Files
codex/codex-rs/utils/image/Cargo.toml
T
Vivian Fang 7844815bd7 Add opt-in prompt image sanitization (#61341)
## What changed

- Add the disabled-by-default `safe_image_decoder` feature to decode and re-encode prompt images without source metadata, with byte and decoded-pixel limits.
- Apply JPEG orientation and supported ICC color conversion to sRGB, emitting PNG for PNG/GIF inputs and JPEG for JPEG/WebP inputs.
- Use the selected decoder for image preparation, `view_image` validation, and MCP image validation. Include the decoder in image cache keys.
- Preserve original inline images in history metadata so resume and fork can regenerate prepared images without repeated JPEG encoding changing their bytes.

## Testing

Add regression tests for identical JPEG replay after history serialization and for preventing legacy cache entries from bypassing sanitization.

GitOrigin-RevId: 718cd83d0a233e2eb8efd1a64c14d8944e44c350
2026-11-13 18:44:31 +00:00

35 lines
990 B
TOML

[package]
name = "codex-utils-image"
version.workspace = true
edition.workspace = true
license.workspace = true
[lints]
workspace = true
[package.metadata.cargo-shear]
# "image" does not forward png's zlib-rs feature. This direct dependency keeps
# encoded PNG bytes stable when WebSocket dependencies are absent from a build.
ignored = ["png"]
[dependencies]
base64 = { workspace = true }
image = { version = "=0.25.9", default-features = false, features = ["jpeg", "png", "gif", "webp"] }
moxcms = { version = "=0.7.11", features = ["options"] }
png = { version = "=0.18.1", features = ["zlib-rs"] }
codex-utils-cache = { workspace = true }
mime_guess = { workspace = true }
thiserror = { workspace = true }
tokio = { workspace = true, features = ["fs", "rt", "rt-multi-thread", "macros"] }
[dev-dependencies]
divan = { workspace = true }
image = { workspace = true, features = ["jpeg", "png", "gif", "webp"] }
[lib]
doctest = false
[[bench]]
name = "prompt_images"
harness = false