jeo-code 0.11.1 → 0.11.3

package/src/ai/model-cache.ts

@@ -11,7 +11,7 @@
  * Persisting the discovered lists (gjc parity) closes both gaps: the next launch
  * rehydrates the account's REAL model set from disk before any network call, and a
  * background refresh keeps it current. The cache is an optimization — a missing,
- * corrupt, or stale file only means "fall back to live discovery + static catalog",
+ * corrupt, or stale file only means live discovery must refresh the catalog,
  * never an error.
  */
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -37,15 +37,16 @@ export interface CachedProviderModels {
 }
 
 export interface ModelCacheFile {
-  version: 2;
+  version: 3;
   updatedAt: number;
   providers: CachedProviderModels[];
 }
 
-const CACHE_VERSION = 2;
+// Earlier snapshots could persist hidden or fabricated OpenAI entries.
+const CACHE_VERSION = 3;
 /** Refresh in the background once the cache is older than this (6h). */
 export const MODEL_CACHE_TTL_MS = 6 * 60 * 60 * 1000;
-/** Bound a single provider's persisted list so a pathological aggregator cannot bloat the file. */
+/** Bound other providers' cache rows; preserve complete authoritative OpenAI lists. */
 const MAX_MODELS_PER_PROVIDER = 500;
 
 function cacheDir(): string {
@@ -62,9 +63,9 @@ export function normalizeCacheEntries(raw: unknown): CachedProviderModels[] {
   for (const entry of raw) {
     const row = entry as Partial<CachedProviderModels>;
     if (!row || typeof row.provider !== "string" || !Array.isArray(row.models)) continue;
-    const models = row.models.filter((m): m is string => typeof m === "string" && m.trim().length > 0).slice(0, MAX_MODELS_PER_PROVIDER);
-    if (models.length === 0) continue;
     const provider = row.provider as ProviderName;
+    const models = row.models.filter((m): m is string => typeof m === "string" && m.trim().length > 0).slice(0, provider === "openai" ? undefined : MAX_MODELS_PER_PROVIDER);
+    if (models.length === 0 && (provider !== "openai" || row.models.length !== 0)) continue;
     const source: ModelCacheSource =
       row.source === "oauth" || row.source === "api_key" || row.source === "keyless" || row.source === "none" ? row.source : "none";
     const baseUrl = typeof row.baseUrl === "string" ? row.baseUrl.replace(/\/+$/, "") : undefined;
@@ -111,26 +112,26 @@ export function isModelCacheStale(cache: ModelCacheFile | null, now = Date.now()
  */
 export function mergeCacheEntries(
   previous: readonly CachedProviderModels[],
-  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string }[],
+  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string; fallback?: boolean }[],
 ): CachedProviderModels[] {
   const byKey = new Map<string, CachedProviderModels>();
-  const keyOf = (provider: string, baseUrl?: string, accountId?: string) =>
-    `${provider}\u0000${baseUrl ?? ""}\u0000${accountId ?? ""}`;
+  const keyOf = (provider: string, baseUrl?: string, accountId?: string, source?: ModelCacheSource) =>
+    `${provider}\u0000${baseUrl?.replace(/\/+$/, "") ?? ""}\u0000${accountId ?? ""}\u0000${provider === "openai" ? source ?? "none" : ""}`;
   for (const entry of previous) {
     const isOpenAIOAuth = entry.provider === "openai" && entry.source === "oauth";
     if (isOpenAIOAuth && !entry.accountId) continue;
-    byKey.set(keyOf(entry.provider, entry.baseUrl, isOpenAIOAuth ? entry.accountId : undefined), entry);
+    byKey.set(keyOf(entry.provider, entry.baseUrl, isOpenAIOAuth ? entry.accountId : undefined, entry.source), entry);
   }
   for (const result of results) {
-    if (!result.ok || result.models.length === 0) continue;
+    if (!result.ok || result.fallback || (result.models.length === 0 && result.provider !== "openai")) continue;
     const source: ModelCacheSource = result.source ?? "none";
     const isOpenAIOAuth = result.provider === "openai" && source === "oauth";
     const baseUrl = typeof result.baseUrl === "string" ? result.baseUrl.replace(/\/+$/, "") : undefined;
     const accountId = typeof result.accountId === "string" ? result.accountId.trim() : "";
     if (isOpenAIOAuth && !accountId) continue;
-    byKey.set(keyOf(result.provider, baseUrl, isOpenAIOAuth ? accountId : undefined), {
+    byKey.set(keyOf(result.provider, baseUrl, isOpenAIOAuth ? accountId : undefined, source), {
       provider: result.provider,
-      models: [...result.models].slice(0, MAX_MODELS_PER_PROVIDER),
+      models: [...result.models].slice(0, result.provider === "openai" ? undefined : MAX_MODELS_PER_PROVIDER),
       source,
       ...(baseUrl ? { baseUrl } : {}),
       ...(isOpenAIOAuth ? { accountId } : {}),
@@ -141,11 +142,16 @@ export function mergeCacheEntries(
 
 /** Persist discovery results (best-effort; never throws, never blocks a turn). */
 export async function writeModelCache(
-  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string }[],
+  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string; fallback?: boolean }[],
 ): Promise<void> {
   // Same hermeticity rule as saveGlobalConfig: a test run may only write into an
   // explicitly sandboxed JEO_CONFIG_DIR, never the developer's real ~/.jeo.
   if (process.env.NODE_ENV === "test" && !jeoEnv("CONFIG_DIR")) return;
+  // A failed/fallback-only refresh must not make an old snapshot appear fresh.
+  const hasFreshResult = results.some(result => result.ok && !result.fallback
+    && (result.models.length > 0 || result.provider === "openai")
+    && !(result.provider === "openai" && result.source === "oauth" && !result.accountId?.trim()));
+  if (!hasFreshResult) return;
   try {
     const existing = await readModelCache();
     const providers = mergeCacheEntries(existing?.providers ?? [], results);
@@ -173,9 +179,10 @@ export function applyCachedModels(cache: ModelCacheFile | null, openAIOauthAccou
     recordLiveProviderModels(entry.provider, entry.models, {
       source: entry.source,
       baseUrl: entry.baseUrl,
+      replace: entry.provider === "openai",
       ...(isOpenAIOAuth && entry.accountId ? { accountId: entry.accountId } : {}),
     });
-    if (isOpenAIOAuth && entry.accountId) {
+    if (isOpenAIOAuth && entry.accountId && !entry.baseUrl) {
       recordLiveCodexModels(entry.models, entry.accountId);
     }
     applied += entry.models.length;

package/src/ai/model-catalog.ts

@@ -179,9 +179,8 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
 
 /**
  * OpenAI models the ChatGPT/Codex subscription backend (`codex/responses`) actually
- * serves. The Codex backend rejects standard API ids (gpt-4o, o3, …) and exposes no
- * usable list endpoint, so an OAuth-only OpenAI login surfaces exactly these instead
- * of the full chat-completions catalog. Verified live against a ChatGPT account.
+ * serves in the bundled offline snapshot. A confirmed account-specific model list
+ * replaces this snapshot for OAuth eligibility, including a successful empty list.
  */
 export const CODEX_MODELS: readonly string[] = ["gpt-5.5", "gpt-5.4", "gpt-5.4-mini"];
 
@@ -236,7 +235,7 @@ export function recordLiveCodexModels(ids: readonly string[], accountId?: string
   const explicitScope = normalizeOpenAIOauthScope(accountId);
   if (explicitScope) setOpenAIOauthAccountScope(explicitScope);
   const scope = explicitScope || EPHEMERAL_OPENAI_OAUTH_SCOPE;
-  const bucket = liveCodexModels.get(scope) ?? new Set<string>();
+  const bucket = new Set<string>();
   for (const id of ids) {
     const trimmed = id.trim();
     if (trimmed) bucket.add(trimmed);
@@ -244,10 +243,11 @@ export function recordLiveCodexModels(ids: readonly string[], accountId?: string
   liveCodexModels.set(scope, bucket);
 }
 
-/** True for the static Codex snapshot or a live id confirmed for the active scope. */
+/** A confirmed account catalog is authoritative; use the snapshot before discovery. */
 export function isCodexModel(model: string): boolean {
   const wire = model.startsWith("openai/") ? model.slice(7) : model;
-  return CODEX_MODELS.includes(wire) || (liveCodexModels.get(activeOpenAIOauthScope)?.has(wire) ?? false);
+  const confirmed = liveCodexModels.get(activeOpenAIOauthScope);
+  return confirmed ? confirmed.has(wire) : CODEX_MODELS.includes(wire);
 }
 
 /** Test-only reset for live Codex observations and the active account scope. */
@@ -330,9 +330,10 @@ function liveModelRecordKey(
   canonical: string,
   baseUrl: string | undefined,
   accountId?: string,
+  source?: LiveProviderModelSource,
 ): string {
   const normalizedAccountId = provider === "openai" ? normalizeOpenAIOauthScope(accountId) : "";
-  return `${provider}\u0000${normalizeBaseUrl(baseUrl) ?? ""}\u0000${normalizedAccountId}\u0000${canonical}`;
+  return `${provider}\u0000${normalizeBaseUrl(baseUrl) ?? ""}\u0000${normalizedAccountId}\u0000${provider === "openai" ? source ?? "none" : ""}\u0000${canonical}`;
 }
 
 function liveModelFallbackRow(provider: ProviderName, canonical: string, providerModel: string): CatalogModel {
@@ -351,12 +352,12 @@ function liveModelFallbackRow(provider: ProviderName, canonical: string, provide
   };
 }
 
-/** Record live ids returned by a provider's own model-list endpoint. Additive only:
- *  transient partial responses must not evict an id observed earlier this session. */
+/** Record live ids. Complete OpenAI refreshes may replace their matching scope;
+ *  partial observations and other providers remain additive. */
 export function recordLiveProviderModels(
   provider: ProviderName,
   ids: readonly string[],
-  opts: { source?: LiveProviderModelSource; baseUrl?: string; accountId?: string } = {},
+  opts: { source?: LiveProviderModelSource; baseUrl?: string; accountId?: string; replace?: boolean } = {},
 ): void {
   const source = opts.source ?? "none";
   const baseUrl = normalizeBaseUrl(opts.baseUrl);
@@ -366,6 +367,14 @@ export function recordLiveProviderModels(
   if (provider === "openai" && source === "oauth" && scopedAccountId) {
     setOpenAIOauthAccountScope(scopedAccountId);
   }
+  if (provider === "openai" && opts.replace) {
+    for (const [key, record] of liveProviderModels) {
+      if (record.row.provider === provider && record.source === source && record.baseUrl === baseUrl
+        && oauthScope(record.accountId) === oauthScope(scopedAccountId)) {
+        removeLiveProviderRecord(key, record);
+      }
+    }
+  }
   for (const id of ids) {
     const canonical = liveCanonicalId(provider, id);
     if (!canonical) continue;
@@ -374,7 +383,7 @@ export function recordLiveProviderModels(
     const row = known
       ? { ...known, canonical, provider, providerModel }
       : liveModelFallbackRow(provider, canonical, providerModel);
-    const recordKey = liveModelRecordKey(provider, canonical, baseUrl, scopedAccountId);
+    const recordKey = liveModelRecordKey(provider, canonical, baseUrl, scopedAccountId, source);
     liveProviderModels.set(recordKey, {
       row,
       source,

package/src/ai/model-discovery.ts

@@ -13,7 +13,6 @@ import type { ProviderName } from "./types";
 import { PROVIDER_NAMES } from "./provider-status";
 import {
   catalogByProvider,
-  CODEX_MODELS,
   KIMI_CODE_MODELS,
   recordLiveCodexModels,
   recordLiveProviderModels,
@@ -32,6 +31,8 @@ export interface ProviderModelsResult {
   source: "oauth" | "api_key" | "keyless" | "none";
   /** Stable OpenAI OAuth account scope for account-specific cache rows. */
   accountId?: string;
+  /** Actual custom endpoint queried, for endpoint-scoped persistent caches. */
+  baseUrl?: string;
   /** Present on failure: a short, human-readable reason. */
   error?: string;
   /** True when the live endpoint was unusable and ids came from the static catalog. */
@@ -45,7 +46,7 @@ export interface DiscoveryOptions {
   /** Per-request timeout; default 5000ms. */
   timeoutMs?: number;
   signal?: AbortSignal;
-  /** Cap the number of returned ids per provider; default 100. */
+  /** Cap returned ids; OpenAI defaults to the full list, other providers to 100. */
   limit?: number;
   /** Config snapshot used for provider base URLs. */
   config?: Config;
@@ -54,8 +55,8 @@ export interface DiscoveryOptions {
    * the just-stored OAuth credential even when an unrelated `providers.openai`
    * API key is also configured, so the report reflects the account that was
    * JUST logged in rather than silently swapping to the API key. Does not
-   * change any other discovery caller — the TUI/`discoverModels` default
-   * (API key preferred when configured) is untouched.
+   * change single-provider discovery's API-key preference. `discoverModels`
+   * queries both OpenAI catalogs when both credentials are configured.
    */
   preferOAuth?: boolean;
 }
@@ -69,13 +70,6 @@ const DEFAULT_LIMIT = 100;
 const CODEX_CLIENT_VERSION = "2.0.0";
 export const CODEX_MODELS_URL = `https://chatgpt.com/backend-api/codex/models?client_version=${CODEX_CLIENT_VERSION}`;
 const ANTIGRAVITY_MODELS_URL = "https://daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels";
-const ANTIGRAVITY_MODEL_DENYLIST = new Set([
-  "chat_20706",
-  "chat_23310",
-  "gemini-2.5-flash-thinking",
-  "gemini-3-pro-low",
-  "gemini-2.5-pro",
-]);
 
 function anthropicHeaders(cred: Credential): Record<string, string> {
   if (cred.kind === "oauth") {
@@ -107,6 +101,7 @@ export function discoveryRequest(
   provider: ProviderName,
   cred: Credential | undefined,
   baseUrl?: string,
+  oauthAccountId?: string,
 ): { url: string; headers: Record<string, string>; method?: "GET" | "POST"; body?: string } {
   // Catalog-driven compat providers: OpenAI `${base}/models` (Bearer) or Anthropic
   // `${base}/v1/models` (x-api-key). Both return { data: [{ id }] }.
@@ -125,7 +120,7 @@ export function discoveryRequest(
     case "openai": {
       const token = cred?.kind === "oauth" || cred?.kind === "api_key" ? cred.token : "";
       if (cred?.kind === "oauth" && !baseUrl && !process.env.OPENAI_BASE_URL) {
-        const accountId = extractChatgptAccountId(token);
+        const accountId = extractChatgptAccountId(token) || oauthAccountId;
         const headers: Record<string, string> = {
           Authorization: `Bearer ${token}`,
           "OpenAI-Beta": "responses=experimental",
@@ -180,11 +175,12 @@ export function discoveryRequest(
 
 /**
  * OpenAI `/v1/models` lists every model family — embeddings, audio/tts, image, moderation,
- * realtime — but jeo only calls chat/completions. Drop the families that can never serve a
+ * realtime — jeo uses chat/completions and Responses. Drop the families that cannot serve a
  * chat turn so pickers never offer a model that fails at call time.
  */
 function isOpenAiChatModel(id: string): boolean {
-  return !/(^|[-/])(text-embedding|embedding|tts|whisper|dall-e|moderation|omni-moderation|davinci|babbage|computer-use|realtime|audio|image|sora|transcribe|instruct|codex)([-/]|$)/i.test(id);
+  return !/(^|[-/])(text-embedding|embedding|tts|whisper|dall-e|moderation|omni-moderation|davinci|babbage|computer-use|realtime|audio|image|sora|transcribe|instruct)([-/]|$)/i.test(id)
+    && !/^codex([-/]|$)/i.test(id);
 }
 
 /**
@@ -195,11 +191,11 @@ function isGeminiChatModel(id: string): boolean {
   return !/(^|[-/])(embedding|aqa|tts|image|imagen|veo|lyria|nano-banana|deep-research|computer-use|antigravity)([-/]|$)/i.test(id);
 }
 
-type CodexModelRow = { slug?: string; id?: string; supported_in_api?: boolean; priority?: number };
+type CodexModelRow = { slug?: string; id?: string; visibility?: string; supported_in_api?: boolean; priority?: number };
 type AntigravityModelRow = { slug?: string; id?: string; name?: string; isInternal?: boolean; model?: string };
 
 /** Parse a provider's models response body into normalized, chat-capable model ids. */
-export function parseModelsBody(provider: ProviderName, body: unknown): string[] {
+export function parseModelsBody(provider: ProviderName, body: unknown, opts: { openaiCompatible?: boolean } = {}): string[] {
   const data = body as {
     data?: { id?: string }[];
     models?: ({ name?: string; supportedGenerationMethods?: string[] } & CodexModelRow)[];
@@ -244,10 +240,11 @@ export function parseModelsBody(provider: ProviderName, body: unknown): string[]
       /** Array of ids OR an object keyed by deprecated id. */
       deprecatedModelIds?: string[] | Record<string, unknown>;
     };
-    const roleIds = (v: unknown): string[] => (Array.isArray(v) ? v.filter((x): x is string => typeof x === "string") : []);
+    const normalizeId = (id: string): string => id.replace(/^models\//, "").replace(/^antigravity\//, "");
+    const roleIds = (v: unknown): string[] => (Array.isArray(v) ? v.filter((x): x is string => typeof x === "string").map(normalizeId) : []);
     const deprecated = Array.isArray(payload.deprecatedModelIds)
       ? roleIds(payload.deprecatedModelIds)
-      : Object.keys(payload.deprecatedModelIds ?? {});
+      : Object.keys(payload.deprecatedModelIds ?? {}).map(normalizeId);
     const agentIds = new Set(
       (Array.isArray(payload.agentModelSorts) ? payload.agentModelSorts : [])
         .flatMap(sort => (Array.isArray(sort?.groups) ? sort.groups : []))
@@ -262,18 +259,16 @@ export function parseModelsBody(provider: ProviderName, body: unknown): string[]
       ...deprecated,
     ]);
     const rawModels = payload.models;
-    const ids = Array.isArray(rawModels)
-      ? rawModels.map(m => m.slug ?? m.id ?? m.name ?? "").filter(Boolean)
-      : Object.entries(rawModels ?? {})
-          .filter(([id, model]) =>
-            !ANTIGRAVITY_MODEL_DENYLIST.has(id) &&
-            model?.isInternal !== true &&
-            (agentIds.size > 0 ? agentIds.has(id) : !nonChat.has(id)))
-          .map(([id]) => id);
-    return ids
-      .map(id => id.replace(/^models\//, ""))
-      .filter(Boolean)
-      .map(id => id.startsWith("antigravity/") ? id : `antigravity/${id}`);
+    const entries = Array.isArray(rawModels)
+      ? rawModels.map(model => [model?.slug ?? model?.id ?? model?.name ?? "", model] as const)
+      : Object.entries(rawModels ?? {});
+    return entries
+      .map(([id, model]) => [typeof id === "string" ? normalizeId(id) : "", model] as const)
+      .filter(([id, model]) =>
+        id.length > 0 &&
+        model?.isInternal !== true &&
+        (agentIds.size > 0 ? agentIds.has(id) : !nonChat.has(id)))
+      .map(([id]) => `antigravity/${id}`);
   }
   if (provider === "gemini") {
     // Keep only models the generateContent endpoint can serve (skip embeddings/tts/aqa/etc).
@@ -285,14 +280,16 @@ export function parseModelsBody(provider: ProviderName, body: unknown): string[]
   }
   if (provider === "openai" && data.models?.some(m => m.slug || m.id)) {
     return data.models
-      .filter(m => m.supported_in_api !== false)
+      // supported_in_api describes API-key availability, not ChatGPT entitlement.
+      // Codex's ChatGPT picker uses visibility, including subscription-only rows.
+      .filter(m => m.visibility === undefined || m.visibility === "list")
       .map(m => m.slug ?? m.id ?? "")
       // Review-only entries (e.g. codex-auto-review) are not chat-turn models.
       .filter(id => id && !/(^|[-/])auto-review([-/]|$)/i.test(id));
   }
   // anthropic / openai: { data: [{ id }] }
   const ids = (data.data ?? []).map(m => m.id ?? "").filter(Boolean);
-  return provider === "openai" ? ids.filter(isOpenAiChatModel) : ids;
+  return provider === "openai" && !opts.openaiCompatible ? ids.filter(isOpenAiChatModel) : ids;
 }
 
 /**
@@ -305,23 +302,23 @@ export function parseModelsBody(provider: ProviderName, body: unknown): string[]
  */
 export function catalogOr(result: ProviderModelsResult): ProviderModelsResult {
   if (result.ok && result.models.length > 0) return result;
+  // OpenAI has live list endpoints for both auth modes. Neither a failed request
+  // nor an authoritative empty list establishes access to the static snapshot.
+  if (result.provider === "openai") return result;
   // Antigravity's available models depend on the Cloud Code Assist agent backend
   // and must never be faked from a hard-coded catalog.
   if (result.provider === "antigravity") return result;
   // No catalog-fallback for oauth-sourced gemini failures: OAuth can LIST but
   // not SERVE gemini models (see listProviderModels' gemini gate).
   if (result.provider === "gemini" && result.source === "oauth") return result;
-  // OAuth: OpenAI/Codex legitimately rejects the standard /models endpoint while
-  // the fixed Codex ids still work; other OAuth providers fall back to their full
-  // static catalog too. API-key providers only fall back when the provider has NO
+  // Other OAuth providers fall back to their static catalog. API-key providers
+  // only fall back when the provider has NO
   // models-list endpoint at all (HTTP 404 / not found) — never for an auth
   // rejection, so a wrong key stays a failure instead of fabricating catalog rows.
   const eligible = result.source === "oauth"
     || (result.source === "api_key" && isMissingModelsEndpoint(result.error));
   if (!eligible) return result;
-  const ids = result.provider === "openai" && result.source === "oauth"
-    ? [...CODEX_MODELS]
-    : result.provider === "kimi" && result.source === "oauth"
+  const ids = result.provider === "kimi" && result.source === "oauth"
       // Kimi OAuth (Kimi Code subscription) serves ONLY the Kimi Code catalog —
       // moonshot API-platform ids would 404 against api.kimi.com/coding.
       ? KIMI_CODE_MODELS.map(id => `kimi/${id}`)
@@ -345,7 +342,8 @@ export async function listProviderModels(
   opts: DiscoveryOptions = {},
 ): Promise<ProviderModelsResult> {
   const fetchImpl = opts.fetchImpl ?? fetch;
-  const limit = opts.limit ?? DEFAULT_LIMIT;
+  const limit = opts.limit ?? (provider === "openai" ? Number.POSITIVE_INFINITY : DEFAULT_LIMIT);
+  let baseUrl = opts.baseUrl;
 
   let cred: Credential | undefined;
   let oauthAccountId: string | undefined;
@@ -363,6 +361,7 @@ export async function listProviderModels(
     cred = raw;
     source = cred.kind === "oauth" ? "oauth" : cred.kind === "api_key" ? "api_key" : "none";
     const config = opts.config ?? (await readGlobalConfig());
+    if (provider === "openai") baseUrl = (baseUrl ?? config.openaiBaseUrl ?? process.env.OPENAI_BASE_URL)?.replace(/\/+$/, "");
 
     if (provider === "antigravity") {
       // Antigravity lists models from the LIVE Cloud Code Assist endpoint
@@ -391,6 +390,12 @@ export async function listProviderModels(
       cred = { kind: "api_key", provider: prov, token: config.providers[prov]! };
       source = "api_key";
     }
+    if (provider === "openai" && baseUrl && cred.kind === "oauth") {
+      // Subscription credentials belong to ChatGPT, not a configured proxy.
+      const key = config.providers?.openai;
+      cred = key ? { kind: "api_key", provider: "openai", token: key } : { kind: "none", provider: "openai" };
+      source = key ? "api_key" : "keyless";
+    }
     if (provider === "openai" && source === "oauth" && cred.kind === "oauth") {
       const stored = await getStoredOAuth("openai").catch(() => undefined);
       const jwtAccountId = extractChatgptAccountId(cred.token);
@@ -406,23 +411,32 @@ export async function listProviderModels(
     if (provider === "gemini" && cred.kind === "oauth") {
       return { provider, models: [], ok: false, source, error: "OAuth cannot serve gemini models — set GEMINI_API_KEY, or use antigravity/* (Cloud Code Assist)" };
     }
-    const isLocalOpenAi = provider === "openai" && !!(opts.baseUrl ?? process.env.OPENAI_BASE_URL);
+    const isLocalOpenAi = provider === "openai" && !!baseUrl;
     if (source === "none" && !isLocalOpenAi) {
       return { provider, models: [], ok: false, source, error: "not logged in" };
     }
   }
 
-  const { url, headers, method, body: requestBody } = discoveryRequest(provider, cred, opts.baseUrl);
+  const { url, headers, method, body: requestBody } = discoveryRequest(provider, cred, baseUrl, oauthAccountId);
+  const scope = { ...(oauthAccountId ? { accountId: oauthAccountId } : {}), ...(baseUrl ? { baseUrl } : {}) };
   const timeout = opts.timeoutMs ?? DEFAULT_TIMEOUT;
   const signal = opts.signal ?? AbortSignal.timeout(timeout);
   try {
     const res = await fetchImpl(url, { method: method ?? "GET", headers, body: requestBody, signal });
     if (!res.ok) {
       const reason = res.status === 401 || res.status === 403 ? "auth rejected" : `HTTP ${res.status}`;
-      return { provider, models: [], ok: false, source, error: reason };
+      return { provider, models: [], ok: false, source, error: reason, ...scope };
     }
     const body = await res.json();
-    let ids = parseModelsBody(provider, body);
+    if (provider === "openai") {
+      const payload = body as { models?: unknown; data?: unknown } | null;
+      const rows = Array.isArray(payload?.models) ? payload.models : payload?.data;
+      if (!Array.isArray(rows) || rows.some(row => !row || typeof row !== "object"
+        || ![row.slug, row.id].some(id => typeof id === "string" && id.trim().length > 0))) {
+        return { provider, models: [], ok: false, source, error: "invalid models response", ...scope };
+      }
+    }
+    let ids = parseModelsBody(provider, body, { openaiCompatible: provider === "openai" && !!baseUrl });
     // Gemini paginates: follow nextPageToken (bounded) so the available list is
     // COMPLETE — page 1 alone silently dropped the newest models (round-15).
     if (provider === "gemini") {
@@ -436,26 +450,28 @@ export async function listProviderModels(
         pageToken = pageBody.nextPageToken;
       }
     }
-    const models = [...new Set(ids)].sort().slice(0, limit);
+    const allModels = [...new Set(ids)].sort();
+    const models = allModels.slice(0, limit);
     // Record live ids for routing supplements. For OpenAI OAuth, keep the
     // existing Codex allow-list widening separate: API-key/custom-base discovery
     // must not make OAuth Codex calls accept unrelated API models.
-    recordLiveProviderModels(provider, models, {
+    recordLiveProviderModels(provider, allModels, {
       source,
-      baseUrl: opts.baseUrl,
+      baseUrl,
+      replace: provider === "openai",
       ...(provider === "openai" && source === "oauth" && oauthAccountId ? { accountId: oauthAccountId } : {}),
     });
-    if (provider === "openai" && source === "oauth") recordLiveCodexModels(models, oauthAccountId);
+    if (provider === "openai" && source === "oauth" && !baseUrl) recordLiveCodexModels(allModels, oauthAccountId);
     return {
       provider,
       models,
       ok: true,
       source,
-      ...(oauthAccountId ? { accountId: oauthAccountId } : {}),
+      ...scope,
     };
   } catch (err) {
     const msg = (err as Error)?.name === "TimeoutError" || (err as Error)?.name === "AbortError" ? "timeout" : "unreachable";
-    return { provider, models: [], ok: false, source, error: msg };
+    return { provider, models: [], ok: false, source, error: msg, ...scope };
   }
 }
 
@@ -495,13 +511,24 @@ export async function discoverModels(
   const providers = opts.providers ?? [...PROVIDER_NAMES];
   const useFallback = opts.catalogFallback !== false;
   const results = await Promise.all(
-    providers.map(p =>
-      listProviderModels(p, {
+    providers.map(async p => {
+      const discoveryOpts = {
         ...opts,
         config: cfg,
         baseUrl: p === "ollama" ? (cfg.ollamaBaseUrl ?? opts.baseUrl) : p === "lmstudio" ? (cfg.lmstudioBaseUrl ?? opts.baseUrl) : p === "openai" ? (cfg.openaiBaseUrl ?? opts.baseUrl) : opts.baseUrl,
-      }),
-    ),
+      };
+      const primary = await listProviderModels(p, discoveryOpts);
+      // Both credentials can coexist. API discovery alone omits subscription-only
+      // models and never teaches the Codex call gate what this account can serve.
+      if (p === "openai" && primary.source === "api_key" && !discoveryOpts.baseUrl && !process.env.OPENAI_BASE_URL) {
+        const credential = await resolveCredential("openai");
+        if (credential.kind === "oauth") {
+          return [primary, await listProviderModels(p, { ...discoveryOpts, preferOAuth: true })];
+        }
+      }
+      return [primary];
+    }),
   );
-  return useFallback ? results.map(catalogOr) : results;
+  const flat = results.flat();
+  return useFallback ? flat.map(catalogOr) : flat;
 }

package/src/ai/model-picker.ts

@@ -16,9 +16,13 @@ export interface PickEntry {
 /** Flatten successful discovery results into an ordered, 1-based pick list. */
 export function flattenModels(results: ProviderModelsResult[]): PickEntry[] {
   const out: PickEntry[] = [];
+  const seen = new Set<string>();
   for (const r of results) {
     if (!r.ok) continue;
     for (const model of r.models) {
+      const key = `${r.provider}\u0000${model}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
       out.push({ index: out.length + 1, provider: r.provider, model });
     }
   }

package/src/autopilot.ts

@@ -180,6 +180,7 @@ export function foldBest(goal: Goal, best: number | undefined, score: number): n
 /**
  * Single source of truth for the ratchet keep/revert decision. Shared by step,
  * loop, and status so they can never diverge.
+ *  - every goal: a failed eval always reverts, regardless of its printed score.
  *  - gate goal: keep iff the eval passed (score is irrelevant).
  *  - min/max goal: a non-measurable (NaN) score can never prove improvement, so
  *    it is always reverted; otherwise keep iff it improves on the best so far.
@@ -190,7 +191,8 @@ export function decideStep(
   passed: boolean,
   best: number | undefined,
 ): "keep" | "revert" {
-  if (goal === "gate") return passed ? "keep" : "revert";
+  if (!passed) return "revert";
+  if (goal === "gate") return "keep";
   if (Number.isNaN(score)) return "revert";
   return isImprovement(goal, score, best) ? "keep" : "revert";
 }
@@ -255,8 +257,11 @@ function cmdStep(flags: Record<string, string>): void {
   if (decision === "revert" && flags["on-revert"]) {
     try {
       execSync(flags["on-revert"], { stdio: "inherit", shell: getShell() });
-    } catch {
-      console.error("jeo autopilot: --on-revert hook failed (decision still logged)");
+    } catch (error) {
+      appendLog({ type: "stop", reason: "rollback_failed", change, score, passed, prevBest: best ?? null, output, error: String(error) });
+      console.error(`jeo autopilot: stop — --on-revert hook failed: ${String(error)}`);
+      process.exitCode = 1;
+      return;
     }
   }
 
@@ -295,6 +300,7 @@ function cmdLoop(flags: Record<string, string>): void {
     if (!runnerOk) {
       appendLog({ type: "stop", reason: "runner_failed", iteration: i });
       console.log(`jeo autopilot: stop — runner failed at iteration ${i}`);
+      process.exitCode = 1;
       return;
     }
 
@@ -304,8 +310,11 @@ function cmdLoop(flags: Record<string, string>): void {
     if (decision === "revert" && flags["on-revert"]) {
       try {
         execSync(flags["on-revert"], { stdio: "inherit", shell: getShell() });
-      } catch {
-        /* logged below regardless */
+      } catch (error) {
+        appendLog({ type: "stop", reason: "rollback_failed", iteration: i, change: `loop#${i}`, score, passed, prevBest: best ?? null, output, error: String(error) });
+        console.error(`jeo autopilot: stop — --on-revert hook failed at iteration ${i}: ${String(error)}`);
+        process.exitCode = 1;
+        return;
       }
     }
     appendLog({ type: "step", iteration: i, change: `loop#${i}`, score, passed, decision, prevBest: best ?? null, output });

package/src/cli/runner.ts

@@ -112,8 +112,8 @@ export const COMMANDS: readonly CommandSpec[] = [
   },
   {
     name: "notify",
-    summary: "Configure/inspect remote subagent notifications over Telegram (gjc notify parity).",
-    usage: "notify [setup [--token <t> --chat-id <id>]|status]",
+    summary: "Configure/inspect Telegram, Discord, and Slack notification channels.",
+    usage: "notify [setup|status|health|test] [--provider telegram|discord|slack] [--token-env NAME] [--app-token-env NAME] [--chat-id ID|--channel-id ID] [--allowed-user-ids IDS]",
     loader: async () => {
       const m = await import("../commands/notify");
       return args => m.runNotifyCommand(args);
@@ -121,7 +121,7 @@ export const COMMANDS: readonly CommandSpec[] = [
   },
   {
     name: "daemon",
-    summary: "Manage the background Telegram notification/subagent-control daemon.",
+    summary: "Manage the shared Telegram/Discord/Slack notification daemon.",
     usage: "daemon [status|start|stop|reload]",
     loader: async () => {
       const m = await import("../commands/daemon");
@@ -197,7 +197,7 @@ export const COMMANDS: readonly CommandSpec[] = [
   },
   {
     name: "notify-daemon-run",
-    summary: "(internal) Foreground worker for the Telegram notification daemon, spawned by 'jeo daemon start'.",
+    summary: "(internal) Foreground notification worker, spawned by 'jeo daemon start'.",
     usage: "notify-daemon-run",
     loader: async () => {
       const m = await import("../agent/notify/telegram-daemon");