fix(model): /model listed one provider instead of every configured one

[ericleepi314]

Summary

/model step 1 showed a single row — anthropic · 22 models — no matter how many providers were configured.

Root cause. model.options in ui-tui/src/gatewayClient.ts was a stub. It called the get_settings control, which describes only the provider the session is currently on, and synthesized a hardcoded one-element array from it. The 26-entry registry (PROVIDER_INFO — hand-written provider classes plus the data-driven OpenAI-compatible specs) was never enumerated, and no backend control exposed it. The row on screen was the active provider echoed back at itself, which is why its model count exactly matched anthropic's.

The picker's multi-provider UI (○/●/* marks, inline key entry, ^d disconnect) was ported whole but had only ever been fed that one synthetic row, so three paths behind it had never been reachable — and two of them were broken.

Providers (src/providers/catalog.py, new)

• provider_catalog() enumerates the real registry: active provider first, then providers that can authenticate, then the rest alphabetically.
• Credential probing deliberately mirrors get_provider_config's literal lookup, because _do_set_provider resolves the same way. A row reported authenticated here but refused there would be a picker offering a provider you cannot select.
• exclusive_env_vars() splits a provider's key env-vars into owned vs borrowed. The candidate list is a resolution preference, not ownership.

Agent server (src/server/agent_server.py)

• list_model_providers, save_provider_key, disconnect_provider.
• set_model's cross-provider refusal now carries provider_mismatch so the client can re-drive the switch without pattern-matching error prose, and canonicalizes both sides so an alias-named session (--provider glm vs canonical zai) isn't mistaken for a cross-provider switch.

TUI (ui-tui/src/gatewayClient.ts, components/modelPicker.tsx)

• model.options calls the new control; falls back to the old synthesis only on a null reply (old backend / timeout). An explicit refusal is surfaced — papering over it would invent a provider row named clawcodex.
• model.save_key and model.disconnect were never wired and fell through to the adapter's default: case returning {}, so key entry always answered "failed to save key" and ^d silently did nothing.
• Cross-provider selection routes through set_provider, then re-applies the model; on failure it rolls back and reports which provider the session actually ended on.

Safety of the disconnect path

^d deletes credentials, so its blast radius got the most scrutiny:

• Only env-var names a provider owns. nvidia-nim lists DEEPSEEK_API_KEY among its candidates; treating that list as a delete-set would destroy a credential set for DeepSeek. Ownership follows the primary candidate — the mirror-image trap is that naive membership makes DeepSeek itself permanently undisconnectable, since nvidia-nim borrows its name.
• Never a name the live session authenticates through. The active-provider guard compares slugs, so it would otherwise miss a session running on nvidia-nim losing the DEEPSEEK_API_KEY it borrows.
• Contested names are reported, not deleted. siliconflow and siliconflow-cn both lead with SILICONFLOW_API_KEY; neither can claim it.
• A shell export behind a config key is sampled before deletion. delete_secret pops os.environ too, so reading it afterwards would report a clean disconnect the shell undoes on next launch. Presence in the environment alone doesn't imply a shell export — set_secret mirrors config writes into the process — so the value is what separates them.
• save_provider_key reads the existing block from the global tier only. Reading the merged view and writing globally would launder a repo-committable providers.*.base_url into the user's global config, permanently and for every project, paired with the key they just typed.

Test Coverage

New: tests/server/test_model_provider_picker.py (36 tests) and 13 in ui-tui/src/__tests__/gatewayClient.test.ts.

Every fix is mutation-tested: the fix is reverted and the intended test confirmed to fail. That includes the shared-env delete-set, the ownership rule in both directions, the raw string compare, the merged-config read, the shell-export predicate, the live-session skip, the fallback gate, and the rollback.

Pre-Landing Review

Reviewed by the critic subagent over two rounds: 2 blocking + 5 major, then 2 residual findings, all fixed and independently re-verified against real config files. Final verdict APPROVE.

Two fixes came from checking rather than accepting: the first ownership fix made DeepSeek undisconnectable, and the reviewer's proposed shell-detection predicate would have reported "your shell exports this" for every ordinary config key.

Known limitation

When no provider is configured the session fails to start, and the init_error guard short-circuits every control — including this one — so the picker can't yet be used to paste a first key. It now reports that reason instead of inventing a provider row. Widening that guard is security-adjacent (it stops /bg spawning subprocesses unsandboxed under a sandbox hard-gate refusal) and is left as follow-up.

Also follow-up: save_provider_key has no active-provider guard, and the disconnect guard is per-session — single_session is stdio-only, so on the --http transport one session could disconnect another's provider. Unreachable from the TUI.

Design Review

No visual changes beyond picker copy: the key-entry stage now names where the key is written (providers.<slug>.api_key), the disconnect confirm screen lists the env vars it will clear, and the old fallback text pointed at a nonexistent clawcodex model command.

Merge note

Merged origin/main (fusion models, #771). Two conflicts, both resolved by keeping both sides. Main made model.options fusion-aware — a fused session reports the base id in model and the fusion name separately, and the picker's current marker must follow the fusion name — so that rule is carried into both new paths and list_model_providers reports fusion alongside model. fusionModel.test.ts answered get_settings directly, which the client no longer calls first; it now targets the new control, with added coverage for the same rule on the fallback path.

TODOS

No TODO items completed in this PR.

Documentation

Documentation is current — no updates needed. Docs reference /model only in historical release notes, and docs/agent-server.md lists control subtypes illustratively (it already omits set_provider, compact, rewind).

Test plan

• Python suite: 9266 passed, 3 skipped, 0 failed
• ui-tui suite: 1605 passed, 8 failed — diffed identical to the pre-existing baseline on main
• Live end-to-end against the real agent-server over stdio: 26 providers returned, ordered and marked correctly; active-provider disconnect refused

🤖 Generated with Claude Code

[github-actions]

Test Results

    1 files      1 suites   7m 46s ⏱️
9 269 tests 9 263 ✅ 6 💤 0 ❌
9 515 runs  9 509 ✅ 6 💤 0 ❌

Results for commit 74f50ed.