Guard OpenAI image compression for PNG outputs

[AAirLin]

Summary

• Guard OpenAI image output_compression so it is only sent for JPEG/WebP outputs.
• Omit output_compression for PNG/default PNG in both direct image API requests and Codex Responses image tool requests.
• Document that openai.outputCompression is ignored for PNG outputs.

Real behavior proof

Behavior or issue addressed: PNG image requests failed when openai.outputCompression was forwarded to OpenAI.

Real environment tested: OpenClaw canary deployment bot-129 in the Kubernetes cluster on 2026-05-24.

Exact steps or command run after the patch:

• kubectl -n openclaw rollout status deploy/bot-129 --timeout=60s
• /Users/airlin/.codex/skills/openclaw-ops/scripts/verify-cluster-patches.sh --repo /Users/airlin/Documents/Codex/2026-05-20/hi/openclaw-cluster --namespace openclaw --deploy bot-129

Evidence after fix:

bot=localhost/openclaw-gateway:2026.5.20-image-compression-20260523
browser=openclaw-sandbox-browser:bookworm-slim
token-exporter=localhost/openclaw-gateway:2026.5.20-image-compression-20260523

[openclaw-patch] OpenAI image compression: patched 2 output_compression call site(s) across 1 file(s); 0 patch marker(s) already present
[openclaw-patch] OpenAI image compression: patched 0 output_compression call site(s) across 0 file(s); 2 patch marker(s) already present
✔ OpenAI image compression patch drops output_compression for PNG output
ℹ tests 22
ℹ pass 22
ℹ fail 0
Patch verification passed for deploy/bot-129.

Observed result after fix: bot-129 rolled out successfully, patch verification passed, and the PNG compression guard was present in the running runtime.

What was not tested: I did not re-trigger a live PNG generation from bot-129 during this review; the canary verification covered the deployed runtime and patch markers.

Tests

• node scripts/test-projects.mjs extensions/openai/image-generation-provider.test.ts (56 tests passed)

[clawsweeper]

Codex review: needs maintainer review before merge.

Latest ClawSweeper review: 2026-05-24 03:35 UTC / May 23, 2026, 11:35 PM ET.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

PR Surface
Source +12, Tests +46, Docs +1. Total +59 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	18	6	+12
Tests	1	46	0	+46
Docs	1	2	1	+1
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	66	7	+59

Summary
The PR adds a shared OpenAI image output-compression resolver used by direct Images and Codex Responses paths, plus PNG omission tests and docs wording.

Reproducibility: yes. source-reproducible. Current main and v2026.5.22 attach output_compression whenever config supplies it, including PNG/default-PNG paths; I did not run a live OpenAI request because this review is read-only.

PR rating
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Summary: Focused provider bug fix with strong source/test evidence and sufficient runtime proof, with only the live PNG generation smoke left as optional maintainer confidence work.

Rank-up moves:

• none

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Real behavior proof
Sufficient (live_output): The PR body includes after-fix live output from a canary deployment verifier showing the running runtime has the PNG compression guard, with the missing live PNG generation smoke clearly disclosed.

Risk before merge

• The supplied real-environment proof verifies the deployed runtime guard rather than a fresh end-to-end OpenAI PNG generation; maintainers may still choose to run that live smoke before merge.

Maintainer options:

1. Decide the mitigation before merge
   Land the provider-local guard with its request-body regression tests and docs update; no core API, config, or product-policy change is needed.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge
No ClawSweeper repair lane is needed; the branch already contains the focused code, test, and docs fix and should proceed through ordinary maintainer review/merge.

Security
Cleared: The diff only changes OpenAI request-field filtering plus focused tests/docs and does not add dependencies, scripts, permissions, credential handling, lockfiles, or supply-chain surfaces.

Review details

Best possible solution:

Land the provider-local guard with its request-body regression tests and docs update; no core API, config, or product-policy change is needed.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible. Current main and v2026.5.22 attach output_compression whenever config supplies it, including PNG/default-PNG paths; I did not run a live OpenAI request because this review is read-only.

Is this the best way to solve the issue?

Yes. Centralizing the format gate and reusing it at both OpenAI request construction sites is the narrowest maintainable fix, and it preserves JPEG/WebP compression behavior.

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live output from a canary deployment verifier showing the running runtime has the PNG compression guard, with the missing live PNG generation smoke clearly disclosed.

Label justifications:

• P2: This is a real OpenAI provider request-shaping bug with limited blast radius and no evidence of data loss, security bypass, or broad runtime outage.
• rating: 🐚 platinum hermit: Current PR rating is 🐚 platinum hermit because proof is 🐚 platinum hermit, patch quality is 🦞 diamond lobster, and Focused provider bug fix with strong source/test evidence and sufficient runtime proof, with only the live PNG generation smoke left as optional maintainer confidence work.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix live output from a canary deployment verifier showing the running runtime has the PNG compression guard, with the missing live PNG generation smoke clearly disclosed.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live output from a canary deployment verifier showing the running runtime has the PNG compression guard, with the missing live PNG generation smoke clearly disclosed.

What I checked:

• Current main still forwards compression for PNG-capable paths: Current main unconditionally adds output_compression in both appendOpenAIImageOptions and the Codex Responses image tool body whenever openai.outputCompression is configured. (extensions/openai/image-generation-provider.ts:197, c38a9a883ab5)
• Latest shipped release has the same behavior: The latest release tag v2026.5.22 shows the same unconditional output_compression forwarding in both direct and Codex image request construction paths. (extensions/openai/image-generation-provider.ts:197, a374c3a5bfd5)
• PR implements the guard centrally: At PR head, resolveOpenAIImageOutputCompression treats omitted outputFormat as PNG and returns compression only for jpeg or webp; both direct request construction and Codex Responses tool construction reuse that helper. (extensions/openai/image-generation-provider.ts:189, 6d12a7929f9a)
• PR adds focused regression coverage: The PR adds tests that explicit PNG direct generations and Codex image requests omit output_compression, while nearby existing tests still cover JPEG/WebP forwarding. (extensions/openai/image-generation-provider.test.ts:608, 6d12a7929f9a)
• Docs match the narrowed behavior: The PR updates the image generation docs to say openai.outputCompression applies to JPEG/WebP and is ignored for PNG outputs. Public docs: docs/tools/image-generation.md. (docs/tools/image-generation.md:313, 6d12a7929f9a)
• Existing tool schema already documents jpeg/webp compression: The tool schema describes openai.outputCompression as OpenAI jpeg/webp compression, so the PR aligns provider request shaping with the existing user-facing parameter description. (src/agents/tools/image-generate-tool.ts:180, c38a9a883ab5)

Likely related people:

• ottodeng: The merged OpenAI image options PR introduced outputCompression types, forwarding, docs, and tests in commit de3f3b8f931928acfb0da24ce0670ab12d89d988. (role: introduced output option surface; confidence: high; commits: de3f3b8f9319; files: extensions/openai/image-generation-provider.ts, extensions/openai/image-generation-provider.test.ts, src/image-generation/types.ts)
• Shakker: git blame on the current main output_compression call sites points at commit a10e152519cfb75654daccf3733a47df22c4dc87, which carried the current provider file content in this checkout. (role: current-line provenance; confidence: medium; commits: a10e152519cf; files: extensions/openai/image-generation-provider.ts, src/image-generation/types.ts)
• steipete: Peter Steinberger co-authored the merged OpenAI image option commit and committed the latest PR-head adjustments, making him a useful routing candidate for this provider-local fix. (role: recent adjacent contributor; confidence: medium; commits: de3f3b8f9319, 7c4ef48ec9be, 636b6a53d2b8; files: extensions/openai/image-generation-provider.ts, extensions/openai/image-generation-provider.test.ts, docs/tools/image-generation.md)

Codex review notes: model gpt-5.5, reasoning high; reviewed against c38a9a883ab5.

[clawsweeper]

ClawSweeper PR egg

✨ Hatched: 🥚 common Pearl Clawlet

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

• Merged PRs are hatchable.
• Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
• Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: finds missing screenshots.
Image traits: location branch lighthouse; accessory tiny test log scroll; palette moss green and polished brass; mood determined; pose nestled inside a glowing shell; shell paper lantern shell; lighting calm overcast light; background quiet workflow signs.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Pearl Clawlet in ClawSweeper.

What is this egg doing here?

• Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
• The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
• Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
• The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
• Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.