feat(providers): discover generic harness model catalogs

[HamedMP]

Summary

• discover bounded live provider/model catalogs from Pi and OpenCode
• let generic harnesses select the providers and models their runtime exposes
• present Matrix AI, owner keys, and harness profiles under Paid through
• enforce one runnable-route predicate across Settings, mutations, Chat, and execution
• update the provider parity contract, spec, verification notes, and regression coverage

Restack cleanup

This PR is now one commit directly on current main. The provider foundation,
funded gateway, Chat runtime integration, Canvas restoration, and other work
already shipped by #1493 / bundle 1144 are no longer part of this PR's ancestry
or diff. The remaining delta is only live generic-harness catalog discovery and
the contract/UI wiring required to use it safely.

UX model

The route is presented as:

Harness → Model → Paid through

Anthropic, OpenAI, Baseten, OpenCode, Z.AI, and other discovered vendors are
model providers. Matrix AI is an access and billing source for eligible models;
it is intentionally not listed as a model provider.

Pi and OpenCode authentication remains owned by each CLI profile under the
owner HOME. Matrix does not copy those credentials or inject platform/provider
secrets into harness-native runs.

Invariants

• Source of truth: the installed Pi/OpenCode CLI catalog is authoritative
  for harness-native providers and models; ProviderSettingsSnapshot is the
  sole renderer projection.
• Lock/transaction scope: owner configuration mutations remain serialized
  by ProviderSettingsStore; discovery is read-only, bounded, cached for one
  minute, and bypassed by explicit Settings refresh.
• Acceptable orphan states: a failed, empty, timed-out, or oversized catalog
  marks only that harness's saved route catalog_unavailable. The instance
  remains visible and editable even if the bounded selectable catalog is full,
  while Chat and execution fail closed until discovery recovers.
• Auth source of truth: Pi/OpenCode own native profiles under owner HOME.
  Matrix-funded and owner-key routes retain their existing exact credential
  resolver; no native-profile secret is persisted in provider settings.
• Deferred scope: searchable/favorited model pickers, multiple named native
  CLI profiles, provider balance ingestion, broader Pi/OpenCode permission
  modes, and Matrix funding for models outside the relay allowlist.

Safety bounds

• 5-second command timeout
• 256 KiB output limit
• allowlisted child environment
• 256 models per harness/provider, 24 discovered providers, 60-second cache
• safe identifier parsing and provider-neutral client errors

Validation

• 168 focused contract, gateway, shell, and UI tests passed
• full repository TypeScript check passed
• changed-diff pattern scan passed with 0 violations
• git diff --check passed
• production Web Desktop compiled and passed TypeScript; local prerender then
  stopped because this checkout has no Clerk publishable key, which CI supplies
• live Pi 0.81.0 and OpenCode 1.16.0 catalog verification from the prior exact
  feature head remains applicable; the catalog implementation was preserved by
  the range-diff during restack

Review / monitoring

• Graphite parent: main
• latest Greptile and CI must rerun against the rewritten head before merge
• no merge automation is enabled

[HamedMP]

• feat(providers): discover generic harness model catalogs #1502 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR adds bounded live Pi and OpenCode provider/model discovery and projects harness-native authentication through the shared provider-settings contract.

• Adds cached, bounded CLI catalog discovery and explicit refresh support.
• Introduces harness-profile access sources and a shared runnable-route predicate across configuration, Chat, and execution.
• Preserves failed catalog routes as visible, disabled catalog_unavailable harness instances.
• Updates Settings controls, transport contracts, documentation, and regression coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/gateway/src/ai-providers/generic-harness-model-catalog.ts	Adds bounded, cached discovery and projection of Pi and OpenCode model catalogs.
packages/gateway/src/ai-providers/provider-settings-projector.ts	Merges discovered catalogs and retains failed saved routes as visible, fail-closed harness instances.
packages/contracts/src/provider-settings.ts	Extends provider-setting contracts with harness-profile sources, route availability, and shared runnable-route predicates.
packages/gateway/src/chat/provider-catalog.ts	Allows discovered models in Chat while continuing to reject disabled or non-runnable harness routes.
packages/gateway/src/coding-agents/harness-credentials.ts	Supports harness-owned profiles without injecting Matrix or provider credentials into child environments.
packages/ui/src/agents-providers/HarnessEditor.tsx	Presents discovered model and payment-source choices while keeping unavailable saved routes editable.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  CLI[Pi / OpenCode CLI] --> Discovery[Bounded catalog discovery]
  Discovery --> Store[ProviderSettingsStore]
  Store --> Snapshot[ProviderSettingsSnapshot]
  Snapshot --> Settings[Settings UI]
  Snapshot --> Chat[Chat catalog]
  Snapshot --> Execution[Harness execution]
  Discovery -- failed or empty --> Offline[catalog_unavailable]
  Offline --> Settings
  Offline -. blocked .-> Chat
  Offline -. blocked .-> Execution

Loading

_{Reviews (6): Last reviewed commit: "feat(providers): discover generic harnes..." | Re-trigger Greptile}

[HamedMP]

@greptile review

[HamedMP]

@greptile review

[HamedMP]

@greptile review

[HamedMP]

@greptile review

[HamedMP]

@greptile review