fix(providers): make the model picker reflect what the CLI actually accepts

[j35dev]

The bug

The model picker could offer a model the harness would not accept, and the drop happened at log.debug. The turn ran on the agent's default while the composer kept showing the user's pick — silently, every time.

Four defects, all shipping in v0.3.1 (74e85e2):

	Defect	Fix
D1	applyModel swallowed a refusal; the picker offered models the agent never advertises	Outcome reported + a new non-fatal notice event; the session's own agent now supplies the live catalog
D2	#writeDiskCache persisted the post-probe merged overlay under the models.dev provider key	Writes only what the registry round actually carried
D3	CLAUDE_ALIASES prepended at two sites onto lists already containing those families	Version-less pointers ride as aliases; duplicate names collapse; superseded members become isLegacy
D4	findBinary was a bare existsSync, so a directory named codex was a provider row	Regular-file check, plus a readiness gate on the rail

The guarantee

Ari automatically reflects every model exposed by your configured CLI — with a clearly marked cached fallback.

The picker records each catalog's provenance and names a non-live list for what it is ("… has not reported its own models — this is a bundled list. It may not accept every entry.") with a refresh control, rather than presenting a guess as fact.

Why discovery moved to the session

The probe runs --no-install from homedir(). When the npx package isn't cached the probe fails while a real turn still works — and the snapshot fallback then names models the agent refuses outright. On this machine the bundled Claude ids and what the local claude agent actually advertises share zero entries.

I pre-scoped a fix changing the probe's cwd to the session workspace and measured it instead: cwd=C:\Users\user and cwd=D:/Projects/Ari both return default, opus[1m], sonnet, sonnet[1m], haiku, deepseek-v4-flash. No difference, so no change. The real fix is the better direction anyway — an ACP session installs the model list its own agent advertises as the kind's live catalog, so the picker offers what the runtime that will actually run accepts.

Also fixed along the way

• Ari's placeholder id 'default' was conflated with an agent's genuinely advertised default option, making "switch back to the CLI default" a silent no-op.
• A kind already serving live data is no longer re-probed on every refresh (LIVE_RECHECK_MS, 6h). Re-asking spawned an agent process per kind per minute to hear the same list. A kind still on a fallback keeps retrying on the existing 60s throttle.

Contract changes

notice is a new AgentEvent variant (packages/contracts/src/agent-event.ts). It is deliberately not error: error sets firstErrorMessage in engine.ts and settles the turn as failed, and a turn that ran on the wrong model still ran. Anything switching exhaustively over AgentEvent needs a case. catalogModelSchema gains optional aliases and isLegacy.

Known, not fixed — worth a look

• Codex shows 11 registry rows. models.dev's family values are per-variant (gpt-sol, gpt-pro), not per-generation, so the collapse doesn't fire. Applying CURRENT_MODEL_IDS as isLegacy reclassification gets it to ~5 but hides newly-released models until the static allowlist is refreshed — against the guarantee above. Left as-is; the row count is a product call.
• opencode's live probe returns 392 models, uncapped. MAX_MODELS_PER_PROVIDER = 60 exists only in scripts/update-model-snapshot.ts.
• scripts/update-model-snapshot.ts now emits family, but catalog-snapshot.json has not been regenerated, so the fallback path uses id-prefix matching (covered by tests).

Testing

TDD throughout — every production change was preceded by a test watched to fail for the right reason. Mutation-checked the drift guard: forcing ModelDriftWatch.observe to drop its current === this.#agentModel false-positive guard fails exactly one test ("stays quiet when the agent just re-advertises the model already in use"), confirming that test is load-bearing rather than vacuous.

pnpm verify green, exit 0: typecheck 7/7 projects, eslint clean, tests — shared 15, contracts 21, ui 159, providers 440, engine 164, ari-core 260, desktop 1365 passed / 3 skipped.

Stacking note

Based on main by request. The branch also carries 7987186 fix(desktop): bind control socket outside macOS userData, which is fix/macos-control-socket-einval's commit (that branch is pushed but has no PR of its own) — plus a separate commit, test(desktop): derive the music runtime key from the runtime itself, an unrelated test fix that was sitting uncommitted on the branch.

🤖 Generated with Claude Code

---