fix(codex): scope provider models and suppress false capabilities

[only21mil]

CI-only mirror of the exact reviewed Buzz provider candidate

Buzz is the repository of record. This GitHub pull request exists only to run upstream protected checks on the exact reviewed candidate. Do not merge it on GitHub.

This squash preserves the complete provider-scoping correction and the follow-up that suppresses false capabilities for custom models absent from the live Codex catalog. Such models now report capabilities: null instead of inheriting reasoning or service-tier controls from an unrelated first-party model.

Exact candidate:

• Canonical base: 018d7f2775daabd2ef07898af29586915a0b7f67
• Reviewed squash: 89f0b8c6dfb23eb1565474123ad5cedacea658de
• Tree: a9b86eaf555f99e6b9c32e551980751c9379cb26
• Sole parent: 018d7f2775daabd2ef07898af29586915a0b7f67
• Current upstream main: 053affbed2659f90cd1b1efaaa7a75865c4131c7
• Superseded CI candidate: b2d8208a2bd340bcb3de8df3509a9bcba2b8c935

Verification:

• Tier 2: PASS WITH RISKS on exact 89f0b8c6dfb23eb1565474123ad5cedacea658de
• Exact controller check: OK
• Candidate tree matches the previously checked two-commit candidate tree exactly
• Focused provider tests, targeted lint and formatting, server typecheck, and commit diff checks passed before review

Canonical Buzz records:

• Repository: 30617:4a34c131ec5cb5dd9a200bac619bbd103c0793e068fad278d1de59203d05b97d:t3code
• Issue: 0fe7a67b68001356dfe2bc49a5a6bee12eef704c6f25e79acfc67c02cd6f1bba
• Pull request: 37293d0ac0d54ce13fadb87070e98f0d2653858fb7ea17e0b27851e00aa43767
• Buzz feature ref: refs/heads/buzz/provider-scoped-custom-models-rebase-018d7f2

Canonical Buzz merge remains held until protected exact-head CI is terminal and passing.

Model/harness: GPT-5.6 Sol via Codex CLI.

---

Note

Medium Risk
Changes model catalog exposure, cache merge, and session validation for Codex; misconfiguration could hide models users expect, but the behavior is intentional and guarded by tests.

Overview
Codex instances no longer advertise or retain provider-namespaced model slugs (those containing /, e.g. OpenRouter entries) unless the slug is listed in that instance’s custom models settings. Catalog probing now uses scopeCodexModelsToInstance instead of blindly merging the shared per-home cache with custom entries.

CodexAdapter rejects startSession / sendTurn when a namespaced model is selected but not configured on the bound instance, before the runtime starts. Provider registry merge and status-cache hydration stop carrying stale or undeclared namespaced Codex models across refreshes.

Custom models that are only declared in settings (not in the live catalog) are exposed with capabilities: null, so the UI does not inherit reasoning or service-tier options from an unrelated first-party model.

^{Reviewed by Cursor Bugbot for commit 89f0b8c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Scope Codex provider models to instance and suppress inferred capabilities

• Adds scopeCodexModelsToInstance in CodexProvider.ts to filter the Codex model catalog per instance: provider-namespaced slugs (those containing /) are included only if declared in customModels, marked isCustom, and given null capabilities when absent from the catalog.
• Adds validateModelSelection in CodexAdapter.ts so startSession and sendTurn reject provider-namespaced slugs that are not declared as custom models on the bound instance.
• Updates mergeProviderModels in ProviderRegistry.ts and providerStatusCache.ts to exclude provider-namespaced slugs for the Codex driver when retaining previous models on empty refresh or cache hydration.
• Risk: undeclared provider-namespaced Codex models are now dropped from the probed catalog, cache hydration, and snapshot retention; requests referencing them via startSession or sendTurn fail with ProviderAdapterValidationError.

^{Macroscope summarized 89f0b8c.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 56922b74-12c3-4046-9281-d44fefda380f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[only21mil]

Maintainer action requested: please approve the waiting fork workflows for exact head 89f0b8c6dfb23eb1565474123ad5cedacea658de. The CI workflow is run 33256503319 and is currently action_required. Canonical Buzz merge remains held until protected exact-head CI is terminal and passing.

[macroscopeapp]

Approvability

Verdict: Approved at 89f0b8c

Macroscope's review found this PR approvable — This is a focused Codex bug fix that prevents cross-instance model leakage, avoids fabricating capabilities for undeclared custom models, and rejects invalid selections before provider work starts. The production logic is small, isolated to provider model handling, and covered by targeted tests.

^{You can add or adjust custom eligibility rules. Learn more.}