zengate 1.0.0

package/src/openai/responses-request.js

@@ -0,0 +1,176 @@
+import { invalidRequest, unsupported } from '../server/errors.js';
+import { parseResponseFormat, parseToolChoice } from './chat-request.js';
+import { audioFromBase64, fileAttachment, imageFromUrl, videoFromUrl } from './media.js';
+
+const IGNORED = new Set([
+    'temperature', 'top_p', 'max_output_tokens', 'max_tool_calls', 'top_logprobs', 'truncation', 'include',
+    'user', 'safety_identifier', 'prompt_cache_key', 'prompt_cache_retention', 'service_tier', 'stream_options',
+]);
+const HANDLED = new Set([
+    'model', 'input', 'instructions', 'stream', 'tools', 'tool_choice', 'parallel_tool_calls', 'text',
+    'reasoning', 'store', 'previous_response_id', 'metadata', 'background', 'conversation', 'prompt',
+]);
+const isObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+function parseTools(tools, ignored) {
+    if (tools === undefined || tools === null) return [];
+    if (!Array.isArray(tools)) throw invalidRequest('tools must be an array.', 'tools');
+    const parsed = [];
+    tools.forEach((tool, index) => {
+        if (tool?.type === 'function' || tool?.type === 'custom') {
+            if (typeof tool.name !== 'string' || !/^[\w.-]{1,128}$/.test(tool.name)) {
+                throw invalidRequest('Tool names must be letters, digits, _ . or -.', `tools[${index}].name`);
+            }
+            parsed.push({
+                name: tool.name,
+                description: typeof tool.description === 'string' ? tool.description : '',
+                parameters: tool.type === 'function' ? tool.parameters : undefined,
+                kind: tool.type,
+            });
+        } else {
+            ignored.add(`tools.${tool?.type || 'unknown'}`);
+        }
+    });
+    return parsed;
+}
+
+function parseContent(content, param, media, role) {
+    if (typeof content === 'string') return { text: content, media: [] };
+    if (!Array.isArray(content)) throw invalidRequest('content must be a string or an array of parts.', param);
+    const texts = [];
+    const attachments = [];
+    content.forEach((part, index) => {
+        const where = `${param}[${index}]`;
+        const options = { ...media, param: where };
+        switch (part?.type) {
+            case 'input_text': case 'output_text': case 'text': case 'summary_text':
+                texts.push(String(part.text ?? '')); break;
+            case 'refusal': texts.push(String(part.refusal ?? '')); break;
+            case 'input_image':
+                if (part.file_id) throw unsupported('input_image.file_id requires the Files API; send image_url instead.', where);
+                attachments.push(imageFromUrl(part.image_url, options)); break;
+            case 'input_file': attachments.push(fileAttachment(part, options)); break;
+            case 'input_audio': attachments.push(audioFromBase64(part.input_audio?.data ?? part.data, part.input_audio?.format ?? part.format, options)); break;
+            case 'input_video': attachments.push(videoFromUrl(part.video_url?.url ?? part.video_url ?? part.url, options)); break;
+            default: throw unsupported(`Unsupported content part type '${part?.type}'.`, where);
+        }
+    });
+    if (role !== 'user' && attachments.length) throw invalidRequest('Only user messages may carry attachments.', param);
+    for (const file of attachments.filter((a) => a.kind === 'text')) texts.push(`\n<file name="${file.filename || 'attachment'}">\n${file.text}\n</file>\n`);
+    return { text: texts.join(''), media: attachments.filter((a) => a.kind !== 'text') };
+}
+
+function outputText(output) {
+    if (typeof output === 'string') return output;
+    if (Array.isArray(output)) return output.map((part) => part?.text ?? '').join('');
+    return JSON.stringify(output ?? '');
+}
+
+/** Convert Responses input items into canonical messages. */
+export function parseInputItems(input, media, resolveItem) {
+    const items = typeof input === 'string' ? [{ type: 'message', role: 'user', content: input }] : input;
+    if (!Array.isArray(items)) throw invalidRequest('input must be a string or an array of items.', 'input');
+    const messages = [];
+    const pushAssistantCall = (call) => {
+        const last = messages[messages.length - 1];
+        if (last?.role === 'assistant' && !last.content) last.toolCalls.push(call);
+        else messages.push({ role: 'assistant', content: '', media: [], toolCalls: [call] });
+    };
+    items.forEach((raw, index) => {
+        const param = `input[${index}]`;
+        const item = raw?.type === 'item_reference' ? resolveItem(raw.id, param) : raw;
+        const type = item?.type ?? (item?.role ? 'message' : undefined);
+        switch (type) {
+            case 'message': {
+                const role = item.role === 'developer' ? 'system' : item.role;
+                if (!['system', 'user', 'assistant'].includes(role)) throw invalidRequest('role must be user, assistant, system or developer.', `${param}.role`);
+                const { text, media: attachments } = parseContent(item.content, `${param}.content`, media, role);
+                messages.push({ role, content: text, media: attachments, ...(role === 'assistant' ? { toolCalls: [] } : {}) });
+                break;
+            }
+            case 'function_call':
+            case 'custom_tool_call':
+                if (typeof item.name !== 'string' || typeof item.call_id !== 'string') throw invalidRequest(`${type} needs name and call_id.`, param);
+                pushAssistantCall({
+                    id: item.call_id,
+                    name: item.name,
+                    arguments: type === 'custom_tool_call' ? JSON.stringify({ input: String(item.input ?? '') }) : String(item.arguments || '{}'),
+                });
+                break;
+            case 'function_call_output':
+            case 'custom_tool_call_output':
+                if (typeof item.call_id !== 'string') throw invalidRequest(`${type} needs call_id.`, param);
+                messages.push({ role: 'tool', content: outputText(item.output), media: [], toolCallId: item.call_id });
+                break;
+            case 'reasoning':
+                break;
+            default:
+                throw unsupported(`Unsupported input item type '${type}'.`, param);
+        }
+    });
+    return messages;
+}
+
+/**
+ * Validate a Responses API request into canonical form (+ Responses extras).
+ * @param {unknown} body
+ * @param {{ maxBytes: number }} media
+ * @param {{ history: (id: string) => object[]|null, item: (id: string) => object|null }} store
+ */
+export function parseResponsesRequest(body, media, store) {
+    if (!isObject(body)) throw invalidRequest('Request body must be a JSON object.');
+    if (typeof body.model !== 'string' || !body.model.trim()) throw invalidRequest('model is required (see GET /v1/models).', 'model');
+    if (body.input === undefined) throw invalidRequest('input is required.', 'input');
+    if (body.background === true) throw unsupported('background responses are not supported; stream instead.', 'background');
+    if (body.conversation) throw unsupported('The Conversations API is not supported; use previous_response_id.', 'conversation');
+    if (body.prompt) throw unsupported('Stored prompt templates are not supported.', 'prompt');
+    if (body.instructions !== undefined && body.instructions !== null && typeof body.instructions !== 'string') {
+        throw invalidRequest('instructions must be a string.', 'instructions');
+    }
+    const ignored = new Set(Object.keys(body).filter((key) => IGNORED.has(key) || !HANDLED.has(key)));
+    const tools = parseTools(body.tools, ignored);
+    let history = [];
+    if (body.previous_response_id) {
+        history = store.history(body.previous_response_id);
+        if (!history) throw invalidRequest(`Previous response '${body.previous_response_id}' was not found (it may have expired or been stored with store=false).`, 'previous_response_id', 'previous_response_not_found');
+    }
+    const resolveItem = (id, param) => {
+        const item = store.item(id);
+        if (!item) throw invalidRequest(`Item '${id}' was not found.`, param);
+        return item;
+    };
+    const input = parseInputItems(body.input, media, resolveItem);
+    const system = body.instructions ? [{ role: 'system', content: body.instructions, media: [] }] : [];
+    return {
+        model: body.model.trim(),
+        messages: [...system, ...history, ...input],
+        inputMessages: input,
+        history,
+        tools,
+        toolChoice: parseToolChoice(body.tool_choice, tools),
+        parallelToolCalls: body.parallel_tool_calls !== false,
+        format: parseResponseFormat(body.text?.format, 'text.format'),
+        reasoningEffort: typeof body.reasoning?.effort === 'string' ? body.reasoning.effort : null,
+        stop: [],
+        n: 1,
+        stream: body.stream === true,
+        store: body.store !== false,
+        echo: {
+            instructions: body.instructions ?? null,
+            metadata: isObject(body.metadata) ? body.metadata : {},
+            previous_response_id: body.previous_response_id ?? null,
+            parallel_tool_calls: body.parallel_tool_calls !== false,
+            tool_choice: body.tool_choice ?? 'auto',
+            tools: Array.isArray(body.tools) ? body.tools : [],
+            text: body.text?.format ? { format: body.text.format } : { format: { type: 'text' } },
+            reasoning: { effort: body.reasoning?.effort ?? null, summary: body.reasoning?.summary ?? null },
+            temperature: body.temperature ?? null,
+            top_p: body.top_p ?? null,
+            max_output_tokens: body.max_output_tokens ?? null,
+            user: body.user ?? null,
+            store: body.store !== false,
+            truncation: body.truncation ?? 'disabled',
+        },
+        ignored: [...ignored],
+    };
+}

package/src/openai/responses-store.js

@@ -0,0 +1,78 @@
+const TTL_MS = 60 * 60 * 1000;
+const MAX_ENTRY_CHARS = 4 * 1024 * 1024;
+
+/**
+ * In-memory store behind previous_response_id and GET/DELETE
+ * /v1/responses/{id}. Bounded (LRU + 1h TTL) and never persisted: a gateway
+ * restart forgets stored responses, which clients see as "not found".
+ * @param {{ maxEntries: number }} options
+ */
+export function createResponsesStore({ maxEntries }) {
+    const entries = new Map();
+    const items = new Map();
+
+    const expired = (entry) => Date.now() - entry.at > TTL_MS;
+
+    function evict(id) {
+        const entry = entries.get(id);
+        if (!entry) return;
+        for (const itemId of entry.itemIds) items.delete(itemId);
+        entries.delete(id);
+    }
+
+    function get(id) {
+        const entry = entries.get(id);
+        if (!entry) return null;
+        if (expired(entry)) {
+            evict(id);
+            return null;
+        }
+        entries.delete(id);
+        entries.set(id, entry);
+        return entry;
+    }
+
+    const owned = (id, owner) => {
+        const entry = get(id);
+        return entry && entry.owner === owner ? entry : null;
+    };
+
+    /**
+     * A view limited to one client (API key): other keys' responses are
+     * invisible, as if they did not exist.
+     * @param {string} owner opaque client id
+     */
+    function scope(owner) {
+        return Object.freeze({
+            /**
+             * @param {object} response public Response object
+             * @param {object[]} history canonical messages up to and including this turn
+             */
+            save(response, history) {
+                if (maxEntries <= 0) return;
+                if (JSON.stringify(history).length > MAX_ENTRY_CHARS) return;
+                const itemIds = response.output.map((item) => item.id);
+                for (const item of response.output) items.set(item.id, { item, responseId: response.id });
+                entries.set(response.id, { response, history, itemIds, owner, at: Date.now() });
+                while (entries.size > maxEntries) evict(entries.keys().next().value);
+            },
+            response: (id) => owned(id, owner)?.response ?? null,
+            history: (id) => owned(id, owner)?.history ?? null,
+            item(id) {
+                const found = items.get(id);
+                return found && owned(found.responseId, owner) ? found.item : null;
+            },
+            delete(id) {
+                if (!owned(id, owner)) return false;
+                evict(id);
+                return true;
+            },
+        });
+    }
+
+    return Object.freeze({
+        enabled: maxEntries > 0,
+        scope,
+        size: () => entries.size,
+    });
+}

package/src/openai/responses.js

@@ -0,0 +1,65 @@
+import { ApiError } from '../server/errors.js';
+import { generate } from './generate.js';
+import { buildPrompt } from './prompt.js';
+import { createResponseBuilder } from './response-builder.js';
+import { parseResponsesRequest } from './responses-request.js';
+import { openSse } from './sse-writer.js';
+import { assertPublicUrls } from './url-guard.js';
+
+function assistantHistory(result) {
+    return { role: 'assistant', content: result.content, media: [], toolCalls: result.toolCalls.map(({ id, name, arguments: args }) => ({ id, name, arguments: args })) };
+}
+
+/**
+ * POST /v1/responses, GET /v1/responses/:id, DELETE /v1/responses/:id
+ * @param {{ runner: object, catalog: object, store: object, limits: { maxBytes: number } }} deps
+ */
+export function responsesHandlers({ runner, catalog, store, limits }) {
+    const create = async (req, res) => {
+        const scoped = store.scope(req.clientId);
+        const request = parseResponsesRequest(req.body, limits, scoped);
+        const model = await catalog.resolve(request.model);
+        const prompt = buildPrompt(request, model);
+        await assertPublicUrls(prompt.parts);
+        if (request.ignored.length) res.set('x-gateway-ignored-params', request.ignored.join(','));
+
+        await req.withSlot(async (signal) => {
+            const sse = request.stream ? openSse(res) : null;
+            const builder = createResponseBuilder({
+                model: model.id,
+                echo: request.echo,
+                emit: sse ? (event) => sse.send(event, event.type) : undefined,
+            });
+            builder.start();
+            try {
+                const result = await generate({
+                    runner, prompt, request, signal,
+                    onText: (text) => builder.textDelta(text),
+                    onReasoning: (text) => builder.reasoningDelta(text),
+                });
+                const response = builder.finish(result);
+                if (request.store) scoped.save(response, [...request.history, ...request.inputMessages, assistantHistory(result)]);
+                if (!sse) res.json(response);
+            } catch (error) {
+                if (!sse) throw error;
+                const apiError = builder.fail(error);
+                req.log.warn('Responses stream failed', { status: apiError.status, code: apiError.code, error: apiError.message });
+            } finally {
+                sse?.end();
+            }
+        });
+    };
+
+    const retrieve = (req, res) => {
+        const response = store.scope(req.clientId).response(req.params.id);
+        if (!response) throw new ApiError(404, `No response with id '${req.params.id}' (responses are kept in memory for one hour).`, { code: 'not_found' });
+        res.json(response);
+    };
+
+    const remove = (req, res) => {
+        if (!store.scope(req.clientId).delete(req.params.id)) throw new ApiError(404, `No response with id '${req.params.id}'.`, { code: 'not_found' });
+        res.json({ id: req.params.id, object: 'response', deleted: true });
+    };
+
+    return { create, retrieve, remove };
+}

package/src/openai/sse-writer.js

@@ -0,0 +1,37 @@
+const HEARTBEAT_MS = 15000;
+
+/**
+ * Server-sent events response helper: flushes headers immediately, disables
+ * Nagle for low token latency and sends comment heartbeats so idle proxies
+ * don't cut long generations.
+ */
+export function openSse(res) {
+    res.status(200);
+    res.set({
+        'Content-Type': 'text/event-stream; charset=utf-8',
+        'Cache-Control': 'no-cache, no-transform',
+        Connection: 'keep-alive',
+        'X-Accel-Buffering': 'no',
+    });
+    res.flushHeaders();
+    res.socket?.setNoDelay(true);
+    const heartbeat = setInterval(() => write(': keep-alive\n\n'), HEARTBEAT_MS);
+    heartbeat.unref();
+
+    function write(text) {
+        if (res.writableEnded || res.destroyed) return;
+        res.write(text);
+    }
+
+    return {
+        /** Send one JSON event; `event` adds an SSE event name (Responses API). */
+        send(data, event) {
+            write(`${event ? `event: ${event}\n` : ''}data: ${JSON.stringify(data)}\n\n`);
+        },
+        raw: write,
+        end() {
+            clearInterval(heartbeat);
+            if (!res.writableEnded) res.end();
+        },
+    };
+}

package/src/openai/stop.js

@@ -0,0 +1,41 @@
+/**
+ * Applies OpenAI `stop` sequences to streamed text. Text that could be the
+ * beginning of a stop sequence is held back until it is safe to release.
+ * @param {string[]} stops
+ */
+export function createStopFilter(stops) {
+    const sequences = stops.filter(Boolean);
+    const hold = sequences.reduce((max, s) => Math.max(max, s.length - 1), 0);
+    let pending = '';
+    let stopped = false;
+
+    return {
+        get stopped() { return stopped; },
+        /** @returns {string} text that can be emitted now */
+        push(text) {
+            if (stopped || !text) return '';
+            if (!sequences.length) return text;
+            pending += text;
+            let cut = -1;
+            for (const sequence of sequences) {
+                const index = pending.indexOf(sequence);
+                if (index >= 0 && (cut < 0 || index < cut)) cut = index;
+            }
+            if (cut >= 0) {
+                stopped = true;
+                const out = pending.slice(0, cut);
+                pending = '';
+                return out;
+            }
+            const safe = Math.max(0, pending.length - hold);
+            const out = pending.slice(0, safe);
+            pending = pending.slice(safe);
+            return out;
+        },
+        flush() {
+            const out = stopped ? '' : pending;
+            pending = '';
+            return out;
+        },
+    };
+}

package/src/openai/tool-calls.js

@@ -0,0 +1,187 @@
+import crypto from 'node:crypto';
+
+/**
+ * OpenAI function calling, emulated over a plain-text protocol.
+ *
+ * OpenCode sessions only expose OpenCode's own tools (which this gateway
+ * rejects), so client-defined functions are described in the system prompt
+ * and the model answers with <tool_call>{json}</tool_call> blocks. The parser
+ * turns those back into standard tool_calls; everything else stays content.
+ * Models trained on other conventions sometimes write <function_calls> or
+ * <tool_calls> instead, so those spellings are accepted too.
+ */
+const OPEN = '<tool_call>';
+const CLOSE = '</tool_call>';
+const TAGS = ['tool_call', 'tool_calls', 'function_call', 'function_calls'];
+const OPENERS = [...TAGS.map((tag) => `<${tag}>`), '<function='];
+// Group 1: wrapper tag name; group 2: function name in the <function=name> form.
+const OPEN_RE = /<(tool_calls?|function_calls?)>|<function=([\w.-]{1,128})>/;
+const NAMED_TAIL_RE = /^<function=[\w.-]{0,128}$/;
+const MAX_HELD = 150;
+
+export const newCallId = () => `call_${crypto.randomBytes(12).toString('hex')}`;
+
+/**
+ * @param {{ name: string, description?: string, parameters?: object, kind?: 'function'|'custom' }[]} tools
+ * @param {'auto'|'none'|'required'|{ name: string }} choice
+ * @param {boolean} parallel
+ */
+export function toolInstructions(tools, choice, parallel) {
+    if (!tools.length || choice === 'none') return '';
+    const lines = [
+        '# Client functions',
+        'The user\'s application provides the functions listed below. They are NOT native tools: invoking them as a tool fails.',
+        'The only way to call one is to write this text block in your reply, with the arguments as a JSON object:',
+        `${OPEN}{"name": "<function name>", "arguments": {<arguments>}}${CLOSE}`,
+        parallel
+            ? 'Write one block per call; several blocks call several functions at once. Write nothing after the last block.'
+            : 'Call at most one function per reply. Write nothing after the block.',
+        'The application runs the function and sends the result back as a <tool_result> entry. When no call is needed, reply normally without any block.',
+    ];
+    if (choice === 'required') lines.push('You must call at least one of these functions in this reply by writing a block.');
+    if (choice && typeof choice === 'object') lines.push(`You must call the function "${choice.name}" in this reply by writing a block.`);
+    lines.push('', 'Functions:');
+    for (const tool of tools) {
+        lines.push(`- ${tool.name}${tool.description ? `: ${tool.description}` : ''}`);
+        if (tool.kind === 'custom') lines.push('  arguments: {"input": "<free-form text input>"}');
+        else lines.push(`  arguments JSON Schema: ${JSON.stringify(tool.parameters || { type: 'object', properties: {} })}`);
+    }
+    return lines.join('\n');
+}
+
+/** Render a past call in the same syntax, so history teaches the protocol. */
+export function renderToolCall(call) {
+    let args = call.arguments;
+    try { args = JSON.parse(call.arguments); } catch { /* keep raw string */ }
+    return `${OPEN}${JSON.stringify({ name: call.name, arguments: args })}${CLOSE}`;
+}
+
+/** Length of a trailing fragment that could still grow into an opening tag. */
+function heldPrefixLength(text) {
+    const lt = text.lastIndexOf('<');
+    if (lt < 0 || text.length - lt > MAX_HELD) return 0;
+    const tail = text.slice(lt);
+    return OPENERS.some((opener) => opener.startsWith(tail)) || NAMED_TAIL_RE.test(tail) ? tail.length : 0;
+}
+
+/** Arguments of the <function=name> form: a JSON object or <parameter=key>value</parameter> pairs. */
+function namedArguments(body) {
+    const params = [...body.matchAll(/<parameter=([\w.-]+)>([\s\S]*?)<\/parameter>/g)];
+    if (!params.length) return jsonValues(body)?.[0] ?? (body.trim() ? null : {});
+    return Object.fromEntries(params.map(([, key, raw]) => {
+        const value = raw.trim();
+        try { return [key, JSON.parse(value)]; } catch { return [key, value]; }
+    }));
+}
+
+/** Split a block body into top-level JSON values (objects or arrays). */
+function jsonValues(body) {
+    const text = body.trim().replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/, '').trim();
+    const values = [];
+    let depth = 0;
+    let start = -1;
+    let inString = false;
+    for (let i = 0; i < text.length; i += 1) {
+        const ch = text[i];
+        if (inString) {
+            if (ch === '\\') i += 1;
+            else if (ch === '"') inString = false;
+        } else if (ch === '"') {
+            inString = true;
+        } else if (ch === '{' || ch === '[') {
+            if (depth === 0) start = i;
+            depth += 1;
+        } else if ((ch === '}' || ch === ']') && depth > 0) {
+            depth -= 1;
+            if (depth === 0) {
+                try { values.push(JSON.parse(text.slice(start, i + 1))); } catch { return null; }
+            }
+        }
+    }
+    return values.length ? values.flat() : null;
+}
+
+function toCall(parsed, toolsByName) {
+    const name = typeof parsed?.name === 'string' ? parsed.name : parsed?.function?.name;
+    const tool = toolsByName.get(name);
+    if (!tool) return null;
+    const rawArgs = parsed.arguments ?? parsed.parameters ?? parsed.input ?? parsed.function?.arguments ?? {};
+    let args = rawArgs;
+    if (typeof rawArgs === 'string') {
+        try { args = JSON.parse(rawArgs); } catch { args = tool.kind === 'custom' ? { input: rawArgs } : null; }
+    }
+    if (tool.kind === 'custom' && (typeof args !== 'object' || args === null || !('input' in args))) args = { input: typeof args === 'string' ? args : JSON.stringify(args) };
+    if (!args || typeof args !== 'object' || Array.isArray(args)) return null;
+    return { id: newCallId(), name, kind: tool.kind || 'function', arguments: JSON.stringify(args) };
+}
+
+function parseBlock(body, toolsByName) {
+    const values = jsonValues(body);
+    if (!values) return null;
+    const calls = values.map((value) => toCall(value, toolsByName));
+    return calls.every(Boolean) ? calls : null;
+}
+
+function parseNamed(name, body, toolsByName) {
+    const args = namedArguments(body);
+    if (args === null) return null;
+    const call = toCall({ name, arguments: args }, toolsByName);
+    return call ? [call] : null;
+}
+
+/** Parse all blocks in `text`; unparseable blocks stay as visible text. */
+function extractCalls(text, toolsByName) {
+    const calls = [];
+    let leftover = '';
+    let rest = text;
+    while (rest.length) {
+        const match = OPEN_RE.exec(rest);
+        if (!match) { leftover += rest; break; }
+        leftover += rest.slice(0, match.index);
+        const named = match[2];
+        const close = named ? '</function>' : `</${match[1]}>`;
+        const bodyStart = match.index + match[0].length;
+        const end = rest.indexOf(close, bodyStart);
+        const body = rest.slice(bodyStart, end < 0 ? undefined : end);
+        const parsed = named ? parseNamed(named, body, toolsByName) : parseBlock(body, toolsByName);
+        if (parsed) calls.push(...parsed);
+        else leftover += rest.slice(match.index, end < 0 ? undefined : end + close.length);
+        rest = end < 0 ? '' : rest.slice(end + close.length);
+    }
+    return { text: calls.length ? leftover.trim() : leftover, calls };
+}
+
+/**
+ * Streaming parser. `push(text)` returns content that is safe to show now;
+ * once a call block starts, the rest is held until `finish()`.
+ * @param {{ name: string, kind?: string }[]} tools
+ */
+export function createToolCallParser(tools) {
+    const toolsByName = new Map(tools.map((tool) => [tool.name, tool]));
+    let pending = '';
+    let capturing = false;
+
+    return {
+        push(text) {
+            pending += text;
+            if (capturing) return '';
+            const match = OPEN_RE.exec(pending);
+            if (match) {
+                const visible = pending.slice(0, match.index);
+                pending = pending.slice(match.index);
+                capturing = true;
+                return visible;
+            }
+            const hold = heldPrefixLength(pending);
+            const visible = pending.slice(0, pending.length - hold);
+            pending = pending.slice(pending.length - hold);
+            return visible;
+        },
+        /** @returns {{ text: string, calls: object[] }} trailing content and parsed calls */
+        finish() {
+            const rest = pending;
+            pending = '';
+            return capturing ? extractCalls(rest, toolsByName) : { text: rest, calls: [] };
+        },
+    };
+}

package/src/openai/url-guard.js

@@ -0,0 +1,61 @@
+import dns from 'node:dns/promises';
+import net from 'node:net';
+import { invalidRequest } from '../server/errors.js';
+
+/**
+ * Attachment URLs are fetched by OpenCode on this host, so a client could
+ * otherwise point them at internal services (SSRF). Only public addresses
+ * are allowed; this blocks loopback, private, link-local, CGNAT, multicast
+ * and other special-purpose ranges.
+ */
+const BLOCKED = new net.BlockList();
+[
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16],
+    ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15],
+    ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
+].forEach(([address, prefix]) => BLOCKED.addSubnet(address, prefix, 'ipv4'));
+[
+    ['::', 128], ['::1', 128], ['64:ff9b::', 96], ['100::', 64], ['2001:db8::', 32], ['fc00::', 7], ['fe80::', 10], ['ff00::', 8],
+].forEach(([address, prefix]) => BLOCKED.addSubnet(address, prefix, 'ipv6'));
+
+const LOOKUP_TIMEOUT_MS = 5000;
+
+export function isBlockedAddress(address) {
+    const family = net.isIP(address);
+    if (family === 0) return true;
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address);
+    if (mapped) return BLOCKED.check(mapped[1], 'ipv4');
+    return BLOCKED.check(address, family === 4 ? 'ipv4' : 'ipv6');
+}
+
+async function resolve(hostname) {
+    const literal = hostname.replace(/^\[|\]$/g, '');
+    if (net.isIP(literal)) return [literal];
+    const lookup = dns.lookup(literal, { all: true, verbatim: true });
+    const timeout = new Promise((_, reject) => setTimeout(() => reject(new Error('DNS lookup timed out')), LOOKUP_TIMEOUT_MS).unref());
+    const records = await Promise.race([lookup, timeout]);
+    return records.map((record) => record.address);
+}
+
+/**
+ * Reject prompt parts whose https URL resolves to a non-public address.
+ * @param {{ url?: string }[]} parts OpenCode prompt parts
+ */
+export async function assertPublicUrls(parts) {
+    const hosts = new Set();
+    for (const part of parts) {
+        if (typeof part.url !== 'string' || !part.url.startsWith('https:')) continue;
+        hosts.add(new URL(part.url).hostname);
+    }
+    await Promise.all([...hosts].map(async (hostname) => {
+        let addresses;
+        try {
+            addresses = await resolve(hostname);
+        } catch {
+            throw invalidRequest(`Could not resolve attachment host '${hostname}'.`, null, 'invalid_attachment_url');
+        }
+        if (!addresses.length || addresses.some(isBlockedAddress)) {
+            throw invalidRequest(`Attachment host '${hostname}' is not a public address.`, null, 'invalid_attachment_url');
+        }
+    }));
+}