@bitkyc08/opencodex 2.7.17 → 2.7.19

package/src/adapters/base.ts

@@ -4,6 +4,12 @@ import type { AdapterEvent, OcxParsedRequest } from "../types";
 export interface IncomingMeta {
   headers: Headers;
   abortSignal?: AbortSignal;
+  /**
+   * Image-normalization ladder bias for upstream-413 tightened retries: every image
+   * starts one tier lower (devlog/260714_image_normalization_pipeline/030). Only the
+   * anthropic adapter consumes it; others ignore it.
+   */
+  imageTierBias?: number;
 }
 
 export interface ProviderAdapter {

package/src/adapters/cursor/exec-policy.ts

@@ -6,7 +6,15 @@ export type CursorNativeExecMode = "off" | "codex-sandbox" | "on";
 /** Codex permissions template marker, e.g. "`sandbox_mode` is `danger-full-access`". */
 export const CURSOR_SANDBOX_FULL_ACCESS_RE = /sandbox_mode[^\n]{0,80}danger-full-access/i;
 
-/** Config-owner-selected policy; explicit mode wins, legacy boolean maps to "on". */
+/**
+ * Config-owner-selected policy; explicit mode wins, legacy boolean maps to "on".
+ * The UNSET default is "codex-sandbox": native local exec is APPROVED for requests that
+ * declare the Codex danger-full-access sandbox (the normal full-access Codex flow — "approve
+ * most") and DENIED for requests that do not. Set `nativeLocalExec: "off"` to deny all, or
+ * "on" to always allow. Legacy `unsafeAllowNativeLocalExec: true` still maps to "on".
+ * Security note: codex-sandbox trusts a caller-controlled full-access marker the proxy cannot
+ * verify, and the auth-free loopback bind admits any local process — see the src/types.ts doc.
+ */
 export function resolveCursorNativeExecMode(provider: OcxProviderConfig): CursorNativeExecMode {
   const mode = provider.nativeLocalExec;
   if (mode === "off" || mode === "codex-sandbox" || mode === "on") return mode;

package/src/adapters/cursor/live-transport.ts

@@ -15,14 +15,14 @@ import {
   CreatePlanResultSchema,
   CreatePlanSuccessSchema,
   ExaFetchRequestResponseSchema,
-  ExaFetchRequestResponse_RejectedSchema,
+  ExaFetchRequestResponse_ApprovedSchema,
   ExaSearchRequestResponseSchema,
-  ExaSearchRequestResponse_RejectedSchema,
+  ExaSearchRequestResponse_ApprovedSchema,
   InteractionResponseSchema,
   SwitchModeRequestResponseSchema,
   SwitchModeRequestResponse_RejectedSchema,
   WebSearchRequestResponseSchema,
-  WebSearchRequestResponse_RejectedSchema,
+  WebSearchRequestResponse_ApprovedSchema,
   type AgentServerMessage,
   type ExecServerMessage,
   type InteractionQuery,
@@ -181,8 +181,16 @@ export function planMcpArgsHandling(
  *     Codex as visible output so the user still sees it.
  *   - askQuestion: reject with a reason — the agent must proceed autonomously; there is no human to
  *     answer mid-turn. (Future: bridge to a Codex user-input request.)
- *   - switchMode / webSearch / exaSearch / exaFetch: reject (deterministic default; web search has
- *     its own sidecar path outside this transport).
+ *   - webSearch / exaSearch / exaFetch: APPROVE (empty approval). These are approve/reject
+ *     permission gates, not client-run requests — the response schema has no result field, so
+ *     approval delegates the search to Cursor's SERVER, which runs it and injects results into the
+ *     model server-side (the answer then streams back as textDelta; the display-plane
+ *     web_search_tool_call/exa_*_tool_call result frames are native, non-mcp, and safely dropped by
+ *     the event mapper). Rejecting them (the old default) killed the model's web capability on the
+ *     Cursor path. Tradeoff: approval consumes the user's Cursor web-search/Exa quota. The synthetic
+ *     web_search sidecar (src/web-search) is an orthogonal proxy-side path used only when the client
+ *     sends a hosted web_search tool; it does not cover Cursor-native web search.
+ *   - switchMode: reject (deterministic default; no non-interactive mode switch).
  *   - setupVmEnvironment: the result schema has no error case — reply success so the agent is not
  *     left waiting; the command itself was never run locally.
  * Pure (no I/O) for unit testing; `handleServerMessage` writes the frame and emits liveness.
@@ -240,10 +248,10 @@ export function planInteractionQueryReply(query: InteractionQuery): { response:
       response: respond({
         case: "webSearchRequestResponse",
         value: create(WebSearchRequestResponseSchema, {
-          result: { case: "rejected", value: create(WebSearchRequestResponse_RejectedSchema, { reason: NON_INTERACTIVE_REASON }) },
+          result: { case: "approved", value: create(WebSearchRequestResponse_ApprovedSchema, {}) },
         }),
       }),
-      replyCase: "webSearchRequestResponse:rejected",
+      replyCase: "webSearchRequestResponse:approved",
     };
   }
   if (q.case === "exaSearchRequestQuery") {
@@ -251,10 +259,10 @@ export function planInteractionQueryReply(query: InteractionQuery): { response:
       response: respond({
         case: "exaSearchRequestResponse",
         value: create(ExaSearchRequestResponseSchema, {
-          result: { case: "rejected", value: create(ExaSearchRequestResponse_RejectedSchema, { reason: NON_INTERACTIVE_REASON }) },
+          result: { case: "approved", value: create(ExaSearchRequestResponse_ApprovedSchema, {}) },
         }),
       }),
-      replyCase: "exaSearchRequestResponse:rejected",
+      replyCase: "exaSearchRequestResponse:approved",
     };
   }
   if (q.case === "exaFetchRequestQuery") {
@@ -262,10 +270,10 @@ export function planInteractionQueryReply(query: InteractionQuery): { response:
       response: respond({
         case: "exaFetchRequestResponse",
         value: create(ExaFetchRequestResponseSchema, {
-          result: { case: "rejected", value: create(ExaFetchRequestResponse_RejectedSchema, { reason: NON_INTERACTIVE_REASON }) },
+          result: { case: "approved", value: create(ExaFetchRequestResponse_ApprovedSchema, {}) },
         }),
       }),
-      replyCase: "exaFetchRequestResponse:rejected",
+      replyCase: "exaFetchRequestResponse:approved",
     };
   }
   if (q.case === "setupVmEnvironmentArgs") {

package/src/adapters/cursor/protobuf-request.ts

@@ -108,12 +108,13 @@ function rootPromptMessages(request: CursorRunRequest): Uint8Array[] {
     } else if (message.role === "assistant") {
       const text = assistantRootText(message).trim();
       if (text.length > 0) entries.push(storeCursorBlob(jsonBlob({ role: "assistant", content: [{ type: "text", text }] })));
-      for (const part of message.content) {
-        if (typeof part === "string" || part.type !== "toolCall") continue;
-        const toolName = namespacedToolName(part.namespace, part.name);
-        const callText = `[Tool Call]\ncall_id: ${part.id}\nname: ${toolName}\narguments:\n${JSON.stringify(part.arguments ?? {})}`;
-        entries.push(storeCursorBlob(jsonBlob({ role: "assistant", content: [{ type: "text", text: callText }] })));
-      }
+      // Assistant tool CALLS are intentionally NOT replayed as visible "[Tool Call]" text here.
+      // rootPromptMessagesJson is the model-visible prompt, so a synthetic "[Tool Call]" marker in an
+      // assistant turn gets few-shot-mimicked: the model then emits later (esp. parallel/mixed) tool
+      // calls as inert text instead of real tool frames, halting multi-tool continuations. The paired
+      // tool result below ([Tool Result]/[Tool Error]) carries the call id/name/output Cursor needs to
+      // continue, and conversationTurns replays the native mcpToolCall step. Mirrors request-builder.ts
+      // contentPartToText() which returns undefined for toolCall for the same reason.
     } else if (message.role === "toolResult") {
       const prefix = message.isError ? "[Tool Error]" : "[Tool Result]";
       const text = `${prefix}\n${toolResultToText(message)}`;

package/src/adapters/kiro-images.ts

@@ -1,4 +1,5 @@
 import type { OcxContentPart } from "../types";
+import { normalizeImageTargets, type NormalizeOptions, type NormalizeTarget } from "./anthropic-image-normalize";
 
 // CodeWhisperer native image part (matches Kiro IDE wire format): the base64 bytes live directly in
 // userInputMessage.images, NOT in userInputMessageContext. Verified against kiro-gateway.
@@ -33,3 +34,96 @@ export function extractKiroImages(content: string | OcxContentPart[]): KiroImage
   }
   return out;
 }
+
+/**
+ * Conservative POLICY caps for the CodeWhisperer GenerateAssistantResponse payload,
+ * whose limits are undocumented. Derived from adjacent AWS surfaces
+ * (devlog/260714_image_normalization_pipeline/050): Bedrock `Message` allows 20 images
+ * per message (Converse), and `InvokeModel` caps requests at 25,000,000 bytes — 18MiB
+ * bounds the IMAGE share of the body with headroom for text/tools.
+ */
+export const KIRO_IMAGE_BASE64_BUDGET = 18 * 1024 * 1024;
+export const KIRO_MAX_IMAGES_PER_MESSAGE = 20;
+
+const COUNT_CAP_NOTE = "[image omitted: exceeded the 20-image per-message cap; oldest images in this message were dropped]";
+
+/** A kiro wire message that can carry images (history userInputMessage or currentMessage). */
+interface KiroImageCarrier {
+  content?: string;
+  images?: KiroImage[];
+}
+
+function isCarrier(v: unknown): v is KiroImageCarrier {
+  return typeof v === "object" && v !== null;
+}
+
+/** Collect image-bearing userInputMessages in wire order (history oldest-first, then current). */
+function collectKiroImageCarriers(payload: unknown): KiroImageCarrier[] {
+  const state = (payload as { conversationState?: { history?: unknown[]; currentMessage?: { userInputMessage?: unknown } } })?.conversationState;
+  if (!state) return [];
+  const carriers: KiroImageCarrier[] = [];
+  for (const entry of state.history ?? []) {
+    const uim = (entry as { userInputMessage?: unknown })?.userInputMessage;
+    if (isCarrier(uim)) carriers.push(uim);
+  }
+  const current = state.currentMessage?.userInputMessage;
+  if (isCarrier(current)) carriers.push(current);
+  return carriers;
+}
+
+function appendNote(carrier: KiroImageCarrier, note: string): void {
+  carrier.content = carrier.content ? `${carrier.content}\n${note}` : note;
+}
+
+/**
+ * Apply the generous image pipeline to a built CodeWhisperer payload (mutates in
+ * place): per-message 20-image cap first (oldest dropped), then the shared tier
+ * machinery with the kiro budget and terminal-overflow DROP (kiro has no downstream
+ * guard). Test seams (encode/validate) forward into the core.
+ */
+export async function normalizeKiroImages(
+  payload: unknown,
+  opts?: Pick<NormalizeOptions, "encode" | "validate">,
+): Promise<void> {
+  const carriers = collectKiroImageCarriers(payload);
+  if (carriers.length === 0) return;
+
+  // Pre-pass: per-message count cap (drop oldest within the message).
+  for (const carrier of carriers) {
+    const images = carrier.images;
+    if (!images || images.length <= KIRO_MAX_IMAGES_PER_MESSAGE) continue;
+    images.splice(0, images.length - KIRO_MAX_IMAGES_PER_MESSAGE);
+    appendNote(carrier, COUNT_CAP_NOTE);
+  }
+
+  // Targets over the survivors, oldest→newest across carriers. Drops resolve the image
+  // by OBJECT IDENTITY at execution time (indices go stale after earlier splices) and
+  // delete an emptied images field per the builder's omission contract.
+  const targets: NormalizeTarget[] = [];
+  for (const carrier of carriers) {
+    for (const img of carrier.images ?? []) {
+      targets.push({
+        base64: typeof img.source?.bytes === "string" && img.source.bytes.length > 0 ? img.source.bytes : null,
+        mediaType: `image/${(img.format || "jpeg").toLowerCase()}`,
+        replace: (data: string, mediaType: string) => {
+          img.source.bytes = data;
+          img.format = (mediaType.split("/")[1] ?? "jpeg").toLowerCase();
+        },
+        drop: (note: string) => {
+          const arr = carrier.images;
+          if (arr) {
+            const idx = arr.indexOf(img);
+            if (idx !== -1) arr.splice(idx, 1);
+            if (arr.length === 0) delete carrier.images;
+          }
+          appendNote(carrier, note);
+        },
+      });
+    }
+  }
+  await normalizeImageTargets(targets, {
+    budget: KIRO_IMAGE_BASE64_BUDGET,
+    overflowAction: "drop",
+    ...(opts ?? {}),
+  });
+}

package/src/adapters/kiro.ts

@@ -25,7 +25,7 @@ import type {
 } from "../types";
 import type { ProviderAdapter } from "./base";
 import type { AdapterFetchContext, AdapterRequest } from "./base";
-import { extractKiroImages, type KiroImage } from "./kiro-images";
+import { extractKiroImages, normalizeKiroImages, type KiroImage } from "./kiro-images";
 import { fetchKiroWithRetry } from "./kiro-retry";
 import { convertKiroToolContext } from "./kiro-tools";
 import { neutralizeIdentity } from "./identity";
@@ -497,7 +497,7 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
   let toolNameMap: Map<string, string> | undefined;
   return {
     name: "kiro",
-    buildRequest(parsed: OcxParsedRequest) {
+    async buildRequest(parsed: OcxParsedRequest) {
       if (typeof provider.apiKey !== "string" || provider.apiKey.trim() === "") {
         throw new Error("kiro token missing — run ocx login kiro");
       }
@@ -520,6 +520,10 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
       // fake-reasoning contract by injecting effort-derived thinking tags into only the current user turn.
       const built = buildKiroPayload(parsed, profileArn);
       toolNameMap = built.nameMap;
+      // Generous image pipeline (devlog/260714_image_normalization_pipeline/050):
+      // tier-normalize + cap images before serialization so bodyBytes below reflects
+      // the normalized size.
+      await normalizeKiroImages(built.payload);
       const body = JSON.stringify(built.payload);
       debugProviderDiagnostic("kiro", "request", {
         region,

package/src/adapters/mimo-free.ts

@@ -0,0 +1,228 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getConfigDir } from "../config";
+import type { OcxProviderConfig, OcxParsedRequest } from "../types";
+import { createOpenAIChatAdapter } from "./openai-chat";
+import type { ProviderAdapter, AdapterRequest } from "./base";
+
+const BOOTSTRAP_URL = "https://api.xiaomimimo.com/api/free-ai/bootstrap";
+export const MIMO_CHAT_URL = "https://api.xiaomimimo.com/api/free-ai/openai/chat";
+
+/**
+ * Anti-abuse gate: the free chat endpoint returns 403 "Illegal access" unless
+ * a system message contains this exact string as a substring.
+ */
+export const MIMO_SYSTEM_MARKER =
+  "You are MiMoCode, an interactive CLI tool that helps users with software engineering tasks.";
+
+// Chrome-like User-Agent required by the upstream anti-abuse gate.
+const USER_AGENTS = [
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+  "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+];
+
+const JWT_FALLBACK_TTL_MS = 3_000_000; // 50 min
+const JWT_EXPIRY_BUFFER_MS = 300_000;  // 5 min early refresh
+const BOOTSTRAP_TIMEOUT_MS = 15_000;
+
+// In-process JWT cache -- survives across requests, reset on restart.
+let cachedJwt: string | null = null;
+let jwtExpiresAt = 0;
+// Single-flight guard: concurrent first requests share one bootstrap.
+let inFlightJwt: Promise<string> | null = null;
+
+function randomUserAgent(): string {
+  return USER_AGENTS[Math.floor(Math.random() * USER_AGENTS.length)]!;
+}
+
+/**
+ * Anonymous per-install client id for the bootstrap `client` field. A random UUID
+ * persisted under the config dir (OPENCODEX_HOME-aware) — deliberately NOT derived
+ * from machine attributes (hostname/username/CPU), which would be a stable
+ * pseudonymous device fingerprint. Delete the file to rotate the id.
+ */
+let cachedClientId: string | null = null;
+export function getMimoClientId(): string {
+  if (cachedClientId) return cachedClientId;
+  const dir = getConfigDir();
+  const file = join(dir, "mimo-client-id");
+  try {
+    if (existsSync(file)) {
+      const stored = readFileSync(file, "utf8").trim();
+      if (/^[0-9a-f-]{36}$/i.test(stored)) {
+        cachedClientId = stored;
+        return stored;
+      }
+    }
+  } catch { /* fall through to regenerate */ }
+  const fresh = randomUUID();
+  try {
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    writeFileSync(file, `${fresh}\n`, "utf8");
+  } catch { /* persist best-effort; still usable for this process */ }
+  cachedClientId = fresh;
+  return fresh;
+}
+
+/** Test hook: clear the in-process client-id cache (file state is the test's concern). */
+export function resetMimoClientIdCache(): void {
+  cachedClientId = null;
+}
+
+function parseJwtExp(jwt: string): number {
+  try {
+    const parts = jwt.split(".");
+    if (parts.length < 2) return 0;
+    const payload = JSON.parse(Buffer.from(parts[1]!, "base64").toString()) as { exp?: number };
+    if (payload.exp) return payload.exp * 1000;
+  } catch { /* ignore */ }
+  return Date.now() + JWT_FALLBACK_TTL_MS;
+}
+
+export function resetMimoJwtCache(): void {
+  cachedJwt = null;
+  jwtExpiresAt = 0;
+  inFlightJwt = null;
+}
+
+async function fetchJwt(signal?: AbortSignal): Promise<string> {
+  // Bounded bootstrap: request-abort propagates, and a stalled bootstrap can never
+  // hang past BOOTSTRAP_TIMEOUT_MS.
+  const timeout = AbortSignal.timeout(BOOTSTRAP_TIMEOUT_MS);
+  const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+  const response = await fetch(BOOTSTRAP_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "User-Agent": randomUserAgent(),
+    },
+    body: JSON.stringify({ client: getMimoClientId() }),
+    signal: combined,
+  });
+  if (!response.ok) {
+    try { await response.body?.cancel(); } catch { /* already consumed */ }
+    throw new Error(`MiMo bootstrap failed: ${response.status}`);
+  }
+  const data = await response.json() as { jwt?: string };
+  if (!data.jwt) throw new Error("MiMo bootstrap returned no JWT");
+  return data.jwt;
+}
+
+export async function getMimoJwt(signal?: AbortSignal): Promise<string> {
+  if (cachedJwt && Date.now() < jwtExpiresAt - JWT_EXPIRY_BUFFER_MS) {
+    return cachedJwt;
+  }
+  // Single-flight: concurrent callers await the same bootstrap instead of issuing
+  // parallel bootstraps.
+  if (!inFlightJwt) {
+    inFlightJwt = (async () => {
+      try {
+        const jwt = await fetchJwt(signal);
+        cachedJwt = jwt;
+        jwtExpiresAt = parseJwtExp(jwt);
+        return jwt;
+      } finally {
+        inFlightJwt = null;
+      }
+    })();
+  }
+  return inFlightJwt;
+}
+
+/**
+ * Idempotently prepend the MiMo anti-abuse system marker if it is not already present.
+ * The marker must appear in a system message; we prepend one if the request has none with it.
+ */
+export function injectMimoSystemMarker(body: unknown): unknown {
+  if (!body || typeof body !== "object") return body;
+  const parsed = body as Record<string, unknown>;
+  const messages = parsed["messages"];
+  if (!Array.isArray(messages)) return body;
+  const hasMarker = messages.some(
+    (m): m is { role: string; content: string } =>
+      m !== null &&
+      typeof m === "object" &&
+      (m as Record<string, unknown>)["role"] === "system" &&
+      typeof (m as Record<string, unknown>)["content"] === "string" &&
+      ((m as Record<string, unknown>)["content"] as string).includes(MIMO_SYSTEM_MARKER),
+  );
+  if (hasMarker) return body;
+  return { ...parsed, messages: [{ role: "system", content: MIMO_SYSTEM_MARKER }, ...messages] };
+}
+
+/**
+ * Creates the MiMo Free adapter. Wraps openai-chat's request builder to inject:
+ *   1. JWT from the bootstrap endpoint (cached, auto-refreshed).
+ *   2. Anti-abuse system marker in the request body.
+ *   3. Required headers (User-Agent, X-Mimo-Source, x-session-affinity).
+ * On 401/403, flushes the JWT cache and retries once via fetchResponse.
+ */
+export function createMimoFreeAdapter(provider: OcxProviderConfig): ProviderAdapter {
+  const base = createOpenAIChatAdapter(provider);
+  // Per-adapter session-affinity id (random, per process instance).
+  const sessionId = `ses_${Math.random().toString(36).slice(2, 26)}`;
+
+  return {
+    ...base,
+    name: "mimo-free",
+
+    async buildRequest(parsed: OcxParsedRequest): Promise<AdapterRequest> {
+      const jwt = await getMimoJwt();
+
+      // Let the base adapter build the wire body (handles reasoning, tools, etc.)
+      // but override the URL and headers after.
+      const baseReq = base.buildRequest(parsed) as AdapterRequest;
+      const baseBody = JSON.parse(baseReq.body as string) as unknown;
+      const markedBody = injectMimoSystemMarker(baseBody);
+
+      const headers: Record<string, string> = {
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${jwt}`,
+        "X-Mimo-Source": "mimocode-cli-free",
+        "User-Agent": randomUserAgent(),
+        "x-session-affinity": sessionId,
+        "Accept": parsed.stream ? "text/event-stream" : "application/json",
+      };
+
+      return {
+        url: MIMO_CHAT_URL,
+        method: "POST",
+        headers,
+        body: JSON.stringify(markedBody),
+      };
+    },
+
+    async fetchResponse(request: AdapterRequest, ctx): Promise<Response> {
+      const response = await fetch(request.url, {
+        method: request.method,
+        headers: request.headers as Record<string, string>,
+        body: request.body,
+        signal: ctx?.abortSignal,
+      });
+
+      // Retry predicate: 401 (expired/invalid JWT) retries ONCE with a fresh token.
+      // 403 is NOT retried — Xiaomi uses it for anti-abuse "Illegal access" and there is
+      // no documented token-expiry signature that would mark a 403 as retryable.
+      if (response.status === 401) {
+        // Drain the first response body before issuing the retry.
+        try { await response.body?.cancel(); } catch { /* already consumed */ }
+        resetMimoJwtCache();
+        const freshJwt = await getMimoJwt(ctx?.abortSignal);
+        const retryHeaders = {
+          ...(request.headers as Record<string, string>),
+          "Authorization": `Bearer ${freshJwt}`,
+        };
+        return fetch(request.url, {
+          method: request.method,
+          headers: retryHeaders,
+          body: request.body,
+          signal: ctx?.abortSignal,
+        });
+      }
+
+      return response;
+    },
+  };
+}