npm - @bitkyc08/opencodex - Versions diffs - 2.7.17 → 2.7.18 - Mend

@bitkyc08/opencodex 2.7.17 → 2.7.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (27) hide show

package/gui/dist/assets/index-BUBsQALh.css +1 -0
package/gui/dist/assets/index-DEbBFENM.js +40 -0
package/gui/dist/index.html +2 -2
package/package.json +1 -1
package/src/adapters/anthropic-image-guard.ts +63 -7
package/src/adapters/anthropic-image-normalize.ts +383 -0
package/src/adapters/anthropic.ts +7 -2
package/src/adapters/base.ts +6 -0
package/src/adapters/cursor/exec-policy.ts +9 -1
package/src/adapters/cursor/live-transport.ts +19 -11
package/src/adapters/cursor/protobuf-request.ts +7 -6
package/src/adapters/kiro-images.ts +94 -0
package/src/adapters/kiro.ts +6 -2
package/src/adapters/openai-chat.ts +49 -0
package/src/adapters/openai-responses.ts +128 -2
package/src/cli/claude.ts +3 -0
package/src/codex/catalog.ts +11 -0
package/src/providers/registry.ts +27 -2
package/src/server/claude-messages.ts +11 -0
package/src/server/image-retry.ts +42 -0
package/src/server/management-api.ts +27 -0
package/src/server/responses.ts +74 -22
package/src/server/system-env.ts +7 -3
package/src/types.ts +22 -4
package/src/web-search/index.ts +8 -5
package/gui/dist/assets/index-Cq8maiJf.css +0 -1
package/gui/dist/assets/index-m4o3xsSn.js +0 -40

package/gui/dist/index.html CHANGED Viewed

@@ -16,8 +16,8 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-m4o3xsSn.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-Cq8maiJf.css">
+    <script type="module" crossorigin src="/assets/index-DEbBFENM.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BUBsQALh.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.7.17",
+  "version": "2.7.18",
   "description": "Universal provider proxy for OpenAI Codex — use any LLM with Codex CLI/App/SDK",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/src/adapters/anthropic-image-guard.ts CHANGED Viewed

@@ -7,10 +7,13 @@
  * - Hard cap: 100 images per request.
  *
  * Codex threads accumulate screenshots in history, so long sessions cross 20 images
- * easily and any single retina capture (>2000px wide) kills every later turn. Bun has
- * no native resizer and we do not want a decoder dependency, so instead of downscaling
- * we keep the request under the 20-image threshold (restoring the 8000px allowance) by
- * textifying the OLDEST image blocks. Newest screenshots are the ones the model needs.
+ * easily and any single retina capture (>2000px wide) kills every later turn. The
+ * PRIMARY layer is now anthropic-image-normalize.ts (Bun.Image resize/re-encode with an
+ * age-tier pyramid — devlog/260714_image_normalization_pipeline/020), which runs before
+ * this guard; these rules remain the deterministic BACKSTOP for whatever normalization
+ * could not shrink (undecodable passthroughs, all-terminal overflow). When this guard
+ * must drop, it textifies the OLDEST image blocks — newest screenshots are the ones the
+ * model needs.
  */
 export const MANY_IMAGE_THRESHOLD = 20;
@@ -18,8 +21,33 @@ export const MANY_IMAGE_MAX_DIMENSION = 2000;
 export const ABSOLUTE_MAX_DIMENSION = 8000;
 export const MAX_IMAGES_PER_REQUEST = 100;
+/**
+ * Anthropic rejects any single image over 5MiB ("image exceeds 5 MB maximum", HTTP 400)
+ * regardless of dimensions or count. The unit is the BASE64 STRING LENGTH, not decoded
+ * bytes — verified in Claude Code's apiLimits.ts against Anthropic's internal API source
+ * (devlog/260714_image_normalization_pipeline/001_prior_art.md §1). A decoded-bytes
+ * comparison would let images with base64 length in (5.24MiB, 6.99MiB] through to a 400.
+ */
+export const MAX_IMAGE_BASE64_LENGTH = 5 * 1024 * 1024;
+/** @deprecated Renamed — the cap is measured in base64 chars. Use MAX_IMAGE_BASE64_LENGTH. */
+export const MAX_IMAGE_FILE_BYTES = MAX_IMAGE_BASE64_LENGTH;
+/**
+ * Anthropic rejects raw HTTP bodies over ~32MB with 413 request_too_large, and base64
+ * image data dominates image-heavy histories (base64 is single-byte ASCII, so base64
+ * chars ≈ serialized body bytes for the image share). The guard runs inside buildRequest
+ * BEFORE system/tools attach, so it cannot measure the final body; instead we bound the
+ * image share to 20MiB, leaving ≥11MB headroom even against a decimal 32,000,000-byte
+ * cap — realistic non-image share (context-capped text history + tool schemas) stays
+ * well under that. Residual: a request dominated by non-image content can still 413.
+ */
+export const TOTAL_IMAGE_BASE64_BUDGET = 20 * 1024 * 1024;
 const OMITTED_TEXT = "[image omitted: Anthropic request exceeded the 20-image limit for large images; older screenshots were dropped]";
 const OVERSIZED_TEXT = "[image omitted: exceeds Anthropic's 8000px per-side limit]";
+const PER_IMAGE_TOO_LARGE_TEXT = "[image omitted: exceeds Anthropic's 5MB per-image limit]";
+const BYTE_BUDGET_TEXT = "[image omitted: total image payload exceeded Anthropic's 32MB request limit; older screenshots were dropped]";
 interface ImageDimensions { width: number; height: number }
@@ -105,7 +133,7 @@ export function sniffImageDimensions(base64: string): ImageDimensions | null {
   return pngDimensions(bytes) ?? jpegDimensions(bytes) ?? gifDimensions(bytes) ?? webpDimensions(bytes) ?? null;
 }
-interface ImageBlockRef {
+export interface ImageBlockRef {
   /** The array holding the block (message content or tool_result content). */
   container: unknown[];
   index: number;
@@ -117,7 +145,7 @@ function isImageBlock(block: unknown): block is { type: "image"; source: Record<
 }
 /** Collect refs to every image block in wire order (oldest first), descending into tool_result content. */
-function collectImageRefs(messages: unknown[]): ImageBlockRef[] {
+export function collectImageRefs(messages: unknown[]): ImageBlockRef[] {
   const refs: ImageBlockRef[] = [];
   const scanArray = (arr: unknown[]): void => {
     for (let i = 0; i < arr.length; i++) {
@@ -150,7 +178,9 @@ function textify(ref: ImageBlockRef, text: string): void {
  * Enforce Anthropic image limits on already-built wire messages (mutates in place).
  * Policy: unconditionally textify >8000px images; when the request would be a
  * many-image request (>20) with at least one image over 2000px, textify oldest
- * images until <=20 so the 8000px allowance applies; always cap at 100 images.
+ * images until <=20 so the 8000px allowance applies; always cap at 100 images;
+ * textify images over the 5MB per-image cap; and drop oldest base64 images until
+ * the total base64 payload fits the request-size budget.
  */
 export function enforceAnthropicImageLimits(messages: unknown[]): void {
   const refs = collectImageRefs(messages);
@@ -168,6 +198,16 @@ export function enforceAnthropicImageLimits(messages: unknown[]): void {
     }
   }
+  // Rule 1b: images over the 5MiB per-image cap (base64 chars) are invalid in any request.
+  for (let i = 0; i < refs.length; i++) {
+    if (!live.has(i)) continue;
+    const b64 = refs[i].base64;
+    if (b64 && b64.length > MAX_IMAGE_BASE64_LENGTH) {
+      textify(refs[i], PER_IMAGE_TOO_LARGE_TEXT);
+      live.delete(i);
+    }
+  }
   // Rule 2: many-image requests cap each image at 2000px. Keep the request at <=20
   // images (dropping oldest first) whenever a surviving image exceeds that cap OR has
   // unknown dimensions (URL sources and unsniffable formats): one unverifiable offender
@@ -192,4 +232,20 @@ export function enforceAnthropicImageLimits(messages: unknown[]): void {
       live.delete(i);
     }
   }
+  // Rule 4: bound the total base64 payload (see TOTAL_IMAGE_BASE64_BUDGET rationale).
+  // Oldest base64 images are dropped first — newest screenshots are the ones the model
+  // needs. URL-source images carry no base64 weight and are never evicted here.
+  let base64Sum = 0;
+  for (const i of live) base64Sum += refs[i].base64?.length ?? 0;
+  if (base64Sum > TOTAL_IMAGE_BASE64_BUDGET) {
+    for (const i of [...live]) {
+      if (base64Sum <= TOTAL_IMAGE_BASE64_BUDGET) break;
+      const b64 = refs[i].base64;
+      if (!b64) continue;
+      textify(refs[i], BYTE_BUDGET_TEXT);
+      live.delete(i);
+      base64Sum -= b64.length;
+    }
+  }
 }

package/src/adapters/anthropic-image-normalize.ts ADDED Viewed

@@ -0,0 +1,383 @@
+/**
+ * Anthropic image normalization: resize/re-encode images to fit Anthropic's request
+ * limits instead of dropping them (devlog/260714_image_normalization_pipeline/020).
+ *
+ * Age-tier pyramid: newest images keep near-full fidelity, older images become
+ * progressively smaller JPEG thumbnails, so a whole session's screenshots stay visible
+ * under the request byte budget. An aggregate demotion loop re-encodes the OLDEST
+ * not-yet-terminal image one ladder position at a time until the total fits; only when
+ * every image is terminal-floored does the guard's Rule 4 (textify) fire as backstop.
+ *
+ * Runs inside the anthropic adapter's buildRequest BEFORE enforceAnthropicImageLimits,
+ * on freshly-built wire messages (in-place mutation is safe: messagesToAnthropicFormat
+ * creates new arrays/blocks). Encoding uses Bun.Image (bun >= 1.3.14, probe-verified:
+ * decodes JPEG/PNG/WebP/GIF/BMP/TIFF/HEIC/AVIF; corrupt input throws).
+ */
+import {
+  collectImageRefs,
+  sniffImageDimensions,
+  TOTAL_IMAGE_BASE64_BUDGET,
+  type ImageBlockRef,
+} from "./anthropic-image-guard";
+/** One ladder position: dimension cap, JPEG quality attempts, per-image base64 cap. */
+export interface TierSpec {
+  maxEdge: number;
+  qualities: number[];
+  /** Hard per-image base64-length cap at this position; Infinity = terminal (measured size accepted). */
+  hardCap: number;
+}
+const KiB = 1024;
+const MiB = 1024 * 1024;
+/**
+ * Ladder positions 0-5. 0-2 are the age-assigned tiers; 3-5 are demotion floor steps.
+ * Terminal (last) accepts its measured output so the aggregate loop always terminates
+ * (audit round 2, blocker 1).
+ */
+export const TIER_SPECS: TierSpec[] = [
+  { maxEdge: 2000, qualities: [80, 60, 40, 30], hardCap: 2 * MiB },
+  { maxEdge: 1024, qualities: [70, 50], hardCap: 512 * KiB },
+  { maxEdge: 700, qualities: [60, 40], hardCap: 192 * KiB },
+  { maxEdge: 500, qualities: [40], hardCap: 100 * KiB },
+  { maxEdge: 400, qualities: [30], hardCap: 100 * KiB },
+  { maxEdge: 320, qualities: [25], hardCap: Infinity },
+];
+const TERMINAL_POS = TIER_SPECS.length - 1;
+/** Newest 6 images ride tier 0, the next 14 tier 1, the rest tier 2 (020 tier table). */
+const TIER0_COUNT = 6;
+const TIER1_COUNT = 14;
+/** Decode-bomb guards: refuse to decode absurd inputs (020 guards; "extreme values excluded"). */
+export const MAX_INPUT_BASE64_LENGTH = 64 * MiB;
+export const MAX_INPUT_PIXELS = 100_000_000;
+const UNDECODABLE_TEXT = "[image omitted: undecodable or corrupt image data]";
+const BOMB_TEXT = "[image omitted: image too large to process safely]";
+const OVERFLOW_DROP_TEXT = "[image omitted: total image payload exceeded the provider request budget; older images were dropped]";
+/** Formats Anthropic accepts as-is; anything else must be transcoded or dropped. */
+const PASSTHROUGH_MEDIA = new Set(["image/jpeg", "image/png", "image/gif", "image/webp"]);
+export interface NormalizeOptions {
+  /** Shift every image's starting ladder position down (413 retry tightening; 030). */
+  tierBias?: number;
+  /** Test seam: replaces the Bun.Image encode path (audit round 1, blocker 6). */
+  encode?: EncodeFn;
+  /** Test seam: replaces the pass-through decode validation (C-gate round 1, blocker 1). */
+  validate?: ValidateFn;
+}
+export type EncodeFn = (
+  input: Uint8Array,
+  spec: TierSpec,
+  quality: number,
+) => Promise<{ data: string; mediaType: string }>;
+/** Proves the payload fully decodes; must throw for corrupt/truncated data. */
+export type ValidateFn = (input: Uint8Array) => Promise<void>;
+type ProcessResult =
+  | { kind: "pass"; b64Length: number }
+  | { kind: "encoded"; data: string; mediaType: string }
+  | { kind: "failed" };
+/**
+ * Byte-weighted LRU over normalized outputs (audit round 1, blocker 2): aggregate cap,
+ * not entry count. Entries are immutable snapshots — demotions write NEW tier-suffixed
+ * keys, never mutate stored values.
+ */
+const CACHE_BYTE_CAP = 64 * MiB;
+// "pass" = validated pass-through; "miss" = this position's ladder cannot meet its hard
+// cap for these bytes (skip straight to the next position — C-gate round 2, blocker 1).
+const cache = new Map<string, { data: string; mediaType: string } | "pass" | "miss">();
+let cacheBytes = 0;
+let encodeCalls = 0;
+function cachePut(key: string, value: { data: string; mediaType: string } | "pass" | "miss"): void {
+  const size = typeof value === "string" ? 0 : value.data.length;
+  const existing = cache.get(key);
+  if (existing !== undefined) {
+    cacheBytes -= typeof existing === "string" ? 0 : existing.data.length;
+    cache.delete(key); // re-insert refreshes recency and prevents double-count on concurrent misses
+  }
+  while (cacheBytes + size > CACHE_BYTE_CAP && cache.size > 0) {
+    const oldest = cache.keys().next().value as string;
+    const evicted = cache.get(oldest);
+    cacheBytes -= typeof evicted === "string" || evicted === undefined ? 0 : evicted.data.length;
+    cache.delete(oldest);
+  }
+  cache.set(key, value);
+  cacheBytes += size;
+}
+/** Read a cache entry, refreshing its recency (true LRU, C-gate round 1 blocker 5). */
+function cacheGet(key: string): { data: string; mediaType: string } | "pass" | "miss" | undefined {
+  const value = cache.get(key);
+  if (value !== undefined) {
+    cache.delete(key);
+    cache.set(key, value);
+  }
+  return value;
+}
+/** Test hooks: encoder-invocation counter + cache reset (no production caller). */
+export function getNormalizeStatsForTests(): { encodeCalls: number; cacheEntries: number; cacheBytes: number } {
+  return { encodeCalls, cacheEntries: cache.size, cacheBytes };
+}
+export function resetNormalizeStateForTests(): void {
+  cache.clear();
+  cacheBytes = 0;
+  encodeCalls = 0;
+}
+/** Default encoder: Bun.Image resize-to-fit + JPEG at the given quality. */
+const bunImageEncode: EncodeFn = async (input, spec, quality) => {
+  const image = new Bun.Image(input);
+  const meta = await image.metadata();
+  const w = typeof meta.width === "number" ? meta.width : 0;
+  const h = typeof meta.height === "number" ? meta.height : 0;
+  let pipeline = new Bun.Image(input);
+  if (w > spec.maxEdge || h > spec.maxEdge) {
+    const scale = spec.maxEdge / Math.max(w, h);
+    pipeline = pipeline.resize(Math.max(1, Math.round(w * scale)), Math.max(1, Math.round(h * scale)));
+  }
+  const out = await pipeline.jpeg({ quality }).toBuffer();
+  return { data: Buffer.from(out).toString("base64"), mediaType: "image/jpeg" };
+};
+/**
+ * Default pass-through validation: force a full decode (resize forces pixel decoding, a
+ * header-only metadata read does not). A sniffable-but-truncated payload must throw here
+ * instead of riding pass-through to an Anthropic 400 (C-gate round 1, blocker 1).
+ */
+const bunImageValidate: ValidateFn = async input => {
+  await new Bun.Image(input).resize(1, 1).jpeg({ quality: 1 }).toBuffer();
+};
+function mediaTypeOf(ref: ImageBlockRef): string {
+  const block = ref.container[ref.index] as { source?: { media_type?: unknown } } | undefined;
+  const mt = block?.source?.media_type;
+  return typeof mt === "string" ? mt.toLowerCase() : "";
+}
+function textify(ref: ImageBlockRef, text: string): void {
+  ref.container[ref.index] = { type: "text", text };
+}
+function replaceImage(ref: ImageBlockRef, data: string, mediaType: string): void {
+  ref.container[ref.index] = { type: "image", source: { type: "base64", media_type: mediaType, data } };
+}
+function initialPosition(newestFirstIndex: number, bias: number): number {
+  const base = newestFirstIndex < TIER0_COUNT ? 0 : newestFirstIndex < TIER0_COUNT + TIER1_COUNT ? 1 : 2;
+  return Math.min(base + Math.max(0, bias), TERMINAL_POS);
+}
+/**
+ * Process one image at a ladder position: pass through when it already fits the
+ * position's caps (Anthropic-native format, dims within maxEdge, size within hardCap —
+ * this also exempts possibly-animated GIF/WebP from a lossy re-encode; pass-through is
+ * additionally VALIDATED with a full decode once, cached), otherwise walk positions
+ * downward encoding until a hard cap is met; terminal accepts measured size.
+ * `mediaType` must be the ORIGINAL source media type (cache keys include it — C-gate
+ * round 1, blocker 4 — and pass-through eligibility depends on it).
+ */
+async function processAt(
+  b64: string,
+  startPos: number,
+  mediaType: string,
+  encode: EncodeFn,
+  validate: ValidateFn,
+): Promise<ProcessResult & { pos: number }> {
+  const dims = sniffImageDimensions(b64);
+  const hash = Bun.hash(b64).toString(36);
+  let input: Uint8Array;
+  try {
+    input = Uint8Array.from(Buffer.from(b64, "base64"));
+  } catch {
+    return { kind: "failed", pos: startPos };
+  }
+  for (let pos = startPos; pos <= TERMINAL_POS; pos++) {
+    const spec = TIER_SPECS[pos];
+    const key = `${hash}:${mediaType}:${pos}`;
+    const cached = cacheGet(key);
+    if (cached === "pass") return { kind: "pass", b64Length: b64.length, pos };
+    if (cached === "miss") continue; // known cap miss: skip to the next position
+    if (cached) return { kind: "encoded", data: cached.data, mediaType: cached.mediaType, pos };
+    const fitsDims = dims !== null && dims.width <= spec.maxEdge && dims.height <= spec.maxEdge;
+    if (PASSTHROUGH_MEDIA.has(mediaType) && fitsDims && b64.length <= spec.hardCap) {
+      try {
+        await validate(input); // sniffable-but-truncated data must not ride pass-through
+      } catch {
+        return { kind: "failed", pos };
+      }
+      cachePut(key, "pass");
+      return { kind: "pass", b64Length: b64.length, pos };
+    }
+    let last: { data: string; mediaType: string } | null = null;
+    try {
+      for (const quality of spec.qualities) {
+        encodeCalls++;
+        last = await encode(input, spec, quality);
+        if (last.data.length <= spec.hardCap) {
+          cachePut(key, last);
+          return { kind: "encoded", data: last.data, mediaType: last.mediaType, pos };
+        }
+      }
+    } catch {
+      // Decode/encode failure: corrupt or unsupported payload (audit round 2, blocker 2).
+      return { kind: "failed", pos };
+    }
+    if (pos === TERMINAL_POS && last) {
+      cachePut(key, last);
+      return { kind: "encoded", data: last.data, mediaType: last.mediaType, pos };
+    }
+    // Hard cap missed at this position — remember the miss, continue down the ladder.
+    cachePut(key, "miss");
+  }
+  return { kind: "failed", pos: TERMINAL_POS };
+}
+/**
+ * Wire-neutral image handle (devlog/260714_image_normalization_pipeline/050): the core
+ * algorithm below normalizes THROUGH this interface so non-Anthropic wire shapes (kiro
+ * CodeWhisperer) reuse the exact same tier/cache/demotion machinery. `mediaType` is the
+ * canonical lowercased MIME ("image/<format>") — cache identity and pass-through
+ * decisions depend on it; wire-specific conversions live inside `replace`.
+ */
+export interface NormalizeTarget {
+  base64: string | null;
+  mediaType: string;
+  replace(data: string, mediaType: string): void;
+  drop(note: string): void;
+}
+export interface NormalizeTargetsOptions extends NormalizeOptions {
+  /** Total base64 budget across all targets. Default: TOTAL_IMAGE_BASE64_BUDGET. */
+  budget?: number;
+  /**
+   * What to do when every image is terminal-floored and the sum still exceeds budget:
+   * "none" (anthropic — the guard's Rule 4 backstop textifies downstream) or "drop"
+   * (kiro — no downstream guard exists, so drop OLDEST targets here until it fits).
+   */
+  overflowAction?: "none" | "drop";
+  /** Only the newest N images are processed (older ones skipped). Default: unlimited. */
+  processLimit?: number;
+}
+/**
+ * Core normalization over wire-neutral targets (mutates via target callbacks).
+ * Null-base64 targets (URL/file sources) pass through untouched.
+ */
+export async function normalizeImageTargets(targets: NormalizeTarget[], options: NormalizeTargetsOptions = {}): Promise<void> {
+  if (targets.length === 0) return;
+  const encode = options.encode ?? bunImageEncode;
+  const validate = options.validate ?? bunImageValidate;
+  const bias = options.tierBias ?? 0;
+  const budget = options.budget ?? TOTAL_IMAGE_BASE64_BUDGET;
+  const overflowAction = options.overflowAction ?? "none";
+  const processLimit = options.processLimit ?? Number.POSITIVE_INFINITY;
+  const n = targets.length;
+  // sourceB64/sourceMedia are the ORIGINAL input (encode source + cache identity);
+  // size always reflects the bytes currently ON the wire for this target (the core is
+  // the only mutator, so tracked size cannot drift from reality).
+  interface Entry { target: NormalizeTarget; sourceB64: string; sourceMedia: string; pos: number; size: number; done: boolean }
+  const entries: (Entry | null)[] = new Array(n).fill(null);
+  for (let i = 0; i < n; i++) {
+    const target = targets[i];
+    const b64 = target.base64;
+    if (!b64) continue; // URL source: no base64 weight, never touched here.
+    const newestFirstIndex = n - 1 - i;
+    // Images beyond the processing limit are left untouched (anthropic passes 100:
+    // its guard textifies the surplus anyway, so decode/encode work there is waste).
+    if (newestFirstIndex >= processLimit) continue;
+    if (b64.length > MAX_INPUT_BASE64_LENGTH) {
+      target.drop(BOMB_TEXT);
+      continue;
+    }
+    const dims = sniffImageDimensions(b64);
+    if (dims && dims.width * dims.height > MAX_INPUT_PIXELS) {
+      target.drop(BOMB_TEXT);
+      continue;
+    }
+    const sourceMedia = target.mediaType.toLowerCase();
+    const pos = initialPosition(newestFirstIndex, bias);
+    const result = await processAt(b64, pos, sourceMedia, encode, validate);
+    if (result.kind === "failed") {
+      target.drop(UNDECODABLE_TEXT);
+      continue;
+    }
+    let size = b64.length;
+    if (result.kind === "encoded") {
+      target.replace(result.data, result.mediaType);
+      size = result.data.length;
+    }
+    entries[i] = { target, sourceB64: b64, sourceMedia, pos: result.pos, size, done: result.pos >= TERMINAL_POS };
+  }
+  // Aggregate demotion loop (audit rounds 1+3): while the measured total exceeds the
+  // budget, demote the OLDEST not-yet-terminal image one position and re-encode.
+  let sum = 0;
+  for (const e of entries) if (e) sum += e.size;
+  while (sum > budget) {
+    const entry = entries.find((e): e is Entry => e !== null && !e.done);
+    if (!entry) break; // all terminal — overflowAction below decides
+    const result = await processAt(entry.sourceB64, entry.pos + 1, entry.sourceMedia, encode, validate);
+    if (result.kind === "failed") {
+      entry.target.drop(UNDECODABLE_TEXT);
+      sum -= entry.size;
+      entries[entries.indexOf(entry)] = null;
+      continue;
+    }
+    let newSize = entry.size;
+    if (result.kind === "encoded") {
+      entry.target.replace(result.data, result.mediaType);
+      newSize = result.data.length;
+    } else {
+      newSize = result.b64Length; // pass leaves current bytes (only reachable for never-encoded entries)
+    }
+    sum += newSize - entry.size;
+    entry.size = newSize;
+    entry.pos = result.pos;
+    entry.done = result.pos >= TERMINAL_POS;
+  }
+  // Terminal overflow (050 audit round 1, blocker 3): with no downstream guard, drop
+  // OLDEST targets until the sum fits.
+  if (overflowAction === "drop") {
+    for (let i = 0; i < entries.length && sum > budget; i++) {
+      const e = entries[i];
+      if (!e) continue;
+      e.target.drop(OVERFLOW_DROP_TEXT);
+      sum -= e.size;
+      entries[i] = null;
+    }
+  }
+}
+/**
+ * Normalize every base64 image in already-built Anthropic wire messages (mutates in
+ * place). URL-source images pass through untouched. See module header for the contract.
+ */
+export async function normalizeAnthropicImages(messages: unknown[], options: NormalizeOptions = {}): Promise<void> {
+  const refs = collectImageRefs(messages);
+  if (refs.length === 0) return;
+  const targets: NormalizeTarget[] = refs.map(ref => ({
+    base64: ref.base64,
+    mediaType: mediaTypeOf(ref),
+    replace: (data: string, mediaType: string) => replaceImage(ref, data, mediaType),
+    drop: (note: string) => textify(ref, note),
+  }));
+  // Anthropic hard-caps 100 images/request and its guard textifies the surplus, so
+  // processing beyond the newest 100 is pure waste; terminal overflow stays with the
+  // guard's Rule 4 backstop (overflowAction "none").
+  await normalizeImageTargets(targets, { ...options, processLimit: 100, overflowAction: "none" });
+}

package/src/adapters/anthropic.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { ProviderAdapter } from "./base";
+import type { IncomingMeta, ProviderAdapter } from "./base";
 import { debugDroppedFrame } from "../lib/debug";
 import type {
   AdapterEvent,
@@ -17,6 +17,7 @@ import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, too
 import { ANTHROPIC_OAUTH_BETA, CLAUDE_CODE_SYSTEM_INSTRUCTION, applyClaudeToolPrefix, stripClaudeToolPrefix } from "../oauth/anthropic";
 import { parseDataUrl } from "./image";
 import { enforceAnthropicImageLimits } from "./anthropic-image-guard";
+import { normalizeAnthropicImages } from "./anthropic-image-normalize";
 import { neutralizeIdentity } from "./identity";
 import { CLAUDE_CODE_HEADERS, claudeCodeSessionId } from "./client-fingerprint";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
@@ -584,7 +585,7 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
   return {
     name: "anthropic",
-    buildRequest(parsed: OcxParsedRequest) {
+    async buildRequest(parsed: OcxParsedRequest, incoming?: IncomingMeta) {
       if (typeof provider.apiKey !== "string" || provider.apiKey.trim() === "") {
         if (isOAuth) {
           throw new Error("anthropic oauth token missing — run ocx login anthropic");
@@ -593,6 +594,10 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
       }
       const { system, messages } = messagesToAnthropicFormat(parsed, toolNames);
+      // Primary image layer: resize/re-encode to fit Anthropic limits without dropping
+      // (anthropic-image-normalize.ts); the guard below remains the deterministic backstop.
+      // imageTierBias > 0 = upstream-413 tightened retry (030): start every image one tier lower.
+      await normalizeAnthropicImages(messages, { tierBias: incoming?.imageTierBias ?? 0 });
       // Anthropic rejects many-image requests (>20 images) carrying any image over
       // 2000px per side; see anthropic-image-guard.ts for the full limit policy.
       enforceAnthropicImageLimits(messages);

package/src/adapters/base.ts CHANGED Viewed

@@ -4,6 +4,12 @@ import type { AdapterEvent, OcxParsedRequest } from "../types";
 export interface IncomingMeta {
   headers: Headers;
   abortSignal?: AbortSignal;
+  /**
+   * Image-normalization ladder bias for upstream-413 tightened retries: every image
+   * starts one tier lower (devlog/260714_image_normalization_pipeline/030). Only the
+   * anthropic adapter consumes it; others ignore it.
+   */
+  imageTierBias?: number;
 }
 export interface ProviderAdapter {

package/src/adapters/cursor/exec-policy.ts CHANGED Viewed

@@ -6,7 +6,15 @@ export type CursorNativeExecMode = "off" | "codex-sandbox" | "on";
 /** Codex permissions template marker, e.g. "`sandbox_mode` is `danger-full-access`". */
 export const CURSOR_SANDBOX_FULL_ACCESS_RE = /sandbox_mode[^\n]{0,80}danger-full-access/i;
-/** Config-owner-selected policy; explicit mode wins, legacy boolean maps to "on". */
+/**
+ * Config-owner-selected policy; explicit mode wins, legacy boolean maps to "on".
+ * The UNSET default is "codex-sandbox": native local exec is APPROVED for requests that
+ * declare the Codex danger-full-access sandbox (the normal full-access Codex flow — "approve
+ * most") and DENIED for requests that do not. Set `nativeLocalExec: "off"` to deny all, or
+ * "on" to always allow. Legacy `unsafeAllowNativeLocalExec: true` still maps to "on".
+ * Security note: codex-sandbox trusts a caller-controlled full-access marker the proxy cannot
+ * verify, and the auth-free loopback bind admits any local process — see the src/types.ts doc.
+ */
 export function resolveCursorNativeExecMode(provider: OcxProviderConfig): CursorNativeExecMode {
   const mode = provider.nativeLocalExec;
   if (mode === "off" || mode === "codex-sandbox" || mode === "on") return mode;

package/src/adapters/cursor/live-transport.ts CHANGED Viewed

@@ -15,14 +15,14 @@ import {
   CreatePlanResultSchema,
   CreatePlanSuccessSchema,
   ExaFetchRequestResponseSchema,
-  ExaFetchRequestResponse_RejectedSchema,
+  ExaFetchRequestResponse_ApprovedSchema,
   ExaSearchRequestResponseSchema,
-  ExaSearchRequestResponse_RejectedSchema,
+  ExaSearchRequestResponse_ApprovedSchema,
   InteractionResponseSchema,
   SwitchModeRequestResponseSchema,
   SwitchModeRequestResponse_RejectedSchema,
   WebSearchRequestResponseSchema,
-  WebSearchRequestResponse_RejectedSchema,
+  WebSearchRequestResponse_ApprovedSchema,
   type AgentServerMessage,
   type ExecServerMessage,
   type InteractionQuery,
@@ -181,8 +181,16 @@ export function planMcpArgsHandling(
  *     Codex as visible output so the user still sees it.
  *   - askQuestion: reject with a reason — the agent must proceed autonomously; there is no human to
  *     answer mid-turn. (Future: bridge to a Codex user-input request.)
- *   - switchMode / webSearch / exaSearch / exaFetch: reject (deterministic default; web search has
- *     its own sidecar path outside this transport).
+ *   - webSearch / exaSearch / exaFetch: APPROVE (empty approval). These are approve/reject
+ *     permission gates, not client-run requests — the response schema has no result field, so
+ *     approval delegates the search to Cursor's SERVER, which runs it and injects results into the
+ *     model server-side (the answer then streams back as textDelta; the display-plane
+ *     web_search_tool_call/exa_*_tool_call result frames are native, non-mcp, and safely dropped by
+ *     the event mapper). Rejecting them (the old default) killed the model's web capability on the
+ *     Cursor path. Tradeoff: approval consumes the user's Cursor web-search/Exa quota. The synthetic
+ *     web_search sidecar (src/web-search) is an orthogonal proxy-side path used only when the client
+ *     sends a hosted web_search tool; it does not cover Cursor-native web search.
+ *   - switchMode: reject (deterministic default; no non-interactive mode switch).
  *   - setupVmEnvironment: the result schema has no error case — reply success so the agent is not
  *     left waiting; the command itself was never run locally.
  * Pure (no I/O) for unit testing; `handleServerMessage` writes the frame and emits liveness.
@@ -240,10 +248,10 @@ export function planInteractionQueryReply(query: InteractionQuery): { response:
       response: respond({
         case: "webSearchRequestResponse",
         value: create(WebSearchRequestResponseSchema, {
-          result: { case: "rejected", value: create(WebSearchRequestResponse_RejectedSchema, { reason: NON_INTERACTIVE_REASON }) },
+          result: { case: "approved", value: create(WebSearchRequestResponse_ApprovedSchema, {}) },
         }),
       }),
-      replyCase: "webSearchRequestResponse:rejected",
+      replyCase: "webSearchRequestResponse:approved",
     };
   }
   if (q.case === "exaSearchRequestQuery") {
@@ -251,10 +259,10 @@ export function planInteractionQueryReply(query: InteractionQuery): { response:
       response: respond({
         case: "exaSearchRequestResponse",
         value: create(ExaSearchRequestResponseSchema, {
-          result: { case: "rejected", value: create(ExaSearchRequestResponse_RejectedSchema, { reason: NON_INTERACTIVE_REASON }) },
+          result: { case: "approved", value: create(ExaSearchRequestResponse_ApprovedSchema, {}) },
         }),
       }),
-      replyCase: "exaSearchRequestResponse:rejected",
+      replyCase: "exaSearchRequestResponse:approved",
     };
   }
   if (q.case === "exaFetchRequestQuery") {
@@ -262,10 +270,10 @@ export function planInteractionQueryReply(query: InteractionQuery): { response:
       response: respond({
         case: "exaFetchRequestResponse",
         value: create(ExaFetchRequestResponseSchema, {
-          result: { case: "rejected", value: create(ExaFetchRequestResponse_RejectedSchema, { reason: NON_INTERACTIVE_REASON }) },
+          result: { case: "approved", value: create(ExaFetchRequestResponse_ApprovedSchema, {}) },
         }),
       }),
-      replyCase: "exaFetchRequestResponse:rejected",
+      replyCase: "exaFetchRequestResponse:approved",
     };
   }
   if (q.case === "setupVmEnvironmentArgs") {