@bubblebrain-ai/bubble 0.0.58 → 0.0.60

package/dist/provider-registry.js

@@ -12,7 +12,7 @@ import { BUILTIN_PROVIDERS as CATALOG_PROVIDERS, clearDynamicModelMetadata, getB
 import { ModelConfig } from "./model-config.js";
 import { AuthStorage } from "./oauth/index.js";
 import { fetchGeminiModels, geminiReasoningLevels } from "./provider-ai-sdk.js";
-import { extractChatGptAccountId, fetchOpenAICodexModelCatalog } from "./provider-openai-codex.js";
+import { extractChatGptAccountId, fetchOpenAICodexModelCatalog, getCodexClientVersion } from "./provider-openai-codex.js";
 import { fetchGrokSubscriptionModels } from "./provider-grok.js";
 import { refreshOpenAICodex } from "./oauth/openai-codex.js";
 import { refreshGrok } from "./oauth/grok.js";
@@ -44,7 +44,9 @@ async function fetchOpenAICompatibleModelIds(provider) {
     if (!response.ok)
         throw new Error(`HTTP ${response.status}`);
     const payload = (await response.json());
-    const entries = payload.data ?? payload.models ?? [];
+    const entries = payload?.data ?? payload?.models;
+    if (!Array.isArray(entries))
+        throw new Error("Model catalog response has no model list.");
     return entries
         .filter((entry) => typeof entry?.id === "string" && entry.id.trim().length > 0)
         .map((entry) => ({
@@ -63,12 +65,17 @@ export function sanitizeProviderHeaders(value) {
     }
     return Object.keys(out).length > 0 ? out : undefined;
 }
+function isCompleteDiscovery(result) {
+    return result.source === "remote" && result.authoritative && !result.error;
+}
 const MODEL_DISCOVERY_SUCCESS_TTL_MS = 60_000;
 const MODEL_DISCOVERY_FAILURE_TTL_MS = 10_000;
 /** How long a successful discovery survives on disk before a fresh fetch. */
 const MODEL_DISCOVERY_DISK_TTL_MS = 24 * 60 * 60 * 1000;
 /** Discovery must never delay startup or a model picker for long. */
 const MODEL_DISCOVERY_TIMEOUT_MS = 5_000;
+// Per request: the ChatGPT backend is often reached through a user proxy.
+const OPENAI_CODEX_MODEL_DISCOVERY_TIMEOUT_MS = 15_000;
 // Included in the cache identity so a pre-single-model OpenRouter disk cache
 // can never repopulate the picker with the old full remote catalog.
 const OPENROUTER_CATALOG_SCOPE = "ox-alpha-only-v2";
@@ -123,6 +130,10 @@ export const USER_VISIBLE_PROVIDER_IDS = BUILTIN_PROVIDERS
 export function isUserVisibleProvider(providerId) {
     return USER_VISIBLE_PROVIDER_IDS.includes(providerId);
 }
+/** Judge expiry on the exact credential set the caller is about to send. */
+function credentialsExpired(credentials, graceMs = 5 * 60 * 1000) {
+    return Date.now() >= credentials.expiresAt - graceMs;
+}
 export class ProviderRegistry {
     config;
     modelConfig;
@@ -165,10 +176,12 @@ export class ProviderRegistry {
             const parsed = JSON.parse(readFileSync(this.discoveryDiskCachePath, "utf8"));
             const now = Date.now();
             for (const [key, entry] of Object.entries(parsed)) {
-                if (!entry || typeof entry.expiresAt !== "number" || entry.expiresAt <= now)
+                if (!entry || typeof entry.expiresAt !== "number")
                     continue;
                 if (!entry.result || !Array.isArray(entry.result.models))
                     continue;
+                if (entry.expiresAt <= now && !(entry.providerId === "openai" && isCompleteDiscovery(entry.result)))
+                    continue;
                 const provider = { id: entry.providerId ?? "", authType: entry.authType, protocol: entry.protocol };
                 // Capability fields may have been derived by an older Bubble build.
                 // Recompute them with the current code while retaining cached remote
@@ -181,6 +194,7 @@ export class ProviderRegistry {
                     providerId: provider.id,
                     authType: entry.authType,
                     protocol: entry.protocol,
+                    confirmed: isCompleteDiscovery(result) ? { models: result.models, until: entry.expiresAt } : undefined,
                 });
                 // Rebuild the dynamic overlay so context window / reasoning levels
                 // resolve from the cached catalog at startup, not only on /model open.
@@ -199,17 +213,28 @@ export class ProviderRegistry {
             return;
         try {
             const data = {};
+            const now = Date.now();
             for (const [key, entry] of this.modelDiscoveryCache) {
-                if (entry.result.error)
-                    continue;
-                data[key] = {
-                    result: entry.result,
-                    expiresAt: Date.now() + MODEL_DISCOVERY_DISK_TTL_MS,
+                const common = {
                     identityKey: entry.identityKey,
                     providerId: entry.providerId,
                     authType: entry.authType,
                     protocol: entry.protocol,
                 };
+                if (!entry.result.error) {
+                    data[key] = { ...common, result: entry.result, expiresAt: now + MODEL_DISCOVERY_DISK_TTL_MS };
+                    continue;
+                }
+                // A failed refresh must not erase the identity's last confirmed catalog
+                // from disk when an unrelated provider triggers a rewrite; persist the
+                // confirmation under its remaining horizon instead of dropping the key.
+                if (entry.confirmed && (entry.confirmed.until > now || entry.providerId === "openai")) {
+                    data[key] = {
+                        ...common,
+                        result: { models: entry.confirmed.models, source: "remote", authoritative: true },
+                        expiresAt: entry.confirmed.until,
+                    };
+                }
             }
             mkdirSync(dirname(this.discoveryDiskCachePath), { recursive: true });
             writeFileSync(this.discoveryDiskCachePath, JSON.stringify(data, null, 2), { mode: 0o600 });
@@ -225,6 +250,10 @@ export class ProviderRegistry {
      * (docs/model-routing-design.md §1.6).
      */
     getRoutingRevision() {
+        // A login/logout in another Bubble process only reaches handleAuthMutation
+        // when the storage notices the file changed; callers cache against this
+        // number without touching credentials, so look now (one stat).
+        this.authStorage.sync();
         return this.routingRevision;
     }
     bumpRoutingRevision() {
@@ -259,9 +288,57 @@ export class ProviderRegistry {
     getAuthStorage() {
         return this.authStorage;
     }
+    /**
+     * Run discovery for an account-scoped (OAuth) provider so the routing
+     * snapshot knows the account's real catalog before the routing prompt is
+     * composed and before the first subagent spawn. Discovery was previously
+     * triggered only by the model picker, which left tier routing on the static
+     * builtin list for the whole session unless the user opened /model.
+     * Resolves when discovery settles (it never throws: failures resolve to the
+     * local fallback); resolves immediately when a fresh cache exists or the
+     * provider is not account-scoped. Hosts bound the wait, see waitForModelDiscovery.
+     */
+    warmModelDiscovery(providerId) {
+        const provider = this.getConfigured().find((item) => item.id === providerId);
+        if (!provider?.enabled || !provider.apiKey || provider.authType !== "oauth")
+            return Promise.resolve();
+        if (this.getCachedDiscoverySnapshot(providerId))
+            return Promise.resolve();
+        return this.discoverModels(provider).then(() => undefined, () => undefined);
+    }
+    /**
+     * Warm discovery but never hold startup hostage to the network: after
+     * `maxWaitMs` the host proceeds with whatever the snapshot has, and the
+     * still-running discovery updates the live accessor when it lands.
+     */
+    async waitForModelDiscovery(providerId, maxWaitMs) {
+        let timer;
+        const deadline = new Promise((resolve) => {
+            timer = setTimeout(resolve, maxWaitMs);
+            timer.unref?.();
+        });
+        try {
+            await Promise.race([this.warmModelDiscovery(providerId), deadline]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
     supportsOAuth(providerId) {
         return !!getBuiltinProvider(providerId)?.supportsOAuth;
     }
+    /**
+     * Auth-storage keys currently backing a provider's OAuth login. The visible
+     * `openai` provider may still be backed by the legacy `openai-codex` key,
+     * so UI state and logout must not check `has(providerId)` directly.
+     */
+    getOAuthLoginKeys(providerId) {
+        const candidates = providerId === "openai" || providerId === "openai-codex"
+            ? ["openai", "openai-codex"]
+            : [providerId];
+        return candidates.filter((key) => this.authStorage.has(key));
+    }
     resolveOAuthAuthKey(providerId) {
         if (providerId === "openai" || providerId === "openai-codex") {
             if (this.authStorage.has("openai"))
@@ -280,30 +357,10 @@ export class ProviderRegistry {
         let refreshPromise;
         return {
             getCredentials: readCredentials,
-            isExpired: (_credentials, graceMs) => this.authStorage.isExpired(this.resolveOAuthAuthKey(providerId), graceMs),
-            refreshCredentials: async () => {
+            isExpired: credentialsExpired,
+            refreshCredentials: async (used) => {
                 if (!refreshPromise) {
-                    refreshPromise = (async () => {
-                        const authKey = this.resolveOAuthAuthKey(providerId);
-                        const current = this.authStorage.get(authKey);
-                        if (!current?.refreshToken) {
-                            throw new Error(`OpenAI OAuth credentials for ${providerId} are missing a refresh token.`);
-                        }
-                        const refreshed = await refreshOpenAICodex(current.refreshToken);
-                        const next = {
-                            type: "oauth",
-                            accessToken: refreshed.accessToken,
-                            refreshToken: refreshed.refreshToken,
-                            expiresAt: refreshed.expiresAt,
-                            idToken: refreshed.idToken || current.idToken,
-                            accountId: refreshed.accountId || current.accountId,
-                        };
-                        this.authStorage.set("openai", next);
-                        if (authKey !== "openai") {
-                            this.authStorage.set(authKey, next);
-                        }
-                        return next;
-                    })().finally(() => {
+                    refreshPromise = this.refreshOpenAICredentials(providerId, used).finally(() => {
                         refreshPromise = undefined;
                     });
                 }
@@ -317,24 +374,10 @@ export class ProviderRegistry {
         let refreshPromise;
         return {
             getCredentials: () => this.authStorage.get("grok"),
-            isExpired: (_credentials, graceMs) => this.authStorage.isExpired("grok", graceMs),
-            refreshCredentials: async () => {
+            isExpired: credentialsExpired,
+            refreshCredentials: async (used) => {
                 if (!refreshPromise) {
-                    refreshPromise = (async () => {
-                        const current = this.authStorage.get("grok");
-                        if (!current?.refreshToken) {
-                            throw new Error("Grok OAuth credentials are missing a refresh token. Run /login grok again.");
-                        }
-                        const refreshed = await refreshGrok(current.refreshToken);
-                        const next = {
-                            type: "oauth",
-                            accessToken: refreshed.accessToken,
-                            refreshToken: refreshed.refreshToken,
-                            expiresAt: refreshed.expiresAt,
-                        };
-                        this.authStorage.set("grok", next);
-                        return next;
-                    })().finally(() => {
+                    refreshPromise = this.refreshGrokCredentials(used).finally(() => {
                         refreshPromise = undefined;
                     });
                 }
@@ -353,38 +396,138 @@ export class ProviderRegistry {
         return listBuiltinModels(providerId)[0]?.id;
     }
     async prepareProvider(providerId) {
-        if (providerId === "grok" && this.authStorage.isExpired("grok")) {
-            const creds = this.authStorage.get("grok");
-            if (creds?.refreshToken) {
-                const refreshed = await refreshGrok(creds.refreshToken);
-                this.authStorage.set("grok", {
+        // One snapshot decides both "is it expired" and "what did we hold": with
+        // two reads another process could rotate in between, and the fresh set
+        // would be taken for the held one and refreshed again for nothing.
+        if (providerId === "grok") {
+            const held = this.authStorage.get("grok");
+            if (held?.refreshToken && credentialsExpired(held))
+                await this.refreshGrokCredentials(held);
+            return;
+        }
+        if (providerId !== "openai" && providerId !== "openai-codex")
+            return;
+        const held = this.authStorage.get(this.resolveOAuthAuthKey(providerId));
+        if (held?.refreshToken && credentialsExpired(held))
+            await this.refreshOpenAICredentials(providerId, held);
+    }
+    refreshOpenAICredentials(providerId, used) {
+        return this.refreshSharedCredentials({
+            // Resolved under the lock: another process may have completed a fresh
+            // /login openai meanwhile, and a legacy openai-codex refresh must not be
+            // mirrored over it.
+            resolveKeys: () => {
+                const authKey = this.resolveOAuthAuthKey(providerId);
+                // "openai" is the canonical key; a legacy openai-codex login is mirrored.
+                return { authKey, writeKeys: authKey === "openai" ? ["openai"] : ["openai", authKey] };
+            },
+            used,
+            label: "OpenAI",
+            loginHint: "/login openai",
+            refresh: async (current) => {
+                const refreshed = await refreshOpenAICodex(current.refreshToken);
+                return {
                     type: "oauth",
                     accessToken: refreshed.accessToken,
                     refreshToken: refreshed.refreshToken,
                     expiresAt: refreshed.expiresAt,
-                });
-            }
-            return;
-        }
-        const authKey = this.resolveOAuthAuthKey(providerId);
-        if ((providerId === "openai" || providerId === "openai-codex") && this.authStorage.isExpired(authKey)) {
-            const creds = this.authStorage.get(authKey);
-            if (creds?.refreshToken) {
-                const refreshed = await refreshOpenAICodex(creds.refreshToken);
-                const next = {
+                    idToken: refreshed.idToken || current.idToken,
+                    accountId: refreshed.accountId || current.accountId,
+                };
+            },
+        });
+    }
+    refreshGrokCredentials(used) {
+        return this.refreshSharedCredentials({
+            resolveKeys: () => ({ authKey: "grok", writeKeys: ["grok"] }),
+            used,
+            label: "Grok",
+            loginHint: "/login grok",
+            refresh: async (current) => {
+                const refreshed = await refreshGrok(current.refreshToken);
+                return {
                     type: "oauth",
                     accessToken: refreshed.accessToken,
                     refreshToken: refreshed.refreshToken,
                     expiresAt: refreshed.expiresAt,
-                    idToken: refreshed.idToken || creds.idToken,
-                    accountId: refreshed.accountId || creds.accountId,
                 };
-                this.authStorage.set("openai", next);
-                if (authKey !== "openai") {
-                    this.authStorage.set(authKey, next);
+            },
+        });
+    }
+    /**
+     * The one place a refresh token is spent. auth.json is shared by every
+     * Bubble process and refresh tokens are single-use, so the token is only
+     * presented under the cross-process lock and only after re-reading the file:
+     * if another process already rotated it, its result is adopted and no
+     * request is made. A rejected token gets the same second look before the
+     * error surfaces, because the rotation may have landed mid-request.
+     *
+     * `used` is the credential set the caller was holding when it asked (the
+     * provider passes it, also for a forced refresh after a 401): "rotated" means
+     * the file no longer holds that set, not merely that it is unexpired.
+     */
+    refreshSharedCredentials(options) {
+        const { label, loginHint, refresh } = options;
+        const held = options.used ?? this.authStorage.get(options.resolveKeys().authKey);
+        return this.authStorage.withRefreshLock(async () => {
+            this.authStorage.reload();
+            const { authKey, writeKeys } = options.resolveKeys();
+            const current = this.authStorage.get(authKey);
+            if (!current?.refreshToken) {
+                throw new Error(`${label} OAuth credentials are missing a refresh token. Run ${loginHint} again.`);
+            }
+            const rotatedElsewhere = (since) => {
+                this.authStorage.reload();
+                // Re-resolved every time: a login elsewhere may have created the
+                // canonical key since, and it is then the entry to adopt.
+                const latest = this.authStorage.get(options.resolveKeys().authKey);
+                if (!latest || !since)
+                    return undefined;
+                if (latest.refreshToken === since.refreshToken && latest.accessToken === since.accessToken)
+                    return undefined;
+                return credentialsExpired(latest) ? undefined : latest;
+            };
+            const adopted = rotatedElsewhere(held);
+            if (adopted)
+                return adopted;
+            let next;
+            try {
+                next = await refresh(current);
+            }
+            catch (error) {
+                const rescued = rotatedElsewhere(current);
+                if (rescued)
+                    return rescued;
+                const message = error instanceof Error ? error.message : String(error);
+                // A 400/401 from the token endpoint is a verdict on the refresh token
+                // (reused, revoked, expired), not a transient failure: say what to do.
+                if (/Token refresh failed: 40[01]\b|refresh_token_reused|invalid_grant/.test(message)) {
+                    throw new Error(`${label} login is no longer valid. Run ${loginHint} to sign in again.\n${message}`);
                 }
+                throw error;
             }
-        }
+            // A /login or /logout elsewhere may have landed while the request was in
+            // flight (they do not take the refresh lock): their outcome wins.
+            if (!this.authStorage.replaceIfUnchanged(authKey, next, current.refreshToken)) {
+                const replaced = this.authStorage.get(authKey);
+                if (replaced)
+                    return replaced;
+                throw new Error(`${label} credentials were removed while refreshing. Run ${loginHint} to sign in again.`);
+            }
+            for (const key of writeKeys) {
+                if (key === authKey)
+                    continue;
+                // Mirror keys were absent when resolved under the lock. If a login
+                // created one since, it is now the preferred entry: leave it alone and
+                // hand its credentials to the caller instead of the old account's.
+                if (!this.authStorage.replaceIfUnchanged(key, next, null)) {
+                    const preferred = this.authStorage.get(options.resolveKeys().authKey);
+                    if (preferred && !credentialsExpired(preferred))
+                        return preferred;
+                }
+            }
+            return next;
+        });
     }
     getConfigured() {
         // 1. Try models.json first
@@ -459,6 +602,14 @@ export class ProviderRegistry {
                 });
             }
         }
+        // OAuth providers can be injected even when models.json owns the model
+        // catalog. Honor the separately stored enable preference in either path.
+        const enablePreferences = new Map(this.config.getProviders().map((p) => [p.id, p.enabled]));
+        for (const provider of providers) {
+            if (provider.authType === "oauth" && enablePreferences.has(provider.id)) {
+                provider.enabled = enablePreferences.get(provider.id) !== false && !!provider.apiKey;
+            }
+        }
         return providers;
     }
     getEnabled() {
@@ -515,6 +666,8 @@ export class ProviderRegistry {
     async discoverModels(provider, options = {}) {
         const key = this.modelDiscoveryKey(provider);
         const now = Date.now();
+        // A failed refresh must carry the last confirmed catalog forward.
+        const retainedConfirmation = this.modelDiscoveryCache.get(key)?.confirmed;
         if (!options.forceRefresh) {
             const cached = this.modelDiscoveryCache.get(key);
             if (cached && cached.expiresAt > now) {
@@ -527,11 +680,13 @@ export class ProviderRegistry {
                 // without waiting up to 24 hours or requiring a manual Ctrl+R refresh.
                 const local = this.localModelsForProvider(provider);
                 const localIds = new Set(local.map((model) => model.id));
-                const models = cachedResult.source === "static"
-                    ? local
-                    : cachedResult.authoritative
-                        ? cachedResult.models
-                        : [...local, ...cachedResult.models.filter((model) => !localIds.has(model.id))];
+                const models = provider.id === "openai"
+                    ? cachedResult.models
+                    : cachedResult.source === "static"
+                        ? local
+                        : cachedResult.authoritative
+                            ? cachedResult.models
+                            : [...local, ...cachedResult.models.filter((model) => !localIds.has(model.id))];
                 const result = { ...cachedResult, models, source: "cache" };
                 const current = this.getConfigured().find((item) => item.id === provider.id);
                 if (!current || this.modelDiscoveryKey(current) === key) {
@@ -544,7 +699,8 @@ export class ProviderRegistry {
                 return inFlight;
         }
         else {
-            this.modelDiscoveryCache.delete(key);
+            // Keep the last confirmation readable while the replacement is in flight.
+            // Forced discovery bypasses freshness without invalidating a good catalog.
             // Do not let a superseded request's finally-handler remove this retry.
             this.modelDiscoveryInFlight.delete(key);
         }
@@ -552,10 +708,12 @@ export class ProviderRegistry {
         this.modelDiscoveryGeneration.set(provider.id, generation);
         let pending;
         pending = this.performModelDiscovery(provider).then((rawResult) => {
-            const result = normalizeProviderDiscoveryMetadata(provider, rawResult);
+            const result = normalizeProviderDiscoveryMetadata(provider, provider.id === "openai" && rawResult.error
+                ? { ...rawResult, models: retainedConfirmation?.models ?? [] }
+                : rawResult);
             if (!this.isCurrentModelDiscovery(provider, key, generation)) {
                 return {
-                    models: this.localModelsForProvider(this.getConfigured().find((item) => item.id === provider.id) ?? provider),
+                    models: provider.id === "openai" ? [] : this.localModelsForProvider(this.getConfigured().find((item) => item.id === provider.id) ?? provider),
                     source: "fallback",
                     authoritative: false,
                     error: "Model catalog changed while it was refreshing.",
@@ -563,9 +721,15 @@ export class ProviderRegistry {
             }
             this.applyDynamicDiscoveryMetadata(provider, result);
             const previous = this.lastDiscoveryMembership.get(key);
+            const stored = { ...result, source: result.source === "cache" ? "remote" : result.source };
             this.modelDiscoveryCache.set(key, {
-                result: { ...result, source: result.source === "cache" ? "remote" : result.source },
+                result: stored,
                 expiresAt: Date.now() + (result.error ? MODEL_DISCOVERY_FAILURE_TTL_MS : MODEL_DISCOVERY_SUCCESS_TTL_MS),
+                // A complete success starts a new confirmation horizon; anything else
+                // (failure fallback, partial union) carries the previous one forward.
+                confirmed: isCompleteDiscovery(stored)
+                    ? { models: stored.models, until: Date.now() + MODEL_DISCOVERY_DISK_TTL_MS }
+                    : this.modelDiscoveryCache.get(key)?.confirmed ?? retainedConfirmation,
                 identityKey: this.discoveryIdentity(provider),
                 providerId: provider.id,
                 authType: provider.authType,
@@ -591,7 +755,7 @@ export class ProviderRegistry {
     }
     async performModelDiscovery(provider) {
         const customModels = filterProviderModels(provider.id, this.modelConfig.getCustomModels(provider.id));
-        if (customModels.length > 0) {
+        if (customModels.length > 0 && provider.id !== "openai") {
             return { models: customModels, source: "static", authoritative: true };
         }
         if (provider.id === "openrouter") {
@@ -659,9 +823,10 @@ export class ProviderRegistry {
                 const catalog = await fetchOpenAICodexModelCatalog({
                     baseURL: currentProvider.baseURL,
                     accessToken: currentProvider.apiKey,
+                    timeoutMs: OPENAI_CODEX_MODEL_DISCOVERY_TIMEOUT_MS,
                 });
                 if (catalog.status === "unavailable") {
-                    throw new Error("OpenAI Codex model catalog is unavailable.");
+                    throw new Error(`OpenAI Codex model catalog is unavailable${catalog.reason ? ` (${catalog.reason})` : ""}.`);
                 }
                 const visible = catalog.descriptors.filter((descriptor) => descriptor.visibility !== "hide");
                 return {
@@ -749,10 +914,19 @@ export class ProviderRegistry {
         // while unlisted), remote-only ids are appended, obvious non-chat
         // modalities are filtered out. Not authoritative — membership is a union,
         // so nothing downstream may treat it as a closed allowlist.
-        if (isOpenAICompatibleProtocol(provider.protocol) && provider.apiKey) {
+        if ((isOpenAICompatibleProtocol(provider.protocol) || provider.id === "openai") && provider.apiKey) {
             try {
                 const remote = await fetchOpenAICompatibleModelIds(provider);
                 const local = this.localModelsForProvider(provider);
+                if (provider.id === "openai") {
+                    const metadata = new Map(local.map(model => [model.id, model]));
+                    return {
+                        models: remote.filter(entry => isLikelyChatModelId(entry.id)).map(entry => ({
+                            ...metadata.get(entry.id), id: entry.id, name: entry.name || entry.id, providerId: provider.id,
+                        })),
+                        source: "remote", authoritative: true,
+                    };
+                }
                 const known = new Set(local.map((model) => model.id));
                 const extras = remote
                     .filter((entry) => !known.has(entry.id) && isLikelyChatModelId(entry.id))
@@ -767,21 +941,23 @@ export class ProviderRegistry {
                 }
                 return { models: [...local, ...extras], source: "remote", authoritative: false };
             }
-            catch {
+            catch (error) {
+                if (provider.id === "openai")
+                    return this.fallbackDiscovery(provider, error);
                 // Vendors that don't implement /models (or gate it) fall back silently:
                 // the curated catalog is the contract, discovery is a bonus.
                 return { models: this.localModelsForProvider(provider), source: "static", authoritative: true };
             }
         }
         return {
-            models: this.localModelsForProvider(provider),
+            models: provider.id === "openai" ? [] : this.localModelsForProvider(provider),
             source: "static",
             authoritative: true,
         };
     }
     fallbackDiscovery(provider, error) {
         return {
-            models: this.localModelsForProvider(provider),
+            models: provider.id === "openai" ? [] : this.localModelsForProvider(provider),
             source: "fallback",
             authoritative: false,
             error: modelDiscoveryError(error),
@@ -825,7 +1001,15 @@ export class ProviderRegistry {
             provider.authType ?? "api",
             provider.protocol ?? "default",
             this.discoveryIdentity(provider),
-            provider.id === "openrouter" ? OPENROUTER_CATALOG_SCOPE : undefined,
+            provider.id === "openrouter"
+                ? OPENROUTER_CATALOG_SCOPE
+                // The ChatGPT backend filters /codex/models by the client version we
+                // claim, so a catalog fetched under an older pin (possibly by another
+                // still-running Bubble sharing the disk cache) must not satisfy this
+                // build's discovery.
+                : provider.id === "openai"
+                    ? `remote-only-v1:${provider.authType === "oauth" ? `codex-client:${getCodexClientVersion()}` : "api"}`
+                    : undefined,
         ]);
     }
     /**
@@ -835,18 +1019,46 @@ export class ProviderRegistry {
      * derived strictly: only a successful full remote catalog qualifies —
      * never static or fallback results, whose internal `authoritative` flag
      * this design does not trust.
+     * Desktop catalogs can explicitly retain the last confirmation beyond its
+     * routing horizon; ordinary routing callers keep the default expiry policy.
      */
-    getCachedDiscoverySnapshot(providerId) {
+    getCachedDiscoverySnapshot(providerId, options = {}) {
         const provider = this.getConfigured().find((item) => item.id === providerId);
         if (!provider)
             return undefined;
         const cached = this.modelDiscoveryCache.get(this.modelDiscoveryKey(provider));
-        if (!cached || cached.expiresAt <= Date.now())
+        if (!cached)
+            return undefined;
+        const now = Date.now();
+        const fresh = cached.expiresAt > now;
+        if (fresh && isCompleteDiscovery(cached.result)) {
+            return {
+                models: cached.result.models,
+                source: cached.result.source,
+                complete: true,
+                expiresAt: cached.expiresAt,
+                identityKey: cached.identityKey,
+            };
+        }
+        // The live result is stale or not complete: routing keeps the last
+        // confirmed catalog for this identity until its horizon passes, so a
+        // long session does not lose its tier candidates after the freshness
+        // minute or across one failed refresh.
+        if (cached.confirmed && (cached.confirmed.until > now || options.allowExpiredConfirmation)) {
+            return {
+                models: cached.confirmed.models,
+                source: "cache",
+                complete: true,
+                expiresAt: cached.confirmed.until,
+                identityKey: cached.identityKey,
+            };
+        }
+        if (!fresh)
             return undefined;
         return {
             models: cached.result.models,
             source: cached.result.source,
-            complete: cached.result.source === "remote" && cached.result.authoritative && !cached.result.error,
+            complete: false,
             expiresAt: cached.expiresAt,
             identityKey: cached.identityKey,
         };

package/dist/provider-transform.js

@@ -31,6 +31,14 @@ function isFireworksKimi(providerId, modelId) {
 export function resolveProviderRequestConfig(providerId, modelId, requestedLevel) {
     const supportedLevels = getAvailableThinkingLevels(providerId, modelId);
     const effectiveThinkingLevel = normalizeThinkingLevel(requestedLevel, supportedLevels);
+    if (providerId === "opencode-zen" && modelId === "space-bunny-free") {
+        const level = normalizeInheritedThinkingLevel(providerId, modelId, requestedLevel);
+        return {
+            effectiveThinkingLevel: level,
+            reasoningContentEcho: "tool_calls",
+            extraBody: { reasoning_effort: level },
+        };
+    }
     if (providerId === "openai-codex") {
         const model = getBuiltinModel(providerId, modelId);
         if (!model || model.reasoningLevels.length === 0) {

package/dist/provider-zen-errors.d.ts

@@ -0,0 +1,9 @@
+import { ProviderStreamInterruptedError } from "./network/retry.js";
+/** Only Zen's opaque upstream rejection is recoverable, not arbitrary 422s. */
+export declare function isSpaceBunnyUpstreamRejection(providerId: string | undefined, model: string, error: unknown): boolean;
+export declare function recoverableSpaceBunnyError(error: unknown): ProviderStreamInterruptedError;
+/** Counts only: never persist prompts, tool arguments, URLs or API headers. */
+export declare function chatRequestShape(body: {
+    messages?: Record<string, unknown>[];
+    tools?: unknown[];
+}): Record<string, number>;