fix: third-party provider compat — update, metrics, and refusal message

[oyi77]

Summary

Four fixes for third-party provider users:

1. openclaude update blocked for all 3P users

src/cli/update.ts — Changed gate from getAPIProvider() !== 'firstParty' to also check MACRO.PACKAGE_URL === '@anthropic-ai/claude-code'. OpenClaude builds (where PACKAGE_URL is @gitlawb/openclaude) can now self-update from npm.

src/utils/autoUpdater.ts — Same fix in assertMinVersion().

2. Metrics endpoint called by 3P providers

src/services/api/metricsOptOut.ts — Added firstParty gate to _fetchMetricsEnabled(). Previously, 3P users with API keys would hit api.anthropic.com/api/claude_code/organizations/metrics_enabled and get auth errors.

3. Stale hardcoded model in refusal message

src/services/api/errors.ts — Replaced hardcoded 'claude-sonnet-4-20250514' with getDefaultMainLoopModel() so the model suggestion is always current and provider-appropriate.

Testing

• openclaude update should work for non-Anthropic builds
• Metrics check should return { metrics_logging_enabled: false } for 3P without hitting Anthropic
• Refusal message should suggest the correct default model for the current provider

[Meetpatel006]

look fine , lgtm

[jatmn]

Thanks for the update. I took another pass through the changed paths and found one issue that still needs to be addressed before this is ready.

Findings

• [P2] Apply the third-party metrics gate before reusing the disk cache
  src/services/api/metricsOptOut.ts:144
  The new provider check only runs inside _fetchMetricsEnabled(), but checkMetricsEnabled() returns metricsStatusCache first. If a user previously ran a first-party session where the Anthropic metrics API returned enabled: true, then switches the same OpenClaude install to OpenAI/Gemini/etc., this path will keep returning enabled: true from disk for up to 24 hours and never reach the new getAPIProvider() !== 'firstParty' short-circuit. That means the PR's "third-party providers should not use Anthropic metrics" behavior is not guaranteed for existing cached installs. Please short-circuit non-first-party sessions before reading the shared disk cache, or make the cache provider/account scoped so first-party state cannot be reused by third-party sessions.

[oyi77]

Fixed. Added firstParty gate in checkMetricsEnabled() before disk cache read at line 135 — stale first-party enabled: true can no longer leak to third-party sessions.

[jatmn]

Thanks for the update. I rechecked the previously discussed paths and do not see any remaining actionable issues from my side.