[WRONG BRANCH] fix(kiro): avoid mixed-script estimator allocations

[luvs01]

Motivation

• A change in the Kiro estimator created attacker-sized synthetic strings (String.repeat) when any CJK character appeared in a mostly-Latin payload, amplifying transient memory and enabling DoS from accepted loopback requests. The goal is to remove those allocations while preserving existing token-ratio behavior.

Description

• Replace the allocating mixed-script path with arithmetic over pre-counted script buckets by adding estimateTokensFromCharacterCounts to src/lib/token-estimate.ts and delegating estimateTokens to it.
• Update the Kiro wire estimator in src/adapters/kiro.ts to call estimateTokensFromCharacterCounts instead of building "x".repeat(...) / "한".repeat(...), and apply the existing Latin wire expansion only to the computed Latin portion.
• Add a regression test in tests/lib/token-estimate.test.ts that asserts equivalence between the pre-counted arithmetic and the original mixed-script estimate (including a large numeric bucket check) without materializing huge strings.

Testing

• Ran bun test tests/lib/token-estimate.test.ts and the modified token-estimate tests passed.
• Ran bun test tests/providers/kiro/kiro-stream.test.ts which mostly passed but surfaced one unrelated existing assertion failure: the normalized images contribute conservative context tokens test failed.
• Ran bun run typecheck (bun x tsc --noEmit) which succeeded.
• Ran bun run privacy:scan which succeeded.
• Ran the full suite (bun run test) and observed unrelated current-HEAD test failures in other subsystems; the changes in this PR are isolated to the Kiro estimator and token-estimate sidecar.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 498b38ff-cdb7-491a-8f20-c830e258328f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T05:43:52.371049Z	427bd55	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request is being kept as a draft automatically. Once every issue above is resolved, it will be marked ready for review again.

[luvs01]

Closed as a duplicate of #441. Comparing the two heads with git diff --name-only reports zero differing files, so both PRs carry the same change and only one can be upstreamed. #441 is the surviving copy.