[Upstream PR #219] feat: enforce real provider disable policy

[quangdang46]

Mirrored from upstream 1jehuang/jcode — Pull Request #219 by @DarkPhilosophy
Original state: open
Created: 2026-05-15T18:18:55Z · Updated: 2026-05-15T18:18:55Z
Diff: https://github.com/1jehuang/jcode/pull/219.diff
This issue is an auto-mirrored copy. Comments and edits here are local to quangdang46/jcode — do not expect them to propagate upstream.

---

Summary

• add a real disabled-provider policy via [provider].disabled_providers, [policy].disabled_providers, and JCODE_DISABLED_PROVIDERS
• keep disabled providers out of startup initialization, auth surfaces, model routing, failover, account/login pickers, and remote /model views
• stop treating generic GH_TOKEN / GITHUB_TOKEN as Copilot credentials unless the user explicitly opts in with JCODE_COPILOT_ALLOW_GITHUB_ENV=1

Rationale

A disabled provider should behave as absent, not as loaded-but-warned. If a provider is disabled, it should not be discovered, initialized, auto-selected, offered as a fallback, or shown as a usable account/model route.

This also removes an especially surprising source of implicit Copilot activation: generic GitHub credentials are commonly present for normal GitHub workflows and are not a Copilot intent signal by themselves.

Behavior changes

• new disabled-provider config entries are normalized and respected consistently across runtime/provider selection
• disabled providers are filtered from auth status, auth doctor, auth test, account/login pickers, completion suggestions, and remote model snapshots
• startup and hot-refresh paths skip disabled providers instead of initializing them and hiding them later
• model selection rejects explicit use of disabled providers
• fallback sequences exclude disabled providers
• Copilot now only consumes COPILOT_GITHUB_TOKEN by default; reusing GH_TOKEN / GITHUB_TOKEN requires explicit opt-in

Tests

• cargo test --lib test_env_override_disabled_providers_normalizes_entries
• cargo test --lib copilot_does_not_auto_use_generic_github_env_without_opt_in
• cargo test --lib copilot_recent_token_exchange_failure_is_not_auto_usable
• cargo test --lib test_enabled_fallback_sequence_omits_disabled_providers
• cargo test --lib disabled_login_providers_are_filtered_from_user_facing_lists

[quangdang46]

Mirrored upstream PR #219: enforce real provider disable policy. 25 files / 1373 lines — large policy refactor. Closing as not planned for now — file a fresh local issue with the desired policy semantics if you want to port.

[quangdang46]

Upstream PR 1jehuang#219 enforces a real provider-disable policy across 25 files / 1373 lines. This is policy plumbing across the provider layer, registry, and TUI badges. Too large to port wholesale safely. Closing as not planned — file as a fresh local feature with a written policy spec (which providers count as 'disabled', how it interacts with multi-account, what UI feedback the user gets) before re-attempting the port.

[quangdang46]

MVP shipped via PR #239 — JCODE_DISABLED_PROVIDERS=foo,bar env var helper + crate::config::is_provider_disabled(). Wiring into auth surfaces / model routing / failover / pickers can land in follow-ups as each surface gets touched. Closing this main issue as MVP shipped; create follow-up issues for specific surfaces if needed.