@iislee/opencodex 2.11.0 → 2.35.0

package/src/oauth/key-providers.ts

@@ -18,9 +18,30 @@ export const KEY_LOGIN_PROVIDERS: Record<string, KeyLoginProvider> = deriveKeyLo
  * `noReasoningModels`, `defaultModel`) onto a provider config being created, for any field the
  * caller didn't already supply. Lets the vision/reasoning classification actually reach the saved
  * config (the GUI/API only send adapter/baseUrl/apiKey/defaultModel). No-op for unknown names.
+ *
+ * `modelSupportsReasoningSummaries` and the verbosity capability are deliberately excluded from
+ * what gets persisted. They are
+ * registry-only metadata resolved at runtime, and this function feeds a config that is about to
+ * be written to disk. Persisting today's registry defaults would freeze them as the user's own
+ * overrides: a later registry correction — say we learn a model's backend rejects summary
+ * delivery — would never reach anyone who created their provider before the correction, and they
+ * would keep getting upstream 400s with no way to know why. Catalog gathering enriches a
+ * detached runtime clone, so the defaults still apply where they matter.
  */
 export function enrichProviderFromCatalog(name: string, prov: OcxProviderConfig): void {
+  const hadOwnSummaries = Object.hasOwn(prov, "modelSupportsReasoningSummaries");
+  const submittedSummaries = prov.modelSupportsReasoningSummaries;
+  const hadOwnVerbosity = Object.hasOwn(prov, "modelSupportsVerbosity");
+  const submittedVerbosity = prov.modelSupportsVerbosity;
+  const hadOwnProviderVerbosity = Object.hasOwn(prov, "supportsVerbosity");
+  const submittedProviderVerbosity = prov.supportsVerbosity;
   enrichProviderFromRegistry(name, prov);
+  if (hadOwnSummaries) prov.modelSupportsReasoningSummaries = submittedSummaries;
+  else delete prov.modelSupportsReasoningSummaries;
+  if (hadOwnVerbosity) prov.modelSupportsVerbosity = submittedVerbosity;
+  else delete prov.modelSupportsVerbosity;
+  if (hadOwnProviderVerbosity) prov.supportsVerbosity = submittedProviderVerbosity;
+  else delete prov.supportsVerbosity;
 }
 
 export function isKeyLoginProvider(name: string): boolean {
@@ -52,6 +73,10 @@ export async function validateApiKey(
   key: string,
 ): Promise<boolean | "unknown"> {
   try {
+    // A public model catalog cannot prove that the supplied key is valid. Returning unknown keeps
+    // the best-effort login flow available without persisting a false-positive validation result.
+    if (provider.apiKeyValidation === "unknown") return "unknown";
+
     if (provider.adapter === "anthropic") {
       const base = provider.baseUrl.replace(/\/v1\/?$/, "");
       const res = await fetch(`${base}/v1/messages`, {

package/src/oauth/kimi.ts

@@ -151,7 +151,21 @@ async function requestDeviceAuthorization(): Promise<{
 }
 
 function parseTokenPayload(payload: TokenResponse, refreshFallback?: string): OAuthCredentials {
-  if (!payload.access_token || typeof payload.expires_in !== "number") {
+  // Number.isFinite is required here: typeof NaN === "number", so the type check
+  // alone would let a NaN expires_in through and produce a never-refreshing expiry.
+  // Negative durations would stamp an already-past expiry — also malformed.
+  // The computed timestamp itself must also stay finite: Number.MAX_VALUE passes
+  // Number.isFinite but overflows to Infinity once multiplied by 1000.
+  if (
+    !payload.access_token
+    || typeof payload.expires_in !== "number"
+    || !Number.isFinite(payload.expires_in)
+    || payload.expires_in < 0
+  ) {
+    throw new Error("Kimi token response missing required fields");
+  }
+  const expires = Date.now() + payload.expires_in * 1000 - OAUTH_EXPIRY_SKEW_MS;
+  if (!Number.isFinite(expires)) {
     throw new Error("Kimi token response missing required fields");
   }
   const refresh = payload.refresh_token ?? refreshFallback;
@@ -160,7 +174,7 @@ function parseTokenPayload(payload: TokenResponse, refreshFallback?: string): OA
   return {
     access: payload.access_token,
     refresh,
-    expires: Date.now() + payload.expires_in * 1000 - OAUTH_EXPIRY_SKEW_MS,
+    expires,
     ...identity,
   };
 }
@@ -195,7 +209,15 @@ async function pollForToken(deviceCode: string, intervalMs: number, expiresInMs:
 
 export async function loginKimi(ctrl: OAuthController): Promise<OAuthCredentials> {
   const device = await requestDeviceAuthorization();
-  ctrl.onAuth?.({ url: device.verificationUriComplete, instructions: `Enter code: ${device.userCode}` });
+  // `deviceCode` carries the human-typed user code, matching the other device
+  // providers. It is also what tells the management login route this is a device
+  // flow, so a provider-supplied verification URI is no longer handed to a local
+  // browser spawn — the URL stays visible and copyable in every login surface.
+  ctrl.onAuth?.({
+    url: device.verificationUriComplete,
+    instructions: `Enter code: ${device.userCode}`,
+    deviceCode: device.userCode,
+  });
   return pollForToken(device.deviceCode, device.intervalMs, device.expiresInMs, ctrl.signal);
 }
 

package/src/oauth/kiro.ts

@@ -28,6 +28,7 @@ import {
 } from "./kiro-credentials";
 import { homedir } from "node:os";
 import { getAccountSet, saveAccountCredential } from "./store";
+import { KIRO_BUILDER_ID_SERVICE_PROFILE_ARN } from "../adapters/kiro-constants";
 
 const DEFAULT_REGION = "us-east-1";
 const REFRESH_URL = "https://prod.{region}.auth.desktop.kiro.dev/refreshToken";
@@ -172,13 +173,37 @@ async function defaultKiroCliRunner(args: string[], signal?: AbortSignal): Promi
   }
 }
 
-async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string }> {
+/** Kiro profile ARN structure: arn:<partition>:codewhisperer:<region>:<account>:profile/<id> */
+const KIRO_PROFILE_ARN_PATTERN = /^arn:[a-z0-9-]+:codewhisperer:[a-z0-9-]+:\d{12}:profile\/[A-Za-z0-9-]+$/;
+const KIRO_PROFILE_ARN_MAX_LENGTH = 256;
+
+function parseKiroProfileArn(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || trimmed.length > KIRO_PROFILE_ARN_MAX_LENGTH) return undefined;
+  return KIRO_PROFILE_ARN_PATTERN.test(trimmed) ? trimmed : undefined;
+}
+
+function profileArnFromWhoami(parsed: Record<string, unknown>): string | undefined {
+  // Only narrowly-named documented-ish shapes; never invent an ARN (#993).
+  return parseKiroProfileArn(parsed.profileArn)
+    ?? parseKiroProfileArn(parsed.profile_arn)
+    ?? (parsed.profile && typeof parsed.profile === "object" && !Array.isArray(parsed.profile)
+      ? parseKiroProfileArn((parsed.profile as Record<string, unknown>).arn)
+      : undefined);
+}
+
+async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string; profileArn?: string }> {
   try {
     const result = await runner(["whoami", "--format", "json"], signal);
     if (result.exitCode !== 0) return {};
-    const parsed = JSON.parse(result.stdout) as { email?: unknown };
+    const parsed = JSON.parse(result.stdout) as Record<string, unknown>;
     const email = typeof parsed.email === "string" ? parsed.email.trim().toLowerCase() : "";
-    return email && email.length <= 320 ? { email } : {};
+    const profileArn = profileArnFromWhoami(parsed);
+    return {
+      ...(email && email.length <= 320 ? { email } : {}),
+      ...(profileArn ? { profileArn } : {}),
+    };
   } catch {
     return {};
   }
@@ -251,14 +276,34 @@ async function oauthCredentialFromImported(
   runner: KiroCliRunner,
   signal?: AbortSignal,
 ): Promise<OAuthCredentials> {
-  const identity = imported.source === "sqlite" ? await readKiroCliIdentity(runner, signal) : {};
-  const metadata = metadataFromImported(imported);
+  let identity: { email?: string; profileArn?: string } = {};
+  if (imported.source === "sqlite") {
+    identity = await readKiroCliIdentity(runner, signal);
+    // Session-switch race (#993 review): another process may have switched the
+    // active Kiro CLI session between the SQLite read and whoami. Accept
+    // whoami's identity only when the session token STILL matches the import —
+    // refresh token, or access token when refresh is absent.
+    if (identity.profileArn !== undefined) {
+      const current = readKiroCliSqliteCredential();
+      const importedKey = imported.refresh || imported.access;
+      const currentKey = current ? current.refresh || current.access : "";
+      if (!current || currentKey !== importedKey) identity = {};
+    }
+  }
+  // Builder ID imports often lack a profileArn in SQLite; whoami against the
+  // SAME active CLI session can supply it (#993). Imported stays authoritative.
+  const resolvedProfileArn = imported.profileArn ?? identity.profileArn;
+  const metadata: KiroOAuthMetadata | undefined = (() => {
+    const base = metadataFromImported(imported) ?? {};
+    if (resolvedProfileArn && !base.profileArn) base.profileArn = resolvedProfileArn;
+    return Object.keys(base).length > 0 ? base : undefined;
+  })();
   return {
     access: imported.access,
     refresh: imported.refresh,
     expires: imported.expires,
     source: imported.source === "json" ? "credential-file" : "local-cli",
-    ...(imported.profileArn ? { accountId: imported.profileArn } : {}),
+    ...(resolvedProfileArn ? { accountId: resolvedProfileArn } : {}),
     ...(identity.email ? { email: identity.email } : {}),
     ...(metadata ? { kiro: metadata } : {}),
   };
@@ -429,6 +474,50 @@ export function resolveKiroProfileArn(account?: Pick<KiroOAuthMetadata, "profile
   return readImportedKiroCredential()?.profileArn;
 }
 
+/**
+ * Resolve the profileArn actually SENT upstream, which is not always the account's own.
+ *
+ * An AWS Builder ID account authenticates through SSO OIDC and never receives an account-scoped
+ * profile ARN, so gated models reject its requests with a `profileArn`-demanding
+ * `ValidationException`. The Kiro CLI handles this by carrying a fixed service profile on Builder
+ * ID requests, and this mirrors that.
+ *
+ * Deliberately separate from `resolveKiroProfileArn`: that resolver answers "what is this
+ * account's profile", and callers that ask it — region inference, account matching, continuation
+ * scoping — must keep receiving `undefined` here. Only request construction uses this function.
+ *
+ * The fallback is gated on `authType === "aws_sso_oidc"` rather than on a missing ARN, so a
+ * `kiro_desktop` account whose profile import failed keeps producing its actionable error instead
+ * of silently borrowing a service profile that does not describe it.
+ */
+export function resolveKiroRequestProfileArn(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): string | undefined {
+  return resolveKiroRequestProfile(account).profileArn;
+}
+
+/**
+ * The profileArn to send, together with WHY it was chosen.
+ *
+ * The request builder must decide the wire envelope from the same evaluation that produced the
+ * ARN. Re-deriving "is this Builder ID" from the account context alone would miss the accountless
+ * path, where the auth type comes from the locally imported credential instead: the fallback would
+ * be sent while the request was shaped as an enterprise IDE call, which is not a combination the
+ * vendor client ever produces.
+ */
+export function resolveKiroRequestProfile(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): { profileArn: string | undefined; builderIdFallback: boolean } {
+  const own = resolveKiroProfileArn(account);
+  if (own) return { profileArn: own, builderIdFallback: false };
+  const authType = account !== undefined
+    ? account.authType
+    : readImportedKiroCredential()?.authType;
+  return authType === "aws_sso_oidc"
+    ? { profileArn: KIRO_BUILDER_ID_SERVICE_PROFILE_ARN, builderIdFallback: true }
+    : { profileArn: undefined, builderIdFallback: false };
+}
+
 async function kiroTokenRefreshError(response: Response): Promise<KiroTokenRefreshError> {
   let oauthError: string | undefined;
   try {

package/src/oauth/local-token-detect.ts

@@ -24,7 +24,10 @@ export function detectGrokCliToken(): OAuthCredentials | null {
 
     const accessToken = entry.key as string;
     const refreshToken = entry.refresh_token as string;
-    const expiresAt = entry.expires_at ? new Date(entry.expires_at as string).getTime() : 0;
+    const parsedExpiresAt = entry.expires_at ? new Date(entry.expires_at as string).getTime() : 0;
+    // Guard against unparseable/NaN expiries: a non-finite value must never be treated as
+    // "valid forever". Unknown → 0, which forces the refresh-validation path downstream.
+    const expiresAt = Number.isFinite(parsedExpiresAt) ? parsedExpiresAt : 0;
 
     return {
       refresh: refreshToken,
@@ -55,6 +58,9 @@ export function shouldAdoptGrokGeneration(
   now = Date.now(),
   refreshSkewMs = 60_000,
 ): boolean {
+  // A non-finite disk expiry means we cannot reason about the generation: the credential is
+  // either garbage or unknown. Treat it as requiring refresh validation, never as an upgrade.
+  if (!Number.isFinite(disk.expires)) return false;
   if (disk.expires <= now + refreshSkewMs) return false;
   const bothExpiriesExist = stored.expires > 0 && disk.expires > 0;
   if (bothExpiriesExist) return disk.expires >= stored.expires;
@@ -108,7 +114,10 @@ export function parseClaudeOauthPayload(raw: string): OAuthCredentials | null {
     const data = JSON.parse(raw) as { claudeAiOauth?: { accessToken?: string; refreshToken?: string; expiresAt?: number } };
     const o = data.claudeAiOauth;
     if (!o?.accessToken || !o?.refreshToken) return null;
-    return { access: o.accessToken, refresh: o.refreshToken, expires: o.expiresAt ?? 0, source: "local-cli" };
+    // Number.isFinite guard: a string/NaN expiresAt must not flow into downstream time
+    // comparisons as a "valid forever" value. Unknown → 0 (refresh-validation path).
+    const expires = typeof o.expiresAt === "number" && Number.isFinite(o.expiresAt) ? o.expiresAt : 0;
+    return { access: o.accessToken, refresh: o.refreshToken, expires, source: "local-cli" };
   } catch {
     return null;
   }
@@ -119,3 +128,5 @@ export function detectClaudeCodeToken(): OAuthCredentials | null {
   if (!raw) return null;
   return parseClaudeOauthPayload(raw);
 }
+
+export { detectLocalClineToken as detectClineToken } from "./cline";

package/src/oauth/log.ts

@@ -1,5 +1,6 @@
 // src/oauth/log.ts
 import { maskAccountId } from "../lib/privacy";
+import { redactSecretString } from "../lib/redact";
 
 /** Normalize camelCase / snake_case / kebab-case field names before secret checks. */
 function normalizeFieldKey(key: string): string {
@@ -20,6 +21,7 @@ const FORBIDDEN_NORMALIZED = new Set([
   "id_token",
   "client_secret",
   "oauth_code",
+  "code_verifier",
   "clientsecret",
 ]);
 
@@ -44,5 +46,5 @@ export function logOAuthEvent(
     if (value === undefined) continue;
     parts.push(`${key}=${String(value)}`);
   }
-  console.info(parts.join(" "));
+  console.info(redactSecretString(parts.join(" ")));
 }

package/src/oauth/login-cli.ts

@@ -1,13 +1,22 @@
 import * as readline from "node:readline";
 import { openUrl } from "../lib/open-url";
 import { loadConfig, saveConfig } from "../config";
-import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
+import { findLiveProxy } from "../server/proxy-liveness";
+import {
+  requestBoundLocalProviderReload,
+  type LocalProviderReloadResult,
+} from "../server/local-provider-reload-client";
 import { isPublicOAuthProvider, listOAuthProviders, runLogin } from "./index";
 import { KEY_LOGIN_PROVIDERS, isKeyLoginProvider, validateApiKey, type KeyLoginProvider } from "./key-providers";
-import type { OcxProviderConfig } from "../types";
+import type { OcxConfig, OcxProviderConfig } from "../types";
 import { configuredAdminToken } from "../lib/admin-secrets";
 import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
 
+const LIVE_RELOAD_PROVIDERS = new Set<string>([
+  ...listOAuthProviders(),
+  ...Object.keys(KEY_LOGIN_PROVIDERS),
+]);
+
 export function runningProxyUpdateHeaders(): Headers {
   const headers = new Headers({ "Content-Type": "application/json" });
   const adminToken = configuredAdminToken();
@@ -15,34 +24,43 @@ export function runningProxyUpdateHeaders(): Headers {
   return headers;
 }
 
-/** Push the new provider into a running proxy's live config so it routes without a restart. */
-export async function notifyRunningProxy(name: string, provider: unknown): Promise<void> {
-  // Identity-checked runtime-port lookup: reaches a fallback-port proxy and avoids
-  // posting credentials-adjacent config to whatever else answers on config.port.
+/**
+ * Ask the attested runtime to reload one already-persisted provider.
+ *
+ * Returns the outcome instead of swallowing it. A running proxy that predates
+ * attested reload — or one whose runtime record no longer matches — cannot adopt
+ * the new credential, and the caller has to say so: the credential is on disk, but
+ * the live process keeps routing with the old one until it restarts. Silently
+ * printing success there is how a login appears to work and then does not.
+ */
+export async function notifyRunningProxy(name: string): Promise<LocalProviderReloadResult | null> {
+  if (!LIVE_RELOAD_PROVIDERS.has(name)) return null;
   const live = await findLiveProxy();
-  if (!live) return;
-  try {
-    await fetch(`http://${probeHostname(live.hostname)}:${live.port}/api/providers`, {
-      method: "POST",
-      headers: runningProxyUpdateHeaders(),
-      body: JSON.stringify({ name, provider }),
-    });
-  } catch {
-    /* proxy unreachable; disk config loads on next start */
-  }
+  if (!live) return null;
+  return await requestBoundLocalProviderReload(live, name);
 }
 
 /**
  * After `runLogin()` has persisted the merged provider (including preserved apiKey /
- * apiKeyPool / authMode), push that on-disk entry into a running proxy.
- *
- * Must not send `OAUTH_PROVIDERS[name].providerConfig`: POST /api/providers replaces the
- * live entry and saves it, which would drop the preserved key billing state.
+ * apiKeyPool / authMode), ask the attested proxy to reload that exact on-disk entry.
+ */
+export async function notifyRunningProxyAfterOAuthLogin(name: string): Promise<LocalProviderReloadResult | null> {
+  if (!loadConfig().providers[name]) return null;
+  return await notifyRunningProxy(name);
+}
+
+/**
+ * A live proxy was found but could not adopt the credential. `null` means there was
+ * nothing to notify (no running proxy, or a provider that never reloads live), which
+ * is not a warning-worthy state.
  */
-export async function notifyRunningProxyAfterOAuthLogin(name: string): Promise<void> {
-  const provider = loadConfig().providers[name];
-  if (!provider) return;
-  await notifyRunningProxy(name, provider);
+export function warnIfLiveReloadSkipped(result: LocalProviderReloadResult | null): void {
+  if (!result || result.kind === "reloaded") return;
+  console.warn(
+    `\n⚠️  A proxy is running but could not reload this provider (${result.reason}).`
+    + `\n   The credential is saved to disk; the running proxy keeps using the previous one.`
+    + `\n   Restart it to pick this up: ocx restart`,
+  );
 }
 
 export async function handleLogin(provider?: string): Promise<void> {
@@ -73,8 +91,9 @@ async function handleOAuthLogin(name: string): Promise<void> {
   } finally {
     rl.close();
   }
-  await notifyRunningProxyAfterOAuthLogin(name);
+  const reload = await notifyRunningProxyAfterOAuthLogin(name);
   console.log(`\n✅ Logged in to ${name}. Try: ocx sync`);
+  warnIfLiveReloadSkipped(reload);
 }
 
 export function providerConfigFromKeyLoginProvider(def: KeyLoginProvider, key: string, baseUrlOverride?: string): OcxProviderConfig {
@@ -102,10 +121,51 @@ export function providerConfigFromKeyLoginProvider(def: KeyLoginProvider, key: s
     ...(def.noPenaltyModels ? { noPenaltyModels: [...def.noPenaltyModels] } : {}),
     ...(def.autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels: [...def.autoToolChoiceOnlyModels] } : {}),
     ...(def.preserveReasoningContentModels ? { preserveReasoningContentModels: [...def.preserveReasoningContentModels] } : {}),
+    ...(def.requiresReasoningPlaceholderModels ? { requiresReasoningPlaceholderModels: [...def.requiresReasoningPlaceholderModels] } : {}),
     ...(def.escapeBuiltinToolNames !== undefined ? { escapeBuiltinToolNames: def.escapeBuiltinToolNames } : {}),
   };
 }
 
+/**
+ * Merge a freshly built key-login provider row with a previously saved row,
+ * carrying operator-owned fields the key-provider preset cannot know about.
+ * Currently that is the user-configured modelCosts overlay: rotating the API
+ * key must not silently revert Logs/Usage estimates to catalog prices.
+ */
+export function mergeKeyLoginProviderRow(
+  provider: OcxProviderConfig,
+  existing: OcxProviderConfig | undefined,
+): OcxProviderConfig {
+  return {
+    ...provider,
+    ...(existing?.modelCosts !== undefined ? { modelCosts: existing.modelCosts } : {}),
+  };
+}
+
+/**
+ * Commit a fresh key-login provider row: merge operator-owned fields from the
+ * existing row (currently the modelCosts overlay), persist the merged row, and
+ * push the SAME merged row to a running proxy so its live config cannot diverge
+ * from disk (e.g. by replacing the overlay with catalog prices until reload).
+ * Returns the merged row that was persisted and notified.
+ */
+export async function commitKeyLoginProvider(
+  config: OcxConfig,
+  name: string,
+  provider: OcxProviderConfig,
+  onLiveReload?: (result: LocalProviderReloadResult | null) => void,
+): Promise<OcxProviderConfig> {
+  const mergedProvider = mergeKeyLoginProviderRow(provider, config.providers[name]);
+  config.providers[name] = mergedProvider;
+  saveConfig(config);
+  // Evaluate the reload BEFORE the optional call: `onLiveReload?.(await ...)` short-circuits
+  // the whole argument list when no callback is supplied, so the reload would never fire for
+  // callers that do not care about the outcome.
+  const reloadResult = await notifyRunningProxy(name);
+  onLiveReload?.(reloadResult);
+  return mergedProvider;
+}
+
 async function handleKeyLogin(name: string): Promise<void> {
   const def = KEY_LOGIN_PROVIDERS[name];
   const preflightConfig = loadConfig();
@@ -148,10 +208,10 @@ async function handleKeyLogin(name: string): Promise<void> {
     console.error(`Error: ${commitCollision}.`);
     process.exit(1);
   }
-  config.providers[name] = provider;
-  saveConfig(config);
-  await notifyRunningProxy(name, provider);
+  let reload: LocalProviderReloadResult | null = null;
+  await commitKeyLoginProvider(config, name, provider, result => { reload = result; });
   console.log(`✅ ${def.label} added. Try: ocx sync`);
+  warnIfLiveReloadSkipped(reload);
 }
 
 function cloneRecordOfArrays(input: Record<string, string[]>): Record<string, string[]> {