@pure01fx/dsh-openai-codex-auth 0.10.1 → 0.11.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 0.11.0
+
+- Removes plugin payload byte ceilings for native and cloud requests, SSE events, WebSocket messages and queues, response accumulation, encrypted replay state, model catalogs, and image data; removes the corresponding transport options, including `maxRequestBodyBytes`. WebSocket disables the underlying `ws` message-size ceiling explicitly.
+- Keeps WebSocket incremental request preparation separate from HTTP serialization, preserving image history across incremental reuse, reconnects, and HTTP fallback.
+- Preserves complete search output and result arrays, processes all inline result images, forwards selected human search context in full, and removes search batch/domain count ceilings and image-tool prompt length ceilings. Protocol validation, service errors, cancellation, retry/session lifecycle controls, and DSH attachment/file policies still apply.
+
 ## 0.10.1
 
 - Targets DSH 0.1.5-rc.1 with exact SDK peers and runtime helpers; migrates Responses tool calls to ToolCallId.

package/README.md

@@ -17,10 +17,12 @@
 
 ## 快速开始
 
-版本 `0.10.1` 明确适配 DeepSeek Harness `0.1.5-rc.1`，SDK peers/runtime helpers 精确锁定该版本；不声明兼容旧 SDK。旧 DSH `0.1.1-rc.2` profile 应保留原插件 `0.10.0`，升级时在独立 profile 安装新版插件并保留原 profile/锁文件以便回滚。无需迁移账号文件或浏览器隐藏列表；`dsh.engines` 仅作兼容性说明，不当作宿主硬门禁。
+版本 `0.11.0` 明确适配 DeepSeek Harness `0.1.5-rc.1`，SDK peers/runtime helpers 精确锁定该版本；不声明兼容旧 SDK。旧 DSH `0.1.1-rc.2` profile 应保留原插件 `0.10.0`，升级时在独立 profile 安装新版插件并保留原 profile/锁文件以便回滚。无需迁移账号文件或浏览器隐藏列表；`dsh.engines` 仅作兼容性说明，不当作宿主硬门禁。
 
 本版本通过真实目标 LLM/tools 服务与本地 HTTP/SSE/WebSocket 回放、错误/取消回归；模型隐藏覆盖真实目录/catalog/store 的投影更新、重连和重新加载。验证命令为 `pnpm typecheck && pnpm build && pnpm test`；当前版本未执行线上 OAuth/付费模型验收。
 
+`0.11.0` 移除了插件额外设置的请求、响应、SSE/WebSocket、图片和重放状态大小上限，以及相应的 transport 选项（含 `maxRequestBodyBytes`）；旧配置中的该字段应删除。搜索结果完整保留，WebSocket 继续优先复用增量上下文。服务端限制、协议校验及 DSH 文件/附件策略仍生效。
+
 将插件安装到 DSH 的 `web` profile：
 
 ```sh

package/lib/catalog.js

@@ -8,7 +8,6 @@ export const CODEX_MODELS_URL = 'https://chatgpt.com/backend-api/codex/models';
 export const CODEX_CATALOG_CACHE_TTL_MS = 5 * 60_000;
 const CODEX_CATALOG_MAX_STALE_MS = 7 * 24 * 60 * 60_000;
 const CODEX_CATALOG_TIMEOUT_MS = 5_000;
-const MAX_CATALOG_BODY_LENGTH = 2 * 1024 * 1024;
 const ORIGINATOR = 'dsh';
 class CatalogFetchError extends LlmError {
     allowsStale;
@@ -92,7 +91,7 @@ function parseServiceTiers(value) {
     }
     return tiers;
 }
-async function boundedResponseText(response) {
+async function responseText(response) {
     if (response.body === null)
         return '';
     const reader = response.body.getReader();
@@ -104,10 +103,6 @@ async function boundedResponseText(response) {
             if (done)
                 break;
             total += value.byteLength;
-            if (total > MAX_CATALOG_BODY_LENGTH) {
-                await reader.cancel();
-                throw new CatalogFetchError('native Codex catalog response exceeded the size limit', 'CATALOG_INVALID_RESPONSE', true);
-            }
             chunks.push(value);
         }
     }
@@ -366,7 +361,7 @@ export class NativeCodexCatalog {
             }
             let body;
             try {
-                body = await boundedResponseText(response);
+                body = await responseText(response);
             }
             catch (error) {
                 if (error instanceof CatalogFetchError)

package/lib/cloud-context.d.ts

@@ -13,7 +13,7 @@ export declare function chooseCloudModel(params: {
 export declare function visibleCloudImages(messages: readonly Message[]): ImageAttachmentRef[];
 /** Last two human texts plus intervening visible assistant text. UTF-8 bytes conservatively
  * upper-bound byte-level tokenizer tokens; a single 1000-byte assistant budget avoids
- * relying on an unavailable model tokenizer. User text has a separate 64 KiB cap. */
+ * relying on an unavailable model tokenizer. The selected human texts are preserved in full. */
 export declare function recentSearchInput(messages: readonly Message[]): {
     role: 'user' | 'assistant';
     content: string;

package/lib/cloud-context.js

@@ -61,14 +61,13 @@ function boundedText(text, bytes, tail = false) {
 }
 /** Last two human texts plus intervening visible assistant text. UTF-8 bytes conservatively
  * upper-bound byte-level tokenizer tokens; a single 1000-byte assistant budget avoids
- * relying on an unavailable model tokenizer. User text has a separate 64 KiB cap. */
+ * relying on an unavailable model tokenizer. The selected human texts are preserved in full. */
 export function recentSearchInput(messages) {
     const users = messages.map((message, i) => message.role === 'user' && message.source.kind === 'user' && message.content.some(block => block.type === 'text') ? i : -1).filter(i => i >= 0).slice(-2);
     if (!users.length)
         return [];
     const selected = [];
     let assistantBytes = 1000;
-    let userBytes = 64 * 1024;
     // Budget newest text first, then restore chronology.
     for (let i = messages.length - 1; i >= users[0]; i--) {
         const message = messages[i];
@@ -76,12 +75,10 @@ export function recentSearchInput(messages) {
         if (!user && (message.role !== 'assistant' || message.source.kind !== 'model'))
             continue;
         const text = message.content.filter(block => block.type === 'text').map(block => block.text).join('\n');
-        const content = boundedText(text, user ? userBytes : assistantBytes, true);
+        const content = user ? text : boundedText(text, assistantBytes, true);
         if (!content)
             continue;
-        if (user)
-            userBytes -= Buffer.byteLength(content);
-        else
+        if (!user)
             assistantBytes -= Buffer.byteLength(content);
         selected.push({ role: user ? 'user' : 'assistant', content });
     }

package/lib/cloud-http.d.ts

@@ -5,15 +5,12 @@ export interface NativeCodexCloudOptions {
     fetch?: typeof fetch;
     endpoint?: string;
     requestTimeoutMs?: number;
-    maxRequestBodyBytes?: number;
-    maxResponseBytes?: number;
 }
 export interface NativeCodexCloudPostOptions {
     credential: NativeCodexCredential;
     signal: AbortSignal;
     headers?: Record<string, string>;
     timeoutMs?: number;
-    maxResponseBytes?: number;
 }
 export type NativeCodexCloudPath = 'alpha/search' | 'images/generations' | 'images/edits';
 export declare class NativeCodexCloudClient {

package/lib/cloud-http.js

@@ -1,4 +1,4 @@
-/** Bounded, nonstreaming Codex cloud requests. Never retry ambiguous POST failures. */
+/** Nonstreaming Codex cloud requests. Never retry ambiguous POST failures. */
 import { attributionHeaders, LlmError } from '@deepseek-ai/dsh-llm';
 import { nativeCodexEndpoint } from './endpoint.js';
 const fail = (message, code = 'CODEX_CLOUD_FAILED') => new LlmError(message, code);
@@ -54,8 +54,6 @@ export class NativeCodexCloudClient {
         if (!['alpha/search', 'images/generations', 'images/edits'].includes(path))
             throw fail('Invalid Codex cloud path', 'INVALID_ARGS');
         const timeoutMs = positive(options.timeoutMs ?? this.options.requestTimeoutMs, 120_000);
-        const maxBytes = positive(options.maxResponseBytes ?? this.options.maxResponseBytes, 48 * 1024 * 1024);
-        const requestLimit = positive(this.options.maxRequestBodyBytes, 48 * 1024 * 1024);
         let encoded;
         try {
             encoded = JSON.stringify(body);
@@ -63,8 +61,8 @@ export class NativeCodexCloudClient {
         catch {
             throw fail('Invalid cloud JSON request', 'INVALID_ARGS');
         }
-        if (typeof encoded !== 'string' || Buffer.byteLength(encoded) > requestLimit)
-            throw fail('Cloud request exceeds byte limit', 'INVALID_ARGS');
+        if (typeof encoded !== 'string')
+            throw fail('Invalid cloud JSON request', 'INVALID_ARGS');
         let credential = credentialCopy(options.credential);
         const accountId = credential.accountId;
         const controller = new AbortController();
@@ -118,11 +116,7 @@ export class NativeCodexCloudClient {
                 if (!reader)
                     throw fail('Codex cloud response is empty');
                 const chunks = [];
-                let size = 0;
                 try {
-                    const declared = response.headers.get('content-length');
-                    if (declared !== null && Number(declared) > maxBytes)
-                        throw fail('Codex cloud response exceeds byte limit');
                     while (true) {
                         let part;
                         try {
@@ -133,9 +127,6 @@ export class NativeCodexCloudClient {
                         }
                         if (part.done)
                             break;
-                        size += part.value.byteLength;
-                        if (size > maxBytes)
-                            throw fail('Codex cloud response exceeds byte limit');
                         chunks.push(part.value);
                     }
                 }

package/lib/cloud-images.d.ts

@@ -1,6 +1,5 @@
-/** Pure image endpoint validation and bounded decoding. */
+/** Pure image endpoint validation and decoding. */
 import type { ImageMediaType } from '@deepseek-ai/dsh-attachment';
-export declare const MAX_IMAGE_BYTES: number;
 export type ImageSource = {
     attachment_id: string;
 } | {
@@ -36,7 +35,7 @@ export declare function buildImageEditRequest(value: unknown, images: readonly {
     size: string;
     n?: number;
 };
-export declare function decodeImageBase64(value: unknown, maxBytes?: number): Uint8Array;
+export declare function decodeImageBase64(value: unknown): Uint8Array;
 export declare function imageMediaType(data: Uint8Array): ImageMediaType;
 export interface ParsedCloudImage {
     data: Uint8Array;

package/lib/cloud-images.js

@@ -1,12 +1,11 @@
-export const MAX_IMAGE_BYTES = 32 * 1024 * 1024;
 function object(value, label) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new Error(label + ' must be an object');
     return value;
 }
-function text(value, label, max = 32_000) {
-    if (typeof value !== 'string' || !value.trim() || value.length > max)
-        throw new Error(label + ' must be a nonempty bounded string');
+function text(value, label, max) {
+    if (typeof value !== 'string' || !value.trim() || (max !== undefined && value.length > max))
+        throw new Error(label + ' must be a valid nonempty string');
     return value;
 }
 function count(value, label, max) {
@@ -68,16 +67,14 @@ export function buildImageEditRequest(value, images, defaultModel) {
     }
     return { ...validateImageGenerateArgs(value, defaultModel), images: images.map(({ image_url }) => ({ image_url })) };
 }
-export function decodeImageBase64(value, maxBytes = MAX_IMAGE_BYTES) {
-    const cap = Math.min(maxBytes, MAX_IMAGE_BYTES);
-    if (typeof value !== 'string' || !value.length || value.length > 4 * Math.ceil(cap / 3))
-        throw new Error('Image base64 is empty or exceeds byte limit');
-    // Check length before scanning or allocating the decoded payload.
+export function decodeImageBase64(value) {
+    if (typeof value !== 'string' || !value.length)
+        throw new Error('Image base64 is empty');
     if (value.length % 4 !== 0 || /[^A-Za-z0-9+/=]/.test(value) || !/^[A-Za-z0-9+/]*={0,2}$/.test(value))
         throw new Error('Invalid image base64');
     const data = Buffer.from(value, 'base64');
-    if (!data.length || data.length > cap || data.toString('base64') !== value)
-        throw new Error('Invalid image base64 or byte limit exceeded');
+    if (!data.length || data.toString('base64') !== value)
+        throw new Error('Invalid image base64');
     return data;
 }
 export function imageMediaType(data) {
@@ -108,11 +105,9 @@ export function parseImageResponse(value, requestId) {
         metadata.size = text(response.size, 'response size', 64);
     if (requestId !== undefined)
         metadata.request_id = text(requestId, 'request_id', 512);
-    let total = 0;
     const images = response.data.map((entry) => {
         const item = object(entry, 'Image response data');
-        const data = decodeImageBase64(item.b64_json, MAX_IMAGE_BYTES - total);
-        total += data.length;
+        const data = decodeImageBase64(item.b64_json);
         const generation_id = item.generation_id == null ? undefined : text(item.generation_id, 'generation_id', 512);
         // Unknown fields may contain payloads or private service state; never copy them to history.
         return { data, mediaType: imageMediaType(data), metadata: generation_id === undefined ? {} : { generation_id },

package/lib/cloud-media.js

@@ -2,7 +2,7 @@
 import { randomUUID } from 'node:crypto';
 import { posix, win32 } from 'node:path';
 import { imageSize } from 'image-size';
-import { MAX_IMAGE_BYTES, imageMediaType, validateImageSelection } from './cloud-images.js';
+import { imageMediaType, validateImageSelection } from './cloud-images.js';
 // Check both process-world grammars without resolving against the plugin host OS.
 function absoluteWorldPath(path) {
     return !path.includes('\0') && (posix.isAbsolute(path) || (win32.isAbsolute(path) && /^[A-Za-z]:|^\\\\[^\\]+\\[^\\]+/.test(path)));
@@ -25,7 +25,6 @@ export async function resolveImageSources(value, deps) {
         if ('attachment_id' in source && !refs.has(source.attachment_id))
             throw new Error('Image attachment is not visible in this session: ' + source.attachment_id);
     const result = [];
-    let total = 0;
     for (const source of sources) {
         deps.signal?.throwIfAborted();
         let data;
@@ -33,8 +32,8 @@ export async function resolveImageSources(value, deps) {
         let path;
         if ('attachment_id' in source) {
             attachment = refs.get(source.attachment_id);
-            if (!Number.isSafeInteger(attachment.bytes) || attachment.bytes <= 0 || attachment.bytes > MAX_IMAGE_BYTES - total)
-                throw new Error('Image inputs exceed byte limit');
+            if (!Number.isSafeInteger(attachment.bytes) || attachment.bytes <= 0)
+                throw new Error('Invalid image byte count');
             const stored = await deps.attachments.readImage(attachment, deps.signal);
             data = stored.data;
             if (stored.ref.attachmentId !== attachment.attachmentId || stored.ref.bytes !== attachment.bytes ||
@@ -46,12 +45,12 @@ export async function resolveImageSources(value, deps) {
             if (!absoluteWorldPath(source.path))
                 throw new Error('Image path must be absolute');
             const target = await deps.fs.resolve(source.path, { cwd: deps.workspace, ...(deps.signal ? { signal: deps.signal } : {}) });
-            data = await deps.fs.readBytes(target, deps.signal, MAX_IMAGE_BYTES - total);
+            // The filesystem API requires a numeric bound; impose no plugin-specific byte ceiling.
+            data = await deps.fs.readBytes(target, deps.signal, Number.MAX_SAFE_INTEGER);
             path = deps.fs.processPath(target);
         }
-        total += data.length;
-        if (!data.length || total > MAX_IMAGE_BYTES)
-            throw new Error('Image inputs are empty or exceed byte limit');
+        if (!data.length)
+            throw new Error('Image inputs are empty');
         const mediaType = imageMediaType(data);
         await deps.attachments.validateImage({ data, mediaType });
         const dimensions = encodedDimensions(data);
@@ -74,13 +73,11 @@ export async function saveImageOutputs(response, deps) {
         throw new Error('Caller workspace must be absolute');
     if (!deps.policy || !deps.shell.sandboxMode)
         throw new Error('Original image writes require a policy-enforcing DSH shell');
-    let total = 0;
     const dimensions = [];
     for (const image of response.images) {
         deps.signal?.throwIfAborted();
-        total += image.data.length;
-        if (!image.data.length || total > MAX_IMAGE_BYTES)
-            throw new Error('Image outputs exceed byte limit');
+        if (!image.data.length)
+            throw new Error('Image outputs are empty');
         if (imageMediaType(image.data) !== image.mediaType)
             throw new Error('Output media type does not match bytes');
         await deps.attachments.validateImage({ data: image.data, mediaType: image.mediaType });

package/lib/cloud-search.d.ts

@@ -22,7 +22,7 @@ export declare function buildCloudSearchRequest(args: CloudSearchArgs, context:
     model: string;
     input?: unknown;
 }): Record<string, unknown>;
-/** Keep whole opaque result entries and identify any omitted data explicitly. */
+/** Preserve complete output and opaque result entries. */
 export declare function parseCloudSearchResponse(body: unknown): {
     output: string;
     results?: unknown[];

package/lib/cloud-search.js

@@ -1,9 +1,6 @@
 /** Wire contract: Codex b348fc26674189f758d5941cdab3f78f258b2aa7, codex-api/src/search.rs. */
 import { createHash } from 'node:crypto';
 import { LlmError } from '@deepseek-ai/dsh-llm';
-const MAX_REQUEST_BYTES = 256 * 1024;
-const MAX_OUTPUT_BYTES = 128 * 1024;
-const MAX_RESULTS_BYTES = 256 * 1024;
 const invalid = () => new LlmError('Invalid codex_web arguments; check command fields and limits', 'INVALID_ARGS');
 function object(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype)
@@ -11,7 +8,7 @@ function object(value) {
     return value;
 }
 function text(value, empty = false) {
-    if (typeof value !== 'string' || (!empty && !value.trim()) || value.length > MAX_REQUEST_BYTES)
+    if (typeof value !== 'string' || (!empty && !value.trim()))
         throw invalid();
     return value;
 }
@@ -22,7 +19,7 @@ const uint = value => {
     return value;
 };
 const strings = value => {
-    if (!Array.isArray(value) || value.length > 100)
+    if (!Array.isArray(value))
         throw invalid();
     return value.map(item => text(item));
 };
@@ -67,10 +64,9 @@ const operations = {
                 return s;
             } }, required: ['utc_offset'] },
 };
-function boundedRequest(value) {
+function validateRequestJson(value) {
     try {
-        if (Buffer.byteLength(JSON.stringify(value)) > MAX_REQUEST_BYTES)
-            throw invalid();
+        JSON.stringify(value);
     }
     catch {
         throw invalid();
@@ -88,13 +84,13 @@ export function parseCloudSearchArgs(value) {
                     result[key] = choice('short', 'medium', 'long')(items);
                     continue;
                 }
-                if (!Object.hasOwn(operations, key) || !Array.isArray(items) || items.length === 0 || items.length > 100)
+                if (!Object.hasOwn(operations, key) || !Array.isArray(items) || items.length === 0)
                     throw invalid();
                 const operation = operations[key];
                 count += items.length;
                 result[key] = items.map(item => fields(item, operation.rules, operation.required));
             }
-            if (count === 0 || count > 100)
+            if (count === 0)
                 throw invalid();
             return result;
         },
@@ -104,7 +100,7 @@ export function parseCloudSearchArgs(value) {
         filters: value => fields(value, { allowed_domains: strings, blocked_domains: strings }),
         image_settings: value => fields(value, { max_results: uint, caption: bool }),
     }, ['commands']);
-    boundedRequest(parsed);
+    validateRequestJson(parsed);
     return parsed;
 }
 /** The caller selects the model and visible context using the same request credential. */
@@ -122,10 +118,10 @@ export function buildCloudSearchRequest(args, context) {
     if (input !== undefined && typeof input !== 'string' && !Array.isArray(input))
         throw invalid();
     const result = { id, model: text(context.model), commands: parsed.commands, settings, ...(input === undefined ? {} : { input }) };
-    boundedRequest(result);
+    validateRequestJson(result);
     return result;
 }
-/** Keep whole opaque result entries and identify any omitted data explicitly. */
+/** Preserve complete output and opaque result entries. */
 export function parseCloudSearchResponse(body) {
     let data;
     try {
@@ -136,17 +132,10 @@ export function parseCloudSearchResponse(body) {
     }
     if (typeof data.output !== 'string' || (data.results != null && !Array.isArray(data.results)))
         throw new LlmError('Invalid Codex search response', 'CODEX_CLOUD_FAILED');
-    let output = data.output;
-    let truncated = false;
-    if (Buffer.byteLength(output) > MAX_OUTPUT_BYTES) {
-        // Truncate only at complete UTF-8 boundaries; the notice warns that references may be omitted.
-        output = new TextDecoder().decode(Buffer.from(output).subarray(0, MAX_OUTPUT_BYTES)).replace(/\uFFFD$/, '');
-        truncated = true;
-    }
+    const output = data.output;
     let results;
     if (Array.isArray(data.results)) {
         results = [];
-        let bytes = 2;
         for (const item of data.results) {
             let serialized;
             try {
@@ -157,16 +146,8 @@ export function parseCloudSearchResponse(body) {
             }
             if (serialized === undefined)
                 throw new LlmError('Invalid Codex search results', 'CODEX_CLOUD_FAILED');
-            const size = Buffer.byteLength(serialized) + 1;
-            if (results.length >= 100 || bytes + size > MAX_RESULTS_BYTES) {
-                truncated = true;
-                continue;
-            }
             results.push(JSON.parse(serialized));
-            bytes += size;
         }
     }
-    if (truncated)
-        output += '\n[Search response truncated; some content or references were omitted. Narrow the request to retrieve them.]';
-    return { output, ...(results === undefined ? {} : { results }), truncated };
+    return { output, ...(results === undefined ? {} : { results }), truncated: false };
 }

package/lib/cloud-tools.js

@@ -10,7 +10,7 @@ const imageRefs = { type: 'array', minItems: 1, maxItems: 5, description: 'Image
         ],
     } };
 const common = {
-    prompt: { type: 'string', description: 'Describe the image to generate or the edits to perform.', minLength: 1, maxLength: 32000 },
+    prompt: { type: 'string', description: 'Describe the image to generate or the edits to perform.', minLength: 1 },
     model: { type: 'string', description: 'Optional Codex image model; defaults to configured imageModel or gpt-image-2.' },
     quality: { type: 'string', enum: ['auto', 'low', 'medium', 'high'] },
     background: { type: 'string', enum: ['auto', 'transparent', 'opaque'] },
@@ -105,7 +105,7 @@ export function registerCodexImageTools(ctx, deps) {
             name: 'codex_image_inspect',
             description: 'Ask a Codex vision model to analyze images, OCR, screenshots or charts. This makes one additional cloud inference call, without recursive tools. Use explicit model or configured visionModel for non-Codex callers. Reports effective detail and actual dimensions.',
             parameters: { type: 'object', additionalProperties: false, required: ['prompt', 'images'], properties: {
-                    prompt: { type: 'string', minLength: 1, maxLength: 32000 }, images: imageRefs,
+                    prompt: { type: 'string', minLength: 1 }, images: imageRefs,
                     model: { type: 'string' }, detail: { type: 'string', enum: ['auto', 'low', 'high', 'original'] }, reasoning_effort: { type: 'string' },
                 } },
             output, timeoutMs: 120_000, isConcurrencySafe: () => true,

package/lib/cloud-vision.js

@@ -10,8 +10,8 @@ export function parseCloudVisionArgs(value) {
     const row = value;
     if (Object.keys(row).some(key => !['prompt', 'images', 'model', 'detail', 'reasoning_effort'].includes(key)))
         throw new Error('Unknown vision argument');
-    if (typeof row.prompt !== 'string' || !row.prompt.trim() || Buffer.byteLength(row.prompt) > 32_000)
-        throw new Error('Vision prompt must be a nonempty bounded string');
+    if (typeof row.prompt !== 'string' || !row.prompt.trim())
+        throw new Error('Vision prompt must be a nonempty string');
     const selection = validateImageSelection(row);
     if (!selection.images)
         throw new Error('Vision requires explicit images');
@@ -73,21 +73,13 @@ export async function inspectCloudImages(args, deps) {
                 ...(model.instructionsTemplate === undefined ? {} : { instructionsTemplate: model.instructionsTemplate }),
             } } : {}) });
     const texts = new Map();
-    let visibleBytes = 0;
     let usage;
     let finished = false;
     for await (const chunk of chunks) {
         if (chunk.type === 'tool-call-delta' || (chunk.type === 'block-start' && chunk.blockType === 'tool-call'))
             throw new LlmError('Image inspection returned an unexpected tool call', 'UNSUPPORTED');
-        if (chunk.type === 'text-delta') {
-            visibleBytes += Buffer.byteLength(chunk.text);
-            if (visibleBytes > 128 * 1024)
-                throw new LlmError('Image inspection output exceeded limit', 'RESPONSE_TOO_LARGE');
-        }
         if (chunk.type === 'block-end' && chunk.block.type === 'text') {
             texts.set(chunk.index, chunk.block.text);
-            if ([...texts.values()].reduce((bytes, text) => bytes + Buffer.byteLength(text), 0) > 128 * 1024)
-                throw new LlmError('Image inspection output exceeded limit', 'RESPONSE_TOO_LARGE');
         }
         if (chunk.type === 'usage')
             usage = chunk.usage;

package/lib/cloud-web-tool.js

@@ -22,7 +22,7 @@ const operations = {
     response_length: enumeration('short', 'medium', 'long'),
 };
 const parameters = object({
-    commands: { ...object(operations), description: 'One or more nonempty command arrays; at most 100 operations total. Dependent actions require separate calls. screenshot only supports zero-indexed PDF pages.' },
+    commands: { ...object(operations), description: 'One or more nonempty command arrays. Dependent actions require separate calls. screenshot only supports zero-indexed PDF pages.' },
     model: { ...str, description: 'Explicit Codex catalog model; otherwise cloudTools.searchModel, then current openai-codex model. No guessed fallback.' },
     context: { ...str, description: 'Optional explicit text. Default includes last two visible human texts and at most 1000 UTF-8 bytes of visible assistant text.' },
     mode: enumeration('cached', 'indexed', 'live'), search_context_size: enumeration('low', 'medium', 'high'),
@@ -51,12 +51,8 @@ function inputImage(value) {
 async function admitSearchImages(body, attachments, signal) {
     const images = [];
     const notes = new Set();
-    let seen = 0;
-    let bytes = 0;
-    const visit = async (item, depth) => {
+    const visit = async (item) => {
         signal.throwIfAborted();
-        if (depth > 8)
-            return item;
         if (inputImage(item)) {
             if (publicUrl(item.image_url)) {
                 notes.add('Remote image unavailable: the public DSH web boundary has no binary image retrieval. Image and source links are preserved.');
@@ -69,12 +65,9 @@ async function admitSearchImages(body, attachments, signal) {
             try {
                 if (!attachments)
                     throw new Error('Attachment service unavailable');
-                if (++seen > 4 || match[2].length > 12 * 1024 * 1024)
-                    throw new Error('Image count or byte limit');
                 const data = Buffer.from(match[2], 'base64');
-                bytes += data.length;
-                if (!data.length || bytes > 8 * 1024 * 1024 || data.toString('base64') !== match[2])
-                    throw new Error('Invalid or oversized inline image');
+                if (!data.length || data.toString('base64') !== match[2])
+                    throw new Error('Invalid inline image');
                 signal.throwIfAborted();
                 ref = await attachments.saveImage({ data, mediaType: match[1] });
                 signal.throwIfAborted();
@@ -87,26 +80,23 @@ async function admitSearchImages(body, attachments, signal) {
             // Binary transfer data must not become historical text; unknown fields remain opaque.
             return { ...item, image_url: ref ? '[DSH attachment ' + ref.attachmentId + ']' : '[inline image unavailable]' };
         }
-        // Bounded structural walk permits known content blocks nested in evolving result DTOs.
+        // Visit known content blocks while keeping unknown object fields opaque.
         if (Array.isArray(item)) {
-            if (item.length > 100)
-                return item; // Unknown large arrays stay opaque for bounded parsing.
             const result = [];
             for (const value of item)
-                result.push(await visit(value, depth + 1));
+                result.push(await visit(value));
             return result;
         }
-        if (record(item) && Array.isArray(item.content) && item.content.length <= 100) {
-            return { ...item, content: await visit(item.content, depth + 1) };
+        if (record(item) && Array.isArray(item.content)) {
+            return { ...item, content: await visit(item.content) };
         }
         return item;
     };
     if (!record(body) || !Array.isArray(body.results))
         return { body, images, notes };
-    // Leave excess entries for the response parser to mark explicitly as truncated.
     const results = [];
-    for (let i = 0; i < body.results.length; i++)
-        results.push(i < 100 ? await visit(body.results[i], 0) : body.results[i]);
+    for (const item of body.results)
+        results.push(await visit(item));
     return { body: { ...body, results }, images, notes };
 }
 const markerPrefix = '[codex_web context: ';
@@ -208,7 +198,7 @@ export function registerCodexWeb(ctx, deps) {
             checkReferences(args, messages, id, recent);
             const response = await deps.client.post('alpha/search', body, { credential, signal: exec.signal });
             // Validate the envelope before any attachment write; image bytes are replaced
-            // before the final bounded result projection so large valid images can attach.
+            // before the final result projection so inline images become attachments.
             if (!record(response.body) || typeof response.body.output !== 'string' || (response.body.results != null && !Array.isArray(response.body.results)))
                 throw new LlmError('Invalid Codex search response', 'CODEX_CLOUD_FAILED');
             const media = await admitSearchImages(response.body, agent.ctx.attachments, exec.signal);

package/lib/native-http.d.ts

@@ -20,11 +20,9 @@ export interface NativeCodexHttpOptions {
     endpoint?: string;
     requestTimeoutMs?: number;
     streamIdleTimeoutMs?: number;
-    maxSseEventBytes?: number;
     maxTransientRetries?: number;
     initialRetryDelayMs?: number;
     maxRetryDelayMs?: number;
-    maxRequestBodyBytes?: number;
     random?: () => number;
     sleep?: (delayMs: number, signal?: AbortSignal) => Promise<void>;
     createRequestId?: () => string;
@@ -37,7 +35,6 @@ export interface NativeCodexPreparedRequest {
     generation: GenerateOptions;
     mode: NativeCodexTransportMode;
     request: Record<string, unknown>;
-    body: string;
     routingId: string;
     routingHint: string;
 }
@@ -51,7 +48,6 @@ export declare class NativeCodexHttpTransport {
     private readonly maxRetries;
     private readonly initialDelayMs;
     private readonly maxDelayMs;
-    private readonly maxBodyBytes;
     constructor(options: NativeCodexHttpOptions);
     private retryDelay;
     private wait;

package/lib/native-http.js

@@ -16,7 +16,6 @@ const DEFAULT_INITIAL_RETRY_DELAY_MS = 200;
 const DEFAULT_MAX_RETRY_DELAY_MS = 10_000;
 const INITIAL_CONNECTION_RETRY_DELAY_MS = 5_000;
 const MAX_CONNECTION_RETRY_DELAY_MS = 60_000;
-const DEFAULT_MAX_REQUEST_BODY_BYTES = 24 * 1024 * 1024;
 const MAX_ERROR_BODY_BYTES = 64 * 1024;
 function aborted(message = 'native Codex request was aborted') {
     return new LlmError(message, 'ABORTED');
@@ -357,7 +356,6 @@ export class NativeCodexHttpTransport {
     maxRetries;
     initialDelayMs;
     maxDelayMs;
-    maxBodyBytes;
     constructor(options) {
         this.options = options;
         this.fetchImpl = options.fetch ?? fetch;
@@ -367,7 +365,6 @@ export class NativeCodexHttpTransport {
         this.maxRetries = safeRetryCount(options.maxTransientRetries);
         this.initialDelayMs = safePositiveInteger(options.initialRetryDelayMs, DEFAULT_INITIAL_RETRY_DELAY_MS, 'initial retry delay');
         this.maxDelayMs = safePositiveInteger(options.maxRetryDelayMs, DEFAULT_MAX_RETRY_DELAY_MS, 'maximum retry delay');
-        this.maxBodyBytes = safePositiveInteger(options.maxRequestBodyBytes, DEFAULT_MAX_REQUEST_BODY_BYTES, 'request body limit');
     }
     retryDelay(retry, providerDelay) {
         if (providerDelay !== undefined)
@@ -410,24 +407,28 @@ export class NativeCodexHttpTransport {
                 sessionId: stablePromptCacheKey(sessionId),
             };
         let request;
-        let body;
         try {
             request = codexRequestBody(wireOptions, messages, mode);
-            body = JSON.stringify(request);
         }
         catch (error) {
             if (error instanceof LlmError)
                 throw error;
             throw fixedFailure('native Codex request could not be encoded', 'INVALID_ARGS', { cause: error });
         }
-        if (Buffer.byteLength(body) > this.maxBodyBytes) {
-            throw fixedFailure('native Codex request exceeded the size limit', 'REQUEST_TOO_LARGE');
-        }
-        return { generation, mode, request, body, routingId, routingHint };
+        // WebSocket chooses a full request or an incremental suffix after preparation.
+        // Serialize only in the selected transport.
+        return { generation, mode, request, routingId, routingHint };
     }
     async *stream(generation, mode = {}) {
         const prepared = await this.prepare(generation, mode);
-        const { body, routingId, routingHint } = prepared;
+        const { request, routingId, routingHint } = prepared;
+        let body;
+        try {
+            body = JSON.stringify(request);
+        }
+        catch (error) {
+            throw fixedFailure('native Codex request could not be encoded', 'INVALID_ARGS', { cause: error });
+        }
         let activeTurnState = mode.turnState;
         if (activeTurnState !== undefined
             && (activeTurnState.length === 0 || Buffer.byteLength(activeTurnState) > 4096
@@ -553,9 +554,6 @@ export class NativeCodexHttpTransport {
                 for await (const chunk of streamResponses(response.body, {
                     signal: watchdog.signal,
                     onActivity: watchdog.pulse,
-                    ...this.options.maxSseEventBytes === undefined
-                        ? {}
-                        : { maxEventBytes: this.options.maxSseEventBytes },
                     onMalformedEvent: () => {
                         this.options.warn?.('native Codex ignored a malformed SSE event');
                     },

package/lib/native-websocket-session.js

@@ -1,7 +1,6 @@
 /** Pure WebSocket v2 previous-response and incremental suffix state. */
 import { createHash } from 'node:crypto';
 import { LlmError } from '@deepseek-ai/dsh-llm';
-const MAX_RESPONSE_ID_BYTES = 256;
 const IGNORED_REUSE_FIELDS = new Set([
     'input', 'previous_response_id', 'generate', 'client_metadata',
     'stream_options', 'access_programs',
@@ -84,8 +83,7 @@ export class NativeCodexWebSocketSessionState {
         return { ...plan, payload: { ...plan.payload, generate: false } };
     }
     complete(responseId, outputItems) {
-        if (this.pending === undefined || responseId.length === 0
-            || Buffer.byteLength(responseId) > MAX_RESPONSE_ID_BYTES) {
+        if (this.pending === undefined || responseId.length === 0) {
             this.reset();
             throw failure('native Codex WebSocket completion identity is invalid');
         }

package/lib/native-websocket-socket.d.ts

@@ -17,7 +17,6 @@ export interface NativeCodexWebSocketConnectOptions {
     headers: Record<string, string>;
     signal?: AbortSignal;
     connectTimeoutMs?: number;
-    maxFrameBytes?: number;
 }
 export interface NativeCodexWebSocketFactory {
     connect(options: NativeCodexWebSocketConnectOptions): Promise<NativeCodexWebSocket>;

package/lib/native-websocket-socket.js

@@ -1,4 +1,4 @@
-/** Bounded Node WebSocket client seam with injectable deterministic factories. */
+/** Node WebSocket client seam with injectable deterministic factories. */
 import { LlmError, ProviderRequestId } from '@deepseek-ai/dsh-llm';
 import { HttpsProxyAgent } from 'https-proxy-agent';
 import { getProxyForUrl } from 'proxy-from-env';
@@ -6,8 +6,6 @@ import { nativeCodexEndpoint } from './endpoint.js';
 import { NATIVE_CODEX_CONNECTION_FAILED_CODE, isNativeCodexConnectionFailure, } from './native-adapter.js';
 import WebSocket from 'ws';
 const DEFAULT_CONNECT_TIMEOUT_MS = 10_000;
-const DEFAULT_MAX_FRAME_BYTES = 64 * 1024 * 1024;
-const MAX_QUEUED_BYTES = 64 * 1024 * 1024;
 function failure(message, code, cause) {
     return new LlmError(message, code, cause === undefined ? undefined : { cause });
 }
@@ -54,29 +52,20 @@ export function nativeCodexWebSocketUrl(endpoint) {
 class NodeNativeCodexWebSocket {
     socket;
     responseHeaders;
-    maxFrameBytes;
     queue = [];
-    queuedBytes = 0;
     waiters = [];
     ended = false;
-    constructor(socket, responseHeaders, maxFrameBytes) {
+    constructor(socket, responseHeaders) {
         this.socket = socket;
         this.responseHeaders = responseHeaders;
-        this.maxFrameBytes = maxFrameBytes;
         socket.on('message', (data, isBinary) => {
             if (isBinary) {
                 this.fail(failure('native Codex WebSocket returned a binary frame', 'WS_PROTOCOL_ERROR'));
                 return;
             }
-            const bytes = Array.isArray(data)
-                ? data.reduce((total, chunk) => total + chunk.byteLength, 0) : data.byteLength;
-            if (bytes > maxFrameBytes) {
-                this.fail(failure('native Codex WebSocket frame exceeded the size limit', 'WS_FRAME_TOO_LARGE'));
-                return;
-            }
-            const buffer = Array.isArray(data) ? Buffer.concat(data, bytes)
+            const buffer = Array.isArray(data) ? Buffer.concat(data)
                 : Buffer.isBuffer(data) ? data : Buffer.from(data);
-            this.push({ type: 'text', text: buffer.toString('utf8') }, bytes);
+            this.push({ type: 'text', text: buffer.toString('utf8') });
         });
         socket.on('close', (code, reason) => {
             this.ended = true;
@@ -86,7 +75,7 @@ class NodeNativeCodexWebSocket {
             this.fail(failure('native Codex WebSocket transport failed', 'WS_RETRYABLE', error));
         });
     }
-    push(value, bytes = 0) {
+    push(value) {
         const waiter = this.waiters.shift();
         if (waiter !== undefined) {
             if (value instanceof LlmError)
@@ -95,12 +84,7 @@ class NodeNativeCodexWebSocket {
                 waiter.resolve(value);
             return;
         }
-        if (this.queuedBytes + bytes > MAX_QUEUED_BYTES) {
-            this.fail(failure('native Codex WebSocket queued too much response data', 'WS_RESPONSE_TOO_LARGE'));
-            return;
-        }
-        this.queue.push({ value, bytes });
-        this.queuedBytes += bytes;
+        this.queue.push(value);
     }
     fail(error) {
         if (!this.ended)
@@ -110,9 +94,8 @@ class NodeNativeCodexWebSocket {
         for (const waiter of waiters)
             waiter.reject(error);
         this.queue.length = 0;
-        this.queuedBytes = 0;
         if (waiters.length === 0)
-            this.queue.push({ value: error, bytes: 0 });
+            this.queue.push(error);
     }
     async send(text, signal) {
         if (signal?.aborted)
@@ -140,10 +123,9 @@ class NodeNativeCodexWebSocket {
             throw abortFailure(signal);
         const queued = this.queue.shift();
         if (queued !== undefined) {
-            this.queuedBytes -= queued.bytes;
-            if (queued.value instanceof LlmError)
-                throw queued.value;
-            return queued.value;
+            if (queued instanceof LlmError)
+                throw queued;
+            return queued;
         }
         return new Promise((resolve, reject) => {
             let waiter;
@@ -173,7 +155,6 @@ class NodeNativeCodexWebSocket {
 export class NodeNativeCodexWebSocketFactory {
     async connect(options) {
         const timeout = positive(options.connectTimeoutMs, DEFAULT_CONNECT_TIMEOUT_MS, 'connect timeout');
-        const maximum = positive(options.maxFrameBytes, DEFAULT_MAX_FRAME_BYTES, 'frame limit');
         if (options.signal?.aborted)
             throw abortFailure(options.signal);
         return new Promise((resolve, reject) => {
@@ -184,7 +165,8 @@ export class NodeNativeCodexWebSocketFactory {
                 headers: options.headers,
                 ...(agent === undefined ? {} : { agent }),
                 handshakeTimeout: timeout,
-                maxPayload: maximum,
+                // ws uses zero to disable its default message-size ceiling.
+                maxPayload: 0,
                 perMessageDeflate: true,
             });
             const abort = () => {
@@ -215,7 +197,7 @@ export class NodeNativeCodexWebSocketFactory {
             });
             socket.on('open', () => {
                 options.signal?.removeEventListener('abort', abort);
-                resolve(new NodeNativeCodexWebSocket(socket, responseHeaders, maximum));
+                resolve(new NodeNativeCodexWebSocket(socket, responseHeaders));
             });
             socket.on('error', (error) => {
                 options.signal?.removeEventListener('abort', abort);

package/lib/native-websocket.d.ts

@@ -6,7 +6,6 @@ export interface NativeCodexWebSocketTransportOptions extends NativeCodexHttpOpt
     webSocketFactory?: NativeCodexWebSocketFactory;
     webSocketConnectTimeoutMs?: number;
     webSocketIdleTimeoutMs?: number;
-    maxWebSocketFrameBytes?: number;
     maxWebSocketSessions?: number;
     webSocketSessionIdleMs?: number;
     maxWebSocketReconnects?: number;
@@ -19,7 +18,6 @@ export declare class NativeCodexWebSocketTransport implements NativeCodexTranspo
     private readonly sessions;
     private readonly connectTimeoutMs;
     private readonly idleTimeoutMs;
-    private readonly maxFrameBytes;
     private readonly maxSessions;
     private readonly sessionIdleMs;
     private readonly maxReconnects;

package/lib/native-websocket.js

@@ -12,7 +12,6 @@ import { NodeNativeCodexWebSocketFactory, } from './native-websocket-socket.js';
 import { NativeCodexWebSocketSessionState } from './native-websocket-session.js';
 const WS_BETA = 'responses_websockets=2026-02-06';
 const DEFAULT_IDLE_TIMEOUT_MS = 300_000;
-const DEFAULT_MAX_FRAME_BYTES = 64 * 1024 * 1024;
 const DEFAULT_MAX_SESSIONS = 32;
 const DEFAULT_SESSION_IDLE_MS = 30 * 60_000;
 const DEFAULT_MAX_RECONNECTS = 5;
@@ -21,14 +20,13 @@ const DEFAULT_MAX_RETRY_DELAY_MS = 10_000;
 const INITIAL_CONNECTION_RETRY_DELAY_MS = 5_000;
 const MAX_CONNECTION_RETRY_DELAY_MS = 60_000;
 const MAX_TURN_STATE_BYTES = 4096;
-const MAX_RETAINED_OUTPUT_BYTES = 64 * 1024 * 1024;
 function failure(message, code, cause) {
     return new LlmError(message, code, cause === undefined ? undefined : { cause });
 }
 function reconnectable(code) {
     return [
         'WS_RETRYABLE', 'WS_RETRYABLE_RESET', 'WS_PROTOCOL_ERROR',
-        'WS_FRAME_TOO_LARGE', 'WS_RESPONSE_TOO_LARGE', 'TIMEOUT',
+        'TIMEOUT',
         NATIVE_CODEX_CONNECTION_FAILED_CODE,
     ].includes(code);
 }
@@ -211,7 +209,6 @@ export class NativeCodexWebSocketTransport {
     sessions = new Map();
     connectTimeoutMs;
     idleTimeoutMs;
-    maxFrameBytes;
     maxSessions;
     sessionIdleMs;
     maxReconnects;
@@ -226,7 +223,6 @@ export class NativeCodexWebSocketTransport {
         this.factory = options.webSocketFactory ?? new NodeNativeCodexWebSocketFactory();
         this.connectTimeoutMs = boundedPositive(options.webSocketConnectTimeoutMs, 10_000, 120_000, 'WebSocket connect timeout');
         this.idleTimeoutMs = boundedPositive(options.webSocketIdleTimeoutMs, DEFAULT_IDLE_TIMEOUT_MS, 60 * 60_000, 'WebSocket idle timeout');
-        this.maxFrameBytes = boundedPositive(options.maxWebSocketFrameBytes, DEFAULT_MAX_FRAME_BYTES, DEFAULT_MAX_FRAME_BYTES, 'WebSocket frame limit');
         this.maxSessions = boundedPositive(options.maxWebSocketSessions, DEFAULT_MAX_SESSIONS, 256, 'WebSocket session limit');
         this.sessionIdleMs = boundedPositive(options.webSocketSessionIdleMs, DEFAULT_SESSION_IDLE_MS, 24 * 60 * 60_000, 'WebSocket session idle limit');
         this.maxReconnects = retryCount(options.maxWebSocketReconnects);
@@ -338,7 +334,6 @@ export class NativeCodexWebSocketTransport {
             headers: this.headers(prepared, credential),
             signal,
             connectTimeoutMs: this.connectTimeoutMs,
-            maxFrameBytes: this.maxFrameBytes,
         });
         if (this.disposed) {
             socket.close();
@@ -381,16 +376,12 @@ export class NativeCodexWebSocketTransport {
         if (entry.socket === undefined)
             throw failure('native Codex WebSocket is unavailable', 'WS_RETRYABLE');
         const encoded = JSON.stringify(payload);
-        if (Buffer.byteLength(encoded) > 24 * 1024 * 1024) {
-            throw failure('native Codex WebSocket request exceeded the size limit', 'REQUEST_TOO_LARGE');
-        }
         await entry.socket.send(encoded, signal);
         const translator = new ResponsesStreamTranslator(prewarm ? undefined : {
             provider: generation.provider,
             model: mode.publicModel ?? generation.model,
         });
         const outputItems = [];
-        let outputBytes = 0;
         while (true) {
             const text = await this.receive(entry, signal);
             let event;
@@ -420,14 +411,8 @@ export class NativeCodexWebSocketTransport {
                     entry.turnState = nextTurnState;
             }
             const output = normalizedOutputItem(event);
-            if (output !== undefined) {
-                const nextOutputBytes = outputBytes + Buffer.byteLength(JSON.stringify(output));
-                if (nextOutputBytes > MAX_RETAINED_OUTPUT_BYTES) {
-                    throw failure('native Codex WebSocket retained output exceeded the size limit', 'WS_RESPONSE_TOO_LARGE');
-                }
+            if (output !== undefined)
                 outputItems.push(output);
-                outputBytes = nextOutputBytes;
-            }
             if (event.type === 'response.completed') {
                 const response = typeof event.response === 'object'
                     && event.response !== null

package/lib/replay.d.ts

@@ -1,4 +1,4 @@
-/** Bounded, versioned Codex Responses continuation state. */
+/** Versioned Codex Responses continuation state. */
 import { type ContentBlock } from '@deepseek-ai/dsh-llm';
 export declare const NATIVE_CODEX_REPLAY_KIND = "openai-codex-native.responses-replay";
 export declare const NATIVE_CODEX_REPLAY_VERSION = 1;
@@ -33,12 +33,11 @@ export interface NativeCodexReplaySource {
 export declare function replayableItemId(value: string | undefined): string | undefined;
 /** True only for legacy raw state or an rc.2 envelope emitted by this package. */
 export declare function hasNativeCodexReplayKind(value: unknown): boolean;
-/** Attempt-local byte-bounded accumulator; no ciphertext can grow unchecked before completion. */
+/** Attempt-local accumulator for completed replay descriptors. */
 export declare class NativeCodexReplayCapture {
     private readonly provider;
     private readonly model;
     private readonly descriptors;
-    private stateBytes;
     constructor(provider: string, model: string);
     add(item: NativeCodexReplayDescriptor): void;
     finish(): NativeCodexReplayState | undefined;

package/lib/replay.js

@@ -1,10 +1,7 @@
-/** Bounded, versioned Codex Responses continuation state. */
+/** Versioned Codex Responses continuation state. */
 import { LlmError } from '@deepseek-ai/dsh-llm';
 export const NATIVE_CODEX_REPLAY_KIND = 'openai-codex-native.responses-replay';
 export const NATIVE_CODEX_REPLAY_VERSION = 1;
-const MAX_REPLAY_ITEM_ID_BYTES = 256;
-const MAX_REPLAY_CIPHERTEXT_BYTES = 64 * 1024 * 1024;
-const MAX_REPLAY_STATE_BYTES = 64 * 1024 * 1024;
 function failure(message, code = 'INVALID_REPLAY_STATE') {
     return new LlmError(message, code);
 }
@@ -17,30 +14,22 @@ function onlyKeys(row, keys) {
     const allowed = new Set(keys);
     return Object.keys(row).every(key => allowed.has(key));
 }
-function boundedString(value, maximum = 256) {
-    return typeof value === 'string' && value.length > 0
-        && Buffer.byteLength(value) <= maximum ? value : undefined;
+function nonemptyString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
 /** Preserve only server item IDs that Codex itself would replay. */
 export function replayableItemId(value) {
     if (value === undefined)
         return undefined;
-    if (Buffer.byteLength(value) > MAX_REPLAY_ITEM_ID_BYTES) {
-        throw failure('native Codex response item identity exceeded the replay limit', 'MALFORMED_RESPONSE');
-    }
     const split = value.indexOf('_');
     return split > 0 && split < value.length - 1 ? value : undefined;
 }
-function safeStateSize(value, code) {
-    let serialized;
+function validateStateJson(value) {
     try {
-        serialized = JSON.stringify(value);
+        JSON.stringify(value);
     }
     catch {
-        throw failure('native Codex replay state is not lossless JSON', code);
-    }
-    if (Buffer.byteLength(serialized) > MAX_REPLAY_STATE_BYTES) {
-        throw failure('native Codex replay state exceeded the size limit', code);
+        throw failure('native Codex replay state is not lossless JSON');
     }
 }
 function validateBlockArray(value) {
@@ -59,7 +48,7 @@ function parseDescriptor(value) {
     if (row === undefined || typeof row.type !== 'string') {
         throw failure('native Codex replay descriptor is invalid');
     }
-    const id = row.id === undefined ? undefined : boundedString(row.id, MAX_REPLAY_ITEM_ID_BYTES);
+    const id = row.id === undefined ? undefined : nonemptyString(row.id);
     const split = id?.indexOf('_') ?? -1;
     if (row.id !== undefined && (id === undefined || split <= 0 || split >= id.length - 1)) {
         throw failure('native Codex replay item identity is invalid');
@@ -74,7 +63,7 @@ function parseDescriptor(value) {
     if (row.type === 'reasoning') {
         const blocks = validateBlockArray(row.blocks);
         const encryptedContent = row.encryptedContent === undefined
-            ? undefined : boundedString(row.encryptedContent, MAX_REPLAY_CIPHERTEXT_BYTES);
+            ? undefined : nonemptyString(row.encryptedContent);
         if (blocks === undefined
             || (row.encryptedContent !== undefined && encryptedContent === undefined)
             || !onlyKeys(row, ['type', 'id', 'blocks', 'encryptedContent'])) {
@@ -86,7 +75,7 @@ function parseDescriptor(value) {
         };
     }
     if (row.type === 'function_call') {
-        const namespace = row.namespace === undefined ? undefined : boundedString(row.namespace);
+        const namespace = row.namespace === undefined ? undefined : nonemptyString(row.namespace);
         if (!Number.isSafeInteger(row.block) || Number(row.block) < 0
             || (row.namespace !== undefined && namespace === undefined)
             || !onlyKeys(row, ['type', 'id', 'namespace', 'block'])) {
@@ -109,15 +98,15 @@ export function hasNativeCodexReplayKind(value) {
 }
 function parseState(value) {
     const payload = replayPayload(value);
-    safeStateSize(payload, 'INVALID_REPLAY_STATE');
+    validateStateJson(payload);
     const row = object(payload);
     if (row === undefined || row.kind !== NATIVE_CODEX_REPLAY_KIND
         || row.version !== NATIVE_CODEX_REPLAY_VERSION
         || !onlyKeys(row, ['kind', 'version', 'provider', 'model', 'items'])) {
         throw failure('native Codex replay state kind or version is invalid');
     }
-    const provider = boundedString(row.provider);
-    const model = boundedString(row.model, 512);
+    const provider = nonemptyString(row.provider);
+    const model = nonemptyString(row.model);
     if (provider === undefined || model === undefined || !Array.isArray(row.items)
         || row.items.length === 0) {
         throw failure('native Codex replay state metadata is invalid');
@@ -131,35 +120,17 @@ function parseState(value) {
         items,
     };
 }
-/** Attempt-local byte-bounded accumulator; no ciphertext can grow unchecked before completion. */
+/** Attempt-local accumulator for completed replay descriptors. */
 export class NativeCodexReplayCapture {
     provider;
     model;
     descriptors = [];
-    stateBytes;
     constructor(provider, model) {
         this.provider = provider;
         this.model = model;
-        this.stateBytes = Buffer.byteLength(JSON.stringify({
-            kind: NATIVE_CODEX_REPLAY_KIND,
-            version: NATIVE_CODEX_REPLAY_VERSION,
-            provider,
-            model,
-            items: [],
-        }));
     }
     add(item) {
-        if (item.type === 'reasoning' && item.encryptedContent !== undefined
-            && Buffer.byteLength(item.encryptedContent) > MAX_REPLAY_CIPHERTEXT_BYTES) {
-            throw failure('native Codex encrypted reasoning exceeded the replay limit', 'MALFORMED_RESPONSE');
-        }
-        const itemBytes = Buffer.byteLength(JSON.stringify(item));
-        const nextBytes = this.stateBytes + itemBytes + (this.descriptors.length === 0 ? 0 : 1);
-        if (nextBytes > MAX_REPLAY_STATE_BYTES) {
-            throw failure('native Codex replay state exceeded the size limit', 'REPLAY_STATE_TOO_LARGE');
-        }
         this.descriptors.push(item);
-        this.stateBytes = nextBytes;
     }
     finish() {
         return createNativeCodexReplayState(this.provider, this.model, this.descriptors);
@@ -176,7 +147,6 @@ export function createNativeCodexReplayState(provider, model, items) {
         model,
         items: items.map(item => ({ ...item })),
     };
-    safeStateSize(state, 'REPLAY_STATE_TOO_LARGE');
     try {
         return parseState(state);
     }

package/lib/responses.d.ts

@@ -109,11 +109,9 @@ export declare class ResponsesStreamTranslator {
     private readonly order;
     private readonly replayCapture;
     private nextIndex;
-    private retainedBytes;
     private sawToolCall;
     terminated: boolean;
     constructor(replayContext?: ResponsesReplayContext | undefined);
-    private reserve;
     private append;
     private fill;
     private open;

package/lib/responses.js

@@ -6,7 +6,6 @@ import { NativeCodexReplayCapture, replayAssistantInput, replayableItemId, } fro
 export const DEFAULT_CODEX_INSTRUCTIONS = 'You are Codex, an AI coding agent. Help the user with software engineering tasks.';
 const CALL_ID_MAX_LENGTH = 64;
 const CALL_ID_PREFIX = 'call_';
-const MAX_RETAINED_RESPONSE_BYTES = 64 * 1024 * 1024;
 const UUID_NAMESPACE_OID = Buffer.from('6ba7b8129dad11d180b400c04fd430c8', 'hex');
 function uuidV5(namespace, name) {
     const bytes = createHash('sha1').update(namespace).update(name).digest().subarray(0, 16);
@@ -321,7 +320,6 @@ export class ResponsesStreamTranslator {
     order = [];
     replayCapture;
     nextIndex = 0;
-    retainedBytes = 0;
     sawToolCall = false;
     terminated = false;
     constructor(replayContext) {
@@ -330,26 +328,15 @@ export class ResponsesStreamTranslator {
             ? undefined
             : new NativeCodexReplayCapture(replayContext.provider, replayContext.model);
     }
-    reserve(bytes) {
-        const nextBytes = this.retainedBytes + bytes;
-        if (!Number.isSafeInteger(nextBytes) || nextBytes > MAX_RETAINED_RESPONSE_BYTES) {
-            throw fixedError('native Codex response retained content exceeded the size limit', 'RESPONSE_TOO_LARGE');
-        }
-        this.retainedBytes = nextBytes;
-    }
     append(block, delta) {
-        this.reserve(Buffer.byteLength(delta));
         block.text += delta;
     }
     fill(block, text) {
         if (block.text.length > 0)
             return;
-        this.reserve(Buffer.byteLength(text));
         block.text = text;
     }
     open(key, kind, chunks, callId = '', name) {
-        this.reserve(128 + Buffer.byteLength(key) + Buffer.byteLength(callId)
-            + (name === undefined ? 0 : Buffer.byteLength(name)));
         const block = {
             index: this.nextIndex++, kind, text: '', callId,
             ...name === undefined ? {} : { name },
@@ -445,7 +432,7 @@ export class ResponsesStreamTranslator {
                     if (item.call_id === undefined || item.call_id.length === 0
                         || item.name === undefined || item.name.length === 0
                         || (item.namespace !== undefined && (typeof item.namespace !== 'string'
-                            || item.namespace.length === 0 || Buffer.byteLength(item.namespace) > 256))
+                            || item.namespace.length === 0))
                         || typeof item.arguments !== 'string') {
                         throw fixedError('native Codex function call has invalid content', 'MALFORMED_RESPONSE');
                     }

package/lib/sse.d.ts

@@ -1,4 +1,3 @@
-export declare const DEFAULT_MAX_SSE_EVENT_BYTES: number;
 export interface SseEvent {
     data: string;
     event?: string;
@@ -7,7 +6,6 @@ export interface ParseSseOptions {
     signal?: AbortSignal;
     onActivity?: () => void;
     onBytes?: (bytes: number) => void;
-    maxEventBytes?: number;
 }
-/** Decode a byte stream into bounded SSE frames. */
+/** Decode a byte stream into SSE frames. */
 export declare function parseSse(stream: ReadableStream<Uint8Array>, options?: ParseSseOptions): AsyncGenerator<SseEvent>;

package/lib/sse.js

@@ -1,18 +1,10 @@
-/** Bounded, cancellable Server-Sent Events byte framing. */
+/** Cancellable Server-Sent Events byte framing. */
 import { LlmError } from '@deepseek-ai/dsh-llm';
-export const DEFAULT_MAX_SSE_EVENT_BYTES = 64 * 1024 * 1024;
 function aborted() {
     return new LlmError('native Codex SSE stream was cancelled', 'ABORTED');
 }
-function tooLarge() {
-    return new LlmError('native Codex SSE event exceeded the size limit', 'SSE_EVENT_TOO_LARGE');
-}
-/** Decode a byte stream into bounded SSE frames. */
+/** Decode a byte stream into SSE frames. */
 export async function* parseSse(stream, options = {}) {
-    const limit = options.maxEventBytes ?? DEFAULT_MAX_SSE_EVENT_BYTES;
-    if (!Number.isSafeInteger(limit) || limit <= 0) {
-        throw new LlmError('native Codex SSE size limit is invalid', 'INVALID_CONFIG');
-    }
     if (options.signal?.aborted === true)
         throw aborted();
     const reader = stream.getReader();
@@ -20,7 +12,6 @@ export async function* parseSse(stream, options = {}) {
     let pending = '';
     let dataLines = [];
     let eventName;
-    let eventBytes = 0;
     let cancelled = false;
     const onAbort = () => {
         cancelled = true;
@@ -39,8 +30,6 @@ export async function* parseSse(stream, options = {}) {
             options.onActivity?.();
             options.onBytes?.(value.byteLength);
             pending += decoder.decode(value, { stream: true });
-            if (Buffer.byteLength(pending) > limit && !pending.includes('\n'))
-                throw tooLarge();
             let newline = pending.indexOf('\n');
             while (newline >= 0) {
                 let line = pending.slice(0, newline);
@@ -57,12 +46,8 @@ export async function* parseSse(stream, options = {}) {
                     }
                     dataLines = [];
                     eventName = undefined;
-                    eventBytes = 0;
                     continue;
                 }
-                eventBytes += Buffer.byteLength(line) + 1;
-                if (eventBytes > limit)
-                    throw tooLarge();
                 if (line.startsWith(':'))
                     options.onActivity?.();
                 else if (line.startsWith('data:'))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pure01fx/dsh-openai-codex-auth",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "Native ChatGPT Codex provider, device-code-first login, and same-origin Web integration for DeepSeek Harness",
   "license": "MIT",
   "publishConfig": {