Harden model/provider switching against non-canonical provider identities

[OpenCodeEngineer]

Problem

We shipped a regression because model/provider switching logic assumed provider identity was stable across all layers. In practice these are different identifiers:

• config key, for example model_provider = "azure"
• human-readable provider name, for example name = "Azure OpenAI"
• upstream catalog/provider ID, for example azure in models.dev

That led to two concrete failures:

1. Azure model discovery broke when the configured provider name was Azure OpenAI instead of matching the upstream azure catalog entry directly.
2. Copilot model switching broke because config rebuild paths did not preserve the active profile during in-session provider switching.

Scope

Add process/test guardrails so this class of bug is harder to reintroduce.

Acceptance Criteria

• Document that provider identity must be treated as three separate concepts: config key, provider display name, and upstream catalog/provider ID.
• Require regression coverage for ModelsManager, aliasing, models.dev, or provider /models changes using a non-canonical provider name and a non-canonical host.
• Explicit minimum regression case: name = "Azure OpenAI" must still resolve to the azure catalog entry even when the base URL is a proxy/localhost URL.
• Require regression coverage that config rebuild, cwd/profile switching, and /model switching preserve active_profile, model_provider_id, and model unless intentionally reset.
• Require provider-backed catalog tests to cover both picker population and post-selection execution, not just discovery.
• Require diagnosis guidance to inspect effective config and persisted auth before blaming missing environment variables.

Notes

This is process hardening informed by the Azure/Copilot regression fixed in issue #12.

[OpenCodeEngineer]

Started work on this. Pushed branch issue-21-provider-identity-guardrails with the AGENTS/process hardening changes and opened a PR linked to this issue.

[OpenCodeEngineer]

Correction: the branch is pushed, but PR creation through the GitHub MCP failed because that identity is not a collaborator on the repo. Creating the PR via gh instead so the issue still gets a linked PR.

[OpenCodeEngineer]

PR is up: #23 (docs: harden model/provider switching guardrails). This PR contains the AGENTS/process hardening changes only.

[OpenCodeEngineer]

Implemented and pushed the actual Rust fix on branch issue-21-provider-identity-guardrails in commit a725e6b1c.

What landed:

• ModelsManager now treats provider identity aliases explicitly, so name = "Azure OpenAI" still resolves to the azure models.dev provider even when the base URL is a proxy/localhost host.
• config rebuild now preserves active_profile, which keeps Copilot /model switching pinned to the selected provider/model instead of silently rebuilding against the wrong provider.
• the real TUI /model E2E harness now tolerates partial accepted sockets, which fixed the PTY-path regression test instability that showed up during validation.

Validated locally with:

• cargo test -p codex-core models_dev_provider_match_accepts_azure_openai_alias -- --nocapture
• cargo test -p codex-tui rebuild_config_for_cwd_preserves_active_profile -- --nocapture
• cargo test -p codex-tui provider_model_presets_for_picker_fetches_copilot_models_for_inactive_provider -- --nocapture
• cargo test -p codex-tui --test all copilot_model_switch_then_prompt_uses_responses_api_without_cli_provider_override -- --nocapture --test-threads=1
• cargo test -p codex-tui --test all model_switching_e2e -- --nocapture --test-threads=1 (10 passed; 0 failed)

Tracking PR: #23