Add bounded Code Mode output collection and rendering (#57848)

## What changed

Add output collection and rendering components in `code-mode-runtime`, without wiring them into runtime execution yet.

- Retain a text prefix and rolling tail under a 1 MiB text allowance, with independent allowances of 8 MiB for image URLs and 62 MiB for audio URLs and a separate 32,768-item limit.
- Render retained output using the shared token-budget formatter, preserving media details and reporting collector losses even with a zero-token budget. Summarize scattered losses to keep notices bounded.
- Preserve collected output and omission accounting when delivery fails, and document the separate media limits in the protocol.

## Testing

Add unit tests for Unicode retention, item pressure, independent media allowances, media-space reclamation, failed delivery, default token budgets, and loss-notice placement and aggregation.

GitOrigin-RevId: f419fdbe316a8456cea3b7b097c4d3a658f3150f

codex-rs/code-mode-protocol/src/host/mod.rs

@@ -15,9 +15,17 @@ pub const MAX_PENDING_DELEGATE_CALLS: usize = 1_024;
 /// Stdio connection support for the optional `session/open.outputTruncation` field.
 /// Each session selects its own setting after the connection hello.
 pub const BOUNDED_OUTPUT_CAPABILITY: &str = "bounded-output-v1";
-/// Maximum retained bytes between server-truncated observations.
+/// Maximum aggregate text bytes retained per server-truncated observation.
 pub const BOUNDED_OUTPUT_MAX_BYTES: usize = 1024 * 1024;
 
+/// Maximum aggregate inline image bytes retained per server-truncated observation.
+pub const BOUNDED_OUTPUT_MAX_IMAGE_BYTES: usize = 8 * 1024 * 1024;
+
+/// Maximum aggregate encoded audio URL bytes retained per server-truncated observation.
+/// Count the whole URL, including the data URL prefix and any base64 payload.
+/// This leaves heuristic transport headroom but does not bound the complete response.
+pub const BOUNDED_OUTPUT_MAX_AUDIO_BYTES: usize = 62 * 1024 * 1024;
+
 /// Negotiated support for cell execution resource limits on `session/open`.
 pub const SESSION_RESOURCE_LIMITS_CAPABILITY: &str = "session-cell-execution-resource-limits";
 

codex-rs/code-mode-protocol/src/session.rs

@@ -41,13 +41,14 @@ pub enum CodeModeOutputTruncation {
     /// transmitting output (10,000 tokens by default). Clients must not truncate
     /// it again or append the script error: status and error metadata remain separate.
     ///
-    /// Between observations, the host retains at most
-    /// [`crate::host::BOUNDED_OUTPUT_MAX_BYTES`] of output payload. It also
-    /// bounds the storage for retained items separately, without charging it
-    /// against the payload or observation token budgets.
-    /// Ordinary text notices report overflow, even for a zero-token budget.
-    /// Media are indivisible and can be omitted if they exceed the collector.
-    /// Without overflow, formatting matches Core's client policy.
+    /// A complete observation keeps up to [`crate::host::BOUNDED_OUTPUT_MAX_BYTES`]
+    /// of text, [`crate::host::BOUNDED_OUTPUT_MAX_IMAGE_BYTES`] of inline image URLs,
+    /// and [`crate::host::BOUNDED_OUTPUT_MAX_AUDIO_BYTES`] of audio URLs, subject
+    /// to a separate item limit. While these limits hold, formatting matches
+    /// Core's client policy. On text overflow the collector keeps a prefix and a
+    /// rolling tail. Each image or audio clip is admitted if it fits its remaining
+    /// byte allowance. Eviction at the item limit can free space for later media.
+    /// Media are indivisible. Bounded loss notices survive even a zero-token budget.
     Server,
 }