feat(provider): rename the SSO identity to AIGW

SSO-issued keys now write the aigw / AIGW provider identity into agent
configs. The pre-rename netgate id joins aigateway as a recognition-only
legacy id: detection, base_url readback, and the credential scrub still
match it, nothing writes it, and installs converge on aigw at their next
config rewrite.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: quickbeard

AGENTS.md

@@ -132,11 +132,11 @@ When testing the gate, build CoDev-authored fixtures by calling the real writers
 
 `src/lib/provider.ts` owns the provider id and display name CoDev writes into the OpenAI-compatible agent configs (Codex `model_provider` + `[model_providers.<id>]`, OpenCode/CoDev Code `provider.<id>` plus the `"<id>/<model>"` reference, Continue's `CoDev (<name>)` title). Claude Code has no provider concept — it only gets env vars.
 
-Two built-in identities: **netgate / netGate** for SSO-issued keys (the "Get a new API Key" path, and "Reuse existing API Key" when the saved key carries no provider), and **ai-gateway / AI Gateway** as the manual path's fallback. On "I have my own API Key" the first form field is an optional, ASCII-only **Provider Name**; `providerFromName` slugs it (lowercase, non-alphanumeric runs → `-`, trimmed, capped at 32) and a blank or unusable name falls back to AI Gateway. The slug charset is deliberately `[a-z0-9-]`: TOML bare-key safe so `[model_providers.<id>]` needs no quoting, and slash-free so OpenCode's `"<id>/<model>"` stays parseable.
+Two built-in identities: **aigw / AIGW** for SSO-issued keys (the "Get a new API Key" path, and "Reuse existing API Key" when the saved key carries no provider), and **ai-gateway / AI Gateway** as the manual path's fallback. On "I have my own API Key" the first form field is an optional, ASCII-only **Provider Name**; `providerFromName` slugs it (lowercase, non-alphanumeric runs → `-`, trimmed, capped at 32) and a blank or unusable name falls back to AI Gateway. The slug charset is deliberately `[a-z0-9-]`: TOML bare-key safe so `[model_providers.<id>]` needs no quoting, and slash-free so OpenCode's `"<id>/<model>"` stays parseable.
 
-The load-bearing consequence: the provider id **is** CoDev's authorship marker for codex/opencode/codev-code. It gates `detectConfiguredTools` (whose configs `codevhub model` rewrites), `isCodevAuthored` (restore's delete-vs-`kept-live` decision), and `readAgentConfig`'s base_url readback. Since it's no longer a compile-time constant, `codevProviderIds()` returns the candidate set — the id saved in `~/.codev-hub/auth.json`, then `netgate`, `ai-gateway`, and the pre-rename `aigateway` — and `firstNestedKey` resolves the live entry against it. Nothing writes `aigateway` any more; it stays recognized so installs predating the rename keep working, and they converge on the new id at the next config rewrite. Detection is deliberately *saved-id-first*: without auth.json a custom-id config is unattributable and restore keeps it rather than deleting it, matching the module's standing rule that a config we can't attribute is one we don't delete.
+The load-bearing consequence: the provider id **is** CoDev's authorship marker for codex/opencode/codev-code. It gates `detectConfiguredTools` (whose configs `codevhub model` rewrites), `isCodevAuthored` (restore's delete-vs-`kept-live` decision), and `readAgentConfig`'s base_url readback. Since it's no longer a compile-time constant, `codevProviderIds()` returns the candidate set — the id saved in `~/.codev-hub/auth.json`, then `aigw`, `ai-gateway`, and the pre-rename `netgate` and `aigateway` — and `firstNestedKey` resolves the live entry against it. Nothing writes the pre-rename ids any more; they stay recognized so installs predating the renames keep working, and they converge on the new id at the next config rewrite. Detection is deliberately *saved-id-first*: without auth.json a custom-id config is unattributable and restore keeps it rather than deleting it, matching the module's standing rule that a config we can't attribute is one we don't delete.
 
-`Credentials`/`ApiKeyCreds` carry `providerId`/`providerName` (persisted as `provider_id`/`provider_name`), and `resolveProvider` supplies the netGate default when they're absent. **`saveApiKey` writes the whole api-key block, so an omitted provider pair clears it** — every re-save site (`ModelApp`'s two re-auth branches and its model switch, `refresh.ts#ensureFreshGatewayKey`, `SetupApp`'s model-choice) must thread it through, or a manually-named provider silently reverts to netGate on the next model switch or launch-time key refresh. `logout()` is the same hazard by a different route: it rebuilds the surviving file field-by-field rather than deleting SSO keys from it, so anything not listed in its `preserved` object is dropped. The provider pair was missing there and had to be added back — a field added to `AuthFileContents` is not automatically a field that survives sign-out.
+`Credentials`/`ApiKeyCreds` carry `providerId`/`providerName` (persisted as `provider_id`/`provider_name`), and `resolveProvider` supplies the AIGW default when they're absent. **`saveApiKey` writes the whole api-key block, so an omitted provider pair clears it** — every re-save site (`ModelApp`'s two re-auth branches and its model switch, `refresh.ts#ensureFreshGatewayKey`, `SetupApp`'s model-choice) must thread it through, or a manually-named provider silently reverts to AIGW on the next model switch or launch-time key refresh. `logout()` is the same hazard by a different route: it rebuilds the surviving file field-by-field rather than deleting SSO keys from it, so anything not listed in its `preserved` object is dropped. The provider pair was missing there and had to be added back — a field added to `AuthFileContents` is not automatically a field that survives sign-out.
 
 ## Context windows and auto-compaction
 

src/lib/auth.ts

@@ -73,7 +73,7 @@ export interface ApiKeyCreds {
 	baseUrl?: string;
 	model?: string;
 	// Set only for manually-entered keys, where the user names their own
-	// provider. Absent ⇒ the key is SSO-issued and takes the netGate default
+	// provider. Absent ⇒ the key is SSO-issued and takes the AIGW default
 	// (see lib/provider.ts#resolveProvider).
 	providerId?: string;
 	providerName?: string;
@@ -219,7 +219,7 @@ function saveAuth(data: AuthData): void {
 // Writes the whole api-key block, so an omitted field *clears* it: callers that
 // re-save a key (model switch, re-auth, launch-time refresh) must thread the
 // provider pair through, or a manually-named provider silently reverts to the
-// netGate default on the next write.
+// AIGW default on the next write.
 export function saveApiKey(creds: ApiKeyCreds): void {
 	const existing = readAuthFile() ?? {};
 	writeAuthFile({
@@ -311,7 +311,7 @@ export async function logout(): Promise<boolean> {
 			model: raw.model,
 			// The provider pair belongs to the api-key block above and must travel
 			// with it. Dropping it here silently re-labels a manually-named
-			// provider as the netGate default on the next config write — the same
+			// provider as the AIGW default on the next config write — the same
 			// failure saveApiKey's whole-block rewrite is documented to cause,
 			// reached by a different route.
 			provider_id: raw.provider_id,

src/lib/configure.ts

@@ -73,7 +73,7 @@ export interface Credentials {
 	// Absent ⇒ treat as [model], so older call sites stay valid.
 	models?: string[];
 	// The provider the user named on the manual path. Absent ⇒ SSO-issued key,
-	// which gets the built-in netGate identity (lib/provider.ts).
+	// which gets the built-in AIGW identity (lib/provider.ts).
 	providerId?: string;
 	providerName?: string;
 }
@@ -179,7 +179,7 @@ const OPENCODE_K = {
 //   Codex       → config.toml   → model_providers.<provider>.base_url
 //   OpenCode    → opencode.json → provider.<provider>.options.baseURL
 //
-// <provider> is the netGate default for SSO-issued keys, or the id derived from
+// <provider> is the AIGW default for SSO-issued keys, or the id derived from
 // the name the user typed on the manual path — so it's resolved at read time
 // against codevProviderIds() rather than a fixed key.
 //

src/lib/provider.ts

@@ -10,10 +10,10 @@ export interface ProviderIdentity {
 }
 
 // SSO-issued keys ("Get a new API Key", and "Reuse existing API Key" when the
-// saved key carries no provider of its own) — "netgate" / "netGate".
+// saved key carries no provider of its own) — "aigw" / "AIGW".
 const DEFAULT_PROVIDER: ProviderIdentity = {
-	id: atob("bmV0Z2F0ZQ=="),
-	name: atob("bmV0R2F0ZQ=="),
+	id: atob("YWlndw=="),
+	name: atob("QUlHVw=="),
 };
 
 // The manual path's fallback, used when the user leaves the provider name blank
@@ -23,10 +23,11 @@ const MANUAL_PROVIDER: ProviderIdentity = {
 	name: atob("QUkgR2F0ZXdheQ=="),
 };
 
-// Pre-rename installs wrote this id — "aigateway". Kept purely so detection
-// (and the base_url readback) still recognizes configs written before the
-// netGate rename; nothing writes it any more.
-const LEGACY_PROVIDER_ID = atob("YWlnYXRld2F5");
+// Pre-rename installs wrote these ids — "netgate" (the SSO identity before the
+// AIGW rename) and "aigateway" (before the rename preceding that). Kept purely
+// so detection (and the base_url readback) still recognizes configs written
+// before the renames; nothing writes them any more.
+const LEGACY_PROVIDER_IDS = [atob("bmV0Z2F0ZQ=="), atob("YWlnYXRld2F5")];
 
 // Provider ids end up as TOML bare keys (`[model_providers.<id>]`) and as the
 // left half of OpenCode's `"<id>/<model>"` string, so the slug is restricted to
@@ -59,7 +60,7 @@ export function providerFromName(name: string): ProviderIdentity {
 
 // Configure-time resolution. Credentials carry a provider only when they came
 // from the manual path (or from a saved manual key being reused); everything
-// else is an SSO-issued key and gets the netGate default.
+// else is an SSO-issued key and gets the AIGW default.
 export function resolveProvider(creds: {
 	providerId?: string;
 	providerName?: string;
@@ -78,7 +79,7 @@ export function resolveProvider(creds: {
 // which is the conservative direction this module has always taken.
 export function codevProviderIds(): string[] {
 	const saved = loadApiKey()?.providerId;
-	const ids = [DEFAULT_PROVIDER.id, MANUAL_PROVIDER.id, LEGACY_PROVIDER_ID];
+	const ids = [DEFAULT_PROVIDER.id, MANUAL_PROVIDER.id, ...LEGACY_PROVIDER_IDS];
 	if (saved && !ids.includes(saved)) ids.unshift(saved);
 	return ids;
 }

tests/lib/auth.test.ts

@@ -247,7 +247,7 @@ describe("logout", () => {
 	});
 
 	// The provider pair identifies a manually-named provider and is what every
-	// config writer keys off. Losing it here reverts the user to the netGate
+	// config writer keys off. Losing it here reverts the user to the AIGW
 	// default on the next model switch or launch-time key refresh, silently.
 	test("preserves the provider pair alongside the key it belongs to", async () => {
 		const dir = join(tempDir, ".codev-hub");