fix(models): [#1052 D14 review-fix M3] don't crash on non-JSON error body + fire refresh at boot

Two consensus-review findings on the D14 commit (`248eaaf86c`):

1. Pre-existing crash: `ModelsDev.Data()`'s `Flock.withLock` branch calls
   `JSON.parse(result2.text)` unconditionally after `fetchApi()` returns —
   even when `result2.ok === false` and the body is an HTML 5xx error page.
   That throws `SyntaxError` and blocks model initialization. Bug existed
   before D14 but was rarely exposed because the eager import-time refresh()
   warmed the disk cache first, so most subsequent `Data()` calls returned via
   `readJson`. Post-D14 more first-calls fall through to fetch, so the crash
   window widens. Fix: return `{}` when `!result2.ok` — callers already tolerate
   an empty catalog (Provider.state produces no models.dev-derived entries,
   same UX as `OPENCODE_DISABLE_MODELS_FETCH=1`).

2. Reintroduce a boot-time refresh without holding the event loop: 4/6
   reviewers flagged the loss of "fresh at boot" as a real regression for
   short-lived commands. Fix: `Promise.resolve().then(() => refresh().catch())`.
   A microtask can't itself keep Bun alive, and if the fetch it schedules is
   still in flight at process-exit the snapshot covers callers on the next
   run. Preserves the load-bearing part of the D14 fix (no `setTimeout` keeping
   the loop alive) while restoring near-immediate cache warming. If this ever
   reintroduces the unshare-net sanity hang on CI, drop the Promise.then line —
   the snapshot alone keeps release binaries functional offline.

Also fixes the misleading comment "always have model metadata even on a
cold-start with no network" — accurate for release binaries but false in
dev-mode where the snapshot isn't embedded. Reworded to say so.

Verified: typecheck clean; `--version` exits in ~1s cleanly; existing D12
phase-label test still passes.

Author: sahrizvi

packages/opencode/src/provider/models.ts

@@ -121,11 +121,18 @@ export namespace ModelsDev {
       const result = await Filesystem.readJson(Flag.OPENCODE_MODELS_PATH ?? filepath).catch(() => {})
       if (result) return result
       const result2 = await fetchApi()
-      if (result2.ok) {
-        await Filesystem.write(filepath, result2.text).catch((e) => {
-          log.error("Failed to write models cache", { error: e })
-        })
-      }
+      // altimate_change — #1052 D14 review-fix (M3): fetchApi returning a non-2xx
+      // (e.g. 5xx with an HTML error body) previously fell through to
+      // `JSON.parse(<HTML>)` and crashed with SyntaxError. Return an empty
+      // catalog instead — callers already tolerate empty results (Provider.state
+      // just yields no models.dev-derived providers, which is the same UX as
+      // running with OPENCODE_DISABLE_MODELS_FETCH=1). Pre-D14 this rarely
+      // fired because the eager refresh usually warmed the disk cache; post-D14
+      // more first-calls fall through to fetch, so more chances to hit the crash.
+      if (!result2.ok) return {}
+      await Filesystem.write(filepath, result2.text).catch((e) => {
+        log.error("Failed to write models cache", { error: e })
+      })
       return JSON.parse(result2.text)
     })
   })
@@ -164,19 +171,24 @@ if (!Flag.OPENCODE_DISABLE_MODELS_FETCH && !process.argv.includes("--get-yargs-c
   //
   // Callers that need model data use `ModelsDev.Data()`, which resolves in this
   // priority order: (1) local disk cache, (2) bundled snapshot at
-  // `models-snapshot.ts` (always embedded in release binaries, regenerated at
-  // each build), (3) `Flock.withLock(...) → fetchApi()` only when both are
-  // absent. The bundled snapshot means release-binary users always have model
-  // metadata even on a cold-start with no network. Long-running processes
-  // (TUI, serve) still receive updates via the hourly `setInterval` below
-  // (`.unref()`'d so it never blocks exit). Short-lived commands rely on the
-  // snapshot's release-time freshness.
+  // `models-snapshot.ts` (embedded in release binaries — regenerated at each
+  // build; dev-mode builds without the snapshot fall through to fetch), (3)
+  // `Flock.withLock(...) → fetchApi()` only when both are absent. Release
+  // binaries therefore have release-time model metadata even on a cold-start
+  // with no network. Long-running processes (TUI, serve) still receive updates
+  // via the hourly `setInterval` below (`.unref()`'d so it never blocks exit).
+  //
+  // Trade-off: without an eager fetch, models added to models.dev between
+  // releases would not appear until the hourly interval below fires. The
+  // fire-and-forget refresh() below narrows that window without holding the
+  // event loop — a microtask can't itself keep Bun alive, and if the fetch it
+  // schedules is still in flight at process-exit, the snapshot covers callers
+  // on the next run. The load-bearing part of the D14 fix (removing the
+  // setTimeout(...,0)-wrapped fetch that kept the loop alive) is preserved.
   //
-  // Trade-off: models added to models.dev between releases do not appear in
-  // short-lived commands until the next release rebuild. Bounded by the release
-  // cadence (~weekly). Users needing bleeding-edge model metadata can run
-  // `altimate-code auth login` or open the TUI, both of which trigger the
-  // hourly interval on start-up rebase.
+  // If this reintroduces the unshare-net hang on CI, drop the Promise.then
+  // line — the snapshot alone still keeps release binaries functional offline.
+  Promise.resolve().then(() => ModelsDev.refresh().catch(() => {}))
   setInterval(async () => {
     await ModelsDev.refresh()
   }, 60 * 60 * 1000).unref()