@iislee/opencodex 2.31.0 → 2.35.0

package/src/oauth/generic-account-failover.ts

@@ -0,0 +1,231 @@
+/**
+ * Generic OAuth multi-account 429 failover (#2568).
+ *
+ * The API-key twin (`providers/key-failover.ts`) rotates by default for any key provider with a
+ * 2+ pool, but it returns false for `authMode === "oauth"`, and the only OAuth rotator that
+ * exists is Anthropic's — behind its own opt-in. So xAI, Cursor, Kimi, GitHub Copilot,
+ * Antigravity and Nous have no recovery path on a 429 even with several accounts logged in.
+ *
+ * Deliberately narrower than the Anthropic pool: no session affinity, no quota-ranked selection,
+ * no probe leases. Those carry provider-specific meaning; this module only answers "the account
+ * that just 429'd is cooled, is there another one we may use".
+ *
+ * NOT a home for Codex (`codex/routing.ts` owns quota scopes and probe leases) or Anthropic
+ * (`oauth/anthropic-routing.ts` owns affinity and a fail-closed local-cli credential rule).
+ * Both are excluded by `isGenericFailoverProvider`.
+ */
+import { getAccountSet } from "./store";
+import { getValidAccessSnapshotForAccount, type OAuthAccessSnapshot } from "./index";
+import { parseRetryAfterMs } from "../combos/failover";
+import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+
+/** Cap same-request rotations so a short Retry-After cannot spin. Mirrors the Anthropic bound. */
+export const GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST = 3;
+
+const DEFAULT_COOLDOWN_MS = 60_000;
+const MAX_COOLDOWN_MS = 15 * 60_000;
+
+/**
+ * How long a presence answer may be reused before the store is consulted again.
+ *
+ * `loadAuthStore` has no cache: every call chmods the config dir and the secret, reads the whole
+ * file, parses it and normalizes the store (store.ts:136-151). Since presence now decides
+ * activation, this predicate runs on paths that have not seen a 429 at all — the streaming and
+ * non-streaming runTurn entry points evaluate it once per request — so an uncached check would put
+ * a synchronous file read in front of every request for every OAuth provider.
+ *
+ * Two seconds is short enough that a login in another window is picked up before the operator can
+ * switch back and send a prompt, and long enough that a burst of requests shares one read. The
+ * cache holds a COUNT, never a credential.
+ */
+const PRESENCE_CACHE_TTL_MS = 2_000;
+
+/**
+ * Providers whose rotation is owned elsewhere and must not be handled here.
+ *
+ * `openai` is the Codex pool: quota scopes, probe leases and affinity semantics that this
+ * module deliberately does not reimplement. `anthropic` has its own pool with a fail-closed
+ * rule about background local-cli credential slots.
+ */
+const EXCLUDED_PROVIDERS = new Set(["openai", "anthropic"]);
+
+interface AccountHealth {
+  cooldownUntil: number;
+  cooldownSource: "retry-after" | "default";
+}
+
+interface PresenceEntry {
+  eligible: number;
+  readAt: number;
+}
+
+/** Process-local, like the Anthropic pool's: a restart is allowed to forget a cooldown. */
+const health = new Map<string, AccountHealth>();
+
+/** Provider -> recent eligible-account count. TTL-bounded; never holds credential material. */
+const presence = new Map<string, PresenceEntry>();
+
+const healthKey = (provider: string, accountId: string) => `${provider}\u0000${accountId}`;
+
+function isCooled(provider: string, accountId: string, now: number): boolean {
+  const entry = health.get(healthKey(provider, accountId));
+  if (!entry) return false;
+  if (entry.cooldownUntil <= now) {
+    health.delete(healthKey(provider, accountId));
+    return false;
+  }
+  return true;
+}
+
+/** True when this provider participates in generic rotation at all. */
+export function isGenericFailoverProvider(providerName: string, provider: OcxProviderConfig): boolean {
+  return provider.authMode === "oauth" && !EXCLUDED_PROVIDERS.has(providerName);
+}
+
+/**
+ * Stored accounts that could serve traffic if asked, ignoring cooldowns.
+ *
+ * Cooldowns are excluded on purpose: they are transient and per-request, while this answers the
+ * durable question "did the operator log in more than one account". Treating a cooled account as
+ * absent would switch the feature off for the rest of the cooldown, which is exactly when it is
+ * needed.
+ */
+function eligibleAccountCount(providerName: string, now: number): number {
+  const cached = presence.get(providerName);
+  if (cached && now >= cached.readAt && now - cached.readAt < PRESENCE_CACHE_TTL_MS) return cached.eligible;
+  const set = getAccountSet(providerName);
+  const eligible = set ? set.accounts.filter(account => account.needsReauth !== true).length : 0;
+  presence.set(providerName, { eligible, readAt: now });
+  return eligible;
+}
+
+/**
+ * Presence IS consent (#2568d).
+ *
+ * `hasKeyPoolFailover` already reads a 2+ key pool as the operator asking for rotation, and a
+ * second OAuth login is the same statement. One account stays a strict no-op either way, so this
+ * only changes behaviour for someone who deliberately logged in twice.
+ */
+export function hasFailoverAccountQuorum(providerName: string, now = Date.now()): boolean {
+  return eligibleAccountCount(providerName, now) >= 2;
+}
+
+/**
+ * Whether generic rotation is active for this provider.
+ *
+ * Precedence, most specific first:
+ *
+ *   1. `providers.<name>.oauthAccountFailover.enabled` — an operator may accept rotation on one
+ *      provider and refuse it on another, because provider terms differ.
+ *   2. `oauthAccountFailover.enabled` — the global switch. Anyone who already wrote `false` keeps
+ *      strict single-account behaviour across this change.
+ *   3. Presence: 2 or more eligible stored accounts (#2568d, owner decision).
+ *
+ * Only an explicit boolean overrides presence. A malformed value falls through instead of
+ * throwing, because a typo in a knob must not take a provider out of service.
+ */
+export function isGenericOAuthFailoverEnabled(
+  config: OcxConfig,
+  providerName: string,
+  now = Date.now(),
+): boolean {
+  const provider = config.providers?.[providerName];
+  if (!provider || !isGenericFailoverProvider(providerName, provider)) return false;
+  const perProvider = provider.oauthAccountFailover?.enabled;
+  if (typeof perProvider === "boolean") return perProvider;
+  const global = config.oauthAccountFailover?.enabled;
+  if (typeof global === "boolean") return global;
+  return hasFailoverAccountQuorum(providerName, now);
+}
+
+/** Accounts that may serve traffic right now: not cooled, not flagged for reauth. */
+export function eligibleFailoverAccounts(providerName: string, now = Date.now()): string[] {
+  const set = getAccountSet(providerName);
+  if (!set) return [];
+  return set.accounts
+    .filter(account => account.needsReauth !== true && !isCooled(providerName, account.id, now))
+    .map(account => account.id);
+}
+
+/**
+ * Cool the account that actually 429'd and name the next eligible one, or null.
+ *
+ * Returns the id only; the caller mints the credential so a failed refresh does not leave the
+ * cooldown applied to an account we then could not use.
+ */
+export function rotateGenericOAuthAccountOn429(
+  config: OcxConfig,
+  providerName: string,
+  failedAccountId: string,
+  retryAfterHeader: string | null | undefined,
+  now = Date.now(),
+): string | null {
+  if (!isGenericOAuthFailoverEnabled(config, providerName)) return null;
+  const set = getAccountSet(providerName);
+  // A single stored account has nowhere to go; rotating to itself would just replay the 429.
+  if (!set || set.accounts.length < 2) return null;
+
+  const parsed = parseRetryAfterMs(retryAfterHeader, now);
+  const cooldownMs = Math.min(parsed ?? DEFAULT_COOLDOWN_MS, MAX_COOLDOWN_MS);
+  health.set(healthKey(providerName, failedAccountId), {
+    cooldownUntil: now + cooldownMs,
+    cooldownSource: parsed ? "retry-after" : "default",
+  });
+  sweepExpiredOnWrite(now);
+
+  const eligible = eligibleFailoverAccounts(providerName, now).filter(id => id !== failedAccountId);
+  if (eligible.length === 0) return null;
+  // A rotation means the roster in use just changed; do not answer the next activation question
+  // from a count read before the failure.
+  presence.delete(providerName);
+  // Deterministic: start after the failed account so repeated 429s walk the roster instead of
+  // hammering whichever id happens to sort first.
+  const order = set.accounts.map(account => account.id);
+  const start = order.indexOf(failedAccountId);
+  for (let i = 1; i <= order.length; i++) {
+    const candidate = order[(start + i) % order.length]!;
+    if (candidate !== failedAccountId && eligible.includes(candidate)) return candidate;
+  }
+  return null;
+}
+
+/**
+ * Full credential snapshot for a rotated account.
+ *
+ * Returns the snapshot rather than a bare bearer: Antigravity pairs an account-matched
+ * `projectId` with its token and Kiro carries routing metadata, so a token-only swap would mix
+ * one account's bearer with another's routing data.
+ */
+export async function failoverAccountSnapshot(
+  providerName: string,
+  accountId: string,
+): Promise<OAuthAccessSnapshot> {
+  return getValidAccessSnapshotForAccount(providerName, accountId);
+}
+
+/** Earliest remaining cooldown, for a client-facing Retry-After when every account is cooled. */
+export function genericFailoverRetryAfterSeconds(providerName: string, now = Date.now()): number | null {
+  const set = getAccountSet(providerName);
+  if (!set) return null;
+  let earliest: number | null = null;
+  for (const account of set.accounts) {
+    const entry = health.get(healthKey(providerName, account.id));
+    if (!entry || entry.cooldownUntil <= now) continue;
+    if (earliest === null || entry.cooldownUntil < earliest) earliest = entry.cooldownUntil;
+  }
+  return earliest === null ? null : Math.max(1, Math.ceil((earliest - now) / 1000));
+}
+
+/** Test seam and manual-recovery hook. */
+export function clearGenericFailoverHealth(providerName?: string): void {
+  if (!providerName) {
+    health.clear();
+    presence.clear();
+    return;
+  }
+  presence.delete(providerName);
+  for (const key of [...health.keys()]) {
+    if (key.startsWith(`${providerName}\u0000`)) health.delete(key);
+  }
+}

package/src/oauth/health.ts

@@ -3,7 +3,7 @@ import { getAnthropicAccountHealthSnapshot } from "./anthropic-routing";
 import { isAccountNeedsReauth } from "../codex/account-runtime-state";
 import { getCodexAccountCredential, listCodexAccountIds } from "../codex/account-store";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
-import { readRuntimePort } from "../config";
+import { readRuntimePort } from "../config/process-state";
 import { LOCAL_MANAGEMENT_READ_PATHS } from "../lib/local-management-capability";
 import { maskAccountId } from "../lib/privacy";
 import { findLiveProxy } from "../server/proxy-liveness";

package/src/oauth/index.ts

@@ -14,6 +14,7 @@ import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity"
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
+import { loginCline, refreshClineToken } from "./cline";
 import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
@@ -58,11 +59,20 @@ export interface OAuthAccessSnapshot {
   /** Cloud Code Assist project selected during Antigravity login. */
   projectId?: string;
   /** Safe request-routing subset; refresh-only Kiro client secrets never leave the credential store. */
-  kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion">;
+  kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion" | "authType">;
+  /**
+   * Allowlisted GitHub Copilot API origin belonging to THIS account.
+   *
+   * Copilot pins its bearer to an account-scoped regional host, and the initial route already
+   * pairs the two (`core.ts` resolves transport with `getOAuthCredentialApiBaseUrl`). Account
+   * failover must carry the pairing across the rotation; without it, account B's token is sent to
+   * account A's origin (#2568d).
+   */
+  apiBaseUrl?: string;
 }
 
 export interface ObservedOAuthAccessSnapshot extends OAuthAccessSnapshot {
-  /** Allowlisted provider API origin consumed by GitHub Copilot model discovery. */
+  /** Retained for callers that predate `apiBaseUrl` moving onto the base snapshot. */
   apiBaseUrl?: string;
 }
 
@@ -237,6 +247,12 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     // Unofficial Copilot bridge — keep proactive traffic lazy-only (no background guardian spam).
     defaultRefreshPolicy: "lazy-only",
   },
+  cline: {
+    login: (ctrl, opts) => loginCline(ctrl, { importLocal: opts?.forceLogin ? "off" : "fallback", forceLogin: opts?.forceLogin }),
+    refresh: refreshClineToken,
+    providerConfig: oauthConfig("cline"),
+    defaultModel: oauthDefaultModel("cline"),
+  },
   chatgpt: {
     login: loginChatGPT,
     refresh: (rt) => refreshChatGPTToken(rt),
@@ -350,24 +366,43 @@ export function publicOAuthAuthenticationErrorMessage(error: unknown): string {
 }
 
 function accessSnapshot(provider: string, accountId: string, cred: OAuthCredentials): OAuthAccessSnapshot {
+  // Derived, not read back: a stored `authType` is trusted when present, but a credential imported
+  // before the field existed still routes correctly because the client pair implies SSO OIDC.
+  const kiroAuthType = cred.kiro?.authType
+    ?? (cred.kiro?.clientId && cred.kiro?.clientSecret ? "aws_sso_oidc" as const : undefined);
   const storedKiroRouting = {
     ...(cred.kiro?.profileArn ? { profileArn: cred.kiro.profileArn } : {}),
     ...(cred.kiro?.apiRegion ? { apiRegion: cred.kiro.apiRegion } : {}),
     ...(cred.kiro?.ssoRegion ? { ssoRegion: cred.kiro.ssoRegion } : {}),
   };
+  // `authType` is a property OF the account, not routing the environment can substitute for, so it
+  // is merged after the environment fallback decision rather than counting as stored routing.
+  // Folding it into `storedKiroRouting` would make a client-pair-only credential look non-empty
+  // and silently disable `environmentKiroRoutingMetadata()` for it.
+  const kiroAuthTypeRouting = kiroAuthType ? { authType: kiroAuthType } : {};
+  // Validated here, not at the call site: an unvalidated origin from a legacy or crafted
+  // credential must never travel with a bearer, and dropping it makes the transport fall back to
+  // the canonical host rather than to whatever the previous account was using.
+  const copilotApiBaseUrl = provider === "github-copilot"
+    ? validateCopilotApiBaseUrl(cred.apiBaseUrl)
+    : undefined;
   return {
     provider,
     accountId,
     generation: credentialGeneration(cred),
     accessToken: cred.access,
     ...(cred.projectId ? { projectId: cred.projectId } : {}),
+    ...(copilotApiBaseUrl ? { apiBaseUrl: copilotApiBaseUrl } : {}),
     // Stored account metadata remains authoritative. Metadata-less legacy/environment credentials
     // may use explicit environment routing, but never borrow the currently signed-in local CLI account.
     ...(provider === "kiro"
       ? {
-          kiro: Object.keys(storedKiroRouting).length > 0
-            ? storedKiroRouting
-            : environmentKiroRoutingMetadata() ?? {},
+          kiro: {
+            ...(Object.keys(storedKiroRouting).length > 0
+              ? storedKiroRouting
+              : environmentKiroRoutingMetadata() ?? {}),
+            ...kiroAuthTypeRouting,
+          },
         }
       : {}),
   };
@@ -467,7 +502,7 @@ export async function getValidAccessTokenSnapshot(provider: string): Promise<OAu
 }
 
 /** Providers whose upstream-401 replay path may force a snapshot refresh. */
-const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot", "kiro"]);
+const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot", "kiro", "cline"]);
 
 export async function forceRefreshOAuthAccessSnapshot(
   rejected: OAuthAccessSnapshot,
@@ -490,6 +525,22 @@ export async function getValidAccessTokenForAccount(provider: string, accountId:
   return (await resolveAccessSnapshotForAccount(provider, accountId)).accessToken;
 }
 
+/**
+ * Account-scoped resolver returning the FULL snapshot, not just the bearer.
+ *
+ * A rotator that swaps only the token silently mixes credential generations: Antigravity pairs
+ * an account-matched `projectId` with its token (see the pairing comment in
+ * server/responses/core.ts), Kiro carries routing metadata, and Copilot's observed snapshot
+ * carries an account-specific API origin. Reading those back from "whichever account is active"
+ * after a rotation is exactly the mixing this returns in one piece to prevent (#2568).
+ */
+export async function getValidAccessSnapshotForAccount(
+  provider: string,
+  accountId: string,
+): Promise<OAuthAccessSnapshot> {
+  return resolveAccessSnapshotForAccount(provider, accountId);
+}
+
 /** Terminal refresh failures (revoked/rotated-away grants) — retrying cannot succeed. */
 function isTerminalRefreshError(err: unknown): boolean {
   const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
@@ -1079,6 +1130,14 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   if (existing?.modelCosts !== undefined) {
     next.modelCosts = existing.modelCosts;
   }
+  // The per-provider account-failover opt-out is operator intent about SPENDING, and the login
+  // path is exactly where losing it does damage: adding a second account both rebuilds this row
+  // from the preset and creates the 2-account quorum that turns presence-driven rotation on
+  // (#2568d). Dropping the opt-out here would enable the thing the operator switched off, at the
+  // moment they were doing something unrelated.
+  if (existing?.oauthAccountFailover !== undefined) {
+    next.oauthAccountFailover = existing.oauthAccountFailover;
+  }
   if (existing && getProviderRegistryEntry(provider)?.allowKeyAuthOverride === true) {
     // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
     let storedApiKey = sanitizeApiKeyValue(existing.apiKey);

package/src/oauth/key-providers.ts

@@ -19,7 +19,8 @@ export const KEY_LOGIN_PROVIDERS: Record<string, KeyLoginProvider> = deriveKeyLo
  * caller didn't already supply. Lets the vision/reasoning classification actually reach the saved
  * config (the GUI/API only send adapter/baseUrl/apiKey/defaultModel). No-op for unknown names.
  *
- * `modelSupportsReasoningSummaries` is deliberately excluded from what gets persisted. It is
+ * `modelSupportsReasoningSummaries` and the verbosity capability are deliberately excluded from
+ * what gets persisted. They are
  * registry-only metadata resolved at runtime, and this function feeds a config that is about to
  * be written to disk. Persisting today's registry defaults would freeze them as the user's own
  * overrides: a later registry correction — say we learn a model's backend rejects summary
@@ -30,9 +31,17 @@ export const KEY_LOGIN_PROVIDERS: Record<string, KeyLoginProvider> = deriveKeyLo
 export function enrichProviderFromCatalog(name: string, prov: OcxProviderConfig): void {
   const hadOwnSummaries = Object.hasOwn(prov, "modelSupportsReasoningSummaries");
   const submittedSummaries = prov.modelSupportsReasoningSummaries;
+  const hadOwnVerbosity = Object.hasOwn(prov, "modelSupportsVerbosity");
+  const submittedVerbosity = prov.modelSupportsVerbosity;
+  const hadOwnProviderVerbosity = Object.hasOwn(prov, "supportsVerbosity");
+  const submittedProviderVerbosity = prov.supportsVerbosity;
   enrichProviderFromRegistry(name, prov);
   if (hadOwnSummaries) prov.modelSupportsReasoningSummaries = submittedSummaries;
   else delete prov.modelSupportsReasoningSummaries;
+  if (hadOwnVerbosity) prov.modelSupportsVerbosity = submittedVerbosity;
+  else delete prov.modelSupportsVerbosity;
+  if (hadOwnProviderVerbosity) prov.supportsVerbosity = submittedProviderVerbosity;
+  else delete prov.supportsVerbosity;
 }
 
 export function isKeyLoginProvider(name: string): boolean {

package/src/oauth/kimi.ts

@@ -209,7 +209,15 @@ async function pollForToken(deviceCode: string, intervalMs: number, expiresInMs:
 
 export async function loginKimi(ctrl: OAuthController): Promise<OAuthCredentials> {
   const device = await requestDeviceAuthorization();
-  ctrl.onAuth?.({ url: device.verificationUriComplete, instructions: `Enter code: ${device.userCode}` });
+  // `deviceCode` carries the human-typed user code, matching the other device
+  // providers. It is also what tells the management login route this is a device
+  // flow, so a provider-supplied verification URI is no longer handed to a local
+  // browser spawn — the URL stays visible and copyable in every login surface.
+  ctrl.onAuth?.({
+    url: device.verificationUriComplete,
+    instructions: `Enter code: ${device.userCode}`,
+    deviceCode: device.userCode,
+  });
   return pollForToken(device.deviceCode, device.intervalMs, device.expiresInMs, ctrl.signal);
 }
 

package/src/oauth/kiro.ts

@@ -28,6 +28,7 @@ import {
 } from "./kiro-credentials";
 import { homedir } from "node:os";
 import { getAccountSet, saveAccountCredential } from "./store";
+import { KIRO_BUILDER_ID_SERVICE_PROFILE_ARN } from "../adapters/kiro-constants";
 
 const DEFAULT_REGION = "us-east-1";
 const REFRESH_URL = "https://prod.{region}.auth.desktop.kiro.dev/refreshToken";
@@ -473,6 +474,50 @@ export function resolveKiroProfileArn(account?: Pick<KiroOAuthMetadata, "profile
   return readImportedKiroCredential()?.profileArn;
 }
 
+/**
+ * Resolve the profileArn actually SENT upstream, which is not always the account's own.
+ *
+ * An AWS Builder ID account authenticates through SSO OIDC and never receives an account-scoped
+ * profile ARN, so gated models reject its requests with a `profileArn`-demanding
+ * `ValidationException`. The Kiro CLI handles this by carrying a fixed service profile on Builder
+ * ID requests, and this mirrors that.
+ *
+ * Deliberately separate from `resolveKiroProfileArn`: that resolver answers "what is this
+ * account's profile", and callers that ask it — region inference, account matching, continuation
+ * scoping — must keep receiving `undefined` here. Only request construction uses this function.
+ *
+ * The fallback is gated on `authType === "aws_sso_oidc"` rather than on a missing ARN, so a
+ * `kiro_desktop` account whose profile import failed keeps producing its actionable error instead
+ * of silently borrowing a service profile that does not describe it.
+ */
+export function resolveKiroRequestProfileArn(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): string | undefined {
+  return resolveKiroRequestProfile(account).profileArn;
+}
+
+/**
+ * The profileArn to send, together with WHY it was chosen.
+ *
+ * The request builder must decide the wire envelope from the same evaluation that produced the
+ * ARN. Re-deriving "is this Builder ID" from the account context alone would miss the accountless
+ * path, where the auth type comes from the locally imported credential instead: the fallback would
+ * be sent while the request was shaped as an enterprise IDE call, which is not a combination the
+ * vendor client ever produces.
+ */
+export function resolveKiroRequestProfile(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): { profileArn: string | undefined; builderIdFallback: boolean } {
+  const own = resolveKiroProfileArn(account);
+  if (own) return { profileArn: own, builderIdFallback: false };
+  const authType = account !== undefined
+    ? account.authType
+    : readImportedKiroCredential()?.authType;
+  return authType === "aws_sso_oidc"
+    ? { profileArn: KIRO_BUILDER_ID_SERVICE_PROFILE_ARN, builderIdFallback: true }
+    : { profileArn: undefined, builderIdFallback: false };
+}
+
 async function kiroTokenRefreshError(response: Response): Promise<KiroTokenRefreshError> {
   let oauthError: string | undefined;
   try {

package/src/oauth/local-token-detect.ts

@@ -128,3 +128,5 @@ export function detectClaudeCodeToken(): OAuthCredentials | null {
   if (!raw) return null;
   return parseClaudeOauthPayload(raw);
 }
+
+export { detectLocalClineToken as detectClineToken } from "./cline";

package/src/oauth/open-browser-choice.ts

@@ -0,0 +1,26 @@
+import type { OcxConfig } from "../types";
+
+/**
+ * Whether a login should open a browser on the machine running the proxy.
+ *
+ * Both login routes share this so the two surfaces cannot drift: a per-request
+ * `openBrowser` beats the persisted setting, and the persisted setting beats
+ * the historical default. It lives in `src/oauth/` rather than beside either
+ * route because `src/codex/auth-api.ts` and
+ * `src/server/management/oauth-account-routes.ts` both already import from
+ * here, so no new edge is added to the import graph.
+ *
+ * The default is the important part. An operator who upgrades and configures
+ * nothing must see exactly what they saw before, so only an explicit `false`
+ * declines — `undefined`, `true`, and a malformed value all open.
+ *
+ * A malformed request field is ignored rather than rejected on purpose: this is
+ * a display preference, and no login should fail because of one.
+ */
+export function shouldOpenBrowserForLogin(
+  requested: unknown,
+  config: Pick<OcxConfig, "oauthOpenBrowser">,
+): boolean {
+  if (typeof requested === "boolean") return requested;
+  return config.oauthOpenBrowser !== false;
+}

package/src/oauth/store.ts

@@ -591,17 +591,26 @@ export async function upsertCredentialByIdentity(
   }, [provider, safe]);
 }
 
-/** Remove the ACTIVE account; remaining accounts promote the first one. */
-export async function removeCredential(provider: string): Promise<void> {
-  await mutateStore(store => {
+/**
+ * Remove the ACTIVE account; remaining accounts promote the first one.
+ *
+ * Returns what actually happened, which a caller cannot otherwise know. A read-then-remove
+ * preflight is not equivalent: `mutateStore` serializes mutations, so between a caller's
+ * `getAccountSet` check and its `removeCredential` call another process can remove the same
+ * account, and both callers would then report a removal that only one of them performed.
+ * Deciding inside the mutation is the only place the answer is true when it is returned.
+ */
+export async function removeCredential(provider: string): Promise<"removed" | "not-found"> {
+  return await mutateStore(store => {
     const set = store[provider];
-    if (!set) return;
+    if (!set) return "not-found" as const;
     set.accounts = set.accounts.filter(a => a.id !== set.activeAccountId);
     if (set.accounts.length === 0) {
       delete store[provider];
-      return;
+      return "removed" as const;
     }
     set.activeAccountId = set.accounts[0]!.id;
+    return "removed" as const;
   }, [provider]);
 }
 

package/src/oauth/types.ts

@@ -1,6 +1,16 @@
 /** Minimal OAuth types, ported from jawcode packages/ai/src/utils/oauth/types.ts. */
 export type OAuthCredentialSource = "oauth" | "local-cli" | "credential-file" | "environment" | "manual";
 
+/**
+ * How the account authenticated. Mirrors `KiroAuthType` in `./kiro-credentials`, restated here so
+ * the credential-store types do not depend on the SQLite import module.
+ *
+ * `aws_sso_oidc` covers AWS Builder ID, which never issues an account-scoped CodeWhisperer
+ * profile ARN; the adapter needs that distinction to tell a Builder ID account apart from a
+ * `kiro_desktop` account whose profile import merely failed.
+ */
+export type KiroCredentialAuthType = "kiro_desktop" | "aws_sso_oidc";
+
 /** Account-scoped Kiro data required for refresh and request routing. */
 export interface KiroOAuthMetadata {
   profileArn?: string;
@@ -8,6 +18,11 @@ export interface KiroOAuthMetadata {
   apiRegion?: string;
   clientId?: string;
   clientSecret?: string;
+  /**
+   * Non-secret routing signal. Derived from the presence of a device-registration client pair, so
+   * it stays accurate even though `clientId`/`clientSecret` never leave the credential store.
+   */
+  authType?: KiroCredentialAuthType;
 }
 
 export type OAuthCredentials = {

package/src/providers/auto-compact-budget.ts

@@ -0,0 +1,65 @@
+import { SUPPORTED_NATIVE_OPENAI_SLUGS } from "../codex/catalog/native-models";
+import { redactSecretString } from "../lib/redact";
+
+const RESERVED_OBJECT_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+function positiveSafeInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+/**
+ * Resolve a client-facing soft compaction budget without changing any hard
+ * model limit. Configuration and measured input ceilings may only lower the
+ * default 90% envelope.
+ */
+export function clampAutoCompactTokenLimit(
+  contextWindow: number,
+  maxInputTokens?: number,
+  configuredLimit?: number,
+): number {
+  const candidates = [Math.floor(contextWindow * 0.9), contextWindow];
+  if (positiveSafeInteger(maxInputTokens)) candidates.push(maxInputTokens);
+  if (positiveSafeInteger(configuredLimit)) candidates.push(configuredLimit);
+  return Math.min(...candidates);
+}
+
+export type AutoCompactBudgetValidationOptions = Readonly<{
+  /** PATCH accepts null for whole-map and per-key deletion. */
+  allowTombstones?: boolean;
+  /** The canonical ChatGPT provider accepts only exact supported native ids. */
+  requireNativeIds?: boolean;
+}>;
+
+/** Shared config/load/management boundary for per-model soft budgets. */
+export function modelAutoCompactTokenLimitsConfigError(
+  value: unknown,
+  options: AutoCompactBudgetValidationOptions = {},
+): string | null {
+  const field = "modelAutoCompactTokenLimits";
+  if (value === undefined || (options.allowTombstones && value === null)) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return `${field} must be a plain object${options.allowTombstones ? " or null" : ""}`;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    return `${field} must be a plain object with own properties`;
+  }
+  for (const [modelId, entry] of Object.entries(value as Record<string, unknown>)) {
+    const safeModelId = JSON.stringify(redactSecretString(modelId));
+    if (!modelId.trim()) return `${field} keys must be nonblank model ids`;
+    if (RESERVED_OBJECT_KEYS.has(modelId)) {
+      return `${field} key ${safeModelId} is reserved`;
+    }
+    if (options.requireNativeIds
+      && (modelId.includes("/") || !SUPPORTED_NATIVE_OPENAI_SLUGS.has(modelId))) {
+      return `${field} key ${safeModelId} must be an exact supported native model id`;
+    }
+    if (options.allowTombstones && entry === null) continue;
+    if (!positiveSafeInteger(entry)) {
+      return `${field}[${safeModelId}] must be a positive safe integer${
+        options.allowTombstones ? " or null" : ""
+      }`;
+    }
+  }
+  return null;
+}