[alltomatos]

Problem

Codex Desktop (and the Codex CLI) inject the Responses hosted tool image_generation into every request. On the native Codex Responses passthrough path, OmniRoute preserves that hosted tool unless the account is detected as a free plan.

gpt-5.3-codex-spark rejects image_generation upstream, so a paid account routing to spark fails with an upstream HTTP 400 — the tool is forwarded even though spark can never run it.

Root cause

normalizeCodexTools() drops image_generation only when its dropImageGeneration option is true, and the Codex executor derived that flag solely from the plan type:

// open-sse/executors/codex.ts
normalizeCodexTools(body, {
  dropImageGeneration: isCodexFreePlan(credentials?.providerSpecificData),
  preserveCustomTools: nativeCodexPassthrough,
});

image_generation is a member of CODEX_HOSTED_TOOL_TYPES and is preserved for any non-free plan (open-sse/executors/codex/tools.ts). Spark's per-model incompatibility was never considered here — spark is only special-cased for quota/rate-limit scope in open-sse/config/codexQuotaScopes.ts.

Fix

Gate dropImageGeneration on the spark scope as well as the free plan, via a small, testable predicate co-located with the other Codex tool-gating helpers:

export function shouldDropCodexImageGeneration(
  providerSpecificData: unknown,
  model: string | null | undefined
): boolean {
  return isCodexFreePlan(providerSpecificData) || getCodexModelScope(model) === "spark";
}

getCodexModelScope() already recognizes gpt-5.3-codex-spark (and reasoning-suffixed variants like gpt-5.3-codex-spark:high) as scope "spark", so the fix reuses existing spark detection rather than re-implementing it. The #2980 free-plan behavior is unchanged; only the additional spark condition is new.

Minimal surface: 1 production file (open-sse/executors/codex.ts, +16/-1) plus a new unit test. No change to normalizeCodexTools() itself — only how the executor derives the flag.

Verification

TDD — the test fails on the unfixed tree and passes after the fix.

$ node --import tsx/esm --test tests/unit/codex-spark-image-generation-6651.test.ts
# before fix:  # tests 4  # pass 0  # fail 4
# after fix:   # tests 4  # pass 4  # fail 0

Neighboring Codex suites remain green:

$ node --import tsx/esm --test \
    tests/unit/codex-free-plan-image-generation.test.ts \
    tests/unit/codex-tools-split.test.ts \
    tests/unit/executor-codex.test.ts
# tests 46  # pass 46  # fail 0

Lint clean on changed files:

$ npx eslint --suppressions-location config/quality/eslint-suppressions.json \
    open-sse/executors/codex.ts tests/unit/codex-spark-image-generation-6651.test.ts
# (no output — 0 errors, 0 warnings)

npm run typecheck:core reports only two pre-existing errors in unrelated omniglyph compression files (optional module not installed locally); codex.ts type-checks clean.

Diff summary

• open-sse/executors/codex.ts — add shouldDropCodexImageGeneration() predicate; use it at the normalizeCodexTools() call site instead of isCodexFreePlan() alone.
• tests/unit/codex-spark-image-generation-6651.test.ts — new regression test (spark-paid drop, free-plan [Feature] Add Codex OAuth Login Compatibility Mode for ChatGPT Account + API Routing #2980 guard, paid non-spark preserve, end-to-end normalizeCodexTools).

Closes #6651.

Thanks for the great work on OmniRoute!