fix(adapters): bound inline image decoding

src/adapters/anthropic-image-codec.ts

@@ -41,7 +41,9 @@ export const MAX_INPUT_BASE64_LENGTH = 64 * MiB;
  * would widen the adapter contract with no demonstrated need.
  */
 export const IMAGE_NORMALIZE_CONCURRENCY = 4;
-export const MAX_INPUT_PIXELS = 100_000_000;
+// Keep one decoded RGBA surface below 64 MiB. Native codecs may allocate additional
+// working buffers, so this is paired with process-wide admission in the normalizer.
+export const MAX_INPUT_PIXELS = 16_000_000;
 
 
 /** Formats Anthropic accepts as-is; anything else must be transcoded or dropped. */
@@ -218,6 +220,9 @@ export const bunImageEncode: EncodeFn = async (input, spec, quality) => {
   const meta = await image.metadata();
   const w = typeof meta.width === "number" ? meta.width : 0;
   const h = typeof meta.height === "number" ? meta.height : 0;
+  if (w <= 0 || h <= 0 || w * h > MAX_INPUT_PIXELS) {
+    throw new Error("image dimensions exceed the safe decode limit");
+  }
   let pipeline = new Bun.Image(input);
   if (w > spec.maxEdge || h > spec.maxEdge) {
     const scale = spec.maxEdge / Math.max(w, h);
@@ -233,7 +238,14 @@ export const bunImageEncode: EncodeFn = async (input, spec, quality) => {
  * instead of riding pass-through to an Anthropic 400 (C-gate round 1, blocker 1).
  */
 export const bunImageValidate: ValidateFn = async input => {
-  await new Bun.Image(input).resize(1, 1).jpeg({ quality: 1 }).toBuffer();
+  const image = new Bun.Image(input);
+  const meta = await image.metadata();
+  const w = typeof meta.width === "number" ? meta.width : 0;
+  const h = typeof meta.height === "number" ? meta.height : 0;
+  if (w <= 0 || h <= 0 || w * h > MAX_INPUT_PIXELS) {
+    throw new Error("image dimensions exceed the safe decode limit");
+  }
+  await image.resize(1, 1).jpeg({ quality: 1 }).toBuffer();
 };
 
 /**

src/adapters/anthropic-image-normalize.ts

@@ -31,6 +31,37 @@ import { bunImageEncode, bunImageValidate, processAt, TERMINAL_POS, TIER0_COUNT,
 import { IMAGE_NORMALIZE_CONCURRENCY, MAX_INPUT_BASE64_LENGTH, MAX_INPUT_PIXELS } from "./anthropic-image-codec";
 import type { NormalizeOptions } from "./anthropic-image-codec";
 
+const IMAGE_DECODE_PROCESS_CONCURRENCY = IMAGE_NORMALIZE_CONCURRENCY;
+let activeImageDecodes = 0;
+const imageDecodeWaiters: Array<() => void> = [];
+
+async function enterImageDecode(signal?: AbortSignal): Promise<() => void> {
+  if (signal?.aborted) throw signal.reason ?? new DOMException("Aborted", "AbortError");
+  let transferred = false;
+  if (activeImageDecodes >= IMAGE_DECODE_PROCESS_CONCURRENCY) {
+    await new Promise<void>((resolve, reject) => {
+      const admit = (): void => {
+        transferred = true;
+        signal?.removeEventListener("abort", abort);
+        resolve();
+      };
+      const abort = (): void => {
+        const index = imageDecodeWaiters.indexOf(admit);
+        if (index >= 0) imageDecodeWaiters.splice(index, 1);
+        reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+      };
+      imageDecodeWaiters.push(admit);
+      signal?.addEventListener("abort", abort, { once: true });
+    });
+  }
+  if (!transferred) activeImageDecodes++;
+  return () => {
+    const next = imageDecodeWaiters.shift();
+    if (next) next();
+    else activeImageDecodes--;
+  };
+}
+
 const UNDECODABLE_TEXT = "[image omitted: undecodable or corrupt image data]";
 const BOMB_TEXT = "[image omitted: image too large to process safely]";
 const OVERFLOW_DROP_TEXT = "[image omitted: total image payload exceeded the provider request budget; older images were dropped]";
@@ -79,6 +110,8 @@ export interface NormalizeTarget {
 }
 
 export interface NormalizeTargetsOptions extends NormalizeOptions {
+  /** Cancels queued native decode work and stops pulling more images. */
+  abortSignal?: AbortSignal;
   /** Total base64 budget across all targets. Default: TOTAL_IMAGE_BASE64_BUDGET. */
   budget?: number;
   /**
@@ -103,8 +136,21 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
   const budget = options.budget ?? TOTAL_IMAGE_BASE64_BUDGET;
   const overflowAction = options.overflowAction ?? "none";
   const processLimit = options.processLimit ?? Number.POSITIVE_INFINITY;
+  const abortSignal = options.abortSignal;
   const n = targets.length;
 
+  const process = async (b64: string, pos: number, mediaType: string) => {
+    if (abortSignal?.aborted) throw abortSignal.reason ?? new DOMException("Aborted", "AbortError");
+    const leave = await enterImageDecode(abortSignal);
+    try {
+      const result = await processAt(b64, pos, mediaType, encode, validate);
+      if (abortSignal?.aborted) throw abortSignal.reason ?? new DOMException("Aborted", "AbortError");
+      return result;
+    } finally {
+      leave();
+    }
+  };
+
   // sourceB64/sourceMedia are the ORIGINAL input (encode source + cache identity);
   // size always reflects the bytes currently ON the wire for this target (the core is
   // the only mutator, so tracked size cannot drift from reality).
@@ -150,7 +196,7 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
       }
       const sourceMedia = target.mediaType.toLowerCase();
       const pos = initialPosition(newestFirstIndex, bias);
-      const result = await processAt(b64, pos, sourceMedia, encode, validate);
+      const result = await process(b64, pos, sourceMedia);
       if (result.kind === "failed") {
         target.drop(UNDECODABLE_TEXT);
         if (target.retainsBytesOnDrop) {
@@ -192,7 +238,7 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
   while (sum > budget) {
     const entry = entries.find((e): e is Entry => e !== null && !e.done);
     if (!entry) break; // all terminal — overflowAction below decides
-    const result = await processAt(entry.sourceB64, entry.pos + 1, entry.sourceMedia, encode, validate);
+    const result = await process(entry.sourceB64, entry.pos + 1, entry.sourceMedia);
     if (result.kind === "failed") {
       entry.target.drop(UNDECODABLE_TEXT);
       if (entry.target.retainsBytesOnDrop) {

src/adapters/openai-chat-images.ts

@@ -13,7 +13,9 @@ import {
 export const OPENAI_CHAT_IMAGE_BASE64_BUDGET = 3_670_016; // 3.5MiB
 
 export interface NormalizeOpenAIChatImagesOptions
-  extends Pick<NormalizeOptions, "encode" | "tierBias" | "validate"> {}
+  extends Pick<NormalizeOptions, "encode" | "tierBias" | "validate"> {
+  abortSignal?: AbortSignal;
+}
 
 /** Whether `value` is a plain object, so message and part shapes can be walked safely. */
 function isRecord(value: unknown): value is Record<string, unknown> {

src/adapters/openai-chat.ts

@@ -1679,7 +1679,13 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         };
       };
       if (hasShrinkableOpenAIChatImages(messages)) {
-        return normalizeOpenAIChatImages(messages, { tierBias: incoming?.imageTierBias }).then(finish, finish);
+        return normalizeOpenAIChatImages(messages, {
+          tierBias: incoming?.imageTierBias,
+          abortSignal: incoming?.abortSignal,
+        }).then(finish, error => {
+          if (incoming?.abortSignal?.aborted) throw error;
+          return finish();
+        });
       }
       return finish();
     },

src/server/responses/core.ts

@@ -7524,7 +7524,11 @@ async function handleResponsesInner(
   const remainingTransientSendBudget = (budget: number): number =>
     Math.max(1, budget - transientSendsUsed);
   try {
-    initialRequest = await activeAdapter.buildRequest(parsed, { headers: selectedForwardHeaders, translatorBudget });
+    initialRequest = await activeAdapter.buildRequest(parsed, {
+      headers: selectedForwardHeaders,
+      translatorBudget,
+      abortSignal: upstream.signal,
+    });
     refreshRequestToolAliases(initialRequest);
     recordAdapterReasoning(logCtx, initialRequest);
     recordAdapterTier(logCtx, initialRequest);
@@ -7659,6 +7663,7 @@ async function handleResponsesInner(
           retryRequest = await activeAdapter.buildRequest(parsed, {
             headers: selectedForwardHeaders,
             translatorBudget,
+            abortSignal: upstream.signal,
             ...(imageTierBias > 0 ? { imageTierBias } : {}),
           });
           recordAdapterReasoning(logCtx, retryRequest);

structure/adapters/registry.md

@@ -128,7 +128,7 @@ Combo child requests normalize effort and thinking controls against the selected
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 

structure/data-planes/inbound-compat.md

@@ -242,7 +242,7 @@ Account quota surfaces use [safe probe diagnostics](../transports/inventory.md#a
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 

structure/providers/chat-compat.md

@@ -291,4 +291,4 @@ byte-limit boundaries.
 
 Canonical Spark Lite metadata follows the final serialized model and surviving nonempty Lite tool catalog; see [Responses transport](../transports/responses.md).
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.

structure/providers/cursor.md

@@ -105,4 +105,4 @@ Combo child requests normalize effort and thinking controls against the selected
 
 `src/adapters/cursor.ts` surfaces the first bare context overflow before attempting conversation remint on later eligible requests. `cursorClientThreadOwner` recognizes both client thread aliases; `src/adapters/cursor/thread-continuity.ts` limits recovery to three remints per retained identity-scoped owner, with a one-hour idle TTL and 2,048-entry bound. Conversation-only requests have no stable owner and do not automatically remint. Quota/rate errors, tool-result resumes, partial output, local side effects, isolated helper/shadow requests and compaction remain fail-closed. Isolated requests neither consume the parent allowance nor invalidate its checkpoint. Eligible overflow checks refresh existing retention timestamps and LRU position even after the cap is exhausted, without allocating absent scopes. Retention expiry, eviction or process restart resets the in-memory allowance; this is not a persistent lifetime cap or semantic-progress policy.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.

structure/runtime.md

@@ -339,7 +339,7 @@ The account history response can include a [low-confidence effective capacity es
 
 Account quota surfaces use [safe probe diagnostics](transports/inventory.md#account-quota-failure-diagnostics) separately from quota validity, credential health and routing authority.
 
-Translated Chat request construction uses the [inline-image budget](transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 OpenCode catalog discovery in `src/cli/opencode.ts` uses the local admin credential and a validated numeric-loopback management origin. It dials through `src/server/direct-local-http.ts`, rejects redirects and preserves the request/body deadline. Hub ingress selection stays separate from exported inference settings.
 

structure/transports/byte-accounting.md

@@ -1,5 +1,7 @@
 # Byte Accounting
 
+Translated Chat inline-image normalization keeps retained wire bytes in its aggregate budget while process-wide native-decode admission and a decoded-pixel ceiling bound memory outside that byte accounting.
+
 How opencodex measures request and stream bytes without allocating copies solely to count
 them. These contracts are shared by request parsing, SSE rewriting, the provider adapters and
 the translator budget, which is why so many documents link here rather than restating them.

structure/transports/inventory.md

@@ -135,7 +135,7 @@ Antigravity account quota probes expose only a closed `quotaFailure` category wh
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 

structure/transports/responses.md

@@ -593,7 +593,7 @@ Pool quota producers and account commands follow the [bounded raw-observation co
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 

structure/transports/streaming-health.md

@@ -244,7 +244,7 @@ Live sideband admission and its bounded upstream handshake follow the [runtime c
 
 ## Translated Chat inline-image budget
 
-`src/adapters/openai-chat-images.ts` reuses the shared image normalization ladder for translated Chat bodies above a 3.5 MiB base64-image budget. This is best effort, not a whole-request ceiling. Remote URLs are not fetched; unprocessable and terminal images remain attached, and retained bytes continue to count during demotion. Under-budget construction stays synchronous; delegating MiMo awaits conditional asynchronous construction. Native Chat passthrough and Anthropic-only 413 retry policy retain their existing behavior.
+`src/adapters/openai-chat-images.ts` reuses the shared image normalization ladder for translated Chat bodies above a 3.5 MiB base64-image budget. This is best effort, not a whole-request ceiling. Remote URLs are not fetched; unprocessable and terminal images remain attached, and retained bytes continue to count during demotion. Under-budget construction stays synchronous; delegating MiMo awaits conditional asynchronous construction. Native decoding is admitted through a process-wide four-operation gate, guarded by a 16-million-pixel ceiling confirmed from codec metadata, and request cancellation stops queued and subsequent normalization work. Native Chat passthrough and Anthropic-only 413 retry policy retain their existing behavior.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 

tests/adapters/anthropic/anthropic-image-normalize.test.ts

@@ -397,6 +397,27 @@ describe("bounded parallel first pass (WP170)", () => {
     expect(g.stats().arrivals).toBe(10);
   });
 
+  test("the decoder concurrency limit is shared across simultaneous requests", async () => {
+    const g = gatedEncoder();
+    const first = normalizeAnthropicImages(
+      [userMsg(distinctImages(8).map(b64 => imageBlock(b64)))],
+      { encode: g.encode },
+    );
+    const second = normalizeAnthropicImages(
+      [userMsg(distinctImages(8).map(b64 => imageBlock(b64)))],
+      { encode: g.encode },
+    );
+
+    await g.waitForArrivals(IMAGE_NORMALIZE_CONCURRENCY);
+    expect(g.stats().active).toBe(IMAGE_NORMALIZE_CONCURRENCY);
+    await Bun.sleep(10);
+    expect(g.stats().arrivals).toBe(IMAGE_NORMALIZE_CONCURRENCY);
+
+    g.release();
+    await Promise.all([first, second]);
+    expect(g.stats().peak).toBe(IMAGE_NORMALIZE_CONCURRENCY);
+  });
+
   test("a thrown target callback rejects the call, settles in-flight work, and stops new pulls", async () => {
     // processAt swallows encode/validate throws into {kind:"failed"} (its own catch),
     // so the production escape hatch is a throwing target callback (drop/replace).