fix: skip system prompt for claude

[shuv1337]

Summary

• prevent system prompt injection for Claude models via Anthropic provider
• keep existing prompt routing for other providers

Greptile Summary

This PR prevents system prompt duplication for Claude models accessed via the Anthropic provider. Previously, Claude models would receive the system prompt both through the standard system message mechanism and via the options.instructions field, causing prompt injection issues.

Key Changes:

• Modified SystemPrompt.provider() to return an empty array for Claude models via Anthropic provider (checking both providerID.includes("anthropic") and api.id.includes("claude"))
• Updated llm.ts to move provider/auth lookups earlier in the flow and conditionally skip SystemPrompt.provider() for Codex sessions
• The system prompt for Claude via Anthropic is now only sent via options.instructions (for Codex) or not at all (letting the native provider handle it)

Additional Improvements:

• Fixed missing return statement in prompt.ts when transitioning from plan to build mode
• Added AWS Web Identity Token support for Bedrock provider
• Improved bearer token precedence handling for AWS Bedrock
• Removed unused anthropicModel parameter from GitLab provider
• Added provider existence validation in Provider.list()

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The changes are well-targeted and address a specific system prompt injection issue. The logic is straightforward - adding early returns and conditional checks to prevent duplicate prompts. The PR includes test coverage for new AWS Web Identity Token functionality. All changes follow existing patterns in the codebase.
• No files require special attention

Important Files Changed

Filename	Overview
packages/opencode/src/session/llm.ts	Refactored system prompt handling for Claude models via Anthropic provider - moves provider/auth lookup earlier and conditionally skips SystemPrompt.provider() for Codex sessions
packages/opencode/src/session/system.ts	Changed SystemPrompt.provider() to return empty array for Claude models via Anthropic provider, preventing duplicate system prompt injection
packages/opencode/src/provider/provider.ts	Added AWS_WEB_IDENTITY_TOKEN_FILE support for Bedrock, improved bearer token handling, removed unused anthropicModel parameter from GitLab, added provider existence check
packages/opencode/src/session/prompt.ts	Fixed missing return statement when switching from plan to build mode, refactored plan path template to use string concatenation

Sequence Diagram

sequenceDiagram
    participant Client
    participant LLM
    participant SystemPrompt
    participant Provider
    participant API

    Client->>LLM: stream(input)
    Note over LLM: Fetch provider and auth info early
    
    LLM->>Provider: getProvider and getLanguage
    Provider-->>LLM: provider and language info
    
    Note over LLM: Determine if Codex session
    
    LLM->>SystemPrompt: header(providerID)
    SystemPrompt-->>LLM: header array
    
    alt Has agent prompt
        Note over LLM: Use agent prompt
    else isCodex
        Note over LLM: Skip SystemPrompt.provider()
    else Regular session
        LLM->>SystemPrompt: provider(model)
        alt Anthropic with Claude
            SystemPrompt-->>LLM: empty array (prevents duplicate)
        else Other providers
            SystemPrompt-->>LLM: provider prompt
        end
    end
    
    alt isCodex
        Note over LLM: Set options.instructions<br/>Wrap system as user message
    else Anthropic (non-Codex)
        Note over LLM: Send as system role
    end
    
    LLM->>API: Send request with appropriate format
    API-->>LLM: Stream response
    LLM-->>Client: StreamTextResult

Loading

[shuv1337]

nevermind, dario just hates opencode. remove opencode references from system prompts and it works