fix(provider): keep each ChatGPT list with the login that served it

The fetched list was saved under the account from a token read made before
the request. When that read failed, the request's own read could still
succeed and name the account, so the picker looked under that account, found
nothing, and showed the built-in models. The token that makes the request now
picks where its list is kept, and a failed read gets one more try.

Two logins with no account id shared one saved list, so a reconnect whose
fetch failed or came back empty showed the previous login's models while
requests used the new token. Such a login is now told apart by its creation
time, which a token refresh keeps and a new sign-in changes.

The list shown while connecting was thrown away, so a failed fetch after
connecting fell back to the built-in models. It is now kept once the submit
saves the profile, before the picker reads it.

Author: bwachman

docs/IMPLEMENTATION.md

@@ -420,7 +420,7 @@ This release changes no settings, OAuth-store, or session persistence format and
 
 **OpenCode Go multi-protocol.** Selectable ids come from live `GET /zen/go/v1/models` (process-cached; packaged seed when cold or the fetch fails). Byte and model-count caps fail closed as malformed — never a truncated prefix. Protocol routing stays on the local map; unknown live ids use Chat Completions. `buildGoSource` / `resolveGoEndpoint` pick the adapter and base URL per model (not a single provider-wide OpenAI route). When Go is the active provider, subscription usage is fetched for the status bar and omitted on auth/network failure.
 
-**ChatGPT model catalog.** Each ChatGPT (Codex OAuth) profile lists the models its account serves: after startup the TUI fetches `GET /codex/models` with the profile's refreshed token and account id, keeps entries whose `visibility` is `list`, orders them by `priority`, and the first becomes the profile's default (`src/provider/codex-model-catalog.ts`). Connecting an account fetches the same list with the just-issued token for the connect model step, which preselects its first model unless the operator has moved to another one; `/connect` then refreshes every profile's list for the picker. The list is cached per profile and account for the process, and fleet workers spawned from the TUI read it through the live catalog. Until a fetch succeeds the profile uses `CODEX_DEFAULT_MODELS`; a later failed fetch keeps the last live list. Headless runs never fetch, so they and their workers always use `CODEX_DEFAULT_MODELS`. The backend filters the catalog by the request's `client_version`: an old `CODEX_CLIENT_VERSION` returns fewer models or none. Only an empty list logs a warning ("listed no models"); a shortened list is silent, so when a model the Codex CLI offers is missing here, bump `CODEX_CLIENT_VERSION` to a current Codex CLI release.
+**ChatGPT model catalog.** Each ChatGPT (Codex OAuth) profile lists the models its account serves: after startup the TUI fetches `GET /codex/models` with the profile's refreshed token and account id, keeps entries whose `visibility` is `list`, orders them by `priority`, and the first becomes the profile's default (`src/provider/codex-model-catalog.ts`). Connecting an account fetches the same list with the just-issued token for the connect model step, which preselects its first model unless the operator has moved to another one; `/connect` keeps that list for the saved profile, then refreshes every profile's list for the picker. The list is cached per profile and account for the process (a login with no account id is told apart by when it signed in), and fleet workers spawned from the TUI read it through the live catalog. Until a fetch succeeds the profile uses `CODEX_DEFAULT_MODELS`; a later failed fetch keeps the last live list. Headless runs never fetch, so they and their workers always use `CODEX_DEFAULT_MODELS`. The backend filters the catalog by the request's `client_version`: an old `CODEX_CLIENT_VERSION` returns fewer models or none. Only an empty list logs a warning ("listed no models"); a shortened list is silent, so when a model the Codex CLI offers is missing here, bump `CODEX_CLIENT_VERSION` to a current Codex CLI release.
 
 ### CLI Verbs and Flags
 

src/provider/codex-model-catalog.test.ts

@@ -14,6 +14,7 @@ import { codexProfilesToCatalogEntries } from "../config/codex-providers.js";
 import {
   discoverStagedCodexModels,
   prefetchCodexModels,
+  rememberConnectedCodexModels,
   resetCodexModelDiscoveryForTests,
   selectableCodexModelIds,
 } from "./codex-model-catalog.js";
@@ -111,10 +112,14 @@ const RECORDED_LISTED_IDS = [
   "gpt-5.6-luna",
 ];
 
-function profile(name: string, accountId?: string): CodexProfile {
+function profile(
+  name: string,
+  accountId?: string,
+  createdAt = 0,
+): CodexProfile {
   return {
     name,
-    createdAt: 0,
+    createdAt,
     tokens: {
       access: `stored-${name}`,
       refresh: "r",
@@ -126,6 +131,8 @@ function profile(name: string, accountId?: string): CodexProfile {
 
 let storedProfiles: CodexProfile[] = [];
 let tokenFailure: Error | undefined;
+// Token reads that fail before they start succeeding.
+let tokenFailuresLeft = 0;
 // Simulates a token refresh that learns the account id and writes it back to
 // the stored profile.
 let accountLearnedOnRefresh: string | undefined;
@@ -143,6 +150,10 @@ await withMockedModule(
     ...real,
     getValidCodexToken: async (name: string) => {
       if (tokenFailure !== undefined) throw tokenFailure;
+      if (tokenFailuresLeft > 0) {
+        tokenFailuresLeft -= 1;
+        throw new Error("token read failed");
+      }
       const stored = storedProfiles.find((p) => p.name === name);
       if (stored === undefined) throw new Error(`no profile ${name}`);
       const learned = accountLearnedOnRefresh;
@@ -165,6 +176,7 @@ afterEach(() => {
   globalThis.fetch = originalFetch;
   storedProfiles = [];
   tokenFailure = undefined;
+  tokenFailuresLeft = 0;
   accountLearnedOnRefresh = undefined;
   resetCodexModelDiscoveryForTests();
 });
@@ -329,6 +341,109 @@ describe("ChatGPT model catalog", () => {
     expect(selectableCodexModelIds(reread)).toEqual(["gpt-6-sol"]);
   });
 
+  test("a fetch after a failed token read keeps its list for the account it fetched as", async () => {
+    storedProfiles = [profile("legacy")];
+    tokenFailuresLeft = 1;
+    accountLearnedOnRefresh = "acct-legacy";
+    serveModels([{ slug: "gpt-6-sol", visibility: "list", priority: 1 }]);
+
+    await prefetchCodexModels();
+
+    expect(selectableCodexModelIds(defined(storedProfiles[0]))).toEqual([
+      "gpt-6-sol",
+    ]);
+  });
+
+  describe("a login with no account id", () => {
+    const list = [{ slug: "gpt-6-sol", visibility: "list", priority: 1 }];
+
+    async function reconnectThenServe(response: () => Response) {
+      storedProfiles = [profile("work", undefined, 1)];
+      serveModels(list);
+      await prefetchCodexModels();
+      expect(selectableCodexModelIds(profile("work", undefined, 1))).toEqual([
+        "gpt-6-sol",
+      ]);
+
+      const reconnected = profile("work", undefined, 2);
+      storedProfiles = [reconnected];
+      serve(response);
+      await prefetchCodexModels();
+      return reconnected;
+    }
+
+    test("does not inherit the list of the login it replaced when its fetch fails", async () => {
+      const reconnected = await reconnectThenServe(
+        () => new Response("no", { status: 503 }),
+      );
+      expect(selectableCodexModelIds(reconnected)).toEqual(
+        CODEX_DEFAULT_MODELS,
+      );
+    });
+
+    test("does not inherit the list of the login it replaced when its catalog is empty", async () => {
+      const reconnected = await reconnectThenServe(() =>
+        Response.json({ models: [] }),
+      );
+      expect(selectableCodexModelIds(reconnected)).toEqual(
+        CODEX_DEFAULT_MODELS,
+      );
+    });
+
+    test("keeps its list across a token refresh, which keeps its creation time", async () => {
+      storedProfiles = [profile("work", undefined, 1)];
+      serveModels(list);
+      await prefetchCodexModels();
+
+      const refreshed = profile("work", undefined, 1);
+      refreshed.tokens = { ...refreshed.tokens, refresh: "rotated" };
+      expect(selectableCodexModelIds(refreshed)).toEqual(["gpt-6-sol"]);
+    });
+  });
+
+  describe("the models shown while connecting", () => {
+    const shown: [string, ...string[]] = ["gpt-6-sol", "gpt-5.6-luna"];
+
+    test("stay the profile's list when the fetch after connecting fails", async () => {
+      const connected = profile("work", "acct-new", 5);
+      rememberConnectedCodexModels(connected, shown);
+      storedProfiles = [connected];
+      serve(() => new Response("no", { status: 503 }));
+
+      await prefetchCodexModels();
+
+      expect(selectableCodexModelIds(connected)).toEqual(shown);
+    });
+
+    test("cover a login with no account id", () => {
+      const connected = profile("work", undefined, 5);
+      rememberConnectedCodexModels(connected, shown);
+
+      expect(selectableCodexModelIds(connected)).toEqual(shown);
+      expect(selectableCodexModelIds(profile("work", undefined, 6))).toEqual(
+        CODEX_DEFAULT_MODELS,
+      );
+    });
+
+    test("give way to a later successful fetch", async () => {
+      const connected = profile("work", "acct-new", 5);
+      rememberConnectedCodexModels(connected, shown);
+      storedProfiles = [connected];
+      serveModels([{ slug: "gpt-6.1-sol", visibility: "list", priority: 1 }]);
+
+      await prefetchCodexModels();
+
+      expect(selectableCodexModelIds(connected)).toEqual(["gpt-6.1-sol"]);
+    });
+
+    test("an empty list is not remembered", () => {
+      const connected = profile("work", "acct-new", 5);
+      rememberConnectedCodexModels(connected, []);
+
+      expect(selectableCodexModelIds(connected)).toEqual(CODEX_DEFAULT_MODELS);
+    });
+  });
+
   test("a reconnect whose first fetch fails does not show the previous account's list", async () => {
     storedProfiles = [profile("work", "acct-old")];
     serveModels([{ slug: "gpt-6-sol", visibility: "list", priority: 1 }]);

src/provider/codex-model-catalog.ts

@@ -16,6 +16,7 @@ import { listCodexProfiles } from "../config/oauth-stores.js";
 import {
   type CatalogDiscoveryState,
   createBoundedModelCatalog,
+  logCatalogFallback,
 } from "./bounded-model-catalog.js";
 import { DEFAULT_MODELS_REQUEST_TIMEOUT_MS } from "./models-endpoint.js";
 
@@ -92,42 +93,54 @@ function createCodexModelCatalog(
   });
 }
 
-// One catalog per profile and account, so a list is only ever read back for
-// the account that served it and a reconnected profile never shows the
-// previous account's list.
-const catalogs = new Map<string, ReturnType<typeof createCodexModelCatalog>>();
+// The last live list per login, so a list is only ever read back for the login
+// that served it and a reconnected profile never shows the previous account's
+// list. A login with no account id is told apart by its creation time: a token
+// refresh keeps that, and a new sign-in changes it.
+const liveLists = new Map<string, readonly [string, ...string[]]>();
 
-function catalogKey(profileName: string, accountId: string | undefined) {
-  return JSON.stringify([profileName, accountId ?? null]);
+function listKey(
+  profile: Pick<CodexProfile, "name" | "createdAt">,
+  accountId: string | undefined,
+) {
+  return JSON.stringify([profile.name, accountId ?? profile.createdAt]);
 }
 
-/** Sync picker ids for a ChatGPT profile: its account's last live list, else the built-in list. Never empty. */
+/** Sync picker ids for a ChatGPT profile: its login's last live list, else the built-in list. Never empty. */
 export function selectableCodexModelIds(
   profile: CodexProfile,
 ): readonly [string, ...string[]] {
   return (
-    catalogs
-      .get(catalogKey(profile.name, profile.tokens.accountId))
-      ?.selectableModelIds() ?? CODEX_DEFAULT_MODELS
+    liveLists.get(listKey(profile, profile.tokens.accountId)) ??
+    CODEX_DEFAULT_MODELS
   );
 }
 
 async function prefetchProfileModels(profile: CodexProfile): Promise<void> {
-  // A token refresh can name an account the stored profile does not have
-  // yet, so the refreshed token picks the catalog. When the refresh fails,
-  // the catalog's own request fails the same way and logs why.
-  const accountId = await getValidCodexToken(profile.name).then(
-    (access) => access.accountId,
-    () => profile.tokens.accountId,
-  );
-  const key = catalogKey(profile.name, accountId);
-  const catalog =
-    catalogs.get(key) ??
-    createCodexModelCatalog(`ChatGPT profile ${profile.name}`, () =>
+  const catalogLabel = `ChatGPT profile ${profile.name}`;
+  // A token refresh can name an account the stored profile does not have yet,
+  // so the token that made the request picks where its list is kept. A token
+  // read that fails gets one more try before the fetch counts as failed.
+  let accountId = profile.tokens.accountId;
+  const state = await createCodexModelCatalog(catalogLabel, async () => {
+    const access = await getValidCodexToken(profile.name).catch(() =>
       getValidCodexToken(profile.name),
     );
-  catalogs.set(key, catalog);
-  await catalog.prefetchModels();
+    accountId = access.accountId;
+    return access;
+  }).discoverModels();
+  const key = listKey(profile, accountId);
+  if (state.status === "models") {
+    liveLists.set(key, state.models);
+    return;
+  }
+  // Empty and failed fetches leave a live list in place: stale-but-live beats
+  // the built-in list.
+  logCatalogFallback(
+    catalogLabel,
+    state,
+    liveLists.has(key) ? "the last live list" : "the built-in list",
+  );
 }
 
 /** Fetch every stored ChatGPT profile's live catalog; failures keep the fallback and log why. */
@@ -145,6 +158,20 @@ export function discoverStagedCodexModels(
   ).discoverModels();
 }
 
+/**
+ * Keep the list a sign-in showed once its profile is saved, so the fetch after
+ * connecting failing leaves the models the operator just saw, not the built-in
+ * list.
+ */
+export function rememberConnectedCodexModels(
+  profile: CodexProfile,
+  models: readonly string[],
+): void {
+  const [first, ...rest] = models;
+  if (first === undefined) return;
+  liveLists.set(listKey(profile, profile.tokens.accountId), [first, ...rest]);
+}
+
 export function resetCodexModelDiscoveryForTests(): void {
-  catalogs.clear();
+  liveLists.clear();
 }

src/tui/onboarding.test.ts

@@ -267,6 +267,15 @@ describe("runOnboarding settings source", () => {
               expiresAt: 0,
             },
             commit: () => writeXAIAuthProfile(testHome, "work"),
+            profile: {
+              name: "work",
+              createdAt: 0,
+              tokens: {
+                access: "work-access-token",
+                refresh: "work-refresh-token",
+                expiresAt: 0,
+              },
+            },
           },
         },
       );

src/tui/provider-setup-submit.test.ts

@@ -65,6 +65,7 @@ function stagedCodexOAuth(
     providerName: "codex/work",
     tokens: stagedCodexTokens,
     commit,
+    profile: { name: "work", createdAt: 0, tokens: stagedCodexTokens },
   };
 }