fix: use configured subagent roster for encrypted fallback

[x3M3x]

Summary

• Use the configured subagentModels roster when encrypted V2 sub-agent tasks require native-only fallback.
• Keep the fallback disabled when no sub-agent roster is configured, avoiding implicit native credential use.

Verification

• bun run typecheck
• git diff --check
• Focused Bun test attempted, but the Windows test process did not complete in this environment; no assertion failures were reported.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes

  • Improved fallback handling for encrypted subagent requests when a configured model roster is available.
  • Requests now use the first configured fallback model when no explicit fallback chain is set.
  • Requests remain unchanged when no fallback models are configured.

• Tests

  • Added coverage for configured and unconfigured native-only fallback scenarios.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 27674ed9-260d-4574-9e42-80e9d076a2b9

📥 Commits

Reviewing files that changed from the base of the PR and between 7d25f99 and 57bbaec.

📒 Files selected for processing (2)

• src/codex/subagent-model-fallback.ts
• tests/subagent-model-fallback.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Native-only subagent fallback now derives a chain from the primary model and configured subagentModels when no resolved chain exists. Tests cover rewriting to the first roster entry and preserving the original model when no roster is configured.

Changes

Native subagent fallback

Layer / File(s)	Summary
Fallback synthesis and validation src/codex/subagent-model-fallback.ts, tests/subagent-model-fallback.test.ts	When native-only fallback is enabled and no resolved chain exists, the implementation derives a normalized chain from parsed.modelId and subagentModels. Tests verify rewriting to gpt-5.6-sol and returning null without changing the model when no roster is configured.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to 57bba

The change routes encrypted fallback through the configured subagent roster and disables fallback when no roster is configured. The focused test did not complete and the required readiness checks remain incomplete, so the PR is not merge-ready until verification and readiness gates are completed or explicitly accepted.

Suggested reviewers: wibias

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: encrypted fallback now uses the configured subagent roster.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[x3M3x]

Consolidated into PR #3252, which now contains the runtime encrypted-fallback fix, dashboard switch, API persistence, tests, and docs.