[vishr]

Summary

new conversation
  auto: Claude → Codex → Copilot (first compatible installed CLI)
  explicit: selected provider, or an actionable error
  persist provider + session ID
  every turn: same provider → Driga tools → broker approval

What changed

Chat and driga ask can use an installed Claude Code, Codex or GitHub Copilot CLI. Selection is lazy, defaults to automatic, and stays pinned for each conversation. CLI overrides apply to new conversations through an already-running service; UI and TUI identify the answering provider.

Closes #103

Why

Users may have only one assistant installed. Separate adapters preserve each CLI's protocol while the existing broker retains command authorization, cancellation and capture policy. The design and supported-provider limits are recorded in docs/specs/2026-11-10-assistant-providers.md.

Evidence

• Before: Chat required Claude; self-session exclusion used bare IDs; service-backed CLI selection ignored the client preference.
  After: fake-provider tests cover ordered automatic selection, explicit overrides through the service, pinned resume after restart, provider-ID collisions and hook/spool self-exclusion.
• Independent Standards, Spec and Astra reviews found and resolved tool, environment, acknowledgment and presentation defects. A separate user test caught the service override issue. Final results: docs/specs/2026-11-10-provider-review.md.
• Local checks: isolated full Go tests; race checks for affected packages; native and Windows vet; Linux build; 212 UI tests; 1,224 browser-story tests; generated-doc check; Gitleaks.

Real provider/authentication/model turns were not used in tests. Copilot fails before sending a question unless protocol 3, explicit safety acknowledgments and an exact Driga-only catalog are accepted. Codex is limited to the verified 0.167.0 build and default OpenAI configuration; its adapter supports reads/panels and broker-gated commands, with dashboard writes unavailable. Direct MCP cleanup, acknowledgment, jumps, delegated prompts and summary actions remain Claude-only. Project summaries retain their Claude model/budget contract.

Risk and rollout

No schema migration or agent-settings edits. New Chat conversations can send permitted context through the chosen CLI's existing vendor connection. Capture policy and fleet sharing are unchanged. Process commands continue through the broker's human approval and identity checks.

CLI overrides affect only new conversations. Desktop Chat uses the collector preference; restart the service after changing that configuration. Existing conversations remain bound to their original provider; turn/authentication/quota errors never cause cross-provider replay.

Contract changes

Adds assistant.provider = "auto" | "claude" | "codex" | "copilot" and DRIGA_ASSISTANT_PROVIDER. Adds an optional authenticated conversation-create preference; an empty request retains the daemon default. Existing conversation storage already records the provider, so no migration is needed.

Merge Danger

Door: two-way

Code rollback is straightforward. Conversation provider IDs remain stored and require the corresponding adapter to resume.

Blast Radius: Chat

Collector session exclusion also changes to provider-qualified identities. Unsupported CLIs fail closed; vendor-native execution is disabled and all local commands remain broker-gated.

Verified

• Full isolated go test ./...; focused race checks on chat, llm, collector, config, store and TUI.
• Linux build, native/Windows vet, UI build/tests, Storybook, generated docs and secret scan.
• Initial macOS open-file timeout passed on isolated retry and subsequent full run; final collector memory-budget check passed.
• CLA acceptance is not asserted by this PR body.