wechatbridge-cli 1.4.2__tar.gz → 1.4.3__tar.gz

{wechatbridge_cli-1.4.2/wechatbridge_cli.egg-info → wechatbridge_cli-1.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wechatbridge-cli
-Version: 1.4.2
+Version: 1.4.3
 Summary: Bridge WeChat messages to agy, Grok Build, or Codex CLIs — text/image/file/voice in, CLI replies and generated files back.
 Author: WeChatBridge contributors
 License: MIT
@@ -250,8 +250,8 @@ See [`deploy/wechatbridge-windows.md`](deploy/wechatbridge-windows.md).
 | `/help` | list supported commands for the active backend |
 | `/backend <agy\|grok\|codex>` | switch CLI backend for this WeChat user (on real change: clears that backend's continuation state — agy/grok flag and codex `thread_id`/resume — so the next turn starts a fresh session; history files may remain until retention cleanup) |
 | `/clear` or `/new` | drop continue flag so the next CLI turn is a new conversation (does not instantly delete history files) |
-| `/model <name>` | set model (validation differs by backend: agy/grok check against the live model list; codex stores the name without verifying, so a typo only surfaces on the next run; see `/models`) |
-| `/models` | list models — agy/grok query the live CLI; codex returns a built-in reference list, not your actual account's models |
+| `/model <name>` | set model (all backends validate against a live list: agy/grok via CLI `models`; codex via `codex debug models` [then `--bundled`]; unknown name or list-fetch failure refuse and do not write prefs; see `/models`) |
+| `/models` | list models — agy/grok/codex all query the live CLI (codex: `debug models`; falls back to a built-in reference note only if the live list cannot be fetched) |
 | `/fast` | set low reasoning effort (**on only** — not a toggle; no “off” command) |
 | `/planning` | set planning mode (**on only** — not a toggle) |
 | `/add-dir <path>` | **agy:** pass `--add-dir` on later runs if path is allowed. **grok:** recorded only; not passed to the CLI yet |

{wechatbridge_cli-1.4.2 → wechatbridge_cli-1.4.3}/README.md

@@ -219,8 +219,8 @@ See [`deploy/wechatbridge-windows.md`](deploy/wechatbridge-windows.md).
 | `/help` | list supported commands for the active backend |
 | `/backend <agy\|grok\|codex>` | switch CLI backend for this WeChat user (on real change: clears that backend's continuation state — agy/grok flag and codex `thread_id`/resume — so the next turn starts a fresh session; history files may remain until retention cleanup) |
 | `/clear` or `/new` | drop continue flag so the next CLI turn is a new conversation (does not instantly delete history files) |
-| `/model <name>` | set model (validation differs by backend: agy/grok check against the live model list; codex stores the name without verifying, so a typo only surfaces on the next run; see `/models`) |
-| `/models` | list models — agy/grok query the live CLI; codex returns a built-in reference list, not your actual account's models |
+| `/model <name>` | set model (all backends validate against a live list: agy/grok via CLI `models`; codex via `codex debug models` [then `--bundled`]; unknown name or list-fetch failure refuse and do not write prefs; see `/models`) |
+| `/models` | list models — agy/grok/codex all query the live CLI (codex: `debug models`; falls back to a built-in reference note only if the live list cannot be fetched) |
 | `/fast` | set low reasoning effort (**on only** — not a toggle; no “off” command) |
 | `/planning` | set planning mode (**on only** — not a toggle) |
 | `/add-dir <path>` | **agy:** pass `--add-dir` on later runs if path is allowed. **grok:** recorded only; not passed to the CLI yet |

{wechatbridge_cli-1.4.2 → wechatbridge_cli-1.4.3}/tests/test_codex.py

@@ -3,12 +3,14 @@
 from __future__ import annotations
 
 import asyncio
+import json
 import os
 import sys
 import tempfile
 import time
 import unittest
 from unittest import mock
+from unittest.mock import AsyncMock
 
 _HERE = os.path.dirname(os.path.abspath(__file__))
 _FIXTURES = os.path.join(_HERE, "fixtures")
@@ -519,23 +521,148 @@ class TestCodexSlash(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(_read_codex_thread_id(sd), "")
         self.assertFalse(os.path.exists(os.path.join(sd, ".initialized.codex")))
 
-    async def test_model_unvalidated_stores(self):
+    async def test_model_validated_stores(self):
+        """Known model in live list → switch succeeds and prefs are written."""
         from wechatbridge.codex import handle_codex_slash_command
         from wechatbridge.runner_common import load_prefs
-        reply = await handle_codex_slash_command("/model gpt-5.1-codex", "u-model")
+        from wechatbridge import codex as codex_mod
+
+        with mock.patch.object(
+            codex_mod,
+            "_fetch_codex_model_list",
+            new=AsyncMock(return_value=["gpt-5.1-codex", "gpt-5.1", "gpt-5"]),
+        ):
+            reply = await handle_codex_slash_command("/model gpt-5.1-codex", "u-model")
         self.assertIn("模型已切换", reply)
-        self.assertIn("未校验", reply)
+        self.assertNotIn("未校验", reply)
         self.assertEqual(load_prefs("u-model")["model"], "gpt-5.1-codex")
 
+    async def test_model_unknown_rejects(self):
+        """Unknown model → refuse and prefs unchanged."""
+        from wechatbridge.codex import handle_codex_slash_command
+        from wechatbridge.runner_common import load_prefs, save_prefs
+        from wechatbridge import codex as codex_mod
+
+        uid = "u-model-unknown"
+        save_prefs(uid, {"model": "gpt-5.1", "effort": "", "mode": ""})
+        with mock.patch.object(
+            codex_mod,
+            "_fetch_codex_model_list",
+            new=AsyncMock(return_value=["gpt-5.1-codex", "gpt-5.1"]),
+        ):
+            reply = await handle_codex_slash_command("/model not-a-real-model", uid)
+        self.assertIn("模型不存在", reply)
+        self.assertNotIn("模型已切换", reply)
+        self.assertEqual(load_prefs(uid)["model"], "gpt-5.1")
+
+    async def test_model_list_fail_rejects(self):
+        """List fetch failure → refuse and do not write prefs (strict)."""
+        from wechatbridge.codex import handle_codex_slash_command
+        from wechatbridge.runner_common import load_prefs, save_prefs
+        from wechatbridge import codex as codex_mod
+
+        uid = "u-model-listfail"
+        save_prefs(uid, {"model": "gpt-5", "effort": "", "mode": ""})
+        with mock.patch.object(
+            codex_mod,
+            "_fetch_codex_model_list",
+            new=AsyncMock(return_value=None),
+        ):
+            reply = await handle_codex_slash_command("/model gpt-5.1-codex", uid)
+        self.assertIn("无法获取模型列表", reply)
+        self.assertNotIn("模型已切换", reply)
+        self.assertEqual(load_prefs(uid)["model"], "gpt-5")
+
+    async def test_model_prefix_match(self):
+        """Prefix match takes the first hit (same as agy)."""
+        from wechatbridge.codex import handle_codex_slash_command
+        from wechatbridge.runner_common import load_prefs
+        from wechatbridge import codex as codex_mod
+
+        with mock.patch.object(
+            codex_mod,
+            "_fetch_codex_model_list",
+            new=AsyncMock(return_value=["gpt-5.1-codex", "gpt-5.1", "gpt-5"]),
+        ):
+            reply = await handle_codex_slash_command("/model gpt-5.1", "u-model-prefix")
+        # exact "gpt-5.1" is in list → exact match wins over longer prefixes
+        self.assertIn("模型已切换", reply)
+        self.assertEqual(load_prefs("u-model-prefix")["model"], "gpt-5.1")
+
+        with mock.patch.object(
+            codex_mod,
+            "_fetch_codex_model_list",
+            new=AsyncMock(return_value=["gpt-5.1-codex", "gpt-5-codex"]),
+        ):
+            reply2 = await handle_codex_slash_command("/model gpt-5.1", "u-model-prefix2")
+        self.assertIn("模型已切换", reply2)
+        self.assertEqual(load_prefs("u-model-prefix2")["model"], "gpt-5.1-codex")
+
     async def test_model_empty_shows_current(self):
         from wechatbridge.codex import handle_codex_slash_command
+        from wechatbridge.runner_common import save_prefs
+
+        save_prefs("u-model-empty", {"model": "gpt-5.1-codex", "effort": "", "mode": ""})
         reply = await handle_codex_slash_command("/model", "u-model-empty")
         self.assertIn("当前模型", reply)
+        self.assertIn("gpt-5.1-codex", reply)
+        self.assertNotIn("不会校验", reply)
+        self.assertNotIn("未校验", reply)
 
-    async def test_models_builtin(self):
+    async def test_models_live_list(self):
+        """/models under mock returns the live list."""
         from wechatbridge.codex import handle_codex_slash_command
-        reply = await handle_codex_slash_command("/models", "u-models")
+        from wechatbridge import codex as codex_mod
+
+        with mock.patch.object(
+            codex_mod,
+            "_fetch_codex_model_list",
+            new=AsyncMock(return_value=["gpt-5.1-codex", "gpt-5.1"]),
+        ):
+            reply = await handle_codex_slash_command("/models", "u-models")
         self.assertIn("gpt-5.1-codex", reply)
+        self.assertIn("gpt-5.1", reply)
+        self.assertIn("debug models", reply)
+
+    async def test_models_fallback_builtin(self):
+        """/models falls back to built-in note when live list fails."""
+        from wechatbridge.codex import handle_codex_slash_command
+        from wechatbridge import codex as codex_mod
+
+        with mock.patch.object(
+            codex_mod,
+            "_fetch_codex_model_list",
+            new=AsyncMock(return_value=None),
+        ):
+            reply = await handle_codex_slash_command("/models", "u-models-fb")
+        self.assertIn("参考", reply)
+        self.assertIn("gpt-5.1-codex", reply)
+
+    async def test_parse_codex_models_json_and_lines(self):
+        from wechatbridge.codex import _parse_codex_models
+
+        j = json.dumps({
+            "models": [
+                {"slug": "gpt-5.1-codex"},
+                {"slug": "gpt-5"},
+            ]
+        })
+        self.assertEqual(_parse_codex_models(j), ["gpt-5.1-codex", "gpt-5"])
+
+        nested = json.dumps({
+            "models": [{"slug": "a"}, {"id": "b", "name": "ignored-without-slug-only"}]
+        })
+        # models[] item with slug + item with id (no slug) both accepted
+        self.assertEqual(_parse_codex_models(nested), ["a", "b"])
+
+        # bare string list
+        self.assertEqual(_parse_codex_models(json.dumps(["m1", "m2"])), ["m1", "m2"])
+
+        lines = "* gpt-5.1-codex (default)\n- gpt-5\n"
+        self.assertEqual(_parse_codex_models(lines), ["gpt-5.1-codex", "gpt-5"])
+
+        self.assertEqual(_parse_codex_models(""), [])
+        self.assertEqual(_parse_codex_models("{}"), [])
 
     async def test_fast_and_planning(self):
         from wechatbridge.codex import handle_codex_slash_command

{wechatbridge_cli-1.4.2 → wechatbridge_cli-1.4.3}/tests/test_hardening.py

@@ -1564,6 +1564,18 @@ class TestModelCmdRejectsBellThrottle(unittest.IsolatedAsyncioTestCase):
         self.assertIn("无法获取模型列表", out)
         self.assertNotIn("模型已切换", out)
 
+    async def test_codex_model_bell_throttle(self):
+        from wechatbridge.runner_common import format_notice
+        from wechatbridge import codex as codex_mod
+
+        thr = format_notice("助手通道繁忙", "上游限流")
+        with mock.patch.object(
+            codex_mod, "_run_codex_subcommand", new=AsyncMock(return_value=thr)
+        ):
+            out = await codex_mod._cmd_model("gpt-5.1-codex", "u-model-codex")
+        self.assertIn("无法获取模型列表", out)
+        self.assertNotIn("模型已切换", out)
+
 
 class TestEnvIntList(unittest.TestCase):
     """#8 optional: _env_int_list boundary cases."""

{wechatbridge_cli-1.4.2 → wechatbridge_cli-1.4.3}/wechatbridge/__init__.py

@@ -1,2 +1,2 @@
 """WeChatBridge — bridge WeChat messages to agy, Grok Build, or Codex CLIs."""
-__version__ = "1.4.2"
+__version__ = "1.4.3"

{wechatbridge_cli-1.4.2 → wechatbridge_cli-1.4.3}/wechatbridge/codex.py

@@ -21,7 +21,7 @@ from .config import config
 from .runner_common import (
     sanitize_user_id, get_session_dir, ensure_session_dir, is_first_message, mark_initialized, clear_initialized,
     clean_output, load_prefs, save_prefs, is_dangerous, parse_model_effort,
-    sanitize_env, terminate_process, update_active_prefs,
+    sanitize_env, terminate_process, update_active_prefs, is_bridge_formatted_reply,
     format_error, format_cli_error, format_model_label, EMPTY_REPLY, validate_add_dir,
 )
 
@@ -776,45 +776,265 @@ async def run_codex(prompt: str, user_id: str, timeout: int = None) -> tuple:
 # Slash command support
 # ---------------------------------------------------------------------------
 
-async def _cmd_model(args: str, user_id: str) -> str:
-    """Handle /model <name>: store directly (codex has no models subcommand to validate)."""
-    name = args.strip()
-    if not name:
-        prefs = load_prefs(user_id)
-        return (
-            "📋 **当前模型** 📋\n\n"
-            f"`{format_model_label(prefs.get('model', ''))}`\n\n"
-            "（codex 无列模型子命令，设置不会校验；填错会在下次运行时报错）"
+async def _run_codex_subcommand(subcmd_args: list, user_id: str) -> str:
+    """Run a short codex subcommand (e.g. ``debug models``) and return cleaned output.
+
+    Timeout is fixed at 30 seconds. Session isolation matches ``run_codex``:
+    per-user ``HOME`` / ``CODEX_HOME``, optional ``CODEX_API_KEY`` refill after
+    ``sanitize_env``.
+    """
+    session_dir = ensure_user_codex(user_id)
+    cmd = [config.codex_binary_path] + list(subcmd_args)
+    process = None
+    try:
+        env = sanitize_env(session_dir)
+        env["CODEX_HOME"] = os.path.join(session_dir, ".codex")
+        env["PAGER"] = "cat"
+        env["CI"] = "true"
+        env["NONINTERACTIVE"] = "1"
+        env["PYTHONUNBUFFERED"] = "1"
+        raw_key = os.environ.get("CODEX_API_KEY")
+        if raw_key:
+            env["CODEX_API_KEY"] = raw_key
+
+        process = await asyncio.create_subprocess_exec(
+            *cmd,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+            stdin=asyncio.subprocess.DEVNULL,
+            cwd=session_dir,
+            env=env,
+            preexec_fn=os.setsid if hasattr(os, "setsid") else None,
         )
-    update_active_prefs(user_id, model=name)
-    return (
-        f"✅ **模型已切换** ✅\n\n`{name}`\n\n"
-        "（未校验，填错会在下次运行时报错）"
-    )
+        stdout_bytes, stderr_bytes = await asyncio.wait_for(
+            process.communicate(), timeout=30.0
+        )
+        stdout_text = stdout_bytes.decode("utf-8", errors="replace").strip()
+        stderr_text = stderr_bytes.decode("utf-8", errors="replace").strip()
+
+        if process.returncode != 0:
+            logger.warning(
+                "codex %s exited with code %s",
+                " ".join(subcmd_args),
+                process.returncode,
+            )
+            return format_cli_error(
+                stderr_text or stdout_text or "终端指令执行失败",
+                backend="codex",
+            )
+
+        return clean_output(stdout_text) or EMPTY_REPLY
+
+    except asyncio.TimeoutError:
+        await terminate_process(process, graceful=True)
+        return format_error("查询超时", "查询超时，请稍后再试。")
+    except asyncio.CancelledError:
+        await terminate_process(process, graceful=False)
+        raise
+    except Exception as e:
+        logger.exception("codex subcommand error: %s", e)
+        await terminate_process(process, graceful=False)
+        return format_error(
+            "执行出错",
+            "这次没处理好，请稍后再试。若一直失败，请联系管理员。",
+        )
+
+
+def _parse_codex_models(output: str) -> list[str]:
+    """Loose-parse model slug list from ``codex debug models`` stdout.
+
+    Accepts JSON (any shape with ``slug`` fields, or a ``models`` array of
+    strings/objects) and falls back to line-oriented text (one name per line,
+    optional leading bullets).
+    """
+    if not output or not output.strip():
+        return []
+
+    text = output.strip()
+    models: list[str] = []
+    seen: set[str] = set()
+
+    def _add(name: str) -> None:
+        name = (name or "").strip()
+        if not name or name in seen:
+            return
+        # Skip obvious non-slug noise
+        if name.startswith(("[", "{", "(", "<")):
+            return
+        if name in (EMPTY_REPLY, "(empty response)"):
+            return
+        seen.add(name)
+        models.append(name)
+
+    def _walk(obj, *, under_models: bool = False) -> None:
+        if isinstance(obj, dict):
+            slug = obj.get("slug")
+            if isinstance(slug, str) and slug.strip():
+                _add(slug)
+            elif under_models:
+                # Inside a models array: accept id/name/model when slug absent
+                for key in ("id", "name", "model"):
+                    val = obj.get(key)
+                    if isinstance(val, str) and val.strip():
+                        _add(val)
+                        break
+            # Prefer the conventional "models" key, then recurse the rest
+            if "models" in obj:
+                _walk(obj["models"], under_models=True)
+            for k, v in obj.items():
+                if k == "models":
+                    continue
+                _walk(v, under_models=False)
+        elif isinstance(obj, list):
+            for item in obj:
+                if isinstance(item, str) and under_models:
+                    _add(item)
+                else:
+                    _walk(item, under_models=under_models)
+
+    # Try full-text JSON first, then per-line JSON (JSONL-ish).
+    try:
+        data = json.loads(text)
+        # Top-level bare list of strings counts as a models array
+        if isinstance(data, list) and data and all(isinstance(x, str) for x in data):
+            _walk(data, under_models=True)
+        else:
+            _walk(data)
+    except (json.JSONDecodeError, TypeError, ValueError):
+        for line in text.splitlines():
+            line = line.strip()
+            if not line or not line.startswith(("{", "[")):
+                continue
+            try:
+                piece = json.loads(line)
+                if isinstance(piece, list) and piece and all(isinstance(x, str) for x in piece):
+                    _walk(piece, under_models=True)
+                else:
+                    _walk(piece)
+            except (json.JSONDecodeError, TypeError, ValueError):
+                continue
 
+    if models:
+        return models
 
-def _cmd_models() -> str:
-    """Return a built-in note listing common codex models (no CLI to query)."""
+    # Line-oriented fallback (only when JSON yielded nothing useful)
+    for line in text.splitlines():
+        line = line.strip()
+        if not line:
+            continue
+        # Strip common bullets / list markers
+        for prefix in ("* ", "- ", "• ", "· "):
+            if line.startswith(prefix):
+                line = line[len(prefix):].strip()
+                break
+        # Take first token; drop trailing parenthetical notes
+        token = line.split()[0] if line.split() else ""
+        token = token.split("(")[0].strip().rstrip(",;:")
+        if token and not token.endswith(":") and not token.lower().startswith("available"):
+            _add(token)
+
+    return models
+
+
+async def _fetch_codex_model_list(user_id: str) -> list[str] | None:
+    """Return live model slugs, or None if the list cannot be retrieved.
+
+    Tries ``codex debug models`` first, then ``codex debug models --bundled``.
+    Strict: empty / error / bridge-formatted failure → None (caller must not write prefs).
+    """
+    for args in (["debug", "models"], ["debug", "models", "--bundled"]):
+        output = await _run_codex_subcommand(args, user_id)
+        if not output or output.startswith("[error]") or is_bridge_formatted_reply(output):
+            continue
+        if output == EMPTY_REPLY:
+            continue
+        models = _parse_codex_models(output)
+        if models:
+            return models
+    return None
+
+
+def _builtin_codex_models_note() -> str:
+    """Fallback reference list when live ``debug models`` is unavailable."""
     return (
         "📋 **codex 可用模型（参考）** 📋\n\n"
-        "codex 没有 `models` 子命令可供查询，以下为常见模型名，以你的 OpenAI 账户实际可用为准：\n\n"
+        "暂时无法从本机 `codex debug models` 拉取实时列表，以下为常见模型名，"
+        "以你的 OpenAI 账户实际可用为准：\n\n"
         "- `gpt-5.1-codex`\n"
         "- `gpt-5.1`\n"
         "- `gpt-5-codex`\n"
         "- `gpt-5`\n"
         "- `gpt-4.1`\n\n"
-        "直接 `/model <名称>` 即可；填错会在下次运行时报错。"
+        "请稍后重试 `/models`，或直接 `/model <名称>`（会校验实时列表）。"
     )
 
 
+async def _cmd_model(args: str, user_id: str) -> str:
+    """Handle /model <name>: validate against ``codex debug models``, then save.
+
+    Strict: list fetch failure or unknown name → refuse and do not write prefs.
+    Matching order (same as agy): exact match, then first prefix match.
+    """
+    name = args.strip()
+    if not name:
+        prefs = load_prefs(user_id)
+        return (
+            "📋 **当前模型** 📋\n\n"
+            f"`{format_model_label(prefs.get('model', ''))}`\n\n"
+            "用 `/models` 查看可用模型，`/model <名称>` 切换。"
+        )
+
+    models = await _fetch_codex_model_list(user_id)
+    if models is None:
+        return "❌ **无法获取模型列表** ❌"
+
+    def _apply(model_name: str) -> str:
+        _, embedded = parse_model_effort(model_name)
+        if embedded:
+            update_active_prefs(user_id, model=model_name, effort="")
+        else:
+            update_active_prefs(user_id, model=model_name)
+        return f"✅ **模型已切换** ✅\n\n`{model_name}`"
+
+    # Exact match
+    if name in models:
+        return _apply(name)
+
+    # Prefix match (first hit, same as agy)
+    prefix_matches = [m for m in models if m.startswith(name)]
+    if prefix_matches:
+        return _apply(prefix_matches[0])
+
+    return f"❌ **模型不存在** ❌\n\n`{name}`"
+
+
+async def _cmd_models(user_id: str) -> str:
+    """List codex models via live ``debug models``; fall back to built-in note."""
+    models = await _fetch_codex_model_list(user_id)
+    if models is None:
+        return _builtin_codex_models_note()
+
+    lines = [
+        "📋 **codex 可用模型** 📋",
+        "",
+        "（via `codex debug models`）",
+        "",
+    ]
+    for m in models:
+        lines.append(f"- `{m}`")
+    lines.append("")
+    lines.append("用 `/model <名称>` 切换（支持前缀匹配）。")
+    return "\n".join(lines)
+
+
 def _cmd_help() -> str:
     """Build /help response for codex backend."""
     lines = [
         "📋 **wechatbridge 支持指令 (codex)** 📋",
         "",
         "**模型控制**",
-        "- `/model <名称>` — 切换模型（codex 无列模型子命令，直接存名字，未校验）",
-        "- `/models` — 查看常见模型名（内置说明）",
+        "- `/model <名称>` — 切换模型（用 `/models` 查看可用列表）",
+        "- `/models` — 查看可用模型列表",
         "- `/backend <agy|grok|codex>` — 切换助手引擎",
         "",
         "**对话控制**",
@@ -883,7 +1103,7 @@ async def handle_codex_slash_command(text: str, user_id: str) -> str | None:
         return await _cmd_model(args, user_id)
 
     if cmd == "/models":
-        return _cmd_models()
+        return await _cmd_models(user_id)
 
     if cmd == "/add-dir":
         path = args.strip()

{wechatbridge_cli-1.4.2 → wechatbridge_cli-1.4.3/wechatbridge_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wechatbridge-cli
-Version: 1.4.2
+Version: 1.4.3
 Summary: Bridge WeChat messages to agy, Grok Build, or Codex CLIs — text/image/file/voice in, CLI replies and generated files back.
 Author: WeChatBridge contributors
 License: MIT
@@ -250,8 +250,8 @@ See [`deploy/wechatbridge-windows.md`](deploy/wechatbridge-windows.md).
 | `/help` | list supported commands for the active backend |
 | `/backend <agy\|grok\|codex>` | switch CLI backend for this WeChat user (on real change: clears that backend's continuation state — agy/grok flag and codex `thread_id`/resume — so the next turn starts a fresh session; history files may remain until retention cleanup) |
 | `/clear` or `/new` | drop continue flag so the next CLI turn is a new conversation (does not instantly delete history files) |
-| `/model <name>` | set model (validation differs by backend: agy/grok check against the live model list; codex stores the name without verifying, so a typo only surfaces on the next run; see `/models`) |
-| `/models` | list models — agy/grok query the live CLI; codex returns a built-in reference list, not your actual account's models |
+| `/model <name>` | set model (all backends validate against a live list: agy/grok via CLI `models`; codex via `codex debug models` [then `--bundled`]; unknown name or list-fetch failure refuse and do not write prefs; see `/models`) |
+| `/models` | list models — agy/grok/codex all query the live CLI (codex: `debug models`; falls back to a built-in reference note only if the live list cannot be fetched) |
 | `/fast` | set low reasoning effort (**on only** — not a toggle; no “off” command) |
 | `/planning` | set planning mode (**on only** — not a toggle) |
 | `/add-dir <path>` | **agy:** pass `--add-dir` on later runs if path is allowed. **grok:** recorded only; not passed to the CLI yet |