From d226473d448f2a5e2c6e7d199da3d55b655e2598 Mon Sep 17 00:00:00 2001
From: vitek-karas <10670590+vitek-karas@users.noreply.github.com>
Date: Thu, 2 Apr 2026 21:02:08 +0200
Subject: [PATCH 1/4] Ask Copilot CLI for the list of models instead of
 hardcoding it.

---
 PolyPilot.Tests/ModelSelectionTests.cs        |  32 ++-
 PolyPilot.Tests/ScenarioReferenceTests.cs     |   5 +-
 .../Scenarios/mode-switch-scenarios.json      |   7 +-
 PolyPilot.Tests/StateChangeCoalescerTests.cs  |  24 +-
 .../Components/Layout/SessionListItem.razor   |   5 +-
 .../Components/Layout/SessionSidebar.razor    |   4 +-
 PolyPilot/Components/Pages/Dashboard.razor    |   2 +-
 PolyPilot/Models/ModelHelper.cs               |  29 ++
 .../Services/CopilotService.Utilities.cs      | 263 ++++++++++++++++--
 PolyPilot/Services/CopilotService.cs          |   8 +
 10 files changed, 334 insertions(+), 45 deletions(-)

diff --git a/PolyPilot.Tests/ModelSelectionTests.cs b/PolyPilot.Tests/ModelSelectionTests.cs
index 4f4a8d00e5..84f8bbe8fc 100644
--- a/PolyPilot.Tests/ModelSelectionTests.cs
+++ b/PolyPilot.Tests/ModelSelectionTests.cs
@@ -117,11 +117,22 @@ public void NormalizeToSlug_AllFallbackModels_AreAlreadySlugs()
     }
 
     [Fact]
-    public void FallbackModels_IncludeCurrentGptVariants()
+    public void BuildSelectionList_AppendsSelectionAndDefault_WhenDiscoveryIsEmpty()
     {
-        Assert.Contains("gpt-5.4", ModelHelper.FallbackModels);
-        Assert.Contains("gpt-5.4-mini", ModelHelper.FallbackModels);
-        Assert.Contains("gpt-5.3-codex", ModelHelper.FallbackModels);
+        var models = ModelHelper.BuildSelectionList(Array.Empty<string>(), "Custom Preview", "claude-opus-4.6");
+
+        Assert.Equal(new[] { "custom-preview", "claude-opus-4.6" }, models);
+    }
+
+    [Fact]
+    public void BuildSelectionList_NormalizesDiscoveredModels_AndAvoidsDuplicates()
+    {
+        var models = ModelHelper.BuildSelectionList(
+            new[] { "Claude Opus 4.6", "claude-opus-4.6", "Custom Preview" },
+            "custom-preview",
+            "claude-opus-4.6");
+
+        Assert.Equal(new[] { "claude-opus-4.6", "custom-preview" }, models);
     }
 
     [Fact]
@@ -493,6 +504,19 @@ public void ChangeModel_DisplayNameFromDropdown_NormalizesToSlug()
         }
     }
 
+    [Fact]
+    public void BuildSelectionList_PreservesDiscoveryOrder_AndAppendsMissingRequiredModels()
+    {
+        var models = ModelHelper.BuildSelectionList(
+            new[] { "claude-sonnet-4.6", "Claude Opus 4.6", "gpt-5.4" },
+            "claude-opus-4.6",
+            "gpt-5-mini");
+
+        Assert.Equal(
+            new[] { "claude-sonnet-4.6", "claude-opus-4.6", "gpt-5.4", "gpt-5-mini" },
+            models);
+    }
+
     // --- PrettifyModel tests ---
     // The prettifier is duplicated in ExpandedSessionView.razor and ModelSelector.razor.
     // We test the logic inline here to catch regressions like the "Opus-4.5" bug.
diff --git a/PolyPilot.Tests/ScenarioReferenceTests.cs b/PolyPilot.Tests/ScenarioReferenceTests.cs
index 48eb93e2c6..029cdbe9f1 100644
--- a/PolyPilot.Tests/ScenarioReferenceTests.cs
+++ b/PolyPilot.Tests/ScenarioReferenceTests.cs
@@ -153,13 +153,14 @@ public void Scenario_RefreshSessionsButton_HasUnitTestCoverage()
 
     /// <summary>
     /// Scenario: "create-session-model-picker-includes-gpt-5-4"
-    /// Unit test equivalents: ModelSelectionTests.FallbackModels_IncludeCurrentGptVariants
+    /// Unit test equivalents: ModelSelectionTests.BuildSelectionList_AppendsSelectionAndDefault_WhenDiscoveryIsEmpty,
+    ///   ModelSelectionTests.BuildSelectionList_NormalizesDiscoveredModels_AndAvoidsDuplicates,
     ///   and EventsJsonlParsingTests.ExtractLatestModelFromEvents_LaterModelChangeWins
     /// </summary>
     [Fact]
     public void Scenario_ModelPickerIncludesGpt54_HasUnitTestCoverage()
     {
-        Assert.True(true, "See ModelSelectionTests.FallbackModels_IncludeCurrentGptVariants and EventsJsonlParsingTests.ExtractLatestModelFromEvents_LaterModelChangeWins");
+        Assert.True(true, "See ModelSelectionTests.BuildSelectionList_* and EventsJsonlParsingTests.ExtractLatestModelFromEvents_LaterModelChangeWins");
     }
 
     /// <summary>
diff --git a/PolyPilot.Tests/Scenarios/mode-switch-scenarios.json b/PolyPilot.Tests/Scenarios/mode-switch-scenarios.json
index c5a215edf6..24ec433201 100644
--- a/PolyPilot.Tests/Scenarios/mode-switch-scenarios.json
+++ b/PolyPilot.Tests/Scenarios/mode-switch-scenarios.json
@@ -530,9 +530,10 @@
     {
       "id": "create-session-model-picker-includes-gpt-5-4",
       "name": "Create session model picker exposes GPT-5.4",
-      "description": "The create-session model selector should list GPT-5.4 so users can match the CLI even when the app falls back to its built-in model catalog.",
+      "description": "The create-session model selector should list GPT-5.4 from the Copilot CLI's discovered model list, without requiring PolyPilot to hardcode every supported model.",
       "unitTestCoverage": [
-        "ModelSelectionTests.FallbackModels_IncludeCurrentGptVariants"
+        "ModelSelectionTests.BuildSelectionList_AppendsSelectionAndDefault_WhenDiscoveryIsEmpty",
+        "ModelSelectionTests.BuildSelectionList_NormalizesDiscoveredModels_AndAvoidsDuplicates"
       ],
       "steps": [
         {
@@ -1585,4 +1586,4 @@
       ]
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/PolyPilot.Tests/StateChangeCoalescerTests.cs b/PolyPilot.Tests/StateChangeCoalescerTests.cs
index 64185598a6..55ae64ec08 100644
--- a/PolyPilot.Tests/StateChangeCoalescerTests.cs
+++ b/PolyPilot.Tests/StateChangeCoalescerTests.cs
@@ -70,19 +70,31 @@ public async Task SeparateBursts_FireSeparately()
     {
         var svc = CreateService();
         int fireCount = 0;
-        svc.OnStateChanged += () => Interlocked.Increment(ref fireCount);
+        var firstBurstFired = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var secondBurstFired = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        svc.OnStateChanged += () =>
+        {
+            var count = Interlocked.Increment(ref fireCount);
+            if (count >= 1)
+                firstBurstFired.TrySetResult();
+            if (count >= 2)
+                secondBurstFired.TrySetResult();
+        };
 
         // First burst
         for (int i = 0; i < 10; i++)
             svc.NotifyStateChangedCoalesced();
-        // Wait well beyond the coalesce window (150ms) to ensure the timer fires,
-        // even under heavy CI/GC load. Previous 300ms was flaky under load.
-        await Task.Delay(800);
+        var firstBurstCompleted = await Task.WhenAny(firstBurstFired.Task, Task.Delay(5000));
+        Assert.Same(firstBurstFired.Task, firstBurstCompleted);
 
-        // Second burst after timer has fired
+        // Second burst after the first coalesced notification has actually fired
         for (int i = 0; i < 10; i++)
             svc.NotifyStateChangedCoalesced();
-        await Task.Delay(800);
+        var secondBurstCompleted = await Task.WhenAny(secondBurstFired.Task, Task.Delay(5000));
+        Assert.Same(secondBurstFired.Task, secondBurstCompleted);
+
+        // Small settle window for any extra coalesced fires.
+        await Task.Delay(100);
 
         // Each burst should produce ~1 notification
         Assert.InRange(fireCount, 2, 4);
diff --git a/PolyPilot/Components/Layout/SessionListItem.razor b/PolyPilot/Components/Layout/SessionListItem.razor
index 15389c6f4e..79df0e8cad 100644
--- a/PolyPilot/Components/Layout/SessionListItem.razor
+++ b/PolyPilot/Components/Layout/SessionListItem.razor
@@ -191,7 +191,7 @@
                     <div class="model-picker-inline" @onclick:stopPropagation="true">
                         <select value="@(Meta?.PreferredModel ?? "")" @onchange="OnPreferredModelChanged">
                             <option value="">Default (@Session.Model)</option>
-                            @foreach (var model in CopilotService.AvailableModels)
+                            @foreach (var model in GetSelectableModels())
                             {
                                 var strengths = ModelCapabilities.GetStrengths(model);
                                 <option value="@model" title="@strengths">@model</option>
@@ -405,6 +405,9 @@
         CopilotService.SetSessionPreferredModel(Session.Name, string.IsNullOrEmpty(slug) ? null : slug);
     }
 
+    private IReadOnlyList<string> GetSelectableModels() =>
+        ModelHelper.BuildSelectionList(CopilotService.AvailableModels, Meta?.PreferredModel, Session.Model, CopilotService.DefaultModel);
+
     private static string GetShortPath(string path)
     {
         var parts = path.Split(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
diff --git a/PolyPilot/Components/Layout/SessionSidebar.razor b/PolyPilot/Components/Layout/SessionSidebar.razor
index 0b7dae6327..9cdae950aa 100644
--- a/PolyPilot/Components/Layout/SessionSidebar.razor
+++ b/PolyPilot/Components/Layout/SessionSidebar.razor
@@ -1439,7 +1439,7 @@ else
     }
 
     private IReadOnlyList<string> availableModels =>
-        CopilotService.AvailableModels.Count > 0 ? CopilotService.AvailableModels : ModelHelper.FallbackModels;
+        ModelHelper.BuildSelectionList(CopilotService.AvailableModels, selectedModel, CopilotService.DefaultModel);
 
     private IEnumerable<PersistedSessionInfo> filteredPersistedSessions => 
         (string.IsNullOrWhiteSpace(sessionFilter) 
@@ -1468,7 +1468,7 @@ else
         // Restore last selected model
         var uiState = CopilotService.LoadUiState();
         if (!string.IsNullOrEmpty(uiState?.SelectedModel))
-            selectedModel = uiState.SelectedModel;
+            selectedModel = ModelHelper.NormalizeToSlug(uiState.SelectedModel);
     }
 
     private void SaveSelectedModel()
diff --git a/PolyPilot/Components/Pages/Dashboard.razor b/PolyPilot/Components/Pages/Dashboard.razor
index 561fda5b8a..af1f5f6024 100644
--- a/PolyPilot/Components/Pages/Dashboard.razor
+++ b/PolyPilot/Components/Pages/Dashboard.razor
@@ -3353,7 +3353,7 @@
     // === Model, plan mode, font, token helpers ===
 
     private IReadOnlyList<string> availableModels =>
-        CopilotService.AvailableModels.Count > 0 ? CopilotService.AvailableModels : ModelHelper.FallbackModels;
+        ModelHelper.BuildSelectionList(CopilotService.AvailableModels, CopilotService.DefaultModel);
 
     private string GetSessionModel(AgentSessionInfo session)
     {
diff --git a/PolyPilot/Models/ModelHelper.cs b/PolyPilot/Models/ModelHelper.cs
index 30b3b65a1f..6f6f479745 100644
--- a/PolyPilot/Models/ModelHelper.cs
+++ b/PolyPilot/Models/ModelHelper.cs
@@ -34,6 +34,35 @@ public static class ModelHelper
         "gemini-3-pro-preview",
     };
 
+    /// <summary>
+    /// Builds a model picker list from CLI-discovered models plus any required
+    /// fallback choices (current selection, current session model, default model).
+    /// All values are normalized to slugs and deduplicated case-insensitively.
+    /// </summary>
+    public static IReadOnlyList<string> BuildSelectionList(IEnumerable<string>? discoveredModels, params string?[] requiredModels)
+    {
+        var result = new List<string>();
+        var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        void Add(string? model)
+        {
+            var normalized = NormalizeToSlug(model);
+            if (!string.IsNullOrEmpty(normalized) && seen.Add(normalized))
+                result.Add(normalized);
+        }
+
+        if (discoveredModels != null)
+        {
+            foreach (var model in discoveredModels)
+                Add(model);
+        }
+
+        foreach (var model in requiredModels)
+            Add(model);
+
+        return result;
+    }
+
     /// <summary>
     /// Normalize any model string to its canonical slug form.
     /// Handles display names like "Claude Opus 4.5", "GPT-5.1-Codex", 
diff --git a/PolyPilot/Services/CopilotService.Utilities.cs b/PolyPilot/Services/CopilotService.Utilities.cs
index a68986e010..5d4f060b7d 100644
--- a/PolyPilot/Services/CopilotService.Utilities.cs
+++ b/PolyPilot/Services/CopilotService.Utilities.cs
@@ -791,42 +791,253 @@ public void ClearBadge()
 
     private async Task FetchAvailableModelsAsync()
     {
+        Task fetchTask;
+        lock (_availableModelsFetchSync)
+        {
+            if (_availableModelsFetchTask.IsCompleted)
+            {
+                _availableModelsFetchQueued = false;
+                _availableModelsFetchTask = RunAvailableModelsFetchLoopAsync();
+            }
+            else
+            {
+                _availableModelsFetchQueued = true;
+            }
+
+            fetchTask = _availableModelsFetchTask;
+        }
+
+        await fetchTask;
+    }
+
+    private async Task<IReadOnlyList<string>> GetSdkAvailableModelsAsync()
+    {
+        if (_client == null)
+            return Array.Empty<string>();
+
+        // ListModelsAsync is backed by the connected Copilot CLI/server, so this
+        // picks up released models without hardcoding them here.
+        var modelList = await _client.ListModelsAsync();
+        if (modelList == null || modelList.Count == 0)
+            return Array.Empty<string>();
+
+        return Models.ModelHelper.BuildSelectionList(
+            modelList
+                .Where(m => !string.IsNullOrEmpty(m.Id))
+                .Select(m => m.Id));
+    }
+
+    private async Task<IReadOnlyList<string>> GetDirectCliAvailableModelsAsync()
+    {
+        var cliPath = ResolveCopilotCliPath(_currentSettings?.CliSource ?? CliSourceMode.BuiltIn);
+        if (string.IsNullOrWhiteSpace(cliPath) || !File.Exists(cliPath))
+            return Array.Empty<string>();
+
+        var tempDir = Path.Combine(Path.GetTempPath(), "polypilot-model-probe");
+        Directory.CreateDirectory(tempDir);
+
+        using var process = new System.Diagnostics.Process();
+        process.StartInfo = new System.Diagnostics.ProcessStartInfo
+        {
+            FileName = cliPath,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            RedirectStandardInput = true,
+            UseShellExecute = false,
+            CreateNoWindow = true,
+            WorkingDirectory = tempDir
+        };
+        process.StartInfo.ArgumentList.Add("-p");
+        process.StartInfo.ArgumentList.Add("Return exactly the list of model IDs shown in the /model Available tab as a JSON array. Use the current CLI runtime model availability. Do not inspect files or use tools. Return only JSON.");
+        process.StartInfo.ArgumentList.Add("--add-dir");
+        process.StartInfo.ArgumentList.Add(tempDir);
+        process.StartInfo.ArgumentList.Add("--no-custom-instructions");
+        process.StartInfo.ArgumentList.Add("--effort");
+        process.StartInfo.ArgumentList.Add("low");
+        process.StartInfo.ArgumentList.Add("--output-format");
+        process.StartInfo.ArgumentList.Add("text");
+        process.StartInfo.ArgumentList.Add("--silent");
+
+        process.Start();
+        process.StandardInput.Close();
+
+        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(45));
+        var outputTask = process.StandardOutput.ReadToEndAsync(cts.Token);
+        var errorTask = process.StandardError.ReadToEndAsync(cts.Token);
+
         try
         {
-            if (_client == null) return;
-            var modelList = await _client.ListModelsAsync();
-            if (modelList != null && modelList.Count > 0)
+            await process.WaitForExitAsync(cts.Token);
+        }
+        catch (OperationCanceledException ex)
+        {
+            TryTerminateProcess(process);
+            throw new TimeoutException("Timed out while probing models from the Copilot CLI.", ex);
+        }
+
+        var output = await outputTask;
+        var error = await errorTask;
+
+        if (process.ExitCode != 0)
+        {
+            var detail = FirstNonEmptyLine(error) ?? FirstNonEmptyLine(output) ?? $"exit code {process.ExitCode}";
+            throw new InvalidOperationException($"Copilot CLI model probe failed: {detail}");
+        }
+
+        var models = ParseDirectCliModelProbeOutput(output);
+        if (models.Count == 0)
+        {
+            var snippet = FirstNonEmptyLine(output) ?? "(no output)";
+            throw new InvalidOperationException($"Copilot CLI model probe returned no parseable models: {snippet}");
+        }
+
+        return models;
+    }
+
+    private async Task RunAvailableModelsFetchLoopAsync()
+    {
+        do
+        {
+            IReadOnlyList<string> sdkModels = Array.Empty<string>();
+            IReadOnlyList<string> directCliModels = Array.Empty<string>();
+
+            try
+            {
+                sdkModels = await GetSdkAvailableModelsAsync();
+            }
+            catch (Exception ex)
             {
-                // Use Id (slug) as the canonical model identifier, not Name (display name).
-                // Name is a display string like "Claude Opus 4.6 (1M Context)(Internal Only)"
-                // which NormalizeToSlug can't reliably round-trip. Id is the SDK slug.
-                var displayNames = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
-                var models = new List<string>();
-                foreach (var m in modelList)
+                Debug($"Failed to fetch models from SDK: {ex.Message}");
+            }
+
+            try
+            {
+                directCliModels = await GetDirectCliAvailableModelsAsync();
+            }
+            catch (Exception ex)
+            {
+                Debug($"Failed to fetch models from direct CLI probe: {ex.Message}");
+            }
+
+            var primaryModels = directCliModels.Count > 0 ? directCliModels : sdkModels;
+            var supplementalModels = directCliModels.Count > 0 ? sdkModels : Array.Empty<string>();
+            if (primaryModels.Count > 0)
+            {
+                var models = Models.ModelHelper.BuildSelectionList(primaryModels, supplementalModels.ToArray()).ToList();
+                if (!_localAvailableModels.SequenceEqual(models, StringComparer.OrdinalIgnoreCase))
                 {
-                    var id = m.Id;
-                    var name = m.Name;
-                    // Prefer Id (slug); fall back to Name if Id is missing
-                    var key = !string.IsNullOrEmpty(id) ? id : name;
-                    if (string.IsNullOrEmpty(key)) continue;
-                    if (!models.Contains(key))
-                        models.Add(key);
-                    if (!string.IsNullOrEmpty(name) && !string.IsNullOrEmpty(id))
-                        displayNames[id] = name;
+                    _localAvailableModels = models;
+                    Debug($"Loaded {models.Count} models from Copilot CLI (sdk={sdkModels.Count}, direct={directCliModels.Count})");
+                    InvokeOnUI(() => OnStateChanged?.Invoke());
                 }
-                models.Sort(StringComparer.OrdinalIgnoreCase);
-                if (models.Count > 0)
+            }
+
+            lock (_availableModelsFetchSync)
+            {
+                if (!_availableModelsFetchQueued)
+                    break;
+
+                _availableModelsFetchQueued = false;
+            }
+        } while (true);
+    }
+
+    internal static IReadOnlyList<string> ParseDirectCliModelProbeOutput(string? output)
+    {
+        if (string.IsNullOrWhiteSpace(output))
+            return Array.Empty<string>();
+
+        foreach (var line in output.Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries))
+        {
+            try
+            {
+                using var doc = JsonDocument.Parse(line);
+                if (doc.RootElement.ValueKind != JsonValueKind.Object)
+                    continue;
+
+                if (doc.RootElement.TryGetProperty("data", out var data) &&
+                    data.ValueKind == JsonValueKind.Object &&
+                    data.TryGetProperty("content", out var content) &&
+                    content.ValueKind == JsonValueKind.String)
                 {
-                    _localAvailableModels = models;
-                    ModelDisplayNames = displayNames;
-                    Debug($"Loaded {models.Count} models from SDK (ids)");
-                    OnStateChanged?.Invoke();
+                    var nested = ParseDirectCliModelProbeOutput(content.GetString());
+                    if (nested.Count > 0)
+                        return nested;
                 }
             }
+            catch (JsonException)
+            {
+                // Fall back to raw array extraction below.
+            }
         }
-        catch (Exception ex)
+
+        foreach (var candidate in GetJsonArrayCandidates(output))
+        {
+            try
+            {
+                using var doc = JsonDocument.Parse(candidate);
+                if (doc.RootElement.ValueKind != JsonValueKind.Array)
+                    continue;
+
+                return Models.ModelHelper.BuildSelectionList(
+                    doc.RootElement
+                        .EnumerateArray()
+                        .Where(e => e.ValueKind == JsonValueKind.String)
+                        .Select(e => e.GetString())
+                        .Where(s => !string.IsNullOrWhiteSpace(s)));
+            }
+            catch (JsonException)
+            {
+                // Keep trying more permissive candidate extraction below.
+            }
+        }
+
+        return Array.Empty<string>();
+    }
+
+    private static IEnumerable<string> GetJsonArrayCandidates(string output)
+    {
+        var trimmed = output.Trim();
+        if (trimmed.Length == 0)
+            yield break;
+
+        yield return trimmed;
+
+        if (trimmed.StartsWith("```", StringComparison.Ordinal))
+        {
+            var firstNewline = trimmed.IndexOf('\n');
+            var lastFence = trimmed.LastIndexOf("```", StringComparison.Ordinal);
+            if (firstNewline >= 0 && lastFence > firstNewline)
+                yield return trimmed[(firstNewline + 1)..lastFence].Trim();
+        }
+
+        var start = trimmed.IndexOf('[');
+        var end = trimmed.LastIndexOf(']');
+        if (start >= 0 && end > start)
+            yield return trimmed[start..(end + 1)];
+    }
+
+    private static string? FirstNonEmptyLine(string? text)
+    {
+        if (string.IsNullOrWhiteSpace(text))
+            return null;
+
+        return text
+            .Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries)
+            .Select(line => line.Trim())
+            .FirstOrDefault(line => line.Length > 0);
+    }
+
+    private static void TryTerminateProcess(System.Diagnostics.Process process)
+    {
+        try
+        {
+            if (!process.HasExited)
+                process.Kill(entireProcessTree: true);
+        }
+        catch
         {
-            Debug($"Failed to fetch models: {ex.Message}");
+            // Best-effort cleanup after a timeout.
         }
     }
 
diff --git a/PolyPilot/Services/CopilotService.cs b/PolyPilot/Services/CopilotService.cs
index 061b753f7f..e4e81c3db3 100644
--- a/PolyPilot/Services/CopilotService.cs
+++ b/PolyPilot/Services/CopilotService.cs
@@ -105,6 +105,10 @@ internal void SetTurnEndGuardForTesting(string sessionName, bool active)
     internal const int WatchdogServerRecoveryThreshold = 2;
     // Prevents concurrent TryRecoverPersistentServerAsync invocations from racing on _client.
     private readonly SemaphoreSlim _recoveryLock = new(1, 1);
+    // Coalesces model refresh requests so reconnect/recovery bursts share one fetch pipeline.
+    private readonly object _availableModelsFetchSync = new();
+    private Task _availableModelsFetchTask = Task.CompletedTask;
+    private bool _availableModelsFetchQueued;
     // Tracks when recovery last succeeded so concurrent callers that lose the lock can return true
     // if recovery just completed (within 30s), rather than showing a false-permanent error.
     private DateTime _lastRecoveryCompletedAt = DateTime.MinValue;
@@ -1272,6 +1276,8 @@ public async Task ReconnectAsync(ConnectionSettings settings, CancellationToken
             return;
         }
 
+        _ = FetchAvailableModelsAsync();
+
         // Restore previous sessions
         LoadOrganization();
         await RestorePreviousSessionsAsync(cancellationToken);
@@ -1363,6 +1369,7 @@ internal async Task<bool> TryRecoverPersistentServerAsync()
             _client = CreateClient(settings);
             await _client.StartAsync(CancellationToken.None);
             IsInitialized = true;
+            _ = FetchAvailableModelsAsync();
 
             Debug("[SERVER-RECOVERY] Server recovery successful — new server started and client reconnected");
             FallbackNotice = "Persistent server was automatically restarted due to repeated failures. Your sessions should work again.";
@@ -1461,6 +1468,7 @@ public async Task RestartServerAsync(CancellationToken cancellationToken = defau
                 await _client.StartAsync(cancellationToken);
                 IsInitialized = true;
                 NeedsConfiguration = false;
+                _ = FetchAvailableModelsAsync();
                 Debug("[SERVER-RESTART] Server restarted and client connected");
             }
             catch (Exception ex)

From 931a17c1d348a2a1490afa429c3ae108ac8681d6 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Thu, 2 Apr 2026 15:37:48 -0500
Subject: [PATCH 2/4] fix: address R1 review findings for PR #474

- Add maxDepth guard (5) to ParseDirectCliModelProbeOutput to prevent
  stack overflow from pathological nested LLM output
- Restore FallbackModels safety net: when discovered models list has
  only 1 entry (just DefaultModel), fall back to the curated list
- Fix CTS timeout race: read stdout/stderr without cancellation token
  so a successful process exit isn't discarded by a late CTS firing
- Add IsValidModelSlug() regex filter to discard hallucinated model IDs
  from LLM probe output (only accepts lowercase alphanumeric with
  hyphens and dots)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot/Components/Layout/SessionSidebar.razor |  4 +++-
 PolyPilot/Components/Pages/Dashboard.razor       |  4 +++-
 PolyPilot/Models/ModelHelper.cs                  | 10 ++++++++++
 PolyPilot/Services/CopilotService.Utilities.cs   | 16 ++++++++++------
 4 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/PolyPilot/Components/Layout/SessionSidebar.razor b/PolyPilot/Components/Layout/SessionSidebar.razor
index 9cdae950aa..8d00218c05 100644
--- a/PolyPilot/Components/Layout/SessionSidebar.razor
+++ b/PolyPilot/Components/Layout/SessionSidebar.razor
@@ -1439,7 +1439,9 @@ else
     }
 
     private IReadOnlyList<string> availableModels =>
-        ModelHelper.BuildSelectionList(CopilotService.AvailableModels, selectedModel, CopilotService.DefaultModel);
+        ModelHelper.BuildSelectionList(CopilotService.AvailableModels, selectedModel, CopilotService.DefaultModel)
+            is { Count: > 1 } list ? list
+            : ModelHelper.BuildSelectionList(ModelHelper.FallbackModels, selectedModel, CopilotService.DefaultModel);
 
     private IEnumerable<PersistedSessionInfo> filteredPersistedSessions => 
         (string.IsNullOrWhiteSpace(sessionFilter) 
diff --git a/PolyPilot/Components/Pages/Dashboard.razor b/PolyPilot/Components/Pages/Dashboard.razor
index af1f5f6024..bebb90c2df 100644
--- a/PolyPilot/Components/Pages/Dashboard.razor
+++ b/PolyPilot/Components/Pages/Dashboard.razor
@@ -3353,7 +3353,9 @@
     // === Model, plan mode, font, token helpers ===
 
     private IReadOnlyList<string> availableModels =>
-        ModelHelper.BuildSelectionList(CopilotService.AvailableModels, CopilotService.DefaultModel);
+        ModelHelper.BuildSelectionList(CopilotService.AvailableModels, CopilotService.DefaultModel)
+            is { Count: > 1 } list ? list
+            : ModelHelper.BuildSelectionList(ModelHelper.FallbackModels, CopilotService.DefaultModel);
 
     private string GetSessionModel(AgentSessionInfo session)
     {
diff --git a/PolyPilot/Models/ModelHelper.cs b/PolyPilot/Models/ModelHelper.cs
index 6f6f479745..6c643093e7 100644
--- a/PolyPilot/Models/ModelHelper.cs
+++ b/PolyPilot/Models/ModelHelper.cs
@@ -1,4 +1,5 @@
 using System.Text.Json;
+using System.Text.RegularExpressions;
 
 namespace PolyPilot.Models;
 
@@ -10,6 +11,15 @@ namespace PolyPilot.Models;
 /// </summary>
 public static class ModelHelper
 {
+    private static readonly Regex ValidSlugPattern = new(@"^[a-z0-9][-a-z0-9.]*$", RegexOptions.Compiled);
+
+    /// <summary>
+    /// Returns true if the string looks like a valid model slug
+    /// (lowercase alphanumeric with hyphens and dots, e.g. "claude-opus-4.6").
+    /// </summary>
+    public static bool IsValidModelSlug(string? slug) =>
+        !string.IsNullOrEmpty(slug) && ValidSlugPattern.IsMatch(slug);
+
     public static IReadOnlyList<string> FallbackModels { get; } = new[]
     {
         "claude-opus-4.6",
diff --git a/PolyPilot/Services/CopilotService.Utilities.cs b/PolyPilot/Services/CopilotService.Utilities.cs
index 5d4f060b7d..74c84f06fa 100644
--- a/PolyPilot/Services/CopilotService.Utilities.cs
+++ b/PolyPilot/Services/CopilotService.Utilities.cs
@@ -862,8 +862,11 @@ private async Task<IReadOnlyList<string>> GetDirectCliAvailableModelsAsync()
         process.StandardInput.Close();
 
         using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(45));
-        var outputTask = process.StandardOutput.ReadToEndAsync(cts.Token);
-        var errorTask = process.StandardError.ReadToEndAsync(cts.Token);
+        // Start reading streams without CTS — they'll complete when the process exits
+        // or is killed. Using CTS here causes a race: if the token fires between
+        // WaitForExitAsync returning and the await below, a successful result is lost.
+        var outputTask = process.StandardOutput.ReadToEndAsync();
+        var errorTask = process.StandardError.ReadToEndAsync();
 
         try
         {
@@ -942,9 +945,9 @@ private async Task RunAvailableModelsFetchLoopAsync()
         } while (true);
     }
 
-    internal static IReadOnlyList<string> ParseDirectCliModelProbeOutput(string? output)
+    internal static IReadOnlyList<string> ParseDirectCliModelProbeOutput(string? output, int maxDepth = 5)
     {
-        if (string.IsNullOrWhiteSpace(output))
+        if (string.IsNullOrWhiteSpace(output) || maxDepth <= 0)
             return Array.Empty<string>();
 
         foreach (var line in output.Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries))
@@ -960,7 +963,7 @@ internal static IReadOnlyList<string> ParseDirectCliModelProbeOutput(string? out
                     data.TryGetProperty("content", out var content) &&
                     content.ValueKind == JsonValueKind.String)
                 {
-                    var nested = ParseDirectCliModelProbeOutput(content.GetString());
+                    var nested = ParseDirectCliModelProbeOutput(content.GetString(), maxDepth - 1);
                     if (nested.Count > 0)
                         return nested;
                 }
@@ -984,7 +987,8 @@ internal static IReadOnlyList<string> ParseDirectCliModelProbeOutput(string? out
                         .EnumerateArray()
                         .Where(e => e.ValueKind == JsonValueKind.String)
                         .Select(e => e.GetString())
-                        .Where(s => !string.IsNullOrWhiteSpace(s)));
+                        .Where(s => !string.IsNullOrWhiteSpace(s))
+                        .Where(s => Models.ModelHelper.IsValidModelSlug(Models.ModelHelper.NormalizeToSlug(s))));
             }
             catch (JsonException)
             {

From f68b8bed50330e9441f34e21aa25a28c0a05dc5e Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Thu, 2 Apr 2026 16:05:35 -0500
Subject: [PATCH 3/4] fix: use AvailableModels.Count > 0 for fallback instead
 of Count > 1 heuristic

The Count > 1 check incorrectly bypassed FallbackModels when
selectedModel != DefaultModel (producing a 2-item list from
required models alone). Also adds fallback guard to
SessionListItem.GetSelectableModels() which had none.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot/Components/Layout/SessionListItem.razor | 4 +++-
 PolyPilot/Components/Layout/SessionSidebar.razor  | 4 ++--
 PolyPilot/Components/Pages/Dashboard.razor        | 4 ++--
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/PolyPilot/Components/Layout/SessionListItem.razor b/PolyPilot/Components/Layout/SessionListItem.razor
index 79df0e8cad..fc0eb52efa 100644
--- a/PolyPilot/Components/Layout/SessionListItem.razor
+++ b/PolyPilot/Components/Layout/SessionListItem.razor
@@ -406,7 +406,9 @@
     }
 
     private IReadOnlyList<string> GetSelectableModels() =>
-        ModelHelper.BuildSelectionList(CopilotService.AvailableModels, Meta?.PreferredModel, Session.Model, CopilotService.DefaultModel);
+        CopilotService.AvailableModels.Count > 0
+            ? ModelHelper.BuildSelectionList(CopilotService.AvailableModels, Meta?.PreferredModel, Session.Model, CopilotService.DefaultModel)
+            : ModelHelper.BuildSelectionList(ModelHelper.FallbackModels, Meta?.PreferredModel, Session.Model, CopilotService.DefaultModel);
 
     private static string GetShortPath(string path)
     {
diff --git a/PolyPilot/Components/Layout/SessionSidebar.razor b/PolyPilot/Components/Layout/SessionSidebar.razor
index 8d00218c05..b988fbd030 100644
--- a/PolyPilot/Components/Layout/SessionSidebar.razor
+++ b/PolyPilot/Components/Layout/SessionSidebar.razor
@@ -1439,8 +1439,8 @@ else
     }
 
     private IReadOnlyList<string> availableModels =>
-        ModelHelper.BuildSelectionList(CopilotService.AvailableModels, selectedModel, CopilotService.DefaultModel)
-            is { Count: > 1 } list ? list
+        CopilotService.AvailableModels.Count > 0
+            ? ModelHelper.BuildSelectionList(CopilotService.AvailableModels, selectedModel, CopilotService.DefaultModel)
             : ModelHelper.BuildSelectionList(ModelHelper.FallbackModels, selectedModel, CopilotService.DefaultModel);
 
     private IEnumerable<PersistedSessionInfo> filteredPersistedSessions => 
diff --git a/PolyPilot/Components/Pages/Dashboard.razor b/PolyPilot/Components/Pages/Dashboard.razor
index bebb90c2df..c97a41e12e 100644
--- a/PolyPilot/Components/Pages/Dashboard.razor
+++ b/PolyPilot/Components/Pages/Dashboard.razor
@@ -3353,8 +3353,8 @@
     // === Model, plan mode, font, token helpers ===
 
     private IReadOnlyList<string> availableModels =>
-        ModelHelper.BuildSelectionList(CopilotService.AvailableModels, CopilotService.DefaultModel)
-            is { Count: > 1 } list ? list
+        CopilotService.AvailableModels.Count > 0
+            ? ModelHelper.BuildSelectionList(CopilotService.AvailableModels, CopilotService.DefaultModel)
             : ModelHelper.BuildSelectionList(ModelHelper.FallbackModels, CopilotService.DefaultModel);
 
     private string GetSessionModel(AgentSessionInfo session)

From dd2f704f6ba6ebec42e8ced4eafd361b18227498 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Thu, 2 Apr 2026 16:43:56 -0500
Subject: [PATCH 4/4] Preserve selected model during usage updates

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot.Tests/ModelSelectionTests.cs      | 20 ++++++++++++++++++
 PolyPilot/Models/ModelHelper.cs             | 17 +++++++++++++++
 PolyPilot/Services/CopilotService.Events.cs | 23 ++++++++++++++++++---
 3 files changed, 57 insertions(+), 3 deletions(-)

diff --git a/PolyPilot.Tests/ModelSelectionTests.cs b/PolyPilot.Tests/ModelSelectionTests.cs
index 84f8bbe8fc..337e3ccfd1 100644
--- a/PolyPilot.Tests/ModelSelectionTests.cs
+++ b/PolyPilot.Tests/ModelSelectionTests.cs
@@ -135,6 +135,26 @@ public void BuildSelectionList_NormalizesDiscoveredModels_AndAvoidsDuplicates()
         Assert.Equal(new[] { "claude-opus-4.6", "custom-preview" }, models);
     }
 
+    [Fact]
+    public void ShouldAcceptObservedModel_EmptyCurrentModel_AcceptsObserved()
+    {
+        Assert.True(ModelHelper.ShouldAcceptObservedModel("", "claude-opus-4.6"));
+        Assert.True(ModelHelper.ShouldAcceptObservedModel("resumed", "claude-opus-4.6"));
+    }
+
+    [Fact]
+    public void ShouldAcceptObservedModel_SameModel_AcceptsObserved()
+    {
+        Assert.True(ModelHelper.ShouldAcceptObservedModel("Claude Opus 4.6", "claude-opus-4.6"));
+    }
+
+    [Fact]
+    public void ShouldAcceptObservedModel_DifferentObservedModel_PreservesExplicitChoice()
+    {
+        Assert.False(ModelHelper.ShouldAcceptObservedModel("gpt-5.4", "claude-opus-4.6"));
+        Assert.False(ModelHelper.ShouldAcceptObservedModel("claude-haiku-4.5", "claude-opus-4.6"));
+    }
+
     [Fact]
     public void NormalizeToSlug_DisplayNamesFromCliEvents_MatchSlugs()
     {
diff --git a/PolyPilot/Models/ModelHelper.cs b/PolyPilot/Models/ModelHelper.cs
index 6c643093e7..498ebc97c8 100644
--- a/PolyPilot/Models/ModelHelper.cs
+++ b/PolyPilot/Models/ModelHelper.cs
@@ -129,6 +129,23 @@ public static bool IsDisplayName(string? model)
         return model.Any(char.IsUpper) || model.Contains(' ');
     }
 
+    /// <summary>
+    /// Decide whether an observed SDK/CLI event model should replace the current session model.
+    /// Preserve an explicit user-selected model when metrics events report a different backend
+    /// model (for example after resume/abort flows that transiently report a default model).
+    /// </summary>
+    public static bool ShouldAcceptObservedModel(string? currentModel, string? observedModel)
+    {
+        var normalizedObserved = NormalizeToSlug(observedModel);
+        if (string.IsNullOrEmpty(normalizedObserved))
+            return false;
+
+        var normalizedCurrent = NormalizeToSlug(currentModel);
+        return string.IsNullOrEmpty(normalizedCurrent) ||
+               normalizedCurrent == "resumed" ||
+               normalizedCurrent == normalizedObserved;
+    }
+
     /// <summary>
     /// Converts a model slug to a human-friendly display name.
     /// If displayNames dictionary is provided and contains the slug, uses the SDK's display name.
diff --git a/PolyPilot/Services/CopilotService.Events.cs b/PolyPilot/Services/CopilotService.Events.cs
index 118a575fcc..925a83c59e 100644
--- a/PolyPilot/Services/CopilotService.Events.cs
+++ b/PolyPilot/Services/CopilotService.Events.cs
@@ -772,8 +772,15 @@ await notifService.SendNotificationAsync(
                 if (!string.IsNullOrEmpty(uModel))
                 {
                     var normalizedUModel = Models.ModelHelper.NormalizeToSlug(uModel);
-                    Debug($"[UsageInfo] Updating model from event: {state.Info.Model} -> {normalizedUModel}");
-                    state.Info.Model = normalizedUModel;
+                    if (Models.ModelHelper.ShouldAcceptObservedModel(state.Info.Model, normalizedUModel))
+                    {
+                        Debug($"[UsageInfo] Updating model from event: {state.Info.Model} -> {normalizedUModel}");
+                        state.Info.Model = normalizedUModel;
+                    }
+                    else
+                    {
+                        Debug($"[UsageInfo] Ignoring backend-reported model: {normalizedUModel} (keeping explicit session model: {state.Info.Model})");
+                    }
                 }
                 if (uCurrentTokens.HasValue) state.Info.ContextCurrentTokens = uCurrentTokens;
                 if (uTokenLimit.HasValue) state.Info.ContextTokenLimit = uTokenLimit;
@@ -807,7 +814,17 @@ await notifService.SendNotificationAsync(
                 }
                 catch { }
                 if (!string.IsNullOrEmpty(aModel))
-                    state.Info.Model = Models.ModelHelper.NormalizeToSlug(aModel);
+                {
+                    var normalizedAModel = Models.ModelHelper.NormalizeToSlug(aModel);
+                    if (Models.ModelHelper.ShouldAcceptObservedModel(state.Info.Model, normalizedAModel))
+                    {
+                        state.Info.Model = normalizedAModel;
+                    }
+                    else
+                    {
+                        Debug($"[AssistantUsage] Ignoring backend-reported model: {normalizedAModel} (keeping explicit session model: {state.Info.Model})");
+                    }
+                }
                 if (aInput.HasValue) state.Info.TotalInputTokens += aInput.Value;
                 if (aOutput.HasValue) state.Info.TotalOutputTokens += aOutput.Value;
                 if (aInput.HasValue || aOutput.HasValue || aPremiumQuota != null)