Merge pull request #10914 from diegosouzapw/fix/10848-image-scan-cookie-bridge

fix(config): exclude cookie-auth image bridges from unprefixed model scan (#10848)

changelog.d/fixes/10848-image-scan-cookie-bridge.md

@@ -0,0 +1 @@
+- fix(config): exclude cookie-auth image bridges (chatgpt-web, gemini-web) from the unprefixed model scan so a bare id never silently binds to an unofficial web bridge (#10848)

open-sse/config/imageRegistry.ts

@@ -918,9 +918,9 @@ export function parseImageModel(modelStr) {
     }
   }
 
-  // No provider prefix — try to find the model in every provider
+  // No provider prefix — try to find the model in every provider, excluding cookie-auth (web) bridges
   for (const [providerId, config] of Object.entries(IMAGE_PROVIDERS)) {
-    if (config.routingAliases?.includes(modelStr) || config.models.some((m) => m.id === modelStr)) {
+    if (config.authHeader !== "cookie" && (config.routingAliases?.includes(modelStr) || config.models.some((m) => m.id === modelStr))) {
       return { provider: providerId, model: modelStr };
     }
   }

tests/unit/unprefixed-scan-web-cookie-10848.test.ts

@@ -0,0 +1,34 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { IMAGE_PROVIDERS, parseImageModel } from "../../open-sse/config/imageRegistry.ts";
+
+test("#10848 bare id that only exists on a cookie-auth web bridge should not silently resolve to it", () => {
+  const chatgptWeb = IMAGE_PROVIDERS["chatgpt-web"];
+  assert.equal(chatgptWeb.authHeader, "cookie");
+  const otherProvidersWithSameId = Object.entries(IMAGE_PROVIDERS).filter(
+    ([providerId, config]) =>
+      providerId !== "chatgpt-web" && config.models.some((m) => m.id === "gpt-5.5")
+  );
+  assert.deepEqual(
+    otherProvidersWithSameId,
+    [],
+    "expected only chatgpt-web (cookie) to register gpt-5.5"
+  );
+
+  const resolved = parseImageModel("gpt-5.5");
+
+  assert.notDeepEqual(
+    resolved,
+    { provider: "chatgpt-web", model: "gpt-5.5" },
+    "bare 'gpt-5.5' must not silently bind to the cookie-auth chatgpt-web bridge"
+  );
+
+  assert.deepEqual(parseImageModel("chatgpt-web/gpt-5.5"), {
+    provider: "chatgpt-web",
+    model: "gpt-5.5",
+  });
+  assert.deepEqual(parseImageModel("cgpt-web/gpt-5.5"), {
+    provider: "chatgpt-web",
+    model: "gpt-5.5",
+  });
+});