@cloudcli-ai/cloudcli 1.36.2 → 1.37.0

package/server/modules/providers/list/cursor/cursor-sessions.provider.ts

@@ -2,7 +2,7 @@ import crypto from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
 
-import { parseImagesInputTag } from '@/shared/image-attachments.js';
+import { parseFilesInputTag, parseImagesInputTag } from '@/shared/image-attachments.js';
 import type { IProviderSessions } from '@/shared/interfaces.js';
 import type { AnyRecord, FetchHistoryOptions, FetchHistoryResult, NormalizedMessage } from '@/shared/types.js';
 import {
@@ -85,16 +85,22 @@ function unwrapUserQueryText(value: string, role: 'user' | 'assistant'): string
 function extractUserTextAndImages(
   value: string,
   role: 'user' | 'assistant',
-): { text: string; images?: Array<{ path: string; name?: string }> } {
+): {
+  text: string;
+  images?: Array<{ path: string; name?: string }>;
+  files?: Array<{ path: string; name?: string }>;
+} {
   const unwrapped = unwrapUserQueryText(value, role);
   if (role !== 'user') {
     return { text: unwrapped };
   }
 
-  const { text, attachments } = parseImagesInputTag(unwrapped);
+  const parsedImages = parseImagesInputTag(unwrapped);
+  const parsedFiles = parseFilesInputTag(parsedImages.text);
   return {
-    text,
-    images: attachments.length > 0 ? attachments : undefined,
+    text: parsedFiles.text,
+    images: parsedImages.attachments.length > 0 ? parsedImages.attachments : undefined,
+    files: parsedFiles.attachments.length > 0 ? parsedFiles.attachments : undefined,
   };
 }
 
@@ -471,16 +477,18 @@ export class CursorSessionsProvider implements IProviderSessions {
                 text = unwrapUserQueryText(content.message.content, role);
               }
             }
-            const { text: cleanText, images } = role === 'user'
+            const { text: cleanText, images, files } = role === 'user'
               ? (() => {
-                const parsed = parseImagesInputTag(text);
+                const parsedImages = parseImagesInputTag(text);
+                const parsedFiles = parseFilesInputTag(parsedImages.text);
                 return {
-                  text: parsed.text,
-                  images: parsed.attachments.length > 0 ? parsed.attachments : undefined,
+                  text: parsedFiles.text,
+                  images: parsedImages.attachments.length > 0 ? parsedImages.attachments : undefined,
+                  files: parsedFiles.attachments.length > 0 ? parsedFiles.attachments : undefined,
                 };
               })()
-              : { text, images: undefined };
-            if (cleanText?.trim() || images) {
+              : { text, images: undefined, files: undefined };
+            if (cleanText?.trim() || images || files) {
               messages.push(createNormalizedMessage({
                 id: baseId,
                 sessionId,
@@ -490,6 +498,7 @@ export class CursorSessionsProvider implements IProviderSessions {
                 role,
                 content: cleanText,
                 images,
+                files,
                 sequence: blob.sequence,
                 rowid: blob.rowid,
               }));
@@ -541,8 +550,8 @@ export class CursorSessionsProvider implements IProviderSessions {
             }
 
             if (part?.type === 'text' && part?.text) {
-              const { text: normalizedPartText, images } = extractUserTextAndImages(part.text, role);
-              if (!normalizedPartText && !images) {
+              const { text: normalizedPartText, images, files } = extractUserTextAndImages(part.text, role);
+              if (!normalizedPartText && !images && !files) {
                 continue;
               }
               messages.push(createNormalizedMessage({
@@ -554,6 +563,7 @@ export class CursorSessionsProvider implements IProviderSessions {
                 role,
                 content: normalizedPartText,
                 images,
+                files,
                 sequence: blob.sequence,
                 rowid: blob.rowid,
               }));
@@ -593,8 +603,8 @@ export class CursorSessionsProvider implements IProviderSessions {
           && content.content.trim()
           && !isInternalCursorText(content.content)
         ) {
-          const { text: normalizedText, images } = extractUserTextAndImages(content.content, role);
-          if (!normalizedText && !images) {
+          const { text: normalizedText, images, files } = extractUserTextAndImages(content.content, role);
+          if (!normalizedText && !images && !files) {
             continue;
           }
           messages.push(createNormalizedMessage({
@@ -606,6 +616,7 @@ export class CursorSessionsProvider implements IProviderSessions {
             role,
             content: normalizedText,
             images,
+            files,
             sequence: blob.sequence,
             rowid: blob.rowid,
           }));

package/server/modules/providers/list/cursor/cursor.provider.ts

@@ -1,6 +1,7 @@
 import { AbstractProvider } from '@/modules/providers/shared/base/abstract.provider.js';
 import { CursorProviderAuth } from '@/modules/providers/list/cursor/cursor-auth.provider.js';
 import { CursorProviderModels } from '@/modules/providers/list/cursor/cursor-models.provider.js';
+import { cursorRuntime } from '@/modules/providers/list/cursor/cursor-runtime.provider.js';
 import { CursorMcpProvider } from '@/modules/providers/list/cursor/cursor-mcp.provider.js';
 import { CursorSessionSynchronizer } from '@/modules/providers/list/cursor/cursor-session-synchronizer.provider.js';
 import { CursorSessionsProvider } from '@/modules/providers/list/cursor/cursor-sessions.provider.js';
@@ -8,12 +9,14 @@ import { CursorSkillsProvider } from '@/modules/providers/list/cursor/cursor-ski
 import type {
   IProviderAuth,
   IProviderModels,
+  IProviderRuntime,
   IProviderSessionSynchronizer,
   IProviderSkills,
   IProviderSessions,
 } from '@/shared/interfaces.js';
 
 export class CursorProvider extends AbstractProvider {
+  readonly runtime: IProviderRuntime = cursorRuntime;
   readonly models: IProviderModels = new CursorProviderModels();
   readonly mcp = new CursorMcpProvider();
   readonly auth: IProviderAuth = new CursorProviderAuth();

package/server/modules/providers/list/opencode/opencode-models.provider.ts

@@ -1,20 +1,18 @@
 import Database from 'better-sqlite3';
 import crossSpawn from 'cross-spawn';
 
+import { sessionsDb } from '@/modules/database/index.js';
 import type { IProviderModels } from '@/shared/interfaces.js';
 import type {
-  ProviderChangeActiveModelInput,
   ProviderCurrentActiveModel,
   ProviderModelOption,
   ProviderModelsDefinition,
-  ProviderSessionActiveModelChange,
 } from '@/shared/types.js';
 import {
   buildDefaultProviderCurrentActiveModel,
   getOpenCodeDatabasePath,
   readObjectRecord,
   readOptionalString,
-  writeProviderSessionActiveModelChange,
 } from '@/shared/utils.js';
 
 export const OPENCODE_FALLBACK_MODELS: ProviderModelsDefinition = {
@@ -464,6 +462,11 @@ export class OpenCodeProviderModels implements IProviderModels {
       return buildDefaultProviderCurrentActiveModel(await this.getSupportedModels());
     }
 
+    // OpenCode's `session` table is keyed by its own session id, so the stable
+    // app id has to be translated first; sessions discovered on disk store the
+    // provider id in both columns and resolve to themselves.
+    const providerSessionId = sessionsDb.getSessionById(sessionId)?.provider_session_id ?? sessionId;
+
     try {
       const dbPath = getOpenCodeDatabasePath();
       const db = new Database(dbPath, { readonly: true, fileMustExist: true });
@@ -481,7 +484,7 @@ export class OpenCodeProviderModels implements IProviderModels {
           WHERE s.id = ?
           ORDER BY COALESCE(s.time_updated, s.time_created, 0) DESC
           LIMIT 1
-        `).get(sessionId) as {
+        `).get(providerSessionId) as {
           sessionId?: string;
           model?: unknown;
           agent?: string | null;
@@ -505,10 +508,4 @@ export class OpenCodeProviderModels implements IProviderModels {
 
     return buildDefaultProviderCurrentActiveModel(await this.getSupportedModels());
   }
-
-  async changeActiveModel(
-    input: ProviderChangeActiveModelInput,
-  ): Promise<ProviderSessionActiveModelChange> {
-    return writeProviderSessionActiveModelChange('opencode', input);
-  }
 }

package/server/{opencode-cli.js → modules/providers/list/opencode/opencode-runtime.provider.js}

@@ -3,12 +3,13 @@ import fsSync from 'node:fs';
 import crossSpawn from 'cross-spawn';
 import Database from 'better-sqlite3';
 
-import { appendImagesInputTag } from './shared/image-attachments.js';
-import { sessionsService } from './modules/providers/services/sessions.service.js';
-import { providerAuthService } from './modules/providers/services/provider-auth.service.js';
-import { providerModelsService } from './modules/providers/services/provider-models.service.js';
-import { notifyRunFailed, notifyRunStopped } from './services/notification-orchestrator.js';
-import { createCompleteMessage, createNormalizedMessage, flattenPromptForWindowsShell, getOpenCodeDatabasePath } from './shared/utils.js';
+import {
+  appendFilesInputTag,
+  appendImagesInputTag,
+  normalizeAttachmentDescriptors
+} from '@/shared/image-attachments.js';
+import { notifyRunFailed, notifyRunStopped } from '@/modules/notifications/index.js';
+import { createCompleteMessage, createNormalizedMessage, flattenPromptForWindowsShell, getOpenCodeDatabasePath } from '@/shared/utils.js';
 
 // cross-spawn resolves .cmd shims/PATHEXT on Windows and delegates to
 // child_process.spawn everywhere else.
@@ -122,12 +123,27 @@ function readOpenCodeTokenUsage(sessionId) {
   }
 }
 
-async function spawnOpenCode(command, options = {}, ws) {
+async function spawnOpenCode(command, options = {}, ws, context) {
   return new Promise((resolve, reject) => {
-    const { sessionId, projectPath, cwd, model, effort, sessionSummary, images, permissionMode } = options;
+    const {
+      sessionId,
+      projectPath,
+      cwd,
+      model,
+      effort,
+      sessionSummary,
+      images,
+      files,
+      permissionMode
+    } = options;
+    // Callers pass the stable app session id; the CLI resumes with the
+    // provider-native id recorded on the session row.
+    const providerSessionId = context.resolveProviderSessionId(sessionId);
     const workingDir = cwd || projectPath || process.cwd();
+    // Process-map key: the app session id when the caller supplied one, so
+    // abort-by-app-id always works.
     const processKey = sessionId || Date.now().toString();
-    let capturedSessionId = sessionId || null;
+    let capturedSessionId = providerSessionId;
     let sessionCreatedSent = false;
     let stdoutLineBuffer = '';
     let terminalNotificationSent = false;
@@ -142,7 +158,8 @@ async function spawnOpenCode(command, options = {}, ws) {
       }
 
       terminalNotificationSent = true;
-      const finalSessionId = capturedSessionId || sessionId || processKey;
+      // Notifications are app-facing, so they carry the app session id.
+      const finalSessionId = sessionId || capturedSessionId || processKey;
       if (code === 0 && !error) {
         notifyRunStopped({
           userId: ws?.userId || null,
@@ -169,7 +186,9 @@ async function spawnOpenCode(command, options = {}, ws) {
       }
 
       capturedSessionId = nextSessionId;
-      if (processKey !== capturedSessionId && opencodeProcess) {
+      // Legacy/direct callers without an app session id re-key the process
+      // under the provider-native id once it is known.
+      if (!sessionId && processKey !== capturedSessionId && opencodeProcess) {
         activeOpenCodeProcesses.delete(processKey);
         activeOpenCodeProcesses.set(capturedSessionId, opencodeProcess);
       }
@@ -181,7 +200,7 @@ async function spawnOpenCode(command, options = {}, ws) {
         ws.setSessionId(capturedSessionId);
       }
 
-      if (!sessionId && !sessionCreatedSent) {
+      if (!providerSessionId && !sessionCreatedSent) {
         sessionCreatedSent = true;
         ws.send(createNormalizedMessage({
           kind: 'session_created',
@@ -212,11 +231,7 @@ async function spawnOpenCode(command, options = {}, ws) {
 
       try {
         registerSession(readOpenCodeSessionId(response));
-        const normalized = sessionsService.normalizeMessage(
-          'opencode',
-          response,
-          capturedSessionId || sessionId || null,
-        );
+        const normalized = context.normalizeMessage(response, capturedSessionId || sessionId || null);
         for (const msg of normalized) {
           ws.send(msg);
         }
@@ -232,10 +247,10 @@ async function spawnOpenCode(command, options = {}, ws) {
       }
     };
 
-    void providerModelsService.resolveResumeModel('opencode', sessionId, model).then(async (resolvedModel) => {
+    void context.resolveResumeModel(sessionId, model).then(async (resolvedModel) => {
       let effortModels = null;
       try {
-        effortModels = (await providerModelsService.getProviderModels('opencode')).models;
+        effortModels = await context.getProviderModels();
       } catch (error) {
         console.warn('[OpenCode] Unable to load provider models for effort validation:', error);
       }
@@ -246,8 +261,8 @@ async function spawnOpenCode(command, options = {}, ws) {
       // Relying on the child-process cwd alone is not enough on Linux, where
       // the CLI can still resolve the session under the server install dir.
       args.push('--dir', workingDir);
-      if (sessionId) {
-        args.push('--session', sessionId);
+      if (providerSessionId) {
+        args.push('--session', providerSessionId);
       }
       if (resolvedModel) {
         args.push('--model', resolvedModel);
@@ -257,12 +272,19 @@ async function spawnOpenCode(command, options = {}, ws) {
       }
       const permissionOptions = resolveOpenCodePermissionOptions(permissionMode);
       args.push(...permissionOptions.args);
-      if (command && command.trim()) {
+      const hasAttachments =
+        normalizeAttachmentDescriptors(images).length > 0
+        || normalizeAttachmentDescriptors(files).length > 0;
+      if ((command && command.trim()) || hasAttachments) {
         // Image attachments ride along as an <images_input> path list appended
         // to the prompt; the session history reader strips the tag back out.
         // opencode is a .cmd shim on Windows, so the whole argument must be
         // newline-free or cmd.exe silently truncates it at the first newline.
-        args.push(flattenPromptForWindowsShell(appendImagesInputTag(command.trim(), images)));
+        const promptWithAttachments = appendFilesInputTag(
+          appendImagesInputTag(command?.trim() || '', images),
+          files
+        );
+        args.push(flattenPromptForWindowsShell(promptWithAttachments));
       }
 
       opencodeProcess = spawnFunction('opencode', args, {
@@ -300,7 +322,7 @@ async function spawnOpenCode(command, options = {}, ws) {
       });
 
       opencodeProcess.on('close', async (code) => {
-        const finalSessionId = capturedSessionId || sessionId || processKey;
+        const finalSessionId = sessionId || capturedSessionId || processKey;
         activeOpenCodeProcesses.delete(finalSessionId);
         activeOpenCodeProcesses.delete(processKey);
 
@@ -309,7 +331,8 @@ async function spawnOpenCode(command, options = {}, ws) {
           stdoutLineBuffer = '';
         }
 
-        const tokenBudget = readOpenCodeTokenUsage(finalSessionId);
+        // OpenCode's own database is keyed by the provider-native id.
+        const tokenBudget = readOpenCodeTokenUsage(capturedSessionId);
         if (tokenBudget) {
           ws.send(createNormalizedMessage({
             kind: 'status',
@@ -334,7 +357,7 @@ async function spawnOpenCode(command, options = {}, ws) {
         }
 
         if (code === 127 || code === null) {
-          const installed = await providerAuthService.isProviderInstalled('opencode');
+          const installed = await context.isProviderInstalled();
           if (!installed) {
             ws.send(createNormalizedMessage({
               kind: 'error',
@@ -350,11 +373,11 @@ async function spawnOpenCode(command, options = {}, ws) {
       });
 
       opencodeProcess.on('error', async (error) => {
-        const finalSessionId = capturedSessionId || sessionId || processKey;
+        const finalSessionId = sessionId || capturedSessionId || processKey;
         activeOpenCodeProcesses.delete(finalSessionId);
         activeOpenCodeProcesses.delete(processKey);
 
-        const installed = await providerAuthService.isProviderInstalled('opencode');
+        const installed = await context.isProviderInstalled();
         const errorContent = !installed
           ? 'OpenCode CLI is not installed. Install it from https://opencode.ai/docs/'
           : error.message;
@@ -398,6 +421,11 @@ function getActiveOpenCodeSessions() {
   return Array.from(activeOpenCodeProcesses.keys());
 }
 
+export const opencodeRuntime = {
+  run: spawnOpenCode,
+  abort: abortOpenCodeSession,
+};
+
 export {
   spawnOpenCode,
   abortOpenCodeSession,

package/server/{opencode-cli.test.js → modules/providers/list/opencode/opencode-runtime.provider.test.js}

@@ -4,7 +4,20 @@ import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
 
-import { resolveOpenCodePermissionOptions, spawnOpenCode } from './opencode-cli.js';
+import {
+  opencodeRuntime,
+  resolveOpenCodePermissionOptions,
+} from './opencode-runtime.provider.js';
+import { OpenCodeSessionsProvider } from './opencode-sessions.provider.js';
+
+const sessionsProvider = new OpenCodeSessionsProvider();
+const runtimeContext = {
+  resolveProviderSessionId: (sessionId) => sessionId || null,
+  resolveResumeModel: async (_sessionId, requestedModel) => requestedModel || undefined,
+  getProviderModels: async () => ({ OPTIONS: [], DEFAULT: '' }),
+  normalizeMessage: (raw, sessionId) => sessionsProvider.normalizeMessage(raw, sessionId),
+  isProviderInstalled: async () => true,
+};
 
 const findEnvKey = (name) =>
   Object.keys(process.env).find((key) => key.toLowerCase() === name.toLowerCase()) || name;
@@ -71,7 +84,7 @@ test('spawnOpenCode emits session_created before normalized live messages for ne
         : `.COM;.EXE;.BAT;.CMD${previousPathExt ? `;${previousPathExt}` : ''}`;
     }
 
-    await spawnOpenCode('Hi', { cwd: tempRoot }, writer);
+    await opencodeRuntime.run('Hi', { cwd: tempRoot }, writer, runtimeContext);
 
     const sessionCreatedIndex = messages.findIndex((message) => message.kind === 'session_created');
     const assistantDeltaIndex = messages.findIndex((message) =>
@@ -98,6 +111,26 @@ test('spawnOpenCode emits session_created before normalized live messages for ne
     assert.equal(launchedArgs.includes('--auto'), false);
     assert.equal(launchedArgs.includes('--agent'), false);
     assert.equal(capture.permissionEnv, null);
+
+    const attachmentOnlyCapturePath = path.join(tempRoot, 'opencode-attachment-only.json');
+    process.env.OPENCODE_ARGS_CAPTURE = attachmentOnlyCapturePath;
+    await opencodeRuntime.run(
+      '',
+      {
+        cwd: tempRoot,
+        files: [{
+          path: path.join(tempRoot, 'brief.pdf'),
+          name: 'brief.pdf',
+          mimeType: 'application/pdf',
+        }],
+      },
+      writer,
+      runtimeContext,
+    );
+    const attachmentOnlyCapture = JSON.parse(await readFile(attachmentOnlyCapturePath, 'utf8'));
+    const attachmentPrompt = attachmentOnlyCapture.args[attachmentOnlyCapture.args.length - 1];
+    assert.match(attachmentPrompt, /<files_input>/);
+    assert.match(attachmentPrompt, /brief\.pdf/);
   } finally {
     if (previousPath === undefined) {
       delete process.env[pathKey];
@@ -186,7 +219,12 @@ test('spawnOpenCode passes permission mode flags and env to the CLI', async () =
       const argsCapturePath = path.join(tempRoot, `opencode-args-${scenario.permissionMode}.json`);
       process.env.OPENCODE_ARGS_CAPTURE = argsCapturePath;
 
-      await spawnOpenCode('Hi', { cwd: tempRoot, permissionMode: scenario.permissionMode }, writer);
+      await opencodeRuntime.run(
+        'Hi',
+        { cwd: tempRoot, permissionMode: scenario.permissionMode },
+        writer,
+        runtimeContext,
+      );
 
       const capture = JSON.parse(await readFile(argsCapturePath, 'utf8'));
       for (const expectedArg of scenario.expectArgs) {

package/server/modules/providers/list/opencode/opencode-sessions.provider.ts

@@ -2,7 +2,7 @@ import fsSync from 'node:fs';
 
 import Database from 'better-sqlite3';
 
-import { parseImagesInputTag } from '@/shared/image-attachments.js';
+import { parseFilesInputTag, parseImagesInputTag } from '@/shared/image-attachments.js';
 import type { IProviderSessions } from '@/shared/interfaces.js';
 import type { AnyRecord, FetchHistoryOptions, FetchHistoryResult, NormalizedMessage } from '@/shared/types.js';
 import {
@@ -404,10 +404,17 @@ export class OpenCodeSessionsProvider implements IProviderSessions {
         const rawContent = extractText(partData);
         // User prompts sent with attachments carry an <images_input> path
         // list; strip it for display and surface the paths as images.
-        const { text: content, attachments } = messageRole === 'user'
+        const parsedImages = messageRole === 'user'
           ? parseImagesInputTag(rawContent)
           : { text: rawContent, attachments: [] };
-        if (content.trim() || attachments.length > 0) {
+        const parsedFiles = messageRole === 'user'
+          ? parseFilesInputTag(parsedImages.text)
+          : { text: rawContent, attachments: [] };
+        if (
+          parsedFiles.text.trim()
+          || parsedImages.attachments.length > 0
+          || parsedFiles.attachments.length > 0
+        ) {
           normalized.push(createNormalizedMessage({
             id: baseId,
             sessionId,
@@ -415,8 +422,9 @@ export class OpenCodeSessionsProvider implements IProviderSessions {
             provider: PROVIDER,
             kind: 'text',
             role: messageRole === 'user' ? 'user' : 'assistant',
-            content,
-            images: attachments.length > 0 ? attachments : undefined,
+            content: parsedFiles.text,
+            images: parsedImages.attachments.length > 0 ? parsedImages.attachments : undefined,
+            files: parsedFiles.attachments.length > 0 ? parsedFiles.attachments : undefined,
           }));
         }
         continue;

package/server/modules/providers/list/opencode/opencode.provider.ts

@@ -1,5 +1,6 @@
 import { OpenCodeProviderAuth } from '@/modules/providers/list/opencode/opencode-auth.provider.js';
 import { OpenCodeProviderModels } from '@/modules/providers/list/opencode/opencode-models.provider.js';
+import { opencodeRuntime } from '@/modules/providers/list/opencode/opencode-runtime.provider.js';
 import { OpenCodeMcpProvider } from '@/modules/providers/list/opencode/opencode-mcp.provider.js';
 import { OpenCodeSessionSynchronizer } from '@/modules/providers/list/opencode/opencode-session-synchronizer.provider.js';
 import { OpenCodeSessionsProvider } from '@/modules/providers/list/opencode/opencode-sessions.provider.js';
@@ -8,12 +9,14 @@ import { AbstractProvider } from '@/modules/providers/shared/base/abstract.provi
 import type {
   IProviderAuth,
   IProviderModels,
+  IProviderRuntime,
   IProviderSessionSynchronizer,
   IProviderSkills,
   IProviderSessions,
 } from '@/shared/interfaces.js';
 
 export class OpenCodeProvider extends AbstractProvider {
+  readonly runtime: IProviderRuntime = opencodeRuntime;
   readonly models: IProviderModels = new OpenCodeProviderModels();
   readonly mcp = new OpenCodeMcpProvider();
   readonly auth: IProviderAuth = new OpenCodeProviderAuth();

package/server/modules/providers/provider.routes.ts

@@ -4,6 +4,7 @@ import { providerAuthService } from '@/modules/providers/services/provider-auth.
 import { providerCapabilitiesService } from '@/modules/providers/services/provider-capabilities.service.js';
 import { providerMcpService } from '@/modules/providers/services/mcp.service.js';
 import { providerModelsService } from '@/modules/providers/services/provider-models.service.js';
+import { providerTokenUsageService } from '@/modules/providers/services/provider-token-usage.service.js';
 import { providerSkillsService } from '@/modules/providers/services/skills.service.js';
 import { sessionConversationsSearchService } from '@/modules/providers/services/session-conversations-search.service.js';
 import { sessionsService } from '@/modules/providers/services/sessions.service.js';
@@ -11,7 +12,6 @@ import type {
   LLMProvider,
   McpScope,
   McpTransport,
-  ProviderChangeActiveModelInput,
   ProviderSkillCreateFile,
   ProviderSkillCreateInput,
   UpsertProviderMcpServerInput,
@@ -352,7 +352,7 @@ const parseSessionSearchLimit = (value: unknown): number => {
   return Math.max(1, Math.min(parsed, 100));
 };
 
-const parseChangeActiveModelPayload = (payload: unknown): ProviderChangeActiveModelInput => {
+const parseSessionModelPayload = (payload: unknown): string => {
   if (!payload || typeof payload !== 'object') {
     throw new AppError('Request body must be an object.', {
       code: 'INVALID_REQUEST_BODY',
@@ -369,10 +369,7 @@ const parseChangeActiveModelPayload = (payload: unknown): ProviderChangeActiveMo
     });
   }
 
-  return {
-    sessionId: '',
-    model,
-  };
+  return model;
 };
 
 router.get(
@@ -394,20 +391,40 @@ router.get(
   }),
 );
 
-router.post(
+/**
+ * Reports which model one session is using. `requestedModel` lets the client
+ * pass the default it would otherwise send, so a session that has not been
+ * sent on yet resolves to that instead of the catalog default.
+ */
+router.get(
   '/:provider/sessions/:sessionId/active-model',
   asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     const sessionId = parseSessionId(req.params.sessionId);
-    const payload = parseChangeActiveModelPayload(req.body);
-    const result = await providerModelsService.changeActiveModel(provider, {
-      ...payload,
+    const requestedModel = readOptionalQueryString(req.query.requestedModel);
+    const result = await providerModelsService.resolveSessionModel(provider, {
       sessionId,
+      requestedModel,
     });
     res.json(createApiSuccessResponse(result));
   }),
 );
 
+router.post(
+  '/:provider/sessions/:sessionId/active-model',
+  asyncHandler(async (req: Request, res: Response) => {
+    const provider = parseProvider(req.params.provider);
+    const sessionId = parseSessionId(req.params.sessionId);
+    const model = parseSessionModelPayload(req.body);
+    const stored = providerModelsService.setSessionModel(provider, sessionId, model);
+    // A session row only exists once the gateway has allocated one. Report the
+    // selection back either way so the client can hold it until the first send.
+    res.json(createApiSuccessResponse(
+      stored ?? { provider, sessionId, model, source: 'session' as const },
+    ));
+  }),
+);
+
 // ----------------- Skills routes -----------------
 router.get(
   '/:provider/skills',
@@ -556,6 +573,26 @@ router.get(
   }),
 );
 
+router.get(
+  '/sessions/:sessionId/token-usage',
+  asyncHandler(async (req: Request, res: Response) => {
+    const sessionId = parseSessionId(req.params.sessionId);
+    const result = await providerTokenUsageService.getSessionTokenUsage(sessionId);
+    res.json(createApiSuccessResponse(result));
+  }),
+);
+
+// Must stay registered after the static `/sessions/running` and
+// `/sessions/archived` routes so those literals never match `:sessionId`.
+router.get(
+  '/sessions/:sessionId',
+  asyncHandler(async (req: Request, res: Response) => {
+    const sessionId = parseSessionId(req.params.sessionId);
+    const result = sessionsService.getSessionDetailsById(sessionId);
+    res.json(createApiSuccessResponse(result));
+  }),
+);
+
 router.delete(
   '/sessions/:sessionId',
   asyncHandler(async (req: Request, res: Response) => {

package/server/modules/providers/services/provider-capabilities.service.ts

@@ -15,6 +15,8 @@ type ProviderCapabilities = {
   defaultPermissionMode: string;
   /** Whether image attachments can be included in a chat.send. */
   supportsImages: boolean;
+  /** Whether general file attachments can be included in a chat.send. */
+  supportsFiles: boolean;
   /** Whether an in-flight run can be cancelled via chat.abort. */
   supportsAbort: boolean;
   /** Whether interactive tool permission prompts can reach the UI. */
@@ -37,6 +39,7 @@ const PROVIDER_CAPABILITIES: Record<LLMProvider, ProviderCapabilities> = {
     permissionModes: ['default', 'auto', 'acceptEdits', 'bypassPermissions', 'plan'],
     defaultPermissionMode: 'default',
     supportsImages: true,
+    supportsFiles: true,
     supportsAbort: true,
     supportsPermissionRequests: true,
     supportsTokenUsage: true,
@@ -47,6 +50,7 @@ const PROVIDER_CAPABILITIES: Record<LLMProvider, ProviderCapabilities> = {
     permissionModes: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
     defaultPermissionMode: 'default',
     supportsImages: true,
+    supportsFiles: true,
     supportsAbort: true,
     supportsPermissionRequests: false,
     supportsTokenUsage: false,
@@ -57,6 +61,7 @@ const PROVIDER_CAPABILITIES: Record<LLMProvider, ProviderCapabilities> = {
     permissionModes: ['default', 'acceptEdits', 'bypassPermissions'],
     defaultPermissionMode: 'default',
     supportsImages: true,
+    supportsFiles: true,
     supportsAbort: true,
     supportsPermissionRequests: false,
     supportsTokenUsage: true,
@@ -66,10 +71,11 @@ const PROVIDER_CAPABILITIES: Record<LLMProvider, ProviderCapabilities> = {
     provider: 'opencode',
     // Mapped by the runtime onto OpenCode's controls: `--agent plan` (plan),
     // `--auto` (bypassPermissions) and the OPENCODE_PERMISSION env var
-    // (acceptEdits). See resolveOpenCodePermissionOptions in opencode-cli.js.
+    // (acceptEdits). See resolveOpenCodePermissionOptions in the OpenCode runtime adapter.
     permissionModes: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
     defaultPermissionMode: 'default',
     supportsImages: true,
+    supportsFiles: true,
     supportsAbort: true,
     supportsPermissionRequests: false,
     supportsTokenUsage: true,