cartethyia 2.5.1 → 2.5.3

package/src/providers/integrations/buddy/workbuddy/shared.ts

@@ -1,200 +1,201 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-
-import type { OpenAICompatibleAdapterConfig } from "../../../adapters/compatible-adapter";
-import { withBearerAuthentication } from "../../../adapters/compatible-adapter";
-import type { CanonicalRequest } from "../../../../protocol/canonical-model";
-import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from "../../../provider-contracts";
-import { resolveInboundSessionId } from "../../../operations/session-resolution";
-import { buddyConversationHeaders } from "../buddy-conversation-headers";
-import { buddyCliHeaders, buddyCliTraceHeaders } from "../buddy-cli-headers";
-import { buddyUserId, resolveBuddyIdentity } from "../buddy-identity";
-import {
-  buildWorkBuddyUserAgent,
-  getWorkBuddyClientVersion,
-  getWorkBuddyCliVersion,
-} from "../../../operations/client-versions";
-
-/**
- * WorkBuddy serves chat from a versioned path on a base URL that carries no
- * version segment (billing uses the unversioned `/billing/…` path), so both the
- * adapter config and the static catalog rows must state it. The generic
- * `/chat/completions` default would join into
- * `https://www.workbuddy.ai/chat/completions`, which that upstream answers with
- * a 405 HTML error page.
- */
-export const WORKBUDDY_CHAT_PATH = "/v2/chat/completions" as const;
-
-export {
-  buildWorkBuddyUserAgent,
-  getWorkBuddyClientVersion,
-  getWorkBuddyCliVersion,
-};
-
-/** WorkBuddy international gateway domain (Origin/Referer/X-Domain). */
-export const WORKBUDDY_DOMAIN = "www.workbuddy.ai";
-
-/**
- * Stable per-account device identifiers.
- *
- * WorkBuddy's desktop client presents one fixed virtual device per account.
- * Deriving `X-Machine-ID` / `X-Session-ID` from the account id (sha256, 36 hex)
- * keeps them constant across restarts while staying distinct per account, so
- * multiple pooled accounts are not correlated by a missing or drifting device
- * fingerprint. Mirrors the reference gateway's `wb2a:<purpose>:<uid>` scheme.
- */
-function deriveAccountStableId(accountId: string, purpose: string): string {
-  const sum = createHash("sha256").update(`wb2a:${purpose}:${accountId}`).digest("hex");
-  return sum.slice(0, 36);
-}
-
-/**
- * Per-request WorkBuddy chat headers — the exact desktop-client contract.
- *
- * The international gateway gates chat on the desktop `User-Agent` (platform
- * brand `WorkBuddy AI`; the wrong brand trips 403 code 11140), plus the
- * `X-CodeBuddy-Request` risk gate and the account-scoped device headers.
- * The background client-version monitor keeps this value fresh; dispatch only
- * reads the cached value and never waits on a version endpoint.
- *
- * `cliIdentity` selects the reference CLI contract instead. The two are not
- * variations of one set: the CLI drops every browser header and the device
- * token, and adds the agent envelope. Left unset, nothing changes.
- */
-export async function workbuddyHeaders(
-  context?: ProviderDispatchContext,
-  request?: CanonicalRequest,
-  domain = WORKBUDDY_DOMAIN,
-  clientVersion = getWorkBuddyClientVersion(),
-  cliIdentity?: boolean,
-): Promise<Record<string, string>> {
-  const conversation = buddyConversationHeaders({
-    ...(resolveInboundSessionId(context, request) === undefined
-      ? {}
-      : { conversationId: resolveInboundSessionId(context, request) }),
-  });
-  const accountId = context?.credential.account_id;
-  if (resolveBuddyIdentity(context, cliIdentity) === "cli") {
-    // The reference CLI: issued by the OpenAI Node SDK, so no browser header
-    // and no device token, and the machine/session device pair does not
-    // exist — only `X-User-Id`, which is `anonymous` without a uid.
-    return {
-      accept: "application/json",
-      "user-agent": `CLI/${getWorkBuddyCliVersion()} CodeBuddy/${getWorkBuddyCliVersion()}`,
-      "x-domain": domain,
-      "x-agent-purpose": "conversation",
-      "x-ide-name": "CLI",
-      "x-ide-type": "CLI",
-      "x-ide-version": getWorkBuddyCliVersion(),
-      "x-product": "SaaS",
-      "x-no-enterprise-id": "1",
-      ...conversation,
-      ...buddyCliTraceHeaders(conversation),
-      ...buddyCliHeaders({ userId: buddyUserId(context) }),
-    };
-  }
-  const headers: Record<string, string> = {
-    accept: "application/json, text/event-stream",
-    "user-agent": buildWorkBuddyUserAgent(clientVersion, getWorkBuddyCliVersion()),
-    origin: `https://${domain}`,
-    referer: `https://${domain}/`,
-    "accept-language": "en-US",
-    "x-requested-with": "XMLHttpRequest",
-    "x-codebuddy-request": "1",
-    "x-domain": domain,
-    "x-agent-purpose": "conversation",
-    "x-ide-name": "WorkBuddy",
-    "x-ide-type": "WorkBuddy",
-    "x-ide-version": clientVersion,
-    // Both references send the literal `SaaS` here. `WorkBuddy` was a value
-    // this repo invented; the desktop product name belongs in `x-ide-name`,
-    // and the CN test below compares the two realms against each other rather
-    // than to a hard-coded string.
-    "x-product": "SaaS",
-    // Personal international accounts carry no enterprise id: declare it
-    // explicitly so upstream risk control does not treat the omission as
-    // suspicious.
-    "x-no-enterprise-id": "1",
-  };
-  // The conversation/tracing family the upstream's channel check looks for. A
-  // live request carrying only `x-session-id` was refused for a missing
-  // conversation id; the aggregation key below is the one the reference marks
-  // mandatory.
-  Object.assign(headers, conversation);
-  if (accountId) {
-    headers["x-user-id"] = accountId;
-    headers["x-machine-id"] = deriveAccountStableId(accountId, "machine");
-    headers["x-session-id"] = deriveAccountStableId(accountId, "session");
-  }
-  const deviceToken = readBuddyDeviceToken(context);
-  if (deviceToken !== undefined) headers["x-device-token"] = deviceToken;
-  return headers;
-}
-
-/**
- * Desktop risk token, sent only when the account actually has one.
- *
- * The account's own `auth_state` wins. When it carries none, a file the
- * desktop client writes (`CARTETHYIA_DEVICE_TOKEN_FILE`, default
- * `/app/data/device_token`) is read instead — cached for five minutes, and
- * ignored when it is larger than 1 KB, because a token file that size is not
- * a token. A missing file is the normal case and reads as "no token".
- */
-const DEVICE_TOKEN_FILE_MAX_BYTES = 1024;
-const DEVICE_TOKEN_FILE_TTL_MS = 5 * 60_000;
-let deviceTokenFileCache: { readonly value: string | undefined; readonly readAt: number } | undefined;
-
-export function readBuddyDeviceToken(context?: ProviderDispatchContext): string | undefined {
-  const state = context?.credential.auth_state;
-  const value = state?.["deviceToken"] ?? state?.["device_token"];
-  if (typeof value === "string" && value.trim().length > 0) return value.trim();
-  return readDeviceTokenFile();
-}
-
-function readDeviceTokenFile(): string | undefined {
-  const now = Date.now();
-  if (deviceTokenFileCache !== undefined && now - deviceTokenFileCache.readAt < DEVICE_TOKEN_FILE_TTL_MS) {
-    return deviceTokenFileCache.value;
-  }
-  const path = process.env["CARTETHYIA_DEVICE_TOKEN_FILE"] ?? "/app/data/device_token";
-  let value: string | undefined;
-  try {
-    const raw = readFileSync(path);
-    if (raw.byteLength > 0 && raw.byteLength <= DEVICE_TOKEN_FILE_MAX_BYTES) {
-      const text = raw.toString("utf8").trim();
-      if (text.length > 0) value = text;
-    }
-  } catch {
-    value = undefined;
-  }
-  deviceTokenFileCache = { value, readAt: now };
-  return value;
-}
-
-/**
- * Shared OpenAI-compatible chat-adapter config for WorkBuddy: bearer auth
- * (api_key and oauth both use `Authorization: Bearer`), `/v2/chat/completions`
- * endpoint, per-request desktop-client headers, and the payload hook.
- */
-export function workbuddyAdapterConfig(args: {
-  providerId: ProviderId;
-  baseUrl: string;
-  domain?: string;
-  prePayload: (
-    payload: Record<string, unknown>,
-    request: CanonicalRequest,
-    candidate: ProviderDispatchTarget,
-  ) => void;
-  fetchImpl?: typeof fetch;
-  cliIdentity?: boolean;
-}): OpenAICompatibleAdapterConfig {
-  return withBearerAuthentication({
-    provider_id: args.providerId,
-    base_url: args.baseUrl,
-    endpoint_paths_by_wire_family: { chat: WORKBUDDY_CHAT_PATH },
-    buildExtraHeaders: (context, request) =>
-      workbuddyHeaders(context, request, args.domain ?? WORKBUDDY_DOMAIN, undefined, args.cliIdentity),
-    prePayload: args.prePayload,
-    ...(args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}),
-  });
-}
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+import type { OpenAICompatibleAdapterConfig } from "../../../adapters/compatible-adapter";
+import { withBearerAuthentication } from "../../../adapters/compatible-adapter";
+import type { CanonicalRequest } from "../../../../protocol/canonical-model";
+import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from "../../../provider-contracts";
+import { resolveInboundSessionId } from "../../../operations/session-resolution";
+import { buddyConversationHeaders } from "../buddy-conversation-headers";
+import { buddyCliHeaders, buddyCliTraceHeaders } from "../buddy-cli-headers";
+import { buddyUserId, resolveBuddyIdentity } from "../buddy-identity";
+import {
+  buildWorkBuddyUserAgent,
+  getWorkBuddyClientVersion,
+  getWorkBuddyCliVersion,
+} from "../../../operations/client-versions";
+
+/**
+ * WorkBuddy serves chat from a versioned path on a base URL that carries no
+ * version segment (billing uses the unversioned `/billing/…` path), so both the
+ * adapter config and the static catalog rows must state it. The generic
+ * `/chat/completions` default would join into
+ * `https://www.workbuddy.ai/chat/completions`, which that upstream answers with
+ * a 405 HTML error page.
+ */
+export const WORKBUDDY_CHAT_PATH = "/v2/chat/completions" as const;
+
+export {
+  buildWorkBuddyUserAgent,
+  getWorkBuddyClientVersion,
+  getWorkBuddyCliVersion,
+};
+
+/** WorkBuddy international gateway domain (Origin/Referer/X-Domain). */
+export const WORKBUDDY_DOMAIN = "www.workbuddy.ai";
+
+/**
+ * Stable per-account device identifiers.
+ *
+ * WorkBuddy's desktop client presents one fixed virtual device per account.
+ * Deriving `X-Machine-ID` / `X-Session-ID` from the account id (sha256, 36 hex)
+ * keeps them constant across restarts while staying distinct per account, so
+ * multiple pooled accounts are not correlated by a missing or drifting device
+ * fingerprint. Mirrors the reference gateway's `wb2a:<purpose>:<uid>` scheme.
+ */
+function deriveAccountStableId(accountId: string, purpose: string): string {
+  const sum = createHash("sha256").update(`wb2a:${purpose}:${accountId}`).digest("hex");
+  return sum.slice(0, 36);
+}
+
+/**
+ * Per-request WorkBuddy chat headers — the exact desktop-client contract.
+ *
+ * The international gateway gates chat on the desktop `User-Agent` (platform
+ * brand `WorkBuddy AI`, carried on the wire as the token `workbuddy-ai`;
+ * the wrong token trips 403 code 11140), plus the `X-CodeBuddy-Request` risk
+ * gate and the account-scoped device headers.
+ * The background client-version monitor keeps this value fresh; dispatch only
+ * reads the cached value and never waits on a version endpoint.
+ *
+ * `cliIdentity` selects the reference CLI contract instead. The two are not
+ * variations of one set: the CLI drops every browser header and the device
+ * token, and adds the agent envelope. Left unset, nothing changes.
+ */
+export async function workbuddyHeaders(
+  context?: ProviderDispatchContext,
+  request?: CanonicalRequest,
+  domain = WORKBUDDY_DOMAIN,
+  clientVersion = getWorkBuddyClientVersion(),
+  cliIdentity?: boolean,
+): Promise<Record<string, string>> {
+  const conversation = buddyConversationHeaders({
+    ...(resolveInboundSessionId(context, request) === undefined
+      ? {}
+      : { conversationId: resolveInboundSessionId(context, request) }),
+  });
+  const accountId = context?.credential.account_id;
+  if (resolveBuddyIdentity(context, cliIdentity) === "cli") {
+    // The reference CLI: issued by the OpenAI Node SDK, so no browser header
+    // and no device token, and the machine/session device pair does not
+    // exist — only `X-User-Id`, which is `anonymous` without a uid.
+    return {
+      accept: "application/json",
+      "user-agent": `CLI/${getWorkBuddyCliVersion()} CodeBuddy/${getWorkBuddyCliVersion()}`,
+      "x-domain": domain,
+      "x-agent-purpose": "conversation",
+      "x-ide-name": "CLI",
+      "x-ide-type": "CLI",
+      "x-ide-version": getWorkBuddyCliVersion(),
+      "x-product": "SaaS",
+      "x-no-enterprise-id": "1",
+      ...conversation,
+      ...buddyCliTraceHeaders(conversation),
+      ...buddyCliHeaders({ userId: buddyUserId(context) }),
+    };
+  }
+  const headers: Record<string, string> = {
+    accept: "application/json, text/event-stream",
+    "user-agent": buildWorkBuddyUserAgent(clientVersion, getWorkBuddyCliVersion()),
+    origin: `https://${domain}`,
+    referer: `https://${domain}/`,
+    "accept-language": "en-US",
+    "x-requested-with": "XMLHttpRequest",
+    "x-codebuddy-request": "1",
+    "x-domain": domain,
+    "x-agent-purpose": "conversation",
+    "x-ide-name": "WorkBuddy",
+    "x-ide-type": "WorkBuddy",
+    "x-ide-version": clientVersion,
+    // Both references send the literal `SaaS` here. `WorkBuddy` was a value
+    // this repo invented; the desktop product name belongs in `x-ide-name`,
+    // and the CN test below compares the two realms against each other rather
+    // than to a hard-coded string.
+    "x-product": "SaaS",
+    // Personal international accounts carry no enterprise id: declare it
+    // explicitly so upstream risk control does not treat the omission as
+    // suspicious.
+    "x-no-enterprise-id": "1",
+  };
+  // The conversation/tracing family the upstream's channel check looks for. A
+  // live request carrying only `x-session-id` was refused for a missing
+  // conversation id; the aggregation key below is the one the reference marks
+  // mandatory.
+  Object.assign(headers, conversation);
+  if (accountId) {
+    headers["x-user-id"] = accountId;
+    headers["x-machine-id"] = deriveAccountStableId(accountId, "machine");
+    headers["x-session-id"] = deriveAccountStableId(accountId, "session");
+  }
+  const deviceToken = readBuddyDeviceToken(context);
+  if (deviceToken !== undefined) headers["x-device-token"] = deviceToken;
+  return headers;
+}
+
+/**
+ * Desktop risk token, sent only when the account actually has one.
+ *
+ * The account's own `auth_state` wins. When it carries none, a file the
+ * desktop client writes (`CARTETHYIA_DEVICE_TOKEN_FILE`, default
+ * `/app/data/device_token`) is read instead — cached for five minutes, and
+ * ignored when it is larger than 1 KB, because a token file that size is not
+ * a token. A missing file is the normal case and reads as "no token".
+ */
+const DEVICE_TOKEN_FILE_MAX_BYTES = 1024;
+const DEVICE_TOKEN_FILE_TTL_MS = 5 * 60_000;
+let deviceTokenFileCache: { readonly value: string | undefined; readonly readAt: number } | undefined;
+
+export function readBuddyDeviceToken(context?: ProviderDispatchContext): string | undefined {
+  const state = context?.credential.auth_state;
+  const value = state?.["deviceToken"] ?? state?.["device_token"];
+  if (typeof value === "string" && value.trim().length > 0) return value.trim();
+  return readDeviceTokenFile();
+}
+
+function readDeviceTokenFile(): string | undefined {
+  const now = Date.now();
+  if (deviceTokenFileCache !== undefined && now - deviceTokenFileCache.readAt < DEVICE_TOKEN_FILE_TTL_MS) {
+    return deviceTokenFileCache.value;
+  }
+  const path = process.env["CARTETHYIA_DEVICE_TOKEN_FILE"] ?? "/app/data/device_token";
+  let value: string | undefined;
+  try {
+    const raw = readFileSync(path);
+    if (raw.byteLength > 0 && raw.byteLength <= DEVICE_TOKEN_FILE_MAX_BYTES) {
+      const text = raw.toString("utf8").trim();
+      if (text.length > 0) value = text;
+    }
+  } catch {
+    value = undefined;
+  }
+  deviceTokenFileCache = { value, readAt: now };
+  return value;
+}
+
+/**
+ * Shared OpenAI-compatible chat-adapter config for WorkBuddy: bearer auth
+ * (api_key and oauth both use `Authorization: Bearer`), `/v2/chat/completions`
+ * endpoint, per-request desktop-client headers, and the payload hook.
+ */
+export function workbuddyAdapterConfig(args: {
+  providerId: ProviderId;
+  baseUrl: string;
+  domain?: string;
+  prePayload: (
+    payload: Record<string, unknown>,
+    request: CanonicalRequest,
+    candidate: ProviderDispatchTarget,
+  ) => void;
+  fetchImpl?: typeof fetch;
+  cliIdentity?: boolean;
+}): OpenAICompatibleAdapterConfig {
+  return withBearerAuthentication({
+    provider_id: args.providerId,
+    base_url: args.baseUrl,
+    endpoint_paths_by_wire_family: { chat: WORKBUDDY_CHAT_PATH },
+    buildExtraHeaders: (context, request) =>
+      workbuddyHeaders(context, request, args.domain ?? WORKBUDDY_DOMAIN, undefined, args.cliIdentity),
+    prePayload: args.prePayload,
+    ...(args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}),
+  });
+}

package/src/providers/integrations/claude/claude.ts

@@ -96,7 +96,9 @@ export const CLAUDE_MODELS: readonly ModelDefinition[] = [
   claudeMessagesModel("claude-sonnet-5", 1_000_000, 128_000, true),
   claudeMessagesModel("claude-sonnet-4-6", 1_000_000, 128_000, true),
   claudeMessagesModel("claude-opus-4-5", 200_000, 64_000, true),
-  claudeMessagesModel("claude-sonnet-4-5", 1_000_000, 64_000, true),
+  // 200K: the 4.5 trio predates the million-token window, which arrived with
+  // Opus 4.6. Only this row claimed 1M while its own siblings said 200K.
+  claudeMessagesModel("claude-sonnet-4-5", 200_000, 64_000, true),
   claudeMessagesModel("claude-haiku-4-5", 200_000, 64_000, true),
 ];
 

package/src/providers/integrations/cline/cline-quota.ts

@@ -1,7 +1,6 @@
 import type { FetchLike, ProviderQuotaResult, ProviderQuotaWindow } from "../../quota/quota-contracts";
-import { authCredential, getJson, record, text } from "../../quota/quota-contracts";
+import { authCredential, getJson, record, text, unsupportedQuota } from "../../quota/quota-contracts";
 import { parseLimitWindows } from "../../quota/quota-limit-windows";
-import { probeApiKeyConnectivity } from "../../quota/quota-support";
 import { getClineCliVersion, getClineSdkVersion } from "../../operations/client-versions";
 import { clinePlatform, clinePlatformVersion } from "../../operations/cli-platform";
 
@@ -87,16 +86,14 @@ export async function fetchClineQuota(
   credential: string,
   fetcher: FetchLike,
 ): Promise<ProviderQuotaResult> {
-  // API-key accounts carry no OAuth envelope and upstream exposes no quota
-  // surface for them, so an api key must never reach the OAuth-only
-  // users/me endpoint (a 401 there is not dispatchable either). The account
-  // test for keys is plain validity via /models.
+  // An api_key account has no OAuth envelope, and Cline's quota surface
+  // answers 401 for one — the upstream's message asks the operator to
+  // re-authenticate, which is a false verdict: the key is fine and the gateway
+  // never had a quota to read. Report "not available" and make no upstream
+  // call. A probe here also cannot distinguish a dead key from Cline refusing
+  // the client, so the only honest answer is that quota is unavailable.
   if (credential.startsWith(CLINE_API_KEY_PREFIX)) {
-    return probeApiKeyConnectivity(
-      CLINE_PROVIDER_ID,
-      credential.slice(CLINE_API_KEY_PREFIX.length),
-      fetcher,
-    );
+    return unsupportedQuota(CLINE_PROVIDER_ID);
   }
   const fields = authCredential(credential);
   const access = text(fields.accessToken);

package/src/providers/integrations/cloudflareai/cloudflareai-models.ts

@@ -59,7 +59,9 @@ export const CLOUDFLAREAI_MODELS: readonly ModelDefinition[] = [
   ["claude-opus-4.7", 1_000_000, 128_000] as const,
   ["claude-opus-4.8", 1_000_000, 128_000] as const,
   ["claude-opus-5", 1_000_000, 128_000] as const,
-  ["claude-sonnet-4.5", 1_000_000, 64_000] as const,
+  // 200K, matching the other two 4.5 rows: the million-token window starts at
+  // Opus 4.6, so the 4.5 trio is 200K across the board.
+  ["claude-sonnet-4.5", 200_000, 64_000] as const,
   ["claude-sonnet-4.6", 1_000_000, 128_000] as const,
   ["claude-sonnet-5", 1_000_000, 128_000] as const,
 ].map(cloudflareaiModel);

package/src/providers/integrations/inferhub.ts

@@ -124,7 +124,9 @@ const INFERHUB_MODELS_RAW: readonly {
   { id: "cc/claude-opus-4-8", contextLimit: 1000000, outputLimit: 128000 },
   { id: "cc/claude-opus-5", contextLimit: 1000000, outputLimit: 128000 },
   { id: "cc/claude-sonnet-4-5", contextLimit: 200000, outputLimit: 64000 },
-  { id: "cc/claude-sonnet-4-6", contextLimit: 1000000, outputLimit: 64000 },
+  // 128K: Sonnet 4.6 is in the 1M/128K generation, the same as the Opus 4.6
+  // row directly above it and every other 4.6+ row here.
+  { id: "cc/claude-sonnet-4-6", contextLimit: 1000000, outputLimit: 128000 },
   { id: "cc/claude-sonnet-5", contextLimit: 1000000, outputLimit: 128000 },
   // cb/ — CodeBuddy (12 models)
   { id: "cb/claude-opus-4.6", contextLimit: 1000000, outputLimit: 128000 },

package/src/providers/integrations/kilo/kilo.ts

@@ -87,7 +87,6 @@ export const KILO_MODELS: readonly ModelDefinition[] = [
   // window the router may select into rather than one model's.
   kiloModel("kilo-auto/free", 256_000, 32_768, { reasoning: true }),
   kiloModel("kilo-auto/small", 262_144, 32_768, { vision: true, reasoning: true }),
-  kiloModel("openrouter/auto", 2_000_000, 128_000, { reasoning: true }),
 ];
 
 /**

package/src/providers/integrations/kiro/kiro-catalog.ts

@@ -71,9 +71,15 @@ export const KIRO_MODELS: readonly ModelDefinition[] = [
   kiroModel({ id: "claude-opus-4.5", ctx: 200_000, out: 64_000, vision: true, reasoning: true, toolCall: true }),
   kiroModel({ id: "claude-sonnet-5", ctx: 1_000_000, out: 128_000, vision: true, reasoning: true, toolCall: true }),
   kiroModel({ id: "claude-sonnet-5.5", ctx: 1_000_000, out: 128_000, vision: true, reasoning: true, toolCall: true }),
-  kiroModel({ id: "claude-sonnet-4.5", ctx: 1_000_000, out: 64_000, vision: true, reasoning: true, toolCall: true }),
+  // 200K, not the 1M the 1M-window models use: Sonnet 4.5 predates it. The
+  // million-token window arrived with Opus 4.6 and the 5.x generation; the 4.5
+  // trio is 200K, and Opus and Haiku here already say so.
+  kiroModel({ id: "claude-sonnet-4.5", ctx: 200_000, out: 64_000, vision: true, reasoning: true, toolCall: true }),
   kiroModel({ id: "claude-haiku-4.5", ctx: 200_000, out: 64_000, vision: true, reasoning: true, toolCall: true }),
-  kiroModel({ id: "claude-haiku-5.5", ctx: 200_000, out: 64_000, vision: true, reasoning: true, toolCall: true }),
+  // 1M/128K, not the 200K/64K of the 4.5 row above it: Haiku moved to the
+  // million-token window and the doubled output ceiling with the rest of the
+  // 5.x generation, and this line had been copied from its predecessor.
+  kiroModel({ id: "claude-haiku-5.5", ctx: 1_000_000, out: 128_000, vision: true, reasoning: true, toolCall: true }),
   kiroModel({ id: "gpt-5.5", ctx: 272_000, out: 128_000, reasoning: true, toolCall: true }),
   kiroModel({ id: "gpt-5.6-sol", ctx: 272_000, out: 128_000, reasoning: true, toolCall: true }),
   kiroModel({ id: "gpt-5.6-terra", ctx: 272_000, out: 128_000, reasoning: true, toolCall: true }),