image_url serialized as "image urf" in long conversations

Description

When a conversation reaches ~156+ messages and includes images, the Codex CLI serializes image_url as image urf (missing the letter "l") in the API request body. This causes the API to reject the request with a deserialization error.

Error Message

Failed to deserialize the JSON body into the target type: messages[156]: unknown variant image urf, expected "text" at line 1 column 199472

Steps to Reproduce

1. Have a long conversation (156+ messages) that includes image content
2. Continue the conversation — Codex will attempt to serialize the full history
3. The API returns the above deserialization error

Expected Behavior

image_url should be serialized correctly as image_url, not image urf.

Environment

• Codex Desktop (Windows)
• CLI version: 0.137.0-alpha.4
• Date: 2026-06-07

Additional Context

The issue appears to be in the Rust serialization layer where message content types are constructed for the API request. The string image_url is being truncated/corrupted to image urf at position 156 in the messages array, suggesting a possible buffer overflow or string truncation bug.