[crispinhu27]

What changed

Personal settings can keep a model catalog for Codex, Claude Code, and the agent CLIs that use a custom Base URL: OpenCode, Antigravity, Kimi, Pi, DeepSeek Harness, and ZCode. From that page you can fetch the models a service publishes, then pick, reorder, and rename them. An empty catalog follows that published list. With no Base URL, or with the Gemini official protocol, the CLI's own models are used and the editor stays hidden. Cursor CLI still uses only its official models.

Codex and Claude Code catalogs are stored in new user_configs columns. Agent CLI catalogs stay in the existing credentials JSON. Startup AutoMigrate adds the columns; migrations/027_cli_model_catalog.sql is the same change for a manual apply.

Scope

• Platform core / API / runner
• Public adapter / deployment
• Classic
• Portable
• Shared behavior contract
• Installer / CLI
• Documentation only

Compatibility

Existing keys, Base URLs, and protocols are unchanged. A missing catalog follows the service list, which is the previous behavior. The new columns are nullable and additive. Cursor CLI is unchanged.

Validation

Ran:

go test ./web -count=1 -run 'TestCredentialListAndWizard|TestCredentialWizardCSSKeepsToastsAnimating|TestCredentialRowActivation|TestGotoCredentialBranches'
go test ./internal/repo -count=1 -run 'TestProviderUserCredentials|TestAgentCLICredentialsRoundTrip'
node --check web/app/workbench.js
python3 scripts/check-public.py

Not run: go test -p=2 ./..., go vet ./..., bash local/scripts/validate.sh, bash local/scripts/smoke-install.sh, bash local/scripts/e2e.sh, bash scripts/scan-secrets.sh.

Safety

• I did not include credentials, internal endpoints, production data, or organization-specific infrastructure.
• I preserved user files and unrelated changes.
• I updated generated Classic host bundles when applicable.
• I documented third-party content and licensing changes when applicable.

No Classic host bundles or third-party content changed.

[Robert0622]

LoopForge PR Review — head 756339941389350d3f93eee115357b71a0ec29de

Verdict: ✅ Pass

• Scope: personal model catalog for Codex/Claude Code (new nullable codex_models / claude_code_models columns, additive migration 027_cli_model_catalog.sql) plus catalog support for configurable Agent CLIs inside the existing agent_cli_credentials JSON. Cursor CLI stays official-only; Gemini-official protocol keeps the built-in model list — matches the stated scope.
• Code review: internal/repo/users.go decode/encode/normalize helpers and UserCredentialUpdate's *[]domain.CLIModel pointer fields correctly distinguish "field untouched" vs "clear to empty"; PutUser now also preserves CodexModels/ClaudeCodeModels across partial updates, same pattern as the existing API-key/Base URL fields. Web layer keeps name==id entries name-less on save (credentialCatalogModels), and credentialClearPayload now empties the catalog together with the key/Base URL.
• Tests: diff updates internal/repo/provider_credentials_test.go (TestProviderUserCredentials) and adds ~30 assertions to web/syntax_test.go covering save/clear payloads, catalog HTML rendering (ordering, empty/official/Gemini states), and validation errors (duplicate id, id with spaces, name length) — consistent with the author-reported go test ./web ... / go test ./internal/repo ... runs.
• CI (GitHub Actions, this SHA): the actual test/build steps all pass — Non-browser Go tests, Real-browser Go tests, Coverage gate regression tests, go vet, full e2e matrix, browser, first-run, UI tests. Only core's govulncheck step fails (GO-2026-6859, Go 1.26.10 net/http), which cascades into the platform-required gate. This is a repo-wide toolchain advisory, not introduced by this diff: main's last CI run (same base SHA) still shows core/platform-required green because it predates the advisory, and sibling PR fix(deploy): update Go security patch and install missing prerequisites #179 bumps Go to 1.26.11 specifically to clear it for every PR. Not attributable to this change.
• This review sandbox has no Go/Node toolchain to re-run the suite directly; verdict relies on the CI step-level results above (fetched via the Actions API) plus manual diff/test inspection.

[Robert0622]

Reviewed head 72fd087. No blocking findings in catalog persistence, omitted-versus-empty updates, official/custom endpoint selection, model ordering/names, and credential-editor changes.

Validation performed in this review: targeted repo credential round-trip, HTTP API assistant-engine catalog, and web credential tests passed; node --check web/app/workbench.js and node --test webtest/tests/workbench-credentials.test.mjs passed; relevant Go vet and public-content checks passed. A real CodeBuddy iOA scheduled chat turn on this head returned the expected marker, and the persisted transcript plus completed generation were verified using an isolated local fixture and the explicitly supplied credential. This confirms the CodeBuddy path remains functional; live calls to other CLI providers were not performed. No test credential is included in this review or source changes.