…825)

Split the 4691-line kiro_executor.go into three focused files:

- kiro_transform.go (~470 LOC): endpoint config types, region resolution,
  payload builders (buildKiroPayloadForFormat, sanitizeKiroPayload),
  model mapping (mapModelToKiro), credential extraction (kiroCredentials),
  and auth-method helpers (getEffectiveProfileArnWithWarning, isIDCAuth).

- kiro_streaming.go (~2990 LOC): streaming execution (ExecuteStream,
  executeStreamWithRetry), AWS Event Stream parsing (parseEventStream,
  readEventStreamMessage, extractEventTypeFromBytes), channel-based
  streaming (streamToChannel), and the full web search MCP handler
  (handleWebSearchStream, handleWebSearch, callMcpAPI, etc.).

- kiro_executor.go (~1270 LOC): core executor struct (KiroExecutor),
  HTTP client pool, retry logic, Execute/executeWithRetry,
  CountTokens, Refresh, and token persistence helpers.

All functions remain in the same package; no public API changes.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Ports the cliproxy adapter responsibilities from thegent Python code
(cliproxy_adapter.py, cliproxy_error_utils.py, cliproxy_header_utils.py,
cliproxy_models_transform.py) into a canonical Go SDK package so consumers
no longer need to reimplement raw HTTP calls.

pkg/llmproxy/client/ provides:
- client.go  — Client with Health, ListModels, ChatCompletion, Responses
- types.go   — Request/response types + Option wiring
- client_test.go — 13 httptest-based unit tests (all green)

Handles both proxy-normalised {"models":[...]} and raw OpenAI
{"data":[...]} shapes, propagates x-models-etag, surfaces APIError
with status code and structured message, and enforces non-streaming on
all methods (streaming is left to callers via net/http directly).

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* centralize provider alias normalization in cliproxyctl

* chore(airlock): track default workflow config

Co-authored-by: Codex <noreply@openai.com>

* chore(artifacts): remove stale AI tooling artifacts

Co-authored-by: Codex <noreply@openai.com>

* feat(deps): migrate from phenotype-go-kit monolith to phenotype-go-auth

Replace the monolithic phenotype-go-kit/pkg/auth import with the
standalone phenotype-go-auth module across all auth token storage
implementations (claude, copilot, gemini).

Update go.mod to:
- Remove: github.com/KooshaPari/phenotype-go-kit v0.0.0
- Add: github.com/KooshaPari/phenotype-go-auth v0.0.0
- Update replace directive to point to template-commons/phenotype-go-auth

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Add pkg/llmproxy/auth/base/token_storage.go with BaseTokenStorage, which
centralises the Save/Load/Clear file-I/O logic that was duplicated across
every auth provider.  Key design points:

- Save() uses an atomic write (temp file + os.Rename) to prevent partial reads
- Load() and Clear() are idempotent helpers for callers that load/clear credentials
- GetAccessToken/RefreshToken/Email/Type accessor methods satisfy the common interface
- FilePath field is runtime-only (json:"-") so it never bleeds into persisted JSON

Migrate claude, copilot, gemini, codex, kimi, kilo, and iflow providers to
embed *base.BaseTokenStorage.  Each provider's SaveTokenToFile() now delegates
to base.Save() after setting its Type field.  Struct literals in *_auth.go
callers updated to use the nested BaseTokenStorage initialiser.

Skipped: qwen (already has own helper), vertex (service-account JSON format),
kiro (custom symlink guards), empty (no-op), antigravity/synthesizer/diff
(no token storage).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>