fix: reconcile profile projections and selected-model fallback checks

manifests/context-packs/skill-triggers@1.json

@@ -10,7 +10,7 @@
     "id": "hand-seeded",
     "source": "manual-curation-pending-regeneration"
   },
-  "registryDigest": "0d2acf5e4a441fd9d6cbd5427f960ddd68ee0c2429413ef34ebc45f0700c6863",
+  "registryDigest": "2f875b395c5ccc302976234366e93d2bb9e284039081de35a702b3566389e791",
   "schemaVersion": 1,
   "triggers": {
     "skill:agent-runtime-gateway-smoke-test": [

pi/core/skills/docker-patterns/SKILL.md

@@ -416,6 +416,35 @@ explicit Compose `--env NAME` flag, understand that the value is inspectable
 and can be exfiltrated for the container lifetime, and remove the exact named
 container immediately after.
 
+### Authenticate Codex Inside the Networked Session
+
+`codex login` binds its OAuth callback server to `127.0.0.1:1455` inside the
+container. A Docker port publish forwards to the container interface, not
+loopback, so the host browser's redirect to `http://localhost:1455` is refused
+without a bridge. The `real-cli-networked` service publishes host
+`127.0.0.1:1455` to container port `1456`; bridge that port to loopback before
+logging in:
+
+```bash
+npm install --global @openai/codex   # the harness image does not ship codex
+node /ecc/docker/plugin-setup/codex-auth-relay.js &
+relay_pid=$!
+codex login
+kill "$relay_pid"
+```
+
+Complete the sign-in in the host browser. Each attempt mints a fresh
+`state`/`code`, so always follow the newest printed link. The token stays in
+the disposable container's `~/.codex/auth.json`; removing the named container
+deletes that credential copy. Stop the relay after the login attempt. Only one container can hold host port 1455 at a time
+because the OAuth redirect targets a fixed port.
+
+The host publish is restricted to loopback. Inside the container, the relay
+listens on all interfaces so Docker can forward to it; other containers on the
+same bridge network can reach it while it runs. Use a dedicated network without
+untrusted peers for this login, and remove the exact named container after use.
+Idle callback connections close after 30 seconds.
+
 Run the same focused suite natively on the host:
 
 ```bash

skills/context-budget/SKILL.md

@@ -131,4 +131,3 @@ values, missing or non-string types, and blank lines are unclassified. Neither c
 These counts do not establish active context, remaining room, token usage, billing, or what a
 reconnect loads. For current harness-reported context and usage, use the version-appropriate
 [`/context` and `/usage` commands (`/cost` is an alias)](https://code.claude.com/docs/en/commands).
-

src/llm/providers/resolver.py

@@ -111,7 +111,7 @@ def get_provider(provider_type: ProviderType | str | None = None, **kwargs: str
     if not provider_cls:
         raise ValueError(f"No provider registered for type: {provider_type}")
 
-    if "default_model" not in kwargs and provider_cls in _MODEL_ENV_VARS:
+    if not kwargs.get("default_model") and provider_cls in _MODEL_ENV_VARS:
         model = _resolve_default_model(provider_type, provider_cls, saved_model)
         if model:
             kwargs = {**kwargs, "default_model": model}

tests/scripts/repair.test.js

@@ -215,7 +215,7 @@ function runTests() {
           legacyMode: false,
         },
         resolution: {
-          selectedModules: ['platform-configs'],
+          selectedModules: ['platform-configs', 'shared-script-utils'],
           skippedModules: [],
         },
         operations: [
@@ -298,7 +298,7 @@ function runTests() {
         cwd: projectRoot,
         homeDir,
       });
-      assert.strictEqual(doctorAfter.code, 0, doctorAfter.stderr);
+      assert.strictEqual(doctorAfter.code, 0, doctorAfter.stdout + doctorAfter.stderr);
       assert.ok(doctorAfter.stdout.includes('Status: OK'));
     } finally {
       cleanup(homeDir);
@@ -331,7 +331,7 @@ function runTests() {
           legacyMode: false,
         },
         resolution: {
-          selectedModules: ['platform-configs'],
+          selectedModules: ['platform-configs', 'shared-script-utils'],
           skippedModules: [],
         },
         operations: [

tests/skills/desk-pattern-skills.test.js

@@ -41,6 +41,8 @@ function test(name, fn) {
 
 function walk(dir, acc = []) {
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === '__pycache__' || entry.name === '.pytest_cache'
+      || /\.py[co]$/.test(entry.name)) continue;
     const full = path.join(dir, entry.name);
     if (entry.isDirectory()) {
       walk(full, acc);

tests/test_model_config.py

@@ -117,3 +117,13 @@ def test_cn_blank_specific_model_uses_normalized_shared_model(
 
     assert get_provider(ProviderType.ASTRAFLOW_CN).get_default_model() == "Shared/MixedCase-model"
     assert AstraflowCNProvider().get_default_model() == "Shared/MixedCase-model"
+
+
+@pytest.mark.parametrize("default_model", (None, ""))
+def test_unset_constructor_model_uses_selected_model(
+    monkeypatch: pytest.MonkeyPatch, default_model: str | None
+) -> None:
+    monkeypatch.setenv("LLM_PROVIDER", "openai")
+    monkeypatch.setenv("LLM_MODEL", "Selected-Case-Model")
+    provider = get_provider("openai", api_key="test-key", default_model=default_model)
+    assert provider.get_default_model() == "Selected-Case-Model"