fix: stop fallback to models.json when OPENCODE_MODELS_URL is set (#362)

When OPENCODE_MODELS_URL is configured, the URL-derived cache file
(models-<sha1(url)>.json) is the only authoritative source for that
registry. Falling through to the default models.json crosses a trust
domain boundary and can cause Systematic to pin source defaults from
unrelated availability data.

Per Option B in issue #361: treat a URL-derived cache miss as
status: 'unknown' rather than reading models.json. This aligns with
Systematic's existing safety posture of skipping source-default
emission when availability cannot be trusted.

Updates the OPENCODE_MODELS_URL test that previously asserted the
fallthrough, and adds a spy-based test confirming models.json is
never opened when OPENCODE_MODELS_URL is set.

Closes #361

Author: fro-bot

src/lib/model-availability.ts

@@ -192,7 +192,12 @@ function readFallbackCache(): ModelAvailability {
     if (urlResult !== null) {
       return { status: 'cache', models: urlResult }
     }
-    // Fall through to models.json when the URL-derived cache is absent
+    // When OPENCODE_MODELS_URL is set, the URL-derived cache file is the
+    // only authoritative source for this registry. Do not fall through to
+    // the default models.json — that file belongs to a different registry
+    // trust domain and could cause Systematic to pin source defaults from
+    // unrelated availability data.
+    return emptyAvailability()
   }
 
   const defaultPath = path.join(cacheDir, MODELS_JSON_FILENAME)

tests/unit/model-availability.test.ts

@@ -273,7 +273,7 @@ describe('getAvailableModels', () => {
       expect(result.models.has('openai/gpt-5.5')).toBe(false)
     })
 
-    test('falls back to models.json when OPENCODE_MODELS_URL is set but no URL-derived file exists', async () => {
+    test('returns unknown (not models.json) when OPENCODE_MODELS_URL is set but no URL-derived file exists', async () => {
       const cacheDir = path.join(testDir, 'cache', 'opencode')
       fs.mkdirSync(cacheDir, { recursive: true })
 
@@ -289,8 +289,36 @@ describe('getAvailableModels', () => {
       const client = makeThrowingClient(new Error('network error'))
       const result = await getAvailableModels(client)
 
-      expect(result.status).toBe('cache')
-      expect(result.models.has('openai/gpt-5.5')).toBe(true)
+      expect(result.status).toBe('unknown')
+      expect(result.models.size).toBe(0)
+    })
+
+    test('does NOT read models.json when OPENCODE_MODELS_URL is set and URL-derived file is absent (spy verification)', async () => {
+      const cacheDir = path.join(testDir, 'cache', 'opencode')
+      fs.mkdirSync(cacheDir, { recursive: true })
+
+      fs.writeFileSync(
+        path.join(cacheDir, 'models.json'),
+        JSON.stringify({ openai: { models: { 'gpt-5.5': {} } } }),
+      )
+
+      process.env.XDG_CACHE_HOME = path.join(testDir, 'cache')
+      process.env.OPENCODE_MODELS_URL =
+        'https://custom.models.example.com/api.json'
+
+      const openSyncSpy = spyOn(fs, 'openSync')
+
+      const client = makeThrowingClient(new Error('network error'))
+      await getAvailableModels(client)
+
+      const modelsJsonCalls = openSyncSpy.mock.calls.filter(
+        (args) =>
+          typeof args[0] === 'string' &&
+          (args[0] as string).endsWith('models.json'),
+      )
+      expect(modelsJsonCalls.length).toBe(0)
+
+      openSyncSpy.mockRestore()
     })
   })