@bitkyc08/opencodex 2.84.0 → 2.86.0

package/src/lib/local-internal-call-capability.ts

@@ -0,0 +1,55 @@
+/**
+ * Process-local internal-call capability.
+ *
+ * Some requests ARE the proxy itself talking to its own data plane: the advisor sidecar's
+ * loopback consultation is the first user. Such a request must be recognized as INTERNAL without
+ * trusting anything the client controls. A client-supplied header value is not evidence — any
+ * external caller can send it — and neither is the peer address: a public listener reached
+ * through Docker, WSL, a tunnel, or port forwarding can present as loopback on the last hop, as
+ * the local-management attestation notes.
+ *
+ * The authority is therefore process-owned: a 256-bit random value minted once per process, kept
+ * in memory only. It is never written to config or disk, never logged, never returned by the
+ * management API, never placed in usage or request metadata, and never forwarded upstream. A new
+ * process mints a new value, so a token captured from an older process is worthless. Comparison
+ * is timing-safe and shape-checked, reusing the same secret shape as the local attestation
+ * module.
+ *
+ * The same primitive is what the vision-describe fence would need for the same reason; wiring
+ * that surface is deliberately left out of this change (recorded as a pre-existing analogous
+ * issue) so the change stays scoped.
+ */
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { isLocalAttestationSecret } from "./local-management-attestation";
+
+/** Header an internal sidecar presents on its own loopback request. */
+export const ADVISOR_INTERNAL_CAPABILITY_HEADER = "x-opencodex-advisor-internal";
+
+let processCapability: string | null = null;
+
+/**
+ * The current process's internal-call capability. Minted lazily on first use (one random draw,
+ * no I/O), so an install that never enables the advisor never generates one.
+ */
+export function internalCallCapability(): string {
+  if (processCapability === null) processCapability = randomBytes(32).toString("base64url");
+  return processCapability;
+}
+
+/** Test seam: install a deterministic value, or `null` to force a fresh mint. */
+export function setInternalCallCapabilityForTests(value: string | null): void {
+  processCapability = value;
+}
+
+/**
+ * True only when the supplied header value IS this process's capability. Shape-checked first so
+ * a malformed value cannot reach the comparison, then compared in constant time.
+ */
+export function isInternalCallCapability(supplied: string | null | undefined): boolean {
+  if (typeof supplied !== "string" || !isLocalAttestationSecret(supplied)) return false;
+  if (processCapability === null) return false;
+  const expected = processCapability;
+  const suppliedBytes = Buffer.from(supplied);
+  const expectedBytes = Buffer.from(expected);
+  return suppliedBytes.length === expectedBytes.length && timingSafeEqual(suppliedBytes, expectedBytes);
+}

package/src/lib/package-tree-integrity.ts

@@ -68,7 +68,7 @@ export interface PackageTreeIntegrityOptions {
 }
 
 export type ObservePackageTree = () => PackageTreeObservation | null;
-export type PackageTreeRuntimeInstall = "bun" | "mise" | "npm" | "pnpm" | "source";
+export type PackageTreeRuntimeInstall = "bun" | "mise" | "npm" | "pnpm" | "source" | "standalone";
 
 const packageManifestUrl = new URL("../../package.json", import.meta.url);
 
@@ -323,7 +323,7 @@ export function createRuntimePackageTreeIntegrityGuard(
   now: () => number = Date.now,
   options: PackageTreeIntegrityOptions = {},
   ): PackageTreeIntegrityGuard {
-    if (installer === "source" || isStandaloneBinary()) {
+    if (installer === "source" || installer === "standalone" || isStandaloneBinary()) {
       return { status: () => ({ ok: true }), dispose: () => {} };
     }
     // The restart replacement spawns process.execPath, the bundled Bun in an npm install. Read it

package/src/lib/socks5-fetch.ts

@@ -1,6 +1,7 @@
 import net, { type Socket } from "node:net";
 import tls, { type TLSSocket } from "node:tls";
 import { classifyContentCoding, isNullBodyStatus } from "./http-response-semantics";
+import { socks5Credentials, socks5Handshake, Socks5HandshakeError } from "./socks5-handshake";
 
 const DEFAULT_SOCKS5_PORT = 1080;
 const SOCKS5_CONNECT_TIMEOUT_MS = 30_000;
@@ -10,11 +11,6 @@ const MAX_BODY_SLICE_BYTES = 64 * 1024;
 const MAX_DECODED_BODY_BYTES = 32 * 1024 * 1024;
 const MAX_STREAM_DECODE_EXPANSION_RATIO = 128;
 const SOCKS5_VERSION = 0x05;
-const SOCKS5_NO_AUTH = 0x00;
-const SOCKS5_USER_PASS = 0x02;
-const SOCKS5_CONNECT = 0x01;
-const SOCKS5_DOMAIN = 0x03;
-const SOCKS5_SUCCESS = 0x00;
 const CRLF = Buffer.from("\r\n");
 const HEADER_END = Buffer.from("\r\n\r\n");
 
@@ -22,24 +18,6 @@ export class Socks5FetchError extends Error {
   override readonly name = "Socks5FetchError";
 }
 
-function proxyCredentials(proxy: URL): { username?: Uint8Array; password?: Uint8Array } {
-  if (!proxy.username && !proxy.password) return {};
-  let username: string;
-  let password: string;
-  try {
-    username = decodeURIComponent(proxy.username);
-    password = decodeURIComponent(proxy.password);
-  } catch {
-    throw new Socks5FetchError("SOCKS5 proxy credentials contain invalid percent encoding");
-  }
-  const usernameBytes = new TextEncoder().encode(username);
-  const passwordBytes = new TextEncoder().encode(password);
-  if (usernameBytes.byteLength > 255 || passwordBytes.byteLength > 255) {
-    throw new Socks5FetchError("SOCKS5 proxy credentials must each fit in 255 UTF-8 bytes");
-  }
-  return { username: usernameBytes, password: passwordBytes };
-}
-
 function validateProxy(proxy: string): URL {
   let parsed: URL;
   try {
@@ -55,7 +33,10 @@ function validateProxy(proxy: string): URL {
     throw new Socks5FetchError("SOCKS5 proxy port is invalid");
   }
   if (parsed.search || parsed.hash) throw new Socks5FetchError("SOCKS5 proxy URL must not contain a query or fragment");
-  proxyCredentials(parsed);
+  try { socks5Credentials(parsed); } catch (error) {
+    if (error instanceof Socks5HandshakeError) throw new Socks5FetchError(error.message);
+    throw error;
+  }
   return parsed;
 }
 
@@ -130,6 +111,14 @@ class SocketReader {
     socket.resume();
   }
 
+  write(bytes: Uint8Array): void {
+    this.socket.write(bytes);
+  }
+
+  readExact(bytes: number, signal?: AbortSignal): Promise<Buffer> {
+    return this.read(bytes, signal);
+  }
+
   private readonly onData = (chunk: Buffer | string): void => {
     const value = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
     if (this.anyWaiters.length > 0) {
@@ -263,7 +252,7 @@ class SocketReader {
 
 async function socks5Connect(proxy: string, target: URL, signal?: AbortSignal): Promise<Socket> {
   const parsedProxy = validateProxy(proxy);
-  const credentials = proxyCredentials(parsedProxy);
+  const credentials = socks5Credentials(parsedProxy);
   const proxyHost = parsedProxy.hostname.replace(/^\[|\]$/g, "");
   const socket = await connectSocket(proxyHost, Number(parsedProxy.port) || DEFAULT_SOCKS5_PORT, signal);
   socket.setTimeout(SOCKS5_CONNECT_TIMEOUT_MS, () => {
@@ -271,49 +260,12 @@ async function socks5Connect(proxy: string, target: URL, signal?: AbortSignal):
   });
   const reader = new SocketReader(socket);
   try {
-    const methods = credentials.username ? Buffer.from([SOCKS5_NO_AUTH, SOCKS5_USER_PASS]) : Buffer.from([SOCKS5_NO_AUTH]);
-    socket.write(Buffer.from([SOCKS5_VERSION, methods.byteLength, ...methods]));
-    const greeting = await reader.read(2, signal);
-    if (greeting[0] !== SOCKS5_VERSION) throw new Socks5FetchError("SOCKS5 proxy returned an invalid greeting");
-    if (greeting[1] === SOCKS5_USER_PASS && credentials.username && credentials.password) {
-      socket.write(Buffer.from([
-        0x01,
-        credentials.username.byteLength,
-        ...credentials.username,
-        credentials.password.byteLength,
-        ...credentials.password,
-      ]));
-      const auth = await reader.read(2, signal);
-      if (auth[0] !== 0x01 || auth[1] !== 0x00) throw new Socks5FetchError("SOCKS5 proxy authentication failed");
-    } else if (greeting[1] !== SOCKS5_NO_AUTH) {
-      throw new Socks5FetchError("SOCKS5 proxy does not accept an offered authentication method");
-    }
-
-    const hostname = new TextEncoder().encode(target.hostname);
-    if (hostname.byteLength > 255) throw new Socks5FetchError("SOCKS5 target hostname is too long");
-    const port = targetPort(target);
-    socket.write(Buffer.from([
-      SOCKS5_VERSION,
-      SOCKS5_CONNECT,
-      0x00,
-      SOCKS5_DOMAIN,
-      hostname.byteLength,
-      ...hostname,
-      port >> 8,
-      port & 0xff,
-    ]));
-    const reply = await reader.read(4, signal);
-    if (reply[0] !== SOCKS5_VERSION) throw new Socks5FetchError("SOCKS5 proxy returned an invalid connect response");
-    if (reply[1] !== SOCKS5_SUCCESS) throw new Socks5FetchError(`SOCKS5 proxy refused the connection (code ${reply[1]})`);
-    if (reply[2] !== 0x00 || ![0x01, SOCKS5_DOMAIN, 0x04].includes(reply[3]!)) {
-      throw new Socks5FetchError("SOCKS5 proxy returned an invalid address type or reserved byte");
-    }
-    const addressLength = reply[3] === 0x01 ? 4 : reply[3] === SOCKS5_DOMAIN ? (await reader.read(1, signal))[0]! : 16;
-    await reader.read(addressLength + 2, signal);
+    await socks5Handshake(reader, { host: target.hostname, port: targetPort(target) }, credentials, signal);
     socket.setTimeout(0);
     return socket;
   } catch (error) {
     socket.destroy();
+    if (error instanceof Socks5HandshakeError) throw new Socks5FetchError(error.message);
     throw error;
   } finally {
     reader.dispose();
@@ -341,25 +293,50 @@ function requestHeaders(request: Request, target: URL): { text: string; chunked:
 
 async function secureSocket(socket: Socket, target: URL, signal: AbortSignal): Promise<TLSSocket> {
   return new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      socket.destroy();
+      reject(signal.reason instanceof Error ? signal.reason : new Error("The operation was aborted"));
+      return;
+    }
     const tlsSocket = tls.connect({
       socket,
       servername: target.hostname,
       rejectUnauthorized: true,
     });
-    const onAbort = () => {
+    let settled = false;
+    // Absolute deadline: a peer sending occasional TLS bytes must not extend the handshake.
+    const timer = setTimeout(() => {
+      fail(new Socks5FetchError("SOCKS5 TLS handshake timed out"));
+    }, SOCKS5_CONNECT_TIMEOUT_MS);
+    const cleanup = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      tlsSocket.removeListener("secureConnect", onSecureConnect);
+      tlsSocket.removeListener("error", onError);
+      tlsSocket.removeListener("close", onClose);
+    };
+    const fail = (error: Error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      // No error argument: pending event observers must not receive a second error.
       tlsSocket.destroy();
-      reject(signal.reason instanceof Error ? signal.reason : new Error("The operation was aborted"));
+      reject(error);
     };
+    const onAbort = () => fail(signal.reason instanceof Error ? signal.reason : new Error("The operation was aborted"));
+    const onError = (error: Error) => fail(error);
+    const onClose = () => fail(new Socks5FetchError("SOCKS5 upstream closed during TLS handshake"));
     const onSecureConnect = () => {
-      signal.removeEventListener("abort", onAbort);
+      if (settled) return;
+      settled = true;
+      cleanup();
       resolve(tlsSocket);
     };
     tlsSocket.once("secureConnect", onSecureConnect);
-    tlsSocket.once("error", error => {
-      signal.removeEventListener("abort", onAbort);
-      reject(error);
-    });
+    tlsSocket.once("error", onError);
+    tlsSocket.once("close", onClose);
     signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) onAbort();
   });
 }
 

package/src/lib/socks5-handshake.ts

@@ -0,0 +1,112 @@
+/**
+ * The SOCKS5 handshake both raw outbound transports share: method negotiation
+ * (RFC 1928), the optional RFC 1929 username/password subnegotiation, and the
+ * CONNECT exchange.
+ *
+ * `src/lib/socks5-fetch.ts` (the HTTP tunnel) and
+ * `src/lib/desktop-upstream-tunnel.ts` (the native desktop relay's raw
+ * dial) each own their socket, their timeouts, and what happens after CONNECT;
+ * this module only frames bytes through the reader each hands it, so a
+ * credentialed `socks5://` proxy URL authenticates identically whether the caller
+ * is a fetch or a raw WebSocket upgrade. When the URL carries credentials the
+ * greeting offers NO-AUTH alongside USER-PASS, which keeps an unauthenticated
+ * proxy working for a caller that configured more than it needed.
+ */
+
+export class Socks5HandshakeError extends Error {
+  override readonly name = "Socks5HandshakeError";
+}
+
+const SOCKS5_VERSION = 0x05;
+const SOCKS5_NO_AUTH = 0x00;
+const SOCKS5_USER_PASS = 0x02;
+const SOCKS5_CONNECT = 0x01;
+const SOCKS5_DOMAIN = 0x03;
+const SOCKS5_SUCCESS = 0x00;
+
+/** RFC 1929 credentials decoded from the proxy URL, each bounded to one length byte. */
+export interface Socks5Credentials {
+  username?: Uint8Array;
+  password?: Uint8Array;
+}
+
+export function socks5Credentials(proxy: URL): Socks5Credentials {
+  if (!proxy.username && !proxy.password) return {};
+  let username: string;
+  let password: string;
+  try {
+    username = decodeURIComponent(proxy.username);
+    password = decodeURIComponent(proxy.password);
+  } catch {
+    throw new Socks5HandshakeError("SOCKS5 proxy credentials contain invalid percent encoding");
+  }
+  const usernameBytes = new TextEncoder().encode(username);
+  const passwordBytes = new TextEncoder().encode(password);
+  if (usernameBytes.byteLength > 255 || passwordBytes.byteLength > 255) {
+    throw new Socks5HandshakeError("SOCKS5 proxy credentials must each fit in 255 UTF-8 bytes");
+  }
+  return { username: usernameBytes, password: passwordBytes };
+}
+
+/**
+ * The slice of a transport's socket reader the handshake needs: exact-length reads
+ * that reject on close, on error, or on the transport's own timeout, plus writes.
+ * Bytes read past a step stay queued in the transport's reader; the handshake never
+ * touches the socket itself.
+ */
+export interface Socks5HandshakeReader {
+  write(bytes: Uint8Array): void;
+  readExact(bytes: number, signal?: AbortSignal): Promise<Uint8Array>;
+}
+
+export interface Socks5Target {
+  host: string;
+  port: number;
+}
+
+/** Negotiate methods, authenticate when the proxy picks USER-PASS, and CONNECT to `target`. */
+export async function socks5Handshake(
+  reader: Socks5HandshakeReader,
+  target: Socks5Target,
+  credentials: Socks5Credentials,
+  signal?: AbortSignal,
+): Promise<void> {
+  const hostBytes = Buffer.from(target.host, "utf8");
+  if (hostBytes.byteLength > 255) throw new Socks5HandshakeError("SOCKS5 target hostname is too long");
+  const methods = credentials.username ? [SOCKS5_NO_AUTH, SOCKS5_USER_PASS] : [SOCKS5_NO_AUTH];
+  reader.write(Buffer.from([SOCKS5_VERSION, methods.length, ...methods]));
+  const greeting = await reader.readExact(2, signal);
+  if (greeting[0] !== SOCKS5_VERSION) throw new Socks5HandshakeError("SOCKS5 proxy returned an invalid greeting");
+  if (greeting[1] === SOCKS5_USER_PASS && credentials.username && credentials.password) {
+    reader.write(Buffer.from([
+      0x01,
+      credentials.username.byteLength,
+      ...credentials.username,
+      credentials.password.byteLength,
+      ...credentials.password,
+    ]));
+    const auth = await reader.readExact(2, signal);
+    if (auth[0] !== 0x01 || auth[1] !== 0x00) throw new Socks5HandshakeError("SOCKS5 proxy authentication failed");
+  } else if (greeting[1] !== SOCKS5_NO_AUTH) {
+    throw new Socks5HandshakeError("SOCKS5 proxy does not accept an offered authentication method");
+  }
+
+  reader.write(Buffer.from([
+    SOCKS5_VERSION,
+    SOCKS5_CONNECT,
+    0x00,
+    SOCKS5_DOMAIN,
+    hostBytes.byteLength,
+    ...hostBytes,
+    target.port >> 8,
+    target.port & 0xff,
+  ]));
+  const reply = await reader.readExact(4, signal);
+  if (reply[0] !== SOCKS5_VERSION) throw new Socks5HandshakeError("SOCKS5 proxy returned an invalid connect response");
+  if (reply[1] !== SOCKS5_SUCCESS) throw new Socks5HandshakeError(`SOCKS5 proxy refused the connection (code ${reply[1]})`);
+  if (reply[2] !== 0x00 || ![0x01, SOCKS5_DOMAIN, 0x04].includes(reply[3]!)) {
+    throw new Socks5HandshakeError("SOCKS5 proxy returned an invalid address type or reserved byte");
+  }
+  const addressLength = reply[3] === 0x01 ? 4 : reply[3] === SOCKS5_DOMAIN ? (await reader.readExact(1, signal))[0]! : 16;
+  await reader.readExact(addressLength + 2, signal);
+}

package/src/lib/translator-budget.ts

@@ -1,3 +1,5 @@
+import { isNonReplayableResponse, markResponseNonReplayable } from "./upstream-retry";
+
 export const TRANSLATOR_MAX_CALL_ARGUMENT_BYTES = 2 * 1024 * 1024;
 export const TRANSLATOR_MAX_TURN_BYTES = 32 * 1024 * 1024;
 export const TRANSLATOR_MAX_SSE_EVENT_BYTES = 32 * 1024 * 1024;
@@ -410,5 +412,9 @@ export function finalizeTranslatorBudgetResponse(response: Response, budget: Tra
   });
   if (signal?.aborted) finalize();
   else signal?.addEventListener("abort", finalize, { once: true });
-  return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+  const finalizedResponse = new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+  // The rebuild above drops identity markers. A refusal that must not be replayed
+  // stays non-replayable through accounting finalization.
+  if (isNonReplayableResponse(response)) markResponseNonReplayable(finalizedResponse);
+  return finalizedResponse;
 }

package/src/oauth/generic-account-failover.ts

@@ -41,6 +41,7 @@ import type { KiroRefusalKind } from "../adapters/kiro-refusal";
 import { kiroAccountEvidence } from "../providers/kiro-usage";
 import { kiroEvidenceIdentity } from "../providers/kiro-account-state-disk";
 import { kiroAccountSupportsModel } from "../providers/kiro-model-catalog";
+import { antigravityAccountSupportsModel } from "../providers/antigravity-account-roster";
 import { ACCOUNT_QUOTA_TTL_MS } from "../providers/quota-wire";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { subscribeOAuthAccountPauseChanges } from "../lib/account-selection-events";
@@ -248,11 +249,31 @@ export function eligibleFailoverAccounts(providerName: string, now = Date.now(),
   return eligibleIdsIn(getAccountSet(providerName), providerName, now, family);
 }
 
-/** Model evidence only ranks accounts already eligible and below any configured cap. */
+/** Whether an account's own model listing includes `model`; undefined when unknown. */
+function accountListsModel(providerName: string, accountId: string, model: string): boolean | undefined {
+  if (providerName === "kiro") return kiroAccountSupportsModel(accountId, model);
+  if (providerName === "google-antigravity") return antigravityAccountSupportsModel(providerName, accountId, model);
+  return undefined;
+}
+
+/**
+ * Model evidence only ranks accounts already eligible and below any configured cap.
+ *
+ * Kiro and Antigravity both gate models per account. For Antigravity (Claude 4.6 vs 5.5, Argon)
+ * an account whose discovered roster lists the model wins; an account whose roster omits it is
+ * skipped while any other remains; an account with no roster yet is unknown and stays usable.
+ */
 export function preferKiroModelSupport(
   providerName: string, ids: string[], model?: string | null, config?: OcxConfig,
 ): string[] {
-  if (providerName !== "kiro" || !model) return ids;
+  if (!model) return ids;
+  if (providerName === "google-antigravity") {
+    const positive = ids.filter(id => accountListsModel(providerName, id, model) === true);
+    if (positive.length) return positive;
+    const notListedAgainst = ids.filter(id => accountListsModel(providerName, id, model) !== false);
+    return notListedAgainst.length ? notListedAgainst : ids;
+  }
+  if (providerName !== "kiro") return ids;
   const cap = config?.providers?.kiro?.oauthAccountFailover?.maxConcurrentPerAccount;
   const withRoom = typeof cap === "number" && Number.isInteger(cap) && cap >= 1 && cap <= 100
     ? ids.filter(id => accountInFlight("kiro", id) < cap) : ids;
@@ -631,10 +652,13 @@ export function preferredInitialAccount(
   const modelEligible = preferKiroModelSupport(providerName,
     eligibleFailoverAccounts(providerName, now, classifyModelFamilyForQuota(providerName, requestedModelId)),
     requestedModelId, config);
-  const activeLacks = providerName === "kiro" && !!active && !!requestedModelId
-    && kiroAccountSupportsModel(active, requestedModelId) === false;
+  const activeLacks = (providerName === "kiro" || providerName === "google-antigravity")
+    && !!active && !!requestedModelId
+    && accountListsModel(providerName, active, requestedModelId) === false;
   const listingSibling = activeLacks
-    ? modelEligible.find(id => id !== active && kiroModelListingHasRoom(config, id, requestedModelId!))
+    ? modelEligible.find(id => id !== active && (providerName === "kiro"
+      ? kiroModelListingHasRoom(config, id, requestedModelId!)
+      : accountListsModel(providerName, id, requestedModelId!) === true))
     : undefined;
   if (listingSibling) return listingSibling;
 

package/src/oauth/index.ts

@@ -49,7 +49,7 @@ import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUr
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
 import { loginMetaMuse, refreshMetaMuseToken } from "./meta-muse";
 import { loginOrcaRouter, orcaRouterInferenceBaseUrl, refreshOrcaRouterKey } from "./orcarouter";
-import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
+import { ANTIGRAVITY_DISCOVERY_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
 import { effectiveGoogleMode, getProviderRegistryEntry, mergeRegistryStaticHeaders, providerMatchesRegistryTransport } from "../providers/registry";
@@ -1161,7 +1161,9 @@ export function buildModelsRequest(
   if (effectiveGoogleMode(providerName, effectiveProvider) === "cloud-code-assist") {
     headers.Accept = "application/json";
     headers["Content-Type"] = "application/json";
-    headers["User-Agent"] = ANTIGRAVITY_REQUEST_UA;
+    // CLI UA: CCA lists Gemini 4 Argon's wire ids only to the CLI client family. Inference keeps
+    // choosing per wire model (antigravityUserAgentForWireModel).
+    headers["User-Agent"] = ANTIGRAVITY_DISCOVERY_UA;
     if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
     return guarded({
       method: "POST" as const,

package/src/oauth/kiro-device-login.ts

@@ -250,9 +250,10 @@ async function poll(flow: Flow, principal: KiroDevicePrincipal): Promise<KiroDev
       if (data.status === "authorization_pending") return publicView(flow);
       if (data.status === "expired_token" || data.status === "expired") return terminal(flow, "expired");
     }
+    // The social poll reports a completed grant as status "authorized"; "approved" is kept as an alias.
     if (result.status !== 200 || Object.hasOwn(data, "error") || error || (builder && (data.status !== undefined || !positive(data.expiresIn) || !isStorableKiroClientPart(flow.clientId)
       || !isStorableKiroClientPart(flow.clientSecret)))
-      || (!builder && (data.status !== undefined && data.status !== "approved"))) return terminal(flow, "failed");
+      || (!builder && (data.status !== undefined && data.status !== "authorized" && data.status !== "approved"))) return terminal(flow, "failed");
     if (!code(data.accessToken) || !code(data.refreshToken)
       || (!builder && (typeof data.profileArn !== "string" || !PROFILE_ARN.test(data.profileArn)))) return terminal(flow, "failed");
     const credential: OAuthCredentials = {

package/src/oauth/kiro.ts

@@ -45,6 +45,10 @@ const KIRO_TERMINAL_REFRESH_ERRORS = new Set([
   "access_denied",
   "expired_token",
 ]);
+// The desktop refresh endpoint rejects a dead refresh token with HTTP 401 and a bare
+// `{"message":"Bad credentials"}` body, without an OAuth `error` code. Only that exact
+// pair is a terminal verdict; it is surfaced under this fixed code, never the raw text.
+const KIRO_DESKTOP_BAD_CREDENTIALS = "bad_credentials";
 
 interface ImportedKiroToken {
   access: string;
@@ -545,12 +549,14 @@ async function kiroTokenRefreshError(response: Response, awsSsoRefresh = false):
   let oauthError: string | undefined;
   let refreshAttention = false;
   try {
-    const payload = await response.json() as { error?: unknown };
+    const payload = await response.json() as { error?: unknown; message?: unknown };
     // This input-error code is attention evidence only for our AWS SSO refresh request,
     // never a terminal grant verdict. Do not surface arbitrary upstream descriptions.
     refreshAttention = awsSsoRefresh && response.status === 400 && payload.error === "invalid_request";
     if (typeof payload.error === "string" && KIRO_TERMINAL_REFRESH_ERRORS.has(payload.error)) {
       oauthError = payload.error;
+    } else if (!awsSsoRefresh && response.status === 401 && payload.message === "Bad credentials") {
+      oauthError = KIRO_DESKTOP_BAD_CREDENTIALS;
     }
   } catch {
     // Error bodies are untrusted and intentionally excluded from the surfaced message.