Rename the subscription providers to chatgpt-subscription and anthropic-subscription

[code-yeongyu]

Summary

Two subscription providers are named after their internals, not after what the user pays for: openai-codex (a ChatGPT Plus/Pro subscription) and claude-sdk-oauth (a Claude Pro/Max subscription). Users cannot tell them apart from the metered API-key lanes openai and anthropic, which is a recurring source of confusion.

Rename them to chatgpt-subscription and anthropic-subscription, across every surface a user reads or types, without regressing anyone who is already logged in.

Expected (ideal state)

An existing user upgrades and: stays logged in; keeps their default model, favorites, thinking levels and service tiers; resumes old sessions on the same model; keeps hand-edited models.json overrides working; sees the new names everywhere; and if they type an old id, gets an error that names the new one.

Scope

Renamed: provider id, display name, the claudeSdkOauthProvider settings key, the per-account directory, all user-facing strings, and (separately committed) internal symbols, files and the extension directory.

NOT renamed: the api id openai-codex-responses; CLAUDE_CODE_OAUTH_TOKEN*; the API-key providers openai/anthropic; the npm package @anthropic-ai/claude-agent-sdk; and seven persisted tokens (session binding entry + its sidecar filename, tool-watch type, affinity key, managed sentinel, compact entry type, compact-boundary diagnostic).

Defects found while planning that a naive rename would ship silently

1. The managed sentinel is derived, not literal. managedSentinelMaterial(providerId) returns \${providerId}-managed` (packages/ai/src/auth/pool/slots.ts:384) and repairPoisonedPoolSlotscalls it with the auth.json top-level key. Moving that key makes pool repair stop matching stored sentinels, so a pooled user gets a slot that can never authenticate and is hidden fromlistAccounts. isManagedSentinelSlot` must accept both spellings.
2. PROVIDER_PRECEDENCE lists the old id first. packages/coding-agent/src/core/retry-fallback/expansion.ts declares ["claude-sdk-oauth","anthropic","kimi-coding"] above a comment stating absent providers sort alphabetically last. A rename that misses this table drops the subscription lane behind the metered anthropic lane.
3. Provider id, api id and baseUrl are one constant for the Anthropic lane (claude-sdk-oauth/index.ts), and prompt-cache-ttl.ts:358 switches on that api id — so renaming the provider silently renames the wire dialect. The api constant must be split first.
4. Session JSONL is already truncate-rewritten by senpi (session-manager.ts:1145), so normalized ids will reach disk through the existing path; that is expected, not a violation.

Acceptance criteria

• Legacy credentials, settings, overrides and sessions all resolve under the new ids, proven by fixture tests AND a real-CLI run on a seeded long-time-user profile.
• Rung ORDER is preserved wherever the subscription lane was deliberately placed ahead of a metered lane.
• No user-facing string contains a legacy id, enforced by a guard test with an explicit allowlist for the frozen tokens.
• A typed legacy id fails with a message naming the new id; config written by an earlier version never hard-errors.

Plan

Decision-complete plan with 23 implementation todos and 4 final verifiers is held locally; evidence held locally.

[code-yeongyu]

Wave 1 (foundation) status

Blocker cleared first. main was red before this work could land: test/model-registry.test.ts > modelOverrides failed on every PR because its fixture model anthropic/claude-opus-4 no longer exists in the generated catalog. Filed as #1993, fixed in #1996, merged as a00ed04a20. Attribution was measured rather than asserted — the two PRs below, disjoint diffs in different packages, failed with byte-identical assertions on the same base.

Step	PR	Head	Status
Split the Anthropic lane's wire api id from its provider id	#1991	5a70b0c585	rebased onto the fix, CI running, 0 fails
Canonical legacy provider-id map + normalizers in packages/ai	#1992	80c1c10447	rebased onto the fix, CI running, 0 fails

Both are internal-only (nothing is wired up and no user-visible behaviour changes yet), so both carry no-changelog plus a changes.md design record. The user-facing CHANGELOG entries belong to the PRs where a user first sees something different — the provider-id renames, the storage migrations, and the typed-surface rejection.

Why #1991 comes first

claude-sdk-oauth/index.ts registered the provider id, the wire api id and baseUrl from a single constant, and packages/ai/src/utils/prompt-cache-ttl.ts:358 plus the compaction lane policy switch on that api id. Renaming the provider would silently have renamed the wire dialect too, invisibly in review. #1991 gives the wire identity its own frozen constant first, guarded by a test whose comment states that a failure there means a rename went too far and the fix is to restore the wire id, not to update the expected value.

Findings that changed the plan since this issue was filed

• The managed sentinel is derived, not literal. managedSentinelMaterial(providerId) returns \${providerId}-managed` (packages/ai/src/auth/pool/slots.ts:384) and repairPoisonedPoolSlotsfeeds it the auth.json top-level key. Freezing the literal does not protect it;isManagedSentinelSlotmust accept both spellings or pooled users get a slot that can never authenticate and is hidden fromlistAccounts`.
• PROVIDER_PRECEDENCE lists the old id first (retry-fallback/expansion.ts), and absent providers sort alphabetically last — so a pure rename drops the subscription lane behind the metered anthropic lane. test/suite/retry-fallback-expansion.test.ts already pins that order and will go red; that red is the defect, not a stale assertion.
• Display names have no single source — model-registry.ts:177 resolves getProvider()?.name ?? BUILT_IN_PROVIDER_DISPLAY_NAMES[id] ?? id, so the provider's own name shadows the table that looks canonical, and five more modules hand-build the same label. Tracked separately as Provider display names have no single source: the provider's own name shadows BUILT_IN_PROVIDER_DISPLAY_NAMES, and five modules hand-build the same label #1995; consolidation is deliberately out of scope here, but every producer must be updated or the rename is a no-op on screen.
• No Windows CI covers the per-account directory move. test-coding-agent runs on ubuntu-latest only and the workflow has zero references to claude-sdk-oauth, so that step must be correct by construction with its fallback asserted by forcing the failure.
• @earendil-works/pi-ai is bundled into the senpi tarball, so npm view <version> cannot detect a release whose nested catalog is stale — release verification uses npm pack plus a grep of the nested dist/providers/data.

Downstream adoption is tracked at code-yeongyu/oh-my-openagent#8654 and code-yeongyu/omo-desktop-app#990.