fix(providers): correct Ollama Cloud kimi-k2.7-code capabilities (#3761) (#3768)

Importing kimi-k2.7-code via Ollama Cloud's 'import from /models' left it
with the 128000/8192 capability defaults and no vision, because the model
had no spec/registry entry and Ollama Cloud's /v1/models upstream returns
no per-model metadata. Add a global kimi-k2.7-code model spec (parity with
kimi-k2.6: 262K context/output, vision + thinking + tools) and a registry
entry on ollama-cloud so the real capabilities resolve.

Closes #3761

CHANGELOG.md

@@ -8,6 +8,8 @@
 
 ### 🐛 Fixed
 
+- fix(providers): give Ollama Cloud's `kimi-k2.7-code` its real capabilities (262K context, 262K max output, vision + thinking + tools) instead of the degraded `128000 / 8192` defaults. The model had no spec/registry entry, so importing it via "Import from /models" (whose `/v1/models` upstream returns no per-model metadata) left it as a bare custom model with fallback capabilities. Added a global `kimi-k2.7-code` model spec (parity with `kimi-k2.6`) plus a registry entry on `ollama-cloud`. ([#3761](https://github.com/diegosouzapw/OmniRoute/issues/3761) — thanks @SultanKs4)
+
 - fix(providers): repair qwen-web (chat.qwen.ai) connection validation, which failed with a misleading `provider.validation.ssrf_blocked` error. qwen-web had no specialty validator, so the generic OpenAI-compatible path probed a non-existent `/api/v2/models` URL that answers with a 307 redirect — the outbound guard blocked the redirect and the route mislabeled it as an SSRF security block. Added a `qwen-web` specialty validator that probes the real session endpoint (`GET /api/v2/user`, mirroring the executor's anti-bot headers + cookie-jar replay). Also hardened `toValidationErrorResult` so a blocked redirect is only flagged `securityBlocked` when its target is a private/internal host — a benign 3xx to a public host is no longer mislabeled as an SSRF attempt (this affected every web-cookie provider, not just qwen). ([#3288](https://github.com/diegosouzapw/OmniRoute/issues/3288), [#3758](https://github.com/diegosouzapw/OmniRoute/issues/3758))
 
 - fix(oauth): stop nulling the stored `refresh_token` of non-rotating providers when a proactive health-check refresh fails with `invalid_grant`. The destructive `refreshToken: null` write in `tokenHealthCheck` was only meant for rotating one-time-use tokens (Codex/OpenAI), but it also fired for Google-family providers (gemini-cli / antigravity / gemini) whose refresh tokens are non-rotating. Once nulled, the connection reported "No valid refresh token available" and could never recover even after re-activation. The token is now preserved (gated on `isRotatingProvider`) so it stays as the recovery artifact. ([#3679](https://github.com/diegosouzapw/OmniRoute/issues/3679) — thanks @3xa228148)

open-sse/config/providerRegistry.ts

@@ -3197,6 +3197,18 @@ const _REGISTRY_EAGER: Record<string, RegistryEntry> = {
       { id: "deepseek-v4-pro", name: "DeepSeek V4 Pro", supportsReasoning: true },
       { id: "deepseek-v4-flash", name: "DeepSeek V4 Flash", supportsReasoning: true },
       { id: "kimi-k2.6", name: "Kimi K2.6" },
+      // #3761: 262K native, vision + thinking + tools (parity with K2.6). Without this
+      // entry the "import from /models" path leaves it as a bare custom model with the
+      // 128K/8K capability defaults.
+      {
+        id: "kimi-k2.7-code",
+        name: "Kimi K2.7 Code",
+        contextLength: 262144,
+        maxOutputTokens: 262144,
+        supportsReasoning: true,
+        supportsVision: true,
+        toolCalling: true,
+      },
       { id: "glm-5.1", name: "GLM 5.1" },
       // #3110: MiniMax M3 via Ollama
       { id: "minimax-m3", name: "MiniMax M3", contextLength: 1048576, supportsVision: true },

src/shared/constants/modelSpecs.ts

@@ -274,6 +274,18 @@ export const MODEL_SPECS: Record<string, ModelSpec> = {
     aliases: ["kimi-k2.6-thinking", "kimi-for-coding"],
   },
 
+  // ── Kimi K2.7 Code (Moonshot — 262K native, parity with K2.6) ───
+  // #3761: importing this via Ollama Cloud's sparse /v1/models gave it no caps, so it
+  // fell back to the 128K/8K defaults and lost vision/thinking. Pin the real values.
+  "kimi-k2.7-code": {
+    maxOutputTokens: 262144,
+    contextWindow: 262144,
+    supportsThinking: true,
+    supportsTools: true,
+    supportsVision: true,
+    aliases: ["kimi-k2.7", "kimi-k2.7-code-thinking"],
+  },
+
   // ── Kimi K2.5 (Moonshot — 262K native, parity with K2.6) ────────
   "kimi-k2.5": {
     maxOutputTokens: 262144,

tests/unit/model-capabilities-registry.test.ts

@@ -166,3 +166,23 @@ test("Kimi K2.6 supports vision capability", () => {
   const kimiThinking = modelCapabilities.getResolvedModelCapabilities("kimi-k2.6-thinking");
   assert.equal(kimiThinking.supportsVision, true);
 });
+
+test("Kimi K2.7 Code resolves full capabilities instead of the degraded import defaults (#3761)", () => {
+  // Spec-driven, so it works for any provider serving the model.
+  const kimi = modelCapabilities.getResolvedModelCapabilities("kimi-k2.7-code");
+  assert.equal(kimi.contextWindow, 262144);
+  assert.equal(kimi.maxOutputTokens, 262144);
+  assert.equal(kimi.supportsVision, true);
+  assert.equal(kimi.supportsThinking, true);
+  assert.equal(kimi.supportsTools, true);
+
+  // The reported case: imported via Ollama Cloud's "import from /models". Before the
+  // fix this had no spec/registry entry, so context fell back to the 128000 default
+  // and max output to 8192, with vision dropped.
+  const ollama = modelCapabilities.getResolvedModelCapabilities("ollama-cloud/kimi-k2.7-code");
+  assert.equal(ollama.contextWindow, 262144);
+  assert.equal(ollama.maxOutputTokens, 262144);
+  assert.equal(ollama.supportsVision, true);
+  assert.notEqual(ollama.contextWindow, 128000);
+  assert.notEqual(ollama.maxOutputTokens, 8192);
+});