From bed4d24049982550f892e5c899015e21dd8d8c64 Mon Sep 17 00:00:00 2001
From: Markus Hartung <mail@hartmark.se>
Date: Thu, 20 Aug 2026 20:33:19 -0300
Subject: [PATCH] fix(config): exclude cookie-auth image bridges from
 unprefixed model scan (#10848)

---
 .../fixes/10848-image-scan-cookie-bridge.md   |  1 +
 open-sse/config/imageRegistry.ts              |  4 +--
 .../unprefixed-scan-web-cookie-10848.test.ts  | 34 +++++++++++++++++++
 3 files changed, 37 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/fixes/10848-image-scan-cookie-bridge.md
 create mode 100644 tests/unit/unprefixed-scan-web-cookie-10848.test.ts

diff --git a/changelog.d/fixes/10848-image-scan-cookie-bridge.md b/changelog.d/fixes/10848-image-scan-cookie-bridge.md
new file mode 100644
index 0000000000..07e0f20291
--- /dev/null
+++ b/changelog.d/fixes/10848-image-scan-cookie-bridge.md
@@ -0,0 +1 @@
+- fix(config): exclude cookie-auth image bridges (chatgpt-web, gemini-web) from the unprefixed model scan so a bare id never silently binds to an unofficial web bridge (#10848)
diff --git a/open-sse/config/imageRegistry.ts b/open-sse/config/imageRegistry.ts
index 8defd6d8a8..650dcdd69c 100644
--- a/open-sse/config/imageRegistry.ts
+++ b/open-sse/config/imageRegistry.ts
@@ -918,9 +918,9 @@ export function parseImageModel(modelStr) {
     }
   }
 
-  // No provider prefix — try to find the model in every provider
+  // No provider prefix — try to find the model in every provider, excluding cookie-auth (web) bridges
   for (const [providerId, config] of Object.entries(IMAGE_PROVIDERS)) {
-    if (config.routingAliases?.includes(modelStr) || config.models.some((m) => m.id === modelStr)) {
+    if (config.authHeader !== "cookie" && (config.routingAliases?.includes(modelStr) || config.models.some((m) => m.id === modelStr))) {
       return { provider: providerId, model: modelStr };
     }
   }
diff --git a/tests/unit/unprefixed-scan-web-cookie-10848.test.ts b/tests/unit/unprefixed-scan-web-cookie-10848.test.ts
new file mode 100644
index 0000000000..1d5683401c
--- /dev/null
+++ b/tests/unit/unprefixed-scan-web-cookie-10848.test.ts
@@ -0,0 +1,34 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { IMAGE_PROVIDERS, parseImageModel } from "../../open-sse/config/imageRegistry.ts";
+
+test("#10848 bare id that only exists on a cookie-auth web bridge should not silently resolve to it", () => {
+  const chatgptWeb = IMAGE_PROVIDERS["chatgpt-web"];
+  assert.equal(chatgptWeb.authHeader, "cookie");
+  const otherProvidersWithSameId = Object.entries(IMAGE_PROVIDERS).filter(
+    ([providerId, config]) =>
+      providerId !== "chatgpt-web" && config.models.some((m) => m.id === "gpt-5.5")
+  );
+  assert.deepEqual(
+    otherProvidersWithSameId,
+    [],
+    "expected only chatgpt-web (cookie) to register gpt-5.5"
+  );
+
+  const resolved = parseImageModel("gpt-5.5");
+
+  assert.notDeepEqual(
+    resolved,
+    { provider: "chatgpt-web", model: "gpt-5.5" },
+    "bare 'gpt-5.5' must not silently bind to the cookie-auth chatgpt-web bridge"
+  );
+
+  assert.deepEqual(parseImageModel("chatgpt-web/gpt-5.5"), {
+    provider: "chatgpt-web",
+    model: "gpt-5.5",
+  });
+  assert.deepEqual(parseImageModel("cgpt-web/gpt-5.5"), {
+    provider: "chatgpt-web",
+    model: "gpt-5.5",
+  });
+});