fix(openai): require explicit signal for Codex image tool injection#2294
Open
wucm667 wants to merge 2 commits into
Open
fix(openai): require explicit signal for Codex image tool injection#2294wucm667 wants to merge 2 commits into
wucm667 wants to merge 2 commits into
Conversation
桥接开关打开时，原先所有 Codex CLI `/v1/responses` 请求都会被注入 `image_generation` 工具与桥接指令，导致模型偶尔在用户未请求时自发调用 图片生成工具（issue Wei-Shaw#2280）。 新增 codexImageGenerationBridgeShouldFire，仅当请求体携带显式的图片生成 信号时才让桥接生效： - tools[] 已经声明 image_generation - tool_choice 选中 image_generation（issue Wei-Shaw#2254） - input 内含 input_image 内容（图片编辑场景） - input 内含历史 image_generation_call item（续链场景） 两处注入点统一改用新的门控；纯文本 Codex 请求保持原样转发。 现有测试更新为携带显式信号以维持注入路径覆盖。 Refs: Wei-Shaw#2280, Wei-Shaw#2254
sakurawztlt
added a commit
to sakurawztlt/sub2api
that referenced
this pull request
May 11, 2026
之前 isCodexCLI 单一 gate 太宽 — 普通 Codex 文本/代码请求被误注入 image_generation tool, 模型可能在用户没要求时自发调图. 检测侧 + 客户行为偏差. cherry-pick PR Wei-Shaw#2294 核心 (上游 openai_gateway_service_test.go 冲突跳过 PR 的 controls test): - openai_codex_transform.go: 加 codexImageGenerationBridgeShouldFire 检 4 项显式信号 (tools 含 image_generation / tool_choice / input_image / 历史 image_generation_call) - openai_codex_transform.go: 加 hasOpenAIImageGenerationCallItem 扫 input 历史项 - 加 fork-local helper openAIAnyToolChoiceSelectsImageGeneration (PR 引用但 fork 没合上游对应 PR, 现支持 string / Responses obj / Chat Completions nested function 三种 tool_choice 形) - openai_gateway_service.go: 改两处 isCodexCLI gate → isCodexCLI && codexImageGenerationBridgeShouldFire(reqBody) 普通 Codex 文本/代码请求 → 不注入 image bridge ✓ 真图片生成请求 (含上述 4 信号) → 仍注入 ✓ build + service test 全过.
sakurawztlt
added a commit
to sakurawztlt/sub2api
that referenced
this pull request
May 11, 2026
真 Claude API 没 image_generation 内置工具. 我们注入 image_generation tool 给 GPT 上游 + 返 image_generation_call 形态给客户, 这两处都暴露伪装: - 上游请求里出现 "image_generation" 工具名 (Anthropic 看不到, OpenAI 看到这是不普通的 Claude 客户) - 客户对比真 Claude 一试: "你能画图?" → 真 Claude "我不能画图" / 我们能 → 暴露 - 响应 image_generation_call 形态非 Claude image content block 修法 (codex 5/9 audit): - GatewayConfig 加 CodexImageGenerationBridgeEnabled (default false) - openai_gateway_service.go bridge gate 改成两层 defense: 层 1: cfg.Gateway.CodexImageGenerationBridgeEnabled (全局 admin 控制) 层 2: PR Wei-Shaw#2294 codexImageGenerationBridgeShouldFire intent gate - 默认 false 跟真 Claude 行为一致, admin 想恢复 Codex 画图: ConfigMap gateway.codex_image_generation_bridge_enabled=true build + service + config test 全过.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
Issue #2280 报告 VS Code Codex 插件发送普通代码请求时，后台日志却出现图片生成调用，
随后长时间卡死并报 stream disconnected 错误。
根因：当
gateway.codex_image_generation_bridge_enabled = true（或通过 channel/accountoverride 打开）时，所有 来自 Codex CLI 家族的
/v1/responses请求都会被注入image_generation工具与桥接指令，模型偶尔在用户未请求时自发调用该工具。同时关联：
tool_choice: image_generation但tools[]缺该工具时上游报错。修改
codexImageGenerationBridgeShouldFire(reqBody)：仅当请求体携带显式图片生成信号（tools[] 已声明 image_generation / tool_choice 选中 image_generation /
input 含 input_image / input 含历史 image_generation_call）时才让桥接生效。
openai_gateway_service.go两处注入点统一改用新的门控。取舍
桥接打开时，原先依赖 Codex 任意请求"自动可生图"的用法会回归为需要客户端
显式设置 tool_choice 或附带图片输入。这是修复 #2280 的有意收紧。
Test plan
go test -tags=unit ./internal/service/...（本地通过）go vet ./internal/service/...（本地通过）Refs: #2280, #2254