On a fresh open of LevelCode, a paid plan's model picker showed only TWO models
(the free engine + the flagship) instead of the full roster — no Opus 4.8, no
Kimi K3, and none of the "×credits · ctx · turns left" detail or "coming soon"
rows. That is the OFFLINE fallback branch of pickCloudModel, reached whenever
fetchCloudRoster returns no models.

Cause: fetchCloudRoster returned null on ANY non-OK response and, unlike the
profile fetch (webHandoffUrl) and the agent loop, did NOT refresh the token on a
401. Access tokens are short-lived, so the FIRST roster request after a fresh
open is made with last session's expired token → 401 → null → 2-model fallback.
The account WEB page looked correct because it authenticates differently and
refreshes.

Fix, mirroring the proven webHandoffUrl retry:
- On 401, refreshCloudToken() once and retry with the fresh token.
- Gate on the stored TOKEN, not the cloudSignedIn flag — the flag can still be
  false mid-activation while a valid token exists, which was a second path to the
  same degraded menu.
- On a genuinely transient failure, return the last-known-good roster
  (cloudRoster) instead of collapsing to the 2-model fallback; the menu just omits
  the credits/turns detail it can't recompute offline.

Not unit-tested — this is vscode-requiring host glue with no pure seam to extract;
it is verified by reading and by matching webHandoffUrl's battle-tested pattern
(now the second of two 401-refresh call sites). I could not reproduce the live
401 without a running, signed-in editor, so this fixes the identified code path
rather than an observed repro. Full gate: 24 suites, 0 failures.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…review)

1. The comment claimed "credits/turns aren't cached", but cloudRoster = data.models
   caches the per-model fields including turns_left, so the cached-roster fallback
   CAN show a slightly stale "≈ turns left". Only the account-level credit BALANCE
   is genuinely not carried (the "$X credits left" header is omitted until the next
   good fetch). Comment now says exactly that.

2. After refreshCloudToken() succeeds, the refreshed secret was used unchecked —
   if it came back falsy the retry would send `Authorization: Bearer null`, noise
   that masks the real 401. Now the retry only fires when the refreshed token is
   truthy; otherwise it falls through to the cached-roster path.

Comment-and-guard only, no behaviour change on the happy path. Full gate: 24
suites, 0 failures.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…array (PR #43 review)

The retry returned `data || cached()`, so any truthy JSON that lacked a valid
`models` array — a 200 with an error object, a partial response, a schema drift —
was returned as-is. pickCloudModel then sees "no models" and collapses to the
2-model fallback even though cloudRoster still holds a good list, defeating the
whole point of the cache.

Now a payload only counts as a roster when data.models is an array; otherwise it
returns cached(). Also fixes the mirror case where a 200 arrives but json() failed
(data null) — same fall-through to the cache.

Full gate: 24 suites, 0 failures.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>