llm-switcher 1.6.10 → 1.6.12

package/tests/dashboard-fixture.mjs

@@ -8,6 +8,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { stopChild, reapDir, reapDirSync, onAbnormalExit } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -39,6 +40,11 @@ export function baselineConfig(port, blindfoldPort, upstreamBase) {
 export async function startDashboardFixture() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'lsw-dashboard-'));
   const cfgPath = path.join(dir, 'config.json');
+  let interceptor = null;
+  let proxy = null;
+  // A run that ends before stop() (a signal, a failed start) still stops the children and an
+  // interceptor the gateway started detached, and removes the dir.
+  const cancelExitReap = onAbnormalExit(() => reapDirSync(dir, [proxy?.pid, interceptor?.pid]));
   const received = [];
   // 'ok' answers like a healthy provider; 'deny' answers 401; 'down' answers 503.
   const upstream = { mode: 'ok', received, models: ['up-alpha', 'up-beta', 'up-gamma'], latest: '99.0.0' };
@@ -62,6 +68,23 @@ export async function startDashboardFixture() {
     });
   });
   await new Promise(r => upstreamServer.listen(0, '127.0.0.1', r));
+
+  async function stop() {
+    cancelExitReap();
+    // The gateway first: once it is gone it can start no interceptor.
+    await stopChild(proxy);
+    await stopChild(interceptor);
+    upstreamServer.close();
+    upstreamServer.closeAllConnections?.();
+    // A tool set change can start a detached interceptor of its own; stop the one the gateway recorded.
+    try {
+      const { pid } = JSON.parse(fs.readFileSync(path.join(dir, 'blindfold.json'), 'utf8'));
+      if (Number.isInteger(pid) && pid !== interceptor?.pid) process.kill(pid);
+    } catch { /* none was started */ }
+    // One it had not recorded yet still names the dir on its command line.
+    await reapDir(dir);
+  }
+
   const upstreamBase = `http://127.0.0.1:${upstreamServer.address().port}`;
 
   const port = await freePort();
@@ -96,7 +119,7 @@ export async function startDashboardFixture() {
   // The gateway starts an interceptor of its own when it finds none on the port. This one is up
   // first and answers the identity proof with this gateway's port and tool set, so nothing real
   // is spawned.
-  const interceptor = spawn(process.execPath, ['--input-type=module', '-e', `
+  interceptor = spawn(process.execPath, ['--input-type=module', '-e', `
     const s = await import(${JSON.stringify(pathToFileURL(path.join(ROOT, 'state.mjs')).href)});
     const http = await import('node:http');
     s.ensureAdminToken();
@@ -112,11 +135,11 @@ export async function startDashboardFixture() {
   for (;;) {
     const probe = await fetch(`http://127.0.0.1:${blindfoldPort}/?challenge=probe`).catch(() => null);
     if (probe?.ok) break;
-    if (Date.now() > deadline) { interceptor.kill(); throw new Error('the stand-in interceptor never came up'); }
+    if (Date.now() > deadline) { await stop(); throw new Error('the stand-in interceptor never came up'); }
     await new Promise(r => setTimeout(r, 100));
   }
 
-  const proxy = spawn(process.execPath, [path.join(ROOT, 'proxy.mjs'), '--port', String(port)], { env, stdio: ['ignore', 'pipe', 'pipe'] });
+  proxy = spawn(process.execPath, [path.join(ROOT, 'proxy.mjs'), '--port', String(port)], { env, stdio: ['ignore', 'pipe', 'pipe'] });
   let log = '';
   proxy.stdout.on('data', d => { log += d; });
   proxy.stderr.on('data', d => { log += d; });
@@ -125,7 +148,7 @@ export async function startDashboardFixture() {
     try { started = (await fetch(`http://127.0.0.1:${port}/health`)).ok; } catch { /* not listening yet */ }
     if (!started) await new Promise(r => setTimeout(r, 100));
   }
-  if (!started) { proxy.kill(); interceptor.kill(); throw new Error(`gateway did not start:\n${log}`); }
+  if (!started) { await stop(); throw new Error(`gateway did not start:\n${log}`); }
 
   const adminToken = () => fs.readFileSync(path.join(dir, 'admin.token'), 'utf8').trim();
   return {
@@ -153,17 +176,6 @@ export async function startDashboardFixture() {
       headers: { 'Content-Type': 'application/json', 'anthropic-version': '2023-06-01' },
       body: JSON.stringify({ model: 'claude-opus-4-6', max_tokens: 64, messages: [{ role: 'user', content: 'hello from the test' }] })
     }).then(async r => ({ status: r.status, text: await r.text() })),
-    async stop() {
-      interceptor.kill();
-      proxy.kill();
-      upstreamServer.close();
-      upstreamServer.closeAllConnections?.();
-      // A tool set change can start a detached interceptor of its own; stop the one the gateway recorded.
-      try {
-        const { pid } = JSON.parse(fs.readFileSync(path.join(dir, 'blindfold.json'), 'utf8'));
-        if (Number.isInteger(pid) && pid !== interceptor.pid) process.kill(pid);
-      } catch { /* none was started */ }
-      fs.rmSync(dir, { recursive: true, force: true });
-    }
+    stop
   };
 }

package/tests/datadir.test.mjs

@@ -1,4 +1,4 @@
-import { test } from 'node:test';
+import { test, after } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -6,7 +6,9 @@ import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { resolveDataDir } from '../state.mjs';
 
-const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'llm-sw-datadir-'));
+const made = [];
+after(() => { for (const d of made) fs.rmSync(d, { recursive: true, force: true }); });
+const tmp = () => { const d = fs.mkdtempSync(path.join(os.tmpdir(), 'llm-sw-datadir-')); made.push(d); return d; };
 
 test('a git checkout keeps its data next to the code', () => {
   const root = tmp();

package/tests/formats.test.mjs

@@ -12,8 +12,11 @@ import {
   createChatStream, buildChatMessage, chatFinish, anthropicStopReason,
   smartText, smartReasoning, sanitizeJsonSchema, normalizeUpstream, buildVertexMessage,
   createCodeAssistStream,
-  budgetToEffort, effortToBudget, normalizeEffort, capEffort, mapEquivalentEffort, EFFORT_LEVELS, parseArgs, buildAnthropicMessage
+  budgetToEffort, effortToBudget, normalizeEffort, capEffort, mapEquivalentEffort, EFFORT_LEVELS, parseArgs, buildAnthropicMessage,
+  refusesImageInput, omitChatImages, IMAGE_OMITTED_TEXT,
+  stripGeminiPlaceholders, geminiPaddedTools, withGeminiPlaceholderStrip
 } from '../formats.mjs';
+import { NULL_TOOL_VOCAB, createToolVocab } from '../toolvocab.mjs';
 import { assertValidAnthropicEvents } from './helpers.mjs';
 
 test('anthropicToIR: stream defaults to false and thinking budget_tokens is preserved', () => {
@@ -39,6 +42,50 @@ test('Chat emitter restores thinking for versioned Claude Opus model IDs', () =>
   }
 });
 
+// Only an answer that says the model takes no images may turn into a text-only retry.
+test('refusesImageInput matches the known no-image errors and nothing else', () => {
+  for (const t of [
+    '{"error":{"message":"Invalid content type. image_url is only supported by certain models."}}',
+    'Failed to deserialize the JSON body into the target type: messages[0]: unknown variant `image_url`, expected `text`',
+    'This model does not support image input',
+    'Image input is not supported for this model',
+    'Vision is not supported by deepseek-chat'
+  ]) assert.equal(refusesImageInput(t), true, t);
+  for (const t of ['', 'temperature must be between 0 and 2', 'maximum context length exceeded', 'vision model overloaded', 'not supported: tool_choice',
+    'Invalid image_url: could not decode base64', "Invalid 'messages[0].content[1].image_url.url'. Expected a base64-encoded data URL"])
+    assert.equal(refusesImageInput(t), false, t);
+});
+
+test('omitChatImages replaces every image part with text and counts them', () => {
+  const body = { messages: [
+    { role: 'system', content: 'sys' },
+    { role: 'user', content: [{ type: 'image_url', image_url: { url: 'data:image/png;base64,AA' } }, { type: 'text', text: 'what?' }] },
+    { role: 'assistant', content: 'a cat' },
+    { role: 'user', content: [{ type: 'image_url', image_url: { url: 'https://x/y.png' } }] }
+  ] };
+  assert.equal(omitChatImages(body), 2);
+  assert.deepEqual(body.messages[1].content, [{ type: 'text', text: IMAGE_OMITTED_TEXT }, { type: 'text', text: 'what?' }]);
+  assert.deepEqual(body.messages[3].content, [{ type: 'text', text: IMAGE_OMITTED_TEXT }]);
+  assert.equal(IMAGE_OMITTED_TEXT, '[image omitted: this model does not accept images]');
+  assert.equal(omitChatImages(body), 0, 'nothing left to replace');
+  assert.equal(omitChatImages({}), 0);
+});
+
+// A max_tokens above the model's own output limit is refused upstream, so it is clamped when the limit is known.
+test('emitUpstreamBody clamps max tokens to a known output limit, and leaves it when the limit is unknown', () => {
+  const ir = anthropicToIR({ model: 'x', max_tokens: 64000, messages: [{ role: 'user', content: 'hi' }] });
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm', { maxOutputTokens: 8192 }).max_tokens, 8192);
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm', { thinkingMode: 'native', maxOutputTokens: 8192 }).max_completion_tokens, 8192);
+  assert.equal(emitUpstreamBody('anthropic', ir, 'm', { maxOutputTokens: 8192 }).max_tokens, 8192);
+  assert.equal(emitUpstreamBody('vertex', ir, 'm', { maxOutputTokens: 8192 }).generationConfig.maxOutputTokens, 8192);
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm').max_tokens, 64000, 'unknown limit: unchanged');
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm', { maxOutputTokens: 128000 }).max_tokens, 64000, 'under the limit: unchanged');
+  assert.equal(ir.params.maxTokens, 64000, 'the client IR is not changed');
+  const bare = anthropicToIR({ model: 'x', messages: [{ role: 'user', content: 'hi' }] });
+  assert.equal('max_tokens' in emitUpstreamBody('openai-chat', bare, 'm', { maxOutputTokens: 8192 }), false, 'no max tokens sent: none invented');
+  assert.equal(emitUpstreamBody('anthropic', bare, 'm', { maxOutputTokens: 2048 }).max_tokens, 2048, 'the Anthropic default of 4096 is clamped too');
+});
+
 test('emitUpstreamBody: billing header stripped only for antigravity (ag/) models', () => {
   const header = 'x-anthropic-billing-header: cc_version=2.1.275.f15; cc_entrypoint=cli;';
   const fromArray = anthropicToIR({
@@ -1343,3 +1390,126 @@ test('healAnthropicPayload dedupes repeated tool_use ids', () => {
   assert.deepEqual(msgs[2].content.map(b => [b.tool_use_id, b.content]), [[ids[0], 'a.txt']]);
   assert.deepEqual(msgs[4].content.map(b => [b.tool_use_id, b.content]), [[ids[1], '/'], [ids[2], 'uid']]);
 });
+
+// Reasoning from an aborted turn must not attach to the assistant turn after the next user message.
+test('responsesToIR drops pending reasoning at a user message and joins reasoning pieces with a newline', () => {
+  const ir = responsesToIR({ model: 'x', input: [
+    { type: 'message', role: 'user', content: 'plan it' },
+    { type: 'reasoning', summary: [{ type: 'summary_text', text: 'stale plan' }] },
+    { type: 'message', role: 'user', content: 'start over' },
+    { type: 'reasoning', summary: [{ type: 'summary_text', text: 'fresh plan' }] },
+    { type: 'reasoning', summary: [{ type: 'summary_text', text: 'second piece' }] },
+    { type: 'message', role: 'assistant', content: 'done' }
+  ] });
+  const assistant = ir.messages.find(m => m.role === 'assistant');
+  assert.equal(assistant.reasoning, 'fresh plan\nsecond piece');
+  const viaString = responsesToIR({ model: 'x', input: [
+    { type: 'reasoning', summary: [{ type: 'summary_text', text: 'stale plan' }] },
+    'start over',
+    { type: 'message', role: 'assistant', content: 'done' }
+  ] });
+  assert.equal(viaString.messages.find(m => m.role === 'assistant').reasoning, undefined);
+});
+
+// The direct Anthropic route has no system role inside messages; dropping the message loses its instruction.
+test('healAnthropicPayload folds a mid-conversation system message into a user turn', () => {
+  const roles = (msgs) => msgs.map(m => m.role);
+  const texts = (msgs) => JSON.stringify(msgs);
+  const alternates = (msgs) => msgs.every((m, i) => i === 0 || m.role !== msgs[i - 1].role);
+
+  const r = healAnthropicPayload({ model: 'x', max_tokens: 10, messages: [
+    { role: 'user', content: 'list files' },
+    { role: 'assistant', content: [{ type: 'tool_use', id: 'toolu_1', name: 'Bash', input: { command: 'ls' } }] },
+    { role: 'system', content: 'Use British spelling from now on.' },
+    { role: 'user', content: [{ type: 'tool_result', tool_use_id: 'toolu_1', content: 'a.txt' }] },
+    { role: 'assistant', content: 'one file' },
+    { role: 'system', content: [{ type: 'text', text: 'Be brief.' }] }
+  ] });
+  assert.equal(r.changed, true);
+  const msgs = r.payload.messages;
+  assert.ok(!msgs.some(m => m.role === 'system'), 'no system role remains');
+  assert.ok(alternates(msgs), `roles alternate: ${roles(msgs)}`);
+  assert.deepEqual(roles(msgs), ['user', 'assistant', 'user', 'assistant']);
+  assert.deepEqual(msgs[2].content, [
+    { type: 'tool_result', tool_use_id: 'toolu_1', content: 'a.txt' },
+    { type: 'text', text: '[system] Use British spelling from now on.' },
+    { type: 'text', text: '[system] Be brief.' }
+  ], 'a tool_result stays first; with no user turn after it, the last text joins the previous user turn');
+  assert.ok(!texts(msgs[3]).includes('[system]'));
+
+  const only = healAnthropicPayload({ model: 'x', max_tokens: 10, messages: [
+    { role: 'system', content: 'Answer in French.' },
+    { role: 'assistant', content: 'Bonjour' }
+  ] }).payload.messages;
+  assert.deepEqual(only, [{ role: 'user', content: [{ type: 'text', text: '[system] Answer in French.' }] }, { role: 'assistant', content: 'Bonjour' }]);
+});
+
+// Vertex path: the schema is deep-copied before it is sent, and an Anthropic client streams the call.
+test('a Vertex tool padded for Gemini loses _placeholder in streamed arguments, and only where padded', () => {
+  const ir = anthropicToIR({ model: 'x', max_tokens: 10, messages: [{ role: 'user', content: 'go' }], tools: [{ name: 'run', input_schema: {
+    type: 'object', properties: { env: { type: 'object' }, list: { type: 'array', items: { type: 'object' } }, opts: { type: 'object', properties: { _placeholder: { type: 'string' } } } }
+  } }, { name: 'plain', input_schema: { type: 'object', properties: { a: { type: 'string' } } } }] });
+  const body = JSON.parse(JSON.stringify(irToVertexBody(ir, 'gemini-3-pro')));
+  const padded = geminiPaddedTools(body);
+  assert.deepEqual([...padded.keys()], ['run'], 'only the tool with a padded node');
+  const args = { env: { A: '1', _placeholder: true }, list: [{ _placeholder: false, b: 2 }], opts: { _placeholder: 'keep' }, _placeholder: 1 };
+  assert.deepEqual(stripGeminiPlaceholders(args, padded.get('run')), { env: { A: '1' }, list: [{ b: 2 }], opts: { _placeholder: 'keep' }, _placeholder: 1 });
+
+  const events = [];
+  const r = createAnthropicStream((e, d) => events.push(d), 'm', { vocab: withGeminiPlaceholderStrip(NULL_TOOL_VOCAB, padded) });
+  r.start();
+  const json = JSON.stringify(args);
+  r.tool({ index: 0, id: 'c1', name: 'run', args: json.slice(0, 12) });
+  r.tool({ index: 0, args: json.slice(12) });
+  r.finish('tool_calls');
+  const streamed = events.filter(d => d.delta?.type === 'input_json_delta').map(d => d.delta.partial_json).join('');
+  assert.deepEqual(JSON.parse(streamed), { env: { A: '1' }, list: [{ b: 2 }], opts: { _placeholder: 'keep' }, _placeholder: 1 });
+  assert.equal(withGeminiPlaceholderStrip(NULL_TOOL_VOCAB, padded).args('plain', '{"_placeholder":true}'), '{"_placeholder":true}');
+  assert.equal(withGeminiPlaceholderStrip(NULL_TOOL_VOCAB, new Map()), NULL_TOOL_VOCAB, 'no padding, no wrapper');
+});
+
+// A vertex client gets complete functionCalls, so the strip applies when the call is written out.
+test('a vertex client gets tool-call args without the padded _placeholder, stream and non-stream', () => {
+  const declared = [{ name: 'run', parameters: { type: 'object', properties: { env: { type: 'object' }, opts: { type: 'object', properties: { _placeholder: { type: 'string' } } } } } }];
+  const ir = anthropicToIR({ model: 'x', max_tokens: 10, messages: [{ role: 'user', content: 'go' }], tools: declared.map(t => ({ name: t.name, input_schema: t.parameters })) });
+  const padded = geminiPaddedTools(JSON.parse(JSON.stringify(irToVertexBody(ir, 'gemini-3-pro'))));
+  const vocab = withGeminiPlaceholderStrip(createToolVocab(ir.tools, { allowHyphens: false }), padded);
+  const args = JSON.stringify({ env: { A: '1', _placeholder: true }, opts: { _placeholder: 'keep' } });
+  const want = { env: { A: '1' }, opts: { _placeholder: 'keep' } };
+
+  const chunks = [];
+  const s = createVertexStream((e, d) => chunks.push(d), 'm', { vocab });
+  s.tool({ index: 0, id: 'c1', name: 'run', args: args.slice(0, 9) });
+  s.tool({ index: 0, args: args.slice(9) });
+  s.finish('tool_calls');
+  const streamed = chunks.flatMap(c => c.candidates?.[0]?.content?.parts || []).find(p => p.functionCall);
+  assert.deepEqual(streamed.functionCall.args, want);
+
+  const whole = buildVertexMessage({ model: 'm', tools: [{ index: 0, id: 'c1', name: 'run', args }], finish: 'tool_calls', vocab });
+  assert.deepEqual(whole.candidates[0].content.parts.find(p => p.functionCall).functionCall.args, want);
+});
+
+// The Vertex body names a tool without hyphens, so the strip must find the schema by either name.
+test('the placeholder strip finds a hyphenated tool by its upstream name and by its client name', () => {
+  const ir = anthropicToIR({ model: 'x', max_tokens: 10, messages: [{ role: 'user', content: 'go' }], tools: [{ name: 'my-tool', input_schema: { type: 'object', properties: { env: { type: 'object' } } } }] });
+  const vocab = createToolVocab(ir.tools, { allowHyphens: false, names: ['my-tool'] });
+  assert.equal(vocab.name('my_tool'), 'my-tool', 'fixture: the upstream name is the sanitized one');
+  const padded = geminiPaddedTools(JSON.parse(JSON.stringify(irToVertexBody(ir, 'gemini-3-pro'))));
+  assert.deepEqual([...padded.keys()], ['my_tool']);
+  const strip = withGeminiPlaceholderStrip(vocab, padded);
+  const args = '{"env":{"A":"1","_placeholder":true}}';
+  assert.deepEqual(JSON.parse(strip.args('my_tool', args)), { env: { A: '1' } }, 'upstream name');
+  assert.deepEqual(JSON.parse(strip.args('my-tool', args)), { env: { A: '1' } }, 'client name');
+});
+
+// A union with an object branch becomes anyOf for Gemini, and that object branch is padded too.
+test('the placeholder strip reaches a padded object inside an anyOf branch', () => {
+  const ir = anthropicToIR({ model: 'x', max_tokens: 10, messages: [{ role: 'user', content: 'go' }], tools: [{ name: 'run', input_schema: {
+    type: 'object', properties: { env: { oneOf: [{ type: 'object' }, { type: 'string' }] } }
+  } }] });
+  const padded = geminiPaddedTools(JSON.parse(JSON.stringify(irToVertexBody(ir, 'gemini-3-pro'))));
+  const schema = padded.get('run');
+  assert.ok(Array.isArray(schema?.properties?.env?.anyOf), 'fixture: env is an anyOf with a padded branch');
+  assert.deepEqual(stripGeminiPlaceholders({ env: { A: '1', _placeholder: true } }, schema), { env: { A: '1' } });
+  assert.deepEqual(stripGeminiPlaceholders({ env: 'plain' }, schema), { env: 'plain' });
+});

package/tests/gateway.e2e.test.mjs

@@ -11,14 +11,14 @@ import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import zlib from 'node:zlib';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { assertValidAnthropicEvents } from './helpers.mjs';
+import { assertValidAnthropicEvents, stopChild, reapDir, reapDirSync, onAbnormalExit } from './helpers.mjs';
 import { createFrameReader } from '../blindfold/wsframe.mjs';
 
 const MASKED = '__LLM_SWITCHER_KEEP_KEY__';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
-let upstream, upstreamPort, proxy, proxyPort, tmpDir, fakeInterceptor, blindfoldPort, certsDir;
+let upstream, upstreamPort, proxy, proxyPort, tmpDir, fakeInterceptor, blindfoldPort, certsDir, cancelExitReap;
 const received = []; // { url, headers, body }
 const hangState = { closed: false, slowAborted: false };
 const bigState = { finishedAt: 0 };
@@ -62,6 +62,18 @@ const sse = (res, objs, { raw = [] } = {}) => {
   res.end();
 };
 
+// Upstream errors keyed by a MOCK_ERR:<key> marker in the last user message: [status, message].
+const MOCK_ERRORS = {
+  comma: [400, "This model's maximum context length is 131,072 tokens. However, your messages resulted in 140,000 tokens."],
+  dot: [400, 'Input exceeds the context window of 131.072 tokens: requested 140.000 tokens'],
+  space: [400, 'maximum context length is 131 072 tokens, you requested 140 000 tokens'],
+  underscore: [400, 'maximum context length is 131_072 tokens, you requested 140_000 tokens'],
+  prefixed: [400, 'prompt is too long: 200000 tokens > 199999 maximum'],
+  nonumber: [400, 'The input exceeds the context window of this model.'],
+  rate: [429, 'Rate limit reached on context tokens per minute: maximum context length is 131,072'],
+  server: [500, "Internal error: this model's maximum context length is 131,072 tokens"]
+};
+
 function startUpstream() {
   upstream = http.createServer((req, res) => {
     let body = '';
@@ -83,7 +95,8 @@ function startUpstream() {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         return res.end(JSON.stringify({ data: [
           { id: 'gpt-5.6-sol', context_length: 1048576, compact_window: 272000 },
-          { id: 'up-opus', context_length: 200000 }
+          { id: 'up-opus', context_length: 200000 },
+          { id: 'up-capped', context_length: 200000, max_output_tokens: 8192 }
         ] }));
       }
       if (req.url.startsWith('/intact/v1/messages')) {
@@ -95,6 +108,20 @@ function startUpstream() {
         return res.end(JSON.stringify({ id: 'c1', object: 'chat.completion', model: json.model, choices: [{ index: 0, message: { role: 'assistant', content: 'converted ok' }, finish_reason: 'stop' }], usage: { prompt_tokens: 1, completion_tokens: 1 } }));
       }
       if (req.url.startsWith('/chat/v1/chat/completions')) {
+        // A text-only model: it refuses any image part, and one that refuses for an unrelated reason.
+        const hasImage = (json.messages || []).some(m => Array.isArray(m.content) && m.content.some(p => p?.type === 'image_url'));
+        if (json.model === 'up-textonly' && hasImage) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message: 'Failed to deserialize the JSON body: messages[0]: unknown variant `image_url`, expected `text`', type: 'invalid_request_error' } }));
+        }
+        if (json.model === 'up-textonly' && lastUser.includes('RETRY_FAILS')) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message: 'try again later', type: 'invalid_request_error' } }));
+        }
+        if (json.model === 'up-badreq') {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message: 'temperature must be between 0 and 2', type: 'invalid_request_error' } }));
+        }
         if (lastUser.includes('TOOL_ALIAS_REPLAY')) {
           const reference = json.messages.find(m => m.role === 'tool');
           const name = JSON.parse(reference.content).tool_name;
@@ -108,10 +135,28 @@ function startUpstream() {
             { choices: [{ index: 0, delta: {}, finish_reason: 'tool_calls' }], usage: { prompt_tokens: 10, completion_tokens: 15 } }
           ], { raw: ['data: [DONE]\n\n'] });
         }
+        if (lastUser.includes('PLACEHOLDER_ECHO')) {
+          const args = '{"cmd":"ls","env":{"A":"1","_placeholder":true},"opts":{"_placeholder":"keep"},"_placeholder":true}';
+          if (!json.stream) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            return res.end(JSON.stringify({ choices: [{ index: 0, message: { role: 'assistant', content: null, tool_calls: [{ id: 'call_ph', type: 'function', function: { name: 'run', arguments: args } }] }, finish_reason: 'tool_calls' }], usage: { prompt_tokens: 5, completion_tokens: 5 } }));
+          }
+          return sse(res, [
+            { choices: [{ index: 0, delta: { tool_calls: [{ index: 0, id: 'call_ph', type: 'function', function: { name: 'run', arguments: args.slice(0, 30) } }] } }] },
+            { choices: [{ index: 0, delta: { tool_calls: [{ index: 0, function: { arguments: args.slice(30) } }] } }] },
+            { choices: [{ index: 0, delta: {}, finish_reason: 'tool_calls' }], usage: { prompt_tokens: 5, completion_tokens: 5 } }
+          ], { raw: ['data: [DONE]\n\n'] });
+        }
         if (lastUser.includes('RATE_LIMIT')) {
           res.writeHead(429, { 'Content-Type': 'application/json', 'retry-after': '7' });
           return res.end(JSON.stringify({ error: { message: 'slow down' } }));
         }
+        const mockErr = lastUser.match(/MOCK_ERR:(\w+)/)?.[1];
+        if (mockErr && MOCK_ERRORS[mockErr]) {
+          const [status, message] = MOCK_ERRORS[mockErr];
+          res.writeHead(status, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message, type: 'invalid_request_error' } }));
+        }
         if (lastUser.includes('CONTEXT_OVERFLOW')) {
           res.writeHead(400, { 'Content-Type': 'application/json' });
           return res.end(JSON.stringify({ error: { message: "This model's maximum context length is 131072 tokens. However, you requested 140000 tokens (132000 in the messages, 8000 in the completion). Please reduce the length of the messages or completion.", type: 'invalid_request_error', code: 'invalid_request_error' } }));
@@ -220,6 +265,8 @@ before(async () => {
   await startUpstream();
   proxyPort = await freePort();
   tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'llm-switcher-test-'));
+  // A run that ends with no after() still stops the gateway and the interceptor it started detached.
+  cancelExitReap = onAbnormalExit(() => reapDirSync(tmpDir, [proxy?.pid, fakeInterceptor?.pid]));
 
   // R3b: both tools are active in this fixture, so every admin write runs through
   // checkBlindfoldTarget. Give the interceptor a port of its own and a certificate minted for
@@ -243,6 +290,11 @@ before(async () => {
       roles: { name: 'Mock Public Roles', mode: 'convert', inFormat: 'responses', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-roles', publicModels: ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna'], defaultModels: { main: 'ag/mock-flash', review: 'ag/mock-review', subagent: 'ag/mock-low' } },
       native: { name: 'Mock Strict OpenAI', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', thinkingMode: 'native', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-native', defaultModels: models },
       intactcc: { name: 'Mock intact', mode: 'convert', tool: 'claude', outFormat: 'openai-chat', thinkingMode: 'off', baseURL: `${base}/intact/v1`, apiKey: 'sk-intact-user', defaultModels: { opus: 'claude/claude-opus-5', sonnet: 'gem/flash', haiku: 'claude/claude-haiku-4-5', fable: 'gem/flash' } },
+      textonly: { name: 'Mock Text Only', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-textonly', defaultModels: { opus: 'up-textonly', sonnet: 'up-badreq', haiku: 'up-haiku', fable: 'up-fable' } },
+      capped: { name: 'Mock Capped Output', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-capped', defaultModels: { opus: 'up-capped', sonnet: 'up-sonnet', haiku: 'up-haiku', fable: 'up-fable' } },
+      agyph: { name: 'Mock agy to AG via chat', mode: 'convert', tool: 'agy', outFormat: 'openai-chat', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-agy', defaultModels: { main: 'ag/mock-flash' } },
+      cappedtwin: { name: 'Mock Capped Twin', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-capped', defaultModels: { opus: 'up-capped', sonnet: 'up-sonnet', haiku: 'up-haiku', fable: 'up-fable' } },
+      cappedold: { name: 'Mock Capped Old', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-capped', defaultModels: { opus: 'up-capped', sonnet: 'up-sonnet', haiku: 'up-haiku', fable: 'up-fable' } },
       ant: { name: 'Mock Anthropic', mode: 'direct', inFormat: 'auto', outFormat: 'anthropic', baseURL: `${base}/ant`, apiKey: 'sk-secret-ant', defaultModels: models }
     }
   };
@@ -302,9 +354,11 @@ before(async () => {
   }
 });
 
-after(() => {
-  fakeInterceptor?.kill();
-  proxy?.kill();
+after(async () => {
+  cancelExitReap?.();
+  // The gateway first: once it is gone it can start no interceptor.
+  await stopChild(proxy);
+  await stopChild(fakeInterceptor);
   upstream?.close();
   // A test that changes the tool set makes the gateway start a real interceptor. It is detached on
   // purpose, so it outlives the gateway; stop the one the gateway recorded before its state goes.
@@ -312,7 +366,8 @@ after(() => {
     const { pid } = JSON.parse(fs.readFileSync(path.join(tmpDir, 'blindfold.json'), 'utf8'));
     if (Number.isInteger(pid) && pid !== fakeInterceptor?.pid) process.kill(pid);
   } catch {}
-  if (tmpDir) fs.rmSync(tmpDir, { recursive: true, force: true });
+  // One it had not recorded yet still names the dir on its command line.
+  if (tmpDir) await reapDir(tmpDir);
 });
 
 const url = (p) => `http://127.0.0.1:${proxyPort}${p}`;
@@ -590,6 +645,123 @@ test('A8: /v1/chat/completions and /chat/completions answer 404 on the gateway',
   assert.equal(received.length, before, 'a removed route never reaches an upstream');
 });
 
+// The profile's own list names the output limit, so a max_tokens above it is clamped instead of refused.
+test('max_tokens above the listed output limit is clamped; a model with no listed limit keeps it', async () => {
+  const listed = await fetch(url('/v1/models'), { headers: { 'x-llm-profile': 'capped' } });
+  assert.equal(listed.status, 200);
+  await listed.text();
+  const res = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 64000, messages: [{ role: 'user', content: 'hi' }] }, { 'x-llm-profile': 'capped' });
+  assert.equal(res.status, 200);
+  await res.text();
+  assert.equal(received.at(-1).body.model, 'up-capped');
+  assert.equal(received.at(-1).body.max_tokens, 8192);
+  const free = await post('/v1/messages', { model: 'claude-sonnet-4-6', max_tokens: 64000, messages: [{ role: 'user', content: 'hi' }] }, { 'x-llm-profile': 'capped' });
+  await free.text();
+  assert.equal(received.at(-1).body.model, 'up-sonnet');
+  assert.equal(received.at(-1).body.max_tokens, 64000);
+});
+
+// The clamp trusts only the list this profile read within the hour, whatever other profile shares its baseURL.
+test('max_tokens is clamped only from a fresh cache entry of the same profile', async () => {
+  const listed = await fetch(url('/v1/models'), { headers: { 'x-llm-profile': 'capped' } });
+  await listed.text();
+  const ask = async (profile) => {
+    const res = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 64000, messages: [{ role: 'user', content: 'hi' }] }, { 'x-llm-profile': profile });
+    assert.equal(res.status, 200, profile);
+    await res.text();
+    assert.equal(received.at(-1).body.model, 'up-capped', profile);
+    return received.at(-1).body.max_tokens;
+  };
+  assert.equal(await ask('cappedtwin'), 64000, 'another profile on the same baseURL has not read its list');
+  const cacheFile = path.join(tmpDir, 'model-windows.json');
+  const cache = JSON.parse(fs.readFileSync(cacheFile, 'utf8'));
+  const base = `http://127.0.0.1:${upstreamPort}/chat/v1`;
+  cache[`cappedold@${base}`] = { at: Date.now() - 2 * 3_600_000, baseURL: base, models: { 'up-capped': { context: 200000, compact: 0, output: 4096 } } };
+  fs.writeFileSync(cacheFile, JSON.stringify(cache));
+  assert.equal(await ask('cappedold'), 64000, 'an entry two hours old is not trusted');
+  assert.equal(await ask('capped'), 8192);
+});
+
+// Gemini gets `_placeholder` on an empty nested object; the client never declared it, so it must not come back.
+test('A _placeholder the gateway added for Gemini is stripped from tool-call arguments, stream and non-stream', async () => {
+  const tools = [{ type: 'function', name: 'run', parameters: { type: 'object', properties: {
+    cmd: { type: 'string' },
+    env: { type: 'object', additionalProperties: { type: 'string' } },
+    opts: { type: 'object', properties: { _placeholder: { type: 'string' } } }
+  } } }];
+  const want = { cmd: 'ls', env: { A: '1' }, opts: { _placeholder: 'keep' }, _placeholder: true };
+
+  const plain = await post('/v1/responses', { model: 'main', stream: false, tools, input: 'PLACEHOLDER_ECHO' }, { 'x-llm-profile': 'agmock' });
+  assert.equal(plain.status, 200);
+  const sent = received.at(-1).body.tools.find(t => t.function.name === 'run').function.parameters;
+  assert.deepEqual(Object.keys(sent.properties.env.properties), ['_placeholder'], 'the schema sent upstream was padded');
+  const call = (await plain.json()).output.find(o => o.type === 'function_call');
+  assert.deepEqual(JSON.parse(call.arguments), want);
+
+  const streamed = await post('/v1/responses', { model: 'main', stream: true, tools, input: 'PLACEHOLDER_ECHO' }, { 'x-llm-profile': 'agmock' });
+  const done = parseSSE(await streamed.text()).find(e => e.data?.type === 'response.completed');
+  assert.ok(done, 'the stream completes');
+  assert.deepEqual(JSON.parse(done.data.response.output.find(o => o.type === 'function_call').arguments), want);
+});
+
+test('A Code Assist (agy) client gets tool-call args without the padded _placeholder, stream and non-stream', async () => {
+  const envelope = { project: 'p', requestId: 'agent/s/1/t/1', model: 'gemini-3.8-flash-high', userAgent: 'antigravity', requestType: 'agent', request: {
+    contents: [{ role: 'user', parts: [{ text: 'PLACEHOLDER_ECHO' }] }],
+    tools: [{ functionDeclarations: [{ name: 'run', description: 'Run.', parameters: { type: 'OBJECT', properties: {
+      cmd: { type: 'STRING' }, env: { type: 'OBJECT' }, opts: { type: 'OBJECT', properties: { _placeholder: { type: 'STRING' } } }
+    } } }] }]
+  } };
+  const want = { cmd: 'ls', env: { A: '1' }, opts: { _placeholder: 'keep' }, _placeholder: true };
+  const headers = { 'content-type': 'application/json', 'x-llm-profile': 'agyph' };
+  const callOf = (chunks) => chunks.flatMap(c => c.response?.candidates?.[0]?.content?.parts || []).find(p => p.functionCall)?.functionCall;
+
+  const whole = await fetch(url('/v1internal:generateContent'), { method: 'POST', headers, body: JSON.stringify(envelope) });
+  assert.equal(whole.status, 200);
+  const sent = received.at(-1).body.tools.find(t => t.function.name === 'run').function.parameters;
+  assert.deepEqual(Object.keys(sent.properties.env.properties), ['_placeholder'], 'the schema sent upstream was padded');
+  assert.deepEqual(callOf([await whole.json()]).args, want);
+
+  const streamed = await fetch(url('/v1internal:streamGenerateContent?alt=sse'), { method: 'POST', headers, body: JSON.stringify(envelope) });
+  assert.equal(streamed.status, 200);
+  const chunks = parseSSE(await streamed.text()).map(e => e.data).filter(Boolean);
+  assert.deepEqual(callOf(chunks).args, want);
+});
+
+// A text-only model refuses an image that stays in the history, so every later turn would fail too.
+test('An image refused by a text-only chat model is retried once as text in each request', async () => {
+  const image = { type: 'image', source: { type: 'base64', media_type: 'image/png', data: 'iVBORw0KGgo=' } };
+  const calls = model => received.filter(r => r.url.startsWith('/chat/v1/chat/completions') && r.body.model === model).length;
+  const sentImage = r => r.body.messages.some(m => Array.isArray(m.content) && m.content.some(p => p?.type === 'image_url'));
+  const first = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 100, messages: [{ role: 'user', content: [image, { type: 'text', text: 'what is this' }] }] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(first.status, 200);
+  assert.equal((await first.json()).type, 'message');
+  assert.equal(calls('up-textonly'), 2, 'one refusal, one retry');
+  assert.equal(sentImage(received.at(-1)), false);
+  assert.ok(JSON.stringify(received.at(-1).body).includes('[image omitted: this model does not accept images]'));
+
+  const second = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 100, stream: true, messages: [
+    { role: 'user', content: [image, { type: 'text', text: 'what is this' }] },
+    { role: 'assistant', content: 'an image' },
+    { role: 'user', content: 'and now?' }
+  ] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(second.status, 200);
+  await second.text();
+  assert.equal(calls('up-textonly'), 4, 'nothing is remembered: one refusal, one retry again');
+  assert.equal(sentImage(received.at(-2)), true);
+  assert.equal(sentImage(received.at(-1)), false);
+
+  const failed = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 100, messages: [{ role: 'user', content: [image, { type: 'text', text: 'RETRY_FAILS' }] }] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(failed.status, 400);
+  assert.match((await failed.json()).error.message, /try again later/, 'the client gets the error of the retry, not the first refusal');
+  assert.equal(calls('up-textonly'), 6);
+
+  const other = await post('/v1/messages', { model: 'claude-sonnet-4-6', max_tokens: 100, messages: [{ role: 'user', content: [image, { type: 'text', text: 'hi' }] }] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(other.status, 400);
+  assert.match((await other.json()).error.message, /temperature must be between 0 and 2/);
+  assert.equal(calls('up-badreq'), 1, 'an unrelated 400 is relayed, never retried');
+  assert.equal(sentImage(received.at(-1)), true);
+});
+
 test('Upstream 429 is returned in Anthropic error shape with retry-after', async () => {
   const res = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 10, messages: [{ role: 'user', content: 'RATE_LIMIT' }] });
   assert.equal(res.status, 429);
@@ -612,6 +784,36 @@ test('sendClientError maps context overflow per client', async () => {
   assert.match(codexJson.error.message, /maximum context length is 131072/);
 });
 
+test('Context overflow numbers with thousands separators reach Claude Code whole', async () => {
+  const ask = async (key) => {
+    const res = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 10, messages: [{ role: 'user', content: `MOCK_ERR:${key}` }] });
+    return { status: res.status, error: (await res.json()).error };
+  };
+  for (const key of ['comma', 'dot', 'space', 'underscore']) {
+    const { status, error } = await ask(key);
+    assert.equal(status, 400, key);
+    assert.equal(error.type, 'invalid_request_error', key);
+    assert.equal(error.message, `prompt is too long: 140000 tokens > 131072 maximum (${MOCK_ERRORS[key][1]})`, key);
+  }
+  assert.deepEqual(await ask('prefixed'), { status: 400, error: { type: 'invalid_request_error', message: MOCK_ERRORS.prefixed[1] } });
+  assert.deepEqual(await ask('nonumber'), { status: 400, error: { type: 'invalid_request_error', message: `prompt is too long: ${MOCK_ERRORS.nonumber[1]}` } });
+  assert.deepEqual(await ask('rate'), { status: 429, error: { type: 'rate_limit_error', message: MOCK_ERRORS.rate[1] } });
+  assert.deepEqual(await ask('server'), { status: 500, error: { type: 'api_error', message: MOCK_ERRORS.server[1] } });
+});
+
+test('Codex WS: an upstream context overflow fails the turn with context_length_exceeded', async () => {
+  const ws = await rawWs();
+  ws.socket.write(clientFrame(1, JSON.stringify({ type: 'response.create', model: 'main', input: 'MOCK_ERR:comma over ws' })));
+  assert.ok(await until(() => ws.messages.some(m => m.type === 'response.failed')), 'no response.failed');
+  const failed = ws.messages.find(m => m.type === 'response.failed').response.error;
+  assert.equal(failed.code, 'context_length_exceeded');
+  assert.equal(failed.message, MOCK_ERRORS.comma[1]);
+  ws.socket.write(clientFrame(1, JSON.stringify({ type: 'response.create', model: 'main', input: 'MOCK_ERR:rate over ws' })));
+  assert.ok(await until(() => ws.messages.filter(m => m.type === 'response.failed').length === 2), 'no second response.failed');
+  assert.equal(ws.messages.filter(m => m.type === 'response.failed')[1].response.error.code, 'rate_limit_exceeded');
+  ws.socket.destroy();
+});
+
 test('Mid-stream upstream error surfaces as an error event instead of a fake end_turn', async () => {
   const res = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 10, stream: true, messages: [{ role: 'user', content: 'MID_STREAM_ERROR' }] });
   const events = parseSSE(await res.text());