fix: propagate gateway token; kilo targets opencode.jsonc; goose URL + api_key fix

internal/adapter/common/blocks.go

@@ -180,9 +180,9 @@ func ProvidersAsCagentMap(p *canonical.Profile) map[string]any {
 		return out
 	}
 	out[gatewayProviderID] = map[string]any{
-		"base_url":  p.Gateway.URL,
-		"token_key": "HARNESS_SYNC_GATEWAY_TOKEN",
-		"provider":  "openai",
+		"base_url": p.Gateway.URL,
+		"api_key":  p.Gateway.Token,
+		"provider": "openai",
 	}
 	return out
 }
@@ -261,16 +261,16 @@ func GooseCustomProviderFile(p *canonical.Profile) ([]byte, string) {
 		}
 	}
 
-	chatURL := strings.TrimRight(p.Gateway.URL, "/") + "/v1/chat/completions"
+	// Append only /chat/completions — the profile URL already contains /v1.
+	chatURL := strings.TrimRight(p.Gateway.URL, "/") + "/chat/completions"
 
 	entry := map[string]any{
-		"name":          providerName,
-		"engine":        "openai",
-		"display_name":  displayName,
-		"base_url":      chatURL,
-		"models":        models,
-		"requires_auth": true,
-		"api_key_env":   "CUSTOM_HARNESS_SYNC_GATEWAY_API_KEY",
+		"name":         providerName,
+		"engine":       "openai",
+		"display_name": displayName,
+		"base_url":     chatURL,
+		"models":       models,
+		"api_key":      p.Gateway.Token,
 	}
 	body, err := json.MarshalIndent(entry, "", "  ")
 	if err != nil {

internal/adapters/cagent/cagent_test.go

@@ -55,8 +55,8 @@ func TestCagentRenderProducesExpectedTargets(t *testing.T) {
 	providers := parsed["providers"].(map[string]any)
 	gwProv := providers["harness-sync-gateway"].(map[string]any)
 	assert.Equal(t, "https://gw", gwProv["base_url"])
-	assert.Equal(t, "HARNESS_SYNC_GATEWAY_TOKEN", gwProv["token_key"])
 	assert.Equal(t, "openai", gwProv["provider"])
+	assert.NotContains(t, gwProv, "token_key")
 
 	// models map.
 	models := parsed["models"].(map[string]any)
@@ -96,8 +96,9 @@ func TestCagentRenderProvidersAndModelsMaps(t *testing.T) {
 	gw, ok := providers["harness-sync-gateway"].(map[string]any)
 	require.True(t, ok)
 	assert.Equal(t, "https://gw", gw["base_url"])
-	assert.Equal(t, "HARNESS_SYNC_GATEWAY_TOKEN", gw["token_key"])
+	assert.Equal(t, "tok", gw["api_key"])
 	assert.Equal(t, "openai", gw["provider"])
+	assert.NotContains(t, gw, "token_key")
 
 	// agents.default.model uses inline shorthand.
 	agents := parsed["agents"].(map[string]any)

internal/adapters/goose/goose_test.go

@@ -117,8 +117,9 @@ func TestGooseRenderProducesCustomProviderFile(t *testing.T) {
 	require.NoError(t, json.Unmarshal(seen[cpDest].Content, &cp))
 	assert.Equal(t, "custom_harness-sync-gateway", cp["name"])
 	assert.Equal(t, "openai", cp["engine"])
-	assert.Equal(t, true, cp["requires_auth"])
-	assert.Equal(t, "CUSTOM_HARNESS_SYNC_GATEWAY_API_KEY", cp["api_key_env"])
+	assert.Equal(t, "tok", cp["api_key"])
+	assert.NotContains(t, cp, "api_key_env")
+	assert.NotContains(t, cp, "requires_auth")
 	models, ok := cp["models"].([]any)
 	require.True(t, ok)
 	require.Len(t, models, 1)

internal/adapters/kilo/kilo.go

@@ -2,6 +2,8 @@
 package kilo
 
 import (
+	"encoding/json"
+	"maps"
 	"os"
 	"path/filepath"
 
@@ -106,6 +108,52 @@ func (a *Adapter) Render(b *canonical.Bundle) (*adapter.FileSet, error) {
 		Content: merged,
 	})
 
+	// Also merge into opencode.jsonc when present — kilo reads it as its
+	// primary config. Delete the enabled_providers filter so our provider is
+	// visible alongside user-defined providers. Deep-merge the provider map
+	// so existing providers (e.g. "llmgw") are preserved.
+	ocPath := filepath.Join(base, "opencode.jsonc")
+	if ocRaw, readErr := os.ReadFile(ocPath); readErr == nil {
+		// Parse existing content (supports JSONC comments internally).
+		var ocBase map[string]any
+		clean := common.StripJSONComments(string(ocRaw))
+		_ = json.Unmarshal([]byte(clean), &ocBase)
+		if ocBase == nil {
+			ocBase = map[string]any{}
+		}
+
+		ocOverlay := map[string]any{
+			"enabled_providers": nil, // delete filter
+		}
+
+		// Deep-merge provider: add our entries INTO the existing provider map.
+		if newProv, ok := overlay["provider"].(map[string]any); ok && len(newProv) > 0 {
+			existing, _ := ocBase["provider"].(map[string]any)
+			if existing == nil {
+				existing = map[string]any{}
+			}
+			maps.Copy(existing, newProv)
+			ocOverlay["provider"] = existing
+		}
+		// Copy model/small_model/mcp from the kilo.json overlay.
+		for _, k := range []string{"model", "small_model", "mcp"} {
+			if v, ok := overlay[k]; ok {
+				ocOverlay[k] = v
+			}
+		}
+
+		ocMerged, mergeErr := common.MergeJSONKeys([]byte(clean), ocOverlay)
+		if mergeErr != nil {
+			return nil, mergeErr
+		}
+		fs.Add(adapter.File{
+			Dest:    ocPath,
+			Kind:    adapter.RenderedFile,
+			Content: ocMerged,
+			NoMerge: true,
+		})
+	}
+
 	return fs, nil
 }
 

internal/adapters/kilo/kilo_test.go

@@ -128,6 +128,48 @@ func TestKiloRenderEmitsModelString(t *testing.T) {
 	assert.Equal(t, "https://gw", opts["baseURL"])
 }
 
+func TestKiloRenderMergesOpenCodeJSONC(t *testing.T) {
+	home := t.TempDir()
+	base := filepath.Join(home, ".config", "kilo")
+	require.NoError(t, os.MkdirAll(base, 0o750))
+
+	// Existing opencode.jsonc with a filter and a different provider.
+	existing := `{
+		"enabled_providers": ["llmgw"],
+		"provider": {
+			"llmgw": {"npm": "@ai-sdk/openai-compatible", "options": {"baseURL": "https://old"}}
+		},
+		"model": "llmgw/old-model"
+	}`
+	require.NoError(t, os.WriteFile(filepath.Join(base, "opencode.jsonc"), []byte(existing), 0o600))
+
+	ad := New(WithHome(home))
+	b := &canonical.Bundle{
+		Profile: canonical.Profile{
+			Gateway: canonical.Gateway{URL: "https://gw", Token: "dummy", DefaultModel: "sonnet"},
+			Models:  []canonical.Model{{ID: "claude-sonnet-4-6", Alias: "sonnet"}},
+		},
+	}
+	fs, err := ad.Render(b)
+	require.NoError(t, err)
+	seen := map[string]adapter.File{}
+	fs.ForEach(func(f adapter.File) { seen[f.Dest] = f })
+
+	ocDest := filepath.Join(base, "opencode.jsonc")
+	require.Contains(t, seen, ocDest)
+
+	var parsed map[string]any
+	require.NoError(t, json.Unmarshal(seen[ocDest].Content, &parsed))
+	// enabled_providers deleted so our provider is visible.
+	assert.NotContains(t, parsed, "enabled_providers")
+	// llmgw preserved, harness-sync-gateway added.
+	provider := parsed["provider"].(map[string]any)
+	assert.Contains(t, provider, "llmgw")
+	assert.Contains(t, provider, "harness-sync-gateway")
+	// model updated.
+	assert.Equal(t, "harness-sync-gateway/sonnet", parsed["model"])
+}
+
 func TestKiloImport(t *testing.T) {
 	home := t.TempDir()
 	base := filepath.Join(home, ".config", "kilo")