[WRONG BRANCH] fix: avoid spreading hosted-tool indices - #45
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
⏳ DRAFT
What to do
Its title has been prefixed with |
github-actions
Bot
changed the title
|
✅ Deterministic PR hygiene checks passed. |
📝 WalkthroughWalkthroughThe adapter now tracks only the first ChangesHosted image-generation restoration
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/openai-responses-passthrough.test.ts`:
- Around line 1241-1248: Update the test around adapter.buildRequest to capture
the returned request, then assert the restored payload contains exactly one
hosted image_generation declaration in the first stripped additional_tools
container. Also assert the second and third additional_tools containers do not
contain a duplicate, while preserving the existing no-throw check.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 23813477-4052-486b-b617-f180495315b3
📒 Files selected for processing (2)
src/adapters/openai-responses.tstests/openai-responses-passthrough.test.ts
| try { | ||
| expect(() => adapter.buildRequest({ | ||
| modelId: "provider-image-model", | ||
| context: { messages: [] }, | ||
| stream: true, | ||
| options: {}, | ||
| _rawBody: { model: "provider-image-model", input }, | ||
| }, meta)).not.toThrow(); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Assert the restored payload, not only request construction.
This test can pass if the adapter strips all three client declarations and restores none, or restores image_generation to the wrong container. Capture the built request and assert that this input restores exactly one hosted declaration in the first stripped additional_tools container. Assert that the second and third containers do not receive a duplicate.
As per path instructions, the adapter behavior change must have a focused regression test that checks the changed behavior.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/openai-responses-passthrough.test.ts` around lines 1241 - 1248, Update
the test around adapter.buildRequest to capture the returned request, then
assert the restored payload contains exactly one hosted image_generation
declaration in the first stripped additional_tools container. Also assert the
second and third additional_tools containers do not contain a duplicate, while
preserving the existing no-throw check.
Source: Path instructions
1 participant
Motivation
Math.min(...strippedAdditionalToolsIndices)spread of an attacker-controlled set could throwRangeErrorfor very largeadditional_toolsarrays, causing a denial-of-service during request build.image_generationrestore semantics.Description
Set+ spread +Math.min(...)approach with constant-space tracking of the first strippedadditional_toolscontainer viafirstStrippedAdditionalToolsIndex, and use that single index when restoring the hosted tool.image_generationdeclaration is restored into the first applicable container.tests/openai-responses-passthrough.test.tsthat asserts restoration does not rely on spreading indices (simulates a constrainedMath.minto catch regressions).src/adapters/openai-responses.tsandtests/openai-responses-passthrough.test.tsonly.Testing
PATH="$PWD/node_modules/.bin:$PATH" bun test tests/openai-responses-passthrough.test.ts— passed (61 tests in that focused file).PATH="$PWD/node_modules/.bin:$PATH" bun run typecheck— passed (typecheck clean).PATH="$PWD/node_modules/.bin:$PATH" bun run test— attempted but the full-suite run encountered unrelated timeouts in this environment; the focused tests and typecheck that exercise the change passed.Summary by CodeRabbit
Bug Fixes
Tests