Bug: tool-call envelope leaked into assistant text + occasional lottery/ads injection

Bug: Tool-call envelope leaks into assistant text (+ occasional off-topic injection like lottery/ads)

What version of Codex CLI is running?

@openai/codex dependency in app: ^0.106.0

Which model were you using?

gpt-5.3-codex (observed in local leak logs)

What platform is your computer?

macOS (Apple Silicon)

What issue are you seeing?

In GUI integration (Codex embedded via app-server/SDK), the assistant occasionally outputs tool-call envelope text as normal chat content, for example:

assistant to=functions.exec_command commentary json
{"cmd":"cat > backend/src/main/java/.../AuthController.java ..."}

This should be emitted as structured tool events (item.started/item.completed) rather than visible assistant message text.

Additionally, there are intermittent off-topic/injected fragments reported by users (e.g. unrelated lottery/ads-like strings such as “中彩票/买彩票”), mixed into normal output.

Reproduction

1. Start a long coding turn with continuous follow-up prompts like 继续.
2. Let the model execute multiple tool calls (exec_command, file writes, tests).
3. Occasionally, the UI receives leaked envelope text and renders it as assistant content.

Expected behavior

• Tool calls are always represented as structured tool events only.
• Assistant text should never include tool-call envelope/protocol text.
• No unrelated injection text (lottery/ads) should appear.

Actual behavior

• Rarely, assistant text includes protocol-like strings:
• assistant to=functions.exec_command ...
• recipient_name: functions.exec_command ...
• In some sessions, off-topic injection text can also appear.

Evidence

• Local leak log file:
• /Users/wlkjyy/Downloads/11111/跑腿/.vibe/logs/codex-tool-envelope-leak.jsonl
• Example fields from leak entries:
• leakMarker: "assistant_to_functions"
• model: "gpt-5.3-codex"
• hadToolActivity: true
• hadToolFailure: false
• hadErrorEvent: false
• Sample leaked snippet:
• assistant to=functions.exec_command ... {"cmd":"cat > ..."}
• Additional leaked sample (same session style):
• ...注册与安全配置已补完...完成后会直接联调前端并跑测试。assistant to=functions.exec_command ... {"cmd":"cat > backend/src/main/java/com/vibeide/backend/module/auth/controller/AuthController.java ..."}

Notes

I understand similar reports were previously labeled as model-behavior (e.g. #11688, #11966). Reporting this again because the tool-envelope leakage still surfaces in real usage and harms UX/reliability in embedded GUI clients.

If needed, I can provide thread/session IDs and additional logs.