From e2b3519ea942bacb688aab3508a050cdeb4f623b Mon Sep 17 00:00:00 2001 From: Owen Date: Tue, 21 Jul 2026 14:07:09 +0900 Subject: [PATCH] fix(openai): guard Codex GPT-5.6 discovery boundary (#104335) * fix: guard OpenAI Codex model discovery boundary DEV-20260711-001 * docs: narrow OpenAI Codex catalog comment DEV-20260711-002 * test(openai): remove redundant catalog assertion The exact model-id equality already excludes every static fallback row. Keep the new hidden-only regression as the distinct coverage.\n\nCo-authored-by: owen-ever --------- Co-authored-by: Peter Steinberger --- extensions/openai/openai-provider.test.ts | 10 ++++++++++ extensions/openai/openai-provider.ts | 3 +++ 2 files changed, 13 insertions(+) diff --git a/extensions/openai/openai-provider.test.ts b/extensions/openai/openai-provider.test.ts index d2e7f9a96567..94f2aac9142a 100644 --- a/extensions/openai/openai-provider.test.ts +++ b/extensions/openai/openai-provider.test.ts @@ -878,6 +878,16 @@ describe("buildOpenAIProvider", () => { it.each([ ["fails", () => new Response("temporarily unavailable", { status: 503 })], ["returns no models", () => Response.json({ models: [] })], + [ + "returns hidden-only models", + () => + Response.json({ + models: [ + { slug: "gpt-5.6-sol", display_name: "GPT-5.6 Sol", visibility: "hide" }, + { slug: "gpt-5.5", display_name: "GPT-5.5", show_in_picker: false }, + ], + }), + ], ])("keeps static OpenAI OAuth rows when Codex catalog discovery %s", async (_label, response) => { const release = vi.fn(async () => undefined); const fetchGuard: LiveModelCatalogFetchGuard = vi.fn(async () => ({ diff --git a/extensions/openai/openai-provider.ts b/extensions/openai/openai-provider.ts index f17786772bbc..61453498b1e5 100644 --- a/extensions/openai/openai-provider.ts +++ b/extensions/openai/openai-provider.ts @@ -488,6 +488,9 @@ async function buildOpenAICodexLiveProviderConfig(params: { .map(buildOpenAICodexModelFromLiveRow) .filter((model): model is ModelDefinitionConfig => Boolean(model)); if (models.length > 0) { + // Successful Codex OAuth discovery is account-scoped and authoritative + // for the picker/list catalog. Do not merge static OpenAI fallback rows + // into a successful live catalog. return { baseUrl: OPENAI_CODEX_RESPONSES_BASE_URL, api: "openai-chatgpt-responses",