@bitkyc08/opencodex 2.86.0 → 2.87.0

package/src/server/chat-native-reasoning.ts

@@ -0,0 +1,123 @@
+import type { OcxProviderConfig, OcxReasoningReplayScopeRef } from "../types";
+import type { TranslatorBudget } from "../lib/translator-budget";
+import { chatReasoningReplayPolicy, isChatRecord } from "../adapters/openai-chat/reasoning-replay";
+import { bindReasoningReplayScope, reasoningReplayDestinationIdentity,
+  reasoningReplayKeyCredentialIdentity, rememberReasoningForCall } from "../responses/reasoning-replay-cache";
+import { reasoningReplayConversationIdFromResponsesRequest, sessionIdHeaderFromRequest } from "./request-log-conversation";
+
+type Rec = Record<string, unknown>;
+
+export function nativeChatReplayScope(headers: Headers): OcxReasoningReplayScopeRef | undefined {
+  const clientThreadId = reasoningReplayConversationIdFromResponsesRequest({
+    threadIdHeader: headers.get("thread-id"), sessionIdHeader: sessionIdHeaderFromRequest(headers),
+  });
+  return clientThreadId ? { clientThreadId } : undefined;
+}
+
+/** Rebind before EVERY build: a key rotation must not retrieve another credential's reasoning. */
+export function bindNativeChatReplayScope(
+  scope: OcxReasoningReplayScopeRef | undefined,
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+): void {
+  const providerDestinationIdentity = reasoningReplayDestinationIdentity(provider.baseUrl);
+  const credentialIdentity = reasoningReplayKeyCredentialIdentity(provider);
+  bindReasoningReplayScope(scope, providerDestinationIdentity && credentialIdentity ? {
+    providerName, modelId, adapterName: "openai-chat",
+    providerDestinationIdentity, credentialIdentity,
+  } : undefined);
+}
+
+/** Observe the native wire, never translate it or retain tool arguments/content. */
+export function nativeChatReasoningCapture(
+  provider: OcxProviderConfig,
+  modelId: string,
+  scope: OcxReasoningReplayScopeRef | undefined,
+  budget: TranslatorBudget,
+) {
+  const choices = new Map<number, { text: string; calls: Map<number, string> }>();
+  const accounting = { kind: "retained_collectors" as const };
+  // This optional fallback cannot retain more than the cache it feeds (256 KiB / 64 calls).
+  const maxBytes = 256 * 1024;
+  let bytes = 0;
+  let callCount = 0;
+  let disabled = !scope?.current || !chatReasoningReplayPolicy(provider, modelId).preserve;
+  const discard = () => {
+    budget.releaseRetained(bytes, accounting);
+    bytes = 0;
+    choices.clear();
+    disabled = true;
+  };
+  const remember = (text: string, calls: Iterable<string>) => {
+    for (const id of calls) rememberReasoningForCall(id, text, scope);
+  };
+  const observe = (value: Rec) => {
+    if (disabled || !Array.isArray(value.choices)) return;
+    for (const [ordinal, raw] of value.choices.entries()) {
+      if (!isChatRecord(raw) || !isChatRecord(raw.delta)) continue;
+      const index = typeof raw.index === "number" ? raw.index : ordinal;
+      if (!choices.has(index)) {
+        if (choices.size >= 64) { discard(); return; }
+        choices.set(index, { text: "", calls: new Map() });
+      }
+      const state = choices.get(index)!;
+      const delta = raw.delta;
+      const append = (previous: string, fragment: string): string | undefined => {
+        const added = Buffer.byteLength(fragment) * 2;
+        if (bytes + added > maxBytes) { discard(); return undefined; }
+        // Account the new retained fragment before concatenation; the transient reservation
+        // covers the old string while its replacement is allocated.
+        const reservation = budget.reserveTransient(Buffer.byteLength(previous) * 2, accounting);
+        try {
+          budget.chargeRetained(added, accounting);
+          bytes += added;
+          return previous + fragment;
+        } finally { reservation.release(); }
+      };
+      if (typeof delta.reasoning_content === "string" && delta.reasoning_content.length > 0) {
+        const text = append(state.text, delta.reasoning_content);
+        if (text === undefined) return;
+        state.text = text;
+      }
+      if (Array.isArray(delta.tool_calls)) {
+        for (const [toolOrdinal, tool] of delta.tool_calls.entries()) {
+          if (!isChatRecord(tool) || typeof tool.id !== "string" || tool.id.length === 0) continue;
+          const toolIndex = typeof tool.index === "number" ? tool.index : toolOrdinal;
+          if (!state.calls.has(toolIndex)) {
+            if (callCount >= 64) { discard(); return; }
+            callCount += 1;
+          }
+          const previous = state.calls.get(toolIndex) ?? "";
+          if (previous === tool.id) continue;
+          const id = append(previous, tool.id);
+          if (id === undefined) return;
+          state.calls.set(toolIndex, id);
+        }
+      }
+      // The completed choice is valid even if a caller dispatches its tool before [DONE].
+      if (typeof raw.finish_reason === "string" && raw.finish_reason.length > 0) {
+        remember(state.text, state.calls.values());
+      }
+    }
+  };
+  return {
+    observe,
+    finish(success: boolean) {
+      if (success && !disabled) {
+        for (const state of choices.values()) remember(state.text, state.calls.values());
+      }
+      discard();
+    },
+    json(value: Rec) {
+      if (disabled || !Array.isArray(value.choices)) return;
+      for (const choice of value.choices) {
+        if (!isChatRecord(choice) || !isChatRecord(choice.message)) continue;
+        const message = choice.message;
+        if (typeof message.reasoning_content !== "string" || !Array.isArray(message.tool_calls)) continue;
+        remember(message.reasoning_content, message.tool_calls.filter(isChatRecord)
+          .flatMap(tool => typeof tool.id === "string" ? [tool.id] : []));
+      }
+    },
+  };
+}

package/src/server/chat-native-sse.ts

@@ -1,5 +1,5 @@
 import { chatCompletionsErrorBody } from "../chat/outbound";
-import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
+import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode, UNDECLARED_TOOL_CALL_ERROR_CODE } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
 import {
   isTranslatorBudgetExceededError,
@@ -16,6 +16,39 @@ function isRec(value: unknown): value is Rec {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+export const UNDECLARED_CHAT_TOOL_MESSAGE = "Upstream emitted a client tool call outside this request's declared tool catalog.";
+
+function* chatToolCalls(value: Rec): Generator<{ key: string; name: string; snapshot: boolean; invalid?: boolean }> {
+  const choices = Array.isArray(value.choices) ? value.choices : [];
+  for (const [position, choice] of choices.entries()) {
+    if (!isRec(choice)) continue;
+    const choiceIndex = typeof choice.index === "number" ? choice.index : position;
+    for (const [payload, snapshot] of [[choice.delta, false], [choice.message, true]] as const) {
+      if (!isRec(payload)) continue;
+      const tools = Array.isArray(payload.tool_calls) ? payload.tool_calls : [];
+      for (const [index, tool] of tools.entries()) {
+        const fn = isRec(tool) && isRec(tool.function) ? tool.function : {};
+        const toolIndex = isRec(tool) && typeof tool.index === "number" ? tool.index : index;
+        yield {
+          key: `${choiceIndex}:tool:${toolIndex}`, name: typeof fn.name === "string" ? fn.name : "", snapshot,
+          invalid: !isRec(tool) || (tool.type !== undefined && tool.type !== "function"),
+        };
+      }
+      if (payload.function_call !== undefined && payload.function_call !== null) {
+        const fn = isRec(payload.function_call) ? payload.function_call : {};
+        yield { key: `${choiceIndex}:legacy`, name: typeof fn.name === "string" ? fn.name : "", snapshot };
+      }
+    }
+  }
+}
+
+export function chatResponseHasUndeclaredToolCalls(value: Rec, declared: ReadonlySet<string>): boolean {
+  for (const call of chatToolCalls(value)) {
+    if (call.invalid || !declared.has(call.name)) return true;
+  }
+  return false;
+}
+
 export function usageFromChat(value: unknown): OcxUsage | undefined {
   if (!isRec(value)) return undefined;
   const prompt = typeof value.prompt_tokens === "number" ? value.prompt_tokens : undefined;
@@ -134,8 +167,11 @@ interface NativeChatSseOptions {
    * `stallTimeoutSec` then resolves to disabled so a slow local model is not cut mid-turn.
    */
   localUpstream?: boolean;
+  clientDeclaredEmptyToolCatalog?: boolean;
+  declaredLegacyFunctionNames?: ReadonlySet<string>;
   onFirstOutput?: () => void;
   onUsage: (usage: OcxUsage) => void;
+  onChunk?: (value: Rec) => void;
   onTerminal?: (status: number, message?: string) => void;
   onCancel?: () => void;
 }
@@ -154,6 +190,29 @@ export function nativeChatSse(
     }
   });
   let queuedBytes = 0;
+  const declared = options.declaredLegacyFunctionNames ?? new Set<string>();
+  const toolNames = new Map<string, string>();
+  const pendingToolNames = new Set<string>();
+  const heldFrames: string[] = [];
+  let heldBytes = 0;
+  let toolNameBytes = 0;
+  const hasPendingToolName = () => pendingToolNames.size > 0;
+  const inspectToolCalls = (value: Rec): boolean => {
+    for (const call of chatToolCalls(value)) {
+      if (call.invalid) return false;
+      const previous = toolNames.get(call.key);
+      const name = call.snapshot ? call.name : (previous ?? "") + call.name;
+      if (!declared.has(name) && ![...declared].some(allowed => allowed.startsWith(name))) return false;
+      const bytes = previous === undefined ? 128 + Buffer.byteLength(call.key) * 2 + Buffer.byteLength(name) * 2
+        : Math.max(0, Buffer.byteLength(name) - Buffer.byteLength(previous)) * 2;
+      options.translatorBudget.chargeRetained(bytes, scope);
+      toolNameBytes += bytes;
+      toolNames.set(call.key, name);
+      if (declared.has(name)) pendingToolNames.delete(call.key);
+      else pendingToolNames.add(call.key);
+    }
+    return true;
+  };
   let sawFinish = false;
   let sawDone = false;
   let firstOutput = false;
@@ -191,7 +250,31 @@ export function nativeChatSse(
       throw error;
     }
   };
-  const releaseBuffer = () => buffer.clear();
+  const releaseHeld = () => {
+    options.translatorBudget.releaseRetained(heldBytes, scope);
+    heldBytes = 0;
+    heldFrames.length = 0;
+  };
+  const relay = (controller: ReadableStreamDefaultController<Uint8Array>, text: string) => {
+    if (hasPendingToolName()) {
+      const bytes = Buffer.byteLength(text) * 2;
+      options.translatorBudget.chargeRetained(bytes, scope);
+      heldBytes += bytes;
+      heldFrames.push(text);
+      return;
+    }
+    for (const frame of heldFrames) enqueue(controller, frame);
+    releaseHeld();
+    enqueue(controller, text);
+  };
+  const releaseBuffer = () => {
+    buffer.clear();
+    releaseHeld();
+    options.translatorBudget.releaseRetained(toolNameBytes, scope);
+    toolNameBytes = 0;
+    toolNames.clear();
+    pendingToolNames.clear();
+  };
   const settle = (status: number, message?: string) => {
     if (settled) return;
     settled = true;
@@ -206,12 +289,12 @@ export function nativeChatSse(
     type = "upstream_error",
   ) => {
     const safeMessage = redactSecretString(message);
+    releaseBuffer();
     try {
       const frame = `data: ${JSON.stringify(chatCompletionsErrorBody(status, safeMessage, type, code))}\n\n`;
       if (code === "translation_buffer_limit") controller.enqueue(encoder.encode(frame));
       else enqueue(controller, frame);
     } catch { /* controller may already be closed */ }
-    releaseBuffer();
     settle(status, safeMessage);
     try { void reader.cancel(new Error(safeMessage)).catch(() => {}); } catch { /* already closed */ }
     try { controller.close(); } catch { /* already closed */ }
@@ -224,16 +307,20 @@ export function nativeChatSse(
     const payload = sseDataPayload(block);
     if (payload === null) {
       if (performance.now() >= pullDeadline) throw stalled;
-      enqueue(controller, block + delimiter);
+      relay(controller, block + delimiter);
       return;
     }
     const trimmed = payload.trim();
     if (trimmed === "") {
       if (performance.now() >= pullDeadline) throw stalled;
-      enqueue(controller, block + delimiter);
+      relay(controller, block + delimiter);
       return;
     }
     if (trimmed === "[DONE]") {
+      if (hasPendingToolName()) {
+        fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+        return;
+      }
       sawDone = true;
       enqueue(controller, replaceSseDataPayload(block, "[DONE]") + delimiter);
       releaseBuffer();
@@ -272,9 +359,20 @@ export function nativeChatSse(
       return;
     }
     const usage = usageFromChat(parsed.usage);
+    options.onChunk?.(parsed);
     if (usage) options.onUsage(usage);
+    if (options.clientDeclaredEmptyToolCatalog && !inspectToolCalls(parsed)) {
+      fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+      return;
+    }
     const choices = Array.isArray(parsed.choices) ? parsed.choices : [];
     const finished = choices.some(choice => isRec(choice) && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0);
+    if (hasPendingToolName() && choices.some((choice, position) => isRec(choice)
+      && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0
+      && [...pendingToolNames].some(key => key.startsWith(`${typeof choice.index === "number" ? choice.index : position}:`)))) {
+      fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+      return;
+    }
     if (finished) sawFinish = true;
     const hasText = choices.some(choice => {
       if (!isRec(choice) || !isRec(choice.delta)) return false;
@@ -302,11 +400,11 @@ export function nativeChatSse(
     const hasProgress = hasText || hasTool;
     if (hasProgress || finished) pullDeadline = performance.now() + stallMs;
     else if (performance.now() >= pullDeadline) throw stalled;
-    if (!firstOutput && hasProgress) {
+    if (!firstOutput && hasProgress && !hasPendingToolName()) {
       firstOutput = true;
       options.onFirstOutput?.();
     }
-    enqueue(controller, replaceSseDataPayload(block, JSON.stringify(normalizedChunk(parsed, options.requestedModel))) + delimiter);
+    relay(controller, replaceSseDataPayload(block, JSON.stringify(normalizedChunk(parsed, options.requestedModel))) + delimiter);
   };
 
   function onAbort() {
@@ -336,6 +434,7 @@ export function nativeChatSse(
           if (next) {
             buffer.compact();
             processBlock(controller, next.block, next.delimiter);
+            if (heldFrames.length > 0 && !settled) continue;
             return;
           }
           if (performance.now() >= pullDeadline) throw stalled;
@@ -370,6 +469,10 @@ export function nativeChatSse(
             continue;
           }
           buffer.append(decoder.decode());
+          if (hasPendingToolName()) {
+            fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+            return;
+          }
           if (buffer.tail().trim().length > 0) {
             fail(controller, "upstream SSE ended with an unterminated event", "upstream_sse_unterminated");
             return;

package/src/server/chat-native.ts

@@ -1,5 +1,6 @@
 import { createPhysicalSendReporter } from "../lib/request-execution-budget";
 import { createInferenceSendBudget } from "./inference/context";
+import { observeAdvisorNativeReasoning } from "./inference/advisor-diagnostics";
 import { buildOpenAIChatPassthroughRequest, createOpenAIChatAdapter } from "../adapters/openai-chat";
 import type { AdapterRequest, ProviderAdapter } from "../adapters/base";
 import { isNativeChatRouteEligible } from "./chat-native-eligibility";
@@ -18,6 +19,7 @@ import {
   isCyberPolicyCode,
   isCyberPolicyMessage,
   SEND_BUDGET_EXHAUSTED_CODE,
+  UNDECLARED_TOOL_CALL_ERROR_CODE,
 } from "../lib/errors";
 import { reportDispatchSends, type RequestExecutionBudget, type SingleUseDispatchPermit } from "../lib/request-execution-budget";
 import type { AdmissionLease } from "../lib/admission";
@@ -54,10 +56,13 @@ import {
   rateLimitRetryDelayMs,
   rateLimitRetryPolicyFor,
   rotateProviderTransportOn429,
+  rotateProviderTransportOn401,
   transientRetryPolicyFor,
 } from "../providers/key-failover";
 import { fastPolicyForModel } from "../providers/service-tier";
+import { RequestPacingQueueOverloadError } from "../providers/request-pacing";
 import { stampApiKeyAccountLabel } from "../providers/label";
+import { distributedKeyPhysicalFetch, distributedKeyResponseOwner } from "../providers/api-key-response-ownership";
 import { providerApiKeySelectionIsCurrent, resolveCurrentProviderApiKeyTransport } from "../providers/api-key-selection";
 import { enrichOpenCodeZenFreeTierMessage } from "../providers/opencode-zen-rate-limit";
 import type { OcxProviderTransport } from "../providers/xai-transport";
@@ -74,7 +79,7 @@ import {
   recordAttemptCredentialSource,
   type RequestLogContext,
 } from "./request-log";
-import { jsonCompletionSse, nativeChatSse, structuredError, usageFromChat } from "./chat-native-sse";
+import { chatResponseHasUndeclaredToolCalls, UNDECLARED_CHAT_TOOL_MESSAGE, jsonCompletionSse, nativeChatSse, structuredError, usageFromChat } from "./chat-native-sse";
 import { beginInferenceAttempt, type InferenceAttempt } from "./inference/attempt";
 import { createFinalRequestLog } from "./inference/final-log";
 import { registerTurn, unregisterTurn } from "./lifecycle";
@@ -82,6 +87,7 @@ import { attachRequestSpendTracker } from "./responses/request-spend";
 import { workflowRefusalResponse } from "./workflow-refusal";
 import type { ComboProtocolSource } from "./responses/core-combo-native";
 import type { ProtocolEnvelope } from "../protocols/envelope";
+import { nativeChatReplayScope, bindNativeChatReplayScope, nativeChatReasoningCapture } from "./chat-native-reasoning";
 
 export { isNativeChatRouteEligible, nativeChatDeclineReason } from "./chat-native-eligibility";
 
@@ -275,9 +281,15 @@ export async function runNativeChatAttempt(
 ): Promise<Response> {
   const { req, config, logCtx, logIds, route, requestedModel, requestedStream, translatorBudget, finishLog } = execution;
   const { sendBudget } = execution;
+  const clientDeclaredEmptyToolCatalog = Array.isArray(execution.chatBody.tools) && execution.chatBody.tools.length === 0;
+  const declaredLegacyFunctionNames = new Set<string>(clientDeclaredEmptyToolCatalog && Array.isArray(execution.chatBody.functions)
+    ? execution.chatBody.functions.flatMap(fn => isRec(fn) && typeof fn.name === "string" && fn.name.length > 0 ? [fn.name] : [])
+    : []);
   const { attempt } = attemptHandle;
-  const onFirstOutput = execution.onFirstOutput
+  let outputDelivered = false;
+  const notifyFirstOutput = execution.onFirstOutput
     ?? (logIds ? () => recordFirstOutput(logCtx, logIds.start) : undefined);
+  const onFirstOutput = () => { outputDelivered = true; notifyFirstOutput?.(); };
   const fail = (status: number, message: string, type?: string, code?: string | null): Response => {
     const safeMessage = redactSecretString(message);
     finishLog(status, safeMessage);
@@ -313,14 +325,23 @@ export async function runNativeChatAttempt(
   // assigned before the transport pin in core.ts.
   // Transport variant: the bare picker answers with the persisted row, which for a built-in
   // provider carries no adapter id or base URL until routedProviderConfig backfills it.
-  const proactiveKeyProvider = selectProactiveApiKeyTransport(config, route.providerName, route.provider);
-  if (proactiveKeyProvider) route.provider = proactiveKeyProvider;
+  try {
+    const proactiveKeyProvider = selectProactiveApiKeyTransport(config, route.providerName, route.provider);
+    if (proactiveKeyProvider) route.provider = proactiveKeyProvider;
+  } catch (error) {
+    cleanupAbort(); upstream.abort();
+    if (!(error instanceof RequestPacingQueueOverloadError)) throw error;
+    const refusal = fail(429, error.message, "rate_limit_error");
+    refusal.headers.set("Retry-After", String(error.retryAfterSeconds));
+    return refusal;
+  }
   let activeProvider: OcxProviderConfig = route.provider;
   stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
   const spendTracker = sendBudget ? undefined : attachRequestSpendTracker(req, logCtx);
   const physicalBudget = sendBudget ?? createInferenceSendBudget(req, logCtx);
   let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
   let activeRequest: AdapterRequest;
+  const replayScope = nativeChatReplayScope(req.headers);
   let retainedRequestBytes = 0;
   const releaseRetainedRequest = () => {
     if (retainedRequestBytes === 0) return;
@@ -333,8 +354,9 @@ export async function runNativeChatAttempt(
     retainedRequestBytes = bytes;
   };
   const buildActiveRequest = () => {
+    bindNativeChatReplayScope(replayScope, activeProvider, route.providerName, route.modelId);
     recordAttemptCredentialSource(attempt, route.providerName, activeProvider, activeAdapter.name);
-    return buildOpenAIChatPassthroughRequest(
+    const request = buildOpenAIChatPassthroughRequest(
       activeProvider,
       execution.chatBody,
       route.modelId,
@@ -342,7 +364,10 @@ export async function runNativeChatAttempt(
       fastPolicyForModel(activeProvider, route.modelId, route.providerName, "chat"),
       config.fastMode,
       route.providerName,
+      replayScope,
     );
+    observeAdvisorNativeReasoning(req.headers, logCtx, request.body);
+    return request;
   };
   try {
     activeRequest = buildActiveRequest();
@@ -421,9 +446,10 @@ export async function runNativeChatAttempt(
     } else if (!spendTracker?.charge()) throw new NativeChatSpendRefusal();
   };
 
+  let responseOwnsDistributedKey = true;
   const send = async (
     request: AdapterRequest,
-    recovery?: "rate-limit-429" | "key-429" | UpstreamSendRecovery,
+    recovery?: "rate-limit-429" | "key-429" | "key-401" | UpstreamSendRecovery,
     singleShot = false,
   ): Promise<Response> => {
     try {
@@ -453,9 +479,16 @@ export async function runNativeChatAttempt(
             onPhysicalDispatch: comboReceipt
               ? () => { if (!physicalBudget.spendEnforced) settleNonEnforcedSend(request.url); }
               : undefined,
-            dispatchOverride: async (_input, init, execute) => {
-              if (!providerApiKeySelectionIsCurrent(config, route.providerName, activeProvider)) {
-                const current = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
+            dispatchOverride: async (_input, init, execute, reacquirePacing) => {
+              for (let attempt = 0; !providerApiKeySelectionIsCurrent(config, route.providerName, activeProvider); attempt++) {
+                if (outputDelivered) throw new Error("Provider key selection is unavailable during the native Chat turn");
+                if (attempt >= 3) throw new Error("Provider key selection changed repeatedly before native Chat dispatch");
+                let current = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
+                if (!current && activeProvider.requestPacing?.enabled
+                  && (activeProvider.requestPacing.keys || activeProvider.requestPacing.keySelection === "round-robin")) {
+                  const fresh = resolveCurrentProviderApiKeyTransport(config, route.providerName, { ...activeProvider, _apiKeyAttempt: undefined });
+                  if (fresh) current = selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh;
+                }
                 if (!current || !isNativeChatRouteEligible({ ...route, provider: current }, execution.chatBody, config)) {
                   throw new Error("Provider key selection is no longer available for native Chat");
                 }
@@ -467,6 +500,11 @@ export async function runNativeChatAttempt(
                 activeRequest = buildActiveRequest();
                 try { retainRequest(activeRequest); }
                 catch (error) { activeRequest.releaseBodyObservation?.(); throw error; }
+                if (current.requestPacing?.enabled
+                  && (current.requestPacing.keys || current.requestPacing.keySelection === "round-robin")) {
+                  if (!reacquirePacing) throw new Error("Refreshed native Chat dispatch requires pacing readmission");
+                  await reacquirePacing(current, route.modelId);
+                }
               }
               // The retry closure may still hold a pre-pacing request. Replace its entire
               // wire shape, not just Authorization, and retain transport recovery flags.
@@ -495,7 +533,8 @@ export async function runNativeChatAttempt(
                 // A reselected provider transport is still a physical send: the connection policy
                 // and manual-redirect ownership wrap the selected implementation (#4992).
                 dispatched = await sendWithConnectionPolicy(
-                  (activeProvider as OcxProviderTransport).fetch ?? execute,
+                  distributedKeyPhysicalFetch((activeProvider as OcxProviderTransport).fetch ?? execute,
+                    route.providerName, activeProvider, request.url),
                   request.url,
                   applyUpstreamRecoveryInit({
                     ...init, method: request.method, headers, body: request.body,
@@ -510,6 +549,8 @@ export async function runNativeChatAttempt(
                 try { if (physicalBudget.spendEnforced) spendReport(1); }
                 finally { spendReport.close?.(); }
               }
+              responseOwnsDistributedKey = !activeProvider._apiKeyAttempt?.distributed
+                || distributedKeyResponseOwner(dispatched, config, route.providerName) !== null;
               if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
               return dispatched;
             },
@@ -566,8 +607,11 @@ export async function runNativeChatAttempt(
     }
     // Same reason as above, plus a second one: rotating here would write a cooldown against
     // a key that rate-limited nothing, and that false signal outlives the request.
-    while (response.status === 429 && !isNonReplayableResponse(response) && hasKeyPoolFailover(activeProvider)) {
-      const rotated = rotateProviderTransportOn429(config, route.providerName, activeProvider, {
+    while ((response.status === 429 || (response.status === 401 && activeProvider._apiKeyAttempt?.distributed))
+      && responseOwnsDistributedKey && !isNonReplayableResponse(response) && hasKeyPoolFailover(activeProvider)) {
+      const failureStatus = response.status;
+      const rotate = failureStatus === 401 ? rotateProviderTransportOn401 : rotateProviderTransportOn429;
+      const rotated = rotate(config, route.providerName, activeProvider, {
         retryAfter: response.headers.get("retry-after"),
         now: Date.now(),
         attemptedKey: activeProvider.apiKey,
@@ -586,7 +630,7 @@ export async function runNativeChatAttempt(
       releaseRetainedRequest();
       activeRequest = buildActiveRequest();
       retainRequest(activeRequest);
-      response = await send(activeRequest, "key-429");
+      response = await send(activeRequest, failureStatus === 401 ? "key-401" : "key-429");
     }
   } catch (error) {
     releaseRetainedRequest();
@@ -594,6 +638,11 @@ export async function runNativeChatAttempt(
     upstream.abort();
     if (req.signal.aborted) return fail(499, "Client cancelled request", "client_cancelled");
     const sendError = error instanceof UpstreamRetryEvidenceError ? error.cause : error;
+    if (sendError instanceof RequestPacingQueueOverloadError) {
+      const refusal = fail(429, sendError.message, "rate_limit_error");
+      refusal.headers.set("Retry-After", String(sendError.retryAfterSeconds));
+      return refusal;
+    }
     if (sendError instanceof SendBudgetExhaustedError) {
       // A decision this process made, answered as the Responses path answers it: 429, not 502.
       return fail(429, sendError.message, SEND_BUDGET_EXHAUSTED_CODE, SEND_BUDGET_EXHAUSTED_CODE);
@@ -704,6 +753,7 @@ export async function runNativeChatAttempt(
   }
 
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  const reasoningCapture = nativeChatReasoningCapture(activeProvider, route.modelId, replayScope, translatorBudget);
   if (contentType.includes("text/event-stream") && response.body) {
     if (requestedStream) transferTurnToStream();
     let terminalStatus: number | undefined;
@@ -740,7 +790,10 @@ export async function runNativeChatAttempt(
       signal: upstream.signal,
       stallTimeoutSec: config.stallTimeoutSec,
       localUpstream: isLocalUpstream(activeProvider.baseUrl),
+      clientDeclaredEmptyToolCatalog,
+      declaredLegacyFunctionNames,
       onFirstOutput,
+      onChunk: reasoningCapture.observe,
       onUsage: usage => {
         if (!recordKeyWireAttemptUsage(logCtx, usage)) {
           logCtx.usage = usage;
@@ -748,6 +801,7 @@ export async function runNativeChatAttempt(
         }
       },
       onTerminal: (status: number, message?: string) => {
+        reasoningCapture.finish(status < 400);
         terminalStatus = status;
         if (!requestedStream) return;
         try {
@@ -758,8 +812,9 @@ export async function runNativeChatAttempt(
           releaseStreamTurn();
         }
       },
-      ...(requestedStream ? {
-        onCancel: () => {
+      onCancel: () => {
+        reasoningCapture.finish(false);
+        if (requestedStream) {
           try {
             cleanupAbort();
             upstream.abort();
@@ -767,8 +822,8 @@ export async function runNativeChatAttempt(
           } finally {
             releaseStreamTurn();
           }
-        },
-      } : {}),
+        }
+      },
     });
     if (requestedStream) {
       return new Response(stream, {
@@ -833,6 +888,7 @@ export async function runNativeChatAttempt(
   if (error) return fail(error.status ?? 502, error.message, error.type, error.code);
   const completion = chatCompletionJson(parsedJson);
   if (!completion) return fail(502, "upstream response contained no choices", "upstream_error");
+  reasoningCapture.json(completion);
   const usage = usageFromChat(completion.usage);
   if (usage) {
     if (!recordKeyWireAttemptUsage(logCtx, usage)) {
@@ -840,6 +896,9 @@ export async function runNativeChatAttempt(
       attempt.usage = usage;
     }
   }
+  if (clientDeclaredEmptyToolCatalog && chatResponseHasUndeclaredToolCalls(completion, declaredLegacyFunctionNames)) {
+    return fail(502, UNDECLARED_CHAT_TOOL_MESSAGE, "upstream_error", UNDECLARED_TOOL_CALL_ERROR_CODE);
+  }
   onFirstOutput?.();
   try {
     const serialized = requestedStream