@polderlabs/bizar 10.21.0 → 10.22.0

package/cli/commands/model.mjs

@@ -3,7 +3,7 @@
  *
  * `bizar model` subcommands:
  *   list  — fetch all models from the configured provider gateway and group
- *           by provider prefix.
+ *           by provider family.
  *
  * The gateway URL is read from `BIZAR_MODEL_ROUTER_URL` or
  * `ANTHROPIC_BASE_URL`. If neither is set, the command errors out with a
@@ -14,18 +14,24 @@
  * makes the /model picker surface only IDs prefixed with "claude" or
  * "anthropic". This command shows the FULL set including cx/, oc/, and
  * unprefixed IDs.
+ *
+ * 10.22.0 / Phase 4 spirit-of-constraint fix: this command used to carry a
+ * hardcoded `PROVIDER_GROUPS` prefix list that duplicated the canonical
+ * provider family detection in `cli/commands/models.mjs#classifyKind`.
+ * It now imports `classifyKind` from there (single source of truth) and
+ * filters the operator's `disabledProviders` list using the same
+ * case-sensitive prefix match as every other read site — adding a new
+ * provider family no longer requires touching this file.
  */
 import chalk from 'chalk';
 
+import { classifyKind, filterCandidatesByDisabledProviders, readDisabledProviders } from './models.mjs';
+
 const BIZAR_MODEL_ROUTER_URL = process.env.BIZAR_MODEL_ROUTER_URL
   || process.env.ANTHROPIC_BASE_URL
   || null;
 const ANTHROPIC_AUTH_TOKEN = process.env.ANTHROPIC_AUTH_TOKEN || null;
 
-const PROVIDER_GROUPS = [
-  'cx/', 'claude-minimax/', 'claude-qwen/', 'oc/', 'claude/', 'anthropic/',
-];
-
 function showHelp() {
   const gatewayDisplay = BIZAR_MODEL_ROUTER_URL ?? '(not configured)';
   console.log(`
@@ -41,13 +47,17 @@ function showHelp() {
     The /model picker inside Claude Code shows only "claude"/"anthropic" prefixed
     IDs. This command exposes the full set (cx/, claude-minimax/, claude-qwen/, oc/, etc.).
 
+    The list honours the operator's \`disabledProviders\` list from
+    model-router.json (10.22.0 / Phase 4) — same source of truth as
+    \`bizar models\`.
+
   Gateway configuration:
     Set BIZAR_MODEL_ROUTER_URL or ANTHROPIC_BASE_URL to your provider gateway
     (e.g. https://router.example.com/v1). If neither is set, this command
     exits with a configuration error.
 
   Flags:
-    --json   Emit { providers: { "cx/": [...], ... }, total: N }
+    --json   Emit { providers: { "<family>": [...], ... }, total: N }
   `);
 }
 
@@ -94,19 +104,28 @@ async function fetchModels() {
 }
 
 function groupByProvider(models) {
+  // 10.22.0 / Phase 4: filter the operator's `disabledProviders` first,
+  // then group by the canonical `classifyKind` family name. No
+  // hardcoded prefix list lives in this file.
+  const ids = models.map((m) => (typeof m?.id === 'string' ? m.id : ''));
+  const disabled = readDisabledProviders();
+  const { kept } = filterCandidatesByDisabledProviders(ids, disabled);
+  const keptSet = new Set(kept);
+
   const groups = {};
   for (const m of models) {
-    const id = m.id ?? '';
-    const prefix = PROVIDER_GROUPS.find(p => id.startsWith(p)) || null;
-    const key = prefix !== null ? prefix : '(no prefix)';
+    const id = typeof m?.id === 'string' ? m.id : '';
+    if (!id || !keptSet.has(id)) continue;
+    const family = classifyKind(id);
+    const key = family || '(unclassified)';
     if (!groups[key]) groups[key] = [];
-    groups[key].push({ id, display_name: m.display_name ?? m.id });
+    groups[key].push({ id, display_name: m.display_name ?? id });
   }
   return groups;
 }
 
 function printTable(groups) {
-  const colWidths = { provider: 14, id: 50, display_name: 30 };
+  const colWidths = { provider: 16, id: 50, display_name: 30 };
 
   const header = [
     'provider'.padEnd(colWidths.provider),

package/cli/commands/models.mjs

@@ -670,6 +670,134 @@ export function classifyKind(modelId) {
   return 'other';
 }
 
+// ── Disabled providers (10.22.0 / Phase 4) ────────────────────────────────────
+//
+// Operator-controllable provider disable list. Read from the top-level
+// `disabledProviders: string[]` key on the model-router config. There is NO
+// in-code hardcoded list — adding or removing a blocked provider is a
+// single JSON edit.
+//
+// Dual-path read: the Bizar path (`~/.config/bizar/config/claude/model-router.json`)
+// WINS when both exist, including an explicit `[]` (operators may pin
+// "no providers disabled" without deleting the legacy mirror). Whitespace
+// trim + lowercase normalization happens at read time so operators may
+// write `"  Anthropic  "` in JSON and still match `anthropic/...` model
+// ids. The comparison itself is a case-sensitive prefix filter against
+// the (lowercase) disabled prefixes, so `Anthropic/claude-X` (capital A)
+// is intentionally NOT stripped — pin test covers that.
+
+/**
+ * Normalize a single disabled-provider prefix: trim whitespace, lowercase.
+ * Returns empty string for non-string / empty input.
+ * @param {unknown} raw
+ * @returns {string}
+ */
+function normalizeDisabledPrefix(raw) {
+  if (typeof raw !== 'string') return '';
+  const trimmed = raw.trim();
+  if (!trimmed) return '';
+  return trimmed.toLowerCase();
+}
+
+/**
+ * Read `disabledProviders` from a parsed router object. Returns the
+ * normalized prefix array (or empty array when missing / malformed).
+ * @param {unknown} router
+ * @returns {string[]}
+ */
+function extractDisabledProviders(router) {
+  if (!router || typeof router !== 'object' || Array.isArray(router)) return [];
+  const raw = router.disabledProviders;
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const v of raw) {
+    const norm = normalizeDisabledPrefix(v);
+    if (norm) out.push(norm);
+  }
+  return out;
+}
+
+/**
+ * Read the operator's `disabledProviders` list from the model-router
+ * config. Dual-path: the Bizar path wins when present (even with an
+ * explicit empty array); the legacy `~/.claude/model-router.json` mirror
+ * is the fallback. Both paths are normalized (trim + lowercase) at read.
+ *
+ * Pure function over the filesystem; returns an empty array when neither
+ * file exists, when both files lack the key, or when both reads fail.
+ *
+ * @param {{ routerPath?: string, legacyPath?: string }} [opts]
+ *   - `routerPath` defaults to the Bizar home path
+ *     (`~/.config/bizar/config/claude/model-router.json`).
+ *   - `legacyPath` defaults to the Claude Code mirror
+ *     (`~/.claude/model-router.json`).
+ * @returns {string[]} normalized disabled-provider prefixes
+ */
+export function readDisabledProviders({ routerPath, legacyPath } = {}) {
+  const bizarPath = routerPath || join(homedir(), '.config', 'bizar', 'config', 'claude', 'model-router.json');
+  const fallPath = legacyPath || join(homedir(), '.claude', 'model-router.json');
+  if (existsSync(bizarPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync(bizarPath, 'utf8'));
+      const extracted = extractDisabledProviders(parsed);
+      // Bizar path exists — its `disabledProviders` is authoritative even
+      // when explicitly `[]` (operators may pin "no providers disabled"
+      // without deleting the legacy mirror). Missing key still falls back.
+      if (Array.isArray(parsed && typeof parsed === 'object' ? parsed.disabledProviders : undefined)) {
+        return extracted;
+      }
+    } catch {
+      // Corrupt Bizar file — fall through to the legacy mirror.
+    }
+  }
+  if (existsSync(fallPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync(fallPath, 'utf8'));
+      return extractDisabledProviders(parsed);
+    } catch {
+      return [];
+    }
+  }
+  return [];
+}
+
+/**
+ * Filter a candidate id list against the disabled-providers prefix list.
+ *
+ * The comparison is a strict, case-sensitive prefix match against the
+ * NORMALIZED (lowercase) disabled prefixes. Candidate ids are checked
+ * as-given, so a candidate like `Anthropic/claude-X` (capital A) is
+ * intentionally NOT stripped when `disabledProviders` is `["anthropic"]`
+ * — pin test covers that. Operators who want to block mixed-case ids
+ * should write the lowercase form.
+ *
+ * Empty / missing `disabledProviders` is a no-op (returns the input list).
+ *
+ * @template T extends string
+ * @param {T[] | Iterable<T>} candidates
+ * @param {string[]} disabledProviders  already-normalized prefixes
+ * @returns {{ kept: T[], stripped: T[] }}
+ */
+export function filterCandidatesByDisabledProviders(candidates, disabledProviders) {
+  const list = Array.isArray(candidates) ? candidates : Array.from(candidates || []);
+  const prefixes = Array.isArray(disabledProviders)
+    ? disabledProviders.filter((p) => typeof p === 'string' && p.length > 0)
+    : [];
+  if (prefixes.length === 0) return { kept: [...list], stripped: [] };
+  const kept = [];
+  const stripped = [];
+  for (const id of list) {
+    const s = typeof id === 'string' ? id : '';
+    let blocked = false;
+    for (const p of prefixes) {
+      if (s && s.startsWith(p)) { blocked = true; break; }
+    }
+    if (blocked) stripped.push(id);
+    else kept.push(id);
+  }
+  return { kept, stripped };
+}
+
 // ── Persistence ──────────────────────────────────────────────────────────────
 
 /**
@@ -692,8 +820,16 @@ export function loadRouter(routerPath) {
  * @param {{ routerPath: string, models: string[], tierHints?: Record<string,string>, profiles?: Record<string,object>, source?: string }} opts
  * @returns {{ models: string[], lastUpdated: string, source: string, tierHints: Record<string,string>, profiles: Record<string,object> }}
  */
-export function applyModels({ routerPath, models, tierHints = {}, profiles = {}, source = 'live-pick' }) {
-  const list = Array.isArray(models) ? models.filter((m) => typeof m === 'string' && m.trim()) : [];
+export function applyModels({ routerPath, models, tierHints = {}, profiles = {}, source = 'live-pick', disabledProviders }) {
+  const incoming = Array.isArray(models) ? models.filter((m) => typeof m === 'string' && m.trim()) : [];
+  // 10.22.0 / Phase 4: strip any id whose provider prefix is on the
+  // operator's disabled-providers list. The router file owns the list —
+  // no in-code hardcoded families. Stripped ids never reach the picker,
+  // the settings.json sync, the SessionStart hook, or the Agent guard.
+  // Tests pass an explicit `disabledProviders` array to keep the contract
+  // deterministic; production callers omit it and read from disk.
+  const disabled = Array.isArray(disabledProviders) ? disabledProviders : readDisabledProviders();
+  const { kept: list } = filterCandidatesByDisabledProviders(incoming, disabled);
   const hints = { ...(tierHints || {}) };
   for (const id of list) if (!hints[id]) hints[id] = defaultTierHint(id);
   const block = {
@@ -739,9 +875,14 @@ function writeAtomic(path, body) {
  *   - `staleIds` — picks that were never returned by the gateway in this run.
  *   - `unknownIds` — picks whose live status is unknown (no live pool yet).
  */
-export function partitionStalePicks({ liveIds, pickedIds }) {
+export function partitionStalePicks({ liveIds, pickedIds, disabledProviders }) {
   const live = Array.isArray(liveIds) ? new Set(liveIds) : null;
-  const picks = Array.isArray(pickedIds) ? pickedIds.filter((id) => typeof id === 'string' && id.trim()) : [];
+  const incoming = Array.isArray(pickedIds) ? pickedIds.filter((id) => typeof id === 'string' && id.trim()) : [];
+  // 10.22.0 / Phase 4: strip disabled-provider ids before partition so
+  // they never reach the live pool OR the stale list — they were never
+  // the operator's intent once the disable list landed.
+  const disabled = Array.isArray(disabledProviders) ? disabledProviders : readDisabledProviders();
+  const { kept: picks } = filterCandidatesByDisabledProviders(incoming, disabled);
   if (!live || live.size === 0) {
     return { liveIds: [], staleIds: [], unknownIds: [...new Set(picks)] };
   }
@@ -782,18 +923,25 @@ export function partitionStalePicks({ liveIds, pickedIds }) {
  *   wrote: boolean,
  *   syncedIds: string[],
  *   skippedStale: string[],
+ *   skippedDisabled: string[],
  *   settingsPath: string|null,
  * }}
  */
-export function applyModelOverrides({ settingsJsonPath, pickedIds, liveIds = [] }) {
+export function applyModelOverrides({ settingsJsonPath, pickedIds, liveIds = [], disabledProviders }) {
   const path = settingsJsonPath === undefined
     ? join(homedir(), '.claude', 'settings.json')
     : settingsJsonPath;
   if (path === null) {
-    return { wrote: false, syncedIds: [], skippedStale: [], settingsPath: null };
+    return { wrote: false, syncedIds: [], skippedStale: [], skippedDisabled: [], settingsPath: null };
   }
   const live = new Set(Array.isArray(liveIds) ? liveIds : []);
-  const picks = Array.isArray(pickedIds) ? pickedIds.filter((id) => typeof id === 'string' && id.trim()) : [];
+  const incoming = Array.isArray(pickedIds) ? pickedIds.filter((id) => typeof id === 'string' && id.trim()) : [];
+  // 10.22.0 / Phase 4: strip disabled-provider ids BEFORE the self-map
+  // so Claude Code never sees an `anthropic/*` self-map entry. The
+  // skipped ids are reported back so the operator can see what was
+  // dropped (without crashing on the disabled list).
+  const disabled = Array.isArray(disabledProviders) ? disabledProviders : readDisabledProviders();
+  const { kept: picks, stripped: skippedDisabled } = filterCandidatesByDisabledProviders(incoming, disabled);
   // Self-map only IDs the live gateway serves. Stale IDs intentionally stay
   // out so the `[claude-code:unrecognized_model]` diagnostic still fires
   // for them — the operator should re-run `bizar models` to drop them.
@@ -810,14 +958,14 @@ export function applyModelOverrides({ settingsJsonPath, pickedIds, liveIds = []
     } catch {
       // Corrupt settings.json — refuse to overwrite it; surface the sync
       // as a no-op so `bizar models` still completes.
-      return { wrote: false, syncedIds: [], skippedStale: skipped, settingsPath: path };
+      return { wrote: false, syncedIds: [], skippedStale: skipped, skippedDisabled, settingsPath: path };
     }
   }
   // Self-map pattern — Claude Code uses modelOverrides to suppress
   // `[claude-code:unrecognized_model]` for any ID that maps to itself.
   settings.modelOverrides = Object.fromEntries(synced.map((id) => [id, id]));
   writeAtomic(path, JSON.stringify(settings, null, 2) + '\n');
-  return { wrote: true, syncedIds: synced, skippedStale: skipped, settingsPath: path };
+  return { wrote: true, syncedIds: synced, skippedStale: skipped, skippedDisabled, settingsPath: path };
 }
 
 /**
@@ -893,18 +1041,24 @@ export function deriveModelLabel(modelId, profile) {
  *   wrote: boolean,
  *   options: Array<{model: string, label: string, description?: string}>,
  *   skippedStale: string[],
+ *   skippedDisabled: string[],
  *   settingsPath: string|null,
  * }}
  */
-export function applyModelPicker({ settingsJsonPath, pickedIds, profiles = {}, liveIds = [] }) {
+export function applyModelPicker({ settingsJsonPath, pickedIds, profiles = {}, liveIds = [], disabledProviders }) {
   const path = settingsJsonPath === undefined
     ? join(homedir(), '.claude', 'settings.json')
     : settingsJsonPath;
   if (path === null) {
-    return { wrote: false, options: [], skippedStale: [], settingsPath: null };
+    return { wrote: false, options: [], skippedStale: [], skippedDisabled: [], settingsPath: null };
   }
   const live = new Set(Array.isArray(liveIds) ? liveIds : []);
-  const picks = Array.isArray(pickedIds) ? pickedIds.filter((id) => typeof id === 'string' && id.trim()) : [];
+  const incoming = Array.isArray(pickedIds) ? pickedIds.filter((id) => typeof id === 'string' && id.trim()) : [];
+  // 10.22.0 / Phase 4: drop disabled-provider ids BEFORE the live-id
+  // gate so Claude Code's `/model` picker never surfaces an
+  // `anthropic/*` (or any other disabled) option.
+  const disabled = Array.isArray(disabledProviders) ? disabledProviders : readDisabledProviders();
+  const { kept: picks, stripped: skippedDisabled } = filterCandidatesByDisabledProviders(incoming, disabled);
   const surviving = live.size === 0 ? picks : picks.filter((id) => live.has(id));
   const skipped = live.size === 0 ? [] : picks.filter((id) => !live.has(id));
   const options = surviving.map((id) => {
@@ -922,12 +1076,12 @@ export function applyModelPicker({ settingsJsonPath, pickedIds, profiles = {}, l
       const parsed = JSON.parse(readFileSync(path, 'utf8'));
       if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) settings = parsed;
     } catch {
-      return { wrote: false, options: [], skippedStale: skipped, settingsPath: path };
+      return { wrote: false, options: [], skippedStale: skipped, skippedDisabled, settingsPath: path };
     }
   }
   settings.modelPicker = { options };
   writeAtomic(path, JSON.stringify(settings, null, 2) + '\n');
-  return { wrote: true, options, skippedStale: skipped, settingsPath: path };
+  return { wrote: true, options, skippedStale: skipped, skippedDisabled, settingsPath: path };
 }
 
 // ── F-190 / IMP-017 refresh + operator-override preservation ────────────────
@@ -956,7 +1110,7 @@ function profileNeedsRefresh(profile, now = new Date()) {
  * `bizar models --refresh` prints in non-interactive mode.
  *
  * @param {{ routerPath: string, candidates: Array<{ id: string, profile?: object }>, catalog: object, aliasMap?: object, now?: Date }} opts
- * @returns {{ refreshed: string[], preservedOperator: string[], skippedFresh: string[], error?: string }}
+ * @returns {{ refreshed: string[], preservedOperator: string[], skippedFresh: string[], skippedDisabled: string[], error?: string }}
  */
 export function applyRefresh({
   routerPath,
@@ -964,6 +1118,7 @@ export function applyRefresh({
   catalog,
   aliasMap = {},
   now = new Date(),
+  disabledProviders,
 } = {}) {
   if (!routerPath || typeof routerPath !== 'string') throw new Error('routerPath is required');
   if (!Array.isArray(candidates)) throw new Error('candidates is required (array)');
@@ -979,15 +1134,29 @@ export function applyRefresh({
   const existingProfiles = userSelected.profiles && typeof userSelected.profiles === 'object'
     ? userSelected.profiles
     : {};
-  const existingModels = Array.isArray(userSelected.models) ? userSelected.models : [];
+  const rawExistingModels = Array.isArray(userSelected.models) ? userSelected.models : [];
   const existingTierHints = userSelected.tierHints && typeof userSelected.tierHints === 'object'
     ? userSelected.tierHints
     : {};
 
+  // 10.22.0 / Phase 4: filter disabled-provider ids off the existing
+  // list BEFORE the refresh loop so the disabled ids never get a
+  // refresh attempt, are not in the returned counts, and the persisted
+  // userSelected.models reflects the operator's intent. Dropped profiles
+  // are also pruned so the on-disk state does not keep growing on every
+  // refresh.
+  const disabled = Array.isArray(disabledProviders) ? disabledProviders : readDisabledProviders();
+  const { kept: existingModels, stripped: droppedDisabledIds } = filterCandidatesByDisabledProviders(
+    rawExistingModels.filter((id) => typeof id === 'string' && id.trim()),
+    disabled,
+  );
+  const newProfiles = { ...existingProfiles };
+  for (const dropped of droppedDisabledIds) delete newProfiles[dropped];
+
   const refreshed = [];
   const preservedOperator = [];
   const skippedFresh = [];
-  const newProfiles = { ...existingProfiles };
+  const skippedDisabled = [...droppedDisabledIds];
 
   for (const id of existingModels) {
     if (typeof id !== 'string' || !id.trim()) continue;
@@ -1050,7 +1219,7 @@ export function applyRefresh({
   // the picker write path above.
   writeAtomic(routerPath, JSON.stringify(router, null, 2) + '\n');
 
-  return { refreshed, preservedOperator, skippedFresh };
+  return { refreshed, preservedOperator, skippedFresh, skippedDisabled };
 }
 
 function safeParseRouter(path) {
@@ -1149,11 +1318,17 @@ function stampProvenance(profile, now) {
  * Read the user-selected block off the router. Returns the models array
  * (possibly empty) and the tier hints.
  */
-export function currentSelection(router) {
+export function currentSelection(router, { disabledProviders } = {}) {
   if (!router || typeof router !== 'object') return { models: [], tierHints: {} };
   const us = router.userSelected;
   if (!us || typeof us !== 'object') return { models: [], tierHints: {} };
-  const models = Array.isArray(us.models) ? us.models.filter((m) => typeof m === 'string') : [];
+  const incoming = Array.isArray(us.models) ? us.models.filter((m) => typeof m === 'string') : [];
+  // 10.22.0 / Phase 4: also strip disabled-provider ids on every read.
+  // Callers (interactive picker, JSON envelope, audit tools) all consume
+  // the filtered list so the operator's disable intent is honoured even
+  // for ids already persisted in `userSelected.models` from a prior run.
+  const disabled = Array.isArray(disabledProviders) ? disabledProviders : readDisabledProviders();
+  const { kept: models } = filterCandidatesByDisabledProviders(incoming, disabled);
   const tierHints = us.tierHints && typeof us.tierHints === 'object' ? us.tierHints : {};
   return { models, tierHints };
 }
@@ -1770,6 +1945,16 @@ function showHelp() {
     a default. Bizar is provider-agnostic and ships no default gateway.
 
   Auth: $ANTHROPIC_AUTH_TOKEN -> settings.json#env.ANTHROPIC_AUTH_TOKEN.\n\n  Discovered models are enriched from https://models.dev/models.json.\n  Metadata lookup is best-effort and never hides gateway-reported models.
+
+  Disable providers (10.22.0 / Phase 4): the operator's
+    model-router.json#disabledProviders: string[]
+  list filters out every id whose provider prefix matches (case-sensitive,
+  trimmed + lowercased at read time). The filter is consulted at every
+  reader site: the picker (interactive + --list), settings.json#model
+  and #modelOverrides, settings.json#modelPicker.options, the
+  SessionStart sync, and the Agent model guard. Empty / missing list is
+  a no-op (every id passes through). Add or remove a blocked provider
+  with a single JSON edit; no in-code list exists.
 `;
   console.log(help);
 }

package/cli/commands/upgrade-defaults.mjs

@@ -11,7 +11,7 @@
  *   2. Sets the permissive defaults the Bizar user typically wants:
  *        - permissions.defaultMode  → "bypassPermissions"
  *        - worktree.bgIsolation     → "worktree"
- *        - model                    → "claude/minimax/MiniMax-M3"
+ *        - model                    → userSelected.models[0] (10.22.0 / Phase 4)
  *        - alwaysThinkingEnabled    → true
  *        - effortLevel              → "high"
  *        - skipDangerousModePermissionPrompt → true
@@ -21,6 +21,9 @@
  *      a more restrictive mode (e.g. a user who set
  *      defaultMode="default" gets to keep it).
  *   4. Preserves every unrelated key (mcpServers, hooks, env, etc.).
+ *   5. Skips `model` entirely when userSelected is empty — Claude Code
+ *      inherits its session default, still gated by the operator's
+ *      `disabledProviders` list (10.22.0 / Phase 4).
  *
  * Why this exists: the canonical config/claude/settings.json ships with
  * these defaults and `cli/provision.mjs` (F-163 scope-owned) is the
@@ -37,11 +40,39 @@ import { join } from 'node:path';
 const HOME = homedir();
 const CLAUDE_DIR = process.env.CLAUDE_CONFIG_DIR?.trim() || join(HOME, '.claude');
 const SETTINGS_PATH = join(CLAUDE_DIR, 'settings.json');
+// 10.22.0 / Phase 4 spirit-of-constraint: the install model id comes
+// from the operator's `userSelected.models[0]`, not a hardcoded literal.
+// Dual-path read matches `cli/commands/models.mjs#readDisabledProviders`:
+// the Bizar path wins when present; the Claude Code mirror is fallback.
+const BIZAR_ROUTER_PATH = process.env.BIZAR_MODEL_ROUTER_CONFIG?.trim()
+  || join(HOME, '.config', 'bizar', 'config', 'claude', 'model-router.json');
+const LEGACY_ROUTER_PATH = join(HOME, '.claude', 'model-router.json');
+
+function readUserSelectedModels() {
+  for (const path of [BIZAR_ROUTER_PATH, LEGACY_ROUTER_PATH]) {
+    if (!existsSync(path)) continue;
+    try {
+      const parsed = JSON.parse(readFileSync(path, 'utf8'));
+      const list = Array.isArray(parsed?.userSelected?.models)
+        ? parsed.userSelected.models.filter((id) => typeof id === 'string' && id.trim())
+        : [];
+      if (list.length > 0) return list;
+      // Bizar path exists with an explicit empty `userSelected.models` —
+      // honour that intent (do NOT fall through to the legacy mirror).
+      if (path === BIZAR_ROUTER_PATH && parsed && typeof parsed === 'object'
+          && Array.isArray(parsed.userSelected?.models)) {
+        return [];
+      }
+    } catch { /* keep falling through */ }
+  }
+  return [];
+}
 
-const FAVORED = {
+const STATIC_FAVORED = {
   permissions: { defaultMode: 'bypassPermissions' },
   worktree: { bgIsolation: 'worktree' },
-  model: 'claude/minimax/MiniMax-M3',
+  // `model` is intentionally absent — `buildFavored()` derives it from
+  // userSelected.models[0] (or omits it when empty).
   alwaysThinkingEnabled: true,
   effortLevel: 'high',
   skipDangerousModePermissionPrompt: true,
@@ -49,6 +80,13 @@ const FAVORED = {
   askUserQuestionTimeout: '5m',
 };
 
+function buildFavored() {
+  const out = { ...STATIC_FAVORED };
+  const picks = readUserSelectedModels();
+  if (picks[0]) out.model = picks[0];
+  return out;
+}
+
 function isAtLeastAsPermissive(existing, desired) {
   // Don't downgrade: if the user picked a stricter mode, keep theirs.
   const order = { default: 0, acceptEdits: 1, bypassPermissions: 2 };
@@ -86,10 +124,11 @@ function load() {
 
 function diff(existing) {
   const proposed = JSON.parse(JSON.stringify(existing));
-  deepAssign(proposed, FAVORED);
+  const favored = buildFavored();
+  deepAssign(proposed, favored);
   // Permission-mode guard.
   const existingMode = existing?.permissions?.defaultMode;
-  if (existingMode && !isAtLeastAsPermissive(existingMode, FAVORED.permissions.defaultMode)) {
+  if (existingMode && !isAtLeastAsPermissive(existingMode, favored.permissions.defaultMode)) {
     proposed.permissions.defaultMode = existingMode;
   }
   return proposed;

package/cli/provision.mjs

@@ -813,6 +813,13 @@ export function writeClaudeSettings({ dryRun = false, force = false } = {}) {
   // source of truth for defaultMode, worktree, enableWorkflows, etc. We
   // overlay Bizar-owned keys (mcpServers, hooks, env) on top so the installer
   // honors user preferences without having to fork the template here.
+  // 10.22.0 / Phase 4 spirit-of-constraint fix: `model` and
+  // `modelOverrides` are no longer hardcoded in the shipped template;
+  // they are derived from the operator's persisted
+  // `userSelected.models[0]`. When the operator has not picked anything
+  // yet, both keys are omitted entirely — Claude Code inherits its
+  // session default, still gated by the operator's `disabledProviders`
+  // list (10.22.0 / Phase 4).
   const bizarSettings = {
     ...shipped,
     $schema: shipped.$schema || 'https://json.schemastore.org/claude-code-settings.json',
@@ -901,6 +908,37 @@ export function writeClaudeSettings({ dryRun = false, force = false } = {}) {
     },
   };
 
+  // 10.22.0 / Phase 4: derive `model` and `modelOverrides` from the
+  // operator's `userSelected.models[0]`. Both keys are omitted entirely
+  // when the operator has not picked anything — Claude Code inherits its
+  // session default. Dual-path read matches
+  // `cli/commands/models.mjs#readDisabledProviders` and
+  // `cli/commands/upgrade-defaults.mjs#readUserSelectedModels`.
+  const bizarRouterPath = process.env.BIZAR_MODEL_ROUTER_CONFIG?.trim()
+    || join(BIZAR_HOME(), 'config', 'claude', 'model-router.json');
+  const legacyRouterPath = join(CLAUDE_DIR, 'model-router.json');
+  let userSelectedModels = [];
+  for (const p of [bizarRouterPath, legacyRouterPath]) {
+    if (!existsSync(p)) continue;
+    const parsed = readJsonSafe(p, null);
+    if (!parsed || typeof parsed !== 'object') continue;
+    const list = Array.isArray(parsed?.userSelected?.models)
+      ? parsed.userSelected.models.filter((id) => typeof id === 'string' && id && id.trim())
+      : [];
+    if (list.length > 0) { userSelectedModels = list; break; }
+    // Bizar path exists with explicit empty `userSelected.models` —
+    // honour that intent and stop the fallback walk.
+    if (p === bizarRouterPath) break;
+  }
+  const installModel = userSelectedModels[0];
+  if (installModel) {
+    bizarSettings.model = installModel;
+    bizarSettings.modelOverrides = { [installModel]: installModel };
+  } else {
+    delete bizarSettings.model;
+    delete bizarSettings.modelOverrides;
+  }
+
   const merged = { ...existing };
   if (force) {
     Object.assign(merged, bizarSettings);
@@ -1108,7 +1146,25 @@ export async function runProvision(opts = {}) {
   if (anyFail) console.log(chalk.yellow('  ⚠ Some steps had issues.'));
   else { console.log(chalk.bold.green('  ✓ Bizar is ready.')); console.log(chalk.dim('     Next: restart your Claude Code session.')); }
   console.log('');
-  console.log(chalk.dim('  Premium model: ANTHROPIC_MODEL=claude-qwen/qwen3.8-max claude'));
+  // 10.22.0 / Phase 4 spirit-of-constraint fix: derive the install-banner
+  // premium model id from the operator's persisted
+  // `userSelected.tierHints.premium[0]` instead of hardcoding one
+  // provider's id. When the operator has not picked anything yet, fall
+  // back to a clear hint to run `bizar models`.
+  let premiumPick = null;
+  try {
+    const routerPath = join(BIZAR_HOME(), 'config', 'claude', 'model-router.json');
+    const router = JSON.parse(readFileSync(routerPath, 'utf8'));
+    const picks = Array.isArray(router?.userSelected?.tierHints?.premium)
+      ? router.userSelected.tierHints.premium.filter((id) => typeof id === 'string' && id)
+      : [];
+    premiumPick = picks[0] || null;
+  } catch { /* fresh install — no router file yet */ }
+  if (premiumPick) {
+    console.log(chalk.dim(`  Premium model: ANTHROPIC_MODEL=${premiumPick} claude`));
+  } else {
+    console.log(chalk.dim('  Premium model: (no premium pick configured yet — run `bizar models`)'));
+  }
   console.log(chalk.dim('  See /use-premium or .claude/commands/use-premium.md for the full launch snippet.'));
   console.log('');
   return { ok: !anyFail, mode: effectiveMode, state: detectState(), stepResults };

package/config/claude/agents/office-manager.md

@@ -31,11 +31,13 @@ Default tier classification heuristic (set by the picker, overridable per-model
 | anything else | `mid` |
 | `nano`, `mini`, `haiku` (older), `flash`, `lite`, `tiny` | `budget` |
 
-Concrete example: if `userSelected.models = ["claude-minimax/MiniMax-M3", "claude-qwen/qwen3.8-max"]` and `tierHints = { "claude-minimax/MiniMax-M3": "default", "claude-qwen/qwen3.8-max": "premium" }`:
-- a `default`-tier dispatch picks `claude-minimax/MiniMax-M3`,
-- a `premium`-tier dispatch picks `claude-qwen/qwen3.8-max`,
+Concrete example: if `userSelected.models = ["<pick-from-default-tier>", "<pick-from-premium-tier>"]` and `tierHints = { "<pick-from-default-tier>": "default", "<pick-from-premium-tier>": "premium" }`:
+- a `default`-tier dispatch picks `<pick-from-default-tier>`,
+- a `premium`-tier dispatch picks `<pick-from-premium-tier>`,
 - anything else (no tier configured) → omit `model` and inherit the session.
 
+10.22.0 / Phase 4: agent docs ship with placeholder ids (`<pick-from-default-tier>`, `<pick-from-premium-tier>`) instead of literal model ids so a provider swap never requires editing this file. Operators configure the real ids via `bizar models`.
+
 The SDK resolver (`packages/sdk/src/router/agent-model-registry.ts#rankUserSelectedForRole`) now ranks the `userSelected` pool by capability profile before falling back to the tier default.
 
 Do not auto-discover new models. Do not add tier-candidates that are not in `userSelected`. The Agent-model-guard (`config/claude/hooks/agent-model-guard.mjs`) blocks any other model override.

package/config/claude/hooks/agent-model-guard.mjs

@@ -60,18 +60,62 @@ function advise(reason) {
   };
 }
 
+/**
+ * 10.22.0 / Phase 4: extract the operator's `disabledProviders` list from
+ * the loaded registry. Whitespace-trimmed + lowercased at read time.
+ * Returns `[]` for legacy configs that lack the key (no in-code default).
+ * The hook MUST fail open on parse errors — the orchestrator already
+ * chose a model; let Claude Code validate it once.
+ */
+function readDisabledProvidersFromRegistry(registry) {
+  if (!registry || typeof registry !== 'object') return [];
+  const raw = registry.disabledProviders;
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const v of raw) {
+    if (typeof v !== 'string') continue;
+    const trimmed = v.trim();
+    if (!trimmed) continue;
+    out.push(trimmed.toLowerCase());
+  }
+  return out;
+}
+
+/**
+ * 10.22.0 / Phase 4: case-sensitive prefix filter against the (lowercase)
+ * disabled list. Empty / missing prefix list is a no-op (returns input).
+ */
+function isDisabledId(id, prefixes) {
+  if (!Array.isArray(prefixes) || prefixes.length === 0) return false;
+  if (typeof id !== 'string' || !id) return false;
+  for (const p of prefixes) {
+    if (typeof p === 'string' && p && id.startsWith(p)) return true;
+  }
+  return false;
+}
+
 /**
  * Models that pass the configured-tier check: every model in any
  * `tiers.<x>.models` block, PLUS every model in `userSelected.models`.
+ *
+ * 10.22.0 / Phase 4: ids whose provider prefix is on the operator's
+ * `disabledProviders` list are silently filtered out — the picker IS
+ * still the discovery surface for user picks, but the operator's
+ * disable intent overrides user intent.
  */
 function configuredModels(registry) {
+  const disabled = readDisabledProvidersFromRegistry(registry);
   const out = new Set();
   for (const tier of Object.values(registry?.tiers || {})) {
-    if (Array.isArray(tier?.models)) for (const id of tier.models) out.add(id);
+    if (Array.isArray(tier?.models)) for (const id of tier.models) {
+      if (!isDisabledId(id, disabled)) out.add(id);
+    }
   }
   const userSelected = registry?.userSelected;
   if (userSelected && Array.isArray(userSelected.models)) {
-    for (const id of userSelected.models) out.add(id);
+    for (const id of userSelected.models) {
+      if (!isDisabledId(id, disabled)) out.add(id);
+    }
   }
   return out;
 }
@@ -79,12 +123,17 @@ function configuredModels(registry) {
 /**
  * Subset of `configuredModels` that came from the user picker. These bypass
  * the live-discovery validation (the picker IS the discovery).
+ *
+ * 10.22.0 / Phase 4: same disabled-prefix filter as `configuredModels`.
  */
 function userSelectedModels(registry) {
+  const disabled = readDisabledProvidersFromRegistry(registry);
   const out = new Set();
   const userSelected = registry?.userSelected;
   if (userSelected && Array.isArray(userSelected.models)) {
-    for (const id of userSelected.models) out.add(id);
+    for (const id of userSelected.models) {
+      if (!isDisabledId(id, disabled)) out.add(id);
+    }
   }
   return out;
 }
@@ -127,6 +176,16 @@ export async function guardAgentModel(input, options = {}) {
     return {};
   }
 
+  // 10.22.0 / Phase 4: silent-filter contract — if the operator's
+  // `disabledProviders` list covers the requested id, fall through
+  // without advising. The orchestrator already chose the id; the
+  // operator's disable intent overrides user picks at config time, not
+  // dispatch time. Pin: see
+  // `config/claude/hooks/__tests__/agent-model-guard.test.mjs#Agent
+  // model guard filters disabled-provider user picks silently`.
+  const disabled = readDisabledProvidersFromRegistry(registry);
+  if (isDisabledId(requested, disabled)) return {};
+
   const allowed = configuredModels(registry);
   const userPicks = userSelectedModels(registry);
 

package/config/claude/hooks/sessionstart-model-sync.mjs

@@ -65,6 +65,69 @@ function readRouterPath() {
   return join(homedir(), '.config', 'bizar', 'config', 'claude', 'model-router.json');
 }
 
+/**
+ * 10.22.0 / Phase 4: read the operator's `disabledProviders: string[]`
+ * list with the same dual-path contract as `cli/commands/models.mjs`.
+ * The Bizar path (`~/.config/bizar/config/claude/model-router.json`) wins
+ * when both exist (even with explicit `[]`); the legacy
+ * `~/.claude/model-router.json` mirror is the fallback. Whitespace +
+ * lowercase normalization happens here. Returns `[]` on any failure —
+ * the hook is advisory and must NEVER block session start.
+ */
+function readDisabledProviders() {
+  const bizarPath = readRouterPath();
+  const legacyPath = join(homedir(), '.claude', 'model-router.json');
+  const extract = (parsed) => {
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
+    if (!Array.isArray(parsed.disabledProviders)) return null;
+    const out = [];
+    for (const v of parsed.disabledProviders) {
+      if (typeof v !== 'string') continue;
+      const trimmed = v.trim();
+      if (!trimmed) continue;
+      out.push(trimmed.toLowerCase());
+    }
+    return out;
+  };
+  if (existsSync(bizarPath)) {
+    const parsed = readJsonIfObject(bizarPath);
+    // Bizar path exists — its `disabledProviders` is authoritative even
+    // when explicit `[]`. Missing key still falls back to the legacy.
+    if (parsed && Array.isArray(parsed.disabledProviders)) {
+      const extracted = extract(parsed);
+      if (extracted !== null) return extracted;
+    }
+  }
+  const legacy = readJsonIfObject(legacyPath);
+  if (legacy && Array.isArray(legacy.disabledProviders)) {
+    const extracted = extract(legacy);
+    if (extracted !== null) return extracted;
+  }
+  return [];
+}
+
+/**
+ * Strip disabled-provider prefixes from an id list. Case-sensitive
+ * prefix match against the (lowercase) disabled list. The hook mirrors
+ * the CLI's `filterCandidatesByDisabledProviders` contract — see
+ * `cli/commands/models.mjs` for the authoritative implementation.
+ */
+function filterDisabled(ids, disabled) {
+  const list = Array.isArray(ids) ? ids : [];
+  const prefixes = Array.isArray(disabled) ? disabled.filter((p) => typeof p === 'string' && p) : [];
+  if (prefixes.length === 0) return [...list];
+  const kept = [];
+  for (const id of list) {
+    if (typeof id !== 'string' || !id) { kept.push(id); continue; }
+    let blocked = false;
+    for (const p of prefixes) {
+      if (id.startsWith(p)) { blocked = true; break; }
+    }
+    if (!blocked) kept.push(id);
+  }
+  return kept;
+}
+
 function readSettingsPath() {
   return join(homedir(), '.claude', 'settings.json');
 }
@@ -129,7 +192,15 @@ function syncOnce() {
   const profiles = userSelected && userSelected.profiles && typeof userSelected.profiles === 'object'
     ? userSelected.profiles
     : {};
-  const liveIds = models.filter((id) => typeof id === 'string' && id.trim());
+  // 10.22.0 / Phase 4: filter the operator's disabled-provider ids out
+  // of the SessionStart re-apply so Claude Code's `/model` picker never
+  // surfaces e.g. `anthropic/*` after a session restart. Dual-path read
+  // matches `cli/commands/models.mjs#readDisabledProviders`.
+  const disabled = readDisabledProviders();
+  const liveIds = filterDisabled(
+    models.filter((id) => typeof id === 'string' && id.trim()),
+    disabled,
+  );
   if (liveIds.length === 0) {
     return { applied: 0, modelAfter: null, skipped: 'no-userSelected' };
   }
@@ -155,7 +226,7 @@ function syncOnce() {
   settings.modelOverrides = Object.fromEntries(liveIds.map((id) => [id, id]));
 
   let modelChanged = false;
-  if (typeof settings.model === 'string' && settings.model.startsWith('claude-')) {
+  if (typeof settings.model === 'string' && !liveIds.includes(settings.model)) {
     settings.model = liveIds[0];
     modelChanged = true;
   }

package/config/claude/model-router.json

@@ -2,7 +2,8 @@
   "$schema": "https://bizar.dev/schema/model-router.v3.json",
   "version": "13.0.0",
   "endpoint": null,
-  "comment": "Mike selects the cheapest sufficient user-selected model per dispatch. Agent roles never carry fixed models. The orchestrator dispatches ONLY with IDs in `userSelected.models`. When `userSelected` is empty, omit the Agent model override and inherit the active session model instead of retrying aliases. The gateway endpoint is intentionally null in the shipped config — operators MUST configure it via the `ANTHROPIC_BASE_URL` or `BIZAR_MODEL_ROUTER_URL` environment variable. Bizar is provider-agnostic and ships no default provider.",
+  "disabledProviders": ["anthropic"],
+  "comment": "Mike selects the cheapest sufficient user-selected model per dispatch. Agent roles never carry fixed models. The orchestrator dispatches ONLY with IDs in `userSelected.models`. When `userSelected` is empty, omit the Agent model override and inherit the active session model instead of retrying aliases. The gateway endpoint is intentionally null in the shipped config — operators MUST configure it via the `ANTHROPIC_BASE_URL` or `BIZAR_MODEL_ROUTER_URL` environment variable. Bizar is provider-agnostic and ships no default provider. `disabledProviders` (top-level, optional) is a case-insensitive-at-write, case-sensitive-at-filter list of provider prefixes whose model ids are stripped from every read site (CLI sync, picker, settings.json sync, SessionStart hook, Agent model guard). Defaults to `[]`; ships with `[\"anthropic\"]` so a fresh install never dispatches `anthropic/*` ids even if a gateway reports them.",
   "userSelected": {
     "models": [],
     "lastUpdated": null,

package/config/claude/settings.json

@@ -59,10 +59,6 @@
     "bgIsolation": "worktree",
     "cleanupPeriodDays": 7
   },
-  "model": "claude-minimax/MiniMax-M3[1m]",
-  "modelOverrides": {
-    "claude-minimax/MiniMax-M3": "claude-minimax/MiniMax-M3[1m]"
-  },
   "alwaysThinkingEnabled": true,
   "effortLevel": "high",
   "skipDangerousModePermissionPrompt": true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar",
-  "version": "10.21.0",
+  "version": "10.22.0",
   "description": "Autonomous, human-in-the-loop multi-agent harness for Claude Code with guarded workflows, typed SDK primitives, and MCP tools.",
   "type": "module",
   "bin": {

package/packages/sdk/dist/version.d.ts

@@ -1,5 +1,5 @@
 /**
  * SDK version constant. Keep synchronized with the workspace package versions.
  */
-export declare const SDK_VERSION: "10.19.8";
+export declare const SDK_VERSION: "10.22.0";
 //# sourceMappingURL=version.d.ts.map

package/packages/sdk/dist/version.js

@@ -1,5 +1,5 @@
 /**
  * SDK version constant. Keep synchronized with the workspace package versions.
  */
-export const SDK_VERSION = "10.19.8";
+export const SDK_VERSION = "10.22.0";
 //# sourceMappingURL=version.js.map

package/packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar-sdk",
-  "version": "10.20.1",
+  "version": "10.22.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",