@moonshot-ai/kimi-code 0.23.4 → 0.23.5

package/dist/main.mjs

@@ -1083,13 +1083,42 @@ var init_capability = __esmMin((() => {
 function isRetryableGenerateError(error) {
 	if (error instanceof APIConnectionError$3 || error instanceof APITimeoutError) return true;
 	if (error instanceof APIEmptyResponseError) return true;
-	return error instanceof APIStatusError && [
+	if (error instanceof APIStatusError) return [
+		408,
+		409,
 		429,
 		500,
 		502,
 		503,
-		504
+		504,
+		529
 	].includes(error.statusCode);
+	return error instanceof ChatProviderError && !isImageFormatError(error);
+}
+/**
+* Whether the provider rejected an IMAGE in the request because of its
+* FORMAT or DATA — an unsupported media type or undecodable image bytes.
+* The rejection is deterministic for a given history (the same image is
+* re-sent on every request, so the session would fail every turn), and the
+* only recovery is to resend once with all media stripped (see the
+* media-stripped resend in the agent loop). Body-size (413), context
+* overflow, image count/size limits, image-input-disabled rejections, and
+* non-image (audio/video) media rejections are excluded — the first two
+* have their own recoveries, and the rest are not fixed by stripping media.
+*/
+function isImageFormatError(error) {
+	if (error instanceof APIStatusError) {
+		if (error instanceof APIContextOverflowError) return false;
+		if (error instanceof APIRequestTooLargeError) return false;
+		if (error.statusCode !== 400) return false;
+		const lowerMessage = error.message.toLowerCase();
+		return IMAGE_FORMAT_STATUS_MESSAGE_PATTERNS.some((pattern) => pattern.test(lowerMessage)) || MEDIA_TYPE_FIELD_PATTERN.test(lowerMessage) && lowerMessage.includes("image");
+	}
+	if (error instanceof ChatProviderError) {
+		const lowerMessage = error.message.toLowerCase();
+		return IMAGE_FORMAT_PROVIDER_MESSAGE_PATTERNS.some((pattern) => pattern.test(lowerMessage));
+	}
+	return false;
 }
 /**
 * Classify a raw (non-SDK) error message into the right transport-layer
@@ -1107,11 +1136,25 @@ function classifyBaseApiError(message) {
 function isContextOverflowErrorCode(code) {
 	return code === "context_length_exceeded";
 }
-function normalizeAPIStatusError(statusCode, message, requestId) {
-	if (statusCode === 429) return new APIProviderRateLimitError(message, requestId);
-	if (isContextOverflowStatusError(statusCode, message)) return new APIContextOverflowError(statusCode, message, requestId);
-	if (isRequestTooLargeStatusError(statusCode, message)) return new APIRequestTooLargeError(statusCode, message, requestId);
-	return new APIStatusError(statusCode, message, requestId);
+function normalizeAPIStatusError(statusCode, message, requestId, retryAfterMs) {
+	if (statusCode === 429) return new APIProviderRateLimitError(message, requestId, retryAfterMs);
+	if (isContextOverflowStatusError(statusCode, message)) return new APIContextOverflowError(statusCode, message, requestId, retryAfterMs);
+	if (isRequestTooLargeStatusError(statusCode, message)) return new APIRequestTooLargeError(statusCode, message, requestId, retryAfterMs);
+	return new APIStatusError(statusCode, message, requestId, retryAfterMs);
+}
+/**
+* Parse a `retry-after` response header into milliseconds. Only integer
+* seconds is honored; an HTTP-date (or any non-integer / missing value)
+* returns null and the caller falls back to its computed backoff. Shared by
+* the provider error converters so every backend honors the same server
+* backoff directive.
+*/
+function parseRetryAfterMs(headers) {
+	const raw = headers !== null && typeof headers === "object" && typeof headers.get === "function" ? headers.get("retry-after") : null;
+	if (raw === null || raw === void 0) return null;
+	const seconds = Number.parseInt(raw, 10);
+	if (!Number.isFinite(seconds) || seconds < 0) return null;
+	return seconds * 1e3;
 }
 function isContextOverflowStatusError(statusCode, message) {
 	if (statusCode !== 400 && statusCode !== 413 && statusCode !== 422) return false;
@@ -1163,7 +1206,7 @@ function getStatusCode(error) {
 function errorMessage$6(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-var ChatProviderError, APIConnectionError$3, APITimeoutError, APIStatusError, APIContextOverflowError, APIRequestTooLargeError, APIProviderRateLimitError, APIEmptyResponseError, NETWORK_RE$1, TIMEOUT_RE$1, CONTEXT_OVERFLOW_MESSAGE_PATTERNS, PROVIDER_RATE_LIMIT_MESSAGE_PATTERNS, REQUEST_TOO_LARGE_MESSAGE_PATTERNS, TOOL_EXCHANGE_ADJACENCY_MESSAGE_PATTERNS, STRUCTURAL_REQUEST_MESSAGE_PATTERNS;
+var ChatProviderError, APIConnectionError$3, APITimeoutError, APIStatusError, APIContextOverflowError, APIRequestTooLargeError, APIProviderRateLimitError, APIEmptyResponseError, IMAGE_FORMAT_PROVIDER_MESSAGE_PATTERNS, IMAGE_FORMAT_STATUS_MESSAGE_PATTERNS, MEDIA_TYPE_FIELD_PATTERN, NETWORK_RE$1, TIMEOUT_RE$1, CONTEXT_OVERFLOW_MESSAGE_PATTERNS, PROVIDER_RATE_LIMIT_MESSAGE_PATTERNS, REQUEST_TOO_LARGE_MESSAGE_PATTERNS, TOOL_EXCHANGE_ADJACENCY_MESSAGE_PATTERNS, STRUCTURAL_REQUEST_MESSAGE_PATTERNS;
 var init_errors$12 = __esmMin((() => {
 	ChatProviderError = class extends Error {
 		constructor(message) {
@@ -1186,28 +1229,36 @@ var init_errors$12 = __esmMin((() => {
 	APIStatusError = class extends ChatProviderError {
 		statusCode;
 		requestId;
-		constructor(statusCode, message, requestId) {
+		/**
+		* Server-requested backoff from the `retry-after` response header, in
+		* milliseconds. When present, the retry loop honors it instead of its own
+		* computed backoff — a server `Retry-After` directive overrides the local
+		* exponential delay.
+		*/
+		retryAfterMs;
+		constructor(statusCode, message, requestId, retryAfterMs) {
 			super(message);
 			this.name = "APIStatusError";
 			this.statusCode = statusCode;
 			this.requestId = requestId ?? null;
+			this.retryAfterMs = retryAfterMs ?? null;
 		}
 	};
 	APIContextOverflowError = class extends APIStatusError {
-		constructor(statusCode, message, requestId) {
-			super(statusCode, message, requestId);
+		constructor(statusCode, message, requestId, retryAfterMs) {
+			super(statusCode, message, requestId, retryAfterMs);
 			this.name = "APIContextOverflowError";
 		}
 	};
 	APIRequestTooLargeError = class extends APIStatusError {
-		constructor(statusCode, message, requestId) {
-			super(statusCode, message, requestId);
+		constructor(statusCode, message, requestId, retryAfterMs) {
+			super(statusCode, message, requestId, retryAfterMs);
 			this.name = "APIRequestTooLargeError";
 		}
 	};
 	APIProviderRateLimitError = class extends APIStatusError {
-		constructor(message, requestId) {
-			super(429, message, requestId);
+		constructor(message, requestId, retryAfterMs) {
+			super(429, message, requestId, retryAfterMs);
 			this.name = "APIProviderRateLimitError";
 		}
 	};
@@ -1221,6 +1272,16 @@ var init_errors$12 = __esmMin((() => {
 			this.rawFinishReason = options.rawFinishReason ?? null;
 		}
 	};
+	IMAGE_FORMAT_PROVIDER_MESSAGE_PATTERNS = [/unsupported media type for base64 image/, /invalid data url for image/];
+	IMAGE_FORMAT_STATUS_MESSAGE_PATTERNS = [
+		/unsupported image (?:url|format|type)/,
+		/does not represent a valid image/,
+		/could not (?:process|decode) (?:the |input )?image/,
+		/unable to process (?:the |input )?image/,
+		/failed to decode (?:the )?image/,
+		/invalid image(?: data| type| format)?/
+	];
+	MEDIA_TYPE_FIELD_PATTERN = /(?:media|mime)_?type/;
 	NETWORK_RE$1 = /network|connection|connect|disconnect|terminated/i;
 	TIMEOUT_RE$1 = /timed?\s*out|timeout|deadline/i;
 	CONTEXT_OVERFLOW_MESSAGE_PATTERNS = [
@@ -9608,7 +9669,7 @@ function convertAnthropicError(error) {
 	if (error instanceof APIConnectionError$2) return new APIConnectionError$3(error.message);
 	if (error instanceof APIError$2 && typeof error.status === "number") {
 		const reqId = error.requestID ?? null;
-		return normalizeAPIStatusError(error.status, error.message, reqId);
+		return normalizeAPIStatusError(error.status, error.message, reqId, parseRetryAfterMs(error.headers));
 	}
 	if (error instanceof AnthropicError) return new ChatProviderError(`Anthropic error: ${error.message}`);
 	if (error instanceof Error) return classifyBaseApiError(error.message);
@@ -53199,7 +53260,7 @@ function convertOpenAIError(error) {
 	if (error instanceof APIConnectionError) return new APIConnectionError$3(error.message);
 	if (error instanceof APIError && typeof error.status === "number") {
 		const reqId = error.requestID ?? null;
-		return normalizeAPIStatusError(error.status, error.message, reqId);
+		return normalizeAPIStatusError(error.status, error.message, reqId, parseRetryAfterMs(error.headers));
 	}
 	if (error instanceof APIError && error.constructor === APIError && error.error === void 0) return classifyBaseApiError(error.message);
 	if (error instanceof OpenAIError) return new ChatProviderError(`Error: ${error.message}`);
@@ -54315,10 +54376,14 @@ function functionCallId(callId) {
 function formatResponsesErrorEvent(code, message, param) {
 	return `${code ?? "unknown"}: ${message}${param === null ? "" : ` (param: ${param})`}`;
 }
+function readEmbeddedStatusCode(message) {
+	const match = EMBEDDED_STATUS_CODE_RE.exec(message);
+	return match === null ? void 0 : Number(match[1]);
+}
 function errorFromOpenAIResponsesEvent(prefix, code, message, param) {
 	const fullMessage = `${prefix}: ${formatResponsesErrorEvent(code, message, param)}`;
 	if (isContextOverflowErrorCode(code)) return new APIContextOverflowError(400, fullMessage);
-	if (code === "rate_limit_exceeded") return new APIProviderRateLimitError(fullMessage);
+	if (code === "rate_limit_exceeded" || readEmbeddedStatusCode(message) === 429) return new APIProviderRateLimitError(fullMessage);
 	return new ChatProviderError(fullMessage);
 }
 function parseNestedGatewayStreamError(message) {
@@ -54589,7 +54654,7 @@ function convertHistoryMessages(history, modelName, toolMessageConversion) {
 	flushPendingMedia();
 	return input;
 }
-var OPENAI_RESPONSES_TOOL_CALL_ID_POLICY, OMITTED_AUDIO_PLACEHOLDER, OMITTED_VIDEO_PLACEHOLDER, OpenAIResponsesStreamedMessage, OpenAIResponsesChatProvider;
+var OPENAI_RESPONSES_TOOL_CALL_ID_POLICY, EMBEDDED_STATUS_CODE_RE, OMITTED_AUDIO_PLACEHOLDER, OMITTED_VIDEO_PLACEHOLDER, OpenAIResponsesStreamedMessage, OpenAIResponsesChatProvider;
 var init_openai_responses = __esmMin((() => {
 	init_errors$12();
 	init_message$3();
@@ -54602,6 +54667,7 @@ var init_openai_responses = __esmMin((() => {
 		normalize: (id) => sanitizeOpenAIResponsesCallId(id, 64),
 		maxLength: 64
 	};
+	EMBEDDED_STATUS_CODE_RE = /\bstatus_code\s*[:=]\s*(\d{3})\b/;
 	OMITTED_AUDIO_PLACEHOLDER = "(audio omitted: unsupported audio format)";
 	OMITTED_VIDEO_PLACEHOLDER = "(video omitted: not supported by this provider)";
 	OpenAIResponsesStreamedMessage = class {
@@ -69080,6 +69146,174 @@ var init_file_type$1 = __esmMin((() => {
 	});
 }));
 //#endregion
+//#region ../../packages/agent-core/src/tools/support/image-format-policy.ts
+/**
+* Lowercase, drop MIME parameters, and apply the `image/jpg` alias. Parameter
+* stripping keeps a declared media type like `image/jpeg; charset=utf-8`
+* consistent with a data-URL MIME token (which the parser already clips at
+* the first `;`), so an accepted image with parameters is treated exactly
+* like the bare form instead of being misread as unsupported.
+*/
+function normalizeImageMime(mimeType) {
+	const lower = mimeType.trim().toLowerCase();
+	const semi = lower.indexOf(";");
+	const base = (semi === -1 ? lower : lower.slice(0, semi)).trim();
+	return base === "image/jpg" ? "image/jpeg" : base;
+}
+/**
+* Decode just the prefix of a base64 payload needed for magic-byte
+* sniffing, without allocating the full image. `Buffer.from` never throws
+* on malformed base64 — it decodes what it can.
+*/
+function decodeBase64Prefix(base64) {
+	return Buffer.from(base64.slice(0, BASE64_SNIFF_CHARS), "base64");
+}
+/**
+* The MIME an image should be judged by: the sniffed bytes when the magic
+* header is recognized (bytes are authoritative — a mislabeled image, e.g.
+* AVIF bytes an MCP image search tool labels `image/png`, is gated on what
+* it IS, because the provider decodes bytes not labels), else the declared
+* MIME. A header recognized as a non-image container also wins, so a video
+* file hiding in an image part is refused instead of trusted.
+*/
+function resolveEffectiveImageMime(declaredMime, header) {
+	const sniffed = sniffMediaFromMagic(header);
+	return sniffed !== null ? sniffed.mimeType : declaredMime;
+}
+/**
+* Whether a non-data image URL points at a format providers reject, judged
+* by its path extension. A best-effort heuristic for the case where there
+* are no bytes to sniff (a remote http(s) image): catches the common
+* search-tool direct link ending in `.avif`. Query string and fragment are
+* ignored; the match is case-insensitive. URLs without an extension, or
+* whose extension lies, fall through to the provider — and to the 400
+* recovery — unchanged.
+*
+* Returns the unsupported MIME when the extension is known and not in the
+* accepted set (so the notice names the right format), else null.
+*/
+function unsupportedImageMimeFromUrl(url) {
+	let path = url;
+	const query = path.indexOf("?");
+	if (query !== -1) path = path.slice(0, query);
+	const hash = path.indexOf("#");
+	if (hash !== -1) path = path.slice(0, hash);
+	const dot = path.lastIndexOf(".");
+	if (dot === -1) return null;
+	const ext = path.slice(dot).toLowerCase();
+	const mime = ext === ".svg" ? "image/svg+xml" : IMAGE_MIME_BY_SUFFIX[ext];
+	if (mime === void 0 || isModelAcceptedImageMime(mime)) return null;
+	return mime;
+}
+/**
+* Parse an image `data:` URL into its MIME and base64 payload. The MIME is
+* returned raw — callers decide via {@link isModelAcceptedImageMime} and
+* forward {@link normalizeImageMime}. MIME parameters are tolerated and
+* ignored (`data:image/avif;charset=utf-8;base64,…`), so a parameter-bearing
+* URL cannot slip past the format gate. The scheme and `base64` marker are
+* matched case-insensitively (RFC 2045 encoding names are case-insensitive),
+* so an uppercase `;BASE64,` cannot slip past either — and since callers
+* rebuild to the canonical URL, the marker comes back out lowercase.
+* Returns null for non-data URLs (e.g. a remote http(s) image — see the
+* scope note in the module header).
+*/
+function parseImageDataUrl(url) {
+	const match = /^data:([^;,]+)(?:;[^;,]+)*?;base64,(.*)$/is.exec(url);
+	if (match === null) return null;
+	return {
+		mimeType: match[1],
+		base64: match[2]
+	};
+}
+/**
+* Whether a URL claims to be a `data:` URL (the scheme is case-insensitive).
+* Used to distinguish "failed to parse a data URL" (malformed — guaranteed
+* to fail at the provider) from "not a data URL" (a remote http(s) image
+* the provider fetches).
+*/
+function isDataUrl(url) {
+	return url.toLowerCase().startsWith("data:");
+}
+/**
+* Whether an image with this MIME may be sent to the model. Only the closed
+* accepted set passes; everything else must be refused at the entry point —
+* once an unsupported `image_url` lands in the session history, every later
+* request in the session is rejected by the provider.
+*/
+function isModelAcceptedImageMime(mimeType) {
+	return MODEL_ACCEPTED_IMAGE_MIMES.has(normalizeImageMime(mimeType));
+}
+/**
+* Refusal for an unsupported image that has a readable file path, with a
+* conversion command matching the execution environment (`kaos.osEnv.osKind`
+* — where Bash actually runs, so SSH/container sessions get the right command
+* too). The model can run the command through Bash (under the normal
+* permission flow) and read the converted file.
+*
+* macOS converts with the built-in `sips`; Linux and Windows have no built-in
+* decoder for these formats, so the guidance names ImageMagick (plus the
+* format's dedicated Linux decoder when one exists, e.g. heif-convert).
+*/
+function buildImageConversionGuidance(path, mimeType, osKind) {
+	const converted = path.replace(/\.[^./\\]+$/, "") + ".jpg";
+	return `"${path}" is an ${mimeType} image, which the provider does not accept. Convert it to JPEG first, then read the converted file. ` + imageConversionCommand(path, converted, osKind, UNSUPPORTED_IMAGE_FORMATS[normalizeImageMime(mimeType)]);
+}
+function imageConversionCommand(path, converted, osKind, format) {
+	const magick = `magick "${path}" "${converted}"`;
+	const linuxDecoder = format?.linuxDecoder;
+	switch (osKind) {
+		case "macOS": return `On macOS: sips -s format jpeg "${path}" --out "${converted}"`;
+		case "Linux": return linuxDecoder === void 0 ? `On Linux, with ImageMagick: ${magick}` : `On Linux: ${linuxDecoder.command} "${path}" "${converted}" (package ${linuxDecoder.packageName}), or with ImageMagick: ${magick}`;
+		case "Windows": return `On Windows, with ImageMagick: ${magick} (install it first if missing: winget install ImageMagick.ImageMagick)`;
+		default: return `Options: sips -s format jpeg "${path}" --out "${converted}" (macOS)` + (linuxDecoder === void 0 ? "" : `, ${linuxDecoder.command} "${path}" "${converted}" (Linux, package ${linuxDecoder.packageName})`) + `, or ${magick} (ImageMagick)`;
+	}
+}
+/**
+* Short notice standing in for an unsupported image where there is no file
+* path to point at (MCP tool results, prompt uploads): the image part is
+* dropped and this text replaces it, so the model knows what happened and
+* the session history stays free of formats the provider rejects.
+*/
+function buildUnsupportedImageNotice(mimeType, name) {
+	return `[Image omitted: ${name === void 0 || name.length === 0 ? `unsupported image format ${mimeType}` : `"${name}" uses unsupported image format ${mimeType}`}. Model providers accept only ${ACCEPTED_FORMATS_TEXT} — convert it to PNG or JPEG and try again.]`;
+}
+/**
+* Notice standing in for an image part whose `data:` URL could not be parsed
+* at all (missing `;base64,` separator, empty MIME, …): the provider is
+* guaranteed to reject it, so it is dropped at ingestion instead of being
+* left to poison the session and trigger the media-stripped resend on every
+* later turn. The URL is truncated — a malformed payload can be huge.
+*/
+function buildMalformedImageNotice(url) {
+	return `[Image omitted: "${url.length > 80 ? `${url.slice(0, 80)}…` : url}" is not a valid data URL (its header or payload could not be parsed). Re-encode the image as PNG or JPEG and try again.]`;
+}
+var MODEL_ACCEPTED_IMAGE_MIMES, ACCEPTED_FORMATS_TEXT, UNSUPPORTED_IMAGE_FORMATS, BASE64_SNIFF_CHARS;
+var init_image_format_policy = __esmMin((() => {
+	init_file_type$1();
+	MODEL_ACCEPTED_IMAGE_MIMES = new Set([
+		"image/png",
+		"image/jpeg",
+		"image/gif",
+		"image/webp"
+	]);
+	ACCEPTED_FORMATS_TEXT = "PNG, JPEG, GIF, and WebP";
+	UNSUPPORTED_IMAGE_FORMATS = Object.freeze({
+		"image/avif": {},
+		"image/heic": { linuxDecoder: {
+			command: "heif-convert",
+			packageName: "libheif-examples"
+		} },
+		"image/heif": { linuxDecoder: {
+			command: "heif-convert",
+			packageName: "libheif-examples"
+		} },
+		"image/bmp": {},
+		"image/tiff": {},
+		"image/x-icon": {}
+	});
+	BASE64_SNIFF_CHARS = 48;
+}));
+//#endregion
 //#region ../../node_modules/.pnpm/@jsquash+webp@1.5.0/node_modules/@jsquash/webp/codec/dec/webp_dec.js
 var Module;
 var init_webp_dec = __esmMin((() => {
@@ -111969,7 +112203,7 @@ async function compressImageForModel(bytes, mimeType, options = {}) {
 	const maxEdge = options.maxEdge ?? resolveMaxImageEdgePx();
 	const byteBudget = options.byteBudget ?? 3932160;
 	const maxDecodeBytes = options.maxDecodeBytes ?? MAX_DECODE_BYTES;
-	const normalizedMime = normalizeMime(mimeType);
+	const normalizedMime = normalizeImageMime(mimeType);
 	const dims = sniffImageDimensions(bytes);
 	const passthrough = () => ({
 		data: bytes,
@@ -112031,7 +112265,10 @@ async function compressImageForModel(bytes, mimeType, options = {}) {
 /**
 * Convenience wrapper for call sites that already hold base64 (MCP results,
 * data URLs). Decodes, compresses, and re-encodes to base64. Best effort:
-* returns the original base64 unchanged on any failure.
+* returns the original base64 unchanged on any failure — including formats it
+* cannot re-encode, so callers must refuse MIME types outside the
+* provider-accepted set (`isModelAcceptedImageMime`) before building an
+* image part from the result.
 */
 async function compressBase64ForModel(base64, mimeType, options = {}) {
 	const startedAt = Date.now();
@@ -112052,7 +112289,7 @@ async function compressBase64ForModel(base64, mimeType, options = {}) {
 		reportCompressEvent(options.telemetry, {
 			outcome: "passthrough_guard",
 			startedAt,
-			inputMime: normalizeMime(mimeType),
+			inputMime: normalizeImageMime(mimeType),
 			exifTransposed: false,
 			result
 		});
@@ -112076,7 +112313,7 @@ async function compressBase64ForModel(base64, mimeType, options = {}) {
 		reportCompressEvent(options.telemetry, {
 			outcome: "passthrough_error",
 			startedAt,
-			inputMime: normalizeMime(mimeType),
+			inputMime: normalizeImageMime(mimeType),
 			exifTransposed: false,
 			result
 		});
@@ -112107,6 +112344,76 @@ async function compressBase64ForModel(base64, mimeType, options = {}) {
 	};
 }
 /**
+* Enforce the provider-accepted image format set (see ./image-format-policy)
+* on a content-part list. Inline `data:` image parts whose MIME is outside
+* the accepted set are dropped and replaced with a text notice, so one
+* unsupported image cannot poison the session history. Accepted images are
+* forwarded only as the byte-exact canonical data URL: an alias
+* (`image/jpg`), case/whitespace variants, or MIME parameters
+* (`image/jpeg;charset=utf-8`) all rebuild to the bare canonical form,
+* because strict provider whitelists exact-match the full header. Remote
+* (non-data) image URLs and non-image parts pass through — a URL carries no
+* bytes to inspect.
+*
+* The BYTES are authoritative, not the declared MIME: the header of each
+* inline image is sniffed, and a mismatch (e.g. AVIF bytes an MCP image
+* search tool labels `image/png`) is gated on what the image IS — the
+* provider decodes bytes, not labels. When the sniffer doesn't recognize
+* the bytes (corrupt image, exotic container), the declared MIME stands
+* and the 400-recovery path remains the backstop.
+*
+* This is the format gate shared by every ingestion point; run it BEFORE
+* compression so unsupported bytes are never decoded.
+*/
+function gateImageFormatParts(parts) {
+	const out = [];
+	for (const part of parts) {
+		if (part.type === "image_url") {
+			const parsed = parseImageDataUrl(part.imageUrl.url);
+			if (parsed === null) {
+				if (isDataUrl(part.imageUrl.url)) {
+					out.push({
+						type: "text",
+						text: buildMalformedImageNotice(part.imageUrl.url)
+					});
+					continue;
+				}
+				const extMime = unsupportedImageMimeFromUrl(part.imageUrl.url);
+				if (extMime !== null) {
+					out.push({
+						type: "text",
+						text: buildUnsupportedImageNotice(extMime, part.imageUrl.url)
+					});
+					continue;
+				}
+				out.push(part);
+				continue;
+			}
+			const effectiveMime = resolveEffectiveImageMime(parsed.mimeType, decodeBase64Prefix(parsed.base64));
+			if (!isModelAcceptedImageMime(effectiveMime)) {
+				out.push({
+					type: "text",
+					text: buildUnsupportedImageNotice(effectiveMime)
+				});
+				continue;
+			}
+			const canonicalUrl = `data:${normalizeImageMime(effectiveMime)};base64,${parsed.base64}`;
+			if (part.imageUrl.url !== canonicalUrl) {
+				out.push({
+					type: "image_url",
+					imageUrl: {
+						...part.imageUrl,
+						url: canonicalUrl
+					}
+				});
+				continue;
+			}
+		}
+		out.push(part);
+	}
+	return out;
+}
+/**
 * Compress any inline base64 image parts in a content-part list — used by
 * the MCP tool-result path (prompt ingestion compresses per image with
 * {@link compressBase64ForModel} while constructing the part). Image parts
@@ -112114,6 +112421,13 @@ async function compressBase64ForModel(base64, mimeType, options = {}) {
 * through, as are non-image parts. Best effort: a part that fails to
 * compress is left unchanged.
 *
+* The format gate ({@link gateImageFormatParts}) runs first: parts whose
+* MIME is outside the provider-accepted set are never forwarded — the part
+* is dropped and a text notice stands in, so one unsupported image cannot
+* poison the session history. This is the MCP funnel's enforcement point —
+* MCP servers can return any `image/*` MIME (e.g. AVIF from an image search
+* tool).
+*
 * With `annotate` set, every image that was actually re-encoded gets a
 * caption in {@link CompressedContentParts.captions} so the model knows it
 * is looking at a downsampled copy. `annotate.persistOriginal` additionally
@@ -112125,9 +112439,9 @@ async function compressImageContentParts(parts, options = {}) {
 	const { annotate, ...compressOptions } = options;
 	const out = [];
 	const captions = [];
-	for (const part of parts) {
+	for (const part of gateImageFormatParts(parts)) {
 		if (part.type === "image_url") {
-			const parsed = parseImageDataUrl$1(part.imageUrl.url);
+			const parsed = parseImageDataUrl(part.imageUrl.url);
 			if (parsed !== null) {
 				const result = await compressBase64ForModel(parsed.base64, parsed.mimeType, compressOptions);
 				if (result.changed) {
@@ -112189,7 +112503,7 @@ async function cropImageForModel(bytes, mimeType, region, options = {}) {
 	const maxEdge = options.maxEdge ?? resolveMaxImageEdgePx();
 	const byteBudget = options.byteBudget ?? 3932160;
 	const maxDecodeBytes = options.maxDecodeBytes ?? MAX_DECODE_BYTES;
-	const normalizedMime = normalizeMime(mimeType);
+	const normalizedMime = normalizeImageMime(mimeType);
 	const fail = (errorKind, error) => {
 		reportCropEvent(options.telemetry, {
 			startedAt,
@@ -112339,14 +112653,6 @@ function formatByteSize$2(bytes) {
 	if (bytes < 1024 * 1024) return `${String(Math.round(bytes / 1024))} KB`;
 	return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 }
-function parseImageDataUrl$1(url) {
-	const match = /^data:([^;,]+);base64,(.*)$/s.exec(url);
-	if (match === null) return null;
-	return {
-		mimeType: match[1],
-		base64: match[2]
-	};
-}
 /**
 * Decode `bytes` into a jimp image. PNG/JPEG decode through jimp itself
 * (which applies EXIF orientation); WebP decodes through the bundled wasm
@@ -112455,10 +112761,6 @@ function fitWithinEdge(image, edge) {
 	});
 	return true;
 }
-function normalizeMime(mimeType) {
-	const lower = mimeType.trim().toLowerCase();
-	return lower === "image/jpg" ? "image/jpeg" : lower;
-}
 /**
 * Emit the `image_compress` event. Properties are all numeric/enum — never
 * paths or content — and a throwing client is swallowed so telemetry can
@@ -112471,7 +112773,7 @@ function reportCompressEvent(telemetry, input) {
 			source: telemetry.source,
 			outcome: input.outcome,
 			input_mime: input.inputMime,
-			output_mime: normalizeMime(input.result.mimeType),
+			output_mime: normalizeImageMime(input.result.mimeType),
 			original_bytes: input.result.originalByteLength,
 			final_bytes: input.result.finalByteLength,
 			original_width: input.result.originalWidth,
@@ -112508,6 +112810,7 @@ function reportCropEvent(telemetry, input) {
 var MAX_IMAGE_EDGE_ENV, IMAGE_BYTE_BUDGET, READ_IMAGE_BYTE_BUDGET_ENV, JPEG_QUALITY_STEPS, FALLBACK_EDGES_PX, PNG_RESCALE_FLOOR_PX, MAX_DECODE_PIXELS, MAX_DECODE_BYTES, RECODABLE_MIME, CAPTION_OPENING, CAPTION_PATTERN;
 var init_image_compress = __esmMin((() => {
 	init_file_type$1();
+	init_image_format_policy();
 	init_webp_decode();
 	MAX_IMAGE_EDGE_ENV = "KIMI_IMAGE_MAX_EDGE_PX";
 	IMAGE_BYTE_BUDGET = 3.75 * 1024 * 1024;
@@ -121073,7 +121376,7 @@ async function chatWithRetry(input) {
 			logRequestFailure(input, error, attempt, maxAttempts);
 			throw error;
 		}
-		const delayMs = delays[attempt - 1] ?? 0;
+		const delayMs = readRetryAfterMs(error) ?? delays[attempt - 1] ?? 0;
 		input.params.signal.throwIfAborted();
 		input.dispatchEvent({
 			type: "step.retrying",
@@ -121113,13 +121416,24 @@ function paramsForAttempt(input, attempt, maxAttempts) {
 	};
 }
 function retryBackoffDelays(maxAttempts) {
-	return import_retry$1.timeouts({
-		retries: Math.max(maxAttempts - 1, 0),
-		minTimeout: RETRY_MIN_TIMEOUT_MS,
-		maxTimeout: RETRY_MAX_TIMEOUT_MS,
-		factor: RETRY_FACTOR,
-		randomize: true
-	});
+	const count = Math.max(maxAttempts - 1, 0);
+	const delays = [];
+	for (let i = 0; i < count; i += 1) {
+		const base = Math.min(BASE_DELAY_MS * Math.pow(RETRY_FACTOR, i), MAX_DELAY_MS);
+		delays.push(base + Math.random() * JITTER_FACTOR * base);
+	}
+	return delays;
+}
+/**
+* Server-requested backoff carried on a kosong `APIStatusError` (parsed from
+* the `retry-after` response header). When present and positive it overrides
+* the computed backoff — a server `Retry-After` directive takes precedence
+* over the local exponential delay.
+*/
+function readRetryAfterMs(error) {
+	if (typeof error !== "object" || error === null) return null;
+	const value = error.retryAfterMs;
+	return typeof value === "number" && value > 0 ? value : null;
 }
 async function sleepForRetry(delayMs, signal) {
 	signal.throwIfAborted();
@@ -121137,15 +121451,15 @@ function maybeStatusCode(error) {
 	const statusCode = error.statusCode;
 	return typeof statusCode === "number" ? statusCode : void 0;
 }
-var import_retry$1, RETRY_MIN_TIMEOUT_MS, RETRY_MAX_TIMEOUT_MS, RETRY_FACTOR;
+var BASE_DELAY_MS, MAX_DELAY_MS, RETRY_FACTOR, JITTER_FACTOR;
 var init_retry = __esmMin((() => {
 	init_dist$4();
-	import_retry$1 = /* @__PURE__ */ __toESM(require_retry$4(), 1);
 	init_abort();
 	init_errors$4();
-	RETRY_MIN_TIMEOUT_MS = 300;
-	RETRY_MAX_TIMEOUT_MS = 5e3;
+	BASE_DELAY_MS = 500;
+	MAX_DELAY_MS = 32e3;
 	RETRY_FACTOR = 2;
+	JITTER_FACTOR = .25;
 }));
 //#endregion
 //#region ../../packages/agent-core/src/tools/support/input-schema.ts
@@ -121988,7 +122302,7 @@ var init_full = __esmMin((() => {
 						summary = extractCompactionSummary(response);
 						break;
 					} catch (error) {
-						if (error instanceof APIRequestTooLargeError && !mediaStripAttempted) {
+						if ((error instanceof APIRequestTooLargeError || isImageFormatError(error)) && !mediaStripAttempted) {
 							mediaStripAttempted = true;
 							const stripped = replaceMediaPartsWithMarkers(historyForModel);
 							if (stripped !== historyForModel) {
@@ -124015,15 +124329,17 @@ function isDegradableMediaPart(part) {
 /**
 * Replace all but the `keepRecent` most recent media parts with deterministic
 * text markers. This is the media-degraded projection used to resend a request
-* the provider rejected as too large (HTTP 413 on accumulated base64 media):
-* a purely read-side transform — the underlying history is left untouched —
-* that trades old pixels for bytes while the surrounding text (including
-* ReadMediaFile's `<image path="...">` wrapper) survives, so the model can
-* re-read any file it still needs. Untouched messages are returned by
-* reference, and when nothing needs degrading the input array itself is
-* returned.
-*/
-function degradeOlderMediaParts(messages, keepRecent) {
+* the provider rejected as too large (HTTP 413 on accumulated base64 media)
+* and — with `keepRecent = 0` and `MEDIA_STRIPPED_PLACEHOLDERS` — the resend
+* after an image-format rejection, where the poisoned image could be anywhere
+* and only a full strip guarantees a clean request. A purely read-side
+* transform — the underlying history is left untouched — that trades pixels
+* for deliverability while the surrounding text (including ReadMediaFile's
+* `<image path="...">` wrapper) survives, so the model can re-read any file
+* it still needs. Untouched messages are returned by reference, and when
+* nothing needs degrading the input array itself is returned.
+*/
+function degradeOlderMediaParts(messages, keepRecent, placeholders = MEDIA_DEGRADED_PLACEHOLDERS) {
 	const mediaCount = messages.reduce((count, message) => count + message.content.filter(isDegradableMediaPart).length, 0);
 	let toDegrade = Math.max(0, mediaCount - keepRecent);
 	if (toDegrade === 0) return messages;
@@ -124034,7 +124350,7 @@ function degradeOlderMediaParts(messages, keepRecent) {
 			toDegrade -= 1;
 			return {
 				type: "text",
-				text: MEDIA_DEGRADED_PLACEHOLDERS[part.type]
+				text: placeholders[part.type]
 			};
 		});
 		return {
@@ -124043,7 +124359,7 @@ function degradeOlderMediaParts(messages, keepRecent) {
 		};
 	});
 }
-var SYNTHETIC_TOOL_RESULT_TEXT, MEDIA_DEGRADED_PLACEHOLDERS;
+var SYNTHETIC_TOOL_RESULT_TEXT, MEDIA_DEGRADED_PLACEHOLDERS, MEDIA_STRIPPED_PLACEHOLDERS;
 var init_projector = __esmMin((() => {
 	init_errors$8();
 	init_tool_result_render();
@@ -124053,6 +124369,11 @@ var init_projector = __esmMin((() => {
 		audio_url: "[audio omitted: dropped to fit the provider request size limit; re-read the file to hear it]",
 		video_url: "[video omitted: dropped to fit the provider request size limit; re-read the file to view it]"
 	};
+	MEDIA_STRIPPED_PLACEHOLDERS = {
+		image_url: "[image omitted: the provider rejected this image; re-read the file for conversion instructions]",
+		audio_url: "[audio omitted: dropped along with a rejected image; re-read the file to hear it]",
+		video_url: "[video omitted: dropped along with a rejected image; re-read the file to view it]"
+	};
 }));
 //#endregion
 //#region ../../packages/agent-core/src/agent/context/types.ts
@@ -124452,6 +124773,9 @@ var init_context$2 = __esmMin((() => {
 		get mediaDegradedMessages() {
 			return degradeOlderMediaParts(this.messages, 2);
 		}
+		get mediaStrippedMessages() {
+			return degradeOlderMediaParts(this.messages, 0, MEDIA_STRIPPED_PLACEHOLDERS);
+		}
 		useProjectedHistoryFrom(source) {
 			this.clear();
 			this.pushHistory(...trimTrailingOpenToolExchange(source.project(source.history)));
@@ -137278,7 +137602,7 @@ var init_tool_call = __esmMin((() => {
 * does not lose model usage that was already spent.
 */
 async function executeLoopStep(deps) {
-	const { turnId, signal, buildMessages, buildMessagesStrict, buildMessagesMediaDegraded, dispatchEvent, llm, tools, buildTools, describeMissingTool, hooks, log, currentStep, maxRetryAttempts, recordUsage } = deps;
+	const { turnId, signal, buildMessages, buildMessagesStrict, buildMessagesMediaDegraded, buildMessagesMediaStripped, dispatchEvent, llm, tools, buildTools, describeMissingTool, hooks, log, currentStep, maxRetryAttempts, recordUsage } = deps;
 	if (hooks?.beforeStep !== void 0) {
 		const beforeStep = await hooks.beforeStep({
 			turnId,
@@ -137333,6 +137657,7 @@ async function executeLoopStep(deps) {
 	};
 	let response;
 	let mediaDegradedResendUsed = false;
+	let mediaStrippedResendUsed = false;
 	try {
 		response = await chatWithRetry({
 			...retryInput,
@@ -137367,6 +137692,34 @@ async function executeLoopStep(deps) {
 			}
 			mediaDegradedResendUsed = true;
 			log?.info("recovered after media-degraded resend", { turnStep: `${turnId}.${String(currentStep)}` });
+		} else if (buildMessagesMediaStripped !== void 0 && isImageFormatError(error)) {
+			signal.throwIfAborted();
+			log?.warn("provider rejected an image in the request; resending with all media stripped", {
+				turnStep: `${turnId}.${String(currentStep)}`,
+				model: llm.modelName
+			});
+			const strippedMessages = await buildMessagesMediaStripped();
+			signal.throwIfAborted();
+			try {
+				response = await chatWithRetry({
+					...retryInput,
+					params: {
+						...chatParams,
+						messages: strippedMessages,
+						requestLogFields: { projection: "media-stripped" }
+					}
+				});
+			} catch (strippedError) {
+				log?.error("media-stripped resend still rejected by provider", {
+					turnStep: `${turnId}.${String(currentStep)}`,
+					model: llm.modelName,
+					originalError: errorMessage$5(error),
+					strippedError: errorMessage$5(strippedError)
+				});
+				throw strippedError;
+			}
+			mediaStrippedResendUsed = true;
+			log?.info("recovered after media-stripped resend", { turnStep: `${turnId}.${String(currentStep)}` });
 		} else if (buildMessagesStrict !== void 0 && isRecoverableRequestStructureError(error)) {
 			signal.throwIfAborted();
 			log?.warn("provider rejected request structure; resending with strict projection", {
@@ -137436,7 +137789,8 @@ async function executeLoopStep(deps) {
 	return {
 		usage,
 		stopReason: stopTurnAfterStep && effectiveStopReason === "tool_use" ? "end_turn" : effectiveStopReason,
-		mediaDegradedResendUsed
+		mediaDegradedResendUsed,
+		mediaStrippedResendUsed
 	};
 }
 /**
@@ -137535,12 +137889,13 @@ var init_turn_step = __esmMin((() => {
 //#endregion
 //#region ../../packages/agent-core/src/loop/run-turn.ts
 async function runTurn(input) {
-	const { turnId, signal, llm, buildMessages, buildMessagesStrict, buildMessagesMediaDegraded, dispatchEvent, tools, buildTools, describeMissingTool, hooks, log, maxSteps, maxRetryAttempts, recordStepUsage: hostRecordStepUsage } = input;
+	const { turnId, signal, llm, buildMessages, buildMessagesStrict, buildMessagesMediaDegraded, buildMessagesMediaStripped, dispatchEvent, tools, buildTools, describeMissingTool, hooks, log, maxSteps, maxRetryAttempts, recordStepUsage: hostRecordStepUsage } = input;
 	let usage = emptyUsage();
 	let steps = 0;
 	let stopReason = "end_turn";
 	let activeStep;
 	let mediaDegradedActive = false;
+	let mediaStrippedActive = false;
 	const recordStepUsage = async (stepUsage) => {
 		usage = addUsage$1(usage, stepUsage);
 		return hostRecordStepUsage?.(stepUsage);
@@ -137554,9 +137909,10 @@ async function runTurn(input) {
 			const stepResult = await executeLoopStep({
 				turnId,
 				signal,
-				buildMessages: mediaDegradedActive && buildMessagesMediaDegraded !== void 0 ? buildMessagesMediaDegraded : buildMessages,
+				buildMessages: mediaStrippedActive && buildMessagesMediaStripped !== void 0 ? buildMessagesMediaStripped : mediaDegradedActive && buildMessagesMediaDegraded !== void 0 ? buildMessagesMediaDegraded : buildMessages,
 				buildMessagesStrict,
 				buildMessagesMediaDegraded,
+				buildMessagesMediaStripped,
 				dispatchEvent,
 				llm,
 				tools,
@@ -137570,6 +137926,7 @@ async function runTurn(input) {
 			});
 			activeStep = void 0;
 			mediaDegradedActive = mediaDegradedActive || stepResult.mediaDegradedResendUsed === true;
+			mediaStrippedActive = mediaStrippedActive || stepResult.mediaStrippedResendUsed === true;
 			if (stepResult.stopReason === "tool_use") continue;
 			const terminalStopReason = stepResult.stopReason;
 			stopReason = terminalStopReason;
@@ -143796,10 +144153,16 @@ function convertMCPContentBlock(block) {
 	}
 	if (block.type === "resource_link" && typeof block.uri === "string") {
 		const mimeType = block.mimeType ?? "application/octet-stream";
-		if (mimeType.startsWith("image/")) return {
-			type: "image_url",
-			imageUrl: { url: block.uri }
-		};
+		if (mimeType.startsWith("image/")) {
+			if (!isModelAcceptedImageMime(mimeType)) return {
+				type: "text",
+				text: buildUnsupportedImageNotice(mimeType, block.uri)
+			};
+			return {
+				type: "image_url",
+				imageUrl: { url: block.uri }
+			};
+		}
 		if (mimeType.startsWith("audio/")) return {
 			type: "audio_url",
 			audioUrl: { url: block.uri }
@@ -143980,6 +144343,7 @@ function collapseSingleText(parts) {
 var MCP_MAX_OUTPUT_CHARS, MCP_OUTPUT_TRUNCATED_TEXT, MCP_MAX_BINARY_PART_BYTES, MCP_MAX_BINARY_PART_CHARS;
 var init_output = __esmMin((() => {
 	init_image_compress();
+	init_image_format_policy();
 	init_image_originals();
 	MCP_MAX_OUTPUT_CHARS = 1e5;
 	MCP_OUTPUT_TRUNCATED_TEXT = `\n\n[Output truncated: exceeded ${String(MCP_MAX_OUTPUT_CHARS)} character limit. Use pagination or more specific queries to get remaining content.]`;
@@ -152113,25 +152477,6 @@ function buildMediaNote(input) {
 	parts.push("If you generate or edit images or videos via commands or scripts, read the result back immediately before continuing.");
 	return `<system>${parts.join(" ")}</system>`;
 }
-/**
-* Refusal message for HEIC/HEIF with a conversion command matching the
-* execution environment (`kaos.osEnv.osKind` — where Bash actually runs, so
-* SSH/container sessions get the right command too). macOS converts with the
-* built-in `sips`; Linux and Windows have no built-in HEIC decoder, so the
-* guidance names the common tools and how to get them.
-*/
-function buildHeicConversionGuidance(path, mimeType, osKind) {
-	const converted = path.replace(/\.[^./\\]+$/, "") + ".jpg";
-	return `"${path}" is a ${mimeType} image, which the provider does not accept. Convert it to JPEG first, then read the converted file. ` + heicConversionCommand(path, converted, osKind);
-}
-function heicConversionCommand(path, converted, osKind) {
-	switch (osKind) {
-		case "macOS": return `On macOS: sips -s format jpeg "${path}" --out "${converted}"`;
-		case "Linux": return `On Linux: heif-convert "${path}" "${converted}" (package libheif-examples), or with ImageMagick: magick "${path}" "${converted}"`;
-		case "Windows": return `On Windows, with ImageMagick: magick "${path}" "${converted}" (install it first if missing: winget install ImageMagick.ImageMagick)`;
-		default: return `Options: sips -s format jpeg "${path}" --out "${converted}" (macOS), heif-convert "${path}" "${converted}" (Linux, package libheif-examples), or magick "${path}" "${converted}" (ImageMagick)`;
-	}
-}
 var MAX_MEDIA_MEGABYTES, MAX_MEDIA_BYTES, ReadMediaFileInputSchema, ReadMediaFileTool;
 var init_read_media = __esmMin((() => {
 	init_zod$1();
@@ -152140,6 +152485,7 @@ var init_read_media = __esmMin((() => {
 	init_path_access();
 	init_file_type$1();
 	init_image_compress();
+	init_image_format_policy();
 	init_image_limits();
 	init_input_schema();
 	init_rule_match();
@@ -152225,9 +152571,9 @@ var init_read_media = __esmMin((() => {
 					isError: true,
 					output: "The current model does not support image input. Tell the user to use a model with image input capability."
 				};
-				if (fileType.mimeType === "image/heic" || fileType.mimeType === "image/heif") return {
+				if (fileType.kind === "image" && !isModelAcceptedImageMime(fileType.mimeType)) return {
 					isError: true,
-					output: buildHeicConversionGuidance(args.path, fileType.mimeType, this.kaos.osEnv.osKind)
+					output: buildImageConversionGuidance(args.path, fileType.mimeType, this.kaos.osEnv.osKind)
 				};
 				if (fileType.kind === "video" && !this.capabilities.video_in) return {
 					isError: true,
@@ -154723,6 +155069,7 @@ var init_turn = __esmMin((() => {
 	init_errors$8();
 	init_errors$4();
 	init_loop();
+	init_image_compress();
 	init_abort();
 	init_context$2();
 	init_hooks();
@@ -154792,27 +155139,29 @@ var init_turn = __esmMin((() => {
 			return this.agent.homedir ? basename$2(this.agent.homedir) : this.agent.type;
 		}
 		prompt(input, origin = USER_PROMPT_ORIGIN) {
+			const gated = gateImageFormatParts(input);
 			this.agent.records.logRecord({
 				type: "turn.prompt",
-				input,
+				input: gated,
 				origin
 			});
-			return this.launch(input, origin);
+			return this.launch(gated, origin);
 		}
 		steer(input, origin = USER_PROMPT_ORIGIN) {
+			const gated = gateImageFormatParts(input);
 			this.agent.records.logRecord({
 				type: "turn.steer",
-				input,
+				input: gated,
 				origin
 			});
 			if (this.activeTurn || this.agent.fullCompaction.isCompacting) {
 				this.steerBuffer.push({
-					input,
+					input: gated,
 					origin
 				});
 				return null;
 			}
-			return this.launch(input, origin);
+			return this.launch(gated, origin);
 		}
 		retry(trigger) {
 			return this.prompt([], {
@@ -155245,6 +155594,7 @@ var init_turn = __esmMin((() => {
 						buildMessages: () => this.agent.context.messages,
 						buildMessagesStrict: () => this.agent.context.strictMessages,
 						buildMessagesMediaDegraded: () => this.agent.context.mediaDegradedMessages,
+						buildMessagesMediaStripped: () => this.agent.context.mediaStrippedMessages,
 						dispatchEvent: this.buildDispatchEvent(turnId),
 						buildTools: () => this.agent.tools.loopTools,
 						describeMissingTool: (name) => this.agent.tools.missingToolMessage(name),
@@ -218888,6 +219238,7 @@ var init_src = __esmMin((() => {
 	init_context$2();
 	init_tool_result_render();
 	init_image_compress();
+	init_image_format_policy();
 	init_image_limits();
 	init_image_originals();
 	init_provider_manager();
@@ -240329,6 +240680,9 @@ function isHideOutputMarker(value) {
 * Convert an array of ACP {@link ContentBlock}s into the SDK's
 * {@link PromptPart} array.
 *
+* Image parts are built from the client-declared MIME verbatim; run the
+* result through {@link compressPromptImageParts} before submitting so
+* unsupported formats are dropped and MIME aliases canonicalized.
 */
 function acpBlocksToPromptParts(blocks) {
 	const out = [];
@@ -240394,6 +240748,13 @@ function acpBlocksToPromptParts(blocks) {
 * server's upload-time step. Best effort: a part that cannot be compressed is
 * passed through unchanged.
 *
+* The format gate (`gateImageFormatParts`) runs first: parts whose MIME is
+* outside the provider-accepted set are never forwarded — the part is
+* dropped and a text notice stands in, so one unsupported image cannot
+* poison the session history; accepted MIME aliases (`image/jpg`,
+* case/whitespace variants) are rewritten to the canonical form strict
+* provider whitelists require.
+*
 * Compression is never silent: a re-encoded image gains a caption text part
 * immediately before it stating what the original was, and the original bytes
 * are persisted (into `originalsDir` — typically the session's
@@ -240402,7 +240763,7 @@ function acpBlocksToPromptParts(blocks) {
 */
 async function compressPromptImageParts(parts, options = {}) {
 	const out = [];
-	for (const part of parts) {
+	for (const part of gateImageFormatParts(parts)) {
 		if (part.type === "image_url") {
 			const parsed = parseImageDataUrl(part.imageUrl.url);
 			if (parsed !== null) {
@@ -240448,14 +240809,6 @@ async function compressPromptImageParts(parts, options = {}) {
 	}
 	return out;
 }
-function parseImageDataUrl(url) {
-	const match = /^data:([^;,]+);base64,(.*)$/s.exec(url);
-	if (match === null) return null;
-	return {
-		mimeType: match[1],
-		base64: match[2]
-	};
-}
 /**
 * Minimum-viable XML-attribute escaping for prompt-embedded resource
 * wrappers. The output is consumed by an LLM, not parsed by a canonical
@@ -278086,7 +278439,17 @@ async function resolvePromptMediaFiles(body, store, cacheDir, options = {}) {
 	const content = [];
 	for (const part of body.content) {
 		if (part.type === "image" && part.source.kind === "base64") {
-			const compressed = await compressBase64ForModel(part.source.data, part.source.media_type, {
+			const effectiveMime = resolveEffectiveImageMime(part.source.media_type, decodeBase64Prefix(part.source.data));
+			if (!isModelAcceptedImageMime(effectiveMime)) {
+				content.push({
+					type: "text",
+					text: buildUnsupportedImageNotice(effectiveMime)
+				});
+				changed = true;
+				continue;
+			}
+			const canonicalMime = normalizeImageMime(effectiveMime);
+			const compressed = await compressBase64ForModel(part.source.data, canonicalMime, {
 				maxEdge: options.maxImageEdgePx,
 				telemetry: telemetryFor("prompt_inline")
 			});
@@ -278120,9 +278483,31 @@ async function resolvePromptMediaFiles(body, store, cacheDir, options = {}) {
 					}
 				});
 				changed = true;
+			} else if (canonicalMime !== part.source.media_type) {
+				content.push({
+					...part,
+					source: {
+						...part.source,
+						media_type: canonicalMime
+					}
+				});
+				changed = true;
 			} else content.push(part);
 			continue;
 		}
+		if (part.type === "image" && part.source.kind === "url") {
+			const extMime = unsupportedImageMimeFromUrl(part.source.url);
+			if (extMime !== null) {
+				content.push({
+					type: "text",
+					text: buildUnsupportedImageNotice(extMime, part.source.url)
+				});
+				changed = true;
+				continue;
+			}
+			content.push(part);
+			continue;
+		}
 		if (part.type !== "image" && part.type !== "video" || part.source.kind !== "file") {
 			content.push(part);
 			continue;
@@ -278142,6 +278527,16 @@ async function resolvePromptMediaFiles(body, store, cacheDir, options = {}) {
 		let mediaType = file.meta.media_type;
 		let bytes = data;
 		if (part.type === "image") {
+			mediaType = resolveEffectiveImageMime(mediaType, data);
+			if (!isModelAcceptedImageMime(mediaType)) {
+				content.push({
+					type: "text",
+					text: buildUnsupportedImageNotice(mediaType, file.meta.name)
+				});
+				changed = true;
+				continue;
+			}
+			mediaType = normalizeImageMime(mediaType);
 			const compressed = await compressImageForModel(data, mediaType, {
 				maxEdge: options.maxImageEdgePx,
 				telemetry: telemetryFor("prompt_file")
@@ -370621,6 +371016,7 @@ function runPromptTurn(session, prompt, outputFormat, stdout, stderr, waitForGoa
 					return;
 				case "turn.step.retrying":
 					outputWriter.discardAssistant();
+					outputWriter.writeRetrying(event);
 					return;
 				case "assistant.delta":
 					outputWriter.writeAssistantDelta(event.delta);
@@ -370727,6 +371123,7 @@ var PromptTranscriptWriter = class {
 	writeToolCall() {}
 	writeToolCallDelta() {}
 	writeToolResult() {}
+	writeRetrying() {}
 	flushAssistant() {
 		this.assistantWriter.finish();
 	}
@@ -370813,6 +371210,20 @@ var PromptJsonWriter = class {
 		this.assistantText = "";
 		this.toolCalls.length = 0;
 	}
+	writeRetrying(event) {
+		const message = {
+			role: "meta",
+			type: "turn.step.retrying",
+			failed_attempt: event.failedAttempt,
+			next_attempt: event.nextAttempt,
+			max_attempts: event.maxAttempts,
+			delay_ms: event.delayMs,
+			error_name: event.errorName,
+			error_message: event.errorMessage,
+			status_code: event.statusCode
+		};
+		this.writeJsonLine(message);
+	}
 	finish() {
 		this.flushAssistant();
 	}