feat(tui): offer the account's live ChatGPT models at connect

Author: bwachman

docs/IMPLEMENTATION.md

@@ -420,7 +420,7 @@ This release changes no settings, OAuth-store, or session persistence format and
 
 **OpenCode Go multi-protocol.** Selectable ids come from live `GET /zen/go/v1/models` (process-cached; packaged seed when cold or the fetch fails). Byte and model-count caps fail closed as malformed — never a truncated prefix. Protocol routing stays on the local map; unknown live ids use Chat Completions. `buildGoSource` / `resolveGoEndpoint` pick the adapter and base URL per model (not a single provider-wide OpenAI route). When Go is the active provider, subscription usage is fetched for the status bar and omitted on auth/network failure.
 
-**ChatGPT model catalog.** Each ChatGPT (Codex OAuth) profile lists the models its account serves: after startup the TUI fetches `GET /codex/models` with the profile's refreshed token and account id, keeps entries whose `visibility` is `list`, orders them by `priority`, and the first becomes the profile's default (`src/provider/codex-model-catalog.ts`). Connecting an account with `/connect` refreshes every profile's list for the picker. The list is cached per profile and account for the process, and fleet workers spawned from the TUI read it through the live catalog. Until a fetch succeeds the profile uses `CODEX_DEFAULT_MODELS`; a later failed fetch keeps the last live list. Headless runs never fetch, so they and their workers always use `CODEX_DEFAULT_MODELS`. The backend filters the catalog by the request's `client_version`: an old `CODEX_CLIENT_VERSION` returns fewer models or none. Only an empty list logs a warning ("listed no models"); a shortened list is silent, so when a model the Codex CLI offers is missing here, bump `CODEX_CLIENT_VERSION` to a current Codex CLI release.
+**ChatGPT model catalog.** Each ChatGPT (Codex OAuth) profile lists the models its account serves: after startup the TUI fetches `GET /codex/models` with the profile's refreshed token and account id, keeps entries whose `visibility` is `list`, orders them by `priority`, and the first becomes the profile's default (`src/provider/codex-model-catalog.ts`). Connecting an account fetches the same list with the just-issued token for the connect model step, which preselects its first model unless the operator has moved to another one; `/connect` then refreshes every profile's list for the picker. The list is cached per profile and account for the process, and fleet workers spawned from the TUI read it through the live catalog. Until a fetch succeeds the profile uses `CODEX_DEFAULT_MODELS`; a later failed fetch keeps the last live list. Headless runs never fetch, so they and their workers always use `CODEX_DEFAULT_MODELS`. The backend filters the catalog by the request's `client_version`: an old `CODEX_CLIENT_VERSION` returns fewer models or none. Only an empty list logs a warning ("listed no models"); a shortened list is silent, so when a model the Codex CLI offers is missing here, bump `CODEX_CLIENT_VERSION` to a current Codex CLI release.
 
 ### CLI Verbs and Flags
 

src/provider/bounded-model-catalog.ts

@@ -80,6 +80,43 @@ type DiscoveredModels = Extract<
   { status: "models" }
 >["models"];
 
+/**
+ * Log why a live catalog fetch kept `keeping` instead of a fresh list. An
+ * unreachable catalog is routine (offline, transient outage), so it stays at
+ * debug; an empty or malformed answer means the endpoint's contract moved,
+ * which only shows up here, so it warns.
+ */
+export function logCatalogFallback(
+  catalogLabel: string,
+  state: Exclude<CatalogDiscoveryState, { status: "models" }>,
+  keeping: string,
+): void {
+  // HTTP and size failures already name the catalog; transport and parse
+  // errors do not, so the catalog is named exactly once either way.
+  const reason = (message: string): string =>
+    message.startsWith(catalogLabel) ? message : `${catalogLabel}: ${message}`;
+  switch (state.status) {
+    case "unavailable":
+      catalogLogger.debug(
+        "Model catalog unavailable ({reason}); keeping {fallback}",
+        { reason: reason(state.message), fallback: keeping },
+      );
+      return;
+    case "empty":
+      catalogLogger.warn(
+        "Model catalog listed no models ({catalog}); keeping {fallback}",
+        { catalog: catalogLabel, fallback: keeping },
+      );
+      return;
+    case "malformed":
+      catalogLogger.warn(
+        "Model catalog response rejected ({reason}); keeping {fallback}",
+        { reason: reason(state.message), fallback: keeping },
+      );
+      return;
+  }
+}
+
 export function createBoundedModelCatalog<
   Seed extends readonly string[],
 >(args: {
@@ -198,40 +235,14 @@ export function createBoundedModelCatalog<
     return selectableModelIds();
   }
 
-  // An unreachable catalog is routine (offline, transient outage), so it
-  // stays at debug. An empty or malformed answer means the endpoint's
-  // contract moved, which only shows up here, so it warns.
   function logFallback(
     state: Exclude<CatalogDiscoveryState, { status: "models" }>,
   ): void {
-    const fallback =
-      snapshot === undefined ? "the built-in list" : "the last live list";
-    // HTTP and size failures already name the catalog; transport and parse
-    // errors do not, so the catalog is named exactly once either way.
-    const reason = (message: string): string =>
-      message.startsWith(catalogLabel)
-        ? message
-        : `${catalogLabel}: ${message}`;
-    switch (state.status) {
-      case "unavailable":
-        catalogLogger.debug(
-          "Model catalog unavailable ({reason}); keeping {fallback}",
-          { reason: reason(state.message), fallback },
-        );
-        return;
-      case "empty":
-        catalogLogger.warn(
-          "Model catalog listed no models ({catalog}); keeping {fallback}",
-          { catalog: catalogLabel, fallback },
-        );
-        return;
-      case "malformed":
-        catalogLogger.warn(
-          "Model catalog response rejected ({reason}); keeping {fallback}",
-          { reason: reason(state.message), fallback },
-        );
-        return;
-    }
+    logCatalogFallback(
+      catalogLabel,
+      state,
+      snapshot === undefined ? "the built-in list" : "the last live list",
+    );
   }
 
   function prefetchModels(): Promise<Seed | DiscoveredModels> {

src/provider/codex-model-catalog.test.ts

@@ -12,6 +12,7 @@ import type * as CodexSession from "../auth/codex/session.js";
 import type * as OAuthStores from "../config/oauth-stores.js";
 import { codexProfilesToCatalogEntries } from "../config/codex-providers.js";
 import {
+  discoverStagedCodexModels,
   prefetchCodexModels,
   resetCodexModelDiscoveryForTests,
   selectableCodexModelIds,
@@ -436,3 +437,54 @@ describe("contract drift", () => {
     expect(defined(misses[0])).toContain("response rejected");
   });
 });
+
+describe("a sign-in not yet saved as a profile", () => {
+  const staged = () => ({
+    access: "staged-access",
+    refresh: "staged-refresh",
+    expiresAt: Date.now() + 3_600_000,
+    accountId: "acct-new",
+  });
+
+  test("asks with the staged token and account and returns the listed models", async () => {
+    const seen: Headers[] = [];
+    serve((_url, headers) => {
+      seen.push(headers);
+      return Response.json({
+        models: [
+          { slug: "gpt-6-sol", visibility: "list", priority: 2 },
+          { slug: "gpt-5.6-luna", visibility: "list", priority: 1 },
+        ],
+      });
+    });
+
+    expect(await discoverStagedCodexModels(staged())).toEqual({
+      status: "models",
+      models: ["gpt-5.6-luna", "gpt-6-sol"],
+    });
+    expect(seen[0]?.get("authorization")).toBe("Bearer staged-access");
+    expect(seen[0]?.get("chatgpt-account-id")).toBe("acct-new");
+  });
+
+  test("reports an HTTP failure as unavailable instead of rejecting", async () => {
+    serve(() => new Response("no", { status: 500 }));
+
+    expect((await discoverStagedCodexModels(staged())).status).toBe(
+      "unavailable",
+    );
+  });
+
+  test("never fills a stored profile's list", async () => {
+    serveModels([{ slug: "gpt-6-sol", visibility: "list", priority: 1 }]);
+
+    await discoverStagedCodexModels(staged());
+
+    expect(
+      selectableCodexModelIds({
+        name: "default",
+        createdAt: 0,
+        tokens: staged(),
+      }),
+    ).toEqual(CODEX_DEFAULT_MODELS);
+  });
+});

src/provider/codex-model-catalog.ts

@@ -5,8 +5,12 @@ import {
   CODEX_DEFAULT_MODELS,
   CODEX_MODELS_URL,
 } from "../auth/codex/constants.js";
-import { type CodexAccess, getValidCodexToken } from "../auth/codex/session.js";
-import type { CodexProfile } from "../auth/codex/store.js";
+import {
+  type CodexAccess,
+  getValidCodexToken,
+  refreshStagedCodexTokens,
+} from "../auth/codex/session.js";
+import type { CodexProfile, CodexTokens } from "../auth/codex/store.js";
 import { COMMAND_NAME } from "../branding.js";
 import { listCodexProfiles } from "../config/oauth-stores.js";
 import {
@@ -132,6 +136,15 @@ export async function prefetchCodexModels(): Promise<void> {
   await Promise.all(profiles.map(prefetchProfileModels));
 }
 
+/** One fetch for a sign-in not yet saved as a profile. Never rejects; a failure is a non-`models` state. */
+export function discoverStagedCodexModels(
+  tokens: CodexTokens,
+): Promise<CatalogDiscoveryState> {
+  return createCodexModelCatalog("ChatGPT sign-in", () =>
+    refreshStagedCodexTokens(tokens),
+  ).discoverModels();
+}
+
 export function resetCodexModelDiscoveryForTests(): void {
   catalogs.clear();
 }