docs: add kiro oauth-model-alias examples for Claude model name compatibility by hpylsy · Pull Request #28 · Ve-ria/CLIProxyAPIPlus

hpylsy · 2026-05-11T03:04:23Z

Problem

Kiro OAuth models are discovered at runtime with a kiro- prefix (e.g. kiro-claude-opus-4-7). Without explicit oauth-model-alias configuration, these models are only accessible via their prefixed names. Clients expecting standard Anthropic model names (e.g. claude-opus-4-7) cannot route requests to Kiro.

For example, claude-opus-4-6 works because it has an alias mapping, but claude-opus-4-7 does not — even though kiro-claude-opus-4-7 is available in the model list.

Solution

Add a kiro section to the oauth-model-alias examples in config.example.yaml, demonstrating how to map Kiro models to standard Claude names using fork: true.

Example

oauth-model-alias:
  kiro:
    - name: "kiro-claude-opus-4-7"
      alias: "claude-opus-4-7"
      fork: true
    - name: "kiro-claude-opus-4-7-agentic"
      alias: "claude-opus-4-7-agentic"
      fork: true

This makes both kiro-claude-opus-4-7 and claude-opus-4-7 available in /v1/models, so clients can use either name.

Verified

Tested on a live server — after adding the alias config and restarting, /v1/models correctly shows both the prefixed and unprefixed model names.

- Simplify project ID selection to always use the backend project ID returned by Gemini onboarding - Update Gemini CLI version from 0.31.0 to 0.34.0 - Add 'terminal' to User-Agent string for better client identification Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ment Both branches assign finalProjectID = responseProjectID, so move the assignment outside the conditional and keep only the logging inside.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

After a Codex CLI compact, the client sends a full conversation transcript (with compaction items or assistant messages) as input. Previously, normalizeResponseSubsequentRequest() unconditionally merged this with stale lastRequest/lastResponseOutput, breaking function_call/function_call_output pairings and causing 400 errors ("No tool output found for function call"). Add inputContainsFullTranscript() heuristic that detects compaction items (type=compaction/compaction_summary) or assistant messages in the input array, and bypasses the merge when a full transcript is present. Fixes router-for-me#2207

Custom headers configured under openai-compatibility (and any other provider passing through applyCustomHeaders) were silently dropped for the Host key, because Go's net/http reads the wire Host from req.Host, not req.Header["Host"]. As a result, virtual-host routed upstreams (e.g. LiteLLM behind an ingress) saw the base-url's host instead of the user-configured override and returned 404. Detect the Host key with http.CanonicalHeaderKey and assign it to req.Host so it is actually written on the wire. Other headers continue to use Header.Set as before. Fixes router-for-me#2833

…r tests

Addressing the P1 note from the Codex reviewer: applyCustomHeaders is also called with a synthetic &http.Request{Header: ...} from the websockets executors (aistudio_executor.go, codex_websockets_executor.go), which forward only the header map. The previous continue meant a custom Host was dropped from that map, regressing virtual-host overrides on those flows. Mirror the value to both r.Host (for real net/http) and r.Header (for header-map-only consumers).

…ni, Claude, Codex, OpenAI, and Vertex

feat(api): integrate auth index into key retrieval endpoints for Gemi…

…dex-GPT and Codex-Gemini flows - Introduced `LastImageHashByItemID` in Codex-GPT and `LastImageHashByID` in Codex-Gemini for deduplication of generated images. - Added support for handling `partial_image` and `image_generation_call` types, with inline data embedding for Gemini and URL payload conversion for GPT. - Extended unit tests to verify image handling in both streaming and non-streaming modes.

…outer-for-me#2866) Anthropic has moved the 1M-context-window feature to General Availability, so the context-1m-2025-08-07 beta flag is no longer accepted and now causes 400 Bad Request errors when forwarded upstream. Remove the X-CPA-CLAUDE-1M detection and the corresponding injection of the now-invalid beta header. Also drop the unused net/textproto import that was only needed for the header-key lookup.

…remove-obsolete-1m-beta-header fix(executor): drop obsolete context-1m-2025-08-07 beta header

… links - Added VisionCoder sponsorship information to `README.md`, `README_CN.md`, and `README_JA.md`. - Updated external links to include `target="_blank"` for improved user experience. - Added new logo asset `visioncoder.png` for README use.

- Introduced `refreshIneffectiveBackoff` to prevent tight-looping in auto-refresh when token refresh fails to update expiry. - Adjusted refresh logic to apply backoff when `shouldRefresh` evaluates true. Closes: router-for-me#2830

- Refactored `/healthz` handler to support `HEAD` requests alongside `GET`. - Updated tests to include validation for `HEAD` requests with expected status and empty body. Closes: router-for-me#2929

…m-output-backfill fix(codex): backfill streaming response output

…t-host-header fix(util): forward custom Host header to upstream

- Added `GPT-Image-2` as a built-in model to avoid dependency on remote updates for Codex. - Updated model tier functions (`CodexFree`, `CodexTeam`, etc.) to include built-in models via `WithCodexBuiltins`. - Introduced new handlers for image generation and edit operations under `OpenAIAPIHandler`. - Extended tests to validate 503 response for unsupported image model requests.

… image handlers

…AI image handlers

Codex CLI gates the built-in image_generation tool behind AuthMode::Chatgpt (OAuth only). When clients connect via API key auth through CPA, the tool is absent from requests, making image generation unavailable through the reverse proxy. Changes: 1. Inject image_generation tool (codex_executor.go): Add ensureImageGenerationTool() that appends {"type":"image_generation","output_format":"png"} to the tools array if not already present. Applied to all three execution paths: Execute, executeCompact, and ExecuteStream. 2. Route aliases for Codex CLI direct access (server.go): Add /backend-api/codex/responses routes that map to the same OpenAI Responses API handlers as /v1/responses. This allows Codex CLI to connect via chatgpt_base_url config while keeping AuthMode::Chatgpt, which enables the built-in image_generation tool on the client side. 3. Unit tests (codex_executor_imagegen_test.go): Cover no-tools, existing tools, already-present, empty array, and mixed built-in tool scenarios.

When auth-dir is not specified in config.yaml, ResolveAuthDir returns an empty string which causes os.MkdirAll to fail with no path. Use the documented default ~/.cli-proxy-api instead. Fixes router-for-me#3272

- Added new helper methods for OAuth session management (`RegisterOAuthSession`, `CompleteOAuthSession`, etc.). - Introduced `WriteConfig` for persisting management configurations. - Exported `Handler` type and `NewHandler` constructors for SDK consumers.

…e control plane - Introduced `-home` and `-home-password` flags for specifying home control plane address and authentication. - Implemented fetching and parsing configuration from the home control plane when `-home` is used. - Adjusted server configuration handling to bypass local config files when loading from home. - Ensured compatibility with cloud deploy mode and validation of home configurations.

- Introduced `disable_cooling` metadata field for fine-grained control over cooldown scheduling. - Updated `Auth` object to include `Metadata` with conditional logic for handling empty states. - Added YAML configuration support for `disable_cooling` in API key definitions across providers. - Enhanced unit tests to validate `disable_cooling` behavior in various scenarios.

…mplify session affinity logic

fix(executor): ignore null OpenAI stream usage chunks

fix: apply default auth-dir when config value is empty

- Updated `FileTokenStore` and related stores (`objectstore`, `gitstore`, `postgresstore`) to include the `disabled` flag in metadata for token storage. - Adjusted `Auth` metadata handling to initialize empty maps when absent. - Refined logic in `auto_refresh_loop` and `conductor` to exclude `disabled` tokens from refresh checks. - Added comprehensive unit tests to verify proper handling of the `disabled` flag in storage and retrieval operations.

…dling - Updated `EnsureIndex` logic to incorporate absolute and cleaned file paths when generating auth indexes. - Refined metadata handling to include OAuth type in auth index seed. - Improved compatibility for `json` file paths as sources in auth attributes. - Added unit tests to validate correct auth index behavior for various path and type scenarios.

…s-tool-output-context Fix Responses WebSocket tool output context repair

- Introduced `SetHomeEnabled` to enable/disable request-log forwarding to the home control plane. - Implemented `forwardRequestLogToHome` for non-streaming logs and `homeStreamingLogWriter` for real-time streaming logs. - Enhanced `FileRequestLogger` to bypass local logging when home forwarding is enabled. - Updated server configuration to dynamically toggle home request-log forwarding based on changes. - Added corresponding unit tests to ensure correct forwarding behavior and fallback mechanisms.

…ble usage statistics - Added `count` attribute to `homeAuthCount` requests to improve home message batching. - Enabled usage statistics for home mode by default and added config-level enforcement. - Adjusted failure logging to include detailed metadata in `UsageReporter`. - Updated multiple executors to pass error details to `PublishFailure` for better debugging. - Enhanced unit tests to validate `count` behavior and usage statistics enforcement across components.

…ve error handling in home mode - Introduced `shouldReturnLastErrorOnPickFailure` to streamline error return logic during provider selection. - Added `isHomeRequestRetryExceededError` for better home-specific error classification. - Updated fallback conditions to enhance error handling clarity in `pickNextMixed`.

…upport - Introduced `homeRuntimeAuths` to cache home auths for websocket session reuse. - Updated `pickNextViaHome` to prioritize cached auths for pinned websocket sessions. - Implemented automatic clearing of cached home auths when home mode is disabled. - Added unit tests to validate caching behavior, clearing logic, and fallback scenarios.

…ef counting - Added `homeRuntimeAuthSessions` and `homeRuntimeAuthRefs` for scoped caching of home auths per session. - Updated `pickNextViaHome` to prevent reuse of already-tried pinned auths during session retries. - Implemented reference counting for shared auths across multiple sessions to improve memory management. - Enhanced session cleanup logic to clear cached auths only when all referencing sessions are closed. - Added unit tests to validate scoped caching, retry logic, and session cleanup behavior.

…counting - Consolidated `homeRuntimeAuths` to store a map of session-scoped auth maps, replacing `homeRuntimeAuthSessions` and `homeRuntimeAuthRefs`. - Adjusted session cleanup logic to directly remove session-scoped auths without reference counting. - Added `GetExecutionSessionAuthByID` to retrieve auths scoped to a specific execution session. - Updated tests to reflect the new session-scoped caching behavior.

- Introduced `logHomeConfigChanges` to compare old and new configs, logging detected differences. - Leveraged `diff.BuildConfigChangeDetails` for structured change detection. - Adjusted logging behavior to enable debug-level logs dynamically when required.

Add example configuration for mapping Kiro OAuth models to standard Claude model names (without the kiro- prefix). This enables clients to use familiar model names like 'claude-opus-4-7' instead of 'kiro-claude-opus-4-7'. Without this alias configuration, Kiro models are only accessible via their kiro-prefixed names (e.g. kiro-claude-opus-4-7), which may not be recognized by clients expecting standard Anthropic model names. Example mappings added: - kiro-claude-opus-4-7 → claude-opus-4-7 - kiro-claude-opus-4-7-agentic → claude-opus-4-7-agentic - kiro-claude-sonnet-4-6 → claude-sonnet-4-6 - kiro-claude-sonnet-4-5 → claude-sonnet-4-5

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

github-actions · 2026-05-11T03:04:34Z

This pull request targeted main.

The base branch has been automatically changed to dev.

The "prepare build args" stage swings between ~130s and ~450s for no change in the code. Comparing the runner logs of two consecutive builds on the same commit shows exactly why: apk add gcc musl-dev 13.4s (fast run) apk add gcc musl-dev 322.7s (slow run) Same layer, same packages, 24x slower. The gcc toolchain pulls ~200MB from dl-cdn.alpinelinux.org, and when that CDN degrades every package stalls (libstdc++ alone took 76s to download, zstd-libs 53s). It is not a cache miss: the module download and the source copy are unchanged (26s / 0.2s in both runs), and the build itself is just as slow - the default CDN is intermittent, not uniformly slow. Fixes: - Dockerfile: install gcc/musl-dev from a pinned China mirror before the module layer, so the toolchain sits in a cache-friendly layer and no longer depends on a degrading CDN. Dropping this mirror was the regression that brought the instability back. - Dockerfile: retry `go mod download` (the proxy also drops connections, which currently aborts the whole image build) and keep the failure fatal once the retries are exhausted. - Dockerfile: pin -buildvcs=false so the output does not depend on the git metadata that differs between checkouts. - Dockerfile: build the apk layers with --no-cache and drop the stale apk cache, freeing ~200MB in the builder image. - .cnb.yml: reuse the BuildKit layer cache between runs, so the gcc and go mod layers are not rebuilt from scratch every time. Falls back cleanly when the docker version has no local cache exporter. Verified against the aliyun mirror: gcc 15.2.0-r2, musl-dev 1.2.5-r23, tzdata 2026e-r0 and libc6-compat (provided by gcompat 1.1.0-r4) all match the official CDN versions and their full dependency closures resolve with no missing packages. Refs Ve-ria#28

The previous fix (bb26ee3) pinned a mirror but left two problems in place, and the stage still ran 5+ minutes on the next two builds. Measured on the runs after that commit (stage durations from the build API): build cnb-mpn-1k4bhl115 prepare build args 357.9s build cnb-ae3-1k4bi09mm prepare build args 322.4s Both are the same stage as before, and the runner logs show the same shape: Ve-ria#10 (13/14) Installing gcc -> t=23.7s / t=30.3s Ve-ria#10 (14/14) Installing musl-dev -> t=147.5s / t=209.1s Ve-ria#10 DONE 154.5s / 218.3s 13 packages install in ~24s; musl-dev alone blocks for 120-180s. So the "intermittent CDN" story was incomplete: one package dominates every run. Two concrete causes: 1. The mirror rewrite (sed s#dl-cdn...#mirrors.aliyun.com#) edited whatever repositories the base image happened to ship. That resolves the package set for a different Alpine branch than the one assumed: the logs install gcc 15.2.0-r5 / musl-dev 1.2.6-r2 / jansson 2.15.0-r0, which are the aliyun v3.24 versions, not the v3.23 versions (15.2.0-r2 / 1.2.5-r23 / 2.14.1-r0) the commit claimed to have verified. apk's resolution was therefore not what the commit message described. 2. .cnb.yml wrote a BuildKit local cache that never hit. Both runs end in WARNING: local cache import at /root/docker-build-cache skipped due to err: could not read .../index.json: no such file or directory CNB_RUNNER_PIPELINE_CACHE is empty in the script, so the cache landed in /root/docker-build-cache, which does not survive to the next runner. The export step still cost ~24s per build (22.7s + 21.9s preparing), so it added time and returned nothing. Fixes: - Dockerfile.cache: new cache image holding only the expensive prerequisites (gcc/musl-dev toolchain + go mod download). Built through the platform's docker:cache task, keyed on go.mod/go.sum, so it is rebuilt only when the module graph changes and reused verbatim otherwise. - Dockerfile: builder stage now derives from that cache image via CACHE_IMAGE and only compiles the binary. Defaults to golang:1.26-alpine so a plain docker build . still works. - Pin the Alpine branch and mirror explicitly instead of rewriting the base image's repository file, so package resolution is deterministic. v3.23 was checked: gcc, musl-dev, tzdata, gcompat and their full dependency closures all resolve (libc6-compat is provided by gcompat). - Drop the non-functional local cache exporter and add docker.volumes for /root/.cache/go-build and /go/pkg/mod, which is the platform-supported way to persist node-local caches. - apk now retries three times before failing, matching the go mod download behaviour, so one flaky connection no longer aborts the image build. Expected after this: the toolchain and module layers stop being rebuilt, and the compile step is the only real work left in the stage. Refs Ve-ria#28

Two defects in the docker:cache setup introduced by the previous commit. 1) Stale cache image. The comment claimed the cache image is rebuilt when "the Dockerfile" changes, but versionBy only listed go.mod/go.sum. CNB computes the cache version as sha1(Dockerfile + versionBy + buildArgs + target + arch), where `Dockerfile` is the file named by `dockerfile:` and `by` only controls the build context. So a commit touching only Dockerfile.cache kept the same cache key and silently reused the old toolchain image. Dockerfile.cache is now in versionBy. 2) musl version split between builder and runtime. The previous commit pinned the apk branch to v3.23 but left the base image as the rolling `golang:1.26-alpine` tag. That tag is not promised to track 3.23: at the time of writing it is Alpine 3.24.2, so musl-dev 1.2.6-r2 was linked into a binary that runs against musl 1.2.5-r23 from alpine:3.23. The base image is now `golang:1.26-alpine3.23` (Alpine 3.23.6) in Dockerfile.cache, and the CACHE_IMAGE fallbacks in Dockerfile/.cnb.yml follow it, so both stages resolve musl-dev/musl to 1.2.5-r23. The cache image is rebuilt once by this change, which is the point of the fix. Refs Ve-ria#28

kslamph and others added 30 commits March 29, 2026 23:52

refactor(gemini-cli): simplify redundant if/else in project ID assign…

91387ca

…ment Both branches assign finalProjectID = responseProjectID, so move the assignment outside the conditional and keep only the logging inside.

fix(claude-auth): dedupe OAuth refresh and honor 429 backoff

6431cec

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

fix(executor): route Claude refresh through retry-aware auth

29e32aa

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

fix(websocket): narrow compact replay detection

d2d0e6f

fix(websocket): gate compact replay by downstream support

4ca00f7

fix(tests): update model lookup references and enhance Claude executo…

d9a3b3e

…r tests

fix(tests): update Gemini family test case numbers for consistency

da43f63

feat(api): integrate auth index into key retrieval endpoints for Gemi…

894baad

…ni, Claude, Codex, OpenAI, and Vertex

fix(management): stabilize auth-index mapping

c26936e

fix(tests): remove obsolete config_auth_index_test file

a64141a

Merge pull request router-for-me#2892 from router-for-me/fix-provider

c6baa64

feat(api): integrate auth index into key retrieval endpoints for Gemi…

Merge pull request router-for-me#2898 from octo-patch/fix/issue-2866-…

e05abec

…remove-obsolete-1m-beta-header fix(executor): drop obsolete context-1m-2025-08-07 beta header

fix(codex): backfill streaming response output

bb8408c

perf(codex): avoid repeated output patch writes

b6781d6

feat(api): add support for HEAD requests to /healthz endpoint

1716a84

- Refactored `/healthz` handler to support `HEAD` requests alongside `GET`. - Updated tests to include validation for `HEAD` requests with expected status and empty body. Closes: router-for-me#2929

Merge pull request router-for-me#2939 from stringer07/fix/codex-strea…

3444820

…m-output-backfill fix(codex): backfill streaming response output

Merge pull request router-for-me#2834 from muzhi1991/fix/openai-compa…

8ced7a5

…t-host-header fix(util): forward custom Host header to upstream

feat(models): add Kimi K2.6 model entry to registry JSON

4fc2c61

fix(handlers): remove handling of unsupported n parameter in OpenAI…

fd71960

… image handlers

fix(handlers): remove references to unsupported n parameter in Open…

a188159

…AI image handlers

lihan3238 and others added 21 commits May 8, 2026 21:47

fix: apply default auth-dir when config value is empty

4071fde

When auth-dir is not specified in config.yaml, ResolveAuthDir returns an empty string which causes os.MkdirAll to fail with no path. Use the documented default ~/.cli-proxy-api instead. Fixes router-for-me#3272

refactor: extract DefaultAuthDir constant per review feedback

4cbe172

refactor(cliproxy): remove ClaudeCodeSessionAffinity support and si…

0dcb8bd

…mplify session affinity logic

Merge pull request router-for-me#3221 from mochenya/main

09ac8a1

fix(executor): ignore null OpenAI stream usage chunks

Merge pull request router-for-me#3292 from lihan3238/fix-3272

68fddaa

fix: apply default auth-dir when config value is empty

Merge pull request router-for-me#3283 from wuchulonly/fix/responses-w…

3cbd587

…s-tool-output-context Fix Responses WebSocket tool output context repair

Merge branch 'v7' into dev

a44e5eb

Merge remote-tracking branch 'origin/pr/3239'

1fca942

Copilot AI review requested due to automatic review settings May 11, 2026 03:04

Copilot AI reviewed May 11, 2026

github-actions Bot changed the base branch from main to dev May 11, 2026 03:04

hpylsy closed this May 12, 2026

hpylsy deleted the feat/kiro-model-alias-example branch May 12, 2026 05:36

Navigation Menu

Repository navigation

docs: add kiro oauth-model-alias examples for Claude model name compatibility - #28

docs: add kiro oauth-model-alias examples for Claude model name compatibility#28
hpylsy wants to merge 177 commits into
Ve-ria:devfrom
hpylsy:feat/kiro-model-alias-example

hpylsy commented May 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

hpylsy commented May 11, 2026

Problem

Solution

Example

Verified

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants