@amalgm/chat 0.2.8 → 0.2.9-main.34746990150

package/host/adapters/cursor.js

@@ -3,23 +3,21 @@
 // cursor parameterization (binary resolution, model translation, permission
 // handling, and ACP lifecycle inputs).
 //
-// Laws come from ../../dist: event constructors via `createEventConstructors`,
-// the normalizer via `createCursorNormalizer`, `cursorStopReason`, and
-// Effectful tooling and the recorder are sibling host modules.
-
 import os from 'node:os';
+import fs from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
-import { createEventConstructors } from '../../dist/events/index.js';
-import { createCursorNormalizer, cursorStopReason } from '../../dist/normalizers/cursor.js';
+import { usageFromAcpPrompt } from '../../dist/usage/index.js';
 import { recordNativeEvent } from '../recorder.js';
 import { toAcpMcpServers } from '../tooling/mcp-bundle.js';
 import { executableExists, findOnPath } from '../tooling/native-binaries.js';
 import { prepareHarnessRuntime } from '../tooling/runtime-home.js';
+import { preparedSystemPrompt } from '../tooling/system-prompt.js';
 import { requestPermission } from '../permissions.js';
+import { runAcpPrompt } from './acp-prompt.js';
 import { AcpClient } from './acp-client.js';
 import {
-  acpSessionParams,
   assertAcpMcpCapabilities,
   assertAcpPromptCapabilities,
 } from './acp-capabilities.js';
@@ -31,12 +29,28 @@ import {
 } from './input-capabilities.js';
 import { acpPromptParts } from './prompt.js';
 
-const events = createEventConstructors({ clockMs: () => Date.now() });
-const { done, errorEvent, warningEvent } = events;
-const { cursorPromptUsage, normalizeCursorUpdate } = createCursorNormalizer(events);
-
 const PROTOCOL_VERSION = 1;
 
+/** Cursor loads native rules and ambient MCP at process startup, while ACP's
+ * session cwd supplies the actual workspace. Keep configuration in a managed,
+ * content-addressed directory so concurrent executions cannot replace guidance. */
+function cursorLaunchDirectory(contract) {
+  const instructions = preparedSystemPrompt(contract);
+  const revision = createHash('sha256').update(instructions).digest('hex');
+  const directory = path.join(contract.auth.runtimeHome, 'launch', revision);
+  const rules = path.join(directory, '.cursor', 'rules');
+  fs.mkdirSync(rules, { recursive: true });
+  if (instructions) {
+    const file = path.join(rules, 'amalgm.mdc');
+    const content = `---\nalwaysApply: true\n---\n${instructions}\n`;
+    try { fs.writeFileSync(file, content, { flag: 'wx', mode: 0o600 }); }
+    catch (error) {
+      if (error.code !== 'EEXIST' || fs.readFileSync(file, 'utf8') !== content) throw error;
+    }
+  }
+  return directory;
+}
+
 function resolveBinary() {
   const binaryName = process.platform === 'win32' ? 'cursor-agent.exe' : 'cursor-agent';
   const homes = [...new Set([process.env.AMALGM_NATIVE_HOME, os.homedir()].filter(Boolean))];
@@ -138,12 +152,14 @@ function pickRejectOption(options = []) {
 
 class CursorAdapter {
   constructor(options = {}) {
+    this.outputType = 'acp';
+    this.materializeAttachments = true;
     this.requestPermission = options.requestPermission || null;
     this.inputCapabilities = nativeInputCapabilities({
       authModes: ['subscription', 'byok'],
       modelSettings: [...COMMON_REASONING_SETTINGS, ...COMMON_SPEED_SETTINGS],
       tools: true,
-      instructions: 'acp_extension',
+      instructions: 'native',
     });
   }
 
@@ -153,7 +169,7 @@ class CursorAdapter {
     const client = new AcpClient({
       binary,
       args: ['acp'],
-      cwd: contract.cwd,
+      cwd: cursorLaunchDirectory(contract),
       env: runtime.env,
       label: 'Cursor',
     });
@@ -161,40 +177,44 @@ class CursorAdapter {
       sessionId: contract.sessionId,
       providerSessionId: contract.providerSessionId || null,
       client,
-      modelWarning: null,
       activePrompt: null,
       cancelRequested: false,
       permissionMode: contract.permissionMode,
       capabilities: {},
     };
-    client.onRequest((method, params) => this.handleAgentRequest(session, method, params));
-    const initialized = await client.request('initialize', {
-      protocolVersion: PROTOCOL_VERSION,
-      clientInfo: { name: 'amalgm-chat', version: '1.0.0' },
-      clientCapabilities: { fs: { readTextFile: false, writeTextFile: false } },
-    });
-    session.capabilities = initialized?.agentCapabilities || {};
-    const mcpServers = toAcpMcpServers(contract);
-    assertAcpMcpCapabilities('cursor', session.capabilities, mcpServers);
-    const sessionParams = acpSessionParams('cursor', session.capabilities, contract, mcpServers);
-    let acpSession = null;
-    if (session.providerSessionId) {
-      // session/load replays history as session/update notifications; nothing is
-      // subscribed yet, so the replay is discarded and the turn starts clean.
-      acpSession = await client.request('session/load', {
-        sessionId: session.providerSessionId,
-        ...sessionParams,
-      }, 600000).catch((err) => {
-        console.warn('[Cursor] Failed to load native session; starting a new one:', err.message);
-        return null;
+    try {
+      client.onRequest((method, params) => this.handleAgentRequest(session, method, params));
+      const initialized = await client.request('initialize', {
+        protocolVersion: PROTOCOL_VERSION,
+        clientInfo: { name: 'amalgm-chat', version: '1.0.0' },
+        clientCapabilities: { fs: { readTextFile: false, writeTextFile: false } },
       });
+      session.capabilities = initialized?.agentCapabilities || {};
+      const mcpServers = toAcpMcpServers(contract);
+      assertAcpMcpCapabilities('cursor', session.capabilities, mcpServers);
+      const sessionParams = { cwd: contract.cwd, mcpServers };
+      let acpSession = null;
+      if (session.providerSessionId) {
+        // session/load replays history as session/update notifications; nothing is
+        // subscribed yet, so the replay is discarded and the turn starts clean.
+        acpSession = await client.request('session/load', {
+          sessionId: session.providerSessionId,
+          ...sessionParams,
+        }, 600000).catch((err) => {
+          console.warn('[Cursor] Failed to load native session; starting a new one:', err.message);
+          return null;
+        });
+      }
+      if (!acpSession) {
+        acpSession = await client.request('session/new', sessionParams);
+        session.providerSessionId = acpSession.sessionId;
+      }
+      await this.selectModel(session, acpSession, contract);
+      return session;
+    } catch (error) {
+      client.close();
+      throw error;
     }
-    if (!acpSession) {
-      acpSession = await client.request('session/new', sessionParams);
-      session.providerSessionId = acpSession.sessionId;
-    }
-    await this.selectModel(session, acpSession, contract);
-    return session;
   }
 
   async selectModel(session, acpSession, contract) {
@@ -268,71 +288,24 @@ class CursorAdapter {
     session.client.close();
   }
 
-  async *prompt(session, input, contract) {
+  async *prompt(session, input, contract, effects = {}) {
     assertAcpPromptCapabilities('cursor', session.capabilities, input);
-    const queue = [];
-    let complete = false;
-    let wake = null;
-    const wakeLoop = () => { if (wake) { wake(); wake = null; } };
-    const push = (e) => {
-      if (e.type === 'done' || e.type === 'error') complete = true;
-      queue.push(e);
-      wakeLoop();
-    };
-    const state = { providerSessionId: session.providerSessionId, tools: new Map() };
-    session.cancelRequested = false;
-    session.activePrompt = state;
-    if (session.modelWarning) {
-      push(warningEvent(session.modelWarning, { providerSessionId: session.providerSessionId }));
-      session.modelWarning = null;
-    }
-    const off = session.client.onNotification((msg) => {
-      if (msg.method !== 'session/update') return;
-      const params = msg.params || {};
-      if (params.sessionId && params.sessionId !== session.providerSessionId) return;
-      recordNativeEvent('cursor.acp.update', msg, {
-        providerSessionId: session.providerSessionId,
-        sessionId: contract.sessionId,
-        assistantMessageId: contract.assistantMessageId,
-        updateKind: params.update?.sessionUpdate,
-      });
-      for (const e of normalizeCursorUpdate(params.update || {}, state)) push(e);
+    const metadata = { providerSessionId: session.providerSessionId, sessionId: contract.sessionId,
+      assistantMessageId: contract.assistantMessageId };
+    yield* runAcpPrompt(session, acpPromptParts(input), {
+      onUpdate: message => recordNativeEvent('cursor.acp.update', message, metadata),
+      onResult: async result => {
+        recordNativeEvent('cursor.acp.prompt_result', result, metadata);
+        const usage = usageFromAcpPrompt(result?.usage);
+        if (usage) await effects.recordUsage?.({ usage,
+          raw: { source: 'cursor.acp.prompt_result', payload: result } });
+      },
     });
-    session.client.request('session/prompt', {
-      sessionId: session.providerSessionId,
-      prompt: acpPromptParts(input),
-    }, 0).then((result) => {
-      recordNativeEvent('cursor.acp.prompt_result', result, {
-        providerSessionId: session.providerSessionId,
-        sessionId: contract.sessionId,
-        assistantMessageId: contract.assistantMessageId,
-      });
-      const usage = cursorPromptUsage(result?.usage, { providerSessionId: session.providerSessionId });
-      if (usage) push(usage);
-      const stopReason = session.cancelRequested ? 'cancelled' : cursorStopReason(result?.stopReason);
-      push(done({ providerSessionId: session.providerSessionId, stopReason }));
-    }).catch((err) => {
-      if (session.cancelRequested) {
-        push(done({ providerSessionId: session.providerSessionId, stopReason: 'cancelled' }));
-        return;
-      }
-      push(errorEvent(err.message, { providerSessionId: session.providerSessionId }));
-      push(done({ providerSessionId: session.providerSessionId, stopReason: 'error' }));
-    });
-    try {
-      while (!complete || queue.length) {
-        if (!queue.length) await new Promise((resolve) => { wake = resolve; });
-        else yield queue.shift();
-      }
-    } finally {
-      off();
-      session.activePrompt = null;
-      session.cancelRequested = false;
-    }
   }
 }
 
 const __private = {
+  cursorLaunchDirectory,
   matchAcpModel,
   pickPermissionOption,
   resolveBinary,

package/host/adapters/opencode.js

@@ -8,6 +8,7 @@ import path from 'node:path';
 import { createEventConstructors } from '../../dist/events/index.js';
 import { createOpenCodeNormalizer } from '../../dist/normalizers/opencode.js';
 import { recordNativeEvent } from '../recorder.js';
+import { directProviderModelId } from '../model-resolution.js';
 import { toOpenCodeMcpConfig } from '../tooling/mcp-bundle.js';
 import { bundledOpenCodeBinary, executableExists, findOnPath } from '../tooling/native-binaries.js';
 import { importPackage } from '../tooling/package-import.js';
@@ -16,6 +17,7 @@ import { preparedSystemPrompt } from '../tooling/system-prompt.js';
 import { requestPermission } from '../permissions.js';
 import { nativeInputCapabilities, UnsupportedExecutionInputError } from './input-capabilities.js';
 import { openCodePromptParts } from './prompt.js';
+import { providerBaseUrl } from './provider-url.js';
 
 const events = createEventConstructors({ clockMs: () => Date.now() });
 const { done, errorEvent, reasoningStarted } = events;
@@ -31,7 +33,7 @@ function splitModel(model, auth) {
   if (auth?.method === 'byok' && auth?.providerKind === 'anthropic_compatible') {
     const bare = raw.replace(/^vercel\//, '').replace(/^anthropic\//, '');
     const modelID = bare.startsWith('anthropic/') ? bare.slice('anthropic/'.length) : bare;
-    return { providerID: 'anthropic', modelID };
+    return { providerID: 'anthropic', modelID: directProviderModelId('anthropic', modelID) };
   }
   if (raw.startsWith('vercel/')) {
     return { providerID: 'vercel', modelID: raw.slice('vercel/'.length) };
@@ -99,11 +101,12 @@ function configFor(contract) {
     mcp: toOpenCodeMcpConfig(contract),
   };
   if (contract.authMethod !== 'provider_auth') {
+    const baseUrl = providerBaseUrl(contract.auth.baseUrl, model.providerID === 'vercel' ? '/v3/ai' : '/v1');
     config.provider = {
       [model.providerID]: {
         options: {
-          baseURL: contract.auth.baseUrl,
-          baseUrl: contract.auth.baseUrl,
+          baseURL: baseUrl,
+          baseUrl,
           apiKey: contract.auth.tokenRef,
           timeout: 300000,
           chunkTimeout: 300000,
@@ -258,31 +261,42 @@ class OpenCodeAdapter {
 
   async create(contract) {
     const instance = await this.startInstance(contract);
-    let created = null;
-    if (contract.providerSessionId) {
-      try {
-        created = resultData(await instance.client.session.get({
-          path: { id: contract.providerSessionId },
+    try {
+      const selected = splitModel(contract.cliModel || contract.usageModelId, contract.auth);
+      const catalog = resultData(await instance.client.provider.list({ query: { directory: contract.cwd } }));
+      const model = catalog?.all?.find(provider => provider.id === selected.providerID)?.models?.[selected.modelID];
+      const contextLimit = Number(model?.limit?.context) || undefined;
+      let created = null;
+      if (contract.providerSessionId) {
+        try {
+          created = resultData(await instance.client.session.get({
+            path: { id: contract.providerSessionId },
+            query: { directory: contract.cwd },
+          }));
+        } catch (err) {
+          console.warn('[OpenCode] Failed to resume persisted session; creating a new native session:', err.message);
+        }
+      }
+      if (!created) {
+        created = resultData(await instance.client.session.create({
+          body: { title: `Amalgm ${contract.sessionId}` },
           query: { directory: contract.cwd },
         }));
-      } catch (err) {
-        console.warn('[OpenCode] Failed to resume persisted session; creating a new native session:', err.message);
       }
+      if (!created?.id) throw new Error('OpenCode SDK did not return a session id');
+      return {
+        sessionId: contract.sessionId,
+        providerSessionId: created.id,
+        instance,
+        abortController: null,
+        turnCount: 0,
+        contextLimit,
+      };
+    } catch (error) {
+      instance.server.close();
+      instance.closed = true;
+      throw error;
     }
-    if (!created) {
-      created = resultData(await instance.client.session.create({
-        body: { title: `Amalgm ${contract.sessionId}` },
-        query: { directory: contract.cwd },
-      }));
-    }
-    if (!created?.id) throw new Error('OpenCode SDK did not return a session id');
-    return {
-      sessionId: contract.sessionId,
-      providerSessionId: created.id,
-      instance,
-      abortController: null,
-      turnCount: 0,
-    };
   }
 
   async resume(session, contract) {
@@ -314,7 +328,7 @@ class OpenCodeAdapter {
       providerSessionId: session.providerSessionId,
       userMessageId: null,
       turnStartedAt: Date.now(),
-      contextLimit: Number(contract.contextWindow || 0) || undefined,
+      contextLimit: session.contextLimit || Number(contract.contextWindow || 0) || undefined,
       messageRoles: new Map(),
       partTypes: new Map(),
       partText: new Map(),

package/host/adapters/pi.js

@@ -12,6 +12,7 @@ import { createEventConstructors } from '../../dist/events/index.js';
 import { createPiNormalizer } from '../../dist/normalizers/pi.js';
 import { allowed, requestPermission } from '../permissions.js';
 import { recordNativeEvent } from '../recorder.js';
+import { directProviderModelId } from '../model-resolution.js';
 import { relayedMcpServers } from '../tooling/mcp-bundle.js';
 import { executableExists, findOnPath } from '../tooling/native-binaries.js';
 import { prepareHarnessRuntime } from '../tooling/runtime-home.js';
@@ -22,6 +23,7 @@ import {
   UnsupportedExecutionInputError,
 } from './input-capabilities.js';
 import { piPrompt } from './prompt.js';
+import { providerBaseUrl } from './provider-url.js';
 
 const events = createEventConstructors({ clockMs: () => Date.now() });
 const { done, errorEvent } = events;
@@ -190,18 +192,15 @@ function resolveBinary() {
   throw new Error(`Pi CLI is not available. Checked: ${failures.join(', ') || 'no candidates'}. Install it with: npm install -g @mariozechner/pi-coding-agent`);
 }
 
-// Under amalgm auth every gateway request must flow through the local egress
-// proxy. Pi's provider baseUrl is overridden by a tiny extension; the URL rides
-// in on an env var so the extension file itself is static.
-function ensureEgressExtension(runtimeHome) {
-  const file = path.join(runtimeHome, '.pi', 'amalgm-egress-extension.js');
+// Every explicitly authenticated provider uses its prepared endpoint.
+function ensureProviderExtension(runtimeHome, provider) {
+  const file = path.join(runtimeHome, '.pi', 'amalgm-provider-extension.js');
   fs.mkdirSync(path.dirname(file), { recursive: true });
   const source = [
-    '// Generated by @amalgm/chat: routes the Vercel AI Gateway provider',
-    '// through the per-session amalgm egress proxy for billing and audit.',
+    '// Generated by @amalgm/chat: uses the prepared provider endpoint.',
     'export default function (pi) {',
-    '  const baseUrl = process.env.AMALGM_PI_GATEWAY_BASE_URL;',
-    `  if (baseUrl) pi.registerProvider(${JSON.stringify(GATEWAY_PROVIDER)}, { baseUrl });`,
+    '  const baseUrl = process.env.AMALGM_PI_PROVIDER_BASE_URL;',
+    `  if (baseUrl) pi.registerProvider(${JSON.stringify(provider)}, { baseUrl });`,
     '}',
     '',
   ].join('\n');
@@ -210,7 +209,7 @@ function ensureEgressExtension(runtimeHome) {
 }
 
 function piProvider(contract) {
-  if (contract.authMethod === 'amalgm') return GATEWAY_PROVIDER;
+  if (contract.authMethod === 'amalgm' || contract.auth?.providerKind === 'ai_gateway') return GATEWAY_PROVIDER;
   const provider = String(contract.providerId || '').trim();
   if (provider === 'vercel' || provider === 'ai-gateway' || provider === 'ai_gateway') return GATEWAY_PROVIDER;
   return provider;
@@ -218,11 +217,11 @@ function piProvider(contract) {
 
 function piModel(contract, provider) {
   const model = String(contract.providerModelId || contract.cliModel || '').trim();
-  if (provider === GATEWAY_PROVIDER && contract.authMethod === 'amalgm' && !model.includes('/')) {
+  if (provider === GATEWAY_PROVIDER && !model.includes('/')) {
     return `${contract.providerId}/${model}`;
   }
-  if (provider !== GATEWAY_PROVIDER && model.startsWith(`${provider}/`)) return model.slice(provider.length + 1);
-  return model;
+  if (provider === GATEWAY_PROVIDER) return model;
+  return directProviderModelId(provider, model.startsWith(`${provider}/`) ? model.slice(provider.length + 1) : model);
 }
 
 const PI_KEY_ENV = Object.freeze({
@@ -341,13 +340,15 @@ function thinkingLevelFor(contract) {
 
 function buildArgs(contract, runtimeHome) {
   const provider = piProvider(contract);
-  const args = ['--mode', 'rpc', '--provider', provider, '--model', piModel(contract, provider)];
+  const args = ['--mode', 'rpc', '--no-extensions', '--provider', provider, '--model', piModel(contract, provider)];
   const thinking = thinkingLevelFor(contract);
   if (thinking) args.push('--thinking', thinking);
   const systemPrompt = preparedSystemPrompt(contract);
   if (systemPrompt) args.push('--system-prompt', systemPrompt);
   if (contract.providerSessionId) args.push('--session', contract.providerSessionId);
-  if (contract.authMethod === 'amalgm') args.push('--extension', ensureEgressExtension(runtimeHome));
+  if (contract.authMethod !== 'provider_auth' && contract.auth?.baseUrl) {
+    args.push('--extension', ensureProviderExtension(runtimeHome, provider));
+  }
   const hasSelectedTools = Array.isArray(contract.mcpServers) && contract.mcpServers.length > 0;
   if (contract.permissionMode === 'ask' || hasSelectedTools) {
     args.push('--extension', ensureAmalgmExtension(runtimeHome, contract));
@@ -377,8 +378,9 @@ class PiAdapter {
     const env = { ...runtime.env };
     const provider = piProvider(contract);
     applyPiByokEnvironment(env, contract, provider);
-    if (contract.authMethod === 'amalgm' && contract.auth.baseUrl) {
-      env.AMALGM_PI_GATEWAY_BASE_URL = contract.auth.baseUrl;
+    if (contract.authMethod !== 'provider_auth' && contract.auth.baseUrl) {
+      env.AMALGM_PI_PROVIDER_BASE_URL = providerBaseUrl(contract.auth.baseUrl,
+        provider === 'anthropic' || provider === GATEWAY_PROVIDER ? '' : '/v1');
     }
     const client = new PiRpc({
       binary,
@@ -476,7 +478,10 @@ class PiAdapter {
         eventType: event?.type,
       });
       if (event?.type === 'agent_end') {
-        finish().catch(() => push(done({ providerSessionId: session.providerSessionId, stopReason: 'end_turn' })));
+        finish().catch((error) => {
+          push(errorEvent(error.message, { providerSessionId: session.providerSessionId }));
+          push(done({ providerSessionId: session.providerSessionId, stopReason: 'error' }));
+        });
         return;
       }
       for (const e of normalizePiEvent(event, state)) {
@@ -510,7 +515,7 @@ const __private = {
   applyPiByokEnvironment,
   buildArgs,
   ensureAmalgmExtension,
-  ensureEgressExtension,
+  ensureProviderExtension,
   piModel,
   piProvider,
   resolveBinary,

package/host/adapters/prompt.js

@@ -156,35 +156,27 @@ export function claudePrompt(prompt) {
   }());
 }
 
+function openCodeMediaType(mime) {
+  return /^(image|audio)\//.test(mime) || mime === 'application/pdf';
+}
+
 export function openCodePromptParts(prompt) {
-  return prompt.parts.map((part) => {
+  return prompt.parts.map((part, index) => {
     if (part.type === 'text') return { type: 'text', text: part.text };
     if (part.type === 'resource_link') {
-      return {
-        type: 'file',
-        mime: mimeOf(part),
-        filename: resourceName(part),
-        url: part.uri,
-      };
+      if (!openCodeMediaType(mimeOf(part))) return { type: 'text', text: linkedText(part) };
+      return { type: 'file', mime: mimeOf(part), filename: resourceName(part), url: part.uri };
     }
     if (part.type === 'image' || part.type === 'audio') {
-      return {
-        type: 'file',
-        mime: part.mimeType,
-        url: dataUrl(part.mimeType, part.data),
-      };
+      return { type: 'file', mime: part.mimeType, url: dataUrl(part.mimeType, part.data) };
     }
     const resource = part.resource;
+    if (typeof resource.text === 'string') return { type: 'text', text: embeddedText(part) };
     const mime = mimeOf(part);
-    const data = typeof resource.text === 'string'
-      ? Buffer.from(resource.text, 'utf8').toString('base64')
-      : resource.blob;
-    return {
-      type: 'file',
-      mime,
-      filename: resourceName(part),
-      url: dataUrl(mime, data),
-    };
+    if (!openCodeMediaType(mime)) {
+      throw new UnsupportedPromptPartError('opencode', index, part, `embedded ${mime} requires host file materialization`);
+    }
+    return { type: 'file', mime, filename: resourceName(part), url: dataUrl(mime, resource.blob) };
   });
 }
 

package/host/adapters/provider-url.js

@@ -0,0 +1,8 @@
+/** Project a configured provider base onto the path consumed by its SDK. */
+export function providerBaseUrl(baseUrl, apiPath) {
+  if (!baseUrl) return baseUrl;
+  const url = new URL(baseUrl);
+  const root = url.pathname.replace(/\/+$/, '').replace(/\/(?:v1|v3\/ai)$/, '');
+  url.pathname = root + apiPath;
+  return url.href.replace(/\/$/, '');
+}

package/host/auth.js

@@ -112,12 +112,14 @@ function providerAuthIdentity(harness) {
   return `${harness || 'provider'}:provider-default`;
 }
 
-function runtimeHome({ runtimeHomeRoot, harness, agentConfigId }) {
+function runtimeHome({ runtimeHomeRoot, harness, agentConfigId, method, authority }) {
   const harnessHome = path.join(runtimeHomeRoot, safePathSegment(harness));
   return path.join(
     harnessHome,
     'agents',
     safePathSegment(agentConfigId || harness),
+    'auth',
+    `${method}-${fingerprint(authority)}`,
     'home',
   );
 }
@@ -139,7 +141,7 @@ export function authEnvelope({
   agentConfigId,
 }) {
   const supported = AUTH_METHODS[harness];
-  if (supported && !supported.includes(authMethod)) {
+  if (!['amalgm', 'byok', 'provider_auth'].includes(authMethod) || (supported && !supported.includes(authMethod))) {
     throw new Error(`${harness} does not support ${authMethod} auth`);
   }
   const method = authMethod;
@@ -185,7 +187,8 @@ export function authEnvelope({
   } else if (method === 'provider_auth') {
     tokenFingerprint = providerAuthFingerprint(harness);
   }
-  const runtimeHomePath = runtimeHome({ runtimeHomeRoot, harness, agentConfigId });
+  const authority = method === 'amalgm' ? proxyBaseUrl : `${baseUrl || ''}:${tokenFingerprint || ''}`;
+  const runtimeHomePath = runtimeHome({ runtimeHomeRoot, harness, agentConfigId, method, authority });
   return {
     method,
     baseUrl,
@@ -201,17 +204,15 @@ export function authEnvelope({
 
 function safeBaseEnv(baseEnv = process.env) {
   const env = {};
-  for (const key of ['PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'LANG', 'LC_ALL', 'TERM', 'TMPDIR']) {
+  for (const key of ['PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'LANG', 'LC_ALL', 'TERM', 'TMPDIR',
+    'HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'NO_PROXY', 'SSL_CERT_FILE', 'NODE_EXTRA_CA_CERTS']) {
     if (baseEnv[key]) env[key] = baseEnv[key];
   }
   return env;
 }
 
 export function runtimeEnv(contract, baseEnv = process.env) {
-  const env = contract.authMethod === 'provider_auth' ? { ...baseEnv } : safeBaseEnv(baseEnv);
-  for (const key of ['OPENAI_API_KEY', 'OPENAI_BASE_URL', 'ANTHROPIC_API_KEY', 'ANTHROPIC_BASE_URL', 'AI_GATEWAY_API_KEY', 'AI_GATEWAY_BASE_URL', 'CURSOR_API_KEY', 'CURSOR_AUTH_TOKEN']) {
-    delete env[key];
-  }
+  const env = safeBaseEnv(baseEnv);
   if (contract.auth.runtimeHome) {
     fs.mkdirSync(contract.auth.runtimeHome, { recursive: true });
     env.HOME = contract.auth.runtimeHome;
@@ -248,7 +249,7 @@ export function runtimeEnv(contract, baseEnv = process.env) {
       // Pi keys the vercel-ai-gateway provider on this env var; base-URL
       // overrides ride through the generated egress extension instead.
       env.AI_GATEWAY_API_KEY = contract.auth.tokenRef || '';
-    } else {
+    } else if (contract.harness === 'codex') {
       env.OPENAI_API_KEY = contract.auth.tokenRef || '';
       if (contract.auth.baseUrl) env.OPENAI_BASE_URL = contract.auth.baseUrl;
     }

package/host/http.js

@@ -96,7 +96,8 @@ async function streamTurn(response, updates, completion) {
     const turn = await (typeof completion === 'function' ? completion() : completion);
     writeSse(response, 'complete', turn);
   } catch (error) {
-    writeSse(response, 'error', errorBody(error).error);
+    if (error?.turn) writeSse(response, 'complete', error.turn);
+    else writeSse(response, 'error', errorBody(error).error);
   } finally {
     if (!response.destroyed) response.end();
   }
@@ -130,7 +131,7 @@ export function createChatHttpHandler(options) {
   if (!options?.chat) throw new TypeError('createChatHttpHandler requires chat');
   const chat = options.chat;
   const prefix = String(options.prefix || '/chat').replace(/\/$/, '');
-  const bodyLimit = options.bodyLimitBytes || 2_000_000;
+  const bodyLimit = options.bodyLimitBytes || 64 * 1024 * 1024;
 
   return async function handleChatHttp(request, response) {
     const url = new URL(request.url || '/', 'http://localhost');

package/host/model-resolution.js

@@ -124,6 +124,13 @@ function selectedModelId(contract) {
   return modelId.startsWith(`${providerId}/`) ? modelId : `${providerId}/${modelId}`;
 }
 
+/** Direct Anthropic APIs use hyphenated versions; gateways use dotted ids. */
+export function directProviderModelId(providerId, modelId) {
+  return providerId === 'anthropic'
+    ? modelId.replace(/-(\d+)\.(\d+)(?=$|-)/g, '-$1-$2')
+    : modelId;
+}
+
 export function gatewayModelId(raw) {
   let bare = String(raw || '').trim()
     .replace(/^opencode-/, '')

package/host/native-contract.js

@@ -5,7 +5,7 @@ import { authEnvelope } from './auth.js';
 import { amalgmDir } from './lib/runtime-paths.js';
 import { resolveNativeModel } from './model-resolution.js';
 import { normalizeAcpMcpServers } from './tooling/mcp-bundle.js';
-import { composeSystemPrompt } from './tooling/system-prompt.js';
+import { composeSystemPrompt, toolSystemInstructions } from './tooling/system-prompt.js';
 
 export { nativeModel } from './model-resolution.js';
 
@@ -58,7 +58,7 @@ export class NativeExecutionPreparer {
     }));
     this.resolveInstructions = options.resolveInstructions || (async (contract, agent) => composeSystemPrompt(
       { compiledAgentInstructions: agent?.compiledAgentInstructions || '' },
-      { projectContextPromptBlock: options.projectContextPromptBlock },
+      { amalgmDir: this.amalgmDir, projectContextPromptBlock: options.projectContextPromptBlock },
     ));
     this.validateModel = options.validateModel || (async () => undefined);
     this.resolveModel = options.resolveModel || resolveNativeModel;
@@ -141,7 +141,8 @@ export class NativeExecutionPreparer {
       mode: contract.auth.mode,
       bindingId: contract.auth.bindingId,
     });
-    const instructionText = String(await this.resolveInstructions(contract, agent) || '').trim();
+    const instructionText = [String(await this.resolveInstructions(contract, agent) || '').trim(), toolSystemInstructions(tools)]
+      .filter(Boolean).join('\n\n');
     const instructions = Object.freeze({
       text: instructionText,
       revisionId: instructionText