[WRONG BRANCH] fix(adapters): bound inline image decoding

[luvs01]

Motivation

• The openai-chat image normalization path decoded attacker-supplied inline images without a safe decoded-memory cap, allowing a small number of requests to force large native decodes and exhaust process memory/CPU.
• The normalization flow also did not observe the request abort signal, so cancelled clients could not stop in-flight native work.

Description

• Lower per-image decoded-pixel ceiling from 100_000_000 to 16_000_000 and reject inputs that exceed it by checking Bun image metadata before a full decode in bunImageEncode and bunImageValidate (src/adapters/anthropic-image-codec.ts).
• Serialize native decode work with a process-wide admission gate sized to IMAGE_NORMALIZE_CONCURRENCY so decoded-image work is limited across requests and not per-request (src/adapters/anthropic-image-normalize.ts).
• Propagate abort signals into adapter request construction and translated-chat normalization by passing abortSignal to buildRequest and normalizeOpenAIChatImages, and make the normalizer respect cancellation so queued decode work stops when the client disconnects (src/server/responses/core.ts, src/adapters/openai-chat.ts, src/adapters/openai-chat-images.ts, src/adapters/anthropic-image-normalize.ts).
• Add regression tests that assert the decoder gate is shared across concurrent requests, that highly-compressed huge images do not reach the decoder, and that already-cancelled oversized builds do not start normalization (tests/adapters/anthropic/anthropic-image-normalize.test.ts, tests/adapters/openai/openai-chat-image-normalization.test.ts).
• Update structure/docs to record the process-wide decoder admission, the metadata-confirmed pixel ceiling, and cancellation semantics (structure/* updates).

Testing

• Ran the focused adapter tests with ./node_modules/bun/bin/bun.exe test tests/adapters/openai/openai-chat-image-normalization.test.ts tests/adapters/anthropic/anthropic-image-normalize.test.ts, which completed with 42 passed, 0 failed.
• Ran bun run typecheck, bun run privacy:scan, and bun run structure:check, all of which passed in this environment.
• Ran the repository full test driver (bun run test) in this container; the image-normalization changes passed locally but the full parallel suite reported unrelated failures in tests/server/api-key-attribution.test.ts that are not caused by the image-normalization changes (environmental/cross-test server interactions observed in this CI container).

---

Codex Task

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T01:01:00.222261Z	673d542	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: eafb7b0c-9ef9-4c64-989b-316c1ee46b37

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 673d542aed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pass abort signals through every normalizer wrapper

The new process-wide queue is cancellable only when abortSignal reaches this option, but the Anthropic production paths do not expose or pass it: normalizeAnthropicImages still accepts only NormalizeOptions, createAnthropicAdapter().buildRequest omits incoming.abortSignal, and native Claude normalization omits req.signal. When all four slots are occupied, disconnected Anthropic requests therefore remain in imageDecodeWaiters, retain their image payloads, and later consume decode capacity, allowing cancelled traffic to build a CPU/memory backlog that delays live requests. Extend the wrapper options and thread the request signal through these callers.

AGENTS.md reference: src/AGENTS.md:L19-L19

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Include the abort signal in continuation rebuilds

This propagates cancellation for the initial build and the recovery rebuild, but fetchContinuation later calls activeAdapter.buildRequest without abortSignal around core.ts:8206. For an oversized OpenAI-chat image request that reaches terminal-guard continuation, disconnecting while normalization is queued will not remove that work from the new process-wide gate, so the request continues retaining and decoding images after cancellation. Pass upstream.signal to that continuation build as well.

AGENTS.md reference: src/AGENTS.md:L19-L19

Useful? React with 👍 / 👎.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.