@bitkyc08/opencodex 2.7.43-preview.20260728 → 2.8.0

package/src/oauth/index.ts

@@ -1,19 +1,21 @@
-import type { OAuthController, OAuthCredentials } from "./types";
+import type { KiroOAuthMetadata, OAuthController, OAuthCredentials } from "./types";
 import { parseCallbackInput } from "./callback-server";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
 import { loadConfig, resolveEnvValue, saveConfig } from "../config";
 import { maskEmail } from "../lib/privacy";
-import { getAccountCredential, getAccountSet, saveAccountCredential, saveCredential, markAccountNeedsReauth, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, clearOAuthRefreshIntent } from "./store";
+import { KiroTokenRefreshError, environmentKiroRoutingMetadata, loginKiro, refreshKiroToken, settleKiroLoginTransaction } from "./kiro";
+import { getAccountCredential, getAccountSet, removeAccount, saveAccountCredential, saveCredential, setActiveAccount, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, clearOAuthRefreshIntent } from "./store";
 import { loginXai, refreshXaiToken, XAI_LOCAL_CLI_DETACH_WARNING, XaiTokenRequestError } from "./xai";
 import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import { loginKimi, refreshKimiToken } from "./kimi";
-import { loginKiro, readKiroCliSqlite, refreshKiroToken } from "./kiro";
 import { loginChatGPT, refreshChatGPTToken } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
-import { effectiveGoogleMode } from "../providers/registry";
+import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
+import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport } from "../providers/registry";
+import { resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { resolveProviderTransport } from "../providers/xai-transport";
 import { detectClaudeCodeToken, detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
 import { logOAuthEvent } from "./log";
@@ -37,6 +39,7 @@ export {
   type OAuthHealthLabel,
 } from "./health";
 export { OAUTH_REFRESH_LOCK_WAIT_MS, peekAuthStore, peekOAuthRefreshIntent } from "./store";
+import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
 
 const REFRESH_SKEW_MS = 60_000;
 export interface OAuthAccessSnapshot {
@@ -44,6 +47,8 @@ export interface OAuthAccessSnapshot {
   accountId: string;
   generation: string;
   accessToken: string;
+  /** Safe request-routing subset; refresh-only Kiro client secrets never leave the credential store. */
+  kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion">;
 }
 
 const tokenRefreshes = new Map<string, Promise<OAuthAccessSnapshot>>();
@@ -57,9 +62,18 @@ function cached(p:string,a:string,c:OAuthCredentials,now:()=>number){const k=ver
 
 export interface LoginOpts { forceLogin?: boolean; /** When set, persist into this account slot and require matching identity. */ reauthAccountId?: string }
 
+export interface LoginFlowLifecycle {
+  /** Runs after background credential/config persistence settles, before status becomes done. */
+  onSettled?: () => void | Promise<void>;
+}
+
 interface OAuthProviderDef {
   login(ctrl: OAuthController, opts?: LoginOpts): Promise<OAuthCredentials>;
-  refresh(refreshToken: string, signal?: AbortSignal): Promise<OAuthCredentials>;
+  refresh(
+    refreshToken: string,
+    signal?: AbortSignal,
+    credential?: OAuthCredentials,
+  ): Promise<OAuthCredentials>;
   /** provider entry written into config.json on first login. */
   providerConfig: OcxProviderConfig;
   defaultModel: string;
@@ -107,8 +121,8 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     defaultModel: oauthDefaultModel("kimi"),
   },
   kiro: {
-    login: (ctrl) => loginKiro(ctrl),
-    refresh: (rt, signal) => refreshKiroToken(rt, signal),
+    login: (ctrl, opts) => loginKiro(ctrl, { forceLogin: opts?.forceLogin }),
+    refresh: (rt, signal, credential) => refreshKiroToken(rt, signal, credential),
     providerConfig: oauthConfig("kiro"),
     defaultModel: oauthDefaultModel("kiro"),
   },
@@ -194,11 +208,25 @@ export class OAuthLoginRequiredError extends Error {
 }
 
 function accessSnapshot(provider: string, accountId: string, cred: OAuthCredentials): OAuthAccessSnapshot {
+  const storedKiroRouting = {
+    ...(cred.kiro?.profileArn ? { profileArn: cred.kiro.profileArn } : {}),
+    ...(cred.kiro?.apiRegion ? { apiRegion: cred.kiro.apiRegion } : {}),
+    ...(cred.kiro?.ssoRegion ? { ssoRegion: cred.kiro.ssoRegion } : {}),
+  };
   return {
     provider,
     accountId,
     generation: credentialGeneration(cred),
     accessToken: cred.access,
+    // Stored account metadata remains authoritative. Metadata-less legacy/environment credentials
+    // may use explicit environment routing, but never borrow the currently signed-in local CLI account.
+    ...(provider === "kiro"
+      ? {
+          kiro: Object.keys(storedKiroRouting).length > 0
+            ? storedKiroRouting
+            : environmentKiroRoutingMetadata() ?? {},
+        }
+      : {}),
   };
 }
 
@@ -267,12 +295,6 @@ export async function getValidAccessTokenForAccount(provider: string, accountId:
   return (await resolveAccessSnapshotForAccount(provider, accountId)).accessToken;
 }
 
-function readFreshKiroCliCredential(): OAuthCredentials | undefined {
-  const imported = readKiroCliSqlite();
-  if (!imported || imported.expires <= Date.now() + REFRESH_SKEW_MS) return undefined;
-  return { access: imported.access, refresh: imported.refresh, expires: imported.expires, source: "local-cli" };
-}
-
 /** Terminal refresh failures (revoked/rotated-away grants) — retrying cannot succeed. */
 function isTerminalRefreshError(err: unknown): boolean {
   const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
@@ -286,6 +308,7 @@ function isTerminalRefreshError(err: unknown): boolean {
 function terminal(error:unknown):boolean{
   if(error instanceof XaiTokenRequestError)return ["invalid_grant","refresh_token_reused","revoked_token"].includes(error.oauthError??"");
   if(error instanceof AnthropicTokenError)return (error.httpStatus===400||error.httpStatus===401)&&["invalid_grant","refresh_token_reused","revoked","revoked_token","refresh_token_revoked"].includes(error.oauthError??"");
+  if(error instanceof KiroTokenRefreshError)return (error.httpStatus===400||error.httpStatus===401)&&error.oauthError!==undefined;
   return isTerminalRefreshError(error);
 }
 function authoritative(stored:OAuthCredentials,active:boolean,now:()=>number):OAuthCredentials{if(stored.source!=="local-cli")return stored;const disk=detectGrokCliToken();if(!disk)return stored;const allowed=isSameGrokIdentity(stored,disk)||(active&&!hasComparableGrokIdentity(stored,disk));return allowed&&shouldAdoptGrokGeneration(stored,disk,now(),REFRESH_SKEW_MS)?disk:stored;}
@@ -297,6 +320,7 @@ function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCrede
     ...(fresh.apiBaseUrl === undefined && previous.apiBaseUrl ? { apiBaseUrl: previous.apiBaseUrl } : {}),
     ...(fresh.email === undefined && previous.email ? { email: previous.email } : {}),
     ...(fresh.accountId === undefined && previous.accountId ? { accountId: previous.accountId } : {}),
+    ...(fresh.kiro === undefined && previous.kiro ? { kiro: previous.kiro } : {}),
   };
 }
 export async function refreshXaiAccountWithLock(provider:string,accountId:string,def:OAuthProviderDef,callerCredential:OAuthCredentials,deps:XaiRefreshDeps={}):Promise<string>{const now=deps.now??Date.now;const guard=await(deps.intentLock??createOAuthRefreshIntentLock(provider,accountId)).acquire();try{const stored=getAccountCredential(provider,accountId);if(!stored)throw new OAuthLoginRequiredError(provider);const active=getAccountSet(provider)?.activeAccountId===accountId,candidate=authoritative(stored,active,now);if(credentialGeneration(candidate)!==credentialGeneration(callerCredential)&&candidate.expires>now()+REFRESH_SKEW_MS){if(credentialGeneration(candidate)!==credentialGeneration(stored)){const o=await mergeAccountCredential(provider,accountId,candidate,{expectedGeneration:credentialGeneration(stored),afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}}return candidate.access;}if(cached(provider,accountId,candidate,now))throw new OAuthLoginRequiredError(provider);const generation=credentialGeneration(candidate);try{const fresh=merged(await def.refresh(candidate.refresh),candidate);const o=await mergeAccountCredential(provider,accountId,fresh,{expectedGeneration:generation,afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}permanentRefreshFailures.delete(verdictKey(provider,accountId,candidate));if(candidate.source==="local-cli")console.warn(XAI_LOCAL_CLI_DETACH_WARNING);return fresh.access;}catch(error){if(!terminal(error))throw error;permanentRefreshFailures.set(verdictKey(provider,accountId,candidate),now()+XAI_PERMANENT_FAILURE_TTL_MS);await markAccountNeedsReauthIfGeneration(provider,accountId,generation);throw new OAuthLoginRequiredError(provider);}}finally{guard.release();}}
@@ -395,7 +419,7 @@ export async function refreshGenericAccountWithLock(
     }
     const generation = credentialGeneration(stored);
     try {
-      const fresh = merged(await def.refresh(stored.refresh), stored);
+      const fresh = merged(await def.refresh(stored.refresh, undefined, stored), stored);
       const outcome = await mergeAccountCredential(provider, accountId, fresh, {
         expectedGeneration: generation,
         afterPrePersistRead: deps.afterPrePersistRead,
@@ -407,7 +431,7 @@ export async function refreshGenericAccountWithLock(
       logOAuthEvent("OAuth credentials rotated and persisted", { provider, accountId });
       return fresh.access;
     } catch (error) {
-      if (!isTerminalRefreshError(error)) throw error;
+      if (!terminal(error)) throw error;
       await markAccountNeedsReauthIfGeneration(provider, accountId, generation);
       throw new OAuthLoginRequiredError(provider);
     }
@@ -422,30 +446,9 @@ async function refreshAndPersistAccessToken(
   def: OAuthProviderDef,
   cred: OAuthCredentials,
 ): Promise<string> {
-  // Local-CLI import fallback only for the ACTIVE account: importing another identity's
-  // token under a background account id would silently contaminate that account.
-  const isActive = getAccountSet(provider)?.activeAccountId === accountId;
-  if (provider === "kiro" && isActive) {
-    const imported = readFreshKiroCliCredential();
-    if (imported) {
-      await saveCredential(provider, imported);
-      return imported.access;
-    }
-  }
   if (provider === "xai") return refreshXaiAccountWithLock(provider, accountId, def, cred);
   if (provider === "anthropic") return refreshAnthropicAccountWithLock(provider, accountId, def, cred);
-  try {
-    return await refreshGenericAccountWithLock(provider, accountId, def, cred);
-  } catch (err) {
-    if (provider === "kiro" && isActive) {
-      const imported = readFreshKiroCliCredential();
-      if (imported) {
-        await saveCredential(provider, imported);
-        return imported.access;
-      }
-    }
-    throw err;
-  }
+  return refreshGenericAccountWithLock(provider, accountId, def, cred);
 }
 
 /**
@@ -465,44 +468,70 @@ export async function resolveModelsAuthToken(name: string, prov: OcxProviderConf
   return resolveEnvValue(prov.apiKey);
 }
 
+function modelDiscoveryTransportSeed(providerName: string, prov: OcxProviderConfig): OcxProviderConfig {
+  const entry = getProviderRegistryEntry(providerName);
+  if (
+    prov.authMode !== "oauth"
+    || entry?.authKind !== "oauth"
+    || entry.allowBaseUrlOverride === true
+    || /\{[^}]*\}/.test(entry.baseUrl)
+    || !providerMatchesRegistryTransport(providerName, prov)
+  ) {
+    return prov;
+  }
+  // Normal routing pins fixed OAuth presets before adapter-specific transport resolution.
+  // Discovery must do the same so a stale or modified config baseUrl never receives a token.
+  return { ...prov, adapter: entry.adapter, baseUrl: entry.baseUrl };
+}
+
 /**
  * Provider-correct `GET /models` request (URL + headers), so both model-listing paths fetch the
  * LIVE catalog correctly per adapter. Anthropic is the special case: its endpoint is `/v1/models`
- * (not `/models`), it needs `anthropic-version`, and it authenticates with `x-api-key` (key) or
- * `Authorization: Bearer` + the OAuth beta (oauth) — not a bare Bearer. Google (ai-studio mode)
+ * (not `/models`), it needs `anthropic-version`, and it authenticates with `x-api-key` by default
+ * (or `Authorization: Bearer` when `apiKeyTransport = "bearer"`), plus the OAuth beta for oauth
+ * mode — not a bare Bearer. Google (ai-studio mode)
  * is the other special case: `x-goog-api-key` + `/v1beta/models`, returning `{ models: [...] }`.
  * The catalog authority gate intentionally degrades that non-OpenAI shape to stale/static data.
  * Everyone else uses the OpenAI-style `/models` + Bearer with a `{ data: [{ id, owned_by? }] }`
  * response.
  */
 export function buildModelsRequest(prov: OcxProviderConfig, apiKey: string | undefined, providerName = ""): { url: string; headers: Record<string, string> } {
+  const transportSeed = modelDiscoveryTransportSeed(providerName, prov);
   const effectiveProvider = resolveProviderTransport(
     providerName,
-    prov,
+    transportSeed,
     undefined,
     providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(providerName) : undefined,
   );
   const headers: Record<string, string> = { ...(effectiveProvider.headers ?? {}) };
+  const discoveryUrl = (defaultUrl: string): string => resolveProviderModelDiscoveryUrl(
+    providerName,
+    prov,
+    effectiveProvider.baseUrl,
+    defaultUrl,
+  );
   if (effectiveGoogleMode(providerName, effectiveProvider) === "ai-studio") {
     // Generative Language API: API key goes in x-goog-api-key (never Authorization: Bearer),
     // models live under /v1beta (v1 misses preview models), and pageSize maxes at 1000 —
     // enough to list everything without a pageToken loop. Vertex/antigravity keep the
     // generic branch (they fall back to their static model lists).
     if (apiKey) headers["x-goog-api-key"] = apiKey;
-    return { url: `${effectiveProvider.baseUrl}/v1beta/models?pageSize=1000`, headers };
+    return { url: discoveryUrl(`${effectiveProvider.baseUrl}/v1beta/models?pageSize=1000`), headers };
   }
   if (effectiveProvider.adapter === "anthropic") {
+    const base = effectiveProvider.baseUrl.replace(/\/v1\/?$/, "");
     headers["anthropic-version"] = "2023-06-01";
     if (effectiveProvider.authMode === "oauth") {
       headers["anthropic-beta"] = ANTHROPIC_OAUTH_BETA;
       if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
     } else if (apiKey) {
-      headers["x-api-key"] = apiKey;
+      if (effectiveProvider.apiKeyTransport === "bearer") headers["Authorization"] = `Bearer ${apiKey}`;
+      else headers["x-api-key"] = apiKey;
     }
-    return { url: `${effectiveProvider.baseUrl}/v1/models?limit=1000`, headers };
+    return { url: discoveryUrl(`${base}/v1/models?limit=1000`), headers };
   }
   if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-  return { url: `${effectiveProvider.baseUrl}/models`, headers };
+  return { url: discoveryUrl(`${effectiveProvider.baseUrl}/models`), headers };
 }
 
 /**
@@ -566,39 +595,219 @@ export function reconcileOAuthProviders(config: OcxConfig): boolean {
   return changed;
 }
 
-/** Add/refresh an OAuth provider's config entry on a config object (does not persist). */
+/** Runtime guards: provider config is intentionally passthrough, so persisted fields may be malformed. */
+function preservableApiKeyPool(value: unknown): NonNullable<OcxProviderConfig["apiKeyPool"]> | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const pool: NonNullable<OcxProviderConfig["apiKeyPool"]> = [];
+  const ids = new Set<string>();
+  const keys = new Set<string>();
+  for (const entry of value as unknown[]) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const candidate = entry as Record<string, unknown>;
+    const id = typeof candidate.id === "string" ? candidate.id.trim() : "";
+    const key = sanitizeApiKeyValue(candidate.key);
+    if (!id || !key || ids.has(id) || keys.has(key)) continue;
+    const label = typeof candidate.label === "string" ? candidate.label : undefined;
+    const addedAt = typeof candidate.addedAt === "number" && Number.isFinite(candidate.addedAt)
+      ? candidate.addedAt
+      : undefined;
+    ids.add(id);
+    keys.add(key);
+    pool.push({
+      id,
+      key,
+      ...(label !== undefined ? { label } : {}),
+      ...(addedAt !== undefined ? { addedAt } : {}),
+    });
+  }
+  // `apiKey` remains the routing source of truth. Keep valid alternate slots even when a
+  // hand-edited config left the pool out of sync, rather than deleting usable credentials.
+  return pool.length > 0 ? pool : undefined;
+}
+
+/**
+ * Add/refresh an OAuth provider's config entry on a config object (does not persist).
+ *
+ * Providers whose registry entry sets `allowKeyAuthOverride` (xai, github-copilot) can be
+ * billed through a stored API key instead of the OAuth login (router.ts honors
+ * `authMode: "key"` for them). A blind preset overwrite here deletes `apiKey`/`apiKeyPool`
+ * on every OAuth login, silently destroying the stored key and forcing a re-paste — and it
+ * flips billing back to the subscription without the user asking. Carry the key fields over
+ * and keep key billing while usable key material remains and the user was not explicitly on
+ * oauth. If the final key was removed and only the old key mode remains, let the OAuth
+ * preset restore `authMode: "oauth"` so the newly saved OAuth credential can be used.
+ *
+ * After preservation, `apiKey` always has exactly one matching pool entry (inserting via the
+ * same content-derived id as the API-key manager when the active key was missing from the
+ * pool). Key mode reflects stored user intent (explicit `"key"` or omitted mode with safe
+ * key material) — never whether the login CLI process can resolve an env reference. Env-backed
+ * availability is decided at proxy routing time in `router.ts`.
+ */
 export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   if (provider === "chatgpt") return;
   const def = OAUTH_PROVIDERS[provider];
   if (!def) return;
-  config.providers[provider] = { ...def.providerConfig };
+  const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
+  if (namespaceCollision) throw new Error(namespaceCollision);
+  const existing = config.providers[provider];
+  const next: OcxProviderConfig = { ...def.providerConfig };
+  if (existing && getProviderRegistryEntry(provider)?.allowKeyAuthOverride === true) {
+    // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
+    let storedApiKey = sanitizeApiKeyValue(existing.apiKey);
+    const storedApiKeyPool = preservableApiKeyPool(existing.apiKeyPool);
+    // Unsafe/blank active key with a usable pool: promote the first safe pool entry so
+    // key billing keeps working instead of falling back to oauth while pool keys remain.
+    if (storedApiKey === undefined && storedApiKeyPool && storedApiKeyPool.length > 0) {
+      storedApiKey = storedApiKeyPool[0]!.key;
+    }
+    if (storedApiKey !== undefined) {
+      const pool = storedApiKeyPool ? [...storedApiKeyPool] : [];
+      // Keep routing and listProviderApiKeys in sync: never leave a hidden active key that
+      // is absent from the pool (listing would fall back to pool[0] as "active").
+      if (!pool.some(entry => entry.key === storedApiKey)) {
+        pool.push({ id: apiKeyPoolEntryId(storedApiKey), key: storedApiKey });
+      }
+      next.apiKey = storedApiKey;
+      next.apiKeyPool = pool;
+      const previousModeAllowsKey = existing.authMode === "key" || existing.authMode === undefined;
+      if (previousModeAllowsKey) next.authMode = "key";
+    }
+  }
+  config.providers[provider] = next;
+}
+
+interface RunLoginDeps {
+  saveCredential?: typeof saveCredential;
+  saveAccountCredential?: typeof saveAccountCredential;
+  loadConfig?: typeof loadConfig;
+  saveConfig?: typeof saveConfig;
+  settleKiroLoginTransaction?: typeof settleKiroLoginTransaction;
+  removeAccount?: typeof removeAccount;
+  setActiveAccount?: typeof setActiveAccount;
+}
+
+/** Roll back only accounts created by this forced login, preserving concurrent refreshes of others. */
+async function rollbackForcedKiroAccountWrite(
+  provider: string,
+  previousActiveId: string | undefined,
+  previousAccountIds: ReadonlySet<string>,
+  deps: Pick<RunLoginDeps, "removeAccount" | "setActiveAccount">,
+): Promise<void> {
+  const set = getAccountSet(provider);
+  if (!set) return;
+  for (const account of [...set.accounts]) {
+    if (previousAccountIds.has(account.id)) continue;
+    await (deps.removeAccount ?? removeAccount)(provider, account.id);
+  }
+  if (previousActiveId && getAccountCredential(provider, previousActiveId)) {
+    await (deps.setActiveAccount ?? setActiveAccount)(provider, previousActiveId);
+  }
 }
 
 /** Run the login flow, persist the credential + upsert the provider entry to disk, return cred. */
-export async function runLogin(provider: string, ctrl: OAuthController, opts?: LoginOpts): Promise<OAuthCredentials> {
+export async function runLogin(
+  provider: string,
+  ctrl: OAuthController,
+  opts?: LoginOpts,
+  deps: RunLoginDeps = {},
+): Promise<OAuthCredentials> {
   const def = OAUTH_PROVIDERS[provider];
   if (!def) throw new UnsupportedOAuthProviderError(provider);
+  const loadLatestConfig = deps.loadConfig ?? loadConfig;
+  const saveLatestConfig = deps.saveConfig ?? saveConfig;
+  if (provider !== "chatgpt") {
+    const preflightConfig = loadLatestConfig();
+    const namespaceCollision = codexAccountNamespaceProviderCollisionError(
+      preflightConfig.codexAccountNamespaces,
+      provider,
+    );
+    if (namespaceCollision) throw new Error(namespaceCollision);
+  }
+  // loginKiro keys its pending CLI-session transaction by object identity. Keep this exact object
+  // for settlement even when source normalization below creates a derived credential object.
+  const shouldRollbackKiroAccounts = provider === "kiro" && opts?.forceLogin === true;
+  const previousKiroAccounts = shouldRollbackKiroAccounts ? getAccountSet(provider) : undefined;
+  const previousKiroActiveId = previousKiroAccounts?.activeAccountId;
+  const previousKiroAccountIds = new Set(previousKiroAccounts?.accounts.map(account => account.id) ?? []);
   const rawCred = await def.login(ctrl, opts);
   const cred: OAuthCredentials = rawCred.source ? rawCred : { ...rawCred, source: "oauth" };
-  if (opts?.reauthAccountId) {
-    const existing = getAccountCredential(provider, opts.reauthAccountId);
-    if (!existing) throw new Error(`Unknown account for reauth: ${opts.reauthAccountId}`);
-    const expected = existing.accountId ?? existing.email;
-    const got = cred.accountId ?? cred.email;
-    if (!expected) {
-      throw new Error("Could not verify signed-in account identity for reauth.");
+  const settleKiroTransaction = deps.settleKiroLoginTransaction ?? settleKiroLoginTransaction;
+  try {
+    // Validate the provider row before credential persistence. A namespace claimed during the
+    // credential write is handled again below before the latest row is re-upserted.
+    if (provider !== "chatgpt") {
+      const preCommitConfig = loadLatestConfig();
+      upsertOAuthProvider(preCommitConfig, provider);
+    }
+    if (opts?.reauthAccountId) {
+      const existing = getAccountCredential(provider, opts.reauthAccountId);
+      if (!existing) throw new Error(`Unknown account for reauth: ${opts.reauthAccountId}`);
+      if (!existing.accountId && !existing.email) {
+        throw new Error("Could not verify signed-in account identity for reauth.");
+      }
+      const identityMatches = existing.accountId && cred.accountId
+        ? existing.accountId === cred.accountId
+        : existing.email && cred.email
+          ? existing.email.toLowerCase() === cred.email.toLowerCase()
+          : false;
+      if (!identityMatches) {
+        throw new Error("Signed-in account does not match the selected account. Sign in with the same account.");
+      }
+      await (deps.saveAccountCredential ?? saveAccountCredential)(provider, opts.reauthAccountId, cred);
+    } else {
+      await (deps.saveCredential ?? saveCredential)(provider, cred, {
+        preserveIdentityless: provider === "kiro" && opts?.forceLogin === true,
+      });
     }
-    if (!got || expected !== got) {
-      throw new Error("Signed-in account does not match the selected account. Sign in with the same account.");
+    if (provider !== "chatgpt") {
+      // Re-run against post-credential state so same-provider API-key additions, removals,
+      // and active-key switches survive. A late namespace claim wins over provider creation.
+      const latestConfig = loadLatestConfig();
+      const lateCollision = codexAccountNamespaceProviderCollisionError(
+        latestConfig.codexAccountNamespaces,
+        provider,
+      );
+      if (lateCollision) {
+        throw new Error(
+          `${lateCollision}. The credential for "${provider}" was saved, but the provider entry was not written. `
+          + "Rename the account selector, then re-run the login.",
+        );
+      }
+      upsertOAuthProvider(latestConfig, provider);
+      saveLatestConfig(latestConfig);
+    }
+  } catch (error) {
+    const errors: unknown[] = [error];
+    if (shouldRollbackKiroAccounts) {
+      try {
+        await rollbackForcedKiroAccountWrite(provider, previousKiroActiveId, previousKiroAccountIds, deps);
+      } catch (rollbackError) {
+        errors.push(rollbackError);
+      }
+    }
+    try {
+      settleKiroTransaction(rawCred, false);
+    } catch (restoreError) {
+      errors.push(restoreError);
+    }
+    if (errors.length > 1) {
+      throw new AggregateError(
+        errors,
+        "Kiro login persistence failed and the previous Kiro CLI session could not be restored.",
+      );
+    }
+    throw error;
+  }
+  settleKiroTransaction(rawCred, true);
+  if (provider !== "chatgpt") {
+    try {
+      const { clearAccountQuotaCache, clearProviderQuotaCache } = await import("../providers/quota");
+      clearProviderQuotaCache();
+      clearAccountQuotaCache(provider);
+    } catch {
+      // Quota module may be unavailable in tightly scoped unit tests.
     }
-    await saveAccountCredential(provider, opts.reauthAccountId, cred);
-  } else {
-    await saveCredential(provider, cred);
   }
-  if (provider === "chatgpt") return cred;
-  const config = loadConfig();
-  upsertOAuthProvider(config, provider);
-  saveConfig(config);
   return cred;
 }
 
@@ -745,7 +954,11 @@ export function cancelLoginFlow(provider: string): boolean {
   return true;
 }
 
-export async function startLoginFlow(provider: string, opts?: LoginOpts): Promise<{ url: string; instructions?: string; deviceCode?: string }> {
+export async function startLoginFlow(
+  provider: string,
+  opts?: LoginOpts,
+  lifecycle?: LoginFlowLifecycle,
+): Promise<{ url: string; instructions?: string; deviceCode?: string }> {
   const def = OAUTH_PROVIDERS[provider];
   if (!def) throw new UnsupportedOAuthProviderError(provider);
   const existing = loginState.get(provider);
@@ -768,22 +981,44 @@ export async function startLoginFlow(provider: string, opts?: LoginOpts): Promis
       onManualCodeInput: (expectedState?: string) => waitForManualLoginCode(provider, abort.signal, expectedState),
       signal: abort.signal,
     };
-    // Background: runLogin persists the credential + upserts the provider entry to disk config.
-    runLogin(provider, ctrl, opts)
-      .then(() => {
+    const settle = async (error?: unknown): Promise<void> => {
+      let finalError = error;
+      try {
+        await lifecycle?.onSettled?.();
+      } catch (settleError) {
+        // A successful credential/config commit is not fully live until its owner reconciles the
+        // runtime config. For an already-failed login, keep the original recovery error.
+        if (finalError === undefined) finalError = settleError;
+      }
+      if (finalError === undefined) {
         loginAbort.delete(provider);
         clearManualCodeSlot(provider);
         loginState.set(provider, { done: true });
         // Local-token import (grok-cli / Claude Code keychain) completes WITHOUT firing onAuth —
         // resolve so the GUI call returns instead of hanging.
         if (!urlResolved) resolve({ url: "", instructions: "Logged in via an existing local CLI/keychain token — no browser needed." });
-      })
-      .catch((e: unknown) => {
-        loginAbort.delete(provider);
-        clearManualCodeSlot(provider);
-        const msg = e instanceof Error ? e.message : String(e);
-        loginState.set(provider, { done: true, error: msg });
-        if (!urlResolved) reject(e);
-      });
+        return;
+      }
+
+      const e = finalError;
+      loginAbort.delete(provider);
+      clearManualCodeSlot(provider);
+      const msg = e instanceof Error ? e.message : String(e);
+      loginState.set(provider, { done: true, error: msg });
+      if (!urlResolved) reject(e);
+    };
+    // Background: runLogin persists the credential + provider entry to disk. The lifecycle hook
+    // lets a long-lived server config adopt that settled state before clients observe done=true.
+    void runLogin(provider, ctrl, opts).then(
+      () => settle(),
+      (e: unknown) => settle(e),
+    ).catch((e: unknown) => {
+      // settle catches lifecycle failures, so this is only a defensive promise-boundary guard.
+      loginAbort.delete(provider);
+      clearManualCodeSlot(provider);
+      const msg = e instanceof Error ? e.message : String(e);
+      loginState.set(provider, { done: true, error: msg });
+      if (!urlResolved) reject(e);
+    });
   });
 }

package/src/oauth/key-providers.ts

@@ -1,11 +1,13 @@
 import type { OcxProviderConfig } from "../types";
 import { deriveKeyLoginMap, enrichProviderFromRegistry, type DerivedKeyLoginProvider } from "../providers/derive";
+import { resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 
 /**
  * API-key "login" providers: not OAuth — the flow opens the provider's dashboard so the user can
  * create/copy a key, then validates + stores it as the provider's `apiKey` (authMode "key").
  * Most use the OpenAI-compatible chat API (`openai-chat` adapter, `Authorization: Bearer <key>`); a
- * few expose only an Anthropic-compatible endpoint and set `adapter: "anthropic"` (`x-api-key`).
+ * few expose only an Anthropic-compatible endpoint and set `adapter: "anthropic"` (default
+ * `x-api-key`, optional bearer via `apiKeyTransport`).
  */
 export interface KeyLoginProvider extends DerivedKeyLoginProvider {}
 
@@ -29,23 +31,38 @@ export function listKeyLoginProviders(): Array<{ id: string } & KeyLoginProvider
   return Object.entries(KEY_LOGIN_PROVIDERS).map(([id, p]) => ({ id, ...p }));
 }
 
+function anthropicKeyValidationHeaders(provider: Pick<KeyLoginProvider, "apiKeyTransport">, key: string): HeadersInit {
+  return provider.apiKeyTransport === "bearer"
+    ? {
+      "Content-Type": "application/json",
+      "anthropic-version": "2023-06-01",
+      "Authorization": `Bearer ${key}`,
+    }
+    : {
+      "Content-Type": "application/json",
+      "anthropic-version": "2023-06-01",
+      "x-api-key": key,
+    };
+}
+
 /** Best-effort key validation. Returns true/false/unknown; never persists the key itself. */
-export async function validateApiKey(provider: KeyLoginProvider, key: string): Promise<boolean | "unknown"> {
+export async function validateApiKey(
+  providerName: string,
+  provider: KeyLoginProvider,
+  key: string,
+): Promise<boolean | "unknown"> {
   try {
     if (provider.adapter === "anthropic") {
       const base = provider.baseUrl.replace(/\/v1\/?$/, "");
       const res = await fetch(`${base}/v1/messages`, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "anthropic-version": "2023-06-01",
-          "x-api-key": key,
-        },
+        headers: anthropicKeyValidationHeaders(provider, key),
         body: JSON.stringify({
           model: provider.defaultModel ?? "claude-haiku-4-5",
           max_tokens: 1,
           messages: [{ role: "user", content: "ping" }],
         }),
+        redirect: "error",
         signal: AbortSignal.timeout(8000),
       });
       if (res.ok) return true;
@@ -58,6 +75,7 @@ export async function validateApiKey(provider: KeyLoginProvider, key: string): P
       // documented x-goog-api-key header instead (pageSize=1 — validation only needs a 200).
       const res = await fetch(`${provider.baseUrl}/v1beta/models?pageSize=1`, {
         headers: { "x-goog-api-key": key },
+        redirect: "error",
         signal: AbortSignal.timeout(8000),
       });
       if (res.ok) return true;
@@ -65,8 +83,20 @@ export async function validateApiKey(provider: KeyLoginProvider, key: string): P
       return "unknown";
     }
 
-    const res = await fetch(`${provider.baseUrl}/models`, {
+    const configuredProvider: OcxProviderConfig = {
+      adapter: provider.adapter,
+      baseUrl: provider.baseUrl,
+      authMode: "key",
+    };
+    const modelsUrl = resolveProviderModelDiscoveryUrl(
+      providerName,
+      configuredProvider,
+      provider.baseUrl,
+      `${provider.baseUrl}/models`,
+    );
+    const res = await fetch(modelsUrl, {
       headers: { Authorization: `Bearer ${key}` },
+      redirect: "error",
       signal: AbortSignal.timeout(8000),
     });
     if (res.ok) return true;