fix(providers): preserve explicit vision restrictions

[luvs01]

Motivation

• A startup repair was automatically rewriting saved noVisionModels and modelInputModalities entries that may be intentional operator policy, which could remove fail-closed image stripping and forward raw images upstream.
• The change aims to preserve operator-authored routing controls while keeping registry corrections as defaults for new or missing values.

Description

• Removed the unsafe stale-vision startup migration by deleting src/providers/stale-vision-classification-migration.ts and stopped invoking it from src/providers/model-rename-startup.ts, so startup no longer rewrites existing noVisionModels or modelInputModalities values.
• Kept the registry metadata as the default for new/missing rows and clarified that derive.ts fills missing registry metadata but does not replace saved operator values in src/providers/registry/entries-core.ts.
• Replaced the migration-oriented test with focused regressions in tests/providers/vision-classification-seed-repair.test.ts that assert explicit text-only policies and noVisionModels restrictions are preserved and continue to require vision preprocessing.
• Updated documentation in structure/providers-and-adapters.md to explain why startup must not rewrite indistinguishable operator restrictions and how operators can opt into the corrected registry classification.

Testing

• Ran the focused provider tests with bun test tests/providers/vision-classification-seed-repair.test.ts tests/providers/model-rename-migration.test.ts tests/providers/devin-cli-authmode-migration.test.ts and they passed.
• Ran layout tooling tests with bun test tests/test-layout.test.ts tests/test-layout-tooling.test.ts and they passed.
• Ran static gates bun run typecheck, bun run structure:check, and bun run privacy:scan, all of which passed.
• Attempted a full bun run test; the full suite did not complete within the container run time (attempt stopped) but focused regressions and static checks passed.

---

Codex Task

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8f8e1f9f-e0de-4d80-8d70-466dfc205b8e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T01:54:23.784662Z	7c7b1f5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Done in ad19aec. The vision-sidecar guide now documents the corrected OpenCode Go classification (opencode-go/deepseek-v4.1-flash accepts image_url input and defaults to native vision, while deepseek-v4-flash stays sidecar-backed) and the upgrade steps for existing installs: remove deepseek-v4.1-flash from the provider's noVisionModels and delete its saved modelInputModalities ["text"] entry in ~/.opencodex/config.json — or delete and re-add the preset — since registry metadata only fills missing values. Mirrored across all seven locale translations (fr, ja, ko, ru, tr, zh-cn, zh-tw).