feat: Built-in provider wizard + /provider command + .env/auth fixes

[TheArchitectit]

Summary

This is PR 2 of 3 in a stacked PR chain implementing the plugin-provider architecture for SmallCode.

This PR adds a built-in provider configuration wizard that runs via the /provider command, plus 7 bug fixes for .env loading, authentication headers, and provider persistence across projects.

Changes

Provider wizard (bin/provider-wizard/wizard.js)

• runWizard(options) — interactive wizard with 4 steps:
  1. Provider selection (LM Studio, Ollama, OpenRouter, OpenAI, Anthropic, DeepSeek, custom)
  2. Base URL configuration (with provider-specific defaults)
  3. API key entry (skipped for local providers, required for custom endpoints)
  4. Model selection (auto-lists from provider's /v1/models endpoint)
• Supports both interactive (readline) and non-interactive (tool args) modes
• formatProvidersList() — renders the provider menu with numbered options

Provider status detection (bin/provider-wizard/status.js)

• getStatus() — reads .env files, env vars, and smallcode.toml to detect current provider config
• formatStatus() — renders a human-readable status report
• PROVIDERS — registry of all supported providers with defaults and key env names
• parseEnvFile() — reads .env files into key-value pairs

Tool handlers

• bin/provider-wizard/tool-status.js — provider_status tool handler (reads status, returns formatted string)
• bin/provider-wizard/tool-configure.js — configure_provider tool handler (runs wizard with optional args)

/provider command (bin/commands.js + bin/smallcode.js)

• New /provider slash command that dispatches to the wizard
• Works both when a model IS configured (reconfigure) and when none is set (initial setup)
• Registered in the command table alongside /clear, /undo, /commit, etc.

configure_provider tool (bin/executor.js)

• New tool available to the LLM for programmatic provider configuration
• Accepts provider, baseUrl, model, apiKey, escalationProvider, escalationModel
• Falls back to interactive wizard when no args provided

Bug fixes

1. Export PROVIDER_TOOLS (bin/tools.js)

• PROVIDER_TOOLS was defined but not exported — tools.js couldn't reference the built-in provider tools

2. /provider when no model configured (bin/smallcode.js)

• /provider was only dispatched in the non-interactive branch (when no model was set)
• Added dispatch in the main main() function so /provider works in all contexts

3. /provider when model IS configured (bin/smallcode.js)

• /provider dispatch was placed before the positional prompt branch
• Now correctly intercepts the command even when SMALLCODE_MODEL is set

4. createCommandHandler require (bin/smallcode.js)

• Provider dispatch required createCommandHandler but it wasn't imported at the dispatch point
• Added proper require('./commands') import

5. Custom provider endpoint API key (bin/provider-wizard/wizard.js)

• Custom endpoints skipped the API key step — the wizard now always prompts for an API key with custom providers
• Prevents silent auth failures downstream

6. Provider config persistence (bin/provider-wizard/wizard.js)

• Provider config was written to local .env — didn't persist across projects
• Now writes to global ~/.smallcode/.env for cross-project persistence

7. .env loading (bin/smallcode.js)

• loadDotenv() stopped at the first .env file found (local or global)
• Now loads all .env files (local first, then global) and merges them

8. Missing os import (bin/provider-wizard/wizard.js)

• os.homedir() was called without importing os — crashed on /provider command
• Added const os = require('os') to the import block

Files changed

• bin/smallcode.js — /provider dispatch, .env loading, createCommandHandler require
• bin/commands.js — /provider command registration
• bin/executor.js — configure_provider tool case
• bin/tools.js — PROVIDER_TOOLS export
• bin/config.js — provider configuration wiring
• bin/provider-wizard/wizard.js — interactive wizard (318 lines)
• bin/provider-wizard/status.js — status detection (112 lines)
• bin/provider-wizard/tool-configure.js — tool handler (29 lines)
• bin/provider-wizard/tool-status.js — tool handler (7 lines)
• bin/init.js — symlink fix for init

---

Stacked with:

• PR 1: Plugin system core — ProviderRegistry, hooks, permissions
• PR 3: #feat/anthropic-provider-plugin — Example Anthropic provider plugin

🤖 Generated with Claude Code

[Doorman11991]

Wizard UX is good. Issues to fix before merge:

1. bin/commands.js /help block has chalk.cron('/sessions') — typo for chalk.cyan. Throws TypeError: chalk.cron is not a function whenever a user runs /help.
2. /provider handler does const { configureProvider } = require('../src/compiled/providers/registry') but registry.js only exports register / get / has / list / getCapabilities. configureProvider is undefined, then wrapped in try { configureProvider(); } catch {} so the failure is silently swallowed and the wizard's persistence side-effect never runs through the registry.
3. .smallcode/plugins/anthropic-provider/adapter.js reads tc.name / tc.arguments; SmallCode's internal tool_calls are OpenAI-format and nest under tc.function. Use tc.function.name / tc.function.arguments.
4. resolveProvider() registers the OpenAI-compat fallback into the registry under any unknown name, so subsequent calls hit the plugin-provider branch in chatCompletion and bypass the real fetch. Make the fallback return without registering.
5. positional.find(a => a.startsWith('/provider') || a === 'provider') will also match /provider-foo, /providerwhatever, etc. Use exact match or '/provider ' prefix.
6. In main(), when a model is configured, new PluginLoader(...).loadAll() runs twice (once early for the no-model branch, then again at the original site that calls runInit). This re-registers providers and re-pushes init handlers — providers get clobbered with new instances and any side-effects in plugin module top-level run twice.
7. The wizard always writes to ~/.config/smallcode/.env, including API keys, with no prompt. That globally persists secrets across every project the user later opens. Add a confirm step or a --scope choice (project / user / global).
8. Rebase on master — current head is v0.9.7 and package-lock.json is still at 0.9.6.

[Doorman11991]

Reviewed locally. The provider wizard, /provider command, configure_provider / provider_status tools, and the --scope flag for /plugin install / remove are all good additions. Merging by hand on top of master to resolve the conflicts: PR #28 already shipped a superset of the plugin-loader / registry / anthropic-adapter changes, and the auth-header sites needed master's 1.2.1 provider-aware buildAuthHeaders() preserved (otherwise OpenAI keys leak to DeepSeek). Tested 124/124 unit tests + offline E2E green. Thank you for both PRs.

[Doorman11991]

Landed in b92b4ab on master, shipped as 1.3.0. Verification details in the merge commit. Thanks @TheArchitectit.