@webpresso/agent-kit 3.2.0 → 3.3.0

package/dist/esm/cli/commands/init/scaffolders/file-transaction.js

@@ -1,35 +1,207 @@
-import { existsSync, lstatSync, mkdirSync, readFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
-import lockfile from "proper-lockfile";
+import { isProcessAlive } from "#cli/auto-update/install-lock.js";
 import { writeFileAtomicStrict } from "#shared-utils/write-json-file.js";
 const LOCK_TIMEOUT_MS = 5_000;
 const LOCK_POLL_MS = 25;
 const LOCK_STALE_MS = 30_000;
+/**
+ * Hard-age backstop: past this, a stale lock is reclaimed regardless of owner
+ * liveness. Prevents a recycled pid — or a `kill(pid,0)` that fails safe to
+ * "alive" (EPERM / unknown / cross-PID-namespace) — from wedging the lock
+ * forever. Mirrors `isInstallLockActive`, which likewise pairs liveness with an
+ * age bound rather than trusting liveness alone. Also serves as the reaper's own
+ * stale bound. Not a new deadline: it replaces the prior reaper-stale constant.
+ */
+const LOCK_STALE_HARD_MS = 5 * 60_000;
+const LOCK_OWNER_FILE = "owner";
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
-/** Serialize a complete read/modify/write transaction for a host config file. */
-export function withScaffolderFileLock(path, action) {
-    mkdirSync(dirname(path), { recursive: true });
-    const startedAt = Date.now();
-    let release;
-    while (!release) {
+function isErrno(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+/** Directory age in ms, or `undefined` when the directory is gone (ENOENT). */
+function directoryAgeMs(path, now) {
+    try {
+        return now - statSync(path).mtime.getTime();
+    }
+    catch (error) {
+        if (isErrno(error, "ENOENT"))
+            return undefined;
+        throw error;
+    }
+}
+/**
+ * Read the lock's owner record. The token is the full `"<pid>:<uuid>"` string
+ * (identical to what release compares); `pid` is its leading integer. Returns
+ * `undefined` for a missing/empty/unparseable owner — i.e. a crash that never
+ * finished writing the record, which is reclaimable once age-stale.
+ */
+function readLockOwner(lockPath) {
+    let token;
+    try {
+        token = readFileSync(`${lockPath}/${LOCK_OWNER_FILE}`, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const separator = token.indexOf(":");
+    if (separator <= 0)
+        return undefined;
+    const pid = Number(token.slice(0, separator));
+    if (!Number.isInteger(pid) || pid <= 0)
+        return undefined;
+    return { pid, token };
+}
+function tryAcquireDirectory(path) {
+    try {
+        mkdirSync(path);
+        return true;
+    }
+    catch (error) {
+        if (isErrno(error, "EEXIST"))
+            return false;
+        throw error;
+    }
+}
+/**
+ * Serialize stale reclaim across contenders. A crashed reaper holder is itself
+ * reclaimed race-free: exactly one waiter's atomic rename of the reaper carcass
+ * succeeds; losers observe ENOENT and retry the mkdir. This is what stops two
+ * reclaimers from deleting each other's fresh lock — the original lost-update.
+ *
+ * Release is owner-token-checked, exactly like the main lock: if a paused reaper
+ * holder is stolen and replaced while it sleeps, its release sees a mismatched
+ * owner token and no-ops, so it cannot delete the successor's reaper and let a
+ * third reclaimer in behind it.
+ */
+function acquireReaperLock(path, deadline, now) {
+    const ownerPath = `${path}/${LOCK_OWNER_FILE}`;
+    const ownerToken = `${process.pid}:${randomUUID()}`;
+    while (!tryAcquireDirectory(path)) {
+        const ageMs = directoryAgeMs(path, now());
+        if (ageMs !== undefined && ageMs >= LOCK_STALE_HARD_MS) {
+            const carcass = `${path}.stale-${process.pid}-${randomUUID()}`;
+            try {
+                renameSync(path, carcass);
+                rmSync(carcass, { recursive: true, force: true });
+            }
+            catch (error) {
+                // A concurrent waiter won the atomic rename; retry the mkdir.
+                if (!isErrno(error, "ENOENT"))
+                    throw error;
+            }
+            continue;
+        }
+        if (now() >= deadline) {
+            throw new Error(`Timed out waiting for stale host config lock reaper: ${path}`);
+        }
+        sleepSync(LOCK_POLL_MS);
+    }
+    try {
+        writeFileSync(ownerPath, ownerToken, "utf8");
+    }
+    catch (error) {
+        // Mirror the main lock: don't leave a reaper others must wait out on an
+        // owner-write failure.
+        rmSync(path, { recursive: true, force: true });
+        throw error;
+    }
+    return () => {
         try {
-            release = lockfile.lockSync(path, {
-                realpath: false,
-                stale: LOCK_STALE_MS,
-                update: LOCK_STALE_MS / 2,
-            });
+            if (readFileSync(ownerPath, "utf8") !== ownerToken)
+                return;
+            rmSync(path, { recursive: true, force: true });
         }
         catch (error) {
-            if (error.code !== "ELOCKED")
+            if (!isErrno(error, "ENOENT"))
+                throw error;
+        }
+    };
+}
+/**
+ * Remove a stale lock while holding the reaper, so at most one reclaimer acts at
+ * a time. Re-checks under the reaper: only a lock that is still age-stale AND
+ * whose owner is absent, dead, or past the hard-age bound is deleted. A live
+ * owner within the hard-age window is never reclaimed, so a slow-but-alive
+ * writer cannot lose its lock to a successor.
+ */
+function reclaimStaleLock(lockPath, reaperPath, deadline, now, isAlive, seams) {
+    const releaseReaper = acquireReaperLock(reaperPath, deadline, now);
+    try {
+        const ageMs = directoryAgeMs(lockPath, now());
+        if (ageMs === undefined || ageMs < LOCK_STALE_MS)
+            return;
+        const owner = readLockOwner(lockPath);
+        // Reclaim an absent owner record (a crash before the owner write) or a dead
+        // owner at the soft-stale age — recovering an abandoned lock fast is the whole
+        // point. A live owner waits for the hard-age backstop. The residual: a writer
+        // OS-suspended for 30s inside the two-statement mkdir/owner-write gap could be
+        // reclaimed and overlap; that window is a strict subset of the documented
+        // advisory-lock boundary (a suspended holder past the reclaim age), so it is
+        // accepted, not silently ignored.
+        const reclaimable = owner === undefined || !isAlive(owner.pid) || ageMs >= LOCK_STALE_HARD_MS;
+        if (!reclaimable)
+            return;
+        seams?.onBeforeReclaimDelete?.();
+        rmSync(lockPath, { recursive: true, force: true });
+    }
+    finally {
+        releaseReaper();
+    }
+}
+function acquireScaffolderFileLock(path, seams) {
+    const lockPath = `${path}.lock`;
+    const reaperPath = `${lockPath}.reaper`;
+    const ownerToken = `${process.pid}:${randomUUID()}`;
+    const ownerPath = `${lockPath}/${LOCK_OWNER_FILE}`;
+    const now = seams?.now ?? Date.now;
+    const isAlive = seams?.isAlive ?? isProcessAlive;
+    const deadline = now() + LOCK_TIMEOUT_MS;
+    for (;;) {
+        if (tryAcquireDirectory(lockPath)) {
+            try {
+                writeFileSync(ownerPath, ownerToken, "utf8");
+            }
+            catch (error) {
+                rmSync(lockPath, { recursive: true, force: true });
                 throw error;
-            if (Date.now() - startedAt >= LOCK_TIMEOUT_MS) {
-                throw new Error(`Timed out waiting for host config lock: ${path}`, { cause: error });
             }
-            sleepSync(LOCK_POLL_MS);
+            return () => {
+                try {
+                    if (readFileSync(ownerPath, "utf8") !== ownerToken)
+                        return;
+                    rmSync(lockPath, { recursive: true, force: true });
+                }
+                catch (error) {
+                    if (!isErrno(error, "ENOENT"))
+                        throw error;
+                }
+            };
+        }
+        const ageMs = directoryAgeMs(lockPath, now());
+        if (ageMs !== undefined && ageMs >= LOCK_STALE_MS) {
+            // Reclaim may be a no-op (owner still alive within the hard-age window);
+            // fall through to the deadline check so a live holder can't spin us
+            // forever, then retry the mkdir on the next iteration.
+            reclaimStaleLock(lockPath, reaperPath, deadline, now, isAlive, seams);
         }
+        if (now() >= deadline) {
+            throw new Error(`Timed out waiting for host config lock: ${path}`);
+        }
+        sleepSync(LOCK_POLL_MS);
     }
+}
+/**
+ * Serialize a complete read/modify/write transaction for a host config file.
+ * These are local single-machine home-config locks (`~/.codex`, `~/.grok`), so
+ * owner-pid liveness is meaningful; this is not a shared-filesystem lock.
+ */
+export function withScaffolderFileLock(path, action, seams) {
+    mkdirSync(dirname(path), { recursive: true });
+    const release = acquireScaffolderFileLock(path, seams);
     try {
         return action();
     }

package/dist/esm/cli/commands/opencode-probe.d.ts

@@ -0,0 +1,107 @@
+import { type OpencodeAccountAvailabilityEvent } from "#review/availability.js";
+import type { ReviewLimitWindow } from "#review/execution/types.js";
+import { type OpencodeAccount, type OpencodeAccountSelection } from "#review/opencode-account.js";
+/** Set to `1`/`true` to launch without probing account health at all. */
+export declare const OPENCODE_SKIP_PROBE_ENV = "WP_OPENCODE_SKIP_PROBE";
+/**
+ * Wall-clock bound for a single account probe.
+ *
+ * Measured live on 2026-07-24 against three real OpenCode Go accounts
+ * (`opencode` 1.18.4, model `opencode-go/deepseek-v4-flash`, trivial prompt):
+ *
+ * | run | capped `a`      | capped `o`      | healthy `z`                |
+ * | --- | --------------- | --------------- | -------------------------- |
+ * | repo cwd, default tools | 6.0s to first limit line | ~10s | 50.9s to completion |
+ * | temp cwd, default tools | 11.6s | 20.7s | 28.2s to first assistant text |
+ * | temp cwd, no-tools agent | 13.9s | 11.8s | 18.6s to first assistant text |
+ *
+ * `opencode --version` alone costs ~5.7s on the same machine, so roughly a third
+ * of the floor is binary startup and cannot be optimised away here. The probe
+ * therefore runs in a fresh temp cwd (a repo cwd made opencode snapshot the
+ * worktree, which alone cost ~23s) with a no-tools agent (which shrinks the
+ * system prompt and saved a further ~10s).
+ *
+ * 45s is ~2.4x the slowest observed healthy completion (18.6s) and ~2.2x the
+ * slowest observed limit detection (20.7s). The headroom covers a cold provider
+ * catalog fetch on a slow network; it is not a workaround for a slow probe.
+ * Hitting it is not a failure to be silenced by raising the bound — it degrades
+ * to `inconclusive` and the launch proceeds on the already-selected account.
+ *
+ * A capped account is detected by *streaming* the output rather than waiting for
+ * exit: opencode retries a usage-limit stream error and does not exit on it, so
+ * a blocking `spawnSync` sat at the full 60s bound in every measured run even
+ * though the limit was already on stderr after ~6s.
+ */
+export declare const OPENCODE_PROBE_TIMEOUT_MS = 45000;
+/**
+ * How long a successful probe is trusted before the account is probed again.
+ *
+ * A probe costs 12-28s (see `OPENCODE_PROBE_TIMEOUT_MS`), so probing a healthy
+ * account on every launch would make `wp opencode` permanently ~19s slower. A
+ * *capped* account never needs a re-probe — its cooldown record already
+ * suppresses it for the real reset window — so only the healthy verdict is
+ * memoised.
+ *
+ * Measured end to end on 2026-07-24 with three real accounts (two capped):
+ * a cold launch that rotated twice took 40.6s; the immediately following launch
+ * took 476ms, because the two capped accounts were suppressed by their recorded
+ * windows and the healthy one was covered by this marker.
+ */
+export declare const OPENCODE_PROBE_HEALTHY_TTL_MS: number;
+export type OpencodeProbeResult = 
+/** The account answered, so it has budget. */
+{
+    readonly kind: "healthy";
+}
+/** The provider reported a usage limit; `retryAfterMs` is already defaulted. */
+ | {
+    readonly kind: "limited";
+    readonly limitWindow: ReviewLimitWindow;
+    readonly retryAfterMs: number;
+    readonly windowParsed: boolean;
+}
+/** Nothing could be concluded; the caller must launch on this account anyway. */
+ | {
+    readonly kind: "inconclusive";
+    readonly reason: string;
+};
+export interface OpencodeProbeRunnerInput {
+    readonly dataDir: string;
+    readonly timeoutMs: number;
+}
+export type OpencodeProbeRunner = (input: OpencodeProbeRunnerInput) => Promise<OpencodeProbeResult>;
+export declare function isOpencodeProbeEnabled(env?: NodeJS.ProcessEnv): boolean;
+export interface ProbeOpencodeAccountDeps {
+    readonly run?: OpencodeProbeRunner;
+    readonly materialize?: (key: string, dataDir: string) => void;
+    readonly now?: () => number;
+    readonly timeoutMs?: number;
+    readonly healthyTtlMs?: number;
+}
+/**
+ * Probe one account's OpenCode Go credential, memoising a healthy verdict.
+ *
+ * Never throws: every failure path resolves to `inconclusive` so a credential
+ * check can never stop the TUI from opening.
+ */
+export declare function probeOpencodeAccount(account: OpencodeAccount, deps?: ProbeOpencodeAccountDeps): Promise<OpencodeProbeResult>;
+export interface OpencodeProbeRotationDeps {
+    readonly probe?: (account: OpencodeAccount) => Promise<OpencodeProbeResult>;
+    readonly recordCooldown?: (canonicalId: string, event: OpencodeAccountAvailabilityEvent) => Promise<unknown>;
+    readonly selectFrom?: (accounts: readonly OpencodeAccount[], excludedIds: ReadonlySet<string>) => OpencodeAccountSelection | undefined;
+    readonly env?: NodeJS.ProcessEnv;
+}
+export interface OpencodeProbeRotation {
+    readonly selection: OpencodeAccountSelection;
+    /** Human-readable lines describing what the probe did, in print order. */
+    readonly lines: readonly string[];
+}
+/**
+ * Probe the selected account and rotate past capped ones, bounded by the number
+ * of configured accounts.
+ *
+ * Returns the account to launch on plus the lines to print. Never throws and
+ * never returns nothing: an inconclusive probe keeps the incoming selection, so
+ * the worst case is exactly today's behaviour plus one log line.
+ */
+export declare function resolveHealthyOpencodeAccount(accounts: readonly OpencodeAccount[], initial: OpencodeAccountSelection, deps?: OpencodeProbeRotationDeps): Promise<OpencodeProbeRotation>;

package/dist/esm/cli/commands/opencode-probe.js

@@ -0,0 +1,323 @@
+import { spawn } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { formatOpencodeResetWait, OPENCODE_UNKNOWN_LIMIT_COOLDOWN_MS, } from "#cli/commands/opencode-rotate.js";
+import { loadOpencodeAccountAvailability, pruneExpiredOpencodeAccountSuppressions, recordOpencodeAccountAvailabilityWithLock, } from "#review/availability.js";
+import { opencodeUsageLimit } from "#review/execution/adapters.js";
+import { opencodeAccountCanonicalId, opencodeAccountDataDir, selectActiveOpencodeAccount, } from "#review/opencode-account.js";
+import { materializeOpencodeGoAuth } from "#review/opencode-auth.js";
+/** Set to `1`/`true` to launch without probing account health at all. */
+export const OPENCODE_SKIP_PROBE_ENV = "WP_OPENCODE_SKIP_PROBE";
+/**
+ * Wall-clock bound for a single account probe.
+ *
+ * Measured live on 2026-07-24 against three real OpenCode Go accounts
+ * (`opencode` 1.18.4, model `opencode-go/deepseek-v4-flash`, trivial prompt):
+ *
+ * | run | capped `a`      | capped `o`      | healthy `z`                |
+ * | --- | --------------- | --------------- | -------------------------- |
+ * | repo cwd, default tools | 6.0s to first limit line | ~10s | 50.9s to completion |
+ * | temp cwd, default tools | 11.6s | 20.7s | 28.2s to first assistant text |
+ * | temp cwd, no-tools agent | 13.9s | 11.8s | 18.6s to first assistant text |
+ *
+ * `opencode --version` alone costs ~5.7s on the same machine, so roughly a third
+ * of the floor is binary startup and cannot be optimised away here. The probe
+ * therefore runs in a fresh temp cwd (a repo cwd made opencode snapshot the
+ * worktree, which alone cost ~23s) with a no-tools agent (which shrinks the
+ * system prompt and saved a further ~10s).
+ *
+ * 45s is ~2.4x the slowest observed healthy completion (18.6s) and ~2.2x the
+ * slowest observed limit detection (20.7s). The headroom covers a cold provider
+ * catalog fetch on a slow network; it is not a workaround for a slow probe.
+ * Hitting it is not a failure to be silenced by raising the bound — it degrades
+ * to `inconclusive` and the launch proceeds on the already-selected account.
+ *
+ * A capped account is detected by *streaming* the output rather than waiting for
+ * exit: opencode retries a usage-limit stream error and does not exit on it, so
+ * a blocking `spawnSync` sat at the full 60s bound in every measured run even
+ * though the limit was already on stderr after ~6s.
+ */
+export const OPENCODE_PROBE_TIMEOUT_MS = 45_000;
+/**
+ * How long a successful probe is trusted before the account is probed again.
+ *
+ * A probe costs 12-28s (see `OPENCODE_PROBE_TIMEOUT_MS`), so probing a healthy
+ * account on every launch would make `wp opencode` permanently ~19s slower. A
+ * *capped* account never needs a re-probe — its cooldown record already
+ * suppresses it for the real reset window — so only the healthy verdict is
+ * memoised.
+ *
+ * Measured end to end on 2026-07-24 with three real accounts (two capped):
+ * a cold launch that rotated twice took 40.6s; the immediately following launch
+ * took 476ms, because the two capped accounts were suppressed by their recorded
+ * windows and the healthy one was covered by this marker.
+ */
+export const OPENCODE_PROBE_HEALTHY_TTL_MS = 30 * 60 * 1_000;
+/**
+ * Cheapest OpenCode Go model at the time of writing. The gateway caps by
+ * account, not by model, so any model reveals the cap; this one is picked purely
+ * to minimise probe cost. If the id ever disappears from the catalog the probe
+ * fails as `inconclusive` and the launch proceeds unchanged, which is the same
+ * safe degradation as a spawn failure.
+ */
+const OPENCODE_PROBE_MODEL = "opencode-go/deepseek-v4-flash";
+const OPENCODE_PROBE_AGENT = "wp-health-probe";
+const OPENCODE_PROBE_PROMPT = "hi";
+const OPENCODE_PROBE_PERMISSIONS = { "*": "deny" };
+const OPENCODE_PROBE_CONFIG = JSON.stringify({
+    $schema: "https://opencode.ai/config.json",
+    share: "disabled",
+    permission: OPENCODE_PROBE_PERMISSIONS,
+    agent: {
+        [OPENCODE_PROBE_AGENT]: {
+            description: "Minimal OpenCode Go credential health probe.",
+            mode: "primary",
+            permission: OPENCODE_PROBE_PERMISSIONS,
+            tools: { "*": false },
+        },
+    },
+});
+/** Rolling capture bound: the limit text always arrives in the newest output. */
+const MAX_CAPTURE_BYTES = 64 * 1_024;
+/** A rendered assistant token or a finished step proves the account answered. */
+const HEALTHY_EVENT_PATTERN = /"type"\s*:\s*"(?:text|step_finish)"/u;
+const HEALTH_MARKER_FILE = "wp-probe-health.json";
+export function isOpencodeProbeEnabled(env = process.env) {
+    const raw = env[OPENCODE_SKIP_PROBE_ENV]?.trim().toLowerCase();
+    return raw !== "1" && raw !== "true";
+}
+function healthMarkerPath(dataDir) {
+    return join(dataDir, HEALTH_MARKER_FILE);
+}
+function readHealthMarker(dataDir) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(healthMarkerPath(dataDir), "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return undefined;
+    const okAt = parsed["okAt"];
+    return typeof okAt === "number" && Number.isFinite(okAt) ? okAt : undefined;
+}
+function writeHealthMarker(dataDir, atMs) {
+    try {
+        mkdirSync(dataDir, { recursive: true });
+        writeFileSync(healthMarkerPath(dataDir), JSON.stringify({ okAt: atMs }), {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+    }
+    catch {
+        // Best-effort memoisation: a missing marker only costs another probe.
+    }
+}
+function limitedFromEvent(message) {
+    const event = opencodeUsageLimit(message);
+    if (event === null || event.kind !== "failure")
+        return null;
+    const parsed = event.retryAfterMs;
+    return {
+        kind: "limited",
+        limitWindow: event.limitWindow ?? "unknown",
+        retryAfterMs: parsed ?? OPENCODE_UNKNOWN_LIMIT_COOLDOWN_MS,
+        windowParsed: parsed !== undefined,
+    };
+}
+function probeArgs() {
+    return [
+        "run",
+        "--pure",
+        "--print-logs",
+        "--log-level",
+        "ERROR",
+        "--format",
+        "json",
+        "--model",
+        OPENCODE_PROBE_MODEL,
+        "--agent",
+        OPENCODE_PROBE_AGENT,
+        OPENCODE_PROBE_PROMPT,
+    ];
+}
+function classifyChunk(captured) {
+    return (limitedFromEvent(captured) ??
+        (HEALTHY_EVENT_PATTERN.test(captured) ? { kind: "healthy" } : null));
+}
+/**
+ * Spawn a bounded `opencode run` against one account's isolated credential
+ * store and classify the first conclusive thing it says.
+ *
+ * There is no OpenCode Go HTTP endpoint anywhere in this codebase — the review
+ * adapter also reaches the provider only by spawning this binary — so a
+ * subprocess is the only available probe vehicle. Per-account isolation is the
+ * same `XDG_DATA_HOME` trick the review adapter uses, so a probe can never race
+ * a live interactive TUI's global `auth.json`.
+ */
+function spawnOpencodeProbe(input) {
+    return new Promise((resolve) => {
+        let probeCwd;
+        try {
+            probeCwd = mkdtempSync(join(tmpdir(), "wp-opencode-probe-"));
+        }
+        catch (error) {
+            resolve({ kind: "inconclusive", reason: describeError(error) });
+            return;
+        }
+        runProbeChild(probeCwd, input, resolve);
+    });
+}
+function runProbeChild(probeCwd, input, resolve) {
+    const child = spawn("opencode", [...probeArgs()], {
+        cwd: probeCwd,
+        env: {
+            ...process.env,
+            XDG_DATA_HOME: input.dataDir,
+            OPENCODE_CONFIG_CONTENT: OPENCODE_PROBE_CONFIG,
+            OPENCODE_DISABLE_AUTOUPDATE: "true",
+            OPENCODE_DISABLE_PRUNE: "true",
+        },
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    let settled = false;
+    let timer;
+    const finish = (result) => {
+        if (settled)
+            return;
+        settled = true;
+        if (timer)
+            clearTimeout(timer);
+        child.kill("SIGKILL");
+        try {
+            rmSync(probeCwd, { recursive: true, force: true });
+        }
+        catch {
+            // Best-effort temp cleanup; the OS reclaims it either way.
+        }
+        resolve(result);
+    };
+    timer = setTimeout(() => finish({ kind: "inconclusive", reason: `probe timed out after ${input.timeoutMs}ms` }), input.timeoutMs);
+    let captured = "";
+    const onChunk = (chunk) => {
+        captured = (captured + chunk.toString("utf8")).slice(-MAX_CAPTURE_BYTES);
+        const result = classifyChunk(captured);
+        if (result)
+            finish(result);
+    };
+    child.stdout.on("data", onChunk);
+    child.stderr.on("data", onChunk);
+    child.on("error", (error) => finish({ kind: "inconclusive", reason: error.message }));
+    child.on("close", (code) => finish(code === 0
+        ? { kind: "healthy" }
+        : { kind: "inconclusive", reason: `opencode exited with code ${code ?? "signal"}` }));
+}
+function describeError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Probe one account's OpenCode Go credential, memoising a healthy verdict.
+ *
+ * Never throws: every failure path resolves to `inconclusive` so a credential
+ * check can never stop the TUI from opening.
+ */
+export async function probeOpencodeAccount(account, deps = {}) {
+    const now = (deps.now ?? Date.now)();
+    const dataDir = opencodeAccountDataDir(account.id);
+    const ttl = deps.healthyTtlMs ?? OPENCODE_PROBE_HEALTHY_TTL_MS;
+    const okAt = readHealthMarker(dataDir);
+    if (okAt !== undefined && now - okAt >= 0 && now - okAt < ttl)
+        return { kind: "healthy" };
+    try {
+        (deps.materialize ?? defaultMaterialize)(account.key, dataDir);
+    }
+    catch (error) {
+        return { kind: "inconclusive", reason: describeError(error) };
+    }
+    const result = await (deps.run ?? spawnOpencodeProbe)({
+        dataDir,
+        timeoutMs: deps.timeoutMs ?? OPENCODE_PROBE_TIMEOUT_MS,
+    });
+    if (result.kind === "healthy")
+        writeHealthMarker(dataDir, now);
+    return result;
+}
+function defaultMaterialize(key, dataDir) {
+    materializeOpencodeGoAuth(key, { dataDir });
+}
+/**
+ * Select the account to launch on, excluding `excludedIds`.
+ *
+ * Excluded ids are the accounts this run just cooled. They are filtered here
+ * rather than relied upon coming back suppressed from the store — the same
+ * read-after-write independence `selectNextAccount` in `opencode-rotate.ts`
+ * keeps, so rotation stays correct even when the cooldown write is contended.
+ */
+function defaultSelectFrom(accounts, excludedIds) {
+    const pool = accounts.filter((account) => !excludedIds.has(account.id));
+    if (pool.length === 0)
+        return undefined;
+    const pruned = pruneExpiredOpencodeAccountSuppressions(loadOpencodeAccountAvailability());
+    return selectActiveOpencodeAccount(pool, pruned.state);
+}
+function coolLimitedAccount(accountId, result, deps) {
+    const canonicalId = opencodeAccountCanonicalId(accountId);
+    // Same event shape `--wp-rotate` and the review gate record, so all three
+    // writers produce identical, mutually-readable cooldown records. Unlike a
+    // manual rotation this one carries the provider's REAL reset window.
+    const event = {
+        failureCode: "opencode-go-usage-limit",
+        terminalClassification: "provider-limit-reached",
+        limitWindow: result.limitWindow,
+        retryAfterMs: result.retryAfterMs,
+    };
+    return (deps.recordCooldown ?? recordOpencodeAccountAvailabilityWithLock)(canonicalId, event);
+}
+function allCappedLines(selection) {
+    return [
+        `wp opencode: every OpenCode Go account probed as capped; launching on the soonest-expiring one (${selection.account.id})${formatOpencodeResetWait(selection.waitMs)}. Add another OPENCODE_GO_KEY_<ID> to widen the pool.`,
+    ];
+}
+/**
+ * Probe the selected account and rotate past capped ones, bounded by the number
+ * of configured accounts.
+ *
+ * Returns the account to launch on plus the lines to print. Never throws and
+ * never returns nothing: an inconclusive probe keeps the incoming selection, so
+ * the worst case is exactly today's behaviour plus one log line.
+ */
+export async function resolveHealthyOpencodeAccount(accounts, initial, deps = {}) {
+    if (!isOpencodeProbeEnabled(deps.env ?? process.env))
+        return { selection: initial, lines: [] };
+    // `cooled` means every account is already known-capped: probing cannot find a
+    // better one and would cost a full timeout, so keep the existing behaviour.
+    if (initial.cooled)
+        return { selection: initial, lines: [] };
+    const probe = deps.probe ?? ((account) => probeOpencodeAccount(account));
+    const selectFrom = deps.selectFrom ?? defaultSelectFrom;
+    const excluded = new Set();
+    const lines = [];
+    let current = initial;
+    for (let attempt = 0; attempt < accounts.length; attempt += 1) {
+        const result = await probe(current.account);
+        if (result.kind === "healthy")
+            return { selection: current, lines };
+        if (result.kind === "inconclusive") {
+            lines.push(`wp opencode: health probe for opencode-go:${current.account.id} was inconclusive (${result.reason}); launching on it anyway.`);
+            return { selection: current, lines };
+        }
+        await coolLimitedAccount(current.account.id, result, deps);
+        excluded.add(current.account.id);
+        const next = selectFrom(accounts, excluded);
+        if (!next) {
+            const fallback = selectFrom(accounts, new Set()) ?? current;
+            lines.push(...allCappedLines(fallback));
+            return { selection: fallback, lines };
+        }
+        lines.push(`wp opencode: probe found opencode-go:${current.account.id} capped${formatOpencodeResetWait(result.retryAfterMs)}, rotated to opencode-go:${next.account.id}`);
+        current = next;
+    }
+    return { selection: current, lines };
+}