@bitkyc08/opencodex 2.7.33 → 2.7.34

package/src/combos/request.ts

@@ -1,5 +1,5 @@
-import type { OcxComboDefaultEffort, OcxComboTarget } from "../types";
-import { parseComboModelId } from "./types";
+import type { OcxComboDefaultEffort, OcxComboTarget, OcxConfig } from "../types";
+import { resolveComboId } from "./types";
 
 const warnedUnsupportedDefaults = new Set<string>();
 
@@ -7,11 +7,11 @@ export function resetComboEffortWarningStateForTests(): void {
   warnedUnsupportedDefaults.clear();
 }
 
-export function comboIdFromRawBody(body: unknown): string | null {
+export function comboIdFromRawBody(body: unknown, config: OcxConfig): string | null {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
   const model = (body as { model?: unknown }).model;
   if (typeof model !== "string") return null;
-  return parseComboModelId(model);
+  return resolveComboId(config, model);
 }
 
 export function concreteComboRequestBody(

package/src/combos/resolve.ts

@@ -1,6 +1,6 @@
 import type { OcxComboTarget, OcxConfig } from "../types";
 import { coolComboTarget, isComboTargetInCooldown } from "./failover";
-import { getCombo, parseComboModelId, targetKey } from "./types";
+import { getCombo, resolveComboId, targetKey } from "./types";
 import type { NormalizedComboConfig } from "./types";
 
 export interface ComboPick {
@@ -162,7 +162,7 @@ export function clearComboSelectionState(comboId?: string): void {
 }
 
 export function tryPickComboModel(config: OcxConfig, modelId: string): ComboPick | null {
-  const comboId = parseComboModelId(modelId);
+  const comboId = resolveComboId(config, modelId);
   if (!comboId) return null;
   if (!getCombo(config, comboId)) throw new UnknownComboError(comboId);
   const picked = pickComboTarget(config, comboId);

package/src/combos/types.ts

@@ -9,6 +9,18 @@ import type {
 
 export const COMBO_NAMESPACE = "combo";
 const COMBO_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+/**
+ * Public alias shape: one optional "/" segment, each segment id-shaped. Bare aliases
+ * (no "/") are the masquerade case — the combo answers to a mandated model id with no
+ * `combo/` prefix. Codex-facing slugs tolerate at most one "/", so deeper paths reject.
+ */
+const COMBO_ALIAS_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}(?:\/[A-Za-z0-9][A-Za-z0-9._-]{0,63})?$/;
+/**
+ * Bare aliases in the OpenAI native family (gpt-*, o1-*, o3-*, o4-*, codex-*) are
+ * rejected: they collide with native catalog rows and the canonical-OpenAI routing
+ * branch, which cannot be shadowed honestly.
+ */
+const NATIVE_OPENAI_FAMILY_PATTERN = /^(?:gpt-|o1-|o3-|o4-|codex-)/;
 
 export interface ComboValidationIssue {
   path: Array<string | number>;
@@ -19,6 +31,8 @@ export interface NormalizedComboConfig {
   strategy: OcxComboStrategy;
   stickyLimit: number;
   defaultEffort: OcxComboDefaultEffort | null;
+  /** Trimmed public alias, or null when the combo keeps the default `combo/<id>` slug. */
+  alias: string | null;
   targets: Array<Required<OcxComboTarget>>;
 }
 
@@ -37,11 +51,88 @@ export function comboModelId(id: string): string {
   return `${COMBO_NAMESPACE}/${id}`;
 }
 
+/** Public model id clients request: the alias when set, else the default `combo/<id>`. */
+export function comboPublicModelId(id: string, combo: { alias?: string | null }): string {
+  const alias = typeof combo.alias === "string" ? combo.alias.trim() : "";
+  return alias || comboModelId(id);
+}
+
+/**
+ * Resolve a client-requested model id to a combo config key. The canonical `combo/<id>`
+ * form wins first (back-compat); otherwise an exact alias match across configured combos.
+ */
+export function resolveComboId(
+  config: { combos?: Record<string, OcxComboConfig> },
+  modelId: string,
+): string | null {
+  const direct = parseComboModelId(modelId);
+  if (direct) return direct;
+  const combos = config.combos;
+  if (!combos) return null;
+  for (const [id, raw] of Object.entries(combos)) {
+    if (!raw || typeof raw !== "object") continue;
+    const alias = typeof raw.alias === "string" ? raw.alias.trim() : "";
+    if (alias && alias === modelId) return id;
+  }
+  return null;
+}
+
+/**
+ * Cross-combo alias checks that need the full combos map (uniqueness). Kept separate
+ * from `comboConfigIssues` so config-file validation and the management API share it.
+ */
+export function comboAliasIssues(
+  id: string,
+  alias: string,
+  combos: Record<string, OcxComboConfig> | undefined,
+  options: { excludeComboId?: string } = {},
+): ComboValidationIssue[] {
+  const issues: ComboValidationIssue[] = [];
+  if (!COMBO_ALIAS_PATTERN.test(alias)) {
+    issues.push({
+      path: ["alias"],
+      message: "alias must use letters, numbers, dot, underscore, or hyphen, with at most one \"/\" segment",
+    });
+    return issues;
+  }
+  if (alias === COMBO_NAMESPACE || alias.startsWith(`${COMBO_NAMESPACE}/`)) {
+    issues.push({
+      path: ["alias"],
+      message: `alias must not use the reserved "${COMBO_NAMESPACE}/" namespace`,
+    });
+  }
+  if (!alias.includes("/") && NATIVE_OPENAI_FAMILY_PATTERN.test(alias)) {
+    issues.push({
+      path: ["alias"],
+      message: "bare aliases in the OpenAI native family (gpt-*, o1-*, o3-*, o4-*, codex-*) are not allowed",
+    });
+  }
+  for (const [otherId, other] of Object.entries(combos ?? {})) {
+    if (otherId === id || otherId === options.excludeComboId) continue;
+    const otherAlias = typeof other?.alias === "string" ? other.alias.trim() : "";
+    if (otherAlias && otherAlias === alias) {
+      issues.push({
+        path: ["alias"],
+        message: `alias "${alias}" is already used by combo "${otherId}"`,
+      });
+    }
+  }
+  return issues;
+}
+
+export interface ComboValidationOptions {
+  requireEnabledTarget?: boolean;
+  /** Full combos map for alias uniqueness checks; omitted during early config load. */
+  combos?: Record<string, OcxComboConfig>;
+  /** Combo being renamed — its stored alias is excluded from uniqueness checks. */
+  excludeComboId?: string;
+}
+
 export function comboConfigIssues(
   id: string,
   raw: unknown,
   providers: Record<string, OcxProviderConfig>,
-  options: { requireEnabledTarget?: boolean } = {},
+  options: ComboValidationOptions = {},
 ): ComboValidationIssue[] {
   const issues: ComboValidationIssue[] = [];
   if (!isValidComboId(id)) {
@@ -88,6 +179,15 @@ export function comboConfigIssues(
     });
   }
 
+  if (body.alias !== undefined) {
+    if (typeof body.alias !== "string") {
+      issues.push({ path: ["alias"], message: "alias must be a string" });
+    } else {
+      const alias = body.alias.trim();
+      if (alias) issues.push(...comboAliasIssues(id, alias, options.combos, options));
+    }
+  }
+
   if (!Array.isArray(body.targets) || body.targets.length === 0) {
     issues.push({ path: ["targets"], message: "targets must be a non-empty array" });
     return issues;
@@ -155,16 +255,18 @@ export function comboConfigError(
   id: string,
   raw: unknown,
   providers: Record<string, OcxProviderConfig>,
-  options: { requireEnabledTarget?: boolean } = {},
+  options: ComboValidationOptions = {},
 ): string | null {
   return comboConfigIssues(id, raw, providers, options)[0]?.message ?? null;
 }
 
 export function normalizeComboConfig(raw: OcxComboConfig): NormalizedComboConfig {
+  const alias = typeof raw.alias === "string" ? raw.alias.trim() : "";
   return {
     strategy: raw.strategy ?? "failover",
     stickyLimit: raw.stickyLimit ?? 1,
     defaultEffort: raw.defaultEffort ?? null,
+    alias: alias || null,
     targets: raw.targets.map(target => ({
       provider: target.provider.trim(),
       model: target.model.trim(),

package/src/config.ts

@@ -329,8 +329,14 @@ const warnedConfigFallbacks = new Set<string>();
 const providerConfigSchema = z.object({
   adapter: z.string().min(1),
   baseUrl: z.string().min(1),
+  responsesPath: z.string().min(1).optional(),
   allowPrivateNetwork: z.boolean().optional(),
   codexAccountMode: z.enum(["pool", "direct"]).optional(),
+  responsesItemIdRepair: z.object({
+    message: z.array(z.string().min(1)).optional(),
+    reasoning: z.array(z.string().min(1)).optional(),
+    repairMissingTerminalIds: z.boolean().optional(),
+  }).strict().optional(),
 }).passthrough();
 
 const RESERVED_PROVIDER_NAMES = new Set(["__proto__", "prototype", "constructor"]);
@@ -369,6 +375,18 @@ export function providerBaseUrlConfigError(baseUrl: string): string | null {
   return null;
 }
 
+function providerResponsesPathConfigError(responsesPath: string | undefined): string | null {
+  if (responsesPath === undefined) return null;
+  if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(responsesPath) || responsesPath.includes("://")) {
+    return "responsesPath must be a relative path without a URL scheme";
+  }
+  if (!responsesPath.startsWith("/")) return "responsesPath must start with /";
+  if (responsesPath.includes("?") || responsesPath.includes("#")) {
+    return "responsesPath must not include query strings or fragments";
+  }
+  return null;
+}
+
 export function providerHeadersConfigError(headers: unknown): string | null {
   if (headers === undefined) return null;
   if (!headers || typeof headers !== "object" || Array.isArray(headers)) return "headers must be an object";
@@ -396,6 +414,14 @@ export function positiveIntegerRecordConfigError(value: unknown, field: string):
   return null;
 }
 
+export function positiveIntegerConfigError(value: unknown, field: string): string | null {
+  if (value === undefined) return null;
+  if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value <= 0) {
+    return `${field} must be a positive finite integer`;
+  }
+  return null;
+}
+
 const configSchema = z.object({
   port: z.number().int().min(0).max(65535).default(10100),
   providers: z.record(z.string(), providerConfigSchema),
@@ -403,6 +429,7 @@ const configSchema = z.object({
   openaiProviderTierVersion: z.union([z.literal(1), z.literal(2)]).optional(),
   providerContextCaps: z.record(z.string(), z.number().int().positive()).optional(),
   contextCapValue: z.number().int().positive().optional(),
+  multiAgentGuidanceEnabled: z.boolean().optional(),
 }).passthrough().superRefine((config, ctx) => {
   for (const name of Object.keys(config.providers)) {
     if (!isValidProviderName(name)) {
@@ -451,6 +478,14 @@ const configSchema = z.object({
         });
       }
     }
+    const responsesPathError = providerResponsesPathConfigError(provider.responsesPath);
+    if (responsesPathError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", name, "responsesPath"],
+        message: responsesPathError,
+      });
+    }
     const headersError = providerHeadersConfigError((provider as { headers?: unknown }).headers);
     if (headersError) {
       ctx.addIssue({
@@ -470,6 +505,28 @@ const configSchema = z.object({
         message: maxInputError,
       });
     }
+    const defaultMaxOutputError = positiveIntegerConfigError(
+      (provider as { defaultMaxOutputTokens?: unknown }).defaultMaxOutputTokens,
+      "defaultMaxOutputTokens",
+    );
+    if (defaultMaxOutputError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", name, "defaultMaxOutputTokens"],
+        message: defaultMaxOutputError,
+      });
+    }
+    const maxOutputError = positiveIntegerRecordConfigError(
+      (provider as { modelMaxOutputTokens?: unknown }).modelMaxOutputTokens,
+      "modelMaxOutputTokens",
+    );
+    if (maxOutputError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", name, "modelMaxOutputTokens"],
+        message: maxOutputError,
+      });
+    }
     if (Object.hasOwn(provider, "codexAccountMode") && provider.codexAccountMode !== undefined) {
       // Persisted account mode is valid ONLY on the canonical built-in `openai` forward provider.
       // Old openai-multi rows stay parseable (they never carry a mode) so startup can migrate them.
@@ -500,7 +557,12 @@ const configSchema = z.object({
       ctx.addIssue({ code: "custom", path: ["combos"], message: "combos must be an object" });
     } else {
       for (const [id, raw] of Object.entries(combos as Record<string, unknown>)) {
-        for (const issue of comboConfigIssues(id, raw, config.providers)) {
+        // Pass the full map so cross-combo rules (alias uniqueness) apply at load time
+        // too, not just via the management API; each combo is excluded from its own check.
+        for (const issue of comboConfigIssues(id, raw, config.providers, {
+          combos: combos as Record<string, import("./types").OcxComboConfig>,
+          excludeComboId: id,
+        })) {
           ctx.addIssue({
             code: "custom",
             path: ["combos", id, ...issue.path],
@@ -688,6 +750,12 @@ export function codexAutoStartEnabled(config: Pick<OcxConfig, "codexAutoStart">)
   return config.codexAutoStart !== false;
 }
 
+export function multiAgentGuidanceEnabled(
+  config: Pick<OcxConfig, "multiAgentGuidanceEnabled">,
+): boolean {
+  return config.multiAgentGuidanceEnabled !== false;
+}
+
 export function getDefaultConfig(): OcxConfig {
   // Fresh-install default: works out of the box with Codex's ChatGPT OAuth (no API key).
   // gpt-* requests forward the caller's incoming OAuth headers to the ChatGPT backend.
@@ -708,6 +776,7 @@ export function getDefaultConfig(): OcxConfig {
     },
     defaultProvider: "openai",
     subagentModels: [...DEFAULT_SUBAGENT_MODELS],
+    multiAgentGuidanceEnabled: true,
     websockets: false,
     codexAutoStart: true,
   };

package/src/lib/eventstream-decoder.ts

@@ -24,6 +24,7 @@ const MESSAGE_CRC_LEN = 4;
 const HEADER_BLOCK_OFFSET = PRELUDE_LEN + PRELUDE_CRC_LEN;
 const MIN_MESSAGE_LEN = HEADER_BLOCK_OFFSET + MESSAGE_CRC_LEN;
 const MAX_MESSAGE_LEN = 16 * 1024 * 1024;
+const MAX_HEADERS_LEN = 128 * 1024;
 
 export interface EventStreamMessage {
 	/** Header casing is preserved verbatim (e.g. `:event-type`, `:message-type`). */
@@ -62,6 +63,7 @@ export function decodeMessage(frame: Uint8Array): EventStreamMessage {
 	const preludeCrc = view.getUint32(8, false);
 	const computedPreludeCrc = crc32(frame.subarray(0, PRELUDE_LEN));
 	if (computedPreludeCrc !== preludeCrc) throw new Error("eventstream: prelude CRC mismatch");
+	if (headersLen > MAX_HEADERS_LEN) throw new Error(`eventstream: headers length ${headersLen} exceeds maximum`);
 	if (headersLen > total - MIN_MESSAGE_LEN) throw new Error("eventstream: headers length exceeds frame payload");
 	const msgCrc = view.getUint32(total - MESSAGE_CRC_LEN, false);
 	const computedMsgCrc = crc32(frame.subarray(0, total - MESSAGE_CRC_LEN));
@@ -185,6 +187,13 @@ export async function* decodeEventStream(source: ReadableStream<Uint8Array>): As
 				const total = dv.getUint32(0, false);
 				if (total < MIN_MESSAGE_LEN) throw new Error(`eventstream: total length ${total} below minimum`);
 				if (total > MAX_MESSAGE_LEN) throw new Error(`eventstream: total length ${total} exceeds maximum`);
+				if (buf.length - offset >= HEADER_BLOCK_OFFSET) {
+					const headersLen = dv.getUint32(4, false);
+					const preludeCrc = dv.getUint32(8, false);
+					const computedPreludeCrc = crc32(buf.subarray(offset, offset + PRELUDE_LEN));
+					if (computedPreludeCrc !== preludeCrc) throw new Error("eventstream: prelude CRC mismatch");
+					if (headersLen > MAX_HEADERS_LEN) throw new Error(`eventstream: headers length ${headersLen} exceeds maximum`);
+				}
 				if (buf.length - offset < total) break;
 				const frame = buf.subarray(offset, offset + total);
 				yield decodeMessage(frame);

package/src/oauth/index.ts

@@ -219,7 +219,7 @@ export async function getValidAccessTokenSnapshot(provider: string): Promise<OAu
 }
 
 /** Providers whose upstream-401 replay path may force a snapshot refresh. */
-const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot"]);
+const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot", "kiro"]);
 
 export async function forceRefreshOAuthAccessSnapshot(
   rejected: OAuthAccessSnapshot,
@@ -478,6 +478,8 @@ const OAUTH_RECONCILE_FIELDS: (keyof OcxProviderConfig)[] = [
   "models",
   "contextWindow",
   "modelContextWindows",
+  "defaultMaxOutputTokens",
+  "modelMaxOutputTokens",
   "modelInputModalities",
   "noReasoningModels",
   "noVisionModels",

package/src/oauth/kiro-credentials.ts

@@ -6,8 +6,17 @@ import { Database } from "bun:sqlite";
 const DEFAULT_EXPIRES_MS = 3600_000;
 const KIRO_REGION_PATTERN = /^[a-z]{2}(?:-[a-z]+)+-\d$/;
 const CLIENT_ID_HASH_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
-const TOKEN_KEYS = ["kirocli:social:token", "kirocli:odic:token", "codewhisperer:odic:token"];
-const REGISTRATION_KEYS = ["kirocli:odic:device-registration", "codewhisperer:odic:device-registration"];
+const TOKEN_KEYS = [
+  "kirocli:odic:token",
+  "kirocli:oidc:token",
+  "kirocli:social:token",
+  "codewhisperer:odic:token",
+];
+const REGISTRATION_KEYS = [
+  "kirocli:odic:device-registration",
+  "kirocli:oidc:device-registration",
+  "codewhisperer:odic:device-registration",
+];
 
 export type KiroAuthType = "kiro_desktop" | "aws_sso_oidc";
 export type KiroCredentialSource = "json" | "sqlite";
@@ -17,6 +26,8 @@ export type KiroDiagnosticStatus =
   | "schema_mismatch"
   | "invalid_json"
   | "token_missing"
+  | "token_ambiguous"
+  | "token_key_missing"
   | "token_found"
   | "registration_found";
 
@@ -99,15 +110,27 @@ function jsonCredentialPaths(): string[] {
 
 function sqliteEntries(): Array<{ location: KiroImportDiagnostic["location"]; path: string }> {
   const home = userHome();
-  const entries: Array<{ location: KiroImportDiagnostic["location"]; path: string }> = [];
-  if (process.env.KIRO_CLI_DB_FILE) entries.push({ location: "kiro-cli-db-env", path: expandPath(process.env.KIRO_CLI_DB_FILE) });
-  entries.push(
+  const configured = process.env.KIROCLI_DB_PATH?.trim() || process.env.KIRO_CLI_DB_FILE?.trim();
+  if (configured) return [{ location: "kiro-cli-db-env", path: expandPath(configured) }];
+  return [
     { location: "kiro-cli-data", path: join(home, "Library", "Application Support", "kiro-cli", "data.sqlite3") },
     { location: "kiro-cli-linux-data", path: join(home, ".local", "share", "kiro-cli", "data.sqlite3") },
     { location: "amazon-q-data", path: join(home, ".local", "share", "amazon-q", "data.sqlite3") },
     { location: "kiro-sso-cache", path: join(home, ".kiro", "sso", "cache.db") },
-  );
-  return entries;
+  ];
+}
+
+function selectTokenRow(db: Database): { value: string } | null | "ambiguous" | "selected_missing" {
+  const rows = db.query("SELECT key, value FROM auth_kv WHERE key LIKE ? ORDER BY key ASC").all("%:token") as Array<{ key: string; value: string }>;
+  const selectedKey = process.env.KIROCLI_TOKEN_KEY?.trim();
+  if (selectedKey) return rows.find(row => row.key === selectedKey) ?? "selected_missing";
+  for (const preferred of TOKEN_KEYS) {
+    const row = rows.find(candidate => candidate.key === preferred);
+    if (row) return row;
+  }
+  if (rows.length === 0) return null;
+  if (rows.length === 1) return rows[0];
+  return "ambiguous";
 }
 
 function credentialFromJson(data: JsonObject, source: KiroCredentialSource): ImportedKiroCredential | undefined {
@@ -202,22 +225,26 @@ function readSqliteCredentials(diagnostics: KiroImportDiagnostic[]): ImportedKir
       continue;
     }
     try {
-      let tokenData: JsonObject | undefined;
-      for (const key of TOKEN_KEYS) {
-        const row = db.query("SELECT value FROM auth_kv WHERE key = ?").get(key) as { value: string } | null;
-        if (!row) continue;
-        try {
-          tokenData = JSON.parse(row.value) as JsonObject;
-        } catch {
-          diagnostics.push({ location, status: "invalid_json" });
-          continue;
-        }
-        if (stringField(tokenData, "access_token", "accessToken")) break;
+      const row = selectTokenRow(db);
+      if (row === "ambiguous") {
+        diagnostics.push({ location, status: "token_ambiguous" });
+        throw new Error("Kiro CLI credential database contains multiple tokens; set KIROCLI_TOKEN_KEY to select one");
+      }
+      if (row === "selected_missing") {
+        diagnostics.push({ location, status: "token_key_missing" });
+        throw new Error("The KIROCLI_TOKEN_KEY selection was not found in the Kiro CLI credential database");
       }
-      if (!tokenData) {
+      if (!row) {
         diagnostics.push({ location, status: "token_missing" });
         continue;
       }
+      let tokenData: JsonObject;
+      try {
+        tokenData = JSON.parse(row.value) as JsonObject;
+      } catch {
+        diagnostics.push({ location, status: "invalid_json" });
+        continue;
+      }
       let registrationData: JsonObject = {};
       for (const key of REGISTRATION_KEYS) {
         const row = db.query("SELECT value FROM auth_kv WHERE key = ?").get(key) as { value: string } | null;
@@ -235,7 +262,8 @@ function readSqliteCredentials(diagnostics: KiroImportDiagnostic[]): ImportedKir
       const credential = credentialFromJson(merged, "sqlite");
       diagnostics.push({ location, status: credential ? "token_found" : "token_missing" });
       if (credential) return credential;
-    } catch {
+    } catch (error) {
+      if (error instanceof Error && error.message.includes("KIROCLI_TOKEN_KEY")) throw error;
       diagnostics.push({ location, status: "schema_mismatch" });
     } finally {
       db.close();

package/src/oauth/login-cli.ts

@@ -72,6 +72,8 @@ export function providerConfigFromKeyLoginProvider(def: KeyLoginProvider, key: s
     ...(def.contextWindow !== undefined ? { contextWindow: def.contextWindow } : {}),
     ...(def.modelContextWindows ? { modelContextWindows: { ...def.modelContextWindows } } : {}),
     ...(def.modelMaxInputTokens ? { modelMaxInputTokens: { ...def.modelMaxInputTokens } } : {}),
+    ...(def.defaultMaxOutputTokens !== undefined ? { defaultMaxOutputTokens: def.defaultMaxOutputTokens } : {}),
+    ...(def.modelMaxOutputTokens ? { modelMaxOutputTokens: { ...def.modelMaxOutputTokens } } : {}),
     ...(def.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(def.modelInputModalities) } : {}),
     ...(def.reasoningEfforts ? { reasoningEfforts: [...def.reasoningEfforts] } : {}),
     ...(def.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(def.modelReasoningEfforts) } : {}),

package/src/providers/derive.ts

@@ -13,6 +13,8 @@ export interface DerivedKeyLoginProvider {
   modelContextWindows?: Record<string, number>;
   modelInputModalities?: Record<string, string[]>;
   modelMaxInputTokens?: Record<string, number>;
+  defaultMaxOutputTokens?: number;
+  modelMaxOutputTokens?: Record<string, number>;
   reasoningEfforts?: string[];
   modelReasoningEfforts?: Record<string, string[]>;
   modelDefaultReasoningEfforts?: Record<string, string>;
@@ -96,6 +98,8 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.modelContextWindows ? { modelContextWindows: { ...entry.modelContextWindows } } : {}),
     ...(entry.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(entry.modelInputModalities) } : {}),
     ...(entry.modelMaxInputTokens ? { modelMaxInputTokens: { ...entry.modelMaxInputTokens } } : {}),
+    ...(entry.defaultMaxOutputTokens !== undefined ? { defaultMaxOutputTokens: entry.defaultMaxOutputTokens } : {}),
+    ...(entry.modelMaxOutputTokens ? { modelMaxOutputTokens: { ...entry.modelMaxOutputTokens } } : {}),
     ...(entry.reasoningEfforts ? { reasoningEfforts: [...entry.reasoningEfforts] } : {}),
     ...(entry.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(entry.modelReasoningEfforts) } : {}),
     ...(entry.modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts: { ...entry.modelDefaultReasoningEfforts } } : {}),
@@ -135,6 +139,8 @@ export function deriveKeyLoginMap(): Record<string, DerivedKeyLoginProvider> {
       ...(entry.modelContextWindows ? { modelContextWindows: { ...entry.modelContextWindows } } : {}),
       ...(entry.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(entry.modelInputModalities) } : {}),
       ...(entry.modelMaxInputTokens ? { modelMaxInputTokens: { ...entry.modelMaxInputTokens } } : {}),
+      ...(entry.defaultMaxOutputTokens !== undefined ? { defaultMaxOutputTokens: entry.defaultMaxOutputTokens } : {}),
+      ...(entry.modelMaxOutputTokens ? { modelMaxOutputTokens: { ...entry.modelMaxOutputTokens } } : {}),
       ...(entry.reasoningEfforts ? { reasoningEfforts: [...entry.reasoningEfforts] } : {}),
       ...(entry.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(entry.modelReasoningEfforts) } : {}),
       ...(entry.modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts: { ...entry.modelDefaultReasoningEfforts } } : {}),
@@ -203,6 +209,8 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (prov.contextWindow === undefined && seed.contextWindow !== undefined) prov.contextWindow = seed.contextWindow;
   if (!prov.modelContextWindows && seed.modelContextWindows) prov.modelContextWindows = { ...seed.modelContextWindows };
   if (!prov.modelInputModalities && seed.modelInputModalities) prov.modelInputModalities = cloneRecordOfArrays(seed.modelInputModalities);
+  if (prov.defaultMaxOutputTokens === undefined && seed.defaultMaxOutputTokens !== undefined) prov.defaultMaxOutputTokens = seed.defaultMaxOutputTokens;
+  if (!prov.modelMaxOutputTokens && seed.modelMaxOutputTokens) prov.modelMaxOutputTokens = { ...seed.modelMaxOutputTokens };
   if (!prov.reasoningEfforts && seed.reasoningEfforts) prov.reasoningEfforts = [...seed.reasoningEfforts];
   if (!prov.modelReasoningEfforts && seed.modelReasoningEfforts) prov.modelReasoningEfforts = cloneRecordOfArrays(seed.modelReasoningEfforts);
   if (!prov.modelDefaultReasoningEfforts && seed.modelDefaultReasoningEfforts) prov.modelDefaultReasoningEfforts = { ...seed.modelDefaultReasoningEfforts };

package/src/providers/kiro-models.ts

@@ -45,8 +45,8 @@ export const KIRO_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 
 const KIRO_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 
-// Kiro has no upstream reasoning_effort enum; these labels map to fake-thinking budgets in
-// src/adapters/kiro.ts.
+// gpt-5.6-sol sends these values through Kiro's verified native reasoning field. Other models map
+// them to bounded thinking instructions until their native effort support is verified.
 export const KIRO_MODEL_REASONING_EFFORTS: Record<string, string[]> = Object.fromEntries(
   KIRO_MODELS.map(id => [id, KIRO_REASONING_EFFORTS]),
 );

package/src/providers/openai-sidecar.ts

@@ -7,6 +7,7 @@ import {
   type CodexAuthContext,
 } from "../codex/auth-context";
 import { recordCodexUpstreamOutcome, type CodexUpstreamOutcome } from "../codex/routing";
+import { extractAccountId } from "../oauth/chatgpt";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "../server/auth-cors";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
 import {
@@ -47,6 +48,23 @@ export function listOpenAiForwardSidecarCandidates(config: OcxConfig): OpenAiFor
   }];
 }
 
+function directSidecarHeaders(
+  incomingHeaders: Headers,
+): Headers | undefined {
+  const bearer = incomingHeaders.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  if (!bearer) return undefined;
+  const derivedAccountId = extractAccountId(undefined, bearer);
+  if (!derivedAccountId) return undefined;
+  const requestedAccountId = incomingHeaders.get("chatgpt-account-id")?.trim();
+  // JWT payloads are decoded locally but not signature-verified. Requiring the caller's
+  // explicit account header, and checking it against the token claim, makes forwarding an
+  // intentional ChatGPT-auth operation instead of silently reclassifying any JWT-shaped
+  // provider credential as a Codex bearer.
+  if (!requestedAccountId || requestedAccountId !== derivedAccountId) return undefined;
+  const selected = headersForCodexAuthContext(incomingHeaders, { kind: "main", accountId: null });
+  return selected;
+}
+
 export async function resolveFirstUsableOpenAiSidecar(
   candidates: readonly OpenAiForwardSidecarCandidate[],
   incomingHeaders: Headers,
@@ -60,7 +78,16 @@ export async function resolveFirstUsableOpenAiSidecar(
     callerBearerMayBeForwarded = false;
   }
   for (const candidate of candidates) {
-    if (candidate.accountMode === "direct" && (!callerBearerMayBeForwarded || !hasCallerCodexBearer(incomingHeaders))) continue;
+    if (candidate.accountMode === "direct") {
+      if (!callerBearerMayBeForwarded || !hasCallerCodexBearer(incomingHeaders)) continue;
+      const headers = directSidecarHeaders(incomingHeaders);
+      if (!headers) continue;
+      return {
+        ...candidate,
+        authContext: { kind: "main", accountId: null },
+        headers,
+      };
+    }
     const authContext = await resolveCodexAuthContext(incomingHeaders, config, candidate.accountMode);
     if (!isCodexAuthContextUsable(authContext, config)) continue;
     return {