@yansigit/opencodex 2.31.0

package/src/providers/free-directory.ts

@@ -0,0 +1,187 @@
+export type ProviderAccessGroup =
+  | "recurring-or-keyless"
+  | "recurring-uncapped"
+  | "recurring-credit"
+  | "signup-credit";
+
+export const FREE_PROVIDER_ACCESS_GROUPS = {
+  "recurring-or-keyless": [
+    "agy", "aihorde", "api-airforce", "arcee-ai", "bazaarlink", "blackbox", "bluesminds", "cerebras",
+    "cloudflare-ai", "cohere", "coze", "duckduckgo-web", "felo-web", "friendliai", "gemini", "github-models",
+    "groq", "hackclub", "huggingchat", "huggingface", "iflytek", "inference-net", "kiro", "liquid", "llm7",
+    "mistral", "morph", "muse-spark-web", "nara", "navy", "nlpcloud", "ollama-cloud", "opencode", "openrouter",
+    "ovhcloud", "pollinations", "puter", "qwen-web", "reka", "sambanova", "sparkdesk", "t3-web", "uncloseai",
+  ],
+  "recurring-uncapped": [
+    "agnes", "ainative", "aion", "baidu", "glm", "glm-cn", "kilo-gateway", "opencode-zen", "requesty",
+    "routeway", "sealion", "siliconflow", "tencent",
+  ],
+  "recurring-credit": ["bytez", "nous-research"],
+  "signup-credit": [
+    "agentrouter", "ai21", "baichuan", "baseten", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
+    "hyperbolic", "longcat", "monsterapi", "nebius", "novita", "nscale", "nvidia", "predibase", "publicai", "qoder",
+    "scaleway", "sensenova", "stepfun", "together", "vertex",
+  ],
+} as const satisfies Record<ProviderAccessGroup, readonly string[]>;
+
+export interface FreeDirectoryProvider {
+  id: string;
+  label: string;
+  adapter: string;
+  baseUrl: string;
+  authKind: "oauth" | "key";
+  accessGroups: readonly ProviderAccessGroup[];
+  supportLevel: "supported" | "experimental" | "reference";
+  verification: "official" | "primary" | "unverified";
+  documentationUrl?: string;
+  modelsUrl?: string;
+  discovery: "live" | "static" | "hybrid" | "unsupported";
+  /**
+   * Date the endpoint was checked against provider documentation. Only rows that were actually
+   * verified carry it — a uniform date on an `unverified` row is a claim nobody made.
+   */
+  lastVerified?: string;
+  dashboardUrl?: string;
+  keyOptional?: boolean;
+  models?: string[];
+  liveModels: boolean;
+  /** Anthropic-compatible gateways that may close streams before terminal frames. */
+  anthropicEofTolerance?: boolean;
+  note?: string;
+  googleMode?: "ai-studio" | "vertex";
+}
+
+type ConnectableOverride = Partial<Omit<FreeDirectoryProvider, "id" | "accessGroups">>;
+
+const LAST_VERIFIED = "2026-07-23";
+/**
+ * Connectable rows carry `lastVerified` because their endpoint was checked against provider
+ * documentation on that date. Reference rows built by the generator below deliberately omit it:
+ * stamping a verification date on a row marked `unverified` asserts provenance nobody produced.
+ */
+const openAi = (baseUrl: string, dashboardUrl: string, extra: Partial<ConnectableOverride> = {}): ConnectableOverride => ({
+  baseUrl,
+  dashboardUrl,
+  adapter: "openai-chat",
+  authKind: "key",
+  supportLevel: "experimental",
+  verification: "primary",
+  discovery: "live",
+  liveModels: true,
+  lastVerified: LAST_VERIFIED,
+  ...extra,
+});
+
+// API roots are limited to documented or primary-source integrations. Consumer-web/session
+// providers remain reference-only: this directory never asks users to paste cookies or bypass WAFs.
+const CONNECTABLE: Record<string, ConnectableOverride> = {
+  kiro: { baseUrl: "https://runtime.us-east-1.kiro.dev", dashboardUrl: "https://kiro.dev", adapter: "kiro", authKind: "oauth", supportLevel: "supported", verification: "official", documentationUrl: "https://kiro.dev/docs/cli/authentication/", lastVerified: LAST_VERIFIED, discovery: "static", liveModels: false },
+  aihorde: openAi("https://oai.aihorde.net/v1", "https://aihorde.net", { modelsUrl: "https://oai.aihorde.net/v1/models" }),
+  "arcee-ai": openAi("https://conductor.arcee.ai/v1", "https://conductor.arcee.ai", { verification: "official", documentationUrl: "https://docs.arcee.ai/" }),
+  cerebras: openAi("https://api.cerebras.ai/v1", "https://cloud.cerebras.ai/platform/apikeys", { supportLevel: "supported", verification: "official", documentationUrl: "https://inference-docs.cerebras.ai/api-reference/models/list" }),
+  "cloudflare-ai": openAi("https://api.cloudflare.com/client/v4/accounts/{account_id}/ai/v1", "https://dash.cloudflare.com/?to=/:account/ai/workers-ai", { supportLevel: "supported", verification: "official", documentationUrl: "https://developers.cloudflare.com/workers-ai/configuration/open-ai-compatibility/", discovery: "static", liveModels: false, models: ["@cf/meta/llama-3.3-70b-instruct-fp8-fast", "@cf/qwen/qwq-32b"] }),
+  cohere: openAi("https://api.cohere.com/compatibility/v1", "https://dashboard.cohere.com/api-keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.cohere.com/reference/list-models", modelsUrl: "https://api.cohere.com/compatibility/v1/models" }),
+  friendliai: openAi("https://api.friendli.ai/serverless/v1", "https://suite.friendli.ai", { modelsUrl: "https://api.friendli.ai/serverless/v1/models" }),
+  gemini: { baseUrl: "https://generativelanguage.googleapis.com", dashboardUrl: "https://aistudio.google.com/apikey", adapter: "google", authKind: "key", supportLevel: "supported", verification: "official", documentationUrl: "https://ai.google.dev/api/models", lastVerified: LAST_VERIFIED, discovery: "live", liveModels: true, googleMode: "ai-studio", models: ["gemini-3.7-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview"] },
+  "github-models": openAi("https://models.github.ai/inference", "https://github.com/settings/tokens", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.github.com/en/github-models/prototyping-with-ai-models", discovery: "static", liveModels: false, models: ["openai/gpt-4.1", "meta/llama-4-scout-17b-16e-instruct"] }),
+  groq: openAi("https://api.groq.com/openai/v1", "https://console.groq.com/keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://console.groq.com/docs/api-reference#models" }),
+  hackclub: openAi("https://ai.hackclub.com/proxy/v1", "https://ai.hackclub.com", { modelsUrl: "https://ai.hackclub.com/proxy/v1/models" }),
+  huggingface: openAi("https://router.huggingface.co/v1", "https://huggingface.co/settings/tokens", { supportLevel: "supported", verification: "official", documentationUrl: "https://huggingface.co/docs/inference-providers/index", modelsUrl: "https://router.huggingface.co/v1/models" }),
+  // The OpenAI-compatible base URL is documented in the HTTP guide; Web.html covers the
+  // WebSocket protocol and does not describe this endpoint.
+  iflytek: openAi("https://spark-api-open.xf-yun.com/v1", "https://console.xfyun.cn", { verification: "official", documentationUrl: "https://www.xfyun.cn/doc/spark/HTTP%E8%B0%83%E7%94%A8%E6%96%87%E6%A1%A3.html" }),
+  liquid: openAi("https://inference.liquid.ai/v1", "https://playground.liquid.ai", { modelsUrl: "https://inference.liquid.ai/v1/models" }),
+  mistral: openAi("https://api.mistral.ai/v1", "https://console.mistral.ai/api-keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.mistral.ai/api/endpoint/models" }),
+  morph: openAi("https://api.morphllm.com/v1", "https://morphllm.com", { verification: "official", documentationUrl: "https://docs.morphllm.com/api-reference/introduction" }),
+  "ollama-cloud": openAi("https://ollama.com/v1", "https://ollama.com/settings/keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.ollama.com/cloud", modelsUrl: "https://ollama.com/api/tags" }),
+  opencode: openAi("https://opencode.ai/zen/v1", "https://opencode.ai/auth", { supportLevel: "supported", verification: "official", documentationUrl: "https://opencode.ai/docs/zen/", modelsUrl: "https://opencode.ai/zen/v1/models" }),
+  openrouter: openAi("https://openrouter.ai/api/v1", "https://openrouter.ai/keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://openrouter.ai/docs/api/api-reference/models/get-models" }),
+  ovhcloud: openAi("https://oai.endpoints.kepler.ai.cloud.ovh.net/v1", "https://console.ovhcloud.com", { keyOptional: true, modelsUrl: "https://oai.endpoints.kepler.ai.cloud.ovh.net/v1/models" }),
+  pollinations: openAi("https://gen.pollinations.ai/v1", "https://pollinations.ai", { keyOptional: true }),
+  reka: openAi("https://api.reka.ai/v1", "https://platform.reka.ai"),
+  sambanova: openAi("https://api.sambanova.ai/v1", "https://cloud.sambanova.ai/apis", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.sambanova.ai/docs/en/get-started/api-keys-urls", modelsUrl: "https://api.sambanova.ai/v1/models", lastVerified: "2026-08-02" }),
+  sparkdesk: openAi("https://spark-api-open.xf-yun.com/v1", "https://console.xfyun.cn", { verification: "official", documentationUrl: "https://www.xfyun.cn/doc/spark/HTTP%E8%B0%83%E7%94%A8%E6%96%87%E6%A1%A3.html" }),
+  agnes: openAi("https://apihub.agnes-ai.com/v1", "https://agnes-ai.com"),
+  ainative: openAi("https://api.ainative.studio/api/v1", "https://ainative.studio", { modelsUrl: "https://api.ainative.studio/api/v1/models" }),
+  aion: openAi("https://api.aionlabs.ai/v1", "https://aionlabs.ai", { modelsUrl: "https://api.aionlabs.ai/v1/models" }),
+  baidu: openAi("https://qianfan.baidubce.com/v2", "https://console.bce.baidu.com/qianfan/ais/console/applicationConsole/application", { verification: "official", documentationUrl: "https://cloud.baidu.com/doc/WENXINWORKSHOP/s/Fm2vrveyu", discovery: "static", liveModels: false, models: ["ernie-5.1", "ernie-5.0", "ernie-4.5-turbo-128k"] }),
+  glm: openAi("https://api.z.ai/api/coding/paas/v4", "https://z.ai/manage-apikey/apikey-list", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.z.ai/guides/overview/quick-start", discovery: "static", liveModels: false, models: ["glm-5"] }),
+  "glm-cn": openAi("https://open.bigmodel.cn/api/coding/paas/v4", "https://open.bigmodel.cn/usercenter/apikeys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.bigmodel.cn/cn/api/introduction", discovery: "static", liveModels: false, models: ["glm-4.5-flash"] }),
+  "kilo-gateway": openAi("https://api.kilo.ai/api/gateway", "https://kilo.ai", { modelsUrl: "https://api.kilo.ai/api/gateway/models" }),
+  "opencode-zen": openAi("https://opencode.ai/zen/v1", "https://opencode.ai/auth", { supportLevel: "supported", verification: "official", documentationUrl: "https://opencode.ai/docs/zen/" }),
+  requesty: openAi("https://router.requesty.ai/v1", "https://app.requesty.ai", { modelsUrl: "https://router.requesty.ai/v1/models" }),
+  routeway: openAi("https://api.routeway.ai/v1", "https://routeway.ai", { modelsUrl: "https://api.routeway.ai/v1/models" }),
+  sealion: openAi("https://api.sea-lion.ai/v1", "https://sea-lion.ai", { discovery: "static", liveModels: false, models: ["aisingapore/Llama-SEA-LION-v3.5-70B-R", "aisingapore/Llama-SEA-LION-v3-70B-IT", "aisingapore/Gemma-SEA-LION-v4-27B-IT", "aisingapore/Qwen-SEA-LION-v4.5-27B-IT", "aisingapore/Qwen-SEA-LION-v4-32B-IT"] }),
+  siliconflow: openAi("https://api.siliconflow.cn/v1", "https://cloud.siliconflow.cn/account/ak", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.siliconflow.cn/en/api-reference/models/get-model-list" }),
+  tencent: openAi("https://api.hunyuan.cloud.tencent.com/v1", "https://console.cloud.tencent.com/hunyuan/api-key", { verification: "official", documentationUrl: "https://cloud.tencent.com/document/product/1729/111007", discovery: "static", liveModels: false, models: ["hunyuan-turbos-latest", "hunyuan-t1-latest", "hunyuan-pro", "hunyuan-lite"] }),
+  // Endpoint is live, but the recurring-credit terms could not be confirmed, so this row stays
+  // `unverified` and drops the shared verification date rather than borrowing it.
+  bytez: openAi("https://api.bytez.com/models/v2/openai/v1", "https://bytez.com", { verification: "unverified", lastVerified: undefined, documentationUrl: "https://docs.bytez.com/", discovery: "static", liveModels: false, models: ["meta-llama/Llama-3.3-70B-Instruct", "mistralai/Mistral-7B-Instruct-v0.3", "Qwen/Qwen2.5-72B-Instruct"], note: "The recurring-credit classification is retained from the requested catalog, but the current reset terms could not be independently verified." }),
+  "nous-research": openAi("https://inference-api.nousresearch.com/v1", "https://portal.nousresearch.com", { discovery: "static", liveModels: false, models: ["Hermes-4-405B", "Hermes-4-70B"] }),
+  agentrouter: { baseUrl: "https://agentrouter.org", dashboardUrl: "https://agentrouter.org", adapter: "anthropic", authKind: "key", supportLevel: "experimental", verification: "primary", modelsUrl: "https://agentrouter.org/v1/models", lastVerified: LAST_VERIFIED, discovery: "live", liveModels: true, anthropicEofTolerance: true },
+  ai21: openAi("https://api.ai21.com/studio/v1", "https://studio.ai21.com/account/api-key", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.ai21.com/reference/models" }),
+  baichuan: openAi("https://api.baichuan-ai.com/v1", "https://platform.baichuan-ai.com/console/apikey", { verification: "official" }),
+  // Verified end-to-end 2026-07-30: /v1/models returns the OpenAI-shaped live catalog (13 models),
+  // and a chat completion against moonshotai/Kimi-K3 returned a standard chat.completion payload.
+  baseten: openAi("https://inference.baseten.co/v1", "https://app.baseten.co/settings/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.baseten.co/inference/model-apis/overview", modelsUrl: "https://inference.baseten.co/v1/models", lastVerified: "2026-07-30" }),
+  deepinfra: openAi("https://api.deepinfra.com/v1/openai", "https://deepinfra.com/dash/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://deepinfra.com/docs/openai_api" }),
+  deepseek: openAi("https://api.deepseek.com", "https://platform.deepseek.com/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://api-docs.deepseek.com/api/list-models" }),
+  doubao: openAi("https://ark.cn-beijing.volces.com/api/v3", "https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey", { verification: "official" }),
+  fireworks: openAi("https://api.fireworks.ai/inference/v1", "https://fireworks.ai/account/api-keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.fireworks.ai/api-reference/list-models", modelsUrl: "https://api.fireworks.ai/v1/accounts/fireworks/models?filter=supports_serverless=true" }),
+  "freemodel-dev": openAi("https://api.freemodel.dev/v1", "https://freemodel.dev", { modelsUrl: "https://api.freemodel.dev/v1/models" }),
+  hyperbolic: openAi("https://api.hyperbolic.xyz/v1", "https://app.hyperbolic.xyz/settings", { verification: "official" }),
+  longcat: openAi("https://api.longcat.chat/openai/v1", "https://longcat.chat", { verification: "official", discovery: "static", liveModels: false, models: ["LongCat-2.0"] }),
+  monsterapi: openAi("https://api.monsterapi.ai/v1", "https://monsterapi.ai", { verification: "official" }),
+  nebius: openAi("https://api.tokenfactory.nebius.com/v1", "https://tokenfactory.nebius.com", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.tokenfactory.nebius.com/quickstart", modelsUrl: "https://api.tokenfactory.nebius.com/v1/models?verbose=true", lastVerified: "2026-08-02" }),
+  novita: openAi("https://api.novita.ai/openai/v1", "https://novita.ai/settings/key-management", { supportLevel: "supported", verification: "official", modelsUrl: "https://api.novita.ai/openai/v1/models" }),
+  nscale: openAi("https://inference.api.nscale.com/v1", "https://console.nscale.com", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.nscale.com/docs/use-cases/chat", modelsUrl: "https://inference.api.nscale.com/v1/models", lastVerified: "2026-08-03" }),
+  nvidia: openAi("https://integrate.api.nvidia.com/v1", "https://build.nvidia.com", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.api.nvidia.com/nim/reference/llm-apis" }),
+  publicai: openAi("https://api.publicai.co/v1", "https://publicai.co"),
+  scaleway: openAi("https://api.scaleway.ai/v1", "https://console.scaleway.com/generative-api", { supportLevel: "supported", verification: "official", documentationUrl: "https://www.scaleway.com/en/docs/generative-apis/api-cli/using-generative-apis/", modelsUrl: "https://api.scaleway.ai/v1/models", lastVerified: "2026-08-01" }),
+  sensenova: openAi("https://token.sensenova.cn/v1", "https://console.sensenova.cn", { verification: "official" }),
+  stepfun: openAi("https://api.stepfun.com/v1", "https://platform.stepfun.com", { verification: "official" }),
+  together: openAi("https://api.together.xyz/v1", "https://api.together.xyz/settings/api-keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.together.ai/reference/models-1" }),
+  vertex: { baseUrl: "https://aiplatform.googleapis.com", dashboardUrl: "https://console.cloud.google.com/vertex-ai", adapter: "google", authKind: "key", supportLevel: "experimental", verification: "official", documentationUrl: "https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/inference", lastVerified: LAST_VERIFIED, discovery: "static", liveModels: false, googleMode: "vertex", models: ["gemini-3.1-pro-preview", "gemini-3.1-flash-lite", "gemini-3-flash-preview"], note: "Vertex accepts an express-mode API key here. ADC users can instead configure project and location through the existing Google Vertex provider." },
+};
+
+const LABELS: Record<string, string> = {
+  agy: "AGY", aihorde: "AI Horde", "api-airforce": "API Airforce", "arcee-ai": "Arcee AI",
+  bazaarlink: "BazaarLink", blackbox: "Blackbox", bluesminds: "Bluesminds", "cloudflare-ai": "Cloudflare AI",
+  coze: "Coze", "duckduckgo-web": "DuckDuckGo Web", "felo-web": "Felo Web", friendliai: "FriendliAI",
+  gemini: "Google Gemini", "github-models": "GitHub Models", huggingchat: "HuggingChat", huggingface: "Hugging Face",
+  iflytek: "iFlytek", "inference-net": "Inference.net", llm7: "LLM7", "muse-spark-web": "Muse Spark Web",
+  nlpcloud: "NLP Cloud", "ollama-cloud": "Ollama Cloud", ovhcloud: "OVHcloud", "qwen-web": "Qwen Web",
+  "t3-web": "T3 Web", uncloseai: "UncloseAI", ainative: "AI Native", baidu: "Baidu Qianfan",
+  glm: "Z.AI GLM", "glm-cn": "BigModel GLM (CN)", "kilo-gateway": "Kilo Gateway", "opencode-zen": "OpenCode Zen",
+  sealion: "SEA-LION", bytez: "Bytez", "nous-research": "Nous Research", agentrouter: "AgentRouter",
+  ai21: "AI21", baichuan: "Baichuan", deepinfra: "DeepInfra", deepseek: "DeepSeek", doubao: "Doubao",
+  "freemodel-dev": "FreeModel.dev", sambanova: "SambaNova Cloud", nebius: "Nebius Token Factory",
+  novita: "Novita", nscale: "Nscale", nvidia: "NVIDIA NIM",
+  publicai: "PublicAI", qoder: "Qoder", sensenova: "SenseNova", stepfun: "StepFun", vertex: "Google Vertex AI",
+};
+
+const referenceNote = "Reference entry only: no safe documented API integration is enabled. Configure it manually only with provider documentation; consumer-web cookies and anti-bot bypasses are intentionally unsupported.";
+
+export const FREE_PROVIDER_DIRECTORY: readonly FreeDirectoryProvider[] = Object.values(FREE_PROVIDER_ACCESS_GROUPS)
+  .flat()
+  .filter((id, index, ids) => ids.indexOf(id) === index)
+  .map(id => {
+    const accessGroups = (Object.entries(FREE_PROVIDER_ACCESS_GROUPS) as [ProviderAccessGroup, readonly string[]][])
+      .filter(([, ids]) => ids.includes(id))
+      .map(([group]) => group);
+    const override = CONNECTABLE[id];
+    return {
+      id,
+      label: LABELS[id] ?? id.split("-").map(word => word.charAt(0).toUpperCase() + word.slice(1)).join(" "),
+      adapter: "openai-chat",
+      baseUrl: "",
+      authKind: "key",
+      accessGroups,
+      supportLevel: "reference",
+      verification: "unverified",
+      discovery: "unsupported",
+      liveModels: false,
+      ...(!override ? { note: referenceNote } : {}),
+      ...override,
+    } satisfies FreeDirectoryProvider;
+  });

package/src/providers/github-copilot-transport.ts

@@ -0,0 +1,56 @@
+import type { OcxProviderConfig } from "../types";
+import {
+  GITHUB_COPILOT_DEFAULT_API_BASE,
+  GITHUB_COPILOT_EDITOR_HEADERS,
+  validateCopilotApiBaseUrl,
+} from "../oauth/github-copilot";
+
+export type OcxProviderTransport = OcxProviderConfig & {
+  fetch?: typeof globalThis.fetch;
+};
+
+function hasHeaderCaseInsensitive(
+  headers: Record<string, string> | undefined,
+  name: string,
+): boolean {
+  const target = name.toLowerCase();
+  return Object.keys(headers ?? {}).some(key => key.toLowerCase() === target);
+}
+
+function withoutUserOverridden(
+  defaults: Readonly<Record<string, string>>,
+  userHeaders: Record<string, string> | undefined,
+): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(defaults).filter(([name]) => !hasHeaderCaseInsensitive(userHeaders, name)),
+  );
+}
+
+/**
+ * Copilot chat requires editor fingerprint headers. Defaults are honest OpenCodex values
+ * with Copilot-Integration-Id set to the vscode-chat integration id the public client uses.
+ * User-configured headers always win.
+ */
+export function resolveGithubCopilotTransport(
+  provider: OcxProviderTransport,
+  apiBaseUrl?: string,
+): OcxProviderTransport {
+  const stableDefaults = withoutUserOverridden(GITHUB_COPILOT_EDITOR_HEADERS, provider.headers);
+  const headers = {
+    ...stableDefaults,
+    ...(provider.headers ?? {}),
+  };
+  // Fail closed: the OAuth bearer only ever goes to an allowlisted *.githubcopilot.com
+  // host. A legacy/crafted credential without endpoints.api, or a user-edited baseUrl,
+  // must not redirect the token — fall back to the canonical default instead.
+  const baseUrl = provider.authMode === "oauth"
+    ? validateCopilotApiBaseUrl(apiBaseUrl)
+      ?? validateCopilotApiBaseUrl(provider.baseUrl)
+      ?? GITHUB_COPILOT_DEFAULT_API_BASE
+    : apiBaseUrl?.trim() || provider.baseUrl || GITHUB_COPILOT_DEFAULT_API_BASE;
+  return {
+    ...provider,
+    baseUrl,
+    headers,
+  };
+}

package/src/providers/google-vertex-location.ts

@@ -0,0 +1,14 @@
+/**
+ * Vertex regional hosts are formed as `<location>-aiplatform.googleapis.com`.
+ * Restricting the location to one lowercase DNS label keeps user configuration
+ * from changing the request authority while remaining forward-compatible with
+ * new Google regions and multi-regions.
+ */
+const GOOGLE_VERTEX_LOCATION_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+export function googleVertexLocationConfigError(location: unknown): string | null {
+  if (typeof location !== "string" || !GOOGLE_VERTEX_LOCATION_LABEL.test(location)) {
+    return "Vertex AI location must be a single lowercase Google Cloud location label (for example, us-central1 or global)";
+  }
+  return null;
+}

package/src/providers/key-failover.ts

@@ -0,0 +1,271 @@
+/**
+ * Multi-key 429 failover for non-OpenAI providers.
+ *
+ * When a provider's upstream returns 429, this module picks the next available key
+ * from `apiKeyPool`, puts the exhausted key into cooldown (respecting Retry-After),
+ * and returns a fresh provider config with the swapped key. If all keys are in
+ * cooldown, returns null so the caller surfaces the 429 to the client.
+ *
+ * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
+ */
+import { saveConfigPreservingClaudeCode } from "../config";
+import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy } from "../types";
+import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
+import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
+
+// ---- cooldown state (in-memory, same as codex/routing.ts) ----
+
+interface KeyCooldown {
+  cooldownUntil: number;
+}
+
+const DEFAULT_COOLDOWN_MS = 60_000;
+const MAX_COOLDOWN_MS = 10 * 60_000; // cap at 10 min for api-key rotation
+
+/**
+ * Default same-target 429 retry policy used when a provider opts in via a bare
+ * `retryOn429: {}` (presence = opt-in with these defaults).
+ */
+const DEFAULT_RATE_LIMIT_RETRY = {
+  enabled: true,
+  attempts: 3,
+  intervalMs: 5_000,
+  maxIntervalMs: 60_000,
+  respectRetryAfter: true,
+} as const satisfies Required<RateLimitRetryPolicy>;
+
+/** Map<`${providerName}\0${keyId}`, KeyCooldown> */
+const keyCooldowns = new Map<string, KeyCooldown>();
+
+function cooldownKey(providerName: string, keyId: string): string {
+  return `${providerName}\0${keyId}`;
+}
+
+/**
+ * Parse an upstream `Retry-After` header: numeric seconds (including `0`) or an HTTP-date.
+ * Returns a bounded delay in ms (1..MAX_COOLDOWN_MS), or undefined when the value is
+ * malformed. An HTTP-date already in the past yields an immediate (1 ms) retry.
+ */
+function parseRetryAfterMs(value: string | null | undefined, now = Date.now()): number | undefined {
+  const text = value?.trim();
+  if (!text) return undefined;
+  if (/^\d+(?:\.\d+)?$/.test(text)) {
+    const seconds = Number(text);
+    if (Number.isFinite(seconds) && seconds >= 0) {
+      return Math.min(Math.max(Math.ceil(seconds * 1000), 1), MAX_COOLDOWN_MS);
+    }
+  }
+  const timestamp = Date.parse(text);
+  if (!Number.isFinite(timestamp)) return undefined;
+  const delay = timestamp - now;
+  // A valid HTTP-date whose retry time has already passed is an immediate retry, exactly like
+  // numeric `Retry-After: 0` — never a malformed-header fallback to the fixed interval.
+  return Math.min(Math.max(delay, 1), MAX_COOLDOWN_MS);
+}
+
+/**
+ * True while the given key is inside its 429 cooldown window (lazily evicting the entry once the
+ * window expires). Used to skip keys that the upstream just rate-limited during failover.
+ */
+function isKeyInCooldown(providerName: string, keyId: string, now = Date.now()): boolean {
+  const entry = keyCooldowns.get(cooldownKey(providerName, keyId));
+  if (!entry) return false;
+  if (entry.cooldownUntil <= now) {
+    keyCooldowns.delete(cooldownKey(providerName, keyId));
+    return false;
+  }
+  return true;
+}
+
+// ---- public API ----
+
+/**
+ * Check whether a provider has multiple keys available for failover.
+ * Returns true only for key-auth providers with 2+ pool entries.
+ */
+export function hasKeyPoolFailover(provider: OcxProviderConfig): boolean {
+  if (provider.authMode === "oauth" || provider.authMode === "forward") return false;
+  return (provider.apiKeyPool?.length ?? 0) >= 2;
+}
+
+/**
+ * Normalize a provider's `retryOn429` policy, or return null when the knob is absent,
+ * explicitly disabled, or the provider is not key-auth (OAuth/forward credentials must not be
+ * replayed on the same token, forward passthrough never reaches the recovery loop anyway, and
+ * local runtimes have no remote key to preserve). The returned policy is fully defaulted so
+ * callers never re-check fields.
+ */
+export function rateLimitRetryPolicyFor(
+  provider: Pick<OcxProviderConfig, "retryOn429" | "authMode">,
+): Required<RateLimitRetryPolicy> | null {
+  const policy = provider.retryOn429;
+  if (!policy || policy.enabled === false) return null;
+  // Fail closed: only explicit key auth or the documented omitted-default (undefined == key for
+  // custom API-key providers) may use same-key replays. OAuth/forward are never replayed on the
+  // same token, local runtimes have no remote key to preserve, and unknown/custom values are
+  // rejected rather than guessed at.
+  if (provider.authMode !== undefined && provider.authMode !== "key") return null;
+  return {
+    enabled: policy.enabled ?? DEFAULT_RATE_LIMIT_RETRY.enabled,
+    attempts: policy.attempts ?? DEFAULT_RATE_LIMIT_RETRY.attempts,
+    intervalMs: policy.intervalMs ?? DEFAULT_RATE_LIMIT_RETRY.intervalMs,
+    maxIntervalMs: policy.maxIntervalMs ?? DEFAULT_RATE_LIMIT_RETRY.maxIntervalMs,
+    respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
+  };
+}
+
+/**
+ * Wait before the next same-target replay: upstream Retry-After (seconds or HTTP-date) when
+ * `respectRetryAfter` is on and the header parses, capped at `maxIntervalMs`; otherwise the
+ * fixed `intervalMs`, also capped at `maxIntervalMs` (a single wait never exceeds the cap).
+ * Malformed headers fall back to the fixed interval.
+ */
+export function rateLimitRetryDelayMs(
+  policy: Required<RateLimitRetryPolicy>,
+  retryAfterHeader: string | null | undefined,
+  now = Date.now(),
+): number {
+  const raw = retryAfterHeader?.trim();
+  if (policy.respectRetryAfter && raw) {
+    const parsed = parseRetryAfterMs(raw, now);
+    if (parsed !== undefined) return Math.min(parsed, policy.maxIntervalMs);
+  }
+  return Math.min(policy.intervalMs, policy.maxIntervalMs);
+}
+
+/**
+ * Record a 429 for the current key and attempt to switch to the next available one.
+ *
+ * @returns A new OcxProviderConfig with the swapped key (and mutated config on disk),
+ *          or `null` when no alternative key is available (all in cooldown or pool < 2).
+ *
+ * The returned object is a snapshot of the PERSISTED config — it carries none of the
+ * registry backfills `routedProviderConfig` merges in at request time. Request paths must
+ * not assign it to an active route wholesale; use `rotateProviderTransportOn429`, which
+ * takes only the swapped key and keeps the routed provider intact.
+ */
+export function rotateKeyOn429(
+  config: OcxConfig,
+  providerName: string,
+  retryAfterHeader: string | null | undefined,
+  now = Date.now(),
+  attemptedKey?: string,
+): OcxProviderConfig | null {
+  const provider = config.providers[providerName];
+  if (!provider) return null;
+  if (provider.authMode === "oauth" || provider.authMode === "forward") return null;
+
+  const pool = provider.apiKeyPool;
+  if (!pool || pool.length < 2) return null;
+
+  // Cool the key that ACTUALLY failed. Under concurrent 429s another request may already have
+  // rotated provider.apiKey — cooling the live key would punish an innocent replacement and can
+  // exhaust a 2-key pool from a single bad key. CAS semantics: callers pass the key they used.
+  const failedKey = attemptedKey ?? provider.apiKey;
+  const currentEntry = pool.find(e => e.key === failedKey);
+  if (currentEntry) {
+    const cooldownMs = parseRetryAfterMs(retryAfterHeader, now) ?? DEFAULT_COOLDOWN_MS;
+    keyCooldowns.set(cooldownKey(providerName, currentEntry.id), {
+      cooldownUntil: now + cooldownMs,
+    });
+    sweepExpiredOnWrite(now);
+  }
+
+  // Lost the race: someone already rotated away from the failed key. If the live key is healthy,
+  // retry with it as-is instead of rotating a second time.
+  if (attemptedKey !== undefined && provider.apiKey !== attemptedKey) {
+    const liveEntry = pool.find(e => e.key === provider.apiKey);
+    if (liveEntry && !isKeyInCooldown(providerName, liveEntry.id, now)) {
+      return { ...provider };
+    }
+  }
+
+  // Pick the next key that is NOT in cooldown
+  const currentIndex = currentEntry ? pool.indexOf(currentEntry) : -1;
+  for (let i = 1; i < pool.length; i++) {
+    const candidate = pool[(currentIndex + i) % pool.length]!;
+    if (!isKeyInCooldown(providerName, candidate.id, now)) {
+      // Swap active key
+      provider.apiKey = candidate.key;
+      saveConfigPreservingClaudeCode(config);
+      console.warn(
+        // Log ids only — labels are user-supplied free text and could carry secret material.
+        `[key-failover] ${providerName}: 429 on key ${currentEntry?.id ?? "?"}; rotating to key ${candidate.id}`,
+      );
+      return { ...provider };
+    }
+  }
+
+  // All keys in cooldown
+  console.warn(`[key-failover] ${providerName}: all ${pool.length} keys in cooldown; returning 429 to client`);
+  return null;
+}
+
+export function sweepExpiredApiKeyCooldowns(now = Date.now()): number {
+  let removed = 0;
+  for (const [key, cooldown] of keyCooldowns) {
+    if (cooldown.cooldownUntil > now) continue;
+    keyCooldowns.delete(key);
+    removed += 1;
+  }
+  return removed;
+}
+
+interface RotateProviderTransportOptions {
+  retryAfter?: string | null;
+  now?: number;
+  attemptedKey?: string;
+  promptCacheKey?: string;
+}
+
+/**
+ * Rotate a failed key and re-apply provider-specific transport metadata to the replacement.
+ *
+ * `routedProvider` is the request's active provider (the `routedProviderConfig` output the
+ * route was built with). The result inherits it and swaps ONLY the API key: the persisted
+ * config that `rotateKeyOn429` snapshots predates registry backfill, so building the retry
+ * provider from that snapshot would silently drop every field the registry merged in at
+ * routing time (scalar flags like `promptCacheKey`/`parallelToolCalls`, merged model
+ * metadata such as `noTemperatureModels`, a pinned baseUrl). Mirrors the OAuth-401 replay
+ * path in src/server/responses/core.ts, which spreads `route.provider` for the same reason.
+ */
+export function rotateProviderTransportOn429(
+  config: OcxConfig,
+  providerName: string,
+  routedProvider: OcxProviderTransport,
+  options: RotateProviderTransportOptions = {},
+): OcxProviderTransport | null {
+  const rotated = rotateKeyOn429(
+    config,
+    providerName,
+    options.retryAfter,
+    options.now,
+    options.attemptedKey,
+  );
+  return rotated
+    ? resolveProviderTransport(
+        providerName,
+        { ...routedProvider, apiKey: rotated.apiKey },
+        options.promptCacheKey,
+      )
+    : null;
+}
+
+/** Clear cooldown state for a provider (e.g. after manual key management). */
+export function clearKeyCooldowns(providerName?: string): void {
+  if (!providerName) {
+    keyCooldowns.clear();
+    return;
+  }
+  const prefix = `${providerName}\0`;
+  for (const key of keyCooldowns.keys()) {
+    if (key.startsWith(prefix)) keyCooldowns.delete(key);
+  }
+}
+
+/** Visible-for-testing: get the cooldown-until timestamp for a key. */
+export function getKeyCooldownUntil(providerName: string, keyId: string, now = Date.now()): number | null {
+  const entry = keyCooldowns.get(cooldownKey(providerName, keyId));
+  if (!entry) return null;
+  return entry.cooldownUntil > now ? entry.cooldownUntil : null;
+}

package/src/providers/kiro-models.ts

@@ -0,0 +1,67 @@
+export const KIRO_MODELS = [
+  "kiro-auto",
+  // OpenAI GPT-5.6 (Kiro experimental, us-east-1) — added to official catalog 2026-07-13
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
+  "claude-sonnet-5",
+  "claude-opus-5",
+  "claude-opus-4.8",
+  "claude-opus-4.7",
+  "claude-opus-4.6",
+  "claude-opus-4.5",
+  "claude-sonnet-4.6",
+  "claude-sonnet-4.5",
+  "claude-sonnet-4.0",
+  "claude-haiku-4.5",
+  "deepseek-3.2",
+  "minimax-m2.5",
+  "minimax-m2.1",
+  "glm-5",
+  "qwen3-coder-next",
+];
+
+// Per-model context windows as documented on Kiro's official model catalog
+// (https://kiro.dev/docs/models/ — "Quick comparison", page updated 2026-07-14).
+// "Auto" is a router with no fixed window on Kiro's table, so it is intentionally omitted.
+export const KIRO_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "gpt-5.6-sol": 272_000,
+  "gpt-5.6-terra": 272_000,
+  "gpt-5.6-luna": 272_000,
+  "claude-sonnet-5": 1_000_000,
+  "claude-opus-5": 1_000_000,
+  "claude-opus-4.8": 1_000_000,
+  "claude-opus-4.7": 1_000_000,
+  "claude-opus-4.6": 1_000_000,
+  "claude-opus-4.5": 200_000,
+  "claude-sonnet-4.6": 1_000_000,
+  "claude-sonnet-4.5": 200_000,
+  "claude-sonnet-4.0": 200_000,
+  "claude-haiku-4.5": 200_000,
+  "deepseek-3.2": 128_000,
+  "minimax-m2.5": 200_000,
+  "minimax-m2.1": 200_000,
+  "glm-5": 200_000,
+  "qwen3-coder-next": 256_000,
+};
+
+const KIRO_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+
+// gpt-5.6-sol and claude-opus-5 send these values through Kiro's verified native effort fields
+// (`reasoning.effort` and `output_config.effort` respectively). Other models map them to bounded
+// thinking instructions until their native effort support is verified.
+export const KIRO_MODEL_REASONING_EFFORTS: Record<string, string[]> = Object.fromEntries(
+  KIRO_MODELS.map(id => [id, KIRO_REASONING_EFFORTS]),
+);
+
+export function normalizeKiroModelId(id: string): string {
+  let model = id.trim().toLowerCase();
+  model = model.replace(/^kiro\//, "").replace(/^kiro-/, "");
+  if (model === "auto") return "auto";
+
+  model = model.replace(/-\d{8}$/, "");
+  model = model.replace(/-(low|medium|high|xhigh|max)$/, "");
+  model = model.replace(/(\d+)-(\d+)/g, "$1.$2");
+  model = model.replace(/^claude-([\d.]+)-(sonnet|opus|haiku)$/, "claude-$2-$1");
+  return model;
+}

package/src/providers/label.ts

@@ -0,0 +1,19 @@
+import { CODEX_ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
+
+export function canonicalUsageProviderLabel(provider: string): string {
+  return provider === "chatgpt" || provider === "openai-multi" ? "openai" : provider;
+}
+
+export function baseProviderLabel(provider: string): string {
+  const canonical = canonicalUsageProviderLabel(provider);
+  if (canonical !== provider) return canonical;
+  const cut = provider.lastIndexOf("-");
+  if (cut <= 0) return canonicalUsageProviderLabel(provider);
+  const suffix = provider.slice(cut + 1);
+  // `-main` is the legacy log label for the main Codex account (MAIN_CODEX_ACCOUNT_ID). New entries
+  // log under the base provider name, but historical `<provider>-main` entries must still collapse.
+  // ChatGPT auth-pool and OpenAI passthrough are the same Codex/OpenAI usage surface, so display
+  // summaries normalize them to one `openai` row after recognized main/pool suffixes are removed.
+  if (suffix === "main") return canonicalUsageProviderLabel(provider.slice(0, cut));
+  return CODEX_ACCOUNT_LOG_LABEL_RE.test(suffix) ? canonicalUsageProviderLabel(provider.slice(0, cut)) : provider;
+}