fix(google): honor models.providers.google.request.allowPrivateNetwork in TTS#71723
Conversation
Greptile SummaryThis PR fixes a bug where Confidence Score: 5/5Safe to merge — minimal, targeted fix that aligns speech-provider with the established pattern from sibling providers. The change is a clean one-line-per-call-site addition that exactly mirrors the already-reviewed pattern in No files require special attention. Reviews (1): Last reviewed commit: "fix(google): honor models.providers.goog..." | Re-trigger Greptile |
steipete
force-pushed
the
fix/google-tts-honor-allow-private-network
branch
from
8e71c17 to
2023f88
Compare
steipete
force-pushed
the
fix/google-tts-honor-allow-private-network
branch
from
2023f88 to
d384312
Compare
…k in TTS Image generation and media understanding both thread the sanitized models.providers.google.request config (including allowPrivateNetwork) into resolveGoogleGenerativeAiHttpRequestConfig. Speech synthesis omitted that arg, so TTS always saw allowPrivateNetwork: false regardless of config — silently falling back to a different speech provider when the configured Google TTS endpoint resolved to a private/internal IP (proxies, custom backends, test mocks). Mirror the image-generation-provider pattern: thread request through synthesizeGoogleTtsPcm at both call sites (synthesize and synthesizeTelephony). Follow-up to openclaw#67216.
steipete
force-pushed
the
fix/google-tts-honor-allow-private-network
branch
from
d384312 to
5c596f9
Compare
|
Landed via rebase onto
Thanks @ro-hansolo! |
2 participants
Summary
models.providers.google.request.allowPrivateNetworkconfig that image-gen + media-understanding honor. Always-blocked when the configured Google API endpoint resolves to a private IP. Silent fallback to a different speech provider.extensions/google/speech-provider.tsnow threadssanitizeConfiguredModelProviderRequest(req.cfg?.models?.providers?.google?.request)intoresolveGoogleGenerativeAiHttpRequestConfig, mirroringimage-generation-provider.ts.models.providers.google.requestunset (which is the case for vast majority of users).Change Type (select all)
Scope (select all touched areas)
Linked Issue/PR
extensions/google/api.tsand image-gen + media-understanding callers but missedextensions/google/speech-provider.ts)Root Cause
synthesizeGoogleTtsPcminextensions/google/speech-provider.tscallsresolveGoogleGenerativeAiHttpRequestConfigwithout passing therequestarg. The central function then defaultsallowPrivateNetworktofalseregardless ofmodels.providers.google.request.allowPrivateNetwork: truein user config.extensions/google/image-generation-provider.ts,extensions/google/media-understanding-provider.ts) threadrequestthrough; speech-provider was missed during the [Bug]: Google Generative AI image generation blocked by SSRF despite allowPrivateNetwork config #67216 fix.params.request?.allowPrivateNetworkhonoring inextensions/google/api.tsand updated image-gen + media-understanding call sites but did not visit the speech-provider call site.Regression Test Plan
extensions/google/speech-provider.test.tsmodels.providers.google.request.allowPrivateNetwork: trueis configured, callingprovider.synthesize(...)should result inpostJsonRequestbeing called withallowPrivateNetwork: true.extensions/google/image-generation-provider.test.ts("honors configured private-network opt-in for Google image generation"). Catches the asymmetry that allowed this regression.User-visible / Behavior Changes
models.providers.google.request.allowPrivateNetworkconfig like other Google capabilities.false).Diagram (if applicable)
N/A
Security Impact (required)
Repro + Verification
Environment
messages.tts.providers.google+ custommodels.providers.google.baseUrlmodels.providers.google.request.allowPrivateNetwork: true;messages.tts.provider: "google";messages.tts.providers.google.{model, voiceName}configuredSteps
models.providers.google.{baseUrl, models, request.allowPrivateNetwork: true}where the resolved baseUrl points at a private IP (e.g. via/etc/hostsredirectinggenerativelanguage.googleapis.comto127.0.0.1for a local proxy).messages.tts.provider: "google"andmessages.tts.providers.google.{model, voiceName}.Expected
Actual (before this fix)
[security] blocked URL fetch (url-fetch) targetOrigin=<configured baseUrl> reason=Blocked: resolves to private/internal/special-use IP address. OC silently falls back to a different speech provider (e.g. Microsoft Edge), losing Google-specific config (voiceName,audioProfile, etc.).Evidence
extensions/google/speech-provider.test.tstest ("honors configured private-network opt-in for Google TTS") fails onmainwithout the source change.Human Verification (required)
models.providers.google.requestconfigured): TTS request behavior unchanged — existing tests pass.request.allowPrivateNetwork: trueset: TTS reaches configured private-IP backend successfully — new test passes; verified on a deploy with the patched build.synthesizeTelephonypath uses the same threading via the second call site.Review Conversations
Compatibility / Migration
Risks and Mitigations
sanitizeConfiguredModelProviderRequestreturnsundefinedfor unset config; passingundefinedtoresolveGoogleGenerativeAiHttpRequestConfig.requestis the same as omitting it (default-false path).AI-assisted (Claude wrote this PR after diagnosing the bug; lightly tested locally + verified end-to-end on a production gateway deploy). Human reviewed every diff hunk before push.