test(provider): gate user-facing strings against the legacy provider names

[code-yeongyu]

Turns "no leaked old name" into an enforced gate. Part of #1989 (todo 11). Stacked on #2018 (todo 10) — base it there, or rebase onto main after #2018 merges.

How it works

Scans every shipped .ts under packages/coding-agent/src and packages/ai/src, extracts string and template literals only (comments and identifiers are not user-facing), and fails on any literal carrying openai-codex, OpenAI Codex, claude-sdk-oauth or Claude SDK OAuth outside the allowlist.

The allowlist is (file, literal) PAIRS

Not whole files — so a new legacy string in an already-listed file still fails. Every entry states why it is frozen:

File	Literal	Why
anthropic-subscription/api-id.ts	claude-sdk-oauth	frozen wire api id (its own comment: "Frozen permanently — must NOT follow a provider-id rename")
goal/terminal-provider-error.ts, utils/prompt-cache-ttl.ts	claude-sdk-oauth	compare/switch on model.api, the frozen wire id
anthropic-subscription/affinity.ts	claude-sdk-oauth-default	persisted HRW affinity key
anthropic-subscription/session-binding.ts	claude-sdk-oauth-binding	persisted binding entry type
anthropic-subscription/config-dir-credentials.ts	claude-sdk-oauth-accounts	the legacy accounts dir the one-shot move reads from
extensions/builtin/index.ts	claude-sdk-oauth	builtin extension module id
packages/ai/src/types.ts	openai-codex	retained KnownProvider legacy member

Allowed anywhere, because the string is the contract: the seven frozen tokens, CLAUDE_CODE_OAUTH_TOKEN/SENPI_CLAUDE_SDK_OAUTH/claude_sdk_oauth_, and "was renamed to" — the todo-9 rejection message must name the old id back to the user.

Allowed wholesale, because knowing the legacy ids is their entire job: legacy-provider-ids.ts, legacy-api-aliases.ts, auth-provider-key-migration.ts, settings-manager.ts.

Scope decisions worth reviewing

• Scans both casings for both providers. An earlier symbol inventory covered SCREAMING_SNAKE only on the Anthropic side and missed OPENAI_CODEX_* entirely; a one-sided gate would be blind to half the surface.
• Does not scan changes.md / AGENTS.md. 166 of 201 legacy hits in the tree are dated design-history entries. A gate that demanded rewriting the fork's own record would be wrong.
• A third case pins the load-bearing direction: both LEGACY_PROVIDER_IDS map keys must stay reachable, since every normalization and every typed rejection reads them.

Verification

bunx vitest run test/suite/anthropic-subscription-naming.test.ts — 3 passed.

Proven live, as the plan requires: re-introducing "OpenAI Codex" as a display name in provider-display-names.ts turns the guard RED and names the offending file and literal:

+   "packages/coding-agent/src/core/provider-display-names.ts: OpenAI Codex",

Restored afterwards; 3 passed again. Biome 0 errors; changelog gate PASS (test-only).

Observation for a follow-up, not fixed here

extensions/builtin/index.ts still registers { id: "claude-sdk-oauth" } while todo 10 moved its directory to anthropic-subscription/, so the builtin id no longer mirrors its directory. Keeping it is correct for a behaviour-free commit (the id is a stable module identifier), but whether it should be renamed with a migration is a real question worth its own issue.

---

Summary by cubic

Completes the internal subscription-provider rename and turns "no leaked old name" into an enforced test gate. The rename is behaviour-free: symbols, module files, the builtin extension directory, and matching test/script names now read anthropic-subscription and chatgpt-subscription; nothing observable changes.

Frozen by design

• Wire api ids, persisted token material, stored file names, and the settings property claudeSdkOauthProvider stay byte-identical; the settings property keeps its legacy read window open.
• Symbols that name the frozen wire API (OpenAICodexResponsesOptions, CLAUDE_SDK_OAUTH_API_ID, the api/openai-codex-responses/ directory) were not renamed.

The gate

• Scans shipped .ts under packages/coding-agent/src and packages/ai/src, extracts string and template literals, and fails on any carrying openai-codex, OpenAI Codex, claude-sdk-oauth, or Claude SDK OAuth outside the allowlist.
• The allowlist is (file, literal) pairs, not whole files, so a new legacy string in a listed file still fails.
• Allowed anywhere are the seven frozen tokens, env-var families, and the rejection message that must name the old id back to the user; four files whose whole job is knowing legacy ids (legacy-provider-ids.ts, legacy-api-aliases.ts, auth-provider-key-migration.ts, settings-manager.ts) are allowed wholesale.
• Proven live: re-introducing "OpenAI Codex" as a display name turns the guard RED and names the file and literal.

^{Written for commit 3173067. Summary will update on new commits.}