docs: document Claude Code opt-out

packages/coding-agent/docs/providers.md

@@ -46,6 +46,13 @@ The `claude-sdk-oauth` provider routes LLM calls through the official [Claude Ag
   - `systemPromptMode` — controls how the system prompt is delivered. **`full`** (default) sends senpi's composed system prompt verbatim; the lane no longer rebuilds from the SDK `claude_code` preset, so all prompt regions (project rules, response-language instructions, etc.) reach the model. **`preset-append`** is the previous behaviour (deprecated, kept for one release; emits a one-time warning). **`override`** loads the system prompt from a file (`systemPromptFile`). The legacy `appendSystemPrompt` key still works: `false` → `preset-append`, `true`/unset → `full`; setting both keys makes `systemPromptMode` win and warns.
   - In `full` and `override` modes, `settingSources` defaults to `[]` on every lane because senpi's prompt already carries project context — loading the SDK's own CLAUDE.md would double-inject it. The CLI always prepends its own `"You are a Claude agent, built on Anthropic's Claude Agent SDK."` block, which senpi cannot suppress; `full` means the prompt is delivered intact, not that it is the only system-prompt text.
   - `settingSources` (filesystem settings load only in the ambient lane, so they cannot override your selected account), `strictMcpConfig`, `pinnedAccount`, `tokenInjection` (`oauth-slots` | `config-dir` | `ambient`), `resumeMode` (`auto` default | `off` restores per-turn sessions), `systemPromptFile`.
+- To prevent the Claude Code provider from loading on startup, disable the builtin by id in global `~/.senpi/agent/settings.json` or project `.senpi/settings.json`:
+  ```json
+  {
+    "disabledBuiltinExtensions": ["claude-sdk-oauth"]
+  }
+  ```
+  Restart senpi after changing this setting. Project settings override global settings, so a project-level `disabledBuiltinExtensions` list must also include `claude-sdk-oauth` to preserve a global opt-out. The setting prevents the provider extension from loading while leaving unrelated built-ins enabled. Remove the id (or remove the setting) to enable it again.
 - **Environment overrides** (precedence: `env > project settings > global settings > default`; no new CLI flags):
 
   | Variable | Purpose |

packages/coding-agent/src/core/extensions/builtin/claude-sdk-oauth/changes.md

@@ -1,5 +1,13 @@
 # claude-sdk-oauth extension changes
 
+## 2026-08-01 - Document the Claude Code opt-out
+
+- Documented `disabledBuiltinExtensions: ["claude-sdk-oauth"]` as the supported way to prevent the Claude SDK OAuth builtin from loading.
+- Clarified the global and project settings paths, project-over-global precedence, and the restart required after changing the setting.
+- Added a regression test that proves the disabled builtin does not register the provider while unrelated builtins remain loaded.
+- The runtime behavior is unchanged; this only documents and locks the existing opt-out.
+- Merge-conflict risk: low. Expected conflict zone is the top of this extension change log.
+
 ## 2026-07-31 - Native system prompt, session reuse, env overrides, and transcript hardening
 
 - **System prompt modes (new default: `full`).** Added a `systemPromptMode` setting with three values. `full` (new default) sends senpi's own composed system prompt verbatim — previously the lane rebuilt a prompt from the SDK `claude_code` preset plus three extracted regions, so any region without a dedicated extractor was silently dropped (a persistent response-language instruction never reached the model). `preset-append` is the previous behaviour, now DEPRECATED and kept for one release; selecting it emits a one-time warning. `override` loads the system prompt verbatim from a file (`systemPromptFile`). The legacy `appendSystemPrompt` key still works and maps onto the modes: `false` → `preset-append`, `true`/unset → `full`. Setting both `appendSystemPrompt` and `systemPromptMode` makes `systemPromptMode` win and emits a warning.

packages/coding-agent/test/agent-session-services-providers.test.ts

@@ -94,4 +94,34 @@ describe("createAgentSessionServices provider registration order", () => {
 			"config:claude-sdk-oauth",
 		]);
 	});
+
+	it("skips the Claude SDK OAuth provider when its builtin is disabled", async () => {
+		const tempDir = mkdtempSync(join(tmpdir(), "senpi-services-provider-disabled-"));
+		tempDirs.push(tempDir);
+		const agentDir = join(tempDir, "agent");
+		const projectDir = join(tempDir, "project");
+		mkdirSync(agentDir, { recursive: true });
+		mkdirSync(projectDir, { recursive: true });
+		writeFileSync(
+			join(agentDir, "settings.json"),
+			`${JSON.stringify({ disabledBuiltinExtensions: ["claude-sdk-oauth"] })}\n`,
+		);
+
+		const modelRuntime = getModelRuntime(await createInMemoryModelRegistry(AuthStorage.inMemory()));
+		const applied: string[] = [];
+		const registerProvider = modelRuntime.registerProvider.bind(modelRuntime);
+		modelRuntime.registerProvider = (name, config) => {
+			applied.push(name);
+			return registerProvider(name, config);
+		};
+
+		const services = await createAgentSessionServices({ cwd: projectDir, agentDir, modelRuntime });
+
+		expect(applied).not.toContain("claude-sdk-oauth");
+		expect(
+			services.resourceLoader
+				.getExtensions()
+				.extensions.some((extension) => extension.path === "<builtin:todowrite>"),
+		).toBe(true);
+	});
 });