From 03ff03ed5250c3a12d3986616610569e498e79b2 Mon Sep 17 00:00:00 2001
From: Chris Staley <christopher-s@users.noreply.github.com>
Date: Thu, 2 Apr 2026 15:18:36 -0600
Subject: [PATCH] fix(gemini): filter out locked models during credential
 selection

isModelLocked() was called to lock models on 429 but never checked
when selecting connections. Requests to a locked model would still
route to it, causing unnecessary repeated 429s.
---
 src/sse/services/auth.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/sse/services/auth.ts b/src/sse/services/auth.ts
index 4347c988aa..16ea4ed839 100644
--- a/src/sse/services/auth.ts
+++ b/src/sse/services/auth.ts
@@ -408,6 +408,8 @@ export async function getProviderCredentials(
         if (isAccountUnavailable(c.rateLimitedUntil)) return false;
         if (isTerminalConnectionStatus(c)) return false;
         if (provider === "codex" && isCodexScopeUnavailable(c, requestedModel)) return false;
+        // Per-model lockout: if this specific model is locked on this connection, skip it
+        if (requestedModel && isModelLocked(provider, c.id, requestedModel)) return false;
       }
       return true;
     });