[WRONG BRANCH] fix(devin): bound remote image prompt references

[luvs01]

Motivation

• The Devin adapter converted every non-data image_url into literal prompt text, allowing an attacker-controlled long URL to bypass admission tokens and amplify memory use during protobuf construction.
• This could turn a fixed 850-token admission charge into multi-copy, megabyte-scale serialized prompts and trigger process RSS exhaustion or OOM.
• The intent is to preserve data-URL image passthrough while ensuring remote references cannot be expanded into attacker-sized prompt text.

Description

• Add a length-and-scheme guard boundedDevinRemoteImageReference with MAX_DEVIN_REMOTE_IMAGE_URL_CHARS = 8192 and only accept https: URLs up to that length.
• Change mapOcxContentToWire to use the guard and to emit a fixed-size omission marker "[image omitted: unsupported or oversized URL]" when the reference is unsupported or oversized; inline data URLs still map to native image parts.
• Add a focused regression test tests/providers/devin-image-passthrough.test.ts that verifies normal HTTPS references are preserved and oversized attacker-controlled URLs are not copied into prompt content.
• Update related structure docs to record the bounded Devin mapping and the adapter/transport contract so the transport invariants reflect the new behavior.

Testing

• Ran the focused regression suite with bun test tests/providers/devin-image-passthrough.test.ts, which passed all tests (7 pass).
• Ran repository checks bun run structure:check, bun run typecheck, and bun run privacy:scan, each of which succeeded.
• Ran git diff --check as part of verification with no check errors.
• Ran the full test suite with bun run test; the focused change is covered, but the full parallel suite in this container showed unrelated timeouts/state-dependent failures and is not green here (these failures are outside the scope of this focused fix).

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1edd3f5f-1cfe-4e4e-9179-7f5433180618

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T00:29:59.636950Z	8a1705a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (Dev); retarget to dev. UI screenshot required.

What to do

• Retarget this PR to dev — all contributions go to dev.
• Add a screenshot of the UI change to the PR description.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.