feat: make the default backend configurable with session.defaultProvider

[saucam]

Closes #339

What this changes

codeoid always put a session on Claude unless the caller named another backend.
An operator who runs only pi, codex or qwen had to pass --provider on every session.

The default is now a setting: session.defaultProvider in config.json, or CODEOID_DEFAULT_PROVIDER.
It sits next to session.defaultModel, which is where the original multi-provider design put it.
The issue proposed a top-level key instead.

{ "session": { "defaultProvider": "pi" } }

It fails loudly instead of quietly

• At startup: a misspelled, disabled or uninstalled default stops the daemon with one line naming the fix, e.g. set providers.geminiCli.enabled to true, or the missing API key.
  It does not fall back to Claude.

• In Settings: a save is refused if the next boot would fail to start.
  The daemon checks the config that boot would load, so it catches:

  • a bad default;
  • disabling the default backend;
  • clearing the default backend's API key;
  • a value that only fails together with an env override.

  If the config is already broken, for example because the default's binary disappeared after an upgrade, unrelated saves still go through, so Settings can still be used to repair it.
  A refusal is shown under the field that caused it.

What else had to change for the default to be safe

• Model checks: four code paths treated "no provider given" as Claude even though the session would run on the default.
  With a pi default, a new pi session was checked against Claude's models, so model: opus was accepted.
  Those paths now use the actual default.
• Old sessions: a session saved before multi-backend support, or one whose backend has since gone, resumes on Claude, not on the new default.
  Moving it to another backend would lose its conversation.
• Queued workers: a worker task queued without a backend is pinned to the backend its model was checked against.
• Telegram /model: it lists the attached session's models, not the default backend's.
• Unchanged: the conductor stays on conductor.provider, because it needs the fleet tools, which only Claude provides today.
  Startup logs which backend is the default.
  The settings help notes that backends gate tool use differently.

Verification

• Tests: 37 new (one obsolete test removed), covering the registry, config, settings, resume, dispatch, Telegram and collaboration resume.
  Each one fails when its fix is reverted, checked by temporarily reverting each fix.

• Suites:

  • daemon: bun test 2656 pass, 0 fail;
  • web: 571 pass;
  • typecheck and lint clean.

• Live run of a real daemon from this branch with an isolated config:

  • A misspelled default in config.json: the daemon exited 1 with the one-line error.
  • CODEOID_DEFAULT_PROVIDER=codex:
    • codex was listed first;
    • models.list served codex;
    • a provider-less session landed on codex and answered a real turn;
    • model: opus was refused for codex;
    • a pre-upgrade session resumed on Claude;
    • Settings refused claud and accepted codex.

• Audit: four rounds, each a correctness review plus a security review.

  • Round 1: ship with fixes, security GO.
  • Round 2: ship with fixes, security GO.
  • Round 3: ship, security GO.
  • Round 4: ship with one fix, security GO.
  • Final audit of the whole diff: ship; its one stale doc line is fixed.

  Every finding was fixed in this branch, except the one below.

• Not run: the Highflame regression suite, because codeoid isn't part of it.
  The live run above stands in for it.

• Known gap, left as a follow-up:

  • The trigger is an env override (CODEOID_DEFAULT_PROVIDER) that masks the operator's own config.json default, while a save disables the backend config.json names.
  • That save goes through, and a boot without the override would then fail.
  • Closing it would double the check's complexity for a setup the operator created on purpose.

For agents: where the code is

• src/config.ts:
  • SessionSchema.defaultProvider (trimmed, non-empty) and DEFAULT_PROVIDER_ENV.
  • loadConfig({ raw, quiet }) loads an in-memory config for previews.
• src/daemon/providers/registry.ts:
  • createDefaultProviderRegistry(config, env = process.env) takes the default from config and its env as a parameter, for dry runs.
  • It throws DefaultProviderError after registration.
  • defaultProviderProblem() has an id-to-config-key map for "disabled" hints.
• src/cli.ts: catches only DefaultProviderError, prints one line and exits 1.
• src/daemon/session-manager.ts:
  • DEFAULT_PROVIDER_ID (always Claude) is removed. "No provider" sites (models.list, create model validation, pack-role validation, dispatch resolveBackend) use #providers.defaultId. Claude-specific sites (the fallback catalog, the conductor) use CLAUDE_PROVIDER_ID.
  • #resumeProviderId: a missing or unregistered persisted provider becomes claude. It is used for both the Session and #resumeRoleChild, and the planned model is dropped when the backend differs.
  • #nextBootProblem / #bootProblem / #culpritKey: the settings next-boot check. It runs on every batch using previewPatches + loadConfig({raw, env}) + a registry build.
    • A batch that sets the default is always checked without the env override.
    • Everything else follows the before/after rule.
    • A refusal is audited as reason=next-boot.
• src/daemon/settings/store.ts: previewPatches() merges patches onto config.json and a copy of process.env without writing.
• src/frontends/telegram/index.ts: /model passes the attached session's provider.
• Tests:
  • src/tests/default-provider.test.ts (new): manager level, with a real registry and mock factories.
  • Also provider-registry, config, models, telegram-flows and collaboration.

🤖 Generated with Claude Code

[saucam]

@highflame-oracle review