dsh-coding-subscription-oauth 0.6.3 → 0.6.5

package/lib/kimi-errors.d.ts

@@ -1,13 +1,3 @@
-/**
- * Kimi Code error remapping.
- * @module dsh-coding-subscription-oauth/kimi-errors
- */
-export declare function isMisclassifiedContextWindowError(detail: string): boolean;
-export declare function remapAuthFailureIfContextOverflow(failure: {
-    message: string;
-    code: string;
-}): {
-    message: string;
-    code: string;
-};
+/** Compatibility facade — implementation lives in `src/runtime/` (mirrored from Hub vendor core). */
+export { isMisclassifiedContextWindowError, remapAuthFailureIfContextOverflow, } from "./runtime/kimi-errors.js";
 //# sourceMappingURL=kimi-errors.d.ts.map

package/lib/kimi-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kimi-errors.d.ts","sourceRoot":"","sources":["../../src/kimi-errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACb,CAGA"}
+{"version":3,"file":"kimi-errors.d.ts","sourceRoot":"","sources":["../../src/kimi-errors.ts"],"names":[],"mappings":"AAAA,qGAAqG;AAErG,OAAO,EACN,iCAAiC,EACjC,iCAAiC,GACjC,MAAM,0BAA0B,CAAC"}

package/lib/runtime/gateway-protocol.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Shared request/stream types for the local coding-subscription gateway.
+ * @module dsh-coding-oauth-core/gateway-protocol
+ */
+export interface GatewayToolCall {
+    id: string;
+    name: string;
+    arguments: string;
+}
+export interface GatewayTool {
+    name: string;
+    description: string;
+    parameters: Record<string, unknown>;
+}
+export interface GatewayChatMessage {
+    role: string;
+    content: string;
+    tool_calls?: readonly GatewayToolCall[];
+    reasoning_content?: string;
+    tool_call_id?: string;
+    tool_name?: string;
+}
+export interface GatewayCompletionRequest {
+    model: string;
+    messages: readonly GatewayChatMessage[];
+    tools?: readonly GatewayTool[];
+    reasoning?: string;
+}
+export type GatewayStreamPart = {
+    type: "text";
+    text: string;
+} | {
+    type: "thinking";
+    text: string;
+} | {
+    type: "tool_call";
+    index: number;
+    id: string;
+    name: string;
+    arguments: string;
+} | {
+    type: "done";
+    finish: "stop" | "tool_calls" | "length";
+};
+export type GatewayThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
+export declare function isThinkingLevel(value: string): value is GatewayThinkingLevel;
+//# sourceMappingURL=gateway-protocol.d.ts.map

package/lib/runtime/gateway-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-protocol.d.ts","sourceRoot":"","sources":["../../../src/runtime/gateway-protocol.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACxC,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GAC1B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,QAAQ,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEnG,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,oBAAoB,CAU5E"}

package/lib/runtime/grok-errors.d.ts

@@ -0,0 +1,13 @@
+/**
+ * xAI / Grok Build error remapping shared by Hub and Subscription.
+ * @module dsh-coding-oauth-core/grok-errors
+ */
+export declare function isXaiCapacityError(detail: string): boolean;
+export declare function remapXaiCapacityFailure(failure: {
+    message: string;
+    code: string;
+}): {
+    message: string;
+    code: string;
+};
+//# sourceMappingURL=grok-errors.d.ts.map

package/lib/runtime/grok-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/grok-errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACb,CAGA"}

package/lib/runtime/http-json.d.ts

@@ -0,0 +1,10 @@
+import type { IncomingMessage } from "node:http";
+export declare const JSON_BODY_LIMIT_BYTES: number;
+export declare class JsonRequestError extends Error {
+    readonly statusCode: 400 | 413;
+    constructor(statusCode: 400 | 413, message: string);
+}
+/** Read one JSON request body with a strict in-memory ceiling. */
+export declare function readJsonRequest(request: IncomingMessage, limit?: number): Promise<unknown>;
+export declare function requestErrorStatus(error: unknown, fallback: number): number;
+//# sourceMappingURL=http-json.d.ts.map

package/lib/runtime/http-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-json.d.ts","sourceRoot":"","sources":["../../../src/runtime/http-json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAE/C,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC;gBAEnB,UAAU,EAAE,GAAG,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM;CAKlD;AASD,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,SAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CAuDzG;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/lib/runtime/kimi-errors.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Kimi Code error remapping shared by Hub and Subscription.
+ * @module dsh-coding-oauth-core/kimi-errors
+ */
+export declare function isMisclassifiedContextWindowError(detail: string): boolean;
+export declare function remapAuthFailureIfContextOverflow(failure: {
+    message: string;
+    code: string;
+}): {
+    message: string;
+    code: string;
+};
+//# sourceMappingURL=kimi-errors.d.ts.map

package/lib/runtime/kimi-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kimi-errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/kimi-errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACb,CAGA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-coding-subscription-oauth",
   "description": "DeepSeek Harness coding-subscription OAuth: SuperGrok/Grok Build, ChatGPT Plus Codex, Kimi Code, Claude Code. Fixes AUTH API key is invalid, INVALID_REPLAY_STATE, grok-4.6 xhigh, Kimi Bearer vs x-api-key.",
-	"version": "0.6.3",
+  "version": "0.6.5",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
@@ -41,6 +41,8 @@
   },
   "scripts": {
     "check:bom": "node build/verify-dsh-bom.mjs",
+    "assert:node": "node scripts/assert-node.mjs",
+    "assert:runtime-slice": "node scripts/assert-runtime-slice-sync.mjs",
     "clean": "node build/clean.mjs",
     "typecheck": "tsc -b tsconfig.host.json tsconfig.client.json",
     "build:server": "tsc -p tsconfig.build.json && tsc -p tsconfig.dts-bin.json && node build/build-server.mjs",
@@ -49,14 +51,17 @@
     "build": "pnpm run release:build",
     "test": "vitest run",
     "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
     "lint": "biome check",
-    "check:next": "pnpm run check:bom && pnpm run lint && pnpm run typecheck && pnpm run test",
-    "check": "pnpm run lint && pnpm run release:build && pnpm run test",
+    "check:next": "pnpm run assert:node && pnpm run assert:runtime-slice && pnpm run check:bom && pnpm run lint && pnpm run typecheck && pnpm run test",
+    "check": "pnpm run assert:node && pnpm run assert:runtime-slice && pnpm run lint && pnpm run release:build && pnpm run test",
     "release:promote": "node build/promote-release.mjs",
     "release:verify": "node build/verify-release.mjs",
     "release:build": "pnpm run build:artifacts && pnpm run release:promote",
     "release:dry": "node scripts/release.mjs --dry-run",
+    "release:inspect": "pnpm run assert:node && node scripts/release.mjs --dry-run",
     "release:pack": "node scripts/release.mjs --pack",
+    "release:publish": "node scripts/release-publish.mjs",
     "verify:deployed": "node scripts/verify-deployed-catalog.mjs",
     "smoke:deployed": "node scripts/smoke-deployed-routes.mjs",
     "prepack": "pnpm run release:build"
@@ -76,7 +81,6 @@
   },
   "files": [
     "lib",
-    "src",
     "media",
     "cordis.patch.yml",
     "INSTALL.md",
@@ -143,8 +147,8 @@
     }
   },
   "dependencies": {
-	"dsh-coding-oauth-core": "0.1.0",
-    "undici": "^7.24.8"
+    "dsh-coding-oauth-core": "0.1.1",
+    "undici": "7.29.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
@@ -210,11 +214,12 @@
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",
     "@types/react-dom": "18.3.7",
+    "@vitest/coverage-v8": "4.1.10",
     "esbuild": "^0.28.2",
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "typescript": "^6.0.3",
-    "undici": "^7.24.8",
+    "undici": "7.29.0",
     "vitest": "^4.1.8"
   },
   "overrides": {

package/scripts/release.mjs

@@ -141,6 +141,7 @@ if (process.platform !== "win32" && typeof packedBin?.mode === "number" && (pack
 const forbiddenFragments = [
 	"docs/local",
 	"reference/",
+	"src/",
 	".env",
 	".secrets",
 	"package-lock.json",

package/src/adapter.ts

@@ -1,348 +0,0 @@
-/** Coding-subscription adapter assembled from public dsh-llm-pi-ai extension points. */
-
-import type { AttachmentStore } from "@deepseek-ai/dsh-attachment";
-import type { RetryPolicyConfig } from "@deepseek-ai/dsh-llm";
-import { type LlmAdapter, LlmError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
-import type { PiAiAdapterOptions, ResolvedPiAiProviderProfile } from "@deepseek-ai/dsh-llm-pi-ai";
-import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
-import type { AliasLlmRoutePolicy } from "./alias-adapter.ts";
-import { AliasLlmAdapter } from "./alias-adapter.ts";
-import { preferredGrokBuildModelFrom } from "./catalog.ts";
-import { withCodexFastRouting } from "./codex-model-capabilities.ts";
-import {
-	CLAUDE_CODE_OAUTH_ROUTE,
-	CLAUDE_PI_PROVIDER,
-	CODEX_OAUTH_FAST_ROUTE,
-	CODEX_OAUTH_ROUTE,
-	CODEX_PI_PROVIDER,
-	DEFAULT_GROK_BUILD_MODEL,
-	GROK_BUILD_ROUTE,
-	GROK_BUILD_STREAM_IDLE_TIMEOUT_MS,
-	KIMI_CODE_OAUTH_ROUTE,
-	KIMI_PI_PROVIDER,
-	XAI_PI_PROVIDER,
-} from "./ids.ts";
-import type { OAuthProviderSession } from "./oauth-session.ts";
-import { grokBuildBaselineModels, grokBuildFingerprintHeaders } from "./provider.ts";
-import { safeMessage } from "./redact.ts";
-import type { GrokBuildSession } from "./session.ts";
-
-type PiAiAuthInjection = PiAiAdapterOptions["auth"];
-type PiAiCredentialStore = PiAiAuthInjection["credentials"];
-
-const REQUEST_IMAGE_POLICY = {
-	maxRequestImageBytes: 20 * 1024 * 1024,
-	requestImagePixelBudget: 2048 * 2048,
-	requestImageMaxBytes: 1024 * 1024,
-} as const;
-
-/**
- * Route pi-ai credential operations to the already owner-locked OAuth files.
- * The adapter may ask its collection about every profile, so an unknown id is
- * never allowed to reach a writable store. Reads are empty and writes fail
- * closed, preserving the existing per-provider refresh lock and file policy.
- */
-function oauthAuthInjection(grok: GrokBuildSession, subscriptions: readonly OAuthProviderSession[]): PiAiAuthInjection {
-	const stores = new Map<string, PiAiCredentialStore>([
-		[XAI_PI_PROVIDER, grok.store],
-		...subscriptions.map((session) => [session.definition.nativeProviderId, session.store] as const),
-	]);
-	const storeFor = (providerId: string): PiAiCredentialStore | undefined => stores.get(providerId);
-	return {
-		credentials: {
-			async read(providerId, options) {
-				return storeFor(providerId)?.read(providerId, options);
-			},
-			async list(options) {
-				const entries = await Promise.all([...stores.values()].map((store) => store.list(options)));
-				return entries.flat();
-			},
-			async modify(providerId, fn, options) {
-				const store = storeFor(providerId);
-				if (store === undefined)
-					throw new Error(`refusing credential write for unknown OAuth provider "${providerId}"`);
-				return store.modify(providerId, fn, options);
-			},
-			async delete(providerId, options) {
-				const store = storeFor(providerId);
-				if (store === undefined)
-					throw new Error(`refusing credential deletion for unknown OAuth provider "${providerId}"`);
-				await store.delete(providerId, options);
-			},
-		},
-		authContext: {
-			// Subscription adapters obtain request credentials only from their
-			// owner-scoped stores. Do not let a foreign environment/file credential
-			// silently change a selected OAuth route.
-			env: async () => undefined,
-			fileExists: async () => false,
-		},
-	};
-}
-
-/** Prefer grok-4.6 when the current (live or baseline) list has it. */
-export function preferredGrokBuildModel(models: readonly { id: string }[] = grokBuildBaselineModels()): string {
-	return preferredGrokBuildModelFrom(models.length === 0 ? [{ id: DEFAULT_GROK_BUILD_MODEL }] : models);
-}
-
-function missingCredential(name: string): never {
-	throw new LlmError(
-		`${name} is not signed in. Open Settings → Coding OAuth and sign in with your subscription.`,
-		"MISSING_CREDENTIAL",
-	);
-}
-
-/**
- * Minimum remaining validity demanded of an exported OAuth access token.
- * pi-ai 0.84+ already refreshes five minutes before the stored expiry; this
- * explicit floor documents the plugin contract and hard-fails a refresh that
- * returns an even-shorter-lived token instead of handing it to a request.
- */
-const MIN_OAUTH_VALIDITY_MS = 60_000;
-
-/**
- * Provider retry policy for the coding-subscription routes. The harness
- * default retryable set (EMPTY_RESPONSE/RATE_LIMIT/SERVER/TIMEOUT/TRANSPORT)
- * deliberately excludes AUTH, so an upstream 401 — e.g. an access token the
- * server revoked before its local expiry — used to kill the turn outright.
- * AUTH is added here because {@link AliasLlmAdapter} invalidates the stored
- * credential on every AUTH finish, so the retried step refreshes first and
- * does not repeat the same rejected token. Quota exhaustion stays outside the
- * set: retrying a billing-limit 403 cannot succeed and only delays the real
- * message. Genuine credential death is converted to MISSING_CREDENTIAL (not
- * retryable) by the resolver below, so it cannot loop either.
- *
- * Five stacked exponential delays (5s → 10s → 20s → 40s → 80s, ~155s total)
- * pair with the xAI capacity remap in {@link AliasLlmAdapter}: "at capacity"
- * finish errors become RATE_LIMIT so they enter this policy instead of failing
- * as PI_AI_ERROR.
- */
-const CODING_OAUTH_RETRY_POLICY = {
-	mode: "normal" as const,
-	maxRetries: 5,
-	retryableCodes: ["EMPTY_RESPONSE", "RATE_LIMIT", "SERVER", "TIMEOUT", "TRANSPORT", "AUTH"],
-	backoff: { initialDelayMs: 5_000, maxDelayMs: 80_000, jitterRatio: 0.1 },
-};
-
-function profile(
-	provider: string,
-	displayName: string,
-	piProvider: ResolvedPiAiProviderProfile["piProvider"],
-	retryPolicy?: RetryPolicyConfig | undefined,
-	headers?: Record<string, string> | undefined,
-): ResolvedPiAiProviderProfile {
-	return {
-		provider,
-		displayName,
-		streamIdleTimeoutMs: GROK_BUILD_STREAM_IDLE_TIMEOUT_MS,
-		retryPolicy: resolveRetryPolicy(
-			retryPolicy ?? CODING_OAUTH_RETRY_POLICY,
-			"dsh-coding-subscription-oauth retryPolicy",
-		),
-		configuredMaxTokens: new Map(),
-		...REQUEST_IMAGE_POLICY,
-		...(headers === undefined ? {} : { headers }),
-		piProvider,
-	};
-}
-
-/** Existing Grok-only constructor retained for public API compatibility. */
-export function createGrokBuildAdapter(
-	session: GrokBuildSession,
-	resolveAttachments: () => AttachmentStore | undefined,
-): PiAiAdapter {
-	return new PiAiAdapter({
-		profiles: () =>
-			new Map<string, ResolvedPiAiProviderProfile>([
-				[
-					GROK_BUILD_ROUTE,
-					profile(GROK_BUILD_ROUTE, "xAI Grok Build", session.provider(), undefined, grokBuildFingerprintHeaders()),
-				],
-			]),
-		resolveApiKey: async () =>
-			resolveOAuthToken("Grok Build", async () => {
-				const auth = await session.models.getAuth(XAI_PI_PROVIDER, { minOAuthValidityMs: MIN_OAUTH_VALIDITY_MS });
-				return auth?.auth.apiKey;
-			}),
-		auth: oauthAuthInjection(session, []),
-		resolveAttachments,
-	});
-}
-
-/** Opt-in Codex Fast wiring; ordinary `codex-oauth` is unchanged when this is omitted. */
-export interface CodingOAuthAdapterOptions {
-	retryPolicy?: RetryPolicyConfig;
-	codexFast?: { isEligible(modelId: string): boolean };
-}
-
-function isRetryPolicyConfig(value: object): value is RetryPolicyConfig {
-	return "mode" in value;
-}
-
-function splitCodingOAuthAdapterArgs(
-	fourth?: RetryPolicyConfig | CodingOAuthAdapterOptions,
-	fifth?: CodingOAuthAdapterOptions,
-): CodingOAuthAdapterOptions {
-	if (fifth !== undefined) {
-		return {
-			...(fourth !== undefined && isRetryPolicyConfig(fourth) ? { retryPolicy: fourth } : {}),
-			...fifth,
-		};
-	}
-	if (fourth === undefined) return {};
-	if (isRetryPolicyConfig(fourth)) return { retryPolicy: fourth };
-	return {
-		...(fourth.retryPolicy === undefined ? {} : { retryPolicy: fourth.retryPolicy }),
-		...(fourth.codexFast === undefined ? {} : { codexFast: fourth.codexFast }),
-	};
-}
-
-/** Create the four-route OAuth adapter while preserving each pi-ai native id. */
-export function createCodingOAuthAdapter(
-	grok: GrokBuildSession,
-	subscriptions: readonly OAuthProviderSession[],
-	resolveAttachments: () => AttachmentStore | undefined,
-	retryPolicy?: RetryPolicyConfig,
-	options?: CodingOAuthAdapterOptions,
-): LlmAdapter;
-export function createCodingOAuthAdapter(
-	grok: GrokBuildSession,
-	subscriptions: readonly OAuthProviderSession[],
-	resolveAttachments: () => AttachmentStore | undefined,
-	options?: CodingOAuthAdapterOptions,
-): LlmAdapter;
-export function createCodingOAuthAdapter(
-	grok: GrokBuildSession,
-	subscriptions: readonly OAuthProviderSession[],
-	resolveAttachments: () => AttachmentStore | undefined,
-	retryPolicyOrOptions?: RetryPolicyConfig | CodingOAuthAdapterOptions,
-	options?: CodingOAuthAdapterOptions,
-): LlmAdapter {
-	const { retryPolicy, codexFast } = splitCodingOAuthAdapterArgs(retryPolicyOrOptions, options);
-	const byNativeId = new Map(subscriptions.map((session) => [session.definition.nativeProviderId, session]));
-	const codexSession = byNativeId.get(CODEX_PI_PROVIDER);
-	const aliases = new Map<string, string>([
-		[GROK_BUILD_ROUTE, GROK_BUILD_ROUTE],
-		[CODEX_OAUTH_ROUTE, CODEX_PI_PROVIDER],
-		[KIMI_CODE_OAUTH_ROUTE, KIMI_PI_PROVIDER],
-		[CLAUDE_CODE_OAUTH_ROUTE, CLAUDE_PI_PROVIDER],
-	]);
-	if (codexFast !== undefined && codexSession !== undefined) {
-		aliases.set(CODEX_OAUTH_FAST_ROUTE, CODEX_OAUTH_FAST_ROUTE);
-	}
-	const policies = new Map<string, AliasLlmRoutePolicy>([
-		[
-			GROK_BUILD_ROUTE,
-			{
-				displayName: "xAI Grok Build (OAuth)",
-				isAuthenticated: async () => (await grok.store.read(XAI_PI_PROVIDER))?.type === "oauth",
-				onAuthFailure: () => grok.invalidateAccessToken(),
-			},
-		],
-	]);
-	for (const session of subscriptions) {
-		policies.set(session.definition.route, {
-			displayName: `${session.definition.displayName.replace(/\s*\([^)]*\)$/u, "")} (OAuth)`,
-			isAuthenticated: async () => (await session.status()).authenticated,
-			onAuthFailure: () => session.invalidateAccessToken(),
-		});
-	}
-	if (codexFast !== undefined && codexSession !== undefined) {
-		policies.set(CODEX_OAUTH_FAST_ROUTE, {
-			displayName: "OpenAI Codex Fast requested (OAuth)",
-			isAuthenticated: async () => (await codexSession.status()).authenticated,
-			includeModel: (modelId) => codexFast.isEligible(modelId),
-			onAuthFailure: () => codexSession.invalidateAccessToken(),
-		});
-	}
-
-	const inner = new PiAiAdapter({
-		profiles: () => {
-			const profiles = new Map<string, ResolvedPiAiProviderProfile>();
-			profiles.set(
-				GROK_BUILD_ROUTE,
-				profile(GROK_BUILD_ROUTE, "xAI Grok Build", grok.provider(), retryPolicy, grokBuildFingerprintHeaders()),
-			);
-			for (const session of subscriptions) {
-				profiles.set(
-					session.definition.nativeProviderId,
-					profile(session.definition.nativeProviderId, session.definition.displayName, session.provider(), retryPolicy),
-				);
-			}
-			if (codexFast !== undefined && codexSession !== undefined) {
-				const wrapped = withCodexFastRouting(codexSession.provider(), {
-					isEligible: (modelId) => codexFast.isEligible(modelId),
-					profileProviderId: CODEX_OAUTH_FAST_ROUTE,
-					nativeProviderId: CODEX_PI_PROVIDER,
-				});
-				// Models.streamSimple dispatches on model.provider. Advertise the Fast
-				// profile id on the catalog so the wrapper runs, then restore native
-				// identity inside withCodexFastRouting before the wire call.
-				const fastProvider = {
-					...wrapped,
-					getModels: () =>
-						wrapped
-							.getModels()
-							.map((model) =>
-								model.provider === CODEX_OAUTH_FAST_ROUTE ? model : { ...model, provider: CODEX_OAUTH_FAST_ROUTE },
-							),
-				};
-				profiles.set(
-					CODEX_OAUTH_FAST_ROUTE,
-					profile(
-						CODEX_OAUTH_FAST_ROUTE,
-						"OpenAI Codex Fast requested",
-						fastProvider as unknown as ResolvedPiAiProviderProfile["piProvider"],
-						retryPolicy,
-					),
-				);
-			}
-			return profiles;
-		},
-		resolveApiKey: async (provider) => {
-			if (provider === GROK_BUILD_ROUTE) {
-				return resolveOAuthToken("Grok Build", async () => {
-					const auth = await grok.models.getAuth(XAI_PI_PROVIDER, { minOAuthValidityMs: MIN_OAUTH_VALIDITY_MS });
-					return auth?.auth.apiKey;
-				});
-			}
-			const session =
-				provider === CODEX_OAUTH_FAST_ROUTE ? byNativeId.get(CODEX_PI_PROVIDER) : byNativeId.get(provider);
-			if (session === undefined) throw new LlmError(`Unknown OAuth provider "${provider}"`, "NO_ADAPTER");
-			return resolveOAuthToken(session.definition.displayName, () => session.resolveAccessToken());
-		},
-		auth: oauthAuthInjection(grok, subscriptions),
-		resolveAttachments,
-	});
-
-	// The Fast wrapper restores wire/replay model identity to openai-codex.
-	// Keep the opaque envelope untouched and map public Fast source identity to
-	// that native replay provider before PiAiAdapter validates it.
-	const replayProviders = new Map(aliases);
-	replayProviders.set(CODEX_OAUTH_FAST_ROUTE, CODEX_PI_PROVIDER);
-	return new AliasLlmAdapter(inner, aliases, policies, replayProviders);
-}
-
-/**
- * Resolve an OAuth access token for one route, translating a failed refresh
- * (revoked refresh token, dead grant) into MISSING_CREDENTIAL so the failure
- * is not retried and the user is told to sign in again rather than shown a
- * bare upstream 401.
- */
-async function resolveOAuthToken(
-	displayName: string,
-	getAccessToken: () => Promise<string | undefined>,
-): Promise<string> {
-	let accessToken: string | undefined;
-	try {
-		accessToken = await getAccessToken();
-	} catch (error) {
-		throw new LlmError(
-			`${displayName} could not refresh its sign-in (${safeMessage(error)}).` +
-				" Open Settings → Coding OAuth and sign in again.",
-			"MISSING_CREDENTIAL",
-		);
-	}
-	if (accessToken === undefined || accessToken.length === 0) return missingCredential(displayName);
-	return accessToken;
-}