@coseung2/opencodex 2.8.0-cs.16 → 2.8.0-cs.17

package/src/oauth/kiro.ts

@@ -27,6 +27,7 @@ import {
   type KiroImportDiagnostic,
 } from "./kiro-credentials";
 import { homedir } from "node:os";
+import { KIRO_BUILDER_ID_SERVICE_PROFILE_ARN } from "../adapters/kiro-constants";
 import { getAccountSet, saveAccountCredential } from "./store";
 
 const DEFAULT_REGION = "us-east-1";
@@ -172,13 +173,37 @@ async function defaultKiroCliRunner(args: string[], signal?: AbortSignal): Promi
   }
 }
 
-async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string }> {
+/** Kiro profile ARN structure: arn:<partition>:codewhisperer:<region>:<account>:profile/<id> */
+const KIRO_PROFILE_ARN_PATTERN = /^arn:[a-z0-9-]+:codewhisperer:[a-z0-9-]+:\d{12}:profile\/[A-Za-z0-9-]+$/;
+const KIRO_PROFILE_ARN_MAX_LENGTH = 256;
+
+function parseKiroProfileArn(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || trimmed.length > KIRO_PROFILE_ARN_MAX_LENGTH) return undefined;
+  return KIRO_PROFILE_ARN_PATTERN.test(trimmed) ? trimmed : undefined;
+}
+
+function profileArnFromWhoami(parsed: Record<string, unknown>): string | undefined {
+  // Only narrowly-named documented-ish shapes; never invent an ARN (#993).
+  return parseKiroProfileArn(parsed.profileArn)
+    ?? parseKiroProfileArn(parsed.profile_arn)
+    ?? (parsed.profile && typeof parsed.profile === "object" && !Array.isArray(parsed.profile)
+      ? parseKiroProfileArn((parsed.profile as Record<string, unknown>).arn)
+      : undefined);
+}
+
+async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string; profileArn?: string }> {
   try {
     const result = await runner(["whoami", "--format", "json"], signal);
     if (result.exitCode !== 0) return {};
-    const parsed = JSON.parse(result.stdout) as { email?: unknown };
+    const parsed = JSON.parse(result.stdout) as Record<string, unknown>;
     const email = typeof parsed.email === "string" ? parsed.email.trim().toLowerCase() : "";
-    return email && email.length <= 320 ? { email } : {};
+    const profileArn = profileArnFromWhoami(parsed);
+    return {
+      ...(email && email.length <= 320 ? { email } : {}),
+      ...(profileArn ? { profileArn } : {}),
+    };
   } catch {
     return {};
   }
@@ -191,6 +216,7 @@ function metadataFromImported(imported: ImportedKiroCredential): KiroOAuthMetada
     ...(imported.apiRegion ? { apiRegion: imported.apiRegion } : {}),
     ...(imported.clientId ? { clientId: imported.clientId } : {}),
     ...(imported.clientSecret ? { clientSecret: imported.clientSecret } : {}),
+    ...(imported.authType ? { authType: imported.authType } : {}),
   };
   return Object.keys(metadata).length > 0 ? metadata : undefined;
 }
@@ -251,14 +277,34 @@ async function oauthCredentialFromImported(
   runner: KiroCliRunner,
   signal?: AbortSignal,
 ): Promise<OAuthCredentials> {
-  const identity = imported.source === "sqlite" ? await readKiroCliIdentity(runner, signal) : {};
-  const metadata = metadataFromImported(imported);
+  let identity: { email?: string; profileArn?: string } = {};
+  if (imported.source === "sqlite") {
+    identity = await readKiroCliIdentity(runner, signal);
+    // Session-switch race (#993 review): another process may have switched the
+    // active Kiro CLI session between the SQLite read and whoami. Accept
+    // whoami's identity only when the session token STILL matches the import —
+    // refresh token, or access token when refresh is absent.
+    if (identity.profileArn !== undefined || identity.email !== undefined) {
+      const current = readKiroCliSqliteCredential();
+      const importedKey = imported.refresh || imported.access;
+      const currentKey = current ? current.refresh || current.access : "";
+      if (!current || currentKey !== importedKey) identity = {};
+    }
+  }
+  // Builder ID imports often lack a profileArn in SQLite; whoami against the
+  // SAME active CLI session can supply it (#993). Imported stays authoritative.
+  const resolvedProfileArn = imported.profileArn ?? identity.profileArn;
+  const metadata: KiroOAuthMetadata | undefined = (() => {
+    const base = metadataFromImported(imported) ?? {};
+    if (resolvedProfileArn && !base.profileArn) base.profileArn = resolvedProfileArn;
+    return Object.keys(base).length > 0 ? base : undefined;
+  })();
   return {
     access: imported.access,
     refresh: imported.refresh,
     expires: imported.expires,
     source: imported.source === "json" ? "credential-file" : "local-cli",
-    ...(imported.profileArn ? { accountId: imported.profileArn } : {}),
+    ...(resolvedProfileArn ? { accountId: resolvedProfileArn } : {}),
     ...(identity.email ? { email: identity.email } : {}),
     ...(metadata ? { kiro: metadata } : {}),
   };
@@ -429,6 +475,25 @@ export function resolveKiroProfileArn(account?: Pick<KiroOAuthMetadata, "profile
   return readImportedKiroCredential()?.profileArn;
 }
 
+/** Request profile and envelope choice are one decision; a fallback is never account identity. */
+export function resolveKiroRequestProfile(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): { profileArn: string | undefined; builderIdFallback: boolean } {
+  const own = resolveKiroProfileArn(account);
+  if (own) return { profileArn: own, builderIdFallback: false };
+  // An explicitly selected account must never borrow a different active local CLI account.
+  const authType = account === undefined ? readImportedKiroCredential()?.authType : account.authType;
+  return authType === "aws_sso_oidc"
+    ? { profileArn: KIRO_BUILDER_ID_SERVICE_PROFILE_ARN, builderIdFallback: true }
+    : { profileArn: undefined, builderIdFallback: false };
+}
+
+export function resolveKiroRequestProfileArn(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): string | undefined {
+  return resolveKiroRequestProfile(account).profileArn;
+}
+
 async function kiroTokenRefreshError(response: Response): Promise<KiroTokenRefreshError> {
   let oauthError: string | undefined;
   try {

package/src/oauth/store.ts

@@ -247,13 +247,15 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
     const apiRegion = clean(kiro.apiRegion, 64);
     const clientId = clean(kiro.clientId, 4096);
     const clientSecret = clean(kiro.clientSecret, 4096);
-    if (profileArn || ssoRegion || apiRegion || clientId || clientSecret) {
+    const authType = kiro.authType === "aws_sso_oidc" || kiro.authType === "kiro_desktop" ? kiro.authType : undefined;
+    if (profileArn || ssoRegion || apiRegion || clientId || clientSecret || authType) {
       normalized.kiro = {
         ...(profileArn ? { profileArn } : {}),
         ...(ssoRegion ? { ssoRegion } : {}),
         ...(apiRegion ? { apiRegion } : {}),
         ...(clientId ? { clientId } : {}),
         ...(clientSecret ? { clientSecret } : {}),
+        ...(authType ? { authType } : {}),
       };
     }
   }

package/src/oauth/types.ts

@@ -1,6 +1,8 @@
 /** Minimal OAuth types, ported from jawcode packages/ai/src/utils/oauth/types.ts. */
 export type OAuthCredentialSource = "oauth" | "local-cli" | "credential-file" | "environment" | "manual";
 
+export type KiroCredentialAuthType = "kiro_desktop" | "aws_sso_oidc";
+
 /** Account-scoped Kiro data required for refresh and request routing. */
 export interface KiroOAuthMetadata {
   profileArn?: string;
@@ -8,6 +10,8 @@ export interface KiroOAuthMetadata {
   apiRegion?: string;
   clientId?: string;
   clientSecret?: string;
+  /** Non-secret request-routing signal; never substitute for an account profile. */
+  authType?: KiroCredentialAuthType;
 }
 
 export type OAuthCredentials = {

package/src/providers/derive.ts

@@ -239,15 +239,17 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (!prov.models && seed.models) prov.models = [...seed.models];
   if (prov.liveModels === undefined && seed.liveModels !== undefined) prov.liveModels = seed.liveModels;
   if (prov.contextWindow === undefined && seed.contextWindow !== undefined) prov.contextWindow = seed.contextWindow;
-  if (!prov.modelContextWindows && seed.modelContextWindows) prov.modelContextWindows = { ...seed.modelContextWindows };
+  if (seed.modelContextWindows) prov.modelContextWindows = { ...seed.modelContextWindows, ...prov.modelContextWindows };
   if (seed.modelInputModalities) prov.modelInputModalities = fillRecordOfArrays(seed.modelInputModalities, prov.modelInputModalities);
   if (prov.defaultMaxOutputTokens === undefined && seed.defaultMaxOutputTokens !== undefined) prov.defaultMaxOutputTokens = seed.defaultMaxOutputTokens;
-  if (!prov.modelMaxOutputTokens && seed.modelMaxOutputTokens) prov.modelMaxOutputTokens = { ...seed.modelMaxOutputTokens };
+  if (seed.modelMaxOutputTokens) prov.modelMaxOutputTokens = { ...seed.modelMaxOutputTokens, ...prov.modelMaxOutputTokens };
   if (!prov.reasoningEfforts && seed.reasoningEfforts) prov.reasoningEfforts = [...seed.reasoningEfforts];
-  if (!prov.modelReasoningEfforts && seed.modelReasoningEfforts) prov.modelReasoningEfforts = cloneRecordOfArrays(seed.modelReasoningEfforts);
-  if (!prov.modelDefaultReasoningEfforts && seed.modelDefaultReasoningEfforts) prov.modelDefaultReasoningEfforts = { ...seed.modelDefaultReasoningEfforts };
+  // One customized model must not hide the registry's knowledge of every other
+  // model. Fill per key on new maps; explicit empty ladders remain authoritative.
+  if (seed.modelReasoningEfforts) prov.modelReasoningEfforts = fillRecordOfArrays(seed.modelReasoningEfforts, prov.modelReasoningEfforts);
+  if (seed.modelDefaultReasoningEfforts) prov.modelDefaultReasoningEfforts = { ...seed.modelDefaultReasoningEfforts, ...prov.modelDefaultReasoningEfforts };
   if (!prov.reasoningEffortMap && seed.reasoningEffortMap) prov.reasoningEffortMap = { ...seed.reasoningEffortMap };
-  if (!prov.modelReasoningEffortMap && seed.modelReasoningEffortMap) prov.modelReasoningEffortMap = cloneNestedRecord(seed.modelReasoningEffortMap);
+  if (seed.modelReasoningEffortMap) prov.modelReasoningEffortMap = { ...cloneNestedRecord(seed.modelReasoningEffortMap), ...cloneNestedRecord(prov.modelReasoningEffortMap ?? {}) };
   if (!prov.noVisionModels && seed.noVisionModels) prov.noVisionModels = [...seed.noVisionModels];
   if (!prov.noReasoningModels && seed.noReasoningModels) prov.noReasoningModels = [...seed.noReasoningModels];
   if (!prov.noTemperatureModels && seed.noTemperatureModels) prov.noTemperatureModels = [...seed.noTemperatureModels];

package/src/providers/opencode-go-transport.ts

@@ -4,6 +4,24 @@ import { registryEntryForProviderDestination } from "./registry";
 
 export const OPENCODE_GO_SESSION_HEADER = "x-opencode-session";
 
+const MUSE_RESPONSE_MODELS = new Set(["muse-spark-1.2-contributor", "muse-spark-1.3-contributor"]);
+const MUSE_RESPONSE_URLS = new Set([
+  "https://opencode.ai/zen/v1/responses",
+  "https://opencode.ai/zen/go/v1/responses",
+]);
+
+/** Compatibility belongs to the exact model AND effective destination, not a provider label. */
+export function isOpenCodeMuseResponses(modelId: unknown, responseUrl: string): boolean {
+  if (typeof modelId !== "string" || !MUSE_RESPONSE_MODELS.has(modelId.trim().toLowerCase())) return false;
+  try {
+    const url = new URL(responseUrl);
+    if (url.username || url.password || url.search || url.hash) return false;
+    return MUSE_RESPONSE_URLS.has(`${url.origin.toLowerCase()}${url.pathname.replace(/\/+$/, "")}`);
+  } catch {
+    return false;
+  }
+}
+
 function hasHeaderCaseInsensitive(
   headers: Record<string, string> | undefined,
   name: string,

package/src/providers/registry.ts

@@ -29,7 +29,12 @@ export type InboundWire = "responses" | "chat" | "anthropic";
  * A per-model wire default: a bare string applies to every inbound, while the object
  * form applies only to the listed inbound protocols.
  */
-export type ModelWireDefault = string | { wire: string; inbound: readonly InboundWire[] };
+export type ModelWireDefault = string | {
+  wire: string;
+  inbound: readonly InboundWire[];
+  /** Optional auth-mode gate for providers whose subscription and API-key products use different wires. */
+  authModes?: readonly ProviderAuthKind[];
+};
 
 export type ProviderModelDiscoveryScalar = string | number | boolean;
 
@@ -700,6 +705,13 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // transport returns 400 ("Multi Agent requests are not allowed on chat completions").
     models: ["grok-4.6", "grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning", "grok-4.20-0309-non-reasoning", "grok-build-0.1", "grok-composer-2.5-fast"],
     defaultModel: "grok-4.5",
+    // Grok's subscription gateway exposes 4.6/4.5 natively on Responses. Scope the default to
+    // OAuth Codex traffic: API-key and Chat/Anthropic callers keep their existing wire, while an
+    // explicit modelAdapters override still wins over this registry-only default.
+    modelWireDefaults: {
+      "grok-4.6": { wire: "openai-responses", inbound: ["responses"], authModes: ["oauth"] },
+      "grok-4.5": { wire: "openai-responses", inbound: ["responses"], authModes: ["oauth"] },
+    },
     // Vision lineup per docs.x.ai model-capabilities/images/understanding: the grok-4.x chat
     // models accept image input (JPEG/PNG, URL or base64). Without this the catalog leaves
     // inputModalities undefined, and deriveComboCatalogModel defaults an undefined member to
@@ -824,16 +836,20 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     featured: true,
     dashboardUrl: "https://platform.openai.com/api-keys",
     defaultModel: "gpt-5.5",
-    models: ["gpt-5.5", ...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS],
+    models: ["gpt-5.5", ...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS, "gpt-6-astra"],
     liveModels: true,
-    modelContextWindows: OPENAI_API_GPT56_CONTEXT_WINDOWS,
-    modelMaxInputTokens: OPENAI_API_GPT56_MAX_INPUT_TOKENS,
+    // API limits differ from the Codex-login Astra pin. Keep the public API ladder
+    // separate: low..max is documented, while the native catalog also carries ultra.
+    modelContextWindows: { ...OPENAI_API_GPT56_CONTEXT_WINDOWS, "gpt-6-astra": 1_050_000 },
+    modelMaxInputTokens: { ...OPENAI_API_GPT56_MAX_INPUT_TOKENS, "gpt-6-astra": 922_000 },
+    modelMaxOutputTokens: { "gpt-6-astra": 128_000 },
     modelInputModalities: Object.fromEntries(
-      ["gpt-5.5", ...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS].map(id => [id, ["text", "image"]]),
-    ),
-    modelReasoningEfforts: Object.fromEntries(
-      [...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS].map(id => [id, OPENAI_API_GPT56_REASONING_EFFORTS]),
+      ["gpt-5.5", ...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS, "gpt-6-astra"].map(id => [id, ["text", "image"]]),
     ),
+    modelReasoningEfforts: {
+      ...Object.fromEntries([...OPENAI_GPT56_MODELS, ...OPENAI_GPT56_PRO_MODELS].map(id => [id, OPENAI_API_GPT56_REASONING_EFFORTS])),
+      "gpt-6-astra": ["low", "medium", "high", "xhigh", "max"],
+    },
     virtualModels: OPENAI_API_GPT56_VIRTUAL_MODELS,
   },
   {
@@ -871,11 +887,15 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     },
     modelContextWindows: {
       "kimi-k3": KIMI_K3_STANDARD_CONTEXT_WINDOW,
+      "muse-spark-1.3-contributor": 1_048_576,
+      "muse-spark-1.2-contributor": 1_048_576,
       [OPENCODE_OX_ALPHA_FREE_MODEL]: OX_ALPHA_CONTEXT_WINDOW,
       [DEEPSEEK_VISION_PREVIEW_MODEL]: 1_048_576,
     },
     modelInputModalities: {
       "kimi-k3": ["text", "image"],
+      "muse-spark-1.3-contributor": ["text", "image"],
+      "muse-spark-1.2-contributor": ["text", "image"],
       [OPENCODE_OX_ALPHA_FREE_MODEL]: ["text", "image"],
       [DEEPSEEK_VISION_PREVIEW_MODEL]: ["text", "image"],
     },
@@ -1799,8 +1819,12 @@ export function providerModelWireDefault(
   if (!entry?.modelWireDefaults || !providerMatchesRegistryTransport(id, provider)) return undefined;
   const declared = entry.modelWireDefaults[modelId.trim().toLowerCase()];
   if (declared === undefined) return undefined;
-  // A bare string applies to every inbound; the object form only to the listed ones.
-  if (typeof declared !== "string" && !declared.inbound.includes(inbound)) return undefined;
+  // A bare string applies to every inbound/auth mode; the object form may narrow either.
+  if (typeof declared !== "string") {
+    if (!declared.inbound.includes(inbound)) return undefined;
+    const authMode = provider.authMode ?? entry.authKind;
+    if (declared.authModes && !declared.authModes.includes(authMode)) return undefined;
+  }
   const wire = typeof declared === "string" ? declared : declared.wire;
   return wire !== undefined && allowedWires.has(wire) ? wire : undefined;
 }

package/src/providers/xai-transport.ts

@@ -22,6 +22,16 @@ export const XAI_GROK_COMPATIBILITY = {
 export const XAI_GROK_CLIENT_VERSION = XAI_GROK_COMPATIBILITY.version;
 export const XAI_CONV_ID_HEADER = XAI_GROK_COMPATIBILITY.headers.conversationId;
 
+/** Both xAI Responses hosts share the same request dialect. */
+export function isXaiResponsesDestination(provider: Pick<OcxProviderConfig, "baseUrl">): boolean {
+  try {
+    const hostname = new URL(provider.baseUrl).hostname.toLowerCase();
+    return hostname === "api.x.ai" || hostname === "cli-chat-proxy.grok.com";
+  } catch {
+    return false;
+  }
+}
+
 export type OcxProviderTransport = OcxProviderConfig & {
   /** Request executor used only at runtime; never persisted. */
   fetch?: typeof globalThis.fetch;

package/src/responses/compaction.ts

@@ -105,7 +105,14 @@ export function buildCompactV1Output(userMessages: string[], summary: string): R
       remaining -= msg.length;
     } else {
       // Budget partially covers this older message: keep its tail (most recent context) and stop.
-      selected.push(msg.slice(msg.length - remaining));
+      let tailStart = msg.length - remaining;
+      // Never start the retained tail on a lone LOW surrogate: the pair's
+      // other half would be lost and encoding substitutes U+FFFD.
+      if (tailStart > 0 && tailStart < msg.length) {
+        const first = msg.charCodeAt(tailStart);
+        if (first >= 0xdc00 && first <= 0xdfff) tailStart += 1;
+      }
+      selected.push(msg.slice(tailStart));
       break;
     }
   }

package/src/responses/namespace-aliases.ts

@@ -0,0 +1,56 @@
+import { namespacedToolName, type OcxTool } from "../types";
+import type { TranslatorBudget } from "../lib/translator-budget";
+
+export interface NamespacedToolIdentity { namespace: string; name: string }
+type ToolIdentity = Pick<OcxTool, "namespace" | "name">;
+
+function sameIdentity(left: ToolIdentity, right: ToolIdentity): boolean {
+  return (left.namespace ?? "") === (right.namespace ?? "") && left.name === right.name;
+}
+
+/**
+ * Resolve all ownership before publishing aliases. Dots may occur in both halves,
+ * and a flat declaration can own a spelling which looks namespaced. Neither the
+ * declaration order nor an ambiguous dotted name may choose a different tool.
+ */
+export function declaredNamespaceAliases(
+  tools: readonly ToolIdentity[],
+  budget?: TranslatorBudget,
+): Map<string, NamespacedToolIdentity> {
+  const owners = new Map<string, ToolIdentity | null>();
+  const candidates = new Set<string>();
+  let temporaryBytes = 0;
+  const claim = (spelling: string, tool: ToolIdentity, candidate: boolean) => {
+    if (!owners.has(spelling)) {
+      const bytes = Buffer.byteLength(spelling) + Buffer.byteLength(tool.name)
+        + Buffer.byteLength(tool.namespace ?? "") + 64;
+      budget?.chargeRetained(bytes, { kind: "request_copies" });
+      temporaryBytes += bytes;
+      owners.set(spelling, tool);
+    } else {
+      const owner = owners.get(spelling);
+      if (owner && !sameIdentity(owner, tool)) owners.set(spelling, null);
+    }
+    if (candidate) candidates.add(spelling);
+  };
+  try {
+    for (const tool of tools) claim(namespacedToolName(tool.namespace, tool.name), tool, !!tool.namespace);
+    for (const tool of tools) {
+      if (!tool.namespace || tool.namespace.includes("__") || tool.name.includes("__")) continue;
+      claim(`${tool.namespace}.${tool.name}`, tool, true);
+    }
+    const aliases = new Map<string, NamespacedToolIdentity>();
+    for (const spelling of candidates) {
+      const owner = owners.get(spelling);
+      if (!owner?.namespace) continue;
+      budget?.chargeRetained(
+        Buffer.byteLength(spelling) + Buffer.byteLength(owner.namespace) + Buffer.byteLength(owner.name),
+        { kind: "request_copies" },
+      );
+      aliases.set(spelling, { namespace: owner.namespace, name: owner.name });
+    }
+    return aliases;
+  } finally {
+    budget?.releaseRetained(temporaryBytes, { kind: "request_copies" });
+  }
+}

package/src/responses/parser.ts

@@ -425,6 +425,18 @@ export function parseRequest(body: unknown): OcxParsedRequest {
           : null;
         const thinkingText = envelope?.txt || text;
 
+        // Kiro reasoning round-trip: a krc-only item carries nothing renderable — it is provider
+        // state for the assistant turn that ALREADY closed, because Kiro emits its
+        // reasoningContentEvent at the END of a turn (after content AND tool calls, verified
+        // against kiro-cli 2.14.1/2.16.0). Folding it into the FOLLOWING turn like ordinary
+        // reasoning would attach turn N's blob to turn N+1, so attach it backwards instead. With
+        // no assistant turn to own it the blob is dropped rather than mis-paired.
+        if (envelope?.krc && thinkingText.length === 0) {
+          const previous = messages[messages.length - 1];
+          if (previous?.role === "assistant") previous.kiroRedactedReasoning = envelope.krc;
+          continue;
+        }
+
         // Native/non-ocxr1 encrypted-only reasoning is opaque here. Do not create a detached
         // assistant turn or invent replayable plaintext/signatures from the encrypted payload.
         if (thinkingText.length > 0) {

package/src/responses/reasoning-envelope.ts

@@ -24,6 +24,12 @@ export interface ReasoningEnvelope {
    * so replay needs it even though the visible summary was suppressed.
    */
   txt?: string;
+  /**
+   * Kiro `reasoningContentEvent.redactedContent`: a KMS-encrypted reasoning blob that is opaque to
+   * the proxy. Kiro's own CLI replays it on the matching `assistantResponseMessage` to preserve
+   * model reasoning across turns, so it round-trips here the same way a signature does.
+   */
+  krc?: string;
 }
 
 export function encodeReasoningEnvelope(envelope: ReasoningEnvelope): string {
@@ -45,7 +51,9 @@ export function decodeReasoningEnvelope(encryptedContent: string): ReasoningEnve
     }
     const txt = (parsed as { txt?: unknown }).txt;
     if (typeof txt === "string" && txt.length > 0) envelope.txt = txt;
-    return envelope.sig || envelope.red || envelope.txt ? envelope : null;
+    const krc = (parsed as { krc?: unknown }).krc;
+    if (typeof krc === "string" && krc.length > 0) envelope.krc = krc;
+    return envelope.sig || envelope.red || envelope.txt || envelope.krc ? envelope : null;
   } catch {
     return null;
   }

package/src/responses/snapshot-policy.ts

@@ -0,0 +1,108 @@
+import { lstatSync, realpathSync, statSync } from "node:fs";
+import { dirname } from "node:path";
+import {
+  forgetHardenedSecretPath,
+  hardenSecretPathAsync,
+  windowsSecretAclApplies,
+} from "../lib/windows-secret-acl";
+
+const BASE_DEBOUNCE_MS = 2_000;
+const SCALE_FROM_BYTES = 1024 * 1024;
+const MAX_DEBOUNCE_MS = 30_000;
+
+/** Large snapshots trade a bounded hard-kill recovery window for fewer atomic replacements. */
+export function responseSnapshotDebounceMs(bytes: number): number {
+  if (!Number.isFinite(bytes) || bytes <= SCALE_FROM_BYTES) return BASE_DEBOUNCE_MS;
+  return Math.min(MAX_DEBOUNCE_MS, Math.round(BASE_DEBOUNCE_MS * bytes / SCALE_FROM_BYTES));
+}
+
+export interface ResponseSnapshotWriteMetrics {
+  writes: number;
+  unchangedSkips: number;
+  bytesWritten: number;
+  lastSnapshotBytes: number;
+  debounceMs: number;
+}
+
+type SnapshotWrite = (path: string, payload: string) => Promise<void>;
+
+/**
+ * Memoize only a digest, size and resolved target, never another copy of the snapshot.
+ * The state store owns the single-flight writer gate; this class does not queue writes.
+ */
+export class ResponseSnapshotWriter {
+  private digest: string | null = null;
+  private target: string | null = null;
+  private bytes = 0;
+  private writes = 0;
+  private unchangedSkips = 0;
+  private bytesWritten = 0;
+
+  constructor(private readonly write: SnapshotWrite) {}
+
+  metrics(): ResponseSnapshotWriteMetrics {
+    return {
+      writes: this.writes,
+      unchangedSkips: this.unchangedSkips,
+      bytesWritten: this.bytesWritten,
+      lastSnapshotBytes: this.bytes,
+      debounceMs: responseSnapshotDebounceMs(this.bytes),
+    };
+  }
+
+  reset(): void {
+    this.digest = null;
+    this.target = null;
+    this.bytes = 0;
+    this.writes = 0;
+    this.unchangedSkips = 0;
+    this.bytesWritten = 0;
+  }
+
+  private async diskMatches(path: string, payload: string, bytes: number): Promise<boolean> {
+    try {
+      const before = lstatSync(path);
+      // Atomic replacement would replace a symlink or break a hardlink. An optimization must
+      // not silently preserve either, even if it currently resolves to identical bytes.
+      if (!before.isFile() || before.nlink !== 1 || before.size !== bytes) return false;
+      if (realpathSync(path) !== this.target) return false;
+      if (!windowsSecretAclApplies()) {
+        if ((before.mode & 0o777) !== 0o600) return false;
+        if ((statSync(dirname(path)).mode & 0o777) !== 0o700) return false;
+      } else {
+        // An ordinary atomic write hardens a new temp. A skipped write must still use the
+        // required publication policy, not a potentially stale pathname-only success memo.
+        forgetHardenedSecretPath(path);
+        try { await hardenSecretPathAsync(path, { required: true }); }
+        finally { forgetHardenedSecretPath(path); }
+      }
+      // The digest records our last write, not the current disk contents. A same-size edit,
+      // a second process or a deleted snapshot must never turn into a false cache hit.
+      if (await Bun.file(path).text() !== payload) return false;
+      const after = lstatSync(path);
+      return after.isFile() && after.nlink === 1 && after.dev === before.dev
+        && after.ino === before.ino && after.size === before.size
+        && after.mtimeMs === before.mtimeMs && realpathSync(path) === this.target;
+    } catch {
+      return false;
+    }
+  }
+
+  async persist(path: string, payload: string): Promise<void> {
+    const bytes = Buffer.byteLength(payload, "utf8");
+    const digest = Bun.hash(payload).toString(36);
+    if (this.digest === digest && this.bytes === bytes && await this.diskMatches(path, payload, bytes)) {
+      this.unchangedSkips += 1;
+      return;
+    }
+    await this.write(path, payload);
+    // Publish the memo only after a successful atomic write. A failed write keeps the previous
+    // fingerprint, which is harmless because every prospective skip rechecks the disk.
+    this.digest = digest;
+    this.bytes = bytes;
+    this.writes += 1;
+    this.bytesWritten += bytes;
+    try { this.target = realpathSync(path); }
+    catch { this.target = null; }
+  }
+}

package/src/responses/state.ts

@@ -4,6 +4,7 @@ import { isDeepStrictEqual } from "node:util";
 import { atomicWriteFileAsync, getConfigDir } from "../config";
 import { enforceAppOwnedMemoryBudget, type RetainedStoreSnapshot } from "../lib/app-owned-memory";
 import type { OcxProviderContinuationState } from "../types";
+import { ResponseSnapshotWriter } from "./snapshot-policy";
 import {
   deleteResponseSpill,
   noteStubSwapForTest,
@@ -17,7 +18,6 @@ import {
 
 const MAX_STORED_RESPONSES = 1_000;
 const RESPONSE_TTL_MS = 60 * 60 * 1_000;
-const SNAPSHOT_DEBOUNCE_MS = 2_000;
 /** In-memory high-water byte cap across all entries. Forced store:false retention (kiro/cursor
  * continuation chains) stores the full expanded input each turn — ~quadratic bytes per chain —
  * so a count cap alone cannot bound memory. Oldest-first eviction applies past this mark. */
@@ -69,6 +69,17 @@ let oldestResidentId: string | undefined;
 let oldestResidentAt: number | null = null;
 let byteCapOverride: number | null = null;
 let stateRevision = 0;
+const snapshotWriter = new ResponseSnapshotWriter(async (path, payload) => {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  try { chmodSync(dirname(path), 0o700); } catch { /* best-effort (e.g. Windows) */ }
+  await atomicWriteFileAsync(path, payload);
+});
+
+/** Scalar-only observation; does not load, prune or retain snapshot contents. */
+export function responseSnapshotMetricsForTests() {
+  return snapshotWriter.metrics();
+}
+
 const spillCounters = { writes: 0, writeFailures: 0, readFailures: 0 };
 const admissionCounters = { directSpills: 0, oversizedDrops: 0, snapshotOversizedRefusals: 0 };
 
@@ -573,14 +584,14 @@ function ensureLoaded(): void {
 
 type SnapshotWriteOutcome = "stable" | "unstable" | "failed";
 
-async function writeBoundedSnapshot(path: string): Promise<SnapshotWriteOutcome> {
+async function writeBoundedSnapshot(path: string, attemptLimit: number): Promise<SnapshotWriteOutcome> {
   // Serialize writers so concurrent flush + debounce cannot race on temps / ACL (#612).
   const previous = persistGate;
   let release!: () => void;
   persistGate = new Promise<void>(resolve => { release = resolve; });
   await previous;
   try {
-    for (let attempt = 0; attempt < MAX_SNAPSHOT_REWRITE_ATTEMPTS; attempt += 1) {
+    for (let attempt = 0; attempt < attemptLimit; attempt += 1) {
       const revision = stateRevision;
       const entries: Array<[string, unknown]> = [];
       let total = 0;
@@ -602,9 +613,7 @@ async function writeBoundedSnapshot(path: string): Promise<SnapshotWriteOutcome>
         entries.push(persistEntry);
       }
       entries.reverse();
-      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-      try { chmodSync(dirname(path), 0o700); } catch { /* best-effort (e.g. Windows) */ }
-      await atomicWriteFileAsync(path, JSON.stringify({ version: 2, states: entries }));
+      await snapshotWriter.persist(path, JSON.stringify({ version: 2, states: entries }));
       persistAttemptHookForTests?.();
       if (revision === stateRevision) return "stable";
     }
@@ -627,7 +636,7 @@ function schedulePersistAt(path: string, replace = false): void {
   if (persistTimer && !replace) return;
   if (persistTimer) clearTimeout(persistTimer);
   pendingPersistPath = path;
-  persistTimer = setTimeout(() => { void persistNow(path); }, SNAPSHOT_DEBOUNCE_MS);
+  persistTimer = setTimeout(() => { void persistNow(path); }, snapshotWriter.metrics().debounceMs);
   (persistTimer as { unref?: () => void }).unref?.();
 }
 
@@ -637,12 +646,15 @@ async function persistNow(path: string, awaitFollowUp = false): Promise<void> {
     persistTimer = null;
   }
   pendingPersistPath = null;
-  let outcome = await writeBoundedSnapshot(path);
+  // Background traffic gets one write per debounce, not four immediate full-file rewrites.
+  // Explicit shutdown flushes retain the existing bounded stabilization contract.
+  const attemptLimit = awaitFollowUp ? MAX_SNAPSHOT_REWRITE_ATTEMPTS : 1;
+  let outcome = await writeBoundedSnapshot(path, attemptLimit);
   if (outcome === "unstable" && awaitFollowUp) {
     if (persistTimer) clearTimeout(persistTimer);
     persistTimer = null;
     pendingPersistPath = null;
-    outcome = await writeBoundedSnapshot(path);
+    outcome = await writeBoundedSnapshot(path, attemptLimit);
   }
   if (outcome === "stable") drainPendingSpillUnlinks();
   else if (outcome === "unstable" && !awaitFollowUp) schedulePersistAt(path, true);
@@ -957,7 +969,7 @@ export function rememberResponseState(
   schedulePersist();
 }
 
-/** Test-only persistence churn hook; invoked after each atomic snapshot rewrite. */
+/** Test-only persistence churn hook; invoked after each write/unchanged-validation attempt. */
 export function setResponseStatePersistAttemptHookForTests(hook: (() => void) | null): void {
   persistAttemptHookForTests = hook;
 }
@@ -986,6 +998,7 @@ export function clearResponseStateMemoryForTests(): void {
   oldestResidentId = undefined;
   oldestResidentAt = null;
   stateRevision = 0;
+  snapshotWriter.reset();
   pendingSpillUnlinks.length = 0;
   spillCounters.writes = 0;
   spillCounters.writeFailures = 0;