diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..8223e5f
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,22 @@
+# ============================================
+# Kiro Stack 配置文件
+# ============================================
+
+# -------------------- 管理面板 --------------------
+# Web 管理面板密码（必填）
+ADMIN_PASSWORD=change_this_password
+
+# -------------------- 内部通信 --------------------
+# kiro-go 和 kiro-gateway 之间的通信密钥（必填）
+# 两个服务会自动使用这个密钥进行鉴权
+INTERNAL_API_KEY=change_this_api_key
+
+# -------------------- 可选配置 --------------------
+# 如果你在中国或有网络限制，可以配置代理
+# VPN_PROXY_URL=http://127.0.0.1:7890
+# VPN_PROXY_URL=socks5://127.0.0.1:1080
+
+# 调试模式（可选）
+# DEBUG_MODE=off        # 关闭（默认）
+# DEBUG_MODE=errors     # 仅记录错误请求
+# DEBUG_MODE=all        # 记录所有请求
diff --git a/.gitignore b/.gitignore
index 2beda53..883782d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,10 +2,14 @@
 # 敏感数据 / Sensitive Data
 # ==============================
 
+# 根目录环境变量（含密码和密钥）
+.env
+.env.local
+
 # kiro-go 账号数据（含 Token）
 kiro-go/data/config.json
 
-# kiro-gateway 环境变量
+# kiro-gateway 环境变量（已废弃，现在统一用根目录 .env）
 kiro-gateway/.env
 kiro-gateway/.env.local
 
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..d9d7198
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,182 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Kiro Stack integrates two upstream projects to provide OpenAI/Anthropic-compatible API access to Kiro (Amazon Q Developer) accounts:
+
+- **kiro-go** (Go): Web admin panel, multi-account pool management, token refresh
+- **kiro-gateway** (Python/FastAPI): Stable proxy layer with retry logic and dual-endpoint fallback
+
+## Architecture
+
+```
+Client (Claude Code/Cursor/etc) → kiro-go:8088 → kiro-gateway:8000 → Kiro API
+```
+
+**Request Flow:**
+1. Client sends OpenAI/Anthropic-compatible request to kiro-go
+2. kiro-go selects account from pool (weighted random selection)
+3. If `KIRO_GATEWAY_BASE` is set, kiro-go forwards to kiro-gateway with account credentials in headers
+4. kiro-gateway handles token refresh, retries, and dual-endpoint fallback
+5. Response streams back through the chain
+
+**Key Integration Point:** `kiro-go/proxy/handler.go:380-395` (`proxyToGatewayWithAccount`) injects account credentials as HTTP headers (`X-Kiro-Refresh-Token`, `X-Kiro-Region`, etc.) when forwarding to gateway.
+
+## Common Commands
+
+### Development
+
+```bash
+# Start both services with Docker Compose
+docker compose up -d
+
+# View logs
+docker compose logs -f kiro-go
+docker compose logs -f kiro-gateway
+
+# Rebuild after code changes
+docker compose up -d --build
+
+# Stop services
+docker compose down
+```
+
+### kiro-go (Go service)
+
+```bash
+cd kiro-go
+
+# Build
+go build -o kiro-go .
+
+# Run locally
+./kiro-go
+
+# Run with custom config path
+CONFIG_PATH=/path/to/config.json ./kiro-go
+
+# Format code
+go fmt ./...
+```
+
+### kiro-gateway (Python service)
+
+```bash
+cd kiro-gateway
+
+# Install dependencies
+pip install -r requirements.txt
+
+# Run locally
+python main.py
+
+# Run with custom port
+python main.py --port 9000
+
+# Run tests
+pytest
+
+# Run specific test file
+pytest tests/unit/test_auth.py
+
+# Run with verbose output
+pytest -v
+```
+
+## Configuration
+
+### Environment Variables
+
+**Root .env file (simplified setup):**
+- `ADMIN_PASSWORD` - Web admin panel password (required)
+- `INTERNAL_API_KEY` - Internal communication key between kiro-go and kiro-gateway (required)
+- `VPN_PROXY_URL` - HTTP/SOCKS5 proxy for restricted networks (optional)
+- `DEBUG_MODE` - Logging mode: `off`, `errors`, `all` (optional)
+
+**How it works:**
+- All configuration is in the root `.env` file
+- `docker-compose.yml` reads from `.env` and distributes variables to both services
+- kiro-go manages all account credentials
+- When forwarding requests, kiro-go injects credentials as HTTP headers (`X-Kiro-*`)
+- kiro-gateway receives credentials from headers, no need for separate .env configuration
+
+### Configuration Files
+
+**kiro-go:** `data/config.json` stores accounts, settings, and statistics. Thread-safe access via `config/config.go` with RWMutex.
+
+**kiro-gateway:** No configuration file needed when used with kiro-go. Receives all credentials via HTTP headers.
+
+## Code Structure
+
+### kiro-go (Go)
+
+**Entry point:** `main.go` - Initializes config, account pool, and HTTP handler
+
+**Core modules:**
+- `config/config.go` - Configuration management with JSON persistence. Account struct includes auth credentials, subscription info, usage tracking, and runtime statistics
+- `pool/account.go` - Account pool with weighted random selection. Maintains enabled accounts in memory
+- `proxy/handler.go` - HTTP routing and request handling. Contains gateway proxy logic (lines 160-176, 380-395)
+- `proxy/kiro.go` - Direct Kiro API client (used when gateway is not configured)
+- `proxy/translator.go` - Request/response translation between OpenAI/Anthropic and Kiro formats
+- `auth/` - Authentication methods: AWS Builder ID, IAM SSO, OIDC token refresh
+
+**Gateway Integration:** When `KIRO_GATEWAY_BASE` is set, `NewHandler()` creates a reverse proxy (`handler.go:163-176`). The `proxyToGatewayWithAccount()` function (`handler.go:380-395`) injects account credentials as headers before forwarding.
+
+### kiro-gateway (Python)
+
+**Entry point:** `main.py` - FastAPI app with lifespan management
+
+**Core modules:**
+- `kiro/config.py` - Environment variable configuration
+- `kiro/auth.py` - KiroAuthManager handles token refresh and authentication
+- `kiro/auth_pool.py` - Builds authentication pool from credentials
+- `kiro/routes_openai.py` - OpenAI-compatible `/v1/chat/completions` endpoint
+- `kiro/routes_anthropic.py` - Anthropic-compatible `/v1/messages` endpoint
+- `kiro/model_resolver.py` - Model name normalization and resolution
+- `kiro/cache.py` - Model info caching
+
+**Request Headers:** Gateway expects account credentials in `X-Kiro-*` headers (set by kiro-go). If not present, falls back to environment variables.
+
+## Important Patterns
+
+### Account Pool Selection
+
+`pool/account.go` uses weighted random selection. Each account has a `Weight` field (default: 100). Higher weight = higher selection probability. Only enabled accounts are included in the pool.
+
+### Token Refresh
+
+Both services handle token refresh:
+- **kiro-go:** Background refresh every 30 minutes (`handler.go:184-203`). Checks if token expires within 5 minutes and refreshes proactively
+- **kiro-gateway:** Refreshes on-demand when token is expired or about to expire
+
+### Retry Logic
+
+**kiro-go:** When using gateway, implements failover with up to 4 attempts (`handler.go:397+`). Tries different accounts on failure.
+
+**kiro-gateway:** Implements dual-endpoint fallback (CodeWhisperer vs Amazon Q endpoints) with configurable retry logic.
+
+### Thinking Mode
+
+Both services support extended thinking mode. Triggered by model name suffix (default: `-thinking`). Configuration in `config.json` (`ThinkingSuffix`, `OpenAIThinkingFormat`, `ClaudeThinkingFormat`).
+
+## Testing
+
+**kiro-gateway only:** Uses pytest. Test structure:
+- `tests/unit/` - Unit tests for individual modules
+- `tests/integration/` - Integration tests
+- `tests/conftest.py` - Shared fixtures
+
+**kiro-go:** No test suite currently exists.
+
+## Utilities
+
+**scripts/sync_tokens.py** - Syncs refresh tokens from kiro-go config to kiro-gateway .env file. Reads enabled accounts from `data/config.json` and writes `KIRO_REFRESH_TOKENS` to `.env` as comma-separated list. Useful for keeping gateway's token pool in sync with go service accounts.
+
+## Deployment Notes
+
+- Both services bind to `0.0.0.0` by default for Docker compatibility
+- kiro-go stores persistent data in `data/config.json` - mount this volume in production
+- Gateway is stateless - no persistent storage required
+- Services communicate via internal Docker network when using docker-compose
diff --git a/README.md b/README.md
index 0e6fc14..0124aa6 100644
--- a/README.md
+++ b/README.md
@@ -61,120 +61,109 @@
 - Docker + Docker Compose
 - Kiro 账号（免费 / 付费均可）
 
-### 1. 克隆仓库
+### 三步启动
 
 ```bash
+# 1. 克隆仓库
 git clone https://github.com/your-username/kiro-stack.git
 cd kiro-stack
-```
-
-### 2. 配置 kiro-gateway
 
-```bash
-cp kiro-gateway/.env.example kiro-gateway/.env
-```
-
-编辑 `kiro-gateway/.env`，至少配置 API Key（用于 kiro-go 调用鉴权）：
-
-```env
-# kiro-go 调用时使用的 API Key（自定义，需与 docker-compose.yml 保持一致）
-API_KEY=your_api_key_here
-```
+# 2. 配置环境变量
+cp .env.example .env
+# 编辑 .env，修改以下两项：
+#   ADMIN_PASSWORD=你的管理面板密码
+#   INTERNAL_API_KEY=随机生成的密钥（用于内部通信）
 
-> 完整配置项参考 [kiro-gateway/README.md](kiro-gateway/README.md)
-
-### 3. 配置 docker-compose.yml
-
-编辑根目录 `docker-compose.yml`：
-
-```yaml
-services:
-  kiro-gateway:
-    ...
-    env_file:
-      - ./kiro-gateway/.env
-    ports:
-      - "8001:8000"   # gateway 内部端口，不对外暴露也可
-
-  kiro-go:
-    ...
-    environment:
-      - ADMIN_PASSWORD=your_admin_password   # Web 管理面板密码
-      - KIRO_GATEWAY_BASE=http://kiro-gateway:8000
-      - KIRO_GATEWAY_API_KEY=your_api_key_here   # 需与 gateway API_KEY 一致
-    ports:
-      - "8088:8080"   # 对外暴露端口
-```
-
-### 4. 启动服务
-
-```bash
+# 3. 启动服务
 docker compose up -d
 ```
 
-### 5. 添加账号
+### 添加账号并使用
 
 1. 打开 `http://localhost:8088/admin`
-2. 输入 `ADMIN_PASSWORD` 登录
+2. 使用 `ADMIN_PASSWORD` 登录
 3. 添加 Kiro 账号（支持 AWS Builder ID / IAM SSO / SSO Token 等方式）
-
-### 6. 使用 API
-
-将客户端的 base URL 设为 `http://localhost:8088`，无需 API Key（或按面板配置）。
+4. 将客户端的 base URL 设为 `http://localhost:8088`
 
 ```bash
 # OpenAI 兼容
 curl http://localhost:8088/v1/chat/completions \
   -H "Content-Type: application/json" \
-  -d '{"model": "claude-sonnet-4-5", "messages": [{"role": "user", "content": "Hello"}], "stream": true}'
+  -d '{"model": "claude-sonnet-4.5", "messages": [{"role": "user", "content": "Hello"}]}'
 
 # Anthropic 兼容
 curl http://localhost:8088/v1/messages \
   -H "Content-Type: application/json" \
-  -d '{"model": "claude-sonnet-4-5", "max_tokens": 1024, "messages": [{"role": "user", "content": "Hello"}]}'
+  -d '{"model": "claude-sonnet-4.5", "max_tokens": 1024, "messages": [{"role": "user", "content": "Hello"}]}'
 ```
 
+> **说明：** 账号凭证由 kiro-go 管理，请求时自动转发给 kiro-gateway，无需在 gateway 单独配置 token。
+
 ---
 
 ## 支持的模型
 
-模型可用性取决于你的 Kiro 订阅等级，以下为常见免费模型：
+模型可用性取决于你的 Kiro 订阅等级，以下为常见模型：
 
 | 模型 | 说明 |
 |------|------|
-| `claude-sonnet-4-5` | 均衡性能，适合编程、写作等通用任务 |
-| `claude-haiku-4-5` | 极速响应，适合简单任务 |
+| `claude-sonnet-4.6` | 最新旗舰模型（2026年2月发布） |
+| `claude-opus-4.6` | 最强推理模型（2026年2月发布） |
+| `claude-sonnet-4.5` | 均衡性能，适合编程、写作等通用任务 |
+| `claude-haiku-4.5` | 极速响应，适合简单任务 |
 | `claude-sonnet-4` | 上一代，稳定可靠 |
-| `claude-3-7-sonnet` | 旧版，向后兼容 |
-| `deepseek-v3-2` | 开源 MoE（685B/37B active），均衡 |
-| `minimax-m2-1` | 开源 MoE（230B/10B active），适合复杂任务 |
+| `claude-3.7-sonnet` | 旧版，向后兼容 |
+| `deepseek-v3.2` | 开源 MoE（685B/37B active），均衡 |
+| `minimax-m2.1` | 开源 MoE（230B/10B active），适合复杂任务 |
 | `qwen3-coder-next` | 开源 MoE（80B/3B active），代码专项 |
 
 模型名称支持多种格式，如 `claude-sonnet-4.5` / `claude-sonnet-4-5` / `claude-sonnet-4-5-20250929` 均可正常解析。
 
+> **⚠️ 关于 `claude-sonnet-4.6` / `claude-opus-4.6` 无法使用的说明**
+>
+> 这两个模型目前处于**小范围灰度开放**阶段，Kiro API 对无权限的请求会返回 HTTP 429，
+> 与普通「限流」使用相同的状态码，因此日志中会看到 `Streaming failed after 3 attempts` 的报错。
+>
+> **原因并非代码 Bug，而是你的 Kiro 账号/Region 尚未获得该模型的访问权限。**
+>
+> 排查步骤：
+> 1. 先用 `claude-sonnet-4.5` 发一条测试请求，若成功则账号和链路均正常
+> 2. 等待 AWS 对你的账号开放 4.6 模型（通常随 Kiro IDE 版本升级逐步推送）
+> 3. 开放后无需任何配置变更，直接使用即可
+
 ---
 
 ## 配置说明
 
-### kiro-go 环境变量
+### 环境变量（.env 文件）
 
-| 变量 | 说明 | 默认值 |
-|---|---|---|
-| `ADMIN_PASSWORD` | Web 管理面板密码 | - |
-| `CONFIG_PATH` | 配置文件路径 | `data/config.json` |
-| `KIRO_GATEWAY_BASE` | kiro-gateway 地址，设置后请求走 gateway | 空（直连 Kiro API） |
-| `KIRO_GATEWAY_API_KEY` | 调用 gateway 的鉴权 Key | 空 |
+所有配置都在根目录的 `.env` 文件中：
 
-### kiro-gateway 主要环境变量
+| 变量 | 说明 | 必填 |
+|------|------|------|
+| `ADMIN_PASSWORD` | Web 管理面板密码 | ✅ 是 |
+| `INTERNAL_API_KEY` | kiro-go 和 kiro-gateway 之间的通信密钥 | ✅ 是 |
+| `VPN_PROXY_URL` | HTTP/SOCKS5 代理（如有网络限制） | ❌ 否 |
+| `DEBUG_MODE` | 调试模式：`off`（默认）/ `errors` / `all` | ❌ 否 |
 
-详见 [kiro-gateway/README.md](kiro-gateway/README.md)，常用项：
+**说明：**
+- `ADMIN_PASSWORD`：用于登录 Web 管理面板
+- `INTERNAL_API_KEY`：两个服务之间的内部鉴权，随机生成即可（如 `openssl rand -hex 32`）
+- `VPN_PROXY_URL`：如果在中国或有网络限制，配置代理地址（如 `http://127.0.0.1:7890`）
+- `DEBUG_MODE`：生产环境建议 `off`，排查问题时可设为 `errors`
 
-| 变量 | 说明 |
-|---|---|
-| `API_KEY` | API 访问密钥 |
-| `PROXY_URL` | HTTP/SOCKS5 代理（如有网络限制） |
-| `MAX_RETRIES` | 最大重试次数 |
-| `RETRY_DELAY` | 重试间隔（秒） |
+### 账号管理
+
+所有 Kiro 账号通过 Web 管理面板添加和管理：
+1. 访问 `http://localhost:8088/admin`
+2. 使用 `ADMIN_PASSWORD` 登录
+3. 点击"添加账号"，支持多种方式：
+   - AWS Builder ID（个人账号）
+   - IAM Identity Center（企业 SSO）
+   - SSO Token（从浏览器导入）
+   - 本地缓存（从 Kiro IDE 导入）
+
+**无需在 kiro-gateway 配置 token**，所有账号凭证由 kiro-go 管理，请求时自动转发。
 
 ---
 
@@ -201,6 +190,25 @@ kiro-stack/
 
 ## 更新日志
 
+### `feature/simplify-config-and-add-4.6-models`
+
+**配置简化：**
+- 整合部署只需配置**根目录一个 `.env` 文件**，不再需要单独维护 `kiro-gateway/.env`
+- 账号凭证（Refresh Token 等）完全通过 kiro-go Web 管理面板管理，kiro-go 转发请求时自动通过 `X-Kiro-*` HTTP 头传递给 gateway
+- `kiro-gateway/.env.example` 更新注释，明确标注仅独立部署时才需要此文件
+
+**新增模型支持：**
+- 在 gateway 内置 fallback 模型列表中添加 `claude-sonnet-4.6`、`claude-opus-4.6`、`claude-opus-4.6-1m`
+
+**集成模式启动修复：**
+- 新增 `SKIP_STARTUP_CREDENTIAL_CHECK=true` 环境变量（已在 `docker-compose.yml` 中预设）
+- 修复集成部署时 kiro-gateway 因找不到本地静态凭证而无法启动的问题（凭证由请求头动态传入，无需启动时校验）
+
+**日志改进：**
+- 429 错误日志现在会附带 Kiro API 返回的响应体，便于判断是真正限流还是模型无权限
+
+---
+
 ### 相比原版的改动
 
 **kiro-go 改动：**
diff --git a/docker-compose.yml b/docker-compose.yml
index e7d8c98..63d7022 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,8 +4,11 @@ services:
     image: kiro-gateway-local:latest
     container_name: kiro-gateway
     restart: unless-stopped
-    env_file:
-      - ./kiro-gateway/.env
+    environment:
+      - PROXY_API_KEY=${INTERNAL_API_KEY}
+      - VPN_PROXY_URL=${VPN_PROXY_URL:-}
+      - DEBUG_MODE=${DEBUG_MODE:-off}
+      - SKIP_STARTUP_CREDENTIAL_CHECK=true
     ports:
       - "8001:8000"
 
@@ -21,6 +24,6 @@ services:
       - ./kiro-go/data:/app/data
     environment:
       - CONFIG_PATH=/app/data/config.json
-      - ADMIN_PASSWORD=change_this_password
+      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
       - KIRO_GATEWAY_BASE=http://kiro-gateway:8000
-      - KIRO_GATEWAY_API_KEY=change_this_api_key
+      - KIRO_GATEWAY_API_KEY=${INTERNAL_API_KEY}
diff --git a/kiro-gateway/.env.example b/kiro-gateway/.env.example
index 18e2b51..c1a7b3c 100644
--- a/kiro-gateway/.env.example
+++ b/kiro-gateway/.env.example
@@ -1,196 +1,43 @@
-# Kiro Gateway - Environment Configuration
-# Copy this file to .env and fill in your values
-
-# ===========================================
-# REQUIRED
-# ===========================================
-
-# Password to protect YOUR proxy server
-# This is NOT a token from anywhere - YOU make it up!
-# Use this same value as api_key when connecting to your gateway
-# Example: "my-super-secret-password-123" or any secure string
-PROXY_API_KEY="my-super-secret-password-123"
-
-# ===========================================
-# OPTION 1: Kiro IDE credentials (JSON file)
-# ===========================================
-
-# Path to JSON credentials file from Kiro IDE
-# KIRO_CREDS_FILE="~/.aws/sso/cache/kiro-auth-token.json"
-
-# ===========================================
-# OPTION 2: Kiro IDE refresh token
-# ===========================================
-
-# Your Kiro refresh token obtained from Kiro IDE traffic.
-# REFRESH_TOKEN="your_kiro_refresh_token_here"
-
-# ===========================================
-# OPTION 3: kiro-cli SQLite database (AWS SSO)
-# ===========================================
-
-# Path to kiro-cli SQLite database (for AWS IAM Identity Center users)
-# The gateway will auto-detect AWS SSO OIDC and use the correct endpoint
-# KIRO_CLI_DB_FILE="~/.local/share/kiro-cli/data.sqlite3"
-
-# ===========================================
-# OPTION 4: AWS SSO cache file (kiro-cli)
-# ===========================================
-
-# Path to AWS SSO cache file (contains clientId and clientSecret)
-# The gateway will auto-detect AWS SSO OIDC and use the correct endpoint
-# KIRO_CREDS_FILE="~/.aws/sso/cache/your-sso-cache-file.json"
-
-# ===========================================
-# PROFILE ARN (optional)
-# ===========================================
-
-# AWS CodeWhisperer profile ARN
-# For Kiro IDE: usually auto-detected from credentials file
-# For kiro-cli (AWS SSO / Builder ID): not needed, will be ignored
-# PROFILE_ARN="arn:aws:codewhisperer:us-east-1:..."
-
-# ===========================================
-# OPTIONAL
-# ===========================================
-
-# AWS region (default: us-east-1)
-# KIRO_REGION="us-east-1"
-
-# ===========================================
-# SERVER SETTINGS
-# ===========================================
-
-# Server host (default: 0.0.0.0 - listen on all interfaces)
-# Use "127.0.0.1" to only allow local connections
-# SERVER_HOST="0.0.0.0"
-
-# Server port (default: 8000)
-# Useful when port 8000 is already in use by another application
-#
-# Configuration priority (highest to lowest):
-#   1. CLI arguments: python main.py --port 9000
-#   2. Environment variables: SERVER_PORT=9000
-#   3. Default value: 8000
-#
-# Note: When using `uvicorn main:app --port 9000` directly,
-# uvicorn handles its own CLI arguments (this setting is ignored)
-# SERVER_PORT="8000"
-
-# ===========================================
-# VPN/PROXY SETTINGS
-# ===========================================
-
-# VPN/Proxy URL for accessing Kiro API through a proxy server.
-# Leave empty to connect directly (default).
+# ============================================
+# Kiro Gateway - 独立部署配置文件
+# ============================================
 #
-# Use cases:
-#   - China: GFW (Great Firewall) blocks AWS endpoints
-#   - Corporate networks: Often require mandatory proxy
-#   - Privacy: Hide your IP address from AWS
+# ⚠️ 注意：如果你使用 kiro-stack 整合部署，请忽略此文件！
 #
-# Supports HTTP and SOCKS5 protocols.
-# Authentication can be embedded in the URL.
+# kiro-stack 用户请配置根目录的 .env 文件，无需配置此文件。
+# 账号凭证由 kiro-go 管理，通过 HTTP 头自动转发给 gateway。
 #
-# Examples:
-#   VPN_PROXY_URL="http://127.0.0.1:7890"
-#   VPN_PROXY_URL="socks5://127.0.0.1:1080"
-#   VPN_PROXY_URL="http://user:password@proxy.company.com:8080"
-#   VPN_PROXY_URL="192.168.1.100:8080"  # defaults to http://
+# 此文件仅用于 kiro-gateway 独立部署（不使用 kiro-go）。
+# 详见：https://github.com/jwadow/kiro-gateway
 #
-# VPN_PROXY_URL=""
+# ============================================
 
 # ===========================================
-# FIRST TOKEN TIMEOUT (Streaming Retry)
+# REQUIRED (独立部署时必填)
 # ===========================================
 
-# Timeout for waiting for the first token from the model (in seconds).
-# If the model doesn't respond within this time, the request will be cancelled and retried.
-# This helps handle "stuck" requests when the model takes too long to start responding.
-# Default: 15 seconds (recommended for production)
-# Set a lower value (e.g., 5-10) for more aggressive retry behavior.
-# FIRST_TOKEN_TIMEOUT="15"
-
-# Maximum number of retry attempts when first token timeout occurs.
-# After exhausting all attempts, a 504 Gateway Timeout error will be returned.
-# Default: 3 attempts
-# FIRST_TOKEN_MAX_RETRIES="3"
-
-# Read timeout for streaming responses (in seconds).
-# This is the maximum time to wait for data between chunks during streaming.
-# Should be longer than FIRST_TOKEN_TIMEOUT since the model may pause between chunks
-# while "thinking" (especially for tool calls or complex reasoning).
-# Default: 300 seconds (5 minutes) - generous timeout to avoid premature disconnects.
-# STREAMING_READ_TIMEOUT="300"
+# 访问密码（自定义）
+PROXY_API_KEY="my-super-secret-password-123"
 
 # ===========================================
-# FAKE REASONING (Extended Thinking via Tag Injection)
+# 账号凭证（独立部署时选择一种方式）
 # ===========================================
 
-# Enable fake reasoning - injects special tags into requests to enable model reasoning.
-# When enabled, the model will include its reasoning process in the response.
-# The response is then parsed and converted to OpenAI-compatible reasoning_content format.
-#
-# WHY "FAKE"? This is NOT native extended thinking API support. Instead, we inject
-# <thinking_mode>enabled</thinking_mode> tags into the prompt, and the model responds
-# with <thinking>...</thinking> blocks that we parse and convert to reasoning_content.
-# It works great, but it's a hack - hence "fake" reasoning.
-#
-# Default: true (ENABLED by default for premium experience out of the box)
-# To disable, set to false:
-# FAKE_REASONING=false
-
-# Maximum thinking length in tokens.
-# This value is injected into the request as <max_thinking_length>{value}</max_thinking_length>
-# Higher values allow for more detailed reasoning but increase response time and token usage.
-# Default: 4000 tokens
-# FAKE_REASONING_MAX_TOKENS=4000
-
-# How to handle the thinking block in responses:
-# - "as_reasoning_content": Extract to reasoning_content field (OpenAI-compatible, recommended)
-# - "remove": Remove thinking block completely, return only final answer
-# - "pass": Pass through as-is with original tags in content
-# - "strip_tags": Remove tags but keep thinking content in regular content
-#
-# Default: "as_reasoning_content"
-# FAKE_REASONING_HANDLING=as_reasoning_content
-
-# Maximum size of initial buffer for tag detection (characters).
-# The parser buffers this many characters before deciding if response contains thinking tags.
-# Lower values = faster first token appearance, but may miss tags with leading whitespace.
-# Default: 20 characters (enough for longest tag <reasoning> = 11 chars + some whitespace)
-# FAKE_REASONING_INITIAL_BUFFER_SIZE=20
+# 方式 1: JSON 凭证文件
+# KIRO_CREDS_FILE="~/.aws/sso/cache/kiro-auth-token.json"
 
-# ===========================================
-# TRUNCATION RECOVERY
-# ===========================================
+# 方式 2: Refresh Token
+# REFRESH_TOKEN="your_kiro_refresh_token_here"
 
-# Enable automatic truncation recovery when Kiro API cuts off large responses.
-# When the model generates large tool calls or content, the upstream API may truncate
-# the response mid-stream. This feature automatically notifies the model about truncation,
-# allowing it to adapt its approach (e.g., write smaller files, split operations).
-#
-# Default: true (ENABLED by default for better out-of-the-box experience)
-# TRUNCATION_RECOVERY=true
+# 方式 3: kiro-cli 数据库
+# KIRO_CLI_DB_FILE="~/.local/share/kiro-cli/data.sqlite3"
 
 # ===========================================
-# LOGGING
+# 可选配置
 # ===========================================
 
-# Log level: TRACE, DEBUG, INFO, WARNING, ERROR, CRITICAL
-# Default: INFO (recommended for production)
-# Set to DEBUG for detailed troubleshooting
-# LOG_LEVEL="INFO"
+# 代理设置（中国用户或网络受限时）
+# VPN_PROXY_URL=http://127.0.0.1:7890
 
-# ===========================================
-# DEBUG (for development only)
-# ===========================================
-
-# Debug logging mode:
-# - off: disabled (default)
-# - errors: save logs only for failed requests (4xx, 5xx) - recommended for troubleshooting
-# - all: save logs for every request (overwrites on each request)
+# 调试模式
 # DEBUG_MODE=off
-
-# Directory for debug log files
-# DEBUG_DIR="debug_logs"
diff --git a/kiro-gateway/kiro/config.py b/kiro-gateway/kiro/config.py
index 9f1f6ce..f630fa3 100644
--- a/kiro-gateway/kiro/config.py
+++ b/kiro-gateway/kiro/config.py
@@ -264,6 +264,8 @@ def _get_raw_env_value(var_name: str, env_file: str = ".env") -> Optional[str]:
     {"modelId": "claude-haiku-4.5"},
     {"modelId": "claude-sonnet-4.5"},
     {"modelId": "claude-opus-4.5"},
+    {"modelId": "claude-sonnet-4.6"},
+    {"modelId": "claude-opus-4.6"},
 ]
 
 # ==================================================================================================
diff --git a/kiro-gateway/kiro/http_client.py b/kiro-gateway/kiro/http_client.py
index 943fa49..e30f1b1 100644
--- a/kiro-gateway/kiro/http_client.py
+++ b/kiro-gateway/kiro/http_client.py
@@ -234,7 +234,12 @@ async def request_with_retry(
                 # 429 - rate limit, wait and retry
                 if response.status_code == 429:
                     delay = BASE_RETRY_DELAY * (2 ** attempt)
-                    logger.warning(f"Received 429, waiting {delay}s (attempt {attempt + 1}/{MAX_RETRIES})")
+                    try:
+                        await response.aread()
+                        _body = response.text[:500]
+                    except Exception:
+                        _body = "<无法读取响应体>"
+                    logger.warning(f"Received 429, waiting {delay}s (attempt {attempt + 1}/{MAX_RETRIES}) | body: {_body}")
                     await asyncio.sleep(delay)
                     continue
                 
diff --git a/kiro-gateway/main.py b/kiro-gateway/main.py
index e810eed..c85d74e 100644
--- a/kiro-gateway/main.py
+++ b/kiro-gateway/main.py
@@ -208,10 +208,17 @@ def validate_configuration() -> None:
     Checks:
     - Either REFRESH_TOKEN, KIRO_CREDS_FILE, or KIRO_CLI_DB_FILE is configured
     - Supports both .env file (local) and environment variables (Docker)
+    - When SKIP_STARTUP_CREDENTIAL_CHECK=true, skips credential check
+      (used in kiro-stack integrated mode where credentials come from kiro-go headers)
     
     Raises:
         SystemExit: If critical configuration is missing
     """
+    # 集成模式：凭证由 kiro-go 通过 X-Kiro-* 请求头动态传入，无需启动时校验
+    if os.getenv("SKIP_STARTUP_CREDENTIAL_CHECK", "").lower() in ("true", "1", "yes"):
+        logger.info("SKIP_STARTUP_CREDENTIAL_CHECK=true，跳过凭证校验（集成模式：凭证由请求头传入）")
+        return
+
     errors = []
     
     # Check if .env file exists (optional - can use environment variables)