@bitkyc08/opencodex 2.6.1 → 2.6.2

package/src/oauth/kiro.ts

@@ -0,0 +1,164 @@
+/**
+ * Kiro (AWS CodeWhisperer) OAuth — import-first.
+ *
+ * Unlike browser/PKCE providers, kiro reuses the locally installed kiro-cli login:
+ * it reads the kiro-cli SQLite token store, falls back to KIRO_ACCESS_TOKEN env, then to a
+ * manual access-token paste (CLI only). Refresh hits the Kiro desktop refresh endpoint.
+ *
+ * Ported from jawcode packages/ai/src/providers/kiro.ts (readKiroCliSqlite, refreshKiroDesktopToken).
+ * profileArn/region are NOT stored in the credential — the kiro ADAPTER resolves them at request
+ * time (SQLite profile_arn / KIRO_PROFILE_ARN, KIRO_REGION) since getValidAccessToken surfaces
+ * only the access token.
+ */
+import type { OAuthController, OAuthCredentials } from "./types";
+import {
+  inferRegionFromProfileArn,
+  inspectKiroCliSqliteSources,
+  normalizeKiroRegion,
+  readImportedKiroCredential,
+  readKiroCliSqliteCredential,
+  requireKiroRegion,
+  type KiroImportDiagnostic,
+} from "./kiro-credentials";
+
+const DEFAULT_REGION = "us-east-1";
+const REFRESH_URL = "https://prod.{region}.auth.desktop.kiro.dev/refreshToken";
+const OIDC_URL = "https://oidc.{region}.amazonaws.com/token";
+
+interface ImportedKiroToken {
+  access: string;
+  refresh: string;
+  expires: number;
+}
+
+export type KiroCliImportDiagnosticStatus = KiroImportDiagnostic["status"];
+export type KiroCliImportDiagnostic = KiroImportDiagnostic;
+
+export function inspectKiroCliSqlite(): { token: ImportedKiroToken | null; diagnostics: KiroCliImportDiagnostic[] } {
+  const { credential, diagnostics } = inspectKiroCliSqliteSources();
+  return {
+    token: credential ? { access: credential.access, refresh: credential.refresh, expires: credential.expires } : null,
+    diagnostics,
+  };
+}
+
+/** Read the kiro-cli SQLite token store (mac/linux). Returns null if no token found. */
+export function readKiroCliSqlite(): ImportedKiroToken | null {
+  const imported = readKiroCliSqliteCredential();
+  return imported ? { access: imported.access, refresh: imported.refresh, expires: imported.expires } : null;
+}
+
+/**
+ * Import-first login: kiro-cli SQLite → KIRO_ACCESS_TOKEN env → manual paste (CLI only).
+ * In GUI (no onManualCodeInput) with no SQLite token and no env, throws a clear error — never hangs.
+ */
+export async function loginKiro(ctrl: OAuthController): Promise<OAuthCredentials> {
+  const imported = readImportedKiroCredential();
+  if (imported) {
+    ctrl.onProgress?.(imported.source === "json" ? "Imported token from Kiro credentials file." : "Imported token from installed kiro-cli login.");
+    return {
+      access: imported.access,
+      refresh: imported.refresh,
+      expires: imported.expires,
+      source: imported.source === "json" ? "credential-file" : "local-cli",
+    };
+  }
+
+  const envToken = process.env.KIRO_ACCESS_TOKEN;
+  if (envToken) {
+    ctrl.onProgress?.("Using KIRO_ACCESS_TOKEN from environment.");
+    return { access: envToken, refresh: process.env.KIRO_REFRESH_TOKEN ?? "", expires: Date.now() + 3600_000, source: "environment" };
+  }
+
+  if (ctrl.onManualCodeInput) {
+    ctrl.onProgress?.("No kiro-cli token found. Paste a Kiro access token (starts with 'aoa').");
+    const raw = (await ctrl.onManualCodeInput()).trim();
+    if (raw) return { access: raw, refresh: "", expires: Date.now() + 3600_000, source: "manual" };
+  }
+
+  throw new Error(
+    "Kiro: no token found. Run `kiro-cli login` first (import), or set KIRO_ACCESS_TOKEN. " +
+      "Browser login is not supported for Kiro.",
+  );
+}
+
+/** Auth/SSO region precedence: KIRO_REGION → imported SSO region → default us-east-1. */
+export function resolveKiroRegion(): string {
+  if (process.env.KIRO_REGION !== undefined) return requireKiroRegion(process.env.KIRO_REGION);
+  return normalizeKiroRegion(readImportedKiroCredential()?.ssoRegion) || DEFAULT_REGION;
+}
+
+/** Runtime API region precedence: KIRO_API_REGION → imported API/profile region → auth region. */
+export function resolveKiroApiRegion(): string {
+  const imported = readImportedKiroCredential();
+  if (process.env.KIRO_API_REGION !== undefined) return requireKiroRegion(process.env.KIRO_API_REGION);
+  return (
+    normalizeKiroRegion(imported?.apiRegion) ||
+    inferRegionFromProfileArn(imported?.profileArn) ||
+    normalizeKiroRegion(imported?.ssoRegion) ||
+    (process.env.KIRO_REGION !== undefined ? requireKiroRegion(process.env.KIRO_REGION) : undefined) ||
+    DEFAULT_REGION
+  );
+}
+
+/**
+ * Resolve the CodeWhisperer profileArn for request-time use by the adapter.
+ * KIRO_PROFILE_ARN env → kiro-cli SQLite `profile_arn`. Returns undefined if absent
+ * (the adapter decides whether that is fatal).
+ */
+export function resolveKiroProfileArn(): string | undefined {
+  const env = process.env.KIRO_PROFILE_ARN;
+  if (env) return env;
+  return readImportedKiroCredential()?.profileArn;
+}
+
+async function readTokenResponse(res: Response, oldRefresh: string): Promise<OAuthCredentials> {
+  const data = (await res.json()) as { accessToken?: string; refreshToken?: string; expiresIn?: number };
+  if (!data.accessToken) throw new Error("Kiro refresh returned no accessToken");
+  return {
+    access: data.accessToken,
+    refresh: data.refreshToken || oldRefresh,
+    expires: Date.now() + (data.expiresIn ?? 3600) * 1000,
+  };
+}
+
+async function refreshKiroDesktopToken(refresh: string, signal?: AbortSignal): Promise<OAuthCredentials> {
+  const region = resolveKiroRegion();
+  const res = await fetch(REFRESH_URL.replace("{region}", region), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refreshToken: refresh }),
+    signal: signal ?? AbortSignal.timeout(30_000),
+  });
+  if (!res.ok) throw new Error(`Kiro token refresh failed: ${res.status}`);
+  return readTokenResponse(res, refresh);
+}
+
+async function refreshAwsSsoOidcToken(refresh: string, signal?: AbortSignal): Promise<OAuthCredentials> {
+  const imported = readImportedKiroCredential();
+  if (!imported?.clientId || !imported.clientSecret) return refreshKiroDesktopToken(refresh, signal);
+  const region = resolveKiroRegion();
+  const run = async (refreshToken: string): Promise<Response> => fetch(OIDC_URL.replace("{region}", region), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      grantType: "refresh_token",
+      clientId: imported.clientId,
+      clientSecret: imported.clientSecret,
+      refreshToken,
+    }),
+    signal: signal ?? AbortSignal.timeout(30_000),
+  });
+  let res = await run(refresh);
+  if (!res.ok && res.status === 400 && imported.source === "sqlite") {
+    const reloaded = readImportedKiroCredential();
+    if (reloaded?.refresh && reloaded.refresh !== refresh) res = await run(reloaded.refresh);
+  }
+  if (!res.ok) throw new Error(`Kiro AWS SSO OIDC refresh failed: ${res.status}`);
+  return readTokenResponse(res, refresh);
+}
+
+export async function refreshKiroToken(refresh: string, signal?: AbortSignal): Promise<OAuthCredentials> {
+  if (!refresh) throw new Error("Kiro: no refresh token available (re-run `kiro-cli login`).");
+  return refreshAwsSsoOidcToken(refresh, signal);
+}

package/src/oauth/local-token-detect.ts

@@ -32,6 +32,7 @@ export function detectGrokCliToken(): OAuthCredentials | null {
       expires: expiresAt,
       accountId: entry.user_id as string | undefined,
       email: entry.email as string | undefined,
+      source: "local-cli",
     };
   } catch {
     return null;
@@ -57,7 +58,7 @@ export function detectClaudeCodeToken(): OAuthCredentials | null {
     const data = JSON.parse(raw) as { claudeAiOauth?: { accessToken?: string; refreshToken?: string; expiresAt?: number } };
     const o = data.claudeAiOauth;
     if (!o?.accessToken || !o?.refreshToken) return null;
-    return { access: o.accessToken, refresh: o.refreshToken, expires: o.expiresAt ?? 0 };
+    return { access: o.accessToken, refresh: o.refreshToken, expires: o.expiresAt ?? 0, source: "local-cli" };
   } catch {
     return null;
   }

package/src/oauth/store.ts

@@ -2,7 +2,7 @@
 import { existsSync, mkdirSync, readFileSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret } from "../config";
-import type { OAuthCredentials } from "./types";
+import type { OAuthCredentialSource, OAuthCredentials } from "./types";
 
 type AuthStore = Record<string, OAuthCredentials>;
 
@@ -16,7 +16,7 @@ export function loadAuthStore(): AuthStore {
   hardenExistingSecret(path);
   if (!existsSync(path)) return {};
   try {
-    return JSON.parse(readFileSync(path, "utf-8")) as AuthStore;
+    return normalizeAuthStore(JSON.parse(readFileSync(path, "utf-8")));
   } catch {
     backupInvalidConfig(path);
     return {};
@@ -33,13 +33,46 @@ function persist(store: AuthStore): void {
   atomicWriteFile(authPath(), JSON.stringify(store, null, 2) + "\n");
 }
 
+function isCredentialSource(value: unknown): value is OAuthCredentialSource {
+  return value === "oauth" || value === "local-cli" || value === "credential-file" || value === "environment" || value === "manual";
+}
+
+function normalizeCredential(cred: unknown): OAuthCredentials | null {
+  if (!cred || typeof cred !== "object") return null;
+  const candidate = cred as Partial<OAuthCredentials>;
+  if (typeof candidate.access !== "string" || typeof candidate.refresh !== "string" || typeof candidate.expires !== "number") {
+    return null;
+  }
+  const normalized: OAuthCredentials = {
+    access: candidate.access,
+    refresh: candidate.refresh,
+    expires: candidate.expires,
+  };
+  if (typeof candidate.email === "string" && candidate.email.length > 0) normalized.email = candidate.email;
+  if (typeof candidate.accountId === "string" && candidate.accountId.length > 0) normalized.accountId = candidate.accountId;
+  if (isCredentialSource(candidate.source)) normalized.source = candidate.source;
+  return normalized;
+}
+
+function normalizeAuthStore(raw: unknown): AuthStore {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const normalized: AuthStore = {};
+  for (const [provider, cred] of Object.entries(raw)) {
+    const safe = normalizeCredential(cred);
+    if (safe) normalized[provider] = safe;
+  }
+  return normalized;
+}
+
 export function getCredential(provider: string): OAuthCredentials | null {
   return loadAuthStore()[provider] ?? null;
 }
 
 export function saveCredential(provider: string, cred: OAuthCredentials): void {
   const store = loadAuthStore();
-  store[provider] = cred;
+  const safe = normalizeCredential(cred);
+  if (!safe) return;
+  store[provider] = safe;
   persist(store);
 }
 

package/src/oauth/types.ts

@@ -1,10 +1,13 @@
 /** Minimal OAuth types, ported from jawcode packages/ai/src/utils/oauth/types.ts. */
+export type OAuthCredentialSource = "oauth" | "local-cli" | "credential-file" | "environment" | "manual";
+
 export type OAuthCredentials = {
   refresh: string;
   access: string;
   expires: number; // epoch ms (already skew-adjusted by the provider flow)
   email?: string;
   accountId?: string;
+  source?: OAuthCredentialSource;
 };
 
 export interface OAuthController {

package/src/oauth/xai.ts

@@ -200,7 +200,7 @@ export async function loginXai(
       ctrl.onProgress?.("Found Grok CLI token, importing automatically");
       if (local.expires >= Date.now() + 60_000) return local;
       try {
-        return await refreshXaiToken(local.refresh, ctrl.signal);
+        return { ...(await refreshXaiToken(local.refresh, ctrl.signal)), source: "local-cli" };
       } catch (error) {
         if (importLocal === "only") {
           throw new Error(

package/src/providers/kiro-models.ts

@@ -0,0 +1,55 @@
+export const KIRO_MODELS = [
+  "kiro-auto",
+  "claude-opus-4.8",
+  "claude-opus-4.7",
+  "claude-opus-4.6",
+  "claude-opus-4.5",
+  "claude-sonnet-4.6",
+  "claude-sonnet-4.5",
+  "claude-sonnet-4.0",
+  "claude-haiku-4.5",
+  "deepseek-3.2",
+  "minimax-m2.5",
+  "minimax-m2.1",
+  "glm-5",
+  "qwen3-coder-next",
+];
+
+// Per-model context windows as documented on Kiro's official model catalog
+// (https://kiro.dev/docs/models/ — "Quick comparison", page updated 2026-06-19).
+// "Auto" is a router with no fixed window on Kiro's table, so it is intentionally omitted.
+export const KIRO_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "claude-opus-4.8": 1_000_000,
+  "claude-opus-4.7": 1_000_000,
+  "claude-opus-4.6": 1_000_000,
+  "claude-opus-4.5": 200_000,
+  "claude-sonnet-4.6": 1_000_000,
+  "claude-sonnet-4.5": 200_000,
+  "claude-sonnet-4.0": 200_000,
+  "claude-haiku-4.5": 200_000,
+  "deepseek-3.2": 128_000,
+  "minimax-m2.5": 200_000,
+  "minimax-m2.1": 200_000,
+  "glm-5": 200_000,
+  "qwen3-coder-next": 256_000,
+};
+
+const KIRO_REASONING_EFFORTS = ["low", "medium", "high", "xhigh"];
+
+// Codex does not accept raw "max" in catalog metadata; Kiro xhigh already maps to the maximum
+// fake-thinking budget in src/adapters/kiro.ts.
+export const KIRO_MODEL_REASONING_EFFORTS: Record<string, string[]> = Object.fromEntries(
+  KIRO_MODELS.map(id => [id, KIRO_REASONING_EFFORTS]),
+);
+
+export function normalizeKiroModelId(id: string): string {
+  let model = id.trim().toLowerCase();
+  model = model.replace(/^kiro\//, "").replace(/^kiro-/, "");
+  if (model === "auto" || model === "kiro-auto") return "auto";
+
+  model = model.replace(/-\d{8}$/, "");
+  model = model.replace(/-(low|medium|high|xhigh|max)$/, "");
+  model = model.replace(/(\d+)-(\d+)/g, "$1.$2");
+  model = model.replace(/^claude-([\d.]+)-(sonnet|opus|haiku)$/, "claude-$2-$1");
+  return model;
+}

package/src/providers/registry.ts

@@ -1,4 +1,5 @@
 import type { OcxProviderConfig } from "../types";
+import { KIRO_MODELS, KIRO_MODEL_CONTEXT_WINDOWS, KIRO_MODEL_REASONING_EFFORTS } from "./kiro-models";
 
 export type ProviderAuthKind = "forward" | "oauth" | "key" | "local";
 export type MetadataModelIdNormalize = "case-insensitive";
@@ -158,6 +159,20 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     autoToolChoiceOnlyModels: ["kimi-k2.7-code", "kimi-k2.7-code-highspeed"],
     preserveReasoningContentModels: KIMI_THINKING_MODELS,
   },
+  {
+    id: "kiro",
+    label: "Kiro (AWS CodeWhisperer)",
+    adapter: "kiro",
+    baseUrl: "https://runtime.us-east-1.kiro.dev",
+    authKind: "oauth",
+    oauthId: "kiro",
+    note: "Import-first: reuses your installed kiro-cli login (no browser). Experimental third-party harness — see Kiro ToS.",
+    models: KIRO_MODELS,
+    defaultModel: "kiro-auto",
+    // Context windows sourced from Kiro's official model catalog (kiro.dev/docs/models/).
+    modelContextWindows: KIRO_MODEL_CONTEXT_WINDOWS,
+    modelReasoningEfforts: KIRO_MODEL_REASONING_EFFORTS,
+  },
   { id: "openai-apikey", label: "OpenAI (API key)", adapter: "openai-responses", baseUrl: "https://api.openai.com/v1", authKind: "key", featured: true, dashboardUrl: "https://platform.openai.com/api-keys", defaultModel: "gpt-5.5" },
   {
     id: "umans",

package/src/redact.ts

@@ -0,0 +1,71 @@
+export const REDACTED_SECRET = "[REDACTED]";
+
+const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cookie|set-cookie|set-cookie2|api[-_]?key|x-api-key|x-goog-api-key|x-amz-security-token|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|client[-_]?secret|password|profile[-_]?arn)$/i;
+
+const SECRET_VALUE_PATTERNS: Array<[RegExp, string]> = [
+  [/\bBearer\s+[A-Za-z0-9._~+/=-]{8,}\b/gi, `Bearer ${REDACTED_SECRET}`],
+  [/\b(sk-[A-Za-z0-9][A-Za-z0-9._-]{6,})\b/g, REDACTED_SECRET],
+  [/\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token|client[_-]?secret|refreshToken|accessToken|clientSecret|apiKey)=)([^&\s"',;]+)/gi, `$1${REDACTED_SECRET}`],
+  [/((?:"(?:api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token|client[_-]?secret|refreshToken|accessToken|clientSecret|apiKey)"\s*:\s*"))([^"]+)(")/gi, `$1${REDACTED_SECRET}$3`],
+  [/\b(arn:aws:[A-Za-z0-9_-]+:[A-Za-z0-9-]*:\d{12}:[A-Za-z0-9_/:+=,.@-]+)\b/g, REDACTED_SECRET],
+];
+
+type HeaderRecord = Record<string, string | string[] | undefined>;
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function isSensitiveKey(key: string): boolean {
+  return SENSITIVE_KEY_PATTERN.test(key);
+}
+
+export function redactSecretString(value: string): string {
+  let redacted = value;
+  for (const [pattern, replacement] of SECRET_VALUE_PATTERNS) {
+    redacted = redacted.replace(pattern, replacement);
+  }
+  return redacted;
+}
+
+export function redactSecrets(value: unknown): unknown {
+  if (typeof value === "string") return redactSecretString(value);
+  if (Array.isArray(value)) return value.map(item => redactSecrets(item));
+  if (value instanceof Date) return value;
+  if (!isPlainObject(value)) return value;
+
+  const result: Record<string, unknown> = {};
+  for (const [key, entryValue] of Object.entries(value)) {
+    result[key] = isSensitiveKey(key) ? REDACTED_SECRET : redactSecrets(entryValue);
+  }
+  return result;
+}
+
+export function redactHeaders(headers: Headers | HeaderRecord): Record<string, string> {
+  const result: Record<string, string> = {};
+  const entries = headers instanceof Headers ? headers.entries() : Object.entries(headers);
+
+  for (const [rawKey, rawValue] of entries) {
+    const key = rawKey.toLowerCase();
+    if (rawValue === undefined) continue;
+    const value = Array.isArray(rawValue) ? rawValue.join(", ") : String(rawValue);
+    result[key] = isSensitiveKey(key) ? REDACTED_SECRET : redactSecretString(value);
+  }
+
+  return result;
+}
+
+export function redactUrlForLog(url: string): string {
+  try {
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return redactSecretString(url.split("?")[0] ?? url);
+  }
+}

package/src/server.ts

@@ -4,9 +4,11 @@ import { extname, isAbsolute, join, relative, resolve } from "node:path";
 import { createAnthropicAdapter } from "./adapters/anthropic";
 import { createAzureAdapter } from "./adapters/azure";
 import { createGoogleAdapter } from "./adapters/google";
+import { createKiroAdapter } from "./adapters/kiro";
 import { createOpenAIChatAdapter } from "./adapters/openai-chat";
 import { createResponsesPassthroughAdapter } from "./adapters/openai-responses";
 import { bridgeToResponsesSSE, buildResponseJSON, formatErrorResponse, type ResponsesTerminalStatus } from "./bridge";
+import { markActivity } from "./sidecar-tracker";
 import {
   buildWarmupCompletionFrames,
   buildWsErrorFrame,
@@ -24,6 +26,8 @@ import {
   hasOwnProvider,
   isValidProviderName,
   loadConfig,
+  providerBaseUrlConfigError,
+  providerHeadersConfigError,
   saveConfig,
   websocketsEnabled,
 } from "./config";
@@ -47,6 +51,7 @@ import type { OcxUsage } from "./types";
 import {
   appendUsageEntry,
   readUsageEntries,
+  usageForFinalLog,
   usageStatusForFinalLog,
   usageTotalTokens,
   type UsageStatus,
@@ -96,6 +101,7 @@ export interface RequestLogContext {
   model: string;
   provider: string;
   requestedModel?: string;
+  requestedEffort?: string;
   requestedServiceTier?: string;
   requestedSpeedLabel?: string;
   configuredServiceTier?: string;
@@ -104,6 +110,7 @@ export interface RequestLogContext {
   responseServiceTier?: string;
   resolvedModel?: string;
   usage?: OcxUsage;
+  usageLogInputTokens?: number;
   usageDebugBodyKind?: UsageDebugBodyKind;
   usageDebugBodySample?: string;
   usageDebugContentType?: string;
@@ -289,6 +296,8 @@ export function resolveAdapter(providerConfig: OcxProviderConfig) {
       return createResponsesPassthroughAdapter(providerConfig);
     case "google":
       return createGoogleAdapter(providerConfig);
+    case "kiro":
+      return createKiroAdapter(providerConfig);
     case "azure":
     case "azure-openai":
       return createAzureAdapter(providerConfig);
@@ -354,6 +363,7 @@ async function handleResponses(
     return formatErrorResponse(400, "invalid_request_error", err instanceof Error ? err.message : String(err));
   }
   logCtx.requestedModel = parsed.modelId;
+  logCtx.requestedEffort = parsed.options.reasoning;
   logCtx.requestedServiceTier = parsed.options.serviceTier;
   logCtx.requestedSpeedLabel = requestLogSpeedLabel(parsed.options.serviceTier);
   logCtx.configuredServiceTier = readConfiguredCodexServiceTier();
@@ -518,14 +528,13 @@ async function handleResponses(
       const turnAc = new AbortController();
       linkAbortSignal(upstream, turnAc.signal);
       registerTurn(turnAc);
-      if (terminalBodyWillRecord && recordTerminalOutcomes) {
-        const recordTerminal = terminalRecorder;
+      if (recordTerminalOutcomes) {
         const reportNativeTerminal = (status: ResponsesTerminalStatus) => {
           if (options.abortSignal?.aborted) {
             options.onNativePassthroughCancel?.();
             return;
           }
-          recordTerminal(status);
+          terminalRecorder?.(status);
           options.onNativePassthroughTerminal?.(status);
         };
         consumeForInspection(inspectBody, reportNativeTerminal, turnAc.signal, () => unregisterTurn(turnAc), logCtx);
@@ -580,11 +589,16 @@ async function handleResponses(
   const connectMs = config.connectTimeoutMs ?? 30_000;
 
   const request = adapter.buildRequest(parsed, { headers: selectedForwardHeaders });
+  if (typeof request.usageLog?.inputTokens === "number") {
+    logCtx.usageLogInputTokens = request.usageLog.inputTokens;
+  }
   let upstreamResponse: Response;
   try {
-    upstreamResponse = await fetchWithHeaderTimeout(request.url, {
-      method: request.method, headers: request.headers, body: request.body,
-    }, upstream.signal, connectMs);
+    upstreamResponse = adapter.fetchResponse
+      ? await adapter.fetchResponse(request, { abortSignal: upstream.signal, timeoutMs: connectMs })
+      : await fetchWithHeaderTimeout(request.url, {
+          method: request.method, headers: request.headers, body: request.body,
+        }, upstream.signal, connectMs);
   } catch (err) {
     cleanupUpstreamAbort();
     upstream.abort();
@@ -700,6 +714,7 @@ export interface RequestLogEntry {
   model: string;
   provider: string;
   requestedModel?: string;
+  requestedEffort?: string;
   requestedServiceTier?: string;
   requestedSpeedLabel?: string;
   configuredServiceTier?: string;
@@ -817,6 +832,7 @@ export function usageFromResponsesPayload(usage: unknown): OcxUsage | undefined
     output_tokens?: unknown;
     input_tokens_details?: { cached_tokens?: unknown };
     output_tokens_details?: { reasoning_tokens?: unknown };
+    total_tokens?: unknown;
     prompt_tokens?: unknown;
     completion_tokens?: unknown;
     prompt_tokens_details?: { cached_tokens?: unknown };
@@ -826,6 +842,7 @@ export function usageFromResponsesPayload(usage: unknown): OcxUsage | undefined
     return {
       inputTokens: raw.input_tokens,
       outputTokens: raw.output_tokens,
+      ...(typeof raw.total_tokens === "number" ? { totalTokens: raw.total_tokens } : {}),
       ...(typeof raw.input_tokens_details?.cached_tokens === "number"
         ? { cachedInputTokens: raw.input_tokens_details.cached_tokens }
         : {}),
@@ -838,6 +855,7 @@ export function usageFromResponsesPayload(usage: unknown): OcxUsage | undefined
     return {
       inputTokens: raw.prompt_tokens,
       outputTokens: raw.completion_tokens,
+      ...(typeof raw.total_tokens === "number" ? { totalTokens: raw.total_tokens } : {}),
       ...(typeof raw.prompt_tokens_details?.cached_tokens === "number"
         ? { cachedInputTokens: raw.prompt_tokens_details.cached_tokens }
         : {}),
@@ -895,14 +913,22 @@ function addFinalRequestLog(
   addLog: (entry: RequestLogEntry) => void = addRequestLog,
 ): void {
   const errorCode = requestLogErrorCode(status);
-  const usageStatus = usageStatusForFinalLog(logCtx.usage);
-  const totalTokens = usageTotalTokens(logCtx.usage);
+  const finalUsage = usageForFinalLog(logCtx.provider, logCtx.usage);
+  const usageFallback = !finalUsage && typeof logCtx.usageLogInputTokens === "number"
+    ? { inputTokens: logCtx.usageLogInputTokens, outputTokens: 0, estimated: true }
+    : undefined;
+  const loggedUsage = finalUsage && typeof logCtx.usageLogInputTokens === "number"
+    ? { ...finalUsage, inputTokens: Math.max(finalUsage.inputTokens, logCtx.usageLogInputTokens) }
+    : (finalUsage ?? usageFallback);
+  const usageStatus = usageStatusForFinalLog(loggedUsage);
+  const totalTokens = usageTotalTokens(loggedUsage);
   addLog({
     requestId,
     timestamp: start,
     model: logCtx.model,
     provider: logCtx.provider,
     ...(logCtx.requestedModel ? { requestedModel: logCtx.requestedModel } : {}),
+    ...(logCtx.requestedEffort ? { requestedEffort: logCtx.requestedEffort } : {}),
     ...(logCtx.requestedServiceTier ? { requestedServiceTier: logCtx.requestedServiceTier } : {}),
     ...(logCtx.requestedSpeedLabel ? { requestedSpeedLabel: logCtx.requestedSpeedLabel } : {}),
     ...(logCtx.configuredServiceTier ? { configuredServiceTier: logCtx.configuredServiceTier } : {}),
@@ -916,7 +942,7 @@ function addFinalRequestLog(
     ...(meta?.terminalStatus ? { terminalStatus: meta.terminalStatus } : {}),
     ...(meta?.closeReason ? { closeReason: meta.closeReason } : {}),
     usageStatus,
-    ...(logCtx.usage ? { usage: logCtx.usage } : {}),
+    ...(loggedUsage ? { usage: loggedUsage } : {}),
     ...(totalTokens !== undefined ? { totalTokens } : {}),
   });
   if (isUsageDebugEnabled()) {
@@ -929,7 +955,7 @@ function addFinalRequestLog(
       upstreamStatus: status,
       bodyKind: logCtx.usageDebugBodyKind ?? "none",
       bodySample: logCtx.usageDebugBodySample ?? "",
-      extractedUsage: logCtx.usage ?? null,
+      extractedUsage: loggedUsage ?? null,
     });
   }
 }
@@ -1507,6 +1533,8 @@ function requireApiAuth(req: Request, config: OcxConfig, kind: "management" | "d
 function providerManagementConfigError(name: string, provider: OcxProviderConfig): string | null {
   const baseUrlError = providerBaseUrlConfigError(provider.baseUrl);
   if (baseUrlError) return `provider ${name} ${baseUrlError}`;
+  const headersError = providerHeadersConfigError(provider.headers);
+  if (headersError) return `provider ${name} ${headersError}`;
   if (provider.authMode === "forward") {
     const normalizedName = name.trim().toLowerCase();
     const base = provider.baseUrl.replace(/\/+$/, "");
@@ -1519,18 +1547,6 @@ function providerManagementConfigError(name: string, provider: OcxProviderConfig
   return null;
 }
 
-function providerBaseUrlConfigError(baseUrl: string): string | null {
-  try {
-    const parsed = new URL(baseUrl.trim());
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "baseUrl must be an http(s) URL";
-    if (parsed.username || parsed.password) return "baseUrl must not include embedded credentials";
-    if (parsed.search || parsed.hash) return "baseUrl must not include query strings or fragments";
-  } catch {
-    return "baseUrl must be a valid URL";
-  }
-  return null;
-}
-
 function publicProviderBaseUrl(baseUrl: string): string {
   try {
     const parsed = new URL(baseUrl.trim());
@@ -1907,6 +1923,7 @@ export function startServer(port?: number) {
     idleTimeout: 255,
     async fetch(req, requestServer): Promise<Response> {
       const url = new URL(req.url);
+      markActivity(`${req.method} ${url.pathname}`);
 
       if (req.method === "OPTIONS") {
         if (!isAllowedRequestOrigin(req, config)) {
@@ -2060,6 +2077,7 @@ export function startServer(port?: number) {
         }
         if (frame.type === "response.processed") return; // ack — no-op
         if (frame.type !== "response.create") return;
+        markActivity("ws response.create");
 
         ws.data.cancel?.();
         const turnId = (ws.data.turnId ?? 0) + 1;