zengate 1.0.4 → 1.1.0

package/src/openai/generate.js

@@ -1,7 +1,10 @@
+import { CHARS_PER_TOKEN, createLengthLimit } from './length-limit.js';
 import { createStopFilter } from './stop.js';
 import { createToolCallParser } from './tool-calls.js';
+import { estimateUsage, learnPromptOverhead, NO_USAGE } from './usage-estimate.js';
 
 const STOP_REACHED = Symbol('stop-sequence');
+const LENGTH_REACHED = Symbol('max-tokens');
 const SEPARATOR = '\n\n';
 
 const FORCED_RETRY_NOTE = 'To call a function, write a <tool_call>{"name": ..., "arguments": {...}}</tool_call> block as plain text in your reply. Do not describe the call; write the block.';
@@ -10,19 +13,20 @@ const addUsage = (a, b) => ({ input: a.input + b.input, output: a.output + b.out
 
 /**
  * Run one completion through OpenCode and apply the OpenAI-side semantics:
- * stop sequences, emulated function calls and structured output.
+ * stop sequences, max_tokens, emulated function calls and structured output.
  *
- * @param {{ runner: object, prompt: object, request: object, signal: AbortSignal,
+ * @param {{ runner: object, prompt: object, request: object, signal: AbortSignal, maxChars: number,
  *           onText?: (text: string) => void, onReasoning?: (text: string) => void }} options
  * @returns {Promise<{ content: string, reasoning: string, toolCalls: object[], finish: string, usage: object }>}
  */
-async function attempt({ runner, prompt, request, signal, onText, onReasoning }) {
+async function attempt({ runner, prompt, request, signal, maxChars, onText, onReasoning }) {
     const controller = new AbortController();
     const forward = () => controller.abort(signal.reason);
     if (signal.aborted) forward();
     else signal.addEventListener('abort', forward, { once: true });
 
     const stopFilter = createStopFilter(request.stop);
+    const lengthLimit = createLengthLimit(maxChars);
     const parser = request.tools.length && request.toolChoice !== 'none' ? createToolCallParser(request.tools) : null;
     // With native structured output, OpenCode returns the JSON separately
     // (info.structured) and any streamed text may be prose, so hold it back.
@@ -36,10 +40,25 @@ async function attempt({ runner, prompt, request, signal, onText, onReasoning })
         content += text;
         onText(text);
     };
-    const acceptText = (text) => {
-        const allowed = stopFilter.push(text);
+    const accept = (text) => {
+        const allowed = lengthLimit.push(text);
         emitText(parser ? parser.push(allowed) : allowed);
-        if (stopFilter.stopped && !controller.signal.aborted) controller.abort(STOP_REACHED);
+    };
+    const acceptText = (text) => {
+        accept(stopFilter.push(text));
+        if (controller.signal.aborted) return;
+        if (stopFilter.stopped) controller.abort(STOP_REACHED);
+        else if (lengthLimit.reached) controller.abort(LENGTH_REACHED);
+    };
+    const done = () => stopFilter.stopped || lengthLimit.reached;
+    // max_completion_tokens and max_output_tokens include reasoning, as in OpenAI's API; max_tokens does not.
+    const acceptReasoning = (text) => {
+        const allowed = request.limitsReasoning ? lengthLimit.push(text) : text;
+        if (allowed) {
+            reasoning += allowed;
+            onReasoning(allowed);
+        }
+        if (lengthLimit.reached && !controller.signal.aborted) controller.abort(LENGTH_REACHED);
     };
 
     let result = null;
@@ -48,44 +67,48 @@ async function attempt({ runner, prompt, request, signal, onText, onReasoning })
             signal: controller.signal,
             onDelta(kind, text) {
                 if (kind === 'reasoning') {
-                    reasoning += text;
-                    onReasoning(text);
+                    if (!done()) acceptReasoning(text);
                 } else if (nativeFormat) {
                     held += text;
-                } else if (!stopFilter.stopped) {
+                } else if (!done()) {
                     acceptText(text);
                 }
             },
         });
     } catch (error) {
-        if (controller.signal.reason !== STOP_REACHED) throw error;
+        const reason = controller.signal.reason;
+        if (reason !== STOP_REACHED && reason !== LENGTH_REACHED) throw error;
     } finally {
         signal.removeEventListener('abort', forward);
     }
+    if (result?.usage) learnPromptOverhead(prompt, result.usage);
 
     if (result?.structured !== undefined) {
         acceptText(typeof result.structured === 'string' ? result.structured : JSON.stringify(result.structured));
     } else if (held) {
         acceptText(held);
     }
-    const tail = stopFilter.flush();
-    emitText(parser ? parser.push(tail) : tail);
+    accept(stopFilter.flush());
     let toolCalls = [];
     if (parser) {
+        // A call cut off by max_tokens cannot be parsed, and its markup is not content.
+        const truncatedCall = lengthLimit.reached && parser.capturing;
         const finished = parser.finish();
         toolCalls = finished.calls;
-        emitText(finished.text);
+        if (!truncatedCall) emitText(finished.text);
     }
     let finish = result?.finish || 'stop';
     if (toolCalls.length) finish = 'tool_calls';
     else if (stopFilter.stopped) finish = 'stop';
+    else if (lengthLimit.reached) finish = 'length';
 
     return {
         content,
         reasoning,
         toolCalls,
         finish,
-        usage: result?.usage || { input: 0, output: 0, reasoning: 0, cacheRead: 0 },
+        // A cut-off turn is aborted before OpenCode reports usage, so it is estimated.
+        usage: result?.usage || (done() ? estimateUsage(prompt, content, reasoning) : NO_USAGE),
         nativeToolAttempt: result?.nativeToolAttempt || null,
     };
 }
@@ -96,33 +119,39 @@ async function attempt({ runner, prompt, request, signal, onText, onReasoning })
  * demands a call (weaker models occasionally do either).
  * @param {Parameters<typeof attempt>[0]} options
  */
-export async function generate({ onText = () => {}, onReasoning = () => {}, ...options }) {
-    const first = await attempt({ ...options, onText, onReasoning });
+export async function generate({ onText: textSink = () => {}, onReasoning: reasoningSink = () => {}, onFirstToken, ...options }) {
     const { request, prompt, signal } = options;
+    const noticing = (sink) => (onFirstToken ? (text) => { if (text) onFirstToken(); sink(text); } : sink);
+    const onText = noticing(textSink);
+    const onReasoning = noticing(reasoningSink);
+    const maxChars = request.maxTokens ? request.maxTokens * CHARS_PER_TOKEN : Infinity;
+    const initial = await attempt({ ...options, maxChars, onText, onReasoning });
     const forced = request.toolChoice === 'required' || (request.toolChoice && typeof request.toolChoice === 'object');
-    if (first.toolCalls.length || signal.aborted || !(forced || first.nativeToolAttempt)) return first;
+    if (initial.toolCalls.length || initial.finish === 'length' || signal.aborted || !(forced || initial.nativeToolAttempt)) return initial;
     const hasClientTools = request.tools.length > 0 && request.toolChoice !== 'none';
     let note = FORCED_RETRY_NOTE;
-    if (first.nativeToolAttempt && hasClientTools) {
-        note = `Your previous attempt to call "${first.nativeToolAttempt}" as a native tool failed: client functions are not native tools. ${FORCED_RETRY_NOTE}`;
-    } else if (first.nativeToolAttempt) {
-        note = `There is no tool named "${first.nativeToolAttempt}". Answer directly without calling tools.`;
+    if (initial.nativeToolAttempt && hasClientTools) {
+        note = `Your previous attempt to call "${initial.nativeToolAttempt}" as a native tool failed: client functions are not native tools. ${FORCED_RETRY_NOTE}`;
+    } else if (initial.nativeToolAttempt) {
+        note = `There is no tool named "${initial.nativeToolAttempt}". Answer directly without calling tools.`;
     }
     const retryPrompt = { ...prompt, system: [prompt.system, note].filter(Boolean).join(SEPARATOR) };
     let separated = false;
     const separate = (emit) => (text) => {
-        if (first.content && !separated && text) {
+        if (initial.content && !separated && text) {
             separated = true;
             onText(SEPARATOR);
         }
         emit(text);
     };
-    const second = await attempt({ ...options, prompt: retryPrompt, onText: separate(onText), onReasoning });
+    const spent = initial.content.length + (initial.content ? SEPARATOR.length : 0) + (request.limitsReasoning ? initial.reasoning.length : 0);
+    const remaining = Math.max(1, maxChars - spent);
+    const second = await attempt({ ...options, maxChars: remaining, prompt: retryPrompt, onText: separate(onText), onReasoning });
     return {
         ...second,
-        content: separated ? `${first.content}${SEPARATOR}${second.content}` : first.content + second.content,
-        reasoning: first.reasoning + second.reasoning,
-        usage: addUsage(first.usage, second.usage),
+        content: separated ? `${initial.content}${SEPARATOR}${second.content}` : initial.content + second.content,
+        reasoning: initial.reasoning + second.reasoning,
+        usage: addUsage(initial.usage, second.usage),
     };
 }
 

package/src/openai/ignored-params.js

@@ -0,0 +1,15 @@
+const HEADER = 'x-gateway-ignored-params';
+const MAX_LISTED = 32;
+const LISTABLE = /^[\w.-]{1,64}$/;
+
+/**
+ * Report accepted-but-ignored request parameters in a response header.
+ * The names come from the client's JSON keys, so only short header-safe
+ * names are listed, and at most MAX_LISTED of them.
+ * @param {import('express').Response} res
+ * @param {string[]} ignored
+ */
+export function setIgnoredParams(res, ignored) {
+    const listed = ignored.filter((name) => LISTABLE.test(name)).slice(0, MAX_LISTED);
+    if (listed.length) res.set(HEADER, listed.join(','));
+}

package/src/openai/length-limit.js

@@ -0,0 +1,49 @@
+import { invalidRequest } from '../server/errors.js';
+
+/**
+ * OpenCode cannot pass a token limit to the model, so `max_tokens` is applied
+ * to the streamed answer instead. Tokens are not counted exactly: a token is
+ * taken to be about four characters, which is close for English text.
+ */
+export const CHARS_PER_TOKEN = 4;
+const MAX_TOKENS = 1_000_000;
+
+/**
+ * The first of `names` that `body` sets, as a validated token count, or null.
+ * @param {object} body request body
+ * @param {string[]} names parameter names in order of precedence
+ */
+export function parseMaxTokens(body, names) {
+    const name = names.find((key) => body[key] !== undefined && body[key] !== null);
+    if (!name) return null;
+    const value = body[name];
+    if (!Number.isInteger(value) || value < 1 || value > MAX_TOKENS) {
+        throw invalidRequest(`${name} must be an integer from 1 to ${MAX_TOKENS}.`, name);
+    }
+    return value;
+}
+
+/**
+ * Cuts streamed text once `maxChars` characters have passed.
+ * @param {number} maxChars Infinity for no limit
+ */
+export function createLengthLimit(maxChars) {
+    let used = 0;
+    let reached = false;
+    return {
+        get reached() { return reached; },
+        get used() { return used; },
+        /** @returns {string} the part of `text` that fits */
+        push(text) {
+            if (reached || !text) return '';
+            const room = maxChars - used;
+            if (text.length <= room) {
+                used += text.length;
+                return text;
+            }
+            reached = true;
+            used = maxChars;
+            return text.slice(0, room);
+        },
+    };
+}

package/src/openai/map-limited.js

@@ -0,0 +1,30 @@
+/**
+ * Map with at most `limit` calls in flight, keeping results in input order.
+ * The first failure calls `onFailure` and stops new calls.
+ * @template T, R
+ * @param {T[]} items
+ * @param {number} limit
+ * @param {(item: T, index: number) => Promise<R>} fn
+ * @param {() => void} [onFailure]
+ * @returns {Promise<R[]>}
+ */
+export async function mapLimited(items, limit, fn, onFailure = () => {}) {
+    const results = new Array(items.length);
+    let next = 0;
+    let failed = false;
+    const worker = async () => {
+        while (next < items.length && !failed) {
+            const index = next;
+            next += 1;
+            try {
+                results[index] = await fn(items[index], index);
+            } catch (error) {
+                failed = true;
+                onFailure();
+                throw error;
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(Math.max(1, limit), items.length) }, worker));
+    return results;
+}

package/src/openai/markup.js

@@ -0,0 +1,31 @@
+/**
+ * Conversations, inlined files and emulated function calls are framed with
+ * pseudo-XML tags in the prompt. Client text must not be able to open or
+ * close those frames, or a message could pass itself off as another turn, a
+ * tool result or a function call. Only the frame tags are escaped, so other
+ * markup in a message reaches the model unchanged.
+ */
+const FRAME_TAG = /<(\/?)((?:user|assistant|tool_result|tool_calls?|function_calls?)(?=[\s/>])|function=|parameter=)/gi;
+const FILE_TAG = /<(\/?)(file)(?=[\s/>])/gi;
+
+/** Escape the conversation and function-call frame tags in client text. */
+export function escapeFrames(text) {
+    return String(text ?? '').replace(FRAME_TAG, '&lt;$1$2');
+}
+
+/** A client-supplied value made safe to place inside a quoted tag attribute. */
+export function attributeValue(value, fallback) {
+    const text = String(value ?? '').replace(/[^\p{L}\p{M}\p{N}_ .:@+-]/gu, '_').slice(0, 255);
+    return text || fallback;
+}
+
+/** Escape file frame tags, so message text cannot pass itself off as an attached file. */
+export function escapeFileTags(text) {
+    return String(text ?? '').replace(FILE_TAG, '&lt;$1$2');
+}
+
+/** An inlined text attachment; its content cannot close the file frame. */
+export function fileBlock(filename, text) {
+    const body = escapeFileTags(escapeFrames(text));
+    return `\n<file name="${attributeValue(filename, 'attachment')}">\n${body}\n</file>\n`;
+}

package/src/openai/prompt.js

@@ -1,10 +1,11 @@
 import { invalidRequest } from '../server/errors.js';
+import { attributeValue, escapeFrames } from './markup.js';
 import { renderToolCall, toolInstructions } from './tool-calls.js';
 
 const TRANSCRIPT_INTRO = 'The conversation so far is below, oldest first. Write only the next assistant reply — no role tags, no transcript markup.';
 
 function attachmentLabel(media, index) {
-    return `[attachment ${index + 1}: ${media.kind}${media.filename ? ` "${media.filename}"` : ''}]`;
+    return `[attachment ${index + 1}: ${media.kind}${media.filename ? ` "${attributeValue(media.filename)}"` : ''}]`;
 }
 
 function toolNameFor(messages, callId) {
@@ -15,7 +16,10 @@ function toolNameFor(messages, callId) {
     return null;
 }
 
-/** Render a multi-turn conversation as one transcript with attachment markers. */
+/**
+ * Render a multi-turn conversation as one transcript with attachment markers.
+ * Message text is escaped so it cannot close its own frame or open another.
+ */
 function renderTranscript(messages, attachments) {
     const blocks = [TRANSCRIPT_INTRO];
     for (const message of messages) {
@@ -23,10 +27,10 @@ function renderTranscript(messages, attachments) {
             attachments.push(media);
             return attachmentLabel(media, attachments.length - 1);
         });
-        const body = [message.content, ...labels].filter(Boolean).join('\n');
+        const body = [escapeFrames(message.content), ...labels].filter(Boolean).join('\n');
         if (message.role === 'tool') {
-            const name = message.name || toolNameFor(messages, message.toolCallId) || 'function';
-            blocks.push(`<tool_result name="${name}" call_id="${message.toolCallId}">\n${body}\n</tool_result>`);
+            const name = attributeValue(message.name || toolNameFor(messages, message.toolCallId), 'function');
+            blocks.push(`<tool_result name="${name}" call_id="${attributeValue(message.toolCallId, 'unknown')}">\n${body}\n</tool_result>`);
         } else if (message.role === 'assistant') {
             const calls = (message.toolCalls || []).map(renderToolCall);
             blocks.push(`<assistant>\n${[body, ...calls].filter(Boolean).join('\n')}\n</assistant>`);

package/src/openai/remote-media.js

@@ -0,0 +1,222 @@
+import https from 'node:https';
+import net from 'node:net';
+import { ApiError, invalidRequest, unsupported } from '../server/errors.js';
+import { fileBlock } from './markup.js';
+import { mapLimited } from './map-limited.js';
+import { kindForMime } from './media.js';
+import { isBlockedAddress, MAX_REMOTE_PARTS, publicLookup, resolvePublic } from './url-guard.js';
+
+const FETCH_TIMEOUT_MS = 30000;
+const MAX_REDIRECTS = 3;
+const PARALLEL_FETCHES = 4;
+const GENERIC_MIME = new Set(['', 'application/octet-stream', 'binary/octet-stream']);
+// A private agent: the global one follows HTTPS_PROXY when NODE_USE_ENV_PROXY is
+// set, and a proxy would resolve names itself and bypass publicLookup.
+const DIRECT_AGENT = new https.Agent({ keepAlive: false });
+const USER_AGENT = 'zengate (+https://github.com/developingchet/zengate)';
+
+const attachmentError = (message) => invalidRequest(message, null, 'invalid_attachment_url');
+
+/**
+ * An attachment URL as it may appear in errors and logs: signed URLs carry
+ * their token in the query string, and some URLs carry credentials, so both
+ * are left out.
+ */
+export function shown(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}${parsed.search ? '?…' : ''}`;
+    } catch {
+        return '(invalid URL)';
+    }
+}
+
+function normalizeMime(header) {
+    const mime = String(header || '').split(';')[0].trim().toLowerCase();
+    return mime === 'image/jpg' ? 'image/jpeg' : mime;
+}
+
+const SIGNATURES = [
+    { mime: 'image/png', bytes: [0x89, 0x50, 0x4e, 0x47] },
+    { mime: 'image/jpeg', bytes: [0xff, 0xd8, 0xff] },
+    { mime: 'image/gif', bytes: [0x47, 0x49, 0x46, 0x38] },
+    { mime: 'application/pdf', bytes: [0x25, 0x50, 0x44, 0x46] },
+    { mime: 'video/webm', bytes: [0x1a, 0x45, 0xdf, 0xa3] },
+];
+
+/** The type of a common image, video or PDF file from its first bytes. */
+function sniffMime(body) {
+    const found = SIGNATURES.find(({ bytes }) => bytes.every((byte, index) => body[index] === byte));
+    if (found) return found.mime;
+    if (body.toString('latin1', 0, 4) === 'RIFF' && body.toString('latin1', 8, 12) === 'WEBP') return 'image/webp';
+    if (body.toString('latin1', 4, 8) === 'ftyp') return 'video/mp4';
+    return '';
+}
+
+/**
+ * The attachment's real type: the server's Content-Type or, when the server
+ * only says "binary", the file's signature or the type guessed from the URL.
+ * It must be the kind the URL was sent as (image_url must be an image),
+ * except that a file URL may turn out to be text, which is inlined.
+ */
+function checkedMime(header, guessed, url, body) {
+    let mime = normalizeMime(header);
+    if (GENERIC_MIME.has(mime)) mime = sniffMime(body) || (guessed.includes('*') ? '' : guessed);
+    const kind = mime ? kindForMime(mime) : null;
+    const expected = kindForMime(guessed.replaceAll('*', 'x'));
+    if (!kind) throw unsupported(`Attachment ${shown(url)} has unsupported type '${mime || 'unknown'}'.`);
+    if (mime === 'image/svg+xml') throw unsupported('SVG images are not supported; send PNG, JPEG, GIF or WebP.');
+    const textFile = kind === 'text' && (expected === 'pdf' || expected === 'text');
+    if (kind !== expected && !textFile) throw attachmentError(`Attachment ${shown(url)} is ${mime}, not ${expected}.`);
+    return { mime, kind };
+}
+
+/**
+ * Byte budget for one request's attachments: each is capped at MAX_MEDIA_MB
+ * and together they are capped at MAX_BODY_MB, the same bounds that apply to
+ * inline data URIs. Returns a per-attachment counter.
+ */
+function createBudget({ maxBytes, maxTotalBytes }) {
+    let total = 0;
+    const mb = (bytes) => (bytes / 1048576).toFixed(0);
+    return (url) => {
+        let used = 0;
+        const check = (bytes) => {
+            if (used + bytes > maxBytes) {
+                throw invalidRequest(`Attachment ${shown(url)} is larger than ${mb(maxBytes)} MB (MAX_MEDIA_MB).`, null, 'attachment_too_large');
+            }
+            if (total + bytes > maxTotalBytes) {
+                throw invalidRequest(`Attachments add up to more than ${mb(maxTotalBytes)} MB (MAX_BODY_MB).`, null, 'attachment_too_large');
+            }
+        };
+        return {
+            check,
+            take(bytes) {
+                check(bytes);
+                used += bytes;
+                total += bytes;
+            },
+        };
+    };
+}
+
+function readBody(response, limit) {
+    return new Promise((resolve, reject) => {
+        const fail = (error) => {
+            response.destroy();
+            reject(error);
+        };
+        const declared = Number(response.headers['content-length']);
+        try {
+            if (declared > 0) limit.check(declared);
+        } catch (error) {
+            fail(error);
+            return;
+        }
+        const chunks = [];
+        let ended = false;
+        response.on('data', (chunk) => {
+            try {
+                limit.take(chunk.length);
+                chunks.push(chunk);
+            } catch (error) {
+                fail(error);
+            }
+        });
+        response.once('end', () => {
+            ended = true;
+            resolve(Buffer.concat(chunks));
+        });
+        response.once('error', reject);
+        response.once('close', () => {
+            if (!ended) reject(new Error('connection closed before the attachment was complete'));
+        });
+    });
+}
+
+function requestOnce(url, { transport, lookup, signal }) {
+    return new Promise((resolve, reject) => {
+        const request = transport.request(url, {
+            method: 'GET',
+            agent: DIRECT_AGENT,
+            lookup,
+            signal,
+            headers: { accept: '*/*', 'accept-encoding': 'identity', 'user-agent': USER_AGENT },
+        });
+        request.once('response', resolve);
+        request.once('error', reject);
+        request.end();
+    });
+}
+
+/**
+ * Download one https attachment. Each connection, including every redirect
+ * hop, goes through publicLookup, so only public addresses are ever reached.
+ * Node does not call `lookup` for an IP literal, so literals are checked here.
+ */
+async function download(url, { transport, lookup, isBlocked, signal, limit }) {
+    let current = new URL(url);
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
+        if (net.isIP(current.hostname.replace(/^\[|\]$/g, ''))) await resolvePublic(current.hostname, isBlocked);
+        const response = await requestOnce(current, { transport, lookup, signal });
+        const status = response.statusCode || 0;
+        if (status >= 300 && status < 400 && response.headers.location) {
+            response.resume();
+            const next = new URL(response.headers.location, current);
+            if (next.protocol !== 'https:') throw attachmentError(`Attachment ${shown(url)} redirects to a non-https URL.`);
+            current = next;
+            continue;
+        }
+        if (status < 200 || status >= 300) {
+            response.resume();
+            throw attachmentError(`Attachment ${shown(url)} returned HTTP ${status}.`);
+        }
+        return { body: await readBody(response, limit), contentType: response.headers['content-type'] };
+    }
+    throw attachmentError(`Attachment ${shown(url)} redirects more than ${MAX_REDIRECTS} times.`);
+}
+
+async function inlinePart(part, options) {
+    const { signal, budget } = options;
+    const timeout = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+    let result;
+    try {
+        result = await download(part.url, { ...options, signal: AbortSignal.any([signal, timeout]), limit: budget(part.url) });
+    } catch (error) {
+        if (signal.aborted) throw signal.reason ?? error;
+        if (error instanceof ApiError) throw error;
+        if (timeout.aborted) throw attachmentError(`Fetching attachment ${shown(part.url)} took longer than ${FETCH_TIMEOUT_MS / 1000}s.`);
+        throw attachmentError(`Could not fetch attachment ${shown(part.url)}: ${error.code || error.message}.`);
+    }
+    const { mime, kind } = checkedMime(result.contentType, part.mime, part.url, result.body);
+    if (kind === 'text') return { type: 'text', text: fileBlock(part.filename, result.body.toString('utf8')) };
+    return { ...part, mime, url: `data:${mime};base64,${result.body.toString('base64')}` };
+}
+
+/**
+ * Replace https attachment URLs in an OpenCode prompt with data URIs (or
+ * inlined text) fetched by the gateway, so OpenCode never fetches a
+ * client-chosen URL itself: no redirects to internal hosts, no DNS
+ * rebinding, and remote files obey the same size limits as inline ones.
+ * @param {{ parts: object[] }} prompt from buildPrompt
+ * @param {{ maxBytes: number, maxTotalBytes: number, signal: AbortSignal,
+ *           transport?: { request: typeof https.request }, isBlocked?: (address: string) => boolean }} options
+ * @returns {Promise<object>} the prompt with every https part inlined
+ */
+export async function inlineRemoteAttachments(prompt, { maxBytes, maxTotalBytes, signal, transport = https, isBlocked = isBlockedAddress }) {
+    const remote = prompt.parts.filter((part) => typeof part.url === 'string' && part.url.startsWith('https:'));
+    if (remote.length === 0) return prompt;
+    if (remote.length > MAX_REMOTE_PARTS) {
+        throw invalidRequest(`At most ${MAX_REMOTE_PARTS} attachments may be URLs; send the rest as data URIs.`, null, 'too_many_attachment_urls');
+    }
+    // One failed attachment fails the request, so the other downloads are cancelled too.
+    const siblings = new AbortController();
+    const options = {
+        transport, lookup: publicLookup(isBlocked), isBlocked,
+        signal: AbortSignal.any([signal, siblings.signal]),
+        budget: createBudget({ maxBytes, maxTotalBytes }),
+    };
+    const fetched = await mapLimited(remote, PARALLEL_FETCHES, (part) => inlinePart(part, options), () => siblings.abort());
+    const replacements = new Map(remote.map((part, index) => [part, fetched[index]]));
+    return { ...prompt, parts: prompt.parts.map((part) => replacements.get(part) ?? part) };
+}

package/src/openai/responses-request.js

@@ -1,20 +1,23 @@
 import { invalidRequest, unsupported } from '../server/errors.js';
-import { parseResponseFormat, parseToolChoice } from './chat-request.js';
+import { MAX_TOOLS, parseResponseFormat, parseToolChoice } from './chat-request.js';
 import { audioFromBase64, fileAttachment, imageFromUrl, videoFromUrl } from './media.js';
+import { parseMaxTokens } from './length-limit.js';
+import { escapeFileTags, fileBlock } from './markup.js';
 
 const IGNORED = new Set([
-    'temperature', 'top_p', 'max_output_tokens', 'max_tool_calls', 'top_logprobs', 'truncation', 'include',
+    'temperature', 'top_p', 'max_tool_calls', 'top_logprobs', 'truncation', 'include',
     'user', 'safety_identifier', 'prompt_cache_key', 'prompt_cache_retention', 'service_tier', 'stream_options',
 ]);
 const HANDLED = new Set([
     'model', 'input', 'instructions', 'stream', 'tools', 'tool_choice', 'parallel_tool_calls', 'text',
-    'reasoning', 'store', 'previous_response_id', 'metadata', 'background', 'conversation', 'prompt',
+    'reasoning', 'store', 'max_output_tokens', 'previous_response_id', 'metadata', 'background', 'conversation', 'prompt',
 ]);
 const isObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 
 function parseTools(tools, ignored) {
     if (tools === undefined || tools === null) return [];
     if (!Array.isArray(tools)) throw invalidRequest('tools must be an array.', 'tools');
+    if (tools.length > MAX_TOOLS) throw invalidRequest(`tools may contain at most ${MAX_TOOLS} entries.`, 'tools');
     const parsed = [];
     tools.forEach((tool, index) => {
         if (tool?.type === 'function' || tool?.type === 'custom') {
@@ -35,7 +38,7 @@ function parseTools(tools, ignored) {
 }
 
 function parseContent(content, param, media, role) {
-    if (typeof content === 'string') return { text: content, media: [] };
+    if (typeof content === 'string') return { text: escapeFileTags(content), media: [] };
     if (!Array.isArray(content)) throw invalidRequest('content must be a string or an array of parts.', param);
     const texts = [];
     const attachments = [];
@@ -44,8 +47,8 @@ function parseContent(content, param, media, role) {
         const options = { ...media, param: where };
         switch (part?.type) {
             case 'input_text': case 'output_text': case 'text': case 'summary_text':
-                texts.push(String(part.text ?? '')); break;
-            case 'refusal': texts.push(String(part.refusal ?? '')); break;
+                texts.push(escapeFileTags(part.text)); break;
+            case 'refusal': texts.push(escapeFileTags(part.refusal)); break;
             case 'input_image':
                 if (part.file_id) throw unsupported('input_image.file_id requires the Files API; send image_url instead.', where);
                 attachments.push(imageFromUrl(part.image_url, options)); break;
@@ -56,7 +59,7 @@ function parseContent(content, param, media, role) {
         }
     });
     if (role !== 'user' && attachments.length) throw invalidRequest('Only user messages may carry attachments.', param);
-    for (const file of attachments.filter((a) => a.kind === 'text')) texts.push(`\n<file name="${file.filename || 'attachment'}">\n${file.text}\n</file>\n`);
+    for (const file of attachments.filter((a) => a.kind === 'text')) texts.push(fileBlock(file.filename, file.text));
     return { text: texts.join(''), media: attachments.filter((a) => a.kind !== 'text') };
 }
 
@@ -153,6 +156,8 @@ export function parseResponsesRequest(body, media, store) {
         reasoningEffort: typeof body.reasoning?.effort === 'string' ? body.reasoning.effort : null,
         stop: [],
         n: 1,
+        maxTokens: parseMaxTokens(body, ['max_output_tokens']),
+        limitsReasoning: true,
         stream: body.stream === true,
         store: body.store !== false,
         echo: {