From aca0e4d14c015fb259e8ca3793c2fb69d01bcf52 Mon Sep 17 00:00:00 2001 From: SB Yoon <44089734+yansigit@users.noreply.github.com> Date: Sat, 8 Aug 2026 21:51:22 -0600 Subject: [PATCH] fix(cursor): hydrate SelectedImage via blobIdWithData + JPEG soft-cap Cursor vision expects SelectedImage.blob_id_with_data (field 9) backed by the session blobStore, and large clipboard PNGs need JPEG soft-cap prep rather than a hard 1 MiB reject before encode. --- open-sse/utils/cursorAgentProtobuf.ts | 85 +++-- open-sse/utils/cursorImages.ts | 449 +++++++++++++++++++++++--- package-lock.json | 4 +- package.json | 1 + tests/unit/cursor-image-input.test.ts | 222 +++++++++---- 5 files changed, 638 insertions(+), 123 deletions(-) diff --git a/open-sse/utils/cursorAgentProtobuf.ts b/open-sse/utils/cursorAgentProtobuf.ts index 106c29ecba..cc3162fb9e 100644 --- a/open-sse/utils/cursorAgentProtobuf.ts +++ b/open-sse/utils/cursorAgentProtobuf.ts @@ -69,15 +69,21 @@ const UM_MODE = 4; // UserMessage.mode (cursor-agent sends 1) // encoder for shape). Images attach to the current UserMessage through its // selected_context (field 3): UserMessage.selected_context is a SelectedContext // whose `selected_images` (field 1) is a repeated SelectedImage. Each -// SelectedImage carries the raw bytes inline in its `data_or_blob_id` oneof -// (the `data` case, field 8) — cursor-agent's CLI instead sends a local file -// `path`, which a proxy cannot use, so we inline the bytes like composer-api. +// SelectedImage uses the `blob_id_with_data` oneof case (field 9) so Cursor can +// hydrate via getBlob while also receiving the bytes inline for cache warm-up. +// Field 8 (`data`) is intentionally not written — live Cursor hydration expects +// blobIdWithData. We also set `path` like native/shunt clients. const SC_SELECTED_IMAGES = 1; // SelectedContext.selected_images [repeated SelectedImage] const SI_UUID = 2; // SelectedImage.uuid +const SI_PATH = 3; // SelectedImage.path const SI_DIMENSION = 4; // SelectedImage.dimension (SelectedImage.Dimension) const SI_MIME_TYPE = 7; // SelectedImage.mime_type -const SI_DATA = 8; // SelectedImage.data (oneof data_or_blob_id) — inline image bytes +// Field 8 (SelectedImage.data) is the legacy inline oneof case — not written. +const SI_BLOB_ID_WITH_DATA = 9; // SelectedImage.blob_id_with_data (oneof) + +const SIBD_BLOB_ID = 1; // SelectedImage.BlobIdWithData.blob_id +const SIBD_DATA = 2; // SelectedImage.BlobIdWithData.data const DIM_WIDTH = 1; // SelectedImage.Dimension.width (int32) const DIM_HEIGHT = 2; // SelectedImage.Dimension.height (int32) @@ -413,18 +419,19 @@ export type AgentRunInput = { // which the executor's processFrame replies to with the stored bytes. systemPrompt?: string; blobStore?: Map; - // Vision input: images attached to the current user turn. Encoded inline as - // SelectedContext.selected_images[] (see encodeSelectedImageBody). Empty / - // undefined keeps the request byte-identical to the text-only path. + // Vision input: images attached to the current user turn. Encoded as + // SelectedContext.selected_images[] via blobIdWithData (see + // encodeSelectedImageBody). Empty / undefined keeps the request + // byte-identical to the text-only path. images?: EncodedImage[]; }; /** * A resolved image ready to embed in a cursor request. `data` is the raw - * decoded image bytes (already SSRF-checked / size-capped by the executor's - * resolveCursorImages helper). `mimeType` (e.g. "image/png") helps cursor - * decode the inline bytes; `width`/`height` populate the optional Dimension - * sub-message when cheaply known; `uuid` is a stable per-image id. + * decoded image bytes (already SSRF-checked / size-capped / JPEG-prepped by + * resolveCursorImages). `mimeType` (e.g. "image/png") helps cursor decode + * the bytes; `width`/`height` populate the optional Dimension sub-message + * when cheaply known; `uuid` is a stable per-image id. */ export type EncodedImage = { data: Buffer; @@ -434,14 +441,41 @@ export type EncodedImage = { uuid: string; }; +/** Filename Cursor clients typically put on SelectedImage.path. */ +export function cursorImageAttachmentPath(uuid: string, mimeType?: string): string { + const normalized = (mimeType || "").toLowerCase(); + const ext = + normalized === "image/jpeg" || normalized === "image/jpg" + ? "jpg" + : normalized === "image/gif" + ? "gif" + : normalized === "image/webp" + ? "webp" + : "png"; + return `attachment-${uuid}.${ext}`; +} + /** * Encode the body of a SelectedImage message (no outer field tag — the caller - * wraps it via encodeMessage(SC_SELECTED_IMAGES, [body])). Sets the inline - * `data` oneof case plus uuid, optional dimension, and mime_type. Fields are - * written in ascending field-number order (canonical protobuf layout). + * wraps it via encodeMessage(SC_SELECTED_IMAGES, [body])). Uses the + * `blob_id_with_data` oneof case (field 9), stores sha256(data) → bytes in + * `blobStore` when provided (same map as system-prompt getBlob), and sets + * path/uuid/optional dimension/mime_type. Fields are written in ascending + * field-number order (canonical protobuf layout). */ -export function encodeSelectedImageBody(img: EncodedImage): Buffer { - const parts: Buffer[] = [encodeString(SI_UUID, img.uuid)]; +export function encodeSelectedImageBody( + img: EncodedImage, + blobStore?: Map +): Buffer { + const blobId = crypto.createHash("sha256").update(img.data).digest(); + if (blobStore) { + blobStore.set(blobId.toString("hex"), img.data); + } + + const parts: Buffer[] = [ + encodeString(SI_UUID, img.uuid), + encodeString(SI_PATH, cursorImageAttachmentPath(img.uuid, img.mimeType)), + ]; if ( typeof img.width === "number" && typeof img.height === "number" && @@ -460,9 +494,13 @@ export function encodeSelectedImageBody(img: EncodedImage): Buffer { if (img.mimeType) { parts.push(encodeString(SI_MIME_TYPE, img.mimeType)); } - // data_or_blob_id oneof = data (inline bytes) — field 8, written last to - // keep ascending field order. - parts.push(encodeBytes(SI_DATA, img.data)); + // data_or_blob_id oneof = blob_id_with_data — field 9 (not legacy field 8). + parts.push( + encodeMessage(SI_BLOB_ID_WITH_DATA, [ + encodeBytes(SIBD_BLOB_ID, blobId), + encodeBytes(SIBD_DATA, img.data), + ]) + ); return Buffer.concat(parts); } @@ -493,12 +531,15 @@ export function encodeAgentRunRequest(input: AgentRunInput): Buffer { // UserMessage { text, message_id, selected_context, mode=1 }. // selected_context is normally an empty placeholder (required by the server // even when empty — see below), but when the turn carries vision input we - // populate its selected_images[] with the inline-encoded images. The - // empty-images path produces byte-identical output to the text-only request. + // populate its selected_images[] with blobIdWithData-encoded images (and + // store the bytes in blobStore for getBlob). The empty-images path produces + // byte-identical output to the text-only request. const selectedContextParts: Buffer[] = []; if (input.images && input.images.length > 0) { for (const img of input.images) { - selectedContextParts.push(encodeMessage(SC_SELECTED_IMAGES, [encodeSelectedImageBody(img)])); + selectedContextParts.push( + encodeMessage(SC_SELECTED_IMAGES, [encodeSelectedImageBody(img, input.blobStore)]) + ); } } // The empty selected_context placeholder and mode=1 match cursor-agent's diff --git a/open-sse/utils/cursorImages.ts b/open-sse/utils/cursorImages.ts index 29e669f57e..bd29dcabf5 100644 --- a/open-sse/utils/cursorImages.ts +++ b/open-sse/utils/cursorImages.ts @@ -2,8 +2,8 @@ * Image resolution + security for Cursor vision input. * * Turns OpenAI `image_url` parts (base64 `data:` URIs or remote `http(s)` - * URLs) into decoded bytes ready to inline into a cursor SelectedImage - * (see ../utils/cursorAgentProtobuf.ts::encodeSelectedImageBody). + * URLs) into decoded, JPEG-prepped bytes ready for SelectedImage + * `blobIdWithData` encoding (see cursorAgentProtobuf.ts). * * Security (OmniRoute hard rules): * - SSRF: remote fetches go through the repo's canonical outbound guard @@ -12,9 +12,9 @@ * cloud-metadata hostnames. Client-supplied image URLs are always held to * the strict public-only policy (never gated by the private-URL toggle that * admin-configured provider URLs use). - * - Size cap: each image must decode to <= 1 MiB (matches composer-api). - * Enforced both before base64 decode (cheap pre-check) and while streaming - * a remote body (so a hostile server can't stream gigabytes). + * - Size caps: inbound decode/fetch is bounded (16 MiB) so large clipboard + * PNGs can shrink via JPEG soft-cap prep; the final wire image must be + * <= 1 MiB. Soft target is ~100 KiB JPEG for reliable Cursor hydration. * - Content type: data URIs and URL responses must be `image/*`. * - Errors throw `CursorImageError` with a clean, path-free message; the * executor routes it through the sanitized 400 path (hard rule #12). @@ -23,6 +23,7 @@ import crypto from "node:crypto"; import dns from "node:dns"; import { isIP } from "node:net"; +import sharp from "sharp"; import { parseAndValidatePublicUrl, isPrivateHost, @@ -30,14 +31,47 @@ import { } from "@/shared/network/outboundUrlGuard"; import type { EncodedImage } from "./cursorAgentProtobuf.ts"; -// 1 MiB per image — matches composer-api's MAX_CURSOR_IMAGE_BYTES. Large -// enough for a typical screenshot, small enough to bound request size and -// memory. +/** Final per-image byte cap after prep (composer-api / wire bound). */ export const MAX_CURSOR_IMAGE_BYTES = 1024 * 1024; -// Upper bound on the number of images per request. Each image triggers (at -// most) one remote fetch, so an unbounded count is a DoS vector; 12 is well -// above any realistic vision prompt. +/** + * Inbound decode/fetch bomb ceiling before JPEG prep. Large clipboard PNGs may + * exceed {@link MAX_CURSOR_IMAGE_BYTES} raw but shrink under the wire cap after + * re-encode. + */ +export const MAX_CURSOR_IMAGE_DECODE_BYTES = 16 * 1024 * 1024; + +/** + * Soft target for Cursor vision hydration. Prefer JPEG at or under this size. + */ +export const CURSOR_VISION_SOFT_MAX_BYTES = 100 * 1024; + +/** Soft target when the client requests `detail: original` or `high`. */ +export const CURSOR_VISION_SOFT_MAX_BYTES_HIGH = 256 * 1024; + +/** Longest edge after Cursor vision prep. */ +export const CURSOR_VISION_MAX_EDGE = 2000; + +/** Decode bomb: reject images whose sniffed longest edge exceeds this. */ +export const MAX_CURSOR_IMAGE_DECODE_EDGE = 8192; + +/** Decode bomb: reject images whose sniffed pixel count exceeds this. */ +export const MAX_CURSOR_IMAGE_PIXELS = 25_000_000; + +const CURSOR_VISION_JPEG_QUALITIES_DEFAULT = [85, 70, 55, 40] as const; +const CURSOR_VISION_JPEG_QUALITIES_HIGH = [90, 80, 65, 50] as const; +const CURSOR_VISION_SOFT_MIN_EDGE = 256; +const CURSOR_VISION_SOFT_SHRINK = 0.85; + +const CURSOR_VISION_PASSTHROUGH_MIME = new Set([ + "image/jpeg", + "image/jpg", + "image/png", + "image/gif", + "image/webp", +]); + +/** Upper bound on images attached to one Cursor turn. */ export const MAX_CURSOR_IMAGES = 12; // Wall-clock cap for a single remote image fetch. A malformed env value @@ -64,6 +98,25 @@ export class CursorImageError extends Error { } } +function estimatedBase64DecodedBytes(payload: string): number { + return Math.floor((payload.length * 3) / 4); +} + +function isHighDetail(detail: string | undefined): boolean { + const normalized = (detail || "").toLowerCase(); + return normalized === "high" || normalized === "original"; +} + +function softMaxBytesForDetail(detail: string | undefined): number { + return isHighDetail(detail) ? CURSOR_VISION_SOFT_MAX_BYTES_HIGH : CURSOR_VISION_SOFT_MAX_BYTES; +} + +function jpegQualitiesForDetail(detail: string | undefined): readonly number[] { + return isHighDetail(detail) + ? CURSOR_VISION_JPEG_QUALITIES_HIGH + : CURSOR_VISION_JPEG_QUALITIES_DEFAULT; +} + function decodeDataUrl(url: string): { data: Buffer; mimeType: string } { // data:[][;base64], const comma = url.indexOf(","); @@ -86,16 +139,21 @@ function decodeDataUrl(url: string): { data: Buffer; mimeType: string } { // Reject on the raw payload length BEFORE the regex/normalize pass, so an // arbitrarily large data URL can't burn CPU on the whitespace strip. Base64 - // expands ~4:3, so 2x the byte cap is a safe upper bound on the encoded text. - if (payload.length > MAX_CURSOR_IMAGE_BYTES * 2) { - throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry."); + // expands ~4:3, so 2x the decode ceiling is a safe upper bound on the text. + if (payload.length > MAX_CURSOR_IMAGE_DECODE_BYTES * 2) { + throw new CursorImageError("Image input is too large to process safely."); } const normalized = payload.replace(/\s/g, ""); - // Cheap pre-check: 4 base64 chars -> 3 bytes. Reject obviously oversized - // payloads before allocating the decode buffer. - if (Math.floor((normalized.length * 3) / 4) > MAX_CURSOR_IMAGE_BYTES) { - throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry."); + if (normalized.length === 0) { + throw new CursorImageError("Image data URL contains invalid base64 data."); + } + // Reject lenient Buffer.from acceptances (wrong alphabet, bad padding). + if (normalized.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(normalized)) { + throw new CursorImageError("Image data URL contains invalid base64 data."); + } + if (estimatedBase64DecodedBytes(normalized) > MAX_CURSOR_IMAGE_DECODE_BYTES) { + throw new CursorImageError("Image input is too large to process safely."); } let data: Buffer; @@ -104,11 +162,16 @@ function decodeDataUrl(url: string): { data: Buffer; mimeType: string } { } catch { throw new CursorImageError("Image data URL contains invalid base64 data."); } - // Buffer.from(base64) silently drops invalid trailing chars; guard against a - // payload that decoded to nothing despite being non-empty. - if (normalized.length > 0 && data.length === 0) { + if (data.length === 0) { throw new CursorImageError("Image data URL contains invalid base64 data."); } + // Round-trip guard: Node can silently drop trailing garbage. + if (data.toString("base64").replace(/=+$/, "") !== normalized.replace(/=+$/, "")) { + throw new CursorImageError("Image data URL contains invalid base64 data."); + } + if (data.length > MAX_CURSOR_IMAGE_DECODE_BYTES) { + throw new CursorImageError("Image input is too large to process safely."); + } return { data, mimeType }; } @@ -216,10 +279,10 @@ async function fetchImageBytes(url: string): Promise<{ data: Buffer; mimeType: s // Reject early on an oversized Content-Length, then still cap during read // (the header is advisory / may be absent). const declaredLen = Number(response.headers.get("content-length") || "0"); - if (Number.isFinite(declaredLen) && declaredLen > MAX_CURSOR_IMAGE_BYTES) { - throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry."); + if (Number.isFinite(declaredLen) && declaredLen > MAX_CURSOR_IMAGE_DECODE_BYTES) { + throw new CursorImageError("Image input is too large to process safely."); } - const data = await readCapped(response, MAX_CURSOR_IMAGE_BYTES); + const data = await readCapped(response, MAX_CURSOR_IMAGE_DECODE_BYTES); return { data, mimeType }; } finally { clearTimeout(timer); @@ -249,7 +312,7 @@ async function readCapped(response: Response, cap: number): Promise { const pushCapped = (chunk: Uint8Array) => { total += chunk.byteLength; if (total > cap) { - throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry."); + throw new CursorImageError("Image input is too large to process safely."); } chunks.push(Buffer.from(chunk)); }; @@ -284,22 +347,311 @@ async function readCapped(response: Response, cap: number): Promise { // Last resort: buffer then cap-check (only exotic non-stream bodies). const buf = Buffer.from(await response.arrayBuffer()); if (buf.length > cap) { - throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry."); + throw new CursorImageError("Image input is too large to process safely."); } return buf; } +/** Magic-byte format sniff (independent of declared MIME). */ +export function sniffCursorImageFormat( + data: Uint8Array +): "png" | "jpeg" | "gif" | "webp" | undefined { + if ( + data.byteLength >= 8 && + data[0] === 0x89 && + data[1] === 0x50 && + data[2] === 0x4e && + data[3] === 0x47 && + data[4] === 0x0d && + data[5] === 0x0a && + data[6] === 0x1a && + data[7] === 0x0a + ) { + return "png"; + } + if ( + data.byteLength >= 6 && + data[0] === 0x47 && + data[1] === 0x49 && + data[2] === 0x46 && + data[3] === 0x38 + ) { + return "gif"; + } + if (data.byteLength >= 4 && data[0] === 0xff && data[1] === 0xd8) return "jpeg"; + if ( + data.byteLength >= 12 && + data[0] === 0x52 && + data[1] === 0x49 && + data[2] === 0x46 && + data[3] === 0x46 && + data[8] === 0x57 && + data[9] === 0x45 && + data[10] === 0x42 && + data[11] === 0x50 + ) { + return "webp"; + } + return undefined; +} + +/** + * Sniff PNG/JPEG/GIF/WebP dimensions from raw bytes when the header is present. + * Best-effort only — unknown formats return undefined (dimension is optional). + */ +export function sniffCursorImageDimensions( + data: Uint8Array +): { width: number; height: number } | undefined { + // PNG: signature + IHDR chunk (width/height at bytes 16..23) + if ( + data.byteLength >= 24 && + data[0] === 0x89 && + data[1] === 0x50 && + data[2] === 0x4e && + data[3] === 0x47 && + data[4] === 0x0d && + data[5] === 0x0a && + data[6] === 0x1a && + data[7] === 0x0a + ) { + const width = ((data[16]! << 24) | (data[17]! << 16) | (data[18]! << 8) | data[19]!) >>> 0; + const height = ((data[20]! << 24) | (data[21]! << 16) | (data[22]! << 8) | data[23]!) >>> 0; + if (width > 0 && height > 0) return { width, height }; + } + // GIF: "GIF8" + width/height as little-endian u16 at bytes 6..9 + if ( + data.byteLength >= 10 && + data[0] === 0x47 && + data[1] === 0x49 && + data[2] === 0x46 && + data[3] === 0x38 + ) { + const width = data[6]! | (data[7]! << 8); + const height = data[8]! | (data[9]! << 8); + if (width > 0 && height > 0) return { width, height }; + } + // WebP: RIFF....WEBP + VP8X / VP8 / VP8L + if ( + data.byteLength >= 30 && + data[0] === 0x52 && + data[1] === 0x49 && + data[2] === 0x46 && + data[3] === 0x46 && + data[8] === 0x57 && + data[9] === 0x45 && + data[10] === 0x42 && + data[11] === 0x50 + ) { + const fourcc = String.fromCharCode(data[12]!, data[13]!, data[14]!, data[15]!); + if (fourcc === "VP8X") { + const width = 1 + (data[24]! | (data[25]! << 8) | (data[26]! << 16)); + const height = 1 + (data[27]! | (data[28]! << 8) | (data[29]! << 16)); + if (width > 0 && height > 0) return { width, height }; + } else if (fourcc === "VP8 ") { + if (data[23] === 0x9d && data[24] === 0x01 && data[25] === 0x2a) { + const width = (data[26]! | (data[27]! << 8)) & 0x3fff; + const height = (data[28]! | (data[29]! << 8)) & 0x3fff; + if (width > 0 && height > 0) return { width, height }; + } + } else if (fourcc === "VP8L" && data[20] === 0x2f) { + const raw = data[21]! | (data[22]! << 8) | (data[23]! << 16) | (data[24]! << 24); + const width = (raw & 0x3fff) + 1; + const height = ((raw >> 14) & 0x3fff) + 1; + if (width > 0 && height > 0) return { width, height }; + } + } + // JPEG: scan for SOF0/SOF2 marker with dimensions + if (data.byteLength >= 4 && data[0] === 0xff && data[1] === 0xd8) { + let offset = 2; + while (offset + 8 < data.byteLength) { + if (data[offset] !== 0xff) break; + const marker = data[offset + 1]!; + // Standalone markers (TEM, RSTn, SOI, EOI) carry no length payload. + if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd9)) { + offset += 2; + continue; + } + const length = (data[offset + 2]! << 8) | data[offset + 3]!; + if (marker === 0xc0 || marker === 0xc2) { + const height = (data[offset + 5]! << 8) | data[offset + 6]!; + const width = (data[offset + 7]! << 8) | data[offset + 8]!; + if (width > 0 && height > 0) return { width, height }; + break; + } + if (length < 2) break; + offset += 2 + length; + } + } + return undefined; +} + +type PreparedImage = { + data: Buffer; + mimeType: string; + width?: number; + height?: number; +}; + +/** + * Re-encode toward a JPEG under the soft vision cap when sharp can decode the + * payload. Fail-closed with CursorImageError on unsupported MIME, decode bombs, + * or undecodable bytes. After the quality ladder, edges shrink iteratively + * until the soft byte cap is met (or the min edge floor is hit). + */ +export async function prepareCursorImageForWire(input: { + data: Buffer; + mimeType: string; + detail?: string; +}): Promise { + const mime = input.mimeType.toLowerCase(); + const softMax = softMaxBytesForDetail(input.detail); + const qualities = jpegQualitiesForDetail(input.detail); + const lowestQuality = qualities[qualities.length - 1]!; + + if (!CURSOR_VISION_PASSTHROUGH_MIME.has(mime)) { + throw new CursorImageError("Image input type is unsupported."); + } + + const format = sniffCursorImageFormat(input.data); + const sniffed = sniffCursorImageDimensions(input.data); + if (sniffed) { + const edge = Math.max(sniffed.width, sniffed.height); + const pixels = sniffed.width * sniffed.height; + if (edge > MAX_CURSOR_IMAGE_DECODE_EDGE || pixels > MAX_CURSOR_IMAGE_PIXELS) { + throw new CursorImageError("Image input dimensions are too large."); + } + } + + // Soft-cap skip: already soft-capped JPEG that has a real SOF (not SOI-only). + const declaredJpeg = mime === "image/jpeg" || mime === "image/jpg"; + const alreadySmallJpeg = + declaredJpeg && format === "jpeg" && sniffed !== undefined && input.data.byteLength <= softMax; + if (alreadySmallJpeg) { + return { + data: input.data, + mimeType: "image/jpeg", + width: sniffed!.width, + height: sniffed!.height, + }; + } + + try { + // Force a full decode before accepting passthrough / encode. + await sharp(input.data, { failOn: "error" }).resize(1, 1).jpeg({ quality: 1 }).toBuffer(); + + // Passthrough only when declared MIME matches actual JPEG magic. + if (declaredJpeg && format === "jpeg" && input.data.byteLength <= softMax) { + const dims = sniffed ?? (await sharp(input.data).metadata()); + const width = typeof dims.width === "number" ? dims.width : undefined; + const height = typeof dims.height === "number" ? dims.height : undefined; + return { + data: input.data, + mimeType: "image/jpeg", + ...(width && height && width > 0 && height > 0 ? { width, height } : {}), + }; + } + + const meta = await sharp(input.data).metadata(); + const width = typeof meta.width === "number" ? meta.width : 0; + const height = typeof meta.height === "number" ? meta.height : 0; + if (width > 0 && height > 0) { + const edge = Math.max(width, height); + if (edge > MAX_CURSOR_IMAGE_DECODE_EDGE || width * height > MAX_CURSOR_IMAGE_PIXELS) { + throw new CursorImageError("Image input dimensions are too large."); + } + } + + let targetW = width; + let targetH = height; + if (width > 0 && height > 0 && Math.max(width, height) > CURSOR_VISION_MAX_EDGE) { + const scale = CURSOR_VISION_MAX_EDGE / Math.max(width, height); + targetW = Math.max(1, Math.round(width * scale)); + targetH = Math.max(1, Math.round(height * scale)); + } + + const encodeAt = async (w: number, h: number, quality: number): Promise => { + let pipeline = sharp(input.data, { failOn: "error" }); + if (w > 0 && h > 0 && (w !== width || h !== height)) { + pipeline = pipeline.resize(w, h); + } + return pipeline.jpeg({ quality, mozjpeg: true }).toBuffer(); + }; + + let best: Buffer | undefined; + for (const quality of qualities) { + const encoded = await encodeAt(targetW, targetH, quality); + if (!best || encoded.byteLength < best.byteLength) best = encoded; + if (encoded.byteLength <= softMax) { + const outDims = sniffCursorImageDimensions(encoded); + return { + data: encoded, + mimeType: "image/jpeg", + ...(outDims ?? (targetW > 0 && targetH > 0 ? { width: targetW, height: targetH } : {})), + }; + } + } + + while ( + best && + best.byteLength > softMax && + targetW > 0 && + targetH > 0 && + Math.max(targetW, targetH) > CURSOR_VISION_SOFT_MIN_EDGE + ) { + const nextW = Math.max(1, Math.round(targetW * CURSOR_VISION_SOFT_SHRINK)); + const nextH = Math.max(1, Math.round(targetH * CURSOR_VISION_SOFT_SHRINK)); + if (Math.max(nextW, nextH) < CURSOR_VISION_SOFT_MIN_EDGE) { + const scale = CURSOR_VISION_SOFT_MIN_EDGE / Math.max(targetW, targetH); + targetW = Math.max(1, Math.round(targetW * scale)); + targetH = Math.max(1, Math.round(targetH * scale)); + } else { + targetW = nextW; + targetH = nextH; + } + const encoded = await encodeAt(targetW, targetH, lowestQuality); + if (!best || encoded.byteLength < best.byteLength) best = encoded; + if (encoded.byteLength <= softMax) { + const outDims = sniffCursorImageDimensions(encoded); + return { + data: encoded, + mimeType: "image/jpeg", + ...(outDims ?? { width: targetW, height: targetH }), + }; + } + if (Math.max(targetW, targetH) <= CURSOR_VISION_SOFT_MIN_EDGE) break; + } + + if (best) { + const outDims = sniffCursorImageDimensions(best); + return { + data: best, + mimeType: "image/jpeg", + ...(outDims ?? (targetW > 0 && targetH > 0 ? { width: targetW, height: targetH } : {})), + }; + } + + if (declaredJpeg && format !== "jpeg") { + throw new CursorImageError("Image input is not a valid JPEG."); + } + throw new CursorImageError("Image input could not be prepared for Cursor vision."); + } catch (err) { + if (err instanceof CursorImageError) throw err; + throw new CursorImageError("Image input is undecodable or unsupported."); + } +} + /** * Resolve OpenAI `image_url` URLs (data: or http(s):) into EncodedImage[] - * ready to inline into a cursor request. Each image gets a stable random uuid. - * Throws CursorImageError (clean message, sanitizable) on any invalid / - * oversized / blocked input. + * ready for SelectedImage blobIdWithData encoding. Each image gets a stable + * random uuid. Throws CursorImageError (clean message, sanitizable) on any + * invalid / oversized / blocked / undecodable input. */ -export async function resolveCursorImages(imageUrls: string[]): Promise { +export async function resolveCursorImages( + imageUrls: string[], + options?: { detail?: string } +): Promise { if (imageUrls.length > MAX_CURSOR_IMAGES) { - throw new CursorImageError( - `Too many images in one request (max ${MAX_CURSOR_IMAGES}).` - ); + throw new CursorImageError(`Too many images in one request (max ${MAX_CURSOR_IMAGES}).`); } const out: EncodedImage[] = []; for (const url of imageUrls) { @@ -314,10 +666,27 @@ export async function resolveCursorImages(imageUrls: string[]): Promise MAX_CURSOR_IMAGE_BYTES) { + if (data.length > MAX_CURSOR_IMAGE_DECODE_BYTES) { + throw new CursorImageError("Image input is too large to process safely."); + } + + const prepared = await prepareCursorImageForWire({ + data, + mimeType, + detail: options?.detail, + }); + if (prepared.data.length > MAX_CURSOR_IMAGE_BYTES) { throw new CursorImageError("Image input is too large (max 1 MiB). Resize and retry."); } - out.push({ data, mimeType, uuid: crypto.randomUUID() }); + + out.push({ + data: prepared.data, + mimeType: prepared.mimeType, + uuid: crypto.randomUUID(), + ...(typeof prepared.width === "number" && typeof prepared.height === "number" + ? { width: prepared.width, height: prepared.height } + : {}), + }); } return out; } @@ -327,17 +696,11 @@ export async function resolveCursorImages(imageUrls: string[]): Promise=18" } @@ -32778,7 +32778,6 @@ "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.3.tgz", "integrity": "sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==", "license": "Apache-2.0", - "optional": true, "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", @@ -32828,7 +32827,6 @@ "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", "license": "ISC", - "optional": true, "bin": { "semver": "bin/semver.js" }, diff --git a/package.json b/package.json index b1430ec223..bcc3b19c4e 100644 --- a/package.json +++ b/package.json @@ -311,6 +311,7 @@ "recharts": "^3.8.1", "safe-regex": "^2.1.1", "selfsigned": "^5.5.0", + "sharp": "^0.35.3", "smol-toml": "1.7.1", "socks": "^2.8.7", "sql.js": "^1.14.1", diff --git a/tests/unit/cursor-image-input.test.ts b/tests/unit/cursor-image-input.test.ts index 1e16035c8f..6aa62aa775 100644 --- a/tests/unit/cursor-image-input.test.ts +++ b/tests/unit/cursor-image-input.test.ts @@ -1,18 +1,25 @@ import test from "node:test"; import assert from "node:assert/strict"; +import crypto from "node:crypto"; +import dns from "node:dns"; +import sharp from "sharp"; import { encodeSelectedImageBody, encodeAgentRunRequest, type EncodedImage, } from "../../open-sse/utils/cursorAgentProtobuf"; -import dns from "node:dns"; import { resolveCursorImages, extractImageUrls, assertResolvedAddressesPublic, + prepareCursorImageForWire, + sniffCursorImageDimensions, + sniffCursorImageFormat, CursorImageError, MAX_CURSOR_IMAGE_BYTES, + MAX_CURSOR_IMAGE_DECODE_BYTES, MAX_CURSOR_IMAGES, + CURSOR_VISION_SOFT_MAX_BYTES, } from "../../open-sse/utils/cursorImages"; import { CursorExecutor } from "../../open-sse/executors/cursor"; @@ -20,12 +27,36 @@ import { CursorExecutor } from "../../open-sse/executors/cursor"; // example hostnames) pass the DNS-rebinding gate. const PUBLIC_IP = [{ address: "93.184.216.34", family: 4 }]; +/** Tiny valid 1x1 PNG (red pixel). */ +const TINY_PNG = Buffer.from( + "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==", + "base64" +); + +async function makeTinyJpeg(): Promise { + return sharp({ + create: { width: 8, height: 8, channels: 3, background: { r: 20, g: 40, b: 60 } }, + }) + .jpeg({ quality: 80 }) + .toBuffer(); +} + +async function makeLargePng(edge = 1200): Promise { + // Uncompressed-ish PNG well over the soft cap but under the decode ceiling. + return sharp({ + create: { + width: edge, + height: edge, + channels: 3, + background: { r: 180, g: 90, b: 30 }, + }, + }) + .png({ compressionLevel: 0 }) + .toBuffer(); +} + // ─── Minimal protobuf field walker (test-only) ────────────────────────────── -// Mirrors the production decoder enough to assert field layout without exposing -// the internal decodeFields helper. -type WalkField = - | { fn: number; wt: 0; varint: bigint } - | { fn: number; wt: 2; bytes: Buffer }; +type WalkField = { fn: number; wt: 0; varint: bigint } | { fn: number; wt: 2; bytes: Buffer }; function walk(buf: Buffer): WalkField[] { const out: WalkField[] = []; @@ -68,9 +99,6 @@ const lenBytes = (fields: WalkField[], fn: number): Buffer => { return Buffer.from((f as { bytes: Buffer }).bytes); }; -// Navigate AgentClientMessage(1) -> AgentRunRequest -> action(2) -> -// ConversationAction -> user_message_action(1) -> UserMessageAction -> -// user_message(1) -> UserMessage. function navUserMessage(req: Buffer): WalkField[] { const acm = walk(req); const arr = walk(lenBytes(acm, 1)); @@ -79,34 +107,56 @@ function navUserMessage(req: Buffer): WalkField[] { return walk(lenBytes(uma, 1)); } +function decodeBlobIdWithData(fields: WalkField[]): { blobId: Buffer; data: Buffer } { + assert.equal(find(fields, 8), undefined, "legacy field 8 (data) must be absent"); + const nested = walk(lenBytes(fields, 9)); + return { + blobId: lenBytes(nested, 1), + data: lenBytes(nested, 2), + }; +} + // ─── encodeSelectedImageBody field layout ─────────────────────────────────── -test("encodeSelectedImageBody emits uuid(2), dimension(4), mime_type(7), data(8)", () => { +test("encodeSelectedImageBody emits uuid(2), path(3), dimension(4), mime_type(7), blobIdWithData(9)", () => { const data = Buffer.from([1, 2, 3, 4, 5]); - const body = encodeSelectedImageBody({ - data, - mimeType: "image/png", - width: 10, - height: 20, - uuid: "abc-123", - }); + const blobStore = new Map(); + const body = encodeSelectedImageBody( + { + data, + mimeType: "image/png", + width: 10, + height: 20, + uuid: "abc-123", + }, + blobStore + ); const fields = walk(body); assert.equal(lenBytes(fields, 2).toString("utf8"), "abc-123"); // uuid + assert.equal(lenBytes(fields, 3).toString("utf8"), "attachment-abc-123.png"); // path const dim = walk(lenBytes(fields, 4)); // dimension submessage assert.equal(Number((find(dim, 1) as { varint: bigint }).varint), 10); // width assert.equal(Number((find(dim, 2) as { varint: bigint }).varint), 20); // height assert.equal(lenBytes(fields, 7).toString("utf8"), "image/png"); // mime_type - assert.deepEqual(lenBytes(fields, 8), data); // inline data (oneof case) + + const expectedBlobId = crypto.createHash("sha256").update(data).digest(); + const { blobId, data: nestedData } = decodeBlobIdWithData(fields); + assert.deepEqual(blobId, expectedBlobId); + assert.deepEqual(nestedData, data); + assert.deepEqual(blobStore.get(expectedBlobId.toString("hex")), data); }); test("encodeSelectedImageBody omits dimension/mime_type when not provided", () => { - const body = encodeSelectedImageBody({ data: Buffer.from([9]), uuid: "u" }); + const data = Buffer.from([9]); + const body = encodeSelectedImageBody({ data, uuid: "u" }); const fields = walk(body); assert.equal(find(fields, 4), undefined, "no dimension"); assert.equal(find(fields, 7), undefined, "no mime_type"); assert.ok(find(fields, 2), "uuid present"); - assert.deepEqual(lenBytes(fields, 8), Buffer.from([9]), "data present"); + assert.ok(find(fields, 3), "path present"); + const { data: nestedData } = decodeBlobIdWithData(fields); + assert.deepEqual(nestedData, data); }); test("encodeSelectedImageBody omits dimension when width/height are invalid", () => { @@ -134,7 +184,6 @@ test("no-image request is byte-identical to images:undefined and images:[]", () assert.ok(plain.equals(undef), "images:undefined matches no images"); assert.ok(plain.equals(empty), "images:[] matches no images"); - // And selected_context (field 3) is present but empty in the no-image case. const um = navUserMessage(plain); const sc = find(um, 3); assert.ok(sc && sc.wt === 2, "selected_context present"); @@ -143,17 +192,19 @@ test("no-image request is byte-identical to images:undefined and images:[]", () // ─── Images attach under UserMessage.selected_context.selected_images ──────── -test("images attach as selected_context.selected_images[] with inline data", () => { +test("images attach as selected_context.selected_images[] with blobIdWithData", () => { const imgs: EncodedImage[] = [ { data: Buffer.from([0xaa, 0xbb]), mimeType: "image/png", uuid: "u1" }, { data: Buffer.from([0xcc]), mimeType: "image/jpeg", uuid: "u2" }, ]; + const blobStore = new Map(); const req = encodeAgentRunRequest({ modelId: "gpt-5.2", userText: "what colors?", conversationId: "c", messageId: "m", images: imgs, + blobStore, }); const um = navUserMessage(req); const sc = walk(lenBytes(um, 3)); // SelectedContext @@ -163,12 +214,14 @@ test("images attach as selected_context.selected_images[] with inline data", () const first = walk(Buffer.from((selectedImages[0] as { bytes: Buffer }).bytes)); assert.equal(lenBytes(first, 2).toString("utf8"), "u1"); assert.equal(lenBytes(first, 7).toString("utf8"), "image/png"); - assert.deepEqual(lenBytes(first, 8), Buffer.from([0xaa, 0xbb])); + const firstNested = decodeBlobIdWithData(first); + assert.deepEqual(firstNested.data, Buffer.from([0xaa, 0xbb])); + assert.deepEqual(blobStore.get(firstNested.blobId.toString("hex")), Buffer.from([0xaa, 0xbb])); const second = walk(Buffer.from((selectedImages[1] as { bytes: Buffer }).bytes)); - assert.deepEqual(lenBytes(second, 8), Buffer.from([0xcc])); + const secondNested = decodeBlobIdWithData(second); + assert.deepEqual(secondNested.data, Buffer.from([0xcc])); - // UserMessage.text (field 1) still carries the prompt text alongside images. assert.equal(lenBytes(um, 1).toString("utf8"), "what colors?"); }); @@ -178,11 +231,11 @@ test("extractImageUrls pulls urls from object and string image_url parts", () => assert.deepEqual( extractImageUrls([ { type: "text", text: "hi" }, - { type: "image_url", image_url: { url: "data:image/png;base64,AA" } }, + { type: "image_url", image_url: { url: "data:image/png;base64,AA==" } }, { type: "image_url", image_url: "https://x.test/y.png" }, { type: "image_url", image_url: { detail: "high" } }, // no url -> ignored ]), - ["data:image/png;base64,AA", "https://x.test/y.png"] + ["data:image/png;base64,AA==", "https://x.test/y.png"] ); assert.deepEqual(extractImageUrls("plain string content"), []); assert.deepEqual(extractImageUrls(null), []); @@ -191,12 +244,14 @@ test("extractImageUrls pulls urls from object and string image_url parts", () => // ─── resolveCursorImages: happy path ──────────────────────────────────────── test("resolveCursorImages decodes a valid base64 data URI", async () => { - const png = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]); - const out = await resolveCursorImages([`data:image/png;base64,${png.toString("base64")}`]); + const out = await resolveCursorImages([`data:image/png;base64,${TINY_PNG.toString("base64")}`]); assert.equal(out.length, 1); - assert.deepEqual(out[0].data, png); - assert.equal(out[0].mimeType, "image/png"); + assert.equal(out[0].mimeType, "image/jpeg"); // soft-cap prep re-encodes to JPEG + assert.ok(out[0].data.length > 0); + assert.ok(out[0].data.length <= CURSOR_VISION_SOFT_MAX_BYTES); assert.ok(out[0].uuid && out[0].uuid.length > 0); + assert.equal(out[0].width, 1); + assert.equal(out[0].height, 1); }); // ─── resolveCursorImages: rejections (all CursorImageError, all sanitized) ─── @@ -215,6 +270,15 @@ test("resolveCursorImages rejects invalid base64", async () => { ); }); +test("resolveCursorImages rejects base64 with trailing garbage (strict round-trip)", async () => { + // Buffer.from would silently drop the trailing "!!!!" — we must reject. + const padded = `${TINY_PNG.toString("base64")}!!!!`; + await assert.rejects( + () => resolveCursorImages([`data:image/png;base64,${padded}`]), + (e) => e instanceof CursorImageError + ); +}); + test("resolveCursorImages rejects a non-base64 data URI", async () => { await assert.rejects( () => resolveCursorImages(["data:image/png,not-base64-payload"]), @@ -222,8 +286,8 @@ test("resolveCursorImages rejects a non-base64 data URI", async () => { ); }); -test("resolveCursorImages rejects an oversized image (>1 MiB)", async () => { - const big = Buffer.alloc(MAX_CURSOR_IMAGE_BYTES + 16).toString("base64"); +test("resolveCursorImages rejects an oversized image over the decode ceiling", async () => { + const big = Buffer.alloc(MAX_CURSOR_IMAGE_DECODE_BYTES + 16).toString("base64"); await assert.rejects( () => resolveCursorImages([`data:image/png;base64,${big}`]), (e) => e instanceof CursorImageError @@ -248,7 +312,7 @@ test("resolveCursorImages blocks SSRF targets (localhost, link-local, file://)", }); test("resolveCursorImages rejects too many images", async () => { - const one = "data:image/png;base64,AAAA"; + const one = `data:image/png;base64,${TINY_PNG.toString("base64")}`; await assert.rejects( () => resolveCursorImages(Array.from({ length: MAX_CURSOR_IMAGES + 1 }, () => one)), (e) => e instanceof CursorImageError @@ -256,26 +320,27 @@ test("resolveCursorImages rejects too many images", async () => { }); test("resolveCursorImages accepts an uppercase DATA: scheme (RFC 2397 case-insensitive)", async () => { - const png = Buffer.from([137, 80, 78, 71]); - const out = await resolveCursorImages([`DATA:image/png;base64,${png.toString("base64")}`]); + const out = await resolveCursorImages([`DATA:image/png;base64,${TINY_PNG.toString("base64")}`]); assert.equal(out.length, 1); - assert.deepEqual(out[0].data, png); - assert.equal(out[0].mimeType, "image/png"); + assert.equal(out[0].mimeType, "image/jpeg"); + assert.ok(out[0].data.length > 0); }); test("assertResolvedAddressesPublic blocks private/metadata IPs, allows public", () => { for (const ip of ["127.0.0.1", "10.0.0.1", "169.254.169.254", "192.168.1.1", "::1", "fd00::1"]) { - assert.throws(() => assertResolvedAddressesPublic([ip]), CursorImageError, `should block ${ip}`); + assert.throws( + () => assertResolvedAddressesPublic([ip]), + CursorImageError, + `should block ${ip}` + ); } assert.doesNotThrow(() => assertResolvedAddressesPublic(["93.184.216.34", "1.1.1.1"])); - // A single private answer among public ones still blocks (DNS-rebinding). assert.throws(() => assertResolvedAddressesPublic(["8.8.8.8", "127.0.0.1"]), CursorImageError); }); test("resolveCursorImages blocks DNS rebinding (public host resolving to a private IP)", async (t) => { t.mock.method(dns.promises, "lookup", async () => [{ address: "127.0.0.1", family: 4 }]); const realFetch = globalThis.fetch; - // fetch should never be reached — the DNS gate blocks first. globalThis.fetch = async () => { throw new Error("fetch must not run for a rebinding host"); }; @@ -290,9 +355,6 @@ test("resolveCursorImages blocks DNS rebinding (public host resolving to a priva }); test("resolveCursorImages re-validates redirects: a 30x to a private host is blocked (SSRF)", async (t) => { - // fetch() follows redirects by default; the resolver uses redirect:"manual" - // and re-validates each hop. A public URL that 302s to 127.0.0.1 must be - // blocked, not followed. t.mock.method(dns.promises, "lookup", async () => PUBLIC_IP); const realFetch = globalThis.fetch; globalThis.fetch = async () => @@ -309,7 +371,6 @@ test("resolveCursorImages re-validates redirects: a 30x to a private host is blo test("resolveCursorImages follows a redirect to another public host and reads the image", async (t) => { t.mock.method(dns.promises, "lookup", async () => PUBLIC_IP); - const png = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]); const realFetch = globalThis.fetch; let call = 0; globalThis.fetch = async () => { @@ -320,7 +381,7 @@ test("resolveCursorImages follows a redirect to another public host and reads th headers: { location: "https://cdn.public.example/a.png" }, }); } - return new Response(new Uint8Array(png), { + return new Response(new Uint8Array(TINY_PNG), { status: 200, headers: { "content-type": "image/png" }, }); @@ -328,8 +389,9 @@ test("resolveCursorImages follows a redirect to another public host and reads th try { const out = await resolveCursorImages(["https://public.example/a.png"]); assert.equal(out.length, 1); - assert.deepEqual(out[0].data, png); - assert.equal(out[0].mimeType, "image/png"); + assert.equal(out[0].mimeType, "image/jpeg"); + assert.ok(out[0].data.length > 0); + assert.ok(out[0].data.length <= MAX_CURSOR_IMAGE_BYTES); } finally { globalThis.fetch = realFetch; } @@ -353,13 +415,67 @@ test("resolveCursorImages rejects an over-long redirect chain", async (t) => { } }); +// ─── JPEG soft-cap / sniff regressions ────────────────────────────────────── + +test("prepareCursorImageForWire re-encodes a large PNG under the soft cap", async () => { + const large = await makeLargePng(1400); + assert.ok(large.length > CURSOR_VISION_SOFT_MAX_BYTES, "fixture must exceed soft cap"); + assert.ok(large.length < MAX_CURSOR_IMAGE_DECODE_BYTES, "fixture under decode ceiling"); + const prepared = await prepareCursorImageForWire({ + data: large, + mimeType: "image/png", + }); + assert.equal(prepared.mimeType, "image/jpeg"); + assert.ok(prepared.data.length <= CURSOR_VISION_SOFT_MAX_BYTES); + assert.ok(prepared.data.length <= MAX_CURSOR_IMAGE_BYTES); + assert.equal(sniffCursorImageFormat(prepared.data), "jpeg"); + const dims = sniffCursorImageDimensions(prepared.data); + assert.ok(dims && dims.width > 0 && dims.height > 0); +}); + +test("prepareCursorImageForWire does not passthrough mislabeled PNG-as-JPEG", async () => { + // Declared JPEG but bytes are PNG — must re-encode (or fail), never SOI-less passthrough. + const prepared = await prepareCursorImageForWire({ + data: TINY_PNG, + mimeType: "image/jpeg", + }); + assert.equal(prepared.mimeType, "image/jpeg"); + assert.equal(sniffCursorImageFormat(prepared.data), "jpeg"); + assert.ok(sniffCursorImageDimensions(prepared.data), "JPEG must have a real SOF"); +}); + +test("prepareCursorImageForWire skips re-encode for small real JPEG with SOF", async () => { + const jpeg = await makeTinyJpeg(); + assert.ok(jpeg.length <= CURSOR_VISION_SOFT_MAX_BYTES); + assert.equal(sniffCursorImageFormat(jpeg), "jpeg"); + assert.ok(sniffCursorImageDimensions(jpeg), "fixture must have SOF dims"); + const prepared = await prepareCursorImageForWire({ + data: jpeg, + mimeType: "image/jpeg", + }); + assert.deepEqual(prepared.data, jpeg); + assert.equal(prepared.mimeType, "image/jpeg"); +}); + +test("sniffCursorImageDimensions reads PNG IHDR", () => { + const dims = sniffCursorImageDimensions(TINY_PNG); + assert.deepEqual(dims, { width: 1, height: 1 }); +}); + +test("resolveCursorImages soft-caps a large PNG under the wire budget", async () => { + const large = await makeLargePng(1400); + const out = await resolveCursorImages([`data:image/png;base64,${large.toString("base64")}`]); + assert.equal(out.length, 1); + assert.equal(out[0].mimeType, "image/jpeg"); + assert.ok(out[0].data.length <= CURSOR_VISION_SOFT_MAX_BYTES); + assert.ok(out[0].data.length <= MAX_CURSOR_IMAGE_BYTES); +}); + // ─── Executor-level error body (response path, hard rule #12) ─────────────── test("executor returns a sanitized 400 for an oversized image", async () => { - // buildRequest throws CursorImageError before any network/session/DB work, - // so this stays fully offline (no token needed). const exec = new CursorExecutor(); - const big = Buffer.alloc(MAX_CURSOR_IMAGE_BYTES + 16).toString("base64"); + const big = Buffer.alloc(MAX_CURSOR_IMAGE_DECODE_BYTES + 16).toString("base64"); const result = await exec.execute({ model: "gpt-5.2", body: { @@ -383,7 +499,6 @@ test("executor returns a sanitized 400 for an oversized image", async () => { const body = await result.response.json(); assert.ok(body.error, "error envelope present"); assert.match(body.error.message, /too large/i); - // No stack-trace / source-path leakage in the response body (hard rule #12). assert.ok(!body.error.message.includes("at /"), "no stack frame in error body"); assert.ok(!/\/(root|home|usr)\//.test(body.error.message), "no absolute path in error body"); }); @@ -415,9 +530,6 @@ test("executor returns a sanitized 400 for an SSRF-blocked image URL", async () }); test("CursorImageError messages never leak stack traces or paths", async () => { - // Every rejection message must be a clean human string (no "at /" frames, - // no absolute paths) so the executor's sanitized 400 body stays clean - // (hard rule #12). const triggers = [ "data:text/plain;base64,aGVsbG8=", "data:image/png;base64,@@@@",