llm-switcher 1.6.10 → 1.6.11

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog — LLM Switcher
 
+## Release 1.6.11 — 2026-10-11
+
+- **Output limit.** The proxy keeps the output limit of each model from the `/models` list of the profile (`max_output_tokens` or `top_provider.max_completion_tokens`) in `model-windows.json`. If the client asks for more tokens than this limit, the proxy sends the limit. This applies to `max_tokens`, `max_completion_tokens` and `maxOutputTokens`. If the limit is not known, the value does not change. The limit does not apply to the anthropic-to-anthropic passthrough (direct mode, outFormat `anthropic`, and the native goal-check request). These requests go to the upstream unchanged.
+- **Images to a text-only chat model.** If a chat upstream refuses an image with HTTP 400, the proxy sends the request one more time. In that request, each image is the text `[image omitted: this model does not accept images]`. The retry happens in each request. The proxy remembers nothing between requests.
+- **Test cleanup.** The browser tests and the gateway tests stop the gateway, the stand-in interceptor, an interceptor that the gateway started, and Chromium. They also delete their temp directories. This occurs also when a test fails or the test process gets `SIGTERM`, `SIGINT` or `SIGHUP`.
+
 ## Release 1.6.10 — 2026-10-11
 
 - **`reasoning_content` replay.** On assistant tool-call turns, `auto` mode sends the earlier thinking as `reasoning_content`. `native` mode sends it only when the profile sets `replayReasoning: true`, because a strict OpenAI-compatible server can refuse the field. `off` mode never sends it.

package/formats.mjs

@@ -1654,6 +1654,13 @@ function emitUpstreamBody(outFormat, ir, model, opts = {}) {
   // thinkingMode 'off' applies to all upstreams: drop the client's thinking entirely.
   let src = normThinkingMode(opts.thinkingMode) === 'off' ? { ...ir, thinking: { type: 'disabled' } } : ir;
   if (isAntigravityModel(model) && src.system) src = { ...src, system: src.system.replace(BILLING_HEADER_RE, '') };
+  // An upstream refuses a max tokens above the model's output limit. The Anthropic body always
+  // carries one (4096 when the client sent none), so that default is clamped too.
+  const limit = opts.maxOutputTokens;
+  if (Number.isFinite(limit) && limit > 0) {
+    const asked = typeof src.params?.maxTokens === 'number' ? src.params.maxTokens : (outFormat === 'anthropic' ? 4096 : null);
+    if (asked != null && asked > limit) src = { ...src, params: { ...src.params, maxTokens: limit } };
+  }
   switch (outFormat) {
     case 'anthropic': return irToAnthropicBody(src, model, opts);
     case 'vertex': return irToVertexBody(src, model, opts);
@@ -1662,6 +1669,31 @@ function emitUpstreamBody(outFormat, ir, model, opts = {}) {
   }
 }
 
+// A text-only chat model refuses an image part with a 400. These are the refusals seen so far;
+// a looser match would turn an unrelated 400 into a silent retry without the image.
+export const IMAGE_OMITTED_TEXT = '[image omitted: this model does not accept images]';
+
+export function refusesImageInput(text) {
+  const t = String(text || '').toLowerCase();
+  return t.includes('unknown variant `image_url`') || t.includes('image_url is only supported by certain models')
+    || t.includes('does not support image') || t.includes('image input is not supported')
+    || (t.includes('vision') && t.includes('not supported'));
+}
+
+// Replaces every image part of a chat body with IMAGE_OMITTED_TEXT, in place. Returns how many it replaced.
+export function omitChatImages(body) {
+  let replaced = 0;
+  for (const m of Array.isArray(body?.messages) ? body.messages : []) {
+    if (!Array.isArray(m?.content)) continue;
+    m.content = m.content.map(p => {
+      if (p?.type !== 'image_url') return p;
+      replaced++;
+      return { type: 'text', text: IMAGE_OMITTED_TEXT };
+    });
+  }
+  return replaced;
+}
+
 // ---------------- native Anthropic healer (direct passthrough) ----------------
 // The anthropic -> anthropic branch skips IR (to preserve thinking signatures, cache_control, documents...),
 // so it patches the Anthropic payload directly, touching only what the API will definitely reject:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-switcher",
-  "version": "1.6.10",
+  "version": "1.6.11",
   "description": "Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code and Codex, with OpenAI-compatible, Anthropic and Vertex upstreams",
   "keywords": [
     "llm",

package/proxy.mjs

@@ -11,7 +11,7 @@ import { createFrameReader } from './blindfold/wsframe.mjs';
 import {
   OUT_FORMATS, parseToIR, emitUpstreamBody, irToAnthropicBody, createUpstreamNormalizer, createCollector,
   createThinkTagSplitter, splitThinkTags, healAnthropicPayload, estimateTokens, THINKING_MODES, VALID_EFFORTS,
-  toGeminiSchema, isAntigravityModel,
+  toGeminiSchema, isAntigravityModel, refusesImageInput, omitChatImages,
   createAnthropicStream, createChatStream, createResponsesStream, createVertexStream,
   buildAnthropicMessage, buildChatMessage, buildResponsesMessage, buildVertexMessage,
   createCodeAssistStream, buildCodeAssistMessage
@@ -26,7 +26,7 @@ import {
   codexModelEntry,
   contractLabSettings, STATE_DIR, stopRecordedBlindfold
 } from './state.mjs';
-import { parseModelWindows, resolveProfileWindows, readLocalCodexWindows } from './windows.mjs';
+import { parseModelWindows, resolveProfileWindows, readLocalCodexWindows, readWindowsCache } from './windows.mjs';
 import { createToolVocab, NULL_TOOL_VOCAB, toolNameMapForIR } from './toolvocab.mjs';
 import { readUpstreamPayloads } from './upstream-stream.mjs';
 import { compactionResponse, emitCompaction, expandGatewayCompactions, collectCompaction } from './compaction.mjs';
@@ -828,12 +828,24 @@ function resolveThinkingEffort(profile, slot, mappedModel) {
   return profile?.thinkingEffort || 'auto';
 }
 
+// The output limit the profile's own model list names for this model, or 0 when no cached list
+// names one. The cache is filled by /v1/models; this only reads it.
+function modelOutputLimit(profile, mappedModel) {
+  if (!profile?.baseURL || !mappedModel) return 0;
+  for (const entry of Object.values(readWindowsCache(STATE_DIR))) {
+    const output = entry?.baseURL === profile.baseURL ? Number(entry.models?.[mappedModel]?.output) : 0;
+    if (output > 0) return output;
+  }
+  return 0;
+}
+
 function buildUpstreamRequest(profile, outFormat, ir, mappedModel, req, slot = null) {
   const effort = resolveThinkingEffort(profile, slot, mappedModel);
   const upBody = emitUpstreamBody(outFormat, ir, mappedModel, {
     thinkingMode: profile.thinkingMode,
     thinkingEffort: effort,
     replayReasoning: profile.replayReasoning === true,
+    maxOutputTokens: modelOutputLimit(profile, mappedModel),
   });
   if (upBody?.tools && Array.isArray(upBody.tools)) {
     upBody.tools = cleanSchemaDeep(upBody.tools);
@@ -845,6 +857,20 @@ function buildUpstreamRequest(profile, outFormat, ir, mappedModel, req, slot = n
   return { url, headers, upBody };
 }
 
+// Sends the upstream request. A chat 400 that says the model takes no images is retried once with
+// every image replaced by text. The status arrives before any byte goes to the client, so the client
+// sees only the retry's answer. Nothing is remembered: a false refusal costs one request, not the model.
+async function fetchUpstream(url, headers, upBody, signal, outFormat, profileKey, mappedModel) {
+  const send = () => fetch(url, { method: 'POST', headers, body: JSON.stringify(upBody), signal });
+  const res = await send();
+  const hasImage = outFormat === 'openai-chat' && upBody.messages?.some(m => Array.isArray(m?.content) && m.content.some(p => p?.type === 'image_url'));
+  if (res.status !== 400 || !hasImage) return res;
+  const errText = await res.text().catch(() => '');
+  if (!refusesImageInput(errText)) return new Response(errText, { status: res.status, statusText: res.statusText, headers: res.headers });
+  console.warn(`[${profileKey}] ${mappedModel} refused ${omitChatImages(upBody)} image(s); retrying this request as text`);
+  return send();
+}
+
 // Feeds upstream stream events to a client renderer until the stream ends, fails or is aborted.
 // Returns the stream error, or null. `sink` is the client stream whose backpressure it waits for.
 async function pumpStream(upstreamRes, { normalize, col, renderer, splitter, signal, sink, tag }) {
@@ -1282,7 +1308,7 @@ async function handleConvert(clientFormat, req, res, bodyBuffer, opts = {}) {
 
     let upstreamRes;
     try {
-      upstreamRes = await fetch(url, { method: 'POST', headers, body: JSON.stringify(upBody), signal: ac.signal });
+      upstreamRes = await fetchUpstream(url, headers, upBody, ac.signal, outFormat, profileKey, mappedModel);
     } catch (fetchErr) {
       if (ac.signal.aborted) return log({ status: 499, error: 'client disconnected' });
       console.error(`[${profileKey}] Network error:`, fetchErr.message);
@@ -2553,7 +2579,7 @@ async function handleWsResponseCreate(socket, payload, req, ac, history = null)
 
     let upstreamRes;
     try {
-      upstreamRes = await fetch(url, { method: 'POST', headers, body: JSON.stringify(upBody), signal: ac.signal });
+      upstreamRes = await fetchUpstream(url, headers, upBody, ac.signal, outFormat, profileKey, mappedModel);
     } catch (fetchErr) {
       if (ac.signal.aborted) return log({ status: 499, error: 'client disconnected' });
       console.error(`[${profileKey}:ws] Network error:`, fetchErr.message);

package/tests/cdp.mjs

@@ -5,6 +5,7 @@ import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { reapDirSync, onAbnormalExit } from './helpers.mjs';
 
 const CANDIDATES = [
   process.env.LLM_SWITCHER_CHROMIUM,
@@ -48,7 +49,10 @@ export async function launchBrowser() {
     'about:blank'
   ];
   // POSIX: a process group of its own, so close() can stop the renderers and helpers too.
-  const child = spawn(findChromium(), args, { stdio: ['ignore', 'ignore', 'pipe'], env: { ...process.env, HOME: dir }, detached: process.platform !== 'win32' });
+  // TMPDIR too: Chromium makes its own org.chromium.* dirs there, and they go with the profile.
+  const child = spawn(findChromium(), args, { stdio: ['ignore', 'ignore', 'pipe'], env: { ...process.env, HOME: dir, TMPDIR: dir }, detached: process.platform !== 'win32' });
+  // The browser runs detached, so a test process that ends without close() would leave it running.
+  const cancelExitReap = onAbnormalExit(() => reapDirSync(dir, process.platform !== 'win32' ? [-child.pid] : [child.pid]));
   const stop = (signal) => {
     try {
       if (process.platform !== 'win32') process.kill(-child.pid, signal);
@@ -71,6 +75,8 @@ export async function launchBrowser() {
       stop('SIGKILL');
       await new Promise(r => { child.once('exit', r); setTimeout(r, 3000); });
     }
+    cancelExitReap();
+    fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
     throw new Error(`Chromium did not open a debugging port (exit: ${exited ?? 'killed'})\n${stderr}`);
   }
 
@@ -84,6 +90,7 @@ export async function launchBrowser() {
       return page;
     },
     async close() {
+      cancelExitReap();
       for (const p of pages) p.close();
       // The whole group: a helper that outlives the main process keeps writing into the profile.
       stop('SIGTERM');

package/tests/dashboard-fixture.mjs

@@ -8,6 +8,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { stopChild, reapDir, reapDirSync, onAbnormalExit } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -39,6 +40,11 @@ export function baselineConfig(port, blindfoldPort, upstreamBase) {
 export async function startDashboardFixture() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'lsw-dashboard-'));
   const cfgPath = path.join(dir, 'config.json');
+  let interceptor = null;
+  let proxy = null;
+  // A run that ends before stop() (a signal, a failed start) still stops the children and an
+  // interceptor the gateway started detached, and removes the dir.
+  const cancelExitReap = onAbnormalExit(() => reapDirSync(dir, [proxy?.pid, interceptor?.pid]));
   const received = [];
   // 'ok' answers like a healthy provider; 'deny' answers 401; 'down' answers 503.
   const upstream = { mode: 'ok', received, models: ['up-alpha', 'up-beta', 'up-gamma'], latest: '99.0.0' };
@@ -62,6 +68,23 @@ export async function startDashboardFixture() {
     });
   });
   await new Promise(r => upstreamServer.listen(0, '127.0.0.1', r));
+
+  async function stop() {
+    cancelExitReap();
+    // The gateway first: once it is gone it can start no interceptor.
+    await stopChild(proxy);
+    await stopChild(interceptor);
+    upstreamServer.close();
+    upstreamServer.closeAllConnections?.();
+    // A tool set change can start a detached interceptor of its own; stop the one the gateway recorded.
+    try {
+      const { pid } = JSON.parse(fs.readFileSync(path.join(dir, 'blindfold.json'), 'utf8'));
+      if (Number.isInteger(pid) && pid !== interceptor?.pid) process.kill(pid);
+    } catch { /* none was started */ }
+    // One it had not recorded yet still names the dir on its command line.
+    await reapDir(dir);
+  }
+
   const upstreamBase = `http://127.0.0.1:${upstreamServer.address().port}`;
 
   const port = await freePort();
@@ -96,7 +119,7 @@ export async function startDashboardFixture() {
   // The gateway starts an interceptor of its own when it finds none on the port. This one is up
   // first and answers the identity proof with this gateway's port and tool set, so nothing real
   // is spawned.
-  const interceptor = spawn(process.execPath, ['--input-type=module', '-e', `
+  interceptor = spawn(process.execPath, ['--input-type=module', '-e', `
     const s = await import(${JSON.stringify(pathToFileURL(path.join(ROOT, 'state.mjs')).href)});
     const http = await import('node:http');
     s.ensureAdminToken();
@@ -112,11 +135,11 @@ export async function startDashboardFixture() {
   for (;;) {
     const probe = await fetch(`http://127.0.0.1:${blindfoldPort}/?challenge=probe`).catch(() => null);
     if (probe?.ok) break;
-    if (Date.now() > deadline) { interceptor.kill(); throw new Error('the stand-in interceptor never came up'); }
+    if (Date.now() > deadline) { await stop(); throw new Error('the stand-in interceptor never came up'); }
     await new Promise(r => setTimeout(r, 100));
   }
 
-  const proxy = spawn(process.execPath, [path.join(ROOT, 'proxy.mjs'), '--port', String(port)], { env, stdio: ['ignore', 'pipe', 'pipe'] });
+  proxy = spawn(process.execPath, [path.join(ROOT, 'proxy.mjs'), '--port', String(port)], { env, stdio: ['ignore', 'pipe', 'pipe'] });
   let log = '';
   proxy.stdout.on('data', d => { log += d; });
   proxy.stderr.on('data', d => { log += d; });
@@ -125,7 +148,7 @@ export async function startDashboardFixture() {
     try { started = (await fetch(`http://127.0.0.1:${port}/health`)).ok; } catch { /* not listening yet */ }
     if (!started) await new Promise(r => setTimeout(r, 100));
   }
-  if (!started) { proxy.kill(); interceptor.kill(); throw new Error(`gateway did not start:\n${log}`); }
+  if (!started) { await stop(); throw new Error(`gateway did not start:\n${log}`); }
 
   const adminToken = () => fs.readFileSync(path.join(dir, 'admin.token'), 'utf8').trim();
   return {
@@ -153,17 +176,6 @@ export async function startDashboardFixture() {
       headers: { 'Content-Type': 'application/json', 'anthropic-version': '2023-06-01' },
       body: JSON.stringify({ model: 'claude-opus-4-6', max_tokens: 64, messages: [{ role: 'user', content: 'hello from the test' }] })
     }).then(async r => ({ status: r.status, text: await r.text() })),
-    async stop() {
-      interceptor.kill();
-      proxy.kill();
-      upstreamServer.close();
-      upstreamServer.closeAllConnections?.();
-      // A tool set change can start a detached interceptor of its own; stop the one the gateway recorded.
-      try {
-        const { pid } = JSON.parse(fs.readFileSync(path.join(dir, 'blindfold.json'), 'utf8'));
-        if (Number.isInteger(pid) && pid !== interceptor.pid) process.kill(pid);
-      } catch { /* none was started */ }
-      fs.rmSync(dir, { recursive: true, force: true });
-    }
+    stop
   };
 }

package/tests/formats.test.mjs

@@ -12,7 +12,8 @@ import {
   createChatStream, buildChatMessage, chatFinish, anthropicStopReason,
   smartText, smartReasoning, sanitizeJsonSchema, normalizeUpstream, buildVertexMessage,
   createCodeAssistStream,
-  budgetToEffort, effortToBudget, normalizeEffort, capEffort, mapEquivalentEffort, EFFORT_LEVELS, parseArgs, buildAnthropicMessage
+  budgetToEffort, effortToBudget, normalizeEffort, capEffort, mapEquivalentEffort, EFFORT_LEVELS, parseArgs, buildAnthropicMessage,
+  refusesImageInput, omitChatImages, IMAGE_OMITTED_TEXT
 } from '../formats.mjs';
 import { assertValidAnthropicEvents } from './helpers.mjs';
 
@@ -39,6 +40,50 @@ test('Chat emitter restores thinking for versioned Claude Opus model IDs', () =>
   }
 });
 
+// Only an answer that says the model takes no images may turn into a text-only retry.
+test('refusesImageInput matches the known no-image errors and nothing else', () => {
+  for (const t of [
+    '{"error":{"message":"Invalid content type. image_url is only supported by certain models."}}',
+    'Failed to deserialize the JSON body into the target type: messages[0]: unknown variant `image_url`, expected `text`',
+    'This model does not support image input',
+    'Image input is not supported for this model',
+    'Vision is not supported by deepseek-chat'
+  ]) assert.equal(refusesImageInput(t), true, t);
+  for (const t of ['', 'temperature must be between 0 and 2', 'maximum context length exceeded', 'vision model overloaded', 'not supported: tool_choice',
+    'Invalid image_url: could not decode base64', "Invalid 'messages[0].content[1].image_url.url'. Expected a base64-encoded data URL"])
+    assert.equal(refusesImageInput(t), false, t);
+});
+
+test('omitChatImages replaces every image part with text and counts them', () => {
+  const body = { messages: [
+    { role: 'system', content: 'sys' },
+    { role: 'user', content: [{ type: 'image_url', image_url: { url: 'data:image/png;base64,AA' } }, { type: 'text', text: 'what?' }] },
+    { role: 'assistant', content: 'a cat' },
+    { role: 'user', content: [{ type: 'image_url', image_url: { url: 'https://x/y.png' } }] }
+  ] };
+  assert.equal(omitChatImages(body), 2);
+  assert.deepEqual(body.messages[1].content, [{ type: 'text', text: IMAGE_OMITTED_TEXT }, { type: 'text', text: 'what?' }]);
+  assert.deepEqual(body.messages[3].content, [{ type: 'text', text: IMAGE_OMITTED_TEXT }]);
+  assert.equal(IMAGE_OMITTED_TEXT, '[image omitted: this model does not accept images]');
+  assert.equal(omitChatImages(body), 0, 'nothing left to replace');
+  assert.equal(omitChatImages({}), 0);
+});
+
+// A max_tokens above the model's own output limit is refused upstream, so it is clamped when the limit is known.
+test('emitUpstreamBody clamps max tokens to a known output limit, and leaves it when the limit is unknown', () => {
+  const ir = anthropicToIR({ model: 'x', max_tokens: 64000, messages: [{ role: 'user', content: 'hi' }] });
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm', { maxOutputTokens: 8192 }).max_tokens, 8192);
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm', { thinkingMode: 'native', maxOutputTokens: 8192 }).max_completion_tokens, 8192);
+  assert.equal(emitUpstreamBody('anthropic', ir, 'm', { maxOutputTokens: 8192 }).max_tokens, 8192);
+  assert.equal(emitUpstreamBody('vertex', ir, 'm', { maxOutputTokens: 8192 }).generationConfig.maxOutputTokens, 8192);
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm').max_tokens, 64000, 'unknown limit: unchanged');
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm', { maxOutputTokens: 128000 }).max_tokens, 64000, 'under the limit: unchanged');
+  assert.equal(ir.params.maxTokens, 64000, 'the client IR is not changed');
+  const bare = anthropicToIR({ model: 'x', messages: [{ role: 'user', content: 'hi' }] });
+  assert.equal('max_tokens' in emitUpstreamBody('openai-chat', bare, 'm', { maxOutputTokens: 8192 }), false, 'no max tokens sent: none invented');
+  assert.equal(emitUpstreamBody('anthropic', bare, 'm', { maxOutputTokens: 2048 }).max_tokens, 2048, 'the Anthropic default of 4096 is clamped too');
+});
+
 test('emitUpstreamBody: billing header stripped only for antigravity (ag/) models', () => {
   const header = 'x-anthropic-billing-header: cc_version=2.1.275.f15; cc_entrypoint=cli;';
   const fromArray = anthropicToIR({

package/tests/gateway.e2e.test.mjs

@@ -11,14 +11,14 @@ import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import zlib from 'node:zlib';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { assertValidAnthropicEvents } from './helpers.mjs';
+import { assertValidAnthropicEvents, stopChild, reapDir, reapDirSync, onAbnormalExit } from './helpers.mjs';
 import { createFrameReader } from '../blindfold/wsframe.mjs';
 
 const MASKED = '__LLM_SWITCHER_KEEP_KEY__';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
-let upstream, upstreamPort, proxy, proxyPort, tmpDir, fakeInterceptor, blindfoldPort, certsDir;
+let upstream, upstreamPort, proxy, proxyPort, tmpDir, fakeInterceptor, blindfoldPort, certsDir, cancelExitReap;
 const received = []; // { url, headers, body }
 const hangState = { closed: false, slowAborted: false };
 const bigState = { finishedAt: 0 };
@@ -83,7 +83,8 @@ function startUpstream() {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         return res.end(JSON.stringify({ data: [
           { id: 'gpt-5.6-sol', context_length: 1048576, compact_window: 272000 },
-          { id: 'up-opus', context_length: 200000 }
+          { id: 'up-opus', context_length: 200000 },
+          { id: 'up-capped', context_length: 200000, max_output_tokens: 8192 }
         ] }));
       }
       if (req.url.startsWith('/intact/v1/messages')) {
@@ -95,6 +96,20 @@ function startUpstream() {
         return res.end(JSON.stringify({ id: 'c1', object: 'chat.completion', model: json.model, choices: [{ index: 0, message: { role: 'assistant', content: 'converted ok' }, finish_reason: 'stop' }], usage: { prompt_tokens: 1, completion_tokens: 1 } }));
       }
       if (req.url.startsWith('/chat/v1/chat/completions')) {
+        // A text-only model: it refuses any image part, and one that refuses for an unrelated reason.
+        const hasImage = (json.messages || []).some(m => Array.isArray(m.content) && m.content.some(p => p?.type === 'image_url'));
+        if (json.model === 'up-textonly' && hasImage) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message: 'Failed to deserialize the JSON body: messages[0]: unknown variant `image_url`, expected `text`', type: 'invalid_request_error' } }));
+        }
+        if (json.model === 'up-textonly' && lastUser.includes('RETRY_FAILS')) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message: 'try again later', type: 'invalid_request_error' } }));
+        }
+        if (json.model === 'up-badreq') {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message: 'temperature must be between 0 and 2', type: 'invalid_request_error' } }));
+        }
         if (lastUser.includes('TOOL_ALIAS_REPLAY')) {
           const reference = json.messages.find(m => m.role === 'tool');
           const name = JSON.parse(reference.content).tool_name;
@@ -220,6 +235,8 @@ before(async () => {
   await startUpstream();
   proxyPort = await freePort();
   tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'llm-switcher-test-'));
+  // A run that ends with no after() still stops the gateway and the interceptor it started detached.
+  cancelExitReap = onAbnormalExit(() => reapDirSync(tmpDir, [proxy?.pid, fakeInterceptor?.pid]));
 
   // R3b: both tools are active in this fixture, so every admin write runs through
   // checkBlindfoldTarget. Give the interceptor a port of its own and a certificate minted for
@@ -243,6 +260,8 @@ before(async () => {
       roles: { name: 'Mock Public Roles', mode: 'convert', inFormat: 'responses', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-roles', publicModels: ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna'], defaultModels: { main: 'ag/mock-flash', review: 'ag/mock-review', subagent: 'ag/mock-low' } },
       native: { name: 'Mock Strict OpenAI', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', thinkingMode: 'native', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-native', defaultModels: models },
       intactcc: { name: 'Mock intact', mode: 'convert', tool: 'claude', outFormat: 'openai-chat', thinkingMode: 'off', baseURL: `${base}/intact/v1`, apiKey: 'sk-intact-user', defaultModels: { opus: 'claude/claude-opus-5', sonnet: 'gem/flash', haiku: 'claude/claude-haiku-4-5', fable: 'gem/flash' } },
+      textonly: { name: 'Mock Text Only', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-textonly', defaultModels: { opus: 'up-textonly', sonnet: 'up-badreq', haiku: 'up-haiku', fable: 'up-fable' } },
+      capped: { name: 'Mock Capped Output', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-capped', defaultModels: { opus: 'up-capped', sonnet: 'up-sonnet', haiku: 'up-haiku', fable: 'up-fable' } },
       ant: { name: 'Mock Anthropic', mode: 'direct', inFormat: 'auto', outFormat: 'anthropic', baseURL: `${base}/ant`, apiKey: 'sk-secret-ant', defaultModels: models }
     }
   };
@@ -302,9 +321,11 @@ before(async () => {
   }
 });
 
-after(() => {
-  fakeInterceptor?.kill();
-  proxy?.kill();
+after(async () => {
+  cancelExitReap?.();
+  // The gateway first: once it is gone it can start no interceptor.
+  await stopChild(proxy);
+  await stopChild(fakeInterceptor);
   upstream?.close();
   // A test that changes the tool set makes the gateway start a real interceptor. It is detached on
   // purpose, so it outlives the gateway; stop the one the gateway recorded before its state goes.
@@ -312,7 +333,8 @@ after(() => {
     const { pid } = JSON.parse(fs.readFileSync(path.join(tmpDir, 'blindfold.json'), 'utf8'));
     if (Number.isInteger(pid) && pid !== fakeInterceptor?.pid) process.kill(pid);
   } catch {}
-  if (tmpDir) fs.rmSync(tmpDir, { recursive: true, force: true });
+  // One it had not recorded yet still names the dir on its command line.
+  if (tmpDir) await reapDir(tmpDir);
 });
 
 const url = (p) => `http://127.0.0.1:${proxyPort}${p}`;
@@ -590,6 +612,57 @@ test('A8: /v1/chat/completions and /chat/completions answer 404 on the gateway',
   assert.equal(received.length, before, 'a removed route never reaches an upstream');
 });
 
+// The profile's own list names the output limit, so a max_tokens above it is clamped instead of refused.
+test('max_tokens above the listed output limit is clamped; a model with no listed limit keeps it', async () => {
+  const listed = await fetch(url('/v1/models'), { headers: { 'x-llm-profile': 'capped' } });
+  assert.equal(listed.status, 200);
+  await listed.text();
+  const res = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 64000, messages: [{ role: 'user', content: 'hi' }] }, { 'x-llm-profile': 'capped' });
+  assert.equal(res.status, 200);
+  await res.text();
+  assert.equal(received.at(-1).body.model, 'up-capped');
+  assert.equal(received.at(-1).body.max_tokens, 8192);
+  const free = await post('/v1/messages', { model: 'claude-sonnet-4-6', max_tokens: 64000, messages: [{ role: 'user', content: 'hi' }] }, { 'x-llm-profile': 'capped' });
+  await free.text();
+  assert.equal(received.at(-1).body.model, 'up-sonnet');
+  assert.equal(received.at(-1).body.max_tokens, 64000);
+});
+
+// A text-only model refuses an image that stays in the history, so every later turn would fail too.
+test('An image refused by a text-only chat model is retried once as text in each request', async () => {
+  const image = { type: 'image', source: { type: 'base64', media_type: 'image/png', data: 'iVBORw0KGgo=' } };
+  const calls = model => received.filter(r => r.url.startsWith('/chat/v1/chat/completions') && r.body.model === model).length;
+  const sentImage = r => r.body.messages.some(m => Array.isArray(m.content) && m.content.some(p => p?.type === 'image_url'));
+  const first = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 100, messages: [{ role: 'user', content: [image, { type: 'text', text: 'what is this' }] }] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(first.status, 200);
+  assert.equal((await first.json()).type, 'message');
+  assert.equal(calls('up-textonly'), 2, 'one refusal, one retry');
+  assert.equal(sentImage(received.at(-1)), false);
+  assert.ok(JSON.stringify(received.at(-1).body).includes('[image omitted: this model does not accept images]'));
+
+  const second = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 100, stream: true, messages: [
+    { role: 'user', content: [image, { type: 'text', text: 'what is this' }] },
+    { role: 'assistant', content: 'an image' },
+    { role: 'user', content: 'and now?' }
+  ] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(second.status, 200);
+  await second.text();
+  assert.equal(calls('up-textonly'), 4, 'nothing is remembered: one refusal, one retry again');
+  assert.equal(sentImage(received.at(-2)), true);
+  assert.equal(sentImage(received.at(-1)), false);
+
+  const failed = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 100, messages: [{ role: 'user', content: [image, { type: 'text', text: 'RETRY_FAILS' }] }] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(failed.status, 400);
+  assert.match((await failed.json()).error.message, /try again later/, 'the client gets the error of the retry, not the first refusal');
+  assert.equal(calls('up-textonly'), 6);
+
+  const other = await post('/v1/messages', { model: 'claude-sonnet-4-6', max_tokens: 100, messages: [{ role: 'user', content: [image, { type: 'text', text: 'hi' }] }] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(other.status, 400);
+  assert.match((await other.json()).error.message, /temperature must be between 0 and 2/);
+  assert.equal(calls('up-badreq'), 1, 'an unrelated 400 is relayed, never retried');
+  assert.equal(sentImage(received.at(-1)), true);
+});
+
 test('Upstream 429 is returned in Anthropic error shape with retry-after', async () => {
   const res = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 10, messages: [{ role: 'user', content: 'RATE_LIMIT' }] });
   assert.equal(res.status, 429);

package/tests/helpers.mjs

@@ -1,4 +1,64 @@
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+const sleep = (ms) => new Promise(r => setTimeout(r, ms));
+
+// The pids of every process whose command line names `dir`, this one excluded. A gateway records
+// its detached interceptor only once it answers, so a teardown that trusts the record misses one
+// still starting. POSIX only: on Windows it returns [].
+export function pidsNaming(dir) {
+  if (process.platform === 'win32' || !dir) return [];
+  const r = spawnSync('ps', ['-eo', 'pid=,args='], { encoding: 'utf8' });
+  if (r.status !== 0) return [];
+  return r.stdout.split('\n')
+    .map(line => line.trim().match(/^(\d+)\s+(.*)$/))
+    .filter(m => m && m[2].includes(dir) && Number(m[1]) !== process.pid)
+    .map(m => Number(m[1]));
+}
+
+// Stops a child and waits for its exit, so nothing it does later lands in a removed directory.
+export async function stopChild(child, ms = 3000) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  const exited = new Promise(r => child.once('exit', r));
+  child.kill('SIGTERM');
+  if (await Promise.race([exited.then(() => true), sleep(ms).then(() => false)])) return;
+  child.kill('SIGKILL');
+  await Promise.race([exited, sleep(ms)]);
+}
+
+// Stops every process that still names `dir` (SIGTERM, then SIGKILL), then removes the dir.
+export async function reapDir(dir) {
+  for (let i = 0; i < 30; i++) {
+    const left = pidsNaming(dir);
+    if (!left.length) break;
+    for (const pid of left) try { process.kill(pid, i < 20 ? 'SIGTERM' : 'SIGKILL'); } catch { /* gone */ }
+    await sleep(100);
+  }
+  fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
+}
+
+// The same, synchronous, for a process that is about to end. A negative pid is a process group.
+export function reapDirSync(dir, pids = []) {
+  for (const pid of [...pids.filter(Number.isInteger), ...pidsNaming(dir)]) try { process.kill(pid, 'SIGKILL'); } catch { /* gone */ }
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* best effort at exit */ }
+}
+
+// Runs `fn` when this process ends before its teardown did: at exit, or on a signal, which ends a
+// test process with no after() hook. Returns the function that cancels it.
+export function onAbnormalExit(fn) {
+  const SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+  const run = () => { off(); try { fn(); } catch { /* best effort at exit */ } };
+  // The listener replaces the default action, so the signal is raised again once it is gone.
+  const onSignal = (sig) => { run(); process.kill(process.pid, sig); };
+  function off() {
+    process.off('exit', run);
+    for (const sig of SIGNALS) process.off(sig, onSignal);
+  }
+  process.once('exit', run);
+  for (const sig of SIGNALS) process.on(sig, onSignal);
+  return off;
+}
 
 // Validate an Anthropic event sequence: indexes increase in start order, deltas only target an open block.
 export function assertValidAnthropicEvents(events) {

package/tests/teardown.test.mjs

@@ -0,0 +1,84 @@
+// The browser tests start a gateway, a stand-in interceptor and a Chromium, and the gateway can
+// start a real interceptor of its own, detached. Whatever ends the run, none of them and none of
+// their temp dirs may outlive it. Each case runs in a child process with a private TMPDIR, so
+// "nothing left" is a check on that one directory.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { skipReason } from './cdp.mjs';
+import { pidsNaming } from './helpers.mjs';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const url = (f) => JSON.stringify(pathToFileURL(path.join(HERE, f)).href);
+const sleep = (ms) => new Promise(r => setTimeout(r, ms));
+const skip = process.platform === 'win32' ? 'lists processes with ps' : skipReason();
+
+// Starts the fixture and a browser, then moves the interceptor to a new port so the gateway starts
+// a real one. `awaitStart` false: the script does not wait for the gateway to record it.
+const PRELUDE = (awaitStart) => `
+  import { startDashboardFixture } from ${url('dashboard-fixture.mjs')};
+  import { launchBrowser } from ${url('cdp.mjs')};
+  import { pidsNaming } from ${url('helpers.mjs')};
+  import net from 'node:net';
+  const free = () => new Promise(r => { const s = net.createServer().listen(0, '127.0.0.1', () => { const { port } = s.address(); s.close(() => r(port)); }); });
+  const fx = await startDashboardFixture();
+  const browser = await launchBrowser();
+  await browser.newPage();
+  const cfg = fx.config();
+  cfg.blindfold.port = await free();
+  fx.writeConfig(cfg);
+  const sync = fx.api('/api/blindfold/sync', {});
+  ${awaitStart ? `const r = await sync; if (r.status !== 200) throw new Error('no interceptor: ' + JSON.stringify(r.json));` : 'sync.catch(() => {});'}
+  for (let i = 0; i < 200 && !pidsNaming(fx.dir).length; i++) await new Promise(r => setTimeout(r, 25));
+  if (!pidsNaming(fx.dir).length) throw new Error('the gateway started no interceptor');
+`;
+
+async function inPrivateTmp(t, script, act) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lsw-teardown-'));
+  t.after(() => {
+    // A red run must not leave what it found behind.
+    for (const pid of pidsNaming(tmp)) try { process.kill(pid, 'SIGKILL'); } catch { /* gone */ }
+    fs.rmSync(tmp, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
+  });
+  const child = spawn(process.execPath, ['--input-type=module', '-e', script], {
+    env: { ...process.env, TMPDIR: tmp, TMP: tmp, TEMP: tmp }, stdio: ['ignore', 'pipe', 'pipe']
+  });
+  let out = '';
+  child.stdout.on('data', d => { out += d; });
+  child.stderr.on('data', d => { out += d; });
+  const exited = new Promise(r => child.once('exit', r));
+  await act(child, () => out);
+  await Promise.race([exited, sleep(30000)]);
+  // A detached process may take a moment to die after the signal.
+  let left = pidsNaming(tmp);
+  for (let i = 0; i < 50 && left.length; i++) { await sleep(100); left = pidsNaming(tmp); }
+  return { left, files: fs.readdirSync(tmp), out: () => out };
+}
+
+test('stop() and close() remove an interceptor the gateway had not recorded yet, and every temp dir', { skip, timeout: 90000 }, async (t) => {
+  const r = await inPrivateTmp(t, `${PRELUDE(false)}
+    await fx.stop();
+    await browser.close();
+    console.log('DONE');
+  `, async () => {});
+  assert.match(r.out(), /DONE/, r.out());
+  assert.deepEqual(r.left, [], 'no process names the temp dir');
+  assert.deepEqual(r.files, [], 'no temp dir is left');
+});
+
+test('a test process stopped by SIGTERM still stops its gateway, interceptor and browser', { skip, timeout: 90000 }, async (t) => {
+  const r = await inPrivateTmp(t, `${PRELUDE(true)}
+    console.log('READY');
+    setInterval(() => {}, 1000);
+  `, async (child, out) => {
+    for (let i = 0; i < 600 && !/READY/.test(out()) && child.exitCode === null; i++) await sleep(100);
+    assert.match(out(), /READY/, out());
+    child.kill('SIGTERM');
+  });
+  assert.deepEqual(r.left, [], 'no process names the temp dir');
+  assert.deepEqual(r.files, [], 'no temp dir is left');
+});

package/tests/windows.test.mjs

@@ -20,11 +20,22 @@ test('a list entry gives the whole window and the window to compress at', () =>
   assert.deepEqual(parseModelWindows({ id: 'groq/q', context_window: 131072 }), { context: 131072, compact: 0 },
     'one window is the whole window, not a threshold');
   assert.deepEqual(parseModelWindows({ id: 'or/r', context_length: 262144, top_provider: { context_length: 262144, max_completion_tokens: 32768 } }),
-    { context: 262144, compact: 0 });
+    { context: 262144, compact: 0, output: 32768 });
   assert.deepEqual(parseModelWindows({ id: 'bare' }), null, 'a model with no limits says nothing');
   assert.deepEqual(parseModelWindows({ id: 'zero', context_length: 0, compact_window: 0 }), null);
 });
 
+// The output limit lets the gateway clamp a max_tokens the model would refuse.
+test('a list entry keeps the output limit it names, and leaves it out when it names none', () => {
+  assert.deepEqual(parseModelWindows({ id: 'i/m', context_length: 200000, max_output_tokens: 8192 }),
+    { context: 200000, compact: 0, output: 8192 });
+  assert.deepEqual(parseModelWindows({ id: 'only-out', max_output_tokens: 4096 }), { context: 0, compact: 0, output: 4096 },
+    'an output limit alone is still worth keeping');
+  assert.equal('output' in parseModelWindows({ id: 'g', context_length: 131072 }), false);
+  assert.deepEqual(parseModelList({ data: [{ id: 'i/m', context_length: 200000, max_output_tokens: 8192 }] }),
+    { 'i/m': { context: 200000, compact: 0, output: 8192 } });
+});
+
 test('parseModelList keys the windows by the id a profile maps, and drops the nameless', () => {
   const out = parseModelList({ data: [{ id: 'models/big', context_length: 1048576 }, { id: 'bare' }, 'plain'] });
   assert.deepEqual(Object.keys(out), ['big'], 'a bare string carries no window, and a models/ prefix is dropped');
@@ -90,6 +101,25 @@ test('windows are cached for an hour, and a failed refresh keeps the stale answe
   }
 });
 
+test('the cache persists the output limit, and an old cache file without it still reads', async () => {
+  const dir = tmpDir();
+  const sink = http.createServer((req, res) => {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ data: [{ id: 'm', context_length: 200000, max_output_tokens: 8192 }] }));
+  });
+  await new Promise(r => sink.listen(0, '127.0.0.1', r));
+  const base = `http://127.0.0.1:${sink.address().port}/v1`;
+  try {
+    await resolveProfileWindows(dir, 'p@' + base, base, 'k', { now: 1_000 });
+    assert.equal(readWindowsCache(dir)['p@' + base].models.m.output, 8192);
+    fs.writeFileSync(path.join(dir, 'model-windows.json'), JSON.stringify({ old: { at: 1_000, baseURL: base, models: { m: { context: 200000, compact: 0 } } } }));
+    assert.deepEqual(await resolveProfileWindows(dir, 'old', base, 'k', { now: 2_000 }), { m: { context: 200000, compact: 0 } });
+  } finally {
+    sink.close();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test('an empty cache file reads as no windows instead of throwing', () => {
   const dir = tmpDir();
   try {

package/windows.mjs

@@ -21,7 +21,8 @@ const FETCH_TIMEOUT_MS = 15000;
 
 const n = v => (Number.isFinite(v) && v > 0 ? Math.round(v) : 0);
 
-// One entry of a provider's list -> the two windows, or null when it names none.
+// One entry of a provider's list -> the two windows, plus `output` (the most the model writes)
+// when the list names it; null when it names none.
 export function parseModelWindows(m) {
   if (!m || typeof m !== 'object') return null;
   const top = m.top_provider && typeof m.top_provider === 'object' ? m.top_provider : {};
@@ -30,8 +31,9 @@ export function parseModelWindows(m) {
   // smaller of the two windows it publishes.
   const compact = n(m.compact_window) || n(m.compaction_threshold)
     || (context && n(m.context_window) && n(m.context_window) < context ? n(m.context_window) : 0);
-  if (!context && !compact) return null;
-  return { context, compact };
+  const output = n(m.max_output_tokens) || n(top.max_completion_tokens);
+  if (!context && !compact && !output) return null;
+  return output ? { context, compact, output } : { context, compact };
 }
 
 // The list as it names the models, so a caller can look one up by the id a profile maps.