fix(executor): stop forwarding downstream User-Agent on wrapped Codex image requests

[fengshao1227]

Summary

• Wrapped Codex image paths (executeOpenAIImage / executeOpenAIImageStream) forwarded the downstream client's User-Agent to upstream chatgpt.com, triggering Cloudflare 1010 when the UA is a script default like Python-urllib/3.9
• Switched both call sites from applyCodexHeaders to the existing applyCodexDirectImageHeaders, which strips downstream UA so resolution falls through to the safe codexUserAgent default
• The direct image path (executeDirectOpenAIImage / executeDirectOpenAIImageStream) already used applyCodexDirectImageHeaders — this fix closes the gap for the wrapped path

Root cause

applyCodexHeaders passes downstream gin headers (including User-Agent) to ensureHeaderWithConfigPrecedence. When no CodexHeaderDefaults.UserAgent config is set, the priority chain is: config (empty) → downstream UA → hardcoded codexUserAgent. So "Python-urllib/3.9" wins over the safe default.

The direct image path already had applyCodexDirectImageHeaders (introduced specifically for this reason) which clones gin headers and calls ginHeaders.Del("User-Agent") before passing them through — so the downstream UA never enters the priority chain and codexUserAgent is used as fallback.

Changes

File	Change
codex_openai_images.go:115	applyCodexHeaders → applyCodexDirectImageHeaders (non-streaming)
codex_openai_images.go:211	applyCodexHeaders → applyCodexDirectImageHeaders (streaming)
codex_openai_images_test.go	New test: wrapped path with Python-urllib/3.9 downstream UA verifies upstream receives codexUserAgent

Tests

• go test -run "OpenAIImage" ./internal/runtime/executor/ — all 5 image tests pass
• go build -o test-output ./cmd/server — compiles cleanly

Closes #3980

[github-actions]

This pull request targeted main.

The base branch has been automatically changed to dev.

[gemini-code-assist]

Code Review

This pull request updates the OpenAI image execution flow to use applyCodexDirectImageHeaders instead of applyCodexHeaders and adds a test to verify that downstream User-Agent headers are not leaked upstream. The reviewer suggested checking the error returned by executor.Execute in the new test to avoid silent failures.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The test currently ignores the error returned by executor.Execute using _, _ =. It is highly recommended to check and assert that err is nil to ensure the execution succeeds and to prevent silent failures or confusing test failures if the setup or request preparation fails.

	_, err := executor.Execute(ctx, newCodexOpenAIImageTestAuth(server.URL), cliproxyexecutor.Request{
		Model:   "codex/dall-e-3",
		Payload: []byte(`{"model":"codex/dall-e-3","prompt":"A cute otter","stream":false}`),
	}, codexOpenAIImageTestOptions(codexImagesGenerationsPath, false))
	if err != nil {
		t.Fatalf("Execute() error = %v", err)
	}