fix(codex): surface gpt-5.x in /model chooser (drop stale allowlist) (#1546)

The API-fetch fallback in `fetchModelsFromAPI` filtered `GET /v1/models`
through `openaiChatModels`, a hard-coded 11-entry map added on
2026-03-02 and never updated. Every `gpt-5*` variant returned by
providers using `codex-cli >= 0.143` (including `gpt-5.6-sol`,
`gpt-5.6-terra`, `gpt-5.6-luna`) was silently dropped, so upgrading the
Codex CLI did not make GPT-5.6 selectable in cc-connect's /model chooser.

Users hitting the other three code paths — `readCodexModelCatalog`
(explicit `model_catalog_json` in `~/.codex/config.toml`),
`configuredModels` (explicit `models = [...]` in the provider config),
or `readCodexCachedModels` (last-resort read of
`~/.codex/models_cache.json`) — were unaffected.

Fix: replace the static map with `isCodexChatModel`, which uses pattern
rules so future frontier models (gpt-5.x, gpt-6, o5-*, codex-*) are
picked up automatically.

  Accept  gpt-* / chatgpt-* / codex-* / o1-* / o3-* / o4-* / o5-*
          plus bare o1, o3, o4, o5.
  Reject  any ID containing embedding, whisper, tts, dall-e,
          audio-preview, realtime, transcribe, moderation, image, or
          search-preview (so /v1/models cannot leak embedding, audio,
          image, or moderation models into a chat chooser).

45 unit tests cover the legacy chat families, GPT-5.0–5.6 (incl. Bedrock
variants), case-insensitivity, and every non-chat modality currently
served by /v1/models.

Reported by external user on WeChat: "5.6 的模型选不到，已经更新几次
cli 到 144 版本".

Co-authored-by: dev-claudecode <dev-claudecode@cc-connect.local>
Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -13,6 +13,7 @@
 - **Feishu: outbound bot-to-bot @mention resolution** via new `mention_map` config option. Maps agent-friendly names (e.g. `BOT-A`) to Feishu open_ids so that when an agent writes `@BOT-A` in its reply, cc-connect converts it to a native Feishu `<at>` tag that triggers a real notification. Layered on top of `resolve_mentions` (group-member matching) with higher priority, so explicit config always wins (#1322).
 
 ### Fixed
+- **codex**: `/model` chooser now surfaces `gpt-5.x` (and any future frontier chat model) when the model list is populated by fetching `GET /v1/models` from the provider. The previous hard-coded 11-entry allowlist (`o1/o3/o4/gpt-4o/gpt-4.1/codex-mini-latest`) had not been updated since 2026-03 and silently filtered out every `gpt-5*` variant (including `gpt-5.6-sol/terra/luna`) returned by the API, so users on `codex-cli >= 0.143` could not pick GPT-5.6 in cc-connect even after upgrading the CLI. The allowlist is replaced with pattern rules: accept the `gpt-*` / `chatgpt-*` / `codex-*` / `o1-*` / `o3-*` / `o4-*` / `o5-*` families plus the bare `o1/o3/o4/o5` IDs, and reject non-chat modalities (`embedding`, `whisper`, `tts`, `dall-e`, `audio-preview`, `realtime`, `transcribe`, `moderation`, `image`, `search-preview`). New frontier chat models are picked up automatically without a code change. Note: this only affects the API-fetch fallback path; users with an explicit `model_catalog_json` in `~/.codex/config.toml` or a `models = [...]` list in cc-connect's provider config were unaffected.
 - **Feishu recall fallback probes**: throttle repeated active-message recall checks so long-running turns do not continuously call platform message APIs.
 - **Skill discovery depth-1 only**: skill scanning no longer recurses into subdirectories. Only `<skill_dir>/<name>/SKILL.md` is registered; nested SKILL.md files (e.g. inside `<name>/references/...`) are treated as skill assets and ignored, matching the Claude Code CLI convention. Previously, nested SKILL.md files leaked into platform command menus as phantom slash commands (101 leaked commands from `frontend-design` skill alone) (#1304).
 - **Feishu: tighter `@` mention detection in `SendWithStatusFooter` / `buildReplyContent`** — a bare `@` inside an email address, URL, or escaped character no longer false-positives as a mention. Mention detection now checks for the resolved `<at user_id="...">` tag instead of a substring match, so card rendering (and the notation-style status footer) is preserved for content that merely contains `@`. Real `@mentions` still force `MsgTypeText` so Feishu fires the mention event (#1322).