@cloudcli-ai/cloudcli 1.36.3 → 1.37.0

package/server/modules/providers/list/codex/codex.provider.ts

@@ -1,6 +1,7 @@
 import { AbstractProvider } from '@/modules/providers/shared/base/abstract.provider.js';
 import { CodexProviderAuth } from '@/modules/providers/list/codex/codex-auth.provider.js';
 import { CodexProviderModels } from '@/modules/providers/list/codex/codex-models.provider.js';
+import { codexRuntime } from '@/modules/providers/list/codex/codex-runtime.provider.js';
 import { CodexMcpProvider } from '@/modules/providers/list/codex/codex-mcp.provider.js';
 import { CodexSessionSynchronizer } from '@/modules/providers/list/codex/codex-session-synchronizer.provider.js';
 import { CodexSessionsProvider } from '@/modules/providers/list/codex/codex-sessions.provider.js';
@@ -8,12 +9,14 @@ import { CodexSkillsProvider } from '@/modules/providers/list/codex/codex-skills
 import type {
   IProviderAuth,
   IProviderModels,
+  IProviderRuntime,
   IProviderSessionSynchronizer,
   IProviderSkills,
   IProviderSessions,
 } from '@/shared/interfaces.js';
 
 export class CodexProvider extends AbstractProvider {
+  readonly runtime: IProviderRuntime = codexRuntime;
   readonly models: IProviderModels = new CodexProviderModels();
   readonly mcp = new CodexMcpProvider();
   readonly auth: IProviderAuth = new CodexProviderAuth();

package/server/modules/providers/list/cursor/cursor-models.provider.ts

@@ -6,16 +6,13 @@ import crossSpawn from 'cross-spawn';
 
 import type { IProviderModels } from '@/shared/interfaces.js';
 import type {
-  ProviderChangeActiveModelInput,
   ProviderCurrentActiveModel,
   ProviderModelOption,
   ProviderModelsDefinition,
-  ProviderSessionActiveModelChange,
 } from '@/shared/types.js';
 import {
   buildDefaultProviderCurrentActiveModel,
   sanitizeLeafDirectoryName,
-  writeProviderSessionActiveModelChange,
 } from '@/shared/utils.js';
 
 export const CURSOR_FALLBACK_MODELS: ProviderModelsDefinition = {
@@ -796,11 +793,5 @@ export class CursorProviderModels implements IProviderModels {
 
     return buildDefaultProviderCurrentActiveModel(await this.getSupportedModels());
   }
-
-  async changeActiveModel(
-    input: ProviderChangeActiveModelInput,
-  ): Promise<ProviderSessionActiveModelChange> {
-    return writeProviderSessionActiveModelChange('cursor', input);
-  }
 }
 

package/server/{cursor-cli.js → modules/providers/list/cursor/cursor-runtime.provider.js}

@@ -1,11 +1,12 @@
 import crossSpawn from 'cross-spawn';
 
-import { appendImagesInputTag } from './shared/image-attachments.js';
-import { notifyRunFailed, notifyRunStopped } from './services/notification-orchestrator.js';
-import { sessionsService } from './modules/providers/services/sessions.service.js';
-import { providerAuthService } from './modules/providers/services/provider-auth.service.js';
-import { providerModelsService } from './modules/providers/services/provider-models.service.js';
-import { createCompleteMessage, createNormalizedMessage, flattenPromptForWindowsShell } from './shared/utils.js';
+import {
+  appendFilesInputTag,
+  appendImagesInputTag,
+  normalizeAttachmentDescriptors
+} from '@/shared/image-attachments.js';
+import { notifyRunFailed, notifyRunStopped } from '@/modules/notifications/index.js';
+import { createCompleteMessage, createNormalizedMessage, flattenPromptForWindowsShell } from '@/shared/utils.js';
 
 // cross-spawn resolves .cmd shims/PATHEXT on Windows and delegates to
 // child_process.spawn everywhere else.
@@ -28,11 +29,24 @@ function isWorkspaceTrustPrompt(text = '') {
   return WORKSPACE_TRUST_PATTERNS.some((pattern) => pattern.test(text));
 }
 
-async function spawnCursor(command, options = {}, ws) {
+async function spawnCursor(command, options = {}, ws, context) {
   return new Promise(async (resolve, reject) => {
-    const { sessionId, projectPath, cwd, toolsSettings, skipPermissions, model, sessionSummary, images } = options;
-    const resolvedModel = await providerModelsService.resolveResumeModel('cursor', sessionId, model);
-    let capturedSessionId = sessionId; // Track session ID throughout the process
+    const {
+      sessionId,
+      projectPath,
+      cwd,
+      toolsSettings,
+      skipPermissions,
+      model,
+      sessionSummary,
+      images,
+      files
+    } = options;
+    // Callers pass the stable app session id; the CLI resumes with the
+    // provider-native id recorded on the session row.
+    const providerSessionId = context.resolveProviderSessionId(sessionId);
+    const resolvedModel = await context.resolveResumeModel(sessionId, model);
+    let capturedSessionId = providerSessionId; // Track the provider-native session id throughout the process
     let sessionCreatedSent = false; // Track if we've already sent session-created event
     let hasRetriedWithTrust = false;
     let settled = false;
@@ -51,18 +65,25 @@ async function spawnCursor(command, options = {}, ws) {
     const baseArgs = [];
 
     // Build flags allowing both resume and prompt together (reply in existing session)
-    // Treat presence of sessionId as intention to resume, regardless of resume flag
-    if (sessionId) {
-      baseArgs.push('--resume=' + sessionId);
+    // Treat a known provider-native id as intention to resume
+    if (providerSessionId) {
+      baseArgs.push('--resume=' + providerSessionId);
     }
 
-    if (command && command.trim()) {
+    const hasAttachments =
+      normalizeAttachmentDescriptors(images).length > 0
+      || normalizeAttachmentDescriptors(files).length > 0;
+    if ((command && command.trim()) || hasAttachments) {
       // Provide a prompt (works for both new and resumed sessions). Image
       // attachments ride along as an <images_input> path list appended to the
       // prompt; the session history reader strips the tag back out for display.
       // cursor-agent is a .cmd shim on Windows, so the whole argument must be
       // newline-free or cmd.exe silently truncates it at the first newline.
-      baseArgs.push('-p', flattenPromptForWindowsShell(appendImagesInputTag(command, images)));
+      const promptWithAttachments = appendFilesInputTag(
+        appendImagesInputTag(command || '', images),
+        files
+      );
+      baseArgs.push('-p', flattenPromptForWindowsShell(promptWithAttachments));
 
       // Model overrides are applied to both new and resumed sessions so a
       // session-scoped change request can take effect on the next turn.
@@ -82,8 +103,9 @@ async function spawnCursor(command, options = {}, ws) {
     // Use cwd (actual project directory) instead of projectPath
     const workingDir = cwd || projectPath || process.cwd();
 
-    // Store process reference for potential abort
-    const processKey = capturedSessionId || Date.now().toString();
+    // Store process reference for potential abort — keyed by the app session
+    // id when the caller supplied one, so abort-by-app-id always works.
+    const processKey = sessionId || Date.now().toString();
 
     const settleOnce = (callback) => {
       if (settled) {
@@ -106,7 +128,8 @@ async function spawnCursor(command, options = {}, ws) {
 
         terminalNotificationSent = true;
 
-        const finalSessionId = capturedSessionId || sessionId || processKey;
+        // Notifications are app-facing, so they carry the app session id.
+        const finalSessionId = sessionId || capturedSessionId || processKey;
         if (code === 0 && !error) {
           notifyRunStopped({
             userId: ws?.userId || null,
@@ -167,8 +190,9 @@ async function spawnCursor(command, options = {}, ws) {
                 if (response.session_id && !capturedSessionId) {
                   capturedSessionId = response.session_id;
 
-                  // Update process key with captured session ID
-                  if (processKey !== capturedSessionId) {
+                  // Legacy/direct callers without an app session id re-key the
+                  // process under the provider-native id once it is known.
+                  if (!sessionId && processKey !== capturedSessionId) {
                     activeCursorProcesses.delete(processKey);
                     activeCursorProcesses.set(capturedSessionId, cursorProcess);
                   }
@@ -178,8 +202,8 @@ async function spawnCursor(command, options = {}, ws) {
                     ws.setSessionId(capturedSessionId);
                   }
 
-                  // Send session-created event only once for new sessions
-                  if (!sessionId && !sessionCreatedSent) {
+                  // Send session-created event only once for sessions with nothing to resume
+                  if (!providerSessionId && !sessionCreatedSent) {
                     sessionCreatedSent = true;
                     ws.send(createNormalizedMessage({ kind: 'session_created', newSessionId: capturedSessionId, model: response.model, cwd: response.cwd, sessionId: capturedSessionId, provider: 'cursor' }));
                   }
@@ -196,7 +220,7 @@ async function spawnCursor(command, options = {}, ws) {
             case 'assistant':
               // Accumulate assistant message chunks
               if (response.message && response.message.content && response.message.content.length > 0) {
-                const normalized = sessionsService.normalizeMessage('cursor', response, capturedSessionId || sessionId || null);
+                const normalized = context.normalizeMessage(response, capturedSessionId || sessionId || null);
                 for (const msg of normalized) ws.send(msg);
               }
               break;
@@ -223,7 +247,7 @@ async function spawnCursor(command, options = {}, ws) {
           }
 
           // If not JSON, send as stream delta via adapter
-          const normalized = sessionsService.normalizeMessage('cursor', line, capturedSessionId || sessionId || null);
+          const normalized = context.normalizeMessage(line, capturedSessionId || sessionId || null);
           for (const msg of normalized) ws.send(msg);
         }
       };
@@ -256,7 +280,9 @@ async function spawnCursor(command, options = {}, ws) {
 
       // Handle process completion
       cursorProcess.on('close', async (code) => {
-        const finalSessionId = capturedSessionId || sessionId || processKey;
+        // The process map is keyed by the app session id when one was given,
+        // otherwise by the captured provider id (or the timestamp fallback).
+        const finalSessionId = sessionId || capturedSessionId || processKey;
         activeCursorProcesses.delete(finalSessionId);
 
         // Flush any final unterminated stdout line before completion handling.
@@ -297,11 +323,11 @@ async function spawnCursor(command, options = {}, ws) {
         console.error('Cursor CLI process error:', error);
 
         // Clean up process reference on error
-        const finalSessionId = capturedSessionId || sessionId || processKey;
+        const finalSessionId = sessionId || capturedSessionId || processKey;
         activeCursorProcesses.delete(finalSessionId);
 
         // Check if Cursor CLI is installed for a clearer error message
-        const installed = await providerAuthService.isProviderInstalled('cursor');
+        const installed = await context.isProviderInstalled();
         const errorContent = !installed
           ? 'Cursor CLI is not installed. Please install it from https://cursor.com'
           : error.message;
@@ -346,6 +372,11 @@ function getActiveCursorSessions() {
   return Array.from(activeCursorProcesses.keys());
 }
 
+export const cursorRuntime = {
+  run: spawnCursor,
+  abort: abortCursorSession,
+};
+
 export {
   spawnCursor,
   abortCursorSession,

package/server/modules/providers/list/cursor/cursor-sessions.provider.ts

@@ -2,7 +2,7 @@ import crypto from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
 
-import { parseImagesInputTag } from '@/shared/image-attachments.js';
+import { parseFilesInputTag, parseImagesInputTag } from '@/shared/image-attachments.js';
 import type { IProviderSessions } from '@/shared/interfaces.js';
 import type { AnyRecord, FetchHistoryOptions, FetchHistoryResult, NormalizedMessage } from '@/shared/types.js';
 import {
@@ -85,16 +85,22 @@ function unwrapUserQueryText(value: string, role: 'user' | 'assistant'): string
 function extractUserTextAndImages(
   value: string,
   role: 'user' | 'assistant',
-): { text: string; images?: Array<{ path: string; name?: string }> } {
+): {
+  text: string;
+  images?: Array<{ path: string; name?: string }>;
+  files?: Array<{ path: string; name?: string }>;
+} {
   const unwrapped = unwrapUserQueryText(value, role);
   if (role !== 'user') {
     return { text: unwrapped };
   }
 
-  const { text, attachments } = parseImagesInputTag(unwrapped);
+  const parsedImages = parseImagesInputTag(unwrapped);
+  const parsedFiles = parseFilesInputTag(parsedImages.text);
   return {
-    text,
-    images: attachments.length > 0 ? attachments : undefined,
+    text: parsedFiles.text,
+    images: parsedImages.attachments.length > 0 ? parsedImages.attachments : undefined,
+    files: parsedFiles.attachments.length > 0 ? parsedFiles.attachments : undefined,
   };
 }
 
@@ -471,16 +477,18 @@ export class CursorSessionsProvider implements IProviderSessions {
                 text = unwrapUserQueryText(content.message.content, role);
               }
             }
-            const { text: cleanText, images } = role === 'user'
+            const { text: cleanText, images, files } = role === 'user'
               ? (() => {
-                const parsed = parseImagesInputTag(text);
+                const parsedImages = parseImagesInputTag(text);
+                const parsedFiles = parseFilesInputTag(parsedImages.text);
                 return {
-                  text: parsed.text,
-                  images: parsed.attachments.length > 0 ? parsed.attachments : undefined,
+                  text: parsedFiles.text,
+                  images: parsedImages.attachments.length > 0 ? parsedImages.attachments : undefined,
+                  files: parsedFiles.attachments.length > 0 ? parsedFiles.attachments : undefined,
                 };
               })()
-              : { text, images: undefined };
-            if (cleanText?.trim() || images) {
+              : { text, images: undefined, files: undefined };
+            if (cleanText?.trim() || images || files) {
               messages.push(createNormalizedMessage({
                 id: baseId,
                 sessionId,
@@ -490,6 +498,7 @@ export class CursorSessionsProvider implements IProviderSessions {
                 role,
                 content: cleanText,
                 images,
+                files,
                 sequence: blob.sequence,
                 rowid: blob.rowid,
               }));
@@ -541,8 +550,8 @@ export class CursorSessionsProvider implements IProviderSessions {
             }
 
             if (part?.type === 'text' && part?.text) {
-              const { text: normalizedPartText, images } = extractUserTextAndImages(part.text, role);
-              if (!normalizedPartText && !images) {
+              const { text: normalizedPartText, images, files } = extractUserTextAndImages(part.text, role);
+              if (!normalizedPartText && !images && !files) {
                 continue;
               }
               messages.push(createNormalizedMessage({
@@ -554,6 +563,7 @@ export class CursorSessionsProvider implements IProviderSessions {
                 role,
                 content: normalizedPartText,
                 images,
+                files,
                 sequence: blob.sequence,
                 rowid: blob.rowid,
               }));
@@ -593,8 +603,8 @@ export class CursorSessionsProvider implements IProviderSessions {
           && content.content.trim()
           && !isInternalCursorText(content.content)
         ) {
-          const { text: normalizedText, images } = extractUserTextAndImages(content.content, role);
-          if (!normalizedText && !images) {
+          const { text: normalizedText, images, files } = extractUserTextAndImages(content.content, role);
+          if (!normalizedText && !images && !files) {
             continue;
           }
           messages.push(createNormalizedMessage({
@@ -606,6 +616,7 @@ export class CursorSessionsProvider implements IProviderSessions {
             role,
             content: normalizedText,
             images,
+            files,
             sequence: blob.sequence,
             rowid: blob.rowid,
           }));

package/server/modules/providers/list/cursor/cursor.provider.ts

@@ -1,6 +1,7 @@
 import { AbstractProvider } from '@/modules/providers/shared/base/abstract.provider.js';
 import { CursorProviderAuth } from '@/modules/providers/list/cursor/cursor-auth.provider.js';
 import { CursorProviderModels } from '@/modules/providers/list/cursor/cursor-models.provider.js';
+import { cursorRuntime } from '@/modules/providers/list/cursor/cursor-runtime.provider.js';
 import { CursorMcpProvider } from '@/modules/providers/list/cursor/cursor-mcp.provider.js';
 import { CursorSessionSynchronizer } from '@/modules/providers/list/cursor/cursor-session-synchronizer.provider.js';
 import { CursorSessionsProvider } from '@/modules/providers/list/cursor/cursor-sessions.provider.js';
@@ -8,12 +9,14 @@ import { CursorSkillsProvider } from '@/modules/providers/list/cursor/cursor-ski
 import type {
   IProviderAuth,
   IProviderModels,
+  IProviderRuntime,
   IProviderSessionSynchronizer,
   IProviderSkills,
   IProviderSessions,
 } from '@/shared/interfaces.js';
 
 export class CursorProvider extends AbstractProvider {
+  readonly runtime: IProviderRuntime = cursorRuntime;
   readonly models: IProviderModels = new CursorProviderModels();
   readonly mcp = new CursorMcpProvider();
   readonly auth: IProviderAuth = new CursorProviderAuth();

package/server/modules/providers/list/opencode/opencode-models.provider.ts

@@ -1,20 +1,18 @@
 import Database from 'better-sqlite3';
 import crossSpawn from 'cross-spawn';
 
+import { sessionsDb } from '@/modules/database/index.js';
 import type { IProviderModels } from '@/shared/interfaces.js';
 import type {
-  ProviderChangeActiveModelInput,
   ProviderCurrentActiveModel,
   ProviderModelOption,
   ProviderModelsDefinition,
-  ProviderSessionActiveModelChange,
 } from '@/shared/types.js';
 import {
   buildDefaultProviderCurrentActiveModel,
   getOpenCodeDatabasePath,
   readObjectRecord,
   readOptionalString,
-  writeProviderSessionActiveModelChange,
 } from '@/shared/utils.js';
 
 export const OPENCODE_FALLBACK_MODELS: ProviderModelsDefinition = {
@@ -464,6 +462,11 @@ export class OpenCodeProviderModels implements IProviderModels {
       return buildDefaultProviderCurrentActiveModel(await this.getSupportedModels());
     }
 
+    // OpenCode's `session` table is keyed by its own session id, so the stable
+    // app id has to be translated first; sessions discovered on disk store the
+    // provider id in both columns and resolve to themselves.
+    const providerSessionId = sessionsDb.getSessionById(sessionId)?.provider_session_id ?? sessionId;
+
     try {
       const dbPath = getOpenCodeDatabasePath();
       const db = new Database(dbPath, { readonly: true, fileMustExist: true });
@@ -481,7 +484,7 @@ export class OpenCodeProviderModels implements IProviderModels {
           WHERE s.id = ?
           ORDER BY COALESCE(s.time_updated, s.time_created, 0) DESC
           LIMIT 1
-        `).get(sessionId) as {
+        `).get(providerSessionId) as {
           sessionId?: string;
           model?: unknown;
           agent?: string | null;
@@ -505,10 +508,4 @@ export class OpenCodeProviderModels implements IProviderModels {
 
     return buildDefaultProviderCurrentActiveModel(await this.getSupportedModels());
   }
-
-  async changeActiveModel(
-    input: ProviderChangeActiveModelInput,
-  ): Promise<ProviderSessionActiveModelChange> {
-    return writeProviderSessionActiveModelChange('opencode', input);
-  }
 }

package/server/{opencode-cli.js → modules/providers/list/opencode/opencode-runtime.provider.js}

@@ -3,12 +3,13 @@ import fsSync from 'node:fs';
 import crossSpawn from 'cross-spawn';
 import Database from 'better-sqlite3';
 
-import { appendImagesInputTag } from './shared/image-attachments.js';
-import { sessionsService } from './modules/providers/services/sessions.service.js';
-import { providerAuthService } from './modules/providers/services/provider-auth.service.js';
-import { providerModelsService } from './modules/providers/services/provider-models.service.js';
-import { notifyRunFailed, notifyRunStopped } from './services/notification-orchestrator.js';
-import { createCompleteMessage, createNormalizedMessage, flattenPromptForWindowsShell, getOpenCodeDatabasePath } from './shared/utils.js';
+import {
+  appendFilesInputTag,
+  appendImagesInputTag,
+  normalizeAttachmentDescriptors
+} from '@/shared/image-attachments.js';
+import { notifyRunFailed, notifyRunStopped } from '@/modules/notifications/index.js';
+import { createCompleteMessage, createNormalizedMessage, flattenPromptForWindowsShell, getOpenCodeDatabasePath } from '@/shared/utils.js';
 
 // cross-spawn resolves .cmd shims/PATHEXT on Windows and delegates to
 // child_process.spawn everywhere else.
@@ -122,12 +123,27 @@ function readOpenCodeTokenUsage(sessionId) {
   }
 }
 
-async function spawnOpenCode(command, options = {}, ws) {
+async function spawnOpenCode(command, options = {}, ws, context) {
   return new Promise((resolve, reject) => {
-    const { sessionId, projectPath, cwd, model, effort, sessionSummary, images, permissionMode } = options;
+    const {
+      sessionId,
+      projectPath,
+      cwd,
+      model,
+      effort,
+      sessionSummary,
+      images,
+      files,
+      permissionMode
+    } = options;
+    // Callers pass the stable app session id; the CLI resumes with the
+    // provider-native id recorded on the session row.
+    const providerSessionId = context.resolveProviderSessionId(sessionId);
     const workingDir = cwd || projectPath || process.cwd();
+    // Process-map key: the app session id when the caller supplied one, so
+    // abort-by-app-id always works.
     const processKey = sessionId || Date.now().toString();
-    let capturedSessionId = sessionId || null;
+    let capturedSessionId = providerSessionId;
     let sessionCreatedSent = false;
     let stdoutLineBuffer = '';
     let terminalNotificationSent = false;
@@ -142,7 +158,8 @@ async function spawnOpenCode(command, options = {}, ws) {
       }
 
       terminalNotificationSent = true;
-      const finalSessionId = capturedSessionId || sessionId || processKey;
+      // Notifications are app-facing, so they carry the app session id.
+      const finalSessionId = sessionId || capturedSessionId || processKey;
       if (code === 0 && !error) {
         notifyRunStopped({
           userId: ws?.userId || null,
@@ -169,7 +186,9 @@ async function spawnOpenCode(command, options = {}, ws) {
       }
 
       capturedSessionId = nextSessionId;
-      if (processKey !== capturedSessionId && opencodeProcess) {
+      // Legacy/direct callers without an app session id re-key the process
+      // under the provider-native id once it is known.
+      if (!sessionId && processKey !== capturedSessionId && opencodeProcess) {
         activeOpenCodeProcesses.delete(processKey);
         activeOpenCodeProcesses.set(capturedSessionId, opencodeProcess);
       }
@@ -181,7 +200,7 @@ async function spawnOpenCode(command, options = {}, ws) {
         ws.setSessionId(capturedSessionId);
       }
 
-      if (!sessionId && !sessionCreatedSent) {
+      if (!providerSessionId && !sessionCreatedSent) {
         sessionCreatedSent = true;
         ws.send(createNormalizedMessage({
           kind: 'session_created',
@@ -212,11 +231,7 @@ async function spawnOpenCode(command, options = {}, ws) {
 
       try {
         registerSession(readOpenCodeSessionId(response));
-        const normalized = sessionsService.normalizeMessage(
-          'opencode',
-          response,
-          capturedSessionId || sessionId || null,
-        );
+        const normalized = context.normalizeMessage(response, capturedSessionId || sessionId || null);
         for (const msg of normalized) {
           ws.send(msg);
         }
@@ -232,10 +247,10 @@ async function spawnOpenCode(command, options = {}, ws) {
       }
     };
 
-    void providerModelsService.resolveResumeModel('opencode', sessionId, model).then(async (resolvedModel) => {
+    void context.resolveResumeModel(sessionId, model).then(async (resolvedModel) => {
       let effortModels = null;
       try {
-        effortModels = (await providerModelsService.getProviderModels('opencode')).models;
+        effortModels = await context.getProviderModels();
       } catch (error) {
         console.warn('[OpenCode] Unable to load provider models for effort validation:', error);
       }
@@ -246,8 +261,8 @@ async function spawnOpenCode(command, options = {}, ws) {
       // Relying on the child-process cwd alone is not enough on Linux, where
       // the CLI can still resolve the session under the server install dir.
       args.push('--dir', workingDir);
-      if (sessionId) {
-        args.push('--session', sessionId);
+      if (providerSessionId) {
+        args.push('--session', providerSessionId);
       }
       if (resolvedModel) {
         args.push('--model', resolvedModel);
@@ -257,12 +272,19 @@ async function spawnOpenCode(command, options = {}, ws) {
       }
       const permissionOptions = resolveOpenCodePermissionOptions(permissionMode);
       args.push(...permissionOptions.args);
-      if (command && command.trim()) {
+      const hasAttachments =
+        normalizeAttachmentDescriptors(images).length > 0
+        || normalizeAttachmentDescriptors(files).length > 0;
+      if ((command && command.trim()) || hasAttachments) {
         // Image attachments ride along as an <images_input> path list appended
         // to the prompt; the session history reader strips the tag back out.
         // opencode is a .cmd shim on Windows, so the whole argument must be
         // newline-free or cmd.exe silently truncates it at the first newline.
-        args.push(flattenPromptForWindowsShell(appendImagesInputTag(command.trim(), images)));
+        const promptWithAttachments = appendFilesInputTag(
+          appendImagesInputTag(command?.trim() || '', images),
+          files
+        );
+        args.push(flattenPromptForWindowsShell(promptWithAttachments));
       }
 
       opencodeProcess = spawnFunction('opencode', args, {
@@ -300,7 +322,7 @@ async function spawnOpenCode(command, options = {}, ws) {
       });
 
       opencodeProcess.on('close', async (code) => {
-        const finalSessionId = capturedSessionId || sessionId || processKey;
+        const finalSessionId = sessionId || capturedSessionId || processKey;
         activeOpenCodeProcesses.delete(finalSessionId);
         activeOpenCodeProcesses.delete(processKey);
 
@@ -309,7 +331,8 @@ async function spawnOpenCode(command, options = {}, ws) {
           stdoutLineBuffer = '';
         }
 
-        const tokenBudget = readOpenCodeTokenUsage(finalSessionId);
+        // OpenCode's own database is keyed by the provider-native id.
+        const tokenBudget = readOpenCodeTokenUsage(capturedSessionId);
         if (tokenBudget) {
           ws.send(createNormalizedMessage({
             kind: 'status',
@@ -334,7 +357,7 @@ async function spawnOpenCode(command, options = {}, ws) {
         }
 
         if (code === 127 || code === null) {
-          const installed = await providerAuthService.isProviderInstalled('opencode');
+          const installed = await context.isProviderInstalled();
           if (!installed) {
             ws.send(createNormalizedMessage({
               kind: 'error',
@@ -350,11 +373,11 @@ async function spawnOpenCode(command, options = {}, ws) {
       });
 
       opencodeProcess.on('error', async (error) => {
-        const finalSessionId = capturedSessionId || sessionId || processKey;
+        const finalSessionId = sessionId || capturedSessionId || processKey;
         activeOpenCodeProcesses.delete(finalSessionId);
         activeOpenCodeProcesses.delete(processKey);
 
-        const installed = await providerAuthService.isProviderInstalled('opencode');
+        const installed = await context.isProviderInstalled();
         const errorContent = !installed
           ? 'OpenCode CLI is not installed. Install it from https://opencode.ai/docs/'
           : error.message;
@@ -398,6 +421,11 @@ function getActiveOpenCodeSessions() {
   return Array.from(activeOpenCodeProcesses.keys());
 }
 
+export const opencodeRuntime = {
+  run: spawnOpenCode,
+  abort: abortOpenCodeSession,
+};
+
 export {
   spawnOpenCode,
   abortOpenCodeSession,