@iislee/opencodex 2.11.0 → 2.35.0

package/src/adapters/kiro.ts

@@ -1,7 +1,7 @@
 import { decodeEventStream } from "../lib/eventstream-decoder";
 import { estimateTokens } from "../lib/token-estimate";
 import { debugProviderDiagnostic } from "../lib/debug";
-import { resolveKiroApiRegion, resolveKiroProfileArn } from "../oauth/kiro";
+import { resolveKiroApiRegion, resolveKiroRequestProfile } from "../oauth/kiro";
 import { KIRO_MODEL_CONTEXT_WINDOWS, normalizeKiroModelId } from "../providers/kiro-models";
 import { modelRecordValue } from "../reasoning-effort";
 import { parseKiroEvent } from "./kiro-events";
@@ -19,6 +19,8 @@ import { createKiroToolNameRegistry, fallbackToolUseId, fingerprint, invocationI
 import { namespacedToolName } from "../types";
 import {
   isTranslatorBudgetExceededError,
+  releaseTranslatedEvent,
+  retainTranslatedEvent,
   type TranslatorBudget,
 } from "../lib/translator-budget";
 import type {
@@ -31,17 +33,21 @@ import type {
   OcxTextContent,
   OcxToolCall,
   OcxToolResultMessage,
+  OcxTool,
   OcxUsage,
 } from "../types";
+import { hasRecordedTrailingDeliveredFinalAnswer } from "../responses/turn-termination";
 import type { ProviderAdapter } from "./base";
 import type { AdapterFetchContext, AdapterRequest } from "./base";
 import { extractKiroImages, normalizeKiroImages, type KiroImage } from "./kiro-images";
 import { sniffImageDimensions } from "./anthropic-image-guard";
 import { fetchKiroWithRetry, noteKiroTransientThrottle } from "./kiro-retry";
 import { convertKiroToolContext } from "./kiro-tools";
-import { neutralizeIdentity } from "./identity";
-import { buildNonOpenAIToolCatalogNudgeFromNames } from "./tool-catalog-nudge";
+import { normalizeEmptyExecToolResultText } from "./exec-tool-result-normalize";
+import { identifyRoutedModel } from "./identity";
+import { buildNonOpenAIToolCatalogNudgeFromNames, isBareShellBridgeTool, isCodexCodeModeExecTool } from "./tool-catalog-nudge";
 import {
+  KIRO_ANSWER_DELIVERED_MESSAGE,
   KIRO_COMPLETION_INSTRUCTIONS,
   KIRO_COMPLETION_RETRY_MESSAGE,
   KIRO_COMPLETION_TOOL_NAME,
@@ -99,7 +105,11 @@ interface KiroUserInputMessage {
 }
 interface KiroHistoryEntry {
   userInputMessage?: KiroUserInputMessage;
-  assistantResponseMessage?: { content: string; toolUses?: KiroToolUse[] };
+  assistantResponseMessage?: {
+    content: string;
+    toolUses?: KiroToolUse[];
+    reasoningContent?: { redactedContent: string };
+  };
 }
 
 function kiroToolWireNames(tools: readonly unknown[]): string[] {
@@ -312,21 +322,78 @@ function validateKiroCapabilities(parsed: OcxParsedRequest): void {
   if (choice !== undefined && choice !== "auto" && choice !== "none") {
     throw new Error("Kiro supports only automatic tool choice or tool_choice:none");
   }
-  if (parsed.options.parallelToolCalls === true) {
-    throw new Error("Kiro does not support parallel tool calls");
-  }
   if (parsed.options.serviceTier !== undefined) {
     throw new Error("Kiro does not support service tiers");
   }
-  const raw = parsed._rawBody as Record<string, unknown> | undefined;
-  if (parsed._structuredOutput || raw?.text !== undefined) {
-    throw new Error("Kiro does not support Responses text controls or structured output");
+  // Structured output is a real contract Kiro cannot honour: the wire has no
+  // schema-constrained response mode, so a caller expecting parseable JSON would receive
+  // prose and fail downstream. Refuse it.
+  //
+  // The rest of the Responses `text` object is not that. `text.verbosity` is a length
+  // preference and `text.format: {type:"text"}` is ordinary prose — the default output
+  // mode, which no capability flag governs and every correct client may send. Testing
+  // `_rawBody.text !== undefined` refused those turns for the mere PRESENCE of the key,
+  // the same mistake db040e70f removed one condition earlier where a permissive
+  // `parallel_tool_calls` hint was read as a requirement.
+  //
+  // Nothing needs stripping the way openai-responses strips a no-op verbosity:
+  // buildKiroPayload composes conversationState field by field from `parsed` and never
+  // spreads `_rawBody`, so a tolerated control is dropped by construction. The test
+  // asserts that absence so it stays true.
+  if (parsed._structuredOutput) {
+    throw new Error("Kiro does not support Responses structured output");
   }
 }
 
 type KiroTurn =
-  | { kind: "user"; content: string; images: KiroImage[]; toolResults: KiroToolResult[] }
-  | { kind: "assistant"; content: string; toolUses: KiroToolUse[] };
+  | {
+      kind: "user";
+      content: string;
+      images: KiroImage[];
+      toolResults: KiroToolResult[];
+      /**
+       * True only for the proxy-generated acknowledgement that follows a delivered final answer.
+       * A flag rather than a content comparison: a real user message may legitimately quote the
+       * same sentence, and treating that as internal state would strip its thinking tags and
+       * completion retry.
+       */
+       answerDeliveredAck?: boolean;
+    }
+  | {
+      kind: "assistant";
+      content: string;
+      toolUses: KiroToolUse[];
+      redactedReasoning?: string;
+      /**
+       * True when this assistant turn was the DELIVERED final answer (Responses
+       * `phase: "final_answer"`). A trailing assistant turn normally means the model stopped
+       * mid-task and needs a continuation prompt, but a delivered final answer already ended its
+       * turn — prompting it again restarts finished work as if a goal were still open.
+       */
+      finalAnswer?: boolean;
+    };
+
+/**
+ * True when the LAST content-bearing message is an assistant final answer that closed its turn.
+ *
+ * Mirrors the turn-merge rule: a tool call in that message, or any later user/tool-result message,
+ * means work continued, so the turn is no longer terminal. Empty assistant messages are skipped
+ * rather than treated as continuation, since they carry no visible turn.
+ */
+function hasTrailingDeliveredFinalAnswer(messages: readonly OcxMessage[], parsed?: OcxParsedRequest): boolean {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const msg = messages[i];
+    if (msg.role !== "assistant") return false;
+    const aMsg = msg as OcxAssistantMessage;
+    const hasToolCall = (aMsg.content ?? []).some(part => part.type === "toolCall");
+    if (hasToolCall) return false;
+    const hasText = (aMsg.content ?? []).some(part => part.type === "text" && part.text.trim());
+    if (!hasText) continue;
+    return aMsg.phase === "final_answer"
+      || (parsed !== undefined && hasRecordedTrailingDeliveredFinalAnswer(parsed, messages));
+  }
+  return false;
+}
 
 function appendTurnText(target: string, next: string): string {
   if (!next) return target;
@@ -381,9 +448,21 @@ function validateKiroConversationState(history: KiroHistoryEntry[], currentMessa
 function boundedInjectedInstruction(text: string, used: { value: number }): string | undefined {
   const remaining = MAX_KIRO_INJECTED_INSTRUCTION_CHARS - used.value;
   if (remaining <= 0 || !text) return undefined;
-  const result = text.length <= remaining ? text : text.slice(0, remaining);
+  let result = text.length <= remaining ? text : text.slice(0, remaining);
+  // Never end the slice on a lone high surrogate: encoding it substitutes
+  // U+FFFD into the injected instruction. One step back keeps a valid pair
+  // out instead of a broken half.
+  if (result.length > 0) {
+    const last = result.charCodeAt(result.length - 1);
+    if (last >= 0xd800 && last <= 0xdbff) result = result.slice(0, -1);
+  }
   used.value += result.length;
-  return result;
+  return result.length > 0 ? result : undefined;
+}
+
+/** Test-only: exercise the surrogate-safe instruction bound directly. */
+export function boundedInjectedInstructionForTests(text: string, used: { value: number }): string | undefined {
+  return boundedInjectedInstruction(text, used);
 }
 
 function kiroCompletionTool(): Record<string, unknown> {
@@ -423,22 +502,66 @@ export function buildKiroPayload(
   const registry = createKiroToolNameRegistry();
   const toolContext = convertKiroToolContext(parsed, registry);
   const ordinaryTools = toolContext.tools;
+  // A turn whose history already ENDS with a delivered final answer has nothing to complete.
+  // Leaving completion "required" here would keep advertising codex_kiro_final_answer with its
+  // instructions, so the model answers again, or replies with ordinary text and trips the
+  // `needsFallback` retry, which ends its payload with KIRO_COMPLETION_RETRY_MESSAGE and reopens
+  // the finished task. Suppressing the mode is what actually closes that loop; the neutral
+  // acknowledgement below only stops the resume wording.
+  //
+  // Read from parsed messages because `completionMode` is needed to build the tool catalog, which
+  // happens before the turn list exists. `forcedCompletionMode` still wins: the fallback retry
+  // passes "text_fallback" explicitly and must not be silently downgraded.
+  const trailingDeliveredAnswer = hasTrailingDeliveredFinalAnswer(kiroPayloadMessages(parsed), parsed);
   const completionMode: KiroCompletionMode = forcedCompletionMode
-    ?? (ordinaryTools.length > 0 ? "required" : "disabled");
+    ?? (ordinaryTools.length > 0 && !trailingDeliveredAnswer ? "required" : "disabled");
   const kiroTools = completionMode === "disabled"
     ? ordinaryTools
     : [...ordinaryTools, kiroCompletionTool()];
   const nameMap = toolContext.nameMap;
   const systemParts: string[] = [];
   const injectedChars = { value: 0 };
-  // Neutralize Codex's GPT-5 identity line so a routed Kiro model never misreports as GPT-5/OpenAI
-  // and the proxy identity never leaks upstream.
-  if (parsed.context.systemPrompt?.length) systemParts.push(neutralizeIdentity(parsed.context.systemPrompt.join("\n\n")));
+  // Name the Kiro model id actually sent on the wire without leaking the proxy identity upstream.
+  if (parsed.context.systemPrompt?.length) {
+    systemParts.push(identifyRoutedModel(parsed.context.systemPrompt.join("\n\n"), modelId));
+  }
   for (const addition of toolContext.systemAdditions) {
     const boundedAddition = boundedInjectedInstruction(addition, injectedChars);
     if (boundedAddition) systemParts.push(boundedAddition);
   }
-  const toolCatalogNudge = buildNonOpenAIToolCatalogNudgeFromNames(kiroToolWireNames(kiroTools));
+  // Kiro renames tools to satisfy its wire constraints, so resolve neighbor names through the
+  // registry's existing aliases; a bare-name comparison would forbid tools this turn actually
+  // advertises. Read the recorded mapping instead of calling `alias()`, which would REGISTER a
+  // name for a tool that was never advertised and pollute the collision domain.
+  const advertisedAlias = new Map<string, string>();
+  for (const [alias, wireName] of registry.nameMap) advertisedAlias.set(wireName, alias);
+  // Code mode is decided on the EMITTED catalog, not the requested list.
+  //
+  // `freeform` only exists on the requested tool objects -- `kiroToolWireNames` has already
+  // reduced the emitted catalog to strings -- so the predicates must read the objects. But the
+  // SHAPE that matters is the one the model receives: the count/byte budget can drop a requested
+  // `exec_command` while `exec` survives, and scanning the requested list would then find a shell
+  // bridge the model cannot call and suppress code mode for a catalog that is code-mode-shaped.
+  // Intersecting the two keeps `tool_choice: "none"` and budget omission correct for free: both
+  // empty the emitted set, so nothing can be named.
+  const emittedToolNames = new Set(kiroToolWireNames(kiroTools));
+  const emittedAlias = (tool: OcxTool): string | undefined => {
+    const wireName = namespacedToolName(tool.namespace, tool.name);
+    // Read the recorded mapping; `registry.alias()` would REGISTER a name here.
+    const alias = advertisedAlias.get(wireName) ?? wireName;
+    return emittedToolNames.has(alias) ? alias : undefined;
+  };
+  const requestedTools = parsed.context.tools ?? [];
+  const emittedCodeModeExec = requestedTools.find(tool => isCodexCodeModeExecTool(tool) && emittedAlias(tool));
+  const emittedShellBridge = requestedTools.some(tool => isBareShellBridgeTool(tool) && emittedAlias(tool));
+  const codeModeExecName = emittedCodeModeExec && !emittedShellBridge
+    ? emittedAlias(emittedCodeModeExec)
+    : undefined;
+  const toolCatalogNudge = buildNonOpenAIToolCatalogNudgeFromNames(
+    kiroToolWireNames(kiroTools),
+    name => advertisedAlias.get(name) ?? name,
+    codeModeExecName,
+  );
   const boundedNudge = toolCatalogNudge ? boundedInjectedInstruction(toolCatalogNudge, injectedChars) : undefined;
   if (boundedNudge) systemParts.push(boundedNudge);
   if (completionMode !== "disabled") {
@@ -458,13 +581,24 @@ export function buildKiroPayload(
       turns.push({ kind: "user", content, images: [...images], toolResults: [...toolResults] });
     }
   };
-  const pushAssistant = (content: string, toolUses: KiroToolUse[]): void => {
+  const pushAssistant = (content: string, toolUses: KiroToolUse[], redactedReasoning?: string, finalAnswer?: boolean): void => {
     const last = turns.at(-1);
     if (last?.kind === "assistant") {
       last.content = appendTurnText(last.content, content);
       last.toolUses.push(...toolUses);
+      // Merged turns keep the newest blob: it covers the reasoning up to the merged turn's end.
+      if (redactedReasoning) last.redactedReasoning = redactedReasoning;
+      // A merged turn is final only if its LAST component was: commentary appended after a final
+      // answer means the model kept working, so the turn is no longer terminal.
+      last.finalAnswer = finalAnswer === true;
     } else {
-      turns.push({ kind: "assistant", content, toolUses: [...toolUses] });
+      turns.push({
+        kind: "assistant",
+        content,
+        toolUses: [...toolUses],
+        ...(redactedReasoning ? { redactedReasoning } : {}),
+        ...(finalAnswer ? { finalAnswer: true } : {}),
+      });
     }
   };
 
@@ -494,14 +628,24 @@ export function buildKiroPayload(
         const hasReasoning = aMsg.content.some(part => part.type === "thinking" && part.thinking.trim());
         if (hasReasoning) continue;
       }
-      pushAssistant(text, toolUses);
+      // `phase` survives the Responses round trip (parser.ts assistant branch), so a replayed
+      // final answer is identifiable here rather than guessed from turn position.
+      pushAssistant(text, toolUses, aMsg.kiroRedactedReasoning, aMsg.phase === "final_answer" && toolUses.length === 0);
     } else if (msg.role === "toolResult") {
       const tr = msg as OcxToolResultMessage;
       if (tr.containsEncryptedContent) {
         throw new Error(`Kiro cannot translate encrypted output for tool call ${JSON.stringify(tr.toolCallId)}`);
       }
       const text = userContentText(tr.content);
-      const resultText = text.trim() ? text : KIRO_EMPTY_TOOL_RESULT_MESSAGE;
+      // An empty code-mode exec result needs the SPECIFIC reason, not the generic fallback: the
+      // model otherwise reads a blank result, concludes its earlier context was lost, and restarts
+      // the task instead of calling text()/notify(). Checked before `text.trim()` because the
+      // wrapper form ("Script completed\nWall time ...\nOutput:\n") is non-blank and would
+      // otherwise pass through as if it were real output.
+      const resultText = normalizeEmptyExecToolResultText(text, {
+        toolName: tr.toolName,
+        toolNamespace: tr.toolNamespace,
+      }) ?? (text.trim() ? text : KIRO_EMPTY_TOOL_RESULT_MESSAGE);
       const images = extractKiroImages(tr.content);
       const toolUseId = normalizeToolId(tr.toolCallId);
       if (!priorCalls.has(toolUseId)) {
@@ -522,12 +666,23 @@ export function buildKiroPayload(
   if (turns.length === 0 || turns[0].kind === "assistant") {
     turns.unshift({ kind: "user", content: KIRO_CONTINUATION_MESSAGE, images: [], toolResults: [] });
   }
-  if (turns.at(-1)?.kind === "assistant") {
+  // Kiro requires the request to end with a user turn, so a trailing assistant turn always gets
+  // one appended (the pop below throws otherwise). What that turn SAYS is the load-bearing part.
+  //
+  // Normally a trailing assistant turn means the model stopped mid-task, and a continuation/retry
+  // prompt is correct. A DELIVERED final answer is the exception: the turn already ended, and
+  // telling that model to "continue" or to call the completion tool again reopens finished work —
+  // the completed-task-behaves-like-an-open-goal loop. It gets a neutral acknowledgement instead:
+  // structurally valid, but carrying no instruction to resume.
+  const trailing = turns.at(-1);
+  if (trailing?.kind === "assistant") {
+    const resumeText = completionMode === "text_fallback" ? KIRO_COMPLETION_RETRY_MESSAGE : KIRO_CONTINUATION_MESSAGE;
     turns.push({
       kind: "user",
-      content: completionMode === "text_fallback" ? KIRO_COMPLETION_RETRY_MESSAGE : KIRO_CONTINUATION_MESSAGE,
+      content: trailing.finalAnswer ? KIRO_ANSWER_DELIVERED_MESSAGE : resumeText,
       images: [],
       toolResults: [],
+      ...(trailing.finalAnswer ? { answerDeliveredAck: true } : {}),
     });
   }
 
@@ -543,11 +698,14 @@ export function buildKiroPayload(
 
   const currentTurn = turns.pop();
   if (!currentTurn || currentTurn.kind !== "user") throw new Error("Kiro request must end with a user turn");
+  // Survives the pop as state, so the checks below never infer intent from user-supplied text.
+  const answerDeliveredAck = currentTurn.answerDeliveredAck === true;
   const toEntry = (turn: KiroTurn): KiroHistoryEntry => turn.kind === "assistant"
     ? {
         assistantResponseMessage: {
           content: turn.content,
           ...(turn.toolUses.length > 0 ? { toolUses: turn.toolUses } : {}),
+          ...(turn.redactedReasoning ? { reasoningContent: { redactedContent: turn.redactedReasoning } } : {}),
         },
       }
     : {
@@ -572,10 +730,17 @@ export function buildKiroPayload(
     currentUim.userInputMessageContext = { ...(currentUim.userInputMessageContext ?? {}), tools: kiroTools };
   }
   if (completionMode === "text_fallback") {
-    if (currentUim.content !== KIRO_COMPLETION_RETRY_MESSAGE) {
+    // Never append the retry instruction onto the answer-delivered acknowledgement: it exists
+    // precisely to avoid asking a finished turn for another completion call, and appending here
+    // would reinstate the loop it prevents.
+    if (currentUim.content !== KIRO_COMPLETION_RETRY_MESSAGE && !answerDeliveredAck) {
       currentUim.content = appendTurnText(currentUim.content, KIRO_COMPLETION_RETRY_MESSAGE);
     }
-  } else if (!currentUim.userInputMessageContext?.toolResults && currentUim.content !== KIRO_CONTINUATION_MESSAGE) {
+  } else if (
+    !currentUim.userInputMessageContext?.toolResults
+    && currentUim.content !== KIRO_CONTINUATION_MESSAGE
+    && !answerDeliveredAck
+  ) {
     currentUim.content = injectKiroThinkingTags(currentUim.content, parsed);
   }
 
@@ -607,8 +772,8 @@ export function buildKiroPayload(
 
 // Stream parsing (shared by parseStream + parseResponse)
 // CodeWhisperer GenerateAssistantResponse ALWAYS returns an AWS eventstream body (there is no
-// non-streaming mode), so both the streaming bridge and the non-streaming web-search sidecar loop
-// decode the same way — parseResponse just collects what parseStream yields.
+// non-streaming wire mode), so the streaming bridge and non-streaming Responses path decode the
+// same way — parseResponse just collects what parseStream yields.
 interface KiroAttemptParseResult {
   terminal?: AdapterEvent;
   needsFallback?: boolean;
@@ -830,16 +995,12 @@ async function* parseKiroAttempt(
   );
   let handedOff = false;
   try {
-    let next = await attempt.next();
-    while (!next.done) {
-      yield next.value;
-      next = await attempt.next();
-    }
+    const result = yield* attempt;
     for (const event of deferred.splice(0)) {
       try { yield event; } finally { retention.releaseEvent(event); }
     }
     handedOff = true;
-    return { ...next.value, releaseRetained: () => retention.releaseAll() };
+    return { ...result, releaseRetained: () => retention.releaseAll() };
   } finally {
     if (!handedOff) retention.releaseAll();
   }
@@ -868,6 +1029,12 @@ async function* parseKiroAttemptEvents(
   }
 
   let open: { id: string; name: string; chunks: string[]; completion: boolean } | null = null;
+  let openCallId: string | undefined;
+  const closeOpenCall = () => {
+    if (!openCallId) return;
+    budget.closeCall(openCallId);
+    openCallId = undefined;
+  };
   let outputChars = "";
   let outputCharsBytes = 0;
   let contextUsagePercentage: number | undefined;
@@ -1080,7 +1247,7 @@ async function* parseKiroAttemptEvents(
     if (!open) return { events: [] };
     const tool = open;
     open = null;
-    budget.closeCall(tool.id);
+    closeOpenCall();
     const input = tool.chunks.join("");
     if (!isCompleteKiroToolInput(input)) {
       return { events: [], terminal: protocolTerminal(kiroTruncationErrorMessage("incomplete tool input JSON"), tool.completion) };
@@ -1170,6 +1337,12 @@ async function* parseKiroAttemptEvents(
           if (ev.data) {
             yield* emitRetained(stage({ type: "reasoning_raw_delta", text: ev.data }));
           }
+          if (ev.redactedContent) {
+            yield* emitRetained(stage({ type: "kiro_redacted_reasoning", data: ev.redactedContent }));
+          }
+          break;
+        case "context_usage":
+          if (ev.contextUsagePercentage > 0) contextUsagePercentage = ev.contextUsagePercentage;
           break;
         case "tool": {
           for (const contentEvent of thinking.flush()) {
@@ -1186,11 +1359,12 @@ async function* parseKiroAttemptEvents(
             if (started.terminal) return { assistantText, sawReasoning, terminal: started.terminal };
             open = started.tool!;
             budget.openCall(open.id);
+            openCallId = open.id;
           } else if (
             (ev.toolUseId && ev.toolUseId !== open.id)
             || (ev.name && open.name !== "unknown" && ev.name !== open.name)
           ) {
-            budget.closeCall(open.id);
+            closeOpenCall();
             open = null;
             return { assistantText, sawReasoning, terminal: protocolTerminal(kiroTruncationErrorMessage("tool input changed identity before stop")) };
           }
@@ -1454,7 +1628,7 @@ async function* parseKiroAttemptEvents(
     };
   } catch (err) {
     if (isTranslatorBudgetExceededError(err)) {
-      if (open) budget.closeCall(open.id);
+      closeOpenCall();
       return {
         assistantText,
         sawReasoning,
@@ -1496,6 +1670,9 @@ async function* parseKiroAttemptEvents(
         usage: usage(),
       },
     };
+  } finally {
+    thinking.dispose();
+    closeOpenCall();
   }
 }
 
@@ -1512,7 +1689,7 @@ export async function* parseKiroStream(
   contextInputEstimate?: number,
 ): AsyncGenerator<AdapterEvent> {
   const contextWindowState: KiroContextWindowState = { value: contextWindow };
-  const first = parseKiroAttempt(
+  const firstResult = yield* parseKiroAttempt(
     response,
     budget,
     completionMode,
@@ -1524,12 +1701,6 @@ export async function* parseKiroStream(
     contextInputEstimate,
     false,
   );
-  let firstNext = await first.next();
-  while (!firstNext.done) {
-    yield firstNext.value;
-    firstNext = await first.next();
-  }
-  const firstResult = firstNext.value;
   try {
     if (!firstResult.needsFallback) {
       if (firstResult.terminal) yield firstResult.terminal;
@@ -1607,7 +1778,7 @@ export async function* parseKiroStream(
       return;
     }
 
-    const second = parseKiroAttempt(
+    const secondResult = yield* parseKiroAttempt(
       fallback.response,
       budget,
       "text_fallback",
@@ -1621,12 +1792,6 @@ export async function* parseKiroStream(
       // A zero-output transport failure here must stay non-retryable to avoid duplicating that text.
       priorEmittedOutput,
     );
-    let secondNext = await second.next();
-    while (!secondNext.done) {
-      yield secondNext.value;
-      secondNext = await second.next();
-    }
-    const secondResult = secondNext.value;
     try {
       if (!secondResult.terminal) {
         yield retryableKiroIncomplete(
@@ -1695,12 +1860,19 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
       throw new Error("kiro token missing — run ocx login kiro");
     }
     const region = resolveKiroApiRegion(parsed._kiroAuthContext);
-    const resolvedProfileArn = resolveKiroProfileArn(parsed._kiroAuthContext);
+    // Request-scoped: an AWS Builder ID account has no profile of its own and resolves to Kiro's
+    // fixed service profile here, without that value ever becoming the account's stored identity.
+    const requestProfile = resolveKiroRequestProfile(parsed._kiroAuthContext);
+    const resolvedProfileArn = requestProfile.profileArn;
     const isApiKey = provider.apiKey.trim().startsWith("ksk_");
     const profileArn = isApiKey ? undefined : resolvedProfileArn;
-    // Builder ID and Kiro API keys have no profile ARN and are accepted only on Kiro's CLI
-    // request path. Enterprise profiles retain the existing IDE-shaped request.
-    const wireClient: KiroWireClient = isApiKey || !profileArn ? "cli" : "ide";
+    // Builder ID and Kiro API keys are accepted only on Kiro's CLI request path; enterprise
+    // profiles retain the IDE-shaped request. Builder ID now carries a profile ARN, so a truthy
+    // `profileArn` no longer implies "enterprise". The wire path reads the resolver's own verdict
+    // rather than re-deriving it, so the accountless path — where the auth type comes from the
+    // local import, not the request context — cannot send the fallback inside an IDE-shaped call.
+    const isBuilderId = requestProfile.builderIdFallback;
+    const wireClient: KiroWireClient = isApiKey || isBuilderId || !profileArn ? "cli" : "ide";
     const fp = fingerprint().slice(0, 64);
     const headers: Record<string, string> = wireClient === "cli" ? {
       authorization: `Bearer ${provider.apiKey}`,
@@ -1832,6 +2004,24 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
 
   return {
     name: "kiro",
+    // A replayed history that already ENDS with a delivered final answer has nothing to ask Kiro.
+    // Before this hook the adapter still appended a trailing user turn — a neutral acknowledgement,
+    // but structurally still a prompt — and performed a real inference, so the model answered the
+    // closed task again and the finished turn behaved like a still-open goal.
+    //
+    // Suppressing the completion contract (above) removed the instruction to complete; it could not
+    // remove the inference. This is the boundary: no request is built, nothing is sent, and no token
+    // estimate is recorded.
+    //
+    // The forced-fallback build is deliberately NOT consulted here: this hook runs on the inbound
+    // turn only, and the adapter-owned bounded retry passes "text_fallback" through `build`
+    // directly, never through this path.
+    localTerminal(parsed: OcxParsedRequest) {
+      return hasTrailingDeliveredFinalAnswer(kiroPayloadMessages(parsed), parsed)
+        ? { reason: "kiro_final_answer_already_delivered" }
+        : undefined;
+    },
+
     async buildRequest(parsed: OcxParsedRequest, incoming) {
       const built = await build(parsed);
       modelId = parsed.modelId;
@@ -1874,25 +2064,32 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
       return safeKiroHttpErrorMessage(status, headers, payloadText);
     },
 
-    // Non-streaming path used by the web-search sidecar loop (loop.ts runs each iteration
-    // non-streamed so it can inspect tool calls). CW only ever event-streams, so we drain the
-    // same decoder into an array. Without this, any Codex request that includes the web_search
-    // tool failed with "web-search sidecar requires a non-streaming adapter" (kiro-only).
+    // Kiro always returns an event stream, including for non-streaming Responses requests. Drain
+    // the decoder into a budget-owned batch so an upstream stream cannot grow this array without
+    // bound while the caller waits for the complete JSON response.
     async parseResponse(response: Response, budget: TranslatorBudget): Promise<AdapterEvent[]> {
       const events: AdapterEvent[] = [];
-      for await (const e of parseKiroStream(
-        response,
-        budget,
-        modelId,
-        inputTokens,
-        contextWindow,
-        toolNameMap,
-        conversationId,
-        completionMode,
-        completionMode === "required" ? fallbackFactory : undefined,
-        contextInputEstimate,
-      )) events.push(e);
-      return events;
+      try {
+        for await (const e of parseKiroStream(
+          response,
+          budget,
+          modelId,
+          inputTokens,
+          contextWindow,
+          toolNameMap,
+          conversationId,
+          completionMode,
+          completionMode === "required" ? fallbackFactory : undefined,
+          contextInputEstimate,
+        )) {
+          retainTranslatedEvent(e, budget, events.at(-1));
+          events.push(e);
+        }
+        return events;
+      } catch (error) {
+        for (const event of events) releaseTranslatedEvent(event, budget);
+        throw error;
+      }
     },
   };
 }

package/src/adapters/mimo-free.ts

@@ -40,6 +40,18 @@ function randomUserAgent(): string {
   return USER_AGENTS[Math.floor(Math.random() * USER_AGENTS.length)]!;
 }
 
+function isCanonicalMimoFreeEndpoint(baseUrl: string): boolean {
+  try {
+    const actual = new URL(baseUrl.trim());
+    const expected = new URL(MIMO_CHAT_URL);
+    actual.pathname = actual.pathname.replace(/\/+$/, "") || "/";
+    expected.pathname = expected.pathname.replace(/\/+$/, "") || "/";
+    return actual.toString().replace(/\/$/, "") === expected.toString().replace(/\/$/, "");
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Anonymous per-install client id for the bootstrap `client` field. A random UUID
  * persisted under the config dir (OPENCODEX_HOME-aware) — deliberately NOT derived
@@ -194,6 +206,11 @@ export function injectMimoSystemMarker(body: unknown): unknown {
  * On 401/403, flushes the JWT cache and retries once via fetchResponse.
  */
 export function createMimoFreeAdapter(provider: OcxProviderConfig): ProviderAdapter {
+  if (!isCanonicalMimoFreeEndpoint(provider.baseUrl)) {
+    throw new Error(
+      "The mimo-free adapter only supports the canonical Xiaomi MiMo Free endpoint. Use openai-chat for a custom endpoint.",
+    );
+  }
   const base = createOpenAIChatAdapter(provider);
   // Per-adapter session-affinity id (random, per process instance).
   const sessionId = `ses_${Math.random().toString(36).slice(2, 26)}`;

package/src/adapters/openai-chat-url.ts

@@ -0,0 +1,11 @@
+const TRAILING_SLASHES = /\/+$/;
+const TRAILING_CHAT_COMPLETIONS = /\/chat\/completions\/?$/;
+
+/** Build the openai-chat send URL from a configured baseUrl.
+ *  Accepts /v1, /v1/, /v1/chat/completions, and /v1/chat/completions/.
+ */
+export function openaiChatCompletionsUrl(baseUrl: string): string {
+  const trimmed = baseUrl.trim().replace(TRAILING_SLASHES, "");
+  const withoutEndpoint = trimmed.replace(TRAILING_CHAT_COMPLETIONS, "");
+  return `${withoutEndpoint}/chat/completions`;
+}