fix(adapters): bound inline image decoding

src/adapters/anthropic-image-codec.ts

@@ -41,7 +41,9 @@ export const MAX_INPUT_BASE64_LENGTH = 64 * MiB;
  * would widen the adapter contract with no demonstrated need.
  */
 export const IMAGE_NORMALIZE_CONCURRENCY = 4;
-export const MAX_INPUT_PIXELS = 100_000_000;
+// Keep one decoded RGBA surface below 64 MiB. Native codecs may allocate additional
+// working buffers, so this is paired with process-wide admission in the normalizer.
+export const MAX_INPUT_PIXELS = 16_000_000;
 
 
 /** Formats Anthropic accepts as-is; anything else must be transcoded or dropped. */
@@ -275,6 +277,9 @@ export const bunImageEncode: EncodeFn = async (input, spec, quality) => {
   const meta = await image.metadata();
   const w = typeof meta.width === "number" ? meta.width : 0;
   const h = typeof meta.height === "number" ? meta.height : 0;
+  if (w <= 0 || h <= 0 || w * h > MAX_INPUT_PIXELS) {
+    throw new Error("image dimensions exceed the safe decode limit");
+  }
   let pipeline = new Bun.Image(input);
   if (w > spec.maxEdge || h > spec.maxEdge) {
     const scale = spec.maxEdge / Math.max(w, h);
@@ -290,7 +295,14 @@ export const bunImageEncode: EncodeFn = async (input, spec, quality) => {
  * instead of riding pass-through to an Anthropic 400 (C-gate round 1, blocker 1).
  */
 export const bunImageValidate: ValidateFn = async input => {
-  await new Bun.Image(input).resize(1, 1).jpeg({ quality: 1 }).toBuffer();
+  const image = new Bun.Image(input);
+  const meta = await image.metadata();
+  const w = typeof meta.width === "number" ? meta.width : 0;
+  const h = typeof meta.height === "number" ? meta.height : 0;
+  if (w <= 0 || h <= 0 || w * h > MAX_INPUT_PIXELS) {
+    throw new Error("image dimensions exceed the safe decode limit");
+  }
+  await image.resize(1, 1).jpeg({ quality: 1 }).toBuffer();
 };
 
 /**

src/adapters/anthropic-image-normalize.ts

@@ -32,6 +32,37 @@ import { recordedEmittedPosition, recordEmittedPosition } from "./anthropic-imag
 import { IMAGE_NORMALIZE_CONCURRENCY, MAX_INPUT_BASE64_LENGTH, MAX_INPUT_PIXELS } from "./anthropic-image-codec";
 import type { NormalizeOptions } from "./anthropic-image-codec";
 
+const IMAGE_DECODE_PROCESS_CONCURRENCY = IMAGE_NORMALIZE_CONCURRENCY;
+let activeImageDecodes = 0;
+const imageDecodeWaiters: Array<() => void> = [];
+
+async function enterImageDecode(signal?: AbortSignal): Promise<() => void> {
+  if (signal?.aborted) throw signal.reason ?? new DOMException("Aborted", "AbortError");
+  let transferred = false;
+  if (activeImageDecodes >= IMAGE_DECODE_PROCESS_CONCURRENCY) {
+    await new Promise<void>((resolve, reject) => {
+      const admit = (): void => {
+        transferred = true;
+        signal?.removeEventListener("abort", abort);
+        resolve();
+      };
+      const abort = (): void => {
+        const index = imageDecodeWaiters.indexOf(admit);
+        if (index >= 0) imageDecodeWaiters.splice(index, 1);
+        reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+      };
+      imageDecodeWaiters.push(admit);
+      signal?.addEventListener("abort", abort, { once: true });
+    });
+  }
+  if (!transferred) activeImageDecodes++;
+  return () => {
+    const next = imageDecodeWaiters.shift();
+    if (next) next();
+    else activeImageDecodes--;
+  };
+}
+
 const UNDECODABLE_TEXT = "[image omitted: undecodable or corrupt image data]";
 const BOMB_TEXT = "[image omitted: image too large to process safely]";
 const OVERFLOW_DROP_TEXT = "[image omitted: total image payload exceeded the provider request budget; older images were dropped]";
@@ -80,6 +111,8 @@ export interface NormalizeTarget {
 }
 
 export interface NormalizeTargetsOptions extends NormalizeOptions {
+  /** Cancels queued native decode work and stops pulling more images. */
+  abortSignal?: AbortSignal;
   /** Total base64 budget across all targets. Default: TOTAL_IMAGE_BASE64_BUDGET. */
   budget?: number;
   /**
@@ -104,8 +137,21 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
   const budget = options.budget ?? TOTAL_IMAGE_BASE64_BUDGET;
   const overflowAction = options.overflowAction ?? "none";
   const processLimit = options.processLimit ?? Number.POSITIVE_INFINITY;
+  const abortSignal = options.abortSignal;
   const n = targets.length;
 
+  const process = async (b64: string, pos: number, mediaType: string) => {
+    if (abortSignal?.aborted) throw abortSignal.reason ?? new DOMException("Aborted", "AbortError");
+    const leave = await enterImageDecode(abortSignal);
+    try {
+      const result = await processAt(b64, pos, mediaType, encode, validate);
+      if (abortSignal?.aborted) throw abortSignal.reason ?? new DOMException("Aborted", "AbortError");
+      return result;
+    } finally {
+      leave();
+    }
+  };
+
   // sourceB64/sourceMedia are the ORIGINAL input (encode source + cache identity);
   // size always reflects the bytes currently ON the wire for this target (the core is
   // the only mutator, so tracked size cannot drift from reality).
@@ -167,7 +213,7 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
       // age tier on a cold store, which is the pre-#4532 behaviour.
       const recorded = recordedEmittedPosition(b64, sourceMedia);
       const pos = Math.min((recorded ?? initialPosition(newestFirstIndex, 0)) + Math.max(0, bias), TERMINAL_POS);
-      const result = await processAt(b64, pos, sourceMedia, encode, validate);
+      const result = await process(b64, pos, sourceMedia);
       if (result.kind === "failed") {
         target.drop(UNDECODABLE_TEXT);
         if (target.retainsBytesOnDrop) {
@@ -209,7 +255,7 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
   while (sum > budget) {
     const entry = entries.find((e): e is Entry => e !== null && !e.done);
     if (!entry) break; // all terminal — overflowAction below decides
-    const result = await processAt(entry.sourceB64, entry.pos + 1, entry.sourceMedia, encode, validate);
+    const result = await process(entry.sourceB64, entry.pos + 1, entry.sourceMedia);
     if (result.kind === "failed") {
       entry.target.drop(UNDECODABLE_TEXT);
       if (entry.target.retainsBytesOnDrop) {

src/adapters/openai-chat-images.ts

@@ -13,7 +13,9 @@ import {
 export const OPENAI_CHAT_IMAGE_BASE64_BUDGET = 3_670_016; // 3.5MiB
 
 export interface NormalizeOpenAIChatImagesOptions
-  extends Pick<NormalizeOptions, "encode" | "tierBias" | "validate"> {}
+  extends Pick<NormalizeOptions, "encode" | "tierBias" | "validate"> {
+  abortSignal?: AbortSignal;
+}
 
 /** Whether `value` is a plain object, so message and part shapes can be walked safely. */
 function isRecord(value: unknown): value is Record<string, unknown> {

src/adapters/openai-chat.ts

@@ -297,7 +297,13 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         };
       };
       if (hasShrinkableOpenAIChatImages(messages)) {
-        return normalizeOpenAIChatImages(messages, { tierBias: incoming?.imageTierBias }).then(finish, finish);
+        return normalizeOpenAIChatImages(messages, {
+          tierBias: incoming?.imageTierBias,
+          abortSignal: incoming?.abortSignal,
+        }).then(finish, error => {
+          if (incoming?.abortSignal?.aborted) throw error;
+          return finish();
+        });
       }
       return finish();
     },

src/server/responses/adapter-dispatch.ts

@@ -246,7 +246,11 @@ export async function prepareAdapterExchange(
     return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json" } });
   }
   try {
-    initialRequest = await transportState.activeAdapter.buildRequest(parsed, { headers: requestState.selectedForwardHeaders, translatorBudget });
+    initialRequest = await transportState.activeAdapter.buildRequest(parsed, {
+      headers: requestState.selectedForwardHeaders,
+      translatorBudget,
+      abortSignal: upstream.signal,
+    });
     refreshRequestToolAliases(initialRequest);
     recordAdapterReasoning(logCtx, initialRequest);
     recordAdapterTier(logCtx, initialRequest);
@@ -405,6 +409,7 @@ export async function prepareAdapterExchange(
           retryRequest = await transportState.activeAdapter.buildRequest(parsed, {
             headers: requestState.selectedForwardHeaders,
             translatorBudget,
+            abortSignal: upstream.signal,
             ...(transportState.imageTierBias > 0 ? { imageTierBias: transportState.imageTierBias } : {}),
           });
           recordAdapterReasoning(logCtx, retryRequest);

structure/adapters/registry.md

@@ -163,7 +163,7 @@ Combo child requests normalize effort and thinking controls against the selected
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 

structure/data-planes/inbound-compat.md

@@ -250,7 +250,7 @@ Account quota surfaces use [safe probe diagnostics](../transports/inventory.md#a
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 

structure/ops/docs-and-release.md

@@ -444,7 +444,7 @@ Account quota surfaces use [safe probe diagnostics](../transports/inventory.md#a
 
 Combo child requests normalize effort and thinking controls against the selected target while retaining reasoning summaries; strict unknown targets preserve caller controls. The [Responses transport owner](../transports/responses.md) documents this boundary, and native Chat removes effort only for an explicit empty declaration or no-reasoning model.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 OpenCode launcher verification distinguishes the local management catalog request from the inference child. Its transport regressions cover proxy environment, redirects, endpoint validation, credential precedence and child-env separation on hosted CI.
 

structure/overview.md

@@ -183,7 +183,7 @@ Pool quota producers and account commands follow the [bounded raw-observation co
 
 Account quota surfaces use [safe probe diagnostics](transports/inventory.md#account-quota-failure-diagnostics) separately from quota validity, credential health and routing authority.
 
-Translated Chat request construction uses the [inline-image budget](transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 

structure/providers/chat-compat.md

@@ -382,7 +382,7 @@ byte-limit boundaries.
 
 Canonical Spark Lite metadata follows the final serialized model and surviving nonempty Lite tool catalog; see [Responses transport](../transports/responses.md).
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 ## Anthropic parallel tool use
 
 `options.parallelToolCalls === false` maps onto Anthropic's nested

structure/providers/cursor.md

@@ -182,7 +182,7 @@ classifies as overflow. Coverage lives in
 
 An incomplete client-tool stream is fail-closed for the current turn: `finalizeTurnEvents` emits the prefix owned by `CURSOR_INCOMPLETE_TOOL_CALL_MESSAGE_PREFIX` and does not retry that send. After the error is streamed, eligible non-isolated turns remint the Cursor conversation id, persist the thread override, and invalidate the inherited checkpoint so the next turn does not resume a conversation left waiting for `mcpResult`. `src/adapters/cursor/thread-continuity.ts` permits three such rotations per retained identity-scoped thread owner in a separate bounded counter; exhaustion keeps reusing the conversation and records an `incomplete-tool-remint-exhausted` diagnostic, while a clean completed turn clears that scope's counter. This allowance never consumes or replenishes the overflow resend budget. Isolated helper and compaction turns neither remint nor change the parent's allowance or checkpoint. Native Composer replay synthesizes `[missing tool_result for this tool_use in history]` for unpaired `toolCallStep` history; external wire models skip native `mcpToolCall` replay, so conversation remint is their recovery path.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 ## Mid-stream envelope echo
 

structure/runtime.md

@@ -398,7 +398,7 @@ The account history response can include a [low-confidence effective capacity es
 
 Account quota surfaces use [safe probe diagnostics](transports/inventory.md#account-quota-failure-diagnostics) separately from quota validity, credential health and routing authority.
 
-Translated Chat request construction uses the [inline-image budget](transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 OpenCode catalog discovery in `src/cli/opencode.ts` uses the local admin credential and a validated numeric-loopback management origin. It dials through `src/server/direct-local-http.ts`, rejects redirects and preserves the request/body deadline. Hub ingress selection stays separate from exported inference settings.
 

structure/transports/byte-accounting.md

@@ -4,6 +4,8 @@ Native result continuations and function-result injection follow [the mode-speci
 
 Native steering follows [the shared WebSocket contract](streaming-health.md#experimental-native-mid-turn-steering); this surface's defaults remain unchanged.
 
+Translated Chat inline-image normalization keeps retained wire bytes in its aggregate budget while process-wide native-decode admission and a decoded-pixel ceiling bound memory outside that byte accounting.
+
 Responses body-reader limits and lifetime handling follow the
 [core module ownership](responses.md#core-module-ownership). Raised HTTP concurrency follows the separate admission contract below.
 

structure/transports/inventory.md

@@ -195,7 +195,7 @@ Antigravity account quota probes expose only a closed `quotaFailure` category wh
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.