llm-switcher 1.6.9 → 1.6.11

package/tests/formats.test.mjs

@@ -12,7 +12,8 @@ import {
   createChatStream, buildChatMessage, chatFinish, anthropicStopReason,
   smartText, smartReasoning, sanitizeJsonSchema, normalizeUpstream, buildVertexMessage,
   createCodeAssistStream,
-  budgetToEffort, effortToBudget, normalizeEffort, capEffort, mapEquivalentEffort, EFFORT_LEVELS, parseArgs, buildAnthropicMessage
+  budgetToEffort, effortToBudget, normalizeEffort, capEffort, mapEquivalentEffort, EFFORT_LEVELS, parseArgs, buildAnthropicMessage,
+  refusesImageInput, omitChatImages, IMAGE_OMITTED_TEXT
 } from '../formats.mjs';
 import { assertValidAnthropicEvents } from './helpers.mjs';
 
@@ -39,6 +40,50 @@ test('Chat emitter restores thinking for versioned Claude Opus model IDs', () =>
   }
 });
 
+// Only an answer that says the model takes no images may turn into a text-only retry.
+test('refusesImageInput matches the known no-image errors and nothing else', () => {
+  for (const t of [
+    '{"error":{"message":"Invalid content type. image_url is only supported by certain models."}}',
+    'Failed to deserialize the JSON body into the target type: messages[0]: unknown variant `image_url`, expected `text`',
+    'This model does not support image input',
+    'Image input is not supported for this model',
+    'Vision is not supported by deepseek-chat'
+  ]) assert.equal(refusesImageInput(t), true, t);
+  for (const t of ['', 'temperature must be between 0 and 2', 'maximum context length exceeded', 'vision model overloaded', 'not supported: tool_choice',
+    'Invalid image_url: could not decode base64', "Invalid 'messages[0].content[1].image_url.url'. Expected a base64-encoded data URL"])
+    assert.equal(refusesImageInput(t), false, t);
+});
+
+test('omitChatImages replaces every image part with text and counts them', () => {
+  const body = { messages: [
+    { role: 'system', content: 'sys' },
+    { role: 'user', content: [{ type: 'image_url', image_url: { url: 'data:image/png;base64,AA' } }, { type: 'text', text: 'what?' }] },
+    { role: 'assistant', content: 'a cat' },
+    { role: 'user', content: [{ type: 'image_url', image_url: { url: 'https://x/y.png' } }] }
+  ] };
+  assert.equal(omitChatImages(body), 2);
+  assert.deepEqual(body.messages[1].content, [{ type: 'text', text: IMAGE_OMITTED_TEXT }, { type: 'text', text: 'what?' }]);
+  assert.deepEqual(body.messages[3].content, [{ type: 'text', text: IMAGE_OMITTED_TEXT }]);
+  assert.equal(IMAGE_OMITTED_TEXT, '[image omitted: this model does not accept images]');
+  assert.equal(omitChatImages(body), 0, 'nothing left to replace');
+  assert.equal(omitChatImages({}), 0);
+});
+
+// A max_tokens above the model's own output limit is refused upstream, so it is clamped when the limit is known.
+test('emitUpstreamBody clamps max tokens to a known output limit, and leaves it when the limit is unknown', () => {
+  const ir = anthropicToIR({ model: 'x', max_tokens: 64000, messages: [{ role: 'user', content: 'hi' }] });
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm', { maxOutputTokens: 8192 }).max_tokens, 8192);
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm', { thinkingMode: 'native', maxOutputTokens: 8192 }).max_completion_tokens, 8192);
+  assert.equal(emitUpstreamBody('anthropic', ir, 'm', { maxOutputTokens: 8192 }).max_tokens, 8192);
+  assert.equal(emitUpstreamBody('vertex', ir, 'm', { maxOutputTokens: 8192 }).generationConfig.maxOutputTokens, 8192);
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm').max_tokens, 64000, 'unknown limit: unchanged');
+  assert.equal(emitUpstreamBody('openai-chat', ir, 'm', { maxOutputTokens: 128000 }).max_tokens, 64000, 'under the limit: unchanged');
+  assert.equal(ir.params.maxTokens, 64000, 'the client IR is not changed');
+  const bare = anthropicToIR({ model: 'x', messages: [{ role: 'user', content: 'hi' }] });
+  assert.equal('max_tokens' in emitUpstreamBody('openai-chat', bare, 'm', { maxOutputTokens: 8192 }), false, 'no max tokens sent: none invented');
+  assert.equal(emitUpstreamBody('anthropic', bare, 'm', { maxOutputTokens: 2048 }).max_tokens, 2048, 'the Anthropic default of 4096 is clamped too');
+});
+
 test('emitUpstreamBody: billing header stripped only for antigravity (ag/) models', () => {
   const header = 'x-anthropic-billing-header: cc_version=2.1.275.f15; cc_entrypoint=cli;';
   const fromArray = anthropicToIR({
@@ -420,7 +465,7 @@ test('toGeminiSchema: bare string shorthands become Schema objects (Vertex 400 f
   assert.deepEqual(toGeminiSchema('string'), { type: 'string' });
   assert.deepEqual(
     toGeminiSchema({ type: 'object', properties: { tags: { type: 'array', items: 'object' }, n: 'string' } }),
-    { type: 'object', properties: { tags: { type: 'array', items: { type: 'object', properties: {} } }, n: { type: 'string' } } }
+    { type: 'object', properties: { tags: { type: 'array', items: { type: 'object', properties: { _placeholder: { type: 'boolean', description: 'Unused. Leave unset.' } } } }, n: { type: 'string' } } }
   );
 });
 
@@ -1167,3 +1212,179 @@ test('Gemini MALFORMED_FUNCTION_CALL finish is an error, not stop', () => {
   const chat = normalizeUpstream({ choices: [{ delta: {}, finish_reason: 'malformed_function_call' }] }, 'openai-chat');
   assert.match(String(chat.error), /malformed_function_call/i);
 });
+
+// DeepSeek/Kimi thinking mode refuse a tool step whose earlier tool-call turn lost its reasoning_content.
+test('irToChatBody replays thinking as reasoning_content on tool-call turns', () => {
+  const ir = anthropicToIR({ model: 'x', max_tokens: 8000, thinking: { type: 'enabled', budget_tokens: 4000 }, messages: [
+    { role: 'user', content: 'list files' },
+    { role: 'assistant', content: [{ type: 'thinking', thinking: 'I should run ls', signature: 'sig' }, { type: 'tool_use', id: 'toolu_1', name: 'Bash', input: { command: 'ls' } }] },
+    { role: 'user', content: [{ type: 'tool_result', tool_use_id: 'toolu_1', content: 'a.txt' }] },
+    { role: 'assistant', content: [{ type: 'tool_use', id: 'toolu_2', name: 'Bash', input: { command: 'pwd' } }] },
+    { role: 'user', content: [{ type: 'tool_result', tool_use_id: 'toolu_2', content: '/' }] }
+  ] });
+  for (const opts of [{ thinkingMode: 'auto' }, { thinkingMode: 'native', replayReasoning: true }]) {
+    const calls = irToChatBody(ir, 'deepseek-reasoner', opts).messages.filter(m => m.tool_calls);
+    assert.equal(calls[0].reasoning_content, 'I should run ls', opts.thinkingMode);
+    assert.equal(calls[1].reasoning_content, '', opts.thinkingMode);
+  }
+  const off = emitUpstreamBody('openai-chat', ir, 'deepseek-reasoner', { thinkingMode: 'off' });
+  assert.ok(off.messages.every(m => !('reasoning_content' in m)));
+
+  const rir = responsesToIR({ model: 'x', reasoning: { effort: 'high' }, input: [
+    { type: 'message', role: 'user', content: 'go' },
+    { type: 'reasoning', summary: [{ type: 'summary_text', text: 'Plan: run ls' }], encrypted_content: 'opaque' },
+    { type: 'function_call', call_id: 'c1', name: 'shell', arguments: '{}' },
+    { type: 'function_call_output', call_id: 'c1', output: 'ok' }
+  ] });
+  const rb = irToChatBody(rir, 'kimi-k2-thinking', { thinkingMode: 'native', replayReasoning: true });
+  assert.equal(rb.messages.find(m => m.tool_calls).reasoning_content, 'Plan: run ls');
+});
+
+// Strict OpenAI-compatible servers may refuse the extra key, so native mode sends it only on the profile opt-in.
+test('irToChatBody native mode sends no reasoning_content without the profile opt-in', () => {
+  const ir = anthropicToIR({ model: 'x', max_tokens: 8000, thinking: { type: 'enabled', budget_tokens: 4000 }, messages: [
+    { role: 'user', content: 'list files' },
+    { role: 'assistant', content: [{ type: 'thinking', thinking: 'I should run ls', signature: 'sig' }, { type: 'tool_use', id: 'toolu_1', name: 'Bash', input: { command: 'ls' } }] },
+    { role: 'user', content: [{ type: 'tool_result', tool_use_id: 'toolu_1', content: 'a.txt' }] },
+    { role: 'assistant', content: [{ type: 'tool_use', id: 'toolu_2', name: 'Bash', input: { command: 'pwd' } }] },
+    { role: 'user', content: [{ type: 'tool_result', tool_use_id: 'toolu_2', content: '/' }] }
+  ] });
+  const cases = [
+    ['gpt-5', ir, { thinkingMode: 'native' }],
+    ['deepseek-reasoner', ir, { thinkingMode: 'native' }],
+    ['gpt-5', ir, { thinkingMode: 'native', replayReasoning: 'yes' }],
+    ['gpt-5', { ...ir, replayReasoning: true }, { thinkingMode: 'native' }]
+  ];
+  for (const [model, input, opts] of cases) {
+    const body = irToChatBody(input, model, opts);
+    assert.ok(body.messages.some(m => m.tool_calls), 'fixture has tool-call turns');
+    assert.ok(body.messages.every(m => !('reasoning_content' in m)), `${model} ${JSON.stringify(opts)}`);
+  }
+});
+
+test('irToAnthropicBody drops thinking for an unsigned tool loop', () => {
+  const ir = responsesToIR({ model: 'x', reasoning: { effort: 'high' }, input: [
+    { type: 'message', role: 'user', content: 'run ls' },
+    { type: 'function_call', call_id: 'c1', name: 'shell', arguments: '{"command":["ls"]}' },
+    { type: 'function_call_output', call_id: 'c1', output: 'a.txt' }
+  ] });
+  const body = irToAnthropicBody(ir, 'claude-opus-4-6');
+  assert.equal(body.thinking, undefined);
+  assert.equal(body.messages.at(-1).content[0].type, 'tool_result');
+  const forced = irToAnthropicBody(ir, 'claude-opus-4-6', { thinkingEffort: 'high' });
+  assert.equal(forced.thinking, undefined);
+  const fresh = irToAnthropicBody(responsesToIR({ model: 'x', reasoning: { effort: 'high' }, input: 'hi' }), 'claude-opus-4-6');
+  assert.equal(fresh.thinking?.type, 'enabled');
+});
+
+test('toGeminiSchema never emits an empty nested OBJECT', () => {
+  const out = toGeminiSchema({ type: 'object', properties: {
+    env: { type: 'object', additionalProperties: { type: 'string' } },
+    list: { type: 'array', items: { type: 'object' } },
+    either: { anyOf: [{ type: 'object' }, { type: 'string' }] },
+    short: 'object'
+  } });
+  const walk = (s, nested) => {
+    if (!s || typeof s !== 'object') return;
+    if (nested && s.type === 'object') assert.ok(Object.keys(s.properties || {}).length, JSON.stringify(s));
+    for (const p of Object.values(s.properties || {})) walk(p, true);
+    if (s.items) walk(s.items, true);
+    for (const b of s.anyOf || []) walk(b, true);
+  };
+  walk(out, false);
+  assert.deepEqual(toGeminiSchema({ type: 'object' }), { type: 'object', properties: {} });
+});
+
+test('irToVertexBody wraps tool output with $ keys', () => {
+  const output = JSON.stringify({ $ref: '#/definitions/Pet', definitions: { Pet: { $id: 'p' } } });
+  const nested = JSON.stringify({ a: { b: [{ $schema: 'x' }] } });
+  const ir = { ...anthropicToIR({ model: 'x', messages: [
+    { role: 'user', content: 'go' },
+    { role: 'assistant', content: [{ type: 'tool_use', id: 't1', name: 'Bash', input: {} }, { type: 'tool_use', id: 't2', name: 'Bash', input: {} }, { type: 'tool_use', id: 't3', name: 'Bash', input: {} }] },
+    { role: 'user', content: [
+      { type: 'tool_result', tool_use_id: 't1', content: output },
+      { type: 'tool_result', tool_use_id: 't2', content: nested },
+      { type: 'tool_result', tool_use_id: 't3', content: '{"ok":true}' }
+    ] }
+  ] }) };
+  const responses = irToVertexBody(ir, 'gemini-2.5-pro').contents.flatMap(c => c.parts).filter(p => p.functionResponse).map(p => p.functionResponse.response);
+  assert.deepEqual(responses[0], { result: output });
+  assert.deepEqual(responses[1], { result: nested });
+  assert.deepEqual(responses[2], { ok: true });
+});
+
+test('toGeminiSchema stringifies an untyped const', () => {
+  const out = toGeminiSchema({ type: 'object', properties: { flag: { const: true }, n: { const: 3 }, s: { const: 'x' } } });
+  assert.deepEqual(out.properties.flag, { enum: ['true'], type: 'string' });
+  assert.deepEqual(out.properties.n, { enum: ['3'], type: 'string' });
+  assert.deepEqual(out.properties.s, { enum: ['x'], type: 'string' });
+});
+
+test('responsesToIR keeps long colliding tool names distinct', () => {
+  const ns = `mcp__${'server_with_a_long_name_'.repeat(3)}`;
+  const ir = responsesToIR({ model: 'x', input: [
+    { type: 'message', role: 'user', content: 'go' },
+    { type: 'function_call', call_id: 'c1', namespace: ns, name: 'list_items_with_filter_b', arguments: '{}' },
+    { type: 'function_call_output', call_id: 'c1', output: 'ok' }
+  ], tools: [{ type: 'namespace', name: ns, tools: [
+    { type: 'function', name: 'list_items_with_filter_a', parameters: { type: 'object', properties: {} } },
+    { type: 'function', name: 'list_items_with_filter_b', parameters: { type: 'object', properties: {} } }
+  ] }] });
+  const names = ir.tools.map(t => t.name);
+  assert.equal(names.length, 2);
+  assert.notEqual(names[0], names[1]);
+  assert.ok(names.every(n => n.length <= 64 && /^[A-Za-z0-9_-]+$/.test(n)), names.join());
+  assert.equal(ir.toolMeta[names[1]].name, 'list_items_with_filter_b');
+  assert.equal(ir.messages[1].toolCalls[0].name, names[1]);
+  assert.equal(responsesToIR({ model: 'x', input: 'hi', tools: [{ type: 'function', name: 'read_file', parameters: {} }] }).tools[0].name, 'read_file');
+});
+
+test('sanitizeJsonSchema drops null keywords and lookaround patterns', () => {
+  const out = sanitizeJsonSchema({ type: 'object', required: null, description: null, properties: {
+    slug: { type: 'string', pattern: '^(?!-)[a-z-]+$' },
+    tag: { type: 'string', pattern: '(?<=#)\\w+' },
+    plain: { type: 'string', pattern: '^[a-z]+$', default: null },
+    named: { type: 'string', pattern: '^(?<year>\\d{4})$' },
+    pattern: { type: 'string', enum: ['a', null], const: null }
+  } });
+  assert.equal('required' in out, false);
+  assert.equal('description' in out, false);
+  assert.equal('pattern' in out.properties.slug, false);
+  assert.equal('pattern' in out.properties.tag, false);
+  assert.equal(out.properties.plain.pattern, '^[a-z]+$');
+  assert.equal(out.properties.plain.default, null);
+  assert.equal(out.properties.named.pattern, '^(?<year>\\d{4})$');
+  assert.deepEqual(out.properties.pattern, { type: 'string', enum: ['a', null], const: null });
+  assert.deepEqual(sanitizeJsonSchema({ type: 'object', properties: {}, default: { a: null, b: {} } }).default, { a: null, b: {} });
+});
+
+test('irToVertexBody never ends on a model turn', () => {
+  const ir = anthropicToIR({ model: 'x', messages: [
+    { role: 'user', content: 'Write a haiku' },
+    { role: 'assistant', content: 'Autumn moon' }
+  ] });
+  const body = irToVertexBody(ir, 'gemini-2.5-pro');
+  assert.equal(body.contents.at(-1).role, 'user');
+  assert.ok(body.contents.some(c => c.role === 'model' && c.parts.some(p => p.text === 'Autumn moon')), 'the prefill text is kept');
+});
+
+test('healAnthropicPayload dedupes repeated tool_use ids', () => {
+  const use = (id, cmd) => ({ type: 'tool_use', id, name: 'Bash', input: { command: cmd } });
+  const result = (id, text) => ({ type: 'tool_result', tool_use_id: id, content: text });
+  const r = healAnthropicPayload({ model: 'claude', messages: [
+    { role: 'user', content: 'go' },
+    { role: 'assistant', content: [use('functions_Bash_0', 'ls')] },
+    { role: 'user', content: [result('functions_Bash_0', 'a.txt')] },
+    { role: 'assistant', content: [use('functions_Bash_0', 'pwd'), use('functions_Bash_1', 'id')] },
+    { role: 'user', content: [result('functions_Bash_0', '/'), result('functions_Bash_1', 'uid')] }
+  ] });
+  assert.equal(r.changed, true);
+  const msgs = r.payload.messages;
+  const ids = msgs.filter(m => m.role === 'assistant').flatMap(m => m.content.filter(b => b.type === 'tool_use').map(b => b.id));
+  assert.equal(new Set(ids).size, ids.length, ids.join());
+  assert.ok(ids.every(id => /^[a-zA-Z0-9_-]+$/.test(id)));
+  assert.equal(ids[0], 'functions_Bash_0');
+  // Each result still answers its own call.
+  assert.deepEqual(msgs[2].content.map(b => [b.tool_use_id, b.content]), [[ids[0], 'a.txt']]);
+  assert.deepEqual(msgs[4].content.map(b => [b.tool_use_id, b.content]), [[ids[1], '/'], [ids[2], 'uid']]);
+});

package/tests/gateway.e2e.test.mjs

@@ -11,14 +11,14 @@ import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import zlib from 'node:zlib';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { assertValidAnthropicEvents } from './helpers.mjs';
+import { assertValidAnthropicEvents, stopChild, reapDir, reapDirSync, onAbnormalExit } from './helpers.mjs';
 import { createFrameReader } from '../blindfold/wsframe.mjs';
 
 const MASKED = '__LLM_SWITCHER_KEEP_KEY__';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
-let upstream, upstreamPort, proxy, proxyPort, tmpDir, fakeInterceptor, blindfoldPort, certsDir;
+let upstream, upstreamPort, proxy, proxyPort, tmpDir, fakeInterceptor, blindfoldPort, certsDir, cancelExitReap;
 const received = []; // { url, headers, body }
 const hangState = { closed: false, slowAborted: false };
 const bigState = { finishedAt: 0 };
@@ -83,7 +83,8 @@ function startUpstream() {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         return res.end(JSON.stringify({ data: [
           { id: 'gpt-5.6-sol', context_length: 1048576, compact_window: 272000 },
-          { id: 'up-opus', context_length: 200000 }
+          { id: 'up-opus', context_length: 200000 },
+          { id: 'up-capped', context_length: 200000, max_output_tokens: 8192 }
         ] }));
       }
       if (req.url.startsWith('/intact/v1/messages')) {
@@ -95,6 +96,20 @@ function startUpstream() {
         return res.end(JSON.stringify({ id: 'c1', object: 'chat.completion', model: json.model, choices: [{ index: 0, message: { role: 'assistant', content: 'converted ok' }, finish_reason: 'stop' }], usage: { prompt_tokens: 1, completion_tokens: 1 } }));
       }
       if (req.url.startsWith('/chat/v1/chat/completions')) {
+        // A text-only model: it refuses any image part, and one that refuses for an unrelated reason.
+        const hasImage = (json.messages || []).some(m => Array.isArray(m.content) && m.content.some(p => p?.type === 'image_url'));
+        if (json.model === 'up-textonly' && hasImage) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message: 'Failed to deserialize the JSON body: messages[0]: unknown variant `image_url`, expected `text`', type: 'invalid_request_error' } }));
+        }
+        if (json.model === 'up-textonly' && lastUser.includes('RETRY_FAILS')) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message: 'try again later', type: 'invalid_request_error' } }));
+        }
+        if (json.model === 'up-badreq') {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message: 'temperature must be between 0 and 2', type: 'invalid_request_error' } }));
+        }
         if (lastUser.includes('TOOL_ALIAS_REPLAY')) {
           const reference = json.messages.find(m => m.role === 'tool');
           const name = JSON.parse(reference.content).tool_name;
@@ -112,6 +127,10 @@ function startUpstream() {
           res.writeHead(429, { 'Content-Type': 'application/json', 'retry-after': '7' });
           return res.end(JSON.stringify({ error: { message: 'slow down' } }));
         }
+        if (lastUser.includes('CONTEXT_OVERFLOW')) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          return res.end(JSON.stringify({ error: { message: "This model's maximum context length is 131072 tokens. However, you requested 140000 tokens (132000 in the messages, 8000 in the completion). Please reduce the length of the messages or completion.", type: 'invalid_request_error', code: 'invalid_request_error' } }));
+        }
         if (lastUser.includes('APPLY_PATCH')) {
           return sse(res, [
             { choices: [{ index: 0, delta: { tool_calls: [{ index: 0, id: 'call_patch', type: 'function', function: { name: 'apply_patch', arguments: '{"input":"*** Begin Patch\\n' } }] } }] },
@@ -216,6 +235,8 @@ before(async () => {
   await startUpstream();
   proxyPort = await freePort();
   tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'llm-switcher-test-'));
+  // A run that ends with no after() still stops the gateway and the interceptor it started detached.
+  cancelExitReap = onAbnormalExit(() => reapDirSync(tmpDir, [proxy?.pid, fakeInterceptor?.pid]));
 
   // R3b: both tools are active in this fixture, so every admin write runs through
   // checkBlindfoldTarget. Give the interceptor a port of its own and a certificate minted for
@@ -239,6 +260,8 @@ before(async () => {
       roles: { name: 'Mock Public Roles', mode: 'convert', inFormat: 'responses', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-roles', publicModels: ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna'], defaultModels: { main: 'ag/mock-flash', review: 'ag/mock-review', subagent: 'ag/mock-low' } },
       native: { name: 'Mock Strict OpenAI', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', thinkingMode: 'native', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-native', defaultModels: models },
       intactcc: { name: 'Mock intact', mode: 'convert', tool: 'claude', outFormat: 'openai-chat', thinkingMode: 'off', baseURL: `${base}/intact/v1`, apiKey: 'sk-intact-user', defaultModels: { opus: 'claude/claude-opus-5', sonnet: 'gem/flash', haiku: 'claude/claude-haiku-4-5', fable: 'gem/flash' } },
+      textonly: { name: 'Mock Text Only', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-textonly', defaultModels: { opus: 'up-textonly', sonnet: 'up-badreq', haiku: 'up-haiku', fable: 'up-fable' } },
+      capped: { name: 'Mock Capped Output', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-capped', defaultModels: { opus: 'up-capped', sonnet: 'up-sonnet', haiku: 'up-haiku', fable: 'up-fable' } },
       ant: { name: 'Mock Anthropic', mode: 'direct', inFormat: 'auto', outFormat: 'anthropic', baseURL: `${base}/ant`, apiKey: 'sk-secret-ant', defaultModels: models }
     }
   };
@@ -298,9 +321,11 @@ before(async () => {
   }
 });
 
-after(() => {
-  fakeInterceptor?.kill();
-  proxy?.kill();
+after(async () => {
+  cancelExitReap?.();
+  // The gateway first: once it is gone it can start no interceptor.
+  await stopChild(proxy);
+  await stopChild(fakeInterceptor);
   upstream?.close();
   // A test that changes the tool set makes the gateway start a real interceptor. It is detached on
   // purpose, so it outlives the gateway; stop the one the gateway recorded before its state goes.
@@ -308,7 +333,8 @@ after(() => {
     const { pid } = JSON.parse(fs.readFileSync(path.join(tmpDir, 'blindfold.json'), 'utf8'));
     if (Number.isInteger(pid) && pid !== fakeInterceptor?.pid) process.kill(pid);
   } catch {}
-  if (tmpDir) fs.rmSync(tmpDir, { recursive: true, force: true });
+  // One it had not recorded yet still names the dir on its command line.
+  if (tmpDir) await reapDir(tmpDir);
 });
 
 const url = (p) => `http://127.0.0.1:${proxyPort}${p}`;
@@ -407,7 +433,7 @@ test('Codex via ag/* target: Gemini-hostile tool schemas are rewritten before up
   const params = up.body.tools[0].function.parameters;
   assert.deepEqual(params.properties.ids, { type: 'array', items: { type: 'string' }, nullable: true });
   assert.deepEqual(params.properties.part, { type: 'object', properties: { t: { type: 'string' } } });
-  assert.deepEqual(params.properties.raw, { type: 'object', properties: {} });
+  assert.deepEqual(params.properties.raw, { type: 'object', properties: { _placeholder: { type: 'boolean', description: 'Unused. Leave unset.' } } });
   assert.deepEqual(params.required, ['ids']);
   assert.ok(!JSON.stringify(params).includes('$ref'), 'no $ref survives');
   assert.equal(params.$defs, undefined);
@@ -586,6 +612,57 @@ test('A8: /v1/chat/completions and /chat/completions answer 404 on the gateway',
   assert.equal(received.length, before, 'a removed route never reaches an upstream');
 });
 
+// The profile's own list names the output limit, so a max_tokens above it is clamped instead of refused.
+test('max_tokens above the listed output limit is clamped; a model with no listed limit keeps it', async () => {
+  const listed = await fetch(url('/v1/models'), { headers: { 'x-llm-profile': 'capped' } });
+  assert.equal(listed.status, 200);
+  await listed.text();
+  const res = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 64000, messages: [{ role: 'user', content: 'hi' }] }, { 'x-llm-profile': 'capped' });
+  assert.equal(res.status, 200);
+  await res.text();
+  assert.equal(received.at(-1).body.model, 'up-capped');
+  assert.equal(received.at(-1).body.max_tokens, 8192);
+  const free = await post('/v1/messages', { model: 'claude-sonnet-4-6', max_tokens: 64000, messages: [{ role: 'user', content: 'hi' }] }, { 'x-llm-profile': 'capped' });
+  await free.text();
+  assert.equal(received.at(-1).body.model, 'up-sonnet');
+  assert.equal(received.at(-1).body.max_tokens, 64000);
+});
+
+// A text-only model refuses an image that stays in the history, so every later turn would fail too.
+test('An image refused by a text-only chat model is retried once as text in each request', async () => {
+  const image = { type: 'image', source: { type: 'base64', media_type: 'image/png', data: 'iVBORw0KGgo=' } };
+  const calls = model => received.filter(r => r.url.startsWith('/chat/v1/chat/completions') && r.body.model === model).length;
+  const sentImage = r => r.body.messages.some(m => Array.isArray(m.content) && m.content.some(p => p?.type === 'image_url'));
+  const first = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 100, messages: [{ role: 'user', content: [image, { type: 'text', text: 'what is this' }] }] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(first.status, 200);
+  assert.equal((await first.json()).type, 'message');
+  assert.equal(calls('up-textonly'), 2, 'one refusal, one retry');
+  assert.equal(sentImage(received.at(-1)), false);
+  assert.ok(JSON.stringify(received.at(-1).body).includes('[image omitted: this model does not accept images]'));
+
+  const second = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 100, stream: true, messages: [
+    { role: 'user', content: [image, { type: 'text', text: 'what is this' }] },
+    { role: 'assistant', content: 'an image' },
+    { role: 'user', content: 'and now?' }
+  ] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(second.status, 200);
+  await second.text();
+  assert.equal(calls('up-textonly'), 4, 'nothing is remembered: one refusal, one retry again');
+  assert.equal(sentImage(received.at(-2)), true);
+  assert.equal(sentImage(received.at(-1)), false);
+
+  const failed = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 100, messages: [{ role: 'user', content: [image, { type: 'text', text: 'RETRY_FAILS' }] }] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(failed.status, 400);
+  assert.match((await failed.json()).error.message, /try again later/, 'the client gets the error of the retry, not the first refusal');
+  assert.equal(calls('up-textonly'), 6);
+
+  const other = await post('/v1/messages', { model: 'claude-sonnet-4-6', max_tokens: 100, messages: [{ role: 'user', content: [image, { type: 'text', text: 'hi' }] }] }, { 'x-llm-profile': 'textonly' });
+  assert.equal(other.status, 400);
+  assert.match((await other.json()).error.message, /temperature must be between 0 and 2/);
+  assert.equal(calls('up-badreq'), 1, 'an unrelated 400 is relayed, never retried');
+  assert.equal(sentImage(received.at(-1)), true);
+});
+
 test('Upstream 429 is returned in Anthropic error shape with retry-after', async () => {
   const res = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 10, messages: [{ role: 'user', content: 'RATE_LIMIT' }] });
   assert.equal(res.status, 429);
@@ -594,6 +671,20 @@ test('Upstream 429 is returned in Anthropic error shape with retry-after', async
   assert.deepEqual(json, { type: 'error', error: { type: 'rate_limit_error', message: 'slow down' } });
 });
 
+// Claude Code compacts only on "prompt is too long", and Codex only on context_length_exceeded.
+test('sendClientError maps context overflow per client', async () => {
+  const cc = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 10, messages: [{ role: 'user', content: 'CONTEXT_OVERFLOW' }] });
+  assert.equal(cc.status, 400);
+  const ccJson = await cc.json();
+  assert.equal(ccJson.error.type, 'invalid_request_error');
+  assert.match(ccJson.error.message, /^prompt is too long: 140000 tokens > 131072 maximum/);
+  const codex = await post('/v1/responses', { model: 'gpt-5-codex', input: 'CONTEXT_OVERFLOW' });
+  assert.equal(codex.status, 400);
+  const codexJson = await codex.json();
+  assert.equal(codexJson.error.code, 'context_length_exceeded');
+  assert.match(codexJson.error.message, /maximum context length is 131072/);
+});
+
 test('Mid-stream upstream error surfaces as an error event instead of a fake end_turn', async () => {
   const res = await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 10, stream: true, messages: [{ role: 'user', content: 'MID_STREAM_ERROR' }] });
   const events = parseSSE(await res.text());

package/tests/helpers.mjs

@@ -1,4 +1,64 @@
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+const sleep = (ms) => new Promise(r => setTimeout(r, ms));
+
+// The pids of every process whose command line names `dir`, this one excluded. A gateway records
+// its detached interceptor only once it answers, so a teardown that trusts the record misses one
+// still starting. POSIX only: on Windows it returns [].
+export function pidsNaming(dir) {
+  if (process.platform === 'win32' || !dir) return [];
+  const r = spawnSync('ps', ['-eo', 'pid=,args='], { encoding: 'utf8' });
+  if (r.status !== 0) return [];
+  return r.stdout.split('\n')
+    .map(line => line.trim().match(/^(\d+)\s+(.*)$/))
+    .filter(m => m && m[2].includes(dir) && Number(m[1]) !== process.pid)
+    .map(m => Number(m[1]));
+}
+
+// Stops a child and waits for its exit, so nothing it does later lands in a removed directory.
+export async function stopChild(child, ms = 3000) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  const exited = new Promise(r => child.once('exit', r));
+  child.kill('SIGTERM');
+  if (await Promise.race([exited.then(() => true), sleep(ms).then(() => false)])) return;
+  child.kill('SIGKILL');
+  await Promise.race([exited, sleep(ms)]);
+}
+
+// Stops every process that still names `dir` (SIGTERM, then SIGKILL), then removes the dir.
+export async function reapDir(dir) {
+  for (let i = 0; i < 30; i++) {
+    const left = pidsNaming(dir);
+    if (!left.length) break;
+    for (const pid of left) try { process.kill(pid, i < 20 ? 'SIGTERM' : 'SIGKILL'); } catch { /* gone */ }
+    await sleep(100);
+  }
+  fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
+}
+
+// The same, synchronous, for a process that is about to end. A negative pid is a process group.
+export function reapDirSync(dir, pids = []) {
+  for (const pid of [...pids.filter(Number.isInteger), ...pidsNaming(dir)]) try { process.kill(pid, 'SIGKILL'); } catch { /* gone */ }
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* best effort at exit */ }
+}
+
+// Runs `fn` when this process ends before its teardown did: at exit, or on a signal, which ends a
+// test process with no after() hook. Returns the function that cancels it.
+export function onAbnormalExit(fn) {
+  const SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+  const run = () => { off(); try { fn(); } catch { /* best effort at exit */ } };
+  // The listener replaces the default action, so the signal is raised again once it is gone.
+  const onSignal = (sig) => { run(); process.kill(process.pid, sig); };
+  function off() {
+    process.off('exit', run);
+    for (const sig of SIGNALS) process.off(sig, onSignal);
+  }
+  process.once('exit', run);
+  for (const sig of SIGNALS) process.on(sig, onSignal);
+  return off;
+}
 
 // Validate an Anthropic event sequence: indexes increase in start order, deltas only target an open block.
 export function assertValidAnthropicEvents(events) {

package/tests/teardown.test.mjs

@@ -0,0 +1,84 @@
+// The browser tests start a gateway, a stand-in interceptor and a Chromium, and the gateway can
+// start a real interceptor of its own, detached. Whatever ends the run, none of them and none of
+// their temp dirs may outlive it. Each case runs in a child process with a private TMPDIR, so
+// "nothing left" is a check on that one directory.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { skipReason } from './cdp.mjs';
+import { pidsNaming } from './helpers.mjs';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const url = (f) => JSON.stringify(pathToFileURL(path.join(HERE, f)).href);
+const sleep = (ms) => new Promise(r => setTimeout(r, ms));
+const skip = process.platform === 'win32' ? 'lists processes with ps' : skipReason();
+
+// Starts the fixture and a browser, then moves the interceptor to a new port so the gateway starts
+// a real one. `awaitStart` false: the script does not wait for the gateway to record it.
+const PRELUDE = (awaitStart) => `
+  import { startDashboardFixture } from ${url('dashboard-fixture.mjs')};
+  import { launchBrowser } from ${url('cdp.mjs')};
+  import { pidsNaming } from ${url('helpers.mjs')};
+  import net from 'node:net';
+  const free = () => new Promise(r => { const s = net.createServer().listen(0, '127.0.0.1', () => { const { port } = s.address(); s.close(() => r(port)); }); });
+  const fx = await startDashboardFixture();
+  const browser = await launchBrowser();
+  await browser.newPage();
+  const cfg = fx.config();
+  cfg.blindfold.port = await free();
+  fx.writeConfig(cfg);
+  const sync = fx.api('/api/blindfold/sync', {});
+  ${awaitStart ? `const r = await sync; if (r.status !== 200) throw new Error('no interceptor: ' + JSON.stringify(r.json));` : 'sync.catch(() => {});'}
+  for (let i = 0; i < 200 && !pidsNaming(fx.dir).length; i++) await new Promise(r => setTimeout(r, 25));
+  if (!pidsNaming(fx.dir).length) throw new Error('the gateway started no interceptor');
+`;
+
+async function inPrivateTmp(t, script, act) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lsw-teardown-'));
+  t.after(() => {
+    // A red run must not leave what it found behind.
+    for (const pid of pidsNaming(tmp)) try { process.kill(pid, 'SIGKILL'); } catch { /* gone */ }
+    fs.rmSync(tmp, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
+  });
+  const child = spawn(process.execPath, ['--input-type=module', '-e', script], {
+    env: { ...process.env, TMPDIR: tmp, TMP: tmp, TEMP: tmp }, stdio: ['ignore', 'pipe', 'pipe']
+  });
+  let out = '';
+  child.stdout.on('data', d => { out += d; });
+  child.stderr.on('data', d => { out += d; });
+  const exited = new Promise(r => child.once('exit', r));
+  await act(child, () => out);
+  await Promise.race([exited, sleep(30000)]);
+  // A detached process may take a moment to die after the signal.
+  let left = pidsNaming(tmp);
+  for (let i = 0; i < 50 && left.length; i++) { await sleep(100); left = pidsNaming(tmp); }
+  return { left, files: fs.readdirSync(tmp), out: () => out };
+}
+
+test('stop() and close() remove an interceptor the gateway had not recorded yet, and every temp dir', { skip, timeout: 90000 }, async (t) => {
+  const r = await inPrivateTmp(t, `${PRELUDE(false)}
+    await fx.stop();
+    await browser.close();
+    console.log('DONE');
+  `, async () => {});
+  assert.match(r.out(), /DONE/, r.out());
+  assert.deepEqual(r.left, [], 'no process names the temp dir');
+  assert.deepEqual(r.files, [], 'no temp dir is left');
+});
+
+test('a test process stopped by SIGTERM still stops its gateway, interceptor and browser', { skip, timeout: 90000 }, async (t) => {
+  const r = await inPrivateTmp(t, `${PRELUDE(true)}
+    console.log('READY');
+    setInterval(() => {}, 1000);
+  `, async (child, out) => {
+    for (let i = 0; i < 600 && !/READY/.test(out()) && child.exitCode === null; i++) await sleep(100);
+    assert.match(out(), /READY/, out());
+    child.kill('SIGTERM');
+  });
+  assert.deepEqual(r.left, [], 'no process names the temp dir');
+  assert.deepEqual(r.files, [], 'no temp dir is left');
+});

package/tests/windows.test.mjs

@@ -20,11 +20,22 @@ test('a list entry gives the whole window and the window to compress at', () =>
   assert.deepEqual(parseModelWindows({ id: 'groq/q', context_window: 131072 }), { context: 131072, compact: 0 },
     'one window is the whole window, not a threshold');
   assert.deepEqual(parseModelWindows({ id: 'or/r', context_length: 262144, top_provider: { context_length: 262144, max_completion_tokens: 32768 } }),
-    { context: 262144, compact: 0 });
+    { context: 262144, compact: 0, output: 32768 });
   assert.deepEqual(parseModelWindows({ id: 'bare' }), null, 'a model with no limits says nothing');
   assert.deepEqual(parseModelWindows({ id: 'zero', context_length: 0, compact_window: 0 }), null);
 });
 
+// The output limit lets the gateway clamp a max_tokens the model would refuse.
+test('a list entry keeps the output limit it names, and leaves it out when it names none', () => {
+  assert.deepEqual(parseModelWindows({ id: 'i/m', context_length: 200000, max_output_tokens: 8192 }),
+    { context: 200000, compact: 0, output: 8192 });
+  assert.deepEqual(parseModelWindows({ id: 'only-out', max_output_tokens: 4096 }), { context: 0, compact: 0, output: 4096 },
+    'an output limit alone is still worth keeping');
+  assert.equal('output' in parseModelWindows({ id: 'g', context_length: 131072 }), false);
+  assert.deepEqual(parseModelList({ data: [{ id: 'i/m', context_length: 200000, max_output_tokens: 8192 }] }),
+    { 'i/m': { context: 200000, compact: 0, output: 8192 } });
+});
+
 test('parseModelList keys the windows by the id a profile maps, and drops the nameless', () => {
   const out = parseModelList({ data: [{ id: 'models/big', context_length: 1048576 }, { id: 'bare' }, 'plain'] });
   assert.deepEqual(Object.keys(out), ['big'], 'a bare string carries no window, and a models/ prefix is dropped');
@@ -90,6 +101,25 @@ test('windows are cached for an hour, and a failed refresh keeps the stale answe
   }
 });
 
+test('the cache persists the output limit, and an old cache file without it still reads', async () => {
+  const dir = tmpDir();
+  const sink = http.createServer((req, res) => {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ data: [{ id: 'm', context_length: 200000, max_output_tokens: 8192 }] }));
+  });
+  await new Promise(r => sink.listen(0, '127.0.0.1', r));
+  const base = `http://127.0.0.1:${sink.address().port}/v1`;
+  try {
+    await resolveProfileWindows(dir, 'p@' + base, base, 'k', { now: 1_000 });
+    assert.equal(readWindowsCache(dir)['p@' + base].models.m.output, 8192);
+    fs.writeFileSync(path.join(dir, 'model-windows.json'), JSON.stringify({ old: { at: 1_000, baseURL: base, models: { m: { context: 200000, compact: 0 } } } }));
+    assert.deepEqual(await resolveProfileWindows(dir, 'old', base, 'k', { now: 2_000 }), { m: { context: 200000, compact: 0 } });
+  } finally {
+    sink.close();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test('an empty cache file reads as no windows instead of throwing', () => {
   const dir = tmpDir();
   try {