Summary

• The provider flattened opencode's system prompt into the user-message transcript, which injection-hardened Cursor models rejected as a prompt-injection attempt (the agent accusing the user of gaslighting / prompt injection). opencode's system prompt is now delivered through Cursor's authoritative rules channel — written to a git-ignored .cursor/rules/opencode.mdc (alwaysApply: true) and loaded via the project settings layer — so opencode keeps control without being flagged.
• New systemPrompt provider option: "rules" (default), "message" (legacy inline, back-comat), "omit". Rules load from disk at Agent.create, so no sidecar/RPC changes.
• dispose removes the generated rule (best-effort). Session reuse is unaffected (fingerprint reads the prompt, not the forwarded message).

Test Plan

• npm run typecheck — clean
• npm test — 229 passed
• npm run build — ESM + DTS success
• rg -n "# System" src — only the guarded "message"-mode branch remains
• Live: with a Cursor key, chat a cursor/* model on a project with an AGENTS.md and confirm the injection-rejection behavior no longer fires

Notes

• Verified the Cursor SDK has no system-prompt input through @cursor/sdk@1.0.22 (latest). Cursor's documented channel for system-level instructions is .cursor/rules loaded via settingSources.
• Tradeoffs documented in the README: a project rule also applies to your own Cursor IDE in this repo (best-effort cleanup on dispose), and enabling the project layer also loads other .cursor/ config.
• Design plan: docs/superpowers/plans/2026-07-02-system-prompt-via-cursor-rules.md.