fix(models): enforce plural allowlist contract on failed live probes

api/routes.py

@@ -22042,7 +22042,7 @@ def _handle_live_models(handler, parsed):
                             if _aid not in ids:
                                 ids.append(_aid)
                 else:
-                    ids = list(_config_ids)
+                    ids = list(_allowlist_ids or _config_ids)
 
         # ── OpenAI-compat live fetch fallback ──────────────────────────────────
         # When provider_model_ids() is unavailable or returns [] for a provider

tests/test_byok_model_dropdown.py

@@ -308,7 +308,7 @@ class TestLiveModelsCustomProviderFallback:
         resp = self._call_live_models(monkeypatch, cfg, "custom:rightcode-codex")
 
         assert resp["provider"] == "custom:rightcode-codex"
-        assert [m["id"] for m in resp["models"]] == ["gpt-5.5", "gpt-5.5-mini"]
+        assert [m["id"] for m in resp["models"]] == ["gpt-5.5-mini"]
 
     def test_bare_custom_fallback_ignores_named_custom_provider_models(self, monkeypatch):
         """Bare custom only represents unnamed custom entries, not named siblings."""

tests/test_issue3718_live_models_custom_probe.py

@@ -182,16 +182,38 @@ def test_allowlisted_model_missing_from_live_is_appended(monkeypatch):
     assert _ids(payload) == ["chat-a", "chat-offline"]
 
 
-def test_probe_failure_falls_back_to_config_ids(monkeypatch):
+def test_contradictory_singular_model_outside_plural_allowlist_is_ignored(monkeypatch):
-    """When the live probe fails, config ids (incl. singular model) are used."""
+    """A singular default outside the plural allowlist must not leak into the picker.
+
+    Paired test: whether the live probe succeeds or fails, only the explicit
+    plural allowlist is exposed.
+    """
     import api.routes as routes
 
     provider = dict(_BASE_PROVIDER, model="chat-default", models=["chat-a"])
+
+    # 1. Successful live fetch -> only plural allowlist
+    payload_success, _ = _run_live_models(
+        monkeypatch, routes, provider, catalog=_LIVE_CATALOG, fail=False
+    )
+    assert _ids(payload_success) == ["chat-a"]
+
+    # 2. Failed live fetch -> still only plural allowlist (not chat-default)
+    payload_fail, _ = _run_live_models(
+        monkeypatch, routes, provider, catalog=_LIVE_CATALOG, fail=True
+    )
+    assert _ids(payload_fail) == ["chat-a"]
+
+
+def test_probe_failure_without_allowlist_falls_back_to_singular_model(monkeypatch):
+    """When no plural allowlist is configured and probe fails, singular model is used."""
+    import api.routes as routes
+
+    provider = dict(_BASE_PROVIDER, model="chat-default")
     payload, _ = _run_live_models(
         monkeypatch, routes, provider, catalog=_LIVE_CATALOG, fail=True
     )
-
+    assert _ids(payload) == ["chat-default"]
-    assert _ids(payload) == ["chat-default", "chat-a"]
 
 
 @pytest.mark.parametrize(