cartethyia 2.7.4 → 2.7.5

package/src/console/providers/catalog/store.ts

@@ -10,7 +10,7 @@ import { globalOrOwnedBy, ownedByOnly } from "../../../persistence/tenant-scope"
 import { nextSortIndex, reorderSortIndex } from "../../../persistence/sort-order";
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
 import { buddyTaskLedger, models, networkPools, providerAccounts, providerOauthStates, providerPoolAccounts, providers, telemetryEvents, telemetryUsageTotals, tenantDisabledModels } from "../../../persistence/schema";
-import { breakdownTelemetry, IS_GATEWAY_ERROR_SQL } from "../../../observability/event-query";
+import { IS_GATEWAY_ERROR_SQL } from "../../../observability/event-query";
 import type { WireFamily } from "../../../protocol/canonical-model";
 import { listAccountHealthEvents, recoverAccount, deleteAccountHealthEvents, type AccountHealthEventRecord } from "../../../providers/operations/account-health-service";
 import { invalidateCredentialCache } from "../../../providers/operations/provider-credential-service";
@@ -679,15 +679,13 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     rows: readonly (typeof providerAccounts.$inferSelect)[],
   ): Promise<readonly ProviderAccountResponse[]> {
     if (rows.length === 0) return [];
-    const todayStart = new Date();
-    todayStart.setUTCHours(0, 0, 0, 0);
     const accountIds = rows.map((row) => row.id);
     // Today's per-account usage is one GROUP BY, not a read of every event
-    // since midnight. `breakdownTelemetry("account")` is capped at 100 groups;
-    // a page of accounts never exceeds it, and the lookup below is by id, so a
-    // group that fell outside the cap simply reads as "no usage today" — the
-    // same value an account with no traffic gets.
-    const todayGroups = await breakdownTelemetry(this.db, tenantId, "account", todayStart);
+    // since midnight. The read is scoped to the accounts on this page via the
+    // `(tenant, account, created_at)` index — a full-tenant breakdown scanned
+    // every of today's events and capped at 100 groups, so an account past
+    // the cap silently read as "no usage today".
+    const todayGroups = await this.accountTodayUsage(tenantId, accountIds);
     const todayByAccount = new Map(
       todayGroups.map((group) => [
         group.key,
@@ -740,6 +738,52 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     });
   }
 
+  /**
+   * Today's per-account usage for a concrete id set. Scoped to those ids so
+   * the `(tenant, account, created_at)` index serves the range instead of a
+   * full-tenant window scan; returns exactly one group per account with
+   * traffic, so an account is never lost to a top-N cap.
+   */
+  private async accountTodayUsage(
+    tenantId: string,
+    accountIds: readonly string[],
+  ): Promise<
+    Array<{ key: string; requests: number; errors: number; inputTokens: number; outputTokens: number }>
+  > {
+    if (accountIds.length === 0) return [];
+    const todayStart = new Date();
+    todayStart.setUTCHours(0, 0, 0, 0);
+    const rows = await this.db
+      .select({
+        accountId: telemetryEvents.accountId,
+        requests: sql<number>`count(*)`,
+        errors: sql<number>`sum(case when ${IS_GATEWAY_ERROR_SQL} then 1 else 0 end)`,
+        inputTokens: sql<number>`coalesce(sum(${telemetryEvents.inputTokens}), 0)`,
+        outputTokens: sql<number>`coalesce(sum(${telemetryEvents.outputTokens}), 0)`,
+      })
+      .from(telemetryEvents)
+      .where(
+        and(
+          eq(telemetryEvents.tenantId, tenantId),
+          gte(telemetryEvents.createdAt, todayStart),
+          inArray(telemetryEvents.accountId, accountIds),
+        ),
+      )
+      .groupBy(telemetryEvents.accountId);
+    return rows.flatMap((row) => {
+      if (row.accountId === null) return [];
+      return [
+        {
+          key: row.accountId,
+          requests: Number(row.requests),
+          errors: Number(row.errors),
+          inputTokens: Number(row.inputTokens),
+          outputTokens: Number(row.outputTokens),
+        },
+      ];
+    });
+  }
+
   private async accountInflightFor(
     tenantId: string,
     providerId: string | undefined,
@@ -873,6 +917,27 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     return [...accounts, ...poolAccounts];
   }
 
+  /**
+   * One cheap id-only read of an account set, for callers that need the set
+   * (e.g. the routing-inflight reader) without the usage aggregates
+   * `listAccounts` computes (P-02). No ORDER BY: the set is order-insensitive.
+   */
+  async listAccountIds(
+    tenantId: string,
+    providerId: string,
+  ): Promise<readonly string[]> {
+    const rows = await this.db
+      .select({ id: providerAccounts.id })
+      .from(providerAccounts)
+      .where(
+        and(
+          eq(providerAccounts.providerId, providerId),
+          globalOrOwnedBy(providerAccounts.tenantId, tenantId),
+        ),
+      );
+    return rows.map((row) => row.id);
+  }
+
   async listAllAccounts(tenantId: string): Promise<readonly ProviderAccountResponse[]> {
     const rows = await this.db
       .select()
@@ -885,6 +950,77 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     return [...accounts, ...poolAccounts];
   }
 
+  async listAllAccountSummaries(
+    tenantId: string,
+  ): Promise<readonly { providerId: string; status: string }[]> {
+    const rows = await this.db
+      .select({ providerId: providerAccounts.providerId, status: providerAccounts.status })
+      .from(providerAccounts)
+      .where(globalOrOwnedBy(providerAccounts.tenantId, tenantId));
+    return rows.map((row) => ({ providerId: row.providerId, status: row.status }));
+  }
+
+  /**
+   * Per-provider account totals for one tenant, from a single grouped read (one
+   * statement, served by the `(provider_id, tenant_id)` index). `active` counts
+   * every status except `disabled` — an account parked by the health machine
+   * (`cooldown`) is still a connection, matching how the account-overview badge
+   * reads status. Used by the provider list overview (`accountCount` /
+   * `activeAccountCount`); totals are never counted in a per-provider loop.
+   */
+  async providerAccountCounts(
+    tenantId: string,
+  ): Promise<readonly { providerId: string; total: number; active: number }[]> {
+    const rows = await this.db
+      .select({
+        providerId: providerAccounts.providerId,
+        total: sql<number>`count(*)`,
+        active: sql<number>`sum(case when ${providerAccounts.status} <> 'disabled' then 1 else 0 end)`,
+      })
+      .from(providerAccounts)
+      .where(globalOrOwnedBy(providerAccounts.tenantId, tenantId))
+      .groupBy(providerAccounts.providerId);
+    return rows.map((row) => ({
+      providerId: row.providerId,
+      total: Number(row.total),
+      active: Number(row.active),
+    }));
+  }
+
+  /**
+   * Per-provider enabled model-row counts for one tenant, from a single grouped
+   * read over `models ⋈ providers`. A model counts only when the row is enabled
+   * and the tenant has not suppressed it via `tenant_disabled_models` — the
+   * same visibility rule the per-provider model listing applies, so the
+   * overview badge never disagrees with what the detail page would list.
+   */
+  async providerModelCounts(
+    tenantId: string,
+  ): Promise<readonly { providerId: string; count: number }[]> {
+    const rows = await this.db
+      .select({ providerId: models.providerId, count: sql<number>`count(*)` })
+      .from(models)
+      .innerJoin(providers, eq(models.providerId, providers.id))
+      .leftJoin(
+        tenantDisabledModels,
+        and(
+          eq(tenantDisabledModels.tenantId, tenantId),
+          eq(tenantDisabledModels.providerId, models.providerId),
+          eq(tenantDisabledModels.modelId, models.modelId),
+          eq(tenantDisabledModels.endpointPath, models.endpointPath),
+        ),
+      )
+      .where(
+        and(
+          eq(models.enabled, true),
+          globalOrOwnedBy(providers.tenantId, tenantId),
+          isNull(tenantDisabledModels.id),
+        ),
+      )
+      .groupBy(models.providerId);
+    return rows.map((row) => ({ providerId: row.providerId, count: Number(row.count) }));
+  }
+
   /**
    * Pool-as-account rows for one provider. Only providers whose rate limit
    * follows the egress address materialize these; every other provider's pool
@@ -1391,6 +1527,8 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
       typeof authState?.["tokenExpiresAt"] === "string" ? authState["tokenExpiresAt"] : undefined;
     const jwtIssuer =
       typeof authState?.["jwtIssuer"] === "string" ? authState["jwtIssuer"] : undefined;
+    const authMethod =
+      typeof authState?.["authMethod"] === "string" ? authState["authMethod"] : undefined;
     return {
       id: row.id,
       providerId: row.providerId,
@@ -1400,6 +1538,7 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
       ...(credentialMode === undefined ? {} : { credentialMode }),
       ...(tokenExpiresAt === undefined ? {} : { tokenExpiresAt }),
       ...(jwtIssuer === undefined ? {} : { jwtIssuer }),
+      ...(authMethod === undefined ? {} : { authMethod }),
       status: row.status,
       ...(usage.inflight === undefined ? {} : { inflight: usage.inflight }),
       usageToday: usage.today,

package/src/console/providers/detail/routes.ts

@@ -30,7 +30,7 @@ const ROUTING_BOUNDS = {
   maxInflightPerProxy: PROVIDER_ROUTING_MAX_INFLIGHT_BOUNDS,
 } as const;
 
-export function createProviderDetailOperations(deps: ProviderDetailConfig) {
+function createProviderDetailOperations(deps: ProviderDetailConfig) {
   const operations = {
     async getRouting(
       access: AccessDecision | undefined,

package/src/console/providers/oauth/callback-listener.ts

@@ -28,7 +28,7 @@ import { log } from "../../../observability/logger";
 import { ConsoleDomainError } from "../../shared/errors";
 
 /** A loopback endpoint a callback can actually be delivered to. */
-export interface LoopbackCallbackEndpoint {
+interface LoopbackCallbackEndpoint {
   readonly port: number;
   readonly path: string;
 }
@@ -44,7 +44,7 @@ const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
  * installed app and a remote host is delivered over the network; neither is
  * something this process can bind, and both keep the manual path.
  */
-export function loopbackCallbackEndpoint(redirectUri: string): LoopbackCallbackEndpoint | undefined {
+function loopbackCallbackEndpoint(redirectUri: string): LoopbackCallbackEndpoint | undefined {
   let url: URL;
   try {
     url = new URL(redirectUri);
@@ -59,12 +59,19 @@ export function loopbackCallbackEndpoint(redirectUri: string): LoopbackCallbackE
 }
 
 /** Completes one callback once its code and state have been read. */
-export interface OAuthCallbackCompleter {
+interface OAuthCallbackCompleter {
   complete(
     providerId: string,
     code: string,
     state: string,
-  ): Promise<{ readonly ok: boolean; readonly message: string }>;
+    /** Extra query params the callback carried (e.g. Kiro's `login_option`). */
+    callbackParams?: Readonly<Record<string, string>>,
+  ): Promise<{
+    readonly ok: boolean;
+    readonly message: string;
+    readonly redirectUrl?: string;
+    readonly continueState?: string;
+  }>;
 }
 
 /** Minimal `Bun.serve` surface this module depends on. */
@@ -79,7 +86,7 @@ type ServeFn = (options: {
   readonly fetch: (request: Request) => Response | Promise<Response>;
 }) => LoopbackServer;
 
-export interface CallbackListenerOptions {
+interface CallbackListenerOptions {
   readonly completer: OAuthCallbackCompleter;
   /** Injected in tests; defaults to `Bun.serve`. */
   readonly serve?: ServeFn;
@@ -92,7 +99,10 @@ const DEFAULT_TTL_MS = 900_000;
 
 interface RegisteredFlow {
   readonly providerId: string;
+  /** Paths this flow's callback may arrive on (e.g. Kiro serves both `/oauth/callback` and `/signin/callback`). */
+  readonly paths: readonly string[];
   readonly timer: ReturnType<typeof setTimeout>;
+  inFlight: boolean;
 }
 
 interface PortListener {
@@ -134,17 +144,30 @@ export class OAuthCallbackListener {
     if (endpoint === undefined) return false;
     const existing = this.#ports.get(endpoint.port);
     if (existing !== undefined) {
-      this.#remember(existing, state, providerId);
+      this.#remember(existing, state, providerId, this.#callbackPaths(endpoint.path));
       return true;
     }
     const servers = this.#bind(endpoint);
     const listener: PortListener = { port: endpoint.port, servers, flows: new Map() };
     this.#ports.set(endpoint.port, listener);
-    this.#remember(listener, state, providerId);
+    this.#remember(listener, state, providerId, this.#callbackPaths(endpoint.path));
     log.info(`[oauth] callback listener bound on 127.0.0.1:${endpoint.port}${endpoint.path}`);
     return true;
   }
 
+  /**
+   * The paths one login may deliver its callback on. Kiro's portal is observed
+   * (unpacked IDE 1.4.62) to redirect to both `/oauth/callback` and
+   * `/signin/callback`; binding only the advertised path left a redirect to the
+   * other one hitting a 404 and the login hanging. Other providers neither
+   * register nor expect `/signin/callback`, so adding it is harmless.
+   */
+  #callbackPaths(advertised: string): readonly string[] {
+    return advertised === "/signin/callback"
+      ? [advertised]
+      : [advertised, "/signin/callback"];
+  }
+
   /** Drops a flow and frees its port when nothing else is waiting on it. */
   release(redirectUri: string, state: string): void {
     const endpoint = loopbackCallbackEndpoint(redirectUri);
@@ -154,6 +177,25 @@ export class OAuthCallbackListener {
     this.#forget(endpoint.port, listener, state);
   }
 
+  /**
+   * Re-registers an existing flow state under a new callback state.
+   *
+   * Kiro's two-phase portal login starts a second authorization leg with a
+   * *fresh* state (the IDE mints a new UUID for the IdC authorize step), so
+   * the loopback listener must retain the pending flow under that second
+   * state too — otherwise the phase-2 callback answers "OAuth session not
+   * found or expired" even though the flow is still alive.
+   */
+  track(redirectUri: string, state: string, newState: string): void {
+    const endpoint = loopbackCallbackEndpoint(redirectUri);
+    if (endpoint === undefined) return;
+    const listener = this.#ports.get(endpoint.port);
+    if (listener === undefined) return;
+    const flow = listener.flows.get(state);
+    if (flow === undefined) return;
+    this.#remember(listener, newState, flow.providerId, flow.paths);
+  }
+
   /**
    * Drops every flow for `providerId` on `redirectUri`'s port.
    *
@@ -182,7 +224,7 @@ export class OAuthCallbackListener {
     }
   }
 
-  #remember(listener: PortListener, state: string, providerId: string): void {
+  #remember(listener: PortListener, state: string, providerId: string, paths: readonly string[]): void {
     const previous = listener.flows.get(state);
     if (previous !== undefined) clearTimeout(previous.timer);
     const timer = setTimeout(() => {
@@ -190,7 +232,7 @@ export class OAuthCallbackListener {
     }, this.#ttlMs);
     // A pending login must not hold the process open on its own.
     (timer as unknown as { unref?: () => void }).unref?.();
-    listener.flows.set(state, { providerId, timer });
+    listener.flows.set(state, { providerId, paths, timer, inFlight: false });
   }
 
   #forget(port: number, listener: PortListener, state: string): void {
@@ -250,9 +292,6 @@ export class OAuthCallbackListener {
     endpoint: LoopbackCallbackEndpoint,
   ): Promise<Response> {
     const url = new URL(request.url);
-    if (url.pathname !== endpoint.path) {
-      return new Response("Not found", { status: 404 });
-    }
     const listener = this.#ports.get(endpoint.port);
     if (listener === undefined) {
       return new Response("OAuth session not found or expired.", { status: 400 });
@@ -278,7 +317,7 @@ export class OAuthCallbackListener {
         { status: 400, headers: { "content-type": "text/html; charset=utf-8" } },
       );
     }
-    if (code.length === 0) {
+    if (code.length === 0 && !url.searchParams.has("login_option")) {
       return new Response("Missing authorization code.", { status: 400 });
     }
     // `state` is the correlation key and the replay guard. An authorization
@@ -297,14 +336,45 @@ export class OAuthCallbackListener {
     if (matched === undefined) {
       return new Response("OAuth session not found or expired.", { status: 400 });
     }
-    // Claim the flow before awaiting: a browser that retries the redirect must
-    // not start a second exchange with a code that is already being spent.
+    // Some providers (Kiro's portal) can land the callback on any of several
+    // registered paths — `/oauth/callback` or `/signin/callback`. Accept the
+    // path the flow registered for, not only the advertised default.
+    if (!matched.paths.includes(url.pathname)) {
+      return new Response("Not found", { status: 404 });
+    }
+    if (matched.inFlight) {
+      return new Response("OAuth callback is already being processed.", { status: 409 });
+    }
+    // Claim while the exchange is in flight. A multi-step flow (Kiro OIDC) may
+    // return a redirect and reuse this listener/state for its next callback.
+    matched.inFlight = true;
     const matchedState = state.length > 0 ? state : this.#stateOf(listener, matched);
-    if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState);
-    let result: { ok: boolean; message: string };
+    let result: {
+      ok: boolean;
+      message: string;
+      redirectUrl?: string;
+      continueState?: string;
+    };
+    // Some authorization servers (Kiro's portal) append provider-specific query
+    // params — `login_option` names the social/enterprise family that approved.
+    // The exchange needs them to rebuild the exact redirect URI the portal saw,
+    // and the OIDC families carry `issuer_url`/`idc_region`/`client_id`/`scopes`
+    // that the continuation flow needs. Forward every param other than the ones
+    // this handler already consumed.
+    const callbackParams: Record<string, string> = {};
+    for (const [key, value] of url.searchParams) {
+      if (key === "code" || key === "state" || key === "error" || key === "error_description") continue;
+      callbackParams[key] = value;
+    }
     try {
-      result = await this.#completer.complete(matched.providerId, code, state);
+      result = await this.#completer.complete(
+        matched.providerId,
+        code,
+        state,
+        Object.keys(callbackParams).length > 0 ? callbackParams : undefined,
+      );
     } catch (failure) {
+      if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState);
       const message = failure instanceof Error ? failure.message : "OAuth login failed";
       log.error(`[oauth] callback completion failed for ${matched.providerId}: ${message}`);
       return new Response(
@@ -312,6 +382,18 @@ export class OAuthCallbackListener {
         { status: 500, headers: { "content-type": "text/html; charset=utf-8" } },
       );
     }
+    if (result.redirectUrl !== undefined) {
+      // Phase 1 of a two-phase login (Kiro OIDC): the flow is still pending, so
+      // continue by sending the browser to the phase-2 authorize URL. The phase-2
+      // authorize URL carries a fresh state (`continueState`), which the completer
+      // already registered under — keep the current matcher alive for it.
+      matched.inFlight = false;
+      return new Response(null, {
+        status: 302,
+        headers: { location: result.redirectUrl },
+      });
+    }
+    if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState);
     if (!result.ok) {
       return new Response(
         `<!doctype html><html><body><p>OAuth login failed: ${escapeHtml(result.message)}</p></body></html>`,

package/src/console/providers/oauth/routes.ts

@@ -171,7 +171,7 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
  * server the redirect arrives at; `callback-listener.ts` is what makes those
  * the same endpoint.
  */
-export interface PersistedOAuthAccount {
+interface PersistedOAuthAccount {
   readonly accountId: string;
 }
 
@@ -212,9 +212,20 @@ async function requireClient(
 }
 
 /** The result of exchanging one authorization code, as the caller should report it. */
-export interface OAuthCompleteOutcome {
+interface OAuthCompleteOutcome {
   readonly ok: boolean;
   readonly message: string;
+  /**
+   * When set, the exchange is not finished: the browser must be redirected to
+   * this URL to continue (Kiro's OIDC families need a second authorization
+   * leg after the portal callback).
+   */
+  readonly redirectUrl?: string;
+  /**
+   * New callback state the phase-2 authorize URL carries (Kiro mints a fresh
+   * state for the IdC leg; the console retains the pending flow under it).
+   */
+  readonly continueState?: string;
 }
 
 /**
@@ -231,29 +242,41 @@ export async function completeLogin(
   providerId: string,
   code: string,
   state: string,
+  callbackParams?: Readonly<Record<string, string>>,
 ): Promise<OAuthCompleteOutcome> {
   // An empty `state` means the authorization server does not echo one
   // (OpenRouter omits it from the callback entirely); correlate by provider in
   // that case, and by state otherwise so the stronger check stays in force
   // wherever the server supports it.
+  //
+  // The flow is peeked, not consumed, until the exchange succeeds: consuming
+  // first means a failed exchange (a transient upstream blip, a paste that
+  // missed a parameter) burns the state and every retry answers "unknown or
+  // expired state". The state is deleted only after the account persists.
   const flow = state
-    ? await config.oauthFlowStore.consumePending(state)
+    ? await config.oauthFlowStore.peekPending(state)
     : await config.oauthFlowStore.consumePendingByProvider(providerId);
   if (!flow || flow.providerId !== providerId) {
     return { ok: false, message: "unknown or expired state" };
   }
-  // The flow is spent, so its listener registration has nothing left to wait
-  // for; releasing it here keeps a manual paste from leaving the port bound.
-  // Stateless callbacks arrive with `""`, which matches no filed state —
-  // release by provider so the OpenRouter port does not linger until TTL.
-  if (state.length > 0) config.callbackListener.release(flow.redirectUri, state);
-  else config.callbackListener.releaseProvider(flow.redirectUri, providerId);
+  // Release the listener registration for this flow. The pending state itself
+  // stays available so a manual re-paste can retry the exchange. The release is
+  // deferred until after the exchange for two-phase flows: Kiro's OIDC portal
+  // callback (phase 1) must keep the loopback listener alive so the second
+  // authorization leg can land on it.
   const client = await requireClient(config.providerRegistry, providerId);
   if (!client.exchangeCode) {
     return { ok: false, message: "provider does not support browser authorization" };
   }
+  const releaseListener = () => {
+    if (state.length > 0) config.callbackListener.release(flow.redirectUri, state);
+    else config.callbackListener.releaseProvider(flow.redirectUri, providerId);
+  };
   try {
-    const result = await client.exchangeCode(code, flow.codeVerifier, flow.redirectUri, state);
+    const result = await client.exchangeCode(code, flow.codeVerifier, flow.redirectUri, state, {
+      ...(callbackParams === undefined ? {} : { parameters: callbackParams }),
+      ...(flow.providerState === undefined ? {} : { providerState: flow.providerState }),
+    });
     const tokenCheck = await validateIssuedAccessToken(
       result.access,
       providerJwtVerification(providerId),
@@ -270,9 +293,51 @@ export async function completeLogin(
       label: result.accountLabel ?? flow.accountLabel,
       ...result,
     });
+    // The exchange succeeded and the account is persisted; now the flow is
+    // spent. Consuming it here (peeked above) frees the state and the provider
+    // pointer so a replayed callback cannot re-create the account.
+    releaseListener();
+    if (state.length > 0) await config.oauthFlowStore.consumePending(state);
+    else await config.oauthFlowStore.consumePendingByProvider(providerId);
     await config.snapshotInvalidator?.invalidate();
     return { ok: true, message: `${providerId} account connected. You may close this tab.` };
   } catch (error) {
+    // Kiro's OIDC families: the portal callback carries no code — only
+    // `login_option` + issuer/region. The client responded with the second-leg
+    // authorize URL plus a fresh PKCE verifier and the OIDC registration.
+    // Rewrite the pending flow so phase 2 exchanges against that verifier, keep
+    // the listener alive, and tell the caller to redirect the browser there.
+    // dynamic-import: B-02 lazy graph — 58KB kiro OIDC path, only for Kiro flows.
+    // The kiro-oauth graph is 58KB, so it is imported lazily here — only the
+    // Kiro OIDC path needs the error class — instead of on the console boot
+    // graph (B-02).
+    const { KiroOidcPendingError } = await import(
+      "../../../providers/integrations/kiro/kiro-oauth"
+    );
+    if (error instanceof KiroOidcPendingError) {
+      // Phase 1 of Kiro's OIDC portal login: the portal callback carried no
+      // code — only `login_option` + issuer/region. The client answered with the
+      // phase-2 authorize URL, a fresh PKCE verifier, and the OIDC client
+      // registration. Mirror the 1.4.62 IDE: the second leg uses a *new* state
+      // (not the portal's), so mint it here, keep the pending flow reachable
+      // under both states, and tell the caller which state to expect back.
+      const continueState = error.continueState;
+      if (state.length > 0 && continueState.length > 0) {
+        await config.oauthFlowStore.savePending(continueState, {
+          ...flow,
+          codeVerifier: error.codeVerifier,
+          providerState: error.providerState,
+        });
+        config.callbackListener.track(flow.redirectUri, state, continueState);
+      }
+      return {
+        ok: false,
+        message: error.message,
+        redirectUrl: error.authorizeUrl,
+        continueState,
+      };
+    }
+    releaseListener();
     // Upstream token-endpoint bodies can echo credentials or sensitive
     // diagnostics — the browser gets a generic failure; the bounded detail
     // stays server-side in the console log.
@@ -351,7 +416,7 @@ function failurePage(message: string, wantsJson: boolean): Response {
   );
 }
 
-export function createOAuthLoginOperations(config: OAuthLoginConfig) {
+function createOAuthLoginOperations(config: OAuthLoginConfig) {
   const operations = {
     async beginAuthorize(
         access: AccessDecision | undefined,
@@ -437,8 +502,15 @@ export function createOAuthLoginOperations(config: OAuthLoginConfig) {
         code: string,
         state: string,
         wantsJson = false,
+        callbackParams?: Readonly<Record<string, string>>,
       ): Promise<Response> {
-        const outcome = await completeLogin(config, providerId, code, state);
+        const outcome = await completeLogin(config, providerId, code, state, callbackParams);
+        if (outcome.redirectUrl !== undefined) {
+          return new Response(null, {
+            status: 302,
+            headers: { location: outcome.redirectUrl },
+          });
+        }
         return outcome.ok ? successPage(providerId, wantsJson) : failurePage(outcome.message, wantsJson);
       },
     async handleCallbackError(
@@ -670,7 +742,14 @@ export function createOAuthLoginRoutes(config: OAuthLoginConfig): AnyElysia {
       // `state` is absent for authorization servers that do not echo it
       // (OpenRouter). The flow is then correlated by provider instead — one
       // browser login is in flight per provider at a time.
-      return factory.handleCallback(params.providerId, code, state, wantsJson);
+      const loginOption = typeof query["login_option"] === "string" ? query["login_option"] : undefined;
+      return factory.handleCallback(
+        params.providerId,
+        code,
+        state,
+        wantsJson,
+        loginOption === undefined ? undefined : { login_option: loginOption },
+      );
     })
     .post(
       "/:providerId/oauth/device/start",

package/src/console/quota/account-quota-global.ts

@@ -1,10 +1,17 @@
 import { t } from "elysia";
 import type { Elysia } from "elysia";
-import { and, eq, isNull } from "drizzle-orm";
+import { and, eq, inArray, isNull } from "drizzle-orm";
 import { adminAuditLog, providerAccounts } from "../../persistence/schema";
 import { requireGlobalAdmin } from "../shared/errors";
-import { GLOBAL_QUOTA_LENS, invalidateQuotaCache } from "../../providers/quota/cache";
-import { invalidateCredentialCache } from "../../providers/operations/provider-credential-service";
+import {
+  GLOBAL_QUOTA_LENS,
+  invalidateQuotaCache,
+  invalidateQuotaCaches,
+} from "../../providers/quota/cache";
+import {
+  invalidateCredentialCache,
+  invalidateCredentialCaches,
+} from "../../providers/operations/provider-credential-service";
 import {
   QUOTA_REFRESH_TIMEOUT_MS,
   loadQuotaTarget,
@@ -119,6 +126,37 @@ export function registerAccountQuotaGlobalRoutes(
       });
       return { success: true };
     })
+    .post("/global/accounts/batch-delete", {
+      body: t.Object({
+        accountIds: t.Array(t.String()),
+      }),
+    }, async ({ request, body }) => {
+      const access = requireGlobalAdmin(accessResolver(request));
+      const accountIds = [...new Set(body.accountIds)];
+      if (accountIds.length === 0) {
+        return { ok: true, deleted: [], missing: [] };
+      }
+      // One DELETE statement scoped to shared accounts only: a tenant-owned row
+      // (`tenant_id IS NOT NULL`) is never matchable by a global admin, so it
+      // lands in `missing`.
+      const deleted = await db
+        .delete(providerAccounts)
+        .where(and(inArray(providerAccounts.id, accountIds), isNull(providerAccounts.tenantId)))
+        .returning({ id: providerAccounts.id });
+      const deletedIds = deleted.map((row) => row.id);
+      const deletedSet = new Set(deletedIds);
+      const missing = accountIds.filter((id) => !deletedSet.has(id));
+      invalidateCredentialCaches(deletedIds);
+      await invalidateQuotaCaches(GLOBAL_QUOTA_LENS, deletedIds, redis);
+      await snapshotInvalidator?.invalidate();
+      await db.insert(adminAuditLog).values({
+        actor: access.admissionIdentity,
+        action: "provider_account.global.batch_deleted",
+        target: "global",
+        detail: { deleted: deletedIds, missing },
+      });
+      return { ok: true, deleted: deletedIds, missing };
+    })
     .post("/global/accounts/:id/quota/refresh", async ({ request, params, set }) => {
       const access = requireGlobalAdmin(accessResolver(request));
       const target = await loadQuotaTarget(db, params.id, null);