npm - @bitkyc08/opencodex - Versions diffs - 2.7.1 → 2.7.3 - Mend

@bitkyc08/opencodex 2.7.1 → 2.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (32) hide show

package/README.md +1 -2
package/gui/dist/assets/index-D7o1qwy-.css +1 -0
package/gui/dist/assets/index-DT4C-vKW.js +40 -0
package/gui/dist/index.html +2 -2
package/package.json +1 -1
package/src/adapters/anthropic.ts +14 -3
package/src/adapters/azure.ts +16 -11
package/src/adapters/cursor/live-models.ts +36 -24
package/src/adapters/cursor/live-transport.ts +5 -17
package/src/adapters/cursor/native-exec.ts +11 -7
package/src/adapters/cursor/transport-retry.ts +1 -4
package/src/adapters/google.ts +32 -9
package/src/adapters/kiro-retry.ts +6 -2
package/src/adapters/kiro.ts +14 -9
package/src/adapters/openai-chat.ts +38 -28
package/src/codex/catalog.ts +67 -32
package/src/config.ts +25 -2
package/src/oauth/index.ts +4 -3
package/src/oauth/key-providers.ts +1 -1
package/src/oauth/kiro-credentials.ts +13 -3
package/src/providers/derive.ts +4 -0
package/src/providers/kiro-models.ts +1 -1
package/src/providers/registry.ts +129 -40
package/src/responses/parser.ts +12 -0
package/src/router.ts +13 -1
package/src/server/management-api.ts +10 -2
package/src/server/request-log.ts +25 -1
package/src/server/responses.ts +141 -43
package/src/types.ts +12 -2
package/src/update/index.ts +1 -1
package/gui/dist/assets/index-BUAMcKFd.css +0 -1
package/gui/dist/assets/index-CtHGtaW8.js +0 -34

package/gui/dist/index.html CHANGED Viewed

@@ -16,8 +16,8 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-CtHGtaW8.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BUAMcKFd.css">
+    <script type="module" crossorigin src="/assets/index-DT4C-vKW.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-D7o1qwy-.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.7.1",
+  "version": "2.7.3",
   "description": "Universal provider proxy for OpenAI Codex — use any LLM with Codex CLI/App/SDK",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/src/adapters/anthropic.ts CHANGED Viewed

@@ -241,7 +241,7 @@ function usesNativeAnthropicEndpoint(provider: OcxProviderConfig): boolean {
   try {
     return new URL(provider.baseUrl).hostname === "api.anthropic.com";
   } catch {
-    return false;
+    throw new Error(`anthropic provider has malformed baseUrl: ${provider.baseUrl}`);
   }
 }
@@ -555,6 +555,13 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
     name: "anthropic",
     buildRequest(parsed: OcxParsedRequest) {
+      if (typeof provider.apiKey !== "string" || provider.apiKey.trim() === "") {
+        if (isOAuth) {
+          throw new Error("anthropic oauth token missing — run ocx login anthropic");
+        }
+        throw new Error("anthropic provider requires a non-empty apiKey (authMode: key)");
+      }
       const { system, messages } = messagesToAnthropicFormat(parsed, toolNames);
       // Anthropic rejects many-image requests (>20 images) carrying any image over
       // 2000px per side; see anthropic-image-guard.ts for the full limit policy.
@@ -618,6 +625,10 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
       const base = provider.baseUrl.replace(/\/v1\/?$/, "");
       const url = `${base}/v1/messages`;
+      const unresolvedPlaceholder = url.match(/\{[^}]*\}/)?.[0];
+      if (unresolvedPlaceholder) {
+        throw new Error(`anthropic baseUrl contains unresolved ${unresolvedPlaceholder}`);
+      }
       const headers: Record<string, string> = {
         "Content-Type": "application/json",
         "anthropic-version": "2023-06-01",
@@ -625,7 +636,7 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
         "User-Agent": "@anthropic-ai/sdk/0.74.0",
       };
       if (isOAuth) {
-        if (provider.apiKey) headers["Authorization"] = `Bearer ${provider.apiKey}`;
+        headers["Authorization"] = `Bearer ${provider.apiKey}`;
         headers["anthropic-beta"] = ANTHROPIC_OAUTH_BETA;
         // Match the real Claude Code CLI request fingerprint: a valid OAuth token with an empty
         // header set is a non-first-party signature. (cch billing-header signing is intentionally
@@ -633,7 +644,7 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
         Object.assign(headers, CLAUDE_CODE_HEADERS);
         headers["X-Claude-Code-Session-Id"] = claudeCodeSessionId(provider.apiKey);
         headers["x-client-request-id"] = crypto.randomUUID();
-      } else if (provider.apiKey) {
+      } else {
         headers["x-api-key"] = provider.apiKey;
       }
       if (provider.headers) Object.assign(headers, provider.headers);

package/src/adapters/azure.ts CHANGED Viewed

@@ -13,19 +13,24 @@ export function createAzureAdapter(provider: OcxProviderConfig): ProviderAdapter
     name: "azure-openai",
     async buildRequest(parsed: OcxParsedRequest) {
-      const request = await inner.buildRequest(parsed);
-      const headers = { ...request.headers };
-      if (provider.apiKey) {
-        headers["api-key"] = provider.apiKey;
-        delete headers["Authorization"];
+      if (provider.authMode === "forward") {
+        throw new Error("azure-openai does not support forward auth mode");
       }
-      let url = request.url;
-      if (!url.includes("/v1/")) {
-        const apiVersion = (provider.headers?.["api-version"]) ?? "2025-04-01-preview";
-        const separator = url.includes("?") ? "&" : "?";
-        url = `${url}${separator}api-version=${apiVersion}`;
+      if (typeof provider.apiKey !== "string" || provider.apiKey.trim() === "") {
+        throw new Error("azure-openai requires a non-empty apiKey");
       }
-      return { ...request, url, headers };
+      const request = await inner.buildRequest(parsed);
+      const unresolvedPlaceholder = request.url.match(/\{[^}]*\}/)?.[0] ?? request.url.match(/[{}]/)?.[0];
+      if (unresolvedPlaceholder) {
+        throw new Error(`azure-openai baseUrl contains unresolved ${unresolvedPlaceholder} — set your real resource URL`);
+      }
+      const headers = { ...request.headers };
+      headers["api-key"] = provider.apiKey;
+      delete headers["Authorization"];
+      // The inner adapter always targets Azure's v1 API here, which needs no api-version query.
+      return { ...request, headers };
     },
   };
 }

package/src/adapters/cursor/live-models.ts CHANGED Viewed

@@ -2,8 +2,8 @@
  * Live Cursor model discovery via the `GetUsableModels` RPC (HTTP/2 + Connect-unary protobuf).
  *
  * Returns the account's actually-usable model ids (the full effort-suffixed variants Cursor offers
- * for THIS plan), so the routed catalog reflects reality instead of a static superset. Returns null on
- * any failure (caller falls back to the static seed).
+ * for THIS plan), so the routed catalog reflects reality instead of a static superset. Failures are
+ * classified so callers can surface the reason before applying their existing degradation policy.
  *
  * Protocol notes (hard-won, see devlog 350.110):
  * - content-type `application/proto` + `connect-protocol-version: 1` (NOT `application/connect+proto`,
@@ -26,13 +26,17 @@ export interface CursorUsableModelsOptions {
   timeoutMs?: number;
 }
-export async function fetchCursorUsableModels(opts: CursorUsableModelsOptions): Promise<string[] | null> {
+export type CursorUsableModelsResult =
+  | { ok: true; models: string[] }
+  | { ok: false; error: "auth" | "http" | "timeout" | "decode" | "empty"; detail?: string };
+export async function fetchCursorUsableModels(opts: CursorUsableModelsOptions): Promise<CursorUsableModelsResult> {
   const baseUrl = (opts.baseUrl ?? "https://api2.cursor.sh").replace(/\/+$/, "");
   const timeoutMs = opts.timeoutMs ?? 8000;
-  return new Promise<string[] | null>(resolve => {
+  return new Promise<CursorUsableModelsResult>(resolve => {
     let settled = false;
-    const finish = (value: string[] | null): void => {
+    const finish = (value: CursorUsableModelsResult): void => {
       if (settled) return;
       settled = true;
       resolve(value);
@@ -42,32 +46,37 @@ export async function fetchCursorUsableModels(opts: CursorUsableModelsOptions):
     try {
       client = http2.connect(baseUrl);
     } catch {
-      return finish(null);
+      return finish({ ok: false, error: "http", detail: "HTTP/2 connection setup failed" });
     }
     const timer = setTimeout(() => {
+      finish({ ok: false, error: "timeout", detail: `No response within ${timeoutMs}ms` });
       client.destroy();
-      finish(null);
     }, timeoutMs);
-    const close = (value: string[] | null): void => {
+    const close = (value: CursorUsableModelsResult): void => {
       clearTimeout(timer);
       client.close();
       finish(value);
     };
-    client.on("error", () => close(null));
+    client.on("error", () => close({ ok: false, error: "http", detail: "HTTP/2 session failed" }));
-    const req = client.request({
-      ":method": "POST",
-      ":path": CURSOR_GET_USABLE_MODELS_PATH,
-      "content-type": "application/proto",
-      "connect-protocol-version": "1",
-      authorization: `Bearer ${opts.apiKey}`,
-      "x-ghost-mode": "true",
-      "x-cursor-client-version": opts.clientVersion ?? CURSOR_DISCOVERY_CLIENT_VERSION,
-      "x-cursor-client-type": "cli",
-      "x-session-id": crypto.randomUUID(),
-    });
+    let req: http2.ClientHttp2Stream;
+    try {
+      req = client.request({
+        ":method": "POST",
+        ":path": CURSOR_GET_USABLE_MODELS_PATH,
+        "content-type": "application/proto",
+        "connect-protocol-version": "1",
+        authorization: `Bearer ${opts.apiKey}`,
+        "x-ghost-mode": "true",
+        "x-cursor-client-version": opts.clientVersion ?? CURSOR_DISCOVERY_CLIENT_VERSION,
+        "x-cursor-client-type": "cli",
+        "x-session-id": crypto.randomUUID(),
+      });
+    } catch {
+      return close({ ok: false, error: "http", detail: "HTTP/2 request setup failed" });
+    }
     let status = 0;
     const chunks: Buffer[] = [];
@@ -75,9 +84,12 @@ export async function fetchCursorUsableModels(opts: CursorUsableModelsOptions):
       status = Number(headers[":status"] ?? 0);
     });
     req.on("data", (chunk: Buffer) => chunks.push(chunk));
-    req.on("error", () => close(null));
+    req.on("error", () => close({ ok: false, error: "http", detail: "HTTP/2 request failed" }));
     req.on("end", () => {
-      if (status !== 200) return close(null);
+      if (status === 401 || status === 403) {
+        return close({ ok: false, error: "auth", detail: `HTTP ${status}` });
+      }
+      if (status !== 200) return close({ ok: false, error: "http", detail: `HTTP ${status || "unknown"}` });
       try {
         const response = fromBinary(GetUsableModelsResponseSchema, new Uint8Array(Buffer.concat(chunks)));
         // Account filtering uses wire `model_id` values only. Aliases like `composer-2-5` must not
@@ -85,9 +97,9 @@ export async function fetchCursorUsableModels(opts: CursorUsableModelsOptions):
         const ids = (response.models ?? [])
           .map(model => (model as { modelId?: string }).modelId)
           .filter((id): id is string => typeof id === "string" && id.length > 0);
-        close(ids.length > 0 ? ids : null);
+        close(ids.length > 0 ? { ok: true, models: ids } : { ok: false, error: "empty" });
       } catch {
-        close(null);
+        close({ ok: false, error: "decode", detail: "Invalid GetUsableModels protobuf response" });
       }
     });

package/src/adapters/cursor/live-transport.ts CHANGED Viewed

@@ -19,8 +19,6 @@ import {
   ExaSearchRequestResponseSchema,
   ExaSearchRequestResponse_RejectedSchema,
   InteractionResponseSchema,
-  SetupVmEnvironmentResultSchema,
-  SetupVmEnvironmentSuccessSchema,
   SwitchModeRequestResponseSchema,
   SwitchModeRequestResponse_RejectedSchema,
   WebSearchRequestResponseSchema,
@@ -270,18 +268,9 @@ export function planInteractionQueryReply(query: InteractionQuery): { response:
     };
   }
   if (q.case === "setupVmEnvironmentArgs") {
-    return {
-      response: respond({
-        case: "setupVmEnvironmentResult",
-        value: create(SetupVmEnvironmentResultSchema, {
-          result: { case: "success", value: create(SetupVmEnvironmentSuccessSchema, {}) },
-        }),
-      }),
-      replyCase: "setupVmEnvironmentResult:success",
-    };
+    throw new Error("Cursor setupVmEnvironment is not supported by opencodex");
   }
-  // Unknown/future query case: an empty response still unblocks the matching id.
-  return { response: respond({ case: undefined, value: undefined } as InteractionResponse["result"]), replyCase: "empty" };
+  throw new Error(`Unsupported Cursor interaction query case: ${q.case ?? "unknown"}`);
 }
 /**
@@ -354,8 +343,8 @@ class LiveCursorTransport implements CursorTransport {
   /**
    * Connect MCP servers and compute the tool definitions advertised to the Cursor server.
    * MUST complete before the first `requestContextArgs` (the server only calls MCP tools it was
-   * told about), so `run()` awaits this before opening the stream. Best-effort: any failure
-   * leaves an empty tool list and MCP disabled for the stream, never blocking the conversation.
+   * told about), so `run()` awaits this before opening the stream. Preparation failures reject the
+   * turn instead of silently running with MCP disabled.
    */
   private prepareMcp(): Promise<void> {
     if (!this.mcpManager) return Promise.resolve();
@@ -370,8 +359,7 @@ class LiveCursorTransport implements CursorTransport {
             unsafeAllowNativeLocalExec: cursorUnsafeNativeLocalExecEnabled(this.input.provider),
           };
         } catch (err) {
-          console.warn(`[cursor-mcp] preparation failed, MCP disabled for this stream: ${err instanceof Error ? err.message : String(err)}`);
-          this.execContext = { ...this.desktopDeps, unsafeAllowNativeLocalExec: cursorUnsafeNativeLocalExecEnabled(this.input.provider) };
+          throw new Error(`Cursor MCP preparation failed: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
         }
       })();
     }

package/src/adapters/cursor/native-exec.ts CHANGED Viewed

@@ -1,8 +1,8 @@
 import { createHash } from "node:crypto";
 import { create } from "@bufbuild/protobuf";
 import {
+  DiagnosticsErrorSchema,
   DiagnosticsResultSchema,
-  DiagnosticsSuccessSchema,
   GetBlobResultSchema,
   KvClientMessageSchema,
   McpErrorSchema,
@@ -63,14 +63,12 @@ export interface CursorNativeExecContext extends CursorNativeExecDeps {
   clientToolDefs?: McpToolDefinition[];
   /** Unsafe opt-in escape hatch for Cursor server-driven local fs/shell/fetch execution. */
   unsafeAllowNativeLocalExec?: boolean;
-  /** @deprecated Use unsafeAllowNativeLocalExec. Kept as a transition alias for local experiments. */
-  allowNativeLocalExec?: boolean;
   /** apply_patch is visible for this request; Cursor-native write/delete must not bypass Codex. */
   rejectNativeFileMutations?: boolean;
 }
-export function cursorUnsafeNativeLocalExecEnabled(input: Pick<CursorNativeExecContext, "unsafeAllowNativeLocalExec" | "allowNativeLocalExec"> = {}): boolean {
-  return input.unsafeAllowNativeLocalExec === true || input.allowNativeLocalExec === true;
+export function cursorUnsafeNativeLocalExecEnabled(input: Pick<CursorNativeExecContext, "unsafeAllowNativeLocalExec"> = {}): boolean {
+  return input.unsafeAllowNativeLocalExec === true;
 }
 /**
@@ -183,10 +181,16 @@ export async function handleCursorNativeExec(execMsg: ExecServerMessage, deps: C
   if (execCase === "diagnosticsArgs") {
     const path = execMsg.message.value.path;
     return [execBytes(execMsg, "diagnosticsResult", create(DiagnosticsResultSchema, {
-      result: { case: "success", value: create(DiagnosticsSuccessSchema, { path, diagnostics: [], totalDiagnostics: 0 }) },
+      result: {
+        case: "error",
+        value: create(DiagnosticsErrorSchema, {
+          path,
+          error: "Diagnostics are not supported by the opencodex Cursor transport.",
+        }),
+      },
     }))];
   }
-  return [];
+  throw new Error(`Unsupported Cursor native exec case: ${execCase ?? "unknown"}`);
 }

package/src/adapters/cursor/transport-retry.ts CHANGED Viewed

@@ -68,8 +68,7 @@ export async function runCursorTurnWithRetry(
   signal: AbortSignal | undefined,
   onEvent: (message: CursorServerMessage, transport: CursorTransport) => void,
 ): Promise<void> {
-  let lastError: unknown;
-  for (let attempt = 0; attempt < CURSOR_RETRY_ATTEMPTS; attempt++) {
+  for (let attempt = 0; ; attempt++) {
     if (signal?.aborted) throw abortError(signal);
     const transport = makeTransport(input);
     let emittedAny = false;
@@ -80,7 +79,6 @@ export async function runCursorTurnWithRetry(
       }
       return;
     } catch (err) {
-      lastError = err;
       const canRetry =
         !emittedAny &&
         attempt < CURSOR_RETRY_ATTEMPTS - 1 &&
@@ -108,7 +106,6 @@ export async function runCursorTurnWithRetry(
       await transport.close?.();
     }
   }
-  throw lastError ?? new Error("Cursor transport failed");
 }
 export type { CursorTransportFactory };

package/src/adapters/google.ts CHANGED Viewed

@@ -231,7 +231,10 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       if (provider.googleMode === "cloud-code-assist") {
         // Google Antigravity (Cloud Code Assist): wrap the flat Gemini body in the CCA envelope.
-        const base = provider.baseUrl || "https://daily-cloudcode-pa.googleapis.com";
+        const token = provider.apiKey?.trim();
+        if (!token) throw new Error("google-antigravity oauth token missing — run ocx login google-antigravity");
+        const base = provider.baseUrl?.trim();
+        if (!base) throw new Error("google-antigravity requires a non-empty baseUrl");
         const url = `${base}/v1internal:${method}${streamParam}`;
         const project = provider.project;
         if (!project) throw new Error("Antigravity requires a discovered Cloud Code Assist project id (re-run `ocx login google-antigravity`).");
@@ -271,7 +274,7 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
           request,
         };
         headers["User-Agent"] = ANTIGRAVITY_REQUEST_UA;
-        if (provider.apiKey) headers["Authorization"] = `Bearer ${provider.apiKey}`;
+        headers["Authorization"] = `Bearer ${token}`;
         return { url, method: "POST", headers, body: JSON.stringify(envelope) };
       }
@@ -296,7 +299,9 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       // ai-studio (default): Generative Language API + x-goog-api-key.
       const url = `${provider.baseUrl}/v1beta/models/${parsed.modelId}:${method}${streamParam}`;
-      if (provider.apiKey) headers["x-goog-api-key"] = provider.apiKey;
+      const apiKey = provider.apiKey?.trim();
+      if (!apiKey) throw new Error("google (AI Studio) requires a non-empty API key");
+      headers["x-goog-api-key"] = apiKey;
       return { url, method: "POST", headers, body: JSON.stringify(body) };
     },
@@ -345,9 +350,15 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
             }
             // Antigravity (CCA) nests the standard Gemini payload under `response`.
-            const root = (provider.googleMode === "cloud-code-assist"
-              ? (chunk.response as Record<string, unknown> | undefined) ?? chunk
-              : chunk);
+            let root = chunk;
+            if (provider.googleMode === "cloud-code-assist") {
+              const wrapped = chunk.response;
+              if (!wrapped || typeof wrapped !== "object" || Array.isArray(wrapped)) {
+                yield { type: "error", message: "google-antigravity response missing response wrapper" };
+                return;
+              }
+              root = wrapped as Record<string, unknown>;
+            }
             // usageMetadata is a top-level field independent of candidates; read it BEFORE the
             // candidates guard so a usage-only final chunk is not dropped.
             const usageMeta = root.usageMetadata as Record<string, number> | undefined;
@@ -397,13 +408,25 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
     async parseResponse(response: Response): Promise<AdapterEvent[]> {
       const raw = await response.json() as Record<string, unknown>;
+      if (raw.error) {
+        const err = raw.error as { message?: string };
+        return [{ type: "error", message: err.message ?? "upstream error" }];
+      }
       // Antigravity (CCA) nests the standard Gemini payload under `response`; unwrap it.
-      const json = (provider.googleMode === "cloud-code-assist"
-        ? (raw.response as Record<string, unknown> | undefined) ?? raw
-        : raw);
+      let json = raw;
+      if (provider.googleMode === "cloud-code-assist") {
+        const wrapped = raw.response;
+        if (!wrapped || typeof wrapped !== "object" || Array.isArray(wrapped)) {
+          return [{ type: "error", message: "google-antigravity response missing response wrapper" }];
+        }
+        json = wrapped as Record<string, unknown>;
+      }
       const events: AdapterEvent[] = [];
       const candidates = json.candidates as { content?: { parts?: { text?: string; functionCall?: { name: string; args: unknown } }[] }; finishReason?: string }[] | undefined;
+      if (!candidates?.length) {
+        return [{ type: "error", message: "google response contained no candidates" }];
+      }
       let toolCallsStarted = 0;
       if (candidates?.[0]?.content?.parts) {
         // Non-streaming CCA: observe thoughtSignatures for the next turn, same as the stream path.

package/src/adapters/kiro-retry.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 import type { AdapterFetchContext, AdapterRequest } from "./base";
 import { safeKiroHttpErrorMessage } from "./kiro-errors";
-import { abortError, sleepWithAbort } from "../lib/upstream-retry";
+import { abortError, isConnectionResetError, sleepWithAbort } from "../lib/upstream-retry";
 const KIRO_RETRY_ATTEMPTS = 3;
 const KIRO_RETRY_BASE_MS = 250;
@@ -32,6 +32,10 @@ function signalWithAttemptTimeout(parent: AbortSignal | undefined, timeoutMs: nu
   return parent ? AbortSignal.any([parent, timeout]) : timeout;
 }
+function retryableKiroFetchError(err: unknown): boolean {
+  return isConnectionResetError(err) || (err instanceof Error && err.name === "TimeoutError");
+}
 async function normalizeFinalKiroHttpError(res: Response): Promise<Response> {
   if (res.ok) return res;
   const payloadText = await res.clone().text().catch(() => "");
@@ -62,8 +66,8 @@ export async function fetchKiroWithRetry(request: AdapterRequest, ctx: AdapterFe
       await sleepWithAbort(retryDelayMs(attempt, res.headers), ctx.abortSignal);
     } catch (err) {
       if (ctx.abortSignal?.aborted) throw err;
+      if (!retryableKiroFetchError(err) || attempt === KIRO_RETRY_ATTEMPTS - 1) throw err;
       lastError = err;
-      if (attempt === KIRO_RETRY_ATTEMPTS - 1) throw err;
       await sleepWithAbort(retryDelayMs(attempt), ctx.abortSignal);
     }
   }

package/src/adapters/kiro.ts CHANGED Viewed

@@ -445,15 +445,17 @@ export async function* parseKiroStream(
           break;
         }
         case "tool_stop": {
-          if (open) {
-            const input = open.chunks.join("");
-            if (!isCompleteKiroToolInput(input)) {
-              open = null;
-              yield { type: "error", message: kiroTruncationErrorMessage("incomplete tool input JSON") };
-              return;
-            }
-            yield* flushTool();
+          if (!open) {
+            yield { type: "error", message: "Kiro response protocol error: tool stop received without an open tool call" };
+            return;
           }
+          const input = open.chunks.join("");
+          if (!isCompleteKiroToolInput(input)) {
+            open = null;
+            yield { type: "error", message: kiroTruncationErrorMessage("incomplete tool input JSON") };
+            return;
+          }
+          yield* flushTool();
           break;
         }
         case "truncation":
@@ -496,11 +498,14 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
   return {
     name: "kiro",
     buildRequest(parsed: OcxParsedRequest) {
+      if (typeof provider.apiKey !== "string" || provider.apiKey.trim() === "") {
+        throw new Error("kiro token missing — run ocx login kiro");
+      }
       const region = resolveKiroApiRegion();
       const profileArn = resolveKiroProfileArn();
       const fp = fingerprint().slice(0, 64);
       const headers: Record<string, string> = {
-        authorization: `Bearer ${provider.apiKey ?? ""}`,
+        authorization: `Bearer ${provider.apiKey}`,
         "content-type": "application/x-amz-json-1.0",
         accept: "application/vnd.amazon.eventstream",
         "x-amz-target": AMZ_TARGET,

package/src/adapters/openai-chat.ts CHANGED Viewed

@@ -1,5 +1,4 @@
 import type { ProviderAdapter } from "./base";
-import { debugDroppedFrame } from "../lib/debug";
 import type { AdapterEvent, OcxAssistantMessage, OcxContentPart, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxTextContent, OcxThinkingContent, OcxToolCall, OcxUsage } from "../types";
 import { isAllowedToolChoice, modelInList, namespacedToolName, resolveToolChoiceWireName, toolAllowedByChoice } from "../types";
 import { mapReasoningEffort } from "../reasoning-effort";
@@ -7,11 +6,9 @@ import { contentPartsToText } from "./image";
 import { neutralizeIdentity } from "./identity";
 import { buildNonOpenAIToolCatalogNudgeForTools, shouldInjectNonOpenAIToolCatalogNudge } from "./tool-catalog-nudge";
-// Z.AI's "glm-5.2[1m]" 1M-context id is a Claude-Code / Anthropic-endpoint-only
-// convention; OpenAI-compatible chat-completions endpoints reject the bracketed
-// suffix (Z.AI 400 code 1211 "Unknown Model"). Strip a single trailing "[...]"
-// group from the wire model id so the bare id is sent. Applies to the
-// openai-chat path only — the anthropic adapter keeps the suffix verbatim.
+// Providers may opt into stripping one trailing "[...]" group from the wire model id.
+// Z.AI needs this because its OpenAI path rejects glm-5.2[1m] with 400 code 1211;
+// unflagged OpenAI-compatible providers and the Anthropic adapter keep ids verbatim.
 export function stripBracketedModelSuffix(modelId: string): string {
   return modelId.replace(/\[[^\]]*\]\s*$/, "");
 }
@@ -125,7 +122,7 @@ function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProviderCon
 function safeToolName(name: string | undefined): string {
   const raw = name && name.trim().length > 0 ? name : "tool_result";
   const sanitized = raw.replace(/[^A-Za-z0-9_-]/g, "_");
-  return sanitized.length > 0 ? sanitized : "tool_result";
+  return sanitized;
 }
 function toolsToChatFormat(parsed: OcxParsedRequest): unknown[] | undefined {
@@ -187,12 +184,17 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
     name: "openai-chat",
     buildRequest(parsed: OcxParsedRequest) {
+      const hasCredential = typeof provider.apiKey === "string" && provider.apiKey.trim().length > 0;
+      if ((provider.authMode === "key" || provider.authMode === "oauth") && !provider.keyOptional && !hasCredential) {
+        throw new Error(`${provider.adapter} requires a non-empty credential (authMode: ${provider.authMode})`);
+      }
       const messages = messagesToChatFormat(parsed, provider);
       const tools = toolsToChatFormat(parsed);
       const toolChoice = toolChoiceToChatFormat(parsed.options.toolChoice, parsed.context.tools);
       const body: Record<string, unknown> = {
-        model: stripBracketedModelSuffix(parsed.modelId),
+        model: provider.modelSuffixBracketStrip ? stripBracketedModelSuffix(parsed.modelId) : parsed.modelId,
         messages,
         stream: parsed.stream,
       };
@@ -247,7 +249,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
       const url = `${provider.baseUrl}/chat/completions`;
       const headers: Record<string, string> = { "Content-Type": "application/json" };
-      if (provider.apiKey) headers["Authorization"] = `Bearer ${provider.apiKey}`;
+      if (hasCredential) headers["Authorization"] = `Bearer ${provider.apiKey}`;
       if (provider.headers) Object.assign(headers, provider.headers);
       return { url, method: "POST", headers, body: JSON.stringify(body) };
@@ -306,8 +308,8 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         try {
           chunk = JSON.parse(payload) as Record<string, unknown>;
         } catch {
-          debugDroppedFrame("openai-chat", payload);
-          return "continue";
+          yield { type: "error", message: "malformed upstream SSE data frame" };
+          return "terminate";
         }
         // A 200/OK chat-completions stream may carry an inline provider error envelope
@@ -416,25 +418,33 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
     async parseResponse(response: Response): Promise<AdapterEvent[]> {
       const json = await response.json() as Record<string, unknown>;
+      if (json.error) {
+        const upstreamError = json.error as { message?: unknown };
+        return [{
+          type: "error",
+          message: typeof upstreamError.message === "string" ? upstreamError.message : "upstream error",
+        }];
+      }
       const events: AdapterEvent[] = [];
       const choices = json.choices as { message?: Record<string, unknown> }[] | undefined;
-      if (choices && choices.length > 0) {
-        const msg = choices[0].message;
-        if (msg) {
-          if (typeof msg.content === "string") {
-            events.push({ type: "text_delta", text: msg.content });
-          }
-          if (typeof msg.reasoning_content === "string" && msg.reasoning_content.length > 0) {
-            events.push({ type: "reasoning_raw_delta", text: msg.reasoning_content });
-          }
-          const toolCalls = msg.tool_calls as { id: string; function: { name: string; arguments: string } }[] | undefined;
-          if (toolCalls) {
-            for (const tc of toolCalls) {
-              events.push({ type: "tool_call_start", id: tc.id, name: tc.function.name });
-              events.push({ type: "tool_call_delta", arguments: tc.function.arguments });
-              events.push({ type: "tool_call_end" });
-            }
-          }
+      if (!Array.isArray(choices) || choices.length === 0 || !choices[0].message) {
+        return [{ type: "error", message: "upstream response contained no choices" }];
+      }
+      const msg = choices[0].message;
+      if (typeof msg.content === "string") {
+        events.push({ type: "text_delta", text: msg.content });
+      }
+      if (typeof msg.reasoning_content === "string" && msg.reasoning_content.length > 0) {
+        events.push({ type: "reasoning_raw_delta", text: msg.reasoning_content });
+      }
+      const toolCalls = msg.tool_calls as { id: string; function: { name: string; arguments: string } }[] | undefined;
+      if (toolCalls) {
+        for (const tc of toolCalls) {
+          events.push({ type: "tool_call_start", id: tc.id, name: tc.function.name });
+          events.push({ type: "tool_call_delta", arguments: tc.function.arguments });
+          events.push({ type: "tool_call_end" });
         }
       }
       const usage = json.usage as Record<string, unknown> | undefined;