github-router 0.3.273 → 0.3.275

package/dist/{peer-mcp-personas-DAZU1OfN.js → peer-mcp-personas-TMOZJhfy.js}

@@ -1,6 +1,6 @@
 import { t as getPackageVersion } from "./version-_Q1WpsQp.js";
 import { t as PATHS } from "./paths-Bg1_DWhi.js";
-import { A as state, C as GITHUB_GRAPHQL_URL, D as githubAgentGraphQLHeaders, E as copilotVersion, O as githubAgentHeaders, S as GITHUB_API_BASE_URL, T as copilotHeaders, b as sanitizeTransportText, d as resolveModel, f as sleep$2, g as HTTPError, h as isAllowedCopilotHost, i as tryRefreshAndRetry, v as classifyTransportError, w as copilotBaseUrl, x as withTransientRetry, y as fetchWithTransientRetry } from "./token-Bz7iN8US.js";
+import { A as state, C as GITHUB_GRAPHQL_URL, D as githubAgentGraphQLHeaders, E as copilotVersion, O as githubAgentHeaders, S as GITHUB_API_BASE_URL, T as copilotHeaders, b as sanitizeTransportText, d as resolveModel, f as sleep$2, g as HTTPError, h as isAllowedCopilotHost, i as tryRefreshAndRetry, v as classifyTransportError, w as copilotBaseUrl, x as withTransientRetry, y as fetchWithTransientRetry } from "./token-Bz6HoH2H.js";
 import { a as resolveExecutable, c as runManagedExeCapture, i as parseIntEnv, l as spawnTaskkillBestEffort, r as parseBoolEnv } from "./exec-y8C_MU8A.js";
 import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-0XrazT05.js";
 import { t as MCP_WORKSPACE_HEADER } from "./mcp-workspace-header-CGJbNeHb.js";
@@ -19052,14 +19052,42 @@ function currentInFlight() {
 //#endregion
 //#region src/lib/vision-preflight.ts
 /**
-* Outbound vision preflight.
+* Outbound vision handling.
 *
-* Converts what would otherwise be an opaque upstream `400` into a local,
-* actionable rejection — the same trade `predictedWindowOverflow` in
-* `src/routes/mcp/handler.ts` already makes for prompt tokens, and the reason
-* this file exists at all: `capabilities.limits.vision` advertises three fields
-* (`max_prompt_images`, `max_prompt_image_size`, `supported_media_types`) and
-* until now the proxy read exactly one of them, in the `models` pretty-printer.
+* WHO DECIDES THE IMAGE LIMIT
+*
+* Copilot does, and this module no longer guesses. The catalog advertises a
+* `max_prompt_images` limit, and that field was measured against the live API
+* on 2026-08-10 across all 23 vision-capable models:
+*
+*   - gemini-3.x        catalog 10 → upstream enforces exactly 10
+*   - gpt-5.6-sol       catalog  1 → upstream enforces 50
+*   - gpt-5.5           catalog  1 → accepted 120, no ceiling found
+*   - claude-opus-5     catalog  1 → accepted 200, no ceiling found
+*   - claude-sonnet/haiku catalog 5 → accepted 32+
+*
+* So the field is accurate for one family and understates the truth by 50x to
+* 200x everywhere else. Note the real ceiling is not even uniform WITHIN a
+* family: gpt-5.6-sol stops at 50 while gpt-5.5 took 120, which is the sharpest
+* argument against substituting one hardcoded number for another. A local cardinality reject built on it rejected at 2
+* what upstream serves at 50, and — because the count was taken over the whole
+* assembled payload including replayed history — the caller could not act on
+* the error, so every retry reproduced it and the session was finished.
+*
+* Upstream also enforces rules this module does not model at all (minimum pixel
+* dimensions on grok-4.5, per-model media-type support on gpt-4o), which is the
+* general argument: local pre-validation cannot be complete, and where it
+* guesses it is wrong.
+*
+* WHAT WE DO INSTEAD
+*
+* Send it, and recover from upstream's answer. Copilot's rejections name the
+* real number ("maximum allowed for model gemini-3.6-flash is 10, got 16",
+* "Exceeded maximum number of images (50) allowed in the request"), so
+* `parseUpstreamImageCeiling` reads it, `planOutboundImages` prunes to it, the
+* transport retries once, and `rememberImageCeiling` keeps it for the process
+* lifetime so the round trip is paid once per model per boot. The learned value
+* is an observation rather than a guess, and it self-heals if Copilot changes.
 *
 * WHY ONE CHOKEPOINT, NOT PER-ADAPTER CHECKS
 *
@@ -19067,38 +19095,82 @@ function currentInFlight() {
 * block, a block nested inside a `tool_result`, the synthetic follow-up user
 * message the shim emits because a tool-output item cannot carry images, images
 * already present in replayed conversation history, and peer-critic
-* attachments. Validating in each adapter means each adapter has to
+* attachments. Handling this in each adapter means each adapter has to
 * rediscover every one of those shapes, and the ones it forgets fail silently.
-* So validation runs ONCE, on the fully assembled payload, immediately before
-* transport serialization — `createResponses` and `createChatCompletions` — and
-* is therefore total by construction.
+* So it runs ONCE, on the fully assembled payload, immediately before transport
+* serialization, and is therefore total by construction.
 *
-* POLICY ON MISSING METADATA
+* NOTHING HERE FAILS A REQUEST
 *
-* Deliberately NOT fail-open. "We don't know the limit" is not "there is no
-* limit"; treating it as the latter reproduces the exact opaque-400 this
-* module exists to remove. The three cases are distinguished:
+* A defect that is fatal for a whole request is fatal forever once the image is
+* in replayed history, because the caller cannot edit history. So every defect
+* this module recognises drops that one image and replaces it IN PLACE with a
+* short text note the model can read and relay. In place, never deletion: a
+* turn whose only content was a screenshot would otherwise become an empty
+* content array, which upstream does reject.
 *
-*   - model absent from the catalog entirely → ALLOW. We have no basis for a
-*     judgement, upstream remains authoritative, and blocking would break
-*     custom catalogs and offline tests. This mirrors `modelSupportsEndpoint`.
-*   - model present, `supports.vision` not true → REJECT, naming the model.
-*   - model present, vision supported, limits absent → CONSERVATIVE FLOOR
-*     (`FLOOR_MAX_IMAGES` / `FLOOR_MAX_IMAGE_BYTES`), and the message says so,
-*     so the caller can tell a real limit from an assumed one.
-*
-* Error strings are returned to callers and end up in front of a model, so they
-* name the model, the numbers, and the fix — never a stack, a local path, or a
-* raw catalog object.
+* Note text carries no ordinals and no running totals. Claude Code replays the
+* whole transcript every turn, so a note reading "image 1 of 2" would become
+* "image 1 of 3" on the next image and invalidate the prompt-cache prefix from
+* the earliest omission onward.
 */
 /**
-* Floor applied when a model advertises vision but publishes no limits. Every
-* vision-capable model in the live catalog reports at least 1 image and a
-* 3 MiB ceiling, so this is the observed minimum rather than a guess.
+* Applied when a model advertises vision but publishes no size limit. Every
+* vision-capable model in the live catalog reports 3 MiB, so this is the
+* observed value rather than a guess. There is deliberately no image-COUNT
+* floor: that is the number upstream turned out to own.
 */
-const FLOOR_MAX_IMAGES = 1;
 const FLOOR_MAX_IMAGE_BYTES = 3145728;
 /**
+* Ceilings observed from upstream rejections, keyed by model id. Process
+* lifetime only, and deliberately not persisted: a stale number on disk would
+* be exactly the catalog problem again, one indirection further away.
+*/
+const learnedCeilings = /* @__PURE__ */ new Map();
+function learnedImageCeiling(modelId) {
+	return learnedCeilings.get(modelId);
+}
+function rememberImageCeiling(modelId, ceiling) {
+	if (!Number.isInteger(ceiling) || ceiling < 1) return;
+	learnedCeilings.set(modelId, ceiling);
+}
+/** True when anything has been learned at all — a cheap pre-parse gate. */
+function hasLearnedImageCeilings() {
+	return learnedCeilings.size > 0;
+}
+/**
+* Both rejection shapes Copilot was observed to emit carry the real ceiling:
+*
+*   too many images: maximum allowed for model gemini-3.6-flash is 10, got 16
+*   Exceeded maximum number of images (50) allowed in the request.
+*
+* Anything else returns `undefined`, and the caller forwards upstream's error
+* untouched. A parser that guesses would reintroduce the failure this module
+* was rewritten to remove.
+*/
+const CEILING_PATTERNS = [/maximum allowed for model \S+ is (\d+)/i, /exceeded maximum number of images \((\d+)\)/i];
+function parseUpstreamImageCeiling(body) {
+	if (!/image/i.test(body)) return void 0;
+	for (const pattern of CEILING_PATTERNS) {
+		const match = pattern.exec(body);
+		if (!match) continue;
+		const ceiling = Number(match[1]);
+		if (Number.isInteger(ceiling) && ceiling >= 1 && ceiling <= 1e4) return ceiling;
+	}
+}
+/**
+* Read an error body without consuming it, so the existing error path can still
+* report the same text downstream. Never throws: a body we cannot read simply
+* yields no ceiling and upstream's error is forwarded as it always was.
+*/
+async function peekErrorBody(response) {
+	try {
+		return await response.clone().text();
+	} catch {
+		return "";
+	}
+}
+/**
 * Split a `data:<mime>;base64,<payload>` URI. Returns `null` for any other URL
 * shape (including a plain remote `https://` reference, which the caller
 * handles separately because its bytes are not ours to inspect).
@@ -19111,45 +19183,162 @@ function parseDataUrl(url) {
 		base64: match[2]
 	};
 }
-function reject(message) {
+/**
+* Judge one image on its own merits. Returns `undefined` when it is fine.
+*
+* Remote-URL images are never judged here: the bytes live on someone else's
+* server, so any local claim about them would be fiction.
+*/
+function imageDefect(image, modelId, maxBytes, assumed, allowedTypes) {
+	if (image.url !== void 0 && image.base64 === void 0) return void 0;
+	if (image.declaredMimeType === void 0 || image.declaredMimeType.length === 0) return {
+		reason: "no media type declared",
+		note: "[image removed: no media type was declared, so it could not be sent]"
+	};
+	if (image.base64 === void 0) return void 0;
+	const bytes = decodeBase64Strict(image.base64);
+	if (!bytes) return {
+		reason: "not valid base64",
+		note: "[image removed: the image data was not valid base64]"
+	};
+	if (bytes.length > maxBytes) return {
+		reason: `${bytes.length} bytes over model ${modelId}'s ${maxBytes}-byte limit${assumed}`,
+		note: `[image removed: it is over this model's ${maxBytes}-byte limit; re-capture at a smaller scale or lower quality]`
+	};
+	const actual = detectImageMimeType(bytes);
+	if (!actual) return {
+		reason: `declared ${image.declaredMimeType} but the bytes are not a supported image`,
+		note: `[image removed: it is declared ${image.declaredMimeType} but its bytes are not a supported image (jpeg, png, webp, gif, heic, heif)]`
+	};
+	if (actual !== image.declaredMimeType) return {
+		reason: `declared ${image.declaredMimeType} but the bytes are ${actual}`,
+		note: `[image removed: it is declared ${image.declaredMimeType} but its bytes are ${actual}; send the correct media type]`
+	};
+	if (allowedTypes && allowedTypes.length > 0 && !allowedTypes.includes(actual)) return {
+		reason: `${actual} is not in model ${modelId}'s accepted media types`,
+		note: `[image removed: ${actual} is not accepted by this model; it accepts ${allowedTypes.join(", ")}]`
+	};
+}
+function keepAll(count) {
 	return {
-		ok: false,
-		message
+		verdicts: Array.from({ length: count }, () => ({ keep: true })),
+		kept: count,
+		dropped: 0
 	};
 }
 /**
-* Validate every image on an outbound request against the resolved model's
-* advertised vision capability.
+* Decide, per image, what goes on the wire.
 *
-* Remote-URL images are counted toward the cardinality limit but not size- or
-* type-checked: the bytes live on someone else's server, so any local claim
-* about them would be fiction. Upstream stays authoritative for those.
+* `maxImages` is the CARDINALITY budget, and it comes only from a ceiling
+* upstream actually stated — never from the catalog, whose `max_prompt_images`
+* was measured wrong for 20 of 23 models. Omit it and no image is dropped for
+* being one too many.
+*
+* Validity is judged BEFORE the budget so a malformed image cannot consume a
+* slot and evict a good one, and the budget pass never rewrites a verdict the
+* validity pass already set — a malformed image must not be reported as a
+* cardinality eviction.
 */
-function checkOutboundImages(modelId, images) {
-	if (images.length === 0) return { ok: true };
+function planOutboundImages(modelId, images, options) {
+	if (images.length === 0) return {
+		verdicts: [],
+		kept: 0,
+		dropped: 0
+	};
 	const model = state.models?.data.find((m) => m.id === modelId);
-	if (!model) return { ok: true };
-	if ((model.capabilities?.supports)?.vision !== true) return reject(`Model ${modelId} does not support image input. Send text only, or select a vision-capable model.`);
-	const limits = model.capabilities?.limits?.vision;
-	const maxImages = limits?.max_prompt_images ?? FLOOR_MAX_IMAGES;
+	const maxImages = options?.maxImages;
+	if (!model) {
+		if (maxImages === void 0) return keepAll(images.length);
+	}
+	const supports = model?.capabilities?.supports;
+	if (model && supports?.vision !== true) {
+		const note = `[image removed: model ${modelId} does not accept image input; select a vision-capable model to send images]`;
+		return {
+			verdicts: images.map(() => ({
+				keep: false,
+				reason: `model ${modelId} does not support image input`,
+				note
+			})),
+			kept: 0,
+			dropped: images.length
+		};
+	}
+	const limits = model?.capabilities?.limits?.vision;
 	const maxBytes = limits?.max_prompt_image_size ?? FLOOR_MAX_IMAGE_BYTES;
-	const assumed = limits?.max_prompt_images === void 0 ? " (assumed; the model publishes no image limits)" : "";
-	if (images.length > maxImages) return reject(`Model ${modelId} accepts at most ${maxImages} image(s) per request${assumed}, but this request carries ${images.length}. Send fewer images, or use a model with a higher image limit.`);
+	const assumed = limits?.max_prompt_image_size === void 0 ? " (assumed; the model publishes no image size limit)" : "";
 	const allowedTypes = limits?.supported_media_types;
-	for (const [index, image] of images.entries()) {
-		if (image.url !== void 0 && image.base64 === void 0) continue;
-		const position = `image ${index + 1} of ${images.length}`;
-		if (image.declaredMimeType === void 0 || image.declaredMimeType.length === 0) return reject(`${position} has no media type. Anthropic's \`source.media_type\` (or a \`data:<mime>;base64,\` prefix) is required — it used to be defaulted, which silently asserted a type the model may not accept.`);
-		if (image.base64 === void 0) continue;
-		const bytes = decodeBase64Strict(image.base64);
-		if (!bytes) return reject(`${position} is not valid base64 and cannot be sent.`);
-		if (bytes.length > maxBytes) return reject(`${position} is ${bytes.length} bytes, over model ${modelId}'s ${maxBytes}-byte limit${assumed}. Re-capture at a smaller scale or lower quality.`);
-		const actual = detectImageMimeType(bytes);
-		if (!actual) return reject(`${position} is declared ${image.declaredMimeType} but its bytes are not a supported image (jpeg, png, webp, gif, heic, heif).`);
-		if (actual !== image.declaredMimeType) return reject(`${position} is declared ${image.declaredMimeType} but its bytes are ${actual}. Send the correct media type.`);
-		if (allowedTypes && allowedTypes.length > 0 && !allowedTypes.includes(actual)) return reject(`${position} is ${actual}, which model ${modelId} does not accept. Supported: ${allowedTypes.join(", ")}.`);
+	const verdicts = images.map((image) => {
+		const defect = model ? imageDefect(image, modelId, maxBytes, assumed, allowedTypes) : imageDefect(image, modelId, Number.POSITIVE_INFINITY, "", void 0);
+		return defect ? {
+			keep: false,
+			reason: defect.reason,
+			note: defect.note
+		} : { keep: true };
+	});
+	if (maxImages !== void 0) {
+		const overflowNote = `[image removed: this model accepts at most ${maxImages} image${maxImages === 1 ? "" : "s"} per request, so only the most recent were sent]`;
+		let admitted = 0;
+		for (let index = verdicts.length - 1; index >= 0; index--) {
+			const verdict = verdicts[index];
+			if (!verdict.keep) continue;
+			if (admitted < maxImages) {
+				admitted++;
+				continue;
+			}
+			verdict.keep = false;
+			verdict.reason = `over model ${modelId}'s ${maxImages}-image ceiling`;
+			verdict.note = overflowNote;
+		}
 	}
-	return { ok: true };
+	const kept = verdicts.filter((v) => v.keep).length;
+	return {
+		verdicts,
+		kept,
+		dropped: verdicts.length - kept
+	};
+}
+/**
+* Emit one warn line per drop. Rewriting a request body on the hot path with no
+* record is not acceptable: the note is addressed to the model, and the model
+* may or may not relay it, so the operator needs their own channel.
+*/
+function logImagePlan(modelId, plan) {
+	if (plan.dropped === 0) return;
+	const reasons = [...new Set(plan.verdicts.filter((v) => !v.keep).map((v) => v.reason))];
+	consola.warn(`Dropped ${plan.dropped} of ${plan.verdicts.length} image(s) bound for ${modelId} (${plan.kept} kept): ${reasons.join("; ")}`);
+}
+function responsesImageUrl(part) {
+	if (part === null || typeof part !== "object") return void 0;
+	const p = part;
+	if (p.type !== "input_image" || typeof p.image_url !== "string") return void 0;
+	return p.image_url;
+}
+function chatImageUrl(part) {
+	if (part === null || typeof part !== "object") return void 0;
+	const p = part;
+	if (p.type !== "image_url") return void 0;
+	const url = p.image_url?.url;
+	return typeof url === "string" ? url : void 0;
+}
+/** Anthropic-native `{type:"image", source:{type:"base64", media_type, data}}`. */
+function anthropicImage(part) {
+	if (part === null || typeof part !== "object") return void 0;
+	const p = part;
+	if (p.type !== "image") return void 0;
+	const source = p.source;
+	if (!source) return void 0;
+	if (typeof source.url === "string" && typeof source.data !== "string") return { url: source.url };
+	return {
+		base64: typeof source.data === "string" ? source.data : void 0,
+		declaredMimeType: typeof source.media_type === "string" ? source.media_type : void 0
+	};
+}
+function fromUrl(url) {
+	const parsed = parseDataUrl(url);
+	return parsed ? {
+		base64: parsed.base64,
+		declaredMimeType: parsed.mimeType
+	} : { url };
 }
 /** Collect the images on an assembled Copilot `/responses` payload. */
 function imagesInResponsesPayload(input) {
@@ -19160,10 +19349,8 @@ function imagesInResponsesPayload(input) {
 		const content = item.content;
 		if (!Array.isArray(content)) continue;
 		for (const part of content) {
-			if (part === null || typeof part !== "object") continue;
-			const p = part;
-			if (p.type !== "input_image" || typeof p.image_url !== "string") continue;
-			images.push(fromUrl(p.image_url));
+			const url = responsesImageUrl(part);
+			if (url !== void 0) images.push(fromUrl(url));
 		}
 	}
 	return images;
@@ -19177,40 +19364,167 @@ function imagesInChatPayload(messages) {
 		const content = message.content;
 		if (!Array.isArray(content)) continue;
 		for (const part of content) {
-			if (part === null || typeof part !== "object") continue;
-			const p = part;
-			if (p.type !== "image_url") continue;
-			const url = p.image_url?.url;
-			if (typeof url !== "string") continue;
-			images.push(fromUrl(url));
+			const url = chatImageUrl(part);
+			if (url !== void 0) images.push(fromUrl(url));
 		}
 	}
 	return images;
 }
-function fromUrl(url) {
-	const parsed = parseDataUrl(url);
-	return parsed ? {
-		base64: parsed.base64,
-		declaredMimeType: parsed.mimeType
-	} : { url };
-}
 /**
-* Run the preflight and throw a client-visible 400 when it fails.
+* Visit every Anthropic image part in order, descending into the nested
+* `content` a `tool_result` carries.
 *
-* Shaped as an `HTTPError` carrying a synthetic `Response` so it flows through
-* the existing `forwardError` path and reaches the client as a normal
-* Anthropic-format `invalid_request_error` — the same envelope an upstream
-* rejection would produce, except it names the actual problem and no upstream
-* request was made. Tests assert that second property: a preflight failure must
-* cost zero upstream calls.
+* The extractor and the pruner BOTH drive off this one walker, so their
+* traversal orders cannot drift apart — which is the failure that would drop
+* the wrong image.
 */
-function assertOutboundImagesOk(modelId, images) {
-	const verdict = checkOutboundImages(modelId, images);
-	if (verdict.ok) return;
-	throw new HTTPError(verdict.message, new Response(JSON.stringify({ error: { message: verdict.message } }), {
-		status: 400,
-		headers: { "content-type": "application/json" }
-	}));
+function walkAnthropicParts(part, visit) {
+	const image = anthropicImage(part);
+	if (image !== void 0) {
+		visit(image);
+		return;
+	}
+	if (part === null || typeof part !== "object") return;
+	const nested = part.content;
+	if (!Array.isArray(nested)) return;
+	for (const inner of nested) walkAnthropicParts(inner, visit);
+}
+/** Collect the images on an Anthropic-native `/v1/messages` body. */
+function imagesInAnthropicMessages(messages) {
+	const images = [];
+	if (!Array.isArray(messages)) return images;
+	for (const message of messages) {
+		if (message === null || typeof message !== "object") continue;
+		const content = message.content;
+		if (!Array.isArray(content)) continue;
+		for (const part of content) walkAnthropicParts(part, (image) => images.push(image));
+	}
+	return images;
+}
+/**
+* Thrown when the pruner's walk does not visit exactly as many images as the
+* planner judged. Fail loudly: defaulting an unjudged image to "keep" would
+* turn a traversal-drift bug into a silently leaked image.
+*/
+var ImageIndexDriftError = class extends Error {};
+function assertConsumed(imageIndex, verdicts) {
+	if (imageIndex !== verdicts.length) throw new ImageIndexDriftError(`image traversal drift: pruner visited ${imageIndex} image(s), planner judged ${verdicts.length}`);
+}
+/**
+* Replace each dropped image with a text part IN PLACE, preserving position.
+* Untouched items and parts keep their original object identity, so nothing is
+* needlessly copied and the caller's payload is never mutated.
+*/
+function pruneImagesFromResponsesInput(input, verdicts) {
+	if (!Array.isArray(input)) return input;
+	let imageIndex = 0;
+	const out = input.map((item) => {
+		if (item === null || typeof item !== "object") return item;
+		const content = item.content;
+		if (!Array.isArray(content)) return item;
+		let replaced = false;
+		const parts = content.map((part) => {
+			if (responsesImageUrl(part) === void 0) return part;
+			const verdict = verdicts[imageIndex++];
+			if (!verdict || verdict.keep) return part;
+			replaced = true;
+			return {
+				type: "input_text",
+				text: verdict.note
+			};
+		});
+		return replaced ? {
+			...item,
+			content: parts
+		} : item;
+	});
+	assertConsumed(imageIndex, verdicts);
+	return out;
+}
+function pruneImagesFromChatMessages(messages, verdicts) {
+	if (!Array.isArray(messages)) return messages;
+	let imageIndex = 0;
+	const out = messages.map((message) => {
+		if (message === null || typeof message !== "object") return message;
+		const content = message.content;
+		if (!Array.isArray(content)) return message;
+		let replaced = false;
+		const parts = content.map((part) => {
+			if (chatImageUrl(part) === void 0) return part;
+			const verdict = verdicts[imageIndex++];
+			if (!verdict || verdict.keep) return part;
+			replaced = true;
+			return {
+				type: "text",
+				text: verdict.note
+			};
+		});
+		return replaced ? {
+			...message,
+			content: parts
+		} : message;
+	});
+	assertConsumed(imageIndex, verdicts);
+	return out;
+}
+function pruneImagesFromAnthropicMessages(messages, verdicts) {
+	if (!Array.isArray(messages)) return messages;
+	let imageIndex = 0;
+	const replacePart = (part) => {
+		if (anthropicImage(part) !== void 0) {
+			const verdict = verdicts[imageIndex++];
+			if (!verdict || verdict.keep) return {
+				part,
+				replaced: false
+			};
+			return {
+				part: {
+					type: "text",
+					text: verdict.note
+				},
+				replaced: true
+			};
+		}
+		if (part !== null && typeof part === "object") {
+			const nested = part.content;
+			if (Array.isArray(nested)) {
+				let nestedReplaced = false;
+				const inner = nested.map((innerPart) => {
+					const result = replacePart(innerPart);
+					if (result.replaced) nestedReplaced = true;
+					return result.part;
+				});
+				if (nestedReplaced) return {
+					part: {
+						...part,
+						content: inner
+					},
+					replaced: true
+				};
+			}
+		}
+		return {
+			part,
+			replaced: false
+		};
+	};
+	const out = messages.map((message) => {
+		if (message === null || typeof message !== "object") return message;
+		const content = message.content;
+		if (!Array.isArray(content)) return message;
+		let replaced = false;
+		const parts = content.map((part) => {
+			const result = replacePart(part);
+			if (result.replaced) replaced = true;
+			return result.part;
+		});
+		return replaced ? {
+			...message,
+			content: parts
+		} : message;
+	});
+	assertConsumed(imageIndex, verdicts);
+	return out;
 }
 //#endregion
 //#region src/lib/diagnose-response.ts
@@ -19336,8 +19650,35 @@ async function readResponseBodyCapped(response, routePath, capBytes = MAX_RESPON
 */
 const createChatCompletions = async (payload, modelHeaders, callerSignal, retryTransient = false) => {
 	if (!state.copilotToken) throw new Error("Copilot token not found");
-	const enableVision = payload.messages.some((x) => typeof x.content !== "string" && x.content?.some((x) => x.type === "image_url"));
-	if (enableVision) assertOutboundImagesOk(payload.model, imagesInChatPayload(payload.messages));
+	const carriesImages = payload.messages.some((x) => typeof x.content !== "string" && x.content?.some((x) => x.type === "image_url"));
+	let enableVision = carriesImages;
+	/**
+	* Apply a cardinality budget plus the per-image checks on the fully assembled
+	* payload — the single outbound chokepoint, so every path that can introduce
+	* an image (top-level block, nested tool_result, the shim's synthetic
+	* follow-up user message, replayed history, peer attachments) is covered
+	* without each of them re-deriving the rules.
+	*
+	* `enableVision` is recomputed: if nothing survives, sending
+	* `copilot-vision-request: true` would trade one 400 for another.
+	*/
+	const applyImagePlan = (maxImages) => {
+		try {
+			const plan = planOutboundImages(payload.model, imagesInChatPayload(payload.messages), maxImages === void 0 ? void 0 : { maxImages });
+			if (plan.dropped === 0) return false;
+			logImagePlan(payload.model, plan);
+			payload = {
+				...payload,
+				messages: pruneImagesFromChatMessages(payload.messages, plan.verdicts)
+			};
+			enableVision = plan.kept > 0;
+			return true;
+		} catch (error) {
+			consola.warn(`Image pruning skipped for ${payload.model}: ${String(error)}`);
+			return false;
+		}
+	};
+	if (carriesImages) applyImagePlan(learnedImageCeiling(payload.model));
 	const isAgentCall = payload.messages.some((msg) => ["assistant", "tool"].includes(msg.role));
 	const url = `${copilotBaseUrl(state)}/chat/completions`;
 	const doFetch = () => {
@@ -19358,10 +19699,21 @@ const createChatCompletions = async (payload, modelHeaders, callerSignal, retryT
 		return fetch(url, fetchInit);
 	};
 	const withRefresh = () => tryRefreshAndRetry(doFetch, "/chat/completions");
-	const response = retryTransient ? await fetchWithTransientRetry(withRefresh, {
+	const send = () => retryTransient ? fetchWithTransientRetry(withRefresh, {
 		signal: callerSignal,
 		label: "/chat/completions"
-	}) : await withRefresh();
+	}) : withRefresh();
+	let response = await send();
+	if (!response.ok && carriesImages) {
+		const ceiling = parseUpstreamImageCeiling(await peekErrorBody(response));
+		if (ceiling !== void 0) {
+			rememberImageCeiling(payload.model, ceiling);
+			if (applyImagePlan(ceiling)) {
+				response.body?.cancel();
+				response = await send();
+			}
+		}
+	}
 	if (!response.ok) {
 		let errorBody;
 		try {
@@ -19400,8 +19752,32 @@ const createChatCompletions = async (payload, modelHeaders, callerSignal, retryT
 */
 const createResponses = async (payload, modelHeaders, callerSignal, retryTransient = false) => {
 	if (!state.copilotToken) throw new Error("Copilot token not found");
-	const enableVision = detectVision(payload.input);
-	if (enableVision) assertOutboundImagesOk(payload.model, imagesInResponsesPayload(payload.input));
+	const carriesImages = detectVision(payload.input);
+	let enableVision = carriesImages;
+	/**
+	* Apply a cardinality budget plus the per-image checks, rewriting `payload`
+	* in place of the caller's object. Returns whether anything changed.
+	*
+	* `enableVision` is recomputed here: if nothing survives, sending
+	* `copilot-vision-request: true` would trade one 400 for another.
+	*/
+	const applyImagePlan = (maxImages) => {
+		try {
+			const plan = planOutboundImages(payload.model, imagesInResponsesPayload(payload.input), maxImages === void 0 ? void 0 : { maxImages });
+			if (plan.dropped === 0) return false;
+			logImagePlan(payload.model, plan);
+			payload = {
+				...payload,
+				input: pruneImagesFromResponsesInput(payload.input, plan.verdicts)
+			};
+			enableVision = plan.kept > 0;
+			return true;
+		} catch (error) {
+			consola.warn(`Image pruning skipped for ${payload.model}: ${String(error)}`);
+			return false;
+		}
+	};
+	if (carriesImages) applyImagePlan(learnedImageCeiling(payload.model));
 	const isAgentCall = detectAgentCall(payload.input);
 	const url = `${copilotBaseUrl(state)}/responses`;
 	const doFetch = () => {
@@ -19422,10 +19798,21 @@ const createResponses = async (payload, modelHeaders, callerSignal, retryTransie
 		return fetch(url, fetchInit);
 	};
 	const withRefresh = () => tryRefreshAndRetry(doFetch, "/responses");
-	const response = retryTransient ? await fetchWithTransientRetry(withRefresh, {
+	const send = () => retryTransient ? fetchWithTransientRetry(withRefresh, {
 		signal: callerSignal,
 		label: "/responses"
-	}) : await withRefresh();
+	}) : withRefresh();
+	let response = await send();
+	if (!response.ok && carriesImages) {
+		const ceiling = parseUpstreamImageCeiling(await peekErrorBody(response));
+		if (ceiling !== void 0) {
+			rememberImageCeiling(payload.model, ceiling);
+			if (applyImagePlan(ceiling)) {
+				response.body?.cancel();
+				response = await send();
+			}
+		}
+	}
 	if (!response.ok) {
 		let bodyText;
 		try {
@@ -25498,7 +25885,7 @@ function capToolResultText(content, capBytes) {
 * loaded into memory, let alone base64-expanded by a third.
 *
 * The per-model check still runs later at the transport boundary
-* (`assertOutboundImagesOk`); this is the cheap guard, not the authority.
+* (`planOutboundImages`); this is the cheap guard, not the authority.
 */
 const MAX_ATTACHMENT_BYTES = 3145728;
 const MAX_TOTAL_ATTACHMENT_BYTES = 12582912;
@@ -25522,7 +25909,7 @@ const READ_FLAGS = typeof constants.O_NOFOLLOW === "number" ? constants.O_RDONLY
 async function loadPeerImages(paths, workspace) {
 	if (paths.length > 10) return {
 		ok: false,
-		error: `imagePaths: ${paths.length} paths exceeds the 10-image ceiling (the most any Copilot model accepts). Send fewer.`
+		error: `imagePaths: ${paths.length} paths exceeds the 10-image per-call budget. Send fewer, or split across calls.`
 	};
 	let workspaceAbs;
 	try {
@@ -25857,6 +26244,67 @@ function buildHeaders(extraHeaders) {
 	};
 }
 /**
+* Prune the images in a parsed Anthropic request body down to `ceiling` and
+* re-serialize. Returns `undefined` when nothing needed dropping.
+*
+* Never throws. A latent traversal bug in the pruner must not convert an error
+* we could have forwarded into a proxy crash — the entire point of this change
+* is that an image problem stops being fatal.
+*
+* This is the one place the proxy re-serializes a `/v1/messages` body it would
+* otherwise forward byte-for-byte, so it inherits the usual JSON round-trip
+* caveat for integers beyond 2^53. It runs only when a ceiling is in hand:
+* either one upstream just stated, or one learned earlier in this process.
+*/
+function applyCeiling(parsed, ceiling) {
+	const model = typeof parsed.model === "string" ? parsed.model : "";
+	try {
+		const plan = planOutboundImages(model, imagesInAnthropicMessages(parsed.messages), { maxImages: ceiling });
+		if (plan.dropped === 0) return void 0;
+		logImagePlan(model, plan);
+		return JSON.stringify({
+			...parsed,
+			messages: pruneImagesFromAnthropicMessages(parsed.messages, plan.verdicts)
+		});
+	} catch (error) {
+		consola.warn(`Image pruning skipped for ${model || "unknown model"}: ${String(error)}`);
+		return;
+	}
+}
+function parseBody(body) {
+	try {
+		return JSON.parse(body);
+	} catch {
+		return;
+	}
+}
+/** Prune to a ceiling this process already learned for the body's own model. */
+function pruneToLearnedCeiling(body) {
+	const parsed = parseBody(body);
+	if (!parsed) return void 0;
+	const model = typeof parsed.model === "string" ? parsed.model : "";
+	if (model.length === 0) return void 0;
+	const ceiling = learnedImageCeiling(model);
+	return ceiling === void 0 ? void 0 : applyCeiling(parsed, ceiling);
+}
+/** Prune to a ceiling upstream just stated, and remember it for next time. */
+function pruneToStatedCeiling(body, ceiling) {
+	const parsed = parseBody(body);
+	if (!parsed) return void 0;
+	const model = typeof parsed.model === "string" ? parsed.model : "";
+	if (model.length > 0) rememberImageCeiling(model, ceiling);
+	return applyCeiling(parsed, ceiling);
+}
+/**
+* Cheap pre-parse gate for the proactive path only. Whitespace-tolerant: a
+* client that pretty-prints its JSON still matches. Deliberately NOT used to
+* gate the recovery path — gating recovery on a string probe means a probe miss
+* silently restores the fatal 400 this whole mechanism removes.
+*/
+function mayCarryImages(body) {
+	return /"type"\s*:\s*"image"/.test(body);
+}
+/**
 * Forward an Anthropic Messages API request to Copilot's native /v1/messages endpoint.
 * Returns the raw Response so callers can handle streaming vs non-streaming.
 *
@@ -25879,6 +26327,7 @@ async function createMessages(body, extraHeaders, callerSignal, retryTransient =
 	if (!state.copilotToken) throw new Error("Copilot token not found");
 	const url = `${copilotBaseUrl(state)}/v1/messages?beta=true`;
 	consola.debug(`Forwarding to ${url}`);
+	if (hasLearnedImageCeilings() && mayCarryImages(body)) body = pruneToLearnedCeiling(body) ?? body;
 	const doFetch = () => {
 		const fetchInit = {
 			method: "POST",
@@ -25893,10 +26342,22 @@ async function createMessages(body, extraHeaders, callerSignal, retryTransient =
 		return fetch(url, fetchInit);
 	};
 	const withRefresh = () => tryRefreshAndRetry(doFetch, "/v1/messages");
-	const response = retryTransient ? await fetchWithTransientRetry(withRefresh, {
+	const send = () => retryTransient ? fetchWithTransientRetry(withRefresh, {
 		signal: callerSignal,
 		label: "/v1/messages"
-	}) : await withRefresh();
+	}) : withRefresh();
+	let response = await send();
+	if (!response.ok) {
+		const ceiling = parseUpstreamImageCeiling(await peekErrorBody(response));
+		if (ceiling !== void 0) {
+			const pruned = pruneToStatedCeiling(body, ceiling);
+			if (pruned !== void 0) {
+				response.body?.cancel();
+				body = pruned;
+				response = await send();
+			}
+		}
+	}
 	if (!response.ok) {
 		let errorBody;
 		try {
@@ -26461,7 +26922,7 @@ function toolEntries(scope) {
 				imagePaths: {
 					type: "array",
 					items: { type: "string" },
-					description: "Optional paths to image files (screenshots, diagrams, charts) INSIDE the workspace for the persona to LOOK AT. The proxy reads and encodes them, so no image data passes through your context. Content is identified by bytes, not extension; jpeg/png/webp/gif/heic/heif, 3 MiB each. Note paths are confined to the proxy's working directory. Note the per-model ceiling: the gemini-backed personas accept 10 images, the gpt- and opus-backed ones accept 1."
+					description: "Optional paths to image files (screenshots, diagrams, charts) INSIDE the workspace for the persona to LOOK AT. The proxy reads and encodes them, so no image data passes through your context. Content is identified by bytes, not extension; jpeg/png/webp/gif/heic/heif, 3 MiB each and 12 MiB in total, up to 10 per call. Note paths are confined to the proxy's working directory."
 				},
 				effort: {
 					type: "string",
@@ -34598,4 +35059,4 @@ function enumerateInjectedMcpToolNames(groupKeys, opts = {}) {
 //#endregion
 export { browserToolsEnabled as $, searchWeb as A, collapsePathKeys as At, buildAnthropicErrorEvent as B, upstreamAllowH2 as Bt, buildToolbeltAwareness as C, provisionAndIndexColbert as Ct, TOOLBELT_TOOLS$1 as D, CONDENSED_OPERATING_SEQUENCE as Dt, vscodeRipgrepPath as E, warmTreeSitterPool as Et, isAdvisorRequested as F, DEFAULT_PORT as Ft, relayAnthropicStream as G, isControllerClosedError as H, withOneMSuffix as Ht, formatThinkingRepairDecline as I, UPSTREAM_FETCH_TIMEOUT_MS as It, agentToolsEnabled as J, handleMcpDelete as K, rememberThinkingHistoryRepair as L, UPSTREAM_INACTIVITY_TIMEOUT_MS as Lt, ADVISOR_TOOL_INSTRUCTIONS as M, DEFAULT_CLAUDE_MODEL_FALLBACKS as Mt, buildAdvisorStream as N, DEFAULT_CODEX_MODEL as Nt, assetFor as O, DEFINITION_OF_GREATNESS as Ot, injectAdvisorTool as P, DEFAULT_CODEX_MODEL_FALLBACKS as Pt, browserCompoundToolsEnabled as Q, repairKnownThinkingHistory as R, generateRandomPort as Rt, availableToolCommands as S, colbertDegradedWarning as St, toolbeltSkipSet as T, extractZipMember as Tt, logStreamError as U, withInstallLock as Ut, buildOpenAIErrorEvent as V, upstreamMaxConnections as Vt, readIteratorWithTimeout as W, brainstormModel as X, artifactToolsEnabled as Y, browseAgentEnabled as Z, appendPlanReminder as _, MAX_RESPONSE_BODY_BYTES as _t, buildPeerAwarenessSnippet as a, scribeModel as at, runWorkerAgent as b, provisionBrowserAssets as bt, personasFor as c, shimDefaultsToXhigh as ct, EXPLORE_DEFAULT_MODEL as d, getTokenCount as dt, fleetToolsEnabled as et, EXPLORE_DEFAULT_THINKING as f, assembleResponsesPayload as ft, TEST_DEFAULT_MODEL as g, createChatCompletions as gt, REVIEW_DEFAULT_MODEL as h, createResponses as ht, buildAgentPrompt as i, scoutModel as it, ADVISOR_INTERNAL_TOOL_NAME as j, toolbeltPathOverride as jt, satisfiesMinVersion as k, shouldUseInsecureTls as kt, BROWSE_DEFAULT_MODEL as l, countTokens as lt, PLAN_DEFAULT_MODEL as m, pickEndpoint as mt, MCP_GROUPS as n, nativeSubagentModel as nt, buildPeerAwarenessSummary as o, standInToolEnabled as ot, IMPLEMENT_DEFAULT_MODEL as p, resolveMcpToolTimeoutMs as pt, handleMcpPost as q, assertMcpToolSurfaceConsistent as r, reviewerModel as rt, enumerateInjectedMcpToolNames as s, workerToolsEnabled as st, GROUP_META as t, geminiAvailable as tt, DEFAULT_MODEL as u, createMessages as ut, resolveModeDefaults as v, readResponseBodyCapped as vt, toolbeltEnabled as w, extractTarGzMember as wt, buildEnv as x, hasSupportedBrowserInstalled as xt, resolveWorkerRunOpts as y, parseJsonOrDiagnose as yt, repairRejectedThinkingHistory as z, pickClaudeDefault as zt };
 
-//# sourceMappingURL=peer-mcp-personas-DAZU1OfN.js.map
+//# sourceMappingURL=peer-mcp-personas-TMOZJhfy.js.map