Greptile Summary

This PR fixes two related bugs in the provider-scoped model picker flow: (1) resolveConfiguredProviderFromAuthChange now correctly prioritizes preferredProvider over any single-configured-model provider, preventing the scope from reverting to a pre-existing provider (e.g. Ollama) when the user authenticates with a different one (e.g. GitHub Copilot); and (2) applyAuthChoiceLoadedPluginProvider now enables the owning plugin for manifest-based auth choices (not just install-catalog entries) before resolving its provider runtime. Both fixes are covered by the new test cases.

Confidence Score: 5/5

This PR is safe to merge — targeted bug fixes with direct test coverage and no side effects on unrelated paths.

Both changes are narrowly scoped, have clear before/after test coverage, and the logic has been traced end-to-end. No P0 or P1 issues were found.

No files require special attention.

_{Reviews (1): Last reviewed commit: "test(configure): cover provider-scoped c..." | Re-trigger Greptile}

Codex review: needs maintainer review before merge.

What this changes:

The PR changes configure auth/provider selection and provider-auth application so provider-scoped model prompts stay on the selected provider and manifest auth choices enable their owning plugin, with targeted regression tests.

Maintainer follow-up before merge:

Keep this PR open for maintainer review. If accepted, land a narrow version that preserves selected provider precedence over stale single configured providers, enables the selected manifest provider plugin through existing enablePluginInConfig semantics, and keeps the targeted auth-choice/configure regression tests.

Best possible solution:

Keep this PR open for maintainer review. If accepted, land a narrow version that preserves selected provider precedence over stale single configured providers, enables the selected manifest provider plugin through existing enablePluginInConfig semantics, and keeps the targeted auth-choice/configure regression tests.

Acceptance criteria:

• pnpm test src/commands/auth-choice.test.ts src/commands/configure.gateway-auth.prompt-auth-config.test.ts

What I checked:

• Protected label: The provided GitHub context lists maintainer on this PR; repository cleanup policy keeps protected-label items open for explicit maintainer handling. (876883897d74)
• Current main provider-scope behavior: On current main, resolveConfiguredProviderFromAuthChange still returns the sole configured provider before falling back to preferredProvider, which can move the post-auth model allowlist prompt back to an existing provider such as Ollama instead of the selected manifest provider. (src/commands/configure.gateway-auth.ts:127, 64bd2a2cbe80)
• Current main manifest-plugin enablement: On current main, applyAuthChoiceLoadedPluginProvider only calls enablePluginInConfig for installCatalogEntry; a manifest auth choice can be scoped to a plugin without enabling that selected owning plugin first. (src/plugins/provider-auth-choice.ts:299, 64bd2a2cbe80)
• Documented configure expectation: The configure docs say provider auth choices should make default-model and allowlist pickers prefer that provider automatically, which matches the behavior this PR is trying to preserve. Public docs: docs/cli/configure.md. (docs/cli/configure.md:16, 64bd2a2cbe80)
• PR diff and security pass: The PR patch changes only two TypeScript implementation files and two Vitest test files; no workflows, dependency manifests, lockfiles, install/build/release scripts, package publishing metadata, generated/vendor files, or new third-party code execution paths are introduced. (876883897d74)
• Feature history: Blame and git history point to recent main work in this exact area: Peter Steinberger introduced the extracted configure/provider-auth-choice flow in 7be65cd, and Ayaan Zaidi recently changed manifest model catalog picker behavior in 1f9fafb. (64bd2a2cbe80)

Likely related people:

• steipete: git blame points the current resolveConfiguredProviderFromAuthChange and applyAuthChoiceLoadedPluginProvider implementations to commit 7be65cd, which introduced the extracted configure/provider-auth-choice files, and 8f6c728 touched adjacent configure tests after merges. (role: introduced current flow and recent maintainer; confidence: high; commits: 7be65cd79801, 8f6c72823e49; files: src/commands/configure.gateway-auth.ts, src/plugins/provider-auth-choice.ts, src/commands/configure.gateway-auth.prompt-auth-config.test.ts)
• obviyus: Ayaan Zaidi authored current-main commit 1f9fafb, which changed manifest model catalog picker behavior in the same configure auth path; this makes the PR author relevant beyond merely opening this PR. (role: recent adjacent maintainer and proposed fixer; confidence: high; commits: 1f9fafb28847; files: src/commands/configure.gateway-auth.ts, src/commands/configure.gateway-auth.prompt-auth-config.test.ts)

Remaining risk / open question:

• The protected maintainer label means automated cleanup should not close or replace this PR without explicit maintainer action.
• Current main still appears to lack at least one proposed behavior, so closing as already implemented would likely discard a valid narrow fix.
• The production change auto-enables selected manifest provider plugins through existing enablement semantics; maintainers should confirm disabled/blocked plugin behavior remains intentional.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 64bd2a2cbe80.

Landed on main.

• Landed source commit: 6a5c4e9
• Merge commit: 75286ef