n9router 0.4.49 → 0.4.50

package/app/open-sse/executors/grok-cli.js

@@ -7,6 +7,12 @@ import {
 } from "../services/oauthCredentialManager.js";
 import { normalizeResponsesInput } from "../translator/formats/responsesApi.js";
 import { getModelUpstreamId } from "../config/providerModels.js";
+import {
+  GROK_CLI_CLIENT_IDENTIFIER,
+  GROK_CLI_VERSION,
+  supportsGrokCliReasoningEffort,
+} from "../config/grokCli.js";
+import { MEMORY_CONFIG } from "../config/runtimeConfig.js";
 import { resolveSessionId } from "../utils/sessionManager.js";
 import { getConsistentMachineId } from "../shared/machineId.js";
 
@@ -45,10 +51,18 @@ const RESPONSES_API_ALLOWLIST = new Set([
   "prompt_cache_key",
 ]);
 
-const EFFORT_LEVELS = ["low", "medium", "high"];
+const EFFORT_LEVELS = ["low", "medium", "high", "xhigh"];
+const GROK_CLI_TURN_STORE_MAX = 5000;
+const GROK_CLI_NATIVE_ITEM_ID = /^(?:rs|msg|fc)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const GROK_CLI_FREEFORM_TOOL_PARAMETERS = {
+  type: "object",
+  properties: { input: { type: "string" } },
+  required: ["input"],
+};
 
 // Per-session last turn index so multi-turn headers never go backwards within this process
 const sessionTurnStore = new Map();
+let requestTurnStore = new WeakMap();
 
 /**
  * Count user turns in a Responses `input` array.
@@ -72,18 +86,138 @@ export function countGrokCliUserTurns(input) {
  * Prefers user-message count from the payload (full history clients), but never
  * decreases vs the last index observed for the same sessionId in this process.
  */
-export function resolveGrokCliTurnIdx(sessionId, input) {
+export function resolveGrokCliTurnIdx(sessionId, input, requestKey = null) {
   const fromInput = countGrokCliUserTurns(input);
   if (!sessionId) return fromInput;
-  const prev = sessionTurnStore.get(sessionId) || 0;
-  const turn = Math.max(fromInput, prev);
-  sessionTurnStore.set(sessionId, turn);
+
+  if (requestKey && requestTurnStore.has(requestKey)) {
+    return requestTurnStore.get(requestKey);
+  }
+
+  const now = Date.now();
+  const existing = sessionTurnStore.get(sessionId);
+  const prev = existing && now - existing.lastUsed <= MEMORY_CONFIG.sessionTtlMs
+    ? existing.turn
+    : 0;
+  if (existing) sessionTurnStore.delete(sessionId);
+
+  // A new delta-style request advances the turn; retries reuse requestKey.
+  const turn = prev > 0 ? Math.max(fromInput, prev + (requestKey ? 1 : 0)) : fromInput;
+  while (sessionTurnStore.size >= GROK_CLI_TURN_STORE_MAX) {
+    sessionTurnStore.delete(sessionTurnStore.keys().next().value);
+  }
+  sessionTurnStore.set(sessionId, { turn, lastUsed: now });
+  if (requestKey) requestTurnStore.set(requestKey, turn);
   return turn;
 }
 
 /** Test helper — clear in-memory turn counters */
 export function _resetGrokCliTurnStore() {
   sessionTurnStore.clear();
+  requestTurnStore = new WeakMap();
+}
+
+export function _getGrokCliTurnStoreSize() {
+  return sessionTurnStore.size;
+}
+
+export function normalizeGrokCliEffort(value) {
+  const effort = typeof value === "string" ? value.trim().toLowerCase() : "";
+  if (effort === "max") return "xhigh";
+  if (EFFORT_LEVELS.includes(effort)) return effort;
+  return "high";
+}
+
+export { supportsGrokCliReasoningEffort } from "../config/grokCli.js";
+
+export function resolveGrokCliSessionId(credentials, body) {
+  // ponytail: clients without stable thread metadata share one connection session;
+  // split further when their wire format exposes a durable conversation id.
+  const explicitSessionBody = {
+    prompt_cache_key: body?.prompt_cache_key,
+    session_id: body?.session_id,
+    conversation_id: body?.conversation_id,
+    metadata: body?.metadata,
+  };
+  return resolveSessionId({
+    headers: credentials?.rawHeaders,
+    body: explicitSessionBody,
+    connectionId: credentials?.connectionId || credentials?.id,
+    workspaceId: credentials?.providerSpecificData?.workspaceId,
+    scope: "grok-cli",
+  });
+}
+
+function stringifyGrokCliToolOutput(output) {
+  if (typeof output === "string") return output;
+  if (output === undefined) return "";
+  return JSON.stringify(output);
+}
+
+function isNativeGrokCliItemId(id) {
+  return typeof id === "string" && GROK_CLI_NATIVE_ITEM_ID.test(id);
+}
+
+function normalizeGrokCliInputItem(item) {
+  if (!item || typeof item !== "object" || Array.isArray(item)) return item;
+  const { internal_chat_message_metadata_passthrough: _metadata, ...clean } = item;
+
+  if (item.type === "reasoning") {
+    if (!isNativeGrokCliItemId(item.id) || typeof item.encrypted_content !== "string") return null;
+    return clean;
+  }
+
+  if (item.type === "custom_tool_call") {
+    const callId = item.call_id || item.id;
+    const name = typeof item.name === "string" ? item.name.trim() : "";
+    if (!callId || !name) return null;
+    return {
+      type: "function_call",
+      call_id: callId,
+      name,
+      arguments: JSON.stringify({ input: stringifyGrokCliToolOutput(item.input ?? item.arguments) }),
+    };
+  }
+
+  if (item.type === "custom_tool_call_output" || item.type === "function_call_output") {
+    const callId = item.call_id || item.id;
+    if (!callId) return null;
+    return {
+      type: "function_call_output",
+      call_id: callId,
+      output: stringifyGrokCliToolOutput(item.output),
+    };
+  }
+
+  if (item.type === "function_call") {
+    const callId = item.call_id || item.id;
+    const name = typeof item.name === "string" ? item.name.trim() : "";
+    if (!callId || !name) return null;
+    return {
+      type: "function_call",
+      ...(isNativeGrokCliItemId(item.id) ? { id: item.id } : {}),
+      call_id: callId,
+      name,
+      arguments: typeof item.arguments === "string" ? item.arguments : JSON.stringify(item.arguments ?? {}),
+      ...(typeof item.status === "string" ? { status: item.status } : {}),
+    };
+  }
+
+  return clean;
+}
+
+export function normalizeGrokCliInput(body) {
+  if (!Array.isArray(body?.input)) return body;
+  const normalized = body.input.map(normalizeGrokCliInputItem).filter(Boolean);
+  const callIds = new Set(
+    normalized
+      .filter((item) => item?.type === "function_call" && item.call_id)
+      .map((item) => item.call_id)
+  );
+  body.input = normalized.filter(
+    (item) => item?.type !== "function_call_output" || callIds.has(item.call_id)
+  );
+  return body;
 }
 
 function stripStoredItemReferences(body) {
@@ -92,7 +226,11 @@ function stripStoredItemReferences(body) {
     if (typeof item === "string" && SERVER_ID_PATTERN.test(item)) return false;
     if (item && typeof item === "object" && !Array.isArray(item)) {
       if (item.type === "item_reference") return false;
-      if (typeof item.id === "string" && SERVER_ID_PATTERN.test(item.id)) delete item.id;
+      if (
+        typeof item.id === "string" &&
+        SERVER_ID_PATTERN.test(item.id) &&
+        !isNativeGrokCliItemId(item.id)
+      ) delete item.id;
     }
     return true;
   });
@@ -103,15 +241,23 @@ function stripStoredItemReferences(body) {
  * Keep hosted tools (web_search / x_search) passthrough.
  */
 function normalizeGrokCliTools(body) {
-  if (!Array.isArray(body.tools)) return;
+  if (!Array.isArray(body.tools) || body.tools.length === 0) {
+    delete body.tools;
+    delete body.tool_choice;
+    return;
+  }
   const validNames = new Set();
+  const hostedTypes = new Set();
   body.tools = body.tools.filter((tool) => {
     if (!tool || typeof tool !== "object" || Array.isArray(tool)) return false;
     const type = typeof tool.type === "string" ? tool.type : "";
 
     if (type !== "function") {
       // Hosted tools: { type: "web_search" } / { type: "x_search" }
-      if (HOSTED_TOOL_TYPES.has(type)) return true;
+      if (HOSTED_TOOL_TYPES.has(type)) {
+        hostedTypes.add(type);
+        return true;
+      }
       // Nested function shape without type
       if (!type && tool.function) {
         // fall through to function flatten below
@@ -143,8 +289,9 @@ function normalizeGrokCliTools(body) {
         : typeof fn?.description === "string"
           ? fn.description
           : "";
-    const parameters =
-      tool.parameters && typeof tool.parameters === "object" && !Array.isArray(tool.parameters)
+    const parameters = type === "custom"
+      ? GROK_CLI_FREEFORM_TOOL_PARAMETERS
+      : tool.parameters && typeof tool.parameters === "object" && !Array.isArray(tool.parameters)
         ? tool.parameters
         : fn?.parameters && typeof fn.parameters === "object" && !Array.isArray(fn.parameters)
           ? fn.parameters
@@ -155,14 +302,25 @@ function normalizeGrokCliTools(body) {
     tool.name = name.slice(0, 128);
     if (description) tool.description = description;
     tool.parameters = parameters;
-    validNames.add(name);
+    validNames.add(tool.name);
     return true;
   });
 
+  if (body.tools.length === 0) {
+    delete body.tools;
+    delete body.tool_choice;
+    return;
+  }
+
   if (body.tool_choice && typeof body.tool_choice === "object" && !Array.isArray(body.tool_choice)) {
-    if (body.tool_choice.type === "function") {
-      const n = typeof body.tool_choice.name === "string" ? body.tool_choice.name.trim() : "";
-      if (!n || !validNames.has(n)) delete body.tool_choice;
+    const choiceType = typeof body.tool_choice.type === "string" ? body.tool_choice.type : "";
+    if (choiceType === "function" || choiceType === "custom") {
+      const rawName = body.tool_choice.name ?? body.tool_choice.function?.name;
+      const name = typeof rawName === "string" ? rawName.trim().slice(0, 128) : "";
+      if (!name || !validNames.has(name)) delete body.tool_choice;
+      else body.tool_choice = { type: "function", name };
+    } else if (!hostedTypes.has(choiceType)) {
+      delete body.tool_choice;
     }
   }
 }
@@ -192,9 +350,9 @@ export class GrokCliExecutor extends BaseExecutor {
     return this.config.baseUrl;
   }
 
-  async refreshCredentials(credentials, log) {
+  async refreshCredentials(credentials, log, proxyOptions = null) {
     if (!credentials?.refreshToken) return null;
-    return refreshProviderCredentials("grok-cli", credentials, log);
+    return refreshProviderCredentials("grok-cli", credentials, log, proxyOptions);
   }
 
   needsRefresh(credentials) {
@@ -210,13 +368,10 @@ export class GrokCliExecutor extends BaseExecutor {
       if (v != null && headers[k] === undefined) headers[k] = v;
     }
 
-    // Ensure token-auth marker is present even if headers map was overridden
-    headers["x-xai-token-auth"] = this.config.tokenAuth || "xai-grok-cli";
     headers["x-grok-client-identifier"] =
-      this.config.clientIdentifier || headers["x-grok-client-identifier"] || "grok-pager";
+      this.config.clientIdentifier || headers["x-grok-client-identifier"] || GROK_CLI_CLIENT_IDENTIFIER;
     headers["x-grok-client-version"] =
-      this.config.clientVersion || headers["x-grok-client-version"] || "0.2.93";
-    headers["x-authenticateresponse"] = "authenticate-response";
+      this.config.clientVersion || headers["x-grok-client-version"] || GROK_CLI_VERSION;
 
     const sessionId = this._currentSessionId || credentials?.connectionId || crypto.randomUUID();
     const reqId = this._currentReqId || crypto.randomUUID();
@@ -231,10 +386,6 @@ export class GrokCliExecutor extends BaseExecutor {
     // Surface model override (CLI always sets this)
     if (this._currentModel) headers["x-grok-model-override"] = this._currentModel;
 
-    if (this.config.compactionAt) {
-      headers["x-compaction-at"] = String(this.config.compactionAt);
-    }
-
     // Identity: mapTokens stores email top-level AND in providerSpecificData;
     // fall back either way so OAuth connections always fingerprint like the CLI.
     const psd = credentials?.providerSpecificData || {};
@@ -267,13 +418,8 @@ export class GrokCliExecutor extends BaseExecutor {
 
   transformRequest(model, body, stream, credentials) {
     // Session / request ids for headers — stable per client conversation when possible
-    this._currentSessionId = resolveSessionId({
-      headers: credentials?.rawHeaders,
-      body,
-      connectionId: credentials?.connectionId || credentials?.id,
-      workspaceId: credentials?.providerSpecificData?.workspaceId,
-      scope: "grok-cli",
-    });
+    const requestKey = body;
+    this._currentSessionId = resolveGrokCliSessionId(credentials, body);
     this._currentReqId = crypto.randomUUID();
     this._agentId =
       credentials?.providerSpecificData?.deviceId ||
@@ -302,11 +448,12 @@ export class GrokCliExecutor extends BaseExecutor {
 
     // Keep role:"system" as-is — official grok-pager HAR sends system, not developer
     // (Codex converts system→developer; Grok CLI does not).
+    normalizeGrokCliInput(body);
     stripStoredItemReferences(body);
     normalizeGrokCliTools(body);
 
     // Turn index after input is finalized (user-message count, monotonic per session)
-    this._currentTurnIdx = resolveGrokCliTurnIdx(this._currentSessionId, body.input);
+    this._currentTurnIdx = resolveGrokCliTurnIdx(this._currentSessionId, body.input, requestKey);
 
     body.stream = true;
     body.store = false;
@@ -325,20 +472,28 @@ export class GrokCliExecutor extends BaseExecutor {
     body.model = resolvedModel;
     this._currentModel = resolvedModel;
 
-    // Reasoning effort priority: explicit > reasoning_effort > model suffix > default high
+    // Reasoning effort priority: explicit > reasoning_effort > model suffix > default high.
+    // grok-build and Composer reject reasoningEffort but still accept summary/encrypted continuity.
+    const supportsReasoningEffort = supportsGrokCliReasoningEffort(resolvedModel);
     if (!body.reasoning || typeof body.reasoning !== "object") {
-      const effort = body.reasoning_effort || modelEffort || "high";
-      body.reasoning = { effort, summary: "concise" };
+      body.reasoning = { summary: "concise" };
+      if (supportsReasoningEffort) {
+        body.reasoning.effort = normalizeGrokCliEffort(body.reasoning_effort || modelEffort);
+      }
     } else {
-      if (!body.reasoning.effort) {
-        body.reasoning.effort = body.reasoning_effort || modelEffort || "high";
+      if (supportsReasoningEffort) {
+        body.reasoning.effort = normalizeGrokCliEffort(
+          body.reasoning.effort || body.reasoning_effort || modelEffort,
+        );
+      } else {
+        delete body.reasoning.effort;
       }
       if (!body.reasoning.summary) body.reasoning.summary = "concise";
     }
     delete body.reasoning_effort;
 
     // Encrypted reasoning for multi-turn continuity (CLI always requests this)
-    if (body.reasoning?.effort && body.reasoning.effort !== "none") {
+    if (body.reasoning && body.reasoning.effort !== "none") {
       const include = Array.isArray(body.include) ? body.include : [];
       if (!include.includes("reasoning.encrypted_content")) {
         include.push("reasoning.encrypted_content");

package/app/open-sse/handlers/chatCore.js

@@ -9,10 +9,11 @@ import { createRequestLogger } from "../utils/requestLogger.js";
 import { getModelTargetFormat, getModelStrip, getModelUpstreamId, getModelType, PROVIDER_ID_TO_ALIAS } from "../config/providerModels.js";
 import { PROVIDERS } from "../config/providers.js";
 import { createErrorResult, parseUpstreamError, formatProviderError } from "../utils/error.js";
-import { HTTP_STATUS } from "../config/runtimeConfig.js";
+import { HTTP_STATUS, TOKEN_SAVER_HEADER } from "../config/runtimeConfig.js";
 import { handleBypassRequest } from "../utils/bypassHandler.js";
 import { trackPendingRequest, appendRequestLog, saveRequestDetail } from "@/lib/usageDb.js";
 import { getExecutor } from "../executors/index.js";
+import { supportsGrokCliReasoningEffort } from "../config/grokCli.js";
 import { buildRequestDetail, extractRequestConfig } from "./chatCore/requestDetail.js";
 import { handleForcedSSEToJson } from "./chatCore/sseToJsonHandler.js";
 import { handleNonStreamingResponse } from "./chatCore/nonStreamingHandler.js";
@@ -21,8 +22,8 @@ import { detectClientTool, isNativePassthrough } from "../utils/clientDetector.j
 import { dedupeTools } from "../utils/toolDeduper.js";
 import { injectCaveman } from "../rtk/caveman.js";
 import { injectPonytail } from "../rtk/ponytail.js";
-import { compressMessages } from "../rtk/index.js";
-import { compressWithHeadroom, formatHeadroomSizeLog, isHeadroomPhantomSavings } from "../rtk/headroom.js";
+import { compressMessages, formatRtkLog } from "../rtk/index.js";
+import { compressWithHeadroom, formatHeadroomLog, formatHeadroomSizeLog, isHeadroomPhantomSavings } from "../rtk/headroom.js";
 import { compressWithPxpipe } from "../rtk/pxpipe.js";
 import { getCapabilitiesForModel } from "../providers/capabilities.js";
 import { stripUnsupportedModalities } from "../translator/concerns/modality.js";
@@ -168,7 +169,8 @@ export async function handleChatCore({ body, modelInfo, credentials, log, onCred
     const msgN = translatedBody.messages?.length || translatedBody.input?.length || translatedBody.contents?.length || body.messages?.length || body.input?.length || 0;
     const toolN = translatedBody.tools?.length || body.tools?.length || 0;
     const fmtStr = passthrough ? `FMT: ${sourceFormat} (passthrough)` : `FMT: ${sourceFormat}→${targetFormat}`;
-    const think = log.fmtThink?.(extractThinking(translatedBody));
+    const showThinking = provider !== "grok-cli" || supportsGrokCliReasoningEffort(model);
+    const think = showThinking ? log.fmtThink?.(extractThinking(translatedBody)) : null;
     const acc = credentials?.connectionName || credentials?.connectionId?.slice(0, 8) || "-";
     const parts = [
       `POST ${clientModel} → ${provider}/${model}`,
@@ -188,40 +190,37 @@ export async function handleChatCore({ body, modelInfo, credentials, log, onCred
     delete translatedBody.tools;
   }
 
-  // Token-saver summary parts, printed as one "⚙" line at the end (only active ones)
-  const xf = [];
+  // Per-request opt-out: client can bypass all token savers via header
+  const tokenSaverEnabled = clientRawRequest?.headers?.[TOKEN_SAVER_HEADER]?.toLowerCase() !== "off";
 
   // RTK: compress tool_result content
-  const rtkStats = compressMessages(translatedBody, rtkEnabled);
-  if (rtkStats?.hits?.length) {
-    const saved = rtkStats.bytesBefore - rtkStats.bytesAfter;
-    const pct = rtkStats.bytesBefore > 0 ? ((saved / rtkStats.bytesBefore) * 100).toFixed(0) : "0";
-    xf.push(`RTK −${saved}B(${pct}%)`);
-  }
+  const rtkStats = compressMessages(translatedBody, tokenSaverEnabled && rtkEnabled);
+  const rtkLine = formatRtkLog(rtkStats);
+  if (rtkLine) console.log(rtkLine);
 
   // Headroom: optional external proxy compression; fail open if proxy is absent.
   const headroomDiagnostics = {};
-  const headroomStats = await compressWithHeadroom(translatedBody, { enabled: headroomEnabled, url: headroomUrl, model: upstreamModel, format: finalFormat, compressUserMessages: headroomCompressUserMessages, diagnostics: headroomDiagnostics });
-  if (headroomStats) {
-    const before = headroomStats.tokens_before || 0;
-    const delta = headroomStats.tokens_saved || 0;
-    const pct = before > 0 ? ((delta / before) * 100).toFixed(1) : "0";
-    xf.push(`HEADROOM −${delta}tok(${pct}%)`);
+  const headroomStats = await compressWithHeadroom(translatedBody, { enabled: tokenSaverEnabled && headroomEnabled, url: headroomUrl, model: upstreamModel, format: finalFormat, compressUserMessages: headroomCompressUserMessages, diagnostics: headroomDiagnostics });
+  const headroomLine = formatHeadroomLog(headroomStats);
+  const headroomSizeLine = formatHeadroomSizeLog(headroomDiagnostics);
+  if (headroomLine) {
+    log?.info?.("HEADROOM", `${headroomLine}${headroomSizeLine ? ` | ${headroomSizeLine}` : ""}`);
     if (isHeadroomPhantomSavings(headroomStats, headroomDiagnostics)) {
       log?.warn?.("HEADROOM", `reported token delta, but outbound JSON shrank <5%; provider may bill near-original payload | ${formatHeadroomSizeLog(headroomDiagnostics)}`);
     }
-  } else if (headroomEnabled) {
-    log?.warn?.("HEADROOM", `skipped: ${headroomDiagnostics.reason || "compression unavailable"}${headroomDiagnostics.endpoint ? ` (${headroomDiagnostics.endpoint})` : ""}`);
-  }
+  } else if (tokenSaverEnabled && headroomEnabled) log?.warn?.("HEADROOM", `skipped: ${headroomDiagnostics.reason || "compression unavailable"}${headroomDiagnostics.endpoint ? ` (${headroomDiagnostics.endpoint})` : ""}`);
+
+  // Token-saver flags accumulator for the single "⚙" log line below.
+  const xf = [];
 
   // Caveman: inject terse-style system prompt
-  if (cavemanEnabled && cavemanLevel) {
+  if (tokenSaverEnabled && cavemanEnabled && cavemanLevel) {
     injectCaveman(translatedBody, finalFormat, cavemanLevel);
     xf.push(`CAVEMAN:${cavemanLevel}`);
   }
 
   // Ponytail: inject lazy-senior-dev system prompt
-  if (ponytailEnabled && ponytailLevel) {
+  if (tokenSaverEnabled && ponytailEnabled && ponytailLevel) {
     injectPonytail(translatedBody, finalFormat, ponytailLevel);
     xf.push(`PONYTAIL:${ponytailLevel}`);
   }

package/app/open-sse/handlers/videoCore.js

@@ -0,0 +1,166 @@
+import { createErrorResult } from "../utils/error.js";
+import { HTTP_STATUS } from "../config/runtimeConfig.js";
+import { refreshTokenByProvider } from "../services/tokenRefresh.js";
+import { PROVIDER_MEDIA } from "../providers/index.js";
+
+// Upstream fetch deadline for video job submission/polling (the job itself is
+// async upstream — this only bounds the HTTP round-trip, not video rendering).
+const VIDEO_FETCH_TIMEOUT_MS = Number(process.env.VIDEO_FETCH_TIMEOUT_MS || 120000);
+
+// POST /videos/* creates a billable upstream job. A network error after the
+// request left the socket may still have created the job, so creation is NEVER
+// auto-retried (the only re-send is the auth retry after a 401/403 refresh,
+// which upstream rejects before job creation).
+export const VIDEO_ACTIONS = new Set(["generations", "edits", "extensions"]);
+
+export function getVideoConfig(provider) {
+  return PROVIDER_MEDIA[provider]?.videoConfig || null;
+}
+
+/** Strip bearer tokens / obvious secrets from text destined for clients or logs. */
+export function sanitizeSecrets(text, credentials = null) {
+  if (!text) return text;
+  let out = String(text).replace(/Bearer\s+[A-Za-z0-9._~+/=-]{8,}/gi, "Bearer [redacted]");
+  for (const key of ["accessToken", "refreshToken", "apiKey"]) {
+    const secret = credentials?.[key];
+    if (typeof secret === "string" && secret.length >= 8) {
+      out = out.split(secret).join("[redacted]");
+    }
+  }
+  return out;
+}
+
+function buildUpstreamUrl(config, action, requestId) {
+  const base = config.baseUrl.replace(/\/$/, "");
+  return requestId ? `${base}/${encodeURIComponent(requestId)}` : `${base}/${action}`;
+}
+
+function buildHeaders({ token, contentType, idempotencyKey }) {
+  const headers = { Accept: "application/json" };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  if (contentType) headers["Content-Type"] = contentType;
+  if (idempotencyKey) headers["Idempotency-Key"] = idempotencyKey;
+  return headers;
+}
+
+function combineSignals(signal, timeoutMs) {
+  const timeoutSignal = typeof AbortSignal?.timeout === "function" ? AbortSignal.timeout(timeoutMs) : null;
+  if (signal && timeoutSignal && typeof AbortSignal.any === "function") {
+    return AbortSignal.any([signal, timeoutSignal]);
+  }
+  return signal || timeoutSignal || undefined;
+}
+
+/**
+ * Transparent proxy for async video jobs (xAI Grok Imagine shape).
+ *
+ * - Forwards the raw body byte-for-byte (JSON or multipart) — no reshaping.
+ * - Passes upstream JSON (request_id, status, video.url, error) back verbatim.
+ * - 401/403 with a refresh token: refresh ONCE, retry ONCE. No other retry.
+ * - Upstream error text is sanitized before it reaches the client.
+ *
+ * @param {object} options
+ * @param {string} options.provider - Provider id (must have registry videoConfig)
+ * @param {"generations"|"edits"|"extensions"|null} options.action - Creation action (POST)
+ * @param {string|null} [options.requestId] - Poll target (GET /videos/{id})
+ * @param {Buffer|string|null} [options.rawBody] - Exact body to forward
+ * @param {string|null} [options.contentType] - Original Content-Type header
+ * @param {string|null} [options.idempotencyKey] - Forwarded Idempotency-Key
+ * @param {object} options.credentials - { accessToken?, apiKey?, refreshToken?, authType? }
+ * @param {AbortSignal} [options.signal] - Client cancellation signal
+ * @param {number} [options.timeoutMs]
+ * @param {object} [options.log]
+ * @param {function} [options.onCredentialsRefreshed]
+ * @returns {Promise<{ success: boolean, response: Response, status?: number, error?: string }>}
+ */
+export async function handleVideoProxyCore({
+  provider,
+  action = null,
+  requestId = null,
+  rawBody = null,
+  contentType = null,
+  idempotencyKey = null,
+  credentials,
+  signal,
+  timeoutMs = VIDEO_FETCH_TIMEOUT_MS,
+  log,
+  onCredentialsRefreshed,
+}) {
+  const config = getVideoConfig(provider);
+  if (!config) {
+    return createErrorResult(HTTP_STATUS.BAD_REQUEST, `Provider '${provider}' does not support video generation`);
+  }
+  if (!requestId && !VIDEO_ACTIONS.has(action)) {
+    return createErrorResult(HTTP_STATUS.BAD_REQUEST, `Unknown video action: ${action}`);
+  }
+
+  const method = requestId ? "GET" : "POST";
+  const url = buildUpstreamUrl(config, action, requestId);
+  const fetchSignal = combineSignals(signal, timeoutMs);
+
+  const doFetch = (token) =>
+    fetch(url, {
+      method,
+      headers: buildHeaders({ token, contentType: method === "POST" ? contentType : null, idempotencyKey: method === "POST" ? idempotencyKey : null }),
+      body: method === "POST" ? rawBody : undefined,
+      signal: fetchSignal,
+    });
+
+  let upstream;
+  try {
+    upstream = await doFetch(credentials?.accessToken || credentials?.apiKey);
+  } catch (error) {
+    if (error?.name === "AbortError" || error?.name === "TimeoutError") {
+      return createErrorResult(HTTP_STATUS.REQUEST_TIMEOUT, `[${provider}] video ${method} aborted: ${error.message}`);
+    }
+    // Never re-send a creation POST on network error — the job may already exist upstream.
+    return createErrorResult(HTTP_STATUS.BAD_GATEWAY, sanitizeSecrets(`[${provider}] video upstream fetch failed: ${error.message}`, credentials));
+  }
+
+  // 401/403 → refresh once → retry once (OAuth accounts only; API keys can't refresh)
+  if (
+    (upstream.status === HTTP_STATUS.UNAUTHORIZED || upstream.status === HTTP_STATUS.FORBIDDEN) &&
+    credentials?.refreshToken
+  ) {
+    let refreshed = null;
+    try {
+      refreshed = await refreshTokenByProvider(provider, credentials, log);
+    } catch (error) {
+      log?.warn?.("TOKEN", `${provider} | video refresh error: ${sanitizeSecrets(error.message, credentials)}`);
+    }
+    if (refreshed?.accessToken) {
+      log?.info?.("TOKEN", `${provider.toUpperCase()} | refreshed for video ${method}`);
+      Object.assign(credentials, refreshed);
+      if (onCredentialsRefreshed) await onCredentialsRefreshed(refreshed);
+      try {
+        await upstream.body?.cancel?.();
+      } catch { /* noop */ }
+      try {
+        upstream = await doFetch(credentials.accessToken || credentials.apiKey);
+      } catch (error) {
+        return createErrorResult(HTTP_STATUS.BAD_GATEWAY, sanitizeSecrets(`[${provider}] video retry after refresh failed: ${error.message}`, credentials));
+      }
+    } else {
+      log?.warn?.("TOKEN", `${provider.toUpperCase()} | video refresh failed — account needs re-auth`);
+    }
+  }
+
+  const bodyText = await upstream.text().catch(() => "");
+
+  if (!upstream.ok) {
+    const message = sanitizeSecrets(bodyText || `HTTP ${upstream.status}`, credentials);
+    return createErrorResult(upstream.status, `[${provider}] ${message.slice(0, 2000)}`);
+  }
+
+  // Success: pass the upstream JSON through untouched (request_id / status / video.url).
+  return {
+    success: true,
+    response: new Response(bodyText, {
+      status: upstream.status,
+      headers: {
+        "Content-Type": upstream.headers.get("content-type") || "application/json",
+        "Access-Control-Allow-Origin": "*",
+      },
+    }),
+  };
+}

package/app/open-sse/providers/capabilities.js

@@ -98,6 +98,8 @@ export const MODEL_CAPABILITIES = {
   "coder-model":       { reasoning: true, thinkingFormat: "qwen", contextWindow: 1000000 },
 };
 
+const KIRO_GPT_5_6_CAPABILITIES = { vision: true, reasoning: true, search: true, thinkingFormat: "openai", contextWindow: 272000, maxOutput: 128000 };
+
 /**
  * Provider-specific capability overrides. Keyed by provider alias/id.
  */
@@ -111,6 +113,20 @@ export const PROVIDER_CAPABILITIES = {
     "deepseek-ai/deepseek-v4-pro": { reasoning: true, thinkingFormat: "openai", contextWindow: 1000000, maxOutput: 65536 },
     "deepseek-ai/deepseek-v4-flash": { reasoning: true, thinkingFormat: "openai", contextWindow: 1000000, maxOutput: 65536 },
   },
+  "kiro": {
+    "gpt-5.6-sol": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-terra": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-luna": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-sol-thinking": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-terra-thinking": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-luna-thinking": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-sol-agentic": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-terra-agentic": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-luna-agentic": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-sol-thinking-agentic": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-terra-thinking-agentic": KIRO_GPT_5_6_CAPABILITIES,
+    "gpt-5.6-luna-thinking-agentic": KIRO_GPT_5_6_CAPABILITIES,
+  },
   // CodeBuddy.cn — authoritative per-model metadata from the gateway's model
   // config (contextWindow=maxInputTokens, maxOutput=maxOutputTokens, vision=
   // supportsImages). Every model reasons via OpenAI-style reasoning_effort
@@ -271,13 +287,17 @@ export const PATTERN_CAPABILITIES = [
 export function getCapabilitiesForModel(provider, model) {
   if (!model) return { ...DEFAULT_CAPABILITIES };
 
+  // Canonical exact lookup strips vendor prefix: "anthropic/claude-opus-4.7" -> "claude-opus-4.7".
+  const baseModel = model.includes("/") ? model.split("/").pop() : model;
+
   // 1. Provider-specific override
-  if (provider && PROVIDER_CAPABILITIES[provider]?.[model]) {
-    return { ...DEFAULT_CAPABILITIES, ...PROVIDER_CAPABILITIES[provider][model] };
+  if (provider) {
+    const providerCaps = PROVIDER_CAPABILITIES[provider];
+    if (providerCaps?.[model]) return { ...DEFAULT_CAPABILITIES, ...providerCaps[model] };
+    if (providerCaps?.[baseModel]) return { ...DEFAULT_CAPABILITIES, ...providerCaps[baseModel] };
   }
 
-  // 2. Canonical exact (strip vendor prefix: "anthropic/claude-opus-4.7" -> "claude-opus-4.7")
-  const baseModel = model.includes("/") ? model.split("/").pop() : model;
+  // 2. Canonical exact
   if (MODEL_CAPABILITIES[baseModel]) return { ...DEFAULT_CAPABILITIES, ...MODEL_CAPABILITIES[baseModel] };
   if (MODEL_CAPABILITIES[model]) return { ...DEFAULT_CAPABILITIES, ...MODEL_CAPABILITIES[model] };