fix(server): drop non-interactive Codex models from the model picker

[colonelpanic8]

What Changed

parseCodexModelListResponse now filters the Codex model/list catalog before
building picker entries:

• entries the app server marks hidden: true are dropped (the flag was
  previously read off the schema and discarded)
• entries whose slug is a known non-interactive Codex model are dropped
  (currently just codex-auto-review)

Why

codex-cli 0.145.0 returns codex-auto-review — Codex's internal "Automatic
approval review model" — in the ordinary catalog, with hidden: false and
the display name of a different entry. Probing the app server directly:

$ codex app-server   # model/list
gpt-5.6-sol         hidden=false  GPT-5.6-Sol
gpt-5.6-terra       hidden=false  GPT-5.6-Terra
codex-auto-review   hidden=false  GPT-5.6-Luna     <-- internal model, name of another entry
gpt-5.6-luna        hidden=false  GPT-5.6-Luna
gpt-5.5             hidden=false  GPT-5.5
...

So the picker shows two identical GPT-5.6-Luna rows and one of them silently
routes to a model that cannot do any work. A thread started on it fails in two
stages:

1. Every tool call is rejected locally. The model emits a code-mode
   custom_tool_call (name: "exec", namespace: "exec") and codex answers
   custom_tool_call_output: "unsupported custom tool call: execexec". No tool
   row ever renders — the model just narrates that "the shell tool is currently
   failing on invocation" and gives up.

2. Every subsequent turn dies before it starts, because the retained call items
   carry namespace, which is not a valid Responses API input field:

   invalid_request_error: [ObjectParam] [input[5].namespace]
   [unknown_parameter] Unknown parameter: 'input[5].namespace'.   (willRetry: false)
   

   That surfaces as thread/status/changed → systemError about half a second
   after each send, and the thread is unrecoverable since the offending item is
   permanently in history.

Filtering the catalog is the narrow fix: honoring hidden is simply respecting
a field the protocol already provides, and the slug list covers the case where
Codex itself mislabels an internal model as selectable. There is precedent for
both shapes in the tree — OpenCodeProvider filters agent.hidden, and
opencodeRuntime keeps a KNOWN_HIDDEN_AGENTS set for entries the CLI does not
flag.

UI Changes

No visual changes. The only user-visible effect is that the duplicate
GPT-5.6-Luna row disappears from the Codex model picker; the remaining rows
and their ordering are unchanged.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (n/a — a row is removed, no visual redesign)
• I included a video for animation/interaction changes (n/a)

---

Validation (scoped per AGENTS.md, which asks that repo-wide suites be left to CI):

vp test run apps/server/src/provider/Layers/CodexProvider.test.ts   # 9 passed
vp run --filter t3 typecheck                                       # exit 0
vp lint apps/server/src/provider/Layers/CodexProvider{,.test}.ts    # clean
vp fmt --check apps/server/src/provider/Layers/CodexProvider{,.test}.ts

The three new tests were confirmed to fail against the unfiltered parser.

---

Note

Low Risk
Narrow catalog filtering at model-list parse time with targeted tests; no auth, session runtime, or UI layout changes beyond removing invalid picker rows.

Overview
Filters Codex model/list entries before they become picker rows in parseCodexModelListResponse.

Catalog items with hidden: true are no longer mapped into ServerProviderModel entries. Slugs in NON_INTERACTIVE_CODEX_MODEL_SLUGS (starting with codex-auto-review) are excluded even when the app server leaves them visible—addressing duplicate labels (e.g. two “GPT-5.6-Luna” rows) and sessions that break on tool calls and follow-up turns.

parseCodexModelListResponse is exported for unit tests; new cases cover normal catalog passthrough, hidden drops, and the codex-auto-review duplicate scenario.

^{Reviewed by Cursor Bugbot for commit 6b75ff3. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Drop non-interactive Codex models from the model picker

Filters out models that should not appear in the interactive model picker by updating parseCodexModelListResponse in CodexProvider.ts. Models marked as hidden or whose slug appears in NON_INTERACTIVE_CODEX_MODEL_SLUGS (initially codex-auto-review) are excluded. The function is also now exported to support direct testing.

^{Macroscope summarized 6b75ff3.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1d577b7e-71a8-4469-853f-fcf5ce5c63be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved

Straightforward bug fix that filters out a broken model ('codex-auto-review') from the model picker. The change is small, well-documented, and includes comprehensive tests covering the filtering behavior.

^{You can customize Macroscope's approvability policy. Learn more.}