🤖 fix: gate direct Copilot model entries

Apply the authoritative Copilot catalog check to direct provider model strings so hidden and custom model lists do not surface Copilot-only entries that the signed-in account cannot use.

---

_Generated with `mux` • Model: `openai:gpt-5.4` • Thinking: `xhigh` • Cost: `$23.81`_

<!-- mux-attribution: model=openai:gpt-5.4 thinking=xhigh costs=23.81 -->

Author: ibetitsmike

src/browser/hooks/useModelsFromSettings.ts

@@ -21,7 +21,10 @@ import { isModelAvailable } from "@/common/routing";
 import type { ProviderModelEntry, ProvidersConfigMap } from "@/common/orpc/types";
 import { DEFAULT_MODEL_KEY, HIDDEN_MODELS_KEY } from "@/common/constants/storage";
 
-import { isGatewayModelAccessibleFromAuthoritativeCatalog } from "@/common/utils/providers/gatewayModelCatalog";
+import {
+  isGatewayModelAccessibleFromAuthoritativeCatalog,
+  isProviderModelAccessibleFromAuthoritativeCatalog,
+} from "@/common/utils/providers/gatewayModelCatalog";
 import { getProviderModelEntryId } from "@/common/utils/providers/modelEntries";
 
 const BUILT_IN_MODELS: string[] = Object.values(KNOWN_MODELS).map((m) => m.id);
@@ -162,10 +165,30 @@ export function useModelsFromSettings() {
     [config]
   );
 
+  const isAuthoritativeProviderModelAccessible = useCallback(
+    (modelString: string) => {
+      const colonIndex = modelString.indexOf(":");
+      if (colonIndex <= 0 || colonIndex >= modelString.length - 1) {
+        return true;
+      }
+
+      const provider = modelString.slice(0, colonIndex);
+      const providerModelId = modelString.slice(colonIndex + 1);
+      return isProviderModelAccessibleFromAuthoritativeCatalog(
+        provider,
+        providerModelId,
+        config?.[provider]?.models
+      );
+    },
+    [config]
+  );
+
   const customModels = useMemo(() => {
-    const next = filterHiddenModels(getCustomModels(config), hiddenModels);
+    const next = filterHiddenModels(getCustomModels(config), hiddenModels).filter(
+      isAuthoritativeProviderModelAccessible
+    );
     return effectivePolicy ? next.filter((m) => isModelAllowedByPolicy(effectivePolicy, m)) : next;
-  }, [config, hiddenModels, effectivePolicy]);
+  }, [config, hiddenModels, effectivePolicy, isAuthoritativeProviderModelAccessible]);
 
   const openaiApiKeySet = config === null ? null : config.openai?.apiKeySet === true;
   const codexOauthSet = config === null ? null : config.openai?.codexOauthSet === true;
@@ -186,6 +209,10 @@ export function useModelsFromSettings() {
         return false;
       }
 
+      if (!isAuthoritativeProviderModelAccessible(modelId)) {
+        return true;
+      }
+
       if (
         isModelAvailable(
           modelId,
@@ -221,6 +248,7 @@ export function useModelsFromSettings() {
     effectivePolicy,
     isConfigured,
     isGatewayModelAccessible,
+    isAuthoritativeProviderModelAccessible,
     routePriority,
     routeOverrides,
     openaiApiKeySet,
@@ -240,14 +268,16 @@ export function useModelsFromSettings() {
     const providerFiltered =
       config == null
         ? suggested
-        : suggested.filter((modelId) =>
-            isModelAvailable(
-              modelId,
-              routePriority,
-              routeOverrides,
-              isConfigured,
-              isGatewayModelAccessible
-            )
+        : suggested.filter(
+            (modelId) =>
+              isAuthoritativeProviderModelAccessible(modelId) &&
+              isModelAvailable(
+                modelId,
+                routePriority,
+                routeOverrides,
+                isConfigured,
+                isGatewayModelAccessible
+              )
           );
 
     if (config == null) {
@@ -286,6 +316,7 @@ export function useModelsFromSettings() {
     effectivePolicy,
     isConfigured,
     isGatewayModelAccessible,
+    isAuthoritativeProviderModelAccessible,
     routePriority,
     routeOverrides,
     openaiApiKeySet,

src/common/utils/providers/gatewayModelCatalog.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  isGatewayModelAccessibleFromAuthoritativeCatalog,
+  isProviderModelAccessibleFromAuthoritativeCatalog,
+} from "./gatewayModelCatalog";
+
+describe("gatewayModelCatalog", () => {
+  test("treats non-Copilot providers as permissive even with custom model lists", () => {
+    expect(
+      isProviderModelAccessibleFromAuthoritativeCatalog("openrouter", "openai/gpt-5", [
+        "team-only-model",
+      ])
+    ).toBe(true);
+  });
+
+  test("treats an empty Copilot catalog as permissive", () => {
+    expect(isProviderModelAccessibleFromAuthoritativeCatalog("github-copilot", "gpt-5.4", [])).toBe(
+      true
+    );
+  });
+
+  test("rejects direct Copilot model ids missing from the authoritative catalog", () => {
+    expect(
+      isProviderModelAccessibleFromAuthoritativeCatalog("github-copilot", "gpt-5.4", [
+        "gpt-5.4-mini",
+      ])
+    ).toBe(false);
+  });
+
+  test("keeps the gateway-specific helper behavior aligned", () => {
+    expect(
+      isGatewayModelAccessibleFromAuthoritativeCatalog("github-copilot", "gpt-5.4", [
+        "gpt-5.4-mini",
+      ])
+    ).toBe(false);
+  });
+});

src/common/utils/providers/gatewayModelCatalog.ts

@@ -2,15 +2,15 @@ import type { ProviderModelEntry } from "@/common/orpc/types";
 
 import { getProviderModelEntryId } from "@/common/utils/providers/modelEntries";
 
-export function isGatewayModelAccessibleFromAuthoritativeCatalog(
-  gateway: string,
+export function isProviderModelAccessibleFromAuthoritativeCatalog(
+  provider: string,
   modelId: string,
   models: ProviderModelEntry[] | undefined
 ): boolean {
   // Most provider config model lists are user-managed custom entries, not exhaustive
   // server catalogs. GitHub Copilot is the current exception because OAuth refresh
   // stores the full model catalog returned by Copilot's /models endpoint.
-  if (gateway !== "github-copilot") {
+  if (provider !== "github-copilot") {
     return true;
   }
 
@@ -20,3 +20,11 @@ export function isGatewayModelAccessibleFromAuthoritativeCatalog(
 
   return models.some((entry) => getProviderModelEntryId(entry) === modelId);
 }
+
+export function isGatewayModelAccessibleFromAuthoritativeCatalog(
+  gateway: string,
+  modelId: string,
+  models: ProviderModelEntry[] | undefined
+): boolean {
+  return isProviderModelAccessibleFromAuthoritativeCatalog(gateway, modelId, models);
+}