@bitkyc08/opencodex 2.67.0 → 2.68.0

package/src/server/responses/fetch-helpers.ts

@@ -8,10 +8,16 @@ import {
 } from "./ws-upstream";
 import type { OcxProviderConfig } from "../../types";
 import type { WsData } from "../ws-bridge";
-import { waitForProviderRequestSlot } from "../../providers/request-pacing";
+import {
+  requestPacingMaxConcurrentRequests,
+  sendTrackingRequestSlot,
+  waitForProviderRequestSlot,
+  type ProviderRequestSlot,
+} from "../../providers/request-pacing";
 import { withUpstreamHttpVersion } from "../../lib/upstream-http-version";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { configuredOutboundFetch } from "../../lib/proxy-env";
+import { isLoopbackUrl, rewriteUpstream } from "../../plugins/upstream-hooks";
 import {
   describeProviderEgressForLog,
   markEgressTransparentExecutor,
@@ -27,6 +33,7 @@ export { withUpstreamHttpVersion };
 const egressWebsocketDowngradeWarned = new Set<string>();
 /** A provider name is configuration-controlled, so the notice set is bounded like any cache. */
 const EGRESS_DOWNGRADE_NOTICE_LIMIT = 64;
+const pacingWebsocketDowngradeWarned = new Set<string>();
 /**
  * Marks an init whose provider egress route an outer physical-send boundary already decided.
  *
@@ -34,6 +41,7 @@ const EGRESS_DOWNGRADE_NOTICE_LIMIT = 64;
  * `dispatchOverride` performs, and an unknown symbol on a `RequestInit` is inert at the wire.
  */
 const EGRESS_DECIDED = Symbol.for("opencodex.provider-egress.decided");
+const UPSTREAM_REWRITTEN = Symbol.for("opencodex.plugins.upstream-rewritten");
 
 /**
  * Announce once, per provider, that an explicit egress route moved this provider off the
@@ -61,6 +69,7 @@ function warnEgressWebsocketDowngradeOnce(providerName: string, egress: string):
 /** Test seam: the downgrade notice is once per provider per process, not once per request. */
 export function __resetEgressWebsocketDowngradeNotices(): void {
   egressWebsocketDowngradeWarned.clear();
+  pacingWebsocketDowngradeWarned.clear();
 }
 
 export function disableResponsesRequestTimeout(req: Request, server: Pick<Server<WsData>, "timeout"> | undefined): boolean {
@@ -121,7 +130,7 @@ export function wantsFreshConnection(
 
 
 export interface PaceAwareFetch {
-  waitForPacing?: (signal?: AbortSignal) => Promise<void>;
+  waitForPacing?: (signal?: AbortSignal) => Promise<ProviderRequestSlot | undefined>;
   unpacedFetch?: typeof globalThis.fetch;
 }
 
@@ -143,11 +152,28 @@ export type ProviderFetch = typeof globalThis.fetch & PaceAwareFetch;
  */
 export function sendWithConnectionPolicy(
   physicalFetch: typeof globalThis.fetch,
-  input: Parameters<typeof globalThis.fetch>[0],
+  rawInput: Parameters<typeof globalThis.fetch>[0],
   init?: RequestInit,
   egress?: ProviderEgressBinding,
 ): Promise<Response> {
-  const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+  let input = rawInput;
+  let headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+  // Plugin rewrites (src/plugins/upstream-hooks.ts) run here, after the caller chose between
+  // the Codex WebSocket and HTTP, and before the connection and egress decisions below so
+  // those follow the rewritten destination. Nested passes rewrite once, like the egress mark.
+  // A rewrite onto this machine's loopback dials directly: a proxy chosen for the provider
+  // (per-provider or HTTP_PROXY) cannot reach a local sidecar. The WebSocket dial does the same.
+  const rewriteDone = (init as Record<symbol, unknown> | undefined)?.[UPSTREAM_REWRITTEN] === true;
+  let redirectedToLoopback = false;
+  if (!rewriteDone) {
+    const original = input instanceof Request ? input.url : String(input);
+    const target = rewriteUpstream(original, headers, "http");
+    headers = target.headers as Headers;
+    if (target.url !== original) {
+      redirectedToLoopback = isLoopbackUrl(target.url);
+      input = input instanceof Request ? new Request(target.url, input) : target.url;
+    }
+  }
   const fresh = wantsFreshConnection(input);
   if (fresh) {
     headers.set("Connection", "close");
@@ -161,15 +187,18 @@ export function sendWithConnectionPolicy(
   // the reselected provider and the rebuilt destination, so it decides and marks the init; the
   // inner pass honours that mark rather than recomputing from a stale closure.
   const alreadyDecided = (init as Record<symbol, unknown> | undefined)?.[EGRESS_DECIDED] === true;
-  const decide = egress !== undefined && !alreadyDecided;
-  const egressInit = decide ? providerEgressSendInit(egress, physicalFetch, input) : {};
+  const decide = egress !== undefined && !alreadyDecided && !redirectedToLoopback;
+  const egressInit = redirectedToLoopback
+    ? { proxy: false as const }
+    : decide ? providerEgressSendInit(egress, physicalFetch, input) : {};
   return physicalFetch(input, {
     ...init,
     headers,
     redirect: "manual",
     ...(fresh ? { keepalive: false } : {}),
     ...egressInit,
-    ...(decide ? { [EGRESS_DECIDED]: true } : {}),
+    ...(decide || redirectedToLoopback ? { [EGRESS_DECIDED]: true } : {}),
+    ...{ [UPSTREAM_REWRITTEN]: true },
   });
 }
 
@@ -187,6 +216,9 @@ export interface ProviderFetchOptions {
   modelId?: string;
   /** One pacing slot was acquired immediately before this fetch wrapper was created. */
   pacingSlotAcquired?: boolean;
+  pacingSlot?: ProviderRequestSlot;
+  /** A runTurn transport holds one concurrency lease across overlapping physical sends. */
+  turnScopedPacing?: boolean;
   /** Captured selected-account observer, attached before the native WS send. */
   onCodexWsQuota?: CodexWsQuotaObserver;
   /** Synchronous admission at actual credential dispatch, after pacing/backoff. */
@@ -271,6 +303,14 @@ export function providerFetch(
     const upstreamWebsocket = provider.upstreamWebsocket;
     if (!options.httpOnly && typeof input === "string" && init
       && shouldUseCodexWsUpstream(input, init, runtime, upstreamWebsocket)) {
+      if (options.providerName && requestPacingMaxConcurrentRequests(provider, options.modelId) > 0) {
+        if (!pacingWebsocketDowngradeWarned.has(providerName)
+          && pacingWebsocketDowngradeWarned.size < EGRESS_DOWNGRADE_NOTICE_LIMIT) {
+          pacingWebsocketDowngradeWarned.add(providerName);
+          console.warn(`[opencodex] provider ${JSON.stringify(redactSecretString(providerName))} has a request concurrency cap; serving over HTTP/SSE.`);
+        }
+        return httpFetch(input, init);
+      }
       const egress = egressFor(input);
       if (providerEgressIsExplicit(egress)) {
         warnEgressWebsocketDowngradeOnce(providerName, describeProviderEgressForLog(egress));
@@ -281,23 +321,33 @@ export function providerFetch(
       // request over HTTP, and dropping the provider's `upstreamHttpVersion`
       // there would silently negotiate a transport the operator ruled out.
       return codexWsUpstreamFetch(input, init, httpFetch, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
-        () => waitForPacing(init.signal ?? undefined));
+        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); });
     }
     return httpFetch(input, init);
   };
   let pacingSlotAcquired = options.pacingSlotAcquired === true;
-  const waitForPacing = (signal?: AbortSignal) => {
+  const waitForPacing = async (signal?: AbortSignal): Promise<ProviderRequestSlot | undefined> => {
     if (pacingSlotAcquired) {
       pacingSlotAcquired = false;
-      return Promise.resolve();
+      if (!options.pacingSlot && requestPacingMaxConcurrentRequests(provider, options.modelId) > 0) {
+        throw new Error("A pre-acquired concurrency slot must be passed to providerFetch");
+      }
+      // Cursor RunSSE and BidiAppend can overlap. The runTurn owner releases this slot when
+      // the whole turn finishes; transferring it to RunSSE's body would admit another turn
+      // while a BidiAppend from this one is still active.
+      return options.turnScopedPacing ? undefined : options.pacingSlot;
+    }
+    if (options.providerName) {
+      return waitForProviderRequestSlot(options.providerName, provider, options.modelId, signal,
+        options.turnScopedPacing && options.pacingSlot?.leased && !options.pacingSlot.released
+          ? { concurrency: false } : undefined);
+    }
+    if (requestPacingMaxConcurrentRequests(provider, options.modelId) > 0) {
+      throw new Error("A provider name is required for request concurrency pacing");
     }
-    return options.providerName
-      ? waitForProviderRequestSlot(options.providerName, provider, options.modelId, signal)
-      : Promise.resolve();
   };
   const wrapped = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
-    await waitForPacing(init?.signal ?? undefined);
-    return unpaced(input, init);
+    return sendTrackingRequestSlot(await waitForPacing(init?.signal ?? undefined), () => unpaced(input, init));
   };
   // The returned wrapper forwards its init down to `dispatch`, which applies the route at the
   // physical send. Adapters that hand this executor back as `provider.fetch` (Cursor does)
@@ -345,8 +395,7 @@ export function storedPoolReplayDispatchNotifier(
     { preconnect: unpacedSource.preconnect },
   ) as ProviderFetch["unpacedFetch"];
   const wrapped = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
-    await executor.waitForPacing?.(init?.signal ?? undefined);
-    return unpaced!(input, init);
+    return sendTrackingRequestSlot(await executor.waitForPacing?.(init?.signal ?? undefined), () => unpaced!(input, init));
   };
   return Object.assign(wrapped, {
     preconnect: executor.preconnect,
@@ -370,20 +419,21 @@ export async function fetchWithHeaderTimeout(
   _manualRedirect = false,
 ): Promise<Response> {
   const pacing = executor as ProviderFetch;
-  await pacing.waitForPacing?.(abortSignal);
+  const slot = await pacing.waitForPacing?.(abortSignal);
   const fetchExecutor = pacing.unpacedFetch ?? executor;
-  const timeout = new AbortController();
-  const timer = setTimeout(() => {
-    if (!timeout.signal.aborted) timeout.abort(new DOMException("Timeout elapsed", "TimeoutError"));
-  }, timeoutMs);
-  const headers = new Headers(init.headers);
-  // Compressed SSE can be held until the decompressor has a complete block. Streaming calls
-  // default to identity for low-latency frame delivery, while an explicit caller choice wins.
-  if (preferIdentityEncoding && !headers.has("accept-encoding")) {
-    headers.set("accept-encoding", "identity");
-  }
+  let timer: ReturnType<typeof setTimeout> | undefined;
   try {
-    return await fetchExecutor(url, {
+    const timeout = new AbortController();
+    timer = setTimeout(() => {
+      if (!timeout.signal.aborted) timeout.abort(new DOMException("Timeout elapsed", "TimeoutError"));
+    }, timeoutMs);
+    const headers = new Headers(init.headers);
+    // Compressed SSE can be held until the decompressor has a complete block. Streaming calls
+    // default to identity for low-latency frame delivery, while an explicit caller choice wins.
+    if (preferIdentityEncoding && !headers.has("accept-encoding")) {
+      headers.set("accept-encoding", "identity");
+    }
+    return await sendTrackingRequestSlot(slot, () => fetchExecutor(url, {
       ...init,
       headers,
       // Never replay provider credentials or request bodies to a redirect destination.
@@ -391,8 +441,9 @@ export async function fetchWithHeaderTimeout(
       redirect: "manual",
       signal: AbortSignal.any([abortSignal, timeout.signal]),
       timeout: 0,
-    });
+    }));
   } finally {
-    clearTimeout(timer);
+    if (timer) clearTimeout(timer);
+    if (!slot?.bodyTracked) slot?.release();
   }
 }

package/src/server/responses/passthrough-delivery.ts

@@ -129,7 +129,7 @@ import { registerTurn, unregisterTurn, trackStreamLifetime } from "../lifecycle"
 import { relaySseEagerBounded } from "../relay-eager";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
 import { idleDeadline } from "../../lib/abort";
-import { resolveStallTimeoutSec } from "../../stall-timeout";
+import { resolveStallTimeoutMs } from "../../stall-timeout";
 import { formatErrorResponse } from "../../bridge";
 import { inspectResponseLogJson } from "../request-log";
 import { restoreRoutedCustomCallsInJson } from "../../responses/custom-tool-compat";
@@ -316,6 +316,7 @@ export async function deliverPassthroughResponse(
     | "rememberPassthroughResponse"
     | "noteInspectedPayload"
     | "normalizeFunctionCompletionJson"
+    | "localUpstream"
   >,
 ): Promise<Response> {
   const { logCtx, config, options, req } = requestContext;
@@ -354,7 +355,7 @@ export async function deliverPassthroughResponse(
     && !isCodexWsUpstreamResponse(upstreamResponse)
     && !(options.nativeControl && isNativeControlResponse(upstreamResponse))) {
     upstreamResponse = await classifyPlaintextV2SseResponse(upstreamResponse, {
-      timeoutMs: resolveStallTimeoutSec(config.stallTimeoutSec) * 1000,
+      timeoutMs: resolveStallTimeoutMs(config.stallTimeoutSec, { localUpstream: nativeExchange.localUpstream }),
       signal: options.abortSignal ?? req.signal,
     });
   }

package/src/server/responses/passthrough-dispatch.ts

@@ -13,6 +13,7 @@ import type { ResponsesEffects } from "./response-effects";
 import type { ResponsesSendBudget } from "./request-send-budget";
 import { transientSendCapFor } from "./request-send-budget";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isLocalUpstream } from "../../lib/local-upstream";
 import { codexSafetyBufferingFilterOptions, terminalStatusFromParsed } from "../relay";
 import { imageGenToolCallAliases } from "../responses-image-gen-repair";
 import { rememberResponseState, isBodyNonPersistable } from "../../responses/state";
@@ -43,6 +44,7 @@ import {
 } from "../../responses/namespace-tool-compat";
 import { restoreRoutedCustomCalls, RoutedCustomToolCompatError } from "../../responses/custom-tool-compat";
 import { XaiToolSchemaCompatibilityError } from "../../adapters/xai-tool-schema";
+import { MuseToolChoiceCompatibilityError } from "../../adapters/openai-responses/muse-tool-choice";
 import { formatErrorResponse } from "../../bridge";
 import { redactSecretString } from "../../lib/redact";
 import {
@@ -137,7 +139,6 @@ import type { OAuthAccessSnapshot } from "../../oauth";
 import { publicOAuthAuthenticationErrorMessage } from "../../oauth";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import {
-  GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
   hasEligibleGenericOAuthFailoverTarget,
   isGenericOAuthFailoverEnabled,
   rotateGenericOAuthAccountOn429,
@@ -193,6 +194,7 @@ export async function preparePassthroughExchange(
     | "refreshResolvedOAuthSelection"
     | "replayOAuthCredentialSnapshot"
     | "genericFailovers"
+    | "genericFailoverLimit"
     | "applyFailoverSnapshot"
     | "noteRoutedAttemptSend"
     | "selectionIsCurrent"
@@ -336,6 +338,7 @@ export async function preparePassthroughExchange(
         error instanceof NamespaceToolCollisionError
         || error instanceof XaiToolSchemaCompatibilityError
         || error instanceof RoutedCustomToolCompatError
+        || error instanceof MuseToolChoiceCompatibilityError
       ) {
         return formatErrorResponse(400, "invalid_request_error", redactSecretString(error.message));
       }
@@ -1318,7 +1321,7 @@ export async function preparePassthroughExchange(
       // have run and would cool down an account that refused nothing.
       && !isNonReplayableResponse(upstreamResponse)
      && transportState.genericFailoverAccountId
-      && transportState.genericFailovers < GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
+      && transportState.genericFailovers < transportState.genericFailoverLimit
       && isGenericOAuthFailoverEnabled(config, route.providerName)
     ) {
       // The roster cap above is one half of the bound; the request's shared budget is the
@@ -1782,6 +1785,12 @@ export async function preparePassthroughExchange(
     break;
     }
 
+  // Where this relay dials upstream. Local infrastructure (loopback / private / `.local` / `.lan`)
+  // is operator-trusted and its silent phases are normal, so an unset stall budget resolves to
+  // disabled for it. Provider rotation above keeps the same endpoint origin, so the routed
+  // provider's baseUrl is the stable classification source.
+  const localUpstream = isLocalUpstream(route.provider.baseUrl);
+
   return {
     codexSafetyBufferingOptions,
     imageGenCallAliases,
@@ -1819,6 +1828,7 @@ export async function preparePassthroughExchange(
     rememberPassthroughResponseChecked,
     upstream,
     connectMs,
+    localUpstream,
     upstreamResponse,
   };
 }

package/src/server/responses/passthrough-execution.ts

@@ -11,7 +11,7 @@ import type { ResponsesSendBudget } from "./request-send-budget";
 import { preparePassthroughExchange } from "./passthrough-dispatch";
 import { deliverPassthroughResponse } from "./passthrough-delivery";
 import { guardDirectPassthroughBodyInactivity } from "../../lib/response-body-inactivity";
-import { resolveStallTimeoutSec } from "../../stall-timeout";
+import { resolveStallTimeoutMs } from "../../stall-timeout";
 import { releaseUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
 
@@ -53,7 +53,7 @@ export async function executePassthroughResponse(
     return guardDirectPassthroughBodyInactivity(
       response,
       nativeExchange.upstream.signal,
-      resolveStallTimeoutSec(requestContext.config.stallTimeoutSec) * 1000,
+      resolveStallTimeoutMs(requestContext.config.stallTimeoutSec, { localUpstream: nativeExchange.localUpstream }),
     );
   } finally {
     if (nativeHostState.lease) {

package/src/server/responses/request-send-budget.ts

@@ -60,6 +60,7 @@ export function createResponsesSendBudget(
   const noteTransientSends = (used: number): void => {
     const charged = Math.max(0, used);
     sendBudget.used += charged;
+    options.onCompactionRecoverySendsReported?.(charged);
     chargeWorkflowSends(workflowRootId, charged);
   };
   // Refused before any dispatch, and deliberately not by evicting the root's ledger entry:
@@ -156,7 +157,7 @@ export function createResponsesSendBudget(
    * refused and the request would answer with a synthetic 502 in place of the real 429 the hop
    * was recovering from.
    */
-  let pendingHopPermit: SingleUseDispatchPermit | undefined;
+  let pendingHopPermit: SingleUseDispatchPermit | undefined = options.compactionRecoveryPermit;
   /**
    * The budget an adapter's OWN dispatch ladder reserves against.
    *
@@ -200,7 +201,9 @@ export function createResponsesSendBudget(
     options: { allowFinalRecoveryReserve?: boolean } = {},
   ): { attempts: number; permit?: SingleUseDispatchPermit } => {
     const base = remainingTransientSendBudget(cap);
-    if (base > 0) return { attempts: base };
+    // The hop already paid for this leg's first send. Include it in the helper's total
+    // attempts without charging it again, or the final account loses one transient attempt.
+    if (base > 0) return { attempts: Math.min(cap, base + (pendingHopPermit ? 1 : 0)) };
     // A provider-configured transient total is an exact physical-send ceiling. Once it is
     // exhausted, the request-wide recovery reserve must not silently widen it. The default stays
     // permissive so unconfigured providers retain the guarded profile's fourth recovery send.
@@ -217,8 +220,8 @@ export function createResponsesSendBudget(
   /**
    * One credential hop of this logical request, admitted by the INTERSECTION of two bounds.
    *
-   * `GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST` and `ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST`
-   * stay exactly as they are: they bound rotation within one credential roster. What neither
+   * The snapshotted generic OAuth roster cap and `ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST`
+   * bound rotation within one credential roster. What neither
    * can see is everything else this request already sent, so three hops layered on a spent
    * budget still reached upstream three more times. A hop now happens only when its own layer
    * cap AND the shared budget both permit it, and the smaller of the two wins.
@@ -245,7 +248,13 @@ export function createResponsesSendBudget(
     countedExternally = false,
   ): { allowed: boolean; permit?: SingleUseDispatchPermit } => {
     if (!isRequestExecutionBudget(sendBudget)) return { allowed: true };
-    const decision = sendBudget.reserveDispatch({ sendClass, targetKey, countedExternally });
+    const decision = sendBudget.reserveDispatch({
+      sendClass,
+      // A same-provider credential hop is not a model/endpoint transition. Its diagnostic
+      // label must not replace the physical target used by the adapter's next retry.
+      targetKey: sendClass === "auth-recovery" ? sendBudget.lastTargetKey ?? targetKey : targetKey,
+      countedExternally,
+    });
     return decision.allowed ? { allowed: true, permit: decision.permit } : { allowed: false };
   };
   /**
@@ -322,6 +331,13 @@ function adapterDispatchBudgetView(
       // already paid does not make an unsafe replay safe, so that check stays with the budget.
       if (intent.replaySafe !== false) {
         const hopPermit = hop.claimHopPermit();
+        if (hopPermit && intent.targetKey !== budget.lastTargetKey) {
+          // The rotated credential can select a different regional endpoint. Replace the
+          // provisional booking synchronously so the actual destination obeys transition
+          // limits, while the physical send is still charged only once.
+          hopPermit.release();
+          return budget.reserveDispatch({ ...intent, sendClass: hopPermit.sendClass });
+        }
         // Confirmed here rather than in `use()`: the adapter reserves immediately before it
         // opens the transport, which is the same boundary the hop's own confirmation uses.
         // A permit some other leg already settled returns false, and this falls through to a

package/src/server/responses/request-transport.ts

@@ -6,8 +6,11 @@ import {
   commitOAuthAccountSelection,
   getAccountCredentialWithStatus,
   credentialGeneration,
+  getAccountSet,
 } from "../../oauth/store";
+import { refreshKiroAccountModelsDetached } from "../../providers/kiro-model-catalog";
 import type { ProviderAdapter, AdapterRequest } from "../../adapters/base";
+import { releaseProviderRequestSlot, waitForProviderRequestSlot, type ProviderRequestSlot } from "../../providers/request-pacing";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig, OcxUsage } from "../../types";
 import type { AnthropicAccountSelectionReason } from "../../oauth/anthropic-routing";
 import {
@@ -24,15 +27,24 @@ import {
   getValidAccessSnapshotForAccount,
   forceRefreshOAuthAccessSnapshot,
   getValidAccessTokenSnapshot,
+  OAuthLoginRequiredError,
   publicOAuthAuthenticationErrorMessage,
   UnsupportedOAuthProviderError,
 } from "../../oauth";
 import {
+  GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST,
+  GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
+  eligibleFailoverAccounts,
   forgetGenericFailoverRoster,
   isGenericFailoverProvider,
+  isProactivePreferenceEnabled,
   preferredInitialAccount,
+  refusalAwareInitialKiroAccount,
   noteGenericPoolSelection,
 } from "../../oauth/generic-account-failover";
+import { tryKiroAlternateAfterTerminalRefresh } from "../../oauth/kiro-terminal-failover";
+import { classifyModelFamilyForQuota } from "../../oauth/account-quota-rank";
+import { expandInferenceOAuthSendBudget } from "../inference/context";
 import { stampOAuthAccountLabel, usesApiKeyAccount } from "../../providers/label";
 import { resolveProviderTransport } from "../../providers/xai-transport";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
@@ -66,6 +78,8 @@ import {
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { bindAttemptDeliveryRecorder } from "../../usage/attempt-delivery";
 import { resolvePassiveRouteSubjectId } from "../passive-route-linker";
+import { clientCancelledResponse } from "./core-errors";
+import { acquireAccountLease, KIRO_ACCOUNT_WAIT_MS } from "../../oauth/kiro-account-load";
 
 /** Owns live credential selection and adapter bindings for one request. */
 export async function prepareResponsesTransport(
@@ -82,6 +96,17 @@ export async function prepareResponsesTransport(
 ) {
   const { config, logCtx, options, req } = requestContext;
   const { route, parsed, inboundWire, translatorBudget } = requestState;
+  const rawKiroCap = route.providerName === "kiro" && route.provider.authMode === "oauth"
+    ? config.providers.kiro?.oauthAccountFailover?.maxConcurrentPerAccount : undefined;
+  const kiroCap = typeof rawKiroCap === "number" && Number.isInteger(rawKiroCap)
+    && rawKiroCap >= 1 && rawKiroCap <= 100 ? rawKiroCap : undefined;
+  const kiroLoadEnabled = route.providerName === "kiro" && route.provider.authMode === "oauth"
+    && (kiroCap !== undefined || (config.pool?.kernel === true
+      && config.providers.kiro?.oauthAccountFailover?.strategy === "least-loaded"
+      && isProactivePreferenceEnabled(config, "kiro", Date.now())));
+  const capacityResponse = () => new Response(JSON.stringify({ error: {
+    type: "server_error", code: "account_capacity", message: "Kiro account capacity is temporarily full; retry shortly.",
+  } }), { status: 503, headers: { "content-type": "application/json", "retry-after": "1" } });
 
 
   // OAuth providers: swap in a fresh access token (auto-refreshed) as the Bearer key, so the
@@ -173,6 +198,15 @@ export async function prepareResponsesTransport(
     const candidate = unchanged ? await forceRefreshOAuthAccessSnapshot(sent) : sent;
     const admitted = await commitResolvedOAuthSelection(candidate);
     if (!admitted) throw new Error("OAuth selection changed during credential recovery");
+    if (kiroLoadEnabled && options.accountLoad?.lease?.accountId !== admitted.accountId) {
+      const replayLease = await acquireAccountLease("kiro", admitted.accountId, { maxConcurrentPerAccount: kiroCap });
+      if (!replayLease || !options.accountLoad) {
+        replayLease?.release();
+        throw new Error("Kiro replay account capacity is full");
+      }
+      options.accountLoad.lease?.release();
+      options.accountLoad.lease = replayLease;
+    }
     genericFailoverAccountId = admitted.accountId;
     stampOAuthAccountLabel(logCtx, route.providerName, route.provider, admitted.accountId);
     return admitted;
@@ -211,8 +245,22 @@ export async function prepareResponsesTransport(
     retryParsed: OcxParsedRequest = parsed,
   ): Promise<OAuthAccessSnapshot | null> => {
     if (route.provider.googleMode === "cloud-code-assist" && !snapshot.projectId) return null;
-    const committed = await commitResolvedOAuthSelection(snapshot);
-    if (!committed) return null;
+    let speculative = kiroLoadEnabled && options.accountLoad?.lease?.accountId !== snapshot.accountId
+      ? await acquireAccountLease("kiro", snapshot.accountId, { maxConcurrentPerAccount: kiroCap }) : null;
+    if (kiroLoadEnabled && options.accountLoad?.lease?.accountId !== snapshot.accountId && !speculative) return null;
+    let committed: OAuthAccessSnapshot | null;
+    try { committed = await commitResolvedOAuthSelection(snapshot); }
+    catch (error) { speculative?.release(); throw error; }
+    if (!committed) { speculative?.release(); return null; }
+    if (kiroLoadEnabled && committed.accountId !== (speculative?.accountId ?? options.accountLoad?.lease?.accountId)) {
+      speculative?.release();
+      speculative = await acquireAccountLease("kiro", committed.accountId, { maxConcurrentPerAccount: kiroCap });
+      if (!speculative) return null;
+    }
+    if (speculative && options.accountLoad) {
+      options.accountLoad.lease?.release();
+      options.accountLoad.lease = speculative;
+    }
     snapshot = committed;
     let rotatedProvider: OcxProviderConfig = { ...route.provider, apiKey: snapshot.accessToken };
     if (route.providerName === "github-copilot") {
@@ -374,24 +422,32 @@ export async function prepareResponsesTransport(
       if (!run) throw new Error("Selected provider no longer supports this turn transport");
       let sent = false;
       let refused = false;
+      let attemptSlot: ProviderRequestSlot | undefined;
       // Both main and image-loop callers already acquired the initial pacing slot.
       // Subsequent physical messages retain this adapter/credential and are paced normally.
-      const fetch = providerFetch(route.provider, options.codexWsRuntimeIdentity, {
-        providerName: route.providerName, modelId: route.modelId, pacingSlotAcquired: true,
-        beforeDispatch: () => {
-          if (sent) return;
-          if (!selectionIsCurrent(binding)) {
-            refused = true;
-            throw new Error("Account selection changed before the first turn dispatch");
-          }
-          commitKeyAttemptSend();
-          sent = true;
-        },
-      });
       try {
+        attemptSlot = attempt === 0
+          ? incoming.pacingSlot ?? await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, incoming.abortSignal)
+          : await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, incoming.abortSignal);
+        const fetch = providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+          providerName: route.providerName, modelId: route.modelId, pacingSlotAcquired: true,
+          pacingSlot: attemptSlot,
+          turnScopedPacing: true,
+          beforeDispatch: () => {
+            if (sent) return;
+            if (!selectionIsCurrent(binding)) {
+              refused = true;
+              throw new Error("Account selection changed before the first turn dispatch");
+            }
+            commitKeyAttemptSend();
+            sent = true;
+          },
+        });
         await run(requestParsed, { ...incoming, providerFetch: fetch }, event => { if (!refused) emit(event); });
       } catch (error) {
         if (!refused) throw error;
+      } finally {
+        releaseProviderRequestSlot(attemptSlot);
       }
       if (!refused) return;
       // The adapter may map the guard's exception to an error event. Neither that
@@ -512,9 +568,12 @@ export async function prepareResponsesTransport(
         // only reacts to a 429, so a turn could open on an account a previous probe already
         // measured as spent. A null answer means "use the active account", so every provider
         // without quota evidence keeps the resolution it has today.
-        const preferredAccountId = isGenericFailoverProvider(route.providerName, route.provider)
+        const refusalAwareId = route.providerName === "kiro" && oauthSelection?.accountId
+          ? refusalAwareInitialKiroAccount(config, oauthSelection.accountId, Date.now(), route.modelId) : null;
+        const preferredAccountId = refusalAwareId ?? (isGenericFailoverProvider(route.providerName, route.provider)
           ? preferredInitialAccount(config, route.providerName, Date.now(), route.modelId)
-          : null;
+          : null);
+        let safetyAlternateId: string | null = refusalAwareId;
         // Resolved account-scoped, NOT through failoverAccountSnapshot: that helper marks a
         // rotation site, and rotation sites must apply their credential through
         // applyFailoverSnapshot's pairing rules. This is initial resolution — the code below
@@ -541,10 +600,22 @@ export async function prepareResponsesTransport(
             // Drop the stale roster so the next request re-reads it, and carry on.
             forgetGenericFailoverRoster(route.providerName);
             usedPreferredAccount = false;
+            safetyAlternateId = null;
             resolved = await getValidAccessTokenSnapshot(route.providerName);
           }
         } else {
-          resolved = await getValidAccessTokenSnapshot(route.providerName);
+          const failedId = route.providerName === "kiro" ? oauthSelection?.accountId : undefined;
+          const failedRow = failedId ? getAccountCredentialWithStatus("kiro", failedId) : null;
+          const failedGeneration = failedRow ? credentialGeneration(failedRow.credential) : undefined;
+          try { resolved = await getValidAccessTokenSnapshot(route.providerName); }
+          catch (error) {
+            if (route.providerName !== "kiro" || !(error instanceof OAuthLoginRequiredError)
+              || !failedId || !failedGeneration) throw error;
+            const alternate = await tryKiroAlternateAfterTerminalRefresh(config, failedId, failedGeneration);
+            if (!alternate) throw error;
+            resolved = alternate;
+            safetyAlternateId = alternate.accountId;
+          }
         }
         // A Cloud Code Assist account needs its own project. Antigravity's refresh path
         // tolerates project discovery failing, so a stored account can legitimately have
@@ -555,8 +626,23 @@ export async function prepareResponsesTransport(
           resolved = await getValidAccessTokenSnapshot(route.providerName);
           usedPreferredAccount = false;
         }
-        const admitted = await commitResolvedOAuthSelection(resolved, true);
+        const admitted = await commitResolvedOAuthSelection(resolved, safetyAlternateId === null);
         if (!admitted) return formatErrorResponse(409, "conflict_error", "OAuth account selection changed; retry the request");
+        if (safetyAlternateId && admitted.accountId !== safetyAlternateId)
+          return formatErrorResponse(409, "conflict_error", "OAuth account selection changed; retry the request");
+        if (kiroLoadEnabled) {
+          const lease = await acquireAccountLease("kiro", admitted.accountId, {
+            maxConcurrentPerAccount: kiroCap, waitMs: KIRO_ACCOUNT_WAIT_MS, signal: options.abortSignal ?? req.signal,
+          });
+          if (!lease) return (options.abortSignal ?? req.signal).aborted
+            ? clientCancelledResponse() : capacityResponse();
+          if (options.accountLoad) options.accountLoad.lease = lease;
+          else lease.release();
+        }
+        if (route.providerName === "kiro") {
+          const account = getAccountSet("kiro")?.accounts.find(row => row.id === admitted.accountId);
+          if (account) refreshKiroAccountModelsDetached(account, route.provider);
+        }
         if (admitted.accountId !== resolved.accountId) usedPreferredAccount = true;
         resolved = admitted;
         replayOAuthCredentialSnapshot = {
@@ -721,7 +807,19 @@ export async function prepareResponsesTransport(
     );
   }
 
+  // Freeze the request ceiling before any 429 writes cooldowns. Selection still reads
+  // live eligibility on every hop; cooled accounts cannot shorten this request's allowance.
+  // The snapshot is clamped: a larger roster must not raise one request's hops or sends.
+  const genericRosterSize = genericFailoverAccountId ? new Set([
+    genericFailoverAccountId,
+    ...eligibleFailoverAccounts(route.providerName, Date.now(), classifyModelFamilyForQuota(route.providerName, route.modelId)),
+  ]).size : 0;
+  const fundedAccounts = Math.min(genericRosterSize, GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST);
+  const genericFailoverLimit = Math.max(GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST, fundedAccounts - 1);
+  if (genericFailoverAccountId) expandInferenceOAuthSendBudget(options.sendBudget, fundedAccounts);
+
   return {
+    genericFailoverLimit,
     isOAuth401ReplayProvider,
     get sentOAuthSnapshot(): OAuthAccessSnapshot | undefined {
       return sentOAuthSnapshot;