@bitkyc08/opencodex 2.84.0 → 2.86.0

package/src/server/responses/core-options.ts

@@ -22,6 +22,8 @@ import type { RequestLogContext } from "../request-log";
 import type { UpstreamHostAdmissionLease } from "../../codex/upstream-host-health";
 import type { AccountLease } from "../../oauth/kiro-account-load";
 import type { PolicyRequestScope } from "./policy-request-scope";
+import type { OcxParsedRequest } from "../../types";
+import type { PolicyRequestEvidence } from "../../routing/evaluator";
 
 export interface ConsumedComboFailure {
   response: Response;
@@ -61,6 +63,32 @@ export interface ClientEncoderOption {
   stream: boolean;
   model: string;
   inputTokenFloor?: number;
+  /**
+   * `direct` when the request side also skipped the internal Responses body (the Antigravity
+   * direct lane), so the attempt's request path is traced as `[inbound, ir, upstream]`.
+   */
+  requestLane?: "bridge" | "direct";
+}
+
+/**
+ * The Antigravity direct lane (`protocols.rollout.antigravityDirect`). The ingress sends the core
+ * a Responses body that carries only the request settings; the conversation is decoded straight
+ * from the client body. Request preparation applies `decode` at the parse seam, reads routing
+ * evidence from `evidence`, and calls `restoreBridgeConversation` if the final route is not the
+ * one the lane was decided for, so every `_rawBody` reader of another adapter sees the full
+ * bridge body.
+ */
+export interface DirectRequestOption {
+  protocol: "chat" | "messages";
+  /** The concrete route the ingress decided the lane for. */
+  providerName: string;
+  modelId: string;
+  /** Policy-routing evidence from the client body; the settings-only body has no `input`. */
+  evidence: PolicyRequestEvidence;
+  /** The settings-only parse with the directly decoded conversation in place of its empty one. */
+  decode(base: OcxParsedRequest): OcxParsedRequest;
+  /** The bridge projection's conversation fields (`input`, `instructions`, `tools`). */
+  bridgeConversation(): Record<string, unknown>;
 }
 
 export interface HandleResponsesOptions {
@@ -137,6 +165,13 @@ export interface HandleResponsesOptions {
    * it. Omitted means a genuine Responses inbound.
    */
   inboundWire?: InboundWire;
+  /**
+   * Set by a translating ingress (Chat / Anthropic) when the client sent an explicit empty
+   * tool catalog. Those wires may defer tool delivery, so their translated body carries no
+   * readable catalog boundary; an explicit `[]` is still a deny-all declaration and the
+   * undeclared-tool guard enforces it. Absent catalogs and partial catalogs stay deferred.
+   */
+  clientDeclaredEmptyToolCatalog?: boolean;
   nativeReasoningReplay?: ReadonlyMap<string, string>;
   nativeReasoningMint?: { owner?: NativeReasoningOwner };
   /** Droid's per-request effort default; each concrete combo or policy target applies it only if its ladder allows it. */
@@ -202,6 +237,15 @@ export interface HandleResponsesOptions {
    * rebuilds headers and carries the fact through this flag.
    */
   visionDescribeTerminal?: boolean;
+  /**
+   * Terminal advisor marker: true when the inbound request IS the advisor sidecar's own loopback
+   * consultation. The advisor planner then never plans a consultation — a depth cap of 1 that
+   * keeps Worker → Advisor → Advisor recursion impossible (same structure as
+   * {@linkcode visionDescribeTerminal}). The Chat surface detects the raw
+   * `x-opencodex-advisor-internal` header before its bridge rebuilds headers and carries the
+   * fact through this flag.
+   */
+  advisorInternal?: boolean;
   /**
    * Set only by the Chat and Messages ingresses when `protocols.rollout.directEncoders` is on and
    * the settled route is one non-Responses target. Adapter delivery then encodes the adapter
@@ -210,6 +254,8 @@ export interface HandleResponsesOptions {
    * returning a Responses body, which the ingress converts as before.
    */
   clientEncoder?: ClientEncoderOption;
+  /** Set only by the Chat or Messages ingress on an eligible Antigravity route; see {@link DirectRequestOption}. */
+  directRequest?: DirectRequestOption;
 }
 
 /** Values shared by the call, not a bag of mutable pipeline state. */

package/src/server/responses/core-replay.ts

@@ -125,11 +125,13 @@ export function bindRouteReasoningReplayScope(args: {
   if (owner) parsed._nativeReasoningBoundOwner = owner;
   else delete parsed._nativeReasoningBoundOwner;
   if (parsed._nativeReasoningReplay?.size) {
+    const rejected = new Set<string>();
     for (const [blob, tag] of parsed._nativeReasoningReplay) {
       if (!nativeReasoningTagMatches(nativeReasoningTag(owner, blob), tag)) {
-        stripNativeReasoningBlob(parsed, blob);
+        rejected.add(blob);
       }
     }
+    if (rejected.size) stripNativeReasoningBlobs(parsed, rejected);
   }
   const continuationDestinationIdentity = providerContinuationDestinationIdentity(parsed, provider);
   const continuationOwner = providerContinuationOwnerFromReplayIdentity(
@@ -169,11 +171,11 @@ export function bindRouteReasoningReplayScope(args: {
   bindProviderContinuationForRoute(parsed, continuationOwner);
 }
 
-function stripNativeReasoningBlob(parsed: OcxParsedRequest, blob: string): void {
+function stripNativeReasoningBlobs(parsed: OcxParsedRequest, rejected: ReadonlySet<string>): void {
   const input = (parsed._rawBody as { input?: unknown } | undefined)?.input;
   if (Array.isArray(input)) {
     for (const item of input) {
-      if (item && typeof item === "object" && item.type === "reasoning" && item.encrypted_content === blob) {
+      if (item && typeof item === "object" && item.type === "reasoning" && rejected.has(item.encrypted_content)) {
         delete item.encrypted_content;
         delete item.id;
       }
@@ -187,7 +189,8 @@ function stripNativeReasoningBlob(parsed: OcxParsedRequest, blob: string): void
         const item: unknown = JSON.parse(part.signature);
         if (!item || typeof item !== "object" || Array.isArray(item)) continue;
         const reasoning = item as Record<string, unknown>;
-        if (reasoning.type !== "reasoning" || reasoning.encrypted_content !== blob) continue;
+        if (reasoning.type !== "reasoning" || typeof reasoning.encrypted_content !== "string"
+          || !rejected.has(reasoning.encrypted_content)) continue;
         delete reasoning.encrypted_content;
         delete reasoning.id;
         part.signature = JSON.stringify(reasoning);

package/src/server/responses/core.ts

@@ -48,7 +48,7 @@ export async function handleResponses(
   abortSignal.addEventListener("abort", cancel, { once: true });
   try {
     const response = await runWithCompactionRecovery(req, config, logCtx, {
-      ...options,
+      ...options, abortSignal,
       openAiSidecarAuth: options.openAiSidecarAuth === undefined
         ? captureExplicitOpenAiCallerAuth(req.headers, config) : options.openAiSidecarAuth,
       nativeCallerAuth: options.nativeCallerAuth === undefined

package/src/server/responses/passthrough-delivery.ts

@@ -108,6 +108,7 @@ import { createResponsesFunctionToolRepairBlockRewrite } from "../responses-func
 import {
   createUndeclaredToolCallGuardBlockRewrite,
   currentTurnWireToolCatalogBody,
+  UNDECLARED_TOOL_CALL_ERROR_CODE,
   undeclaredToolCallNameInResponse,
   undeclaredToolCallMessage,
   normalizeDefaultNamespaceInJson,
@@ -437,8 +438,7 @@ export async function deliverPassthroughResponse(
     normalizeFunctionCompletionJson,
   } = nativeExchange;
   const { commitReasoningReplayServingRoute, recordTerminalOutcomes } = responseEffects;
-  const { parsed, subagentQuotaFailureModel, clientRequestedStream, translatorBudget, inboundWire } = requestState;
-  const enforceDeclaredToolNames = inboundWire !== "chat" && inboundWire !== "anthropic";
+  const { parsed, subagentQuotaFailureModel, clientRequestedStream, translatorBudget } = requestState;
   const { openAiSidecar } = sidecarState;
   const { requestBindings } = transportState;
 
@@ -857,14 +857,17 @@ export async function deliverPassthroughResponse(
           : undefined,
         // Last: every rewrite above can still rename or reshape a call item, so the guard must
         // compare the names the client will actually receive against the declared catalog.
-        nativeExchange.undeclaredToolGuardActive
+        // Deferred-catalog wires keep the rewrite for its normalization half only: a provider's
+        // `default.X` call still collapses to the declared `X`, but an undeclared name is the
+        // client's own deferred registry's business, not this proxy's verdict.
+        nativeExchange.undeclaredToolGuardActive || declaredWireToolNames.size > 0
           ? createUndeclaredToolCallGuardBlockRewrite(
             declaredWireToolNames,
             declaredNamelessClientCallTypes,
             providerExecutedCallTypes,
             declaredBareWireToolNames,
             recoverableBareCustomWireToolNames,
-            enforceDeclaredToolNames,
+            { refuseUndeclared: nativeExchange.undeclaredToolGuardActive },
           )
           : undefined,
         grokUpstreamEchoEnabled
@@ -1322,10 +1325,7 @@ export async function deliverPassthroughResponse(
       if (grokUpstreamEchoEnabled) {
         clientJson = stripGrokUpstreamEnvelopeEchoFromResponsesJson(clientJson);
       }
-      // #1700: same inbound-wire refusal policy as the SSE relay above. Both the plain JSON answer and
-      // the reframed-SSE branch below are built from this body, so one check covers them. This
-      // runs BEFORE the continuation cache write below: a refused turn must not become state a
-      // later `previous_response_id` replay can expand from.
+      // Both response formats use this body, before a refused turn can enter continuation state.
       if (nativeExchange.undeclaredToolGuardActive) {
         const undeclared = (() => {
           try {
@@ -1341,9 +1341,15 @@ export async function deliverPassthroughResponse(
             return undefined;
           }
         })();
-        if (enforceDeclaredToolNames && undeclared !== undefined) {
-          return formatErrorResponse(502, "upstream_error", undeclaredToolCallMessage(undeclared));
+        if (undeclared !== undefined) {
+          return formatErrorResponse(502, "upstream_error", undeclaredToolCallMessage(undeclared), {
+            code: UNDECLARED_TOOL_CALL_ERROR_CODE,
+          });
         }
+      }
+      // Same split as the SSE rewrite: normalization applies whenever a declared name exists,
+      // even on wires whose deferred catalog stands the refusal down.
+      if (declaredWireToolNames.size > 0) {
         clientJson = normalizeDefaultNamespaceInJson(
           clientJson,
           declaredWireToolNames,

package/src/server/responses/passthrough-dispatch.ts

@@ -21,6 +21,7 @@ import { imageGenToolCallAliases } from "../responses-image-gen-repair";
 import { rememberResponseState, isBodyNonPersistable } from "../../responses/state";
 import {
   currentTurnWireToolCatalogBody,
+  hasExplicitEmptyToolCatalog,
   hasExplicitWireToolCatalog,
   collectDeclaredWireToolNames,
   collectDeclaredBareWireToolNames,
@@ -187,6 +188,7 @@ export async function preparePassthroughExchange(
     | "selectedForwardHeaders"
     | "clientRequestedStream"
     | "inboundWire"
+    | "clientDeclaredEmptyToolCatalog"
     | "substituteMainCredential"
     | "callerAuthHeaders"
     | "subagentFallbackAccountId"
@@ -253,6 +255,7 @@ export async function preparePassthroughExchange(
     responseStateOptions,
     clientRequestedStream,
     inboundWire,
+    clientDeclaredEmptyToolCatalog,
     substituteMainCredential,
     callerAuthHeaders,
   } = requestState;
@@ -531,10 +534,18 @@ export async function preparePassthroughExchange(
           declaredWireToolNames.add(name);
         }
       }
+      // Chat and Anthropic inbounds may deliver tools deferred/partially: their client registry
+      // owns the full catalog, so this guard cannot read the translated body as the authorization
+      // boundary. An explicit empty catalog — flagged by the translating ingress or present
+      // verbatim in a replayed body — is still a deny-all the caller declared; everything else
+      // stays deferred to the caller's own tool handling.
       undeclaredToolGuardActive = (
-        declaredWireToolNames.size > 0
-        || clientDeclaredNamelessCallTypes.size > 0
-        || clientExplicitWireToolCatalog
+        inboundWire === "responses"
+          ? declaredWireToolNames.size > 0
+            || clientDeclaredNamelessCallTypes.size > 0
+            || clientExplicitWireToolCatalog
+          : clientDeclaredEmptyToolCatalog
+            || hasExplicitEmptyToolCatalog(clientToolAuthorizationBody)
       ) && route.provider.authMode !== "forward";
       options.nativeControl?.configureToolAuthorization?.(
         undeclaredToolGuardActive,

package/src/server/responses/request-prepare.ts

@@ -1,4 +1,8 @@
-import type { ResponsesRequestContext, ResponsesAdmissionState, ResponsesDispatchers } from "./core-options";
+import type { HandleResponsesOptions, ResponsesRequestContext, ResponsesAdmissionState, ResponsesDispatchers } from "./core-options";
+import type { PolicyRequestEvidence } from "../../routing/evaluator";
+import type { RequestLogContext } from "../request-log";
+import { markProtocolEntry, protocolMarkFeatures } from "../../protocols/trace";
+import { isAntigravityRoute } from "../antigravity-direct-eligibility";
 import { capturePolicyRequestRoute, assertPolicyNormalizedRoute, recordPolicyPreparedDestination, policyCandidateRefusalResponse } from "./policy-request-scope";
 import {
   agentTaskRecoveryConfig,
@@ -155,6 +159,48 @@ import {
 
 import { redactHostedImageDisplayPaths } from "../responses-hosted-image-display";
 
+/** Policy-routing evidence. The direct lane's settings-only body has no conversation to scan. */
+function routeEvidence(options: Pick<HandleResponsesOptions, "directRequest">, parsed: OcxParsedRequest): PolicyRequestEvidence {
+  return options.directRequest?.evidence ?? evidenceFromBody(parsed._rawBody);
+}
+
+/**
+ * Leave the Antigravity direct lane for this request: put the bridge conversation back on the
+ * Responses body so every `_rawBody` reader sees what the bridge would have sent, and trace the
+ * request as the bridge. The IR conversation already decoded stays: it equals what
+ * `parseRequest` builds from the restored body (`tests/protocols/chat-ir-parity.test.ts`).
+ */
+function restoreDirectRequestConversation(options: HandleResponsesOptions, body: unknown, logCtx: RequestLogContext): void {
+  const direct = options.directRequest;
+  if (!direct) return;
+  options.directRequest = undefined;
+  if (body && typeof body === "object" && !Array.isArray(body)) Object.assign(body, direct.bridgeConversation());
+  if (options.clientEncoder) options.clientEncoder = { ...options.clientEncoder, requestLane: "bridge" };
+  markProtocolEntry(logCtx, {
+    inbound: direct.protocol,
+    lane: "bridge",
+    reasonCodes: ["not-migrated"],
+    features: protocolMarkFeatures(logCtx) ?? [],
+  });
+}
+
+/**
+ * Leave the direct lane as soon as the route stops being the Antigravity route it was decided
+ * for. Called after every route assignment, so readers that run between a reroute and dispatch
+ * (canonical sanitization, ciphertext stripping, final normalization) see the bridge body.
+ */
+function leaveDirectLaneIfRerouted(
+  options: HandleResponsesOptions,
+  route: Pick<RouteResult, "providerName" | "modelId" | "provider">,
+  parsed: OcxParsedRequest,
+  logCtx: RequestLogContext,
+): void {
+  const direct = options.directRequest;
+  if (!direct) return;
+  if (route.providerName === direct.providerName && route.modelId === direct.modelId && isAntigravityRoute(route)) return;
+  restoreDirectRequestConversation(options, parsed._rawBody, logCtx);
+}
+
 /** Parses, selects, and admits one request without changing the dispatch policy. */
 export async function prepareResponsesRequest(
   requestContext: Pick<ResponsesRequestContext, "options" | "config" | "req" | "logCtx">,
@@ -306,6 +352,9 @@ export async function prepareResponsesRequest(
   }
   if (comboId && Object.hasOwn(config.combos ?? {}, comboId)) {
     options.onRequestBodyRead?.();
+    // The Antigravity direct lane is decided for one concrete route; a body that reached a combo
+    // goes through the combo's own child loop with the full bridge conversation.
+    restoreDirectRequestConversation(options, body, logCtx);
     return requestDispatchers.handleComboResponses(req, body, comboId, config, logCtx, {
       ...options,
       // Concrete combo child selectors no longer match the shadow source model. Carry the
@@ -383,6 +432,10 @@ export async function prepareResponsesRequest(
   let toolBridgeMaps: ReturnType<typeof buildToolBridgeMaps>;
   try {
     parsed = parseRequest(body);
+    // Antigravity direct lane: the body carried only the request settings, so the parse above
+    // produced them with an empty conversation; the conversation itself comes straight from the
+    // client body. Inside this try so a decode error answers exactly like a parse error.
+    if (options.directRequest) parsed = options.directRequest.decode(parsed);
     if (options.inboundWire === "anthropic") {
       parsed._nativeReasoningReplay = options.nativeReasoningReplay;
       parsed._nativeReasoningMint = options.nativeReasoningMint;
@@ -582,8 +635,8 @@ export async function prepareResponsesRequest(
       const resolved = concreteSelection
         ? routeConcreteModel(config, modelId)
         : parsed._compactionRequest === true
-          ? routeCompactionModel(config, modelId, evidenceFromBody(parsed._rawBody))
-          : routeModel(config, modelId, evidenceFromBody(parsed._rawBody));
+          ? routeCompactionModel(config, modelId, routeEvidence(options, parsed))
+          : routeModel(config, modelId, routeEvidence(options, parsed));
       // A Pool 2 selector may leave Pool 2 only through an operator-configured cross-provider
       // blocked-model redirect, which the router marks as a credential-domain rewrite. Any other
       // destination means the selector fell through to default resolution, which stays refused.
@@ -654,6 +707,7 @@ export async function prepareResponsesRequest(
     if (parsed._compactionRequest === true || options.compactionRoutingOverride) parsed._cursorIsolateConversation = true;
     route = memoryRoute ?? shadowRoute ?? resolveRoute(options.policyFallbackCandidate
       ? `${options.policyFallbackCandidate.provider}/${options.policyFallbackCandidate.model}` : parsed.modelId);
+    leaveDirectLaneIfRerouted(options, route, parsed, logCtx);
     // Name the phase in the persisted route decision, so the request log says why this turn went to
     // the memory destination instead of leaving it looking like a plain user selection. Set here, on
     // the resolved route, so a combo child's own route carries it too.
@@ -893,8 +947,9 @@ export async function prepareResponsesRequest(
     if (fallback?.to && !slugsEquivalent(fallback.to, route.modelId)) {
       try {
         route = captureInboundRoutePolicy(
-          routeModel(config, fallback.to, evidenceFromBody(parsed._rawBody)),
+          routeModel(config, fallback.to, routeEvidence(options, parsed)),
         );
+        leaveDirectLaneIfRerouted(options, route, parsed, logCtx);
         credentialDomainWasRewritten = true;
         logCtx.routeDecision = route.routeDecision;
         logCtx.policyEligibility = route.policyEligibility;
@@ -1109,8 +1164,9 @@ export async function prepareResponsesRequest(
           if (fallback?.to && !slugsEquivalent(fallback.to, route.modelId)) {
             try {
               route = captureInboundRoutePolicy(
-                routeModel(config, fallback.to, evidenceFromBody(parsed._rawBody)),
+                routeModel(config, fallback.to, routeEvidence(options, parsed)),
               );
+              leaveDirectLaneIfRerouted(options, route, parsed, logCtx);
               credentialDomainWasRewritten = true;
               logCtx.routeDecision = route.routeDecision;
               logCtx.policyEligibility = route.policyEligibility;
@@ -1257,6 +1313,8 @@ export async function prepareResponsesRequest(
   // for streaming clients.
   const clientRequestedStream = parsed.stream;
   const admittedPolicyRoute = { providerName: route.providerName, modelId: route.modelId };
+  // Final guard before normalization may inject guidance into the raw body.
+  leaveDirectLaneIfRerouted(options, route, parsed, logCtx);
   await applyFinalRouteRequestNormalization({
     parsed,
     route,
@@ -1452,6 +1510,11 @@ export async function prepareResponsesRequest(
   commitSkillsSnapshot?.();
   return {
     inboundWire,
+    clientDeclaredEmptyToolCatalog: options.clientDeclaredEmptyToolCatalog === true,
+    // Admission facts later route rewrites must not re-derive: the selector the caller sent and
+    // the key scope as it stood when this request was admitted.
+    inboundSelector,
+    admissionScope,
     translatorBudget,
     parsed,
     toolBridgeMaps,

package/src/server/responses/request-transport.ts

@@ -56,6 +56,11 @@ import { stampOAuthAccountLabel, usesApiKeyAccount } from "../../providers/label
 import { resolveProviderTransport } from "../../providers/xai-transport";
 import { captureRouteStaticPolicy } from "../../router";
 import { CopilotAutoHttpError, resolveCopilotAuto } from "../../providers/github-copilot-auto";
+import {
+  AdmissionModelDeniedError,
+  admissionModelDeniedResponse,
+  assertRouteAllowedByScope,
+} from "../admission-model-scope";
 import { renameRoutedIdentityInContext } from "../../adapters/identity";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import {
@@ -109,6 +114,8 @@ export async function prepareResponsesTransport(
     | "inboundWire"
     | "selectedForwardHeaders"
     | "translatorBudget"
+    | "inboundSelector"
+    | "admissionScope"
   >,
 ) {
   const { config, logCtx, options, req } = requestContext;
@@ -297,6 +304,7 @@ export async function prepareResponsesTransport(
   const copilotRequestedModel = route.modelId;
   /** Project only bounded Copilot refusal metadata; upstream bodies and session tokens never reach the client. */
   const copilotRefusalResponse = (error: unknown): Response | undefined => {
+    if (error instanceof AdmissionModelDeniedError) return admissionModelDeniedResponse(error);
     if (!(error instanceof CopilotAutoHttpError) || ![401, 403, 429].includes(error.status)) return;
     const response = formatErrorResponse(error.status, error.status === 429 ? "rate_limit_error" : "authentication_error",
       error.message);
@@ -357,6 +365,13 @@ export async function prepareResponsesTransport(
       replayOAuthCredentialSnapshot = { accountId: refreshed.accountId, generation: refreshed.generation };
       selected = await negotiate();
     }
+    assertRouteAllowedByScope(
+      // The scope captured at admission: a key edited or removed while negotiation was in
+      // flight must not widen this request. The refusal names the caller's own selector.
+      requestState.admissionScope,
+      requestState.inboundSelector,
+      { providerName: route.providerName, modelId: selected.modelId },
+    );
     copilotSessionExpiresAt = selected.expiresAt ?? Infinity;
     route.provider = selected.provider;
     route.modelId = selected.modelId;
@@ -725,6 +740,7 @@ export async function prepareResponsesTransport(
         let nextAdapter: ProviderAdapter;
         try { nextAdapter = await refreshDispatchAdapter(requestParsed); }
         catch (error) {
+          if (error instanceof AdmissionModelDeniedError) throw error;
           const refusal = copilotRefusalResponse(error);
           if (refusal) return refusal;
           throw error;

package/src/server/responses/run-turn-execution.ts

@@ -23,6 +23,7 @@ import { normalizeLogConversationId } from "../request-log-conversation";
 import { normalizeDeclaredToolName, type AdapterEvent, type OcxProviderContinuationState } from "../../types";
 import { adapterFailureFromMessage, SEND_BUDGET_EXHAUSTED_CODE, SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE, type OcxErrorPayload } from "../../lib/errors";
 import { SendBudgetExhaustedError, markResponseNonReplayable } from "../../lib/upstream-retry";
+import { hasKeyPoolFailover, rotateProviderTransportOn401, rotateProviderTransportOn429 } from "../../providers/key-failover";
 import {
   hasEligibleGenericOAuthFailoverTarget,
   isGenericOAuthFailoverEnabled,
@@ -224,6 +225,11 @@ export async function executeResponsesRunTurn(
     // in-flight; only the latest dispatch may merge adapter-written route
     // state back onto `parsed`, or the superseded attempt would restore the
     // failed account's cursor/continuation over the rotation's rebind.
+    type KeyBinding = Extract<NonNullable<ReturnType<typeof adapterBindings.get>>, { kind: "api-key" }>;
+    const failedKeyBindings = new WeakMap<Extract<AdapterEvent, { type: "error" }>, KeyBinding>();
+    const failedKeys = new Set<string>();
+    const keyAttemptLimit = route.provider.apiKeyPool?.length ?? 0;
+    let lastKeyFailure: Extract<AdapterEvent, { type: "error" }> | undefined;
     let runTurnAttemptSeq = 0;
     const runTurnAttempt = async (
       targetQueue: AdapterEventQueue,
@@ -238,7 +244,9 @@ export async function executeResponsesRunTurn(
       const attemptSeq = ++runTurnAttemptSeq;
       if (attemptSeq === 1 && options.comboInitialSend) options.comboInitialSend.producerOwned = true;
       let pacingSlot = preacquiredSlot;
+      let sentKeyBinding: KeyBinding | undefined;
       const emit = (event: AdapterEvent) => {
+        if (event.type === "error" && sentKeyBinding) failedKeyBindings.set(event, sentKeyBinding);
         options.onCompactionRecoveryAdapterEvent?.(event);
         targetQueue.push(event);
       };
@@ -249,6 +257,12 @@ export async function executeResponsesRunTurn(
           pacingSlot = await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, runTurnAbort.signal);
         }
         await refreshRunTurnSelection();
+        const selectedBinding = adapterBindings.get(transportState.runTurnAdapter);
+        if (lastKeyFailure && selectedBinding?.kind === "api-key"
+          && failedKeys.has(selectedBinding.provider.apiKey ?? "")) {
+          emit(lastKeyFailure);
+          return;
+        }
         // LOCAL PATCH (runturn-websearch): refreshRunTurnSelection binds route
         // state onto `parsed`; mirror it onto the iteration-local copy the
         // adapter actually receives.
@@ -293,13 +307,14 @@ export async function executeResponsesRunTurn(
             // The only way the request budget reaches a transport the adapter owns. Without it
             // a Cursor turn's inner ladder was three physical sends the cap read as one.
             ...(adapterDispatchBudget ? { sendBudget: adapterDispatchBudget } : {}),
-            onPhysicalSend: send => noteAdapterPhysicalSend(
-              logCtx.usageLogInputTokens,
-              // The attempt's own recovery kind still labels its first send when the adapter
-              // does not supply one of its own.
-              { ...send, ...(send.recovery ?? recovery ? { recovery: send.recovery ?? recovery } : {}) },
-              { includeFirst: reportsOwnSends },
-            ),
+            onPhysicalSend: send => {
+              // Capture once at this attempt's send, before later selection or recovery changes it.
+              const binding = adapterBindings.get(transportState.runTurnAdapter);
+              if (!sentKeyBinding && binding?.kind === "api-key") sentKeyBinding = binding;
+              noteAdapterPhysicalSend(logCtx.usageLogInputTokens,
+                { ...send, ...(send.recovery ?? recovery ? { recovery: send.recovery ?? recovery } : {}) },
+                { includeFirst: reportsOwnSends });
+            },
             onRecoveryWithheld: noteAdapterRecoveryWithheld,
           },
           emit,
@@ -361,6 +376,7 @@ export async function executeResponsesRunTurn(
     const runTurn = async (): Promise<void> => runTurnAttempt(queue, undefined, true, wsFirstParsed, initialPacingSlot);
     const runTurnFailoverArmed = () =>
       route.provider.authMode === "oauth"
+      || (transportState.runTurnAdapter.name === "qoder" && hasKeyPoolFailover(route.provider))
       || !!(transportState.genericFailoverAccountId
         && isGenericOAuthFailoverEnabled(config, route.providerName));
     const dispatchSearchIteration = (iterParsed: PreparedResponsesRequest["parsed"]): AsyncIterable<AdapterEvent> => {
@@ -464,9 +480,51 @@ export async function executeResponsesRunTurn(
         return false;
       }
     };
+    const recoverRunTurnKey = async (
+      error: Extract<AdapterEvent, { type: "error" }>,
+    ): Promise<AttemptRecoveryKind | undefined> => {
+      const binding = failedKeyBindings.get(error);
+      if (error.apiKeyRecovery !== true || (error.status !== 401 && error.status !== 429)
+        || !binding || runTurnAbort.signal.aborted || !hasKeyPoolFailover(route.provider)
+        || failedKeys.size >= keyAttemptLimit) return undefined;
+      const failed = binding.provider;
+      if (!failed.apiKey || !failed._apiKeyAttempt || failedKeys.has(failed.apiKey)) return undefined;
+      const hop = reserveCredentialHop("auth-recovery", `${route.providerName}|${route.modelId}|runturn-key-${error.status}`);
+      if (!hop.allowed) return undefined;
+      failedKeys.add(failed.apiKey);
+      lastKeyFailure = error;
+      try {
+        const rotate = error.status === 401 ? rotateProviderTransportOn401 : rotateProviderTransportOn429;
+        const rotated = rotate(config, route.providerName, failed, {
+          attemptedKey: failed.apiKey, attemptedSelection: failed._apiKeyAttempt,
+          promptCacheKey: parsed.options.promptCacheKey,
+        });
+        if (!rotated || failedKeys.size >= keyAttemptLimit || failedKeys.has(rotated.apiKey ?? "") || runTurnAbort.signal.aborted) {
+          hop.permit?.release();
+          return undefined;
+        }
+        route.provider = rotated;
+        const adapter = await refreshRunTurnAdapter(parsed);
+        if (!adapter.runTurn || failedKeys.has(route.provider.apiKey ?? "") || runTurnAbort.signal.aborted) {
+          hop.permit?.release();
+          return undefined;
+        }
+        bindRouteReasoningReplayScope({ parsed, providerName: route.providerName, provider: route.provider,
+          adapterName: adapter.name, forwardHeaders: requestState.selectedForwardHeaders });
+        sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, adapter.name, logCtx.accountLogLabel);
+        recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, adapter.name);
+        sendBudgetState.pendingHopPermit = hop.permit;
+        return error.status === 401 ? "key-401" : "key-429";
+      } catch {
+        hop.permit?.release();
+        return undefined;
+      }
+    };
     const recoverRunTurnAdapterOnPreflightError = async (
       error: Extract<AdapterEvent, { type: "error" }>,
     ): Promise<AttemptRecoveryKind | undefined> => {
+      const keyRecovery = await recoverRunTurnKey(error);
+      if (keyRecovery) return keyRecovery;
       if (await recoverRunTurnAdapterOnPreflight401(error)) return "oauth-401";
       if (await rotateRunTurnAdapterOnPreflight429(error)) return "oauth-account-429";
       return undefined;
@@ -683,7 +741,11 @@ export async function executeResponsesRunTurn(
       const stallTimeoutSec = wsPlan?.stallTimeoutSec ?? config.stallTimeoutSec;
       // A disabled watchdog (0) is not a zero preflight: it would commit SSE before Devin's first
       // event and deliver a pre-output 429 in-stream. Fall back to the default finite bound.
-      const preflightDeadlineAt = grokDevinPreflight
+      // A key-pool preflight must not outlast the stall budget, or a silent CLI holds the SSE
+      // Response (heartbeats, stall watchdog) hostage; the OAuth preflight wait is unchanged.
+      const keyPoolPreflight = transportState.runTurnAdapter.name === "qoder"
+        && route.provider.authMode !== "oauth" && hasKeyPoolFailover(route.provider);
+      const preflightDeadlineAt = grokDevinPreflight || keyPoolPreflight
         ? Date.now() + (resolveStallTimeoutSec(stallTimeoutSec) || DEFAULT_STALL_TIMEOUT_SEC) * 1_000
         : undefined;
       if (runTurnFailoverArmed()) {