Best possible solution:

Use #83697 as the canonical fix for #83574 and close this duplicate replacement PR to avoid two automerge branches racing.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level. Current main still calls the picker auth-label resolver without the effective OpenAI/Codex accepted-provider set, and both open PRs target that same path.

Is this the best way to solve the issue?

No, this is no longer the best branch to carry the fix. The maintainable path is to land or close the newer canonical PR that directly references the original issue and already has proof/automerge context.

Security review:

Security review cleared: The diff is limited to auth-label display plumbing, tests, and changelog text; I found no concrete security or supply-chain regression.

What I checked:

• Canonical open PR now tracks the same fix: Live PR metadata for fix(models): label picker auth via effective provider order #83697 shows it is open, uses Fixes for [Bug]: /model picker auth label ignores auth.order resolution #83574, changes the same shared /models provider-label path, includes real formatter proof, and later received an automerge request. (src/auto-reply/reply/commands-models.ts:388, 58153c5178d0)
• Original issue closing reference points at the canonical PR: The original bug report remains open, and GitHub's closing pull request reference for it is fix(models): label picker auth via effective provider order #83697, not this replacement branch.
• This branch duplicates the same central surface: The live diff for this PR updates the same resolveProviderLabel / formatModelsAvailableHeader path and adjacent command tests, plus changelog text, so keeping it open would leave two competing branches for the same auth-label bug. (src/auto-reply/reply/commands-models.ts:388, c6d9e2970eca)
• Current main still has the unfixed shared-label call path: On current main, resolveProviderLabel calls resolveModelAuthLabel without acceptedProviderIds, confirming the remaining source-level work belongs to the canonical fix PR rather than already being implemented on main. (src/auto-reply/reply/commands-models.ts:394, 06a39015f21c)
• OpenAI/Codex auth-order provenance: Merged PR metadata shows prior OpenAI PI auth-order work added and validated the OpenAI/Codex routing and auth-label contract this fix builds on. (src/agents/openai-codex-routing.ts:125, 8267492f27d9)

Likely related people:

• steipete: Merged PR metadata shows this account authored the OpenAI PI auth-order work touching model-auth-label, openai-codex-routing, status labeling, and related tests that this picker-label fix reuses. (role: current implementation introducer and recent area contributor; confidence: high; commits: 8267492f27d9, a2b614a30b75; files: src/agents/model-auth-label.ts, src/agents/openai-codex-routing.ts, src/status/status-text.ts)
• Tak Hoffman: Git history shows recent model-picker/provider endpoint fixes by this person, and the live related threads show this account requested automerge for the replacement/canonical fix path. (role: recent model-picker contributor and automerge requester; confidence: medium; commits: ae2b1aef10c4, 67fba9c5e173; files: src/auto-reply/reply/commands-models.ts)
• Vincent Koc: Local history shows recent Telegram callback and model-picker maintenance in the affected visible channel area, useful if maintainers want a Telegram-specific follow-up review. (role: recent Telegram/model-picker adjacent contributor; confidence: medium; commits: a7ac3c666c4e, 88111453cb76, 438991b6a430; files: extensions/telegram/src/bot-handlers.runtime.ts, src/auto-reply/reply/commands-models.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 06a39015f21c.