rovecode 0.3.3 → 0.4.0-beta.3

package/src/providers/provider-config.ts

@@ -1,311 +0,0 @@
-/** Provider configuration — the DATA half of the provider layer (no adapters, no network).
- *
- *  Sources, merged per provider id in this order (later wins):
- *    1. BUILTIN_PROVIDERS (the table below)            scope "builtin"
- *    2. ~/.rovecode/providers.json (ROVECODE_HOME-aware)   scope "user"
- *    3. <cwd>/.rovecode/providers.json                  scope "project"
- *    4. ROVECODE_BASE_URL + ROVECODE_API_KEY                scope "env" — the "custom" provider, always the default
- *
- *  File shape (both scopes):
- *    { "default"?: "provider/model",
- *      "providers"?: { "<id>": { "baseUrl", "protocol"?, "keyEnv"?, "defaultModel"?, "models"?, "headers"?, "noKey"? } } }
- *
- *  Secrets never live in providers.json. A provider's key is the stored credential (auth.ts,
- *  `rovecode auth set <id>`, masked prompt) else process.env[keyEnv ?? keyNameFor(id)]; `noKey: true`
- *  marks local servers (ollama, vllm) that need none. The `default` selector is "provider/model"
- *  split on the FIRST slash (router.ts grammar) — a bare provider id selects its defaultModel.
- *
- *  Hot reload: ProviderConfig.snapshot() re-reads when the mtime or size of any source file changed
- *  (both providers.json + credentials.json), checked at most once per `throttleMs`. A provider added
- *  from another terminal — or by the agent through provider_edit — is live on the next model call;
- *  no restart. resolveProvider() (stream.ts) is the one-shot form of the same merge, so the CLI and
- *  a long-running TUI always agree on what "the default provider" is. */
-
-import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { credentialsPath, keyNameFor, loadCredentials, rovecodeHome, type StoredCredential } from "./auth.ts";
-
-export type ProviderProtocol = "openai" | "anthropic";
-export type ProviderScope = "builtin" | "user" | "project" | "env";
-/** where a provider's key came from: stored credential, env var, the ROVECODE_API_KEY pair, or nowhere */
-export type KeySource = "stored" | "env" | "inline" | "none";
-
-export interface ProviderSpec {
-  id: string;
-  baseUrl: string;
-  protocol: ProviderProtocol;
-  /** env var consulted when no credential is stored; default keyNameFor(id) (models.dev name or <ID>_API_KEY) */
-  keyEnv?: string;
-  defaultModel?: string;
-  /** static model list for `/models` when the endpoint has no /models route */
-  models?: string[];
-  /** extra request headers (proxies, org ids) — sent on every call to this provider */
-  headers?: Record<string, string>;
-  /** local servers: no key required, the provider counts as configured without one */
-  noKey?: boolean;
-}
-
-export interface ResolvedProvider extends ProviderSpec {
-  keyEnv: string;
-  scope: ProviderScope;
-  apiKey: string | null;
-  keySource: KeySource;
-}
-
-export const BUILTIN_PROVIDERS: readonly ProviderSpec[] = [
-  { id: "kaesra", baseUrl: "https://api.kaesra.tech/v1", protocol: "openai", keyEnv: "KAESRA_API_KEY", defaultModel: "zai-org/glm-5.3-flash" },
-  { id: "openai", baseUrl: "https://api.openai.com/v1", protocol: "openai", keyEnv: "OPENAI_API_KEY" },
-  { id: "anthropic", baseUrl: "https://api.anthropic.com/v1", protocol: "anthropic", keyEnv: "ANTHROPIC_API_KEY", defaultModel: "claude-opus-5" },
-  { id: "deepseek", baseUrl: "https://api.deepseek.com/v1", protocol: "openai", keyEnv: "DEEPSEEK_API_KEY" },
-  { id: "groq", baseUrl: "https://api.groq.com/openai/v1", protocol: "openai", keyEnv: "GROQ_API_KEY" },
-  { id: "openrouter", baseUrl: "https://openrouter.ai/api/v1", protocol: "openai", keyEnv: "OPENROUTER_API_KEY" },
-  { id: "ollama", baseUrl: "http://127.0.0.1:11434/v1", protocol: "openai", keyEnv: "OLLAMA_API_KEY" },
-  { id: "lmstudio", baseUrl: "http://127.0.0.1:1234/v1", protocol: "openai", keyEnv: "LMSTUDIO_API_KEY" },
-  { id: "together", baseUrl: "https://api.together.xyz/v1", protocol: "openai", keyEnv: "TOGETHER_API_KEY" },
-  { id: "mistral", baseUrl: "https://api.mistral.ai/v1", protocol: "openai", keyEnv: "MISTRAL_API_KEY" },
-  { id: "cerebras", baseUrl: "https://api.cerebras.ai/v1", protocol: "openai", keyEnv: "CEREBRAS_API_KEY" },
-  { id: "fireworks", baseUrl: "https://api.fireworks.ai/inference/v1", protocol: "openai", keyEnv: "FIREWORKS_API_KEY" },
-  { id: "perplexity", baseUrl: "https://api.perplexity.ai", protocol: "openai", keyEnv: "PERPLEXITY_API_KEY" },
-  { id: "xai", baseUrl: "https://api.x.ai/v1", protocol: "openai", keyEnv: "XAI_API_KEY" },
-  { id: "moondream", baseUrl: "https://api.moondream.ai/v1", protocol: "openai", keyEnv: "MOONDREAM_API_KEY" },
-  { id: "vllm", baseUrl: "http://127.0.0.1:8000/v1", protocol: "openai", keyEnv: "VLLM_API_KEY" },
-];
-
-// ---------- files ----------
-
-/** one providers.json entry as written: baseUrl required, protocol may be omitted (inferred on read) */
-export interface ProviderEntry extends Partial<Omit<ProviderSpec, "id" | "baseUrl">> { baseUrl: string }
-
-export interface ProvidersFile {
-  default?: string;
-  providers?: Record<string, ProviderEntry>;
-}
-
-export type FileScope = "user" | "project";
-
-export function userProvidersPath(): string { return join(rovecodeHome(), "providers.json"); }
-export function projectProvidersPath(cwd: string): string { return join(cwd, ".rovecode", "providers.json"); }
-export function providersPathFor(scope: FileScope, cwd: string): string {
-  return scope === "project" ? projectProvidersPath(cwd) : userProvidersPath();
-}
-
-/** ids are lowercase slugs — they name env vars (keyNameFor) and appear in "provider/model" selectors */
-export const PROVIDER_ID_RE = /^[a-z0-9][a-z0-9_.-]{0,39}$/;
-const ENV_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
-
-export function inferProtocol(baseUrl: string): ProviderProtocol {
-  return baseUrl.includes("anthropic.com") ? "anthropic" : "openai";
-}
-
-/** Validate one provider entry (file entry or CLI/tool input) into a spec. Pure; never throws. */
-export function validateSpec(id: string, raw: unknown): { spec: ProviderSpec } | { error: string } {
-  if (!PROVIDER_ID_RE.test(id)) return { error: `provider id "${id}" must be a lowercase slug (a-z 0-9 _ . -), at most 40 chars` };
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { error: `provider "${id}": entry must be an object` };
-  const r = raw as Record<string, unknown>;
-  const baseUrl = typeof r["baseUrl"] === "string" ? r["baseUrl"].trim().replace(/\/+$/, "") : "";
-  if (!/^https?:\/\/[^\s/]+/.test(baseUrl)) return { error: `provider "${id}": baseUrl must be an http(s) URL` };
-  const protocol = r["protocol"] === undefined ? inferProtocol(baseUrl) : r["protocol"];
-  if (protocol !== "openai" && protocol !== "anthropic") return { error: `provider "${id}": protocol must be "openai" or "anthropic"` };
-  const spec: ProviderSpec = { id, baseUrl, protocol };
-  if (r["keyEnv"] !== undefined) {
-    if (typeof r["keyEnv"] !== "string" || !ENV_NAME_RE.test(r["keyEnv"])) return { error: `provider "${id}": keyEnv must be an ENV_VAR_NAME` };
-    spec.keyEnv = r["keyEnv"];
-  }
-  if (r["defaultModel"] !== undefined) {
-    if (typeof r["defaultModel"] !== "string" || r["defaultModel"].trim().length === 0) return { error: `provider "${id}": defaultModel must be a non-empty string` };
-    spec.defaultModel = r["defaultModel"].trim();
-  }
-  if (r["models"] !== undefined) {
-    if (!Array.isArray(r["models"]) || !r["models"].every((m) => typeof m === "string" && m.trim().length > 0)) return { error: `provider "${id}": models must be a list of model ids` };
-    spec.models = (r["models"] as string[]).map((m) => m.trim());
-  }
-  if (r["headers"] !== undefined) {
-    const h = r["headers"];
-    if (typeof h !== "object" || h === null || Array.isArray(h) || !Object.values(h as Record<string, unknown>).every((v) => typeof v === "string")) return { error: `provider "${id}": headers must be an object of strings` };
-    spec.headers = { ...(h as Record<string, string>) };
-  }
-  if (r["noKey"] !== undefined) {
-    if (typeof r["noKey"] !== "boolean") return { error: `provider "${id}": noKey must be true or false` };
-    if (r["noKey"]) spec.noKey = true;
-  }
-  return { spec };
-}
-
-/** Read one providers.json: a missing file is {} silently; a corrupt file or a malformed entry is
- *  dropped with a warning, never fatal (auth.ts loadCredentials idiom). */
-export function readProvidersFile(path: string): { data: ProvidersFile; warnings: string[] } {
-  let text: string;
-  try { text = readFileSync(path, "utf8"); } catch { return { data: {}, warnings: [] }; }
-  let parsed: unknown;
-  try { parsed = JSON.parse(text); } catch { return { data: {}, warnings: [`${path}: invalid JSON — ignored`] }; }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { data: {}, warnings: [`${path}: expected an object — ignored`] };
-  const o = parsed as Record<string, unknown>;
-  const data: ProvidersFile = {};
-  const warnings: string[] = [];
-  if (o["default"] !== undefined) {
-    if (typeof o["default"] === "string" && o["default"].trim().length > 0) data.default = o["default"].trim();
-    else warnings.push(`${path}: "default" must be "provider/model" — ignored`);
-  }
-  if (o["providers"] !== undefined) {
-    const p = o["providers"];
-    if (typeof p !== "object" || p === null || Array.isArray(p)) warnings.push(`${path}: "providers" must be an object — ignored`);
-    else {
-      data.providers = {};
-      for (const [id, raw] of Object.entries(p as Record<string, unknown>)) {
-        const v = validateSpec(id, raw);
-        if ("error" in v) { warnings.push(`${path}: ${v.error} — ignored`); continue; }
-        const { id: _id, ...rest } = v.spec;
-        data.providers[id] = rest;
-      }
-    }
-  }
-  return { data, warnings };
-}
-
-export function writeProvidersFile(path: string, data: ProvidersFile): void {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, JSON.stringify(data, null, 2) + "\n");
-}
-
-// ---------- merge ----------
-
-export interface ProviderSnapshot {
-  /** builtins in table order, then file-only providers in file order, then the env "custom" provider */
-  providers: ResolvedProvider[];
-  /** the `default` selector — project file beats user file */
-  defaultSelector?: string;
-  defaultScope?: FileScope;
-  warnings: string[];
-}
-
-export function resolveKey(spec: ProviderSpec, scope: ProviderScope, env: NodeJS.ProcessEnv, creds: Record<string, StoredCredential>): ResolvedProvider {
-  const keyEnv = spec.keyEnv ?? keyNameFor(spec.id);
-  const stored = creds[spec.id]?.key;
-  if (stored !== undefined && stored.trim().length > 0) return { ...spec, keyEnv, scope, apiKey: stored, keySource: "stored" };
-  const fromEnv = env[keyEnv];
-  if (fromEnv !== undefined && fromEnv.trim().length > 0) return { ...spec, keyEnv, scope, apiKey: fromEnv, keySource: "env" };
-  return { ...spec, keyEnv, scope, apiKey: null, keySource: "none" };
-}
-
-/** The ROVECODE_BASE_URL/ROVECODE_API_KEY pair (ROVECODE_API_KEY falls back to OPENAI_API_KEY, as before). */
-export function envCustomProvider(env: NodeJS.ProcessEnv): ResolvedProvider | null {
-  const base = env["ROVECODE_BASE_URL"];
-  const key = env["ROVECODE_API_KEY"] ?? env["OPENAI_API_KEY"];
-  if (!base || !key) return null;
-  return {
-    id: "custom", baseUrl: base, protocol: inferProtocol(base), keyEnv: "ROVECODE_API_KEY", scope: "env", apiKey: key, keySource: "inline",
-    ...(env["ROVECODE_MODEL"] ? { defaultModel: env["ROVECODE_MODEL"] } : {}),
-  };
-}
-
-export function isConfigured(p: ResolvedProvider): boolean {
-  return p.apiKey !== null || p.noKey === true;
-}
-
-export function buildSnapshot(cwd: string, env: NodeJS.ProcessEnv = process.env): ProviderSnapshot {
-  const warnings: string[] = [];
-  const order: string[] = [];
-  const specs = new Map<string, { spec: ProviderSpec; scope: ProviderScope }>();
-  for (const b of BUILTIN_PROVIDERS) { specs.set(b.id, { spec: b, scope: "builtin" }); order.push(b.id); }
-  let defaultSelector: string | undefined;
-  let defaultScope: FileScope | undefined;
-  const layer = (path: string, scope: FileScope): void => {
-    const { data, warnings: w } = readProvidersFile(path);
-    warnings.push(...w);
-    for (const [id, rest] of Object.entries(data.providers ?? {})) {
-      const prev = specs.get(id);
-      specs.set(id, { spec: { ...(prev?.spec ?? {}), ...rest, id } as ProviderSpec, scope });
-      if (prev === undefined) order.push(id);
-    }
-    if (data.default !== undefined) { defaultSelector = data.default; defaultScope = scope; }
-  };
-  layer(userProvidersPath(), "user");
-  layer(projectProvidersPath(cwd), "project");
-  const creds = loadCredentials();
-  const providers = order.map((id) => { const e = specs.get(id)!; return resolveKey(e.spec, e.scope, env, creds); });
-  const custom = envCustomProvider(env);
-  if (custom) providers.push(custom);
-  return { providers, ...(defaultSelector !== undefined ? { defaultSelector, defaultScope } : {}), warnings };
-}
-
-// ---------- selection ----------
-
-export interface Selection { provider: string; model?: string }
-
-/** "provider/model" split on the FIRST slash so model ids keep their own slashes; a bare id is a provider. */
-export function parseSelector(selector: string): Selection {
-  const s = selector.trim();
-  const i = s.indexOf("/");
-  if (i <= 0) return { provider: s };
-  const model = s.slice(i + 1).trim();
-  return model.length > 0 ? { provider: s.slice(0, i), model } : { provider: s.slice(0, i) };
-}
-
-export interface DefaultPick { provider: ResolvedProvider; model?: string; via: "env-pair" | "default" | "stored" | "env-key" | "no-key" }
-
-/** The default provider (+ its model, when one is known WITHOUT env ROVECODE_MODEL — callers layer
- *  that on top): env pair > file `default` (when that provider is configured) > first stored
- *  credential in order > first env key in order > first keyless file provider > null. The first
- *  three ranks are resolveProvider()'s historical precedence, pinned by test/unit/auth.test.ts. */
-export function pickDefault(snap: ProviderSnapshot): DefaultPick | null {
-  const custom = snap.providers.find((p) => p.scope === "env");
-  if (custom) return { provider: custom, model: custom.defaultModel, via: "env-pair" };
-  if (snap.defaultSelector !== undefined) {
-    const sel = parseSelector(snap.defaultSelector);
-    const p = snap.providers.find((x) => x.id === sel.provider);
-    if (p && isConfigured(p)) return { provider: p, model: sel.model ?? p.defaultModel, via: "default" };
-  }
-  const stored = snap.providers.find((p) => p.keySource === "stored");
-  if (stored) return { provider: stored, model: stored.defaultModel, via: "stored" };
-  const fromEnv = snap.providers.find((p) => p.keySource === "env");
-  if (fromEnv) return { provider: fromEnv, model: fromEnv.defaultModel, via: "env-key" };
-  const noKey = snap.providers.find((p) => p.noKey === true);
-  if (noKey) return { provider: noKey, model: noKey.defaultModel, via: "no-key" };
-  return null;
-}
-
-// ---------- live view (hot reload) ----------
-
-export class ProviderConfig {
-  private snap: ProviderSnapshot | null = null;
-  private stamp = "";
-  private checkedAt = -Infinity;
-  private readonly listeners = new Set<(snap: ProviderSnapshot) => void>();
-
-  constructor(
-    private readonly cwd: string,
-    private readonly env: NodeJS.ProcessEnv = process.env,
-    private readonly throttleMs = 250,
-  ) {}
-
-  /** the files whose mtime/size drive reloads */
-  sourcePaths(): string[] { return [userProvidersPath(), projectProvidersPath(this.cwd), credentialsPath()]; }
-
-  private stampNow(): string {
-    return this.sourcePaths().map((p) => { try { const s = statSync(p); return `${s.mtimeMs}:${s.size}`; } catch { return "-"; } }).join("|");
-  }
-
-  /** Current merged view. Re-reads when a source file changed (checked at most every throttleMs);
-   *  listeners fire on every rebuild after the first. */
-  snapshot(): ProviderSnapshot {
-    const now = Date.now();
-    if (this.snap !== null && now - this.checkedAt < this.throttleMs) return this.snap;
-    this.checkedAt = now;
-    const stamp = this.stampNow();
-    if (this.snap === null || stamp !== this.stamp) {
-      const first = this.snap === null;
-      this.stamp = stamp;
-      this.snap = buildSnapshot(this.cwd, this.env);
-      if (!first) for (const cb of this.listeners) cb(this.snap);
-    }
-    return this.snap;
-  }
-
-  /** Force a re-read on the next snapshot() (in-process writers call this right after writing). */
-  invalidate(): void { this.checkedAt = -Infinity; this.stamp = ""; }
-
-  onChange(cb: (snap: ProviderSnapshot) => void): () => void {
-    this.listeners.add(cb);
-    return () => { this.listeners.delete(cb); };
-  }
-}

package/src/providers/registry.ts

@@ -1,333 +0,0 @@
-/** Live provider registry — the ADAPTER half of the provider layer, over provider-config.ts (data).
- *
- *  One registry per runtime. stream() returns a DISPATCHING StreamFn: every call resolves
- *  `model.provider` against the live snapshot (hot reload — provider-config.ts), so a provider added
- *  from another terminal, by `rovecode provider add`, by `/provider add` in the TUI or by the agent's
- *  provider_edit tool serves the very next model call. No restart, no runtime rebuild. Concrete
- *  adapters (stream.ts) are cached per provider id and rebuilt when baseUrl, protocol, key or
- *  headers change — a rotated key takes effect on the next call too.
- *
- *  Seam contract (ADR-003): the dispatcher never throws. An unknown provider or a missing key is ONE
- *  error turn whose text starts with `config: ` — router.ts classifyStreamError treats that prefix
- *  as non-retryable, so neither the same-model retry (port #23) nor a fallback chain (port #14)
- *  spins on a configuration mistake; the text tells the human exactly how to fix it.
- *
- *  Because the dispatcher honours model.provider per call, cross-provider fallback chains
- *  (ROVECODE_MODEL_<ROLE>=a/x,b/y) now really route each candidate to its own endpoint.
- *
- *  Secrets: this module reads keys to build adapters and to redact them from probe errors
- *  (scrubSecret). Nothing here prints or returns a key; formatProviderList shows key SOURCES. */
-
-import type { AssistantTurn, Message, ModelRef, StreamEvent, StreamFn, StreamOptions } from "../core/types.ts";
-import { fetchModels, providerStream, providerStreaming, wantsStreaming, type ProviderConfig as WireProviderConfig } from "./stream.ts";
-import {
-  ProviderConfig, isConfigured, parseSelector, pickDefault, providersPathFor, readProvidersFile, validateSpec, writeProvidersFile,
-  type FileScope, type ProviderEntry, type ProviderSnapshot, type ProviderSpec, type ResolvedProvider,
-} from "./provider-config.ts";
-import { next } from "../core/voice.ts";
-
-export type AdapterFactory = (p: ResolvedProvider, opts: { sse: boolean }) => StreamFn;
-
-/** stream.ts ProviderConfig for a resolved provider (a keyless provider sends an empty bearer). */
-export function toWireConfig(p: ResolvedProvider): WireProviderConfig {
-  return {
-    id: p.id, baseUrl: p.baseUrl, apiKey: p.apiKey ?? "", protocol: p.protocol,
-    ...(p.defaultModel !== undefined ? { defaultModel: p.defaultModel } : {}),
-    ...(p.headers !== undefined ? { headers: p.headers } : {}),
-  };
-}
-
-export const defaultAdapterFactory: AdapterFactory = (p, { sse }) => {
-  const wire = toWireConfig(p);
-  // both protocols stream (openai SSE chunks, anthropic Messages events); `sse` is off only when
-  // ROVECODE_STREAM asked for the one-shot JSON adapters
-  return sse ? providerStreaming(wire) : providerStream(wire);
-};
-
-/** Error-text prefix the router/retry classifier treats as non-retryable (router.ts). */
-export const CONFIG_ERROR_PREFIX = "config: ";
-
-export function configErrorTurn(text: string): AssistantTurn {
-  return { parts: [], stopReason: "error", usage: { input: 0, output: 0 }, error: CONFIG_ERROR_PREFIX + text };
-}
-
-/** Replace a secret wherever it leaked into text (some proxies echo request headers in error bodies). */
-export function scrubSecret(text: string, secret: string | null | undefined): string {
-  return secret !== null && secret !== undefined && secret.length > 0 ? text.split(secret).join("…") : text;
-}
-
-export interface RegistryOptions {
-  env?: NodeJS.ProcessEnv;
-  /** test seam: build adapters without touching the network */
-  adapterFactory?: AdapterFactory;
-  /** provider-config.ts reload throttle (ms); tests pass 0 */
-  throttleMs?: number;
-}
-
-export class ProviderRegistry {
-  readonly cwd: string;
-  private readonly env: NodeJS.ProcessEnv;
-  private readonly cfg: ProviderConfig;
-  private readonly factory: AdapterFactory;
-  private readonly adapters = new Map<string, { sig: string; fn: StreamFn }>();
-
-  constructor(cwd: string, opts: RegistryOptions = {}) {
-    this.cwd = cwd;
-    this.env = opts.env ?? process.env;
-    this.factory = opts.adapterFactory ?? defaultAdapterFactory;
-    this.cfg = new ProviderConfig(cwd, this.env, opts.throttleMs);
-  }
-
-  snapshot(): ProviderSnapshot { return this.cfg.snapshot(); }
-  list(): ResolvedProvider[] { return this.snapshot().providers; }
-  ids(): string[] { return this.list().map((p) => p.id); }
-  get(id: string): ResolvedProvider | undefined { return this.list().find((p) => p.id === id); }
-  /** at least one provider has a key (or needs none) */
-  configured(): boolean { return this.list().some(isConfigured); }
-  warnings(): string[] { return this.snapshot().warnings; }
-  /** fires after every rebuild: external file edits (detected lazily) and in-process add/remove/setDefault */
-  onChange(cb: (snap: ProviderSnapshot) => void): () => void { return this.cfg.onChange(cb); }
-  /** re-read now (in-process writers call it right after writing) and notify listeners */
-  refresh(): ProviderSnapshot { this.cfg.invalidate(); return this.cfg.snapshot(); }
-
-  /** default provider + model with env ROVECODE_MODEL layered on top; null when nothing is configured */
-  defaultRef(): ModelRef | null {
-    const d = pickDefault(this.snapshot());
-    if (d === null) return null;
-    return { provider: d.provider.id, model: this.env["ROVECODE_MODEL"] ?? d.model ?? "" };
-  }
-
-  /** stream.ts-shaped config of the default provider (Runtime.provider compatibility) */
-  defaultConfig(): WireProviderConfig | null {
-    const d = pickDefault(this.snapshot());
-    if (d === null) return null;
-    return { ...toWireConfig(d.provider), ...(d.model !== undefined ? { defaultModel: d.model } : {}) };
-  }
-
-  defaultSelector(): string | undefined { return this.snapshot().defaultSelector; }
-
-  /** "provider/model" or a bare model on `currentProvider`. A leading segment counts as a provider
-   *  only when it names one, so "zai-org/glm-5.3" stays a model id on the current provider. The
-   *  current provider is not validated (it may be "mock" or an injected test stream): a bare model
-   *  always lands there, exactly as `/model <id>` always did. */
-  resolveSelector(selector: string, currentProvider: string): ModelRef | { error: string } {
-    const s = selector.trim();
-    if (s.length === 0) return { error: "empty model selector" };
-    const i = s.indexOf("/");
-    if (i > 0) {
-      const head = s.slice(0, i);
-      const tail = s.slice(i + 1).trim();
-      if (this.get(head) !== undefined) return tail.length > 0 ? { provider: head, model: tail } : { error: `"${s}" names no model — use ${head}/<model>` };
-    }
-    return { provider: currentProvider, model: s };
-  }
-
-  add(spec: ProviderSpec, scope: FileScope = "user"): ResolvedProvider | { error: string } {
-    const { id, ...raw } = spec;
-    const v = validateSpec(id, raw);
-    if ("error" in v) return v;
-    if (this.get(id)?.scope === "env") return { error: `"custom" is reserved for the ROVECODE_BASE_URL/ROVECODE_API_KEY pair — pick another id` };
-    const path = providersPathFor(scope, this.cwd);
-    const { data } = readProvidersFile(path);
-    const { id: _id, ...rest } = v.spec;
-    data.providers = { ...(data.providers ?? {}), [id]: rest };
-    writeProvidersFile(path, data);
-    this.refresh();
-    return this.get(id)!;
-  }
-
-  remove(id: string): { removed: FileScope[] } | { error: string } {
-    const p = this.get(id);
-    if (p === undefined) return { error: `unknown provider "${id}" — known: ${this.ids().join(" ")}` };
-    if (p.scope === "builtin") return { error: `"${id}" is built in; drop its key with \`rovecode auth remove ${id}\` instead` };
-    if (p.scope === "env") return { error: `"custom" comes from ROVECODE_BASE_URL/ROVECODE_API_KEY — unset those env vars` };
-    const removed: FileScope[] = [];
-    for (const scope of ["user", "project"] as const) {
-      const path = providersPathFor(scope, this.cwd);
-      const { data } = readProvidersFile(path);
-      if (data.providers !== undefined && id in data.providers) {
-        delete data.providers[id];
-        if (Object.keys(data.providers).length === 0) delete data.providers;
-        writeProvidersFile(path, data);
-        removed.push(scope);
-      }
-    }
-    this.refresh();
-    return { removed };
-  }
-
-  setDefault(selector: string, scope: FileScope = "user"): ModelRef | { error: string } {
-    const sel = parseSelector(selector);
-    const p = this.get(sel.provider);
-    if (p === undefined) return { error: `unknown provider "${sel.provider}" — known: ${this.ids().join(" ")}` };
-    const model = sel.model ?? p.defaultModel;
-    if (model === undefined) return { error: `"${selector}" names no model and ${p.id} has no default — use ${p.id}/<model>` };
-    const path = providersPathFor(scope, this.cwd);
-    const { data } = readProvidersFile(path);
-    data.default = `${p.id}/${model}`;
-    writeProvidersFile(path, data);
-    this.refresh();
-    return { provider: p.id, model };
-  }
-
-  /** pin a provider's ACTIVE model list (the connect wizard's model step): writes `models` on the
-   *  provider's row in the scope's file — creating the row for a builtin, which is how `add` works
-   *  too. An EMPTY list removes the field: the provider goes back to asking its /models endpoint
-   *  every time (the "use them all" answer — nothing frozen). Returns the written list. */
-  setModels(id: string, models: readonly string[], scope: FileScope = "user"): { models: string[] } | { error: string } {
-    const p = this.get(id);
-    if (p === undefined) return { error: `unknown provider "${id}" — known: ${this.ids().join(" ")}` };
-    if (p.scope === "env") return { error: `"custom" comes from ROVECODE_BASE_URL/ROVECODE_API_KEY — a model list cannot be pinned on it` };
-    for (const m of models) if (m.trim().length === 0) return { error: "model ids must be non-empty strings" };
-    const path = providersPathFor(scope, this.cwd);
-    const { data } = readProvidersFile(path);
-    const rows = data.providers ?? {};
-    const existing = rows[id];
-    // a builtin with no file row yet carries its baseUrl in the spec — the new row must too
-    const row: ProviderEntry = existing ?? { baseUrl: p.baseUrl };
-    const deduped = [...new Set(models.map((m) => m.trim()))];
-    if (deduped.length === 0) {
-      delete row.models;
-    } else {
-      row.models = deduped;
-      // a pinned list that does not contain the current default silently breaks the default —
-      // keep the field only when it still names a usable model
-      if (row.defaultModel !== undefined && !deduped.includes(row.defaultModel)) delete row.defaultModel;
-    }
-    rows[id] = row;
-    data.providers = rows;
-    writeProvidersFile(path, data);
-    this.refresh();
-    return { models: deduped };
-  }
-
-  keyHint(p: ResolvedProvider): string {
-    return `no API key for provider "${p.id}" — I can't call it without one. ${next(`rovecode auth set ${p.id}`)} (masked prompt) · or /provider key ${p.id} <key> in the TUI · or set ${p.keyEnv}`;
-  }
-
-  async models(id: string): Promise<{ ok: true; models: string[]; source: "file" | "endpoint" } | { ok: false; error: string }> {
-    const p = this.get(id);
-    if (p === undefined) return { ok: false, error: `unknown provider "${id}" — known: ${this.ids().join(" ")}` };
-    if (p.models !== undefined && p.models.length > 0) return { ok: true, models: p.models, source: "file" };
-    if (!isConfigured(p)) return { ok: false, error: this.keyHint(p) };
-    const list = await fetchModels(toWireConfig(p), true);
-    return { ok: true, models: list.map((m) => m.id), source: "endpoint" };
-  }
-
-  /** One tiny real call ("ping", ≤8 output tokens): proves url + key + model together. */
-  async probe(id: string, model?: string): Promise<{ ok: boolean; model: string; detail: string }> {
-    const p = this.get(id);
-    if (p === undefined) return { ok: false, model: model ?? "", detail: `unknown provider "${id}" — known: ${this.ids().join(" ")}` };
-    if (!isConfigured(p)) return { ok: false, model: model ?? "", detail: this.keyHint(p) };
-    const m = model ?? p.defaultModel;
-    if (m === undefined) return { ok: false, model: "", detail: `${p.id} has no default model — pass one: test ${p.id} <model>` };
-    const probeMsg: Message = { id: "probe", role: "user", parts: [{ kind: "text", text: "ping" }], parentId: null, createdAt: Date.now() };
-    const t0 = Date.now();
-    let turn: AssistantTurn | undefined;
-    try {
-      for await (const ev of this.adapterFor(p)({ provider: p.id, model: m, maxTokens: 8 }, [probeMsg], { tools: [] })) if (ev.type === "turn") turn = ev.turn;
-    } catch (e) {
-      return { ok: false, model: m, detail: scrubSecret(e instanceof Error ? e.message : String(e), p.apiKey) };
-    }
-    if (turn === undefined) return { ok: false, model: m, detail: "stream produced no turn" };
-    if (turn.stopReason === "error") return { ok: false, model: m, detail: scrubSecret(turn.error ?? "stream error", p.apiKey) };
-    return { ok: true, model: m, detail: `ok in ${Date.now() - t0} ms (${turn.usage.input} in / ${turn.usage.output} out tokens)` };
-  }
-
-  /** The dispatching StreamFn (see the header). */
-  stream(): StreamFn {
-    const self = this;
-    return async function* (model: ModelRef, messages: Message[], options?: StreamOptions): AsyncGenerator<StreamEvent> {
-      const p = self.get(model.provider);
-      if (p === undefined) {
-        yield { type: "turn", turn: configErrorTurn(`provider "${model.provider}" is not configured — I can't route to it. ${next(`rovecode provider add ${model.provider} <baseUrl> [--protocol openai|anthropic]`)} (or /provider add in the TUI); known: ${self.ids().join(" ")}`) };
-        return;
-      }
-      if (!isConfigured(p)) { yield { type: "turn", turn: configErrorTurn(self.keyHint(p)) }; return; }
-      yield* self.adapterFor(p)(model, messages, options);
-    };
-  }
-
-  private adapterFor(p: ResolvedProvider): StreamFn {
-    const sse = wantsStreaming({ ROVECODE_STREAM: this.env["ROVECODE_STREAM"] }); // default ON
-    const sig = [p.baseUrl, p.protocol, p.apiKey ?? "", JSON.stringify(p.headers ?? {}), sse ? "sse" : "json"].join("\u0000");
-    const hit = this.adapters.get(p.id);
-    if (hit !== undefined && hit.sig === sig) return hit.fn;
-    const fn = this.factory(p, { sse });
-    this.adapters.set(p.id, { sig, fn });
-    return fn;
-  }
-}
-
-// ---------- shared CLI / TUI helpers ----------
-
-export const ADD_USAGE = "add <id> <baseUrl> [--protocol openai|anthropic] [--key-env NAME] [--model <id>] [--no-key] [--project]";
-
-export interface AddArgs { spec: ProviderSpec; scope: FileScope; promptKey: boolean }
-
-/** Parse `add` words (CLI argv tail or TUI slash args) into a validated spec + scope. `--key` (CLI:
- *  prompt for the secret afterwards) is recorded, never a value. Pure; never throws. */
-export function parseAddArgs(words: readonly string[]): AddArgs | { error: string } {
-  const pos: string[] = [];
-  const raw: Record<string, unknown> = {};
-  let scope: FileScope = "user";
-  let promptKey = false;
-  for (let i = 0; i < words.length; i++) {
-    const w = words[i]!;
-    const value = (): string | { error: string } => {
-      const v = words[i + 1];
-      if (v === undefined || v.startsWith("-")) return { error: `${w} needs a value — ${ADD_USAGE}` };
-      i++;
-      return v;
-    };
-    switch (w) {
-      case "--protocol": { const v = value(); if (typeof v !== "string") return v; raw["protocol"] = v; break; }
-      case "--key-env": { const v = value(); if (typeof v !== "string") return v; raw["keyEnv"] = v; break; }
-      case "--model": { const v = value(); if (typeof v !== "string") return v; raw["defaultModel"] = v; break; }
-      case "--scope": {
-        const v = value(); if (typeof v !== "string") return v;
-        if (v !== "user" && v !== "project") return { error: "--scope must be user or project" };
-        scope = v; break;
-      }
-      case "--project": scope = "project"; break;
-      case "--user": scope = "user"; break;
-      case "--no-key": raw["noKey"] = true; break;
-      case "--key": promptKey = true; break;
-      default:
-        if (w.startsWith("-")) return { error: `unknown flag ${w} — ${ADD_USAGE}` };
-        pos.push(w);
-    }
-  }
-  const [id, baseUrl] = pos;
-  if (id === undefined || baseUrl === undefined) return { error: `usage: ${ADD_USAGE}` };
-  raw["baseUrl"] = baseUrl;
-  const v = validateSpec(id, raw);
-  if ("error" in v) return v;
-  return { spec: v.spec, scope, promptKey };
-}
-
-/** One row per provider — key SOURCE only, never the value. */
-export function formatProviderLine(p: ResolvedProvider): string {
-  const key = p.keySource === "stored" ? "key: stored"
-    : p.keySource === "env" ? `key: env ${p.keyEnv}`
-    : p.keySource === "inline" ? "key: ROVECODE_API_KEY"
-    : p.noKey === true ? "key: not needed"
-    : `key: NONE (rovecode auth set ${p.id} · or set ${p.keyEnv})`;
-  return `${p.id.padEnd(12)} ${p.protocol.padEnd(9)} ${p.baseUrl.padEnd(40)} ${key}${p.defaultModel !== undefined ? `  model: ${p.defaultModel}` : ""}  [${p.scope}]`;
-}
-
-/** Listing for `rovecode provider list`, `/provider list` and the provider_list tool. Built-in providers
- *  without a key are folded into a count unless `all` — sixteen dead rows hide the live ones. */
-export function formatProviderList(reg: ProviderRegistry, opts: { all?: boolean } = {}): string {
-  const d = reg.defaultRef();
-  const all = reg.list();
-  const rows = all.filter((p) => opts.all === true || isConfigured(p) || p.scope !== "builtin");
-  const lines = [d !== null
-    ? `default → ${d.provider}/${d.model || "(no model — pass one with /model or ROVECODE_MODEL)"}${reg.defaultSelector() !== undefined ? `  (providers.json default: ${reg.defaultSelector()})` : ""}`
-    : `default → none yet. ${next("rovecode setup")} (or rovecode provider add <id> <baseUrl>, then rovecode auth set <id>)`];
-  lines.push(...rows.map(formatProviderLine));
-  const hidden = all.length - rows.length;
-  if (hidden > 0) lines.push(`(+${hidden} built-in providers without a key — \`list --all\` shows them)`);
-  lines.push(...reg.warnings().map((w) => `warning: ${w}`));
-  return lines.join("\n");
-}