fix(openai): guard Codex GPT-5.6 discovery boundary (#104335)

* fix: guard OpenAI Codex model discovery boundary

DEV-20260711-001

* docs: narrow OpenAI Codex catalog comment

DEV-20260711-002

* test(openai): remove redundant catalog assertion

The exact model-id equality already excludes every static fallback row. Keep the new hidden-only regression as the distinct coverage.\n\nCo-authored-by: owen-ever <oh.whenever@gmail.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>

extensions/openai/openai-provider.test.ts

@@ -878,6 +878,16 @@ describe("buildOpenAIProvider", () => {
   it.each([
     ["fails", () => new Response("temporarily unavailable", { status: 503 })],
     ["returns no models", () => Response.json({ models: [] })],
+    [
+      "returns hidden-only models",
+      () =>
+        Response.json({
+          models: [
+            { slug: "gpt-5.6-sol", display_name: "GPT-5.6 Sol", visibility: "hide" },
+            { slug: "gpt-5.5", display_name: "GPT-5.5", show_in_picker: false },
+          ],
+        }),
+    ],
   ])("keeps static OpenAI OAuth rows when Codex catalog discovery %s", async (_label, response) => {
     const release = vi.fn(async () => undefined);
     const fetchGuard: LiveModelCatalogFetchGuard = vi.fn(async () => ({

extensions/openai/openai-provider.ts

@@ -488,6 +488,9 @@ async function buildOpenAICodexLiveProviderConfig(params: {
       .map(buildOpenAICodexModelFromLiveRow)
       .filter((model): model is ModelDefinitionConfig => Boolean(model));
     if (models.length > 0) {
+      // Successful Codex OAuth discovery is account-scoped and authoritative
+      // for the picker/list catalog. Do not merge static OpenAI fallback rows
+      // into a successful live catalog.
       return {
         baseUrl: OPENAI_CODEX_RESPONSES_BASE_URL,
         api: "openai-chatgpt-responses",