@bitkyc08/opencodex 2.33.0 → 2.34.0

package/src/images/loop.ts

@@ -258,10 +258,11 @@ export interface ImageBridgeDeps {
   /** Raw adapter usage at the terminal event, pre wire-normalization (see bridgeToResponsesSSE onUsage). */
   onUsage?: (usage: OcxUsage | undefined) => void;
   /**
-   * Optional 429 key-failover for the routed (non-xAI) model. Return a rebuilt adapter for the
-   * rotated key, or null when the pool is exhausted.
+   * Optional 429 failover for the routed (non-xAI) model. Return a rebuilt adapter for the
+   * rotated credential, or null when the pool is exhausted. Async hooks support OAuth refresh;
+   * existing synchronous key-pool hooks remain valid.
    */
-  on429?: (retryAfterHeader: string | null) => ProviderAdapter | null;
+  on429?: (retryAfterHeader: string | null) => ProviderAdapter | null | Promise<ProviderAdapter | null>;
   /** Opt-in same-target 429 policy (key-auth providers). When present, 429 replays on the SAME key before on429 rotation. */
   retryOn429Policy?: Required<RateLimitRetryPolicy> | null;
   /** Called when the bridged Responses stream completes (parity with runTurn / routed paths). */
@@ -572,7 +573,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       }
       // 429 key-failover parity with web-search / normal routed path.
       while (prepared.response.status === 429 && deps.on429) {
-        const rotated = deps.on429(prepared.response.headers.get("retry-after"));
+        const rotated = await deps.on429(prepared.response.headers.get("retry-after"));
         if (!rotated) break;
         try { void prepared.response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
         adapter = rotated;

package/src/lab/conformance/fixtures/protocol-v1-cases.json

@@ -274,7 +274,7 @@
       "assertions": [
         { "id": "text", "operator": "normalized_text_equals", "selector": "/client/response/normalizedText", "expected": "OK", "required": true },
         { "id": "terminal", "operator": "terminal_signal_equals", "selector": "/client/response/terminal", "expected": "completed", "required": true },
-        { "id": "phase", "operator": "json_path_equals", "selector": "/client/response/events/6/data/item/phase", "expected": "final_answer", "required": true }
+        { "id": "phase", "operator": "json_path_equals", "selector": "/client/response/events/7/data/item/phase", "expected": "final_answer", "required": true }
       ]
     },
     {

package/src/lab/fabric/producer-child.ts

@@ -128,7 +128,7 @@ async function main(): Promise<void> {
   writeLine({ type: "result", patch });
 }
 
-main().catch((error: unknown) => {
+await main().catch((error: unknown) => {
   writeLine({
     type: "error",
     code: "harness_failure",

package/src/lib/config-ownership.ts

@@ -40,6 +40,7 @@ const INITIAL_OWNED_PATHS = [
   "artifacts",
   "auth.json",
   "auth.store.lock",
+  "admin-api-token",
   "catalog-backup.json",
   "claude-env.sh",
   "codex-accounts.json",
@@ -333,6 +334,25 @@ export function removeOwnedConfigState(configDir: string): ConfigRemovalResult {
     }
   }
 
+  // Per-catalog backups are named `catalog-backup-<16 hex>.json` (catalogBackupPathFor), one per
+  // CODEX_HOME, so they cannot be enumerated as literal manifest entries the way every other
+  // owned file can. Without this, `ocx uninstall` always reported "unowned files remain" and
+  // refused to remove a home OpenCodex created itself — the file is unambiguously ours, produced
+  // by our own writer, and the strict hex shape keeps the match from widening.
+  for (const name of readdirSync(configDir)) {
+    if (!/^catalog-backup-[0-9a-f]{16}\.json$/.test(name)) continue;
+    const path = join(configDir, name);
+    try {
+      removeOwnedEntry(rootPath, path);
+    } catch (error) {
+      return {
+        status: "partial",
+        reason: `could not remove owned path ${name}: ${error instanceof Error ? error.message : String(error)}`,
+        residualPaths: [path],
+      };
+    }
+  }
+
   try {
     unlinkSync(join(configDir, CONFIG_UNINSTALL_MANIFEST));
     unlinkSync(join(configDir, CONFIG_OWNER_FILE));

package/src/lib/errors.ts

@@ -6,11 +6,18 @@ export interface OcxErrorPayload {
 
 /** OpenAI / Codex hard block for high-risk cybersecurity activity (HTTP 400 or mid-stream). */
 export const CYBER_POLICY_ERROR_CODE = "cyber_policy";
+export const CYBER_POLICY_FALLBACK_MESSAGE = "Request blocked by the upstream cybersecurity policy.";
 
 export function isCyberPolicyCode(code: string | null | undefined): boolean {
   return code === CYBER_POLICY_ERROR_CODE;
 }
 
+/** Preserve a structured upstream error type; otherwise use the dedicated policy identity. */
+export function cyberPolicyErrorType(type: string | null | undefined): string {
+  const trimmed = typeof type === "string" ? type.trim() : "";
+  return trimmed || CYBER_POLICY_ERROR_CODE;
+}
+
 /**
  * Detect OpenAI cyber-policy refusals from message text when structured `code` was stripped.
  * Matches Codex fallback copy and Cursor/API agent wording (session evidence 2026-07-24).
@@ -139,9 +146,11 @@ export function classifyError(status: number, type: string, message: string): Oc
     return { message, type: "invalid_request_error", code: "client_closed_request" };
   }
   // Codex only shows the dedicated cyber UI when error.code === "cyber_policy".
-  // Prefer that code (and invalid_request_error) over generic remaps / 502 upstream_server_error.
+  // The public wire does not establish invalid_request_error as the canonical type, so
+  // message-only classification keeps the dedicated identity instead of inventing one.
+  // Structured callers re-apply their real upstream type with cyberPolicyErrorType().
   if (type === CYBER_POLICY_ERROR_CODE || isCyberPolicyMessage(text)) {
-    return { message, type: "invalid_request_error", code: CYBER_POLICY_ERROR_CODE };
+    return { message, type: CYBER_POLICY_ERROR_CODE, code: CYBER_POLICY_ERROR_CODE };
   }
   // A LOCAL preflight refusal keeps its own code (#1524). The message necessarily says
   // "context window" -- that is what it is refusing on -- so the generic remap below would

package/src/lib/package-tree-integrity.ts

@@ -0,0 +1,101 @@
+import { statSync } from "node:fs";
+
+export interface PackageTreeObservation {
+  readonly device: bigint;
+  readonly inode: bigint;
+  readonly contentTimeNs: bigint;
+  readonly size: bigint;
+}
+
+export type PackageTreeIntegrityStatus =
+  | { readonly ok: true }
+  | { readonly ok: false; readonly reason: "package_tree_replaced" | "package_tree_unreadable" };
+
+export interface PackageTreeIntegrityGuard {
+  status(): PackageTreeIntegrityStatus;
+}
+
+type ObservePackageTree = () => PackageTreeObservation | null;
+type PackageTreeRuntimeInstall = "bun" | "npm" | "source";
+
+const packageManifestUrl = new URL("../../package.json", import.meta.url);
+
+function observePackageManifest(): PackageTreeObservation | null {
+  try {
+    const stat = statSync(packageManifestUrl, { bigint: true });
+    return {
+      device: stat.dev,
+      inode: stat.ino,
+      // mtimeNs, NOT ctimeNs. An inode-change time moves for METADATA writes that
+      // replace nothing: chmod, chown, touch, an editor normalizing permissions, a
+      // backup tool restoring modes. Each of those left device, inode and size
+      // identical, so the comparison below called the manifest "replaced" and every
+      // /v1/* request answered 503 until the process was restarted. Measured on
+      // macOS: chmod alone moved ctimeNs and left mtimeNs untouched.
+      //
+      // mtimeNs still catches every real replacement. An in-place rewrite of the
+      // same byte length moves mtimeNs while inode and size hold; an atomic
+      // install (write-then-rename, which is what a package manager does) changes
+      // the inode as well. Both were measured before this change was made.
+      contentTimeNs: stat.mtimeNs,
+      size: stat.size,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function sameObservation(left: PackageTreeObservation, right: PackageTreeObservation): boolean {
+  return left.device === right.device
+    && left.inode === right.inode
+    && left.contentTimeNs === right.contentTimeNs
+    && left.size === right.size;
+}
+
+/**
+ * How long an `ok` observation is reused before the manifest is stat'd again.
+ *
+ * `status()` runs on `/healthz`, `/readyz` and every `/v1/*` request, so an unthrottled guard
+ * adds a filesystem syscall to the proxy's hot path to detect an event that happens at most
+ * once per install. A replaced tree is not time-critical either: the process is already
+ * serving broken imports, and one more second of that is not worse than a syscall per turn
+ * forever.
+ *
+ * A NEGATIVE result is never cached — once the tree looks wrong, every later request re-checks,
+ * so a repaired install recovers on its own instead of staying refused for a window.
+ */
+const PACKAGE_TREE_RECHECK_MS = 1_000;
+
+export function createPackageTreeIntegrityGuard(
+  observe: ObservePackageTree = observePackageManifest,
+  now: () => number = Date.now,
+): PackageTreeIntegrityGuard {
+  const boot = observe();
+  let lastOkAt: number | null = null;
+  return {
+    status(): PackageTreeIntegrityStatus {
+      const at = now();
+      if (lastOkAt !== null && at - lastOkAt < PACKAGE_TREE_RECHECK_MS) return { ok: true };
+      const current = observe();
+      if (boot === null || current === null) return { ok: false, reason: "package_tree_unreadable" };
+      if (!sameObservation(boot, current)) return { ok: false, reason: "package_tree_replaced" };
+      lastOkAt = at;
+      return { ok: true };
+    },
+  };
+}
+
+/**
+ * Installed packages fail closed when their manifest is replaced under a live process.
+ * A source checkout is different: editing package.json is ordinary development work, and
+ * Bun keeps serving the module snapshot already loaded by this process until the operator
+ * chooses to restart. Fencing every request there makes running dev directly impossible.
+ */
+export function createRuntimePackageTreeIntegrityGuard(
+  installer: PackageTreeRuntimeInstall,
+  observe: ObservePackageTree = observePackageManifest,
+  now: () => number = Date.now,
+): PackageTreeIntegrityGuard {
+  if (installer === "source") return { status: () => ({ ok: true }) };
+  return createPackageTreeIntegrityGuard(observe, now);
+}

package/src/oauth/generic-account-failover.ts

@@ -0,0 +1,231 @@
+/**
+ * Generic OAuth multi-account 429 failover (#2568).
+ *
+ * The API-key twin (`providers/key-failover.ts`) rotates by default for any key provider with a
+ * 2+ pool, but it returns false for `authMode === "oauth"`, and the only OAuth rotator that
+ * exists is Anthropic's — behind its own opt-in. So xAI, Cursor, Kimi, GitHub Copilot,
+ * Antigravity and Nous have no recovery path on a 429 even with several accounts logged in.
+ *
+ * Deliberately narrower than the Anthropic pool: no session affinity, no quota-ranked selection,
+ * no probe leases. Those carry provider-specific meaning; this module only answers "the account
+ * that just 429'd is cooled, is there another one we may use".
+ *
+ * NOT a home for Codex (`codex/routing.ts` owns quota scopes and probe leases) or Anthropic
+ * (`oauth/anthropic-routing.ts` owns affinity and a fail-closed local-cli credential rule).
+ * Both are excluded by `isGenericFailoverProvider`.
+ */
+import { getAccountSet } from "./store";
+import { getValidAccessSnapshotForAccount, type OAuthAccessSnapshot } from "./index";
+import { parseRetryAfterMs } from "../combos/failover";
+import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+
+/** Cap same-request rotations so a short Retry-After cannot spin. Mirrors the Anthropic bound. */
+export const GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST = 3;
+
+const DEFAULT_COOLDOWN_MS = 60_000;
+const MAX_COOLDOWN_MS = 15 * 60_000;
+
+/**
+ * How long a presence answer may be reused before the store is consulted again.
+ *
+ * `loadAuthStore` has no cache: every call chmods the config dir and the secret, reads the whole
+ * file, parses it and normalizes the store (store.ts:136-151). Since presence now decides
+ * activation, this predicate runs on paths that have not seen a 429 at all — the streaming and
+ * non-streaming runTurn entry points evaluate it once per request — so an uncached check would put
+ * a synchronous file read in front of every request for every OAuth provider.
+ *
+ * Two seconds is short enough that a login in another window is picked up before the operator can
+ * switch back and send a prompt, and long enough that a burst of requests shares one read. The
+ * cache holds a COUNT, never a credential.
+ */
+const PRESENCE_CACHE_TTL_MS = 2_000;
+
+/**
+ * Providers whose rotation is owned elsewhere and must not be handled here.
+ *
+ * `openai` is the Codex pool: quota scopes, probe leases and affinity semantics that this
+ * module deliberately does not reimplement. `anthropic` has its own pool with a fail-closed
+ * rule about background local-cli credential slots.
+ */
+const EXCLUDED_PROVIDERS = new Set(["openai", "anthropic"]);
+
+interface AccountHealth {
+  cooldownUntil: number;
+  cooldownSource: "retry-after" | "default";
+}
+
+interface PresenceEntry {
+  eligible: number;
+  readAt: number;
+}
+
+/** Process-local, like the Anthropic pool's: a restart is allowed to forget a cooldown. */
+const health = new Map<string, AccountHealth>();
+
+/** Provider -> recent eligible-account count. TTL-bounded; never holds credential material. */
+const presence = new Map<string, PresenceEntry>();
+
+const healthKey = (provider: string, accountId: string) => `${provider}\u0000${accountId}`;
+
+function isCooled(provider: string, accountId: string, now: number): boolean {
+  const entry = health.get(healthKey(provider, accountId));
+  if (!entry) return false;
+  if (entry.cooldownUntil <= now) {
+    health.delete(healthKey(provider, accountId));
+    return false;
+  }
+  return true;
+}
+
+/** True when this provider participates in generic rotation at all. */
+export function isGenericFailoverProvider(providerName: string, provider: OcxProviderConfig): boolean {
+  return provider.authMode === "oauth" && !EXCLUDED_PROVIDERS.has(providerName);
+}
+
+/**
+ * Stored accounts that could serve traffic if asked, ignoring cooldowns.
+ *
+ * Cooldowns are excluded on purpose: they are transient and per-request, while this answers the
+ * durable question "did the operator log in more than one account". Treating a cooled account as
+ * absent would switch the feature off for the rest of the cooldown, which is exactly when it is
+ * needed.
+ */
+function eligibleAccountCount(providerName: string, now: number): number {
+  const cached = presence.get(providerName);
+  if (cached && now >= cached.readAt && now - cached.readAt < PRESENCE_CACHE_TTL_MS) return cached.eligible;
+  const set = getAccountSet(providerName);
+  const eligible = set ? set.accounts.filter(account => account.needsReauth !== true).length : 0;
+  presence.set(providerName, { eligible, readAt: now });
+  return eligible;
+}
+
+/**
+ * Presence IS consent (#2568d).
+ *
+ * `hasKeyPoolFailover` already reads a 2+ key pool as the operator asking for rotation, and a
+ * second OAuth login is the same statement. One account stays a strict no-op either way, so this
+ * only changes behaviour for someone who deliberately logged in twice.
+ */
+export function hasFailoverAccountQuorum(providerName: string, now = Date.now()): boolean {
+  return eligibleAccountCount(providerName, now) >= 2;
+}
+
+/**
+ * Whether generic rotation is active for this provider.
+ *
+ * Precedence, most specific first:
+ *
+ *   1. `providers.<name>.oauthAccountFailover.enabled` — an operator may accept rotation on one
+ *      provider and refuse it on another, because provider terms differ.
+ *   2. `oauthAccountFailover.enabled` — the global switch. Anyone who already wrote `false` keeps
+ *      strict single-account behaviour across this change.
+ *   3. Presence: 2 or more eligible stored accounts (#2568d, owner decision).
+ *
+ * Only an explicit boolean overrides presence. A malformed value falls through instead of
+ * throwing, because a typo in a knob must not take a provider out of service.
+ */
+export function isGenericOAuthFailoverEnabled(
+  config: OcxConfig,
+  providerName: string,
+  now = Date.now(),
+): boolean {
+  const provider = config.providers?.[providerName];
+  if (!provider || !isGenericFailoverProvider(providerName, provider)) return false;
+  const perProvider = provider.oauthAccountFailover?.enabled;
+  if (typeof perProvider === "boolean") return perProvider;
+  const global = config.oauthAccountFailover?.enabled;
+  if (typeof global === "boolean") return global;
+  return hasFailoverAccountQuorum(providerName, now);
+}
+
+/** Accounts that may serve traffic right now: not cooled, not flagged for reauth. */
+export function eligibleFailoverAccounts(providerName: string, now = Date.now()): string[] {
+  const set = getAccountSet(providerName);
+  if (!set) return [];
+  return set.accounts
+    .filter(account => account.needsReauth !== true && !isCooled(providerName, account.id, now))
+    .map(account => account.id);
+}
+
+/**
+ * Cool the account that actually 429'd and name the next eligible one, or null.
+ *
+ * Returns the id only; the caller mints the credential so a failed refresh does not leave the
+ * cooldown applied to an account we then could not use.
+ */
+export function rotateGenericOAuthAccountOn429(
+  config: OcxConfig,
+  providerName: string,
+  failedAccountId: string,
+  retryAfterHeader: string | null | undefined,
+  now = Date.now(),
+): string | null {
+  if (!isGenericOAuthFailoverEnabled(config, providerName)) return null;
+  const set = getAccountSet(providerName);
+  // A single stored account has nowhere to go; rotating to itself would just replay the 429.
+  if (!set || set.accounts.length < 2) return null;
+
+  const parsed = parseRetryAfterMs(retryAfterHeader, now);
+  const cooldownMs = Math.min(parsed ?? DEFAULT_COOLDOWN_MS, MAX_COOLDOWN_MS);
+  health.set(healthKey(providerName, failedAccountId), {
+    cooldownUntil: now + cooldownMs,
+    cooldownSource: parsed ? "retry-after" : "default",
+  });
+  sweepExpiredOnWrite(now);
+
+  const eligible = eligibleFailoverAccounts(providerName, now).filter(id => id !== failedAccountId);
+  if (eligible.length === 0) return null;
+  // A rotation means the roster in use just changed; do not answer the next activation question
+  // from a count read before the failure.
+  presence.delete(providerName);
+  // Deterministic: start after the failed account so repeated 429s walk the roster instead of
+  // hammering whichever id happens to sort first.
+  const order = set.accounts.map(account => account.id);
+  const start = order.indexOf(failedAccountId);
+  for (let i = 1; i <= order.length; i++) {
+    const candidate = order[(start + i) % order.length]!;
+    if (candidate !== failedAccountId && eligible.includes(candidate)) return candidate;
+  }
+  return null;
+}
+
+/**
+ * Full credential snapshot for a rotated account.
+ *
+ * Returns the snapshot rather than a bare bearer: Antigravity pairs an account-matched
+ * `projectId` with its token and Kiro carries routing metadata, so a token-only swap would mix
+ * one account's bearer with another's routing data.
+ */
+export async function failoverAccountSnapshot(
+  providerName: string,
+  accountId: string,
+): Promise<OAuthAccessSnapshot> {
+  return getValidAccessSnapshotForAccount(providerName, accountId);
+}
+
+/** Earliest remaining cooldown, for a client-facing Retry-After when every account is cooled. */
+export function genericFailoverRetryAfterSeconds(providerName: string, now = Date.now()): number | null {
+  const set = getAccountSet(providerName);
+  if (!set) return null;
+  let earliest: number | null = null;
+  for (const account of set.accounts) {
+    const entry = health.get(healthKey(providerName, account.id));
+    if (!entry || entry.cooldownUntil <= now) continue;
+    if (earliest === null || entry.cooldownUntil < earliest) earliest = entry.cooldownUntil;
+  }
+  return earliest === null ? null : Math.max(1, Math.ceil((earliest - now) / 1000));
+}
+
+/** Test seam and manual-recovery hook. */
+export function clearGenericFailoverHealth(providerName?: string): void {
+  if (!providerName) {
+    health.clear();
+    presence.clear();
+    return;
+  }
+  presence.delete(providerName);
+  for (const key of [...health.keys()]) {
+    if (key.startsWith(`${providerName}\u0000`)) health.delete(key);
+  }
+}

package/src/oauth/index.ts

@@ -58,11 +58,20 @@ export interface OAuthAccessSnapshot {
   /** Cloud Code Assist project selected during Antigravity login. */
   projectId?: string;
   /** Safe request-routing subset; refresh-only Kiro client secrets never leave the credential store. */
-  kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion">;
+  kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion" | "authType">;
+  /**
+   * Allowlisted GitHub Copilot API origin belonging to THIS account.
+   *
+   * Copilot pins its bearer to an account-scoped regional host, and the initial route already
+   * pairs the two (`core.ts` resolves transport with `getOAuthCredentialApiBaseUrl`). Account
+   * failover must carry the pairing across the rotation; without it, account B's token is sent to
+   * account A's origin (#2568d).
+   */
+  apiBaseUrl?: string;
 }
 
 export interface ObservedOAuthAccessSnapshot extends OAuthAccessSnapshot {
-  /** Allowlisted provider API origin consumed by GitHub Copilot model discovery. */
+  /** Retained for callers that predate `apiBaseUrl` moving onto the base snapshot. */
   apiBaseUrl?: string;
 }
 
@@ -350,24 +359,43 @@ export function publicOAuthAuthenticationErrorMessage(error: unknown): string {
 }
 
 function accessSnapshot(provider: string, accountId: string, cred: OAuthCredentials): OAuthAccessSnapshot {
+  // Derived, not read back: a stored `authType` is trusted when present, but a credential imported
+  // before the field existed still routes correctly because the client pair implies SSO OIDC.
+  const kiroAuthType = cred.kiro?.authType
+    ?? (cred.kiro?.clientId && cred.kiro?.clientSecret ? "aws_sso_oidc" as const : undefined);
   const storedKiroRouting = {
     ...(cred.kiro?.profileArn ? { profileArn: cred.kiro.profileArn } : {}),
     ...(cred.kiro?.apiRegion ? { apiRegion: cred.kiro.apiRegion } : {}),
     ...(cred.kiro?.ssoRegion ? { ssoRegion: cred.kiro.ssoRegion } : {}),
   };
+  // `authType` is a property OF the account, not routing the environment can substitute for, so it
+  // is merged after the environment fallback decision rather than counting as stored routing.
+  // Folding it into `storedKiroRouting` would make a client-pair-only credential look non-empty
+  // and silently disable `environmentKiroRoutingMetadata()` for it.
+  const kiroAuthTypeRouting = kiroAuthType ? { authType: kiroAuthType } : {};
+  // Validated here, not at the call site: an unvalidated origin from a legacy or crafted
+  // credential must never travel with a bearer, and dropping it makes the transport fall back to
+  // the canonical host rather than to whatever the previous account was using.
+  const copilotApiBaseUrl = provider === "github-copilot"
+    ? validateCopilotApiBaseUrl(cred.apiBaseUrl)
+    : undefined;
   return {
     provider,
     accountId,
     generation: credentialGeneration(cred),
     accessToken: cred.access,
     ...(cred.projectId ? { projectId: cred.projectId } : {}),
+    ...(copilotApiBaseUrl ? { apiBaseUrl: copilotApiBaseUrl } : {}),
     // Stored account metadata remains authoritative. Metadata-less legacy/environment credentials
     // may use explicit environment routing, but never borrow the currently signed-in local CLI account.
     ...(provider === "kiro"
       ? {
-          kiro: Object.keys(storedKiroRouting).length > 0
-            ? storedKiroRouting
-            : environmentKiroRoutingMetadata() ?? {},
+          kiro: {
+            ...(Object.keys(storedKiroRouting).length > 0
+              ? storedKiroRouting
+              : environmentKiroRoutingMetadata() ?? {}),
+            ...kiroAuthTypeRouting,
+          },
         }
       : {}),
   };
@@ -490,6 +518,22 @@ export async function getValidAccessTokenForAccount(provider: string, accountId:
   return (await resolveAccessSnapshotForAccount(provider, accountId)).accessToken;
 }
 
+/**
+ * Account-scoped resolver returning the FULL snapshot, not just the bearer.
+ *
+ * A rotator that swaps only the token silently mixes credential generations: Antigravity pairs
+ * an account-matched `projectId` with its token (see the pairing comment in
+ * server/responses/core.ts), Kiro carries routing metadata, and Copilot's observed snapshot
+ * carries an account-specific API origin. Reading those back from "whichever account is active"
+ * after a rotation is exactly the mixing this returns in one piece to prevent (#2568).
+ */
+export async function getValidAccessSnapshotForAccount(
+  provider: string,
+  accountId: string,
+): Promise<OAuthAccessSnapshot> {
+  return resolveAccessSnapshotForAccount(provider, accountId);
+}
+
 /** Terminal refresh failures (revoked/rotated-away grants) — retrying cannot succeed. */
 function isTerminalRefreshError(err: unknown): boolean {
   const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
@@ -1079,6 +1123,14 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   if (existing?.modelCosts !== undefined) {
     next.modelCosts = existing.modelCosts;
   }
+  // The per-provider account-failover opt-out is operator intent about SPENDING, and the login
+  // path is exactly where losing it does damage: adding a second account both rebuilds this row
+  // from the preset and creates the 2-account quorum that turns presence-driven rotation on
+  // (#2568d). Dropping the opt-out here would enable the thing the operator switched off, at the
+  // moment they were doing something unrelated.
+  if (existing?.oauthAccountFailover !== undefined) {
+    next.oauthAccountFailover = existing.oauthAccountFailover;
+  }
   if (existing && getProviderRegistryEntry(provider)?.allowKeyAuthOverride === true) {
     // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
     let storedApiKey = sanitizeApiKeyValue(existing.apiKey);

package/src/oauth/key-providers.ts

@@ -19,7 +19,8 @@ export const KEY_LOGIN_PROVIDERS: Record<string, KeyLoginProvider> = deriveKeyLo
  * caller didn't already supply. Lets the vision/reasoning classification actually reach the saved
  * config (the GUI/API only send adapter/baseUrl/apiKey/defaultModel). No-op for unknown names.
  *
- * `modelSupportsReasoningSummaries` is deliberately excluded from what gets persisted. It is
+ * `modelSupportsReasoningSummaries` and the verbosity capability are deliberately excluded from
+ * what gets persisted. They are
  * registry-only metadata resolved at runtime, and this function feeds a config that is about to
  * be written to disk. Persisting today's registry defaults would freeze them as the user's own
  * overrides: a later registry correction — say we learn a model's backend rejects summary
@@ -30,9 +31,17 @@ export const KEY_LOGIN_PROVIDERS: Record<string, KeyLoginProvider> = deriveKeyLo
 export function enrichProviderFromCatalog(name: string, prov: OcxProviderConfig): void {
   const hadOwnSummaries = Object.hasOwn(prov, "modelSupportsReasoningSummaries");
   const submittedSummaries = prov.modelSupportsReasoningSummaries;
+  const hadOwnVerbosity = Object.hasOwn(prov, "modelSupportsVerbosity");
+  const submittedVerbosity = prov.modelSupportsVerbosity;
+  const hadOwnProviderVerbosity = Object.hasOwn(prov, "supportsVerbosity");
+  const submittedProviderVerbosity = prov.supportsVerbosity;
   enrichProviderFromRegistry(name, prov);
   if (hadOwnSummaries) prov.modelSupportsReasoningSummaries = submittedSummaries;
   else delete prov.modelSupportsReasoningSummaries;
+  if (hadOwnVerbosity) prov.modelSupportsVerbosity = submittedVerbosity;
+  else delete prov.modelSupportsVerbosity;
+  if (hadOwnProviderVerbosity) prov.supportsVerbosity = submittedProviderVerbosity;
+  else delete prov.supportsVerbosity;
 }
 
 export function isKeyLoginProvider(name: string): boolean {

package/src/oauth/kiro.ts

@@ -28,6 +28,7 @@ import {
 } from "./kiro-credentials";
 import { homedir } from "node:os";
 import { getAccountSet, saveAccountCredential } from "./store";
+import { KIRO_BUILDER_ID_SERVICE_PROFILE_ARN } from "../adapters/kiro-constants";
 
 const DEFAULT_REGION = "us-east-1";
 const REFRESH_URL = "https://prod.{region}.auth.desktop.kiro.dev/refreshToken";
@@ -473,6 +474,50 @@ export function resolveKiroProfileArn(account?: Pick<KiroOAuthMetadata, "profile
   return readImportedKiroCredential()?.profileArn;
 }
 
+/**
+ * Resolve the profileArn actually SENT upstream, which is not always the account's own.
+ *
+ * An AWS Builder ID account authenticates through SSO OIDC and never receives an account-scoped
+ * profile ARN, so gated models reject its requests with a `profileArn`-demanding
+ * `ValidationException`. The Kiro CLI handles this by carrying a fixed service profile on Builder
+ * ID requests, and this mirrors that.
+ *
+ * Deliberately separate from `resolveKiroProfileArn`: that resolver answers "what is this
+ * account's profile", and callers that ask it — region inference, account matching, continuation
+ * scoping — must keep receiving `undefined` here. Only request construction uses this function.
+ *
+ * The fallback is gated on `authType === "aws_sso_oidc"` rather than on a missing ARN, so a
+ * `kiro_desktop` account whose profile import failed keeps producing its actionable error instead
+ * of silently borrowing a service profile that does not describe it.
+ */
+export function resolveKiroRequestProfileArn(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): string | undefined {
+  return resolveKiroRequestProfile(account).profileArn;
+}
+
+/**
+ * The profileArn to send, together with WHY it was chosen.
+ *
+ * The request builder must decide the wire envelope from the same evaluation that produced the
+ * ARN. Re-deriving "is this Builder ID" from the account context alone would miss the accountless
+ * path, where the auth type comes from the locally imported credential instead: the fallback would
+ * be sent while the request was shaped as an enterprise IDE call, which is not a combination the
+ * vendor client ever produces.
+ */
+export function resolveKiroRequestProfile(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): { profileArn: string | undefined; builderIdFallback: boolean } {
+  const own = resolveKiroProfileArn(account);
+  if (own) return { profileArn: own, builderIdFallback: false };
+  const authType = account !== undefined
+    ? account.authType
+    : readImportedKiroCredential()?.authType;
+  return authType === "aws_sso_oidc"
+    ? { profileArn: KIRO_BUILDER_ID_SERVICE_PROFILE_ARN, builderIdFallback: true }
+    : { profileArn: undefined, builderIdFallback: false };
+}
+
 async function kiroTokenRefreshError(response: Response): Promise<KiroTokenRefreshError> {
   let oauthError: string | undefined;
   try {