Greptile Summary

This PR routes image generation requests from the OpenAI, MiniMax, and fal providers through the shared resolveProviderHttpRequestConfig + postJsonRequest transport layer, bringing custom base URL normalization, SSRF-guarded private-network routing, and provider header merging into alignment with the rest of the provider HTTP stack. It also makes timeoutMs optional in postTranscriptionRequest / postJsonRequest and threads an auditContext parameter through the same functions.

Key changes:

• OpenAI and MiniMax image providers replace manual fetch + AbortController timeout logic with postJsonRequest, and delegate URL normalization and header shaping to resolveProviderHttpRequestConfig.
• fal image provider follows the same pattern; resolveFalNetworkPolicy is refactored to accept pre-resolved { baseUrl, allowPrivateNetwork } instead of re-reading config itself.
• shared.ts makes timeoutMs optional (backward-compatible) and adds an auditContext option to both postTranscriptionRequest and postJsonRequest.
• A new regression test file covers MiniMax image generation end-to-end.

The previously flagged issue (MiniMax discarding the baseUrl returned by resolveProviderHttpRequestConfig) has been addressed — resolvedBaseUrl is correctly destructured and used.

One issue found: the new auditContext parameter added to postJsonRequest and postTranscriptionRequest is silently dropped whenever allowPrivateNetwork is false and dispatcherPolicy is undefined (the common case), because the entire options object collapses to undefined under that condition. The guard condition needs to include auditContext as a third disjunct.

Confidence Score: 4/5

• Safe to merge after fixing the auditContext guard condition in postJsonRequest and postTranscriptionRequest; no current callers are affected but the broken API contract should be corrected before the parameter is used.
• The core routing change is correct and the previous critical bug (discarded baseUrl in MiniMax) has been fixed. The one remaining P1 is that the newly-introduced auditContext parameter in postJsonRequest/postTranscriptionRequest is silently dropped on the common non-private-network path due to a missing disjunct in the options guard. No current callers are impacted yet, but the broken API surface warrants a fix before the PR lands.
• src/media-understanding/shared.ts — the auditContext guard condition in both postJsonRequest and postTranscriptionRequest

This is a comment left during a code review.
Path: src/media-understanding/shared.ts
Line: 141-147

Comment:
**`auditContext` silently dropped when `allowPrivateNetwork` and `dispatcherPolicy` are both falsy**

The `auditContext` parameter is added to the function signature but will be silently ignored whenever `allowPrivateNetwork` is `false` **and** `dispatcherPolicy` is `undefined` — which is the common (non-private-network) path. The ternary condition selects `undefined` as the entire options object in that case, so `auditContext` never reaches `fetchWithSsrFGuard`.

Any future caller that passes `auditContext` to a standard (non-private-network) `postJsonRequest` call will get no audit trail without any error or warning.

The same issue exists in the parallel block of `postTranscriptionRequest` (lines 112–118).

Fix both by including `auditContext` in the guard condition:

```suggestion
    params.allowPrivateNetwork || params.dispatcherPolicy || params.auditContext
      ? {
          ...(params.allowPrivateNetwork ? { ssrfPolicy: { allowPrivateNetwork: true } } : {}),
          ...(params.dispatcherPolicy ? { dispatcherPolicy: params.dispatcherPolicy } : {}),
          ...(params.auditContext ? { auditContext: params.auditContext } : {}),
        }
      : undefined,
```

The same one-line change is needed in `postTranscriptionRequest` at line 112.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (2): Last reviewed commit: "fix(providers): use normalized minimax i..." | Re-trigger Greptile}

@greptileai review

🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

const detail = await readErrorResponse(res);
const suffix = detail ? `: ${detail}` : "";
throw new Error(`${label} (HTTP ${res.status})${suffix}`);

function sanitizeErrorDetail(detail: string): string {
  return detail
    .replace(/\p{Cc}+/gu, " ")  // remove control chars (includes \x1b)
    .replace(/\s+/g, " ")
    .trim();
}

​// ...
const rawDetail = await readErrorResponse(res);
const detail = rawDetail ? sanitizeErrorDetail(rawDetail) : undefined;

Analyzed PR: #59729 at commit 726deee

_{Last updated on: 2026-04-02T15:54:30Z}