serving: honor the auth wizard's choice and say who served the turn

An explicitly selected subscription source (memcode auth claude/codex/
copilot/grok) now outranks a stored memcode login at boot. Before, the
wizard printed 'using your claude subscription' while the org-key login
silently kept every turn on the hosted gateway — the user had no way to
tell. Ambient endpoints and exported keys still lose to a login; only the
wizard-consented path gets precedence.

The served-by line now names the credential in endpoint mode:
'served by sonnet via claude'.

Author: timothyerwin

internal/agent/runtime/loop.go

@@ -1175,6 +1175,12 @@ func (s *Session) complete(ctx context.Context, purpose llm.Purpose, req wire.Re
 			name = provider.ShortModel(resp.Model)
 		}
 		line := "⇄ served by " + name
+		// In endpoint mode, say WHOSE credential served the turn ("via claude" =
+		// the Claude subscription, "via chatgpt" = Codex, a custom endpoint by
+		// its name) — the one-line answer to "is this really on my sub?".
+		if ep, ok := s.Endpoint(); ok && ep.Name != "" {
+			line += " via " + provider.ServingLabel(ep.Name)
+		}
 		// Why this turn isn't on the pool — the dogfooding instrument for the 80/20 flip.
 		// "thinking"/"planner"/"vision" = deterministic policy; "escalate:<reason>" = a
 		// routing_hint; "cheap_lane_error"/"cheap_lane_overflow"/… = a real fallback. A drift back toward

internal/provider/credsource.go

@@ -102,6 +102,40 @@ func discoverCredentialEndpoint() (Endpoint, bool) {
 	return Endpoint{}, false
 }
 
+// ServingLabel maps an endpoint's internal name to the word a user chose in
+// the auth wizard — the "via X" in the TUI's served-by line. Empty for
+// endpoints that aren't a subscription source (their Name already reads fine).
+func ServingLabel(name string) string {
+	switch name {
+	case "claude-sub":
+		return "claude"
+	case "codex":
+		return "chatgpt"
+	case "copilot":
+		return "copilot"
+	case "grok-sub":
+		return "grok"
+	}
+	return name
+}
+
+// SubscriptionEndpointName reports whether an endpoint name is one of the
+// wizard-selected subscription sources (vs a custom endpoint or own key).
+func SubscriptionEndpointName(name string) bool {
+	switch name {
+	case "claude-sub", "codex", "copilot", "grok-sub":
+		return true
+	}
+	return false
+}
+
+// ExplicitCredentialSource reports the user has actively selected a
+// credential source (memcode auth …) — the consent signal that lets a
+// subscription login outrank other backends.
+func ExplicitCredentialSource() bool {
+	return strings.TrimSpace(os.Getenv(EnvCredentialSource)) != ""
+}
+
 // sourceModel resolves a subscription source's initial model: an explicit
 // MEMCODE_ENDPOINT_MODEL override wins, else the source's sensible default so a
 // subscription "just works" with no configuration. The /model picker changes it

internal/provider/provider.go

@@ -265,6 +265,17 @@ func NewFromEnvLazy(endpoints ...Endpoint) *Lazy {
 		// the endpoint instead of dead air (backend selection re-applies).
 		l.fallback.Store(&ep)
 	}
+	// An EXPLICITLY selected subscription source (memcode auth claude/codex/…)
+	// outranks a stored memcode login: the user just chose where turns should
+	// be served, and silently ignoring that choice made the auth wizard a lie
+	// (it printed "using your claude subscription" while the gateway kept
+	// serving). Ambient endpoints and own keys still lose to a login — only
+	// the wizard-consented subscription path gets this precedence.
+	if ep := l.fallback.Load(); ep != nil &&
+		ExplicitCredentialSource() && SubscriptionEndpointName(ep.Name) {
+		l.c.Store(dialEndpoint(*ep))
+		return l
+	}
 	if token := os.Getenv(EnvAPIToken); strings.HasPrefix(token, TokenPrefix) {
 		l.c.Store(dial(APIURL(), token))
 	} else if ep := l.fallback.Load(); ep != nil {