fix(codex): scope provider models and suppress false capabilities

[only21mil]

CI-only mirror of the canonical Buzz provider candidate

Buzz is the repository of record. This GitHub pull request exists only to run the upstream protected checks on the exact canonical candidate. Do not merge it on GitHub.

The original correction scopes provider-namespaced Codex model catalogs to the active T3 provider instance. The follow-up commit removes a false capability inference: when a configured custom model is absent from the live catalog, T3 now reports capabilities: null instead of copying reasoning and service-tier controls from an unrelated model such as Sol. That prevents unsupported Sol controls from appearing on z-ai/glm-5.3-flash.

Exact candidate:

• Canonical base: 018d7f2775daabd2ef07898af29586915a0b7f67
• Head: b2d8208a2bd340bcb3de8df3509a9bcba2b8c935
• Tree: a9b86eaf555f99e6b9c32e551980751c9379cb26
• Head parent: c27f09695aa8b17487973baf650dbbc33c1d5a95
• Live upstream main observed at publication: 053affbed2659f90cd1b1efaaa7a75865c4131c7

Focused checks:

• CodexProvider.test.ts: 9 tests passed
• Targeted lint passed on the two follow-up paths
• Targeted format check passed on the two follow-up paths
• Server typecheck passed; non-failing suggestions were confined to untouched baseline files
• Commit diff check passed
• The parent candidate previously passed 4 focused files / 92 tests, targeted lint, nine-file format check, server typecheck, and commit diff check

Canonical Buzz records:

• Repository: 30617:4a34c131ec5cb5dd9a200bac619bbd103c0793e068fad278d1de59203d05b97d:t3code
• Issue: 0fe7a67b68001356dfe2bc49a5a6bee12eef704c6f25e79acfc67c02cd6f1bba
• Pull request: 37293d0ac0d54ce13fadb87070e98f0d2653858fb7ea17e0b27851e00aa43767
• Buzz feature ref: refs/heads/buzz/provider-scoped-custom-models-rebase-018d7f2

Model/harness: GPT-5.6 Sol via Codex CLI.

---

Note

Medium Risk
Changes Codex model catalog exposure, cache merge, and session validation; misconfiguration could hide models users expect, but the behavior is intentional and covered by new tests.

Overview
Codex model lists and sessions are now tied to each instance’s declared custom models, so slugs like z-ai/glm-5.3-flash from a shared Codex home catalog are not treated as runnable on that instance unless they appear in settings.

scopeCodexModelsToInstance replaces the old “append all custom slugs” behavior: provider-namespaced catalog entries (detected via isProviderNamespacedModelSlug, i.e. a / in the slug) are dropped unless listed in customModels; when allowed, they are exposed as custom models. Slugs declared in settings but missing from the live catalog are still added with capabilities: null, so reasoning/service-tier UI is not copied from an unrelated first-party model.

Runtime and snapshot hygiene block stale or undeclared namespaced models: CodexAdapter rejects startSession / sendTurn when a namespaced model is not configured on the bound instance; ProviderRegistry merge and providerStatusCache hydration no longer retain or rehydrate undeclared namespaced Codex models from older snapshots.

^{Reviewed by Cursor Bugbot for commit b2d8208. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Scope Codex provider models to instance and suppress inferred capabilities

• Adds scopeCodexModelsToInstance in CodexProvider.ts to filter the Codex model catalog per instance: provider-namespaced slugs (those containing /) are included only if declared in customModels, marked isCustom, and given null capabilities when absent from the catalog.
• Adds validateModelSelection in CodexAdapter.ts so startSession and sendTurn reject provider-namespaced slugs that are not declared as custom models on the bound instance.
• Updates mergeProviderModels in ProviderRegistry.ts and providerStatusCache.ts to exclude provider-namespaced slugs for the Codex driver when retaining previous models on empty refresh or cache hydration.
• Risk: undeclared provider-namespaced Codex models are now dropped from the probed catalog, cache hydration, and snapshot retention; requests referencing them via startSession or sendTurn fail with ProviderAdapterValidationError.

📊 Macroscope summarized b2d8208. 5 files reviewed, 1 issue evaluated, 0 issues filtered, 1 comment posted

🗂️ Filtered Issues

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 847d7028-5373-406c-807f-325e831ba508

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

🟠 High Layers/CodexProvider.ts:265

A namespaced custom model that disappears from a later model/list continues exposing its previous nonempty capabilities after the snapshot update. This fallback sets capabilities: null at line 265, but mergeProviderModels preserves the prior capabilities whenever the incoming model has none, so stale unsupported controls remain visible; update the merge logic to clear capabilities for this fallback case.

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/server/src/provider/Layers/CodexProvider.ts around line 265:

A namespaced custom model that disappears from a later `model/list` continues exposing its previous nonempty `capabilities` after the snapshot update. This fallback sets `capabilities: null` at line 265, but `mergeProviderModels` preserves the prior capabilities whenever the incoming model has none, so stale unsupported controls remain visible; update the merge logic to clear capabilities for this fallback case.

[macroscopeapp]

Approvability

Verdict: Would Approve

Macroscope's review found this PR approvable — This is a focused Codex model-catalog and instance-isolation fix with localized runtime effects, backward-compatible handling for existing non-namespaced models, and targeted tests. An unresolved high-severity finding identifies possible stale capabilities for configured models missing from a later catalog refresh.

Not approved because:

• 1 blocking correctness issue found at or above your repo's Minimum Blocking Severity

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}

[only21mil]

Maintainer action requested: please approve the waiting fork workflows so protected CI can run on exact head b2d8208a2bd340bcb3de8df3509a9bcba2b8c935. The CI workflow is run 33254802915 and is currently action_required. Canonical Buzz merge remains held until protected exact-head CI is terminal and passing.

[only21mil]

Superseded by #8655 at the exact reviewed squash 89f0b8c6dfb23eb1565474123ad5cedacea658de; canonical Buzz delivery now tracks that candidate.