@bitkyc08/opencodex 2.54.0 → 2.55.0

package/src/adapters/cursor/native-exec.ts

@@ -53,6 +53,8 @@ import {
 import { clientBytes, execBytes, execStreamCloseBytes, execThrowBytes } from "./native-exec-common";
 import type { McpToolDefinition } from "./gen/agent_pb";
 import { OCX_RESPONSES_TOOL_PROVIDER } from "./tool-definitions";
+import { cursorRequestHasExecutionPath, cursorRequestHasShellAlias, cursorToolWireName } from "./tool-naming";
+import type { OcxTool } from "../../types";
 
 export type CursorNativeExecDeps = CursorNativeNetworkDeps & CursorNativeToolDeps;
 
@@ -72,6 +74,45 @@ export interface CursorNativeExecContext extends CursorNativeExecDeps {
   rejectNativeFileMutations?: boolean;
   /** The synthetic exact-match edit tools (edit_file / multi_edit) are advertised this request. */
   structuredEditAvailable?: boolean;
+  /** Catalog-aware redirect text for denied native fs/shell attempts (undefined = default bridge wording). */
+  nativeExecRedirectHint?: string;
+}
+
+const REDIRECT_HINT_MAX_TOOLS = 16;
+
+/**
+ * Redirect text for Cursor-native fs/shell/fetch attempts when the request catalog carries NO shell
+ * bridge or other execution-path tool (an orchestrator client that only exposes delegation tools,
+ * for example). The default refusal steers the model to `shell_command` / `exec_command`; when those
+ * are not in the catalog some models (kimi-k3 observed) conclude every tool is unavailable and give
+ * up instead of using the tools that ARE listed. Name the real catalog instead — the client tools
+ * plus any configured MCP tools advertised this turn — and stay neutral about what those tools can
+ * do, so a listed file/search/fetch tool is never contradicted.
+ */
+export function cursorNativeExecRedirectHint(
+  tools: readonly Pick<OcxTool, "namespace" | "name">[] | undefined,
+  mcpToolDefs: readonly Pick<McpToolDefinition, "name" | "providerIdentifier">[] = [],
+): string | undefined {
+  const clientTools = tools ?? [];
+  if (cursorRequestHasShellAlias(clientTools) || cursorRequestHasExecutionPath(clientTools)) return undefined;
+  // Client tools are advertised under OCX_RESPONSES_TOOL_PROVIDER, so the harness shows them as
+  // `mcp_<provider>_<wire name>`; configured MCP servers are advertised under their own provider id.
+  // A request with no client tools but configured MCP tools still gets those named; a request that
+  // advertises nothing at all keeps the default bridge wording.
+  const names = [...new Set([
+    ...clientTools.map(cursorToolWireName),
+    ...mcpToolDefs.map(def => `mcp_${def.providerIdentifier}_${def.name}`),
+  ])];
+  if (names.length === 0) return undefined;
+  const shown = names.slice(0, REDIRECT_HINT_MAX_TOOLS).map(name => `\`${name}\``).join(", ");
+  const more = names.length > REDIRECT_HINT_MAX_TOOLS ? ` (+${names.length - REDIRECT_HINT_MAX_TOOLS} more)` : "";
+  return (
+    `Re-issue this operation NOW through one of the tools listed in this request's catalog: ${shown}${more} `
+    + `(the harness displays a \`${OCX_RESPONSES_TOOL_PROVIDER}\` entry as \`mcp_${OCX_RESPONSES_TOOL_PROVIDER}_<name>\`; that is the same tool). `
+    + "Cursor-native Read/Glob/Grep/LS/Shell/Write/Fetch are not part of this request's catalog; do not retry them. "
+    + "Pick the listed tool that fits the operation — a listed file, search, or fetch tool if there is one, otherwise the listed tool that delegates work to a worker agent. "
+    + "Do NOT narrate this redirect, do NOT comment on tool availability, and do NOT re-announce the task — just make the catalog tool call."
+  );
 }
 
 export function cursorUnsafeNativeLocalExecEnabled(input: Pick<CursorNativeExecContext, "unsafeAllowNativeLocalExec"> = {}): boolean {
@@ -634,16 +675,16 @@ export async function handleCursorNativeExec(execMsg: ExecServerMessage, deps: C
     }))];
   }
   if (!cursorUnsafeNativeLocalExecEnabled(deps)) {
-    if (execCase === "readArgs") return [rejectReadExecForPolicy(execMsg)];
-    if (execCase === "writeArgs") return [rejectWriteExecForPolicy(execMsg)];
-    if (execCase === "deleteArgs") return [rejectDeleteExecForPolicy(execMsg)];
-    if (execCase === "lsArgs") return [rejectLsExecForPolicy(execMsg)];
-    if (execCase === "grepArgs") return [rejectGrepExecForPolicy(execMsg)];
-    if (execCase === "shellArgs") return [rejectShellExecForPolicy(execMsg)];
-    if (execCase === "shellStreamArgs") return rejectShellStreamExecForPolicy(execMsg);
-    if (execCase === "backgroundShellSpawnArgs") return [rejectBackgroundShellSpawnExecForPolicy(execMsg)];
-    if (execCase === "writeShellStdinArgs") return [rejectWriteShellStdinExecForPolicy(execMsg)];
-    if (execCase === "fetchArgs") return [rejectFetchExecForPolicy(execMsg)];
+    if (execCase === "readArgs") return [rejectReadExecForPolicy(execMsg, deps.nativeExecRedirectHint)];
+    if (execCase === "writeArgs") return [rejectWriteExecForPolicy(execMsg, deps.nativeExecRedirectHint)];
+    if (execCase === "deleteArgs") return [rejectDeleteExecForPolicy(execMsg, deps.nativeExecRedirectHint)];
+    if (execCase === "lsArgs") return [rejectLsExecForPolicy(execMsg, deps.nativeExecRedirectHint)];
+    if (execCase === "grepArgs") return [rejectGrepExecForPolicy(execMsg, deps.nativeExecRedirectHint)];
+    if (execCase === "shellArgs") return [rejectShellExecForPolicy(execMsg, deps.nativeExecRedirectHint)];
+    if (execCase === "shellStreamArgs") return rejectShellStreamExecForPolicy(execMsg, deps.nativeExecRedirectHint);
+    if (execCase === "backgroundShellSpawnArgs") return [rejectBackgroundShellSpawnExecForPolicy(execMsg, deps.nativeExecRedirectHint)];
+    if (execCase === "writeShellStdinArgs") return [rejectWriteShellStdinExecForPolicy(execMsg, deps.nativeExecRedirectHint)];
+    if (execCase === "fetchArgs") return [rejectFetchExecForPolicy(execMsg, deps.nativeExecRedirectHint)];
   }
   if (execCase === "readArgs") return [readExec(execMsg)];
   if (execCase === "writeArgs") return [deps.rejectNativeFileMutations ? rejectWriteExecForApplyPatch(execMsg, deps.structuredEditAvailable === true) : writeExec(execMsg)];

package/src/adapters/cursor/policy-error.ts

@@ -0,0 +1,75 @@
+import { BinaryReader, WireType } from "@bufbuild/protobuf/wire";
+
+const POLICY_TITLE = "Review Data Policy";
+const POLICY_DETAIL = "You must acknowledge Claude Fable 5's data retention policy to use the model.";
+const POLICY_REVIEW_URL = "https://cursor.com/dashboard/restricted_models/claude-fable-5";
+const MAX_VALUE_CHARS = 16_384;
+const MAX_FIELDS = 128;
+
+/**
+ * Minimal read-only projection of Cursor's aiserver.v1.ErrorDetails:
+ * error=1 (MODEL_BLOCKED=58), details=2; CustomErrorDetails title=1, detail=2.
+ * Verified against the native CLI schema and the #4508 Connect binary response.
+ * Skip buttons, URLs, analytics and dashboardAction rather than interpreting them.
+ */
+function isFablePolicyError(bytes: Uint8Array, custom = false): boolean {
+  const reader = new BinaryReader(bytes);
+  let error: number | undefined;
+  let details: Uint8Array | undefined;
+  let title: string | undefined;
+  let detail: string | undefined;
+  let fields = 0;
+  while (reader.pos < reader.len) {
+    if (++fields > MAX_FIELDS) return false;
+    const [field, wire] = reader.tag();
+    // Groups are not part of this proto3 projection; avoid recursive unknown-field skips.
+    if (wire === WireType.StartGroup || wire === WireType.EndGroup) return false;
+    if (!custom && field === 1) {
+      if (wire !== WireType.Varint || error !== undefined) return false;
+      error = reader.uint32();
+    } else if (!custom && field === 2) {
+      if (wire !== WireType.LengthDelimited || details !== undefined) return false;
+      details = reader.bytes();
+    } else if (custom && (field === 1 || field === 2)) {
+      if (wire !== WireType.LengthDelimited) return false;
+      const value = reader.bytes();
+      if (value.length > 256) return false;
+      const text = new TextDecoder("utf-8", { fatal: true }).decode(value);
+      if (field === 1) {
+        if (title !== undefined) return false;
+        title = text;
+      } else {
+        if (detail !== undefined) return false;
+        detail = text;
+      }
+    } else {
+      reader.skip(wire);
+    }
+  }
+  return custom
+    ? title === POLICY_TITLE && detail === POLICY_DETAIL
+    : error === 58 && details !== undefined && isFablePolicyError(details, true);
+}
+
+/** Recognize this policy gate, but never forward arbitrary upstream text or consent actions. */
+export function cursorPolicyErrorExplanation(error: unknown): string | undefined {
+  if (!error || typeof error !== "object") return undefined;
+  const envelope = error as { code?: unknown; details?: unknown };
+  if (envelope.code !== "failed_precondition" || !Array.isArray(envelope.details)) return undefined;
+  for (const entry of envelope.details.slice(0, 8)) {
+    if (!entry || typeof entry !== "object") continue;
+    const { type, value } = entry as { type?: unknown; value?: unknown };
+    if (type !== "aiserver.v1.ErrorDetails" || typeof value !== "string"
+      || value.length === 0 || value.length > MAX_VALUE_CHARS
+      || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)) continue;
+    try {
+      const bytes = Buffer.from(value, "base64");
+      if (bytes.toString("base64").replace(/=+$/, "") !== value.replace(/=+$/, "")) continue;
+      if (isFablePolicyError(bytes)) {
+        // Code-owned copy cannot inject credentials or alter downstream keyword classification.
+        return `${POLICY_TITLE}: ${POLICY_DETAIL} Review and accept using the same Cursor account at ${POLICY_REVIEW_URL}, then retry.`;
+      }
+    } catch { /* Unknown/malformed details retain the existing generic Connect error. */ }
+  }
+  return undefined;
+}

package/src/adapters/cursor/protobuf-request.ts

@@ -325,7 +325,12 @@ function rootPromptMessages(
       const replacement = rootBlobCandidate(
         { role: payload.role, content: [{ type: "text", text: marked }] },
         role,
-        { ...opts, messageIndex: previous.entry.messageIndex ?? opts.messageIndex },
+        // `text` must mirror the payload actually stored, not the unmarked text it was built from.
+        // It did not, and every consumer that rebuilds a root from `text` therefore dropped the run
+        // note: truncating a collapsed root silently deleted the "produced N times" line, and so did
+        // the invocation-argument restoration below. The note is the repetition breaker's per-entry
+        // half, so losing it re-primes the self-reinforcing loop the breaker exists to end.
+        { ...opts, text: marked, messageIndex: previous.entry.messageIndex ?? opts.messageIndex },
       );
       entries[entries.indexOf(previous.entry)] = replacement;
       replayRuns.set(role, { text: normalized, entry: replacement, length: runLength });
@@ -694,6 +699,20 @@ function rootPromptMessages(
     historyMessageStart = firstKept?.messageIndex ?? (messages.length);
   }
 
+  // Refund envelope bytes the assembled set left unused to invocation arguments the per-call cap
+  // clipped. Gated on `echoToolResultInRoot`, not `externalModel`: native `composer-2.5` echoes its
+  // results into roots without being an external wire model, so the narrower gate would leave the one
+  // native model that has clipped invocation lines capped for no reason (#4516).
+  if (echoToolResultInRoot && replayedCalls) {
+    selected = restoreClippedInvocationArguments(
+      selected,
+      messages,
+      replayedCalls,
+      knownCallsOffset,
+      carriedRoots.byteLength,
+    );
+  }
+
   return {
     ids: selected.map(entry => storeCursorBlob(entry.data, requestScope)),
     byteLength: selected.reduce((sum, entry) => sum + entry.byteLength, 0),
@@ -967,6 +986,91 @@ function toolInvocationLine(call: Extract<OcxAssistantContentPart, { type: "tool
   return `invoked: ${namespacedToolName(call.namespace, call.name)} with ${toolCallArgumentsText(call.arguments)}`;
 }
 
+/**
+ * Second pass over the assembled root set: spend envelope bytes nothing else claimed on invocation
+ * arguments the per-call cap clipped.
+ *
+ * `CURSOR_INVOCATION_ARGUMENTS_BYTE_LIMIT` is charged while the envelope is still being built, so it
+ * costs a call 2 KiB whether or not anything else wants those bytes. In a small replay nearly the
+ * whole 192-root / 512 KiB envelope goes unused and the cap still bites: a 4,693-byte successful
+ * `write_file` lost its tail inside a 6,011-byte replay, and because the result text does not repeat
+ * the argument, the model could no longer see what it had just written (#4516).
+ *
+ * The cap stays, and admission is still decided on its 2 KiB prefix — it is what keeps a 600 KiB
+ * argument from evicting the output it describes. This pass only refunds leftover aggregate bytes,
+ * after every pruning and truncation decision is already final:
+ *
+ * - newest `toolResult` first, because the argument the model is most likely to still need is the
+ *   one belonging to the call it just made;
+ * - only out of `spare`, so restoring can never push the envelope past its own limit;
+ * - never for an `outputElided` root, whose own output is already gone — widening the invocation
+ *   there would spend the last free bytes describing an answer that is not present;
+ *   this guard is load bearing, and it is not reachable the obvious way. Truncation undershoots
+ *   its own budget by ~28 bytes, far less than a restoration costs, so a root that was merely
+ *   truncated cannot pay. What pays is initiator recovery: after the equal-share pass elides a
+ *   trailing run, recovery drops an elided sibling to fit the user turn, and the bytes it frees
+ *   become spare. It needs the share to land in a narrow window — wide enough that the clipped
+ *   invocation line survives, narrow enough that `output:` does not — and outside it the
+ *   clipped-line lookup below declines the root first. `the skip refuses to widen an elided root
+ *   even when spare would pay` pins a measured instance;
+ * - never by dropping, shrinking or reordering another root, so nothing pruning chose to keep is
+ *   evicted to pay for a wider invocation line.
+ */
+function restoreClippedInvocationArguments(
+  selected: RootBlobCandidate[],
+  messages: readonly OcxMessage[],
+  replayedCalls: Map<string, Extract<OcxAssistantContentPart, { type: "toolCall" }>>,
+  knownCallsOffset: number,
+  carriedBytes: number,
+): RootBlobCandidate[] {
+  let spare = CURSOR_EXTERNAL_ROOT_BYTE_LIMIT
+    - carriedBytes
+    - selected.reduce((sum, entry) => sum + entry.byteLength, 0);
+  if (spare <= 0) return selected;
+  const restored = [...selected];
+  for (let i = restored.length - 1; i >= 0 && spare > 0; i--) {
+    const entry = restored[i];
+    if (!entry || entry.role !== "toolResult" || entry.outputElided === true) continue;
+    if (entry.text === undefined || entry.messageIndex === undefined) continue;
+    const message = messages[entry.messageIndex];
+    if (message?.role !== "toolResult") continue;
+    // Same full-history bound the envelope builder used: `messageIndex` is local to this call's
+    // `rawMessages`, and `knownCallsOffset` re-bases it when only a suffix is replayed.
+    const call = callBefore(
+      replayedCalls,
+      decodeCursorCallId(message.toolCallId),
+      knownCallsOffset + entry.messageIndex,
+    );
+    if (!call) continue;
+    const full = serializeToolCallArguments(call.arguments);
+    if (full === undefined) continue;
+    const clipped = toolCallArgumentsText(call.arguments);
+    if (clipped === full) continue;
+    const name = namespacedToolName(call.namespace, call.name);
+    // Anchored on the preceding newline. `toolResultToText` always emits the invocation after the
+    // `[tool_result]`, `call_id:` and `name:` lines, so the real line is never first — and
+    // `name:` renders the RESULT's tool name, which nothing sanitizes, so an unanchored search could
+    // be satisfied by a crafted tool name and rewrite that header instead of the invocation.
+    const clippedLine = `\ninvoked: ${name} with ${clipped}`;
+    // Absent when truncation already cut through the invocation line itself; there is nothing to
+    // widen in that root, and re-rendering the envelope would undo the output truncation too.
+    if (!entry.text.includes(clippedLine)) continue;
+    // Callback replacement: serialized arguments routinely contain `$&`, `$'` and `$1`, and the
+    // string form of `replace` expands those into the surrounding match instead of inserting them.
+    const widened = entry.text.replace(clippedLine, () => `\ninvoked: ${name} with ${full}`);
+    const candidate = rootBlobCandidate(
+      toolResultRootPayload(widened),
+      "toolResult",
+      { messageIndex: entry.messageIndex, text: widened },
+    );
+    const cost = candidate.byteLength - entry.byteLength;
+    if (cost <= 0 || cost > spare) continue;
+    restored[i] = candidate;
+    spare -= cost;
+  }
+  return restored;
+}
+
 /**
  * History position of each indexed call, keyed by the map `toolCallsByCallId` returned.
  *

package/src/adapters/devin/cloud-direct/catalog.ts

@@ -21,8 +21,10 @@
  *   drift) we silently fall back to the chat path so a transient catalog
  *   outage can't take chat down with it.
  *
- * Schema (verified against the bundled `extension.js`,
- * `exa.codeium_common_pb.ClientModelConfig`):
+ * Schema (#1/#4/#22 verified against the bundled `extension.js`,
+ * `exa.codeium_common_pb.ClientModelConfig`; #18 identified from a live
+ * catalog dump against vendor-known windows; #5 corroborated against the
+ * public WindsurfAPI `ClientModelConfig` documentation):
  *
  *   GetCascadeModelConfigsResponse {
  *     #1 client_model_configs: repeated ClientModelConfig
@@ -30,6 +32,8 @@
  *   ClientModelConfig {
  *     #1  label                string
  *     #4  disabled             bool   ← the gate this module reads
+ *     #5  supports_images      bool   ← tri-state: absent stays unknown
+ *     #18 max_input_tokens     varint ← per-account context window
  *     #22 model_uid            string ← what `GetChatMessage` accepts
  *   }
  *
@@ -78,6 +82,15 @@ export interface ModelCatalogEntry {
    * degrades: the caller keeps its static fallback instead of reporting zero.
    */
   contextWindow?: number;
+  /**
+   * Image-input support from `ClientModelConfig` field #5, kept as a
+   * tri-state: a present `true` asserts text+image support, a present
+   * `false` asserts text-only, and an OMITTED field stays `undefined`
+   * (unknown). Deliberately unlike `disabled`, which defaults to false —
+   * collapsing "never asserted" into "text-only" was the #1796 regression
+   * (see src/providers/antigravity-models.ts).
+   */
+  supportsImages?: boolean;
 }
 
 export interface CacheEntry {
@@ -113,12 +126,17 @@ export function parseCatalogBuffer(buf: Buffer, apiKey: string, host: string): C
     let modelUid = '';
     let disabled = false;
     let contextWindow = 0;
+    let supportsImages: boolean | undefined;
     for (const sf of iterFields(f.value as Buffer)) {
       if (sf.num === 1 && sf.wire === 2 && Buffer.isBuffer(sf.value)) {
         label = (sf.value as Buffer).toString('utf8');
       } else if (sf.num === 4 && sf.wire === 0) {
         // #4 = disabled (bool, varint 0/1)
         disabled = sf.value === 1n;
+      } else if (sf.num === 5 && sf.wire === 0) {
+        // #5 = supportsImages (bool, varint 0/1). Absent stays unknown — see
+        // ModelCatalogEntry; do not default it like disabled.
+        supportsImages = sf.value === 1n;
       } else if (sf.num === 18 && sf.wire === 0) {
         // #18 = max input tokens. Identified by dumping a live catalog and
         // reading the varints back against models whose windows are known from
@@ -135,6 +153,7 @@ export function parseCatalogBuffer(buf: Buffer, apiKey: string, host: string): C
         label: label || modelUid,
         disabled,
         ...(contextWindow > 0 ? { contextWindow } : {}),
+        ...(supportsImages !== undefined ? { supportsImages } : {}),
       });
     }
   }
@@ -278,6 +297,19 @@ export function clearCachedCatalog(): void {
   cacheEpoch++;
 }
 
+/**
+ * Test seam: install a catalog as the live cache entry. Mirrors
+ * clearCachedCatalog's invalidation — the in-flight slot is dropped and the
+ * epoch bumped — so a fetch racing the seed cannot overwrite it, and a null
+ * entry resets the cache between tests.
+ */
+export function setCachedCatalogForTests(entry: CacheEntry | null): void {
+  cached = entry;
+  inFlight = null;
+  inFlightKey = null;
+  cacheEpoch++;
+}
+
 /**
  * Tier-disabled error — thrown by the chat pre-flight when the catalog lists
  * a model as `disabled: true` for this account. The message names the model

package/src/adapters/devin/live-models.ts

@@ -139,7 +139,13 @@ export const DEVIN_MODEL_EFFORTS: Record<string, string[]> = {
 export const DEVIN_DEFAULT_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 
 export type DevinUsableModelsResult =
-  | { ok: true; models: string[]; contextWindows: Record<string, number>; efforts: Record<string, string[]> }
+  | {
+      ok: true;
+      models: string[];
+      contextWindows: Record<string, number>;
+      efforts: Record<string, string[]>;
+      inputModalities: Record<string, string[]>;
+    }
   | { ok: false; error: "auth" | "http" | "empty" | "unknown"; detail?: string };
 
 /**
@@ -160,6 +166,8 @@ export async function fetchDevinUsableModels(opts: {
     const contextWindows: Record<string, number> = {};
     // Effort rungs per base, recovered from the suffixes the collapse strips.
     const rungs = new Map<string, Set<string>>();
+    // supportsImages votes per base; only rows that asserted field #5 vote.
+    const imageVotes = new Map<string, { sawTrue: boolean; sawFalse: boolean }>();
     for (const entry of catalog.byUid.values()) {
       if (entry.disabled) continue;
       // Skip internal enum constants (e.g. MODEL_GPT_5_2_LOW, MODEL_PRIVATE_*).
@@ -183,6 +191,15 @@ export async function fetchDevinUsableModels(opts: {
         const seen = contextWindows[base];
         contextWindows[base] = seen === undefined ? entry.contextWindow : Math.min(seen, entry.contextWindow);
       }
+      if (entry.supportsImages !== undefined) {
+        let votes = imageVotes.get(base);
+        if (!votes) {
+          votes = { sawTrue: false, sawFalse: false };
+          imageVotes.set(base, votes);
+        }
+        if (entry.supportsImages) votes.sawTrue = true;
+        else votes.sawFalse = true;
+      }
     }
     if (bases.size === 0) return { ok: false, error: "empty" };
     const efforts: Record<string, string[]> = {};
@@ -191,7 +208,21 @@ export async function fetchDevinUsableModels(opts: {
       // would draw a picker whose only option is the value already in effect.
       if (set.size > 1) efforts[base] = sortDevinRungs(set);
     }
-    return { ok: true, models: [...bases].sort(), contextWindows, efforts };
+    // supportsImages arrives tri-state per catalog row, so the collapse votes:
+    // a row that never asserted field #5 abstains, which keeps an unsuffixed
+    // unknown row from poisoning a base whose effort variants were measured
+    // image-capable. Unanimous measured rows advertise; measured disagreement
+    // advertises nothing, because a single measured false is not outvoted by
+    // its siblings. One accepted mismatch: resolveWireModelUid prefers the
+    // plain UID when the catalog lists it, so a base advertised
+    // ["text","image"] on variant evidence can still route a no-effort request
+    // to a plain row that never asserted the field.
+    const inputModalities: Record<string, string[]> = {};
+    for (const [base, votes] of imageVotes) {
+      if (votes.sawTrue && votes.sawFalse) continue;
+      inputModalities[base] = votes.sawTrue ? ["text", "image"] : ["text"];
+    }
+    return { ok: true, models: [...bases].sort(), contextWindows, efforts, inputModalities };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     if (/unauth|401|invalid token|login/i.test(message)) return { ok: false, error: "auth", detail: message };

package/src/adapters/google-wire-compiler.ts

@@ -149,6 +149,14 @@ function compileGenerationConfig(value: unknown): JsonObject | undefined {
     const valid = value.responseModalities.filter((m): m is string => typeof m === "string" && ["TEXT", "IMAGE", "AUDIO"].includes(m));
     if (valid.length > 0) out.responseModalities = valid;
   }
+  // Structured output. This compiler is a whitelist, so without these two the adapter
+  // could set a schema and it would still be dropped before the wire.
+  if (typeof value.responseMimeType === "string" && value.responseMimeType.length > 0) {
+    out.responseMimeType = value.responseMimeType;
+  }
+  // Carried through unmodified: a caller-authored output schema is not a tool
+  // declaration, so sanitizeGeminiToolParameters must not touch it.
+  if (isObject(value.responseJsonSchema)) out.responseJsonSchema = value.responseJsonSchema;
   return Object.keys(out).length > 0 ? out : undefined;
 }
 

package/src/adapters/google.ts

@@ -789,6 +789,37 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       : {}),
 
     async buildRequest(parsed: OcxParsedRequest) {
+      // Structured-output admission runs FIRST, before messagesToGeminiFormat writes
+      // lastInjectedCallIds/lastReasoningReplayScope: a refused request must not leave
+      // adapter-scoped replay state pointing at call ids that never went out. These
+      // refusals are local and precede any fetch, and carry no request content, schema
+      // body, URL or credential.
+      const requestedTextFormat = parsed.options.textFormat;
+      if (requestedTextFormat) {
+        if (provider.googleMode === "cloud-code-assist") {
+          // Not implemented or verified by opencodex for the Cloud Code Assist envelope,
+          // including Claude models served through it. This is not a claim that the
+          // upstream cannot do it — silence would return unconstrained prose as success,
+          // which is the failure this fix exists to remove.
+          throw new Error(
+            "google cloud-code-assist structured output is not implemented by opencodex — "
+            + "remove response_format or route this model through AI Studio or Vertex",
+          );
+        }
+        if (isImageCapableModel(parsed.modelId)) {
+          // An image-output model is configured with responseModalities; constraining the
+          // same turn to JSON text is contradictory. Say so rather than dropping the schema.
+          throw new Error(
+            "google image-capable models cannot combine image output with structured output — "
+            + "remove response_format or select a text model",
+          );
+        }
+        if (requestedTextFormat.type === "json_schema" && !requestedTextFormat.schema) {
+          // Downgrading a malformed json_schema to bare JSON mode would silently drop the
+          // constraint the caller asked for.
+          throw new Error("google structured output requires text.format.schema for type json_schema");
+        }
+      }
       const routedModelId = provider.googleMode === "cloud-code-assist"
         ? resolveAntigravityEffortWireModel(
             parsed.modelId,
@@ -846,6 +877,21 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       if (!generationConfig.thinkingConfig && isImageCapableModel(parsed.modelId)) {
         generationConfig.responseModalities = ["TEXT", "IMAGE"];
       }
+      // Structured output travels in generationConfig on generateContent itself.
+      // responseJsonSchema takes ordinary JSON Schema (lowercase types), which is what
+      // options.textFormat.schema already holds; responseSchema would require Gemini's
+      // uppercase typed Schema form, and the docs require omitting it when
+      // responseJsonSchema is used. The response type does not change — the model
+      // returns text containing the conforming JSON — so response parsing is untouched.
+      // The tool-parameter sanitizer is deliberately NOT applied: it narrows a schema
+      // to the function-declaration subset and would corrupt a valid output schema.
+      const textFormat = parsed.options.textFormat;
+      if (textFormat) {
+        generationConfig.responseMimeType = "application/json";
+        if (textFormat.type === "json_schema" && textFormat.schema) {
+          generationConfig.responseJsonSchema = textFormat.schema;
+        }
+      }
       if (Object.keys(generationConfig).length > 0) body.generationConfig = generationConfig;
 
       const method = parsed.stream ? "streamGenerateContent" : "generateContent";

package/src/adapters/input-media-guard.ts

@@ -0,0 +1,45 @@
+import type { ProviderAdapter } from "./base";
+import { untranslatedInputMediaMessage, untranslatedResponsesInputMedia } from "../responses/input-media";
+
+/**
+ * Refuse unrepresentable input at the final translated-adapter boundary. The registry
+ * applies this after wire resolution; Responses passthrough (including Azure) opts
+ * out because it uses the original body rather than the lossy normalized content.
+ */
+export function withInputMediaGuard<T extends ProviderAdapter>(adapter: T): T {
+  const build = adapter.buildRequest.bind(adapter);
+  adapter.buildRequest = (parsed, incoming) => {
+    const kind = untranslatedResponsesInputMedia(parsed._rawBody);
+    if (kind) throw new Error(untranslatedInputMediaMessage(kind));
+    return build(parsed, incoming);
+  };
+
+  const runTurn = adapter.runTurn?.bind(adapter);
+  if (runTurn) {
+    adapter.runTurn = async (parsed, incoming, emit) => {
+      const kind = untranslatedResponsesInputMedia(parsed._rawBody);
+      if (kind) {
+        emit({
+          type: "error",
+          status: 400,
+          errorType: "invalid_request_error",
+          code: "unsupported_input_modality",
+          retryable: false,
+          message: untranslatedInputMediaMessage(kind),
+        });
+        return;
+      }
+      await runTurn(parsed, incoming, emit);
+    };
+  }
+
+  const localTerminal = adapter.localTerminal?.bind(adapter);
+  if (localTerminal) {
+    // This hook is outside the builder's error catch. Decline its success shortcut;
+    // the ordinary buildRequest path then returns the established client-safe 400.
+    adapter.localTerminal = parsed => untranslatedResponsesInputMedia(parsed._rawBody)
+      ? undefined
+      : localTerminal(parsed);
+  }
+  return adapter;
+}

package/src/adapters/kiro/adapter.ts

@@ -13,6 +13,7 @@ import type {
 } from "../../types";
 import type { ProviderAdapter } from "../base";
 import type { AdapterFetchContext, AdapterRequest } from "../base";
+import type { RequestExecutionBudget } from "../../lib/request-execution-budget";
 import { safeKiroHttpErrorMessage } from "../kiro-errors";
 import { calibrateKiroEstimate } from "../kiro-calibration";
 import { normalizeKiroImages } from "../kiro-images";
@@ -58,6 +59,9 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
   let requestSnapshot: OcxParsedRequest | undefined;
   let firstRequestBodyBytes = 0;
   let requestAbortSignal: AbortSignal | undefined;
+  // Captured the same way as the abort signal, because the text-fallback rebuild below runs
+  // outside the fetchResponse frame and used to construct a context without either (#4546).
+  let requestSendBudget: RequestExecutionBudget | undefined;
 
   const build = async (
     parsed: OcxParsedRequest,
@@ -208,6 +212,9 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
         abortSignal: requestAbortSignal,
         returnRawErrors: true,
         stream: true,
+        // The text-fallback rebuild used to construct a fresh context and drop the budget,
+        // so everything after the first send escaped the per-request cap.
+        ...(requestSendBudget ? { sendBudget: requestSendBudget } : {}),
       });
       return {
         response,
@@ -278,6 +285,7 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
       // Keep it for the adapter-owned bounded continuation so cancelling the client turn aborts
       // both the first Kiro request and its one allowed completion retry.
       if (ctx?.abortSignal) requestAbortSignal = ctx.abortSignal;
+      if (ctx?.sendBudget) requestSendBudget = ctx.sendBudget;
       return fetchKiroWithRetry(request, ctx);
     },
 

package/src/adapters/kiro/payload.ts

@@ -22,7 +22,12 @@ import {
 } from "../kiro-constants";
 import { EMPTY_EXEC_OUTPUT_MESSAGE, annotateCodeModeHostFailure, normalizeEmptyExecToolResultText } from "../exec-tool-result-normalize";
 import { identifyRoutedModel } from "../identity";
-import { extractKiroImages, type KiroImage } from "../kiro-images";
+import {
+  countKiroUninlinableImages,
+  extractKiroImages,
+  kiroUninlinableImageMarker,
+  type KiroImage,
+} from "../kiro-images";
 import { convertKiroToolContext } from "../kiro-tools";
 import { createKiroToolNameRegistry, mapModelId, normalizeToolId, stableConversationId } from "../kiro-wire";
 import { buildNonOpenAIToolCatalogNudgeFromNames, isBareShellBridgeTool, isCodexCodeModeExecTool } from "../tool-catalog-nudge";
@@ -233,9 +238,13 @@ export function buildKiroPayload(
     // Original-message adjacency matters even when a turn is collapsed or skipped below.
     if (msg.role !== "toolResult") finishAdjacentResult();
     if (msg.role === "user" || msg.role === "developer") {
-      const text = userContentText((msg as { content: string | OcxContentPart[] }).content);
-      const images = extractKiroImages((msg as { content: string | OcxContentPart[] }).content);
-      pushUser(text, images);
+      const content = (msg as { content: string | OcxContentPart[] }).content;
+      const images = extractKiroImages(content);
+      // Kiro inlines base64 bytes only. A remote reference used to vanish with neither
+      // bytes nor a trace; attach a bounded, URL-free marker so the loss is visible.
+      const marker = kiroUninlinableImageMarker(countKiroUninlinableImages(content));
+      const text = userContentText(content);
+      pushUser(marker ? (text ? text + "\n" + marker : marker) : text, images);
     } else if (msg.role === "assistant") {
       const aMsg = msg as OcxAssistantMessage;
       const text = (aMsg.content || [])
@@ -281,7 +290,15 @@ export function buildKiroPayload(
       const annotatedExecText = normalizedExecText === undefined && codeModeExecName !== undefined
         ? annotateCodeModeHostFailure(text, execOptions)
         : undefined;
-      const resultText = normalizedExecText ?? annotatedExecText ?? (text.trim() ? text : KIRO_EMPTY_TOOL_RESULT_MESSAGE);
+      const uninlinableMarker = kiroUninlinableImageMarker(countKiroUninlinableImages(tr.content));
+      // Appended to the SELECTED result text, not to `text`: when an exec normalization
+      // fires, resultText below takes normalizedExecText/annotatedExecText instead, and
+      // a marker attached to `text` would be dropped — reinstating the silent loss this
+      // exists to remove.
+      const chosenText = normalizedExecText ?? annotatedExecText ?? (text.trim() ? text : KIRO_EMPTY_TOOL_RESULT_MESSAGE);
+      const resultText = uninlinableMarker
+        ? (chosenText ? chosenText + "\n" + uninlinableMarker : uninlinableMarker)
+        : chosenText;
       const images = extractKiroImages(tr.content);
       const toolUseId = normalizeToolId(tr.toolCallId);
       const call = priorCalls.get(toolUseId);
@@ -289,8 +306,13 @@ export function buildKiroPayload(
         throw new Error(`Kiro history contains an orphaned tool result for call ${JSON.stringify(tr.toolCallId)}`);
       }
       // Keep real whitespace and failed wrappers, but no empty-success wrapper boilerplate.
-      const rawGroupText = text.length > 0 && (!text.trim() || normalizedExecText !== EMPTY_EXEC_OUTPUT_MESSAGE)
+      const rawGroupBase = text.length > 0 && (!text.trim() || normalizedExecText !== EMPTY_EXEC_OUTPUT_MESSAGE)
         ? (annotatedExecText ?? text) : undefined;
+      // The grouping path rebuilds a collapsed turn's content from these texts, so the
+      // marker has to ride along here too or an adjacent-result turn loses it.
+      const rawGroupText = uninlinableMarker
+        ? (rawGroupBase ? rawGroupBase + "\n" + uninlinableMarker : uninlinableMarker)
+        : rawGroupBase;
       const last = turns.at(-1);
       if (
         adjacentResult?.rawId === tr.toolCallId