fix(core): isolate integration form configuration

Co-authored-by: Aiden Cline <rekram1-node@users.noreply.github.com>

packages/app/e2e/regression/removed-layout-preference.spec.ts

@@ -23,7 +23,6 @@ test("ignores persisted old layout preferences when opening drafts", async ({ pa
   await page.addInitScript(
     ({ directory, draftID, server }) => {
       localStorage.setItem("settings.v3", JSON.stringify({ general: { newLayoutDesigns: false } }))
-      localStorage.setItem("app-version.v1", JSON.stringify({ version: "1.17.20" }))
       localStorage.setItem(
         "opencode.window.browser.dat:tabs",
         JSON.stringify([{ type: "draft", draftID, server, directory }]),

packages/cli/src/commands/handlers/console/login.ts

@@ -50,7 +50,7 @@ const login = Effect.fn("cli.console.login.run")(function* (timeline: TimelineHo
       {
         integrationID,
         methodID: method.id,
-        inputs: server ? { server } : {},
+        answers: server ? { server } : {},
         location,
       },
       { signal },

packages/cli/src/commands/handlers/mcp/auth.ts

@@ -30,9 +30,11 @@ export default Runtime.handler(
     )
     if (!method)
       return yield* Effect.fail(new Error(`MCP server "${input.name}" is not an OAuth-capable remote server`))
+    if (method.forms)
+      return yield* Effect.fail(new Error(`MCP server "${input.name}" requires an interactive authentication form`))
 
     const started = yield* Effect.promise(() =>
-      client.integration.oauth.connect({ integrationID: integration.id, methodID: method.id, inputs: {}, location }),
+      client.integration.oauth.connect({ integrationID: integration.id, methodID: method.id, answers: {}, location }),
     )
     const attempt = started.data
     if (attempt.mode === "code")

packages/client/src/effect/api/api.ts

@@ -23,9 +23,9 @@ import type { Shell } from "@opencode-ai/schema/shell"
 import type { DateTime } from "effect"
 import type { Provider } from "@opencode-ai/schema/provider"
 import type { Integration } from "@opencode-ai/schema/integration"
+import type { Form } from "@opencode-ai/schema/form"
 import type { Mcp } from "@opencode-ai/schema/mcp"
 import type { Credential } from "@opencode-ai/schema/credential"
-import type { Form } from "@opencode-ai/schema/form"
 import type { Permission } from "@opencode-ai/schema/permission"
 import type { PermissionSaved } from "@opencode-ai/schema/permission-saved"
 import type { FileSystem } from "@opencode-ai/schema/filesystem"
@@ -1006,6 +1006,7 @@ export type Endpoint10_3Input = {
   readonly integrationID: Integration.ID
   readonly location?: { readonly directory?: string | undefined; readonly workspace?: string | undefined } | undefined
   readonly key: string
+  readonly answers: Form.Answer
   readonly label?: string | undefined
 }
 export type Endpoint10_3Output = void
@@ -1017,7 +1018,7 @@ export type Endpoint10_4Input = {
   readonly integrationID: Integration.ID
   readonly location?: { readonly directory?: string | undefined; readonly workspace?: string | undefined } | undefined
   readonly methodID: Integration.MethodID
-  readonly inputs: { readonly [x: string]: string }
+  readonly answers: Form.Answer
   readonly label?: string | undefined
 }
 export type Endpoint10_4Output = { readonly location: Location.Info; readonly data: Integration.Attempt }

packages/client/src/effect/generated/client.ts

@@ -688,7 +688,7 @@ const Endpoint10_3 = (raw: RawClient["server.integration"]) => (input: Endpoint1
     raw["integration.connect.key"]({
       params: { integrationID: input["integrationID"] },
       query: { location: input["location"] },
-      payload: { key: input["key"], label: input["label"] },
+      payload: { key: input["key"], answers: input["answers"], label: input["label"] },
     }).pipe(Effect.mapError(mapClientError)),
   )
 
@@ -697,7 +697,7 @@ const Endpoint10_4 = (raw: RawClient["server.integration"]) => (input: Endpoint1
     raw["integration.oauth.connect"]({
       params: { integrationID: input["integrationID"] },
       query: { location: input["location"] },
-      payload: { methodID: input["methodID"], inputs: input["inputs"], label: input["label"] },
+      payload: { methodID: input["methodID"], answers: input["answers"], label: input["label"] },
     }).pipe(Effect.mapError(mapClientError)),
   )
 

packages/client/src/promise/generated/client.ts

@@ -991,7 +991,7 @@ export function make(options: ClientOptions) {
               method: "POST",
               path: `/api/integration/${encodeURIComponent(input.integrationID)}/connect/key`,
               query: { location: input["location"] },
-              body: { key: input["key"], label: input["label"] },
+              body: { key: input["key"], answers: input["answers"], label: input["label"] },
               successStatus: 204,
               declaredStatuses: [400, 401],
               empty: true,
@@ -1006,7 +1006,7 @@ export function make(options: ClientOptions) {
               method: "POST",
               path: `/api/integration/${encodeURIComponent(input.integrationID)}/connect/oauth`,
               query: { location: input["location"] },
-              body: { methodID: input["methodID"], inputs: input["inputs"], label: input["label"] },
+              body: { methodID: input["methodID"], answers: input["answers"], label: input["label"] },
               successStatus: 200,
               declaredStatuses: [400, 401],
               empty: false,

packages/client/src/promise/generated/types.ts

@@ -195,12 +195,18 @@ export type ProviderInfo = {
   body?: { [x: string]: any }
 }
 
-export type IntegrationWhen = { key: string; op: "eq" | "neq"; value: string }
+export type FormWhen = {
+  key: string
+  op: "eq" | "neq"
+  value: string | number | "Infinity" | "-Infinity" | "NaN" | boolean
+}
+
+export type FormOption = { value: string; label: string; description?: string }
+
+export type FormExternalField = { key: string; type: "external"; url: string; title?: string; description?: string }
 
 export type IntegrationCommandMethod = { id: string; type: "command"; label: string; command: Array<string> }
 
-export type IntegrationKeyMethod = { type: "key"; label?: string }
-
 export type IntegrationEnvMethod = { type: "env"; names: Array<string> }
 
 export type ConnectionCredentialInfo = { type: "credential"; id: string; label: string }
@@ -285,16 +291,6 @@ export type ProjectDirectory = { directory: string; strategy?: string }
 
 export type FormMetadata = { [x: string]: JsonValue }
 
-export type FormWhen = {
-  key: string
-  op: "eq" | "neq"
-  value: string | number | "Infinity" | "-Infinity" | "NaN" | boolean
-}
-
-export type FormOption = { value: string; label: string; description?: string }
-
-export type FormExternalField = { key: string; type: "external"; url: string; title?: string; description?: string }
-
 export type FormValue = string | number | boolean | Array<string>
 
 export type PermissionSource = { type: "tool"; messageID: string; id: string }
@@ -1245,45 +1241,6 @@ export type ModelCost = {
   cache: { read: MoneyUSDPerMillionTokens; write: MoneyUSDPerMillionTokens }
 }
 
-export type IntegrationTextPrompt = {
-  type: "text"
-  key: string
-  message: string
-  placeholder?: string
-  when?: IntegrationWhen
-}
-
-export type IntegrationSelectPrompt = {
-  type: "select"
-  key: string
-  message: string
-  options: Array<{ label: string; value: string; hint?: string }>
-  when?: IntegrationWhen
-}
-
-export type ConnectionInfo = ConnectionCredentialInfo | ConnectionEnvInfo
-
-export type McpServer = {
-  name: string
-  status: McpStatusConnected | McpStatusPending | McpStatusDisabled | McpStatusFailed | McpStatusNeedsAuth
-  integrationID?: string
-}
-
-export type McpResourceCatalog = { resources: Array<McpResource>; templates: Array<McpResourceTemplate> }
-
-export type Project = {
-  id: string
-  canonical: string
-  vcs?: ProjectVcs
-  name?: string
-  icon?: ProjectIcon
-  commands?: ProjectCommands
-  time: ProjectTime
-  sandboxes: Array<string>
-}
-
-export type ProjectDirectories = Array<ProjectDirectory>
-
 export type FormNumberField = {
   key: string
   title?: string
@@ -1349,6 +1306,29 @@ export type FormMultiselectField = {
   default?: Array<string>
 }
 
+export type ConnectionInfo = ConnectionCredentialInfo | ConnectionEnvInfo
+
+export type McpServer = {
+  name: string
+  status: McpStatusConnected | McpStatusPending | McpStatusDisabled | McpStatusFailed | McpStatusNeedsAuth
+  integrationID?: string
+}
+
+export type McpResourceCatalog = { resources: Array<McpResource>; templates: Array<McpResourceTemplate> }
+
+export type Project = {
+  id: string
+  canonical: string
+  vcs?: ProjectVcs
+  name?: string
+  icon?: ProjectIcon
+  commands?: ProjectCommands
+  time: ProjectTime
+  sandboxes: Array<string>
+}
+
+export type ProjectDirectories = Array<ProjectDirectory>
+
 export type FormAnswer = { [x: string]: FormValue }
 
 export type PermissionRequest = {
@@ -1629,13 +1609,6 @@ export type ModelInfo = {
   limit: { context: number; input?: number; output: number }
 }
 
-export type IntegrationOAuthMethod = {
-  id: string
-  type: "oauth"
-  label: string
-  prompts?: Array<IntegrationTextPrompt | IntegrationSelectPrompt>
-}
-
 export type FormField =
   | FormStringField
   | FormNumberField
@@ -1889,15 +1862,9 @@ export type SessionMessageAssistantTool = {
   time: { created: number; ran?: number; completed?: number }
 }
 
-export type IntegrationMethod =
-  | IntegrationOAuthMethod
-  | IntegrationCommandMethod
-  | IntegrationKeyMethod
-  | IntegrationEnvMethod
-
 export type FormFields = [FormField, ...Array<FormField>]
 
-export type FormFields1 = [FormField1, ...Array<FormField1>]
+export type FormFields3 = [FormField1, ...Array<FormField1>]
 
 export type SessionPendingInfo = SessionPendingUser | SessionPendingSynthetic | SessionPendingCompaction
 
@@ -1919,16 +1886,13 @@ export type SessionMessageAssistant = {
   retry?: SessionMessageAssistantRetry
 }
 
-export type IntegrationInfo = {
-  id: string
-  name: string
-  methods: Array<IntegrationMethod>
-  connections: Array<ConnectionInfo>
-}
+export type IntegrationOAuthMethod = { id: string; type: "oauth"; label: string; forms?: FormFields }
+
+export type IntegrationKeyMethod = { type: "key"; label?: string; forms?: FormFields }
 
 export type FormInfo = { id: string; sessionID: string; title: string; metadata?: FormMetadata; fields: FormFields }
 
-export type FormInfo1 = { id: string; sessionID: string; title: string; metadata?: FormMetadata1; fields: FormFields1 }
+export type FormInfo1 = { id: string; sessionID: string; title: string; metadata?: FormMetadata1; fields: FormFields3 }
 
 export type SessionInputAdmitted = {
   id: string
@@ -1951,6 +1915,12 @@ export type SessionMessageInfo =
   | SessionMessageAssistant
   | SessionMessageCompaction
 
+export type IntegrationMethod =
+  | IntegrationOAuthMethod
+  | IntegrationCommandMethod
+  | IntegrationKeyMethod
+  | IntegrationEnvMethod
+
 export type FormCreated = {
   id: string
   created: number
@@ -2008,6 +1978,13 @@ export type SessionMessagesResponse = {
   cursor: { previous?: string | null; next?: string | null }
 }
 
+export type IntegrationInfo = {
+  id: string
+  name: string
+  methods: Array<IntegrationMethod>
+  connections: Array<ConnectionInfo>
+}
+
 export type V2Event =
   | ModelsDevRefreshed
   | IntegrationUpdated
@@ -3857,8 +3834,21 @@ export type IntegrationConnectKeyInput = {
   readonly location?: {
     readonly location?: { readonly directory?: string | undefined; readonly workspace?: string | undefined } | undefined
   }["location"]
-  readonly key: { readonly key: string; readonly label?: string | undefined }["key"]
-  readonly label?: { readonly key: string; readonly label?: string | undefined }["label"]
+  readonly key: {
+    readonly key: string
+    readonly answers: { readonly [x: string]: string | number | boolean | ReadonlyArray<string> }
+    readonly label?: string | undefined
+  }["key"]
+  readonly answers: {
+    readonly key: string
+    readonly answers: { readonly [x: string]: string | number | boolean | ReadonlyArray<string> }
+    readonly label?: string | undefined
+  }["answers"]
+  readonly label?: {
+    readonly key: string
+    readonly answers: { readonly [x: string]: string | number | boolean | ReadonlyArray<string> }
+    readonly label?: string | undefined
+  }["label"]
 }
 
 export type IntegrationConnectKeyOutput = void
@@ -3870,17 +3860,17 @@ export type IntegrationOauthConnectInput = {
   }["location"]
   readonly methodID: {
     readonly methodID: string
-    readonly inputs: { readonly [x: string]: string }
+    readonly answers: { readonly [x: string]: string | number | boolean | ReadonlyArray<string> }
     readonly label?: string | undefined
   }["methodID"]
-  readonly inputs: {
+  readonly answers: {
     readonly methodID: string
-    readonly inputs: { readonly [x: string]: string }
+    readonly answers: { readonly [x: string]: string | number | boolean | ReadonlyArray<string> }
     readonly label?: string | undefined
-  }["inputs"]
+  }["answers"]
   readonly label?: {
     readonly methodID: string
-    readonly inputs: { readonly [x: string]: string }
+    readonly answers: { readonly [x: string]: string | number | boolean | ReadonlyArray<string> }
     readonly label?: string | undefined
   }["label"]
 }

packages/client/test/promise.test.ts

@@ -147,6 +147,45 @@ test("experimental wellknown integration add uses the public HTTP contract", asy
   expect(await request?.json()).toEqual({ url: "https://example.com" })
 })
 
+test("integration connections submit form answers", async () => {
+  const requests: Request[] = []
+  const client = OpenCode.make({
+    baseUrl: "http://localhost:3000",
+    fetch: async (input, init) => {
+      const request = input instanceof Request ? input : new Request(input, init)
+      requests.push(request)
+      if (request.url.endsWith("/connect/key")) return new Response(null, { status: 204 })
+      return Response.json({
+        location: { directory: "/tmp/project", project: { id: "proj_test", directory: "/tmp/project" } },
+        data: {
+          attemptID: "con_test",
+          url: "https://example.com/authorize",
+          instructions: "Authorize",
+          mode: "auto",
+          time: { created: 1, expires: 2 },
+        },
+      })
+    },
+  })
+
+  await client.integration.connect.key({
+    integrationID: "cloudflare-workers-ai",
+    key: "secret",
+    answers: { accountId: "account" },
+  })
+  await client.integration.oauth.connect({
+    integrationID: "github-copilot",
+    methodID: "device",
+    answers: { deploymentType: "enterprise", enabled: true, scopes: ["read:user"] },
+  })
+
+  expect(await requests[0].json()).toEqual({ key: "secret", answers: { accountId: "account" } })
+  expect(await requests[1].json()).toEqual({
+    methodID: "device",
+    answers: { deploymentType: "enterprise", enabled: true, scopes: ["read:user"] },
+  })
+})
+
 test("health.stop sends exact replacement identity", async () => {
   let request: Request | undefined
   const client = OpenCode.make({

packages/core/src/config/normalize.ts

@@ -41,7 +41,7 @@ export type Result =
   | { readonly type: "rejected"; readonly diagnostics: readonly Diagnostic[] }
 
 const options = { errors: "all", onExcessProperty: "ignore", propertyOrder: "original" } as const
-const unsupportedTopLevel = ["logLevel", "server", "small_model", "subagent_depth", "layout"] as const
+const unsupportedTopLevel = ["logLevel", "server", "subagent_depth", "layout"] as const
 const unsupportedExperimental = [
   "disable_paste_summary",
   "batch_tool",
@@ -113,6 +113,23 @@ export function normalize(input: unknown): Result {
   const legacyAgents = mapValues(decodeMap(input.agent, ConfigAgentV1.Info, ["agent"], diagnostics), (value) =>
     canonical(ConfigAgent.Info, ConfigMigrateV1.migrateAgent(value)),
   )
+  const legacySmallModel = own(input, "small_model")
+    ? decodeValue(Schema.String, input.small_model, ["small_model"], diagnostics)
+    : undefined
+  const migratedSmallModel = legacySmallModel
+    ? ConfigMigrateV1.migrate({ small_model: legacySmallModel }).agents?.title?.model
+    : undefined
+  if (legacySmallModel && !migratedSmallModel)
+    diagnostics.push({
+      kind: "unsupported",
+      path: ["small_model"],
+      message: "omitted unsupported legacy model reference",
+    })
+  if (migratedSmallModel)
+    legacyAgents.title = {
+      model: migratedSmallModel,
+      ...legacyAgents.title,
+    }
   const modeAgents = mapValues(decodeMap(input.mode, ConfigAgentV1.Info, ["mode"], diagnostics), (value) =>
     canonical(ConfigAgent.Info, ConfigMigrateV1.migrateAgent({ ...value, mode: "primary" })),
   )

packages/core/src/config/plugin/agent.ts

@@ -161,11 +161,14 @@ function isPathAction(action: string): action is PathAction {
 }
 
 function expandHome(resource: string, home: string) {
-  if (resource.startsWith("~/")) return home + resource.slice(1)
   if (resource === "~") return home
   if (resource === "$HOME") return home
-  if (resource.startsWith("$HOME/")) return home + resource.slice(5)
-  if (resource.startsWith("$HOME\\")) return home + resource.slice(5)
+  const relative = resource.startsWith("~/")
+    ? resource.slice(2)
+    : resource.startsWith("$HOME/") || resource.startsWith("$HOME\\")
+      ? resource.slice(6)
+      : undefined
+  if (relative !== undefined) return (path.posix.isAbsolute(home) ? path.posix : path.win32).join(home, relative)
   return resource
 }
 

packages/core/src/file-mutation.ts

@@ -7,7 +7,7 @@ import { FSUtil } from "@opencode-ai/util/fs-util"
 import { Bom } from "@opencode-ai/util/bom"
 
 export interface Target {
-  readonly canonical: string
+  readonly absolute: string
   readonly resource: string
 }
 
@@ -37,7 +37,7 @@ export interface Interface {
 export class Service extends Context.Service<Service, Interface>()("@opencode/FileMutation") {}
 
 /**
- * Serialize file changes by canonical target. Conditional writes compare and
+ * Serialize file changes by absolute target. Conditional writes compare and
  * write under the same process-local lock so cooperating OpenCode mutations do
  * not overwrite changes made from the same stale content.
  */
@@ -49,11 +49,11 @@ const layer = Layer.effect(
     const withTargetLock =
       (target: Target) =>
       <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-        locks.withLock(target.canonical)(Effect.uninterruptible(effect))
+        locks.withLock(target.absolute)(Effect.uninterruptible(effect))
 
     const writeResult = (target: Target, existed: boolean): WriteResult => ({
       operation: "write",
-      target: target.canonical,
+      target: target.absolute,
       resource: target.resource,
       existed,
     })
@@ -61,8 +61,8 @@ const layer = Layer.effect(
     const write = Effect.fn("FileMutation.write")((input: WriteInput) =>
       withTargetLock(input.target)(
         Effect.gen(function* () {
-          const existed = yield* fs.exists(input.target.canonical)
-          yield* fs.writeWithDirs(input.target.canonical, input.content)
+          const existed = yield* fs.exists(input.target.absolute)
+          yield* fs.writeWithDirs(input.target.absolute, input.content)
           return writeResult(input.target, existed)
         }),
       ),
@@ -73,10 +73,10 @@ const layer = Layer.effect(
         Effect.gen(function* () {
           const next = Bom.split(input.content)
           const current = yield* fs
-            .readFile(input.target.canonical)
+            .readFile(input.target.absolute)
             .pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined)))
           yield* fs.writeWithDirs(
-            input.target.canonical,
+            input.target.absolute,
             Bom.join(next.text, Boolean(current && Bom.has(current)) || next.bom),
           )
           return writeResult(input.target, current !== undefined)

packages/core/src/form.ts

@@ -180,10 +180,14 @@ export const layer = Layer.effect(
         Effect.gen(function* () {
           const entry = yield* find(input.id)
           if (entry.state.status !== "pending") return yield* new AlreadySettledError({ id: input.id })
-          const invalid = validateAnswer(entry.form, input.answer)
+          const invalid = validateAnswer(entry.form.fields, input.answer)
           if (invalid) return yield* new InvalidAnswerError({ id: input.id, message: invalid })
           const next: TerminalState = { status: "answered", answer: input.answer }
-          yield* bus.publish(Form.Event.Replied, { id: input.id, sessionID: entry.form.sessionID, answer: input.answer })
+          yield* bus.publish(Form.Event.Replied, {
+            id: input.id,
+            sessionID: entry.form.sessionID,
+            answer: input.answer,
+          })
           yield* Cache.set(forms, input.id, { ...entry, state: next })
           yield* Deferred.succeed(entry.deferred, next)
         }),
@@ -223,12 +227,12 @@ export const locationLayer = layer
 
 export const node = makeLocationNode({ service: Service, layer, deps: [Bus.node] })
 
-function validateAnswer(form: Info, answer: Answer) {
-  const fields = new Map(form.fields.map((field) => [field.key, field] as const))
+export function validateAnswer(forms: ReadonlyArray<Form.Field>, answer: Answer) {
+  const fields = new Map(forms.map((field) => [field.key, field] as const))
   for (const key of Object.keys(answer)) {
     if (!fields.has(key)) return `Unknown form field: ${key}`
   }
-  for (const field of form.fields) {
+  for (const field of forms) {
     const value = answer[field.key]
     if (field.type === "external") {
       if (value !== true) return `External form field must be acknowledged: ${field.key}`
@@ -264,7 +268,7 @@ function matches(when: Form.When, value: Form.Value | undefined) {
 // carry a value matching that field's type, and use a declared option when the field's options
 // are closed. Rejecting these at creation surfaces authoring mistakes to the caller instead of
 // silently never matching.
-function validateFields(fields: ReadonlyArray<Form.Field>) {
+export function validateFields(fields: ReadonlyArray<Form.Field>) {
   if (fields.length === 0) return "Form must have at least one field"
   const earlier = new Map<string, InputField>()
   const keys = new Set<string>()

packages/core/src/integration.ts

@@ -24,6 +24,7 @@ import { Bus } from "./bus"
 import { IntegrationConnection } from "./integration/connection"
 import { AppProcess } from "@opencode-ai/util/process"
 import { ChildProcess } from "effect/unstable/process"
+import { Form } from "./form"
 
 export const ID = Integration.ID
 export type ID = Integration.ID
@@ -34,18 +35,6 @@ export type MethodID = Integration.MethodID
 export const AttemptID = Integration.AttemptID
 export type AttemptID = typeof AttemptID.Type
 
-export const When = Integration.When
-export type When = Integration.When
-
-export const TextPrompt = Integration.TextPrompt
-export type TextPrompt = Integration.TextPrompt
-
-export const SelectPrompt = Integration.SelectPrompt
-export type SelectPrompt = Integration.SelectPrompt
-
-export const Prompt = Integration.Prompt
-export type Prompt = Integration.Prompt
-
 export const OAuthMethod = Integration.OAuthMethod
 export type OAuthMethod = Integration.OAuthMethod
 
@@ -64,9 +53,6 @@ export type Method = Integration.Method
 export const Info = Integration.Info
 export type Info = Integration.Info
 
-export const Inputs = Integration.Inputs
-export type Inputs = Integration.Inputs
-
 export type OAuthAuthorization = {
   readonly url: string
   readonly instructions: string
@@ -85,7 +71,7 @@ export type OAuthAuthorization = {
 export interface OAuthImplementation {
   readonly integrationID: ID
   readonly method: OAuthMethod
-  readonly authorize: (inputs: Inputs) => Effect.Effect<OAuthAuthorization, unknown, Scope.Scope>
+  readonly authorize: (answers: Form.Answer) => Effect.Effect<OAuthAuthorization, unknown, Scope.Scope>
   readonly refresh?: (credential: Credential.OAuth) => Effect.Effect<Credential.OAuth, unknown>
   readonly label?: (credential: Credential.OAuth) => string | undefined
 }
@@ -175,6 +161,8 @@ export interface Interface extends State.Transformable<Draft> {
       readonly integrationID: ID
       /** Secret entered by the user. */
       readonly key: string
+      /** Values collected from the method's form fields. */
+      readonly answers: Form.Answer
       /** User-facing label for the stored credential. */
       readonly label?: string
     }) => Effect.Effect<void, AuthorizationError>
@@ -191,7 +179,7 @@ export interface Interface extends State.Transformable<Draft> {
     readonly connect: (input: {
       readonly integrationID: ID
       readonly methodID: MethodID
-      readonly inputs: Inputs
+      readonly answers: Form.Answer
       readonly label?: string
     }) => Effect.Effect<Attempt, AuthorizationError>
     /** Returns the current state of an OAuth attempt. */
@@ -356,7 +344,7 @@ const layer = Layer.effect(
       return [...credentials, ...env]
     }
 
-    const project = (entry: Entry, connections: IntegrationConnection.Info[]) =>
+    const project = (entry: Entry, connections: IntegrationConnection.Info[]): Info =>
       Info.make({
         id: entry.ref.id,
         name: entry.ref.name,
@@ -547,15 +535,20 @@ const layer = Layer.effect(
     const connectOAuth = Effect.fn("Integration.oauth.connect")(function* (input: {
       readonly integrationID: ID
       readonly methodID: MethodID
-      readonly inputs: Inputs
+      readonly answers: Form.Answer
       readonly label?: string
     }) {
       const method = state.get().integrations.get(input.integrationID)?.implementations.get(input.methodID)
       if (!method) {
         return yield* Effect.die(new Error(`OAuth method not found: ${input.integrationID}/${input.methodID}`))
       }
+      if (method.method.forms) {
+        const invalid =
+          Form.validateFields(method.method.forms) ?? Form.validateAnswer(method.method.forms, input.answers)
+        if (invalid) return yield* new AuthorizationError({ cause: new Error(invalid) })
+      }
       const attemptScope = yield* Scope.fork(scope)
-      const authorization = yield* authorize(method.authorize(input.inputs)).pipe(
+      const authorization = yield* authorize(method.authorize(input.answers)).pipe(
         Scope.provide(attemptScope),
         Effect.onExit((exit) => (Exit.isFailure(exit) ? Scope.close(attemptScope, exit) : Effect.void)),
       )
@@ -699,12 +692,23 @@ const layer = Layer.effect(
           const method = state
             .get()
             .integrations.get(input.integrationID)
-            ?.methods.some((method) => method.type === "key")
+            ?.methods.find((method) => method.type === "key")
           if (!method) return yield* Effect.die(new Error(`Key method not found: ${input.integrationID}`))
+          if (method.type === "key" && method.forms) {
+            const invalid = Form.validateFields(method.forms) ?? Form.validateAnswer(method.forms, input.answers)
+            if (invalid) return yield* new AuthorizationError({ cause: new Error(invalid) })
+          }
+          if (method.type === "key" && !method.forms && Object.keys(input.answers).length > 0) {
+            return yield* new AuthorizationError({ cause: new Error("Key method does not accept form answers") })
+          }
           yield* credentials.create({
             integrationID: input.integrationID,
             label: input.label,
-            value: Credential.Key.make({ type: "key", key: input.key }),
+            value: Credential.Key.make({
+              type: "key",
+              key: input.key,
+              ...(Object.keys(input.answers).length > 0 ? { configuration: input.answers } : {}),
+            }),
           })
           yield* bus.publish(Integration.Event.ConnectionUpdated, { integrationID: input.integrationID })
           yield* bus.publish(Integration.Event.Updated, {})

packages/core/src/location-mutation.ts

@@ -23,14 +23,9 @@ export const ResolveInput = Schema.Struct({
 })
 export type ResolveInput = typeof ResolveInput.Type
 
-export class PathError extends Schema.TaggedErrorClass<PathError>()("LocationMutation.PathError", {
-  path: Schema.String,
-  reason: Schema.Literal("non_directory_ancestor"),
-}) {}
-
 export interface ExternalDirectoryAuthorization {
   readonly action: "external_directory"
-  /** Canonical existing directory used as the external approval boundary. */
+  /** Lexical directory used as the external approval boundary. */
   readonly directory: string
   /** `external_directory` permission resource. */
   readonly resource: string
@@ -44,9 +39,9 @@ export const externalDirectoryPermission = (input: ExternalDirectoryAuthorizatio
 })
 
 export interface Target {
-  /** Canonical existing path, or missing path below a canonical directory. */
-  readonly canonical: string
-  /** Permission resource: Location-relative for internal paths, canonical for external paths. */
+  /** Absolute lexical path. */
+  readonly absolute: string
+  /** Permission resource: Location-relative for internal paths, absolute for external paths. */
   readonly resource: string
   readonly externalDirectory?: ExternalDirectoryAuthorization
 }
@@ -57,25 +52,11 @@ export interface Interface {
    * from the Location. Paths outside it require separate `external_directory`
    * approval. This does not approve the mutation.
    */
-  readonly resolve: (input: ResolveInput) => Effect.Effect<Target, PathError | FSUtil.Error>
+  readonly resolve: (input: ResolveInput) => Effect.Effect<Target, FSUtil.Error>
 }
 
 export class Service extends Context.Service<Service, Interface>()("@opencode/LocationMutation") {}
 
-interface ResolvedPath {
-  readonly canonical: string
-  readonly type?:
-    | "File"
-    | "Directory"
-    | "SymbolicLink"
-    | "BlockDevice"
-    | "CharacterDevice"
-    | "FIFO"
-    | "Socket"
-    | "Unknown"
-  readonly directory: string
-}
-
 const slash = (value: string) => value.replaceAll("\\", "/")
 
 const layer = Layer.effect(
@@ -84,65 +65,33 @@ const layer = Layer.effect(
     const fs = yield* FSUtil.Service
     const location = yield* Location.Service
 
-    function notFound<A>(effect: Effect.Effect<A, FSUtil.Error>) {
-      return effect.pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined)))
-    }
-
-    const resolvePath = Effect.fnUntraced(function* (absolute: string) {
-      const existing = yield* notFound(fs.realPath(absolute))
-      if (existing !== undefined) {
-        const info = yield* fs.stat(existing)
-        return {
-          canonical: existing,
-          type: info.type,
-          directory: info.type === "Directory" ? existing : path.dirname(existing),
-        } satisfies ResolvedPath
-      }
-
-      let anchor = path.dirname(absolute)
-      while (true) {
-        const canonical = yield* notFound(fs.realPath(anchor))
-        if (canonical !== undefined) {
-          const info = yield* fs.stat(canonical)
-          if (info.type !== "Directory") {
-            return yield* new PathError({ path: absolute, reason: "non_directory_ancestor" })
-          }
-          return {
-            canonical: path.resolve(canonical, path.relative(anchor, absolute)),
-            directory: canonical,
-          } satisfies ResolvedPath
-        }
-        const parent = path.dirname(anchor)
-        if (parent === anchor) return yield* new PathError({ path: absolute, reason: "non_directory_ancestor" })
-        anchor = parent
-      }
-    })
-
     const resolve = Effect.fn("LocationMutation.resolve")(function* (input: ResolveInput) {
       const absolute = path.resolve(location.directory, input.path)
-      // External access follows the requested path boundary. Symlinks reached through an
-      // internal path intentionally retain internal permission semantics after canonicalization.
-      const lexicallyInternal = FSUtil.contains(location.directory, absolute)
-
-      const resolved = yield* resolvePath(absolute)
-      const external = !lexicallyInternal
-      const resource = external ? slash(resolved.canonical) : slash(path.relative(location.directory, absolute) || ".")
-      const externalDirectory =
-        input.kind === "directory" && resolved.type === "Directory" ? resolved.canonical : resolved.directory
+      if (FSUtil.contains(location.directory, absolute)) {
+        return {
+          absolute,
+          resource: slash(path.relative(location.directory, absolute) || "."),
+        } satisfies Target
+      }
+      const type =
+        input.kind === "directory"
+          ? "Directory"
+          : (yield* fs
+              .stat(absolute)
+              .pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined))))?.type
+      const externalDirectory = type === "Directory" ? absolute : path.dirname(absolute)
       const externalResource = slash(path.join(externalDirectory, "*"))
       return {
-        canonical: resolved.canonical,
-        resource,
-        externalDirectory: external
-          ? {
-              action: "external_directory",
-              directory: externalDirectory,
-              resource: externalResource,
-              save: slash(
-                path.join((yield* Project.root(fs, AbsolutePath.make(externalDirectory))) ?? externalDirectory, "*"),
-              ),
-            }
-          : undefined,
+        absolute,
+        resource: slash(absolute),
+        externalDirectory: {
+          action: "external_directory",
+          directory: externalDirectory,
+          resource: externalResource,
+          save: slash(
+            path.join((yield* Project.root(fs, AbsolutePath.make(externalDirectory))) ?? externalDirectory, "*"),
+          ),
+        },
       } satisfies Target
     })
 

packages/core/src/model-resolver.ts

@@ -149,6 +149,7 @@ export const fromCatalogModel = (
   })
   const packageName = Provider.packageName(resolved.package)
   const key = apiKey(resolved, credential)
+  const configuration = credential?.type === "key" ? credential.configuration : undefined
 
   if (Provider.isAISDK(resolved.package) && packageName === "@ai-sdk/openai") {
     return Effect.succeed(
@@ -175,7 +176,7 @@ export const fromCatalogModel = (
         .model({ id: resolved.modelID ?? resolved.id, compatibility: resolved.compatibility }),
     )
   }
-  const configured = { ...resolved.settings, ...credential?.metadata }
+  const configured = { ...resolved.settings, ...credential?.metadata, ...configuration }
   const mapping = Provider.isAISDK(resolved.package)
     ? AISDKNative.map({
         packageName,
@@ -190,6 +191,7 @@ export const fromCatalogModel = (
       draft.settings = Provider.mergeOverlay(draft.settings, {
         ...nativeCredentialSettings(resolved.package ?? "", credential),
         ...credential?.metadata,
+        ...configuration,
       })
     })
     return dependencies.loadAISDK(runtime).pipe(Effect.mapError(() => unsupported(resolved)))

packages/core/src/plugin/host.ts

@@ -47,17 +47,13 @@ export const make = Effect.fn("PluginHost.make")(function* (plugin: import("../p
       workspaceID: location.workspaceID,
       project: location.project,
     })
-  const locationRef = (input?: {
-    readonly location?: { readonly directory?: string; readonly workspace?: string }
-  }) =>
+  const locationRef = (input?: { readonly location?: { readonly directory?: string; readonly workspace?: string } }) =>
     input?.location === undefined
       ? undefined
       : Location.Ref.make({
           directory: AbsolutePath.make(input.location.directory ?? location.directory),
           workspaceID:
-            input.location.workspace === undefined
-              ? location.workspaceID
-              : Workspace.ID.make(input.location.workspace),
+            input.location.workspace === undefined ? location.workspaceID : Workspace.ID.make(input.location.workspace),
         })
   const isCurrentLocation = (ref: Location.Ref) =>
     ref.directory === location.directory && ref.workspaceID === location.workspaceID
@@ -74,7 +70,12 @@ export const make = Effect.fn("PluginHost.make")(function* (plugin: import("../p
           ref && !isCurrentLocation(ref)
             ? runtime.location.agent
                 .list(ref)
-                .pipe(Effect.map((result) => ({ ...result, data: result.data.find((agent) => agent.id === input.agentID) })))
+                .pipe(
+                  Effect.map((result) => ({
+                    ...result,
+                    data: result.data.find((agent) => agent.id === input.agentID),
+                  })),
+                )
             : response(agents.get(input.agentID))
         return output.pipe(
           Effect.flatMap((result) =>
@@ -162,8 +163,7 @@ export const make = Effect.fn("PluginHost.make")(function* (plugin: import("../p
                 mutable(draft.model.get(Provider.ID.make(providerID), Model.ID.make(modelID))),
               update: (providerID, modelID, update) =>
                 draft.model.update(Provider.ID.make(providerID), Model.ID.make(modelID), update),
-              remove: (providerID, modelID) =>
-                draft.model.remove(Provider.ID.make(providerID), Model.ID.make(modelID)),
+              remove: (providerID, modelID) => draft.model.remove(Provider.ID.make(providerID), Model.ID.make(modelID)),
               default: {
                 get: draft.model.default.get,
                 set: (providerID, modelID) =>
@@ -192,6 +192,7 @@ export const make = Effect.fn("PluginHost.make")(function* (plugin: import("../p
           integration.connection.key({
             integrationID: Integration.ID.make(input.integrationID),
             key: input.key,
+            answers: input.answers,
             label: input.label,
           }),
       },
@@ -201,7 +202,7 @@ export const make = Effect.fn("PluginHost.make")(function* (plugin: import("../p
             integration.oauth.connect({
               integrationID: Integration.ID.make(input.integrationID),
               methodID: Integration.MethodID.make(input.methodID),
-              inputs: input.inputs,
+              answers: input.answers,
               label: input.label,
             }),
           ),
@@ -364,9 +365,14 @@ function methodImplementation(input: IntegrationMethodRegistration): Integration
     const refresh = input.refresh
     return {
       integrationID: Integration.ID.make(input.integrationID),
-      method: { ...input.method, id: Integration.MethodID.make(input.method.id) },
-      authorize: (inputs) =>
-        input.authorize(inputs).pipe(
+      method: Schema.decodeUnknownSync(Integration.OAuthMethod)({
+        id: Integration.MethodID.make(input.method.id),
+        type: "oauth",
+        label: input.method.label,
+        ...(input.method.forms === undefined ? {} : { forms: input.method.forms }),
+      }),
+      authorize: (answers) =>
+        input.authorize(answers).pipe(
           Effect.map((authorization) => {
             if (authorization.mode === "auto") {
               return {
@@ -398,7 +404,11 @@ function methodImplementation(input: IntegrationMethodRegistration): Integration
   }
   return {
     integrationID: Integration.ID.make(input.integrationID),
-    method: { type: "key", label: input.method.label },
+    method: Schema.decodeUnknownSync(Integration.KeyMethod)({
+      type: "key",
+      ...(input.method.label === undefined ? {} : { label: input.method.label }),
+      ...(input.method.forms === undefined ? {} : { forms: input.method.forms }),
+    }),
   }
 }
 

packages/core/src/plugin/promise.ts

@@ -179,8 +179,8 @@ export function fromPromise(plugin: Plugin) {
                         const refresh = input.refresh
                         draft.method.update({
                           ...input,
-                          authorize: (inputs) =>
-                            Effect.promise(() => input.authorize(inputs)).pipe(
+                          authorize: (answers) =>
+                            Effect.promise(() => input.authorize(answers)).pipe(
                               Effect.map((authorization) =>
                                 authorization.mode === "auto"
                                   ? {
@@ -359,11 +359,17 @@ type Wire<Value> = unknown extends Value
     ? Value
     : Value extends DateTime.DateTime
       ? number
-      : Value extends ReadonlyArray<infer Item>
-        ? Array<Wire<Item>>
-        : Value extends object
-          ? { -readonly [Key in keyof Value]: Wire<Value[Key]> }
-          : Value
+      : Value extends readonly [infer Head, ...infer Tail]
+        ? [Wire<Head>, ...WireTuple<Tail>]
+        : Value extends ReadonlyArray<infer Item>
+          ? Array<Wire<Item>>
+          : Value extends object
+            ? { -readonly [Key in keyof Value]: Wire<Value[Key]> }
+            : Value
+
+type WireTuple<Value extends ReadonlyArray<unknown>> = {
+  -readonly [Key in keyof Value]: Wire<Value[Key]>
+}
 
 function wire<Value>(value: Value): Wire<Value>
 function wire(value: unknown): unknown {

packages/core/src/plugin/provider/azure.ts

@@ -1,6 +1,7 @@
 import { Effect } from "effect"
 import { define } from "@opencode-ai/plugin/effect/plugin"
 import { Provider } from "../../provider"
+import { configuredSettings } from "./configured"
 
 function selectLanguage(sdk: any, modelID: string, useChat: boolean) {
   if (useChat && sdk.chat) return sdk.chat(modelID)
@@ -13,6 +14,29 @@ function selectLanguage(sdk: any, modelID: string, useChat: boolean) {
 export const AzurePlugin = define({
   id: "opencode.provider.azure",
   effect: Effect.fn(function* (ctx) {
+    const configured = yield* configuredSettings(Provider.ID.azure)
+    yield* ctx.integration.transform((draft) => {
+      draft.method.update({
+        integrationID: Provider.ID.azure,
+        method: {
+          type: "key",
+          label: "API key",
+          ...(resolveResourceName(configured) || typeof configured?.baseURL === "string"
+            ? {}
+            : {
+                forms: [
+                  {
+                    type: "string",
+                    key: "resourceName",
+                    title: "Enter Azure Resource Name",
+                    placeholder: "e.g. my-models",
+                    required: true,
+                  },
+                ],
+              }),
+        },
+      })
+    })
     yield* ctx.catalog.transform((evt) => {
       for (const item of evt.provider.list()) {
         if (item.provider.id !== Provider.ID.azure && Provider.packageName(item.provider.package) !== "@ai-sdk/azure")

packages/core/src/plugin/provider/cloudflare-ai-gateway.ts

@@ -2,10 +2,53 @@ import os from "os"
 import { App } from "../../app"
 import { Effect, Option, Schema } from "effect"
 import { define } from "@opencode-ai/plugin/effect/plugin"
+import { Provider } from "../../provider"
+import { configuredSettings } from "./configured"
+
+const providerID = Provider.ID.make("cloudflare-ai-gateway")
 
 export const CloudflareAIGatewayPlugin = define({
   id: "opencode.provider.cloudflare-ai-gateway",
   effect: Effect.fn(function* (ctx) {
+    const configured = yield* configuredSettings(providerID)
+    const complete = typeof configured?.baseURL === "string"
+    yield* ctx.integration.transform((draft) => {
+      const forms = [
+        ...(complete || process.env.CLOUDFLARE_ACCOUNT_ID || stringOption(configured ?? {}, "accountId")
+          ? []
+          : [
+              {
+                type: "string" as const,
+                key: "accountId",
+                title: "Enter your Cloudflare Account ID",
+                placeholder: "e.g. 1234567890abcdef1234567890abcdef",
+                required: true,
+              },
+            ]),
+        ...(complete ||
+        process.env.CLOUDFLARE_GATEWAY_ID ||
+        stringOption(configured ?? {}, "gatewayId") ||
+        stringOption(configured ?? {}, "gateway")
+          ? []
+          : [
+              {
+                type: "string" as const,
+                key: "gatewayId",
+                title: "Enter your Cloudflare AI Gateway ID",
+                placeholder: "e.g. my-gateway",
+                required: true,
+              },
+            ]),
+      ]
+      draft.method.update({
+        integrationID: providerID,
+        method: {
+          type: "key",
+          label: "Gateway API token",
+          ...(forms[0] ? { forms: [forms[0], ...forms.slice(1)] } : {}),
+        },
+      })
+    })
     yield* ctx.aisdk.hook(
       "sdk",
       Effect.fn(function* (evt) {
@@ -46,7 +89,7 @@ const decodeJson = Schema.decodeUnknownOption(Schema.UnknownFromJsonString)
 
 function gatewayConfig(options: Record<string, unknown>): GatewayConfig | undefined {
   const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? stringOption(options, "accountId")
-  // Credential projection copies key metadata into options. The prompt stores the
+  // Credential projection copies key metadata into options. The form stores the
   // gateway as gatewayId, while older config examples may use gateway.
   const gatewayId =
     process.env.CLOUDFLARE_GATEWAY_ID ?? stringOption(options, "gatewayId") ?? stringOption(options, "gateway")

packages/core/src/plugin/provider/cloudflare-workers-ai.ts

@@ -3,12 +3,36 @@ import { App } from "../../app"
 import { Effect } from "effect"
 import { define } from "@opencode-ai/plugin/effect/plugin"
 import { Provider } from "../../provider"
+import { configuredSettings } from "./configured"
 
 const providerID = Provider.ID.make("cloudflare-workers-ai")
 
 export const CloudflareWorkersAIPlugin = define({
   id: "opencode.provider.cloudflare-workers-ai",
   effect: Effect.fn(function* (ctx) {
+    const configured = yield* configuredSettings(providerID)
+    yield* ctx.integration.transform((draft) => {
+      draft.method.update({
+        integrationID: providerID,
+        method: {
+          type: "key",
+          label: "API key",
+          ...(typeof configured?.baseURL === "string" || resolveAccountId(configured ?? {})
+            ? {}
+            : {
+                forms: [
+                  {
+                    type: "string",
+                    key: "accountId",
+                    title: "Enter your Cloudflare Account ID",
+                    placeholder: "e.g. 1234567890abcdef1234567890abcdef",
+                    required: true,
+                  },
+                ],
+              }),
+        },
+      })
+    })
     yield* ctx.catalog.transform((evt) => {
       const item = evt.provider.get(providerID)
       if (!item) return

packages/core/src/plugin/provider/configured.ts

@@ -0,0 +1,15 @@
+import { Effect, Option } from "effect"
+import type { Document } from "@opencode-ai/schema/config"
+import { Catalog } from "../../catalog"
+import { Config } from "../../config"
+import { Provider } from "../../provider"
+
+export const configuredSettings = Effect.fn("ProviderPlugin.configuredSettings")(function* (id: Provider.ID) {
+  const catalog = yield* Catalog.Service
+  const current = (yield* catalog.provider.get(id))?.settings
+  const service = yield* Effect.serviceOption(Config.Service)
+  const entries = Option.isSome(service) ? yield* service.value.entries() : []
+  return entries
+    .filter((entry): entry is Document => entry.type === "document")
+    .reduce((settings, entry) => Provider.mergeOverlay(settings, entry.info.providers?.[id]?.settings), current)
+})

packages/core/src/plugin/provider/github-copilot.ts

@@ -46,30 +46,33 @@ const oauth = (app: App.Info) => ({
     id: methodID,
     type: "oauth",
     label: "Login with GitHub Copilot",
-    prompts: [
+    forms: [
       {
-        type: "select",
+        type: "string",
         key: "deploymentType",
-        message: "Select GitHub deployment type",
+        title: "Select GitHub deployment type",
+        required: true,
         options: [
-          { label: "GitHub.com", value: "github.com", hint: "Public" },
-          { label: "GitHub Enterprise", value: "enterprise", hint: "Data residency or self-hosted" },
+          { label: "GitHub.com", value: "github.com", description: "Public" },
+          { label: "GitHub Enterprise", value: "enterprise", description: "Data residency or self-hosted" },
         ],
       },
       {
-        type: "text",
+        type: "string",
         key: "enterpriseUrl",
-        message: "Enter your GitHub Enterprise URL or domain",
+        title: "Enter your GitHub Enterprise URL or domain",
         placeholder: "company.ghe.com or https://company.ghe.com",
-        when: { key: "deploymentType", op: "eq", value: "enterprise" },
+        required: true,
+        when: [{ key: "deploymentType", op: "eq", value: "enterprise" }],
       },
     ],
   },
-  authorize: (inputs) =>
+  authorize: (answers) =>
     Effect.gen(function* () {
-      const enterprise = inputs.deploymentType === "enterprise"
-      if (enterprise && !inputs.enterpriseUrl) return yield* Effect.fail(new Error("Enterprise URL is required"))
-      const domain = enterprise ? normalizeDomain(inputs.enterpriseUrl ?? "") : "github.com"
+      const enterprise = answers.deploymentType === "enterprise"
+      const enterpriseUrl = typeof answers.enterpriseUrl === "string" ? answers.enterpriseUrl : undefined
+      if (enterprise && !enterpriseUrl) return yield* Effect.fail(new Error("Enterprise URL is required"))
+      const domain = enterprise ? normalizeDomain(enterpriseUrl ?? "") : "github.com"
       const urls = oauthURLs(domain)
       const device = yield* request(urls.device, {
         method: "POST",

packages/core/src/plugin/provider/opencode.ts

@@ -43,9 +43,9 @@ function oauth(http: HttpClient.HttpClient) {
       type: "oauth",
       label: "OpenCode Console account",
     },
-    authorize: (inputs) =>
+    authorize: (answers) =>
       Effect.gen(function* () {
-        const server = yield* normalizeServer(inputs.server ?? defaultServer)
+        const server = yield* normalizeServer(typeof answers.server === "string" ? answers.server : defaultServer)
         const device = yield* post(http, `${server}/auth/device/code`, { client_id: clientID }, Device)
         const verification = URL.canParse(device.verification_uri_complete)
           ? new URL(device.verification_uri_complete)

packages/core/src/tool/plugin/edit.ts

@@ -116,124 +116,120 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-              name,
-              options: { codemode: false, permission: "edit" },
-              description:
-                "Edit the contents of a file by finding and replacing exact text. When editing text from Read output, preserve the exact indentation (tabs or spaces) and omit the line-number prefix, such as `1: `. Never include the prefix in oldString or newString. The edit fails if oldString is not found. By default, oldString must identify a UNIQUE location. Multiple matches FAIL unless replaceAll is true. Add more surrounding context to disambiguate, or set replaceAll to true to replace every occurrence. Use replaceAll when the change should apply to every occurrence, such as renaming a variable.",
-              input: Input,
-              output: Output,
-              execute: (input, context) => {
-                return Effect.gen(function* () {
-                  const permissionSource = {
-                    type: "tool" as const,
-                    messageID: context.messageID,
-                    id: context.id,
-                  }
-                  if (input.oldString === input.newString) {
-                    return yield* new ToolFailure({
-                      message: "No changes to apply: oldString and newString are identical.",
-                    })
-                  }
-                  if (input.oldString === "") {
-                    return yield* new ToolFailure({
-                      message: "oldString must not be empty. Use write to create or overwrite a file.",
-                    })
-                  }
+        draft.add({
+          name,
+          options: { codemode: false, permission: "edit" },
+          description:
+            "Edit the contents of a file by finding and replacing exact text. When editing text from Read output, preserve the exact indentation (tabs or spaces) and omit the line-number prefix, such as `1: `. Never include the prefix in oldString or newString. The edit fails if oldString is not found. By default, oldString must identify a UNIQUE location. Multiple matches FAIL unless replaceAll is true. Add more surrounding context to disambiguate, or set replaceAll to true to replace every occurrence. Use replaceAll when the change should apply to every occurrence, such as renaming a variable.",
+          input: Input,
+          output: Output,
+          execute: (input, context) => {
+            return Effect.gen(function* () {
+              const permissionSource = {
+                type: "tool" as const,
+                messageID: context.messageID,
+                id: context.id,
+              }
+              if (input.oldString === input.newString) {
+                return yield* new ToolFailure({
+                  message: "No changes to apply: oldString and newString are identical.",
+                })
+              }
+              if (input.oldString === "") {
+                return yield* new ToolFailure({
+                  message: "oldString must not be empty. Use write to create or overwrite a file.",
+                })
+              }
 
-                  const target = yield* mutation.resolve({ path: input.path, kind: "file" })
-                  const external = target.externalDirectory
-                  if (external) {
-                    yield* permission.assert({
-                      ...LocationMutation.externalDirectoryPermission(external),
-                      sessionID: context.sessionID,
-                      agent: context.agent,
-                      source: permissionSource,
-                    })
-                  }
+              const target = yield* mutation.resolve({ path: input.path, kind: "file" })
+              const external = target.externalDirectory
+              if (external) {
+                yield* permission.assert({
+                  ...LocationMutation.externalDirectoryPermission(external),
+                  sessionID: context.sessionID,
+                  agent: context.agent,
+                  source: permissionSource,
+                })
+              }
 
-                  const info = yield* fs.stat(target.canonical).pipe(
-                    Effect.catchReason("PlatformError", "NotFound", () =>
-                      Effect.fail(new ToolFailure({ message: `File not found: ${input.path}` })),
-                    ),
-                  )
-                  if (info.type === "Directory") {
-                    return yield* new ToolFailure({ message: `Path is a directory, not a file: ${input.path}` })
-                  }
-                  const original = yield* Bom.readFile(fs, target.canonical)
-                  const source = original.text
-                  const ending = source.includes(crlf) ? crlf : "\n"
-                  const oldString = input.oldString.replaceAll(crlf, "\n").replaceAll("\n", ending)
-                  const newString = input.newString.replaceAll(crlf, "\n").replaceAll("\n", ending)
-                  const exact = findOccurrences(source, oldString)
-                  // These one-to-one mappings preserve offsets into the original source.
-                  const unicode =
-                    exact.length > 0 ? [] : findOccurrences(normalizeForMatch(source), normalizeForMatch(oldString))
-                  const trailing =
-                    exact.length > 0 || unicode.length > 0
-                      ? []
-                      : findLineOccurrences(source, oldString)
-                  const matches = exact.length > 0 ? exact : unicode.length > 0 ? unicode : trailing
-                  const replacements = matches.length
-                  const replaced = (input.replaceAll === true ? matches : matches.slice(0, 1))
-                    .toReversed()
-                    .reduce(
-                      (content, match) =>
-                        `${content.slice(0, match.start)}${newString}${content.slice(match.end)}`,
-                      source,
-                    )
-                  const preview =
-                    replacements > 0 && (replacements === 1 || input.replaceAll === true)
-                      ? fileDiff(target.resource, source, replaced)
-                      : undefined
-                  yield* permission.assert({
-                    action: "edit",
-                    resources: [target.resource],
-                    save: ["*"],
-                    metadata: preview ? { files: [preview] } : undefined,
-                    sessionID: context.sessionID,
-                    agent: context.agent,
-                    source: permissionSource,
-                  })
-                  if (replacements === 0) {
-                    return yield* new ToolFailure({
-                      message: `Could not find oldString in ${input.path}. It must match exactly, including whitespace and indentation.`,
-                    })
-                  }
-                  if (replacements > 1 && input.replaceAll !== true) {
-                    return yield* new ToolFailure({
-                      message: `Found ${replacements} matches for oldString, but expected exactly one. Add more surrounding context to make oldString unique, or set replaceAll to true to replace every occurrence.`,
-                    })
-                  }
-                  const replacementBom = replaced.startsWith("\uFEFF")
-                  const result = yield* files.write({
-                    target,
-                    content: Bom.join(replaced, original.bom || replacementBom),
-                  })
-                  const bom = original.bom || replacementBom
-                  const formatted = (yield* formatter.file(target.canonical))
-                    ? yield* Bom.syncFile(fs, target.canonical, bom)
-                    : (yield* Bom.readFile(fs, target.canonical)).text
-                  return {
-                    files: [fileDiff(result.resource, source, formatted)],
-                    replacements,
-                  } satisfies Output
-                }).pipe(
-                  Effect.map((output) => ({
-                    output,
-                    content: `Edited ${output.files[0]?.file} (${output.replacements} replacement${output.replacements === 1 ? "" : "s"})`,
-                    metadata: { files: output.files },
-                  })),
-                  Effect.mapError((error) =>
-                    error instanceof ToolFailure
-                      ? error
-                      : new ToolFailure({ message: `Unable to edit ${input.path}`, error }),
+              const info = yield* fs
+                .stat(target.absolute)
+                .pipe(
+                  Effect.catchReason("PlatformError", "NotFound", () =>
+                    Effect.fail(new ToolFailure({ message: `File not found: ${input.path}` })),
                   ),
                 )
-              },
-            }),
-        ),
+              if (info.type === "Directory") {
+                return yield* new ToolFailure({ message: `Path is a directory, not a file: ${input.path}` })
+              }
+              const original = yield* Bom.readFile(fs, target.absolute)
+              const source = original.text
+              const ending = source.includes(crlf) ? crlf : "\n"
+              const oldString = input.oldString.replaceAll(crlf, "\n").replaceAll("\n", ending)
+              const newString = input.newString.replaceAll(crlf, "\n").replaceAll("\n", ending)
+              const exact = findOccurrences(source, oldString)
+              // These one-to-one mappings preserve offsets into the original source.
+              const unicode =
+                exact.length > 0 ? [] : findOccurrences(normalizeForMatch(source), normalizeForMatch(oldString))
+              const trailing = exact.length > 0 || unicode.length > 0 ? [] : findLineOccurrences(source, oldString)
+              const matches = exact.length > 0 ? exact : unicode.length > 0 ? unicode : trailing
+              const replacements = matches.length
+              const replaced = (input.replaceAll === true ? matches : matches.slice(0, 1))
+                .toReversed()
+                .reduce(
+                  (content, match) => `${content.slice(0, match.start)}${newString}${content.slice(match.end)}`,
+                  source,
+                )
+              const preview =
+                replacements > 0 && (replacements === 1 || input.replaceAll === true)
+                  ? fileDiff(target.resource, source, replaced)
+                  : undefined
+              yield* permission.assert({
+                action: "edit",
+                resources: [target.resource],
+                save: ["*"],
+                metadata: preview ? { files: [preview] } : undefined,
+                sessionID: context.sessionID,
+                agent: context.agent,
+                source: permissionSource,
+              })
+              if (replacements === 0) {
+                return yield* new ToolFailure({
+                  message: `Could not find oldString in ${input.path}. It must match exactly, including whitespace and indentation.`,
+                })
+              }
+              if (replacements > 1 && input.replaceAll !== true) {
+                return yield* new ToolFailure({
+                  message: `Found ${replacements} matches for oldString, but expected exactly one. Add more surrounding context to make oldString unique, or set replaceAll to true to replace every occurrence.`,
+                })
+              }
+              const replacementBom = replaced.startsWith("\uFEFF")
+              const result = yield* files.write({
+                target,
+                content: Bom.join(replaced, original.bom || replacementBom),
+              })
+              const bom = original.bom || replacementBom
+              const formatted = (yield* formatter.file(target.absolute))
+                ? yield* Bom.syncFile(fs, target.absolute, bom)
+                : (yield* Bom.readFile(fs, target.absolute)).text
+              return {
+                files: [fileDiff(result.resource, source, formatted)],
+                replacements,
+              } satisfies Output
+            }).pipe(
+              Effect.map((output) => ({
+                output,
+                content: `Edited ${output.files[0]?.file} (${output.replacements} replacement${output.replacements === 1 ? "" : "s"})`,
+                metadata: { files: output.files },
+              })),
+              Effect.mapError((error) =>
+                error instanceof ToolFailure
+                  ? error
+                  : new ToolFailure({ message: `Unable to edit ${input.path}`, error }),
+              ),
+            )
+          },
+        }),
       )
       .pipe(Effect.orDie)
   }),

packages/core/src/tool/plugin/glob.ts

@@ -50,96 +50,93 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-            name,
-            options: { codemode: false },
-            description:
-              'Search file paths using a glob pattern (examples: "**/*.ts", "src/**/*.tsx").',
-            input: Input,
-            output: Output,
-            execute: (input, context) =>
-              Effect.gen(function* () {
-                const searchPath = input.path === "undefined" || input.path === "null" ? undefined : input.path
-                const source = { type: "tool" as const, messageID: context.messageID, id: context.id }
-                const target = yield* mutation.resolve({ path: searchPath ?? ".", kind: "directory" })
-                const external = target.externalDirectory
-                if (external)
-                  yield* permission.assert({
-                    ...LocationMutation.externalDirectoryPermission(external),
-                    sessionID: context.sessionID,
-                    agent: context.agent,
-                    source,
-                  })
+        draft.add({
+          name,
+          options: { codemode: false },
+          description: 'Search file paths using a glob pattern (examples: "**/*.ts", "src/**/*.tsx").',
+          input: Input,
+          output: Output,
+          execute: (input, context) =>
+            Effect.gen(function* () {
+              const searchPath = input.path === "undefined" || input.path === "null" ? undefined : input.path
+              const source = { type: "tool" as const, messageID: context.messageID, id: context.id }
+              const target = yield* mutation.resolve({ path: searchPath ?? ".", kind: "directory" })
+              const external = target.externalDirectory
+              if (external)
                 yield* permission.assert({
-                  action: name,
-                  resources: [input.pattern],
-                  save: ["*"],
-                  metadata: {
-                    root: searchPath ?? ".",
-                    path: searchPath,
-                    limit: input.limit,
-                  },
+                  ...LocationMutation.externalDirectoryPermission(external),
                   sessionID: context.sessionID,
                   agent: context.agent,
                   source,
                 })
-                const info = yield* fs
-                  .stat(target.canonical)
-                  .pipe(
-                    Effect.catchReason("PlatformError", "NotFound", () =>
-                      Effect.fail(new ToolFailure({ message: `Search path does not exist: ${searchPath ?? "."}` })),
-                    ),
-                  )
-                if (info.type !== "Directory")
-                  return yield* Effect.fail(
-                    new ToolFailure({ message: `Search path is not a directory: ${searchPath ?? "."}` }),
-                  )
-                const root = path.resolve(location.directory, searchPath ?? ".")
-                const limit = input.limit ?? FileSystem.DEFAULT_SEARCH_LIMIT
-                const entries = yield* ripgrep
-                  .glob({
-                    cwd: target.canonical,
-                    pattern: input.pattern,
-                    limit: limit + 1,
-                  })
-                  .pipe(
-                    Effect.timeoutOrElse({
-                      duration: FileSystem.DEFAULT_SEARCH_TIMEOUT_MS,
-                      orElse: () =>
-                        Effect.fail(
-                          new ToolFailure({
-                            message: `Search timed out after ${FileSystem.DEFAULT_SEARCH_TIMEOUT_MS / 1_000} seconds. Consider using a more specific path or pattern.`,
-                          }),
-                        ),
-                    }),
-                    Effect.map((result) =>
-                      result.map((entry) =>
-                        FileSystem.Entry.make({
-                          ...entry,
-                          path: RelativePath.make(path.relative(location.directory, path.resolve(root, entry.path))),
+              yield* permission.assert({
+                action: name,
+                resources: [input.pattern],
+                save: ["*"],
+                metadata: {
+                  root: searchPath ?? ".",
+                  path: searchPath,
+                  limit: input.limit,
+                },
+                sessionID: context.sessionID,
+                agent: context.agent,
+                source,
+              })
+              const info = yield* fs
+                .stat(target.absolute)
+                .pipe(
+                  Effect.catchReason("PlatformError", "NotFound", () =>
+                    Effect.fail(new ToolFailure({ message: `Search path does not exist: ${searchPath ?? "."}` })),
+                  ),
+                )
+              if (info.type !== "Directory")
+                return yield* Effect.fail(
+                  new ToolFailure({ message: `Search path is not a directory: ${searchPath ?? "."}` }),
+                )
+              const root = path.resolve(location.directory, searchPath ?? ".")
+              const limit = input.limit ?? FileSystem.DEFAULT_SEARCH_LIMIT
+              const entries = yield* ripgrep
+                .glob({
+                  cwd: target.absolute,
+                  pattern: input.pattern,
+                  limit: limit + 1,
+                })
+                .pipe(
+                  Effect.timeoutOrElse({
+                    duration: FileSystem.DEFAULT_SEARCH_TIMEOUT_MS,
+                    orElse: () =>
+                      Effect.fail(
+                        new ToolFailure({
+                          message: `Search timed out after ${FileSystem.DEFAULT_SEARCH_TIMEOUT_MS / 1_000} seconds. Consider using a more specific path or pattern.`,
                         }),
                       ),
+                  }),
+                  Effect.map((result) =>
+                    result.map((entry) =>
+                      FileSystem.Entry.make({
+                        ...entry,
+                        path: RelativePath.make(path.relative(location.directory, path.resolve(root, entry.path))),
+                      }),
                     ),
-                  )
-                return { entries: entries.slice(0, limit), truncated: entries.length > limit }
-              }).pipe(
-                Effect.map((result) => ({
-                  output: result.entries,
-                  content: toModelContent(
-                    result.entries.map((entry) => ({ ...entry, path: path.resolve(location.directory, entry.path) })),
-                    result.truncated,
                   ),
-                  metadata: { count: result.entries.length, truncated: result.truncated },
-                })),
-                Effect.mapError((error) =>
-                  error instanceof ToolFailure
-                    ? error
-                    : new ToolFailure({ message: `Unable to find files matching ${input.pattern}`, error }),
+                )
+              return { entries: entries.slice(0, limit), truncated: entries.length > limit }
+            }).pipe(
+              Effect.map((result) => ({
+                output: result.entries,
+                content: toModelContent(
+                  result.entries.map((entry) => ({ ...entry, path: path.resolve(location.directory, entry.path) })),
+                  result.truncated,
                 ),
+                metadata: { count: result.entries.length, truncated: result.truncated },
+              })),
+              Effect.mapError((error) =>
+                error instanceof ToolFailure
+                  ? error
+                  : new ToolFailure({ message: `Unable to find files matching ${input.pattern}`, error }),
               ),
-          }),
-        ),
+            ),
+        }),
       )
       .pipe(Effect.orDie)
   }),

packages/core/src/tool/plugin/patch.ts

@@ -58,7 +58,7 @@ type Prepared =
     })
 
 interface Target {
-  readonly canonical: string
+  readonly absolute: string
   readonly resource: string
   readonly externalDirectory?: {
     readonly directory: string
@@ -76,267 +76,256 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-              name,
-              options: { codemode: false, permission: "edit" },
-              description: DESCRIPTION,
-              input: Input,
-              output: Output,
-              execute: (input, context) => {
-                const applied: Array<typeof Applied.Type> = []
-                const fail = (operation: string, error: unknown) => {
-                  const completed = applied.map((item) => item.resource).join(", ")
-                  return new ToolFailure({
-                    message: `${operation}: ${errorMessage(error)}${completed ? `. Completed before failure: ${completed}` : ""}`,
-                  })
-                }
-                return Effect.gen(function* () {
-                  const source = {
-                    type: "tool" as const,
-                    messageID: context.messageID,
-                    id: context.id,
+        draft.add({
+          name,
+          options: { codemode: false, permission: "edit" },
+          description: DESCRIPTION,
+          input: Input,
+          output: Output,
+          execute: (input, context) => {
+            const applied: Array<typeof Applied.Type> = []
+            const fail = (operation: string, error: unknown) => {
+              const completed = applied.map((item) => item.resource).join(", ")
+              return new ToolFailure({
+                message: `${operation}: ${errorMessage(error)}${completed ? `. Completed before failure: ${completed}` : ""}`,
+              })
+            }
+            return Effect.gen(function* () {
+              const source = {
+                type: "tool" as const,
+                messageID: context.messageID,
+                id: context.id,
+              }
+              if (!input.patchText) return yield* new ToolFailure({ message: "patchText is required" })
+              const hunks = yield* Effect.fromResult(Patch.parse(input.patchText)).pipe(
+                Effect.mapError((error) => new ToolFailure({ message: `patch verification failed: ${error.message}` })),
+              )
+              if (hunks.length === 0) {
+                return yield* new ToolFailure({ message: "patch rejected: empty patch" })
+              }
+              const prepared: Prepared[] = []
+              const targets: Target[] = []
+              const updates = new Map<string, string>()
+              for (const hunk of hunks) {
+                yield* Effect.gen(function* () {
+                  const target = resolveTarget(location, hunk.path)
+                  targets.push(target)
+                  if (target.externalDirectory) {
+                    yield* permission.assert({
+                      action: "external_directory",
+                      resources: [target.externalDirectory.resource],
+                      save: [target.externalDirectory.resource],
+                      metadata: {
+                        filepath: target.absolute,
+                        parentDir: target.externalDirectory.directory,
+                      },
+                      sessionID: context.sessionID,
+                      agent: context.agent,
+                      source,
+                    })
                   }
-                  if (!input.patchText) return yield* new ToolFailure({ message: "patchText is required" })
-                  const hunks = yield* Effect.fromResult(Patch.parse(input.patchText)).pipe(
-                    Effect.mapError(
-                      (error) => new ToolFailure({ message: `patch verification failed: ${error.message}` }),
-                    ),
-                  )
-                  if (hunks.length === 0) {
-                    return yield* new ToolFailure({ message: "patch rejected: empty patch" })
+                  if (hunk.type === "add") {
+                    prepared.push({
+                      ...hunk,
+                      target,
+                      before: "",
+                      after: Bom.split(
+                        hunk.contents.endsWith("\n") || hunk.contents === "" ? hunk.contents : `${hunk.contents}\n`,
+                      ).text,
+                    })
+                    return
                   }
-                  const prepared: Prepared[] = []
-                  const targets: Target[] = []
-                  const updates = new Map<string, string>()
-                  for (const hunk of hunks) {
-                    yield* Effect.gen(function* () {
-                      const target = resolveTarget(location, hunk.path)
-                      targets.push(target)
-                      if (target.externalDirectory) {
-                        yield* permission.assert({
-                          action: "external_directory",
-                          resources: [target.externalDirectory.resource],
-                          save: [target.externalDirectory.resource],
-                          metadata: {
-                            filepath: target.canonical,
-                            parentDir: target.externalDirectory.directory,
-                          },
-                          sessionID: context.sessionID,
-                          agent: context.agent,
-                          source,
-                        })
-                      }
-                      if (hunk.type === "add") {
-                        prepared.push({
-                          ...hunk,
-                          target,
-                          before: "",
-                          after: Bom.split(
-                            hunk.contents.endsWith("\n") || hunk.contents === ""
-                              ? hunk.contents
-                              : `${hunk.contents}\n`,
-                          ).text,
-                        })
-                        return
-                      }
-                      if (hunk.type === "delete") {
-                        const content = yield* Bom.readFile(fs, target.canonical).pipe(
-                          Effect.mapError(
-                            (error) =>
-                              new ToolFailure({
-                                message: `patch verification failed: Failed to delete ${target.resource}: ${errorMessage(error)}`,
-                              }),
-                          ),
-                        )
-                        prepared.push({ ...hunk, target, before: content.text, after: "" })
-                        return
-                      }
-                      const previous = updates.get(target.canonical)
-                      const original =
-                        previous ??
-                        (yield* Effect.gen(function* () {
-                          const stats = yield* fs.stat(target.canonical).pipe(
-                            Effect.mapError(
-                              (error) =>
-                                new ToolFailure({
-                                  message: `patch verification failed: Failed to read file to update ${target.canonical}: ${errorMessage(error)}`,
-                                }),
-                            ),
-                          )
-                          if (stats.type === "Directory") {
-                            return yield* new ToolFailure({
-                              message: `patch verification failed: Failed to read file to update ${target.canonical}: path is a directory`,
-                            })
-                          }
-                          const content = yield* Bom.readFile(fs, target.canonical).pipe(
-                            Effect.mapError(
-                              (error) =>
-                                new ToolFailure({
-                                  message: `patch verification failed: Failed to read file to update ${target.canonical}: ${errorMessage(error)}`,
-                                }),
-                            ),
-                          )
-                          return Bom.join(content.text, content.bom)
-                        }))
-                      const before = Bom.split(original).text
-                      const update = yield* Effect.try({
-                        try: () => Patch.derive(hunk.path, hunk.chunks, original),
-                        catch: (error) =>
-                          new ToolFailure({ message: `patch verification failed: ${errorMessage(error)}` }),
-                      })
-                      const moveTarget = hunk.movePath ? resolveTarget(location, hunk.movePath) : undefined
-                      if (moveTarget) targets.push(moveTarget)
-                      if (moveTarget?.externalDirectory) {
-                        yield* permission.assert({
-                          action: "external_directory",
-                          resources: [moveTarget.externalDirectory.resource],
-                          save: [moveTarget.externalDirectory.resource],
-                          metadata: {
-                            filepath: moveTarget.canonical,
-                            parentDir: moveTarget.externalDirectory.directory,
-                          },
-                          sessionID: context.sessionID,
-                          agent: context.agent,
-                          source,
-                        })
-                      }
-                      prepared.push({
-                        ...hunk,
-                        target,
-                        content: Patch.joinBom(update.content, update.bom),
-                        before,
-                        after: update.content,
-                        moveTarget,
-                      })
-                      if (!moveTarget) updates.set(target.canonical, Patch.joinBom(update.content, update.bom))
-                    }).pipe(
-                      Effect.mapError((error) =>
-                        error instanceof ToolFailure
-                          ? error
-                          : new ToolFailure({ message: `Unable to prepare patch at ${hunk.path}`, error }),
+                  if (hunk.type === "delete") {
+                    const content = yield* Bom.readFile(fs, target.absolute).pipe(
+                      Effect.mapError(
+                        (error) =>
+                          new ToolFailure({
+                            message: `patch verification failed: Failed to delete ${target.resource}: ${errorMessage(error)}`,
+                          }),
                       ),
                     )
+                    prepared.push({ ...hunk, target, before: content.text, after: "" })
+                    return
                   }
-
-                  const patchFiles = prepared.map((change) => patchFile(change))
-                  yield* permission.assert({
-                    action: "edit",
-                    resources: [...new Set(targets.map((target) => target.resource))],
-                    save: ["*"],
-                    metadata: {
-                      filepath: targets.map((target) => target.resource).join(", "),
-                      diff: patchFiles.map((file) => `${file.patch}\n`).join(""),
-                      files: patchFiles,
-                    },
-                    sessionID: context.sessionID,
-                    agent: context.agent,
-                    source,
-                  })
-
-                  yield* Effect.forEach(
-                    prepared,
-                    (change) =>
-                      Effect.gen(function* () {
-                        if (change.type === "add") {
-                          yield* fs
-                            .writeWithDirs(
-                              change.target.canonical,
-                              change.contents.endsWith("\n") || change.contents === ""
-                                ? change.contents
-                                : `${change.contents}\n`,
-                            )
-                            .pipe(
-                              Effect.mapError((error) => fail(`Failed to write ${change.target.resource}`, error)),
-                            )
-                          applied.push({
-                            type: change.type,
-                            resource: change.target.resource,
-                            target: change.target.canonical,
-                          })
-                          return
-                        }
-                        if (change.type === "delete") {
-                          yield* fs
-                            .remove(change.target.canonical)
-                            .pipe(
-                              Effect.mapError((error) => fail(`Failed to delete ${change.target.resource}`, error)),
-                            )
-                          applied.push({
-                            type: change.type,
-                            resource: change.target.resource,
-                            target: change.target.canonical,
-                          })
-                          return
-                        }
-                        if (change.moveTarget) {
-                          const moveTarget = change.moveTarget
-                          yield* fs
-                            .writeWithDirs(moveTarget.canonical, change.content)
-                            .pipe(Effect.mapError((error) => fail(`Failed to write ${moveTarget.resource}`, error)))
-                          yield* fs.remove(change.target.canonical).pipe(
-                            Effect.mapError((error) =>
-                              fail(`Wrote ${moveTarget.resource} but failed to remove ${change.target.resource}`, error),
-                            ),
-                          )
-                          applied.push({
-                            type: change.type,
-                            resource: change.moveTarget.resource,
-                            target: change.moveTarget.canonical,
-                          })
-                          return
-                        }
-                        yield* fs
-                          .writeWithDirs(change.target.canonical, change.content)
-                          .pipe(Effect.mapError((error) => fail(`Failed to write ${change.target.resource}`, error)))
-                        applied.push({
-                          type: change.type,
-                          resource: change.target.resource,
-                          target: change.target.canonical,
+                  const previous = updates.get(target.absolute)
+                  const original =
+                    previous ??
+                    (yield* Effect.gen(function* () {
+                      const stats = yield* fs.stat(target.absolute).pipe(
+                        Effect.mapError(
+                          (error) =>
+                            new ToolFailure({
+                              message: `patch verification failed: Failed to read file to update ${target.absolute}: ${errorMessage(error)}`,
+                            }),
+                        ),
+                      )
+                      if (stats.type === "Directory") {
+                        return yield* new ToolFailure({
+                          message: `patch verification failed: Failed to read file to update ${target.absolute}: path is a directory`,
                         })
-                      }),
-                    { discard: true },
-                  )
-                  const formatted = new Map<string, string>()
-                  yield* Effect.forEach(
-                    [...new Set(applied.filter((item) => item.type !== "delete").map((item) => item.target))],
-                    (target) =>
-                      Effect.gen(function* () {
-                        const current = yield* Bom.readFile(fs, target).pipe(
-                          Effect.mapError((error) => fail(`Failed to read ${target}`, error)),
-                        )
-                        formatted.set(
-                          target,
-                          (yield* formatter.file(target))
-                            ? yield* Bom.syncFile(fs, target, current.bom).pipe(
-                                Effect.mapError((error) => fail(`Failed to sync ${target}`, error)),
-                              )
-                            : current.text,
-                        )
-                      }),
-                    { discard: true },
-                  )
-                  const files = yield* Effect.forEach(prepared, (change) => {
-                    if (change.type === "delete") return Effect.succeed(patchFile(change))
-                    const target = change.type === "update" && change.moveTarget ? change.moveTarget : change.target
-                    return Effect.succeed(patchFile(change, formatted.get(target.canonical)))
+                      }
+                      const content = yield* Bom.readFile(fs, target.absolute).pipe(
+                        Effect.mapError(
+                          (error) =>
+                            new ToolFailure({
+                              message: `patch verification failed: Failed to read file to update ${target.absolute}: ${errorMessage(error)}`,
+                            }),
+                        ),
+                      )
+                      return Bom.join(content.text, content.bom)
+                    }))
+                  const before = Bom.split(original).text
+                  const update = yield* Effect.try({
+                    try: () => Patch.derive(hunk.path, hunk.chunks, original),
+                    catch: (error) => new ToolFailure({ message: `patch verification failed: ${errorMessage(error)}` }),
                   })
-                  return { applied, files }
+                  const moveTarget = hunk.movePath ? resolveTarget(location, hunk.movePath) : undefined
+                  if (moveTarget) targets.push(moveTarget)
+                  if (moveTarget?.externalDirectory) {
+                    yield* permission.assert({
+                      action: "external_directory",
+                      resources: [moveTarget.externalDirectory.resource],
+                      save: [moveTarget.externalDirectory.resource],
+                      metadata: {
+                        filepath: moveTarget.absolute,
+                        parentDir: moveTarget.externalDirectory.directory,
+                      },
+                      sessionID: context.sessionID,
+                      agent: context.agent,
+                      source,
+                    })
+                  }
+                  prepared.push({
+                    ...hunk,
+                    target,
+                    content: Patch.joinBom(update.content, update.bom),
+                    before,
+                    after: update.content,
+                    moveTarget,
+                  })
+                  if (!moveTarget) updates.set(target.absolute, Patch.joinBom(update.content, update.bom))
                 }).pipe(
-                  Effect.map((output) => ({
-                    output,
-                    content: toModelOutput(output),
-                    metadata: { files: output.files },
-                  })),
                   Effect.mapError((error) =>
                     error instanceof ToolFailure
                       ? error
-                      : new ToolFailure({ message: "Unable to apply patch", error }),
+                      : new ToolFailure({ message: `Unable to prepare patch at ${hunk.path}`, error }),
                   ),
                 )
-              },
-            }),
-        ),
+              }
+
+              const patchFiles = prepared.map((change) => patchFile(change))
+              yield* permission.assert({
+                action: "edit",
+                resources: [...new Set(targets.map((target) => target.resource))],
+                save: ["*"],
+                metadata: {
+                  filepath: targets.map((target) => target.resource).join(", "),
+                  diff: patchFiles.map((file) => `${file.patch}\n`).join(""),
+                  files: patchFiles,
+                },
+                sessionID: context.sessionID,
+                agent: context.agent,
+                source,
+              })
+
+              yield* Effect.forEach(
+                prepared,
+                (change) =>
+                  Effect.gen(function* () {
+                    if (change.type === "add") {
+                      yield* fs
+                        .writeWithDirs(
+                          change.target.absolute,
+                          change.contents.endsWith("\n") || change.contents === ""
+                            ? change.contents
+                            : `${change.contents}\n`,
+                        )
+                        .pipe(Effect.mapError((error) => fail(`Failed to write ${change.target.resource}`, error)))
+                      applied.push({
+                        type: change.type,
+                        resource: change.target.resource,
+                        target: change.target.absolute,
+                      })
+                      return
+                    }
+                    if (change.type === "delete") {
+                      yield* fs
+                        .remove(change.target.absolute)
+                        .pipe(Effect.mapError((error) => fail(`Failed to delete ${change.target.resource}`, error)))
+                      applied.push({
+                        type: change.type,
+                        resource: change.target.resource,
+                        target: change.target.absolute,
+                      })
+                      return
+                    }
+                    if (change.moveTarget) {
+                      const moveTarget = change.moveTarget
+                      yield* fs
+                        .writeWithDirs(moveTarget.absolute, change.content)
+                        .pipe(Effect.mapError((error) => fail(`Failed to write ${moveTarget.resource}`, error)))
+                      yield* fs
+                        .remove(change.target.absolute)
+                        .pipe(
+                          Effect.mapError((error) =>
+                            fail(`Wrote ${moveTarget.resource} but failed to remove ${change.target.resource}`, error),
+                          ),
+                        )
+                      applied.push({
+                        type: change.type,
+                        resource: change.moveTarget.resource,
+                        target: change.moveTarget.absolute,
+                      })
+                      return
+                    }
+                    yield* fs
+                      .writeWithDirs(change.target.absolute, change.content)
+                      .pipe(Effect.mapError((error) => fail(`Failed to write ${change.target.resource}`, error)))
+                    applied.push({
+                      type: change.type,
+                      resource: change.target.resource,
+                      target: change.target.absolute,
+                    })
+                  }),
+                { discard: true },
+              )
+              const formatted = new Map<string, string>()
+              yield* Effect.forEach(
+                [...new Set(applied.filter((item) => item.type !== "delete").map((item) => item.target))],
+                (target) =>
+                  Effect.gen(function* () {
+                    const current = yield* Bom.readFile(fs, target).pipe(
+                      Effect.mapError((error) => fail(`Failed to read ${target}`, error)),
+                    )
+                    formatted.set(
+                      target,
+                      (yield* formatter.file(target))
+                        ? yield* Bom.syncFile(fs, target, current.bom).pipe(
+                            Effect.mapError((error) => fail(`Failed to sync ${target}`, error)),
+                          )
+                        : current.text,
+                    )
+                  }),
+                { discard: true },
+              )
+              const files = yield* Effect.forEach(prepared, (change) => {
+                if (change.type === "delete") return Effect.succeed(patchFile(change))
+                const target = change.type === "update" && change.moveTarget ? change.moveTarget : change.target
+                return Effect.succeed(patchFile(change, formatted.get(target.absolute)))
+              })
+              return { applied, files }
+            }).pipe(
+              Effect.map((output) => ({
+                output,
+                content: toModelOutput(output),
+                metadata: { files: output.files },
+              })),
+              Effect.mapError((error) =>
+                error instanceof ToolFailure ? error : new ToolFailure({ message: "Unable to apply patch", error }),
+              ),
+            )
+          },
+        }),
       )
       .pipe(Effect.orDie)
 
@@ -365,9 +354,7 @@ function errorMessage(error: unknown) {
 
 function patchFile(change: Prepared, after = change.after): typeof FileDiff.Info.Type {
   const target = (change.type === "update" ? change.moveTarget : undefined)?.resource ?? change.target.resource
-  const patch = trimDiff(
-    createTwoFilesPatch(change.target.canonical, change.target.canonical, change.before, after),
-  )
+  const patch = trimDiff(createTwoFilesPatch(change.target.absolute, change.target.absolute, change.before, after))
   const counts =
     change.type === "delete"
       ? { additions: 0, deletions: change.before.split("\n").length }
@@ -416,22 +403,22 @@ function trimDiff(diff: string) {
 }
 
 function resolveTarget(location: Location.Interface, value: string): Target {
-  const canonical =
+  const absolute =
     process.platform === "win32"
       ? FSUtil.normalizePath(path.resolve(location.directory, value))
       : path.resolve(location.directory, value)
   const projectRoot = path.parse(location.project.directory).root
   const external =
-    !FSUtil.contains(location.directory, canonical) &&
-    (location.project.directory === projectRoot || !FSUtil.contains(location.project.directory, canonical))
-  const directory = path.dirname(canonical)
+    !FSUtil.contains(location.directory, absolute) &&
+    (location.project.directory === projectRoot || !FSUtil.contains(location.project.directory, absolute))
+  const directory = path.dirname(absolute)
   const resource =
     process.platform === "win32"
       ? FSUtil.normalizePathPattern(path.join(directory, "*"))
       : path.join(directory, "*").replaceAll("\\", "/")
   return {
-    canonical,
-    resource: path.relative(location.project.directory, canonical).replaceAll("\\", "/") || ".",
+    absolute,
+    resource: path.relative(location.project.directory, absolute).replaceAll("\\", "/") || ".",
     externalDirectory: external ? { directory, resource } : undefined,
   }
 }

packages/core/src/tool/plugin/read.ts

@@ -25,11 +25,7 @@ const LocationInput = Schema.Struct({
   }),
 })
 export const Input = LocationInput
-const Output = Schema.Union([
-  ReadToolFileSystem.FileContent,
-  ReadToolFileSystem.TextPage,
-  ReadToolFileSystem.ListPage,
-])
+const Output = Schema.Union([ReadToolFileSystem.FileContent, ReadToolFileSystem.TextPage, ReadToolFileSystem.ListPage])
 
 export const Plugin = {
   id: "opencode.tool.read",
@@ -43,105 +39,102 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-            name,
-            options: { codemode: false },
-            description:
-              "Read the contents of a file or directory. Supports text files, images, and PDFs. Images and PDFs are presented directly to the model. Each text line is prefixed by its 1-based line number as <line>: <content>. The prefix is for reference and is not part of the file content. Directory entries are returned one per line. Use offset and limit to read large files or directories in sections. Prefer one larger read over many small slices, and use grep to find specific content in large files.",
-            input: Input,
-            output: Output,
-            execute: (input, context) => {
-              return Effect.gen(function* () {
-                const source = {
-                  type: "tool" as const,
-                  messageID: context.messageID,
-                  id: context.id,
-                }
-                const target = yield* mutation.resolve({ path: input.path, kind: "directory" })
-                const external = target.externalDirectory
-                if (external)
-                  yield* permission.assert({
-                    ...LocationMutation.externalDirectoryPermission(external),
-                    sessionID: context.sessionID,
-                    agent: context.agent,
-                    source,
-                  })
-                const resource = target.resource
-                const absolute = AbsolutePath.make(target.canonical)
+        draft.add({
+          name,
+          options: { codemode: false },
+          description:
+            "Read the contents of a file or directory. Supports text files, images, and PDFs. Images and PDFs are presented directly to the model. Each text line is prefixed by its 1-based line number as <line>: <content>. The prefix is for reference and is not part of the file content. Directory entries are returned one per line. Use offset and limit to read large files or directories in sections. Prefer one larger read over many small slices, and use grep to find specific content in large files.",
+          input: Input,
+          output: Output,
+          execute: (input, context) => {
+            return Effect.gen(function* () {
+              const source = {
+                type: "tool" as const,
+                messageID: context.messageID,
+                id: context.id,
+              }
+              const target = yield* mutation.resolve({ path: input.path })
+              const external = target.externalDirectory
+              if (external)
                 yield* permission.assert({
-                  action: name,
-                  resources: [resource],
-                  save: ["*"],
+                  ...LocationMutation.externalDirectoryPermission(external),
                   sessionID: context.sessionID,
                   agent: context.agent,
                   source,
                 })
-                const type = yield* reader.inspect(absolute).pipe(
-                  Effect.catchReason("PlatformError", "NotFound", () => missing(input.path, target.canonical)),
+              const resource = target.resource
+              const absolute = AbsolutePath.make(target.absolute)
+              yield* permission.assert({
+                action: name,
+                resources: [resource],
+                save: ["*"],
+                sessionID: context.sessionID,
+                agent: context.agent,
+                source,
+              })
+              const type = yield* reader
+                .inspect(absolute)
+                .pipe(Effect.catchReason("PlatformError", "NotFound", () => missing(input.path, target.absolute)))
+              const content =
+                type === "directory"
+                  ? yield* reader.list(absolute, { offset: input.offset, limit: input.limit })
+                  : yield* reader.read(absolute, resource, {
+                      offset: input.offset,
+                      limit: input.limit,
+                    })
+              // After a successful read, discover nearby AGENTS.md walking up to the Location
+              // root exclusive and inject them as durable synthetic instructions. For a
+              // directory listing the walk starts at the directory itself (so its own AGENTS.md
+              // is discovered); for a file it starts at the file's dirname. External reads are
+              // skipped, and discovery failures never fail the read.
+              yield* Effect.gen(function* () {
+                if (target.externalDirectory !== undefined) return
+                const resolved = yield* fs.resolve(target.absolute)
+                const root = yield* fs.resolve(location.directory)
+                // up() searches its stop directory, so the Location-root AGENTS.md (already
+                // supplied by core initial instructions) is dropped by the dirname filter.
+                const discovered = yield* fs.up({
+                  targets: [FILENAME],
+                  start: type === "directory" ? resolved : dirname(resolved),
+                  stop: root,
+                })
+                const candidates = (yield* Effect.forEach(discovered, fs.resolve)).filter(
+                  (file) => dirname(file) !== root,
                 )
-                const content =
-                  type === "directory"
-                    ? yield* reader.list(absolute, { offset: input.offset, limit: input.limit })
-                    : yield* reader.read(absolute, resource, {
-                        offset: input.offset,
-                        limit: input.limit,
-                      })
-                // After a successful read, discover nearby AGENTS.md walking up to the Location
-                // root exclusive and inject them as durable synthetic instructions. For a
-                // directory listing the walk starts at the directory itself (so its own AGENTS.md
-                // is discovered); for a file it starts at the file's dirname. External reads are
-                // skipped, and discovery failures never fail the read.
-                yield* Effect.gen(function* () {
-                  if (target.externalDirectory !== undefined) return
-                  const resolved = yield* fs.resolve(target.canonical)
-                  const root = yield* fs.resolve(location.directory)
-                  // up() searches its stop directory, so the Location-root AGENTS.md (already
-                  // supplied by core initial instructions) is dropped by the dirname filter.
-                  const discovered = yield* fs.up({
-                    targets: [FILENAME],
-                    start: type === "directory" ? resolved : dirname(resolved),
-                    stop: root,
-                  })
-                  const candidates = (yield* Effect.forEach(discovered, fs.resolve)).filter(
-                    (file) => dirname(file) !== root,
-                  )
-                  if (candidates.length === 0) return
-                  yield* sessionInstructions.load({ sessionID: context.sessionID, paths: candidates })
-                }).pipe(
-                  Effect.catch(() => Effect.void),
-                  Effect.catchDefect(() => Effect.void),
-                )
-                if (content.type === "file" && content.encoding === "base64" && !SUPPORTED_MEDIA_MIMES.has(content.mime))
-                  return yield* Effect.fail(new ReadToolFileSystem.BinaryFileError({ resource }))
-                return content
+                if (candidates.length === 0) return
+                yield* sessionInstructions.load({ sessionID: context.sessionID, paths: candidates })
               }).pipe(
-                Effect.map((output) => ({
-                  output,
-                  content: toModelContent(input.path, input.offset, output),
-                })),
-                Effect.mapError((error) => {
-                  if (error instanceof ToolFailure) return error
-                  const message =
-                    error instanceof ReadToolFileSystem.BinaryFileError ||
-                    error instanceof ReadToolFileSystem.MediaIngestLimitError ||
-                    error instanceof ReadToolFileSystem.MalformedUtf8Error ||
-                    error instanceof ReadToolFileSystem.OffsetOutOfRangeError ||
-                    error instanceof ReadToolFileSystem.PathKindError
-                      ? error.message
-                      : `Unable to read ${input.path}`
-                  return new ToolFailure({ message, error })
-                }),
+                Effect.catch(() => Effect.void),
+                Effect.catchDefect(() => Effect.void),
               )
-            },
-          }),
-        ),
+              if (content.type === "file" && content.encoding === "base64" && !SUPPORTED_MEDIA_MIMES.has(content.mime))
+                return yield* Effect.fail(new ReadToolFileSystem.BinaryFileError({ resource }))
+              return content
+            }).pipe(
+              Effect.map((output) => ({
+                output,
+                content: toModelContent(input.path, input.offset, output),
+              })),
+              Effect.mapError((error) => {
+                if (error instanceof ToolFailure) return error
+                const message =
+                  error instanceof ReadToolFileSystem.BinaryFileError ||
+                  error instanceof ReadToolFileSystem.MediaIngestLimitError ||
+                  error instanceof ReadToolFileSystem.OffsetOutOfRangeError ||
+                  error instanceof ReadToolFileSystem.PathKindError
+                    ? error.message
+                    : `Unable to read ${input.path}`
+                return new ToolFailure({ message, error })
+              }),
+            )
+          },
+        }),
       )
       .pipe(Effect.orDie)
 
-    const missing = Effect.fn("ReadTool.missing")(function* (input: string, canonical: string) {
+    const missing = Effect.fn("ReadTool.missing")(function* (input: string, absolute: string) {
       const base = basename(input).toLowerCase()
-      const suggestions = yield* fs.readDirectory(dirname(canonical)).pipe(
+      const suggestions = yield* fs.readDirectory(dirname(absolute)).pipe(
         Effect.map((entries) =>
           entries
             .filter((entry) => {

packages/core/src/tool/plugin/shell.ts

@@ -122,174 +122,176 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-            name,
-            options: { codemode: false },
-            description: description(),
-            input: Input,
-            output: Output,
-            execute: (input, context) =>
-              Effect.gen(function* () {
-                const source = {
-                  type: "tool" as const,
-                  messageID: context.messageID,
-                  id: context.id,
-                }
-                const timeout = input.background === true ? (input.timeout ?? 0) : (input.timeout ?? DEFAULT_TIMEOUT_MS)
-                let finalTimeout = timeout
-                const info = yield* shell.create(
-                  {
-                    command: input.command,
-                    cwd: input.workdir,
-                    timeout,
-                    metadata: { sessionID: context.sessionID },
-                  },
-                  (invocation) =>
-                    Effect.gen(function* () {
-                      const target = yield* mutation.resolve({ path: invocation.cwd, kind: "directory" })
-                      const parsed = yield* ShellParse.scan(invocation.command, invocation.shell, target.canonical)
-                      const directories = yield* Effect.forEach(parsed.directories, (directory) =>
-                        mutation.resolve({ path: path.resolve(target.canonical, directory), kind: "directory" }),
+        draft.add({
+          name,
+          options: { codemode: false },
+          description: description(),
+          input: Input,
+          output: Output,
+          execute: (input, context) =>
+            Effect.gen(function* () {
+              const source = {
+                type: "tool" as const,
+                messageID: context.messageID,
+                id: context.id,
+              }
+              const timeout = input.background === true ? (input.timeout ?? 0) : (input.timeout ?? DEFAULT_TIMEOUT_MS)
+              let finalTimeout = timeout
+              const info = yield* shell.create(
+                {
+                  command: input.command,
+                  cwd: input.workdir,
+                  timeout,
+                  metadata: { sessionID: context.sessionID },
+                },
+                (invocation) =>
+                  Effect.gen(function* () {
+                    const target = yield* mutation.resolve({ path: invocation.cwd, kind: "directory" })
+                    const parsed = yield* ShellParse.scan(invocation.command, invocation.shell, target.absolute)
+                    const directories = yield* Effect.forEach(parsed.directories, (directory) =>
+                      mutation.resolve({ path: path.resolve(target.absolute, directory), kind: "directory" }),
+                    )
+                    invocation.cwd = target.absolute
+                    finalTimeout = invocation.timeout
+                    const external = [target, ...directories]
+                      .map((item) => item.externalDirectory)
+                      .filter((item) => item !== undefined)
+                      .filter(
+                        (item, index, items) => items.findIndex((other) => other.resource === item.resource) === index,
                       )
-                      invocation.cwd = target.canonical
-                      finalTimeout = invocation.timeout
-                      const external = [target, ...directories]
-                        .map((item) => item.externalDirectory)
-                        .filter((item) => item !== undefined)
-                        .filter((item, index, items) => items.findIndex((other) => other.resource === item.resource) === index)
-                      if (external.length > 0)
-                        yield* permission.assert({
-                          action: "external_directory",
-                          resources: external.map((item) => item.resource),
-                          save: external.map((item) => item.save),
-                          sessionID: context.sessionID,
-                          agent: context.agent,
-                          source,
-                        })
-                      if (parsed.commands.length > 0)
-                        yield* permission.assert({
-                          action: name,
-                          resources: parsed.commands.map((command) => command.resource),
-                          save: parsed.commands.map((command) => command.save),
-                          sessionID: context.sessionID,
-                          agent: context.agent,
-                          source,
-                        })
-                      const workdir = yield* fsUtil.stat(target.canonical).pipe(
+                    if (external.length > 0)
+                      yield* permission.assert({
+                        action: "external_directory",
+                        resources: external.map((item) => item.resource),
+                        save: external.map((item) => item.save),
+                        sessionID: context.sessionID,
+                        agent: context.agent,
+                        source,
+                      })
+                    if (parsed.commands.length > 0)
+                      yield* permission.assert({
+                        action: name,
+                        resources: parsed.commands.map((command) => command.resource),
+                        save: parsed.commands.map((command) => command.save),
+                        sessionID: context.sessionID,
+                        agent: context.agent,
+                        source,
+                      })
+                    const workdir = yield* fsUtil
+                      .stat(target.absolute)
+                      .pipe(
                         Effect.catchReason("PlatformError", "NotFound", () =>
-                          Effect.fail(new Error(`Working directory does not exist: ${target.canonical}`)),
+                          Effect.fail(new Error(`Working directory does not exist: ${target.absolute}`)),
                         ),
                       )
-                      if (workdir.type !== "Directory")
-                        return yield* Effect.fail(new Error(`Working directory is not a directory: ${target.canonical}`))
-                    }),
-                )
-                yield* context.progress({ shellID: info.id })
+                    if (workdir.type !== "Directory")
+                      return yield* Effect.fail(new Error(`Working directory is not a directory: ${target.absolute}`))
+                  }),
+              )
+              yield* context.progress({ shellID: info.id })
 
-                const captureShell = Effect.fn("ShellTool.captureShell")(function* () {
-                  const latest = yield* shell.output(info.id, { cursor: Number.MAX_SAFE_INTEGER })
-                  const truncated = latest.size > MAX_CAPTURE_BYTES
-                  const page = yield* shell.output(info.id, {
-                    cursor: Math.max(0, latest.size - MAX_CAPTURE_BYTES),
-                    limit: MAX_CAPTURE_BYTES,
-                  })
-                  const notice = truncated ? `\n\n[output truncated; full output saved to: ${info.file}]` : ""
-                  return {
-                    output: `${page.output || "(no output)"}${notice}`,
-                    truncated,
-                  }
+              const captureShell = Effect.fn("ShellTool.captureShell")(function* () {
+                const latest = yield* shell.output(info.id, { cursor: Number.MAX_SAFE_INTEGER })
+                const truncated = latest.size > MAX_CAPTURE_BYTES
+                const page = yield* shell.output(info.id, {
+                  cursor: Math.max(0, latest.size - MAX_CAPTURE_BYTES),
+                  limit: MAX_CAPTURE_BYTES,
                 })
+                const notice = truncated ? `\n\n[output truncated; full output saved to: ${info.file}]` : ""
+                return {
+                  output: `${page.output || "(no output)"}${notice}`,
+                  truncated,
+                }
+              })
 
-                const settleShell = Effect.fn("ShellTool.settleShell")(function* () {
-                  const final = yield* shell.wait(info.id)
-                  const capture = yield* captureShell()
-
-                  // `exit` is optionalKey in the Output schema; a present-but-undefined key
-                  // fails output encoding, so omit it when the process has no exit code.
-                  if (final.status === "timeout") {
-                    return {
-                      ...(final.exit !== undefined ? { exit: final.exit } : {}),
-                      output: `${capture.output}\n\nCommand exceeded timeout of ${finalTimeout} ms. Retry with a larger timeout if the command is expected to take longer.`,
-                      truncated: capture.truncated,
-                      timeout: true,
-                      status: "completed" as const,
-                    }
-                  }
+              const settleShell = Effect.fn("ShellTool.settleShell")(function* () {
+                const final = yield* shell.wait(info.id)
+                const capture = yield* captureShell()
 
+                // `exit` is optionalKey in the Output schema; a present-but-undefined key
+                // fails output encoding, so omit it when the process has no exit code.
+                if (final.status === "timeout") {
                   return {
                     ...(final.exit !== undefined ? { exit: final.exit } : {}),
-                    output: capture.output,
+                    output: `${capture.output}\n\nCommand exceeded timeout of ${finalTimeout} ms. Retry with a larger timeout if the command is expected to take longer.`,
                     truncated: capture.truncated,
+                    timeout: true,
                     status: "completed" as const,
                   }
-                })
-
-                const settled = yield* Deferred.make<Output>()
-                const run = settleShell().pipe(
-                  Effect.tap((output) => Deferred.succeed(settled, output)),
-                  Effect.map((output) => output.output),
-                  Effect.onInterrupt(() => shell.remove(info.id).pipe(Effect.ignore)),
-                )
-                const job = yield* runtime.job.start({
-                  id: context.id,
-                  type: name,
-                  title: info.command,
-                  metadata: { sessionID: context.sessionID, shellID: info.id },
-                  run,
-                })
-
-                if (input.background === true) {
-                  yield* runtime.job.background(job.id)
-                  yield* notifyWhenDone(context.sessionID, context.id, info.command)
-                  return {
-                    output: BACKGROUND_STARTED,
-                    shellID: info.id,
-                    truncated: false,
-                    status: "running" as const,
-                  }
                 }
 
-                const result = yield* runtime.job.block({ id: job.id, sessionID: context.sessionID }).pipe(
-                  Effect.onInterrupt(() => runtime.job.cancel(job.id).pipe(Effect.ignore)),
-                )
-                if (result?.type === "backgrounded") {
-                  yield* shell.timeout(info.id, 0)
-                  yield* notifyWhenDone(context.sessionID, context.id, info.command)
-                  return {
-                    output: BACKGROUND_STARTED,
-                    shellID: info.id,
-                    truncated: false,
-                    status: "running" as const,
-                  }
+                return {
+                  ...(final.exit !== undefined ? { exit: final.exit } : {}),
+                  output: capture.output,
+                  truncated: capture.truncated,
+                  status: "completed" as const,
                 }
-                if (result?.info.status === "error")
-                  return yield* Effect.fail(new Error(result.info.error ?? "Command failed"))
-                if (result?.info.status === "cancelled") return yield* Effect.fail(new Error("Command cancelled"))
+              })
 
-                return yield* Deferred.await(settled)
-              }).pipe(
-                Effect.map((output) => {
-                  const content: Array<Content> = [{ type: "text", text: output.output }]
-                  const model = modelOutput(output)
-                  if (model) content.push({ type: "text", text: model })
-                  return {
-                    output,
-                    content,
-                    metadata: {
-                      truncated: output.truncated,
-                      ...("exit" in output && output.exit !== undefined ? { exit: output.exit } : {}),
-                      ...("shellID" in output && output.shellID !== undefined ? { shellID: output.shellID } : {}),
-                      ...("timeout" in output && output.timeout !== undefined ? { timeout: output.timeout } : {}),
-                    },
-                  }
-                }),
-                Effect.mapError(
-                  (error) => new ToolFailure({ message: `Unable to execute command: ${input.command}`, error }),
-                ),
+              const settled = yield* Deferred.make<Output>()
+              const run = settleShell().pipe(
+                Effect.tap((output) => Deferred.succeed(settled, output)),
+                Effect.map((output) => output.output),
+                Effect.onInterrupt(() => shell.remove(info.id).pipe(Effect.ignore)),
+              )
+              const job = yield* runtime.job.start({
+                id: context.id,
+                type: name,
+                title: info.command,
+                metadata: { sessionID: context.sessionID, shellID: info.id },
+                run,
+              })
+
+              if (input.background === true) {
+                yield* runtime.job.background(job.id)
+                yield* notifyWhenDone(context.sessionID, context.id, info.command)
+                return {
+                  output: BACKGROUND_STARTED,
+                  shellID: info.id,
+                  truncated: false,
+                  status: "running" as const,
+                }
+              }
+
+              const result = yield* runtime.job
+                .block({ id: job.id, sessionID: context.sessionID })
+                .pipe(Effect.onInterrupt(() => runtime.job.cancel(job.id).pipe(Effect.ignore)))
+              if (result?.type === "backgrounded") {
+                yield* shell.timeout(info.id, 0)
+                yield* notifyWhenDone(context.sessionID, context.id, info.command)
+                return {
+                  output: BACKGROUND_STARTED,
+                  shellID: info.id,
+                  truncated: false,
+                  status: "running" as const,
+                }
+              }
+              if (result?.info.status === "error")
+                return yield* Effect.fail(new Error(result.info.error ?? "Command failed"))
+              if (result?.info.status === "cancelled") return yield* Effect.fail(new Error("Command cancelled"))
+
+              return yield* Deferred.await(settled)
+            }).pipe(
+              Effect.map((output) => {
+                const content: Array<Content> = [{ type: "text", text: output.output }]
+                const model = modelOutput(output)
+                if (model) content.push({ type: "text", text: model })
+                return {
+                  output,
+                  content,
+                  metadata: {
+                    truncated: output.truncated,
+                    ...("exit" in output && output.exit !== undefined ? { exit: output.exit } : {}),
+                    ...("shellID" in output && output.shellID !== undefined ? { shellID: output.shellID } : {}),
+                    ...("timeout" in output && output.timeout !== undefined ? { timeout: output.timeout } : {}),
+                  },
+                }
+              }),
+              Effect.mapError(
+                (error) => new ToolFailure({ message: `Unable to execute command: ${input.command}`, error }),
               ),
-          }),
-        ),
+            ),
+        }),
       )
       .pipe(Effect.orDie)
 

packages/core/src/tool/plugin/write.ts

@@ -54,59 +54,52 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-              name,
-              options: { codemode: false, permission: "edit" },
-              description:
-                "Writes a file to the local filesystem, overwriting if one exists.\n\nMissing parent directories are created automatically.\n\nUse this tool to create new files or overwrite existing files. For partial changes, use the edit tool instead.",
-              input: Input,
-              output: Output,
-              execute: (input, context) =>
-                Effect.gen(function* () {
-                  const source = {
-                    type: "tool" as const,
-                    messageID: context.messageID,
-                    id: context.id,
-                  }
-                  const target = yield* mutation.resolve({ path: input.path, kind: "file" })
-                  const external = target.externalDirectory
-                  if (external)
-                    yield* permission.assert({
-                      ...LocationMutation.externalDirectoryPermission(external),
-                      sessionID: context.sessionID,
-                      agent: context.agent,
-                      source,
-                    })
-                  const current = yield* Bom.readFile(fs, target.canonical).pipe(
-                    Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined)),
-                  )
-                  const next = Bom.split(input.content)
-                  const preview = fileDiff(
-                    target.resource,
-                    current?.text ?? "",
-                    next.text,
-                    current ? "modified" : "added",
-                  )
-                  yield* permission.assert({
-                    action: "edit",
-                    resources: [target.resource],
-                    save: ["*"],
-                    metadata: { files: [preview] },
-                    sessionID: context.sessionID,
-                    agent: context.agent,
-                    source,
-                  })
-                  const result = yield* files.writeTextPreservingBom({ target, content: input.content })
-                  const bom = (yield* Bom.readFile(fs, target.canonical)).bom
-                  if (yield* formatter.file(target.canonical)) yield* Bom.syncFile(fs, target.canonical, bom)
-                  return result
-                }).pipe(
-                  Effect.map((output) => ({ output, content: toModelOutput(output) })),
-                  Effect.mapError((error) => new ToolFailure({ message: `Unable to write ${input.path}`, error })),
-                ),
-            }),
-        ),
+        draft.add({
+          name,
+          options: { codemode: false, permission: "edit" },
+          description:
+            "Writes a file to the local filesystem, overwriting if one exists.\n\nMissing parent directories are created automatically.\n\nUse this tool to create new files or overwrite existing files. For partial changes, use the edit tool instead.",
+          input: Input,
+          output: Output,
+          execute: (input, context) =>
+            Effect.gen(function* () {
+              const source = {
+                type: "tool" as const,
+                messageID: context.messageID,
+                id: context.id,
+              }
+              const target = yield* mutation.resolve({ path: input.path, kind: "file" })
+              const external = target.externalDirectory
+              if (external)
+                yield* permission.assert({
+                  ...LocationMutation.externalDirectoryPermission(external),
+                  sessionID: context.sessionID,
+                  agent: context.agent,
+                  source,
+                })
+              const current = yield* Bom.readFile(fs, target.absolute).pipe(
+                Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined)),
+              )
+              const next = Bom.split(input.content)
+              const preview = fileDiff(target.resource, current?.text ?? "", next.text, current ? "modified" : "added")
+              yield* permission.assert({
+                action: "edit",
+                resources: [target.resource],
+                save: ["*"],
+                metadata: { files: [preview] },
+                sessionID: context.sessionID,
+                agent: context.agent,
+                source,
+              })
+              const result = yield* files.writeTextPreservingBom({ target, content: input.content })
+              const bom = (yield* Bom.readFile(fs, target.absolute)).bom
+              if (yield* formatter.file(target.absolute)) yield* Bom.syncFile(fs, target.absolute, bom)
+              return result
+            }).pipe(
+              Effect.map((output) => ({ output, content: toModelOutput(output) })),
+              Effect.mapError((error) => new ToolFailure({ message: `Unable to write ${input.path}`, error })),
+            ),
+        }),
       )
       .pipe(Effect.orDie)
   }),

packages/core/src/tool/read-filesystem.ts

@@ -34,14 +34,6 @@ export class MediaIngestLimitError extends Schema.TaggedErrorClass<MediaIngestLi
   }
 }
 
-export class MalformedUtf8Error extends Schema.TaggedErrorClass<MalformedUtf8Error>()("ReadTool.MalformedUtf8Error", {
-  resource: Schema.String,
-}) {
-  override get message() {
-    return `File is not valid UTF-8: ${this.resource}`
-  }
-}
-
 export class OffsetOutOfRangeError extends Schema.TaggedErrorClass<OffsetOutOfRangeError>()(
   "ReadTool.OffsetOutOfRangeError",
   { offset: Schema.Number },
@@ -61,13 +53,7 @@ export class PathKindError extends Schema.TaggedErrorClass<PathKindError>()("Rea
 }
 
 export type InspectError = FSUtil.Error | PathKindError
-export type ReadError =
-  | FSUtil.Error
-  | BinaryFileError
-  | MediaIngestLimitError
-  | MalformedUtf8Error
-  | OffsetOutOfRangeError
-  | PathKindError
+export type ReadError = FSUtil.Error | BinaryFileError | MediaIngestLimitError | OffsetOutOfRangeError | PathKindError
 
 export const PageInput = Schema.Struct({
   offset: Schema.optionalKey(NonNegativeInt),
@@ -90,9 +76,15 @@ export class TextPage extends Schema.Class<TextPage>("ReadTool.TextPage")({
   next: Schema.optionalKey(PositiveInt),
 }) {}
 
+export interface ListEntry extends Schema.Schema.Type<typeof ListEntry> {}
+export const ListEntry = Schema.Struct({
+  path: RelativePath,
+  type: Schema.Literals(["file", "directory", "symlink"]),
+}).annotate({ identifier: "ReadTool.ListEntry" })
+
 export class ListPage extends Schema.Class<ListPage>("ReadTool.ListPage")({
   type: Schema.Literal("list-page"),
-  entries: Schema.Array(FileSystem.Entry),
+  entries: Schema.Array(ListEntry),
   truncated: Schema.Boolean,
   next: Schema.optionalKey(PositiveInt),
 }) {}
@@ -109,36 +101,6 @@ export interface Interface {
 
 export class Service extends Context.Service<Service, Interface>()("@opencode/ReadToolFileSystem") {}
 
-const extensions = new Set([
-  ".zip",
-  ".tar",
-  ".gz",
-  ".exe",
-  ".dll",
-  ".so",
-  ".class",
-  ".jar",
-  ".war",
-  ".7z",
-  ".doc",
-  ".docx",
-  ".xls",
-  ".xlsx",
-  ".ppt",
-  ".pptx",
-  ".odt",
-  ".ods",
-  ".odp",
-  ".bin",
-  ".dat",
-  ".obj",
-  ".o",
-  ".a",
-  ".lib",
-  ".wasm",
-  ".pyc",
-  ".pyo",
-])
 const startsWith = (bytes: Uint8Array, prefix: number[]) => prefix.every((value, index) => bytes[index] === value)
 const mediaMime = (bytes: Uint8Array) => {
   if (startsWith(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])) return "image/png"
@@ -148,8 +110,7 @@ const mediaMime = (bytes: Uint8Array) => {
     return "image/webp"
   if (startsWith(bytes, [0x25, 0x50, 0x44, 0x46, 0x2d])) return "application/pdf"
 }
-const binary = (resource: string, bytes: Uint8Array) => {
-  if (extensions.has(path.extname(resource).toLowerCase())) return true
+const binary = (bytes: Uint8Array) => {
   if (bytes.length === 0) return false
   let nonPrintable = 0
   for (const byte of bytes) {
@@ -158,16 +119,9 @@ const binary = (resource: string, bytes: Uint8Array) => {
   }
   return nonPrintable / bytes.length > 0.3
 }
-const decodeUtf8 = (resource: string, decoder: TextDecoder, bytes?: Uint8Array) =>
-  Effect.try({
-    try: () => decoder.decode(bytes, { stream: bytes !== undefined }),
-    catch: (error) => {
-      if (error instanceof TypeError) return new MalformedUtf8Error({ resource })
-      throw error
-    },
-  })
+const decodeUtf8 = (decoder: TextDecoder, bytes?: Uint8Array) => decoder.decode(bytes, { stream: bytes !== undefined })
 const decodeChunk = (resource: string, decoder: TextDecoder, bytes: Uint8Array) =>
-  bytes.includes(0) ? Effect.fail(new BinaryFileError({ resource })) : decodeUtf8(resource, decoder, bytes)
+  bytes.includes(0) ? Effect.fail(new BinaryFileError({ resource })) : Effect.succeed(decodeUtf8(decoder, bytes))
 
 export const inspect = Effect.fn("ReadTool.inspect")(function* (fs: FSUtil.Interface, input: string) {
   const info = yield* fs.stat(input)
@@ -218,19 +172,17 @@ export const read = Effect.fn("ReadTool.read")(function* (
           mime,
         }
       }
-      if (extensions.has(path.extname(resource).toLowerCase()))
-        return yield* Effect.fail(new BinaryFileError({ resource }))
       const paged = info.size > MAX_READ_BYTES || page.offset !== undefined || page.limit !== undefined
       if (!paged) {
-        if (binary(resource, first)) return yield* Effect.fail(new BinaryFileError({ resource }))
-        const decoder = new TextDecoder("utf-8", { fatal: true })
-        const text = [yield* decodeUtf8(resource, decoder, first)]
+        if (binary(first)) return yield* Effect.fail(new BinaryFileError({ resource }))
+        const decoder = new TextDecoder()
+        const text = [decodeUtf8(decoder, first)]
         while (true) {
           const chunk = yield* file.readAlloc(64 * 1024)
           if (Option.isNone(chunk)) break
           text.push(yield* decodeChunk(resource, decoder, chunk.value))
         }
-        text.push(yield* decodeUtf8(resource, decoder))
+        text.push(decodeUtf8(decoder))
         return {
           type: "file" as const,
           uri: pathToFileURL(real).href,
@@ -243,7 +195,7 @@ export const read = Effect.fn("ReadTool.read")(function* (
       const offset = page.offset || 1
       const limit = Math.min(page.limit || MAX_READ_LINES, MAX_READ_LINES)
       const lines: string[] = []
-      const decoder = new TextDecoder("utf-8", { fatal: true })
+      const decoder = new TextDecoder()
       let pending = ""
       let discard = false
       let line = 1
@@ -301,8 +253,8 @@ export const read = Effect.fn("ReadTool.read")(function* (
           const newline = chunk.indexOf(10, start)
           const end = newline === -1 ? chunk.length : newline + 1
           const segment = chunk.subarray(start, end)
-          if (binary(resource, segment)) return yield* Effect.fail(new BinaryFileError({ resource }))
-          if (!consume(yield* decodeUtf8(resource, decoder, segment))) return false
+          if (binary(segment)) return yield* Effect.fail(new BinaryFileError({ resource }))
+          if (!consume(decodeUtf8(decoder, segment))) return false
           start = end
         }
         return true
@@ -314,7 +266,7 @@ export const read = Effect.fn("ReadTool.read")(function* (
         done = !(yield* consumeChunk(chunk.value))
       }
       if (!done) {
-        const tail = yield* decodeUtf8(resource, decoder)
+        const tail = decodeUtf8(decoder)
         if (!discard) pending += tail
         if (pending) append(pending.endsWith("\r") ? pending.slice(0, -1) : pending)
       }
@@ -336,26 +288,26 @@ export const list = Effect.fn("ReadTool.list")(function* (fs: FSUtil.Interface,
   const items = yield* fs.readDirectoryEntries(real)
   const offset = page.offset || 1
   const limit = Math.min(page.limit || MAX_READ_LINES, MAX_READ_LINES)
-  const entries = yield* Effect.forEach(
-    items,
-    (item) =>
-      Effect.gen(function* () {
-        const absolute = path.join(real, item.name)
-        const target = yield* fs.realPath(absolute).pipe(Effect.catch(() => Effect.void))
-        if (!target || !FSUtil.contains(real, target)) return
-        const info = yield* fs.stat(target).pipe(Effect.catch(() => Effect.void))
-        const type = info?.type === "Directory" ? "directory" : info?.type === "File" ? "file" : undefined
-        if (!type) return
-        return FileSystem.Entry.make({
-          path: RelativePath.make(item.name + (type === "directory" ? path.sep : "")),
-          type,
-        })
-      }),
-    { concurrency: 16 },
-  )
-  const visible = entries
-    .filter((item): item is FileSystem.Entry => item !== undefined)
-    .sort((a, b) => (a.type === b.type ? a.path.localeCompare(b.path) : a.type === "directory" ? -1 : 1))
+  const visible = items
+    .flatMap((item) =>
+      item.type === "other"
+        ? []
+        : [
+            ListEntry.make({
+              path: RelativePath.make(item.name + (item.type === "directory" ? path.sep : "")),
+              type: item.type,
+            }),
+          ],
+    )
+    .sort((a, b) =>
+      a.type === "directory"
+        ? b.type === "directory"
+          ? a.path.localeCompare(b.path)
+          : -1
+        : b.type === "directory"
+          ? 1
+          : a.path.localeCompare(b.path),
+    )
   const selected = visible.slice(offset - 1, offset - 1 + limit)
   const truncated = offset - 1 + selected.length < visible.length
   return new ListPage({

packages/core/src/v1/config/migrate.ts

@@ -119,8 +119,16 @@ function agents(info: typeof ConfigV1.Info.Type) {
     ...Object.entries(info.agent ?? {}),
     ...Object.entries(info.mode ?? {}).map(([name, agent]) => [name, { ...agent, mode: "primary" as const }] as const),
   ]
-  if (!entries.length) return undefined
-  return Object.fromEntries(entries.flatMap(([name, agent]) => (agent ? [[name, migrateAgent(agent)]] : [])))
+  const result = Object.fromEntries(entries.flatMap(([name, agent]) => (agent ? [[name, migrateAgent(agent)]] : [])))
+  const small = modelSelection(info.small_model)
+  if (!small) return entries.length ? result : undefined
+  return {
+    ...result,
+    title: {
+      model: small,
+      ...result.title,
+    },
+  }
 }
 
 export function migrateAgent(info: ConfigAgentV1.Info) {

packages/core/test/agent.test.ts

@@ -126,6 +126,7 @@ describe("Agent", () => {
 
       yield* agent.transform((editor) => editor.update(id, () => {}))
       const info = yield* agent.get(id)
+      expect(info?.mode).toBe("primary")
       expect(info?.permissions.slice(0, Agent.Info.default(id).permissions.length)).toEqual(
         Agent.Info.default(id).permissions,
       )

packages/core/test/config/agent.test.ts

@@ -51,6 +51,11 @@ describe("ConfigAgentPlugin.Plugin", () => {
   it.effect("matches Windows paths against home-relative permissions", () =>
     Effect.gen(function* () {
       const permissions = yield* loadHomePermissions("C:\\Users\\test")
+      expect(permissions).toContainEqual({
+        action: "external_directory",
+        resource: "C:\\Users\\test\\p\\**",
+        effect: "allow",
+      })
       expect(
         Permission.evaluate("external_directory", "C:\\Users\\test\\p\\opencode\\src\\*", permissions).effect,
       ).toBe("allow")

packages/core/test/config/config.test.ts

@@ -512,6 +512,20 @@ describe("Config", () => {
     }),
   )
 
+  it.effect("migrates the v1 small model to the title agent", () =>
+    Effect.sync(() => {
+      expect(
+        ConfigMigrateV1.migrate({
+          small_model: "anthropic/claude-haiku-4-5",
+          agent: { title: { prompt: "Custom title prompt" } },
+        }).agents?.title,
+      ).toEqual({
+        model: { providerID: "anthropic", model: "claude-haiku-4-5" },
+        system: "Custom title prompt",
+      })
+    }),
+  )
+
   it.effect("migrates v1 provider lists to policies", () =>
     Effect.sync(() => {
       expect(

packages/core/test/config/normalization.test.ts

@@ -149,6 +149,28 @@ describe("ConfigNormalize", () => {
     expect(() => Schema.decodeUnknownSync(Info)(result.encoded)).not.toThrow()
   })
 
+  test("migrates the legacy small model to the title agent", () => {
+    const result = normalized({
+      small_model: "anthropic/claude-haiku-4-5",
+      agent: { title: { prompt: "Custom title prompt" } },
+    })
+    expect(result.encoded.agents).toEqual({
+      title: {
+        model: { providerID: "anthropic", model: "claude-haiku-4-5" },
+        system: "Custom title prompt",
+      },
+    })
+    expect(result.diagnostics).toEqual([])
+  })
+
+  test("omits an invalid legacy small model without exposing its value", () => {
+    const secret = "do-not-log-this-value"
+    const result = normalized({ small_model: secret })
+    expect(result.encoded.agents).toBeUndefined()
+    expect(result.diagnostics.map((item) => [item.kind, item.path])).toEqual([["unsupported", ["small_model"]]])
+    expect(JSON.stringify(result.diagnostics)).not.toContain(secret)
+  })
+
   test("recovers malformed named entries and retains a valid legacy collision", () => {
     const result = normalized({
       command: { fallback: { template: "legacy" } },
@@ -390,7 +412,6 @@ describe("ConfigNormalize", () => {
     const secret = "do-not-log-this-value"
     const result = normalized({
       logLevel: "DEBUG",
-      small_model: secret,
       agent: { reviewer: { name: secret, prompt: "review" } },
       provider: {
         custom: {
@@ -409,7 +430,6 @@ describe("ConfigNormalize", () => {
     })
     expect(result.diagnostics.filter((item) => item.kind === "unsupported").map((item) => item.path)).toEqual([
       ["logLevel"],
-      ["small_model"],
       ["agent", "reviewer", "name"],
       ["provider", "custom", "id"],
       ["provider", "custom", "whitelist"],

packages/core/test/file-mutation.test.ts

@@ -43,7 +43,7 @@ describe("FileMutation", () => {
 
         expect(yield* (yield* FileMutation.Service).write({ target, content: "after" })).toEqual({
           operation: "write",
-          target: target.canonical,
+          target: target.absolute,
           resource: "hello.txt",
           existed: true,
         })
@@ -62,11 +62,11 @@ describe("FileMutation", () => {
 
         expect(result).toEqual({
           operation: "write",
-          target: target.canonical,
+          target: target.absolute,
           resource: "src/nested/hello.txt",
           existed: false,
         })
-        expect(yield* Effect.promise(() => fs.readFile(result.target, "utf8"))).toBe("hello")
+        expect(yield* Effect.promise(() => fs.readFile(target.absolute, "utf8"))).toBe("hello")
       }).pipe(provide(directory)),
     ),
   )
@@ -84,7 +84,7 @@ describe("FileMutation", () => {
         yield* files.writeTextPreservingBom({ target: created, content: "\uFEFF\uFEFF\uFEFFcreated" })
 
         expect(yield* Effect.promise(() => fs.readFile(preservedPath, "utf8"))).toBe("\uFEFFafter")
-        expect(yield* Effect.promise(() => fs.readFile(created.canonical, "utf8"))).toBe("\uFEFFcreated")
+        expect(yield* Effect.promise(() => fs.readFile(created.absolute, "utf8"))).toBe("\uFEFFcreated")
       }).pipe(provide(directory)),
     ),
   )
@@ -99,7 +99,7 @@ describe("FileMutation", () => {
 
           expect(result).toEqual({
             operation: "write",
-            target: target.canonical,
+            target: target.absolute,
             resource: target.resource,
             existed: false,
           })
@@ -109,7 +109,7 @@ describe("FileMutation", () => {
     ),
   )
 
-  it.live("serializes concurrent writes to the same canonical target", () =>
+  it.live("serializes concurrent writes to the same absolute target", () =>
     withTmp((directory) =>
       Effect.gen(function* () {
         const targetPath = path.join(directory, "shared.txt")
@@ -152,7 +152,7 @@ describe("FileMutation", () => {
     ),
   )
 
-  it.live("allows distinct canonical targets to proceed independently", () =>
+  it.live("allows distinct absolute targets to proceed independently", () =>
     withTmp((directory) =>
       Effect.gen(function* () {
         const firstStarted = yield* Deferred.make<void>()

packages/core/test/integration.test.ts

@@ -140,7 +140,11 @@ describe("Integration", () => {
       yield* integrations.transform((editor) =>
         editor.method.update({
           integrationID,
-          method: { type: "key", label: "API key" },
+          method: {
+            type: "key",
+            label: "API key",
+            forms: [{ type: "string", key: "accountId", title: "Account ID", required: true }],
+          },
         }),
       )
       const updated = yield* bus
@@ -148,9 +152,17 @@ describe("Integration", () => {
         .pipe(Stream.take(1), Stream.runCollect, Effect.forkScoped)
       yield* Effect.yieldNow
 
+      expect(
+        yield* integrations.connection.key({ integrationID, key: "secret", answers: {} }).pipe(
+          Effect.flip,
+          Effect.map((error) => error.cause),
+        ),
+      ).toEqual(expect.objectContaining({ message: "Missing required form field: accountId" }))
+
       yield* integrations.connection.key({
         integrationID,
         key: "secret",
+        answers: { accountId: "account" },
         label: "Work",
       })
 
@@ -158,7 +170,7 @@ describe("Integration", () => {
         expect.objectContaining({
           integrationID,
           label: "Work",
-          value: Credential.Key.make({ type: "key", key: "secret" }),
+          value: Credential.Key.make({ type: "key", key: "secret", configuration: { accountId: "account" } }),
         }),
       ])
       expect((yield* Fiber.join(updated)).length).toBe(1)
@@ -243,7 +255,7 @@ describe("Integration", () => {
       const attempt = yield* integrations.oauth.connect({
         integrationID,
         methodID,
-        inputs: {},
+        answers: {},
         label: "Personal",
       })
       expect(attempt.mode).toBe("code")
@@ -289,7 +301,7 @@ describe("Integration", () => {
         }),
       )
 
-      const attempt = yield* integrations.oauth.connect({ integrationID, methodID, inputs: {} })
+      const attempt = yield* integrations.oauth.connect({ integrationID, methodID, answers: {} })
       expect(
         yield* integrations.oauth.complete({ integrationID, attemptID: attempt.attemptID }).pipe(Effect.flip),
       ).toBeInstanceOf(Integration.CodeRequiredError)
@@ -327,7 +339,7 @@ describe("Integration", () => {
         }),
       )
 
-      const attempt = yield* integrations.oauth.connect({ integrationID, methodID, inputs: {} })
+      const attempt = yield* integrations.oauth.connect({ integrationID, methodID, answers: {} })
       yield* Effect.yieldNow
       expect(yield* integrations.oauth.status({ integrationID, attemptID: attempt.attemptID })).toEqual({
         status: "complete",
@@ -365,7 +377,7 @@ describe("Integration", () => {
         }),
       )
 
-      const attempt = yield* integrations.oauth.connect({ integrationID, methodID, inputs: {} })
+      const attempt = yield* integrations.oauth.connect({ integrationID, methodID, answers: {} })
       const exit = yield* integrations.oauth
         .complete({ integrationID, attemptID: attempt.attemptID, code: "1234" })
         .pipe(Effect.exit)
@@ -401,7 +413,7 @@ describe("Integration", () => {
         }),
       )
 
-      const attempt = yield* integrations.oauth.connect({ integrationID, methodID, inputs: {} })
+      const attempt = yield* integrations.oauth.connect({ integrationID, methodID, answers: {} })
       expect(attempt.time.expires - attempt.time.created).toBe(Duration.toMillis(Duration.minutes(10)))
       yield* TestClock.adjust(Duration.minutes(10))
       yield* Effect.yieldNow
@@ -442,7 +454,7 @@ describe("Integration", () => {
             }),
           )
 
-          const attempt = yield* integrations.oauth.connect({ integrationID, methodID, inputs: {} })
+          const attempt = yield* integrations.oauth.connect({ integrationID, methodID, answers: {} })
           expect(attempt.time).toEqual({ created, expires: expiresAt })
         })
       })

packages/core/test/location-mutation.test.ts

@@ -37,7 +37,7 @@ describe("LocationMutation", () => {
         const target = yield* (yield* LocationMutation.Service).resolve({ path: "hello.txt" })
 
         expect(target).toMatchObject({
-          canonical: yield* Effect.promise(() => fs.realpath(targetPath)),
+          absolute: targetPath,
           resource: "hello.txt",
         })
         expect(target.externalDirectory).toBeUndefined()
@@ -50,10 +50,8 @@ describe("LocationMutation", () => {
       Effect.gen(function* () {
         yield* Effect.promise(() => fs.mkdir(path.join(directory, "src")))
         const target = yield* (yield* LocationMutation.Service).resolve({ path: path.join("src", "new.txt") })
-        const root = yield* Effect.promise(() => fs.realpath(directory))
-
         expect(target).toMatchObject({
-          canonical: path.join(root, "src", "new.txt"),
+          absolute: path.join(directory, "src", "new.txt"),
           resource: "src/new.txt",
         })
       }).pipe(provide(directory)),
@@ -64,9 +62,9 @@ describe("LocationMutation", () => {
     withTmp((directory) =>
       Effect.gen(function* () {
         const target = yield* (yield* LocationMutation.Service).resolve({ path: "../outside.txt" })
-        const root = yield* Effect.promise(() => fs.realpath(path.dirname(directory)))
+        const root = path.dirname(directory)
         expect(target).toMatchObject({
-          canonical: path.join(root, "outside.txt"),
+          absolute: path.join(root, "outside.txt"),
           resource: path.join(root, "outside.txt").replaceAll("\\", "/"),
         })
         expect(target.externalDirectory).toMatchObject({
@@ -77,7 +75,7 @@ describe("LocationMutation", () => {
     ),
   )
 
-  it.live("authorizes a prospective target below an external symlink by its in-location path", () =>
+  it.live("resolves a prospective target below an external symlink lexically", () =>
     withTmp((directory) => {
       const outside = `${directory}-outside`
       return Effect.gen(function* () {
@@ -88,7 +86,7 @@ describe("LocationMutation", () => {
         })
         const target = yield* (yield* LocationMutation.Service).resolve({ path: path.join("escape", "new.txt") })
         expect(target).toMatchObject({
-          canonical: path.join(yield* Effect.promise(() => fs.realpath(outside)), "new.txt"),
+          absolute: path.join(directory, "escape", "new.txt"),
           resource: "escape/new.txt",
         })
         expect(target.externalDirectory).toBeUndefined()
@@ -107,7 +105,7 @@ describe("LocationMutation", () => {
         })
 
         expect(yield* (yield* LocationMutation.Service).resolve({ path: "linked/new.txt" })).toMatchObject({
-          canonical: path.join(yield* Effect.promise(() => fs.realpath(directory)), "actual", "new.txt"),
+          absolute: path.join(directory, "linked", "new.txt"),
           resource: "linked/new.txt",
         })
       }).pipe(provide(directory)),
@@ -120,7 +118,7 @@ describe("LocationMutation", () => {
         const targetPath = path.join(directory, "new.txt")
         const target = yield* (yield* LocationMutation.Service).resolve({ path: targetPath })
         expect(target).toMatchObject({
-          canonical: path.join(yield* Effect.promise(() => fs.realpath(directory)), "new.txt"),
+          absolute: targetPath,
           resource: "new.txt",
         })
         expect(target.externalDirectory).toBeUndefined()
@@ -134,9 +132,9 @@ describe("LocationMutation", () => {
         Effect.gen(function* () {
           const targetPath = path.join(outside, "new.txt")
           const target = yield* (yield* LocationMutation.Service).resolve({ path: targetPath })
-          const root = yield* Effect.promise(() => fs.realpath(outside))
+          const root = outside
           expect(target).toMatchObject({
-            canonical: path.join(root, "new.txt"),
+            absolute: path.join(root, "new.txt"),
             resource: path.join(root, "new.txt").replaceAll("\\", "/"),
           })
           expect(target.externalDirectory).toMatchObject({
@@ -155,24 +153,23 @@ describe("LocationMutation", () => {
           const targetPath = path.join(outside, "existing.txt")
           yield* Effect.promise(() => fs.writeFile(targetPath, "existing"))
           const target = yield* (yield* LocationMutation.Service).resolve({ path: targetPath })
-          const root = yield* Effect.promise(() => fs.realpath(outside))
-          expect(target).toMatchObject({ canonical: path.join(root, "existing.txt") })
-          expect(target.externalDirectory?.directory).toBe(root)
+          expect(target).toMatchObject({ absolute: targetPath })
+          expect(target.externalDirectory?.directory).toBe(outside)
         }).pipe(provide(directory)),
       ),
     ),
   )
 
-  it.live("anchors prospective external descendants at their stable existing directory", () =>
+  it.live("authorizes prospective external descendants at their lexical parent", () =>
     withTmp((directory) =>
       withTmp((outside) =>
         Effect.gen(function* () {
           const targetPath = path.join(outside, "new", "nested", "file.txt")
           const target = yield* (yield* LocationMutation.Service).resolve({ path: targetPath })
-          const root = yield* Effect.promise(() => fs.realpath(outside))
+          const parent = path.dirname(targetPath)
           expect(target.externalDirectory).toMatchObject({
-            directory: root,
-            resource: path.join(root, "*").replaceAll("\\", "/"),
+            directory: parent,
+            resource: path.join(parent, "*").replaceAll("\\", "/"),
           })
         }).pipe(provide(directory)),
       ),

packages/core/test/model-resolver.test.ts

@@ -736,7 +736,11 @@ describe("ModelResolver", () => {
           headers: { "x-aisdk": "header" },
           body: { custom: true },
         }),
-        Credential.Key.make({ type: "key", key: "fallback-secret" }),
+        Credential.Key.make({
+          type: "key",
+          key: "fallback-secret",
+          configuration: { accountId: "account" },
+        }),
         {
           loadAISDK: (runtime) =>
             Effect.sync(() => {
@@ -745,7 +749,7 @@ describe("ModelResolver", () => {
                 modelID: "mistral-api-model",
                 providerID: "test-provider",
                 package: Provider.aisdk("@ai-sdk/mistral"),
-                settings: { project: "test", apiKey: "fallback-secret" },
+                settings: { project: "test", apiKey: "fallback-secret", accountId: "account" },
                 headers: { "x-aisdk": "header" },
                 body: { custom: true },
               })

packages/core/test/plugin/host.ts

@@ -10,7 +10,7 @@ import { Project } from "@opencode-ai/core/project"
 import { Provider } from "@opencode-ai/core/provider"
 import { AbsolutePath } from "@opencode-ai/core/schema"
 import { WebSearch } from "@opencode-ai/core/websearch"
-import { Effect, Stream } from "effect"
+import { Effect, Schema, Stream } from "effect"
 
 type Overrides = Partial<Omit<Plugin.Context, "options" | "session">> & {
   readonly session?: Partial<Plugin.Context["session"]>
@@ -226,8 +226,7 @@ export function catalogHost(catalog: Catalog.Interface): Plugin.Context["catalog
                   })),
                 })
               }),
-            remove: (providerID, modelID) =>
-              draft.model.remove(Provider.ID.make(providerID), Model.ID.make(modelID)),
+            remove: (providerID, modelID) => draft.model.remove(Provider.ID.make(providerID), Model.ID.make(modelID)),
             default: {
               get: () => {
                 const value = draft.model.default.get()
@@ -286,9 +285,9 @@ export function integrationHost(integration: Integration.Interface): Plugin.Cont
                 const refresh = input.refresh
                 draft.method.update({
                   integrationID: Integration.ID.make(input.integrationID),
-                  method: { ...input.method, id: methodID },
-                  authorize: (inputs) =>
-                    input.authorize(inputs).pipe(
+                  method: oauthMethod(input.method, methodID),
+                  authorize: (answers) =>
+                    input.authorize(answers).pipe(
                       Effect.map((authorization) => {
                         if (authorization.mode === "auto") {
                           return {
@@ -354,7 +353,7 @@ export function integrationHost(integration: Integration.Interface): Plugin.Cont
               }
               draft.method.update({
                 integrationID: Integration.ID.make(input.integrationID),
-                method: input.method,
+                method: keyMethod(input.method),
               })
             },
             remove: (id, item) => draft.method.remove(Integration.ID.make(id), internalMethod(item)),
@@ -402,26 +401,21 @@ function oauthCredential(value: Credential.OAuth) {
   return Credential.OAuth.make({ ...value, methodID: Integration.MethodID.make(value.methodID) })
 }
 
-function method(value: Integration.Method) {
+function method(value: Integration.Method): IntegrationMethodRegistration["method"] {
   if (value.type === "env") return { type: value.type, names: [...value.names] }
-  if (value.type === "key") return { type: value.type, label: value.label }
+  if (value.type === "key") return { type: value.type, label: value.label, forms: mutable(value.forms) }
   if (value.type === "command") return { ...value, command: [...value.command] }
   return {
     type: value.type,
     id: value.id,
     label: value.label,
-    prompts: value.prompts?.map((prompt) => {
-      if (prompt.type === "text") return { ...prompt }
-      return { ...prompt, options: prompt.options.map((option) => ({ ...option })) }
-    }),
+    forms: mutable(value.forms),
   }
 }
 
-function internalMethod(
-  value: IntegrationMethodRegistration["method"],
-): Integration.Method {
+function internalMethod(value: IntegrationMethodRegistration["method"]): Integration.Method {
   if (value.type === "env") return value
-  if (value.type === "key") return value
+  if (value.type === "key") return keyMethod(value)
   if (value.type === "command") {
     return {
       ...value,
@@ -429,10 +423,41 @@ function internalMethod(
       command: [...value.command],
     }
   }
-  return {
-    ...value,
-    id: Integration.MethodID.make(value.id),
-  }
+  return oauthMethod(value, Integration.MethodID.make(value.id))
+}
+
+type Mutable<Value> = Value extends readonly [infer Head, ...infer Tail]
+  ? [Mutable<Head>, ...MutableTuple<Tail>]
+  : Value extends ReadonlyArray<infer Item>
+    ? Array<Mutable<Item>>
+    : Value extends object
+      ? { -readonly [Key in keyof Value]: Mutable<Value[Key]> }
+      : Value
+
+type MutableTuple<Value extends ReadonlyArray<unknown>> = {
+  -readonly [Key in keyof Value]: Mutable<Value[Key]>
+}
+
+function mutable<Value>(value: Value): Mutable<Value>
+function mutable(value: unknown): unknown {
+  return structuredClone(value)
+}
+
+function keyMethod(value: IntegrationMethodRegistration["method"] & { type: "key" }) {
+  return Schema.decodeUnknownSync(Integration.KeyMethod)({
+    type: "key",
+    ...(value.label === undefined ? {} : { label: value.label }),
+    ...(value.forms === undefined ? {} : { forms: value.forms }),
+  })
+}
+
+function oauthMethod(value: IntegrationMethodRegistration["method"] & { type: "oauth" }, id: Integration.MethodID) {
+  return Schema.decodeUnknownSync(Integration.OAuthMethod)({
+    id,
+    type: "oauth",
+    label: value.label,
+    ...(value.forms === undefined ? {} : { forms: value.forms }),
+  })
 }
 
 function agentInfo(value: Agent.Info) {

packages/core/test/plugin/provider-azure.test.ts

@@ -8,6 +8,7 @@ import { Plugin } from "@opencode-ai/core/plugin"
 import { PluginHost } from "@opencode-ai/core/plugin/host"
 import { AzurePlugin } from "@opencode-ai/core/plugin/provider/azure"
 import { Provider } from "@opencode-ai/core/provider"
+import { Integration } from "@opencode-ai/core/integration"
 import { testEffect } from "../lib/effect"
 import { PluginTestLayer } from "./fixture"
 
@@ -60,6 +61,27 @@ function fakeSelectorSdk(calls: string[]) {
 }
 
 describe("AzurePlugin", () => {
+  it.effect("registers a resource name form when the environment does not provide one", () =>
+    withEnv({ AZURE_RESOURCE_NAME: undefined, AZURE_COGNITIVE_SERVICES_RESOURCE_NAME: undefined }, () =>
+      Effect.gen(function* () {
+        yield* addPlugin()
+        expect((yield* (yield* Integration.Service).get(Integration.ID.make("azure")))?.methods).toContainEqual({
+          type: "key",
+          label: "API key",
+          forms: [
+            {
+              type: "string",
+              key: "resourceName",
+              title: "Enter Azure Resource Name",
+              placeholder: "e.g. my-models",
+              required: true,
+            },
+          ],
+        })
+      }),
+    ),
+  )
+
   it.effect("resolves resourceName from env", () =>
     withEnv({ AZURE_RESOURCE_NAME: "from-env" }, () =>
       Effect.gen(function* () {
@@ -195,7 +217,17 @@ describe("AzurePlugin", () => {
       Effect.gen(function* () {
         const plugin = yield* Plugin.Service
         const aisdk = yield* AISDK.Service
+        const catalog = yield* Catalog.Service
+        yield* catalog.transform((catalog) =>
+          catalog.provider.update(Provider.ID.azure, (provider) => {
+            provider.settings = { ...provider.settings, baseURL: "https://proxy.example.com/openai" }
+          }),
+        )
         yield* addPlugin()
+        expect((yield* (yield* Integration.Service).get(Integration.ID.make("azure")))?.methods).toContainEqual({
+          type: "key",
+          label: "API key",
+        })
         const result = yield* aisdk.runSDK({
           model: Model.Info.make({
             ...Model.Info.default(Provider.ID.azure, Model.ID.make("deployment")),

packages/core/test/plugin/provider-cloudflare-ai-gateway.test.ts

@@ -1,11 +1,13 @@
 import { AISDK } from "@opencode-ai/core/aisdk"
 import { describe, expect, mock } from "bun:test"
 import { Effect } from "effect"
+import { Catalog } from "@opencode-ai/core/catalog"
 import { Model } from "@opencode-ai/core/model"
 import { Plugin } from "@opencode-ai/core/plugin"
 import { PluginHost } from "@opencode-ai/core/plugin/host"
 import { CloudflareAIGatewayPlugin } from "@opencode-ai/core/plugin/provider/cloudflare-ai-gateway"
 import { Provider } from "@opencode-ai/core/provider"
+import { Integration } from "@opencode-ai/core/integration"
 import { testEffect } from "../lib/effect"
 import { PluginTestLayer } from "./fixture"
 
@@ -102,6 +104,24 @@ mock.module("ai-gateway-provider/providers/unified", () => ({
 }))
 
 describe("CloudflareAIGatewayPlugin", () => {
+  it.effect("registers account and gateway forms when the environment does not provide them", () =>
+    withEnv({ CLOUDFLARE_ACCOUNT_ID: undefined, CLOUDFLARE_GATEWAY_ID: undefined }, () =>
+      Effect.gen(function* () {
+        yield* addPlugin()
+        expect(
+          (yield* (yield* Integration.Service).get(Integration.ID.make("cloudflare-ai-gateway")))?.methods,
+        ).toContainEqual({
+          type: "key",
+          label: "Gateway API token",
+          forms: [
+            expect.objectContaining({ type: "string", key: "accountId", required: true }),
+            expect.objectContaining({ type: "string", key: "gatewayId", required: true }),
+          ],
+        })
+      }),
+    ),
+  )
+
   it.effect("requires account, gateway, and token before creating the unified SDK", () =>
     withEnv(
       {
@@ -357,7 +377,16 @@ describe("CloudflareAIGatewayPlugin", () => {
           resetCalls()
           const plugin = yield* Plugin.Service
           const aisdk = yield* AISDK.Service
+          const catalog = yield* Catalog.Service
+          yield* catalog.transform((catalog) =>
+            catalog.provider.update(Provider.ID.make("cloudflare-ai-gateway"), (provider) => {
+              provider.settings = { ...provider.settings, baseURL: "https://proxy.example/v1" }
+            }),
+          )
           yield* addPlugin()
+          expect(
+            (yield* (yield* Integration.Service).get(Integration.ID.make("cloudflare-ai-gateway")))?.methods,
+          ).toContainEqual({ type: "key", label: "Gateway API token" })
 
           const result = yield* aisdk.runSDK({
             model: Model.Info.make({

packages/core/test/plugin/provider-cloudflare-workers-ai.test.ts

@@ -7,6 +7,7 @@ import { Plugin } from "@opencode-ai/core/plugin"
 import { PluginHost } from "@opencode-ai/core/plugin/host"
 import { CloudflareWorkersAIPlugin } from "@opencode-ai/core/plugin/provider/cloudflare-workers-ai"
 import { Provider } from "@opencode-ai/core/provider"
+import { Integration } from "@opencode-ai/core/integration"
 import type { LanguageModelV3 } from "@ai-sdk/provider"
 import { testEffect } from "../lib/effect"
 import { PluginTestLayer } from "./fixture"
@@ -79,6 +80,29 @@ function cloudflareHeaders(sdk: unknown, modelID = "@cf/model") {
 }
 
 describe("CloudflareWorkersAIPlugin", () => {
+  it.effect("registers an account form when the environment does not provide one", () =>
+    withEnv({ CLOUDFLARE_ACCOUNT_ID: undefined }, () =>
+      Effect.gen(function* () {
+        yield* addPlugin()
+        expect(
+          (yield* (yield* Integration.Service).get(Integration.ID.make("cloudflare-workers-ai")))?.methods,
+        ).toContainEqual({
+          type: "key",
+          label: "API key",
+          forms: [
+            {
+              type: "string",
+              key: "accountId",
+              title: "Enter your Cloudflare Account ID",
+              placeholder: "e.g. 1234567890abcdef1234567890abcdef",
+              required: true,
+            },
+          ],
+        })
+      }),
+    ),
+  )
+
   it.effect("maps account ID to endpoint URL and creates an OpenAI-compatible SDK", () =>
     withEnv({ CLOUDFLARE_ACCOUNT_ID: "acct", CLOUDFLARE_API_KEY: "key" }, () =>
       Effect.gen(function* () {
@@ -91,6 +115,9 @@ describe("CloudflareWorkersAIPlugin", () => {
           }),
         )
         yield* addPlugin()
+        expect(
+          (yield* (yield* Integration.Service).get(Integration.ID.make("cloudflare-workers-ai")))?.methods,
+        ).toContainEqual({ type: "key", label: "API key" })
         const provider = required(yield* catalog.provider.get(Provider.ID.make("cloudflare-workers-ai")))
         const sdk = yield* aisdk.runSDK({
           model: Model.Info.make({
@@ -135,7 +162,16 @@ describe("CloudflareWorkersAIPlugin", () => {
       Effect.gen(function* () {
         const plugin = yield* Plugin.Service
         const aisdk = yield* AISDK.Service
+        const catalog = yield* Catalog.Service
+        yield* catalog.transform((catalog) =>
+          catalog.provider.update(Provider.ID.make("cloudflare-workers-ai"), (provider) => {
+            provider.settings = { ...provider.settings, baseURL: "https://proxy.example/v1" }
+          }),
+        )
         yield* addPlugin()
+        expect(
+          (yield* (yield* Integration.Service).get(Integration.ID.make("cloudflare-workers-ai")))?.methods,
+        ).toContainEqual({ type: "key", label: "API key" })
         const result = yield* aisdk.runSDK({
           model: Model.Info.make({
             ...Model.Info.default(Provider.ID.make("cloudflare-workers-ai"), Model.ID.make("@cf/model")),

packages/core/test/plugin/provider-github-copilot.test.ts

@@ -57,7 +57,7 @@ describe("GithubCopilotPlugin", () => {
         id: Integration.MethodID.make("device"),
         type: "oauth",
         label: "Login with GitHub Copilot",
-        prompts: expect.any(Array),
+        forms: expect.any(Array),
       })
     }),
   )

packages/core/test/plugin/provider-opencode.test.ts

@@ -128,7 +128,7 @@ describe("OpencodePlugin", () => {
           const attempt = yield* integrations.oauth.connect({
             integrationID,
             methodID: Integration.MethodID.make("device"),
-            inputs: { server: `${server.url.origin}/console///?ignored=true#ignored` },
+            answers: { server: `${server.url.origin}/console///?ignored=true#ignored` },
           })
           expect(attempt.url).toBe(`${server.url.origin}/verify`)
           yield* eventually(
@@ -155,7 +155,7 @@ describe("OpencodePlugin", () => {
         .connect({
           integrationID: Integration.ID.make("opencode"),
           methodID: Integration.MethodID.make("device"),
-          inputs: { server: "ftp://console.example.com" },
+          answers: { server: "ftp://console.example.com" },
         })
         .pipe(Effect.flip)
       expect(error).toBeInstanceOf(Integration.AuthorizationError)

packages/core/test/plugin/websearch.test.ts

@@ -67,7 +67,7 @@ describe("built-in web search providers", () => {
         name: "Exa",
         methods: [{ type: "key" }, { type: "env", names: ["EXA_API_KEY"] }],
       })
-      yield* integrations.connection.key({ integrationID: Integration.ID.make("exa"), key: "exa secret" })
+      yield* integrations.connection.key({ integrationID: Integration.ID.make("exa"), key: "exa secret", answers: {} })
       expect(yield* websearch.query({ query: "effect typescript", providerID: WebSearch.ID.make("exa") })).toEqual(
         new WebSearch.Response({
           providerID: WebSearch.ID.make("exa"),
@@ -129,7 +129,11 @@ describe("built-in web search providers", () => {
       yield* WebSearchParallel.Plugin.effect(
         host({ integration: integrationHost(integrations), websearch: webSearchHost(websearch) }),
       )
-      yield* integrations.connection.key({ integrationID: Integration.ID.make("parallel"), key: "parallel-secret" })
+      yield* integrations.connection.key({
+        integrationID: Integration.ID.make("parallel"),
+        key: "parallel-secret",
+        answers: {},
+      })
 
       const output = yield* websearch.query({
         query: "effect layers",

packages/core/test/shared-schema.test.ts

@@ -90,15 +90,10 @@ test("Core reuses the canonical shared schemas", async () => {
     [coreFileSystem.Match, FileSystem.Match],
     [coreIntegration.ID, Integration.ID],
     [coreIntegration.MethodID, Integration.MethodID],
-    [coreIntegration.When, Integration.When],
-    [coreIntegration.TextPrompt, Integration.TextPrompt],
-    [coreIntegration.SelectPrompt, Integration.SelectPrompt],
-    [coreIntegration.Prompt, Integration.Prompt],
     [coreIntegration.OAuthMethod, Integration.OAuthMethod],
     [coreIntegration.KeyMethod, Integration.KeyMethod],
     [coreIntegration.EnvMethod, Integration.EnvMethod],
     [coreIntegration.Method, Integration.Method],
-    [coreIntegration.Inputs, Integration.Inputs],
     [coreIntegration.Ref, Integration.Ref],
     [coreLocation.Ref, Location.Ref],
     [coreAI.ProviderMetadata, AI.ProviderMetadata],

packages/core/test/tool-read-filesystem.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect } from "bun:test"
+import fs from "fs/promises"
 import path from "path"
 import { Effect, FileSystem } from "effect"
 import { LayerNodePlatform } from "@opencode-ai/util/effect/app-node-platform"
@@ -50,22 +51,53 @@ describe("ReadToolFileSystem", () => {
     }),
   )
 
-  it.effect("reports binary and malformed UTF-8 content as typed errors", () =>
+  it.effect("reads malformed UTF-8 lossily and still rejects null-byte binary content", () =>
     Effect.gen(function* () {
       const { fs, files, directory } = yield* fixture
       const binary = path.join(directory, "archive.dat")
       const malformed = path.join(directory, "malformed.txt")
       yield* files.writeFile(binary, Uint8Array.of(0, 1, 2, 3))
-      const malformedContent = new Uint8Array(64 * 1024 + 1).fill(97)
-      malformedContent[64 * 1024] = 0x80
-      yield* files.writeFile(malformed, malformedContent)
+      yield* files.writeFile(malformed, Uint8Array.of(0x68, 0x69, 0x80))
 
       const binaryError = yield* ReadToolFileSystem.read(fs, binary, "archive.dat").pipe(Effect.flip)
-      const malformedError = yield* ReadToolFileSystem.read(fs, malformed, "malformed.txt").pipe(Effect.flip)
+      const malformedResult = yield* ReadToolFileSystem.read(fs, malformed, "malformed.txt")
 
       expect(binaryError).toBeInstanceOf(ReadToolFileSystem.BinaryFileError)
       expect(binaryError.message).toBe("Cannot read binary file: archive.dat")
-      expect(malformedError).toBeInstanceOf(ReadToolFileSystem.MalformedUtf8Error)
+      expect(malformedResult).toMatchObject({ type: "file", content: "hi\uFFFD", encoding: "utf8" })
+    }),
+  )
+
+  it.effect("reads text despite a binary-associated extension", () =>
+    Effect.gen(function* () {
+      const { fs, files, directory } = yield* fixture
+      const file = path.join(directory, "notes.docx")
+      yield* files.writeFileString(file, "plain text")
+
+      const result = yield* ReadToolFileSystem.read(fs, file, "notes.docx")
+
+      expect(result).toMatchObject({ type: "file", content: "plain text", encoding: "utf8" })
+    }),
+  )
+
+  it.effect("lists unresolved symlinks, including broken and escaping links", () =>
+    Effect.gen(function* () {
+      if (process.platform === "win32") return
+      const { fs: service, files, directory } = yield* fixture
+      const outside = yield* files.makeTempDirectoryScoped()
+      yield* files.makeDirectory(path.join(directory, "folder"))
+      yield* files.writeFileString(path.join(directory, "file.txt"), "hello")
+      yield* Effect.promise(() => fs.symlink(path.join(outside, "target.txt"), path.join(directory, "escape")))
+      yield* Effect.promise(() => fs.symlink(path.join(directory, "missing.txt"), path.join(directory, "broken")))
+
+      const result = yield* ReadToolFileSystem.list(service, directory)
+
+      expect(result.entries.map((entry) => ({ ...entry, path: String(entry.path) }))).toEqual([
+        { path: `folder${path.sep}`, type: "directory" },
+        { path: "broken", type: "symlink" },
+        { path: "escape", type: "symlink" },
+        { path: "file.txt", type: "file" },
+      ])
     }),
   )
 

packages/core/test/tool-read.test.ts

@@ -148,13 +148,13 @@ const mutation = Layer.succeed(
   LocationMutation.Service,
   LocationMutation.Service.of({
     resolve: (input) => {
-      const canonical = path.resolve(process.cwd(), input.path)
-      const external = path.isAbsolute(input.path) && !FSUtil.contains(process.cwd(), canonical)
-      const resource = external ? canonical.replaceAll("\\", "/") : path.relative(process.cwd(), canonical) || "."
-      const directory = path.dirname(canonical)
+      const absolute = path.resolve(process.cwd(), input.path)
+      const external = path.isAbsolute(input.path) && !FSUtil.contains(process.cwd(), absolute)
+      const resource = external ? absolute.replaceAll("\\", "/") : path.relative(process.cwd(), absolute) || "."
+      const directory = path.dirname(absolute)
       const externalResource = path.join(directory, "*").replaceAll("\\", "/")
       return Effect.succeed({
-        canonical,
+        absolute,
         resource,
         externalDirectory: external
           ? {
@@ -621,10 +621,6 @@ describe("ReadTool", () => {
     Effect.gen(function* () {
       const registry = yield* Tool.Service
       for (const [error, message] of [
-        [
-          new ReadToolFileSystem.MalformedUtf8Error({ resource: "invalid.txt" }),
-          "File is not valid UTF-8: invalid.txt",
-        ],
         [new ReadToolFileSystem.OffsetOutOfRangeError({ offset: 10 }), "Offset 10 is out of range"],
         [
           new ReadToolFileSystem.PathKindError({ resource: "socket", expected: "a file" }),
@@ -721,16 +717,19 @@ describe("ReadTool", () => {
       const registry = yield* Tool.Service
 
       const result = yield* executeTool(registry, {
-          sessionID,
-          ...toolIdentity,
-          call: {
-            type: "tool-call",
-            id: "call-read-directory",
-            name: "read",
-            input: { path: "src", offset: 2, limit: 10 },
-          },
-        })
-      expect(result).toMatchObject({ status: "completed", output: { entries: listResult.entries, truncated: true, next: 4 } })
+        sessionID,
+        ...toolIdentity,
+        call: {
+          type: "tool-call",
+          id: "call-read-directory",
+          name: "read",
+          input: { path: "src", offset: 2, limit: 10 },
+        },
+      })
+      expect(result).toMatchObject({
+        status: "completed",
+        output: { entries: listResult.entries, truncated: true, next: 4 },
+      })
       if (result.status !== "completed") return
       expect(result.content).toEqual([
         {

packages/core/test/tool-write.test.ts

@@ -90,13 +90,7 @@ const withTool = <A, E, R>(directory: string, body: (registry: Tool.Interface) =
   }).pipe(
     Effect.provide(
       AppNodeBuilder.build(
-        LayerNode.group([
-          Tool.node,
-          Tool.node,
-          LocationMutation.node,
-          FileMutation.node,
-          writeToolNode,
-        ]),
+        LayerNode.group([Tool.node, Tool.node, LocationMutation.node, FileMutation.node, writeToolNode]),
         [
           [FSUtil.node, filesystem],
           [Location.node, activeLocation],
@@ -230,7 +224,10 @@ describe("WriteTool", () => {
         const deduplicated = path.join(tmp.path, "deduplicated.txt")
         formatFile = (target) =>
           Effect.promise(async () => {
-            await fs.writeFile(target, `\uFEFF\uFEFF\uFEFF${(await fs.readFile(target, "utf8")).replace(/^\uFEFF+/, "")}`)
+            await fs.writeFile(
+              target,
+              `\uFEFF\uFEFF\uFEFF${(await fs.readFile(target, "utf8")).replace(/^\uFEFF+/, "")}`,
+            )
             return true
           })
         return Effect.promise(() =>
@@ -323,24 +320,22 @@ describe("WriteTool", () => {
         ).pipe(
           Effect.andThen((settled) =>
             Effect.gen(function* () {
-              const canonicalTarget = path.join(yield* Effect.promise(() => fs.realpath(outside.path)), "external.txt")
+              const absoluteTarget = target
               expect(assertions.map((input) => input.action)).toEqual(["external_directory", "edit"])
               expect(assertions[0]).toMatchObject({
-                resources: [
-                  path.join(yield* Effect.promise(() => fs.realpath(outside.path)), "*").replaceAll("\\", "/"),
-                ],
+                resources: [path.join(outside.path, "*").replaceAll("\\", "/")],
               })
-              expect(assertions[1]).toMatchObject({ resources: [canonicalTarget.replaceAll("\\", "/")], save: ["*"] })
+              expect(assertions[1]).toMatchObject({ resources: [absoluteTarget.replaceAll("\\", "/")], save: ["*"] })
               expect(settled).toMatchObject({
                 status: "completed",
                 output: {
-                  target: canonicalTarget,
-                  resource: canonicalTarget.replaceAll("\\", "/"),
+                  target: absoluteTarget,
+                  resource: absoluteTarget.replaceAll("\\", "/"),
                   existed: false,
                 },
               })
               expect(yield* Effect.promise(() => fs.readFile(target, "utf8"))).toBe("external")
-              expect(writes).toEqual([canonicalTarget])
+              expect(writes).toEqual([absoluteTarget])
             }),
           ),
         )
@@ -368,12 +363,10 @@ describe("WriteTool", () => {
           ),
           Effect.andThen(
             Effect.gen(function* () {
-              const canonicalRepo = yield* Effect.promise(() => fs.realpath(repo))
-              const canonicalNested = yield* Effect.promise(() => fs.realpath(nested))
               expect(assertions[0]).toMatchObject({
                 action: "external_directory",
-                resources: [path.join(canonicalNested, "*").replaceAll("\\", "/")],
-                save: [path.join(canonicalRepo, "*").replaceAll("\\", "/")],
+                resources: [path.join(nested, "*").replaceAll("\\", "/")],
+                save: [path.join(repo, "*").replaceAll("\\", "/")],
               })
             }),
           ),

packages/plugin/src/effect/integration.ts

@@ -8,10 +8,10 @@ import type {
 } from "@opencode-ai/client"
 import type { IntegrationApi } from "@opencode-ai/client/effect/api"
 import { Credential } from "@opencode-ai/schema/credential"
+import { Form } from "@opencode-ai/schema/form"
 import type { Effect, Scope } from "effect"
 import type { Transform } from "./registration.js"
 
-type IntegrationInputs = Record<string, string>
 type IntegrationRef = { id: string; name: string }
 
 export type IntegrationOAuthAuthorization = {
@@ -31,7 +31,7 @@ export type IntegrationOAuthAuthorization = {
 export type IntegrationOAuthMethodRegistration = {
   readonly integrationID: string
   readonly method: IntegrationOAuthMethod
-  readonly authorize: (inputs: IntegrationInputs) => Effect.Effect<IntegrationOAuthAuthorization, unknown, Scope.Scope>
+  readonly authorize: (answers: Form.Answer) => Effect.Effect<IntegrationOAuthAuthorization, unknown, Scope.Scope>
   readonly refresh?: (credential: Credential.OAuth) => Effect.Effect<Credential.OAuth, unknown>
   readonly label?: (credential: Credential.OAuth) => string | undefined
 }

packages/plugin/src/promise/integration.ts

@@ -8,9 +8,9 @@ import type {
 } from "@opencode-ai/client"
 import type { IntegrationApi } from "@opencode-ai/client/promise/api"
 import { Credential } from "@opencode-ai/schema/credential"
+import { Form } from "@opencode-ai/schema/form"
 import type { Transform } from "./registration.js"
 
-type IntegrationInputs = Record<string, string>
 type IntegrationRef = { id: string; name: string }
 
 export type IntegrationOAuthAuthorization = {
@@ -31,7 +31,7 @@ export type IntegrationOAuthAuthorization = {
 export type IntegrationOAuthMethodRegistration = {
   readonly integrationID: string
   readonly method: IntegrationOAuthMethod
-  readonly authorize: (inputs: IntegrationInputs) => Promise<IntegrationOAuthAuthorization>
+  readonly authorize: (answers: Form.Answer) => Promise<IntegrationOAuthAuthorization>
   readonly refresh?: (credential: Credential.OAuth) => Promise<Credential.OAuth>
   readonly label?: (credential: Credential.OAuth) => string | undefined
 }

packages/protocol/src/groups/integration.ts

@@ -1,12 +1,11 @@
 import { Integration } from "@opencode-ai/schema/integration"
 import { Location } from "@opencode-ai/schema/location"
+import { Form } from "@opencode-ai/schema/form"
 import { Schema } from "effect"
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/unstable/httpapi"
 import { InvalidRequestError } from "../errors.js"
 import { LocationQuery, locationQueryOpenApi } from "./location.js"
 
-const Inputs = Schema.Record(Schema.String, Schema.String)
-
 export const IntegrationGroup = HttpApiGroup.make("server.integration")
   .add(
     HttpApiEndpoint.get("integration.list", "/api/integration", {
@@ -59,6 +58,7 @@ export const IntegrationGroup = HttpApiGroup.make("server.integration")
       query: LocationQuery,
       payload: Schema.Struct({
         key: Schema.String,
+        answers: Form.Answer,
         label: Schema.optional(Schema.String),
       }),
       success: HttpApiSchema.NoContent,
@@ -79,7 +79,7 @@ export const IntegrationGroup = HttpApiGroup.make("server.integration")
       query: LocationQuery,
       payload: Schema.Struct({
         methodID: Integration.MethodID,
-        inputs: Inputs,
+        answers: Form.Answer,
         label: Schema.optional(Schema.String),
       }),
       success: Location.response(Integration.Attempt),

packages/schema/src/agent.ts

@@ -41,7 +41,7 @@ export const Info = Schema.Struct({
           id,
           name: Name.make(id),
           request: { settings: {}, headers: {}, body: {} },
-          mode: "all",
+          mode: "primary",
           hidden: false,
           permissions: [
             { action: "*", resource: "*", effect: "allow" },

packages/schema/src/credential.ts

@@ -5,6 +5,7 @@ import { optional } from "./schema.js"
 import { IntegrationMethodID } from "./integration-id.js"
 import { ascending } from "./identifier.js"
 import { NonNegativeInt, statics } from "./schema.js"
+import { Form } from "./form.js"
 
 export const ID = Schema.String.pipe(
   Schema.brand("Credential.ID"),
@@ -27,6 +28,7 @@ export const Key = Schema.Struct({
   type: Schema.Literal("key"),
   key: Schema.String,
   metadata: optional(Schema.Record(Schema.String, Schema.Unknown)),
+  configuration: optional(Form.Answer),
 }).annotate({ identifier: "Credential.Key" })
 
 export const Value = Schema.Union([OAuth, Key])

packages/schema/src/integration.ts

@@ -7,6 +7,7 @@ import { Connection } from "./connection.js"
 import { ascending } from "./identifier.js"
 import { statics } from "./schema.js"
 import { IntegrationID, IntegrationMethodID } from "./integration-id.js"
+import { Form } from "./form.js"
 
 export const ID = IntegrationID
 export type ID = typeof ID.Type
@@ -14,46 +15,12 @@ export type ID = typeof ID.Type
 export const MethodID = IntegrationMethodID
 export type MethodID = typeof MethodID.Type
 
-export interface When extends Schema.Schema.Type<typeof When> {}
-export const When = Schema.Struct({
-  key: Schema.String,
-  op: Schema.Literals(["eq", "neq"]),
-  value: Schema.String,
-}).annotate({ identifier: "Integration.When" })
-
-export interface TextPrompt extends Schema.Schema.Type<typeof TextPrompt> {}
-export const TextPrompt = Schema.Struct({
-  type: Schema.Literal("text"),
-  key: Schema.String,
-  message: Schema.String,
-  placeholder: optional(Schema.String),
-  when: optional(When),
-}).annotate({ identifier: "Integration.TextPrompt" })
-
-export interface SelectPrompt extends Schema.Schema.Type<typeof SelectPrompt> {}
-export const SelectPrompt = Schema.Struct({
-  type: Schema.Literal("select"),
-  key: Schema.String,
-  message: Schema.String,
-  options: Schema.Array(
-    Schema.Struct({
-      label: Schema.String,
-      value: Schema.String,
-      hint: optional(Schema.String),
-    }),
-  ),
-  when: optional(When),
-}).annotate({ identifier: "Integration.SelectPrompt" })
-
-export const Prompt = Schema.Union([TextPrompt, SelectPrompt]).pipe(Schema.toTaggedUnion("type"))
-export type Prompt = typeof Prompt.Type
-
 export interface OAuthMethod extends Schema.Schema.Type<typeof OAuthMethod> {}
 export const OAuthMethod = Schema.Struct({
   id: MethodID,
   type: Schema.Literal("oauth"),
   label: Schema.String,
-  prompts: optional(Schema.Array(Prompt)),
+  forms: optional(Form.Fields),
 }).annotate({ identifier: "Integration.OAuthMethod" })
 
 export interface CommandMethod extends Schema.Schema.Type<typeof CommandMethod> {}
@@ -68,6 +35,7 @@ export interface KeyMethod extends Schema.Schema.Type<typeof KeyMethod> {}
 export const KeyMethod = Schema.Struct({
   type: Schema.Literal("key"),
   label: optional(Schema.String),
+  forms: optional(Form.Fields),
 }).annotate({ identifier: "Integration.KeyMethod" })
 
 export interface EnvMethod extends Schema.Schema.Type<typeof EnvMethod> {}
@@ -81,9 +49,6 @@ export const Method = Schema.Union([OAuthMethod, CommandMethod, KeyMethod, EnvMe
   .annotate({ identifier: "Integration.Method" })
 export type Method = typeof Method.Type
 
-export const Inputs = Schema.Record(Schema.String, Schema.String).annotate({ identifier: "Integration.Inputs" })
-export type Inputs = typeof Inputs.Type
-
 const Updated = ephemeral({
   type: "integration.updated",
   schema: {},

packages/server/src/handlers/integration.ts

@@ -58,6 +58,7 @@ export const IntegrationHandler = HttpApiBuilder.group(Api, "server.integration"
             service.connection.key({
               integrationID: ctx.params.integrationID,
               key: ctx.payload.key,
+              answers: ctx.payload.answers,
               label: ctx.payload.label,
             }),
           )
@@ -73,7 +74,7 @@ export const IntegrationHandler = HttpApiBuilder.group(Api, "server.integration"
               service.oauth.connect({
                 integrationID: ctx.params.integrationID,
                 methodID: ctx.payload.methodID,
-                inputs: ctx.payload.inputs,
+                answers: ctx.payload.answers,
                 label: ctx.payload.label,
               }),
             ),

packages/tui/src/app.tsx

@@ -512,7 +512,7 @@ function App(props: { pair?: DialogPairCredentials }) {
   const terminalTitleEnabled = () => config.data.terminal?.title ?? true
   const copyOnSelectEnabled = () => config.data.terminal?.copy_on_select ?? process.platform !== "win32"
   const pasteSummaryEnabled = () => config.data.prompt?.paste !== "full"
-  const tabsVertical = () => (config.data.tabs?.vertical ?? false) && sessionTabsFitVertically(dimensions().width)
+  const tabsVertical = () => config.data.tabs.layout === "vertical" && sessionTabsFitVertically(dimensions().width)
   const tabsVisible = () =>
     sessionTabs.enabled() && (sessionTabs.tabs().length > 0 || sessionTabs.newTab()) && route.data.type !== "plugin"
 

packages/tui/src/component/dialog-config.tsx

@@ -101,12 +101,11 @@ export const settings: Setting[] = [
     labels: ["current directory", "global"],
   },
   {
-    title: "Vertical",
+    title: "Layout",
     category: "Tabs",
-    path: ["tabs", "vertical"],
-    default: false,
-    values: [false, true],
-    labels: ["off", "on"],
+    path: ["tabs", "layout"],
+    default: "horizontal",
+    values: ["horizontal", "vertical"],
     keywords: ["sidebar", "orientation", "left"],
   },
   {

packages/tui/src/component/dialog-integration.tsx

@@ -5,6 +5,8 @@ import type {
   IntegrationInfo,
   IntegrationOauthConnectOutput,
   IntegrationOAuthMethod,
+  FormAnswer,
+  FormFields,
 } from "@opencode-ai/client"
 import open from "open"
 import { createMemo, createSignal, onCleanup, onMount, Show } from "solid-js"
@@ -18,6 +20,7 @@ import { DialogPrompt } from "../ui/dialog-prompt"
 import { DialogSelect } from "../ui/dialog-select"
 import { Link } from "../ui/link"
 import { useToast } from "../ui/toast"
+import { FormInput } from "../routes/session/form"
 
 const INTEGRATION_PRIORITY: Record<string, number> = {
   opencode: 0,
@@ -181,7 +184,7 @@ function openMethod(
   onConnected?: OnIntegrationConnected,
 ) {
   if (method.type === "key") {
-    dialog.replace(() => <KeyMethod integration={integration} method={method} onConnected={onConnected} />)
+    void beginKey(integration, method, dialog, onConnected)
     return
   }
   if (method.type === "command") {
@@ -191,6 +194,21 @@ function openMethod(
   void beginOAuth(integration, method, dialog, onConnected)
 }
 
+async function beginKey(
+  integration: IntegrationInfo,
+  method: Extract<ConnectMethod, { type: "key" }>,
+  dialog: ReturnType<typeof useDialog>,
+  onConnected?: OnIntegrationConnected,
+) {
+  const answers = method.forms
+    ? await formAnswers(dialog, method.label ?? `Connect ${integration.name}`, method.forms)
+    : {}
+  if (answers === null) return
+  dialog.replace(() => (
+    <KeyMethod integration={integration} method={method} answers={answers} onConnected={onConnected} />
+  ))
+}
+
 function CommandStarting(props: {
   integration: IntegrationInfo
   method: Extract<ConnectMethod, { type: "command" }>
@@ -336,6 +354,7 @@ function CommandView(props: { title: string; output: string; message: string })
 function KeyMethod(props: {
   integration: IntegrationInfo
   method: Extract<ConnectMethod, { type: "key" }>
+  answers: FormAnswer
   onConnected?: OnIntegrationConnected
 }) {
   const data = useData()
@@ -356,6 +375,7 @@ function KeyMethod(props: {
             integrationID: props.integration.id,
             location: location(data),
             key,
+            answers: props.answers,
           })
           .then(() => connected(props.integration, data, dialog, toast, props.onConnected))
           .catch((cause) => setError(message(cause)))
@@ -373,17 +393,17 @@ async function beginOAuth(
   dialog: ReturnType<typeof useDialog>,
   onConnected?: OnIntegrationConnected,
 ) {
-  const inputs = method.prompts?.length ? await promptInputs(dialog, method.prompts) : {}
-  if (inputs === null) return
+  const answers = method.forms ? await formAnswers(dialog, method.label, method.forms) : {}
+  if (answers === null) return
   dialog.replace(() => (
-    <OAuthStarting integration={integration} method={method} inputs={inputs} onConnected={onConnected} />
+    <OAuthStarting integration={integration} method={method} answers={answers} onConnected={onConnected} />
   ))
 }
 
 function OAuthStarting(props: {
   integration: IntegrationInfo
   method: IntegrationOAuthMethod
-  inputs: Record<string, string>
+  answers: FormAnswer
   onConnected?: OnIntegrationConnected
 }) {
   const data = useData()
@@ -397,7 +417,7 @@ function OAuthStarting(props: {
         integrationID: props.integration.id,
         location: location(data),
         methodID: props.method.id,
-        inputs: props.inputs,
+        answers: props.answers,
       })
       .then((result) => {
         if (result.data.mode === "code") {
@@ -621,49 +641,23 @@ function OAuthView(props: {
   )
 }
 
-async function promptInputs(
-  dialog: ReturnType<typeof useDialog>,
-  prompts: NonNullable<IntegrationOAuthMethod["prompts"]>,
-) {
-  const inputs: Record<string, string> = {}
-  for (const prompt of prompts) {
-    if (prompt.when) {
-      const value = inputs[prompt.when.key]
-      if (value === undefined) continue
-      const matches = prompt.when.op === "eq" ? value === prompt.when.value : value !== prompt.when.value
-      if (!matches) continue
-    }
-    if (prompt.type === "select") {
-      const value = await new Promise<string | null>((resolve) => {
-        dialog.replace(
-          () => (
-            <DialogSelect
-              title={prompt.message}
-              options={prompt.options.map((option) => ({
-                title: option.label,
-                value: option.value,
-                description: option.hint,
-              }))}
-              onSelect={(option) => resolve(option.value)}
-            />
-          ),
-          () => resolve(null),
-        )
-      })
-      if (value === null) return null
-      inputs[prompt.key] = value
-      continue
-    }
-    const value = await new Promise<string | null>((resolve) => {
-      dialog.replace(
-        () => <DialogPrompt title={prompt.message} placeholder={prompt.placeholder} onConfirm={resolve} />,
-        () => resolve(null),
-      )
-    })
-    if (value === null) return null
-    inputs[prompt.key] = value
-  }
-  return inputs
+async function formAnswers(dialog: ReturnType<typeof useDialog>, title: string, forms: FormFields) {
+  return new Promise<FormAnswer | null>((resolve) => {
+    dialog.replace(
+      () => (
+        <FormInput
+          form={{ title, fields: forms }}
+          onSubmit={resolve}
+          onCancel={() => {
+            dialog.clear()
+            resolve(null)
+          }}
+        />
+      ),
+      () => resolve(null),
+    )
+    dialog.setSize("large")
+  })
 }
 
 async function connected(

packages/tui/src/component/dialog-model.tsx

@@ -8,17 +8,21 @@ import * as fuzzysort from "fuzzysort"
 import { useConnected } from "./use-connected"
 import { useData } from "../context/data"
 import { modelPreferenceKey } from "../model-preference"
+import { useLocation } from "../context/location"
 
 export function DialogModel(props: { providerID?: string }) {
   const local = useLocal()
   const data = useData()
   const dialog = useDialog()
+  const location = useLocation()
   const [query, setQuery] = createSignal("")
   const favoritePriority = new Set(local.model.favorite().map(modelPreferenceKey))
 
   const connected = useConnected()
-  const providers = createMemo(() => new Map((data.location.provider.list() ?? []).map((item) => [item.id, item])))
-  const models = createMemo(() => data.location.model.list() ?? [])
+  const providers = createMemo(
+    () => new Map((data.location.provider.list(location.ref) ?? []).map((item) => [item.id, item])),
+  )
+  const models = createMemo(() => data.location.model.list(location.ref) ?? [])
 
   const showExtra = createMemo(() => connected() && !props.providerID)
 

packages/tui/src/component/prompt/index.tsx

@@ -327,10 +327,6 @@ export function Prompt(props: PromptProps) {
     if (!session) return
     const agent = session.agent && local.agent.list().find((agent) => agent.id === session.agent)
     if (agent && !args.agent) local.agent.set(agent.id)
-    if (session.model) {
-      local.model.set({ providerID: session.model.providerID, modelID: session.model.id })
-      local.model.variant.set(session.model.variant)
-    }
     syncedSessionID = sessionID
   })
 
@@ -943,15 +939,43 @@ export function Prompt(props: PromptProps) {
       await slash.command.run(slash.input)
       return true
     }
+    const inputText = expandTrackedPastedText(
+      store.prompt.text,
+      input.extmarks.getAllForTypeId(promptPartTypeId).flatMap((extmark) => {
+        const ref = store.extmarkToPart.get(extmark.id)
+        if (ref?.type !== "pasted") return []
+        const part = store.prompt.pasted[ref.index]
+        if (!part) return []
+        return [{ start: extmark.start, end: extmark.end, text: part.text }]
+      }),
+    )
+    const slashHead = parseSlashHead(inputText, /\s/)
+    const isSkill =
+      slashHead !== undefined &&
+      (data.location.skill.list(currentLocation.ref) ?? []).some(
+        (skill) => skill.slash === true && skill.id === slashHead.name,
+      )
+    const isCommand =
+      slashHead !== undefined &&
+      (data.location.command.list(currentLocation.ref) ?? []).some((command) => command.name === slashHead.name)
     const agent = local.agent.current()
     if (!agent) return false
-    const selectedModel = local.model.current()
-    if (!selectedModel) {
+    const selection = local.model.selection()
+    if (!selection) {
       void promptModelWarning()
       return false
     }
+    const usesModel = !props.sessionID || (store.mode !== "shell" && !isSkill)
+    if (usesModel && !local.model.available(selection)) {
+      toast.show({
+        title: "Model unavailable",
+        message: `${selection.providerID}/${selection.modelID} is not available in this session's location`,
+        variant: "warning",
+      })
+      return false
+    }
 
-    const variant = local.model.variant.current()
+    const variant = selection.variant
     let sessionID = props.sessionID
     let session = sessionID ? data.session.get(sessionID) : undefined
     let finishMoveProgress = false
@@ -969,8 +993,8 @@ export function Prompt(props: PromptProps) {
           location: directory ? { directory } : location,
           agent: agent.id,
           model: {
-            providerID: selectedModel.providerID,
-            id: selectedModel.modelID,
+            providerID: selection.providerID,
+            id: selection.modelID,
             variant,
           },
         })
@@ -990,17 +1014,6 @@ export function Prompt(props: PromptProps) {
       session = created
     }
 
-    const inputText = expandTrackedPastedText(
-      store.prompt.text,
-      input.extmarks.getAllForTypeId(promptPartTypeId).flatMap((extmark) => {
-        const ref = store.extmarkToPart.get(extmark.id)
-        if (ref?.type !== "pasted") return []
-        const part = store.prompt.pasted[ref.index]
-        if (!part) return []
-        return [{ start: extmark.start, end: extmark.end, text: part.text }]
-      }),
-    )
-
     // Capture mode before it gets reset
     const currentMode = store.mode
     const editorSelection = editorContext()
@@ -1013,43 +1026,30 @@ export function Prompt(props: PromptProps) {
         command: inputText,
       })
       setStore("mode", "normal")
-    } else if (
-      inputText.startsWith("/") &&
-      (data.location.command.list(currentLocation.current) ?? []).some(
-        (command) => command.name === inputText.split("\n")[0].split(" ")[0].slice(1),
-      )
-    ) {
+    } else if (slashHead && isCommand) {
       move.startSubmit()
-      // Parse command from first line, preserve multi-line content in arguments
-      const firstLineEnd = inputText.indexOf("\n")
-      const firstLine = firstLineEnd === -1 ? inputText : inputText.slice(0, firstLineEnd)
-      const [command, ...firstLineArgs] = firstLine.split(" ")
-      const restOfInput = firstLineEnd === -1 ? "" : inputText.slice(firstLineEnd + 1)
-      const args = firstLineArgs.join(" ") + (restOfInput ? "\n" + restOfInput : "")
+      const model = { providerID: selection.providerID, id: selection.modelID, variant }
+      const cancelCommit = local.model.trackSessionCommit(sessionID, model)
 
       void client.api.session
         .command({
           sessionID,
-          command: command.slice(1),
-          arguments: args,
+          command: slashHead.name,
+          arguments: slashHead.arguments,
           agent: agent.id,
-          model: { providerID: selectedModel.providerID, id: selectedModel.modelID, variant },
+          model,
           files: store.prompt.files,
           agents: store.prompt.agents,
         })
         .catch((error) => {
+          cancelCommit()
           toast.show({ title: "Failed to run command", message: errorMessage(error), variant: "error" })
         })
-    } else if (
-      inputText.startsWith("/") &&
-      (data.location.skill.list(currentLocation.current) ?? []).some(
-        (skill) => skill.slash === true && skill.id === inputText.split("\n")[0].split(" ")[0].slice(1),
-      )
-    ) {
+    } else if (isSkill) {
       move.startSubmit()
       void client.api.session.skill({
         sessionID,
-        skill: inputText.split("\n")[0].split(" ")[0].slice(1),
+        skill: slashHead!.name,
       })
     } else {
       move.startSubmit()
@@ -1061,13 +1061,15 @@ export function Prompt(props: PromptProps) {
         await client.api.session.switchAgent({ sessionID, agent: agent.id })
       }
       if (
-        session?.model?.providerID !== selectedModel.providerID ||
-        session.model.id !== selectedModel.modelID ||
+        session?.model?.providerID !== selection.providerID ||
+        session.model.id !== selection.modelID ||
         (session.model.variant ?? "default") !== (variant ?? "default")
       ) {
-        await client.api.session.switchModel({
-          sessionID,
-          model: { providerID: selectedModel.providerID, id: selectedModel.modelID, variant },
+        const model = { providerID: selection.providerID, id: selection.modelID, variant }
+        const cancelCommit = local.model.trackSessionCommit(sessionID, model)
+        await client.api.session.switchModel({ sessionID, model }).catch((error) => {
+          cancelCommit()
+          throw error
         })
       }
       if (session?.revert) {
@@ -1320,10 +1322,7 @@ export function Prompt(props: PromptProps) {
       return `Ask anything... "${list()[store.placeholder % list().length]}"`
     })()
     if (!value) return undefined
-    const width =
-      dimensions().width < 44
-        ? dimensions().width - 5
-        : Math.min(75, dimensions().width - 4) - 5
+    const width = dimensions().width < 44 ? dimensions().width - 5 : Math.min(75, dimensions().width - 4) - 5
     return Locale.takeWidth(value, Math.max(1, width)).trimEnd()
   })
   const locationLabel = createMemo(() => {

packages/tui/src/config/index.tsx

@@ -132,8 +132,8 @@ export const Info = Schema.Struct({
       scope: Schema.optional(Schema.Literals(["global", "cwd"])).annotate({
         description: "Share tabs globally or keep a separate set for each working directory",
       }),
-      vertical: Schema.optional(Schema.Boolean).annotate({
-        description: "Show tabs in a left sidebar instead of a horizontal strip",
+      layout: Schema.optional(Schema.Literals(["horizontal", "vertical"])).annotate({
+        description: "Show tabs in a horizontal strip or vertical sidebar",
       }),
     }),
   ).annotate({ description: "Tab strip settings" }),
@@ -194,7 +194,7 @@ export type Resolved = Omit<Info, "attention" | "keybinds" | "leader" | "mouse"
   tabs: {
     enabled: boolean
     scope: "global" | "cwd"
-    vertical?: boolean
+    layout: "horizontal" | "vertical"
   }
 }
 
@@ -230,6 +230,7 @@ export function resolve(input: Info, options: { terminalSuspend: boolean }): Res
       ...input.tabs,
       enabled: input.tabs?.enabled ?? true,
       scope: input.tabs?.scope ?? "cwd",
+      layout: input.tabs?.layout ?? "horizontal",
     },
   }
 }

packages/tui/src/context/data.tsx

@@ -15,6 +15,7 @@ import type {
   ModelInfo,
   PermissionSavedInfo,
   PermissionRequest,
+  PermissionReplyInput,
   Project,
   ProviderInfo,
   ReferenceInfo,
@@ -31,6 +32,7 @@ import type {
   OpenCodeEvent,
   WebSearchProvider,
 } from "@opencode-ai/client"
+import { isPermissionNotFoundError } from "@opencode-ai/client"
 import type { Plugin } from "@opencode-ai/plugin/tui"
 import { createStore, produce, reconcile } from "solid-js/store"
 import { createSimpleContext } from "./helper"
@@ -176,6 +178,17 @@ export const { use: useData, provider: DataProvider } = createSimpleContext({
       )
     }
 
+    function removePermission(sessionID: string, requestID: string) {
+      const requests = store.session.permission[sessionID]
+      if (!requests?.some((request) => request.id === requestID)) return
+      setStore(
+        "session",
+        "permission",
+        sessionID,
+        requests.filter((request) => request.id !== requestID),
+      )
+    }
+
     const message = {
       update(sessionID: string, fn: (messages: SessionMessageInfo[], index: Map<string, number>) => void) {
         setStore(
@@ -840,14 +853,7 @@ export const { use: useData, provider: DataProvider } = createSimpleContext({
           ])
           break
         case "permission.replied":
-          setStore(
-            "session",
-            "permission",
-            event.data.sessionID,
-            (store.session.permission[event.data.sessionID] ?? []).filter(
-              (request) => request.id !== event.data.requestID,
-            ),
-          )
+          removePermission(event.data.sessionID, event.data.requestID)
           break
         case "form.created":
           if (store.session.form[event.data.form.sessionID]?.some((form) => form.id === event.data.form.id)) break
@@ -1036,6 +1042,12 @@ export const { use: useData, provider: DataProvider } = createSimpleContext({
           invalidate(sessionID: string) {
             sync.invalidate(`session.permission:${sessionID}`)
           },
+          async reply(input: PermissionReplyInput) {
+            await client.api.permission.reply(input).catch((error: unknown) => {
+              if (!isPermissionNotFoundError(error)) throw error
+            })
+            removePermission(input.sessionID, input.requestID)
+          },
         },
         form: {
           list(sessionID: string, ref?: LocationRef) {

packages/tui/src/context/local.tsx

@@ -1,7 +1,7 @@
 import { createStore } from "solid-js/store"
 import { dedupeWith } from "effect/Array"
 import { createSimpleContext } from "./helper"
-import { batch, createMemo } from "solid-js"
+import { batch, createMemo, onCleanup } from "solid-js"
 import { useEvent } from "./event"
 import path from "path"
 import { useTuiPaths } from "./runtime"
@@ -22,6 +22,7 @@ import { useToast } from "../ui/toast"
 import { useRoute } from "./route"
 import { useData } from "./data"
 import { usePermission } from "./permission"
+import { useLocation } from "./location"
 
 export function parseModel(model: string) {
   const [providerID, ...rest] = model.split("/")
@@ -57,26 +58,29 @@ export const { use: useLocal, provider: LocalProvider } = createSimpleContext({
     const args = useArgs()
     const event = useEvent()
     const permission = usePermission()
+    const location = useLocation()
+
+    const models = () => data.location.model.list(location.ref)
+    const providers = () => data.location.provider.list(location.ref)
 
     function isModelValid(model: ModelPreferenceModel) {
-      return !!data.location.model
-        .list()
-        ?.some((item) => item.providerID === model.providerID && item.id === model.modelID)
+      return !!models()?.some((item) => item.providerID === model.providerID && item.id === model.modelID)
     }
 
     function getFirstValidModel(...modelFns: (() => ModelPreferenceModel | undefined)[]) {
       for (const modelFn of modelFns) {
         const model = modelFn()
-        if (!model) continue
-        if (isModelValid(model)) return model
+        if (model && isModelValid(model)) return model
       }
     }
 
     function createAgent() {
       const agents = createMemo(() =>
-        (data.location.agent.list() ?? []).filter((agent) => agent.mode !== "subagent" && !agent.hidden),
+        (data.location.agent.list(location.ref) ?? []).filter((agent) => agent.mode !== "subagent" && !agent.hidden),
+      )
+      const visibleAgents = createMemo(() =>
+        (data.location.agent.list(location.ref) ?? []).filter((agent) => !agent.hidden),
       )
-      const visibleAgents = createMemo(() => (data.location.agent.list() ?? []).filter((agent) => !agent.hidden))
       const [agentStore, setAgentStore] = createStore({
         current: undefined as string | undefined,
       })
@@ -128,35 +132,40 @@ export const { use: useLocal, provider: LocalProvider } = createSimpleContext({
     const agent = createAgent()
 
     function createModel() {
-      const [modelStore, setModelStore] = createStore<
-        ModelPreference & {
-          ready: boolean
-          model: Record<string, ModelPreferenceModel>
-        }
-      >({
+      type ModelSelection = ModelPreferenceModel & { variant?: string }
+      const [preferences, setPreferences] = createStore<ModelPreference & { ready: boolean }>({
         ready: false,
-        model: {},
         recent: [],
         favorite: [],
         variant: {},
       })
+      const [selectionState, setSelectionState] = createStore<{
+        newSessionModelByLocationAgent: Record<string, ModelPreferenceModel | undefined>
+        draftBySession: Record<string, ModelSelection | undefined>
+      }>({
+        newSessionModelByLocationAgent: {},
+        draftBySession: {},
+      })
 
       const repository = createModelPreferenceRepository(path.join(paths.state, "model.json"))
-      const state = {
+      const pendingSelectionCommits = new Map<string, string>()
+      const selectionKey = (value: ModelSelection) =>
+        `${modelPreferenceKey(value)}:${normalizeModelVariant(value.variant) ?? "default"}`
+      const saveState = {
         pending: false,
       }
 
-      function save() {
-        if (!modelStore.ready) {
-          state.pending = true
+      function savePreferences() {
+        if (!preferences.ready) {
+          saveState.pending = true
           return
         }
-        state.pending = false
+        saveState.pending = false
         void repository
           .patch({
-            recent: modelStore.recent,
-            favorite: modelStore.favorite,
-            variant: modelStore.variant,
+            recent: preferences.recent,
+            favorite: preferences.favorite,
+            variant: preferences.variant,
           })
           .catch(() => undefined)
       }
@@ -164,14 +173,14 @@ export const { use: useLocal, provider: LocalProvider } = createSimpleContext({
       repository
         .load()
         .then((value) => {
-          setModelStore("recent", value.recent)
-          setModelStore("favorite", value.favorite)
-          setModelStore("variant", value.variant)
+          setPreferences("recent", value.recent)
+          setPreferences("favorite", value.favorite)
+          setPreferences("variant", value.variant)
         })
         .catch(() => {})
         .finally(() => {
-          setModelStore("ready", true)
-          if (state.pending) save()
+          setPreferences("ready", true)
+          if (saveState.pending) savePreferences()
         })
 
       const fallbackModel = createMemo(() => {
@@ -185,13 +194,13 @@ export const { use: useLocal, provider: LocalProvider } = createSimpleContext({
           }
         }
 
-        for (const item of modelStore.recent) {
+        for (const item of preferences.recent) {
           if (isModelValid(item)) {
             return item
           }
         }
 
-        const model = data.location.model.list()?.[0]
+        const model = models()?.[0]
         if (!model) return undefined
         return {
           providerID: model.providerID,
@@ -199,30 +208,134 @@ export const { use: useLocal, provider: LocalProvider } = createSimpleContext({
         }
       })
 
-      const currentModel = createMemo(() => {
+      const newSessionModel = createMemo(() => {
         const a = agent.current()
-        return (
-          getFirstValidModel(
-            () => a && modelStore.model[a.id],
-            () => a?.model && { providerID: a.model.providerID, modelID: a.model.id },
-            fallbackModel,
-          ) ?? undefined
+        return getFirstValidModel(
+          () => a && selectionState.newSessionModelByLocationAgent[locationAgentKey(a.id)],
+          () => a?.model && { providerID: a.model.providerID, modelID: a.model.id },
+          fallbackModel,
         )
       })
 
+      const currentSelection = createMemo<ModelSelection | undefined>(() => {
+        if (route.data.type === "session") return sessionSelection(route.data.sessionID)
+        const model = newSessionModel()
+        if (!model) return
+        return { ...model, variant: normalizeModelVariant(preferences.variant[modelPreferenceKey(model)]) }
+      })
+
+      const currentModel = createMemo(() => {
+        const selection = currentSelection()
+        if (!selection) return
+        return { providerID: selection.providerID, modelID: selection.modelID }
+      })
+
+      function locationAgentKey(agentID: string) {
+        const ref = location.ref ?? data.location.default()
+        return `${JSON.stringify([ref.directory, ref.workspaceID])}:${agentID}`
+      }
+
+      function durableSelection(sessionID: string): ModelSelection | undefined {
+        const model = data.session.get(sessionID)?.model
+        if (!model) return
+        return {
+          providerID: model.providerID,
+          modelID: model.id,
+          variant: normalizeModelVariant(model.variant),
+        }
+      }
+
+      function sessionSelection(sessionID: string) {
+        return selectionState.draftBySession[sessionID] ?? durableSelection(sessionID)
+      }
+
+      function setSessionDraft(sessionID: string, selection: ModelSelection) {
+        const durable = durableSelection(sessionID)
+        setSelectionState(
+          "draftBySession",
+          sessionID,
+          durable && selectionKey(durable) === selectionKey(selection) ? undefined : selection,
+        )
+      }
+
+      function selectModel(model: ModelPreferenceModel) {
+        if (route.data.type === "session") {
+          const sessionID = route.data.sessionID
+          const current = sessionSelection(sessionID)
+          const preferred = normalizeModelVariant(
+            current?.providerID === model.providerID && current.modelID === model.modelID
+              ? current.variant
+              : preferences.variant[modelPreferenceKey(model)],
+          )
+          const info = models()?.find((item) => item.providerID === model.providerID && item.id === model.modelID)
+          const variant = preferred && info?.variants?.some((item) => item.id === preferred) ? preferred : undefined
+          setSessionDraft(sessionID, { ...model, variant })
+          return true
+        }
+        const current = agent.current()
+        if (!current) return false
+        setSelectionState("newSessionModelByLocationAgent", locationAgentKey(current.id), model)
+        return true
+      }
+
+      onCleanup(
+        event.on("session.model.selected", (evt) => {
+          const expected = pendingSelectionCommits.get(evt.data.sessionID)
+          if (!expected) return
+          const committed = selectionKey({
+            providerID: evt.data.model.providerID,
+            modelID: evt.data.model.id,
+            variant: evt.data.model.variant,
+          })
+          if (committed !== expected) return
+          pendingSelectionCommits.delete(evt.data.sessionID)
+          const draft = selectionState.draftBySession[evt.data.sessionID]
+          if (draft && selectionKey(draft) === committed)
+            setSelectionState("draftBySession", evt.data.sessionID, undefined)
+        }),
+      )
+
+      onCleanup(
+        event.on("session.deleted", (evt) => {
+          pendingSelectionCommits.delete(evt.data.sessionID)
+          setSelectionState("draftBySession", evt.data.sessionID, undefined)
+        }),
+      )
+
       return {
         current: currentModel,
+        selection: currentSelection,
+        available(model = currentModel()) {
+          return model ? isModelValid(model) : false
+        },
+        trackSessionCommit(
+          sessionID: string,
+          value: {
+            providerID: string
+            id: string
+            variant?: string
+          },
+        ) {
+          const committed = selectionKey({ providerID: value.providerID, modelID: value.id, variant: value.variant })
+          pendingSelectionCommits.set(sessionID, committed)
+          return () => {
+            if (pendingSelectionCommits.get(sessionID) === committed) pendingSelectionCommits.delete(sessionID)
+          }
+        },
         get ready() {
-          return modelStore.ready
+          return preferences.ready
+        },
+        get catalogReady() {
+          return models() !== undefined
         },
         recent() {
-          return modelStore.recent
+          return preferences.recent
         },
         favorite() {
-          return modelStore.favorite
+          return preferences.favorite
         },
         parsed: createMemo(() => {
-          const value = currentModel()
+          const value = currentSelection()
           if (!value) {
             return {
               provider: "Connect a provider",
@@ -230,33 +343,28 @@ export const { use: useLocal, provider: LocalProvider } = createSimpleContext({
               reasoning: false,
             }
           }
-          const provider = data.location.provider.list()?.find((item) => item.id === value.providerID)
-          const info = data.location.model
-            .list()
-            ?.find((item) => item.providerID === value.providerID && item.id === value.modelID)
+          const provider = providers()?.find((item) => item.id === value.providerID)
+          const info = models()?.find((item) => item.providerID === value.providerID && item.id === value.modelID)
           return {
             provider: provider?.name ?? value.providerID,
-            model: info?.name ?? value.modelID,
+            model: info?.name ?? `${value.modelID} (unavailable)`,
             reasoning: (info?.variants?.length ?? 0) !== 0,
           }
         }),
         cycle(direction: 1 | -1) {
-          const current = currentModel()
+          const current = currentSelection()
           if (!current) return
-          const recent = modelStore.recent
+          const recent = recentModels(current, preferences.recent).filter(isModelValid)
           const index = recent.findIndex((x) => x.providerID === current.providerID && x.modelID === current.modelID)
-          if (index === -1) return
-          let next = index + direction
+          let next = index === -1 ? (direction === 1 ? 0 : recent.length - 1) : index + direction
           if (next < 0) next = recent.length - 1
           if (next >= recent.length) next = 0
           const val = recent[next]
           if (!val) return
-          const a = agent.current()
-          if (!a) return
-          setModelStore("model", a.id, { ...val })
+          selectModel({ ...val })
         },
         cycleFavorite(direction: 1 | -1) {
-          const favorites = modelStore.favorite.filter((item) => isModelValid(item))
+          const favorites = preferences.favorite.filter((item) => isModelValid(item))
           if (!favorites.length) {
             toast.show({
               variant: "info",
@@ -265,7 +373,7 @@ export const { use: useLocal, provider: LocalProvider } = createSimpleContext({
             })
             return
           }
-          const current = currentModel()
+          const current = currentSelection()
           let index = -1
           if (current) {
             index = favorites.findIndex((x) => x.providerID === current.providerID && x.modelID === current.modelID)
@@ -279,45 +387,39 @@ export const { use: useLocal, provider: LocalProvider } = createSimpleContext({
           }
           const next = favorites[index]
           if (!next) return
-          const a = agent.current()
-          if (!a) return
-          setModelStore("model", a.id, { ...next })
-          setModelStore("recent", recentModels(next, modelStore.recent))
-          save()
+          if (!selectModel({ ...next })) return
+          setPreferences("recent", recentModels(next, preferences.recent))
+          savePreferences()
         },
         set(model: { providerID: string; modelID: string }, options?: { recent?: boolean }) {
           batch(() => {
             if (!isModelValid(model)) return
-            const a = agent.current()
-            if (!a) return
-            setModelStore("model", a.id, model)
+            if (!selectModel(model)) return
             if (options?.recent) {
-              setModelStore("recent", recentModels(model, modelStore.recent))
-              save()
+              setPreferences("recent", recentModels(model, preferences.recent))
+              savePreferences()
             }
           })
         },
         toggleFavorite(model: { providerID: string; modelID: string }) {
           batch(() => {
             if (!isModelValid(model)) return
-            const exists = modelStore.favorite.some(
+            const exists = preferences.favorite.some(
               (x) => x.providerID === model.providerID && x.modelID === model.modelID,
             )
             const next = exists
-              ? modelStore.favorite.filter((x) => x.providerID !== model.providerID || x.modelID !== model.modelID)
-              : [model, ...modelStore.favorite]
-            setModelStore(
+              ? preferences.favorite.filter((x) => x.providerID !== model.providerID || x.modelID !== model.modelID)
+              : [model, ...preferences.favorite]
+            setPreferences(
               "favorite",
               next.map((x) => ({ providerID: x.providerID, modelID: x.modelID })),
             )
-            save()
+            savePreferences()
           })
         },
         variant: {
           selected() {
-            const m = currentModel()
-            if (!m) return undefined
-            return normalizeModelVariant(modelStore.variant[modelPreferenceKey(m)])
+            return currentSelection()?.variant
           },
           current() {
             const v = this.selected()
@@ -325,18 +427,20 @@ export const { use: useLocal, provider: LocalProvider } = createSimpleContext({
             return undefined
           },
           list() {
-            const m = currentModel()
+            const m = currentSelection()
             if (!m) return []
-            const info = data.location.model
-              .list()
-              ?.find((item) => item.providerID === m.providerID && item.id === m.modelID)
+            const info = models()?.find((item) => item.providerID === m.providerID && item.id === m.modelID)
             return info?.variants?.map((variant) => variant.id) ?? []
           },
           set(value: string | undefined) {
-            const m = currentModel()
+            const m = currentSelection()
             if (!m) return
-            setModelStore("variant", modelPreferenceKey(m), normalizeModelVariant(value))
-            save()
+            if (route.data.type === "session") {
+              setSessionDraft(route.data.sessionID, { ...m, variant: normalizeModelVariant(value) })
+              return
+            }
+            setPreferences("variant", modelPreferenceKey(m), normalizeModelVariant(value))
+            savePreferences()
           },
           cycle() {
             const variants = this.list()

packages/tui/src/routes/session/form.tsx

@@ -4,7 +4,7 @@ import { useRenderer, useTerminalDimensions } from "@opentui/solid"
 import type { ScrollBoxRenderable, TextareaRenderable } from "@opentui/core"
 import open from "open"
 import { useTheme, useThemes } from "../../context/theme"
-import type { FormField, FormValue } from "@opencode-ai/client"
+import type { FormAnswer, FormField, FormValue } from "@opencode-ai/client"
 import type { FormWithLocation } from "../../context/data"
 import { useClient } from "../../context/client"
 import { useClipboard } from "../../context/clipboard"
@@ -44,6 +44,27 @@ function requestOptions(form: FormWithLocation) {
 
 export function FormPrompt(props: { form: FormWithLocation }) {
   const client = useClient()
+  return (
+    <FormInput
+      form={props.form}
+      onSubmit={(answer) =>
+        client.api.form.reply(
+          { sessionID: props.form.sessionID, formID: props.form.id, answer },
+          requestOptions(props.form),
+        )
+      }
+      onCancel={() =>
+        client.api.form.cancel({ sessionID: props.form.sessionID, formID: props.form.id }, requestOptions(props.form))
+      }
+    />
+  )
+}
+
+export function FormInput(props: {
+  form: Pick<FormWithLocation, "title" | "fields" | "metadata">
+  onSubmit: (answer: FormAnswer) => Promise<unknown> | void
+  onCancel: () => Promise<unknown> | void
+}) {
   const themes = useThemes()
   const theme = useTheme("elevated")
   const themeMode = themes.mode
@@ -181,23 +202,14 @@ export function FormPrompt(props: { form: FormWithLocation }) {
   }
 
   function replySingle(field: FormAnswerField, value: FormValue) {
-    client.api.form
-      .reply(
-        {
-          sessionID: props.form.sessionID,
-          formID: props.form.id,
-          answer: { [field.key]: value },
-        },
-        requestOptions(props.form),
+    Promise.resolve(props.onSubmit({ [field.key]: value })).catch((error: unknown) => {
+      setStore(
+        "error",
+        typeof error === "object" && error !== null && "message" in error && typeof error.message === "string"
+          ? error.message
+          : "Invalid answer",
       )
-      .catch((error: unknown) => {
-        setStore(
-          "error",
-          typeof error === "object" && error !== null && "message" in error && typeof error.message === "string"
-            ? error.message
-            : "Invalid answer",
-        )
-      })
+    })
   }
 
   function pick(value: FormValue, customValue?: string) {
@@ -350,7 +362,7 @@ export function FormPrompt(props: { form: FormWithLocation }) {
   }
 
   function cancel() {
-    void client.api.form.cancel({ sessionID: props.form.sessionID, formID: props.form.id }, requestOptions(props.form))
+    void props.onCancel()
   }
 
   function openExternal() {
@@ -402,28 +414,23 @@ export function FormPrompt(props: { form: FormWithLocation }) {
       setStore("error", formValidateValue(invalid, store.answers[invalid.key]) ?? "Invalid answer")
       return
     }
-    client.api.form
-      .reply(
-        {
-          sessionID: props.form.sessionID,
-          formID: props.form.id,
-          answer: Object.fromEntries(
-            fields().flatMap((field) => {
-              const value = store.answers[field.key]
-              return value === undefined ? [] : [[field.key, value] as const]
-            }),
-          ),
-        },
-        requestOptions(props.form),
+    Promise.resolve(
+      props.onSubmit(
+        Object.fromEntries(
+          fields().flatMap((field) => {
+            const value = store.answers[field.key]
+            return value === undefined ? [] : [[field.key, value] as const]
+          }),
+        ),
+      ),
+    ).catch((error: unknown) => {
+      setStore(
+        "error",
+        typeof error === "object" && error !== null && "message" in error && typeof error.message === "string"
+          ? error.message
+          : "Invalid answer",
       )
-      .catch((error: unknown) => {
-        setStore(
-          "error",
-          typeof error === "object" && error !== null && "message" in error && typeof error.message === "string"
-            ? error.message
-            : "Invalid answer",
-        )
-      })
+    })
   }
 
   onMount(() => onCleanup(keymap.mode.push(FORM_MODE)))
@@ -451,10 +458,7 @@ export function FormPrompt(props: { form: FormWithLocation }) {
         group: "Form",
         run: () => {
           if (textual()) {
-            void client.api.form.cancel(
-              { sessionID: props.form.sessionID, formID: props.form.id },
-              requestOptions(props.form),
-            )
+            void props.onCancel()
             return
           }
           setStore("editing", false)

packages/tui/src/routes/session/index.tsx

@@ -204,7 +204,7 @@ export function Session() {
   const availableWidth = createMemo(
     () =>
       dimensions().width -
-      (config.tabs?.enabled && config.tabs.vertical && sessionTabsFitVertically(dimensions().width)
+      (config.tabs?.enabled && config.tabs.layout === "vertical" && sessionTabsFitVertically(dimensions().width)
         ? SESSION_SIDEBAR_WIDTH
         : 0),
   )
@@ -227,7 +227,7 @@ export function Session() {
     permissions().forEach((request) => {
       if (autoApproved.has(request.id)) return
       autoApproved.add(request.id)
-      void client.api.permission
+      void data.session.permission
         .reply({
           sessionID: request.sessionID,
           reply: "once",
@@ -361,7 +361,7 @@ export function Session() {
 
   createEffect(() => {
     const current = prompt()
-    if (sent || !current || !synced() || !local.model.ready) return
+    if (sent || !current || !synced() || !local.model.ready || !local.model.catalogReady) return
     if (!local.agent.current() || !local.model.current()) return
     if (!args.prompt || route.prompt?.text !== args.prompt || current.current.text !== args.prompt) return
     sent = true

packages/tui/src/routes/session/permission.tsx

@@ -3,8 +3,7 @@ import { createMemo, For, Match, Show, Switch } from "solid-js"
 import { Portal, useRenderer, useTerminalDimensions, type JSX } from "@opentui/solid"
 import type { TextareaRenderable } from "@opentui/core"
 import { useTheme, useThemes } from "../../context/theme"
-import type { PermissionRequest } from "@opencode-ai/client"
-import { useClient } from "../../context/client"
+import type { PermissionReply, PermissionRequest } from "@opencode-ai/client"
 import { SplitBorder } from "../../ui/border"
 import { useData } from "../../context/data"
 import { filetype } from "../../util/filetype"
@@ -15,6 +14,7 @@ import { Keymap } from "../../context/keymap"
 import { usePathFormatter } from "../../context/path-format"
 import { SimulationSemantics } from "../../simulation/semantics"
 import { PatchDiff } from "../../component/patch-diff"
+import { useToast } from "../../ui/toast"
 
 type PermissionStage = "permission" | "always" | "reject"
 
@@ -110,8 +110,8 @@ function EditBody(props: { file?: string; diff?: string; patch?: string }) {
 }
 
 export function PermissionPrompt(props: { request: PermissionRequest; directory?: string }) {
-  const client = useClient()
   const data = useData()
+  const toast = useToast()
   const [store, setStore] = createStore({
     stage: "permission" as PermissionStage,
   })
@@ -132,6 +132,12 @@ export function PermissionPrompt(props: { request: PermissionRequest; directory?
 
   const theme = useTheme()
 
+  function reply(value: PermissionReply, message?: string) {
+    void data.session.permission
+      .reply({ sessionID: props.request.sessionID, requestID: props.request.id, reply: value, message })
+      .catch((error: unknown) => toast.error(error))
+  }
+
   return (
     <Switch>
       <Match when={store.stage === "always"}>
@@ -151,11 +157,7 @@ export function PermissionPrompt(props: { request: PermissionRequest; directory?
           onSelect={(option) => {
             setStore("stage", "permission")
             if (option === "cancel") return
-            void client.api.permission.reply({
-              sessionID: props.request.sessionID,
-              reply: "always",
-              requestID: props.request.id,
-            })
+            reply("always")
           }}
         />
       </Match>
@@ -164,12 +166,7 @@ export function PermissionPrompt(props: { request: PermissionRequest; directory?
           action={props.request.action}
           instance={props.request.id}
           onConfirm={(message) => {
-            void client.api.permission.reply({
-              sessionID: props.request.sessionID,
-              reply: "reject",
-              requestID: props.request.id,
-              message: message || undefined,
-            })
+            reply("reject", message || undefined)
           }}
           onCancel={() => {
             setStore("stage", "permission")
@@ -265,18 +262,10 @@ export function PermissionPrompt(props: { request: PermissionRequest; directory?
                     setStore("stage", "reject")
                     return
                   }
-                  void client.api.permission.reply({
-                    sessionID: props.request.sessionID,
-                    reply: "reject",
-                    requestID: props.request.id,
-                  })
+                  reply("reject")
                   return
                 }
-                void client.api.permission.reply({
-                  sessionID: props.request.sessionID,
-                  reply: "once",
-                  requestID: props.request.id,
-                })
+                reply("once")
               }}
             />
           )

packages/tui/test/cli/tui/data.test.tsx

@@ -2067,6 +2067,64 @@ test("reconciles active session permissions when the event stream reconnects", a
   }
 })
 
+test("dismisses a permission that expired before its reply", async () => {
+  const events = createEventStream()
+  const request = { id: "per_stale", sessionID: "ses_active", action: "read", resources: ["old.txt"] }
+  let replies = 0
+  const calls = createFetch((url, init) => {
+    if (url.pathname === "/api/session/ses_active/permission/per_stale/reply" && init.method === "POST") {
+      replies++
+      return json(
+        {
+          _tag: "PermissionNotFoundError",
+          requestID: request.id,
+          message: `Permission request not found: ${request.id}`,
+        },
+        { status: 404 },
+      )
+    }
+  }, events)
+  let data!: ReturnType<typeof useData>
+
+  function Probe() {
+    data = useData()
+    return <box />
+  }
+
+  const app = await testRender(() => (
+    <TestTuiContexts>
+      <ClientProvider api={createApi(calls.fetch)}>
+        <ProjectProvider>
+          <DataProvider>
+            <Probe />
+          </DataProvider>
+        </ProjectProvider>
+      </ClientProvider>
+    </TestTuiContexts>
+  ))
+
+  try {
+    emitEvent(events, {
+      id: "evt_permission_asked_stale",
+      created: 0,
+      type: "permission.asked",
+      data: request,
+    })
+    await wait(() => data.session.permission.list(request.sessionID)?.length === 1)
+
+    await data.session.permission.reply({
+      sessionID: request.sessionID,
+      requestID: request.id,
+      reply: "once",
+    })
+
+    expect(replies).toBe(1)
+    expect(data.session.permission.list(request.sessionID)).toEqual([])
+  } finally {
+    app.renderer.destroy()
+  }
+})
+
 test("adds, dismisses, and refreshes form requests", async () => {
   const events = createEventStream()
   const calls = createFetch((url) => {

packages/tui/test/config-v2.test.tsx

@@ -18,7 +18,10 @@ test("validates mini replay settings", () => {
 test("validates the session tabs setting", () => {
   const decode = Schema.decodeUnknownSync(Info)
 
-  expect(decode({ tabs: { enabled: true, vertical: true } })).toEqual({ tabs: { enabled: true, vertical: true } })
+  expect(decode({ tabs: { enabled: true, layout: "vertical" } })).toEqual({
+    tabs: { enabled: true, layout: "vertical" },
+  })
+  expect(() => decode({ tabs: { layout: true } })).toThrow()
   expect(() => decode({ tabs: { enabled: "on" } })).toThrow()
 })
 
@@ -39,12 +42,13 @@ test("resolves nested config and keybind defaults", () => {
   expect(config.scroll).toEqual({ speed: 2, acceleration: true })
   expect(config.diffs).toEqual({ view: "split" })
   expect(config.debug).toEqual({ devtools: true })
-  expect(config.tabs).toEqual({ enabled: true, scope: "cwd" })
+  expect(config.tabs).toEqual({ enabled: true, scope: "cwd", layout: "horizontal" })
 })
 
 test("shows resolved tab defaults in settings", () => {
   expect(settings.find((setting) => setting.path.join(".") === "tabs.enabled")?.default).toBe(true)
   expect(settings.find((setting) => setting.path.join(".") === "tabs.scope")?.default).toBe("cwd")
+  expect(settings.find((setting) => setting.path.join(".") === "tabs.layout")?.default).toBe("horizontal")
 })
 
 test("provides config and its host interface", async () => {

packages/www/content/docs/(Configure)/agents.mdx

@@ -46,9 +46,9 @@ An agent's `mode` controls where it can run:
 
 | Mode | Behavior |
 | --- | --- |
-| `primary` | Can be selected as the main agent for a session. It cannot be launched as a subagent. |
+| `primary` | Can be selected as the main agent for a session. It cannot be launched as a subagent. This is the default for a custom agent when `mode` is omitted. |
 | `subagent` | Can run in a child session through the `subagent` tool, but cannot be selected as the main agent. |
-| `all` | Can be used either way. This is the default for a custom agent when `mode` is omitted. |
+| `all` | Can be used either way. |
 
 In the TUI, press <kbd>Tab</kbd> and <kbd>Shift</kbd>+<kbd>Tab</kbd> to cycle
 through visible primary and `all` agents, or use `/agents` to choose one.

packages/www/content/docs/migrate-v1.mdx

@@ -419,6 +419,8 @@ The V1 provider filters do not have one-to-one native V2 config fields, but thei
 
 - `enabled_providers` becomes an internal deny-by-default provider policy followed by allows for the listed providers.
 - `disabled_providers` becomes internal deny policies for the listed providers.
+- `small_model` becomes the `model` selection for the built-in `title` agent. Native V2 configuration should use
+  `agents.title.model` instead.
 
 You may keep these fields in V1 syntax. OpenCode normalizes them without warning.
 
@@ -430,7 +432,6 @@ they are not mistaken for active configuration:
 - `logLevel`: use `OPENCODE_LOG_LEVEL` when starting OpenCode.
 - `server`: use the V2 service and explicit server options; the server API is an intentional breaking change.
 - `layout`: remove it; V1 already treated it as deprecated and always used stretch layout.
-- `small_model`: V2 selects models for internal maintenance agents without a separate top-level field.
 - Top-level `subagent_depth`: use `experimental.subagent_depth` instead.
 - `compaction.tail_turns` and `compaction.prune`: V2 uses `compaction.keep.tokens` and checkpoint-based compaction instead.
 - Agent `name` inside V1 JSON configuration.