fix(coding-agent,ai): finalize provider unregister lifecycle and dependency security updates fixes #1669

packages/coding-agent/src/core/extensions/loader.ts

@@ -131,8 +131,7 @@ export function createExtensionRuntime(): ExtensionRuntime {
 			runtime.pendingProviderRegistrations.push({ name, config });
 		},
 		unregisterProvider: (name) => {
-			const idx = runtime.pendingProviderRegistrations.findIndex((r) => r.name === name);
-			if (idx !== -1) runtime.pendingProviderRegistrations.splice(idx, 1);
+			runtime.pendingProviderRegistrations = runtime.pendingProviderRegistrations.filter((r) => r.name !== name);
 		},
 	};
 

packages/coding-agent/src/core/extensions/types.ts

@@ -1122,7 +1122,7 @@ export interface ExtensionAPI {
 	 *
 	 * Removes all models belonging to the named provider and restores any
 	 * built-in models that were overridden by it. Has no effect if the provider
-	 * was not registered by this extension API.
+	 * is not currently registered.
 	 *
 	 * Like `registerProvider`, this takes effect immediately when called after
 	 * the initial load phase.

packages/coding-agent/src/core/model-registry.ts

@@ -15,6 +15,8 @@ import {
 	type OpenAIResponsesCompat,
 	registerApiProvider,
 	registerOAuthProvider,
+	resetApiProviders,
+	resetOAuthProviders,
 	type SimpleStreamOptions,
 } from "@mariozechner/pi-ai";
 import { type Static, Type } from "@sinclair/typebox";
@@ -243,6 +245,11 @@ export class ModelRegistry {
 	refresh(): void {
 		this.customProviderApiKeys.clear();
 		this.loadError = undefined;
+
+		// Ensure dynamic API/OAuth registrations are rebuilt from current provider state.
+		resetApiProviders();
+		resetOAuthProviders();
+
 		this.loadModels();
 
 		for (const [providerName, config] of this.registeredProviders.entries()) {
@@ -545,6 +552,8 @@ export class ModelRegistry {
 	 *
 	 * Removes the provider from the registry and reloads models from disk so that
 	 * built-in models overridden by this provider are restored to their original state.
+	 * Also resets dynamic OAuth and API stream registrations before reapplying
+	 * remaining dynamic providers.
 	 * Has no effect if the provider was never registered.
 	 */
 	unregisterProvider(providerName: string): void {
@@ -570,11 +579,14 @@ export class ModelRegistry {
 				throw new Error(`Provider ${providerName}: "api" is required when registering streamSimple.`);
 			}
 			const streamSimple = config.streamSimple;
-			registerApiProvider({
-				api: config.api,
-				stream: (model, context, options) => streamSimple(model, context, options as SimpleStreamOptions),
-				streamSimple,
-			});
+			registerApiProvider(
+				{
+					api: config.api,
+					stream: (model, context, options) => streamSimple(model, context, options as SimpleStreamOptions),
+					streamSimple,
+				},
+				`provider:${providerName}`,
+			);
 		}
 
 		// Store API key for auth resolution