CLI remote submit omits per-call `provider`, API rejects whole batch → silent local-only fallback

[AndresL230]

Summary

The CLI remote-submit path (src/cli/scan.ts) submits scanned API calls without the provider-enrichment step the webview path applies. Any scan containing a call whose scanner-derived provider is undefined is rejected wholesale by the API with:

Remote enrichment unavailable: Each API call must include a 'provider' field. Update your extension to the latest version.. Falling back to local-only results.

So --project-id / RECOST_PROJECT_ID silently falls back to local-only for essentially every real multi-provider repo, and nothing reaches the dashboard.

Repro

npm run build:ext
RECOST_API_KEY=<valid> RECOST_PROJECT_ID=<valid> \
  node dist/cli/scan.js <a repo with mixed/unresolved-provider calls> --format json
# → "mode": "local-only", stderr shows the 'provider' field rejection

A single-call fixture where the one call already has a resolved provider (e.g. a lone openai chat call) submits fine — which is why this slipped past the #135 verification. It only bites once a scan includes at least one call without a provider.

Root cause

The webview path enriches every call before submit via src/webview/build-remote-api-calls.ts:buildRemoteApiCalls():

const provider = call.provider ?? lookupHost(host) ?? "unknown";
return { ...call, provider };

guaranteeing a provider on every submitted call.

The CLI (src/cli/scan.ts) does not call that helper — it submits the raw filtered list:

const remoteApiCalls = apiCalls.filter(shouldSubmitRemote);   // no provider enrichment
...
const remoteScan = await submitScan(projectId, remoteApiCalls, rcApiKey);

Proposed fix

• In src/cli/scan.ts, replace the inline apiCalls.filter(shouldSubmitRemote) with buildRemoteApiCalls(apiCalls).submitted (same helper the webview uses).
• Surface unknownProviderCount / unknownProviderHosts to stderr, mirroring the webview's scanNotification so unresolved providers aren't silent.

Acceptance criteria

• CLI remote submit attaches a provider to every call (resolved or "unknown").
• Remote scan of a real multi-provider repo returns mode: "remote-enriched" instead of falling back.
• Unresolved-provider count printed to stderr.
• Regression test for the CLI submit shape (existing tests cover the webview handler, not the CLI path).

Context

Found while scanning real repos to validate #45 (the CLI --project-id remote path, merged in #135). The #135 verification only exercised a single-provider fixture, which is why this wasn't caught. Related latent provider-fallback notes: see wave6_status memory / #95-#96 history.