pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-10 17:22:17 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(cursor): hydrate SelectedImage via blobIdWithData + JPEG soft-cap

Browse Source 
Cursor vision expects SelectedImage.blob_id_with_data (field 9) backed by
the session blobStore, and large clipboard PNGs need JPEG soft-cap prep
rather than a hard 1 MiB reject before encode.
This commit is contained in:
SB Yoon
2026-08-08 21:51:22 -06:00
committed by diegosouzapw
parent aae408f585
commit aca0e4d14c
5 changed files with 638 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

85
open-sse/utils/cursorAgentProtobuf.ts
View File

@@ -69,15 +69,21 @@ const UM_MODE = 4; // UserMessage.mode (cursor-agent sends 1)
// encoder for shape). Images attach to the current UserMessage through its
// selected_context (field 3): UserMessage.selected_context is a SelectedContext
// whose `selected_images` (field 1) is a repeated SelectedImage. Each
// SelectedImage carries the raw bytes inline in its `data_or_blob_id` oneof
// (the `data` case, field 8) — cursor-agent's CLI instead sends a local file
// `path`, which a proxy cannot use, so we inline the bytes like composer-api.
// SelectedImage uses the `blob_id_with_data` oneof case (field 9) so Cursor can
// hydrate via getBlob while also receiving the bytes inline for cache warm-up.
// Field 8 (`data`) is intentionally not written — live Cursor hydration expects
// blobIdWithData. We also set `path` like native/shunt clients.
const SC_SELECTED_IMAGES = 1; // SelectedContext.selected_images [repeated SelectedImage]
const SI_UUID = 2; // SelectedImage.uuid
const SI_PATH = 3; // SelectedImage.path
const SI_DIMENSION = 4; // SelectedImage.dimension (SelectedImage.Dimension)
const SI_MIME_TYPE = 7; // SelectedImage.mime_type
const SI_DATA = 8; // SelectedImage.data (oneof data_or_blob_id) — inline image bytes
// Field 8 (SelectedImage.data) is the legacy inline oneof case — not written.
const SI_BLOB_ID_WITH_DATA = 9; // SelectedImage.blob_id_with_data (oneof)
const SIBD_BLOB_ID = 1; // SelectedImage.BlobIdWithData.blob_id
const SIBD_DATA = 2; // SelectedImage.BlobIdWithData.data
const DIM_WIDTH = 1; // SelectedImage.Dimension.width (int32)
const DIM_HEIGHT = 2; // SelectedImage.Dimension.height (int32)
@@ -413,18 +419,19 @@ export type AgentRunInput = {
// which the executor's processFrame replies to with the stored bytes.
systemPrompt?: string;
blobStore?: Map<string, Buffer>;
// Vision input: images attached to the current user turn. Encoded inline as
// SelectedContext.selected_images[] (see encodeSelectedImageBody). Empty /
// undefined keeps the request byte-identical to the text-only path.
// Vision input: images attached to the current user turn. Encoded as
// SelectedContext.selected_images[] via blobIdWithData (see
// encodeSelectedImageBody). Empty / undefined keeps the request
// byte-identical to the text-only path.
images?: EncodedImage[];
};
/**
* A resolved image ready to embed in a cursor request. `data` is the raw
* decoded image bytes (already SSRF-checked / size-capped by the executor's
* resolveCursorImages helper). `mimeType` (e.g. "image/png") helps cursor
* decode the inline bytes; `width`/`height` populate the optional Dimension
* sub-message when cheaply known; `uuid` is a stable per-image id.
* decoded image bytes (already SSRF-checked / size-capped / JPEG-prepped by
* resolveCursorImages). `mimeType` (e.g. "image/png") helps cursor decode
* the bytes; `width`/`height` populate the optional Dimension sub-message
* when cheaply known; `uuid` is a stable per-image id.
*/
export type EncodedImage = {
data: Buffer;
@@ -434,14 +441,41 @@ export type EncodedImage = {
uuid: string;
};
/** Filename Cursor clients typically put on SelectedImage.path. */
export function cursorImageAttachmentPath(uuid: string, mimeType?: string): string {
const normalized = (mimeType || "").toLowerCase();
const ext =
normalized === "image/jpeg" || normalized === "image/jpg"
? "jpg"
: normalized === "image/gif"
? "gif"
: normalized === "image/webp"
? "webp"
: "png";
return `attachment-${uuid}.${ext}`;
}
/**
* Encode the body of a SelectedImage message (no outer field tag — the caller
* wraps it via encodeMessage(SC_SELECTED_IMAGES, [body])). Sets the inline
* `data` oneof case plus uuid, optional dimension, and mime_type. Fields are
* written in ascending field-number order (canonical protobuf layout).
* wraps it via encodeMessage(SC_SELECTED_IMAGES, [body])). Uses the
* `blob_id_with_data` oneof case (field 9), stores sha256(data) → bytes in
* `blobStore` when provided (same map as system-prompt getBlob), and sets
* path/uuid/optional dimension/mime_type. Fields are written in ascending
* field-number order (canonical protobuf layout).
*/
export function encodeSelectedImageBody(img: EncodedImage): Buffer {
const parts: Buffer[] = [encodeString(SI_UUID, img.uuid)];
export function encodeSelectedImageBody(
img: EncodedImage,
blobStore?: Map<string, Buffer>
): Buffer {
const blobId = crypto.createHash("sha256").update(img.data).digest();
if (blobStore) {
blobStore.set(blobId.toString("hex"), img.data);
}
const parts: Buffer[] = [
encodeString(SI_UUID, img.uuid),
encodeString(SI_PATH, cursorImageAttachmentPath(img.uuid, img.mimeType)),
];
if (
typeof img.width === "number" &&
typeof img.height === "number" &&
@@ -460,9 +494,13 @@ export function encodeSelectedImageBody(img: EncodedImage): Buffer {
if (img.mimeType) {
parts.push(encodeString(SI_MIME_TYPE, img.mimeType));
}
// data_or_blob_id oneof = data (inline bytes) — field 8, written last to
// keep ascending field order.
parts.push(encodeBytes(SI_DATA, img.data));
// data_or_blob_id oneof = blob_id_with_data — field 9 (not legacy field 8).
parts.push(
encodeMessage(SI_BLOB_ID_WITH_DATA, [
encodeBytes(SIBD_BLOB_ID, blobId),
encodeBytes(SIBD_DATA, img.data),
])
);
return Buffer.concat(parts);
}
@@ -493,12 +531,15 @@ export function encodeAgentRunRequest(input: AgentRunInput): Buffer {
// UserMessage { text, message_id, selected_context, mode=1 }.
// selected_context is normally an empty placeholder (required by the server
// even when empty — see below), but when the turn carries vision input we
// populate its selected_images[] with the inline-encoded images. The
// empty-images path produces byte-identical output to the text-only request.
// populate its selected_images[] with blobIdWithData-encoded images (and
// store the bytes in blobStore for getBlob). The empty-images path produces
// byte-identical output to the text-only request.
const selectedContextParts: Buffer[] = [];
if (input.images && input.images.length > 0) {
for (const img of input.images) {
selectedContextParts.push(encodeMessage(SC_SELECTED_IMAGES, [encodeSelectedImageBody(img)]));
selectedContextParts.push(
encodeMessage(SC_SELECTED_IMAGES, [encodeSelectedImageBody(img, input.blobStore)])
);
}
}
// The empty selected_context placeholder and mode=1 match cursor-agent's

449
open-sse/utils/cursorImages.ts
View File

@@ -2,8 +2,8 @@
* Image resolution + security for Cursor vision input.
*
* Turns OpenAI `image_url` parts (base64 `data:` URIs or remote `http(s)`
* URLs) into decoded bytes ready to inline into a cursor SelectedImage
* (see ../utils/cursorAgentProtobuf.ts::encodeSelectedImageBody).
* URLs) into decoded, JPEG-prepped bytes ready for SelectedImage
* `blobIdWithData` encoding (see cursorAgentProtobuf.ts).
*
* Security (OmniRoute hard rules):
* - SSRF: remote fetches go through the repo's canonical outbound guard
@@ -12,9 +12,9 @@
* cloud-metadata hostnames. Client-supplied image URLs are always held to
* the strict public-only policy (never gated by the private-URL toggle that
* admin-configured provider URLs use).
* - Size cap: each image must decode to <= 1 MiB (matches composer-api).
* Enforced both before base64 decode (cheap pre-check) and while streaming
* a remote body (so a hostile server can't stream gigabytes).
* - Size caps: inbound decode/fetch is bounded (16 MiB) so large clipboard
* PNGs can shrink via JPEG soft-cap prep; the final wire image must be
* <= 1 MiB. Soft target is ~100 KiB JPEG for reliable Cursor hydration.
* - Content type: data URIs and URL responses must be `image/*`.
* - Errors throw `CursorImageError` with a clean, path-free message; the
* executor routes it through the sanitized 400 path (hard rule #12).
@@ -23,6 +23,7 @@
import crypto from "node:crypto";
import dns from "node:dns";
import { isIP } from "node:net";
import sharp from "sharp";
import {
parseAndValidatePublicUrl,
isPrivateHost,
@@ -30,14 +31,47 @@ import {
} from "@/shared/network/outboundUrlGuard";
import type { EncodedImage } from "./cursorAgentProtobuf.ts";
// 1 MiB per image — matches composer-api's MAX_CURSOR_IMAGE_BYTES. Large
// enough for a typical screenshot, small enough to bound request size and
// memory.
/** Final per-image byte cap after prep (composer-api / wire bound). */
export const MAX_CURSOR_IMAGE_BYTES = 1024 * 1024;
// Upper bound on the number of images per request. Each image triggers (at
// most) one remote fetch, so an unbounded count is a DoS vector; 12 is well
// above any realistic vision prompt.
/**
* Inbound decode/fetch bomb ceiling before JPEG prep. Large clipboard PNGs may
* exceed {@link MAX_CURSOR_IMAGE_BYTES} raw but shrink under the wire cap after
* re-encode.
*/
export const MAX_CURSOR_IMAGE_DECODE_BYTES = 16 * 1024 * 1024;
/**
* Soft target for Cursor vision hydration. Prefer JPEG at or under this size.
*/
export const CURSOR_VISION_SOFT_MAX_BYTES = 100 * 1024;
/** Soft target when the client requests `detail: original` or `high`. */
export const CURSOR_VISION_SOFT_MAX_BYTES_HIGH = 256 * 1024;
/** Longest edge after Cursor vision prep. */
export const CURSOR_VISION_MAX_EDGE = 2000;
/** Decode bomb: reject images whose sniffed longest edge exceeds this. */
export const MAX_CURSOR_IMAGE_DECODE_EDGE = 8192;
/** Decode bomb: reject images whose sniffed pixel count exceeds this. */
export const MAX_CURSOR_IMAGE_PIXELS = 25_000_000;
const CURSOR_VISION_JPEG_QUALITIES_DEFAULT = [85, 70, 55, 40] as const;
const CURSOR_VISION_JPEG_QUALITIES_HIGH = [90, 80, 65, 50] as const;
const CURSOR_VISION_SOFT_MIN_EDGE = 256;
const CURSOR_VISION_SOFT_SHRINK = 0.85;
const CURSOR_VISION_PASSTHROUGH_MIME = new Set([
"image/jpeg",
"image/jpg",
"image/png",
"image/gif",
"image/webp",
]);
/** Upper bound on images attached to one Cursor turn. */
export const MAX_CURSOR_IMAGES = 12;
// Wall-clock cap for a single remote image fetch. A malformed env value
@@ -64,6 +98,25 @@ export class CursorImageError extends Error {
}
}
function estimatedBase64DecodedBytes(payload: string): number {
return Math.floor((payload.length * 3) / 4);
}
function isHighDetail(detail: string | undefined): boolean {
const normalized = (detail || "").toLowerCase();
return normalized === "high" || normalized === "original";
}
function softMaxBytesForDetail(detail: string | undefined): number {
return isHighDetail(detail) ? CURSOR_VISION_SOFT_MAX_BYTES_HIGH : CURSOR_VISION_SOFT_MAX_BYTES;
}
function jpegQualitiesForDetail(detail: string | undefined): readonly number[] {
return isHighDetail(detail)
? CURSOR_VISION_JPEG_QUALITIES_HIGH
: CURSOR_VISION_JPEG_QUALITIES_DEFAULT;
}
function decodeDataUrl(url: string): { data: Buffer; mimeType: string } {
// data:[<mediatype>][;base64],<data>
const comma = url.indexOf(",");
@@ -86,16 +139,21 @@ function decodeDataUrl(url: string): { data: Buffer; mimeType: string } {
// Reject on the raw payload length BEFORE the regex/normalize pass, so an
// arbitrarily large data URL can't burn CPU on the whitespace strip. Base64
// expands ~4:3, so 2x the byte cap is a safe upper bound on the encoded text.
if (payload.length > MAX_CURSOR_IMAGE_BYTES * 2) {
throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry.");
// expands ~4:3, so 2x the decode ceiling is a safe upper bound on the text.
if (payload.length > MAX_CURSOR_IMAGE_DECODE_BYTES * 2) {
throw new CursorImageError("Image input is too large to process safely.");
}
const normalized = payload.replace(/\s/g, "");
// Cheap pre-check: 4 base64 chars -> 3 bytes. Reject obviously oversized
// payloads before allocating the decode buffer.
if (Math.floor((normalized.length * 3) / 4) > MAX_CURSOR_IMAGE_BYTES) {
throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry.");
if (normalized.length === 0) {
throw new CursorImageError("Image data URL contains invalid base64 data.");
}
// Reject lenient Buffer.from acceptances (wrong alphabet, bad padding).
if (normalized.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(normalized)) {
throw new CursorImageError("Image data URL contains invalid base64 data.");
}
if (estimatedBase64DecodedBytes(normalized) > MAX_CURSOR_IMAGE_DECODE_BYTES) {
throw new CursorImageError("Image input is too large to process safely.");
}
let data: Buffer;
@@ -104,11 +162,16 @@ function decodeDataUrl(url: string): { data: Buffer; mimeType: string } {
} catch {
throw new CursorImageError("Image data URL contains invalid base64 data.");
}
// Buffer.from(base64) silently drops invalid trailing chars; guard against a
// payload that decoded to nothing despite being non-empty.
if (normalized.length > 0 && data.length === 0) {
if (data.length === 0) {
throw new CursorImageError("Image data URL contains invalid base64 data.");
}
// Round-trip guard: Node can silently drop trailing garbage.
if (data.toString("base64").replace(/=+$/, "") !== normalized.replace(/=+$/, "")) {
throw new CursorImageError("Image data URL contains invalid base64 data.");
}
if (data.length > MAX_CURSOR_IMAGE_DECODE_BYTES) {
throw new CursorImageError("Image input is too large to process safely.");
}
return { data, mimeType };
}
@@ -216,10 +279,10 @@ async function fetchImageBytes(url: string): Promise<{ data: Buffer; mimeType: s
// Reject early on an oversized Content-Length, then still cap during read
// (the header is advisory / may be absent).
const declaredLen = Number(response.headers.get("content-length") || "0");
if (Number.isFinite(declaredLen) && declaredLen > MAX_CURSOR_IMAGE_BYTES) {
throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry.");
if (Number.isFinite(declaredLen) && declaredLen > MAX_CURSOR_IMAGE_DECODE_BYTES) {
throw new CursorImageError("Image input is too large to process safely.");
}
const data = await readCapped(response, MAX_CURSOR_IMAGE_BYTES);
const data = await readCapped(response, MAX_CURSOR_IMAGE_DECODE_BYTES);
return { data, mimeType };
} finally {
clearTimeout(timer);
@@ -249,7 +312,7 @@ async function readCapped(response: Response, cap: number): Promise<Buffer> {
const pushCapped = (chunk: Uint8Array) => {
total += chunk.byteLength;
if (total > cap) {
throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry.");
throw new CursorImageError("Image input is too large to process safely.");
}
chunks.push(Buffer.from(chunk));
};
@@ -284,22 +347,311 @@ async function readCapped(response: Response, cap: number): Promise<Buffer> {
// Last resort: buffer then cap-check (only exotic non-stream bodies).
const buf = Buffer.from(await response.arrayBuffer());
if (buf.length > cap) {
throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry.");
throw new CursorImageError("Image input is too large to process safely.");
}
return buf;
}
/** Magic-byte format sniff (independent of declared MIME). */
export function sniffCursorImageFormat(
data: Uint8Array
): "png" | "jpeg" | "gif" | "webp" | undefined {
if (
data.byteLength >= 8 &&
data[0] === 0x89 &&
data[1] === 0x50 &&
data[2] === 0x4e &&
data[3] === 0x47 &&
data[4] === 0x0d &&
data[5] === 0x0a &&
data[6] === 0x1a &&
data[7] === 0x0a
) {
return "png";
}
if (
data.byteLength >= 6 &&
data[0] === 0x47 &&
data[1] === 0x49 &&
data[2] === 0x46 &&
data[3] === 0x38
) {
return "gif";
}
if (data.byteLength >= 4 && data[0] === 0xff && data[1] === 0xd8) return "jpeg";
if (
data.byteLength >= 12 &&
data[0] === 0x52 &&
data[1] === 0x49 &&
data[2] === 0x46 &&
data[3] === 0x46 &&
data[8] === 0x57 &&
data[9] === 0x45 &&
data[10] === 0x42 &&
data[11] === 0x50
) {
return "webp";
}
return undefined;
}
/**
* Sniff PNG/JPEG/GIF/WebP dimensions from raw bytes when the header is present.
* Best-effort only — unknown formats return undefined (dimension is optional).
*/
export function sniffCursorImageDimensions(
data: Uint8Array
): { width: number; height: number } | undefined {
// PNG: signature + IHDR chunk (width/height at bytes 16..23)
if (
data.byteLength >= 24 &&
data[0] === 0x89 &&
data[1] === 0x50 &&
data[2] === 0x4e &&
data[3] === 0x47 &&
data[4] === 0x0d &&
data[5] === 0x0a &&
data[6] === 0x1a &&
data[7] === 0x0a
) {
const width = ((data[16]! << 24) | (data[17]! << 16) | (data[18]! << 8) | data[19]!) >>> 0;
const height = ((data[20]! << 24) | (data[21]! << 16) | (data[22]! << 8) | data[23]!) >>> 0;
if (width > 0 && height > 0) return { width, height };
}
// GIF: "GIF8" + width/height as little-endian u16 at bytes 6..9
if (
data.byteLength >= 10 &&
data[0] === 0x47 &&
data[1] === 0x49 &&
data[2] === 0x46 &&
data[3] === 0x38
) {
const width = data[6]! | (data[7]! << 8);
const height = data[8]! | (data[9]! << 8);
if (width > 0 && height > 0) return { width, height };
}
// WebP: RIFF....WEBP + VP8X / VP8 / VP8L
if (
data.byteLength >= 30 &&
data[0] === 0x52 &&
data[1] === 0x49 &&
data[2] === 0x46 &&
data[3] === 0x46 &&
data[8] === 0x57 &&
data[9] === 0x45 &&
data[10] === 0x42 &&
data[11] === 0x50
) {
const fourcc = String.fromCharCode(data[12]!, data[13]!, data[14]!, data[15]!);
if (fourcc === "VP8X") {
const width = 1 + (data[24]! | (data[25]! << 8) | (data[26]! << 16));
const height = 1 + (data[27]! | (data[28]! << 8) | (data[29]! << 16));
if (width > 0 && height > 0) return { width, height };
} else if (fourcc === "VP8 ") {
if (data[23] === 0x9d && data[24] === 0x01 && data[25] === 0x2a) {
const width = (data[26]! | (data[27]! << 8)) & 0x3fff;
const height = (data[28]! | (data[29]! << 8)) & 0x3fff;
if (width > 0 && height > 0) return { width, height };
}
} else if (fourcc === "VP8L" && data[20] === 0x2f) {
const raw = data[21]! | (data[22]! << 8) | (data[23]! << 16) | (data[24]! << 24);
const width = (raw & 0x3fff) + 1;
const height = ((raw >> 14) & 0x3fff) + 1;
if (width > 0 && height > 0) return { width, height };
}
}
// JPEG: scan for SOF0/SOF2 marker with dimensions
if (data.byteLength >= 4 && data[0] === 0xff && data[1] === 0xd8) {
let offset = 2;
while (offset + 8 < data.byteLength) {
if (data[offset] !== 0xff) break;
const marker = data[offset + 1]!;
// Standalone markers (TEM, RSTn, SOI, EOI) carry no length payload.
if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd9)) {
offset += 2;
continue;
}
const length = (data[offset + 2]! << 8) | data[offset + 3]!;
if (marker === 0xc0 || marker === 0xc2) {
const height = (data[offset + 5]! << 8) | data[offset + 6]!;
const width = (data[offset + 7]! << 8) | data[offset + 8]!;
if (width > 0 && height > 0) return { width, height };
break;
}
if (length < 2) break;
offset += 2 + length;
}
}
return undefined;
}
type PreparedImage = {
data: Buffer;
mimeType: string;
width?: number;
height?: number;
};
/**
* Re-encode toward a JPEG under the soft vision cap when sharp can decode the
* payload. Fail-closed with CursorImageError on unsupported MIME, decode bombs,
* or undecodable bytes. After the quality ladder, edges shrink iteratively
* until the soft byte cap is met (or the min edge floor is hit).
*/
export async function prepareCursorImageForWire(input: {
data: Buffer;
mimeType: string;
detail?: string;
}): Promise<PreparedImage> {
const mime = input.mimeType.toLowerCase();
const softMax = softMaxBytesForDetail(input.detail);
const qualities = jpegQualitiesForDetail(input.detail);
const lowestQuality = qualities[qualities.length - 1]!;
if (!CURSOR_VISION_PASSTHROUGH_MIME.has(mime)) {
throw new CursorImageError("Image input type is unsupported.");
}
const format = sniffCursorImageFormat(input.data);
const sniffed = sniffCursorImageDimensions(input.data);
if (sniffed) {
const edge = Math.max(sniffed.width, sniffed.height);
const pixels = sniffed.width * sniffed.height;
if (edge > MAX_CURSOR_IMAGE_DECODE_EDGE || pixels > MAX_CURSOR_IMAGE_PIXELS) {
throw new CursorImageError("Image input dimensions are too large.");
}
}
// Soft-cap skip: already soft-capped JPEG that has a real SOF (not SOI-only).
const declaredJpeg = mime === "image/jpeg" || mime === "image/jpg";
const alreadySmallJpeg =
declaredJpeg && format === "jpeg" && sniffed !== undefined && input.data.byteLength <= softMax;
if (alreadySmallJpeg) {
return {
data: input.data,
mimeType: "image/jpeg",
width: sniffed!.width,
height: sniffed!.height,
};
}
try {
// Force a full decode before accepting passthrough / encode.
await sharp(input.data, { failOn: "error" }).resize(1, 1).jpeg({ quality: 1 }).toBuffer();
// Passthrough only when declared MIME matches actual JPEG magic.
if (declaredJpeg && format === "jpeg" && input.data.byteLength <= softMax) {
const dims = sniffed ?? (await sharp(input.data).metadata());
const width = typeof dims.width === "number" ? dims.width : undefined;
const height = typeof dims.height === "number" ? dims.height : undefined;
return {
data: input.data,
mimeType: "image/jpeg",
...(width && height && width > 0 && height > 0 ? { width, height } : {}),
};
}
const meta = await sharp(input.data).metadata();
const width = typeof meta.width === "number" ? meta.width : 0;
const height = typeof meta.height === "number" ? meta.height : 0;
if (width > 0 && height > 0) {
const edge = Math.max(width, height);
if (edge > MAX_CURSOR_IMAGE_DECODE_EDGE || width * height > MAX_CURSOR_IMAGE_PIXELS) {
throw new CursorImageError("Image input dimensions are too large.");
}
}
let targetW = width;
let targetH = height;
if (width > 0 && height > 0 && Math.max(width, height) > CURSOR_VISION_MAX_EDGE) {
const scale = CURSOR_VISION_MAX_EDGE / Math.max(width, height);
targetW = Math.max(1, Math.round(width * scale));
targetH = Math.max(1, Math.round(height * scale));
}
const encodeAt = async (w: number, h: number, quality: number): Promise<Buffer> => {
let pipeline = sharp(input.data, { failOn: "error" });
if (w > 0 && h > 0 && (w !== width || h !== height)) {
pipeline = pipeline.resize(w, h);
}
return pipeline.jpeg({ quality, mozjpeg: true }).toBuffer();
};
let best: Buffer | undefined;
for (const quality of qualities) {
const encoded = await encodeAt(targetW, targetH, quality);
if (!best || encoded.byteLength < best.byteLength) best = encoded;
if (encoded.byteLength <= softMax) {
const outDims = sniffCursorImageDimensions(encoded);
return {
data: encoded,
mimeType: "image/jpeg",
...(outDims ?? (targetW > 0 && targetH > 0 ? { width: targetW, height: targetH } : {})),
};
}
}
while (
best &&
best.byteLength > softMax &&
targetW > 0 &&
targetH > 0 &&
Math.max(targetW, targetH) > CURSOR_VISION_SOFT_MIN_EDGE
) {
const nextW = Math.max(1, Math.round(targetW * CURSOR_VISION_SOFT_SHRINK));
const nextH = Math.max(1, Math.round(targetH * CURSOR_VISION_SOFT_SHRINK));
if (Math.max(nextW, nextH) < CURSOR_VISION_SOFT_MIN_EDGE) {
const scale = CURSOR_VISION_SOFT_MIN_EDGE / Math.max(targetW, targetH);
targetW = Math.max(1, Math.round(targetW * scale));
targetH = Math.max(1, Math.round(targetH * scale));
} else {
targetW = nextW;
targetH = nextH;
}
const encoded = await encodeAt(targetW, targetH, lowestQuality);
if (!best || encoded.byteLength < best.byteLength) best = encoded;
if (encoded.byteLength <= softMax) {
const outDims = sniffCursorImageDimensions(encoded);
return {
data: encoded,
mimeType: "image/jpeg",
...(outDims ?? { width: targetW, height: targetH }),
};
}
if (Math.max(targetW, targetH) <= CURSOR_VISION_SOFT_MIN_EDGE) break;
}
if (best) {
const outDims = sniffCursorImageDimensions(best);
return {
data: best,
mimeType: "image/jpeg",
...(outDims ?? (targetW > 0 && targetH > 0 ? { width: targetW, height: targetH } : {})),
};
}
if (declaredJpeg && format !== "jpeg") {
throw new CursorImageError("Image input is not a valid JPEG.");
}
throw new CursorImageError("Image input could not be prepared for Cursor vision.");
} catch (err) {
if (err instanceof CursorImageError) throw err;
throw new CursorImageError("Image input is undecodable or unsupported.");
}
}
/**
* Resolve OpenAI `image_url` URLs (data: or http(s):) into EncodedImage[]
* ready to inline into a cursor request. Each image gets a stable random uuid.
* Throws CursorImageError (clean message, sanitizable) on any invalid /
* oversized / blocked input.
* ready for SelectedImage blobIdWithData encoding. Each image gets a stable
* random uuid. Throws CursorImageError (clean message, sanitizable) on any
* invalid / oversized / blocked / undecodable input.
*/
export async function resolveCursorImages(imageUrls: string[]): Promise<EncodedImage[]> {
export async function resolveCursorImages(
imageUrls: string[],
options?: { detail?: string }
): Promise<EncodedImage[]> {
if (imageUrls.length > MAX_CURSOR_IMAGES) {
throw new CursorImageError(
`Too many images in one request (max ${MAX_CURSOR_IMAGES}).`
);
throw new CursorImageError(`Too many images in one request (max ${MAX_CURSOR_IMAGES}).`);
}
const out: EncodedImage[] = [];
for (const url of imageUrls) {
@@ -314,10 +666,27 @@ export async function resolveCursorImages(imageUrls: string[]): Promise<EncodedI
if (!data.length) {
throw new CursorImageError("Image input is empty.");
}
if (data.length > MAX_CURSOR_IMAGE_BYTES) {
if (data.length > MAX_CURSOR_IMAGE_DECODE_BYTES) {
throw new CursorImageError("Image input is too large to process safely.");
}
const prepared = await prepareCursorImageForWire({
data,
mimeType,
detail: options?.detail,
});
if (prepared.data.length > MAX_CURSOR_IMAGE_BYTES) {
throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry.");
}
out.push({ data, mimeType, uuid: crypto.randomUUID() });
out.push({
data: prepared.data,
mimeType: prepared.mimeType,
uuid: crypto.randomUUID(),
...(typeof prepared.width === "number" && typeof prepared.height === "number"
? { width: prepared.width, height: prepared.height }
: {}),
});
}
return out;
}
@@ -327,17 +696,11 @@ export async function resolveCursorImages(imageUrls: string[]): Promise<EncodedI
* Returns the raw url strings (data: or http(s):) in order. Non-image parts
* are ignored. A plain string content has no images.
*/
export function extractImageUrls(
content: unknown
): string[] {
export function extractImageUrls(content: unknown): string[] {
if (!Array.isArray(content)) return [];
const urls: string[] = [];
for (const part of content) {
if (
part &&
typeof part === "object" &&
(part as { type?: unknown }).type === "image_url"
) {
if (part && typeof part === "object" && (part as { type?: unknown }).type === "image_url") {
const imageUrl = (part as { image_url?: unknown }).image_url;
if (typeof imageUrl === "string") {
urls.push(imageUrl);

4
package-lock.json generated
View File

@@ -73,6 +73,7 @@
"recharts": "^3.8.1",
"safe-regex": "^2.1.1",
"selfsigned": "^5.5.0",
"sharp": "^0.35.3",
"smol-toml": "1.7.1",
"socks": "^2.8.7",
"sql.js": "^1.14.1",
@@ -3560,7 +3561,6 @@
"resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
"integrity": "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==",
"license": "MIT",
"optional": true,
"engines": {
"node": ">=18"
}
@@ -32778,7 +32778,6 @@
"resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.3.tgz",
"integrity": "sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==",
"license": "Apache-2.0",
"optional": true,
"dependencies": {
"@img/colour": "^1.1.0",
"detect-libc": "^2.1.2",
@@ -32828,7 +32827,6 @@
"resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
"integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
"license": "ISC",
"optional": true,
"bin": {
"semver": "bin/semver.js"
},

1
package.json
View File

@@ -311,6 +311,7 @@
"recharts": "^3.8.1",
"safe-regex": "^2.1.1",
"selfsigned": "^5.5.0",
"sharp": "^0.35.3",
"smol-toml": "1.7.1",
"socks": "^2.8.7",
"sql.js": "^1.14.1",

222
tests/unit/cursor-image-input.test.ts
View File

@@ -1,18 +1,25 @@
import test from "node:test";
import assert from "node:assert/strict";
import crypto from "node:crypto";
import dns from "node:dns";
import sharp from "sharp";
import {
encodeSelectedImageBody,
encodeAgentRunRequest,
type EncodedImage,
} from "../../open-sse/utils/cursorAgentProtobuf";
import dns from "node:dns";
import {
resolveCursorImages,
extractImageUrls,
assertResolvedAddressesPublic,
prepareCursorImageForWire,
sniffCursorImageDimensions,
sniffCursorImageFormat,
CursorImageError,
MAX_CURSOR_IMAGE_BYTES,
MAX_CURSOR_IMAGE_DECODE_BYTES,
MAX_CURSOR_IMAGES,
CURSOR_VISION_SOFT_MAX_BYTES,
} from "../../open-sse/utils/cursorImages";
import { CursorExecutor } from "../../open-sse/executors/cursor";
@@ -20,12 +27,36 @@ import { CursorExecutor } from "../../open-sse/executors/cursor";
// example hostnames) pass the DNS-rebinding gate.
const PUBLIC_IP = [{ address: "93.184.216.34", family: 4 }];
/** Tiny valid 1x1 PNG (red pixel). */
const TINY_PNG = Buffer.from(
"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==",
"base64"
);
async function makeTinyJpeg(): Promise<Buffer> {
return sharp({
create: { width: 8, height: 8, channels: 3, background: { r: 20, g: 40, b: 60 } },
})
.jpeg({ quality: 80 })
.toBuffer();
}
async function makeLargePng(edge = 1200): Promise<Buffer> {
// Uncompressed-ish PNG well over the soft cap but under the decode ceiling.
return sharp({
create: {
width: edge,
height: edge,
channels: 3,
background: { r: 180, g: 90, b: 30 },
},
})
.png({ compressionLevel: 0 })
.toBuffer();
}
// ─── Minimal protobuf field walker (test-only) ──────────────────────────────
// Mirrors the production decoder enough to assert field layout without exposing
// the internal decodeFields helper.
type WalkField =
| { fn: number; wt: 0; varint: bigint }
| { fn: number; wt: 2; bytes: Buffer };
type WalkField = { fn: number; wt: 0; varint: bigint } | { fn: number; wt: 2; bytes: Buffer };
function walk(buf: Buffer): WalkField[] {
const out: WalkField[] = [];
@@ -68,9 +99,6 @@ const lenBytes = (fields: WalkField[], fn: number): Buffer => {
return Buffer.from((f as { bytes: Buffer }).bytes);
};
// Navigate AgentClientMessage(1) -> AgentRunRequest -> action(2) ->
// ConversationAction -> user_message_action(1) -> UserMessageAction ->
// user_message(1) -> UserMessage.
function navUserMessage(req: Buffer): WalkField[] {
const acm = walk(req);
const arr = walk(lenBytes(acm, 1));
@@ -79,34 +107,56 @@ function navUserMessage(req: Buffer): WalkField[] {
return walk(lenBytes(uma, 1));
}
function decodeBlobIdWithData(fields: WalkField[]): { blobId: Buffer; data: Buffer } {
assert.equal(find(fields, 8), undefined, "legacy field 8 (data) must be absent");
const nested = walk(lenBytes(fields, 9));
return {
blobId: lenBytes(nested, 1),
data: lenBytes(nested, 2),
};
}
// ─── encodeSelectedImageBody field layout ───────────────────────────────────
test("encodeSelectedImageBody emits uuid(2), dimension(4), mime_type(7), data(8)", () => {
test("encodeSelectedImageBody emits uuid(2), path(3), dimension(4), mime_type(7), blobIdWithData(9)", () => {
const data = Buffer.from([1, 2, 3, 4, 5]);
const body = encodeSelectedImageBody({
data,
mimeType: "image/png",
width: 10,
height: 20,
uuid: "abc-123",
});
const blobStore = new Map<string, Buffer>();
const body = encodeSelectedImageBody(
{
data,
mimeType: "image/png",
width: 10,
height: 20,
uuid: "abc-123",
},
blobStore
);
const fields = walk(body);
assert.equal(lenBytes(fields, 2).toString("utf8"), "abc-123"); // uuid
assert.equal(lenBytes(fields, 3).toString("utf8"), "attachment-abc-123.png"); // path
const dim = walk(lenBytes(fields, 4)); // dimension submessage
assert.equal(Number((find(dim, 1) as { varint: bigint }).varint), 10); // width
assert.equal(Number((find(dim, 2) as { varint: bigint }).varint), 20); // height
assert.equal(lenBytes(fields, 7).toString("utf8"), "image/png"); // mime_type
assert.deepEqual(lenBytes(fields, 8), data); // inline data (oneof case)
const expectedBlobId = crypto.createHash("sha256").update(data).digest();
const { blobId, data: nestedData } = decodeBlobIdWithData(fields);
assert.deepEqual(blobId, expectedBlobId);
assert.deepEqual(nestedData, data);
assert.deepEqual(blobStore.get(expectedBlobId.toString("hex")), data);
});
test("encodeSelectedImageBody omits dimension/mime_type when not provided", () => {
const body = encodeSelectedImageBody({ data: Buffer.from([9]), uuid: "u" });
const data = Buffer.from([9]);
const body = encodeSelectedImageBody({ data, uuid: "u" });
const fields = walk(body);
assert.equal(find(fields, 4), undefined, "no dimension");
assert.equal(find(fields, 7), undefined, "no mime_type");
assert.ok(find(fields, 2), "uuid present");
assert.deepEqual(lenBytes(fields, 8), Buffer.from([9]), "data present");
assert.ok(find(fields, 3), "path present");
const { data: nestedData } = decodeBlobIdWithData(fields);
assert.deepEqual(nestedData, data);
});
test("encodeSelectedImageBody omits dimension when width/height are invalid", () => {
@@ -134,7 +184,6 @@ test("no-image request is byte-identical to images:undefined and images:[]", ()
assert.ok(plain.equals(undef), "images:undefined matches no images");
assert.ok(plain.equals(empty), "images:[] matches no images");
// And selected_context (field 3) is present but empty in the no-image case.
const um = navUserMessage(plain);
const sc = find(um, 3);
assert.ok(sc && sc.wt === 2, "selected_context present");
@@ -143,17 +192,19 @@ test("no-image request is byte-identical to images:undefined and images:[]", ()
// ─── Images attach under UserMessage.selected_context.selected_images ────────
test("images attach as selected_context.selected_images[] with inline data", () => {
test("images attach as selected_context.selected_images[] with blobIdWithData", () => {
const imgs: EncodedImage[] = [
{ data: Buffer.from([0xaa, 0xbb]), mimeType: "image/png", uuid: "u1" },
{ data: Buffer.from([0xcc]), mimeType: "image/jpeg", uuid: "u2" },
];
const blobStore = new Map<string, Buffer>();
const req = encodeAgentRunRequest({
modelId: "gpt-5.2",
userText: "what colors?",
conversationId: "c",
messageId: "m",
images: imgs,
blobStore,
});
const um = navUserMessage(req);
const sc = walk(lenBytes(um, 3)); // SelectedContext
@@ -163,12 +214,14 @@ test("images attach as selected_context.selected_images[] with inline data", ()
const first = walk(Buffer.from((selectedImages[0] as { bytes: Buffer }).bytes));
assert.equal(lenBytes(first, 2).toString("utf8"), "u1");
assert.equal(lenBytes(first, 7).toString("utf8"), "image/png");
assert.deepEqual(lenBytes(first, 8), Buffer.from([0xaa, 0xbb]));
const firstNested = decodeBlobIdWithData(first);
assert.deepEqual(firstNested.data, Buffer.from([0xaa, 0xbb]));
assert.deepEqual(blobStore.get(firstNested.blobId.toString("hex")), Buffer.from([0xaa, 0xbb]));
const second = walk(Buffer.from((selectedImages[1] as { bytes: Buffer }).bytes));
assert.deepEqual(lenBytes(second, 8), Buffer.from([0xcc]));
const secondNested = decodeBlobIdWithData(second);
assert.deepEqual(secondNested.data, Buffer.from([0xcc]));
// UserMessage.text (field 1) still carries the prompt text alongside images.
assert.equal(lenBytes(um, 1).toString("utf8"), "what colors?");
});
@@ -178,11 +231,11 @@ test("extractImageUrls pulls urls from object and string image_url parts", () =>
assert.deepEqual(
extractImageUrls([
{ type: "text", text: "hi" },
{ type: "image_url", image_url: { url: "data:image/png;base64,AA" } },
{ type: "image_url", image_url: { url: "data:image/png;base64,AA==" } },
{ type: "image_url", image_url: "https://x.test/y.png" },
{ type: "image_url", image_url: { detail: "high" } }, // no url -> ignored
]),
["data:image/png;base64,AA", "https://x.test/y.png"]
["data:image/png;base64,AA==", "https://x.test/y.png"]
);
assert.deepEqual(extractImageUrls("plain string content"), []);
assert.deepEqual(extractImageUrls(null), []);
@@ -191,12 +244,14 @@ test("extractImageUrls pulls urls from object and string image_url parts", () =>
// ─── resolveCursorImages: happy path ────────────────────────────────────────
test("resolveCursorImages decodes a valid base64 data URI", async () => {
const png = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
const out = await resolveCursorImages([`data:image/png;base64,${png.toString("base64")}`]);
const out = await resolveCursorImages([`data:image/png;base64,${TINY_PNG.toString("base64")}`]);
assert.equal(out.length, 1);
assert.deepEqual(out[0].data, png);
assert.equal(out[0].mimeType, "image/png");
assert.equal(out[0].mimeType, "image/jpeg"); // soft-cap prep re-encodes to JPEG
assert.ok(out[0].data.length > 0);
assert.ok(out[0].data.length <= CURSOR_VISION_SOFT_MAX_BYTES);
assert.ok(out[0].uuid && out[0].uuid.length > 0);
assert.equal(out[0].width, 1);
assert.equal(out[0].height, 1);
});
// ─── resolveCursorImages: rejections (all CursorImageError, all sanitized) ───
@@ -215,6 +270,15 @@ test("resolveCursorImages rejects invalid base64", async () => {
);
});
test("resolveCursorImages rejects base64 with trailing garbage (strict round-trip)", async () => {
// Buffer.from would silently drop the trailing "!!!!" — we must reject.
const padded = `${TINY_PNG.toString("base64")}!!!!`;
await assert.rejects(
() => resolveCursorImages([`data:image/png;base64,${padded}`]),
(e) => e instanceof CursorImageError
);
});
test("resolveCursorImages rejects a non-base64 data URI", async () => {
await assert.rejects(
() => resolveCursorImages(["data:image/png,not-base64-payload"]),
@@ -222,8 +286,8 @@ test("resolveCursorImages rejects a non-base64 data URI", async () => {
);
});
test("resolveCursorImages rejects an oversized image (>1 MiB)", async () => {
const big = Buffer.alloc(MAX_CURSOR_IMAGE_BYTES + 16).toString("base64");
test("resolveCursorImages rejects an oversized image over the decode ceiling", async () => {
const big = Buffer.alloc(MAX_CURSOR_IMAGE_DECODE_BYTES + 16).toString("base64");
await assert.rejects(
() => resolveCursorImages([`data:image/png;base64,${big}`]),
(e) => e instanceof CursorImageError
@@ -248,7 +312,7 @@ test("resolveCursorImages blocks SSRF targets (localhost, link-local, file://)",
});
test("resolveCursorImages rejects too many images", async () => {
const one = "data:image/png;base64,AAAA";
const one = `data:image/png;base64,${TINY_PNG.toString("base64")}`;
await assert.rejects(
() => resolveCursorImages(Array.from({ length: MAX_CURSOR_IMAGES + 1 }, () => one)),
(e) => e instanceof CursorImageError
@@ -256,26 +320,27 @@ test("resolveCursorImages rejects too many images", async () => {
});
test("resolveCursorImages accepts an uppercase DATA: scheme (RFC 2397 case-insensitive)", async () => {
const png = Buffer.from([137, 80, 78, 71]);
const out = await resolveCursorImages([`DATA:image/png;base64,${png.toString("base64")}`]);
const out = await resolveCursorImages([`DATA:image/png;base64,${TINY_PNG.toString("base64")}`]);
assert.equal(out.length, 1);
assert.deepEqual(out[0].data, png);
assert.equal(out[0].mimeType, "image/png");
assert.equal(out[0].mimeType, "image/jpeg");
assert.ok(out[0].data.length > 0);
});
test("assertResolvedAddressesPublic blocks private/metadata IPs, allows public", () => {
for (const ip of ["127.0.0.1", "10.0.0.1", "169.254.169.254", "192.168.1.1", "::1", "fd00::1"]) {
assert.throws(() => assertResolvedAddressesPublic([ip]), CursorImageError, `should block ${ip}`);
assert.throws(
() => assertResolvedAddressesPublic([ip]),
CursorImageError,
`should block ${ip}`
);
}
assert.doesNotThrow(() => assertResolvedAddressesPublic(["93.184.216.34", "1.1.1.1"]));
// A single private answer among public ones still blocks (DNS-rebinding).
assert.throws(() => assertResolvedAddressesPublic(["8.8.8.8", "127.0.0.1"]), CursorImageError);
});
test("resolveCursorImages blocks DNS rebinding (public host resolving to a private IP)", async (t) => {
t.mock.method(dns.promises, "lookup", async () => [{ address: "127.0.0.1", family: 4 }]);
const realFetch = globalThis.fetch;
// fetch should never be reached — the DNS gate blocks first.
globalThis.fetch = async () => {
throw new Error("fetch must not run for a rebinding host");
};
@@ -290,9 +355,6 @@ test("resolveCursorImages blocks DNS rebinding (public host resolving to a priva
});
test("resolveCursorImages re-validates redirects: a 30x to a private host is blocked (SSRF)", async (t) => {
// fetch() follows redirects by default; the resolver uses redirect:"manual"
// and re-validates each hop. A public URL that 302s to 127.0.0.1 must be
// blocked, not followed.
t.mock.method(dns.promises, "lookup", async () => PUBLIC_IP);
const realFetch = globalThis.fetch;
globalThis.fetch = async () =>
@@ -309,7 +371,6 @@ test("resolveCursorImages re-validates redirects: a 30x to a private host is blo
test("resolveCursorImages follows a redirect to another public host and reads the image", async (t) => {
t.mock.method(dns.promises, "lookup", async () => PUBLIC_IP);
const png = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
const realFetch = globalThis.fetch;
let call = 0;
globalThis.fetch = async () => {
@@ -320,7 +381,7 @@ test("resolveCursorImages follows a redirect to another public host and reads th
headers: { location: "https://cdn.public.example/a.png" },
});
}
return new Response(new Uint8Array(png), {
return new Response(new Uint8Array(TINY_PNG), {
status: 200,
headers: { "content-type": "image/png" },
});
@@ -328,8 +389,9 @@ test("resolveCursorImages follows a redirect to another public host and reads th
try {
const out = await resolveCursorImages(["https://public.example/a.png"]);
assert.equal(out.length, 1);
assert.deepEqual(out[0].data, png);
assert.equal(out[0].mimeType, "image/png");
assert.equal(out[0].mimeType, "image/jpeg");
assert.ok(out[0].data.length > 0);
assert.ok(out[0].data.length <= MAX_CURSOR_IMAGE_BYTES);
} finally {
globalThis.fetch = realFetch;
}
@@ -353,13 +415,67 @@ test("resolveCursorImages rejects an over-long redirect chain", async (t) => {
}
});
// ─── JPEG soft-cap / sniff regressions ──────────────────────────────────────
test("prepareCursorImageForWire re-encodes a large PNG under the soft cap", async () => {
const large = await makeLargePng(1400);
assert.ok(large.length > CURSOR_VISION_SOFT_MAX_BYTES, "fixture must exceed soft cap");
assert.ok(large.length < MAX_CURSOR_IMAGE_DECODE_BYTES, "fixture under decode ceiling");
const prepared = await prepareCursorImageForWire({
data: large,
mimeType: "image/png",
});
assert.equal(prepared.mimeType, "image/jpeg");
assert.ok(prepared.data.length <= CURSOR_VISION_SOFT_MAX_BYTES);
assert.ok(prepared.data.length <= MAX_CURSOR_IMAGE_BYTES);
assert.equal(sniffCursorImageFormat(prepared.data), "jpeg");
const dims = sniffCursorImageDimensions(prepared.data);
assert.ok(dims && dims.width > 0 && dims.height > 0);
});
test("prepareCursorImageForWire does not passthrough mislabeled PNG-as-JPEG", async () => {
// Declared JPEG but bytes are PNG — must re-encode (or fail), never SOI-less passthrough.
const prepared = await prepareCursorImageForWire({
data: TINY_PNG,
mimeType: "image/jpeg",
});
assert.equal(prepared.mimeType, "image/jpeg");
assert.equal(sniffCursorImageFormat(prepared.data), "jpeg");
assert.ok(sniffCursorImageDimensions(prepared.data), "JPEG must have a real SOF");
});
test("prepareCursorImageForWire skips re-encode for small real JPEG with SOF", async () => {
const jpeg = await makeTinyJpeg();
assert.ok(jpeg.length <= CURSOR_VISION_SOFT_MAX_BYTES);
assert.equal(sniffCursorImageFormat(jpeg), "jpeg");
assert.ok(sniffCursorImageDimensions(jpeg), "fixture must have SOF dims");
const prepared = await prepareCursorImageForWire({
data: jpeg,
mimeType: "image/jpeg",
});
assert.deepEqual(prepared.data, jpeg);
assert.equal(prepared.mimeType, "image/jpeg");
});
test("sniffCursorImageDimensions reads PNG IHDR", () => {
const dims = sniffCursorImageDimensions(TINY_PNG);
assert.deepEqual(dims, { width: 1, height: 1 });
});
test("resolveCursorImages soft-caps a large PNG under the wire budget", async () => {
const large = await makeLargePng(1400);
const out = await resolveCursorImages([`data:image/png;base64,${large.toString("base64")}`]);
assert.equal(out.length, 1);
assert.equal(out[0].mimeType, "image/jpeg");
assert.ok(out[0].data.length <= CURSOR_VISION_SOFT_MAX_BYTES);
assert.ok(out[0].data.length <= MAX_CURSOR_IMAGE_BYTES);
});
// ─── Executor-level error body (response path, hard rule #12) ───────────────
test("executor returns a sanitized 400 for an oversized image", async () => {
// buildRequest throws CursorImageError before any network/session/DB work,
// so this stays fully offline (no token needed).
const exec = new CursorExecutor();
const big = Buffer.alloc(MAX_CURSOR_IMAGE_BYTES + 16).toString("base64");
const big = Buffer.alloc(MAX_CURSOR_IMAGE_DECODE_BYTES + 16).toString("base64");
const result = await exec.execute({
model: "gpt-5.2",
body: {
@@ -383,7 +499,6 @@ test("executor returns a sanitized 400 for an oversized image", async () => {
const body = await result.response.json();
assert.ok(body.error, "error envelope present");
assert.match(body.error.message, /too large/i);
// No stack-trace / source-path leakage in the response body (hard rule #12).
assert.ok(!body.error.message.includes("at /"), "no stack frame in error body");
assert.ok(!/\/(root|home|usr)\//.test(body.error.message), "no absolute path in error body");
});
@@ -415,9 +530,6 @@ test("executor returns a sanitized 400 for an SSRF-blocked image URL", async ()
});
test("CursorImageError messages never leak stack traces or paths", async () => {
// Every rejection message must be a clean human string (no "at /" frames,
// no absolute paths) so the executor's sanitized 400 body stays clean
// (hard rule #12).
const triggers = [
"data:text/plain;base64,aGVsbG8=",
"data:image/png;base64,@@@@",