@coseung2/opencodex 2.8.0-cs.15 → 2.8.0-cs.17

package/src/oauth/kiro.ts

@@ -27,6 +27,7 @@ import {
   type KiroImportDiagnostic,
 } from "./kiro-credentials";
 import { homedir } from "node:os";
+import { KIRO_BUILDER_ID_SERVICE_PROFILE_ARN } from "../adapters/kiro-constants";
 import { getAccountSet, saveAccountCredential } from "./store";
 
 const DEFAULT_REGION = "us-east-1";
@@ -172,13 +173,37 @@ async function defaultKiroCliRunner(args: string[], signal?: AbortSignal): Promi
   }
 }
 
-async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string }> {
+/** Kiro profile ARN structure: arn:<partition>:codewhisperer:<region>:<account>:profile/<id> */
+const KIRO_PROFILE_ARN_PATTERN = /^arn:[a-z0-9-]+:codewhisperer:[a-z0-9-]+:\d{12}:profile\/[A-Za-z0-9-]+$/;
+const KIRO_PROFILE_ARN_MAX_LENGTH = 256;
+
+function parseKiroProfileArn(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || trimmed.length > KIRO_PROFILE_ARN_MAX_LENGTH) return undefined;
+  return KIRO_PROFILE_ARN_PATTERN.test(trimmed) ? trimmed : undefined;
+}
+
+function profileArnFromWhoami(parsed: Record<string, unknown>): string | undefined {
+  // Only narrowly-named documented-ish shapes; never invent an ARN (#993).
+  return parseKiroProfileArn(parsed.profileArn)
+    ?? parseKiroProfileArn(parsed.profile_arn)
+    ?? (parsed.profile && typeof parsed.profile === "object" && !Array.isArray(parsed.profile)
+      ? parseKiroProfileArn((parsed.profile as Record<string, unknown>).arn)
+      : undefined);
+}
+
+async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string; profileArn?: string }> {
   try {
     const result = await runner(["whoami", "--format", "json"], signal);
     if (result.exitCode !== 0) return {};
-    const parsed = JSON.parse(result.stdout) as { email?: unknown };
+    const parsed = JSON.parse(result.stdout) as Record<string, unknown>;
     const email = typeof parsed.email === "string" ? parsed.email.trim().toLowerCase() : "";
-    return email && email.length <= 320 ? { email } : {};
+    const profileArn = profileArnFromWhoami(parsed);
+    return {
+      ...(email && email.length <= 320 ? { email } : {}),
+      ...(profileArn ? { profileArn } : {}),
+    };
   } catch {
     return {};
   }
@@ -191,6 +216,7 @@ function metadataFromImported(imported: ImportedKiroCredential): KiroOAuthMetada
     ...(imported.apiRegion ? { apiRegion: imported.apiRegion } : {}),
     ...(imported.clientId ? { clientId: imported.clientId } : {}),
     ...(imported.clientSecret ? { clientSecret: imported.clientSecret } : {}),
+    ...(imported.authType ? { authType: imported.authType } : {}),
   };
   return Object.keys(metadata).length > 0 ? metadata : undefined;
 }
@@ -251,14 +277,34 @@ async function oauthCredentialFromImported(
   runner: KiroCliRunner,
   signal?: AbortSignal,
 ): Promise<OAuthCredentials> {
-  const identity = imported.source === "sqlite" ? await readKiroCliIdentity(runner, signal) : {};
-  const metadata = metadataFromImported(imported);
+  let identity: { email?: string; profileArn?: string } = {};
+  if (imported.source === "sqlite") {
+    identity = await readKiroCliIdentity(runner, signal);
+    // Session-switch race (#993 review): another process may have switched the
+    // active Kiro CLI session between the SQLite read and whoami. Accept
+    // whoami's identity only when the session token STILL matches the import —
+    // refresh token, or access token when refresh is absent.
+    if (identity.profileArn !== undefined || identity.email !== undefined) {
+      const current = readKiroCliSqliteCredential();
+      const importedKey = imported.refresh || imported.access;
+      const currentKey = current ? current.refresh || current.access : "";
+      if (!current || currentKey !== importedKey) identity = {};
+    }
+  }
+  // Builder ID imports often lack a profileArn in SQLite; whoami against the
+  // SAME active CLI session can supply it (#993). Imported stays authoritative.
+  const resolvedProfileArn = imported.profileArn ?? identity.profileArn;
+  const metadata: KiroOAuthMetadata | undefined = (() => {
+    const base = metadataFromImported(imported) ?? {};
+    if (resolvedProfileArn && !base.profileArn) base.profileArn = resolvedProfileArn;
+    return Object.keys(base).length > 0 ? base : undefined;
+  })();
   return {
     access: imported.access,
     refresh: imported.refresh,
     expires: imported.expires,
     source: imported.source === "json" ? "credential-file" : "local-cli",
-    ...(imported.profileArn ? { accountId: imported.profileArn } : {}),
+    ...(resolvedProfileArn ? { accountId: resolvedProfileArn } : {}),
     ...(identity.email ? { email: identity.email } : {}),
     ...(metadata ? { kiro: metadata } : {}),
   };
@@ -429,6 +475,25 @@ export function resolveKiroProfileArn(account?: Pick<KiroOAuthMetadata, "profile
   return readImportedKiroCredential()?.profileArn;
 }
 
+/** Request profile and envelope choice are one decision; a fallback is never account identity. */
+export function resolveKiroRequestProfile(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): { profileArn: string | undefined; builderIdFallback: boolean } {
+  const own = resolveKiroProfileArn(account);
+  if (own) return { profileArn: own, builderIdFallback: false };
+  // An explicitly selected account must never borrow a different active local CLI account.
+  const authType = account === undefined ? readImportedKiroCredential()?.authType : account.authType;
+  return authType === "aws_sso_oidc"
+    ? { profileArn: KIRO_BUILDER_ID_SERVICE_PROFILE_ARN, builderIdFallback: true }
+    : { profileArn: undefined, builderIdFallback: false };
+}
+
+export function resolveKiroRequestProfileArn(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): string | undefined {
+  return resolveKiroRequestProfile(account).profileArn;
+}
+
 async function kiroTokenRefreshError(response: Response): Promise<KiroTokenRefreshError> {
   let oauthError: string | undefined;
   try {

package/src/oauth/store.ts

@@ -247,13 +247,15 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
     const apiRegion = clean(kiro.apiRegion, 64);
     const clientId = clean(kiro.clientId, 4096);
     const clientSecret = clean(kiro.clientSecret, 4096);
-    if (profileArn || ssoRegion || apiRegion || clientId || clientSecret) {
+    const authType = kiro.authType === "aws_sso_oidc" || kiro.authType === "kiro_desktop" ? kiro.authType : undefined;
+    if (profileArn || ssoRegion || apiRegion || clientId || clientSecret || authType) {
       normalized.kiro = {
         ...(profileArn ? { profileArn } : {}),
         ...(ssoRegion ? { ssoRegion } : {}),
         ...(apiRegion ? { apiRegion } : {}),
         ...(clientId ? { clientId } : {}),
         ...(clientSecret ? { clientSecret } : {}),
+        ...(authType ? { authType } : {}),
       };
     }
   }

package/src/oauth/types.ts

@@ -1,6 +1,8 @@
 /** Minimal OAuth types, ported from jawcode packages/ai/src/utils/oauth/types.ts. */
 export type OAuthCredentialSource = "oauth" | "local-cli" | "credential-file" | "environment" | "manual";
 
+export type KiroCredentialAuthType = "kiro_desktop" | "aws_sso_oidc";
+
 /** Account-scoped Kiro data required for refresh and request routing. */
 export interface KiroOAuthMetadata {
   profileArn?: string;
@@ -8,6 +10,8 @@ export interface KiroOAuthMetadata {
   apiRegion?: string;
   clientId?: string;
   clientSecret?: string;
+  /** Non-secret request-routing signal; never substitute for an account profile. */
+  authType?: KiroCredentialAuthType;
 }
 
 export type OAuthCredentials = {

package/src/providers/derive.ts

@@ -239,15 +239,17 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (!prov.models && seed.models) prov.models = [...seed.models];
   if (prov.liveModels === undefined && seed.liveModels !== undefined) prov.liveModels = seed.liveModels;
   if (prov.contextWindow === undefined && seed.contextWindow !== undefined) prov.contextWindow = seed.contextWindow;
-  if (!prov.modelContextWindows && seed.modelContextWindows) prov.modelContextWindows = { ...seed.modelContextWindows };
+  if (seed.modelContextWindows) prov.modelContextWindows = { ...seed.modelContextWindows, ...prov.modelContextWindows };
   if (seed.modelInputModalities) prov.modelInputModalities = fillRecordOfArrays(seed.modelInputModalities, prov.modelInputModalities);
   if (prov.defaultMaxOutputTokens === undefined && seed.defaultMaxOutputTokens !== undefined) prov.defaultMaxOutputTokens = seed.defaultMaxOutputTokens;
-  if (!prov.modelMaxOutputTokens && seed.modelMaxOutputTokens) prov.modelMaxOutputTokens = { ...seed.modelMaxOutputTokens };
+  if (seed.modelMaxOutputTokens) prov.modelMaxOutputTokens = { ...seed.modelMaxOutputTokens, ...prov.modelMaxOutputTokens };
   if (!prov.reasoningEfforts && seed.reasoningEfforts) prov.reasoningEfforts = [...seed.reasoningEfforts];
-  if (!prov.modelReasoningEfforts && seed.modelReasoningEfforts) prov.modelReasoningEfforts = cloneRecordOfArrays(seed.modelReasoningEfforts);
-  if (!prov.modelDefaultReasoningEfforts && seed.modelDefaultReasoningEfforts) prov.modelDefaultReasoningEfforts = { ...seed.modelDefaultReasoningEfforts };
+  // One customized model must not hide the registry's knowledge of every other
+  // model. Fill per key on new maps; explicit empty ladders remain authoritative.
+  if (seed.modelReasoningEfforts) prov.modelReasoningEfforts = fillRecordOfArrays(seed.modelReasoningEfforts, prov.modelReasoningEfforts);
+  if (seed.modelDefaultReasoningEfforts) prov.modelDefaultReasoningEfforts = { ...seed.modelDefaultReasoningEfforts, ...prov.modelDefaultReasoningEfforts };
   if (!prov.reasoningEffortMap && seed.reasoningEffortMap) prov.reasoningEffortMap = { ...seed.reasoningEffortMap };
-  if (!prov.modelReasoningEffortMap && seed.modelReasoningEffortMap) prov.modelReasoningEffortMap = cloneNestedRecord(seed.modelReasoningEffortMap);
+  if (seed.modelReasoningEffortMap) prov.modelReasoningEffortMap = { ...cloneNestedRecord(seed.modelReasoningEffortMap), ...cloneNestedRecord(prov.modelReasoningEffortMap ?? {}) };
   if (!prov.noVisionModels && seed.noVisionModels) prov.noVisionModels = [...seed.noVisionModels];
   if (!prov.noReasoningModels && seed.noReasoningModels) prov.noReasoningModels = [...seed.noReasoningModels];
   if (!prov.noTemperatureModels && seed.noTemperatureModels) prov.noTemperatureModels = [...seed.noTemperatureModels];

package/src/providers/opencode-go-transport.ts

@@ -0,0 +1,59 @@
+import { createHash } from "node:crypto";
+import type { OcxProviderConfig } from "../types";
+import { registryEntryForProviderDestination } from "./registry";
+
+export const OPENCODE_GO_SESSION_HEADER = "x-opencode-session";
+
+const MUSE_RESPONSE_MODELS = new Set(["muse-spark-1.2-contributor", "muse-spark-1.3-contributor"]);
+const MUSE_RESPONSE_URLS = new Set([
+  "https://opencode.ai/zen/v1/responses",
+  "https://opencode.ai/zen/go/v1/responses",
+]);
+
+/** Compatibility belongs to the exact model AND effective destination, not a provider label. */
+export function isOpenCodeMuseResponses(modelId: unknown, responseUrl: string): boolean {
+  if (typeof modelId !== "string" || !MUSE_RESPONSE_MODELS.has(modelId.trim().toLowerCase())) return false;
+  try {
+    const url = new URL(responseUrl);
+    if (url.username || url.password || url.search || url.hash) return false;
+    return MUSE_RESPONSE_URLS.has(`${url.origin.toLowerCase()}${url.pathname.replace(/\/+$/, "")}`);
+  } catch {
+    return false;
+  }
+}
+
+function hasHeaderCaseInsensitive(
+  headers: Record<string, string> | undefined,
+  name: string,
+): boolean {
+  const target = name.toLowerCase();
+  return Object.keys(headers ?? {}).some(key => key.toLowerCase() === target);
+}
+
+/** Derive a provider-scoped opaque value without exposing Codex task or subagent ids. */
+export function deriveOpenCodeGoSessionId(sessionLane: string): string {
+  const digest = createHash("sha256")
+    .update("opencodex/opencode-go/session/v1\0")
+    .update(sessionLane)
+    .digest("hex")
+    .slice(0, 32);
+  return `ocx_${digest}`;
+}
+
+/** Add per-conversation Go affinity only to the canonical fixed-key destination. */
+export function resolveOpenCodeGoTransport<T extends OcxProviderConfig>(
+  provider: T,
+  sessionLane: string | undefined,
+): T {
+  if (registryEntryForProviderDestination(provider)?.id !== "opencode-go") return provider;
+  if (!sessionLane) return provider;
+  if (hasHeaderCaseInsensitive(provider.headers, OPENCODE_GO_SESSION_HEADER)) return provider;
+
+  return {
+    ...provider,
+    headers: {
+      ...(provider.headers ?? {}),
+      [OPENCODE_GO_SESSION_HEADER]: deriveOpenCodeGoSessionId(sessionLane),
+    },
+  };
+}

package/src/providers/quota.ts

@@ -992,6 +992,22 @@ function opencodeGoSegments(api: NonNullable<Awaited<ReturnType<typeof fetchOpen
   return segments;
 }
 
+function opencodeGoQuotaFromSegments(
+  segments: NonNullable<ProviderQuotaWindow["segments"]>,
+  now: number,
+): ProviderQuota | null {
+  if (segments.length === 0) return null;
+  return {
+    customWindows: [{
+      // Row label intentionally empty: the segments carry their own labels.
+      label: "",
+      percent: 0,
+      segments,
+    }],
+    updatedAt: now,
+  };
+}
+
 /**
  * opencode.go allocation: prefer the key-scoped usage endpoint (exact console
  * percents + real reset times); fall back to the local request-count estimate
@@ -1001,18 +1017,8 @@ async function fetchOpencodeGoQuota(name: string, config: OcxProviderConfig): Pr
   const activeKey = resolveEnvValue(config.apiKey)?.trim() ?? config.apiKey;
   const api = await fetchOpencodeGoUsageApi(activeKey).catch(() => null);
   if (api) {
-    const segments = opencodeGoSegments(api);
-    if (segments.length > 0) {
-      return report(name, "opencode-go:usage-api", {
-        customWindows: [{
-          // Row label intentionally empty: the segments carry their own labels.
-          label: "",
-          percent: 0,
-          segments,
-        }],
-        updatedAt: Date.now(),
-      });
-    }
+    const quota = opencodeGoQuotaFromSegments(opencodeGoSegments(api), Date.now());
+    if (quota) return report(name, "opencode-go:usage-api", quota);
   }
 
   // Fallback: dominant model's local request counts against published limits.
@@ -1023,36 +1029,30 @@ async function fetchOpencodeGoQuota(name: string, config: OcxProviderConfig): Pr
   if (!dominant) return null;
   const { fiveHour, weekly, monthly } = OPENCODE_GO_LIMITS[dominant]!;
   const now = Date.now();
-  return report(name, "opencode-go:docs-estimate", {
-    customWindows: [{
-      label: "",
-      percent: 0,
-      segments: [
-        {
-          label: "5h",
-          percent: normalizePercent(((estimate.fiveHourCounts.get(dominant) ?? 0) / fiveHour) * 100) ?? 0,
-          resetAt: now + OPENCODE_GO_FIVE_HOUR_MS,
-        },
-        {
-          label: "Weekly",
-          percent: normalizePercent(((estimate.weeklyCounts.get(dominant) ?? 0) / weekly) * 100) ?? 0,
-          resetAt: now + OPENCODE_GO_WEEK_MS,
-        },
-        {
-          label: "Monthly",
-          percent: normalizePercent(((estimate.monthlyCounts.get(dominant) ?? 0) / monthly) * 100) ?? 0,
-          resetAt: now + OPENCODE_GO_COST_WINDOW_MS,
-        },
-      ],
-    }],
-    updatedAt: now,
-  });
+  const quota = opencodeGoQuotaFromSegments([
+    {
+      label: "5h",
+      percent: normalizePercent(((estimate.fiveHourCounts.get(dominant) ?? 0) / fiveHour) * 100) ?? 0,
+      resetAt: now + OPENCODE_GO_FIVE_HOUR_MS,
+    },
+    {
+      label: "Weekly",
+      percent: normalizePercent(((estimate.weeklyCounts.get(dominant) ?? 0) / weekly) * 100) ?? 0,
+      resetAt: now + OPENCODE_GO_WEEK_MS,
+    },
+    {
+      label: "Monthly",
+      percent: normalizePercent(((estimate.monthlyCounts.get(dominant) ?? 0) / monthly) * 100) ?? 0,
+      resetAt: now + OPENCODE_GO_COST_WINDOW_MS,
+    },
+  ], now);
+  return quota ? report(name, "opencode-go:docs-estimate", quota) : null;
 }
 
 /**
- * Per-key monthly-allocation percent for every connected key: the usage endpoint
- * answers per key, so each pool key reports its own real monthly percent. Keys the
- * endpoint rejects fall back to the local 30-day request estimate.
+ * Per-key 5h/weekly/monthly allocation for every connected key. The usage
+ * endpoint is key-scoped, so each pool key reports its own live windows. Keys
+ * the endpoint rejects fall back to the local request-count estimate.
  */
 export async function opencodeGoKeyQuotaEstimates(config: OcxConfig, name: string): Promise<Record<string, ProviderQuota> | null> {
   const provider = config.providers[name];
@@ -1064,40 +1064,48 @@ export async function opencodeGoKeyQuotaEstimates(config: OcxConfig, name: strin
   const now = Date.now();
   const out: Record<string, ProviderQuota> = {};
   const pool = provider.apiKeyPool ?? [];
+  const activeKey = resolveEnvValue(provider.apiKey)?.trim() ?? provider.apiKey;
+  const activeKeyId = activeKey ? pool.find(entry => entry.key === activeKey)?.id : undefined;
   if (pool.length > 0) {
     const results = await Promise.all(pool.map(async entry => {
       const api = await fetchOpencodeGoUsageApi(entry.key).catch(() => null);
-      return [entry.id, api?.monthly] as const;
+      return [entry.id, api] as const;
     }));
-    for (const [keyId, monthly] of results) {
-      if (monthly?.percent === undefined) continue;
-      out[keyId] = {
-        customWindows: [{
-          label: "월간 할당",
-          percent: monthly.percent,
-          ...(monthly.resetAt !== undefined ? { resetAt: monthly.resetAt } : {}),
-        }],
-        updatedAt: now,
-      };
+    for (const [keyId, api] of results) {
+      if (!api) continue;
+      const quota = opencodeGoQuotaFromSegments(opencodeGoSegments(api), now);
+      if (quota) out[keyId] = quota;
     }
   }
   // Fallback for keys the endpoint did not answer.
   const estimate = estimateOpencodeGoUsage(name, provider);
   if (estimate) {
     const dominant = [...estimate.monthlyCounts.entries()]
-      .sort((a, b) => b[1] - a[1])[0]?.[0];
+      .sort((a, b) => b[1] - a[1] || (estimate.weeklyCounts.get(b[0]) ?? 0) - (estimate.weeklyCounts.get(a[0]) ?? 0))[0]?.[0];
     if (dominant) {
-      const monthlyLimit = OPENCODE_GO_LIMITS[dominant]!.monthly;
+      const limits = OPENCODE_GO_LIMITS[dominant]!;
       for (const [keyId, count] of estimate.perKeyMonthlyCounts) {
         if (out[keyId]) continue;
-        out[keyId] = {
-          customWindows: [{
-            label: "월간 할당",
-            percent: normalizePercent((count / monthlyLimit) * 100) ?? 0,
-            resetAt: now + OPENCODE_GO_COST_WINDOW_MS,
-          }],
-          updatedAt: now,
-        };
+        const segments: NonNullable<ProviderQuotaWindow["segments"]> = [];
+        if (keyId === activeKeyId) {
+          segments.push({
+            label: "5h",
+            percent: normalizePercent(((estimate.fiveHourCounts.get(dominant) ?? 0) / limits.fiveHour) * 100) ?? 0,
+            resetAt: now + OPENCODE_GO_FIVE_HOUR_MS,
+          });
+          segments.push({
+            label: "Weekly",
+            percent: normalizePercent(((estimate.weeklyCounts.get(dominant) ?? 0) / limits.weekly) * 100) ?? 0,
+            resetAt: now + OPENCODE_GO_WEEK_MS,
+          });
+        }
+        segments.push({
+          label: "Monthly",
+          percent: normalizePercent((count / limits.monthly) * 100) ?? 0,
+          resetAt: now + OPENCODE_GO_COST_WINDOW_MS,
+        });
+        const quota = opencodeGoQuotaFromSegments(segments, now);
+        if (quota) out[keyId] = quota;
       }
     }
   }

package/src/providers/registry.ts

@@ -29,7 +29,12 @@ export type InboundWire = "responses" | "chat" | "anthropic";
  * A per-model wire default: a bare string applies to every inbound, while the object
  * form applies only to the listed inbound protocols.
  */
-export type ModelWireDefault = string | { wire: string; inbound: readonly InboundWire[] };
+export type ModelWireDefault = string | {
+  wire: string;
+  inbound: readonly InboundWire[];
+  /** Optional auth-mode gate for providers whose subscription and API-key products use different wires. */
+  authModes?: readonly ProviderAuthKind[];
+};
 
 export type ProviderModelDiscoveryScalar = string | number | boolean;
 
@@ -700,6 +705,13 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // transport returns 400 ("Multi Agent requests are not allowed on chat completions").
     models: ["grok-4.6", "grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning", "grok-4.20-0309-non-reasoning", "grok-build-0.1", "grok-composer-2.5-fast"],
     defaultModel: "grok-4.5",
+    // Grok's subscription gateway exposes 4.6/4.5 natively on Responses. Scope the default to
+    // OAuth Codex traffic: API-key and Chat/Anthropic callers keep their existing wire, while an
+    // explicit modelAdapters override still wins over this registry-only default.
+    modelWireDefaults: {
+      "grok-4.6": { wire: "openai-responses", inbound: ["responses"], authModes: ["oauth"] },
+      "grok-4.5": { wire: "openai-responses", inbound: ["responses"], authModes: ["oauth"] },
+    },
     // Vision lineup per docs.x.ai model-capabilities/images/understanding: the grok-4.x chat
     // models accept image input (JPEG/PNG, URL or base64). Without this the catalog leaves
     // inputModalities undefined, and deriveComboCatalogModel defaults an undefined member to
@@ -808,6 +820,9 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // catalog authoritative so a spurious 2xx from runtime.../models cannot drop seeded ids
     // (e.g. newly listed GPT-5.6 tiers) via live-discovery reconciliation.
     liveModels: false,
+    // Kiro rejects request-level parallel tool calls; keep persisted presets and the Codex
+    // catalog aligned with the adapter's single-call capability guard.
+    parallelToolCalls: false,
     // Per-model context metadata is maintained next to the Kiro model list.
     modelContextWindows: KIRO_MODEL_CONTEXT_WINDOWS,
     modelReasoningEfforts: KIRO_MODEL_REASONING_EFFORTS,
@@ -821,16 +836,20 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     featured: true,
     dashboardUrl: "https://platform.openai.com/api-keys",
     defaultModel: "gpt-5.5",
-    models: ["gpt-5.5", ...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS],
+    models: ["gpt-5.5", ...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS, "gpt-6-astra"],
     liveModels: true,
-    modelContextWindows: OPENAI_API_GPT56_CONTEXT_WINDOWS,
-    modelMaxInputTokens: OPENAI_API_GPT56_MAX_INPUT_TOKENS,
+    // API limits differ from the Codex-login Astra pin. Keep the public API ladder
+    // separate: low..max is documented, while the native catalog also carries ultra.
+    modelContextWindows: { ...OPENAI_API_GPT56_CONTEXT_WINDOWS, "gpt-6-astra": 1_050_000 },
+    modelMaxInputTokens: { ...OPENAI_API_GPT56_MAX_INPUT_TOKENS, "gpt-6-astra": 922_000 },
+    modelMaxOutputTokens: { "gpt-6-astra": 128_000 },
     modelInputModalities: Object.fromEntries(
-      ["gpt-5.5", ...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS].map(id => [id, ["text", "image"]]),
-    ),
-    modelReasoningEfforts: Object.fromEntries(
-      [...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS].map(id => [id, OPENAI_API_GPT56_REASONING_EFFORTS]),
+      ["gpt-5.5", ...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS, "gpt-6-astra"].map(id => [id, ["text", "image"]]),
     ),
+    modelReasoningEfforts: {
+      ...Object.fromEntries([...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS].map(id => [id, OPENAI_API_GPT56_REASONING_EFFORTS])),
+      "gpt-6-astra": ["low", "medium", "high", "xhigh", "max"],
+    },
     virtualModels: OPENAI_API_GPT56_VIRTUAL_MODELS,
   },
   {
@@ -862,13 +881,21 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     id: "opencode-go", label: "opencode go", adapter: "openai-chat", baseUrl: "https://opencode.ai/zen/go/v1",
     authKind: "key", featured: true, dashboardUrl: "https://opencode.ai/auth", defaultModel: "kimi-k2.7-code",
     jawcodeBundle: "opencode-go", note: "GLM, DeepSeek, Kimi, Qwen, MiMo…",
+    modelWireDefaults: {
+      "muse-spark-1.3-contributor": "openai-responses",
+      "muse-spark-1.2-contributor": "openai-responses",
+    },
     modelContextWindows: {
       "kimi-k3": KIMI_K3_STANDARD_CONTEXT_WINDOW,
+      "muse-spark-1.3-contributor": 1_048_576,
+      "muse-spark-1.2-contributor": 1_048_576,
       [OPENCODE_OX_ALPHA_FREE_MODEL]: OX_ALPHA_CONTEXT_WINDOW,
       [DEEPSEEK_VISION_PREVIEW_MODEL]: 1_048_576,
     },
     modelInputModalities: {
       "kimi-k3": ["text", "image"],
+      "muse-spark-1.3-contributor": ["text", "image"],
+      "muse-spark-1.2-contributor": ["text", "image"],
       [OPENCODE_OX_ALPHA_FREE_MODEL]: ["text", "image"],
       [DEEPSEEK_VISION_PREVIEW_MODEL]: ["text", "image"],
     },
@@ -1792,8 +1819,12 @@ export function providerModelWireDefault(
   if (!entry?.modelWireDefaults || !providerMatchesRegistryTransport(id, provider)) return undefined;
   const declared = entry.modelWireDefaults[modelId.trim().toLowerCase()];
   if (declared === undefined) return undefined;
-  // A bare string applies to every inbound; the object form only to the listed ones.
-  if (typeof declared !== "string" && !declared.inbound.includes(inbound)) return undefined;
+  // A bare string applies to every inbound/auth mode; the object form may narrow either.
+  if (typeof declared !== "string") {
+    if (!declared.inbound.includes(inbound)) return undefined;
+    const authMode = provider.authMode ?? entry.authKind;
+    if (declared.authModes && !declared.authModes.includes(authMode)) return undefined;
+  }
   const wire = typeof declared === "string" ? declared : declared.wire;
   return wire !== undefined && allowedWires.has(wire) ? wire : undefined;
 }

package/src/providers/xai-transport.ts

@@ -22,6 +22,16 @@ export const XAI_GROK_COMPATIBILITY = {
 export const XAI_GROK_CLIENT_VERSION = XAI_GROK_COMPATIBILITY.version;
 export const XAI_CONV_ID_HEADER = XAI_GROK_COMPATIBILITY.headers.conversationId;
 
+/** Both xAI Responses hosts share the same request dialect. */
+export function isXaiResponsesDestination(provider: Pick<OcxProviderConfig, "baseUrl">): boolean {
+  try {
+    const hostname = new URL(provider.baseUrl).hostname.toLowerCase();
+    return hostname === "api.x.ai" || hostname === "cli-chat-proxy.grok.com";
+  } catch {
+    return false;
+  }
+}
+
 export type OcxProviderTransport = OcxProviderConfig & {
   /** Request executor used only at runtime; never persisted. */
   fetch?: typeof globalThis.fetch;

package/src/responses/compaction.ts

@@ -105,7 +105,14 @@ export function buildCompactV1Output(userMessages: string[], summary: string): R
       remaining -= msg.length;
     } else {
       // Budget partially covers this older message: keep its tail (most recent context) and stop.
-      selected.push(msg.slice(msg.length - remaining));
+      let tailStart = msg.length - remaining;
+      // Never start the retained tail on a lone LOW surrogate: the pair's
+      // other half would be lost and encoding substitutes U+FFFD.
+      if (tailStart > 0 && tailStart < msg.length) {
+        const first = msg.charCodeAt(tailStart);
+        if (first >= 0xdc00 && first <= 0xdfff) tailStart += 1;
+      }
+      selected.push(msg.slice(tailStart));
       break;
     }
   }

package/src/responses/namespace-aliases.ts

@@ -0,0 +1,56 @@
+import { namespacedToolName, type OcxTool } from "../types";
+import type { TranslatorBudget } from "../lib/translator-budget";
+
+export interface NamespacedToolIdentity { namespace: string; name: string }
+type ToolIdentity = Pick<OcxTool, "namespace" | "name">;
+
+function sameIdentity(left: ToolIdentity, right: ToolIdentity): boolean {
+  return (left.namespace ?? "") === (right.namespace ?? "") && left.name === right.name;
+}
+
+/**
+ * Resolve all ownership before publishing aliases. Dots may occur in both halves,
+ * and a flat declaration can own a spelling which looks namespaced. Neither the
+ * declaration order nor an ambiguous dotted name may choose a different tool.
+ */
+export function declaredNamespaceAliases(
+  tools: readonly ToolIdentity[],
+  budget?: TranslatorBudget,
+): Map<string, NamespacedToolIdentity> {
+  const owners = new Map<string, ToolIdentity | null>();
+  const candidates = new Set<string>();
+  let temporaryBytes = 0;
+  const claim = (spelling: string, tool: ToolIdentity, candidate: boolean) => {
+    if (!owners.has(spelling)) {
+      const bytes = Buffer.byteLength(spelling) + Buffer.byteLength(tool.name)
+        + Buffer.byteLength(tool.namespace ?? "") + 64;
+      budget?.chargeRetained(bytes, { kind: "request_copies" });
+      temporaryBytes += bytes;
+      owners.set(spelling, tool);
+    } else {
+      const owner = owners.get(spelling);
+      if (owner && !sameIdentity(owner, tool)) owners.set(spelling, null);
+    }
+    if (candidate) candidates.add(spelling);
+  };
+  try {
+    for (const tool of tools) claim(namespacedToolName(tool.namespace, tool.name), tool, !!tool.namespace);
+    for (const tool of tools) {
+      if (!tool.namespace || tool.namespace.includes("__") || tool.name.includes("__")) continue;
+      claim(`${tool.namespace}.${tool.name}`, tool, true);
+    }
+    const aliases = new Map<string, NamespacedToolIdentity>();
+    for (const spelling of candidates) {
+      const owner = owners.get(spelling);
+      if (!owner?.namespace) continue;
+      budget?.chargeRetained(
+        Buffer.byteLength(spelling) + Buffer.byteLength(owner.namespace) + Buffer.byteLength(owner.name),
+        { kind: "request_copies" },
+      );
+      aliases.set(spelling, { namespace: owner.namespace, name: owner.name });
+    }
+    return aliases;
+  } finally {
+    budget?.releaseRetained(temporaryBytes, { kind: "request_copies" });
+  }
+}

package/src/responses/parser.ts

@@ -425,6 +425,18 @@ export function parseRequest(body: unknown): OcxParsedRequest {
           : null;
         const thinkingText = envelope?.txt || text;
 
+        // Kiro reasoning round-trip: a krc-only item carries nothing renderable — it is provider
+        // state for the assistant turn that ALREADY closed, because Kiro emits its
+        // reasoningContentEvent at the END of a turn (after content AND tool calls, verified
+        // against kiro-cli 2.14.1/2.16.0). Folding it into the FOLLOWING turn like ordinary
+        // reasoning would attach turn N's blob to turn N+1, so attach it backwards instead. With
+        // no assistant turn to own it the blob is dropped rather than mis-paired.
+        if (envelope?.krc && thinkingText.length === 0) {
+          const previous = messages[messages.length - 1];
+          if (previous?.role === "assistant") previous.kiroRedactedReasoning = envelope.krc;
+          continue;
+        }
+
         // Native/non-ocxr1 encrypted-only reasoning is opaque here. Do not create a detached
         // assistant turn or invent replayable plaintext/signatures from the encrypted payload.
         if (thinkingText.length > 0) {

package/src/responses/reasoning-envelope.ts

@@ -24,6 +24,12 @@ export interface ReasoningEnvelope {
    * so replay needs it even though the visible summary was suppressed.
    */
   txt?: string;
+  /**
+   * Kiro `reasoningContentEvent.redactedContent`: a KMS-encrypted reasoning blob that is opaque to
+   * the proxy. Kiro's own CLI replays it on the matching `assistantResponseMessage` to preserve
+   * model reasoning across turns, so it round-trips here the same way a signature does.
+   */
+  krc?: string;
 }
 
 export function encodeReasoningEnvelope(envelope: ReasoningEnvelope): string {
@@ -45,7 +51,9 @@ export function decodeReasoningEnvelope(encryptedContent: string): ReasoningEnve
     }
     const txt = (parsed as { txt?: unknown }).txt;
     if (typeof txt === "string" && txt.length > 0) envelope.txt = txt;
-    return envelope.sig || envelope.red || envelope.txt ? envelope : null;
+    const krc = (parsed as { krc?: unknown }).krc;
+    if (typeof krc === "string" && krc.length > 0) envelope.krc = krc;
+    return envelope.sig || envelope.red || envelope.txt || envelope.krc ? envelope : null;
   } catch {
     return null;
   }