 (opencode2) is not installed. Install it with: npm install -g ${OPENCODE2_PACKAGE_SPEC}`
+      "OpenCode V2 is not installed. Install it with `npm install -g @opencode/cli` or `curl -fsSL https://opencode.ai/v2/install | bash`."
     );
   }
   let port = ctx.port;
@@ -13548,7 +14222,8 @@ Port ${port} is already in use.`));
   if (!ctx.interactive) {
     ctx.log(`OpenCode V2 is not running on port ${port}. Starting it automatically...`);
     const { child: proc, password } = await startOpenCode2(port, {
-      inheritStdio: ctx.inheritStdio
+      inheritStdio: ctx.inheritStdio,
+      command: ctx.command
     });
     const health = await waitForOpenCode2Health(port, password, ctx.startTimeoutMs);
     if (!health.healthy) {
@@ -13569,13 +14244,14 @@ Port ${port} is already in use.`));
       password
     };
   }
+  const command = ctx.command ?? "opencode2";
   const action = await select3({
     message: "OpenCode V2 is not running. What would you like to do?",
     choices: [
       {
         name: "Start OpenCode V2 for me",
         value: "start",
-        description: `Run 'opencode2 serve --port ${port}'`
+        description: `Run '${command} serve --port ${port}'`
       },
       {
         name: "Show me the command",
@@ -13593,14 +14269,15 @@ Port ${port} is already in use.`));
     blank();
     console.log(chalk6.bold("Run this command in another terminal:"));
     blank();
-    console.log(`  ${chalk6.cyan(`opencode2 serve --port ${port}`)}`);
+    console.log(`  ${chalk6.cyan(`${command} serve --port ${port}`)}`);
     blank();
     throw new Error("Please start OpenCode V2 manually");
   }
   if (action === "start") {
     const spinner = ora3("Starting OpenCode V2...").start();
     const { child: proc, password } = await startOpenCode2(port, {
-      inheritStdio: ctx.inheritStdio
+      inheritStdio: ctx.inheritStdio,
+      command: ctx.command
     });
     const health = await waitForOpenCode2Health(port, password, INTERACTIVE_START_TIMEOUT_MS2);
     if (!health.healthy) {
@@ -13626,7 +14303,7 @@ Port ${port} is already in use.`));
 }
 
 // src/lib/runner-credentials.ts
-import { chmodSync as chmodSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmodSync as chmodSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { spawn as spawn5 } from "node:child_process";
 var RUNNER_SECRET_FETCH_TIMEOUT_MS = 6e4;
 var CREDENTIAL_RESTORE_TIMEOUT_MS = 6e4;
@@ -13869,8 +14546,8 @@ async function configureGitHubAccess({ env, log: log3 }) {
   }
   try {
     env.GIT_CONFIG_GLOBAL = GIT_CONFIG_GLOBAL;
-    writeFileSync4(GIT_CONFIG_GLOBAL, "");
-    writeFileSync4(GIT_CREDENTIAL_HELPER, GIT_CREDENTIAL_HELPER_CONTENT, { mode: 448 });
+    writeFileSync5(GIT_CONFIG_GLOBAL, "");
+    writeFileSync5(GIT_CREDENTIAL_HELPER, GIT_CREDENTIAL_HELPER_CONTENT, { mode: 448 });
     chmodSync2(GIT_CREDENTIAL_HELPER, 448);
     const config = [
       ["user.name", env.GIT_USER_NAME ?? "evident-bot"],
@@ -13903,7 +14580,7 @@ async function configureGitHubAccess({ env, log: log3 }) {
 // src/lib/opencode/config-overlay.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { copyFileSync, existsSync as existsSync2, statSync as statSync6 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join11, resolve as resolve4 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join12, resolve as resolve4 } from "node:path";
 function parseConfigContent(content) {
   if (!content?.trim()) return {};
   const parsed = JSON.parse(content);
@@ -13933,7 +14610,7 @@ function applyRunnerOpenCodeConfig({
     return;
   }
   const source = isAbsolute3(overlayPath) ? overlayPath : resolve4(cwd, overlayPath);
-  const target = isFile(join11(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
+  const target = isFile(join12(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
   if (!isFile(source)) {
     log3(
       `RUNNER-OPENCODE-CONFIG-MISSING: ${source} is not a file; headless turns will wedge on the first external-directory permission prompt (#563)`,
@@ -13941,7 +14618,7 @@ function applyRunnerOpenCodeConfig({
     );
     return;
   }
-  copyFileSync(source, join11(cwd, target));
+  copyFileSync(source, join12(cwd, target));
   try {
     execFileSync2("git", ["-C", cwd, "update-index", "--skip-worktree", target], {
       stdio: "ignore"
@@ -13950,13 +14627,13 @@ function applyRunnerOpenCodeConfig({
     const detail = error2 instanceof Error ? error2.message : String(error2);
     log3(`could not mark ${target} skip-worktree: ${detail}; it may show as a local change`, "warn");
   }
-  log3(`Applied runner OpenCode config ${source} to ${join11(cwd, target)}`);
+  log3(`Applied runner OpenCode config ${source} to ${join12(cwd, target)}`);
 }
 
 // src/lib/opencode/runtime-provenance.ts
-import { readFileSync as readFileSync7, readdirSync } from "node:fs";
+import { readFileSync as readFileSync8, readdirSync } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 var PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i;
 var REGISTRY_SPEC = /^[a-z0-9.*+^~<>=|-]+$/i;
 function errorKind(error2) {
@@ -14024,7 +14701,7 @@ function parseJsonc(value) {
   return JSON.parse(output);
 }
 function openCodeCacheRoot(env = process.env, homeDir = homedir7()) {
-  return join12(env.XDG_CACHE_HOME ?? join12(homeDir, ".cache"), "opencode");
+  return join13(env.XDG_CACHE_HOME ?? join13(homeDir, ".cache"), "opencode");
 }
 function readConfiguredPluginSpecs({
   cwd = process.cwd(),
@@ -14033,10 +14710,10 @@ function readConfiguredPluginSpecs({
   let config;
   try {
     try {
-      config = parseJsonc(readFileSync7(join12(cwd, "opencode.jsonc"), "utf8"));
+      config = parseJsonc(readFileSync8(join13(cwd, "opencode.jsonc"), "utf8"));
     } catch (error2) {
       if (!("code" in Object(error2)) || Object(error2).code !== "ENOENT") throw error2;
-      config = parseJsonc(readFileSync7(join12(cwd, "opencode.json"), "utf8"));
+      config = parseJsonc(readFileSync8(join13(cwd, "opencode.json"), "utf8"));
     }
   } catch (error2) {
     log3(`Could not read OpenCode plugin configuration: ${errorKind(error2)}`);
@@ -14064,7 +14741,7 @@ function resolveInstalledPluginVersions({
   homeDir = homedir7(),
   log: log3
 }) {
-  const packagesRoot = join12(cacheRoot ?? openCodeCacheRoot(env, homeDir), "packages");
+  const packagesRoot = join13(cacheRoot ?? openCodeCacheRoot(env, homeDir), "packages");
   let directories;
   try {
     directories = readdirSync(packagesRoot, { withFileTypes: true });
@@ -14085,8 +14762,8 @@ function resolveInstalledPluginVersions({
     let resolvedVersion = null;
     try {
       const packageJson = JSON.parse(
-        readFileSync7(
-          join12(packagesRoot, directory.name, "node_modules", parsed.name, "package.json"),
+        readFileSync8(
+          join13(packagesRoot, directory.name, "node_modules", parsed.name, "package.json"),
           "utf8"
         )
       );
@@ -14107,7 +14784,7 @@ function resolveInstalledPluginVersions({
 }
 
 // src/lib/credential-sync.ts
-import { renameSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { renameSync, writeFileSync as writeFileSync6 } from "node:fs";
 var CREDENTIAL_SYNC_TICK_TIMEOUT_MS = 3e4;
 var CREDENTIAL_FLUSH_DEADLINE_MS = 8e3;
 var CREDENTIAL_FLUSH_ABORT_GRACE_MS = 500;
@@ -14141,7 +14818,7 @@ function writeMarker(markerPath, outcomes, log3) {
 `;
   const temporaryPath = `${markerPath}.tmp`;
   try {
-    writeFileSync5(temporaryPath, body, { mode: 384 });
+    writeFileSync6(temporaryPath, body, { mode: 384 });
     renameSync(temporaryPath, markerPath);
   } catch (error2) {
     log3(`CREDENTIAL-FLUSH-MARKER-UNWRITABLE: ${markerPath}: ${errorMessage2(error2)}`, "warn");
@@ -14381,15 +15058,25 @@ async function responseJson(response) {
 function readSetup(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
   const setup = value;
-  if (typeof setup.runner_id !== "string" || typeof setup.generation !== "string" || typeof setup.status !== "string" || setup.token_id !== null && typeof setup.token_id !== "string") {
+  if (typeof setup.runner_id !== "string" || typeof setup.generation !== "string" || typeof setup.status !== "string" || setup.token_id !== null && typeof setup.token_id !== "string" || typeof setup.acknowledged_at !== "string" && setup.acknowledged_at !== null) {
     return null;
   }
   return setup;
 }
 function clearLocalSetup(options) {
   const env = options.env ?? process.env;
-  (options.store ?? defaultStore).clear(options.agentId);
-  delete env.EVIDENT_PROXY_TOKEN;
+  const store = options.store ?? defaultStore;
+  const stored = store.get(options.agentId);
+  store.clear(options.agentId);
+  const token = env.EVIDENT_PROXY_TOKEN;
+  if (token !== void 0 && token === stored?.token) {
+    delete env.EVIDENT_PROXY_TOKEN;
+  } else if (token !== void 0) {
+    options.log(
+      `MANAGED-INFERENCE-CLEANUP-PRESERVED-EXTERNAL-TOKEN: runner=${options.agentId}`,
+      "debug"
+    );
+  }
 }
 async function discoverManagedInferenceSetup(options) {
   const headers = requestHeaders(options);
@@ -14413,6 +15100,25 @@ async function discoverManagedInferenceSetup(options) {
   const setup = readSetup(body?.setup);
   return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed setup discovery returned an invalid response" };
 }
+async function enrollManagedInferenceSetup(options) {
+  const response = await post(options, "enroll", {});
+  if (!response) {
+    return { kind: "failed", reason: safeFailure("Managed credential enrollment") };
+  }
+  if (response.status === 404) {
+    return { kind: "none" };
+  }
+  const body = await responseJson(response);
+  if (!response.ok) {
+    const serverError = body?.error;
+    return {
+      kind: "failed",
+      reason: typeof serverError === "string" && serverError.trim() ? redactDiagnosticText(serverError).slice(0, 500) : safeFailure("Managed credential enrollment", response.status)
+    };
+  }
+  const setup = readSetup(body?.setup);
+  return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed credential enrollment returned an invalid response" };
+}
 async function post(options, operation, body) {
   const headers = requestHeaders(options);
   try {
@@ -14508,7 +15214,7 @@ async function prepareManagedInferenceSetup(options, discovery, health) {
     }
     return reaffirmStored(options, stored);
   }
-  if (discovery.setup.status === "acknowledged" && stored?.generation === discovery.setup.generation && stored.tokenId === discovery.setup.token_id) {
+  if (discovery.setup.acknowledged_at !== null && stored?.generation === discovery.setup.generation && stored.tokenId === discovery.setup.token_id) {
     return reaffirmStored(options, stored);
   }
   const response = await post(options, "bootstrap", { generation: discovery.setup.generation });
@@ -14594,33 +15300,49 @@ function resolveLogLevel(options) {
   }
   return "info";
 }
-function resolveFileSyncDirectories(raw, homeDir) {
-  const directories = [];
+function resolveFileSyncEntry(entry, homeDir, flagName, labels) {
+  const trimmed = entry.trim();
+  if (trimmed === "") {
+    throw new Error(`${flagName} requires a ${labels.noun} path (got an empty value)`);
+  }
+  const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join14(homeDir, trimmed.slice(2)) : trimmed;
+  if (!isAbsolute4(expanded)) {
+    throw new Error(`${flagName} requires an absolute ${labels.noun} path; got "${entry}"`);
+  }
+  const normalized = resolvePath2(expanded);
+  if (parse(normalized).root === normalized) {
+    throw new Error(
+      `${flagName} will not allow-list the filesystem root ("${entry}"); name the specific ${labels.noun} the credentials belong in (for example ${labels.rootExample})`
+    );
+  }
+  return normalized;
+}
+function resolveFileSyncAllowList(raw, homeDir, flagName, labels) {
+  const paths = [];
   for (const entry of raw ?? []) {
-    const trimmed = entry.trim();
-    if (trimmed === "") {
-      throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
-    }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join13(homeDir, trimmed.slice(2)) : trimmed;
-    if (!isAbsolute4(expanded)) {
-      throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
-    }
-    const normalized = resolvePath2(expanded);
-    if (parse(normalized).root === normalized) {
-      throw new Error(
-        `--enable-file-sync-to will not allow-list the filesystem root ("${entry}"); name the specific directory the credentials belong in (for example ~/.claude)`
-      );
-    }
-    if (!directories.includes(normalized)) {
-      directories.push(normalized);
-    }
+    const normalized = resolveFileSyncEntry(entry, homeDir, flagName, labels);
+    if (!paths.includes(normalized)) paths.push(normalized);
   }
-  if (directories.length > MAX_FILE_SYNC_DIRECTORIES) {
+  if (paths.length > MAX_FILE_SYNC_DIRECTORIES) {
     throw new Error(
-      `--enable-file-sync-to accepts at most ${MAX_FILE_SYNC_DIRECTORIES} directories; got ${directories.length}`
+      `${flagName} accepts at most ${MAX_FILE_SYNC_DIRECTORIES} ${labels.plural}; got ${paths.length}`
     );
   }
-  return directories;
+  return paths;
+}
+function resolveFileSyncDirectories(raw, homeDir) {
+  return resolveFileSyncAllowList(raw, homeDir, "--enable-file-sync-to", {
+    noun: "directory",
+    plural: "directories",
+    rootExample: "~/.claude"
+  });
+}
+function resolveFileSyncExactFiles(raw, homeDir) {
+  return resolveFileSyncAllowList(raw, homeDir, "--enable-file-sync-to-exact-file", {
+    noun: "file",
+    plural: "files",
+    rootExample: "~/.local/share/opencode/mcp-auth.json"
+  });
 }
 var DEFAULT_OPENCODE_START_TIMEOUT_SECONDS = 180;
 var MAX_OPENCODE_START_TIMEOUT_SECONDS = 3600;
@@ -14636,13 +15358,13 @@ function resolveOpenCodeVersion(options, env = process.env) {
     raw = env[OPENCODE_VERSION_ENV];
     source = OPENCODE_VERSION_ENV;
   } else {
-    return { version: "v1", warnings: [] };
+    return { version: "auto", warnings: [] };
   }
   const normalized = raw.trim().toLowerCase();
-  if (normalized !== "v1" && normalized !== "v2") {
+  if (normalized !== "v1" && normalized !== "v2" && normalized !== "auto") {
     return {
-      version: "v1",
-      warnings: [`Ignoring invalid ${source} "${raw}": expected v1 or v2; using the default v1`]
+      version: "auto",
+      warnings: [`Ignoring invalid ${source} "${raw}": expected v1, v2, or auto; using auto`]
     };
   }
   return { version: normalized, warnings: [] };
@@ -15257,7 +15979,7 @@ function shouldWarnForReclaimSkip(reason) {
   return major > 22 || major === 22 && (minor > 13 || minor === 13 && patch >= 0);
 }
 function sessionDbPath() {
-  return join13(homedir8(), ".local", "share", "opencode", "opencode.db");
+  return join14(homedir8(), ".local", "share", "opencode", "opencode.db");
 }
 function logSessionCleanupActivity(state, phase, entry) {
   logActivity(state, {
@@ -15266,6 +15988,47 @@ function logSessionCleanupActivity(state, phase, entry) {
     metadata: { ...entry.metadata, phase }
   });
 }
+async function drainSessionDeletionReports(state) {
+  const path = sessionDeletionReportPath(homedir8(), process.env);
+  let delivered = 0;
+  let failure = null;
+  try {
+    const spool = readSessionDeletionRecords(path);
+    if (spool.readError !== null) {
+      failure = `could not read spool: ${spool.readError}`;
+    } else if (spool.records.length === 0) {
+      return;
+    } else if (!state.agentId || !state.authHeader) {
+      failure = "runner authentication is not available";
+    } else {
+      for (let offset = 0; offset < spool.records.length; offset += 200) {
+        const batch = spool.records.slice(offset, offset + 200);
+        const result = await reportSessionDeletions(state.agentId, state.authHeader, batch);
+        if (!result.ok) {
+          failure = result.error ?? "unknown API error";
+          break;
+        }
+        removeDeliveredSessionDeletionRecords(path, batch);
+        delivered += batch.length;
+      }
+    }
+  } catch (error2) {
+    failure = error2 instanceof Error ? error2.message : String(error2);
+  }
+  const pending = readSessionDeletionRecords(path);
+  const pendingCount = pending.readError === null ? pending.records.length : null;
+  const message = `Session deletion reports: delivered ${delivered}, ${pendingCount === null ? "pending count unavailable" : `${pendingCount} pending`}` + (failure === null ? "." : `; delivery failed: ${failure}.`);
+  logActivity(state, {
+    type: "info",
+    level: failure === null ? "info" : "warn",
+    message,
+    metadata: {
+      outcome: failure === null ? "session-deletion-reports-drained" : "session-deletion-reports-pending",
+      delivered,
+      pending: pendingCount
+    }
+  });
+}
 function logSessionDbProvenanceMismatch(state, provenance, currentVersion, preBootMigrationCount) {
   const record = {
     v: 1,
@@ -15323,17 +16086,22 @@ async function runSweep(state, driver, config) {
     let failedThrew = 0;
     let skippedNewlyActive = 0;
     let remaining = 0;
+    const deletionRecords = [];
     let protectedNow = driver.protectedSessionIds();
     if (sessions !== null) {
-      const toDelete = selectSessionsToDelete(
-        sessions.map((s) => ({ id: s.id, lastActivityMs: sessionLastActivityMs(s) })),
-        {
-          maxAgeMs: config.maxAgeMs,
-          maxCount: config.maxCount,
-          nowMs: Date.now(),
-          protectedIds: protectedNow
-        }
+      const snapshots = sessions.map((session) => ({
+        id: session.id,
+        lastActivityMs: sessionLastActivityMs(session)
+      }));
+      const lastActivityById = new Map(
+        snapshots.map(({ id, lastActivityMs }) => [id, lastActivityMs])
       );
+      const toDelete = selectSessionsToDelete(snapshots, {
+        maxAgeMs: config.maxAgeMs,
+        maxCount: config.maxCount,
+        nowMs: Date.now(),
+        protectedIds: protectedNow
+      });
       const eligibleToDelete = toDelete.filter(
         (id) => (state.sessionDeleteFailures.get(id)?.isolatedFailures ?? 0) < SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES
       );
@@ -15353,6 +16121,17 @@ async function runSweep(state, driver, config) {
         const outcome = await deleteSession(state.port, id, state.opencodeClient ?? void 0);
         if (outcome.ok) {
           deleted++;
+          const lastActivityMs = lastActivityById.get(id) ?? null;
+          deletionRecords.push({
+            opencode_session_id: id,
+            deleted_at: (/* @__PURE__ */ new Date()).toISOString(),
+            reason: "auto_cleanup",
+            policy: {
+              max_age_ms: config.maxAgeMs ?? null,
+              max_count: config.maxCount ?? null,
+              last_activity_at: lastActivityMs === null ? null : new Date(lastActivityMs).toISOString()
+            }
+          });
         } else if (outcome.status === "threw") {
           failed++;
           failedThrew++;
@@ -15408,6 +16187,32 @@ async function runSweep(state, driver, config) {
         message: `Session cleanup: inspected ${sessions.length}, deleted ${deleted}${failedNote}${skippedNote}${remainingNote} (${mode})`
       });
     }
+    if (deletionRecords.length > 0) {
+      try {
+        const dropped = appendSessionDeletionRecords(
+          sessionDeletionReportPath(homedir8(), process.env),
+          deletionRecords
+        );
+        if (dropped > 0) {
+          logSessionCleanupActivity(state, "sweep", {
+            type: "info",
+            level: "warn",
+            message: `Session cleanup: dropped ${dropped} oldest pending deletion report(s) after reaching the spool limit`,
+            metadata: { outcome: "deletion-reports-dropped", dropped_count: dropped }
+          });
+        }
+      } catch (error2) {
+        logSessionCleanupActivity(state, "sweep", {
+          type: "info",
+          level: "warn",
+          message: `Session cleanup: could not persist ${deletionRecords.length} confirmed deletion report(s): ${error2 instanceof Error ? error2.message : String(error2)}`,
+          metadata: {
+            outcome: "deletion-report-spool-write-failed",
+            records: deletionRecords.length
+          }
+        });
+      }
+    }
     const sessionMetadata = {
       sessions_inspected: sessions?.length ?? null,
       sessions_deleted: deleted,
@@ -15477,6 +16282,7 @@ async function runSweep(state, driver, config) {
         }
       });
     }
+    await drainSessionDeletionReports(state);
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     logSessionCleanupActivity(state, "sweep", {
@@ -15959,9 +16765,11 @@ async function run(options) {
   const interactive = isInteractive(options.json);
   let logLevel;
   let fileSyncDirectories;
+  let fileSyncExactFiles;
   try {
     logLevel = resolveLogLevel(options);
     fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir8());
+    fileSyncExactFiles = resolveFileSyncExactFiles(options.enableFileSyncToExactFile, homedir8());
     if (options.restoreSessionDb && !options.sessionDbNoReplicateMarker) {
       throw new Error(
         "--restore-session-db requires --session-db-no-replicate-marker <path>; restore failures must block Litestream replication"
@@ -16037,7 +16845,11 @@ async function run(options) {
   }
   if (fileSyncDirectories.length > 0) {
     log2(state, `File sync enabled for: ${fileSyncDirectories.join(", ")}`);
-  } else {
+  }
+  if (fileSyncExactFiles.length > 0) {
+    log2(state, `File sync exact files enabled for: ${fileSyncExactFiles.join(", ")}`);
+  }
+  if (fileSyncDirectories.length === 0 && fileSyncExactFiles.length === 0) {
     log2(state, "File sync is disabled (no --enable-file-sync-to given)", "debug");
   }
   if (!options.runner && options.agent) {
@@ -16319,6 +17131,7 @@ async function run(options) {
       }
     }
     reportSessionDbRecovery(state);
+    await drainSessionDeletionReports(state);
     if (sessionDbVerifyFatal) {
       throw new Error(
         sessionDbVerifyFatalReason === void 0 ? "SESSION-DB-INTEGRITY-EXHAUSTED: the corrupt session DB could not be proven separated from the active backup prefix or removed from disk" : `SESSION-DB-VERIFY-TIMEOUT: session DB verification timed out (${sessionDbVerifyFatalReason}); refusing to start`
@@ -16338,13 +17151,75 @@ async function run(options) {
     for (const warning2 of opencodeStartTimeoutWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
     }
-    const { version: opencodeVersion, warnings: opencodeVersionWarnings } = resolveOpenCodeVersion(
-      options,
-      process.env
-    );
+    const { version: opencodeVersionSelection, warnings: opencodeVersionWarnings } = resolveOpenCodeVersion(options, process.env);
     for (const warning2 of opencodeVersionWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
     }
+    let opencodeMajor;
+    let opencodeV2Command;
+    let opencodeDetectionSource;
+    let opencodeDetectionLevel = "info";
+    let opencodeDetectionMessage;
+    if (opencodeVersionSelection === "v1") {
+      opencodeMajor = "v1";
+      opencodeDetectionSource = "explicit";
+      opencodeDetectionMessage = "OpenCode V1 was selected explicitly.";
+    } else if (opencodeVersionSelection === "v2") {
+      const installed = resolveInstalledOpenCode();
+      opencodeMajor = "v2";
+      opencodeDetectionSource = "explicit";
+      if (installed.kind === "installed" && installed.major === "v2") {
+        opencodeV2Command = installed.command;
+        opencodeDetectionMessage = `OpenCode V2 was selected explicitly; using ${installed.command}${installed.version ? ` (${installed.version})` : ""}.`;
+      } else if (installed.kind === "unknown") {
+        opencodeDetectionMessage = `OpenCode V2 was selected explicitly; ${installed.command} reported ${JSON.stringify(installed.rawVersion)}, but no V2 command was resolved.`;
+      } else if (installed.kind === "installed") {
+        opencodeDetectionMessage = `OpenCode V2 was selected explicitly; ${installed.command} reported V1 ${installed.version ?? "with an unknown version"}, so no V2 command was resolved.`;
+      } else {
+        opencodeDetectionMessage = "OpenCode V2 was selected explicitly, but no V2 command was resolved.";
+      }
+    } else {
+      const running = await classifyRunningOpenCode(state.port);
+      if (running.kind === "v1") {
+        opencodeMajor = "v1";
+        opencodeDetectionSource = "running-server";
+        opencodeDetectionMessage = `OpenCode detection: found V1 on port ${state.port}${running.version ? ` (${running.version})` : " (version unknown)"}.`;
+      } else if (running.kind === "v2") {
+        opencodeMajor = "v2";
+        opencodeDetectionSource = "running-server";
+        opencodeDetectionMessage = `OpenCode detection: found V2 on port ${state.port}${running.version ? ` (${running.version})` : " (version unknown)"}.`;
+      } else if (running.kind === "authenticated-unknown") {
+        const message = `A server on port ${state.port} requires credentials this runner does not have. This can be a password-protected V1 or a V2 server, so the protocol cannot be established. Select it explicitly with --opencode-version v1 or --opencode-version v2.`;
+        logActivity(state, {
+          type: "info",
+          level: "warn",
+          message: `OpenCode detection: authenticated-unknown on port ${state.port}; ${running.detail}. ${message}`
+        });
+        throw new Error(message);
+      } else {
+        const installed = resolveInstalledOpenCode();
+        opencodeDetectionLevel = "warn";
+        if (installed.kind === "installed") {
+          opencodeMajor = installed.major;
+          opencodeDetectionSource = "installed-binary";
+          if (installed.major === "v2") opencodeV2Command = installed.command;
+          opencodeDetectionMessage = `OpenCode detection: no server identified on port ${state.port} (${running.detail}); using installed ${installed.major} command ${installed.command}${installed.version ? ` (${installed.version})` : " with an unknown version"}.`;
+        } else if (installed.kind === "unknown") {
+          opencodeMajor = "v1";
+          opencodeDetectionSource = "fallback-v1";
+          opencodeDetectionMessage = `OpenCode detection: no server identified on port ${state.port} (${running.detail}); ${installed.command} reported ${JSON.stringify(installed.rawVersion)}, so assuming V1. Use --opencode-version v2 to select V2 explicitly.`;
+        } else {
+          opencodeMajor = "v1";
+          opencodeDetectionSource = "fallback-v1";
+          opencodeDetectionMessage = `OpenCode detection: no server identified on port ${state.port} (${running.detail}); no recognizable OpenCode binary is installed, so continuing into the V1 install flow.`;
+        }
+      }
+    }
+    logActivity(state, {
+      type: "info",
+      level: opencodeDetectionLevel,
+      message: opencodeDetectionMessage
+    });
     const managedSetupOptions = {
       agentId: state.agentId,
       apiUrl: getApiUrlConfig(),
@@ -16356,13 +17231,16 @@ async function run(options) {
         ...level === "error" ? { error: message } : { message }
       })
     };
-    const managedDiscovery = await discoverManagedInferenceSetup(managedSetupOptions);
+    let managedDiscovery = await discoverManagedInferenceSetup(managedSetupOptions);
+    if (managedDiscovery.kind === "none") {
+      managedDiscovery = await enrollManagedInferenceSetup(managedSetupOptions);
+    }
     let managedPreparation = { kind: "none" };
     if (managedDiscovery.kind === "failed") {
       managedPreparation = managedDiscovery;
       managedSetupOptions.log(`MANAGED-INFERENCE-NOT-READY: ${managedDiscovery.reason}`, "warn");
     } else if (managedDiscovery.kind === "setup") {
-      const managedHealth = opencodeVersion === "v2" ? await checkOpenCode2Health(state.port) : await checkOpenCodeHealth(state.port);
+      const managedHealth = opencodeMajor === "v2" ? await checkOpenCode2Health(state.port) : await checkOpenCodeHealth(state.port);
       managedPreparation = await prepareManagedInferenceSetup(
         managedSetupOptions,
         managedDiscovery,
@@ -16387,13 +17265,14 @@ async function run(options) {
     const preBootMigrationIds = readSessionDbMigrationIds(sessionDbPath());
     const ocSpinner = interactive && !state.json ? ora4("Checking OpenCode...").start() : null;
     try {
-      const oc = opencodeVersion === "v2" ? await ensureOpenCode2Running({
+      const oc = opencodeMajor === "v2" ? await ensureOpenCode2Running({
         port: state.port,
         interactive: state.interactive,
         agentId: state.agentId,
         log: (message) => log2(state, message),
         startTimeoutMs: opencodeStartTimeoutMs,
-        inheritStdio: Boolean(options.opencodePidFile)
+        inheritStdio: Boolean(options.opencodePidFile),
+        command: opencodeV2Command
       }) : await ensureOpenCodeRunning({
         port: state.port,
         interactive: state.interactive,
@@ -16405,7 +17284,7 @@ async function run(options) {
       state.port = oc.port;
       state.opencodeProcess = options.opencodePidFile ? null : oc.process;
       state.opencodeVersion = oc.version;
-      state.opencodeApiVersion = opencodeVersion;
+      state.opencodeApiVersion = opencodeMajor;
       let configuredPlugins = [];
       let resolvedPlugins = [];
       try {
@@ -16427,13 +17306,14 @@ async function run(options) {
         metadata: {
           opencode_version: state.opencodeVersion,
           opencode_api_version: state.opencodeApiVersion,
+          opencode_detection_source: opencodeDetectionSource,
           configured_plugins: JSON.stringify(configuredPlugins),
           resolved_plugins: JSON.stringify(resolvedPlugins)
         },
         source: "cli.runtime-provenance"
       });
       let opencodePassword = null;
-      if (opencodeVersion === "v2" && "password" in oc) {
+      if (opencodeMajor === "v2" && "password" in oc) {
         const value = oc.password;
         if (typeof value === "string" || value === null) opencodePassword = value;
       }
@@ -16446,7 +17326,7 @@ async function run(options) {
       state.opencodeClient = openCodeClient;
       if (options.opencodePidFile && oc.process?.pid !== void 0) {
         try {
-          writeFileSync6(options.opencodePidFile, `${oc.process.pid}
+          writeFileSync7(options.opencodePidFile, `${oc.process.pid}
 `, { mode: 384 });
           chmodSync3(options.opencodePidFile, 384);
         } catch (error2) {
@@ -16556,7 +17436,7 @@ async function run(options) {
         let existingPid;
         if (existsSync3(options.litestreamPidFile)) {
           try {
-            const rawPid = readFileSync8(options.litestreamPidFile, "utf8").trim();
+            const rawPid = readFileSync9(options.litestreamPidFile, "utf8").trim();
             const parsedPid = Number(rawPid);
             if (/^\d+$/.test(rawPid) && Number.isSafeInteger(parsedPid) && parsedPid > 0) {
               existingPid = parsedPid;
@@ -16593,7 +17473,7 @@ async function run(options) {
           });
           try {
             if (litestreamProcess.pid !== void 0) {
-              writeFileSync6(options.litestreamPidFile, `${litestreamProcess.pid}
+              writeFileSync7(options.litestreamPidFile, `${litestreamProcess.pid}
 `, {
                 mode: 384
               });
@@ -16652,9 +17532,10 @@ async function run(options) {
       conversationFilter: state.conversationFilter,
       stuckQueuedMs: CHANNEL_STUCK_QUEUED_MS,
       sessionStoreHealth: state.sessionStoreHealth,
-      // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
-      // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
+      // #559: the file-sync allow-lists. Empty ⇒ pending files are REJECTED with
+      // `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
+      fileSyncExactFiles,
       homeDir: homedir8(),
       maxActiveSessions,
       log: (entry) => (
@@ -16925,8 +17806,8 @@ program.command("run").description("Connect to Evident and process messages").op
   "--opencode-start-timeout <seconds>",
   "Seconds to wait for OpenCode to become healthy when the runner starts it (default: 180). Env: EVIDENT_OPENCODE_START_TIMEOUT"
 ).option(
-  "--opencode-version <v1|v2>",
-  "Which OpenCode major version to launch: v1 or v2 (default: v1). Env: EVIDENT_OPENCODE_VERSION"
+  "--opencode-version <v1|v2|auto>",
+  "OpenCode major version: auto (default) detects the running server, then installed binary; v1 and v2 skip server-protocol detection. Env: EVIDENT_OPENCODE_VERSION"
 ).option("--json", "Output in JSON format").option(
   "--session-cleanup-max-age <duration>",
   "Delete OpenCode sessions idle longer than this (e.g. 7d, 24h). Enables cleanup. Env: EVIDENT_SESSION_CLEANUP_MAX_AGE"
@@ -16953,6 +17834,11 @@ program.command("run").description("Connect to Evident and process messages").op
   "Allow Evident to write files into this directory (repeatable). Omit to disable file sync entirely.",
   (value, previous) => previous.concat([value]),
   []
+).option(
+  "--enable-file-sync-to-exact-file <path>",
+  "Allow Evident to write files to exactly this path (repeatable).",
+  (value, previous) => previous.concat([value]),
+  []
 ).option(
   "--tunnel-ready-file <path>",
   "Path to write once the tunnel is connected (opt-in; unused unless an operator/image sets it)"
@@ -17015,6 +17901,9 @@ program.command("run").description("Connect to Evident and process messages").op
       // Raw values — expansion/validation is single-sourced in run.ts's
       // resolveFileSyncDirectories.
       enableFileSyncTo: options.enableFileSyncTo,
+      // Raw values — expansion/validation is single-sourced in run.ts's
+      // resolveFileSyncExactFiles.
+      enableFileSyncToExactFile: options.enableFileSyncToExactFile,
       tunnelReadyFile: options.tunnelReadyFile,
       litestreamConfig: options.litestreamConfig,
       opencodePidFile: options.opencodePidFile,