@bitkyc08/opencodex 2.54.0-preview.20260914 → 2.55.0-preview.20260914

package/src/adapters/kiro-events.ts

@@ -66,6 +66,24 @@ function tokenCount(eventType: string, obj: Record<string, unknown>, key: string
   return value;
 }
 
+/**
+ * A cache counter Kiro did not report, kept as unknown rather than zero (#4546).
+ *
+ * `OcxUsage` omits cache fields it has no reading for, and `cacheHitRate` is null when
+ * unobserved -- the convention everywhere except here. Coercing an absent counter to 0 makes
+ * "the provider said nothing" indistinguishable from "nothing was cached", which is the
+ * difference between a routing change that preserved the prompt cache and one that destroyed
+ * it. A malformed value is still a malformed event; only absence is unknown.
+ */
+function optionalTokenCount(
+  eventType: string,
+  obj: Record<string, unknown>,
+  key: string,
+): number | undefined {
+  if (obj[key] === undefined) return undefined;
+  return tokenCount(eventType, obj, key, true);
+}
+
 function parseTokenUsage(eventType: string, value: unknown): OcxUsage | undefined {
   if (value === undefined || value === null) return undefined;
   if (typeof value !== "object" || Array.isArray(value)) {
@@ -73,19 +91,20 @@ function parseTokenUsage(eventType: string, value: unknown): OcxUsage | undefine
   }
   const usage = value as Record<string, unknown>;
   const uncached = tokenCount(eventType, usage, "uncachedInputTokens", true);
-  const cacheRead = tokenCount(eventType, usage, "cacheReadInputTokens", false);
-  const cacheWrite = tokenCount(eventType, usage, "cacheWriteInputTokens", false);
+  const cacheRead = optionalTokenCount(eventType, usage, "cacheReadInputTokens");
+  const cacheWrite = optionalTokenCount(eventType, usage, "cacheWriteInputTokens");
   const outputTokens = tokenCount(eventType, usage, "outputTokens", true);
   const totalTokens = tokenCount(eventType, usage, "totalTokens", true);
-  const inputTokens = uncached + cacheRead + cacheWrite;
+  // An unreported counter contributes nothing to the total, which is a different statement
+  // from claiming it was measured as zero.
+  const inputTokens = uncached + (cacheRead ?? 0) + (cacheWrite ?? 0);
   if (!Number.isSafeInteger(inputTokens)) return malformed(eventType, "input token usage overflowed");
   return {
     inputTokens,
     outputTokens,
     totalTokens,
-    cachedInputTokens: cacheRead,
-    cacheReadInputTokens: cacheRead,
-    cacheCreationInputTokens: cacheWrite,
+    ...(cacheRead !== undefined ? { cachedInputTokens: cacheRead, cacheReadInputTokens: cacheRead } : {}),
+    ...(cacheWrite !== undefined ? { cacheCreationInputTokens: cacheWrite } : {}),
   };
 }
 

package/src/adapters/kiro-images.ts

@@ -35,6 +35,36 @@ export function extractKiroImages(content: string | OcxContentPart[]): KiroImage
   return out;
 }
 
+/**
+ * Count images Kiro cannot inline, so the loss is never silent.
+ *
+ * Kiro's wire carries base64 bytes only, so a remote reference genuinely cannot be
+ * sent, and this proxy does not fetch one on a request path. Such a part used to be
+ * dropped with neither bytes nor any trace that an attachment existed. Counting them
+ * lets the payload builder attach a bounded marker instead.
+ *
+ * The count is all that crosses: a remote image URL can carry a signed token, so the
+ * URL itself is never echoed into prose.
+ */
+export function countKiroUninlinableImages(content: string | OcxContentPart[]): number {
+  if (typeof content === "string") return 0;
+  let count = 0;
+  for (const p of content) {
+    if (p.type !== "image") continue;
+    // Keyed on the scheme, not on parse success: a malformed data URL also fails
+    // parseDataUrlImage, and labelling that "remote reference" would misstate the cause.
+    if (!p.imageUrl.startsWith("data:")) count++;
+  }
+  return count;
+}
+
+/** Bounded, content-free marker for images Kiro could not inline. */
+export function kiroUninlinableImageMarker(count: number): string {
+  if (count <= 0) return "";
+  if (count === 1) return "[image omitted: remote image references are not supported by this provider]";
+  return "[" + String(count) + " images omitted: remote image references are not supported by this provider]";
+}
+
 /**
  * Conservative POLICY caps for the CodeWhisperer GenerateAssistantResponse payload,
  * whose limits are undocumented. Derived from adjacent AWS surfaces

package/src/adapters/kiro-retry.ts

@@ -5,6 +5,7 @@ import { readBoundedResponseBody } from "../lib/bounded-body";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import { parseRetryAfterMs } from "../combos";
 import {
+  SendBudgetExhaustedError,
   abortError,
   cancelResponseBodyBestEffort,
   fetchWithAttemptDeadline,
@@ -162,6 +163,13 @@ async function fetchWithResetRecovery(
   let lastError: unknown;
   for (let attempt = 0; attempt < RESET_ATTEMPTS; attempt++) {
     if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
+    // Every physical send is admitted, not just the adapter entry. Kiro nests a throttle loop
+    // over this ladder and can run the ladder twice per throttle round, so counting one entry
+    // as one send hid up to eighteen upstream requests from the per-request cap (#4546).
+    const decision = ctx.sendBudget?.reserveDispatch({ sendClass: "transient", targetKey: url });
+    if (decision && (!decision.allowed || !decision.permit.use())) {
+      throw new SendBudgetExhaustedError(url);
+    }
     try {
       const headers = new Headers(request.headers);
       const recovered = attempt > 0;

package/src/adapters/openai-chat.ts

@@ -108,6 +108,17 @@ function openAIChatTransport(provider: OcxProviderConfig): {
   return { url, headers, hasCredential };
 }
 
+/**
+ * The translated Chat route has no video mapping: this adapter does not implement one,
+ * and the marker records that fact so the payload is not dropped in silence.
+ *
+ * The wording is deliberately about opencodex's own translation, not the provider or
+ * model. An earlier revision said "unsupported by this provider", which attributed an
+ * opencodex mapping limit to upstream capability the proxy has not established. Native
+ * Chat passthrough and Google inline video are unaffected by this route.
+ */
+const VIDEO_UNSUPPORTED_MARKER = "[video omitted: the translated Chat route has no video mapping]";
+
 /**
  * Build a provider request from an inbound Chat Completions body without translating it
  * through the Responses contract. This is deliberately a whitelist: Chat-only caller
@@ -784,11 +795,29 @@ function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProviderCon
         } else if (typeof msg.content === "string") {
           chatMsg = { role: "user", content: msg.content };
         } else if (!hasImages) {
-          chatMsg = { role: "user", content: parts!.map(p => (p as OcxTextContent).text).join("") };
+          // A video part has no `text`, so joining it produced "" and the whole message
+          // was dropped: a video-only or text-plus-video turn vanished silently. OpenAI's
+          // Chat Completions wire has no video content part, so state the omission
+          // instead of losing it. Scoped to this adapter's wire, not a claim about video
+          // support in general — native Chat passthrough and Google inline video are
+          // unaffected.
+          chatMsg = {
+            role: "user",
+            content: parts!.map(p => (p.type === "video"
+              ? VIDEO_UNSUPPORTED_MARKER
+              : (p as OcxTextContent).text)).join(""),
+          };
         } else {
-          const chatParts = parts!.map(p => p.type === "image"
-            ? { type: "image_url", image_url: { url: p.imageUrl, ...(p.detail ? { detail: p.detail } : {}) } }
-            : { type: "text", text: (p as OcxTextContent).text });
+          const chatParts = parts!.map(p => {
+            if (p.type === "image") {
+              return { type: "image_url", image_url: { url: p.imageUrl, ...(p.detail ? { detail: p.detail } : {}) } };
+            }
+            // Previously this produced { type: "text", text: undefined } for a video
+            // part — a malformed part, worse than a drop because it can fail upstream
+            // schema validation.
+            if (p.type === "video") return { type: "text", text: VIDEO_UNSUPPORTED_MARKER };
+            return { type: "text", text: (p as OcxTextContent).text };
+          });
           chatMsg = { role: "user", content: chatParts };
         }
         if (pendingToolCalls.length > 0) deferredBarrierMessages.push(chatMsg);

package/src/adapters/openai-responses.ts

@@ -1285,6 +1285,31 @@ function stripUnsupportedForwardParams(body: unknown): unknown {
   return rest;
 }
 
+/** Sampling controls the canonical ChatGPT backend rejects; other forward gateways accept them. */
+const CANONICAL_FORWARD_UNSUPPORTED_SAMPLING = ["temperature", "top_p", "stop", "user"] as const;
+
+/**
+ * Remove sampling controls only the canonical ChatGPT backend rejects.
+ *
+ * A translated Chat turn used to lose these at the Chat ingress for every provider on
+ * the `openai-responses` adapter, which silently discarded caller intent on generic
+ * key gateways that accept them. Deciding at the ingress was also unsound for combo
+ * and policy routes, whose concrete child is chosen later — so the decision belongs
+ * here, on the provider that actually receives the body.
+ *
+ * Returns a copy and never mutates, so `parsed._rawBody` stays caller-owned, and
+ * no-ops when the body carries none of these keys.
+ */
+export function stripCanonicalForwardSamplingParams(body: unknown): unknown {
+  if (!isPlainObject(body)) return body;
+  if (!CANONICAL_FORWARD_UNSUPPORTED_SAMPLING.some(key => Object.prototype.hasOwnProperty.call(body, key))) {
+    return body;
+  }
+  const next: Record<string, unknown> = { ...body };
+  for (const key of CANONICAL_FORWARD_UNSUPPORTED_SAMPLING) delete next[key];
+  return next;
+}
+
 /** Return the lossless text represented by one system message, or null when it is multimodal. */
 function canonicalForwardSystemText(item: Record<string, unknown>): string | null {
   const content = item.content;
@@ -2254,6 +2279,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         // Only the canonical ChatGPT backend rejects the retired field; a self-hosted or
         // third-party forward gateway may still accept it, so this must not be widened.
         if (isCanonicalOpenAiForwardProvider(provider)) {
+          outBody = stripCanonicalForwardSamplingParams(outBody);
           outBody = stripDeprecatedPromptCacheRetention(outBody, parsed.modelId);
           outBody = stripCanonicalForwardPromptCacheOptions(outBody);
           outBody = normalizeCanonicalForwardPromptEnvelope(outBody);

package/src/adapters/registry.ts

@@ -15,6 +15,7 @@ import { createOllamaNativeAdapter } from "./ollama-native";
 import { createResponsesPassthroughAdapter } from "./openai-responses";
 import type { OcxProviderConfig } from "../types";
 import { createAdapterTierMetadata } from "../providers/fastwire";
+import { withInputMediaGuard } from "./input-media-guard";
 
 export type AdapterCacheRetention = "none" | "short" | "long";
 
@@ -180,6 +181,9 @@ export function createRegisteredAdapter(
   const definition = getAdapterDefinition(provider.adapter);
   if (!definition) throw new Error(`Unknown adapter: ${provider.adapter}`);
   const adapter = definition.create(provider, context);
+  if (effectiveAdapterContract(provider.adapter).wire !== "openai-responses") {
+    withInputMediaGuard(adapter);
+  }
   const buildRequest = adapter.buildRequest.bind(adapter);
   adapter.buildRequest = (parsed, incoming) => {
     const attachTierMetadata = (request: Awaited<ReturnType<ProviderAdapter["buildRequest"]>>) => {