🤖 fix: gate direct Copilot model entries

Apply the authoritative Copilot catalog check to direct provider model strings so hidden and custom model lists do not surface Copilot-only entries that the signed-in account cannot use. Also keep explicit compaction suggestions on the same availability rules and stabilize the useRouting hook test so it waits for loaded routing state before asserting unavailable Copilot routes are hidden.

---

_Generated with `mux` • Model: `openai:gpt-5.4` • Thinking: `xhigh` • Cost: `$23.81`_

<!-- mux-attribution: model=openai:gpt-5.4 thinking=xhigh costs=23.81 -->

Author: ibetitsmike

src/browser/hooks/useModelsFromSettings.ts

@@ -21,7 +21,10 @@ import { isModelAvailable } from "@/common/routing";
 import type { ProviderModelEntry, ProvidersConfigMap } from "@/common/orpc/types";
 import { DEFAULT_MODEL_KEY, HIDDEN_MODELS_KEY } from "@/common/constants/storage";
 
-import { isGatewayModelAccessibleFromAuthoritativeCatalog } from "@/common/utils/providers/gatewayModelCatalog";
+import {
+  isGatewayModelAccessibleFromAuthoritativeCatalog,
+  isProviderModelAccessibleFromAuthoritativeCatalog,
+} from "@/common/utils/providers/gatewayModelCatalog";
 import { getProviderModelEntryId } from "@/common/utils/providers/modelEntries";
 
 const BUILT_IN_MODELS: string[] = Object.values(KNOWN_MODELS).map((m) => m.id);
@@ -162,10 +165,30 @@ export function useModelsFromSettings() {
     [config]
   );
 
+  const isAuthoritativeProviderModelAccessible = useCallback(
+    (modelString: string) => {
+      const colonIndex = modelString.indexOf(":");
+      if (colonIndex <= 0 || colonIndex >= modelString.length - 1) {
+        return true;
+      }
+
+      const provider = modelString.slice(0, colonIndex);
+      const providerModelId = modelString.slice(colonIndex + 1);
+      return isProviderModelAccessibleFromAuthoritativeCatalog(
+        provider,
+        providerModelId,
+        config?.[provider]?.models
+      );
+    },
+    [config]
+  );
+
   const customModels = useMemo(() => {
-    const next = filterHiddenModels(getCustomModels(config), hiddenModels);
+    const next = filterHiddenModels(getCustomModels(config), hiddenModels).filter(
+      isAuthoritativeProviderModelAccessible
+    );
     return effectivePolicy ? next.filter((m) => isModelAllowedByPolicy(effectivePolicy, m)) : next;
-  }, [config, hiddenModels, effectivePolicy]);
+  }, [config, hiddenModels, effectivePolicy, isAuthoritativeProviderModelAccessible]);
 
   const openaiApiKeySet = config === null ? null : config.openai?.apiKeySet === true;
   const codexOauthSet = config === null ? null : config.openai?.codexOauthSet === true;
@@ -186,6 +209,10 @@ export function useModelsFromSettings() {
         return false;
       }
 
+      if (!isAuthoritativeProviderModelAccessible(modelId)) {
+        return true;
+      }
+
       if (
         isModelAvailable(
           modelId,
@@ -221,6 +248,7 @@ export function useModelsFromSettings() {
     effectivePolicy,
     isConfigured,
     isGatewayModelAccessible,
+    isAuthoritativeProviderModelAccessible,
     routePriority,
     routeOverrides,
     openaiApiKeySet,
@@ -240,14 +268,16 @@ export function useModelsFromSettings() {
     const providerFiltered =
       config == null
         ? suggested
-        : suggested.filter((modelId) =>
-            isModelAvailable(
-              modelId,
-              routePriority,
-              routeOverrides,
-              isConfigured,
-              isGatewayModelAccessible
-            )
+        : suggested.filter(
+            (modelId) =>
+              isAuthoritativeProviderModelAccessible(modelId) &&
+              isModelAvailable(
+                modelId,
+                routePriority,
+                routeOverrides,
+                isConfigured,
+                isGatewayModelAccessible
+              )
           );
 
     if (config == null) {
@@ -286,6 +316,7 @@ export function useModelsFromSettings() {
     effectivePolicy,
     isConfigured,
     isGatewayModelAccessible,
+    isAuthoritativeProviderModelAccessible,
     routePriority,
     routeOverrides,
     openaiApiKeySet,

src/browser/hooks/useRouting.test.ts

@@ -68,18 +68,18 @@ describe("useRouting", () => {
         models: [KNOWN_MODELS.GPT_54_MINI.providerModelId],
       },
     };
+    routePriority = ["github-copilot", "direct"];
 
     const { result } = renderHook(() => useRouting(), { wrapper });
 
-    await waitFor(() =>
+    await waitFor(() => {
+      expect(result.current.routePriority).toEqual(["github-copilot", "direct"]);
       expect(
         result.current
           .availableRoutes(KNOWN_MODELS.GPT.id)
           .some((route) => route.route === "github-copilot")
-      ).toBe(true)
-    );
-
-    result.current.setRoutePreferences(["github-copilot", "direct"], {});
+      ).toBe(false);
+    });
 
     expect(result.current.resolveRoute(KNOWN_MODELS.GPT.id)).toEqual({
       route: "direct",

src/browser/utils/compaction/suggestion.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, test } from "bun:test";
+
+import { KNOWN_MODELS } from "@/common/constants/knownModels";
+import type { ProvidersConfigMap } from "@/common/orpc/types";
+
+import { getExplicitCompactionSuggestion } from "./suggestion";
+
+const COPILOT_ONLY_PROVIDERS_CONFIG: ProvidersConfigMap = {
+  "github-copilot": {
+    apiKeySet: true,
+    isEnabled: true,
+    isConfigured: true,
+    models: [KNOWN_MODELS.GPT_54_MINI.providerModelId],
+  },
+};
+
+const COPILOT_ONLY_OPTIONS = {
+  providersConfig: COPILOT_ONLY_PROVIDERS_CONFIG,
+  policy: null,
+  routePriority: ["direct"],
+  routeOverrides: {},
+};
+
+describe("getExplicitCompactionSuggestion", () => {
+  test("rejects explicit Copilot models missing from the authoritative catalog", () => {
+    expect(
+      getExplicitCompactionSuggestion({
+        ...COPILOT_ONLY_OPTIONS,
+        modelId: `github-copilot:${KNOWN_MODELS.GPT.providerModelId}`,
+      })
+    ).toBeNull();
+  });
+
+  test("keeps explicit Copilot models that the authoritative catalog exposes", () => {
+    expect(
+      getExplicitCompactionSuggestion({
+        ...COPILOT_ONLY_OPTIONS,
+        modelId: `github-copilot:${KNOWN_MODELS.GPT_54_MINI.providerModelId}`,
+      })
+    ).toMatchObject({
+      kind: "preferred",
+      modelId: `github-copilot:${KNOWN_MODELS.GPT_54_MINI.providerModelId}`,
+    });
+  });
+});

src/browser/utils/compaction/suggestion.ts

@@ -10,7 +10,10 @@ import { isModelAvailable } from "@/common/routing";
 import type { EffectivePolicy, ProvidersConfigMap } from "@/common/orpc/types";
 import { normalizeToCanonical } from "@/common/utils/ai/models";
 import { formatModelDisplayName } from "@/common/utils/ai/modelDisplay";
-import { isGatewayModelAccessibleFromAuthoritativeCatalog } from "@/common/utils/providers/gatewayModelCatalog";
+import {
+  isGatewayModelAccessibleFromAuthoritativeCatalog,
+  isProviderModelAccessibleFromAuthoritativeCatalog,
+} from "@/common/utils/providers/gatewayModelCatalog";
 import { getModelStats } from "@/common/utils/tokens/modelStats";
 
 export interface CompactionSuggestion {
@@ -47,6 +50,26 @@ function buildIsGatewayModelAccessible(
     );
 }
 
+function buildIsAuthoritativeProviderModelAccessible(
+  providersConfig: ProvidersConfigMap | null
+): (modelString: string) => boolean {
+  return (modelString: string) => {
+    const normalized = normalizeToCanonical(modelString);
+    const colonIndex = normalized.indexOf(":");
+    if (colonIndex <= 0 || colonIndex >= normalized.length - 1) {
+      return true;
+    }
+
+    const provider = normalized.slice(0, colonIndex);
+    const providerModelId = normalized.slice(colonIndex + 1);
+    return isProviderModelAccessibleFromAuthoritativeCatalog(
+      provider,
+      providerModelId,
+      providersConfig?.[provider]?.models
+    );
+  };
+}
+
 export interface CompactionRouteOptions {
   routePriority: string[];
   routeOverrides: Record<string, string>;
@@ -70,6 +93,13 @@ export function getExplicitCompactionSuggestion(
   const normalized = normalizeToCanonical(modelId);
   const isConfigured = buildIsConfigured(options.providersConfig);
   const isGatewayModelAccessible = buildIsGatewayModelAccessible(options.providersConfig);
+  const isAuthoritativeProviderModelAccessible = buildIsAuthoritativeProviderModelAccessible(
+    options.providersConfig
+  );
+  if (!isAuthoritativeProviderModelAccessible(normalized)) {
+    return null;
+  }
+
   if (
     !isModelAvailable(
       normalized,

src/common/utils/providers/gatewayModelCatalog.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  isGatewayModelAccessibleFromAuthoritativeCatalog,
+  isProviderModelAccessibleFromAuthoritativeCatalog,
+} from "./gatewayModelCatalog";
+
+describe("gatewayModelCatalog", () => {
+  test("treats non-Copilot providers as permissive even with custom model lists", () => {
+    expect(
+      isProviderModelAccessibleFromAuthoritativeCatalog("openrouter", "openai/gpt-5", [
+        "team-only-model",
+      ])
+    ).toBe(true);
+  });
+
+  test("treats an empty Copilot catalog as permissive", () => {
+    expect(isProviderModelAccessibleFromAuthoritativeCatalog("github-copilot", "gpt-5.4", [])).toBe(
+      true
+    );
+  });
+
+  test("rejects direct Copilot model ids missing from the authoritative catalog", () => {
+    expect(
+      isProviderModelAccessibleFromAuthoritativeCatalog("github-copilot", "gpt-5.4", [
+        "gpt-5.4-mini",
+      ])
+    ).toBe(false);
+  });
+
+  test("keeps the gateway-specific helper behavior aligned", () => {
+    expect(
+      isGatewayModelAccessibleFromAuthoritativeCatalog("github-copilot", "gpt-5.4", [
+        "gpt-5.4-mini",
+      ])
+    ).toBe(false);
+  });
+});

src/common/utils/providers/gatewayModelCatalog.ts

@@ -2,15 +2,15 @@ import type { ProviderModelEntry } from "@/common/orpc/types";
 
 import { getProviderModelEntryId } from "@/common/utils/providers/modelEntries";
 
-export function isGatewayModelAccessibleFromAuthoritativeCatalog(
-  gateway: string,
+export function isProviderModelAccessibleFromAuthoritativeCatalog(
+  provider: string,
   modelId: string,
   models: ProviderModelEntry[] | undefined
 ): boolean {
   // Most provider config model lists are user-managed custom entries, not exhaustive
   // server catalogs. GitHub Copilot is the current exception because OAuth refresh
   // stores the full model catalog returned by Copilot's /models endpoint.
-  if (gateway !== "github-copilot") {
+  if (provider !== "github-copilot") {
     return true;
   }
 
@@ -20,3 +20,11 @@ export function isGatewayModelAccessibleFromAuthoritativeCatalog(
 
   return models.some((entry) => getProviderModelEntryId(entry) === modelId);
 }
+
+export function isGatewayModelAccessibleFromAuthoritativeCatalog(
+  gateway: string,
+  modelId: string,
+  models: ProviderModelEntry[] | undefined
+): boolean {
+  return isProviderModelAccessibleFromAuthoritativeCatalog(gateway, modelId, models);
+}