@bitkyc08/opencodex 2.67.0 → 2.68.0

package/src/server/port-reclaim.ts

@@ -6,7 +6,9 @@
  * `killAllOcxOnPort`, and successful ocx verification. A historical PID allowlist
  * never overrides a rejected verifier result; rejected live holders stay protected.
  */
-import { execFileSync } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
+import { readFile, readdir, readlink } from "node:fs/promises";
+import { promisify } from "node:util";
 import { verifyPidIdentity } from "../config/process-state";
 import { isProcessAlive, killProxy } from "../lib/process-control";
 import { isPortAvailable, type WaitForPortOptions } from "./ports";
@@ -169,6 +171,114 @@ export function listListenPids(port: number): number[] {
   return scan.ok ? scan.pids : [];
 }
 
+const execFileAsync = promisify(execFile);
+const OWNER_LOOKUP_TIMEOUT_MS = 2_000;
+const MAX_PROC_NET_BYTES = 4 * 1024 * 1024;
+const MAX_PROCESS_FDS = 4_096;
+
+/** The exact IPv4 listener the Child relay contacts; ::1 and wildcard binds are not proof. */
+export function parseProcLoopbackListenInodes(tcp: string, tcp6: string, port: number): string[] {
+  const wantedPort = port.toString(16).toUpperCase().padStart(4, "0");
+  const inodes = new Set<string>();
+  for (const [content, wantedAddress] of [
+    [tcp, "0100007F"],
+    [tcp6, "0000000000000000FFFF00000100007F"], // ::ffff:127.0.0.1 in proc word order
+  ] as const) {
+    for (const line of content.split(/\r?\n/).slice(1)) {
+      const fields = line.trim().split(/\s+/);
+      const [address, hexPort] = (fields[1] ?? "").toUpperCase().split(":");
+      if (address !== wantedAddress || hexPort !== wantedPort || fields[3] !== "0A") continue;
+      const inode = fields[9];
+      if (inode && /^[1-9]\d*$/.test(inode)) inodes.add(inode);
+    }
+  }
+  return [...inodes];
+}
+
+/** Parse only 127.0.0.1:port LISTEN owners; an unrelated [::1]:port must not veto it. */
+export function parseIpv4LoopbackListenPidsFromNetstat(output: string, port: number): number[] {
+  const pids = new Set<number>();
+  for (const raw of output.split(/\r?\n/)) {
+    const fields = raw.trim().split(/\s+/);
+    if (fields[0]?.toUpperCase() !== "TCP" || fields[1] !== `127.0.0.1:${port}`) continue;
+    const state = fields[3] ?? "";
+    const foreign = fields[2] ?? "";
+    if (!/^LISTEN/i.test(state) && !["0.0.0.0:0", "[::]:0", "*:*"].includes(foreign)) continue;
+    const pid = Number(fields.at(-1));
+    if (Number.isSafeInteger(pid) && pid > 0) pids.add(pid);
+  }
+  return [...pids];
+}
+
+async function runOwnerLookup(file: string, args: string[], timeoutMs: number): Promise<string> {
+  const { stdout } = await execFileAsync(file, args, {
+    encoding: "utf8", timeout: timeoutMs, maxBuffer: MAX_PROC_NET_BYTES, windowsHide: true,
+  });
+  return stdout;
+}
+
+export interface LoopbackOwnerLookupIo {
+  platform?: NodeJS.Platform;
+  readProc?: (path: string) => Promise<string>;
+  listFds?: (path: string) => Promise<string[]>;
+  readFdLink?: (path: string) => Promise<string>;
+  run?: (file: string, args: string[], timeoutMs: number) => Promise<string>;
+}
+
+/** Async, bounded proof that this PID owns the IPv4 loopback LISTEN socket used by the relay. */
+export async function ownsIpv4LoopbackListener(
+  port: number,
+  expectedPid: number,
+  io: LoopbackOwnerLookupIo = {},
+): Promise<boolean> {
+  if (!Number.isInteger(port) || port < 1 || port > 65535
+    || !Number.isSafeInteger(expectedPid) || expectedPid < 1) return false;
+  const platform = io.platform ?? process.platform;
+  const lookup = async (): Promise<boolean> => {
+    if (platform === "linux") {
+      const readProc = io.readProc ?? (path => readFile(path, "utf8"));
+      const tcp = await readProc("/proc/net/tcp");
+      const tcp6 = await readProc("/proc/net/tcp6").catch(error => {
+        if ((error as NodeJS.ErrnoException).code === "ENOENT") return "";
+        throw error;
+      });
+      if (tcp.length > MAX_PROC_NET_BYTES || tcp6.length > MAX_PROC_NET_BYTES) return false;
+      const inodes = parseProcLoopbackListenInodes(tcp, tcp6, port);
+      if (inodes.length !== 1) return false;
+      const fdDir = `/proc/${expectedPid}/fd`;
+      const fds = await (io.listFds ?? readdir)(fdDir);
+      if (fds.length > MAX_PROCESS_FDS) return false;
+      const wanted = `socket:[${inodes[0]}]`;
+      const readFdLink = io.readFdLink ?? readlink;
+      for (const fd of fds) {
+        try { if (await readFdLink(`${fdDir}/${fd}`) === wanted) return true; }
+        catch { /* an fd may close while it is enumerated */ }
+      }
+      return false;
+    }
+    const run = io.run ?? runOwnerLookup;
+    if (platform === "darwin") {
+      const stdout = await run("/usr/sbin/lsof", ["-nP", "-a", `-iTCP@127.0.0.1:${port}`, "-sTCP:LISTEN", "-t"], OWNER_LOOKUP_TIMEOUT_MS);
+      const pids = new Set(stdout.split(/\r?\n/).map(line => Number(line.trim())).filter(pid => Number.isSafeInteger(pid) && pid > 0));
+      return pids.size === 1 && pids.has(expectedPid);
+    }
+    if (platform === "win32") {
+      const netstat = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\netstat.exe`;
+      const stdout = await run(netstat, ["-ano", "-p", "tcp"], OWNER_LOOKUP_TIMEOUT_MS);
+      const pids = parseIpv4LoopbackListenPidsFromNetstat(stdout, port);
+      return pids.length === 1 && pids[0] === expectedPid;
+    }
+    return false;
+  };
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const deadline = new Promise<false>(resolve => {
+    timer = setTimeout(() => resolve(false), OWNER_LOOKUP_TIMEOUT_MS);
+    timer.unref?.();
+  });
+  try { return await Promise.race([lookup().catch(() => false), deadline]); }
+  finally { if (timer) clearTimeout(timer); }
+}
+
 /**
  * Wait until `port` can bind.
  * Never kills a process unless `killOcxHolders === true` and either

package/src/server/proxy-liveness.ts

@@ -182,6 +182,22 @@ export interface LiveProxy {
   packageTreeFenced?: true;
 }
 
+/**
+ * A /healthz identity proves only that a proxy holds the port. Before a destructive orphan stop,
+ * require that listener to prove possession of this home's runtime-record secret as well.
+ */
+export async function proveLiveProxyOwnedByHome(live: LiveProxy, io: LivenessIo = {}): Promise<boolean> {
+  if (live.pid === null) return false;
+  return attestFencedIdentity(
+    `http://${probeHostname(live.hostname)}:${live.port}/healthz`,
+    live.port,
+    live.pid,
+    io,
+    io.fetchFn ?? directLocalHttpFetch,
+    io.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS,
+  );
+}
+
 /**
  * Host to probe for a given bind hostname: wildcards answer on IPv4 loopback, and raw
  * IPv6 addresses must be bracketed or the composed URL is invalid.

package/src/server/relay.ts

@@ -1624,6 +1624,21 @@ export const CODEX_SAFETY_BUFFERING_HEADERS = [
 
 const CODEX_SAFETY_BUFFERING_HEADER_SET: ReadonlySet<string> = new Set(CODEX_SAFETY_BUFFERING_HEADERS);
 
+const PASSTHROUGH_DROP_HEADERS: ReadonlySet<string> = new Set([
+  "content-encoding",
+  "content-length",
+  "transfer-encoding",
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "set-cookie",
+  "set-cookie2",
+  "te",
+  "trailer",
+  "upgrade",
+]);
+
 export interface CodexSafetyBufferingFilterOptions {
   /**
    * Drop Codex safety-buffering hints: the `x-codex-safety-buffering-*` response
@@ -1642,24 +1657,10 @@ export function codexSafetyBufferingFilterOptions(
 
 export function sanitizePassthroughHeaders(upstream: Headers, options?: CodexSafetyBufferingFilterOptions): Headers {
   const dropSafetyBuffering = options?.dropCodexSafetyBuffering === true;
-  const DROP = new Set([
-    "content-encoding",
-    "content-length",
-    "transfer-encoding",
-    "connection",
-    "keep-alive",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "set-cookie",
-    "set-cookie2",
-    "te",
-    "trailer",
-    "upgrade",
-  ]);
   const out = new Headers();
   upstream.forEach((value, key) => {
     const lower = key.toLowerCase();
-    if (DROP.has(lower)) return;
+    if (PASSTHROUGH_DROP_HEADERS.has(lower)) return;
     if (dropSafetyBuffering && CODEX_SAFETY_BUFFERING_HEADER_SET.has(lower)) return;
     out.set(key, value);
   });

package/src/server/request-log-filter.ts

@@ -22,49 +22,49 @@ export function matchesProtocolMode(entry: Pick<RequestLogEntry, "protocolTrace"
   return isDeliveryMode(mode) && entry.protocolTrace?.mode === mode;
 }
 
-export function filterRequestLogs(logs: RequestLogEntry[], params: URLSearchParams): RequestLogEntry[] {
-  let filtered = logs;
+export function queryRequestLogs(
+  logs: RequestLogEntry[],
+  params: URLSearchParams,
+): { total: number; logs: RequestLogEntry[] } {
   const provider = params.get("provider")?.trim();
-  if (provider) {
-    filtered = filtered.filter(entry => entry.provider === provider
-      || entry.attempts?.some(attempt => attempt.provider === provider));
-  }
   const conversationId = params.get("conversationId")?.trim() || params.get("conversation")?.trim();
-  if (conversationId) {
-    filtered = filtered.filter(entry => matchesLogConversationId(entry.conversationId, conversationId));
-  }
   // #2704: there was no `model` clause at all, so `?model=x` was ACCEPTED and silently
   // ignored -- worse than an error, because it yields wrong conclusions from output that
   // looks correct. Attempts are matched for the same reason `provider` matches them: a
   // request that failed over should be findable by the model that actually served it.
   const model = params.get("model")?.trim();
-  if (model) {
-    filtered = filtered.filter(entry => entry.model === model
-      || entry.attempts?.some(attempt => attempt.model === model));
-  }
   // #4057: "which account served this request" is the first question asked when one provider
   // holds several accounts, and until now the only way to answer it was to grep usage.jsonl by
   // hand. Attempts are matched for the same reason `provider` and `model` match them: when a
   // request failed over between pool accounts, a search for the account that finally served it
   // has to find that request, not only the account that first refused it.
   const account = params.get("account")?.trim();
-  if (account) {
-    filtered = filtered.filter(entry => entry.accountLogLabel === account
-      || entry.attempts?.some(attempt => attempt.accountLogLabel === account));
-  }
   const protocolMode = params.get("protocolMode")?.trim().toLowerCase();
-  if (protocolMode) filtered = filtered.filter(entry => matchesProtocolMode(entry, protocolMode));
   const status = params.get("status")?.trim().toLowerCase();
-  if (status) {
-    filtered = /^[1-5]xx$/.test(status)
-      ? filtered.filter(entry => Math.floor(entry.status / 100) === Number(status[0]))
-      : filtered.filter(entry => String(entry.status) === status);
+
+  const hasFilters = Boolean(provider || conversationId || model || account || protocolMode || status);
+  let filtered: RequestLogEntry[];
+  if (!hasFilters) {
+    filtered = logs;
+  } else {
+    const statusClass = status && /^[1-5]xx$/.test(status) ? Number(status[0]) : undefined;
+    filtered = [];
+    for (const entry of logs) {
+      if (provider && entry.provider !== provider && !entry.attempts?.some(attempt => attempt.provider === provider)) continue;
+      if (conversationId && !matchesLogConversationId(entry.conversationId, conversationId)) continue;
+      if (model && entry.model !== model && !entry.attempts?.some(attempt => attempt.model === model)) continue;
+      if (account && entry.accountLogLabel !== account && !entry.attempts?.some(attempt => attempt.accountLogLabel === account)) continue;
+      if (protocolMode && !matchesProtocolMode(entry, protocolMode)) continue;
+      if (status && (statusClass === undefined ? String(entry.status) !== status : Math.floor(entry.status / 100) !== statusClass)) continue;
+      filtered.push(entry);
+    }
   }
   const tailRaw = params.get("tail")?.trim();
   if (tailRaw) {
     const tail = Number.parseInt(tailRaw, 10);
     if (Number.isFinite(tail) && tail > 0) filtered = filtered.slice(-Math.min(tail, MAX_LOG_SIZE));
   }
+  const total = filtered.length;
   const offsetRaw = params.get("offset")?.trim();
   const limitRaw = params.get("limit")?.trim();
   if (limitRaw) {
@@ -81,12 +81,13 @@ export function filterRequestLogs(logs: RequestLogEntry[], params: URLSearchPara
       }
     }
   }
-  return filtered;
+  return { total, logs: filtered };
+}
+
+export function filterRequestLogs(logs: RequestLogEntry[], params: URLSearchParams): RequestLogEntry[] {
+  return queryRequestLogs(logs, params).logs;
 }
 
 export function filteredRequestLogCount(logs: RequestLogEntry[], params: URLSearchParams): number {
-  const withoutPagination = new URLSearchParams(params);
-  withoutPagination.delete("limit");
-  withoutPagination.delete("offset");
-  return filterRequestLogs(logs, withoutPagination).length;
+  return queryRequestLogs(logs, params).total;
 }

package/src/server/request-log.ts

@@ -73,11 +73,12 @@ import {
   type UsageDebugBodyKind,
 } from "../usage/debug";
 import { MAX_LOG_SIZE } from "./request-log-filter";
-export { filterRequestLogs, filteredRequestLogCount } from "./request-log-filter";
+export { filterRequestLogs, filteredRequestLogCount, queryRequestLogs } from "./request-log-filter";
 import { enforceAppOwnedMemoryBudget, type RetainedStoreSnapshot } from "../lib/app-owned-memory";
 import { capEstimateAtContextWindow } from "../lib/token-estimate";
 import { inferCursorContextWindow } from "../adapters/cursor/discovery";
 import { KIRO_MODEL_CONTEXT_WINDOWS, normalizeKiroModelId } from "../providers/kiro-models";
+import { kiroObservedContextWindow } from "../providers/kiro-model-catalog";
 import { DEVIN_MODEL_CONTEXT_WINDOWS } from "../adapters/devin/live-models";
 import { modelRecordValue } from "../reasoning-effort";
 import {
@@ -1629,7 +1630,8 @@ function contextWindowForModel(adapter: string, modelId: string | undefined): nu
   if (adapter === "kiro" || adapter.startsWith("kiro-")) {
     const normalized = normalizeKiroModelId(modelId);
     if (normalized === "auto") return undefined;
-    return modelRecordValue(KIRO_MODEL_CONTEXT_WINDOWS, modelId)
+    return kiroObservedContextWindow(modelId)
+      ?? modelRecordValue(KIRO_MODEL_CONTEXT_WINDOWS, modelId)
       ?? modelRecordValue(KIRO_MODEL_CONTEXT_WINDOWS, normalized);
   }
   if (adapter === "cursor" || adapter.startsWith("cursor-")) {
@@ -1905,7 +1907,7 @@ export function aggregateAttemptUsage(
 
   const sumOptional = (
     key: "cachedInputTokens" | "cacheReadInputTokens" | "cacheCreationInputTokens"
-      | "reasoningOutputTokens",
+      | "reasoningOutputTokens" | "providerCredits",
   ): number | undefined => {
     const present = usages.flatMap(usage => (
       typeof usage[key] === "number" ? [usage[key] as number] : []
@@ -1916,6 +1918,7 @@ export function aggregateAttemptUsage(
   const cacheReadInputTokens = sumOptional("cacheReadInputTokens");
   const cacheCreationInputTokens = sumOptional("cacheCreationInputTokens");
   const reasoningOutputTokens = sumOptional("reasoningOutputTokens");
+  const providerCredits = sumOptional("providerCredits");
   const totalTokens = usages.reduce(
     (sum, usage) => sum + (usageTotalTokens(usage) ?? 0),
     0,
@@ -1928,6 +1931,7 @@ export function aggregateAttemptUsage(
     ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {}),
     ...(cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens } : {}),
     ...(reasoningOutputTokens !== undefined ? { reasoningOutputTokens } : {}),
+    ...(providerCredits !== undefined ? { providerCredits } : {}),
     ...(status === "estimated" ? { estimated: true } : {}),
   };
   return { usage: aggregate, status, totalTokens };

package/src/server/request-metrics.ts

@@ -1,4 +1,5 @@
 import type { ResponsesTerminalStatus } from "../bridge";
+import type { KiroQuotaMetricRow } from "../providers/kiro-quota-metrics";
 import type { AttemptRecoveryKind } from "../usage/log";
 import {
   REQUEST_FAILURE_CAUSES,
@@ -188,8 +189,34 @@ function appendHistogram(
   }
 }
 
+function appendKiroQuotaGauges(lines: string[], rows: readonly KiroQuotaMetricRow[]): void {
+  const families = [
+    ["opencodex_kiro_quota_used_credits", "Cached Kiro plan credits used.", "used"],
+    ["opencodex_kiro_quota_limit_credits", "Cached Kiro plan credit limit.", "limit"],
+    ["opencodex_kiro_quota_used_percent", "Cached Kiro plan percent used.", "percent"],
+    ["opencodex_kiro_quota_seconds_to_reset", "Seconds until the observed Kiro reset.", "secondsToReset"],
+  ] as const;
+  const labels = new Set<string>();
+  const valid = rows.slice(0, 32).filter(row => {
+    if (!/^o[0-9a-f]{6}$/.test(row.account) || labels.has(row.account)) return false;
+    if (![row.used, row.limit, row.percent].every(value => Number.isFinite(value) && value >= 0)) return false;
+    if (row.limit <= 0 || row.percent > 100) return false;
+    labels.add(row.account);
+    return true;
+  });
+  for (const [name, help, key] of families) {
+    lines.push(`# HELP ${name} ${help}`, `# TYPE ${name} gauge`);
+    for (const row of valid) {
+      const value = row[key];
+      if (typeof value === "number" && Number.isFinite(value) && value >= 0)
+        lines.push(`${name}{account="${row.account}"} ${value}`);
+    }
+  }
+}
+
 export function createRequestMetricsOwner(
   processStartTimeSeconds = Date.now() / 1000,
+  kiroQuotaRows?: () => readonly KiroQuotaMetricRow[],
 ): RequestMetricsOwner {
   let logicalRequests = matrix(REQUEST_METRICS_PROTOCOLS.length, REQUEST_METRICS_RESULTS.length);
   let physicalSends = Array.from({ length: REQUEST_METRICS_PROTOCOLS.length }, () => 0);
@@ -282,6 +309,7 @@ export function createRequestMetricsOwner(
           lines.push(`opencodex_ttft_missing_total${sampleLabels(protocol, result)} ${missingTtft[protocolCell(protocol)]![resultCell(result)]}`);
         }
       }
+      appendKiroQuotaGauges(lines, kiroQuotaRows?.() ?? []);
       lines.push(
         "# HELP opencodex_metrics_process_start_time_seconds Unix time when this process metrics owner started.",
         "# TYPE opencodex_metrics_process_start_time_seconds gauge",

package/src/server/responses/adapter-continuation.ts

@@ -14,7 +14,7 @@ import {
   recordAttemptCredentialSource,
 } from "../request-log";
 import { noteAttemptRecoveryWithheld } from "../request-log";
-import { waitForProviderRequestSlot } from "../../providers/request-pacing";
+import { withProviderRequestSlot } from "../../providers/request-pacing";
 import { providerFetch, fetchWithHeaderTimeout, safeHostLabel } from "./fetch-helpers";
 import {
   transientRetryPolicyFor,
@@ -39,12 +39,17 @@ import {
   formatAnthropicProviderForLog,
 } from "../../oauth/anthropic-routing";
 import {
-  GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
   hasEligibleGenericOAuthFailoverTarget,
   isGenericOAuthFailoverEnabled,
   rotateGenericOAuthAccountOn429,
+  rotateGenericOAuthAccountOnRefusal,
+  quarantineKiroSuspendedAccount,
   failoverAccountSnapshot,
 } from "../../oauth/generic-account-failover";
+import { classifyKiroRefusal } from "../../adapters/kiro-refusal";
+import { normalizeFinalKiroHttpError } from "../../adapters/kiro-retry";
+import { noteKiroMonthlyRefusal } from "../../providers/kiro-usage";
+import { persistKiroAccountState } from "../../providers/kiro-account-state-disk";
 import { shouldAttemptImageTierRetry } from "../image-retry";
 import { readDisplaySafeErrorText, normalizeUpstreamErrorText } from "./core-errors";
 import { isCyberPolicyCode, CYBER_POLICY_FALLBACK_MESSAGE, CYBER_POLICY_ERROR_CODE } from "../../lib/errors";
@@ -53,7 +58,7 @@ import {
   readResponseStreamWithInactivity,
   ResponseBodyInactivityError,
 } from "../../lib/response-body-inactivity";
-import { resolveStallTimeoutSec } from "../../stall-timeout";
+import { resolveStallTimeoutMs } from "../../stall-timeout";
 import { guardTerminalEventStream } from "./terminal-guard";
 
 /** One responsibility of the Responses request pipeline; state owners are explicit. */
@@ -84,6 +89,7 @@ export function createAdapterContinuations(
     | "commitResolvedOAuthSelection"
     | "genericFailoverAccountId"
     | "genericFailovers"
+    | "genericFailoverLimit"
     | "applyFailoverSnapshot"
     | "replayOAuthCredentialSnapshot"
     | "noteRoutedAttemptSend"
@@ -107,7 +113,8 @@ export function createAdapterContinuations(
     | "rateLimitPolicy"
     | "rateLimitRetries"
     | "stallTimeoutMs"
-  >,
+    | "localUpstream"
+   >,
 ) {
   const { options, logCtx, config } = requestContext;
   const {
@@ -120,8 +127,8 @@ export function createAdapterContinuations(
   } = transportState;
   const { route, translatorBudget, inboundWire, parsed } = requestState;
   const { routedCompaction } = sidecarState;
-  const { upstream, connectMs, rateLimitPolicy, stallTimeoutMs } = adapterExchange;
-  const bodyInactivityMs = resolveStallTimeoutSec(config.stallTimeoutSec) * 1000;
+  const { upstream, connectMs, rateLimitPolicy, stallTimeoutMs, localUpstream } = adapterExchange;
+  const bodyInactivityMs = resolveStallTimeoutMs(config.stallTimeoutSec, { localUpstream });
   const {
     adapterDispatchBudget,
     noteAdapterPhysicalSend,
@@ -151,6 +158,8 @@ export function createAdapterContinuations(
     initialRecoveryKind?: AttemptRecoveryKind,
   ): AsyncGenerator<AdapterEvent> {
     let response: Response | undefined;
+    let kiroRefusalPendingReplay: Response | undefined;
+    let kiroReplaySetupFailed = false;
     // One-shot recovery label for the next top-of-loop continuation send after a failover rotation.
     let nextContinuationRecoveryKind: AttemptRecoveryKind | undefined = initialRecoveryKind;
     /**
@@ -198,21 +207,23 @@ export function createAdapterContinuations(
       try {
         if (transportState.activeAdapter.fetchResponse) {
           transportState.noteRoutedAttemptSend(continuationEstimate, replayKind);
-          await waitForProviderRequestSlot(route.providerName, route.provider, nextParsed.modelId, upstream.signal);
-          return await transportState.activeAdapter.fetchResponse(builtContinuationRequest, {
-            abortSignal: upstream.signal,
-            timeoutMs: connectMs,
+          return await withProviderRequestSlot(route.providerName, route.provider, nextParsed.modelId, upstream.signal, pacingSlot =>
+            transportState.activeAdapter.fetchResponse!(builtContinuationRequest, {
+              kiroPreferAccountFailover: route.providerName === "kiro" && isGenericOAuthFailoverEnabled(config, "kiro"),
+              abortSignal: upstream.signal,
+              timeoutMs: connectMs,
               sendBudget: adapterDispatchBudget,
-            onPhysicalSend: send => noteAdapterPhysicalSend(continuationEstimate, send),
-            onRecoveryWithheld: noteAdapterRecoveryWithheld,
-            stream: nextParsed.stream,
-            executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
-              pacingSlotAcquired: true,
-              dispatchOverride: oauthDispatch(builtContinuationRequest, nextParsed),
-              providerName: route.providerName,
-              modelId: nextParsed.modelId,
-            }),
-          });
+              onPhysicalSend: send => noteAdapterPhysicalSend(continuationEstimate, send),
+              onRecoveryWithheld: noteAdapterRecoveryWithheld,
+              stream: nextParsed.stream,
+              executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+                pacingSlotAcquired: true,
+                pacingSlot,
+                dispatchOverride: oauthDispatch(builtContinuationRequest, nextParsed),
+                providerName: route.providerName,
+                modelId: nextParsed.modelId,
+              }),
+            }));
         }
         // Same #1851 scope guard as the initial send: transient-5xx retry only for direct
         // Google AI Studio; every other adapter keeps reset-only semantics here.
@@ -263,13 +274,26 @@ export function createAdapterContinuations(
         const recoveryKind = nextContinuationRecoveryKind;
         nextContinuationRecoveryKind = undefined;
         response = await fetchContinuation(recoveryKind);
+        if (kiroRefusalPendingReplay) {
+          try { void kiroRefusalPendingReplay.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+          kiroRefusalPendingReplay = undefined;
+          sendBudgetState.pendingHopPermit = undefined;
+        }
       } catch (error) {
+        if (kiroRefusalPendingReplay && !options.abortSignal?.aborted && !upstream.signal.aborted) {
+          sendBudgetState.pendingHopPermit?.release();
+          sendBudgetState.pendingHopPermit = undefined;
+          response = kiroRefusalPendingReplay;
+          kiroRefusalPendingReplay = undefined;
+          kiroReplaySetupFailed = true;
+        } else {
         if (options.abortSignal?.aborted || upstream.signal.aborted) {
           yield { type: "error", message: "client closed request during terminal continuation", status: 499 };
         } else {
           yield { type: "error", message: `Provider continuation failed: ${redactSecretString(error instanceof Error ? error.message : String(error))}` };
         }
         return;
+        }
       }
 
       // Same-target 429 wait-and-retry (opt-in `retryOn429`) before key/account failover:
@@ -277,6 +301,7 @@ export function createAdapterContinuations(
       // loop; only after the attempts are exhausted does the continuation fail over.
      while (
        response.status === 429
+        && !kiroReplaySetupFailed
         // A synthesized replay refusal is not a rate limit; replaying the continuation on
         // it would re-send a turn whose first send may already have been processed.
         && !isNonReplayableResponse(response)
@@ -402,11 +427,114 @@ export function createAdapterContinuations(
       // 429 stayed terminal even with failover fully active -- the same class of divergence the
       // two sidecars already produced once. Request-local state is shared with the other arms so
       // the per-request bound cannot be silently re-armed by reaching a different loop.
+      if (route.providerName === "kiro") {
+     if (
+       (response.status === 429 || response.status === 400 || response.status === 403)
+       && transportState.genericFailoverAccountId
+        && !isNonReplayableResponse(response)
+        && !kiroReplaySetupFailed
+      ) {
+        const refusal = classifyKiroRefusal(response.status,
+          await readDisplaySafeErrorText(response.clone(), upstream.signal, ""));
+        if (refusal.kind === "other") break;
+        const sent = transportState.replayOAuthCredentialSnapshot;
+        const monthlyCooldownMs = refusal.kind === "monthly_quota" && sent
+          ? noteKiroMonthlyRefusal(sent.accountId, sent.generation, Date.now()) : undefined;
+        if (monthlyCooldownMs !== undefined) persistKiroAccountState();
+        if (refusal.kind === "suspended")
+          quarantineKiroSuspendedAccount(transportState.genericFailoverAccountId, sent?.generation);
+        if (transportState.genericFailovers >= transportState.genericFailoverLimit
+          || !isGenericOAuthFailoverEnabled(config, "kiro")) break;
+        // Intersection with the shared request budget. The continuation loop re-sends the
+        // turn, so without this the per-request bound could be re-armed simply by reaching a
+        // different loop -- which is the divergence the comment above already warns about.
+        //
+        // Who settles the reservation depends on who sends the replay (#4709). An adapter that
+        // owns its ladder reserves once per physical send and would charge this replay twice;
+        // the helper path reports it back instead, which is what `countedExternally` names.
+        const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
+        const hop = reserveCredentialHop(
+          "auth-recovery",
+          `${route.providerName}|${route.modelId}|continuation-oauth-429`,
+          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+        );
+        const nextAccountId = hop.allowed
+          ? rotateGenericOAuthAccountOnRefusal(
+            config,
+            route.providerName,
+            transportState.genericFailoverAccountId,
+            refusal.kind,
+            response.headers.get("retry-after"),
+            Date.now(),
+            route.modelId,
+            monthlyCooldownMs,
+          )
+          : null;
+        // A roster quorum ignores cooldowns, so only attribute a budget refusal when the
+        // non-mutating selector confirms that an alternate account could serve this model now.
+        if (!hop.allowed && hasEligibleGenericOAuthFailoverTarget(
+          route.providerName, transportState.genericFailoverAccountId, Date.now(), route.modelId,
+        )) noteAttemptRecoveryWithheld(logCtx.activeAttempt, "rotation-send-budget");
+        if (!nextAccountId) hop.permit?.release();
+        if (nextAccountId) {
+          try {
+            // The FULL snapshot through the shared helper, never a bare bearer: Antigravity
+            // pairs an account-matched projectId with its token and Kiro carries routing
+            // metadata, so a token-only swap would mix one account's credential with another's
+            // routing data.
+            const snapshot = await failoverAccountSnapshot(route.providerName, nextAccountId);
+            const applied = await applyFailoverSnapshot(snapshot, nextParsed);
+            if (!applied) hop.permit?.release();
+            if (applied) {
+              transportState.genericFailovers += 1;
+              invalidateSameTargetRequest();
+              transportState.activeAdapter = resolveSelectionAdapter(
+                resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
+                config.cacheRetention,
+              );
+              bindRouteReasoningReplayScope({
+                parsed: nextParsed,
+                providerName: route.providerName,
+                provider: route.provider,
+                adapterName: transportState.activeAdapter.name,
+                oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+              });
+              // Response persistence closes over the outer parsed request; keep its owner binding in
+              // sync with the terminal-guard clone that builds the rotated continuation request.
+              bindRouteReasoningReplayScope({
+                parsed,
+                providerName: route.providerName,
+                provider: route.provider,
+                adapterName: transportState.activeAdapter.name,
+                oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+              });
+              sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
+              recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
+              // The replay goes out on the next iteration. An adapter that owns its ladder
+              // reserves for that send itself, so hand this reservation down rather than let it
+              // take a second one for the same replay. A helper-routed replay needs no handoff:
+              // its reporter settles the booking made above.
+              if (adapterOwnsDispatch) sendBudgetState.pendingHopPermit = hop.permit;
+              nextContinuationRecoveryKind = "oauth-account-429";
+              kiroRefusalPendingReplay = response;
+              continue;
+            }
+          } catch {
+            // Everything in this try runs before the replay: the send happens on the next
+            // iteration, after `continue`. A throw here therefore leaves a reservation that
+            // never dispatched, and holding it would refuse a later recovery in this same
+            // request for a send that never left the process.
+            hop.permit?.release();
+            // fall through to emit continuation error below
+          }
+        }
+      }
+      } else {
      if (
        response.status === 429
        && transportState.genericFailoverAccountId
         && !isNonReplayableResponse(response)
-       && transportState.genericFailovers < GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
+       && transportState.genericFailovers < transportState.genericFailoverLimit
         && isGenericOAuthFailoverEnabled(config, route.providerName)
       ) {
         // Intersection with the shared request budget. The continuation loop re-sends the
@@ -491,6 +619,7 @@ export function createAdapterContinuations(
           }
         }
       }
+      }
       if (shouldAttemptImageTierRetry({
         status: response.status,
         adapterName: transportState.activeAdapter.name,
@@ -507,6 +636,7 @@ export function createAdapterContinuations(
     }
 
     if (!response.ok) {
+      if (route.providerName === "kiro") response = await normalizeFinalKiroHttpError(response, upstream.signal);
       const errorText = await readDisplaySafeErrorText(response, upstream.signal, "unknown error");
       const normalized = normalizeUpstreamErrorText(errorText, "unknown error");
       yield {