Discover Codex subscription model catalogs

[alejandro-ao]

Description

• add a provider-neutral runtime model-catalog discovery capability to tau_ai
• parse and cache the authenticated ChatGPT Codex /models response alongside runtime limits
• publish the account-specific Codex inventory as a process-local tau_coding overlay
• refresh Codex models at session startup and in the /model background refresh, including while another provider is active
• retain the checked-in Codex catalog on offline, empty, malformed, unauthorized, or unavailable discovery
• document the runtime/static catalog relationship and safety model

User experience

New Codex subscription models become selectable as soon as OpenAI exposes them to the authenticated account. Users no longer need to wait for a Tau release that updates the static openai-codex list, and Tau avoids copying potentially unavailable models from the separate public OpenAI API inventory.

The picker still opens immediately with the static fallback and updates in place after discovery. Account-specific metadata remains memory-only.

Issue

No linked issue. Addresses the delay between Codex subscription rollouts and Tau's checked-in model inventory.

Manual validation

1. Run /login openai-codex with a supported ChatGPT/Codex subscription.
2. Open /model and observe the static inventory immediately.
3. Wait for background refresh and confirm the Codex entries update to the authenticated account's visible models.
4. Select a model that is absent from Tau's checked-in Codex list and send a tool-using prompt.
5. Run /session and confirm provider-live context limits are reported.
6. Restart with TAU_OFFLINE=1, open /model, and confirm the static Codex fallback remains available.

Checks

• uv run pytest (1856 passed, 2 skipped: Windows-only updater tests)
• uv run ruff check .
• uv run ruff format --check .
• uv run mypy
• cd website && hugo --minify
• cd website && npx --yes pagefind@latest --site public

[alejandro-ao]

Review findings from the isolated worktree. Validation: 1855 tests passed, 3 skipped; Ruff lint/format and mypy passed. Live authenticated-provider behavior was not tested.

[alejandro-ao]

P1 — Discover live-only models before startup/resume validation. Discovery here runs after initial provider/model resolution, but cold startup and resume resolve against durable settings, which deliberately exclude live-only models. A model selected and recorded successfully in one session can therefore be rejected on subsequent resume before discovery runs (_prepare_session_provider resolves the selection against config.provider_settings). Please discover and overlay the authenticated Codex inventory before validating explicit/resumed Codex selections, and add cold-start/resume coverage for a model absent from the static catalog.

[alejandro-ao]

P2 — Keep active-runtime validity separate from the selectable inventory. Replacing models can exclude the currently active static model. A subsequent reload_provider_settings() calls _refresh_runtime_provider(), whose _build_runtime_provider() validates that active model against this replacement inventory and raises ProviderConfigError. Thus /model background refresh can fail before reaching fresh Codex discovery. I reproduced the overlay excluding static-model and subsequent validation rejecting it. Please retain the current runtime when its model disappears from discovery, and add coverage for discovery excluding the active model followed by settings/picker refresh.