@bitkyc08/opencodex 2.67.0 → 2.68.0

package/src/oauth/kiro-device-login.ts

@@ -0,0 +1,312 @@
+/** Native Kiro device grants. All upstream bodies and credentials stay inside this module. */
+import { randomBytes } from "node:crypto";
+import { loadConfig, saveConfig } from "../config";
+import { providerOutboundPost } from "../lib/provider-outbound";
+import { BOUNDED_BODY_MAX_BYTES, readBoundedResponseBytes } from "../lib/bounded-body";
+import { upsertOAuthProvider } from "./index";
+import { appendKiroAccountFromDeviceLogin, isStorableKiroClientPart, rollbackCredentialWriteIfMatch } from "./store";
+import type { OAuthCredentials } from "./types";
+import type { ManagementPrincipal } from "../server/management-auth";
+import type { OcxConfig } from "../types";
+
+export type KiroDeviceMethod = "builder-id" | "google" | "github";
+export type KiroDevicePrincipal = ManagementPrincipal;
+type State = "pending" | "done" | "failed" | "expired" | "cancelled";
+export interface KiroDeviceView {
+  flowId: string;
+  method: KiroDeviceMethod;
+  state: State;
+  userCode?: string;
+  verificationUri?: string;
+  verificationUriComplete?: string;
+  expiresAt?: number;
+  warning?: "duplicate_profile_arn" | "manual_review_required";
+}
+interface Flow {
+  view: KiroDeviceView;
+  ownerPrincipal: KiroDevicePrincipal;
+  deviceCode?: string;
+  clientId?: string;
+  clientSecret?: string;
+  nextPollAt: number;
+  intervalMs: number;
+  deadline: number;
+  polling?: Promise<KiroDeviceView>;
+  configBaseline?: OcxConfig;
+  commitAccepted?: boolean;
+  terminalAt?: number;
+  retentionTimer?: ReturnType<typeof setTimeout>;
+}
+export type KiroDevicePost = (url: string, body: Record<string, unknown>) => Promise<Response>;
+const SOCIAL = "https://prod.us-east-1.auth.desktop.kiro.dev";
+const OIDC = "https://oidc.us-east-1.amazonaws.com";
+const MAX_KIRO_DEVICE_FLOWS = 4;
+const MAX_KIRO_DEVICE_ENTRIES = 16;
+const TERMINAL_RETENTION_MS = 60_000;
+const MAX_LIFETIME_MS = 15 * 60_000;
+const PROFILE_ARN = /^arn:[a-z0-9-]+:codewhisperer:[a-z0-9-]+:\d{12}:profile\/[A-Za-z0-9-]+$/;
+const USER_CODE = /^[A-Za-z0-9-]{4,32}$/;
+/** C0/C1 controls plus bidi and zero-width formatting marks that can disguise a URL. */
+const CONTROL = /[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/;
+const flows = new Map<string, Flow>();
+
+async function defaultPost(url: string, body: Record<string, unknown>): Promise<Response> {
+  const configured = loadConfig().providers.kiro;
+  return providerOutboundPost("kiro", {
+    baseUrl: new URL(url).origin,
+    ...(configured?.proxy ? { proxy: configured.proxy } : {}),
+    ...(configured?.noProxy ? { noProxy: configured.noProxy } : {}),
+    ...(configured?.allowPrivateNetwork ? { allowPrivateNetwork: true } : {}),
+  }, url, {
+    headers: { "content-type": "application/json" }, body: JSON.stringify(body), signal: AbortSignal.timeout(20_000),
+  });
+}
+
+let transport: KiroDevicePost = defaultPost;
+let clock = () => Date.now();
+function defaultPublishConfig(): void {
+  const config = loadConfig();
+  upsertOAuthProvider(config, "kiro");
+  saveConfig(config);
+}
+let publishConfig: () => void | Promise<void> = defaultPublishConfig;
+/** Tests replace the transport; production always uses the guarded outbound path. */
+export function setKiroDevicePostForTests(post?: KiroDevicePost): void { transport = post ?? defaultPost; }
+export function setKiroDeviceClockForTests(now?: () => number): void { clock = now ?? (() => Date.now()); }
+export function setKiroDevicePublishForTests(publish?: () => void | Promise<void>): void {
+  publishConfig = publish ?? defaultPublishConfig;
+}
+export function clearKiroDeviceFlowsForTests(): void {
+  for (const flow of flows.values()) clearTimeout(flow.retentionTimer);
+  flows.clear(); transport = defaultPost; setKiroDeviceClockForTests(); setKiroDevicePublishForTests();
+}
+export function kiroDeviceFlowCountForTests(): number { return flows.size; }
+
+function object(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+async function reply(url: string, body: Record<string, unknown>): Promise<{ status: number; data: Record<string, unknown>; errorType: string }> {
+  const response = await transport(url, body);
+  // Unknown upstream bodies are bounded and never echoed into a response or error.
+  const { bytes, oversized } = await readBoundedResponseBytes(response, {
+    maxBytes: BOUNDED_BODY_MAX_BYTES, signal: AbortSignal.timeout(20_000),
+  });
+  if (oversized) throw new Error("Kiro device reply too large");
+  let parsed: unknown = {};
+  try { parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)); } catch { /* malformed reply fails closed */ }
+  const data = object(parsed);
+  return { status: response.status, data, errorType: response.headers.get("x-amzn-errortype")?.split(":")[0] ?? "" };
+}
+function positive(value: unknown): value is number { return typeof value === "number" && Number.isFinite(value) && value > 0; }
+function publicView(flow: Flow): KiroDeviceView { return { ...flow.view }; }
+function forgetFlow(id: string): void {
+  const flow = flows.get(id);
+  if (flow?.retentionTimer) clearTimeout(flow.retentionTimer);
+  flows.delete(id);
+}
+function terminal(flow: Flow, state: State, warning?: KiroDeviceView["warning"]): KiroDeviceView {
+  flow.view.state = state;
+  if (flow.terminalAt === undefined) {
+    flow.terminalAt = clock();
+    flow.retentionTimer = setTimeout(() => {
+      if (flows.get(flow.view.flowId) === flow) forgetFlow(flow.view.flowId);
+    }, TERMINAL_RETENTION_MS);
+    flow.retentionTimer.unref();
+  }
+  if (warning) flow.view.warning = warning;
+  delete flow.deviceCode;
+  delete flow.clientId;
+  delete flow.clientSecret;
+  delete flow.configBaseline;
+  return publicView(flow);
+}
+function pruneFlows(): void {
+  const now = clock();
+  for (const [id, flow] of flows) {
+    if (flow.view.state === "pending" && now >= flow.deadline) terminal(flow, "expired");
+    if (flow.terminalAt !== undefined && now - flow.terminalAt >= TERMINAL_RETENTION_MS) forgetFlow(id);
+  }
+  while (flows.size >= MAX_KIRO_DEVICE_ENTRIES) {
+    const oldest = [...flows].find(([, flow]) => flow.view.state !== "pending");
+    if (!oldest) break;
+    forgetFlow(oldest[0]);
+  }
+}
+function owned(flowId: string, principal: KiroDevicePrincipal): Flow | undefined {
+  const flow = flows.get(flowId);
+  if (!flow || flow.ownerPrincipal !== principal) return undefined;
+  if (clock() >= flow.deadline) {
+    terminal(flow, "expired");
+    forgetFlow(flowId);
+    return undefined;
+  }
+  return flow;
+}
+function code(value: unknown): value is string { return typeof value === "string" && value.length > 0; }
+function verificationUri(value: unknown): value is string {
+  if (typeof value !== "string" || value.length > 2048 || CONTROL.test(value)) return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password;
+  } catch { return false; }
+}
+function viewFromAuthorization(flow: Flow, data: Record<string, unknown>, scale: number): void {
+  if (!code(data.deviceCode) || typeof data.userCode !== "string" || !USER_CODE.test(data.userCode)
+    || !verificationUri(data.verificationUri)
+    || (data.verificationUriComplete !== undefined && !verificationUri(data.verificationUriComplete))) {
+    throw new Error("Kiro device authorization failed");
+  }
+  const now = clock();
+  const lifetime = positive(data.expiresInMilliseconds) && scale === 1 ? data.expiresInMilliseconds
+    : positive(data.expiresIn) && scale === 1000 ? data.expiresIn * 1000 : scale === 1 ? 300_000 : 600_000;
+  const interval = positive(data.intervalInMilliseconds) && scale === 1 ? data.intervalInMilliseconds
+    : positive(data.interval) && scale === 1000 ? data.interval * 1000 : 5_000;
+  flow.deviceCode = data.deviceCode;
+  flow.deadline = Math.min(flow.deadline, now + lifetime);
+  flow.intervalMs = Math.max(1000, interval);
+  flow.nextPollAt = now + flow.intervalMs;
+  flow.view = {
+    flowId: flow.view.flowId, method: flow.view.method, state: "pending", userCode: data.userCode,
+    verificationUri: data.verificationUri,
+    ...(data.verificationUriComplete ? { verificationUriComplete: data.verificationUriComplete } : {}),
+    expiresAt: flow.deadline,
+  };
+}
+
+export async function startKiroDeviceLogin(method: KiroDeviceMethod, principal: KiroDevicePrincipal, configBaseline?: OcxConfig): Promise<KiroDeviceView> {
+  // Reserve before the first await, so concurrent starts cannot evade the cap.
+  pruneFlows();
+  if ([...flows.values()].filter(flow => flow.view.state === "pending").length >= MAX_KIRO_DEVICE_FLOWS) {
+    throw new Error("Too many Kiro device logins in progress");
+  }
+  if (flows.size >= MAX_KIRO_DEVICE_ENTRIES) throw new Error("Too many Kiro device logins in progress");
+  const flowId = randomBytes(32).toString("base64url");
+  const flow: Flow = {
+    view: { flowId, method, state: "pending" }, ownerPrincipal: principal,
+    nextPollAt: 0, intervalMs: 5_000, deadline: clock() + MAX_LIFETIME_MS,
+    ...(configBaseline ? { configBaseline: structuredClone(configBaseline) } : {}),
+  };
+  flows.set(flowId, flow);
+  let started = false;
+  try {
+    if (method === "builder-id") {
+      const registration = await reply(`${OIDC}/client/register`, {
+        clientName: "kiro-cli", clientType: "public",
+        scopes: ["codewhisperer:completions", "codewhisperer:analysis", "codewhisperer:conversations"],
+      });
+      if (registration.status < 200 || registration.status >= 300 || !isStorableKiroClientPart(registration.data.clientId)
+        || !isStorableKiroClientPart(registration.data.clientSecret)) throw new Error("Kiro registration failed");
+      flow.clientId = registration.data.clientId;
+      flow.clientSecret = registration.data.clientSecret;
+      const authorization = await reply(`${OIDC}/device_authorization`, {
+        clientId: flow.clientId, clientSecret: flow.clientSecret, startUrl: "https://view.awsapps.com/start",
+      });
+      if (authorization.status < 200 || authorization.status >= 300) throw new Error("Kiro device authorization failed");
+      viewFromAuthorization(flow, authorization.data, 1000);
+    } else {
+      const authorization = await reply(`${SOCIAL}/oauth/device/authorization`, {
+        clientId: "kiro-cli", loginProvider: method === "google" ? "Google" : "Github",
+      });
+      if (authorization.status < 200 || authorization.status >= 300) throw new Error("Kiro device authorization failed");
+      viewFromAuthorization(flow, authorization.data, 1);
+    }
+    started = true;
+    return publicView(flow);
+  } catch {
+    throw new Error("Kiro device login could not start");
+  } finally {
+    if (!started) { terminal(flow, "failed"); forgetFlow(flowId); }
+  }
+}
+
+export function kiroDeviceConfigBaseline(flowId: string, principal: KiroDevicePrincipal): OcxConfig | undefined {
+  return owned(flowId, principal)?.configBaseline;
+}
+
+async function poll(flow: Flow, principal: KiroDevicePrincipal): Promise<KiroDeviceView> {
+  const now = clock();
+  flow.nextPollAt = now + flow.intervalMs;
+  try {
+    const builder = flow.view.method === "builder-id";
+    const result = builder
+      ? await reply(`${OIDC}/token`, {
+        clientId: flow.clientId, clientSecret: flow.clientSecret, deviceCode: flow.deviceCode,
+        grantType: "urn:ietf:params:oauth:grant-type:device_code",
+      })
+      : await reply(`${SOCIAL}/oauth/device/poll`, { clientId: "kiro-cli", deviceCode: flow.deviceCode });
+    if (!owned(flow.view.flowId, principal) || flow.view.state !== "pending") return publicView(flow);
+    const data = result.data;
+    const error = typeof data.error === "string" ? data.error : result.errorType;
+    if (builder && result.status === 400) {
+      if (error === "authorization_pending" || error === "AuthorizationPendingException") return publicView(flow);
+      if (error === "slow_down" || error === "SlowDownException") {
+        flow.intervalMs += 5_000;
+        flow.nextPollAt = clock() + flow.intervalMs;
+        return publicView(flow);
+      }
+      if (error === "expired_token" || error === "ExpiredTokenException") return terminal(flow, "expired");
+    }
+    if (!builder && result.status === 200) {
+      if (data.status === "authorization_pending") return publicView(flow);
+      if (data.status === "expired_token" || data.status === "expired") return terminal(flow, "expired");
+    }
+    if (result.status !== 200 || Object.hasOwn(data, "error") || error || (builder && (data.status !== undefined || !positive(data.expiresIn) || !isStorableKiroClientPart(flow.clientId)
+      || !isStorableKiroClientPart(flow.clientSecret)))
+      || (!builder && (data.status !== undefined && data.status !== "approved"))) return terminal(flow, "failed");
+    if (!code(data.accessToken) || !code(data.refreshToken)
+      || (!builder && (typeof data.profileArn !== "string" || !PROFILE_ARN.test(data.profileArn)))) return terminal(flow, "failed");
+    const credential: OAuthCredentials = {
+      access: data.accessToken, refresh: data.refreshToken,
+      expires: clock() + (positive(data.expiresIn) ? data.expiresIn * 1000 : 3600_000),
+      source: "oauth",
+      kiro: builder
+        ? { clientId: flow.clientId, clientSecret: flow.clientSecret, ssoRegion: "us-east-1", apiRegion: "us-east-1" }
+        : { profileArn: data.profileArn as string, ssoRegion: "us-east-1", apiRegion: "us-east-1" },
+    };
+    const assertBeforePersist = () => {
+      if (flows.get(flow.view.flowId) !== flow || flow.ownerPrincipal !== principal
+        || flow.view.state !== "pending" || clock() >= flow.deadline) throw new Error("Kiro device flow cancelled");
+      flow.commitAccepted = true;
+    };
+    const added = await appendKiroAccountFromDeviceLogin(credential, { assertBeforePersist });
+    try {
+      await publishConfig();
+    } catch {
+      try {
+        if (await rollbackCredentialWriteIfMatch(added.receipt) === "stale") flow.view.warning = "manual_review_required";
+      } catch {
+        flow.view.warning = "manual_review_required";
+      }
+      throw new Error("Kiro account configuration failed");
+    }
+    return terminal(flow, "done", added.warning);
+  } catch {
+    return flow.view.state === "cancelled" ? publicView(flow) : terminal(flow, "failed");
+  }
+}
+
+export async function statusKiroDeviceLogin(flowId: string, principal: KiroDevicePrincipal): Promise<KiroDeviceView | null> {
+  pruneFlows();
+  const flow = owned(flowId, principal);
+  if (!flow) return null;
+  if (flow.view.state !== "pending") {
+    forgetFlow(flowId);
+    return publicView(flow);
+  }
+  if (clock() < flow.nextPollAt) return publicView(flow);
+  if (!flow.polling) flow.polling = poll(flow, principal).finally(() => { flow.polling = undefined; });
+  const result = await flow.polling;
+  if (result.state !== "pending") forgetFlow(flowId);
+  return result;
+}
+
+export function cancelKiroDeviceLogin(flowId: string, principal: KiroDevicePrincipal): KiroDeviceView | null {
+  const flow = owned(flowId, principal);
+  if (!flow) return null;
+  if (flow.commitAccepted && flow.view.state === "pending") return { ...flow.view, state: "done" };
+  if (flow.view.state === "pending") {
+    terminal(flow, "cancelled");
+    forgetFlow(flowId);
+  }
+  return publicView(flow);
+}

package/src/oauth/kiro-terminal-failover.ts

@@ -0,0 +1,28 @@
+import type { OAuthAccessSnapshot } from "./index";
+import type { OcxConfig } from "../types";
+import { getValidAccessSnapshotForAccount } from "./index";
+import { credentialGeneration, getAccountCredentialWithStatus, getAccountSet } from "./store";
+import { eligibleFailoverAccounts, isGenericOAuthFailoverEnabled,
+  GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST } from "./generic-account-failover";
+
+/** Only an unchanged, allowlist-classified dead credential permits this alternate. */
+export async function tryKiroAlternateAfterTerminalRefresh(
+  config: OcxConfig, failedAccountId: string, failedGeneration: string,
+): Promise<OAuthAccessSnapshot | null> {
+  if (!isGenericOAuthFailoverEnabled(config, "kiro")) return null;
+  const failed = getAccountCredentialWithStatus("kiro", failedAccountId);
+  if (!failed?.needsReauth || credentialGeneration(failed.credential) !== failedGeneration) return null;
+  const order = getAccountSet("kiro")?.accounts.map(row => row.id) ?? [];
+  const after = order.indexOf(failedAccountId);
+  if (after < 0) return null;
+  const ring = [...order.slice(after + 1), ...order.slice(0, after)];
+  const eligible = new Set(eligibleFailoverAccounts("kiro"));
+  let attempted = 0;
+  for (const id of ring) {
+    if (id === failedAccountId || !eligible.has(id)) continue;
+    if (++attempted >= GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST) break;
+    try { return await getValidAccessSnapshotForAccount("kiro", id, { requireUsableAccount: true }); }
+    catch { /* Keep the original login-required result if every alternate is stale. */ }
+  }
+  return null;
+}

package/src/oauth/login-flow-state.ts

@@ -10,7 +10,13 @@ import type { GenerationContext } from "../lib/state-store-sweeper";
  * a login that has started and not yet settled, and none of it reads or writes a stored
  * credential. `index.ts` re-exports the two public names, so existing importers are unaffected.
  */
-export const loginState = new Map<string, { error?: string; done: boolean }>();
+/** Human-facing continuation only: never retain credentials or provider response objects. */
+export interface OAuthLoginHint {
+  url: string;
+  instructions?: string;
+  deviceCode?: string;
+}
+export const loginState = new Map<string, { error?: string; done: boolean; hint?: OAuthLoginHint }>();
 export const loginAbort = new Map<string, { controller: AbortController; flowId?: string }>();
 export const kiroLoginSettling = new Set<string>();
 

package/src/oauth/pool-settings-capability.ts

@@ -9,8 +9,8 @@ import type { OcxConfig, OcxProviderConfig } from "../types";
  * other OAuth provider the generic failover module admits; its settings persist on
  * `providers.<name>.oauthAccountFailover`.
  *
- * `strategy` and `autoSwitchThreshold` are still a declared contract the selector does not
- * consume — that is what `inert` reports. `enabled` is NOT inert any more: an explicit
+ * `strategy` and `autoSwitchThreshold` are consumed only when `pool.kernel` is on — that
+ * is what `inert` reports. `enabled` is NOT inert: an explicit
  * `true` enables pre-dispatch exhaustion avoidance (`preferredInitialAccount`); absence is off.
  * Healthy manual selections remain authoritative. What the switch can
  * no longer do is refuse reactive 429 rotation, which activates on account presence and is not
@@ -18,7 +18,7 @@ import type { OcxConfig, OcxProviderConfig } from "../types";
  */
 export type PoolSettingsKind = "codex" | "anthropic" | "generic";
 
-export const GENERIC_POOL_STRATEGIES = ["quota", "round-robin", "fill-first"] as const;
+export const GENERIC_POOL_STRATEGIES = ["quota", "round-robin", "fill-first", "least-loaded"] as const;
 export type GenericPoolStrategy = typeof GENERIC_POOL_STRATEGIES[number];
 
 export function poolSettingsCapability(name: string, provider: OcxProviderConfig | undefined): PoolSettingsKind | null {
@@ -28,12 +28,14 @@ export function poolSettingsCapability(name: string, provider: OcxProviderConfig
   return isGenericFailoverProvider(name, provider) ? "generic" : null;
 }
 
-export function parseGenericPoolStrategy(value: unknown): GenericPoolStrategy | null {
-  // Delegated, not re-implemented. Three pools accepting the same three names from three
-  // private copies of the same check is how they drift apart: the Codex and Anthropic kinds
-  // already shared this parser while the generic kind carried its own. The names and the
-  // 1..100 bound live in pool-kernel.ts, once.
-  return parseAccountPoolStrategy(value) as GenericPoolStrategy | null;
+export function parseGenericPoolStrategy(value: unknown, providerName?: string): GenericPoolStrategy | null {
+  // Keep the common three names in the shared parser; the fourth is Kiro-specific.
+  if (value === "least-loaded") return providerName === "kiro" ? value : null;
+  return parseAccountPoolStrategy(value);
+}
+
+export function parseKiroAccountCap(value: unknown): number | null {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 100 ? value : null;
 }
 
 export function parseGenericAutoSwitchThreshold(value: unknown): number | null {
@@ -46,7 +48,7 @@ export function parseGenericStickyLimit(value: unknown): number | null {
 
 /** Fields the unified pool-settings contract can carry, per kind. */
 export const POOL_SETTINGS_FIELDS = [
-  "enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow",
+  "enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "maxConcurrentPerAccount",
 ] as const;
 export type PoolSettingsField = typeof POOL_SETTINGS_FIELDS[number];
 
@@ -78,6 +80,7 @@ export interface PoolSettingsDto {
   stickyLimit: number | null;
   autoSwitchThreshold: number | null;
   quotaWindow: string | null;
+  maxConcurrentPerAccount: number | null;
 }
 
 
@@ -88,6 +91,8 @@ export interface GenericPoolSettingsDto {
   strategy: GenericPoolStrategy | null;
   autoSwitchThreshold: number | null;
   stickyLimit: number | null;
+  /** Present only for Kiro; other generic providers keep their original legacy shape. */
+  maxConcurrentPerAccount?: number | null;
   /**
    * Marker for `strategy`, `autoSwitchThreshold` and `stickyLimit` only: true while they are
    * persisted but not consumed by the selector, false once `pool.kernel` is on and they
@@ -113,7 +118,8 @@ export function genericPoolSettingsDto(
     provider: name,
     kind: "generic",
     enabled: typeof failover.enabled === "boolean" ? failover.enabled : null,
-    strategy: parseGenericPoolStrategy(failover.strategy),
+    strategy: parseGenericPoolStrategy(failover.strategy, name),
+    ...(name === "kiro" ? { maxConcurrentPerAccount: parseKiroAccountCap(failover.maxConcurrentPerAccount) } : {}),
     autoSwitchThreshold: parseGenericAutoSwitchThreshold(failover.autoSwitchThreshold),
     stickyLimit: parseGenericStickyLimit(failover.stickyLimit),
     inert: kernelEnabled !== true,
@@ -139,7 +145,8 @@ export function unifiedPoolSettingsDto(
   provider: string,
   kind: PoolSettingsKind,
 ): PoolSettingsDto {
-  const base = { provider, kind, supported: SUPPORTED_BY_KIND[kind] };
+  const base = { provider, kind, supported: provider === "kiro"
+    ? [...SUPPORTED_BY_KIND.generic, "maxConcurrentPerAccount" as const] : SUPPORTED_BY_KIND[kind] };
   if (kind === "codex") {
     return {
       ...base,
@@ -151,6 +158,7 @@ export function unifiedPoolSettingsDto(
       stickyLimit: parseGenericStickyLimit(config.accountPoolStickyLimit) ?? 1,
       autoSwitchThreshold: parseGenericAutoSwitchThreshold(config.autoSwitchThreshold) ?? 80,
       quotaWindow: null,
+      maxConcurrentPerAccount: null,
     };
   }
   if (kind === "anthropic") {
@@ -164,6 +172,7 @@ export function unifiedPoolSettingsDto(
       stickyLimit: parseGenericStickyLimit(pool.stickyLimit) ?? 1,
       autoSwitchThreshold: parseGenericAutoSwitchThreshold(pool.autoSwitchThreshold) ?? 80,
       quotaWindow: typeof pool.quotaWindow === "string" ? pool.quotaWindow : "five-hour",
+      maxConcurrentPerAccount: null,
     };
   }
   const failover = config.providers?.[provider]?.oauthAccountFailover ?? {};
@@ -176,10 +185,10 @@ export function unifiedPoolSettingsDto(
     // inherited one. Config only -- the roster quorum the dispatch predicate also applies is a
     // different question and stays out of a settings field.
     enabledEffective: stored ?? (config.oauthAccountFailover?.enabled === true),
-    strategy: parseGenericPoolStrategy(failover.strategy),
+    strategy: parseGenericPoolStrategy(failover.strategy, provider),
     stickyLimit: parseGenericStickyLimit(failover.stickyLimit),
     autoSwitchThreshold: parseGenericAutoSwitchThreshold(failover.autoSwitchThreshold),
     quotaWindow: null,
+    maxConcurrentPerAccount: provider === "kiro" ? parseKiroAccountCap(failover.maxConcurrentPerAccount) : null,
   };
 }
-

package/src/oauth/store.ts

@@ -58,6 +58,12 @@ export function reconcileOAuthReauthState(context: GenerationContext): number {
   return 0;
 }
 
+/** Test-only isolation for suites that exercise generation reconciliation. */
+export function resetOAuthReauthReconcileStateForTests(): void {
+  lastReconciledGeneration = 0;
+  liveOAuthAccountKeys = new Set();
+}
+
 /** Providers whose account set is pinned to a single slot (see module doc). */
 const SINGLE_SLOT_PROVIDERS = new Set(["chatgpt"]);
 
@@ -505,6 +511,12 @@ function isCredentialSource(value: unknown): value is OAuthCredentialSource {
   return value === "oauth" || value === "local-cli" || value === "credential-file" || value === "environment" || value === "manual";
 }
 
+/** Registration values must survive store normalization unchanged. */
+export function isStorableKiroClientPart(value: unknown): value is string {
+  return typeof value === "string" && value.length > 0 && value.length <= 4096
+    && value === value.trim() && !/[\x00-\x1f\x7f]/.test(value);
+}
+
 function normalizeCredential(cred: unknown): OAuthCredentials | null {
   if (!cred || typeof cred !== "object") return null;
   const candidate = cred as Partial<OAuthCredentials>;
@@ -539,8 +551,8 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
     const profileArn = clean(kiro.profileArn, 1024);
     const ssoRegion = clean(kiro.ssoRegion, 64);
     const apiRegion = clean(kiro.apiRegion, 64);
-    const clientId = clean(kiro.clientId, 4096);
-    const clientSecret = clean(kiro.clientSecret, 4096);
+    const clientId = isStorableKiroClientPart(kiro.clientId) ? kiro.clientId : undefined;
+    const clientSecret = isStorableKiroClientPart(kiro.clientSecret) ? kiro.clientSecret : undefined;
     if (profileArn || ssoRegion || apiRegion || clientId || clientSecret) {
       normalized.kiro = {
         ...(profileArn ? { profileArn } : {}),
@@ -614,6 +626,11 @@ function normalizeAccount(value: unknown): ProviderAccount | null {
   if (typeof candidate.alias === "string" && candidate.alias.trim()) account.alias = candidate.alias.trim();
   if (candidate.needsReauth === true) account.needsReauth = true;
   if (typeof candidate.addedAt === "number") account.addedAt = candidate.addedAt;
+  if (typeof candidate.loginId === "string"
+    && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(candidate.loginId)) {
+    account.loginId = candidate.loginId;
+  }
+  if (candidate.loginOrigin === "kiro-device") account.loginOrigin = candidate.loginOrigin;
   return account;
 }
 
@@ -895,6 +912,8 @@ export async function saveCredentialWithReceipt(
         accountId = id;
       }
     }
+    // Every explicit login, including an in-place legacy slot upgrade, starts new evidence.
+    store[provider]!.accounts.find(account => account.id === accountId)!.loginId = randomUUID();
     return {
       provider,
       accountId,
@@ -920,6 +939,38 @@ export async function saveCredential(
   await saveCredentialWithReceipt(provider, cred, opts);
 }
 
+/** Native device approval always gets a new slot; no unverified identity can replace one. */
+export async function appendKiroAccountFromDeviceLogin(
+  cred: OAuthCredentials,
+  opts: { assertBeforePersist?: () => void } = {},
+): Promise<{ receipt: OAuthCredentialWriteReceipt; warning?: "duplicate_profile_arn" }> {
+  const safe = normalizeCredential(cred);
+  if (!safe || !safe.access || !safe.refresh) throw new Error("Invalid Kiro device credential");
+  if (safe.kiro?.clientId || safe.kiro?.clientSecret) {
+    if (!isStorableKiroClientPart(cred.kiro?.clientId) || !isStorableKiroClientPart(cred.kiro?.clientSecret)) {
+      throw new Error("Invalid Kiro client registration");
+    }
+  }
+  return await mutateStore(store => {
+    const set = store.kiro;
+    const id = distinctAccountId(safe, set?.accounts ?? []);
+    const warning = safe.kiro?.profileArn && set?.accounts.some(a => a.credential.kiro?.profileArn === safe.kiro?.profileArn)
+      ? "duplicate_profile_arn" as const : undefined;
+    const account: ProviderAccount = { id, credential: safe, addedAt: Date.now(), loginId: randomUUID(), loginOrigin: "kiro-device" };
+    if (set) set.accounts.push(account);
+    else store.kiro = { activeAccountId: id, accounts: [account] };
+    const receipt: OAuthCredentialWriteReceipt = {
+      provider: "kiro", accountId: id, credentialGeneration: credentialGeneration(safe),
+      selectionRevision: store.kiro.selectionRevision,
+      previousActiveAccountId: set?.activeAccountId, previousAccount: undefined,
+    };
+    return { receipt, ...(warning ? { warning } : {}) };
+  }, [safe], {
+    assertBeforePersist: opts.assertBeforePersist,
+    finalizeResult: (result, store) => { result.receipt.selectionRevision = store.kiro?.selectionRevision; },
+  });
+}
+
 /** Compensate one owned login write without deleting or selecting over concurrent work. */
 export async function rollbackCredentialWriteIfMatch(
   receipt: OAuthCredentialWriteReceipt,
@@ -1066,7 +1117,7 @@ export async function saveAccountCredential(
   provider: string,
   accountId: string,
   cred: OAuthCredentials,
-  opts: { assertBeforePersist?: () => void } = {},
+  opts: { assertBeforePersist?: () => void; rotateLoginId?: boolean } = {},
 ): Promise<void> {
   const safe = normalizeCredential(cred);
   if (!safe) return;
@@ -1074,6 +1125,7 @@ export async function saveAccountCredential(
     const account = store[provider]?.accounts.find(a => a.id === accountId);
     if (!account) return;
     account.credential = safe;
+    if (opts.rotateLoginId) account.loginId = randomUUID();
     delete account.needsReauth;
   }, [provider, accountId, safe], { assertBeforePersist: opts.assertBeforePersist });
 }
@@ -1187,6 +1239,7 @@ export async function replaceProviderAccountSet(
         ...(account.alias ? { alias: account.alias } : {}),
         ...(account.needsReauth ? { needsReauth: true } : {}),
         ...(account.addedAt !== undefined ? { addedAt: account.addedAt } : {}),
+        ...(account.loginId ? { loginId: account.loginId } : {}),
       })),
     };
     return false;

package/src/oauth/types.ts

@@ -79,6 +79,10 @@ export type OAuthCredentials = {
 export interface ProviderAccount {
   /** Stable short id, generated once at append time; never re-derived after rotation. */
   id: string;
+  /** Rotated on each explicit login and retained across token refreshes. */
+  loginId?: string;
+  /** Native Kiro device accounts cannot use the kiro-cli reauth path. */
+  loginOrigin?: "kiro-device";
   /** User-owned display label; never participates in auth identity or routing. */
   alias?: string;
   credential: OAuthCredentials;