fix(provider): key ChatGPT lists by sign-in and order their fetches

A fetch stored its list under the account id on the token that served it,
while the picker and the save after connecting read the id on the stored
profile. A refresh that taught the profile its id, followed by a failed
fetch, left the live list under the old key and showed the built-in one.
Lists are now keyed by profile name and creation time, which a token
refresh keeps and a reconnect changes, so every reader and writer agrees
and a blank account id no longer counts as an identity.

Overlapping fetches could answer in any order, so a startup fetch that
returned after the list shown at connect was kept replaced it with an
older view. Each request now takes a ticket when it starts, and an older
answer never replaces a newer list. The connect list is newer than every
fetch started before it was kept.

Confirming the connect model step before the fetch returned saved the
built-in default and dropped the live list, so the account's first model
never became the saved one. Confirming now waits for the fetch in flight,
bounded by its own timeout, then saves the pick made against the list.

Author: bwachman

docs/IMPLEMENTATION.md

@@ -420,7 +420,7 @@ This release changes no settings, OAuth-store, or session persistence format and
 
 **OpenCode Go multi-protocol.** Selectable ids come from live `GET /zen/go/v1/models` (process-cached; packaged seed when cold or the fetch fails). Byte and model-count caps fail closed as malformed — never a truncated prefix. Protocol routing stays on the local map; unknown live ids use Chat Completions. `buildGoSource` / `resolveGoEndpoint` pick the adapter and base URL per model (not a single provider-wide OpenAI route). When Go is the active provider, subscription usage is fetched for the status bar and omitted on auth/network failure.
 
-**ChatGPT model catalog.** Each ChatGPT (Codex OAuth) profile lists the models its account serves: after startup the TUI fetches `GET /codex/models` with the profile's refreshed token and account id, keeps entries whose `visibility` is `list`, orders them by `priority`, and the first becomes the profile's default (`src/provider/codex-model-catalog.ts`). Connecting an account fetches the same list with the just-issued token for the connect model step, which preselects its first model unless the operator has moved to another one; `/connect` keeps that list for the saved profile, then refreshes every profile's list for the picker. The list is cached per profile and account for the process (a login with no account id is told apart by when it signed in), and fleet workers spawned from the TUI read it through the live catalog. Until a fetch succeeds the profile uses `CODEX_DEFAULT_MODELS`; a later failed fetch keeps the last live list. Headless runs never fetch, so they and their workers always use `CODEX_DEFAULT_MODELS`. The backend filters the catalog by the request's `client_version`: an old `CODEX_CLIENT_VERSION` returns fewer models or none. Only an empty list logs a warning ("listed no models"); a shortened list is silent, so when a model the Codex CLI offers is missing here, bump `CODEX_CLIENT_VERSION` to a current Codex CLI release.
+**ChatGPT model catalog.** Each ChatGPT (Codex OAuth) profile lists the models its account serves: after startup the TUI fetches `GET /codex/models` with the profile's refreshed token and account id, keeps entries whose `visibility` is `list`, orders them by `priority`, and the first becomes the profile's default (`src/provider/codex-model-catalog.ts`). Connecting an account fetches the same list with the just-issued token for the connect model step, which preselects its first model unless the operator has moved to another one; `/connect` keeps that list for the saved profile, then refreshes every profile's list for the picker. The list is cached per sign-in for the process (profile name and when it signed in, which a token refresh keeps and a reconnect changes), and an older fetch never replaces a newer list. Confirming the connect model step while the fetch is still in flight waits for it, so the saved model is picked from the account's list. Fleet workers spawned from the TUI read it through the live catalog. Until a fetch succeeds the profile uses `CODEX_DEFAULT_MODELS`; a later failed fetch keeps the last live list. Headless runs never fetch, so they and their workers always use `CODEX_DEFAULT_MODELS`. The backend filters the catalog by the request's `client_version`: an old `CODEX_CLIENT_VERSION` returns fewer models or none. Only an empty list logs a warning ("listed no models"); a shortened list is silent, so when a model the Codex CLI offers is missing here, bump `CODEX_CLIENT_VERSION` to a current Codex CLI release.
 
 ### CLI Verbs and Flags
 

src/provider/codex-model-catalog.test.ts

@@ -277,11 +277,11 @@ describe("ChatGPT model catalog", () => {
   });
 
   test("a profile name reconnected to another account does not inherit the old list", async () => {
-    storedProfiles = [profile("work", "acct-old")];
+    storedProfiles = [profile("work", "acct-old", 1)];
     serveModels([{ slug: "gpt-6-sol", visibility: "list", priority: 1 }]);
     await prefetchCodexModels();
 
-    expect(selectableCodexModelIds(profile("work", "acct-new"))).toEqual(
+    expect(selectableCodexModelIds(profile("work", "acct-new", 2))).toEqual(
       CODEX_DEFAULT_MODELS,
     );
   });
@@ -341,7 +341,108 @@ describe("ChatGPT model catalog", () => {
     expect(selectableCodexModelIds(reread)).toEqual(["gpt-6-sol"]);
   });
 
-  test("a fetch after a failed token read keeps its list for the account it fetched as", async () => {
+  test("a list stays with its sign-in when a refresh learns the account id and the next fetch fails", async () => {
+    storedProfiles = [profile("legacy")];
+    serveModels([{ slug: "gpt-6-sol", visibility: "list", priority: 1 }]);
+    await prefetchCodexModels();
+
+    // A later refresh names the account and writes it back to the profile.
+    const learned = profile("legacy", "acct-late");
+    storedProfiles = [learned];
+    serve(() => new Response("no", { status: 503 }));
+    await prefetchCodexModels();
+
+    expect(selectableCodexModelIds(learned)).toEqual(["gpt-6-sol"]);
+  });
+
+  test("a blank account id does not make two sign-ins of one profile name share a list", async () => {
+    storedProfiles = [profile("work", "", 1)];
+    serveModels([{ slug: "gpt-6-sol", visibility: "list", priority: 1 }]);
+    await prefetchCodexModels();
+
+    expect(selectableCodexModelIds(profile("work", "", 1))).toEqual([
+      "gpt-6-sol",
+    ]);
+    expect(selectableCodexModelIds(profile("work", "", 2))).toEqual(
+      CODEX_DEFAULT_MODELS,
+    );
+  });
+
+  describe("overlapping fetches", () => {
+    const older = [{ slug: "gpt-5.6-luna", visibility: "list", priority: 1 }];
+    const newer = [{ slug: "gpt-6-sol", visibility: "list", priority: 1 }];
+
+    /** A fetch that stays pending until `release` answers it with `models`. */
+    function heldFetch() {
+      let release: ((models: unknown) => void) | undefined;
+      const held = new Promise<Response>((resolve) => {
+        release = (models) => resolve(Response.json({ models }));
+      });
+      return {
+        held,
+        release: (models: unknown) => defined(release, "release")(models),
+      };
+    }
+
+    test("a startup fetch that returns after the connect list was kept does not replace it", async () => {
+      const connected = profile("work", "acct-new", 5);
+      storedProfiles = [connected];
+      const slow = heldFetch();
+      let requests = 0;
+      serve(() => {
+        requests += 1;
+        return slow.held;
+      });
+      const startup = prefetchCodexModels();
+      while (requests === 0)
+        await new Promise((resolve) => setTimeout(resolve, 0));
+
+      rememberConnectedCodexModels(connected, ["gpt-6-sol", "gpt-5.6-luna"]);
+      slow.release(older);
+      await startup;
+
+      expect(selectableCodexModelIds(connected)).toEqual([
+        "gpt-6-sol",
+        "gpt-5.6-luna",
+      ]);
+    });
+
+    test("an earlier request's answer does not replace a later one's", async () => {
+      const work = profile("work", "acct-work", 1);
+      storedProfiles = [work];
+      const slow = heldFetch();
+      let requests = 0;
+      serve(() => {
+        requests += 1;
+        return requests === 1
+          ? slow.held
+          : Promise.resolve(Response.json({ models: newer }));
+      });
+      const first = prefetchCodexModels();
+      while (requests === 0)
+        await new Promise((resolve) => setTimeout(resolve, 0));
+      await prefetchCodexModels();
+      expect(selectableCodexModelIds(work)).toEqual(["gpt-6-sol"]);
+
+      slow.release(older);
+      await first;
+
+      expect(selectableCodexModelIds(work)).toEqual(["gpt-6-sol"]);
+    });
+
+    test("a later request's answer replaces an earlier one's", async () => {
+      const work = profile("work", "acct-work", 1);
+      storedProfiles = [work];
+      serveModels(older);
+      await prefetchCodexModels();
+      serveModels(newer);
+      await prefetchCodexModels();
+
+      expect(selectableCodexModelIds(work)).toEqual(["gpt-6-sol"]);
+    });
+  });
+
+  test("a fetch after a failed token read keeps its list", async () => {
     storedProfiles = [profile("legacy")];
     tokenFailuresLeft = 1;
     accountLearnedOnRefresh = "acct-legacy";
@@ -445,19 +546,17 @@ describe("ChatGPT model catalog", () => {
   });
 
   test("a reconnect whose first fetch fails does not show the previous account's list", async () => {
-    storedProfiles = [profile("work", "acct-old")];
+    storedProfiles = [profile("work", "acct-old", 1)];
     serveModels([{ slug: "gpt-6-sol", visibility: "list", priority: 1 }]);
     await prefetchCodexModels();
 
-    // The profile is listed under the old account, but by the time its token
-    // is read the reconnect has stored the new one.
-    accountLearnedOnRefresh = "acct-new";
+    // The reconnect stored a new sign-in under the same profile name.
+    const reconnected = profile("work", "acct-new", 2);
+    storedProfiles = [reconnected];
     serve(() => new Response("no", { status: 503 }));
     await prefetchCodexModels();
 
-    expect(selectableCodexModelIds(profile("work", "acct-new"))).toEqual(
-      CODEX_DEFAULT_MODELS,
-    );
+    expect(selectableCodexModelIds(reconnected)).toEqual(CODEX_DEFAULT_MODELS);
   });
 
   describe("falls back to the built-in list", () => {

src/provider/codex-model-catalog.ts

@@ -93,45 +93,60 @@ function createCodexModelCatalog(
   });
 }
 
-// The last live list per login, so a list is only ever read back for the login
-// that served it and a reconnected profile never shows the previous account's
-// list. A login with no account id is told apart by its creation time: a token
-// refresh keeps that, and a new sign-in changes it.
-const liveLists = new Map<string, readonly [string, ...string[]]>();
-
-function listKey(
-  profile: Pick<CodexProfile, "name" | "createdAt">,
-  accountId: string | undefined,
-) {
-  return JSON.stringify([profile.name, accountId ?? profile.createdAt]);
+// The last live list per sign-in, so a list is only ever read back for the
+// sign-in that served it and a reconnected profile never shows the previous
+// login's list. A sign-in is its profile name and creation time: a token
+// refresh keeps the creation time, even when it teaches the profile its
+// account id, and a new sign-in changes it. The account id is not part of the
+// key because the token that served a fetch and the stored profile can name it
+// differently, or not at all.
+interface LiveList {
+  readonly models: readonly [string, ...string[]];
+  /** When the request that produced it started; a later one replaces it. */
+  readonly ticket: number;
+}
+
+const liveLists = new Map<string, LiveList>();
+let lastTicket = 0;
+
+function listKey(profile: Pick<CodexProfile, "name" | "createdAt">) {
+  return JSON.stringify([profile.name, profile.createdAt]);
+}
+
+/** Replaces the key's list unless a later request's answer is already there. */
+function storeLiveList(
+  key: string,
+  models: readonly [string, ...string[]],
+  ticket: number,
+): void {
+  const current = liveLists.get(key);
+  if (current === undefined || current.ticket < ticket) {
+    liveLists.set(key, { models, ticket });
+  }
 }
 
-/** Sync picker ids for a ChatGPT profile: its login's last live list, else the built-in list. Never empty. */
+/** Sync picker ids for a ChatGPT profile: its sign-in's last live list, else the built-in list. Never empty. */
 export function selectableCodexModelIds(
   profile: CodexProfile,
 ): readonly [string, ...string[]] {
-  return (
-    liveLists.get(listKey(profile, profile.tokens.accountId)) ??
-    CODEX_DEFAULT_MODELS
-  );
+  return liveLists.get(listKey(profile))?.models ?? CODEX_DEFAULT_MODELS;
 }
 
 async function prefetchProfileModels(profile: CodexProfile): Promise<void> {
   const catalogLabel = `ChatGPT profile ${profile.name}`;
-  // A token refresh can name an account the stored profile does not have yet,
-  // so the token that made the request picks where its list is kept. A token
-  // read that fails gets one more try before the fetch counts as failed.
-  let accountId = profile.tokens.accountId;
-  const state = await createCodexModelCatalog(catalogLabel, async () => {
-    const access = await getValidCodexToken(profile.name).catch(() =>
+  // Requests are ordered by when they start: overlapping fetches for one
+  // sign-in can answer in any order, and the older answer must not win. A
+  // token read that fails gets one more try before the fetch counts as failed.
+  lastTicket += 1;
+  const ticket = lastTicket;
+  const state = await createCodexModelCatalog(catalogLabel, () =>
+    getValidCodexToken(profile.name).catch(() =>
       getValidCodexToken(profile.name),
-    );
-    accountId = access.accountId;
-    return access;
-  }).discoverModels();
-  const key = listKey(profile, accountId);
+    ),
+  ).discoverModels();
+  const key = listKey(profile);
   if (state.status === "models") {
-    liveLists.set(key, state.models);
+    storeLiveList(key, state.models, ticket);
     return;
   }
   // Empty and failed fetches leave a live list in place: stale-but-live beats
@@ -169,7 +184,10 @@ export function rememberConnectedCodexModels(
 ): void {
   const [first, ...rest] = models;
   if (first === undefined) return;
-  liveLists.set(listKey(profile, profile.tokens.accountId), [first, ...rest]);
+  // Newer than every fetch started so far: one still in flight answers with
+  // an older view and must not replace the list the operator just chose from.
+  lastTicket += 1;
+  storeLiveList(listKey(profile), [first, ...rest], lastTicket);
 }
 
 export function resetCodexModelDiscoveryForTests(): void {

src/tui/provider-setup.test.ts

@@ -1115,6 +1115,109 @@ describe("runProviderSetup sign-in", () => {
     expect(seen[0]?.model).toBe("gpt-5.6-luna");
   });
 
+  describe("confirming the model step before the account's list arrives", () => {
+    test("waits for the list and saves its first model", async () => {
+      const seen: ProviderFormValues[] = [];
+      const remembered: (readonly string[])[] = [];
+      const discovery = deferredCodexDiscovery();
+      const { start, events } = stagedLoginStarter();
+      const { done, harness } = await mountLogin({
+        start,
+        onSubmit: async (values) => {
+          seen.push({ ...values });
+        },
+        rememberCodexModels: (_profile, models) => {
+          remembered.push(models);
+        },
+        discoverCodexModels: discovery.discover,
+      });
+      await signInToChatGPT(harness, events);
+
+      harness.pressKey("Enter");
+      await flush(harness);
+      expect(seen).toEqual([]);
+
+      discovery.land(0, ["gpt-5.6-luna", "gpt-6-sol"]);
+      await flush(harness);
+      expect(await done).toBe(true);
+      expect(seen[0]?.model).toBe("gpt-5.6-luna");
+      expect(remembered).toEqual([["gpt-5.6-luna", "gpt-6-sol"]]);
+    });
+
+    test("saves a model the operator moved to when the list has it", async () => {
+      const seen: ProviderFormValues[] = [];
+      const discovery = deferredCodexDiscovery();
+      const { start, events } = stagedLoginStarter();
+      const { done, harness } = await mountLogin({
+        start,
+        onSubmit: async (values) => {
+          seen.push({ ...values });
+        },
+        discoverCodexModels: discovery.discover,
+      });
+      await signInToChatGPT(harness, events);
+      const moved = defined(CODEX_DEFAULT_MODELS[1]);
+      harness.pressKey("ARROW_DOWN");
+      harness.pressKey("Enter");
+      await flush(harness);
+      expect(seen).toEqual([]);
+
+      discovery.land(0, ["gpt-5.6-luna", moved]);
+      await flush(harness);
+      expect(await done).toBe(true);
+      expect(seen[0]?.model).toBe(moved);
+    });
+
+    test("saves the built-in default when the fetch fails", async () => {
+      const seen: ProviderFormValues[] = [];
+      let fail: (() => void) | undefined;
+      const { start, events } = stagedLoginStarter();
+      const { done, harness } = await mountLogin({
+        start,
+        onSubmit: async (values) => {
+          seen.push({ ...values });
+        },
+        discoverCodexModels: () =>
+          new Promise((resolve) => {
+            fail = () => resolve({ status: "unavailable", message: "offline" });
+          }),
+      });
+      await signInToChatGPT(harness, events);
+
+      harness.pressKey("Enter");
+      await flush(harness);
+      expect(seen).toEqual([]);
+
+      defined(fail, "fetch")();
+      await flush(harness);
+      expect(await done).toBe(true);
+      expect(seen[0]?.model).toBe(CODEX_DEFAULT_MODELS[0]);
+    });
+
+    test("saves nothing when the operator cancels while it waits", async () => {
+      const seen: ProviderFormValues[] = [];
+      const discovery = deferredCodexDiscovery();
+      const { start, events } = stagedLoginStarter();
+      const { done, harness } = await mountLogin({
+        start,
+        onSubmit: async (values) => {
+          seen.push({ ...values });
+        },
+        discoverCodexModels: discovery.discover,
+      });
+      await signInToChatGPT(harness, events);
+
+      harness.pressKey("Enter");
+      await flush(harness);
+      harness.pressKey("Ctrl+C");
+      expect(await done).toBe(false);
+
+      discovery.land(0, ["gpt-5.6-luna"]);
+      await flush(harness);
+      expect(seen).toEqual([]);
+    });
+  });
+
   describe("the list a sign-in showed", () => {
     function rememberRecorder() {
       const remembered: { name: string; models: readonly string[] }[] = [];

src/tui/provider/discovery.ts

@@ -49,6 +49,7 @@ export function createDiscoveryFlows(
 
   const abandonCodexPrefetch = (): void => {
     state.codexPrefetchAttempt += 1;
+    state.codexListPending = null;
   };
 
   const beginOllamaDiscovery = (): void => {
@@ -225,7 +226,7 @@ export function createDiscoveryFlows(
     }
     const attempt = state.codexPrefetchAttempt;
     const prefill = state.choice.defaultModel;
-    void state
+    const pending = state
       .discoverCodexModels(login.tokens)
       .then((discovered) => {
         if (
@@ -285,7 +286,11 @@ export function createDiscoveryFlows(
         // discoverCodexModels never rejects, so only a failure while swapping
         // the list in lands here; the list already on screen stays usable.
         logger.warn`ChatGPT sign-in model list update failed error=${err instanceof Error ? err.message : String(err)}`;
+      })
+      .finally(() => {
+        if (state.codexListPending === pending) state.codexListPending = null;
       });
+    state.codexListPending = pending;
   };
 
   return {