[harlan-huang]

Summary

Since the runtime.kiro.dev migration (#155), /v1/models has returned the static FALLBACK_MODELS list for every account. The gateway never asks Kiro which models the account can use. As a result:

• models released after the list was written do not appear in /v1/models
• models an organization admin has disabled still appear, and requests for them fail with INVALID_MODEL_ID

Root cause

Both hosts were moved to the runtime domain:

KIRO_API_HOST_TEMPLATE = "https://runtime.{region}.kiro.dev"
KIRO_Q_HOST_TEMPLATE   = "https://runtime.{region}.kiro.dev"

runtime.{region}.kiro.dev does not implement ListAvailableModels. Every variant I tried (GET and POST, both casings, with and without x-amz-target) returns UnknownOperationException. To avoid that error, AccountManager skipped the request for runtime hosts. Since every account now uses a runtime host, the dynamic fetch code never ran.

q.{region}.amazonaws.com still serves ListAvailableModels. With the gateway's existing get_kiro_headers() it returns HTTP 200 and the account's real model list, including the effect of organization admin settings.

Changes

• kiro/config.py: new KIRO_MODELS_HOST_TEMPLATE = "https://q.{region}.amazonaws.com" and get_kiro_models_host().
• kiro/auth.py: new models_host property, included in the startup log line.
• kiro/account_manager.py: initialization and TTL refresh request {models_host}/ListAvailableModels. The runtime-host check is removed, along with _is_runtime_endpoint(), which had no other callers.

Not changed:

• generation still uses api_host (runtime)
• q_host is still runtime and is still used by the MCP tools
• if the fetch fails during initialization, FALLBACK_MODELS is used, as before
• if a TTL refresh fails, the last successful list is kept

Tests

6 new tests, in tests/unit/test_account_manager.py (TestAccountManagerModelListSource) and tests/unit/test_auth_manager.py:

• a runtime-host account fetches from https://q.us-east-1.amazonaws.com/ListAvailableModels
• the cache contains exactly the fetched models: a model missing from FALLBACK_MODELS is added, and a FALLBACK_MODELS entry the account lacks is absent
• a failed fetch at initialization falls back to FALLBACK_MODELS and still closes the client
• TTL refresh fetches from models_host and updates the model-to-account mapping
• a failed TTL refresh keeps the previous list
• models_host is region-specific and differs from api_host

Full suite: 1697 passed.

Live verification

Enterprise (IAM Identity Center) account, us-east-1:

• before: /v1/models returned the 13 entries of FALLBACK_MODELS, including models the organization had disabled
• after: the startup log shows models_host=https://q.us-east-1.amazonaws.com and Found 10 models, and /v1/models lists exactly the models the account can call

Known limitation

Issue #58 reported that codewhisperer.{region}.amazonaws.com does not exist outside us-east-1. I could only test q.* in us-east-1. If q.{region} is unreachable in some region, the fetch fails and the gateway falls back to FALLBACK_MODELS, which is the current behavior, so no region should be worse off than today.

Related

#285 and #289 update the static list or try to discover unlisted models. This PR fixes the cause: it fetches the list from Kiro again.

🤖 Generated with Claude Code

[cla-bot]

Thanks for the PR! 🎉

Before merge, we need a one-time CLA confirmation.
It confirms that you have the right to contribute this code and allow the project to use it.

Full CLA text:
https://github.com/jwadow/kiro-gateway/blob/main/CLA.md

Please reply once with:

I have read the CLA and I accept its terms

You need to write once, all further messages from me can be ignored.

[harlan-huang]

I have read the CLA and I accept its terms