jeo-code 0.11.1 → 0.11.2

package/CHANGELOG.md

@@ -9,6 +9,17 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.11.2] - 2026-09-30
+_OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries._
+
+### Fixed
+- Use Codex `visibility` for ChatGPT model discovery; retain visible subscription-only models even when `supported_in_api` is false. Keep modern GPT Codex models in API-key discovery and fetch both catalogs when both credentials are configured.
+- Preserve the full OpenAI model list by default, de-duplicate picker rows, and keep empty or failed live results honest instead of fabricating availability from a static snapshot.
+- Replace account-scoped OpenAI model observations on refresh, migrate old caches, and separate authentication sources and custom endpoints. Use stored account identity for opaque OAuth credentials and the proxy's own API key for custom endpoints.
+
+### Validation
+- Regression coverage for visibility, dual credentials, complete lists, account headers, proxy scoping, cache replacement, and authoritative empty catalogs.
+
 ## [0.11.1] - 2026-08-25
 _Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited._
 

package/README.ja.md

@@ -319,10 +319,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.2]** (2026-09-30) — OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries.
 - **[0.11.1]** (2026-08-25) — Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited.
 - **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
-- **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -320,10 +320,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.2]** (2026-09-30) — OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries.
 - **[0.11.1]** (2026-08-25) — Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited.
 - **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
-- **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -327,10 +327,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.2]** (2026-09-30) — OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries.
 - **[0.11.1]** (2026-08-25) — Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited.
 - **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
-- **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -317,10 +317,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.2]** (2026-09-30) — OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries.
 - **[0.11.1]** (2026-08-25) — Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited.
 - **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
-- **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/ai/model-cache.ts

@@ -11,7 +11,7 @@
  * Persisting the discovered lists (gjc parity) closes both gaps: the next launch
  * rehydrates the account's REAL model set from disk before any network call, and a
  * background refresh keeps it current. The cache is an optimization — a missing,
- * corrupt, or stale file only means "fall back to live discovery + static catalog",
+ * corrupt, or stale file only means live discovery must refresh the catalog,
  * never an error.
  */
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -37,15 +37,16 @@ export interface CachedProviderModels {
 }
 
 export interface ModelCacheFile {
-  version: 2;
+  version: 3;
   updatedAt: number;
   providers: CachedProviderModels[];
 }
 
-const CACHE_VERSION = 2;
+// Earlier snapshots could persist hidden or fabricated OpenAI entries.
+const CACHE_VERSION = 3;
 /** Refresh in the background once the cache is older than this (6h). */
 export const MODEL_CACHE_TTL_MS = 6 * 60 * 60 * 1000;
-/** Bound a single provider's persisted list so a pathological aggregator cannot bloat the file. */
+/** Bound other providers' cache rows; preserve complete authoritative OpenAI lists. */
 const MAX_MODELS_PER_PROVIDER = 500;
 
 function cacheDir(): string {
@@ -62,9 +63,9 @@ export function normalizeCacheEntries(raw: unknown): CachedProviderModels[] {
   for (const entry of raw) {
     const row = entry as Partial<CachedProviderModels>;
     if (!row || typeof row.provider !== "string" || !Array.isArray(row.models)) continue;
-    const models = row.models.filter((m): m is string => typeof m === "string" && m.trim().length > 0).slice(0, MAX_MODELS_PER_PROVIDER);
-    if (models.length === 0) continue;
     const provider = row.provider as ProviderName;
+    const models = row.models.filter((m): m is string => typeof m === "string" && m.trim().length > 0).slice(0, provider === "openai" ? undefined : MAX_MODELS_PER_PROVIDER);
+    if (models.length === 0 && (provider !== "openai" || row.models.length !== 0)) continue;
     const source: ModelCacheSource =
       row.source === "oauth" || row.source === "api_key" || row.source === "keyless" || row.source === "none" ? row.source : "none";
     const baseUrl = typeof row.baseUrl === "string" ? row.baseUrl.replace(/\/+$/, "") : undefined;
@@ -111,26 +112,26 @@ export function isModelCacheStale(cache: ModelCacheFile | null, now = Date.now()
  */
 export function mergeCacheEntries(
   previous: readonly CachedProviderModels[],
-  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string }[],
+  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string; fallback?: boolean }[],
 ): CachedProviderModels[] {
   const byKey = new Map<string, CachedProviderModels>();
-  const keyOf = (provider: string, baseUrl?: string, accountId?: string) =>
-    `${provider}\u0000${baseUrl ?? ""}\u0000${accountId ?? ""}`;
+  const keyOf = (provider: string, baseUrl?: string, accountId?: string, source?: ModelCacheSource) =>
+    `${provider}\u0000${baseUrl?.replace(/\/+$/, "") ?? ""}\u0000${accountId ?? ""}\u0000${provider === "openai" ? source ?? "none" : ""}`;
   for (const entry of previous) {
     const isOpenAIOAuth = entry.provider === "openai" && entry.source === "oauth";
     if (isOpenAIOAuth && !entry.accountId) continue;
-    byKey.set(keyOf(entry.provider, entry.baseUrl, isOpenAIOAuth ? entry.accountId : undefined), entry);
+    byKey.set(keyOf(entry.provider, entry.baseUrl, isOpenAIOAuth ? entry.accountId : undefined, entry.source), entry);
   }
   for (const result of results) {
-    if (!result.ok || result.models.length === 0) continue;
+    if (!result.ok || result.fallback || (result.models.length === 0 && result.provider !== "openai")) continue;
     const source: ModelCacheSource = result.source ?? "none";
     const isOpenAIOAuth = result.provider === "openai" && source === "oauth";
     const baseUrl = typeof result.baseUrl === "string" ? result.baseUrl.replace(/\/+$/, "") : undefined;
     const accountId = typeof result.accountId === "string" ? result.accountId.trim() : "";
     if (isOpenAIOAuth && !accountId) continue;
-    byKey.set(keyOf(result.provider, baseUrl, isOpenAIOAuth ? accountId : undefined), {
+    byKey.set(keyOf(result.provider, baseUrl, isOpenAIOAuth ? accountId : undefined, source), {
       provider: result.provider,
-      models: [...result.models].slice(0, MAX_MODELS_PER_PROVIDER),
+      models: [...result.models].slice(0, result.provider === "openai" ? undefined : MAX_MODELS_PER_PROVIDER),
       source,
       ...(baseUrl ? { baseUrl } : {}),
       ...(isOpenAIOAuth ? { accountId } : {}),
@@ -141,11 +142,16 @@ export function mergeCacheEntries(
 
 /** Persist discovery results (best-effort; never throws, never blocks a turn). */
 export async function writeModelCache(
-  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string }[],
+  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string; fallback?: boolean }[],
 ): Promise<void> {
   // Same hermeticity rule as saveGlobalConfig: a test run may only write into an
   // explicitly sandboxed JEO_CONFIG_DIR, never the developer's real ~/.jeo.
   if (process.env.NODE_ENV === "test" && !jeoEnv("CONFIG_DIR")) return;
+  // A failed/fallback-only refresh must not make an old snapshot appear fresh.
+  const hasFreshResult = results.some(result => result.ok && !result.fallback
+    && (result.models.length > 0 || result.provider === "openai")
+    && !(result.provider === "openai" && result.source === "oauth" && !result.accountId?.trim()));
+  if (!hasFreshResult) return;
   try {
     const existing = await readModelCache();
     const providers = mergeCacheEntries(existing?.providers ?? [], results);
@@ -173,9 +179,10 @@ export function applyCachedModels(cache: ModelCacheFile | null, openAIOauthAccou
     recordLiveProviderModels(entry.provider, entry.models, {
       source: entry.source,
       baseUrl: entry.baseUrl,
+      replace: entry.provider === "openai",
       ...(isOpenAIOAuth && entry.accountId ? { accountId: entry.accountId } : {}),
     });
-    if (isOpenAIOAuth && entry.accountId) {
+    if (isOpenAIOAuth && entry.accountId && !entry.baseUrl) {
       recordLiveCodexModels(entry.models, entry.accountId);
     }
     applied += entry.models.length;

package/src/ai/model-catalog.ts

@@ -179,9 +179,8 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
 
 /**
  * OpenAI models the ChatGPT/Codex subscription backend (`codex/responses`) actually
- * serves. The Codex backend rejects standard API ids (gpt-4o, o3, …) and exposes no
- * usable list endpoint, so an OAuth-only OpenAI login surfaces exactly these instead
- * of the full chat-completions catalog. Verified live against a ChatGPT account.
+ * serves in the bundled offline snapshot. A confirmed account-specific model list
+ * replaces this snapshot for OAuth eligibility, including a successful empty list.
  */
 export const CODEX_MODELS: readonly string[] = ["gpt-5.5", "gpt-5.4", "gpt-5.4-mini"];
 
@@ -236,7 +235,7 @@ export function recordLiveCodexModels(ids: readonly string[], accountId?: string
   const explicitScope = normalizeOpenAIOauthScope(accountId);
   if (explicitScope) setOpenAIOauthAccountScope(explicitScope);
   const scope = explicitScope || EPHEMERAL_OPENAI_OAUTH_SCOPE;
-  const bucket = liveCodexModels.get(scope) ?? new Set<string>();
+  const bucket = new Set<string>();
   for (const id of ids) {
     const trimmed = id.trim();
     if (trimmed) bucket.add(trimmed);
@@ -244,10 +243,11 @@ export function recordLiveCodexModels(ids: readonly string[], accountId?: string
   liveCodexModels.set(scope, bucket);
 }
 
-/** True for the static Codex snapshot or a live id confirmed for the active scope. */
+/** A confirmed account catalog is authoritative; use the snapshot before discovery. */
 export function isCodexModel(model: string): boolean {
   const wire = model.startsWith("openai/") ? model.slice(7) : model;
-  return CODEX_MODELS.includes(wire) || (liveCodexModels.get(activeOpenAIOauthScope)?.has(wire) ?? false);
+  const confirmed = liveCodexModels.get(activeOpenAIOauthScope);
+  return confirmed ? confirmed.has(wire) : CODEX_MODELS.includes(wire);
 }
 
 /** Test-only reset for live Codex observations and the active account scope. */
@@ -330,9 +330,10 @@ function liveModelRecordKey(
   canonical: string,
   baseUrl: string | undefined,
   accountId?: string,
+  source?: LiveProviderModelSource,
 ): string {
   const normalizedAccountId = provider === "openai" ? normalizeOpenAIOauthScope(accountId) : "";
-  return `${provider}\u0000${normalizeBaseUrl(baseUrl) ?? ""}\u0000${normalizedAccountId}\u0000${canonical}`;
+  return `${provider}\u0000${normalizeBaseUrl(baseUrl) ?? ""}\u0000${normalizedAccountId}\u0000${provider === "openai" ? source ?? "none" : ""}\u0000${canonical}`;
 }
 
 function liveModelFallbackRow(provider: ProviderName, canonical: string, providerModel: string): CatalogModel {
@@ -351,12 +352,12 @@ function liveModelFallbackRow(provider: ProviderName, canonical: string, provide
   };
 }
 
-/** Record live ids returned by a provider's own model-list endpoint. Additive only:
- *  transient partial responses must not evict an id observed earlier this session. */
+/** Record live ids. Complete OpenAI refreshes may replace their matching scope;
+ *  partial observations and other providers remain additive. */
 export function recordLiveProviderModels(
   provider: ProviderName,
   ids: readonly string[],
-  opts: { source?: LiveProviderModelSource; baseUrl?: string; accountId?: string } = {},
+  opts: { source?: LiveProviderModelSource; baseUrl?: string; accountId?: string; replace?: boolean } = {},
 ): void {
   const source = opts.source ?? "none";
   const baseUrl = normalizeBaseUrl(opts.baseUrl);
@@ -366,6 +367,14 @@ export function recordLiveProviderModels(
   if (provider === "openai" && source === "oauth" && scopedAccountId) {
     setOpenAIOauthAccountScope(scopedAccountId);
   }
+  if (provider === "openai" && opts.replace) {
+    for (const [key, record] of liveProviderModels) {
+      if (record.row.provider === provider && record.source === source && record.baseUrl === baseUrl
+        && oauthScope(record.accountId) === oauthScope(scopedAccountId)) {
+        removeLiveProviderRecord(key, record);
+      }
+    }
+  }
   for (const id of ids) {
     const canonical = liveCanonicalId(provider, id);
     if (!canonical) continue;
@@ -374,7 +383,7 @@ export function recordLiveProviderModels(
     const row = known
       ? { ...known, canonical, provider, providerModel }
       : liveModelFallbackRow(provider, canonical, providerModel);
-    const recordKey = liveModelRecordKey(provider, canonical, baseUrl, scopedAccountId);
+    const recordKey = liveModelRecordKey(provider, canonical, baseUrl, scopedAccountId, source);
     liveProviderModels.set(recordKey, {
       row,
       source,

package/src/ai/model-discovery.ts

@@ -13,7 +13,6 @@ import type { ProviderName } from "./types";
 import { PROVIDER_NAMES } from "./provider-status";
 import {
   catalogByProvider,
-  CODEX_MODELS,
   KIMI_CODE_MODELS,
   recordLiveCodexModels,
   recordLiveProviderModels,
@@ -32,6 +31,8 @@ export interface ProviderModelsResult {
   source: "oauth" | "api_key" | "keyless" | "none";
   /** Stable OpenAI OAuth account scope for account-specific cache rows. */
   accountId?: string;
+  /** Actual custom endpoint queried, for endpoint-scoped persistent caches. */
+  baseUrl?: string;
   /** Present on failure: a short, human-readable reason. */
   error?: string;
   /** True when the live endpoint was unusable and ids came from the static catalog. */
@@ -45,7 +46,7 @@ export interface DiscoveryOptions {
   /** Per-request timeout; default 5000ms. */
   timeoutMs?: number;
   signal?: AbortSignal;
-  /** Cap the number of returned ids per provider; default 100. */
+  /** Cap returned ids; OpenAI defaults to the full list, other providers to 100. */
   limit?: number;
   /** Config snapshot used for provider base URLs. */
   config?: Config;
@@ -54,8 +55,8 @@ export interface DiscoveryOptions {
    * the just-stored OAuth credential even when an unrelated `providers.openai`
    * API key is also configured, so the report reflects the account that was
    * JUST logged in rather than silently swapping to the API key. Does not
-   * change any other discovery caller — the TUI/`discoverModels` default
-   * (API key preferred when configured) is untouched.
+   * change single-provider discovery's API-key preference. `discoverModels`
+   * queries both OpenAI catalogs when both credentials are configured.
    */
   preferOAuth?: boolean;
 }
@@ -107,6 +108,7 @@ export function discoveryRequest(
   provider: ProviderName,
   cred: Credential | undefined,
   baseUrl?: string,
+  oauthAccountId?: string,
 ): { url: string; headers: Record<string, string>; method?: "GET" | "POST"; body?: string } {
   // Catalog-driven compat providers: OpenAI `${base}/models` (Bearer) or Anthropic
   // `${base}/v1/models` (x-api-key). Both return { data: [{ id }] }.
@@ -125,7 +127,7 @@ export function discoveryRequest(
     case "openai": {
       const token = cred?.kind === "oauth" || cred?.kind === "api_key" ? cred.token : "";
       if (cred?.kind === "oauth" && !baseUrl && !process.env.OPENAI_BASE_URL) {
-        const accountId = extractChatgptAccountId(token);
+        const accountId = extractChatgptAccountId(token) || oauthAccountId;
         const headers: Record<string, string> = {
           Authorization: `Bearer ${token}`,
           "OpenAI-Beta": "responses=experimental",
@@ -180,11 +182,12 @@ export function discoveryRequest(
 
 /**
  * OpenAI `/v1/models` lists every model family — embeddings, audio/tts, image, moderation,
- * realtime — but jeo only calls chat/completions. Drop the families that can never serve a
+ * realtime — jeo uses chat/completions and Responses. Drop the families that cannot serve a
  * chat turn so pickers never offer a model that fails at call time.
  */
 function isOpenAiChatModel(id: string): boolean {
-  return !/(^|[-/])(text-embedding|embedding|tts|whisper|dall-e|moderation|omni-moderation|davinci|babbage|computer-use|realtime|audio|image|sora|transcribe|instruct|codex)([-/]|$)/i.test(id);
+  return !/(^|[-/])(text-embedding|embedding|tts|whisper|dall-e|moderation|omni-moderation|davinci|babbage|computer-use|realtime|audio|image|sora|transcribe|instruct)([-/]|$)/i.test(id)
+    && !/^codex([-/]|$)/i.test(id);
 }
 
 /**
@@ -195,11 +198,11 @@ function isGeminiChatModel(id: string): boolean {
   return !/(^|[-/])(embedding|aqa|tts|image|imagen|veo|lyria|nano-banana|deep-research|computer-use|antigravity)([-/]|$)/i.test(id);
 }
 
-type CodexModelRow = { slug?: string; id?: string; supported_in_api?: boolean; priority?: number };
+type CodexModelRow = { slug?: string; id?: string; visibility?: string; supported_in_api?: boolean; priority?: number };
 type AntigravityModelRow = { slug?: string; id?: string; name?: string; isInternal?: boolean; model?: string };
 
 /** Parse a provider's models response body into normalized, chat-capable model ids. */
-export function parseModelsBody(provider: ProviderName, body: unknown): string[] {
+export function parseModelsBody(provider: ProviderName, body: unknown, opts: { openaiCompatible?: boolean } = {}): string[] {
   const data = body as {
     data?: { id?: string }[];
     models?: ({ name?: string; supportedGenerationMethods?: string[] } & CodexModelRow)[];
@@ -285,14 +288,16 @@ export function parseModelsBody(provider: ProviderName, body: unknown): string[]
   }
   if (provider === "openai" && data.models?.some(m => m.slug || m.id)) {
     return data.models
-      .filter(m => m.supported_in_api !== false)
+      // supported_in_api describes API-key availability, not ChatGPT entitlement.
+      // Codex's ChatGPT picker uses visibility, including subscription-only rows.
+      .filter(m => m.visibility === undefined || m.visibility === "list")
       .map(m => m.slug ?? m.id ?? "")
       // Review-only entries (e.g. codex-auto-review) are not chat-turn models.
       .filter(id => id && !/(^|[-/])auto-review([-/]|$)/i.test(id));
   }
   // anthropic / openai: { data: [{ id }] }
   const ids = (data.data ?? []).map(m => m.id ?? "").filter(Boolean);
-  return provider === "openai" ? ids.filter(isOpenAiChatModel) : ids;
+  return provider === "openai" && !opts.openaiCompatible ? ids.filter(isOpenAiChatModel) : ids;
 }
 
 /**
@@ -305,23 +310,23 @@ export function parseModelsBody(provider: ProviderName, body: unknown): string[]
  */
 export function catalogOr(result: ProviderModelsResult): ProviderModelsResult {
   if (result.ok && result.models.length > 0) return result;
+  // OpenAI has live list endpoints for both auth modes. Neither a failed request
+  // nor an authoritative empty list establishes access to the static snapshot.
+  if (result.provider === "openai") return result;
   // Antigravity's available models depend on the Cloud Code Assist agent backend
   // and must never be faked from a hard-coded catalog.
   if (result.provider === "antigravity") return result;
   // No catalog-fallback for oauth-sourced gemini failures: OAuth can LIST but
   // not SERVE gemini models (see listProviderModels' gemini gate).
   if (result.provider === "gemini" && result.source === "oauth") return result;
-  // OAuth: OpenAI/Codex legitimately rejects the standard /models endpoint while
-  // the fixed Codex ids still work; other OAuth providers fall back to their full
-  // static catalog too. API-key providers only fall back when the provider has NO
+  // Other OAuth providers fall back to their static catalog. API-key providers
+  // only fall back when the provider has NO
   // models-list endpoint at all (HTTP 404 / not found) — never for an auth
   // rejection, so a wrong key stays a failure instead of fabricating catalog rows.
   const eligible = result.source === "oauth"
     || (result.source === "api_key" && isMissingModelsEndpoint(result.error));
   if (!eligible) return result;
-  const ids = result.provider === "openai" && result.source === "oauth"
-    ? [...CODEX_MODELS]
-    : result.provider === "kimi" && result.source === "oauth"
+  const ids = result.provider === "kimi" && result.source === "oauth"
       // Kimi OAuth (Kimi Code subscription) serves ONLY the Kimi Code catalog —
       // moonshot API-platform ids would 404 against api.kimi.com/coding.
       ? KIMI_CODE_MODELS.map(id => `kimi/${id}`)
@@ -345,7 +350,8 @@ export async function listProviderModels(
   opts: DiscoveryOptions = {},
 ): Promise<ProviderModelsResult> {
   const fetchImpl = opts.fetchImpl ?? fetch;
-  const limit = opts.limit ?? DEFAULT_LIMIT;
+  const limit = opts.limit ?? (provider === "openai" ? Number.POSITIVE_INFINITY : DEFAULT_LIMIT);
+  let baseUrl = opts.baseUrl;
 
   let cred: Credential | undefined;
   let oauthAccountId: string | undefined;
@@ -363,6 +369,7 @@ export async function listProviderModels(
     cred = raw;
     source = cred.kind === "oauth" ? "oauth" : cred.kind === "api_key" ? "api_key" : "none";
     const config = opts.config ?? (await readGlobalConfig());
+    if (provider === "openai") baseUrl = (baseUrl ?? config.openaiBaseUrl ?? process.env.OPENAI_BASE_URL)?.replace(/\/+$/, "");
 
     if (provider === "antigravity") {
       // Antigravity lists models from the LIVE Cloud Code Assist endpoint
@@ -391,6 +398,12 @@ export async function listProviderModels(
       cred = { kind: "api_key", provider: prov, token: config.providers[prov]! };
       source = "api_key";
     }
+    if (provider === "openai" && baseUrl && cred.kind === "oauth") {
+      // Subscription credentials belong to ChatGPT, not a configured proxy.
+      const key = config.providers?.openai;
+      cred = key ? { kind: "api_key", provider: "openai", token: key } : { kind: "none", provider: "openai" };
+      source = key ? "api_key" : "keyless";
+    }
     if (provider === "openai" && source === "oauth" && cred.kind === "oauth") {
       const stored = await getStoredOAuth("openai").catch(() => undefined);
       const jwtAccountId = extractChatgptAccountId(cred.token);
@@ -406,23 +419,32 @@ export async function listProviderModels(
     if (provider === "gemini" && cred.kind === "oauth") {
       return { provider, models: [], ok: false, source, error: "OAuth cannot serve gemini models — set GEMINI_API_KEY, or use antigravity/* (Cloud Code Assist)" };
     }
-    const isLocalOpenAi = provider === "openai" && !!(opts.baseUrl ?? process.env.OPENAI_BASE_URL);
+    const isLocalOpenAi = provider === "openai" && !!baseUrl;
     if (source === "none" && !isLocalOpenAi) {
       return { provider, models: [], ok: false, source, error: "not logged in" };
     }
   }
 
-  const { url, headers, method, body: requestBody } = discoveryRequest(provider, cred, opts.baseUrl);
+  const { url, headers, method, body: requestBody } = discoveryRequest(provider, cred, baseUrl, oauthAccountId);
+  const scope = { ...(oauthAccountId ? { accountId: oauthAccountId } : {}), ...(baseUrl ? { baseUrl } : {}) };
   const timeout = opts.timeoutMs ?? DEFAULT_TIMEOUT;
   const signal = opts.signal ?? AbortSignal.timeout(timeout);
   try {
     const res = await fetchImpl(url, { method: method ?? "GET", headers, body: requestBody, signal });
     if (!res.ok) {
       const reason = res.status === 401 || res.status === 403 ? "auth rejected" : `HTTP ${res.status}`;
-      return { provider, models: [], ok: false, source, error: reason };
+      return { provider, models: [], ok: false, source, error: reason, ...scope };
     }
     const body = await res.json();
-    let ids = parseModelsBody(provider, body);
+    if (provider === "openai") {
+      const payload = body as { models?: unknown; data?: unknown } | null;
+      const rows = Array.isArray(payload?.models) ? payload.models : payload?.data;
+      if (!Array.isArray(rows) || rows.some(row => !row || typeof row !== "object"
+        || ![row.slug, row.id].some(id => typeof id === "string" && id.trim().length > 0))) {
+        return { provider, models: [], ok: false, source, error: "invalid models response", ...scope };
+      }
+    }
+    let ids = parseModelsBody(provider, body, { openaiCompatible: provider === "openai" && !!baseUrl });
     // Gemini paginates: follow nextPageToken (bounded) so the available list is
     // COMPLETE — page 1 alone silently dropped the newest models (round-15).
     if (provider === "gemini") {
@@ -436,26 +458,28 @@ export async function listProviderModels(
         pageToken = pageBody.nextPageToken;
       }
     }
-    const models = [...new Set(ids)].sort().slice(0, limit);
+    const allModels = [...new Set(ids)].sort();
+    const models = allModels.slice(0, limit);
     // Record live ids for routing supplements. For OpenAI OAuth, keep the
     // existing Codex allow-list widening separate: API-key/custom-base discovery
     // must not make OAuth Codex calls accept unrelated API models.
-    recordLiveProviderModels(provider, models, {
+    recordLiveProviderModels(provider, allModels, {
       source,
-      baseUrl: opts.baseUrl,
+      baseUrl,
+      replace: provider === "openai",
       ...(provider === "openai" && source === "oauth" && oauthAccountId ? { accountId: oauthAccountId } : {}),
     });
-    if (provider === "openai" && source === "oauth") recordLiveCodexModels(models, oauthAccountId);
+    if (provider === "openai" && source === "oauth" && !baseUrl) recordLiveCodexModels(allModels, oauthAccountId);
     return {
       provider,
       models,
       ok: true,
       source,
-      ...(oauthAccountId ? { accountId: oauthAccountId } : {}),
+      ...scope,
     };
   } catch (err) {
     const msg = (err as Error)?.name === "TimeoutError" || (err as Error)?.name === "AbortError" ? "timeout" : "unreachable";
-    return { provider, models: [], ok: false, source, error: msg };
+    return { provider, models: [], ok: false, source, error: msg, ...scope };
   }
 }
 
@@ -495,13 +519,24 @@ export async function discoverModels(
   const providers = opts.providers ?? [...PROVIDER_NAMES];
   const useFallback = opts.catalogFallback !== false;
   const results = await Promise.all(
-    providers.map(p =>
-      listProviderModels(p, {
+    providers.map(async p => {
+      const discoveryOpts = {
         ...opts,
         config: cfg,
         baseUrl: p === "ollama" ? (cfg.ollamaBaseUrl ?? opts.baseUrl) : p === "lmstudio" ? (cfg.lmstudioBaseUrl ?? opts.baseUrl) : p === "openai" ? (cfg.openaiBaseUrl ?? opts.baseUrl) : opts.baseUrl,
-      }),
-    ),
+      };
+      const primary = await listProviderModels(p, discoveryOpts);
+      // Both credentials can coexist. API discovery alone omits subscription-only
+      // models and never teaches the Codex call gate what this account can serve.
+      if (p === "openai" && primary.source === "api_key" && !discoveryOpts.baseUrl && !process.env.OPENAI_BASE_URL) {
+        const credential = await resolveCredential("openai");
+        if (credential.kind === "oauth") {
+          return [primary, await listProviderModels(p, { ...discoveryOpts, preferOAuth: true })];
+        }
+      }
+      return [primary];
+    }),
   );
-  return useFallback ? results.map(catalogOr) : results;
+  const flat = results.flat();
+  return useFallback ? flat.map(catalogOr) : flat;
 }

package/src/ai/model-picker.ts

@@ -16,9 +16,13 @@ export interface PickEntry {
 /** Flatten successful discovery results into an ordered, 1-based pick list. */
 export function flattenModels(results: ProviderModelsResult[]): PickEntry[] {
   const out: PickEntry[] = [];
+  const seen = new Set<string>();
   for (const r of results) {
     if (!r.ok) continue;
     for (const model of r.models) {
+      const key = `${r.provider}\u0000${model}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
       out.push({ index: out.length + 1, provider: r.provider, model });
     }
   }

package/src/commands/launch.ts

@@ -55,7 +55,7 @@ import { callLlm, type Message } from "../agent/loop";
 import { friendlyProviderError } from "../util/provider-error";
 import { readGlobalConfig, saveConfigPatch, resolveWikiRoot } from "../agent/state";
 import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recency";
-import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
+import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, liveProviderCatalogModels, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
 import { rehydrateLiveModels, writeModelCache } from "../ai/model-cache";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
 import { readGoalState, writeGoalState, clearGoalState, verifyGoal, applyEvidenceGate } from "../agent/goal-verifier";
@@ -335,8 +335,8 @@ function providerDefaultModel(p: ProviderName): string {
 }
 
 /**
- * Pick-list entries for ONE provider, with static fallbacks so the list is never
- * empty.
+ * Pick-list entries for ONE provider. OpenAI availability comes only from live
+ * results; other providers retain their offline catalog fallbacks.
  *
  * Live discovery yields ids only for a logged-in, reachable provider, and
  * `catalogOr` backfills the static catalog for OAuth sources and for API-key
@@ -348,6 +348,9 @@ function providerDefaultModel(p: ProviderName): string {
 export function providerPickEntries(live: ProviderModelsResult[], want: ProviderName): PickEntry[] {
   const fromLive = flattenModels(live.filter(r => r.provider === want));
   if (fromLive.length) return fromLive;
+  // An OpenAI empty/error response is authoritative for this picker. Offering
+  // the static capability catalog here would fabricate account availability.
+  if (want === "openai") return [];
   const catalog = catalogByProvider(want);
   if (catalog.length) {
     return catalog.map((m, i) => ({ index: i + 1, provider: want, model: qualifyModelId(m.providerModel, want) }));
@@ -2427,7 +2430,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // the OAuth Codex gate from the first keystroke, instead of only after the network
   // discovery below happens to land.
   const aliasNames = Object.keys(await listAliases());
-  const cachedModels = await rehydrateLiveModels().catch(() => null);
+  await rehydrateLiveModels().catch(() => null);
+  const completionConfig = await readGlobalConfig();
+  const cachedCompletionModels = liveProviderCatalogModels({ openaiBaseUrl: completionConfig.openaiBaseUrl ?? process.env.OPENAI_BASE_URL });
   void getLiveModels()
     .then(r => {
       liveModelsCache ??= r;
@@ -2442,14 +2447,16 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // access to were un-completable for the first seconds of every session.
     const liveFromDiscovery = liveModelsCache ? flattenModels(liveModelsCache).map(e => e.model) : null;
     const cachedFor = (p: string): string[] =>
-      cachedModels?.providers.filter(entry => entry.provider === p).flatMap(entry => entry.models) ?? [];
+      cachedCompletionModels.filter(entry => entry.provider === p).map(entry => entry.canonical);
     return {
       ...base,
       slashCommands: [...base.slashCommands, ...skillSlashDetails.map(d => d.command)],
-      liveModels: liveFromDiscovery ?? (cachedModels?.providers.flatMap(entry => entry.models) ?? []),
+      liveModels: liveFromDiscovery ?? cachedCompletionModels.map(entry => entry.canonical),
       aliases: aliasNames,
       skillNames: resolvedSkillTokens,
-      modelsForProvider: p => liveModelsCache?.find(r => r.provider === p)?.models ?? cachedFor(p),
+      modelsForProvider: p => liveModelsCache
+        ? flattenModels(liveModelsCache.filter(r => r.provider === p)).map(entry => entry.model)
+        : cachedFor(p),
       mentionPaths,
     };
   };