fix(server): refresh model catalog without CLI update checks

[macodev00]

Fixes #13244

What Changed

enableProviderUpdateChecks no longer gates the remote model-manifest fetch. ModelManifest.refresh and forceRefresh still update the catalog when Settings → General → Provider update checks is off. CLI version lookups stay behind that switch.

Why

The setting is described as checking installed provider CLI versions, but the same flag returned before ModelManifest fetched model-manifest.json. New models that exist only on the remote catalog stayed out of the picker until the switch was turned back on, including an explicit Refresh provider status.

Verification

From apps/server on Node 24.13.1:

vp test run src/provider/ModelManifest.test.ts

Result: 1 file passed, 16 tests passed (1.01s). This includes fetches the remote manifest when provider update checks are disabled, which covers both the TTL refresh and explicit forceRefresh.

vp test run src/provider/providerMaintenance.test.ts -t "does not fetch latest provider versions when update checks are disabled"

Result: 1 passed, 27 skipped. CLI version lookups stay gated by the setting.

UI Changes

None. This is a server-only change.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (none: server-only)
• I included a video for animation/interaction changes (none)

[macroscopeapp]

Approvability

Verdict: Approved at 68e6009

Macroscope's review found this PR approvable — This is a small, isolated server bug fix that separates model-catalog metadata refreshes from provider CLI version checks, with targeted coverage for both refresh modes. Existing enabled behavior and CLI-check gating remain unchanged.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: pingdotgg/t3code/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: a65b0c5d-1260-4fe7-8c63-73cc4438196f

📥 Commits

Reviewing files that changed from the base of the PR and between 921cb3c and 68e6009.

📒 Files selected for processing (2)

• apps/server/src/provider/ModelManifest.test.ts
• apps/server/src/provider/ModelManifest.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Model manifest refresh no longer skips remote fetches when provider update checks are disabled. Tests verify that refresh and forceRefresh each fetch and return the remote manifest.

Changes

Model manifest refresh

Layer / File(s)	Summary
Refresh behavior and verification apps/server/src/provider/ModelManifest.ts, apps/server/src/provider/ModelManifest.test.ts	ModelManifest.make no longer reads provider update settings or skips the remote fetch based on that setting. Tests expect refresh and forceRefresh to return the remote manifest, with one request per call.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 68e60

Remote model catalogs can refresh while CLI update checks are disabled, without removing the existing refresh safeguards. No actionable merge-blocking risk is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 68e60

Disabling provider version checks will no longer suppress catalog downloads. The existing destination, validation, refresh limits, and failure fallback remain. No new inbound access path or privilege expansion was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The added exposure is outbound contact and remote catalog influence on servers with provider update checks disabled. Accepted data affects the server's shared provider catalog and persists in its state directory. Compromise of the common catalog source could influence fetching installations, including those newly eligible under this change.

Trust Boundaries and Controls

• observed — The fetch constructs a GET to a constant URL without a caller-controlled destination or request body. Responses must pass HTTP-status, JSON, schema, and freshness checks before publication. These controls remain in place for newly eligible refreshes.

Resilience and Maintainability Implications

• observed — Timeouts, failed validation, and older remote edits preserve the current catalog. Cache-write failures are ignored after in-memory publication, and invalid disk data falls back to bundled data. These failure-containment mechanisms predate the gate removal; the inspected evidence does not establish cross-process serialization or interrupted-write atomicity.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary change: allowing model-catalog refreshes when CLI update checks are disabled.
Description check	✅ Passed	The description explains the problem, change, rationale, linked issue, verification commands and results, and server-only scope. It uses different headings from the template and does not state explici…
Linked Issues check	✅ Passed	Issue #13244 requires model-catalog refreshes to remain independent from the CLI version-check setting. ModelManifest.ts removes the setting gate, so TTL refresh and forceRefresh continue to fetch…
Out of Scope Changes check	✅ Passed	The pull request changes only apps/server model-manifest logic and its automated test. These changes directly implement issue #13244 and preserve the separate CLI version-check behavior. No unrelate…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[juliusmarminge]

Note

This comment is posted by Julius' dot

Closing for missing approval of this behavior change. At 68e6009, this removes the setting's deliberate model-manifest network gate entirely. The maintainer triage on #13244 identifies misleading settings copy and proposes either clarifying that coupling or adding a separate control; it does not approve unconditional catalog fetching while the existing switch is off.

The prior-approval rule requires agreement on this product direction. The hidden-model/discoverability problem and focused tests are useful. Please obtain explicit approval for the network-control behavior, then align the change with that decision and request reconsideration.