@bitkyc08/opencodex 2.67.0 → 2.68.0-preview.20260927

package/src/providers/command-code-efforts.ts

@@ -22,7 +22,8 @@ import { readBoundedResponseBody } from "../lib/bounded-body";
  * `ultra` returned 400. A correction therefore adds the rungs a profile newly lists and keeps the
  * rungs the upstream measurably accepts; dropping them would strip an effort that works today,
  * including Codex's default `high`. The refresh path decodes the same payload, so it narrows a row
- * only after the upstream actually rejects a rung.
+ * only after the upstream actually rejects a rung. Issue #5096 supplies additional live API
+ * measurements that widen the DeepSeek Flash, GLM-5.3, Gemini-3.7-Flash and HY4 rows.
  */
 const COMMAND_CODE_MODEL_EFFORTS = {
   // Captured profile payload 2026-09-23: claude-fable-5-1.html.
@@ -36,11 +37,11 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     profileUrl: "https://commandcode.ai/models/claude-opus-5-5",
   },
   "deepseek/deepseek-v4-flash": {
-    efforts: ["high", "max"],
+    efforts: ["low", "medium", "high", "xhigh", "max"],
     profileUrl: "https://commandcode.ai/models/deepseek-v4-flash",
   },
   "deepseek/deepseek-v4-flash-vision-exp": {
-    efforts: ["high", "max"],
+    efforts: ["low", "medium", "high", "xhigh", "max"],
     profileUrl: "https://commandcode.ai/models/deepseek-v4-flash-vision-exp",
   },
   // Captured profile payload 2026-09-23: deepseek-v4-flash-fast.html.
@@ -50,7 +51,7 @@ const COMMAND_CODE_MODEL_EFFORTS = {
   },
   // Captured profile payload 2026-09-23: deepseek-v4-1-flash.html.
   "deepseek/deepseek-v4.1-flash": {
-    efforts: ["low", "high", "max"],
+    efforts: ["low", "medium", "high", "xhigh", "max"],
     profileUrl: "https://commandcode.ai/models/deepseek-v4-1-flash",
   },
   "gpt-5.6-luna": {
@@ -58,7 +59,7 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     profileUrl: "https://commandcode.ai/models/gpt-5-6-luna",
   },
   "google/gemini-3.7-flash": {
-    efforts: ["low", "medium", "high"],
+    efforts: ["low", "medium", "high", "xhigh", "max"],
     profileUrl: "https://commandcode.ai/models/gemini-3-7-flash",
   },
   // Captured profile payload 2026-09-23: gemini-3-8-flash.html.
@@ -83,11 +84,11 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     profileUrl: "https://commandcode.ai/models/glm-5-2-fast",
   },
   "zai-org/GLM-5.3": {
-    efforts: ["low", "high", "max"],
+    efforts: ["low", "medium", "high", "xhigh", "max"],
     profileUrl: "https://commandcode.ai/models/glm-5-3",
   },
   "z-ai/glm-5.3-flash": {
-    efforts: ["low", "high", "max"],
+    efforts: ["low", "medium", "high", "xhigh", "max"],
     profileUrl: "https://commandcode.ai/models/glm-5-3-flash",
   },
   // Captured profile payload 2026-09-23: glm-5-3-flashx.html.
@@ -143,7 +144,7 @@ const COMMAND_CODE_MODEL_EFFORTS = {
   },
   // Captured profile payload 2026-09-23: hy4-preview.html.
   "tencent/hy4-preview": {
-    efforts: ["low", "medium", "high"],
+    efforts: ["low", "medium", "high", "xhigh", "max"],
     profileUrl: "https://commandcode.ai/models/hy4-preview",
   },
   // Captured profile payload 2026-09-23: grok-4-7.html.
@@ -151,10 +152,31 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     efforts: ["low", "medium", "high", "xhigh"],
     profileUrl: "https://commandcode.ai/models/grok-4-7",
   },
+  // Live API measurements supplied in #5096; no verified public profile URL.
+  "moonshotai/Kimi-K3": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "MiniMaxAI/MiniMax-M3": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "xiaomi/mimo-v2.5": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "xai/grok-4.5": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "xai/grok-4.6": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "tencent/hy3-paid": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "stepfun/Step-3.7-Flash": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "Qwen/Qwen3.8-Max": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "Qwen/Qwen3.8-27B": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "nvidia/nemotron-3-ultra-550b-a55b": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "meituan/LongCat-2.0:free": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "inclusionai/ling-3.0-flash-sante:free": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "thinkingmachines/inkling-small": { efforts: ["low", "medium", "high", "xhigh", "max"] },
+  "moonshotai/Kimi-K2.7-Code": { efforts: ["low", "medium", "high", "xhigh"] },
+  "moonshotai/Kimi-K2.7-Code-Highspeed": { efforts: ["low", "high", "xhigh", "max"] },
+  "xiaomi/mimo-v2.5-pro": { efforts: ["low", "medium", "high"] },
+  "Qwen/Qwen3.7-32B": { efforts: ["low", "medium", "high", "xhigh"] },
+  "Qwen/Qwen3.7-72B": { efforts: ["low", "medium", "high", "xhigh"] },
+  "Qwen/Qwen3.6-35B-A22B": { efforts: ["low", "medium", "high", "xhigh"] },
+  "poolside/laguna-s-2.1-free": { efforts: ["medium"] },
 } as const;
 
 /**
- * Official Command Code model-profile facts, not a model catalog. Models remain
+ * Command Code profile facts and live API measurements (#5096), not a model catalog. Models remain
  * account-scoped and come exclusively from the authenticated /provider/v1/models endpoint.
  */
 export const COMMAND_CODE_MODEL_REASONING_EFFORTS: Record<string, string[]> = Object.fromEntries(
@@ -273,7 +295,7 @@ export async function refreshCommandCodeReasoningEfforts(
   destination = DEFAULT_EFFORT_DESTINATION,
 ): Promise<readonly string[] | undefined> {
   const key = cacheKey(modelId, destination);
-  let profile: { efforts: readonly string[]; profileUrl: string } | undefined;
+  let profile: { efforts: readonly string[]; profileUrl?: string } | undefined;
   for (const [id, row] of Object.entries(COMMAND_CODE_MODEL_EFFORTS)) {
     if (keyFor(id) === keyFor(modelId)) {
       profile = row;
@@ -286,6 +308,7 @@ export async function refreshCommandCodeReasoningEfforts(
     rejected.add(rejectedEffort);
     rejectedEfforts.set(key, rejected);
   }
+  if (!profile.profileUrl) return commandCodeReasoningEfforts(modelId, destination);
   try {
     const response = await fetchFn(profile.profileUrl, {
       headers: { Accept: "text/html" },

package/src/providers/kiro-account-state-disk.ts

@@ -0,0 +1,44 @@
+/** Kiro login identity and persisted evidence entrypoints. */
+import { createHash } from "node:crypto";
+import type { ProviderAccount } from "../oauth/types";
+import type { ProviderQuota } from "./quota-types";
+import { hydrateAccountQuotaCache, persistAccountQuotaCache } from "./quota/account-cache";
+
+export function kiroEvidenceIdentity(account: ProviderAccount): string {
+  const cred = account.credential;
+  return createHash("sha256").update(JSON.stringify([
+    account.id, account.loginId ?? String(account.addedAt ?? ""),
+    cred.accountId ?? cred.email ?? "", cred.kiro?.profileArn ?? "",
+    cred.kiro?.clientId ?? "",
+  ])).digest("hex");
+}
+
+export interface KiroPersistedQuota extends ProviderQuota { identity: string; }
+
+/** Keep only the closed set emitted by the Kiro parser when disk data is rewritten. */
+export function sanitizeKiroQuota(quota: ProviderQuota): ProviderQuota {
+  const trial = quota.customWindows?.find(window => window.label === "Free trial"
+    && typeof window.percent === "number" && Number.isFinite(window.percent)
+    && window.percent >= 0 && window.percent <= 100);
+  return {
+    monthlyPercent: quota.monthlyPercent,
+    ...(typeof quota.kiroCreditsUsed === "number" && Number.isFinite(quota.kiroCreditsUsed)
+      && quota.kiroCreditsUsed >= 0 ? { kiroCreditsUsed: quota.kiroCreditsUsed } : {}),
+    ...(typeof quota.kiroCreditsLimit === "number" && Number.isFinite(quota.kiroCreditsLimit)
+      && quota.kiroCreditsLimit > 0 ? { kiroCreditsLimit: quota.kiroCreditsLimit } : {}),
+    ...(typeof quota.monthlyResetAt === "number" && Number.isFinite(quota.monthlyResetAt)
+      && Number.isFinite(new Date(quota.monthlyResetAt).getTime())
+      ? { monthlyResetAt: quota.monthlyResetAt } : {}),
+    ...(trial ? { customWindows: [{ label: "Free trial", percent: trial.percent }] } : {}),
+    updatedAt: quota.updatedAt,
+  };
+}
+export interface KiroPersistedVerdict {
+  exhausted: boolean;
+  resetAt?: number;
+  observedAt: number;
+  identity: string;
+}
+
+export function hydrateKiroAccountState(): void { hydrateAccountQuotaCache(); }
+export function persistKiroAccountState(): void { persistAccountQuotaCache(); }

package/src/providers/kiro-model-catalog.ts

@@ -0,0 +1,162 @@
+/** Account-scoped Kiro management model evidence; never required for a request. */
+import type { ProviderAccount } from "../oauth/types";
+import { getAccountSet } from "../oauth/store";
+import type { OcxProviderConfig } from "../types";
+import { providerOutboundPost, providerRedirectError, type ProviderOutboundDependencies } from "../lib/provider-outbound";
+import { kiroEvidenceIdentity } from "./kiro-account-state-disk";
+import { normalizeKiroModelId, KIRO_MODEL_CONTEXT_WINDOWS } from "./kiro-models";
+import { kiroManagementHost, kiroUsageContextForAccount } from "./kiro-usage";
+import { isValidModelDiscoveryModelId, MODEL_DISCOVERY_MAX_MODELS } from "./model-discovery-limits";
+import { asRecord, QUOTA_JSON_READ_FAILURE, readQuotaJson, REQUEST_TIMEOUT_MS } from "./quota-wire";
+
+const TARGET = "KiroControlPlaneBearerService.ListAvailableModels";
+export const KIRO_MODEL_CATALOG_TTL_MS = 60 * 60_000;
+const LAST_GOOD_MS = 24 * 60 * 60_000;
+const FAILURE_RETRY_MS = 60_000;
+
+export interface KiroAccountModel { modelId: string; contextWindow?: number }
+interface Row { identity: string; models: KiroAccountModel[]; observedAt: number; nextRefreshAt: number }
+interface Flight { identity: string; promise: Promise<void> }
+const rows = new Map<string, Row>();
+const flights = new Map<string, Flight>();
+/** Retry time after a failed discovery for an account that has no last good row to carry it. */
+const failedUntil = new Map<string, { identity: string; at: number }>();
+
+export function kiroModelDiscoveryEnabled(): boolean {
+  return process.env.OPENCODEX_KIRO_MODEL_DISCOVERY !== "0";
+}
+
+function liveAccount(accountId: string): ProviderAccount | undefined {
+  return getAccountSet("kiro")?.accounts.find(account => account.id === accountId && account.needsReauth !== true);
+}
+
+function currentIdentity(accountId: string): string | undefined {
+  const account = liveAccount(accountId);
+  return account ? kiroEvidenceIdentity(account) : undefined;
+}
+
+function validRow(account: ProviderAccount): Row | undefined {
+  const live = liveAccount(account.id);
+  if (!live || kiroEvidenceIdentity(live) !== kiroEvidenceIdentity(account)) return undefined;
+  const row = rows.get(account.id);
+  if (!row || row.identity !== kiroEvidenceIdentity(live)) return undefined;
+  if (Date.now() - row.observedAt >= LAST_GOOD_MS) return undefined;
+  return row;
+}
+
+/** Synchronous cache read; no token refresh and no network. */
+export function readKiroAccountModels(account: ProviderAccount): KiroAccountModel[] | undefined {
+  return validRow(account)?.models;
+}
+
+function parseModels(value: unknown): KiroAccountModel[] | undefined {
+  const payload = asRecord(value);
+  if (!payload || !Array.isArray(payload.models) || payload.models.length === 0
+    || payload.models.length > MODEL_DISCOVERY_MAX_MODELS) return undefined;
+  const seen = new Set<string>();
+  const models: KiroAccountModel[] = [];
+  for (const value of payload.models) {
+    const item = asRecord(value);
+    if (!item || !isValidModelDiscoveryModelId(item.modelId) || seen.has(item.modelId)) continue;
+    seen.add(item.modelId);
+    const limits = asRecord(item.tokenLimits);
+    const limit = limits?.maxInputTokens;
+    models.push({ modelId: item.modelId,
+      ...(typeof limit === "number" && Number.isSafeInteger(limit) && limit > 0
+        ? { contextWindow: limit } : {}) });
+  }
+  return models.length ? models : undefined;
+}
+
+/** Start an identity-fenced refresh without adding its latency to the serving request. */
+export function refreshKiroAccountModelsDetached(
+  account: ProviderAccount,
+  providerConfig: OcxProviderConfig,
+  dependencies: ProviderOutboundDependencies = {},
+): void {
+  if (!kiroModelDiscoveryEnabled() || account.needsReauth === true) return;
+  const identity = kiroEvidenceIdentity(account);
+  if (currentIdentity(account.id) !== identity) return;
+  const old = validRow(account);
+  if (old && Date.now() < old.nextRefreshAt) return;
+  const failed = failedUntil.get(account.id);
+  if (!old && failed?.identity === identity && Date.now() < failed.at) return;
+  if (flights.get(account.id)?.identity === identity) return;
+
+  const flight = (async (): Promise<void> => {
+    let fresh: KiroAccountModel[] | undefined;
+    try {
+      const ctx = await kiroUsageContextForAccount(account.id);
+      if (currentIdentity(account.id) !== identity || !ctx.profileArn) return;
+      const url = new URL(kiroManagementHost(ctx));
+      url.searchParams.set("origin", "AI_EDITOR");
+      url.searchParams.set("profileArn", ctx.profileArn);
+      const response = await providerOutboundPost("kiro", providerConfig, url.toString(), {
+        headers: {
+          authorization: `Bearer ${ctx.access}`,
+          "content-type": "application/x-amz-json-1.0",
+          accept: "application/json",
+          "x-amz-target": TARGET,
+          "x-amzn-codewhisperer-optout": "true",
+        },
+        body: JSON.stringify({ origin: "AI_EDITOR", profileArn: ctx.profileArn }),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      }, dependencies);
+      if (response.ok && !await providerRedirectError(response, url.toString())) {
+        const body = await readQuotaJson(response);
+        if (body !== QUOTA_JSON_READ_FAILURE) fresh = parseModels(body);
+      }
+    } catch {
+      // Management discovery is advisory. Keep the last good row on every failure.
+    }
+    if (currentIdentity(account.id) !== identity) return;
+    const now = Date.now();
+    if (fresh) {
+      rows.set(account.id, { identity, models: fresh, observedAt: now,
+        nextRefreshAt: now + KIRO_MODEL_CATALOG_TTL_MS });
+      failedUntil.delete(account.id);
+    } else if (old) rows.set(account.id, { ...old, nextRefreshAt: now + FAILURE_RETRY_MS });
+    // Without a last good row the failure still has to back off, or every serving request
+    // after a restart would start another discovery while the endpoint is failing.
+    else failedUntil.set(account.id, { identity, at: now + FAILURE_RETRY_MS });
+  })();
+  flights.set(account.id, { identity, promise: flight });
+  void flight.catch(() => {}).finally(() => {
+    if (flights.get(account.id)?.promise === flight) flights.delete(account.id);
+  });
+}
+
+export function kiroAccountSupportsModel(accountId: string, model: string): boolean | undefined {
+  const account = liveAccount(accountId);
+  const models = account ? readKiroAccountModels(account) : undefined;
+  if (!models) return undefined;
+  const normalized = normalizeKiroModelId(model);
+  return models.some(row => row.modelId === model || row.modelId === normalized);
+}
+
+/** Include the static floor while any live account has no observed limit. */
+export function kiroObservedContextWindow(model: string): number | undefined {
+  const normalized = normalizeKiroModelId(model);
+  if (normalized === "auto") return undefined;
+  const accounts = getAccountSet("kiro")?.accounts.filter(account => account.needsReauth !== true) ?? [];
+  const limits: number[] = [];
+  let unknown = accounts.length === 0;
+  for (const account of accounts) {
+    const hit = readKiroAccountModels(account)?.find(row => row.modelId === model || row.modelId === normalized);
+    if (hit?.contextWindow === undefined) unknown = true;
+    else limits.push(hit.contextWindow);
+  }
+  const staticWindow = KIRO_MODEL_CONTEXT_WINDOWS[normalized];
+  if (unknown && staticWindow !== undefined) limits.push(staticWindow);
+  return limits.length ? Math.min(...limits) : undefined;
+}
+
+export function clearKiroAccountModels(accountId?: string): void {
+  if (accountId) { rows.delete(accountId); flights.delete(accountId); failedUntil.delete(accountId); }
+  else { rows.clear(); flights.clear(); failedUntil.clear(); }
+}
+
+/** Deterministic test seam; production requests never call this. */
+export function awaitKiroModelRefreshForTests(accountId: string): Promise<void> {
+  return flights.get(accountId)?.promise ?? Promise.resolve();
+}

package/src/providers/kiro-models.ts

@@ -28,12 +28,13 @@ export const KIRO_MODELS = [
 ];
 
 // Per-model context windows as documented on Kiro's official model catalog
-// (https://kiro.dev/docs/models/ — "Quick comparison", page updated 2026-07-14).
+// (https://kiro.dev/docs/models/ — "Quick comparison", page updated 2026-09-25).
 // "Auto" is a router with no fixed window on Kiro's table, so it is intentionally omitted.
+// GPT-5.6 accepts 1M tokens; requests above 272K bill at double the listed rate (two-tier pricing).
 export const KIRO_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
-  "gpt-5.6-sol": 272_000,
-  "gpt-5.6-terra": 272_000,
-  "gpt-5.6-luna": 272_000,
+  "gpt-5.6-sol": 1_000_000,
+  "gpt-5.6-terra": 1_000_000,
+  "gpt-5.6-luna": 1_000_000,
   "gpt-6-sol": 272_000,
   "gpt-6-luna": 272_000,
   "claude-sonnet-5": 1_000_000,

package/src/providers/kiro-quota-metrics.ts

@@ -0,0 +1,35 @@
+/** Cache-only Kiro quota projection for the opt-in metrics snapshot. */
+import { oauthAccountLogLabel } from "../codex/account-label";
+import { getAccountSet } from "../oauth/store";
+import { kiroAccountEvidence } from "./kiro-usage";
+
+export interface KiroQuotaMetricRow {
+  account: string;
+  used: number;
+  limit: number;
+  percent: number;
+  secondsToReset?: number;
+}
+
+const MAX_KIRO_METRIC_ACCOUNTS = 32;
+
+export function cachedKiroQuotaMetricRows(now = Date.now()): KiroQuotaMetricRow[] {
+  const accounts = getAccountSet("kiro")?.accounts ?? [];
+  const rows: KiroQuotaMetricRow[] = [];
+  const labels = new Set<string>();
+  for (const account of [...accounts].sort((a, b) => a.id.localeCompare(b.id))) {
+    const { quotaPercent: percent, creditsUsed: used, creditsLimit: limit, resetAt } =
+      kiroAccountEvidence(account, now, { hydrate: false });
+    if (typeof used !== "number" || !Number.isFinite(used) || used < 0
+      || typeof limit !== "number" || !Number.isFinite(limit) || limit <= 0
+      || typeof percent !== "number" || !Number.isFinite(percent) || percent < 0 || percent > 100
+      || (resetAt !== undefined && (!Number.isFinite(resetAt) || resetAt <= now))) continue;
+    const label = oauthAccountLogLabel(account.id, "kiro");
+    if (labels.has(label)) continue;
+    labels.add(label);
+    rows.push({ account: label, used, limit, percent,
+      ...(resetAt !== undefined ? { secondsToReset: (resetAt - now) / 1000 } : {}) });
+    if (rows.length === MAX_KIRO_METRIC_ACCOUNTS) break;
+  }
+  return rows;
+}

package/src/providers/kiro-usage.ts

@@ -12,6 +12,11 @@
  * the pool needs those two answers to decide how long to cool a 429'd account.
  */
 import { getValidAccessSnapshotForAccount } from "../oauth";
+import { resolveKiroRequestProfile } from "../oauth/kiro";
+import { credentialGeneration, getAccountSet } from "../oauth/store";
+import type { ProviderAccount } from "../oauth/types";
+import { hydrateKiroAccountState, kiroEvidenceIdentity, type KiroPersistedVerdict } from "./kiro-account-state-disk";
+import { accountCacheKey, accountQuotaCache } from "./quota/account-cache";
 import type { ProviderQuota, ProviderQuotaWindow } from "./quota-types";
 import {
   ACCOUNT_QUOTA_TTL_MS,
@@ -46,6 +51,8 @@ export interface KiroUsageContext {
   accountId: string;
   access: string;
   profileArn?: string;
+  /** The ARN is the Builder ID service profile, not the account's; it must not pick the region. */
+  builderIdFallback?: boolean;
   apiRegion?: string;
   ssoRegion?: string;
 }
@@ -61,7 +68,8 @@ export interface KiroUsageSnapshot {
 interface KiroUsageStateEntry {
   exhausted: boolean;
   nextResetAt?: number;
-  ts: number;
+  observedAt: number;
+  identity: string;
 }
 
 /**
@@ -82,7 +90,10 @@ function safeRegion(value: string | undefined): string | undefined {
  * the SSO session that minted the token.
  */
 function usageRegion(ctx: KiroUsageContext): string {
-  return safeRegion(ctx.profileArn?.split(":")[3])
+  // The Builder ID service profile is Amazon's fixed us-east-1 ARN, not the account's own, so it
+  // must not pin the region, as kiro-constants.ts requires for the runtime path.
+  const arnRegion = ctx.builderIdFallback ? undefined : ctx.profileArn?.split(":")[3];
+  return safeRegion(arnRegion)
     ?? safeRegion(ctx.apiRegion)
     ?? safeRegion(ctx.ssoRegion)
     ?? "us-east-1";
@@ -92,6 +103,10 @@ export function kiroUsageManagementUrl(region: string): string {
   return `https://management.${region}.kiro.dev/`;
 }
 
+export function kiroManagementHost(ctx: KiroUsageContext): string {
+  return kiroUsageManagementUrl(usageRegion(ctx));
+}
+
 /** Credit balances are fractional; the integer fields round 695.17 down to 695. */
 function preciseNumber(row: Record<string, unknown>, precise: string, whole: string): number | undefined {
   return toFiniteNumber(row[precise]) ?? toFiniteNumber(row[whole]);
@@ -115,7 +130,8 @@ function parseKiroUsage(body: unknown): KiroUsageSnapshot | null {
 
   const used = preciseNumber(breakdown, "currentUsageWithPrecision", "currentUsage");
   const limit = preciseNumber(breakdown, "usageLimitWithPrecision", "usageLimit");
-  if (used === undefined || limit === undefined || limit <= 0) return null;
+  if (used === undefined || !Number.isFinite(used) || used < 0
+    || limit === undefined || !Number.isFinite(limit) || limit <= 0) return null;
 
   const percent = normalizePercent((used / limit) * 100);
   if (percent === undefined) return null;
@@ -137,6 +153,8 @@ function parseKiroUsage(body: unknown): KiroUsageSnapshot | null {
 
   const quota: ProviderQuota = {
     monthlyPercent: percent,
+    kiroCreditsUsed: used,
+    kiroCreditsLimit: limit,
     ...(nextResetAt !== undefined ? { monthlyResetAt: nextResetAt } : {}),
     ...(customWindows.length > 0 ? { customWindows } : {}),
     updatedAt: Date.now(),
@@ -144,13 +162,12 @@ function parseKiroUsage(body: unknown): KiroUsageSnapshot | null {
 
   // Enterprise accounts with overage enabled keep serving past the included limit, so
   // "used >= limit" is not by itself a reason to stop routing to the account.
-  const overageEnabled = String(asRecord(payload.overageConfiguration)?.overageStatus ?? "")
-    .trim()
-    .toUpperCase() === "ENABLED";
+  const overageStatus = String(asRecord(payload.overageConfiguration)?.overageStatus ?? "")
+    .trim().toUpperCase();
 
   return {
     quota,
-    exhausted: used >= limit && !overageEnabled,
+    exhausted: used >= limit && overageStatus === "DISABLED",
     ...(nextResetAt !== undefined ? { nextResetAt } : {}),
   };
 }
@@ -164,17 +181,18 @@ function parseKiroUsage(body: unknown): KiroUsageSnapshot | null {
  * a log line.
  */
 export async function fetchKiroUsageSnapshot(ctx: KiroUsageContext): Promise<KiroUsageSnapshot | null> {
+  if (!ctx.profileArn) return null;
   const region = usageRegion(ctx);
   const url = new URL(kiroUsageManagementUrl(region));
   url.searchParams.set("origin", "AI_EDITOR");
   url.searchParams.set("isEmailRequired", "true");
-  if (ctx.profileArn) url.searchParams.set("profileArn", ctx.profileArn);
+  url.searchParams.set("profileArn", ctx.profileArn);
 
   // The modeled arguments appear in BOTH the query string and the body. That duplication is
   // the observed Kiro CLI contract, not an oversight; we have no way to test which side the
   // service actually reads, so we reproduce both.
   const body: Record<string, unknown> = { origin: "AI_EDITOR", isEmailRequired: true };
-  if (ctx.profileArn) body.profileArn = ctx.profileArn;
+  body.profileArn = ctx.profileArn;
 
   try {
     const response = await fetch(url, {
@@ -207,28 +225,56 @@ export async function fetchKiroUsageSnapshot(ctx: KiroUsageContext): Promise<Kir
  */
 export async function kiroUsageContextForAccount(accountId: string): Promise<KiroUsageContext> {
   const snapshot = await getValidAccessSnapshotForAccount("kiro", accountId);
+  // Builder ID accounts never get an account-scoped ARN, and GetUsageLimits rejects a missing one
+  // with 400 "Invalid profileArn". Ask the same resolver the runtime path uses, so the usage probe
+  // sends exactly the ARN a generation request would. An account object is always passed, so the
+  // accountless env/local-import fallbacks never apply to a pooled account.
+  const profile = resolveKiroRequestProfile({
+    profileArn: snapshot.kiro?.profileArn,
+    authType: snapshot.kiro?.authType,
+  });
   return {
     accountId,
     access: snapshot.accessToken,
-    ...(snapshot.kiro?.profileArn ? { profileArn: snapshot.kiro.profileArn } : {}),
+    ...(profile.profileArn ? { profileArn: profile.profileArn } : {}),
+    ...(profile.builderIdFallback ? { builderIdFallback: true } : {}),
     ...(snapshot.kiro?.apiRegion ? { apiRegion: snapshot.kiro.apiRegion } : {}),
     ...(snapshot.kiro?.ssoRegion ? { ssoRegion: snapshot.kiro.ssoRegion } : {}),
   };
 }
 
 /** Record exhaustion for a probed account. Called from the quota cache's commit guard. */
-export function commitKiroAccountUsageState(key: string, snapshot: KiroUsageSnapshot | null): void {
+export function commitKiroAccountUsageState(key: string, snapshot: KiroUsageSnapshot | null, identity?: string): void {
   if (!snapshot) {
     usageState.delete(key);
     return;
   }
+  if (!identity) return;
   usageState.set(key, {
     exhausted: snapshot.exhausted,
     ...(snapshot.nextResetAt !== undefined ? { nextResetAt: snapshot.nextResetAt } : {}),
-    ts: Date.now(),
+    observedAt: Date.now(), identity,
   });
 }
 
+export function* kiroPersistableVerdicts(now = Date.now()): IterableIterator<[string, KiroPersistedVerdict]> {
+  const live = new Map(getAccountSet("kiro")?.accounts.map(account =>
+    [accountCacheKey("kiro", account.id), kiroEvidenceIdentity(account)]) ?? []);
+  for (const [key, entry] of usageState) {
+    if (live.get(key) !== entry.identity || entry.observedAt > now
+      || now - entry.observedAt >= ACCOUNT_QUOTA_TTL_MS
+      || (entry.nextResetAt !== undefined && entry.nextResetAt <= now)) continue;
+    yield [key, { exhausted: entry.exhausted, observedAt: entry.observedAt, identity: entry.identity,
+      ...(entry.nextResetAt !== undefined ? { resetAt: entry.nextResetAt } : {}) }];
+  }
+}
+
+export function hydrateKiroUsageVerdict(key: string, verdict: KiroPersistedVerdict, account: ProviderAccount): void {
+  if (usageState.has(key) || verdict.identity !== kiroEvidenceIdentity(account)) return;
+  usageState.set(key, { exhausted: verdict.exhausted, observedAt: verdict.observedAt,
+    identity: verdict.identity, ...(verdict.resetAt !== undefined ? { nextResetAt: verdict.resetAt } : {}) });
+}
+
 /**
  * Is this account known to be out of allowance right now?
  *
@@ -237,11 +283,12 @@ export function commitKiroAccountUsageState(key: string, snapshot: KiroUsageSnap
  */
 export function getKiroAccountExhaustion(
   key: string,
+  account: ProviderAccount,
   now = Date.now(),
 ): { exhausted: boolean; nextResetAt?: number } | null {
   const entry = usageState.get(key);
-  if (!entry) return null;
-  if (now - entry.ts >= ACCOUNT_QUOTA_TTL_MS) return null;
+  if (!entry || entry.identity !== kiroEvidenceIdentity(account)) return null;
+  if (entry.observedAt > now || now - entry.observedAt >= ACCOUNT_QUOTA_TTL_MS) return null;
   if (entry.nextResetAt !== undefined && entry.nextResetAt <= now) return null;
   return {
     exhausted: entry.exhausted,
@@ -249,6 +296,63 @@ export function getKiroAccountExhaustion(
   };
 }
 
+/** The only Kiro routing evidence read; each half expires on its own clock. */
+export function kiroAccountEvidence(account: ProviderAccount, now = Date.now(), opts: { hydrate?: boolean } = {}):
+  { quotaPercent?: number; creditsUsed?: number; creditsLimit?: number; exhausted?: boolean; resetAt?: number } {
+  // Routing hydrates saved evidence on first use; the metrics scrape passes hydrate:false so a
+  // scrape never touches the disk snapshot and simply reports nothing until routing has loaded it.
+  if (opts.hydrate !== false) hydrateKiroAccountState();
+  const key = accountCacheKey("kiro", account.id);
+  const row = accountQuotaCache.get(key);
+  const quota = row?.identity === kiroEvidenceIdentity(account) && row.quota
+    && typeof row.quota.monthlyPercent === "number" && Number.isFinite(row.quota.monthlyPercent)
+    && row.quota.monthlyPercent >= 0 && row.quota.monthlyPercent <= 100
+    && row.quota.updatedAt <= now && now - row.quota.updatedAt < ACCOUNT_QUOTA_TTL_MS
+    && (row.quota.monthlyResetAt === undefined || (row.quota.monthlyResetAt > now
+      && Number.isFinite(new Date(row.quota.monthlyResetAt).getTime()))) ? row.quota : null;
+  const verdict = getKiroAccountExhaustion(key, account, now);
+  return {
+    ...(quota?.monthlyPercent !== undefined ? { quotaPercent: quota.monthlyPercent } : {}),
+    ...(typeof quota?.kiroCreditsUsed === "number" && Number.isFinite(quota.kiroCreditsUsed)
+      && quota.kiroCreditsUsed >= 0 ? { creditsUsed: quota.kiroCreditsUsed } : {}),
+    ...(typeof quota?.kiroCreditsLimit === "number" && Number.isFinite(quota.kiroCreditsLimit)
+      && quota.kiroCreditsLimit > 0 ? { creditsLimit: quota.kiroCreditsLimit } : {}),
+    ...(verdict ? { exhausted: verdict.exhausted } : {}),
+    ...(verdict?.nextResetAt !== undefined ? { resetAt: verdict.nextResetAt }
+      : quota?.monthlyResetAt !== undefined ? { resetAt: quota.monthlyResetAt } : {}),
+  };
+}
+
+/** A confirmed refusal supersedes only older evidence from the same login. */
+export function noteKiroMonthlyRefusal(accountId: string, generation: string, observedAt = Date.now()): number {
+  hydrateKiroAccountState();
+  const live = getAccountSet("kiro")?.accounts.find(row => row.id === accountId);
+  if (!live || credentialGeneration(live.credential) !== generation) return 0;
+  const key = accountCacheKey("kiro", accountId);
+  const identity = kiroEvidenceIdentity(live);
+  const old = usageState.get(key);
+  if (old?.identity === identity && old.observedAt >= observedAt)
+    return Math.max(0, (old.nextResetAt ?? observedAt) - observedAt);
+  const resetAt = kiroAccountEvidence(live, observedAt).resetAt;
+  const until = Math.min(resetAt ?? observedAt + ACCOUNT_QUOTA_TTL_MS, observedAt + ACCOUNT_QUOTA_TTL_MS);
+  usageState.set(key, { identity, exhausted: true, observedAt,
+    ...(resetAt !== undefined ? { nextResetAt: resetAt } : {}) });
+  return Math.max(0, until - observedAt);
+}
+
+/** Completion clears an older verdict only for the credential that actually served. */
+export function noteKiroServedSuccess(accountId: string, generation: string, observedAt = Date.now()): boolean {
+  hydrateKiroAccountState();
+  const live = getAccountSet("kiro")?.accounts.find(row => row.id === accountId);
+  if (!live || credentialGeneration(live.credential) !== generation) return false;
+  const key = accountCacheKey("kiro", accountId);
+  const old = usageState.get(key);
+  if (!old || old.identity !== kiroEvidenceIdentity(live) || old.observedAt >= observedAt || !old.exhausted)
+    return false;
+  usageState.set(key, { ...old, exhausted: false, observedAt });
+  return true;
+}
+
 /** Drop rows for one provider prefix, or all of them. Mirrors clearAccountQuotaCache. */
 export function clearKiroAccountUsageState(prefix?: string): void {
   if (!prefix) {