ChatGPT OAuth agents fail text turns when native image_generation tool is attached

What to build

Fix ChatGPT Subscription (OAuth) agent runs so ordinary text turns do not fail when native image_generation support is available.

On a v3.14.0 deployment using a ChatGPT OAuth provider (chatgpt_oauth) and an agent configured with gpt-5.5, a simple text message to the agent can fail before any useful answer is persisted. The failure has two related parts:

1. The agent loop injects the native Responses API tool sentinel:

   { "type": "image_generation" }
   

   into normal text chat turns whenever the provider advertises image generation capability.

2. Several tool-processing paths assume every tool definition is a function tool and dereference td.Function.Name. Native tools have Function == nil, so this can panic.

Observed stack traces included nil pointer panics in paths such as:

• internal/agent/loop_pipeline_callbacks.go while counting or checking tool names
• internal/pipeline/think_stage.go while building AllowedTools

After adding local nil guards, the request no longer panicked, but ChatGPT OAuth still returned an upstream 500 for a simple text turn when the native image_generation tool was included. Disabling image generation for that agent via:

{
  "allow_image_generation": false
}

made the same agent reply successfully.

Acceptance criteria

• Native provider tools with Function == nil never panic the agent loop, pipeline, tool filtering, history metadata, tracing, or retry guard paths.
• Ordinary text-only turns for ChatGPT OAuth agents do not attach image_generation unless image generation is explicitly requested or otherwise intentionally enabled for that turn.
• If allow_image_generation remains the control, document it and/or expose it in agent/provider settings so admins can disable the native image tool without editing hidden JSON.
• Add regression tests covering a tool list that contains both a function tool and { "type": "image_generation" }.
• Add a regression test or fixture showing a ChatGPT OAuth text turn does not include image_generation by default.

Reproduction notes

Environment:

• GoClaw v3.14.0
• DB schema 80
• Provider type: chatgpt_oauth
• Model: gpt-5.5
• Agent: predefined agent using the ChatGPT OAuth provider

Minimal request:

curl http://localhost:18790/v1/chat/completions \
  -H "Authorization: Bearer $GOCLAW_GATEWAY_TOKEN" \
  -H "X-GoClaw-User-Id: system" \
  -H "X-GoClaw-Tenant-Id: <tenant-id>" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "agent:rook",
    "messages": [{"role": "user", "content": "xin chào"}],
    "stream": false,
    "user": "system"
  }'

Observed behavior before local workaround:

• HTTP connection can close with an empty reply due to panic.
• After nil guards, the request can return a structured 500 from the ChatGPT OAuth backend when image_generation is still attached to the text turn.
• Session history may remain at 0 messages because the turn fails before final persistence.

Observed workaround:

• Set other_config.allow_image_generation=false for the affected agent.
• Recreate/restart the service so the agent config is reloaded.
• The same text request returns HTTP 200 and persists user+assistant messages.

Blocked by

None - can start immediately.

Start by reproducing the ChatGPT OAuth text request with the supplied curl command, then inspect internal/agent/loop_pipeline_callbacks.go and internal/pipeline/think_stage.go for handling of native tools. Trace the image_generation attachment and tool-name checks across the listed agent paths. Done means no nil panics, no native image tool on ordinary text turns by default, and regression coverage for mixed tools and OAuth text requests.