From c639f438918c902f9734504a926a7237473aa41b Mon Sep 17 00:00:00 2001
From: Anais Saraiva <anais.saraiva@ihorizon.org>
Date: Mon, 21 Sep 2026 22:28:31 +0200
Subject: [PATCH] Update index.ts

---
 src/index.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/index.ts b/src/index.ts
index 1511d6b..bd145f5 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1270,7 +1270,9 @@ const server = Bun.serve<{ ticketId: string | null; isAdmin: boolean }>({
         const wantRefresh = /^(1|true|yes)$/i.test(
           url.searchParams.get("refresh") ?? url.searchParams.get("force") ?? "",
         );
-        const models = await registry.listAllModelsCached(wantRefresh && admin);
+        // Copy: the cached array is shared across users and must never be
+        // mutated by the per-user merge below.
+        const models = [...(await registry.listAllModelsCached(wantRefresh && admin))];
         // Personal providers (BYOK): merge the caller's own-key models.
         // Same ids as the global drivers, so already-listed ones are skipped
         // and the model picker groups them with their driver.