Reset the LLM config when the last tool is torn down

[jerm-dro]

Summary

thv llm setup re-applied Bedrock settings that the user had already torn down. Settings like Bedrock and Models are persisted so a plain setup re-run keeps them (#5832), but nothing ever ended that stickiness — a value outlived every tool that read it and got re-applied by the next setup, even against a gateway since repointed elsewhere. Models survived a full teardown; Bedrock could only be cleared with an explicit --bedrock-compat=false.

Teardown now resets the LLM config once no configured tool remains, the same thing thv llm config reset already does. A teardown that leaves other tools configured is unchanged — they still need the gateway settings to work.

Cached OIDC tokens survive the reset unless --purge-tokens is passed, so the keyring secret is never left orphaned.

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e) — not run locally; CI's E2E Tests Core (llm) passed
• Linting (task lint-fix)
• Manual testing (describe below)

Three teardown tests cover the rule: last tool reverted resets the config, a targeted teardown preserves it for the tools that remain, and --purge-tokens still clears the token refs. Also drove setup → teardown → setup end-to-end to confirm the second setup no longer re-pins the Bedrock model IDs.

Does this introduce a user-facing change?

Yes. After tearing down every tool, thv llm setup needs the connection settings supplied again — the same state as a fresh install. Cached tokens are untouched unless --purge-tokens is passed.

Special notes for reviewers

Reset-when-empty is deliberately coarser than tracking which client reads which setting, so one case remains: tearing down claude-code while claude-desktop is still configured leaves Bedrock set with no consumer. Nothing reads it until Claude Code is set up again, and the next full teardown clears it.

Not fixed here — changing --gateway-url without a teardown still re-applies Bedrock keys. Same root cause, worth its own PR.

Best reviewed squashed; the branch history walks through three earlier approaches.

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 82.35294% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.90%. Comparing base (3c4dec3) to head (2575cf5).
⚠️ Report is 9 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/llm/setup.go	82.35%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6295      +/-   ##
==========================================
+ Coverage   72.85%   72.90%   +0.04%     
==========================================
  Files         743      742       -1     
  Lines       77681    77835     +154     
==========================================
+ Hits        56596    56742     +146     
+ Misses      17118    17102      -16     
- Partials     3967     3991      +24     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.