feat: smart merge model_list on model switch, store real token in auth_token_env

- install.sh: infer provider from base_url, smart merge with jq when
  settings.json exists, JSON escaping for user input, store real API key
  instead of env var name in auth_token_env
- entry.tsx: smart merge model_list by model+provider match on --model
  (both interactive and non-interactive), export to process.env
- coder-client.ts: upsertModelList() helper, config.set smart merge
  for model/CODER_MODEL/generic keys, sync process.env on config changes,
  use auth_token_env as direct token value (not env var name)
- Fix config.yaml -> settings.json in 4 comment references

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: jimgqyu

install.sh

@@ -196,38 +196,90 @@ echo "Press Enter for default (deepseek-chat):"
 read -r -p "> " coder_model
 coder_model="${coder_model:-deepseek-chat}"
 
+# -- Infer provider from base_url --
+if [ -n "$coder_base_url" ]; then
+  case "$coder_base_url" in
+    *deepseek*)  coder_provider="deepseek" ;;
+    *anthropic*) coder_provider="anthropic" ;;
+    *openai*)    coder_provider="openai" ;;
+    *)           coder_provider="${coder_model}" ;;
+  esac
+else
+  coder_provider="deepseek"
+fi
+
 # -- CODER_AUTH_TOKEN --
 echo ""
 echo -e "${CYAN}API Key / Auth Token${NC}"
 echo "Press Enter to skip (you can set CODER_AUTH_TOKEN env var later):"
 read -r -p "> " coder_auth_token
 
+# Escape special characters for JSON safety (prevent JSON injection)
+coder_model_escaped=$(echo "$coder_model" | sed 's/\\/\\\\/g; s/"/\\"/g')
+coder_base_url_escaped=$(echo "$coder_base_url" | sed 's/\\/\\\\/g; s/"/\\"/g')
+coder_auth_token_escaped=$(echo "$coder_auth_token" | sed 's/\\/\\\\/g; s/"/\\"/g')
+coder_provider_escaped=$(echo "$coder_provider" | sed 's/\\/\\\\/g; s/"/\\"/g')
+
 # Build settings.json
 SETTINGS_JSON=$(cat <<SETEOF
 {
   "theme": "dark",
-  "default_model": "${coder_model}",
+  "default_model": "${coder_model_escaped}",
   "model_list": [
     {
-      "name": "${coder_model}",
-      "model": "${coder_model}",
-      "base_url": "${coder_base_url}",
-      "auth_token_env": "CODER_AUTH_TOKEN",
-      "provider": "deepseek"
+      "name": "${coder_model_escaped}",
+      "model": "${coder_model_escaped}",
+      "base_url": "${coder_base_url_escaped}",
+      "auth_token_env": "${coder_auth_token_escaped}",
+      "provider": "${coder_provider_escaped}"
     }
   ],
   "env": {
-    "CODER_MODEL": "${coder_model}",
-    "CODER_BASE_URL": "${coder_base_url}",
-    "CODER_AUTH_TOKEN": "${coder_auth_token}"
+    "CODER_MODEL": "${coder_model_escaped}",
+    "CODER_BASE_URL": "${coder_base_url_escaped}",
+    "CODER_AUTH_TOKEN": "${coder_auth_token_escaped}"
   }
 }
 SETEOF
 )
 
-# Write settings.json
-echo "$SETTINGS_JSON" > "$SETTINGS_FILE"
-echo -e "${GREEN}✅ Created ${SETTINGS_FILE}${NC}"
+# Write settings.json with smart merge (Issue 2: don't destructively overwrite)
+if [ -f "$SETTINGS_FILE" ]; then
+  if command -v jq &> /dev/null; then
+    echo -e "${YELLOW}Existing settings.json found. Smart merging model_list...${NC}"
+    # Merge: if model+provider match, update entry; otherwise append new entry.
+    # Also update default_model and env to reflect the new choices.
+    jq \
+      --arg new_model "$coder_model_escaped" \
+      --arg new_provider "$coder_provider" \
+      --arg new_base_url "$coder_base_url_escaped" \
+      --arg new_auth_token "$coder_auth_token_escaped" \
+      '
+      .model_list = (if (.model_list // [] | map(select(.model == $new_model and .provider == $new_provider)) | length > 0) then
+        [.model_list[] | if .model == $new_model and .provider == $new_provider then
+          . * {name: $new_model, base_url: $new_base_url, auth_token_env: $new_auth_token}
+        else . end]
+      else
+        (.model_list // []) + [{name: $new_model, model: $new_model, base_url: $new_base_url, auth_token_env: $new_auth_token, provider: $new_provider}]
+      end) |
+      .default_model = $new_model |
+      .env.CODER_MODEL = $new_model |
+      .env.CODER_BASE_URL = $new_base_url |
+      .env.CODER_AUTH_TOKEN = $new_auth_token
+      ' "$SETTINGS_FILE" > "${SETTINGS_FILE}.tmp" && mv "${SETTINGS_FILE}.tmp" "$SETTINGS_FILE"
+    echo -e "${GREEN}✅ Merged with existing ${SETTINGS_FILE}${NC}"
+  else
+    echo -e "${YELLOW}WARNING: Existing settings.json found but jq not available. Backing up and creating new.${NC}"
+    BACKUP_FILE="${SETTINGS_FILE}.bak.$(date +%s)"
+    cp "$SETTINGS_FILE" "$BACKUP_FILE"
+    echo -e "${YELLOW}  Backup saved to ${BACKUP_FILE}${NC}"
+    echo "$SETTINGS_JSON" > "$SETTINGS_FILE"
+    echo -e "${GREEN}✅ Created ${SETTINGS_FILE}${NC}"
+  fi
+else
+  echo "$SETTINGS_JSON" > "$SETTINGS_FILE"
+  echo -e "${GREEN}✅ Created ${SETTINGS_FILE}${NC}"
+fi
 
 # Export env vars for immediate use
 if [ -n "$coder_base_url" ]; then

packages/cli/src/app/slash/commands/ops.ts

@@ -147,7 +147,7 @@ export const opsCommands: SlashCommand[] = [
 
       if (!['connect', 'disconnect', 'status'].includes(action)) {
         return ctx.transcript.sys(
-          'usage: /browser [connect|disconnect|status] [url] · persistent: set browser.cdp_url in config.yaml'
+          'usage: /browser [connect|disconnect|status] [url] · persistent: set browser.cdp_url in settings.json'
         )
       }
 
@@ -172,7 +172,7 @@ export const opsCommands: SlashCommand[] = [
               return ctx.transcript.sys(
                 r.connected
                   ? `browser connected: ${r.url || '(url unavailable)'}`
-                  : 'browser not connected (try /browser connect <url> or set browser.cdp_url in config.yaml)'
+                  : 'browser not connected (try /browser connect <url> or set browser.cdp_url in settings.json)'
               )
             }
 

packages/cli/src/app/slash/commands/session.ts

@@ -234,7 +234,7 @@ export const sessionCommands: SlashCommand[] = [
           ctx.voice.setVoiceEnabled(!!r.enabled)
           ctx.voice.setVoiceTts(!!r.tts)
 
-          // Render the configured record key (config.yaml ``voice.record_key``)
+          // Render the configured record key (settings.json ``voice.record_key``)
           // instead of hardcoded "Ctrl+B" — the gateway response carries the
           // current value so /voice status and /voice on stay in sync with
           // both the CLI and the TUI's actual binding (#18994).

packages/cli/src/app/useSubmission.ts

@@ -215,7 +215,7 @@ export function useSubmission(opts: UseSubmissionOptions) {
     [interpolate, send, shellExec]
   )
 
-  // Honors `display.busy_input_mode` from config.yaml (CLI parity):
+  // Honors `display.busy_input_mode` from settings.json (CLI parity):
   //   - 'queue'     (legacy): append to queueRef; drains on busy → false
   //   - 'steer'     : inject into the current turn via session.steer; falls
   //                   back to queue when steer is rejected (no agent / no

packages/cli/src/domain/details.ts

@@ -18,7 +18,7 @@ export const SECTION_NAMES = ['thinking', 'tools', 'subagents', 'activity'] as c
 //   - subagents: not set — falls through to the global details_mode so
 //     Spawn trees stay under a chevron until a delegation actually happens.
 //
-// Opt out of any of these with `display.sections.<name>` in config.yaml
+// Opt out of any of these with `display.sections.<name>` in settings.json
 // or at runtime via `/details <name> collapsed|hidden`.
 const SECTION_DEFAULTS: SectionVisibility = {
   thinking: 'collapsed',

packages/cli/src/entry.tsx

@@ -237,6 +237,19 @@ if (cliArgs.model || process.argv.includes('--model')) {
       settings.env.CODER_MODEL = entry.model;
       if (entry.base_url) settings.env.CODER_BASE_URL = entry.base_url;
       if (entry.auth_token_env) settings.env.CODER_AUTH_TOKEN = process.env.CODER_AUTH_TOKEN ?? '';
+      // Smart merge into model_list (match by model + provider)
+      settings.model_list = settings.model_list ?? [];
+      const existingIdx = settings.model_list.findIndex(
+        (m: any) => m.model === entry.model && (m.provider ?? '') === (entry.provider ?? '')
+      );
+      if (existingIdx >= 0) {
+        settings.model_list[existingIdx] = { ...settings.model_list[existingIdx], ...entry };
+      } else {
+        settings.model_list.push(entry);
+      }
+      // Export env vars for immediate effect
+      process.env.CODER_MODEL = entry.model;
+      if (entry.base_url) process.env.CODER_BASE_URL = entry.base_url;
       writeFileSync(settingsPath, JSON.stringify(settings, null, 2));
       console.log(`Default model set to: ${entry.name} (${entry.model})`);
     } else {
@@ -267,6 +280,19 @@ if (cliArgs.model || process.argv.includes('--model')) {
       settings.env.CODER_MODEL = entry.model;
       if (entry.base_url) settings.env.CODER_BASE_URL = entry.base_url;
       if (entry.auth_token_env) settings.env.CODER_AUTH_TOKEN = process.env.CODER_AUTH_TOKEN ?? '';
+      // Smart merge into model_list (match by model + provider)
+      settings.model_list = settings.model_list ?? [];
+      const existingIdx = settings.model_list.findIndex(
+        (m: any) => m.model === entry.model && (m.provider ?? '') === (entry.provider ?? '')
+      );
+      if (existingIdx >= 0) {
+        settings.model_list[existingIdx] = { ...settings.model_list[existingIdx], ...entry };
+      } else {
+        settings.model_list.push(entry);
+      }
+      // Export env vars for immediate effect
+      process.env.CODER_MODEL = entry.model;
+      if (entry.base_url) process.env.CODER_BASE_URL = entry.base_url;
       writeFileSync(settingsPath, JSON.stringify(settings, null, 2));
       console.log(`Default model set to: ${entry.name} (${entry.model})`);
     } else {

packages/cli/src/gateway/coder-client.ts

@@ -60,6 +60,15 @@ function inferProvider(name: string): string {
   return 'anthropic'
 }
 
+function upsertModelList(list: ModelEntry[], newEntry: ModelEntry): void {
+  const idx = list.findIndex(m => m.model === newEntry.model && m.provider === newEntry.provider)
+  if (idx >= 0) {
+    list[idx] = { ...list[idx], ...newEntry }
+  } else {
+    list.push(newEntry)
+  }
+}
+
 interface ClaudeSettings {
   env?: Record<string, string>
   theme?: string
@@ -522,6 +531,21 @@ export class CoderGatewayClient extends EventEmitter implements IGatewayClient {
               if (entry.auth_token_env) settings.env.CODER_AUTH_TOKEN = entry.auth_token_env
               settings.default_model = value
 
+              // Smart merge into model_list (match by model + provider)
+              settings.model_list = settings.model_list ?? []
+              const existingIdx = settings.model_list.findIndex(
+                (m: ModelEntry) => m.model === entry.model && (m.provider ?? '') === (entry.provider ?? '')
+              )
+              if (existingIdx >= 0) {
+                settings.model_list[existingIdx] = { ...settings.model_list[existingIdx], ...entry }
+              } else {
+                settings.model_list.push(entry)
+              }
+
+              // Export to process env for immediate effect
+              process.env.CODER_MODEL = entry.model
+              if (entry.base_url) process.env.CODER_BASE_URL = entry.base_url
+
               // Persist to disk
               writeFileSync(
                 join(homedir(), '.coder', 'settings.json'),
@@ -537,12 +561,41 @@ export class CoderGatewayClient extends EventEmitter implements IGatewayClient {
                 name: entry.name,
                 provider: entry.provider ?? inferProvider(entry.name),
               }
-              this.log(`config.set model=${value} → ${entry.model} (provider=${this.modelConfig.provider})`)
+              this.log(`config.set model=${value} -> ${entry.model} (provider=${this.modelConfig.provider})`)
+            }
+          } else if (key === 'CODER_MODEL' && value) {
+            // Direct model name set: upsert to model_list
+            settings.env = settings.env ?? {}
+            settings.env.CODER_MODEL = value
+            settings.model_list = settings.model_list ?? []
+            const existingIdx = settings.model_list.findIndex(
+              (m: ModelEntry) => (m.model === value || m.name === value)
+            )
+            if (existingIdx >= 0) {
+              settings.model_list[existingIdx] = { ...settings.model_list[existingIdx], model: value, name: value }
+            } else {
+              settings.model_list.push({ name: value, model: value, provider: inferProvider(value) })
             }
+            settings.default_model = value
+            process.env.CODER_MODEL = value
+            writeFileSync(
+              join(homedir(), '.coder', 'settings.json'),
+              JSON.stringify(settings, null, 2),
+            )
+            this.log(`config.set CODER_MODEL=${value}`)
           } else {
             // Generic key: update env[key] in settings and persist
             settings.env = settings.env ?? {}
             settings.env[key] = value
+            // Also update the current default model entry in model_list
+            if (settings.model_list && settings.default_model) {
+              const defEntry = settings.model_list.find((m: ModelEntry) => m.name === settings.default_model)
+              if (defEntry) {
+                if (key === 'CODER_BASE_URL') defEntry.base_url = value
+                if (key === 'CODER_AUTH_TOKEN') defEntry.auth_token_env = 'CODER_AUTH_TOKEN'
+              }
+            }
+            process.env[key] = value
             writeFileSync(
               join(homedir(), '.coder', 'settings.json'),
               JSON.stringify(settings, null, 2),

packages/cli/src/lib/platform.ts

@@ -52,10 +52,10 @@ export const isCopyShortcut = (
 
 /**
  * Voice recording toggle key — configurable via ``voice.record_key`` in
- * ``config.yaml`` (default ``ctrl+b``).
+ * ``settings.json`` (default ``ctrl+b``).
  *
  * Documented in tips.py, the Python CLI prompt_toolkit handler, and the
- * config.yaml default. The TUI honours the same config knob (#18994);
+ * settings.json default. The TUI honours the same config knob (#18994);
  * when ``voice.record_key`` is e.g. ``ctrl+o`` the TUI binds Ctrl+O.
  *
  * Only the documented default (``ctrl+b``) additionally accepts the