fix: honor user model context windows in managed provider runtimes

[jonjlhuang-blip]

Summary

• Honor explicit per-model CLAUDE_CODE_MODEL_CONTEXT_WINDOWS values from the user's root settings.json in host-managed provider runtimes, including official OpenAI/Grok OAuth and DeepSeek Account. Do not treat generated cc-haha/settings.json snapshots as user overrides.
• Preserve precedence: explicit provider configuration > explicit user model windows > preset defaults, including namespaced/base-model aliases. Built-in DeepSeek account windows are preset defaults. Reuse existing validation; do not promote unknown models or disable compaction.
• Include user windows in transcript inspection/history cache fingerprints so changes take effect without new messages.

Motivation

Host-generated provider defaults can overwrite a user's explicit model capacity (for example, with 258,400 tokens). Increasing unrelated maximum-token settings does not repair the effective SDK window. Propagate explicit capacities consistently without changing authentication or model IDs.

Latest-main validation

• 49 tests passed across provider-runtime-env, provider-settings-isolation, and context test files.
• New cache invalidation test passed independently (5 assertions): same SessionService, no new transcript messages, 1M -> 128K reflected in estimates and model usage.
• DeepSeek Account probe returned explicit 777,777 rather than preset 1M; unrelated runtime settings and automatic compaction retained.
• Targeted four-production-module bundling passed before the final follow-up; diff formatting passes.
• Full PR validation lanes and repository-wide typecheck/build not completed locally. Impact reporting indicates CLI-core authorization-label policy requires maintainer review.
• An initial focused run encountered Windows temporary-file rename EPERM; unchanged rerun passed. The first latest-main cache test also exposed missing config initialization; the follow-up initializes config only after paths are isolated and retains all assertions.

Earlier v0.7.1 validation (not latest-main full-suite evidence)

• 44 focused tests + cache test passed. Compiled-sidecar SDK control-protocol A/B: original 258,400 vs patched 1,000,000, compaction retained.
• Final provider-contract rerun: 36 suites, 808 passed. Initial two timeouts did not reproduce in targeted baseline/fixed checks or full rerun.
• Full conversations-file comparison: two shared Windows EBUSY cleanup failures; baseline also had an additional timeout/error.
• Agent-e2e baseline/fixed runs both timed out during server startup before scenario results. E2E remains unverified, not passed.

Limits and privacy

• One synthetic real-backend request completed with 247,992 input tokens and all five distributed markers correct. This is below the former 258,400 default: it proves neither 1M capacity nor crossing the old default.
• No full-repository, release, or near-1M backend verification is claimed. Capacities require explicit configuration grounded in provider capabilities.
• No credentials, personal settings, binaries, or raw runtime logs are included.

[github-actions]

PR quality triage

Changed areas: area:cli-core, area:server

CLI core policy: Blocked by policy until a maintainer applies allow-cli-core-change and approves the PR.

Missing-test policy: No missing-test policy block detected.

Coverage baseline policy: No coverage-baseline policy block detected.

CLI core files:

• src/utils/__tests__/context.test.ts
• src/utils/model/modelContextWindows.ts

Coverage policy files:

• none

Required check plan:

• See PR Quality / scope-plan; it is the single source of truth for selected jobs.

Test coverage signals:

• Agent/model runtime path changed: use mock/request-shape tests in PR and maintainer live-model smoke before release.

Risk notes:

• Provider/search behavior changed: PR gate uses mock tests; live-provider tests stay maintainer-only.

Hard merge gates come from the deterministic GitHub Actions contract lanes above.