@bitkyc08/opencodex 2.33.0 → 2.34.0

package/src/adapters/google.ts

@@ -26,7 +26,7 @@ import { identifyRoutedModel } from "./identity";
 import { antigravityUsesReplayCache, applyAntigravityReplay, clearAntigravityReplay, observeAntigravityReplay } from "./google-antigravity-replay";
 import { resolveAntigravityEffortWireModel } from "../providers/antigravity-models";
 import { googleVertexLocationConfigError } from "../providers/google-vertex-location";
-import { lookupReplayThoughtSignature } from "../responses/thought-signature-replay";
+import { forgetThoughtSignatureForReplay, lookupReplayThoughtSignature } from "../responses/thought-signature-replay";
 import {
   isTranslatorBudgetExceededError,
   retainTranslatedEventBatch,
@@ -48,6 +48,43 @@ const GOOGLE_BREVITY_INSTRUCTION = [
   "- This applies only to intermediate progress text. Your final answer after the work is done is exempt: write it in full and at whatever length the task requires.",
 ].join("\n");
 
+/**
+ * Documented output ceiling for a Google-surface model, or `undefined` when the id is not
+ * recognized.
+ *
+ * Unknown ids return `undefined` deliberately. An earlier revision returned a 16,384 floor for
+ * anything unmatched, which silently truncated aliases, gateway ids, and any model added after
+ * this table was written — the operator asked for N tokens and got 16,384 with no signal. A cap
+ * we cannot justify is worse than no cap: `structure/02_config-and-codex-home.md` is explicit
+ * that an explicit request value wins, so an unrecognized model passes through untouched and the
+ * upstream remains the authority on its own limit.
+ *
+ * Matching is prefix/family based rather than substring based for the same reason: `includes("pro")`
+ * matched any id containing "pro" (`my-prototype-model`), and `includes("oss")` matched any id
+ * containing "oss" (`crossover-v2`).
+ */
+export function maxOutputTokensForGoogleModel(modelId: string): number | undefined {
+  const lower = modelId.toLowerCase().trim();
+  if (lower.startsWith("gemini")) {
+    // Pro tops out one token below the flash/other Gemini ceiling; both are documented values.
+    return /(^|[-.])pro([-.]|$)/.test(lower) ? 65535 : 65536;
+  }
+  if (lower.startsWith("claude")) return 64000;
+  if (lower.startsWith("gpt-oss")) return 32768;
+  return undefined;
+}
+
+export function clampGoogleMaxOutputTokens(
+  modelId: string,
+  requestedTokens?: number,
+): number | undefined {
+  if (requestedTokens === undefined || requestedTokens <= 0) return undefined;
+  const modelMax = maxOutputTokensForGoogleModel(modelId);
+  // Unknown model: honour the request as-is rather than inventing a ceiling for it.
+  if (modelMax === undefined) return requestedTokens;
+  return Math.min(requestedTokens, modelMax);
+}
+
 /**
  * Some Google direct deployments expose current Gemini Flash generations with a `-tiered`
  * wire suffix (`gemini-3.7-flash` -> `gemini-3.7-flash-tiered`). Keep the picker-visible id
@@ -141,7 +178,7 @@ function geminiTextPart(text: unknown): { text: string } | undefined {
  */
 function geminiToolResultText(content: string | OcxContentPart[]): string {
   if (typeof content === "string") return content || GEMINI_EMPTY_TOOL_OUTPUT_PLACEHOLDER;
-  const hasContent = content.some(p => p.type === "image" || (typeof p.text === "string" && p.text.length > 0));
+  const hasContent = content.some(p => p.type !== "text" || p.text.length > 0);
   return hasContent ? contentPartsToText(content) : GEMINI_EMPTY_TOOL_OUTPUT_PLACEHOLDER;
 }
 
@@ -184,7 +221,7 @@ function geminiOrphanToolResultParts(msg: OcxToolResultMessage): unknown[] {
 function messagesToGeminiFormat(
   parsed: OcxParsedRequest,
   identityModelId: string,
-): { systemInstruction?: unknown; contents: unknown[] } {
+): { systemInstruction?: unknown; contents: unknown[]; replayedCallIds: string[] } {
   // Neutralize Codex's GPT-5 identity line (Gemini/Antigravity share this path) so a routed model
   // never misreports as GPT-5/OpenAI, and never leaks the proxy identity upstream.
   const toolCatalogNudge = buildNonOpenAIToolCatalogNudgeForTools(parsed.context.tools, parsed.options.toolChoice);
@@ -196,6 +233,7 @@ function messagesToGeminiFormat(
   const systemInstruction = { parts: [{ text: systemText }] };
 
   const contents: unknown[] = [];
+  const replayedCallIds: string[] = [];
 
   const callIds = createToolCallIdAllocator();
   for (const msg of parsed.context.messages) {
@@ -224,6 +262,13 @@ function messagesToGeminiFormat(
               parts.push(data ? { inline_data: { mime_type: data.mediaType, data: data.base64 } } : { text: `[image: ${p.imageUrl}]` });
               continue;
             }
+            if (p.type === "video") {
+              const data = parseDataUrl(p.videoUrl);
+              // Gemini accepts inline video bytes in the same Part union as images. Arbitrary
+              // remote URLs are not valid fileData references, so retain only a short marker.
+              parts.push(data ? { inline_data: { mime_type: data.mediaType, data: data.base64 } } : { text: `[video: ${p.videoUrl}]` });
+              continue;
+            }
             // Drop empty/malformed text instead of emitting `{ text: "" }` or a bare `{}` part.
             const textPart = geminiTextPart(p.text);
             if (textPart) parts.push(textPart);
@@ -271,7 +316,10 @@ function messagesToGeminiFormat(
             const signature = tc.providerMetadata?.google?.thoughtSignature
               ?? tc.thoughtSignature
               ?? lookupReplayThoughtSignature(tc.id, parsed._reasoningReplayScope);
-            if (isLikelyRealThoughtSignature(signature)) part.thoughtSignature = signature;
+            if (isLikelyRealThoughtSignature(signature)) {
+              part.thoughtSignature = signature;
+              replayedCallIds.push(tc.id);
+            }
             parts.push(part);
           }
         }
@@ -323,7 +371,7 @@ function messagesToGeminiFormat(
     }
   }
 
-  return { systemInstruction, contents };
+  return { systemInstruction, contents, replayedCallIds };
 }
 
 function toolsToGeminiFormat(parsed: OcxParsedRequest): unknown[] | undefined {
@@ -610,6 +658,47 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
   let vertexReplayModel: string | undefined;
   let vertexReplaySession: string | undefined;
   let restoreGoogleToolName = (name: string): string => name;
+  let lastInjectedCallIds: string[] = [];
+  let lastReasoningReplayScope: OcxParsedRequest["_reasoningReplayScope"];
+
+  // Conservative batch invalidation: upstream Gemini/Antigravity errors (e.g.
+  // "Function call is missing a thought_signature in functionCall parts") do not specify which
+  // specific call_id was rejected. When a request containing replayed signatures is rejected,
+  // we evict all callIds injected in that turn (lastInjectedCallIds) from the durable store
+  // and clear the session replay cache, preventing poisoned-signature loops while allowing
+  // subsequent turns to re-accumulate valid signatures. Unrelated calls from other turns remain intact.
+  //
+  // Memory-cache clearing stays broad (any invalid-argument/signature error can poison the
+  // session replay cache), but durable-store eviction is intentionally narrower: it only runs
+  // when the error text explicitly mentions a signature, so a generic tool-schema
+  // INVALID_ARGUMENT does not destroy valid durable signatures.
+  function handleSignatureRejection(errorMessage?: string) {
+    const replayModel = provider.googleMode === "cloud-code-assist" ? antigravityModel : vertexReplayModel;
+    const replaySession = provider.googleMode === "cloud-code-assist" ? antigravitySession : vertexReplaySession;
+    const text = errorMessage ?? "";
+    const isInvalidArgument = /invalid_argument|invalid argument/i.test(text);
+    const isSignatureError = /signature|thought_signature|thoughtSignature/i.test(text);
+    // The in-memory Antigravity replay cache only exists for CCA/Vertex, so clearing it stays
+    // scoped to those modes (replayModel/replaySession are undefined elsewhere anyway).
+    if (
+      (provider.googleMode === "cloud-code-assist" || provider.googleMode === "vertex")
+      && replayModel && replaySession && (isInvalidArgument || isSignatureError)
+    ) {
+      clearAntigravityReplay(replayModel, replaySession);
+    }
+    // The DURABLE store is not mode-scoped: signatures are remembered through
+    // rememberAndSerializeExtraContent and read back by lookupReplayThoughtSignature on every
+    // Google mode, including AI Studio. Gating eviction on CCA/Vertex therefore left AI Studio
+    // with rejected signatures cached forever, replaying them into every subsequent turn — the
+    // store poisons itself and the request keeps failing. Eviction follows the same scope the
+    // write does.
+    if (isSignatureError) {
+      for (const callId of lastInjectedCallIds) {
+        forgetThoughtSignatureForReplay(callId, lastReasoningReplayScope);
+      }
+    }
+  }
+
   return {
     name: "google",
 
@@ -638,7 +727,9 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
           : resolveDirectGeminiWireModelId(parsed.modelId, provider.directGeminiWireRenames !== false);
       // AI Studio's `-tiered` spelling is wire-only; CCA aliases may migrate to another generation.
       const identityModelId = provider.googleMode === "cloud-code-assist" ? routedModelId : parsed.modelId;
-      const { systemInstruction, contents } = messagesToGeminiFormat(parsed, identityModelId);
+      const { systemInstruction, contents, replayedCallIds } = messagesToGeminiFormat(parsed, identityModelId);
+      lastInjectedCallIds = [...replayedCallIds];
+      lastReasoningReplayScope = parsed._reasoningReplayScope;
       const tools = toolsToGeminiFormat(parsed);
 
       const body: Record<string, unknown> = { contents };
@@ -650,7 +741,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       if (toolConfig) body.toolConfig = toolConfig;
 
       const generationConfig: Record<string, unknown> = {};
-      if (parsed.options.maxOutputTokens) generationConfig.maxOutputTokens = parsed.options.maxOutputTokens;
+      const clampedMaxOutputTokens = clampGoogleMaxOutputTokens(identityModelId, parsed.options.maxOutputTokens);
+      if (clampedMaxOutputTokens !== undefined) generationConfig.maxOutputTokens = clampedMaxOutputTokens;
       if (parsed.options.temperature !== undefined) generationConfig.temperature = parsed.options.temperature;
       if (parsed.options.topP !== undefined) generationConfig.topP = parsed.options.topP;
       if (parsed.options.stopSequences) generationConfig.stopSequences = parsed.options.stopSequences;
@@ -864,14 +956,9 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         if (chunk.error) {
           const err = chunk.error as { message?: string } | undefined;
           // Clear-on-invalid: a signature rejection means our replayed thoughtSignatures are stale.
-          // Drop the cache entry so the next turn starts clean instead of re-injecting a bad sig.
-          const replayModel = provider.googleMode === "cloud-code-assist" ? antigravityModel : vertexReplayModel;
-          const replaySession = provider.googleMode === "cloud-code-assist" ? antigravitySession : vertexReplaySession;
-          if ((provider.googleMode === "cloud-code-assist" || provider.googleMode === "vertex")
-            && replayModel && replaySession
-            && /signature|invalid_argument|invalid argument/i.test(err?.message ?? "")) {
-            clearAntigravityReplay(replayModel, replaySession);
-          }
+          // Drop the cache entry and durable store entry for rejected calls so the next turn
+          // starts clean instead of re-injecting a bad sig.
+          handleSignatureRejection(err?.message);
           yield { type: "error", message: err?.message ?? "upstream error" };
           return "terminate";
         }
@@ -1158,7 +1245,18 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       let raw: Record<string, unknown>;
       let rawBytes = 0;
       try {
-        raw = JSON.parse(rawText) as Record<string, unknown>;
+        const parsedRaw: unknown = JSON.parse(rawText);
+        // `JSON.parse("null")` returns null instead of throwing, so the catch below cannot see it
+        // and the `raw.error` read crashed the turn — #1219 at the buffered body root, which #1240
+        // never reached because that audit swept SSE frame parsers only. There is no next frame to
+        // recover into here, so unlike a stream frame this fails closed, matching the
+        // unparseable-body branch just below and the buffered candidate guards added in #2232.
+        if (!isGoogleRecord(parsedRaw)) {
+          budget.releaseRetained(rawTextBytes, { kind: "retained_collectors" });
+          const valueType = googleStructuralValueType(parsedRaw);
+          return [{ type: "error", message: `google response was not a JSON object (${valueType})` }];
+        }
+        raw = parsedRaw;
         rawBytes = new TextEncoder().encode(JSON.stringify(raw)).byteLength;
         const rawReservation = budget.reserveTransient(rawBytes, { kind: "retained_collectors" });
         rawReservation.commitRetained();
@@ -1175,6 +1273,7 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       };
       if (raw.error) {
         const err = raw.error as { message?: string };
+        handleSignatureRejection(err.message);
         return finish([{ type: "error", message: err.message ?? "upstream error" }]);
       }
       // Antigravity (CCA) nests the standard Gemini payload under `response`; unwrap it.

package/src/adapters/image.ts

@@ -18,6 +18,6 @@ export function parseDataUrl(url: string): { mediaType: string; base64: string }
  */
 export function contentPartsToText(content: string | OcxContentPart[]): string {
   if (typeof content === "string") return content;
-  const text = content.map(p => (p.type === "text" ? p.text : "[image]")).join("");
+  const text = content.map(p => p.type === "text" ? p.text : p.type === "image" ? "[image]" : "[video]").join("");
   return text || "[image]";
 }

package/src/adapters/kiro-constants.ts

@@ -1,4 +1,19 @@
 export const KIRO_COMPLETION_TOOL_NAME = "codex_kiro_final_answer";
+
+/**
+ * Request-scoped CodeWhisperer service profile for AWS Builder ID accounts.
+ *
+ * Builder ID is a personal identity with no AWS account behind it, so AWS never mints an
+ * account-scoped `profile/<id>` ARN for it. The Kiro CLI resolves this the same way: it carries
+ * this fixed service profile on Builder ID requests. The embedded account id is Amazon's own, not
+ * the user's, which is why sending it is not the same as synthesizing an account identity.
+ *
+ * Request-scoped is load-bearing. This value must never be persisted into `KiroOAuthMetadata`,
+ * never seed region inference (it is `us-east-1` and would pin every Builder ID account there),
+ * and never participate in account matching.
+ */
+export const KIRO_BUILDER_ID_SERVICE_PROFILE_ARN =
+  "arn:aws:codewhisperer:us-east-1:638616132270:profile/AAAACCCCXXXX";
 export const KIRO_CONTINUATION_MESSAGE =
   "Continue from the prior conversation. Do not quote or mention this instruction.";
 export const KIRO_COMPLETION_RETRY_MESSAGE =

package/src/adapters/kiro-tools.ts

@@ -1,6 +1,7 @@
 import type { OcxParsedRequest, OcxTool } from "../types";
 import { namespacedToolName } from "../types";
 import { normalizeKiroModelId } from "../providers/kiro-models";
+import { isCodexCodeModeExecTool } from "./tool-catalog-nudge";
 import { createKiroToolNameRegistry, type KiroToolNameRegistry } from "./kiro-wire";
 
 const MAX_KIRO_TOOL_DESCRIPTION_UNVERIFIED = 1024;
@@ -103,7 +104,7 @@ function ensureRootObjectType(schema: unknown): Record<string, unknown> {
   // Seed with the root's own properties/required so a schema like
   // { type:"object", properties:{path}, required:["path"], oneOf:[...] } keeps them.
   if (obj.properties && typeof obj.properties === "object") {
-    Object.assign(props, sanitizeKiroSchema(obj.properties) as Record<string, unknown>);
+    Object.assign(props, sanitizeSchemaMap(obj.properties) as Record<string, unknown>);
   }
   if (Array.isArray(obj.required)) {
     for (const r of obj.required) if (typeof r === "string") required.add(r);
@@ -118,7 +119,7 @@ function ensureRootObjectType(schema: unknown): Record<string, unknown> {
       if (!variant || typeof variant !== "object" || Array.isArray(variant)) continue;
       const v = variant as Record<string, unknown>;
       if (v.properties && typeof v.properties === "object") {
-        Object.assign(props, sanitizeKiroSchema(v.properties) as Record<string, unknown>);
+        Object.assign(props, sanitizeSchemaMap(v.properties) as Record<string, unknown>);
       }
       if (mergeRequired && Array.isArray(v.required)) {
         for (const r of v.required) if (typeof r === "string") required.add(r);
@@ -174,8 +175,14 @@ function omittedToolCatalogNotice(kept: number, omitted: readonly OcxTool[], reg
 
 function boundedCatalogPriority(tool: OcxTool): number {
   if (tool.loadedFromToolSearch) return 0;
-  if (tool.toolSearch) return 1;
-  return 2;
+  // Codex code mode reaches shell, file edits, apply_patch and every MCP helper ONLY as nested
+  // `tools.<name>(...)` calls inside this one tool. Dropping it does not shrink the catalog, it
+  // makes the rest of the catalog uncallable -- so it outranks the search gateway and filler.
+  // It stays BEHIND `loadedFromToolSearch` because those are tools the model asked for by name
+  // this turn (#2475). Cursor pins its execution path the same way (request-builder.ts, #399).
+  if (isCodexCodeModeExecTool(tool)) return 1;
+  if (tool.toolSearch) return 2;
+  return 3;
 }
 
 export function convertKiroToolContext(
@@ -209,19 +216,40 @@ export function convertKiroToolContext(
   const candidates = exceedsBudget
     ? convertedEntries.toSorted((a, b) => boundedCatalogPriority(a.tool) - boundedCatalogPriority(b.tool) || a.index - b.index)
     : convertedEntries;
-  const convertedTools: unknown[] = [];
-  let omittedAt = candidates.length;
-  for (const [index, entry] of candidates.entries()) {
+  // Reserve a seat for the code-mode execution path before filling the rest.
+  //
+  // Priority alone cannot save it. `loadedFromToolSearch` tools outrank it and arrive unbounded
+  // (the Responses parser pushes every `tool_search_output` spec), so a session that accumulated
+  // MAX_KIRO_TOOL_COUNT loaded tools would exhaust the budget before reaching tier 1 and drop the
+  // one tool through which all of them are actually callable.
+  //
+  // Reservation rather than eviction: this lowers the room the fill loop sees, so it admits one
+  // fewer tool. It never removes a tool that already fit, which is what keeps #2475's loaded-result
+  // guarantee intact -- Cursor's `evictNonExecutionPath` exempts only the execution path and could
+  // evict a loaded tool instead.
+  const reserved = candidates.find(entry => isCodexCodeModeExecTool(entry.tool));
+  const admitted = new Set<number>();
+  const filled: unknown[] = [];
+  for (const entry of candidates) {
+    if (entry === reserved) continue;
+    // Measure the projected FINAL array: the byte budget is computed over the serialized array, so
+    // subtracting a standalone size would misjudge it by the separators JSON adds between entries.
+    const projected = reserved ? [...filled, entry.converted, reserved.converted] : [...filled, entry.converted];
     if (
-      convertedTools.length >= MAX_KIRO_TOOL_COUNT
-      || serializedToolCatalogBytes([...convertedTools, entry.converted]) > MAX_KIRO_TOOL_CATALOG_BYTES
-    ) {
-      omittedAt = index;
-      break;
-    }
-    convertedTools.push(entry.converted);
+      projected.length > MAX_KIRO_TOOL_COUNT
+      || serializedToolCatalogBytes(projected) > MAX_KIRO_TOOL_CATALOG_BYTES
+    ) break;
+    filled.push(entry.converted);
+    admitted.add(entry.index);
   }
-  const omittedTools = candidates.slice(omittedAt).map(entry => entry.tool);
+  if (reserved) admitted.add(reserved.index);
+  // Rebuild in sorted-candidate order so the wire order stays loaded -> exec -> gateway -> filler.
+  // Pushing the reserved entry after the loop would place it last instead.
+  const convertedTools = candidates.filter(entry => admitted.has(entry.index)).map(entry => entry.converted);
+  // Derive omissions by set difference. The old `candidates.slice(omittedAt)` assumed every
+  // candidate after the first rejection was omitted, which stops being true once one of them was
+  // reserved and admitted: the notice would name `exec` unavailable while it is on the wire.
+  const omittedTools = candidates.filter(entry => !admitted.has(entry.index)).map(entry => entry.tool);
   return {
     tools: convertedTools,
     systemAdditions: omittedTools.length > 0 ? [omittedToolCatalogNotice(convertedTools.length, omittedTools, registry)] : [],

package/src/adapters/kiro.ts

@@ -1,7 +1,7 @@
 import { decodeEventStream } from "../lib/eventstream-decoder";
 import { estimateTokens } from "../lib/token-estimate";
 import { debugProviderDiagnostic } from "../lib/debug";
-import { resolveKiroApiRegion, resolveKiroProfileArn } from "../oauth/kiro";
+import { resolveKiroApiRegion, resolveKiroRequestProfile } from "../oauth/kiro";
 import { KIRO_MODEL_CONTEXT_WINDOWS, normalizeKiroModelId } from "../providers/kiro-models";
 import { modelRecordValue } from "../reasoning-effort";
 import { parseKiroEvent } from "./kiro-events";
@@ -33,6 +33,7 @@ import type {
   OcxTextContent,
   OcxToolCall,
   OcxToolResultMessage,
+  OcxTool,
   OcxUsage,
 } from "../types";
 import type { ProviderAdapter } from "./base";
@@ -42,7 +43,7 @@ import { sniffImageDimensions } from "./anthropic-image-guard";
 import { fetchKiroWithRetry, noteKiroTransientThrottle } from "./kiro-retry";
 import { convertKiroToolContext } from "./kiro-tools";
 import { identifyRoutedModel } from "./identity";
-import { buildNonOpenAIToolCatalogNudgeFromNames } from "./tool-catalog-nudge";
+import { buildNonOpenAIToolCatalogNudgeFromNames, isBareShellBridgeTool, isCodexCodeModeExecTool } from "./tool-catalog-nudge";
 import {
   KIRO_COMPLETION_INSTRUCTIONS,
   KIRO_COMPLETION_RETRY_MESSAGE,
@@ -321,9 +322,23 @@ function validateKiroCapabilities(parsed: OcxParsedRequest): void {
   if (parsed.options.serviceTier !== undefined) {
     throw new Error("Kiro does not support service tiers");
   }
-  const raw = parsed._rawBody as Record<string, unknown> | undefined;
-  if (parsed._structuredOutput || raw?.text !== undefined) {
-    throw new Error("Kiro does not support Responses text controls or structured output");
+  // Structured output is a real contract Kiro cannot honour: the wire has no
+  // schema-constrained response mode, so a caller expecting parseable JSON would receive
+  // prose and fail downstream. Refuse it.
+  //
+  // The rest of the Responses `text` object is not that. `text.verbosity` is a length
+  // preference and `text.format: {type:"text"}` is ordinary prose — the default output
+  // mode, which no capability flag governs and every correct client may send. Testing
+  // `_rawBody.text !== undefined` refused those turns for the mere PRESENCE of the key,
+  // the same mistake db040e70f removed one condition earlier where a permissive
+  // `parallel_tool_calls` hint was read as a requirement.
+  //
+  // Nothing needs stripping the way openai-responses strips a no-op verbosity:
+  // buildKiroPayload composes conversationState field by field from `parsed` and never
+  // spreads `_rawBody`, so a tolerated control is dropped by construction. The test
+  // asserts that absence so it stays true.
+  if (parsed._structuredOutput) {
+    throw new Error("Kiro does not support Responses structured output");
   }
 }
 
@@ -460,9 +475,32 @@ export function buildKiroPayload(
   // name for a tool that was never advertised and pollute the collision domain.
   const advertisedAlias = new Map<string, string>();
   for (const [alias, wireName] of registry.nameMap) advertisedAlias.set(wireName, alias);
+  // Code mode is decided on the EMITTED catalog, not the requested list.
+  //
+  // `freeform` only exists on the requested tool objects -- `kiroToolWireNames` has already
+  // reduced the emitted catalog to strings -- so the predicates must read the objects. But the
+  // SHAPE that matters is the one the model receives: the count/byte budget can drop a requested
+  // `exec_command` while `exec` survives, and scanning the requested list would then find a shell
+  // bridge the model cannot call and suppress code mode for a catalog that is code-mode-shaped.
+  // Intersecting the two keeps `tool_choice: "none"` and budget omission correct for free: both
+  // empty the emitted set, so nothing can be named.
+  const emittedToolNames = new Set(kiroToolWireNames(kiroTools));
+  const emittedAlias = (tool: OcxTool): string | undefined => {
+    const wireName = namespacedToolName(tool.namespace, tool.name);
+    // Read the recorded mapping; `registry.alias()` would REGISTER a name here.
+    const alias = advertisedAlias.get(wireName) ?? wireName;
+    return emittedToolNames.has(alias) ? alias : undefined;
+  };
+  const requestedTools = parsed.context.tools ?? [];
+  const emittedCodeModeExec = requestedTools.find(tool => isCodexCodeModeExecTool(tool) && emittedAlias(tool));
+  const emittedShellBridge = requestedTools.some(tool => isBareShellBridgeTool(tool) && emittedAlias(tool));
+  const codeModeExecName = emittedCodeModeExec && !emittedShellBridge
+    ? emittedAlias(emittedCodeModeExec)
+    : undefined;
   const toolCatalogNudge = buildNonOpenAIToolCatalogNudgeFromNames(
     kiroToolWireNames(kiroTools),
     name => advertisedAlias.get(name) ?? name,
+    codeModeExecName,
   );
   const boundedNudge = toolCatalogNudge ? boundedInjectedInstruction(toolCatalogNudge, injectedChars) : undefined;
   if (boundedNudge) systemParts.push(boundedNudge);
@@ -1723,12 +1761,19 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
       throw new Error("kiro token missing — run ocx login kiro");
     }
     const region = resolveKiroApiRegion(parsed._kiroAuthContext);
-    const resolvedProfileArn = resolveKiroProfileArn(parsed._kiroAuthContext);
+    // Request-scoped: an AWS Builder ID account has no profile of its own and resolves to Kiro's
+    // fixed service profile here, without that value ever becoming the account's stored identity.
+    const requestProfile = resolveKiroRequestProfile(parsed._kiroAuthContext);
+    const resolvedProfileArn = requestProfile.profileArn;
     const isApiKey = provider.apiKey.trim().startsWith("ksk_");
     const profileArn = isApiKey ? undefined : resolvedProfileArn;
-    // Builder ID and Kiro API keys have no profile ARN and are accepted only on Kiro's CLI
-    // request path. Enterprise profiles retain the existing IDE-shaped request.
-    const wireClient: KiroWireClient = isApiKey || !profileArn ? "cli" : "ide";
+    // Builder ID and Kiro API keys are accepted only on Kiro's CLI request path; enterprise
+    // profiles retain the IDE-shaped request. Builder ID now carries a profile ARN, so a truthy
+    // `profileArn` no longer implies "enterprise". The wire path reads the resolver's own verdict
+    // rather than re-deriving it, so the accountless path — where the auth type comes from the
+    // local import, not the request context — cannot send the fallback inside an IDE-shaped call.
+    const isBuilderId = requestProfile.builderIdFallback;
+    const wireClient: KiroWireClient = isApiKey || isBuilderId || !profileArn ? "cli" : "ide";
     const fp = fingerprint().slice(0, 64);
     const headers: Record<string, string> = wireClient === "cli" ? {
       authorization: `Bearer ${provider.apiKey}`,