@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/providers/quota/vendor-probes-oauth.ts

@@ -8,7 +8,7 @@ import { captureOAuthAccountSelection, credentialGeneration, getAccountCredentia
 import { hydrateKiroAccountState, persistKiroAccountState } from "../kiro-account-state-disk";
 import { kiroProbeCurrent, kiroProbeIdentity } from "./kiro-account-probe";
 import { fetchMuseKeyQuotaSnapshot } from "../muse-key-quota";
-import { CLAUDE_CLI_USER_AGENT } from "../claude-cli-identity";
+import { readAnthropicUsageQuota } from "../claude-cli-usage";
 import { XAI_GROK_CLIENT_VERSION, XAI_GROK_COMPATIBILITY } from "../xai-transport";
 import {
   commitKiroAccountUsageState,
@@ -23,7 +23,6 @@ import { providerCodexAccountMode } from "../registry";
 import {
   accountReportCurrent,
   TERMINAL_QUOTA_FAILURE,
-  hasQuotaRows,
   providerLabel,
   providerQuotaFromCodexQuota,
   publicCapacityAggregation,
@@ -228,99 +227,8 @@ export async function fetchXaiQuota(provider: string, context: { accessToken: st
   }
 }
 
-function parseClaudeBucket(value: unknown): { percent?: number; resetAt?: number } | null {
-  const rec = asRecord(value);
-  if (!rec) return null;
-  const percent = normalizePercent(rec.utilization);
-  const resetAt = normalizeResetAt(rec.resets_at);
-  if (percent === undefined && resetAt === undefined) return null;
-  return { percent, resetAt };
-}
-
-const TERMINAL_CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/gu;
-
-function parseClaudeLimit(value: unknown): ProviderQuotaWindow | null {
-  const rec = asRecord(value);
-  if (!rec) return null;
-  const percent = normalizePercent(rec.percent);
-  if (percent === undefined) return null;
-  const scope = asRecord(rec.scope);
-  const model = asRecord(scope?.model);
-  const rawLabel = String(model?.display_name ?? "")
-    .replace(TERMINAL_CONTROL_CHARACTERS, "")
-    .trim();
-  if (!rawLabel) return null;
-  const lowerLabel = rawLabel.toLowerCase();
-  const label = lowerLabel.includes("fable") ? "Fable"
-    : lowerLabel.includes("opus") ? "Opus"
-      : lowerLabel.includes("sonnet") ? "Sonnet"
-        : null;
-  // An unrecognized display_name is never published as a quota label: stripping
-  // control characters still leaves attacker-chosen residue on the quota line.
-  if (label === null) return null;
-  const resetAt = normalizeResetAt(rec.resets_at);
-  // Model scope is proven structurally here, not guessed from text: the caller admits only
-  // `kind: "weekly_scoped"`, and a limit without a recognized `scope.model.display_name` has
-  // already returned null above. Routing keys on `scope`, never on `label`.
-  return { label, scope: "model", percent, ...(resetAt !== undefined ? { resetAt } : {}) };
-}
-
-/** Claude's OAuth usage endpoint, probed with ONE account's own bearer token. */
 const anthropicUsageInflight = new Map<string, Promise<ProviderQuota | null>>();
 
-async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuota | null> {
-  const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
-    headers: {
-      Accept: "application/json, text/plain, */*",
-      "Content-Type": "application/json",
-      "User-Agent": CLAUDE_CLI_USER_AGENT,
-      "anthropic-beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05",
-      Authorization: `Bearer ${accessToken}`,
-    },
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-  });
-  if (!response.ok) return null;
-  const body = asRecord(await readQuotaJson(response));
-  if (!body) return null;
-  const fiveHour = parseClaudeBucket(body.five_hour);
-  const sevenDay = parseClaudeBucket(body.seven_day);
-  const fable = parseClaudeBucket(body.seven_day_fable);
-  const opus = parseClaudeBucket(body.seven_day_opus);
-  const sonnet = parseClaudeBucket(body.seven_day_sonnet);
-  const customWindows: ProviderQuotaWindow[] = [];
-  if (fable?.percent !== undefined) customWindows.push({ label: "Fable", scope: "model", percent: fable.percent, ...(fable.resetAt !== undefined ? { resetAt: fable.resetAt } : {}) });
-  if (opus?.percent !== undefined) customWindows.push({ label: "Opus", scope: "model", percent: opus.percent, ...(opus.resetAt !== undefined ? { resetAt: opus.resetAt } : {}) });
-  if (sonnet?.percent !== undefined) customWindows.push({ label: "Sonnet", scope: "model", percent: sonnet.percent, ...(sonnet.resetAt !== undefined ? { resetAt: sonnet.resetAt } : {}) });
-  const knownLabels = new Set(customWindows.map(window => window.label.toLowerCase()));
-  const limits = Array.isArray(body.limits) ? body.limits : [];
-  for (const rawLimit of limits) {
-    const limitRecord = asRecord(rawLimit);
-    // `session` and `weekly_all` mirror the canonical five-hour and weekly
-    // buckets above; only model-scoped weekly limits add a third window.
-    if (String(limitRecord?.kind ?? "").trim().toLowerCase() !== "weekly_scoped") continue;
-    const limit = parseClaudeLimit(rawLimit);
-    if (!limit || knownLabels.has(limit.label.toLowerCase())) continue;
-    knownLabels.add(limit.label.toLowerCase());
-    customWindows.push(limit);
-  }
-  const quota: ProviderQuota = {
-    // Claude's 5-hour window is a first-class rate limit, same as the Codex login 5h/weekly
-    // rows: report it in the canonical fields so the dashboard renders it with the standard
-    // "5-hour limit" label and ordering instead of as a generic extra window.
-    ...(fiveHour?.percent !== undefined ? { fiveHourPercent: fiveHour.percent } : {}),
-    ...(fiveHour?.resetAt !== undefined ? { fiveHourResetAt: fiveHour.resetAt } : {}),
-    ...(sevenDay?.percent !== undefined ? { weeklyPercent: sevenDay.percent } : {}),
-    ...(sevenDay?.resetAt !== undefined ? { weeklyResetAt: sevenDay.resetAt } : {}),
-    ...(customWindows.length > 0 ? { customWindows } : {}),
-    updatedAt: Date.now(),
-  };
-  // Empty / schema-changed payloads must not cache as "success with no bars".
-  return hasQuotaRows(quota) ? markAnthropicFamilyEnumeration(quota, Array.isArray(body.limits) && body.limits.every(raw => {
-    const kind = asRecord(raw)?.kind;
-    return kind === "session" || kind === "weekly_all" || kind === "weekly_scoped" && parseClaudeLimit(raw) !== null;
-  })) : null;
-}
-
 /**
  * Anthropic per-credential usage.
  *

package/src/providers/quota-types.ts

@@ -19,6 +19,8 @@ export interface ProviderQuotaWindow {
   label: string;
   percent: number;
   resetAt?: number;
+  /** Exact CCA wire model measured by this window; display evidence only, not eligibility. */
+  modelId?: string;
   /**
    * Set only when the PRODUCER proved this window covers one model family, structurally rather
    * than by reading its label: an Anthropic `seven_day_<family>` body key, or a limit with

package/src/providers/quota.ts

@@ -53,7 +53,6 @@ import {
   hydrateAccountQuotaCache,
   mayCommitAccountQuotaKey,
   mayCommitProviderQuotaKey,
-  normalizeAnthropicQuota,
   supportsPerAccountQuota,
   type AccountQuotaCacheEntry,
   type ProviderAccountQuota,
@@ -367,6 +366,7 @@ async function readExplicitAccountQuota(provider: string, accountId: string, con
     case "kimi": result = await fetchKimiQuota(provider, config, accessToken); break;
     case "command-code": result = await fetchCommandCodeQuota(provider, config, accessToken); break;
     case "devin": result = await (await import("./quota/devin")).fetchDevinQuota(provider, accessToken, credential.apiBaseUrl, config.baseUrl); break;
+    case "dsh-account": result = await (await import("./quota/dsh-account")).fetchDshAccountQuota(provider, accessToken, { accountId, credential }); break;
     default: return null;
   }
   return { result, identity, isCurrent };
@@ -424,7 +424,8 @@ async function fetchAccountQuota(
   providerConfig?: OcxProviderConfig,
   liveConfig?: OcxConfig,
 ): Promise<AccountQuotaCacheEntry> {
-  if (accountQuotaProbeSkip(provider, accountId)) return accountQuotaProbeSkip(provider, accountId)!;
+  const skipped = accountQuotaProbeSkip(provider, accountId);
+  if (skipped) return skipped;
   if (isAnthropicInstanceId(provider)) return fetchAnthropicAccountQuota(provider, accountId, forceRefresh, liveConfig);
   if (explicitAccountReader(provider)) return fetchExplicitAccountQuota(provider, accountId, forceRefresh, providerConfig);
   if (provider === "kiro") hydrateAccountQuotaCache();
@@ -432,7 +433,8 @@ async function fetchAccountQuota(
   const writerGeneration = captureConfigGeneration();
   const kiroIdentity = provider === "kiro" ? kiroProbeIdentity(accountId) : undefined;
   const cachedCandidate = accountQuotaCache.get(key);
-  const cached = provider !== "kiro" || cachedCandidate?.identity === kiroIdentity ? cachedCandidate : undefined;
+  const cached = (provider !== "kiro" || cachedCandidate?.identity === kiroIdentity)
+    && cachedCandidate?.isCurrent?.() !== false ? cachedCandidate : undefined;
   if (!forceRefresh && cached && Date.now() - cached.ts < ACCOUNT_QUOTA_TTL_MS) {
     if (provider === "google-antigravity" && cached.quotaFailure && cached.quotaFailureIsCurrent?.() !== true) return { ...cached, quotaFailure: undefined };
     return cached;
@@ -454,6 +456,7 @@ async function fetchAccountQuota(
       try { return epoch === explicitAccountEpoch && diagnosticIdentity !== undefined && diagnosticIdentity === antigravityQuotaDiagnosticIdentity(accountId); }
       catch { return false; }
     };
+    const antigravityIsCurrent = () => quotaFailureIsCurrent();
     const diagnosticFields = () => quotaFailure && quotaFailureIsCurrent() ? { quotaFailure, quotaFailureIsCurrent } : {};
     const unavailable = (): AccountQuotaCacheEntry => {
       const entry: AccountQuotaCacheEntry = {
@@ -461,9 +464,11 @@ async function fetchAccountQuota(
         quota: cached?.quota ?? null,
         unavailable: true,
         ...(provider === "kiro" ? { identity: kiroIdentity } : {}),
+        ...(provider === "google-antigravity" ? { isCurrent: antigravityIsCurrent } : {}),
         ...diagnosticFields(),
       };
-      if (mayCommitAccountQuotaKey(key, writerGeneration) && (provider !== "kiro" || kiroProbeCurrent(accountId, kiroIdentity))) {
+      if (entry.isCurrent?.() !== false && mayCommitAccountQuotaKey(key, writerGeneration)
+        && (provider !== "kiro" || kiroProbeCurrent(accountId, kiroIdentity))) {
         accountQuotaCache.set(key, entry);
         if (provider === "kiro") persistKiroAccountState();
         sweepExpiredOnWrite(entry.ts);
@@ -493,12 +498,15 @@ async function fetchAccountQuota(
           return { ts: Date.now(), quota: null, unavailable: true };
         }
       }
+      if (provider === "google-antigravity" && !antigravityIsCurrent()) return { ts: Date.now(), quota: null, unavailable: true };
       if (!quota) return unavailable();
       const entry: AccountQuotaCacheEntry = {
         ts: Date.now(), quota,
         ...(provider === "kiro" ? { identity: kiroIdentity } : {}),
+        ...(provider === "google-antigravity" ? { isCurrent: antigravityIsCurrent } : {}),
       };
       if (mayCommitAccountQuotaKey(key, writerGeneration)
+        && entry.isCurrent?.() !== false
         && (provider !== "kiro" || kiroProbeCurrent(accountId, kiroIdentity))) {
         accountQuotaCache.set(key, entry);
         if (provider === "kiro") { commitKiroAccountUsageState(key, kiroSnapshot, kiroIdentity); persistKiroAccountState(); }
@@ -530,21 +538,7 @@ export async function fetchProviderAccountQuotas(
   if (!set) return [];
   return mapQuotaRoster(set.accounts, async account => {
     const entry = await fetchAccountQuota(provider, account.id, forceRefresh, providerConfig, liveConfig);
-    const result: ProviderAccountQuota = {
-      accountId: account.id,
-      quota: isAnthropicInstanceId(provider) ? normalizeAnthropicQuota(entry.quota, Date.now()) : entry.quota,
-      ...(entry.unavailable ? { unavailable: true as const } : {}),
-      ...(entry.unavailable && entry.quotaFailure && entry.quotaFailureIsCurrent?.() === true ? { quotaFailure: entry.quotaFailure } : {}),
-    };
-    if (entry.quotaFailureIsCurrent) Object.defineProperty(result, "quotaFailureIsCurrent", { value: entry.quotaFailureIsCurrent });
-    if (isAnthropicInstanceId(provider) && entry.isCurrent) Object.defineProperty(result, "isCurrent", { value: entry.isCurrent });
-    if (!explicitAccountReader(provider)) return result;
-    const identity = entry.identity;
-    Object.defineProperty(result, "isCurrent", { value: () => {
-      if (entry.isCurrent) return entry.isCurrent();
-      const credential = getAccountCredential(provider, account.id);
-      return !!credential && (!identity || explicitQuotaIdentity(provider, account.id, providerConfig) === identity);
-    } });
-    return result;
+    const { projectAccountQuotaRow } = await import("./quota/account-row");
+    return projectAccountQuotaRow(provider, account.id, entry, providerConfig);
   });
 }

package/src/providers/registry/entries-core.ts

@@ -1,4 +1,14 @@
+import { OPENCODE_GO_BASE_URL, OPENCODE_GO_RESPONSES_DEFAULTS } from "../../types/opencode-go";
 import { KIRO_MODELS, KIRO_MODEL_CONTEXT_WINDOWS, KIRO_MODEL_REASONING_EFFORTS } from "../kiro-models";
+import {
+  DSH_ACCOUNT_MODELS,
+  DSH_ACCOUNT_DEFAULT_MODEL,
+  DSH_ACCOUNT_MODEL_CONTEXT_WINDOWS,
+  DSH_ACCOUNT_MODEL_INPUT_MODALITIES,
+  DSH_ACCOUNT_MODEL_MAX_OUTPUT_TOKENS,
+  DSH_ACCOUNT_MODEL_REASONING_EFFORTS,
+  DSH_ACCOUNT_MODEL_DISPLAY_NAMES,
+} from "../dsh-account-models";
 import { DEVIN_MODEL_CONTEXT_WINDOWS, DEVIN_MODEL_EFFORTS, DEVIN_DEFAULT_EFFORTS } from "../../adapters/devin/live-models";
 import { ANTIGRAVITY_MODELS, ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, ANTIGRAVITY_MODEL_EFFORTS, ANTIGRAVITY_MODEL_INPUT_MODALITIES } from "../antigravity-models";
 import {
@@ -506,6 +516,27 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // The proprietary generate wire has no verified per-request serialization flag.
     parallelToolCalls: false,
   },
+  {
+    id: "dsh-account",
+    label: "DeepSeek Account (DSH)",
+    adapter: "dsh-account",
+    baseUrl: "https://api.deepseek.com/anthropic",
+    authKind: "oauth",
+    oauthId: "dsh-account",
+    featured: false,
+    dashboardPreset: true,
+    note: "Import-first: reuses your installed and signed-in DeepSeek Harness Desktop account. Add account imports the grant from ~/.dsh/.credentials.yaml and verifies it with the DeepSeek platform.",
+    dashboardUrl: "https://platform.deepseek.com",
+    // Static catalog: the account token never authorizes model discovery (src/oauth/model-discovery-auth.ts).
+    liveModels: false,
+    defaultModel: DSH_ACCOUNT_DEFAULT_MODEL,
+    models: [...DSH_ACCOUNT_MODELS],
+    modelContextWindows: DSH_ACCOUNT_MODEL_CONTEXT_WINDOWS,
+    modelInputModalities: DSH_ACCOUNT_MODEL_INPUT_MODALITIES,
+    modelMaxOutputTokens: DSH_ACCOUNT_MODEL_MAX_OUTPUT_TOKENS,
+    modelReasoningEfforts: DSH_ACCOUNT_MODEL_REASONING_EFFORTS,
+    modelDisplayNames: DSH_ACCOUNT_MODEL_DISPLAY_NAMES,
+  },
   {
     id: "orcarouter-oauth",
     label: "OrcaRouter - Auth",
@@ -824,7 +855,8 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     escapeBuiltinToolNames: true,
   },
   {
-    id: "opencode-go", label: "opencode go", adapter: "openai-chat", baseUrl: "https://opencode.ai/zen/go/v1",
+    id: "opencode-go", label: "opencode go", adapter: "openai-chat", baseUrl: OPENCODE_GO_BASE_URL,
+    destinationAliases: [{ adapter: "openai-chat", baseUrl: "https://opencode.ai/inference/go/v1" }],
     authKind: "key", featured: true, dashboardUrl: "https://opencode.ai/auth", defaultModel: "kimi-k2.7-code",
     jawcodeBundle: "opencode-go", note: "GLM, DeepSeek, Kimi, Qwen, MiMo…",
     // Zen Go can close a Chat stream after a fully assembled function call without sending
@@ -846,13 +878,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     - 다른 대안 대신 이 방식을 선택한 이유: OpenCode Go documents sibling models on Chat or Anthropic endpoints, and an exact registry default preserves both those routes and explicit opt-out precedence.
     - 장점, 단점 및 영향: Each listed model reaches `/responses` from every inbound surface without changing siblings; a future upstream endpoint change requires an evidence-backed registry update.
     */
-    modelWireDefaults: {
-      "gpt-5.6-luna": "openai-responses",
-      "grok-4.6": "openai-responses",
-      "grok-4.7": "openai-responses",
-      "muse-spark-1.3-contributor": "openai-responses",
-      "muse-spark-1.2-contributor": "openai-responses",
-    },
+    modelWireDefaults: OPENCODE_GO_RESPONSES_DEFAULTS,
     modelContextWindows: {
       "kimi-k3": KIMI_K3_STANDARD_CONTEXT_WINDOW,
       // Zen Go discovers only the gateway id, so carry DeepSeek's official 1M V4.1
@@ -909,6 +935,9 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     },
     modelReasoningEfforts: {
       "gpt-5.6-luna": OPENAI_API_GPT56_REASONING_EFFORTS,
+      // Gemini's native thinkingLevel ladder; higher Codex efforts clamp to high.
+      // https://ai.google.dev/gemini-api/docs/models/gemini-4-argon
+      "gemini-4-argon-contributor": ["low", "medium", "high"],
       "grok-4.6": ["low", "medium", "high", "xhigh"],
       "grok-4.7": ["low", "medium", "high", "xhigh"],
       "glm-5.3": ZAI_GLM_53_REASONING_EFFORTS,

package/src/providers/registry/types.ts

@@ -213,7 +213,7 @@ export interface ProviderRegistryEntry {
    */
   chatCompletionsPath?: string;
   /**
-   * Endpoints this entry used to live at, kept so a saved custom provider that still points
+   * Canonical or historical endpoints, kept so a saved custom provider that still points
    * at one keeps receiving this row's metadata through `registryEntryForProviderDestination`.
    * Destination matching is by adapter plus normalized base URL, so moving a row's wire or
    * prefix would otherwise orphan every config a user wrote against the old address.

package/src/providers/request-pacing.ts

@@ -1,4 +1,5 @@
 import type { OcxProviderConfig, RequestPacingRule } from "../types";
+import { createHash } from "node:crypto";
 import type { GenerationContext } from "../lib/state-store-sweeper";
 import { carryReplayRefusal, isNonReplayableResponse, markResponseNonReplayable } from "../lib/upstream-retry";
 import { redactSecretString } from "../lib/redact";
@@ -39,7 +40,7 @@ export function registerProviderResponseProvenance(markers: WeakMap<Response, un
   responseProvenance.add(markers);
 }
 
-export type RequestPacingQueueOverloadReason = "queue_full" | "queue_expired";
+export type RequestPacingQueueOverloadReason = "queue_full" | "queue_expired" | "keys_exhausted";
 
 export class RequestPacingQueueOverloadError extends Error {
   constructor(
@@ -47,7 +48,7 @@ export class RequestPacingQueueOverloadError extends Error {
     public readonly reason: RequestPacingQueueOverloadReason,
     public readonly retryAfterSeconds: number,
   ) {
-    super(reason === "queue_full"
+    super(reason === "keys_exhausted" ? "No eligible API key remains; wait for the provider cooldown before retrying" : reason === "queue_full"
       ? `request pacing queue for provider '${providerName}' is full`
       : `request pacing queue for provider '${providerName}' exceeded the maximum queued age`);
     this.name = "RequestPacingQueueOverloadError";
@@ -62,6 +63,10 @@ export class RequestPacingProviderRemovedError extends Error {
 }
 
 interface Waiter {
+  keyLease: boolean;
+  keyId?: string;
+  keyIntervalMs: number;
+  keyMaxConcurrent: number;
   modelId?: string;
   providerIntervalMs: number;
   modelIntervalMs: number;
@@ -75,6 +80,9 @@ interface Waiter {
 }
 
 interface ProviderPacer {
+  keyNextStartAt: Map<string, number>;
+  keyInFlight: Map<string, number>;
+  keyStarts: Map<string, number>;
   queue: Waiter[];
   providerNextStartAt: number;
   modelNextStartAt: Map<string, number>;
@@ -138,6 +146,7 @@ export interface ProviderRequestPacingStatus {
   inFlight?: number;
   lastStartedAt?: number;
   lastModelId?: string;
+  keys?: Array<{ id: string; starts: number; inFlight: number; queued: number; nextSlotInMs: number }>;
 }
 
 const pacers = new Map<string, ProviderPacer>();
@@ -165,6 +174,13 @@ function normalizedInterval(rule: RequestPacingRule | undefined): number {
   return Math.max(rpmInterval, fixedInterval);
 }
 
+function keyBucket(provider: OcxProviderConfig): string | undefined {
+  if (provider.authMode === "oauth" || provider.authMode === "forward" || !provider.apiKey) return;
+  if (!provider.requestPacing?.enabled || (!provider.requestPacing.keys && provider.requestPacing.keySelection !== "round-robin")) return;
+  // Internal only: duplicate references share one bucket; never serialize a key or digest.
+  return createHash("sha256").update(provider._apiKeyAttempt?.reference ?? provider.apiKey).digest("hex");
+}
+
 function normalizedMaxConcurrent(rule: RequestPacingRule | undefined): number {
   return typeof rule?.maxConcurrentRequests === "number" && rule.maxConcurrentRequests > 0
     // Floor so runtime-injected configs that bypass the integer schema cannot admit
@@ -178,10 +194,14 @@ export function requestPacingIntervalMs(provider: OcxProviderConfig, modelId?: s
   const policy = provider.requestPacing;
   if (!policy?.enabled) return 0;
   const override = modelId ? policy.models?.[modelId] : undefined;
-  return Math.max(normalizedInterval(policy), normalizedInterval(override));
+  return Math.max(normalizedInterval(policy), normalizedInterval(override), keyBucket(provider) ? normalizedInterval(policy.keys) : 0);
 }
 
 function requestPacingIntervals(provider: OcxProviderConfig, modelId?: string): {
+  keyLease: boolean;
+  keyId?: string;
+  keyIntervalMs: number;
+  keyMaxConcurrent: number;
   providerIntervalMs: number;
   modelIntervalMs: number;
   providerMaxConcurrent: number;
@@ -189,9 +209,14 @@ function requestPacingIntervals(provider: OcxProviderConfig, modelId?: string):
 } {
   const policy = provider.requestPacing;
   if (!policy?.enabled) {
-    return { providerIntervalMs: 0, modelIntervalMs: 0, providerMaxConcurrent: 0, modelMaxConcurrent: 0 };
+    return { keyLease: false, keyIntervalMs: 0, keyMaxConcurrent: 0, providerIntervalMs: 0, modelIntervalMs: 0, providerMaxConcurrent: 0, modelMaxConcurrent: 0 };
   }
+  const keyId = keyBucket(provider);
   return {
+    keyLease: true,
+    keyId,
+    keyIntervalMs: keyId ? normalizedInterval(policy.keys) : 0,
+    keyMaxConcurrent: keyId ? normalizedMaxConcurrent(policy.keys) : 0,
     providerIntervalMs: normalizedInterval(policy),
     modelIntervalMs: modelId ? normalizedInterval(policy.models?.[modelId]) : 0,
     providerMaxConcurrent: normalizedMaxConcurrent(policy),
@@ -209,13 +234,14 @@ function requestPacingIntervals(provider: OcxProviderConfig, modelId?: string):
  */
 export function requestPacingMaxConcurrentRequests(provider: OcxProviderConfig, modelId?: string): number {
   const limits = requestPacingIntervals(provider, modelId);
-  return Math.max(limits.providerMaxConcurrent, limits.modelMaxConcurrent);
+  return Math.max(limits.providerMaxConcurrent, limits.modelMaxConcurrent, limits.keyMaxConcurrent);
 }
 
-function waiterReadyAt(state: ProviderPacer, modelId: string | undefined): number {
+function waiterReadyAt(state: ProviderPacer, modelId: string | undefined, keyId?: string): number {
   return Math.max(
     state.providerNextStartAt,
     modelId ? (state.modelNextStartAt.get(modelId) ?? 0) : 0,
+    keyId ? (state.keyNextStartAt.get(keyId) ?? 0) : 0,
   );
 }
 
@@ -224,8 +250,9 @@ function pacingRetryAfterSeconds(
   modelId: string | undefined,
   now: number,
   concurrencyCapped = false,
+  keyId?: string,
 ): number {
-  const intervalSeconds = Math.max(1, Math.ceil(Math.max(0, waiterReadyAt(state, modelId) - now) / 1000));
+  const intervalSeconds = Math.max(1, Math.ceil(Math.max(0, waiterReadyAt(state, modelId, keyId) - now) / 1000));
   // A waiter blocked by an in-flight lease has no interval to report: when the wait ends
   // in refusal, the honest answer is that the cap is saturated, not "retry every second".
   return concurrencyCapped
@@ -240,7 +267,7 @@ function makeProviderRequestSlot(
 ): BodyTrackableProviderRequestSlot {
   let released = false;
   let bodyTracked = false;
-  const leased = waiter.providerMaxConcurrent > 0 || waiter.modelMaxConcurrent > 0;
+  const leased = (!!waiter.keyId && waiter.keyLease) || waiter.providerMaxConcurrent > 0 || waiter.modelMaxConcurrent > 0;
   const slot: BodyTrackableProviderRequestSlot = {
     providerName,
     leased,
@@ -258,6 +285,7 @@ function makeProviderRequestSlot(
       released = true;
       waiter.signal?.removeEventListener("abort", releaseOnAbort);
       if (waiter.providerMaxConcurrent > 0 && state.providerInFlight > 0) state.providerInFlight -= 1;
+      if (waiter.keyId && waiter.keyLease) state.keyInFlight.set(waiter.keyId, Math.max(0, (state.keyInFlight.get(waiter.keyId) ?? 0) - 1));
       if (waiter.modelId && waiter.modelMaxConcurrent > 0) {
         const current = state.modelInFlight.get(waiter.modelId) ?? 0;
         if (current <= 1) state.modelInFlight.delete(waiter.modelId);
@@ -293,7 +321,8 @@ function rejectExpiredWaiters(providerName: string, state: ProviderPacer, now: n
         state,
         waiter.modelId,
         now,
-        waiter.providerMaxConcurrent > 0 || waiter.modelMaxConcurrent > 0,
+        waiter.providerMaxConcurrent > 0 || waiter.modelMaxConcurrent > 0 || waiter.keyMaxConcurrent > 0,
+        waiter.keyId,
       ),
     ));
   }
@@ -327,17 +356,18 @@ function runQueue(providerName: string, state: ProviderPacer): void {
 
   const providerReadyAt = Math.max(now, state.providerNextStartAt);
   const waiterIndex = state.queue.findIndex(waiter => {
+    if (waiter.keyId && waiter.keyMaxConcurrent > 0 && (state.keyInFlight.get(waiter.keyId) ?? 0) >= waiter.keyMaxConcurrent) return false;
     if (waiter.providerMaxConcurrent > 0 && state.providerInFlight >= waiter.providerMaxConcurrent) return false;
     if (waiter.modelId && waiter.modelMaxConcurrent > 0
       && (state.modelInFlight.get(waiter.modelId) ?? 0) >= waiter.modelMaxConcurrent) return false;
     const modelReadyAt = waiter.modelId ? (state.modelNextStartAt.get(waiter.modelId) ?? 0) : 0;
-    return Math.max(providerReadyAt, modelReadyAt) <= now;
+    return Math.max(providerReadyAt, modelReadyAt, waiter.keyId ? state.keyNextStartAt.get(waiter.keyId) ?? 0 : 0) <= now;
   });
   if (waiterIndex < 0) {
     let earliestAt = Number.POSITIVE_INFINITY;
     for (const waiter of state.queue) {
       const modelReadyAt = waiter.modelId ? (state.modelNextStartAt.get(waiter.modelId) ?? 0) : 0;
-      const readyAt = Math.max(providerReadyAt, modelReadyAt);
+      const readyAt = Math.max(providerReadyAt, modelReadyAt, waiter.keyId ? state.keyNextStartAt.get(waiter.keyId) ?? 0 : 0);
       const expiresAt = waiter.queuedAt + maxQueueAgeMs;
       // A waiter whose start time already passed is blocked on an in-flight lease; its release
       // re-runs this queue through a microtask, so the timer only needs its expiry backstop.
@@ -362,6 +392,11 @@ function runQueue(providerName: string, state: ProviderPacer): void {
   state.lastStartedAt = startedAt;
   state.lastModelId = waiter.modelId;
   state.providerNextStartAt = startedAt + waiter.providerIntervalMs;
+  if (waiter.keyId) {
+    state.keyNextStartAt.set(waiter.keyId, startedAt + waiter.keyIntervalMs);
+    if (waiter.keyLease) state.keyInFlight.set(waiter.keyId, (state.keyInFlight.get(waiter.keyId) ?? 0) + 1);
+    state.keyStarts.set(waiter.keyId, (state.keyStarts.get(waiter.keyId) ?? 0) + 1);
+  }
   if (waiter.modelId && waiter.modelIntervalMs > 0) {
     state.modelNextStartAt.set(waiter.modelId, startedAt + waiter.modelIntervalMs);
   }
@@ -386,22 +421,34 @@ export async function waitForProviderRequestSlot(
   // by interval only, or a follow-up would queue behind the lease its own turn holds.
   const concurrency = options?.concurrency !== false;
   const waiterIntervals = concurrency ? intervals : {
+    keyId: intervals.keyId, keyLease: false, keyIntervalMs: intervals.keyIntervalMs, keyMaxConcurrent: 0,
     providerIntervalMs: intervals.providerIntervalMs,
     modelIntervalMs: intervals.modelIntervalMs,
     providerMaxConcurrent: 0,
     modelMaxConcurrent: 0,
   };
   const paced = Math.max(intervals.providerIntervalMs, intervals.modelIntervalMs) > 0
+    || intervals.keyId !== undefined
     || waiterIntervals.providerMaxConcurrent > 0
     || waiterIntervals.modelMaxConcurrent > 0;
   if (!paced) return inertProviderRequestSlot;
   if (signal?.aborted) throw abortReason(signal);
 
   const state = pacers.get(providerName) ?? {
+    keyNextStartAt: new Map<string, number>(), keyInFlight: new Map<string, number>(), keyStarts: new Map<string, number>(),
     queue: [], providerNextStartAt: 0, modelNextStartAt: new Map<string, number>(),
     providerInFlight: 0, modelInFlight: new Map<string, number>(),
   };
   pacers.set(providerName, state);
+  // Retire removed credentials only after their queued work, leases and spacing debt end.
+  const currentKeys = new Set((provider.apiKeyPool ?? []).map(entry =>
+    keyBucket({ ...provider, apiKey: entry.key, _apiKeyAttempt: undefined })));
+  currentKeys.add(intervals.keyId);
+  for (const key of state.keyStarts.keys()) {
+    if (currentKeys.has(key) || (state.keyInFlight.get(key) ?? 0) > 0
+      || (state.keyNextStartAt.get(key) ?? 0) > runtime.now() || state.queue.some(waiter => waiter.keyId === key)) continue;
+    state.keyStarts.delete(key); state.keyInFlight.delete(key); state.keyNextStartAt.delete(key);
+  }
 
   // Give already-eligible or expired waiters a chance to leave before applying the
   // admission bound to the newest request. This preserves FIFO-ish fairness while
@@ -419,7 +466,8 @@ export async function waitForProviderRequestSlot(
         state,
         modelId,
         runtime.now(),
-        waiterIntervals.providerMaxConcurrent > 0 || waiterIntervals.modelMaxConcurrent > 0,
+        waiterIntervals.providerMaxConcurrent > 0 || waiterIntervals.modelMaxConcurrent > 0 || waiterIntervals.keyMaxConcurrent > 0,
+        waiterIntervals.keyId,
       ),
     );
   }
@@ -464,14 +512,13 @@ export async function waitForProviderRequestSlot(
  * means the exchange is already finished, so the lease returns immediately. A body that
  * is neither read nor cancelled for REQUEST_PACING_UNCONSUMED_BODY_MS releases its lease
  * and cancels the body, so a dropped Response cannot hold a slot forever. The returned
- * Response preserves status, statusText, headers, and the identity-based replay markers.
+ * Response preserves status, statusText, headers, replay markers, and registered provenance.
  */
 export function trackProviderRequestSlotBody(
   slot: ProviderRequestSlot | undefined,
   response: Response,
 ): Response {
-  // An unleased slot has nothing to return on body close, and rewrapping the Response
-  // would break identity-based markers (the eager WS relay registry is a WeakSet).
+  // An unleased slot has nothing to return on body close; preserve the response identity.
   if (!slot?.leased) return response;
   // Slots built outside waitForProviderRequestSlot (test doubles) satisfy only the public
   // ProviderRequestSlot shape; their bodies still own the release through the wrapper below.
@@ -657,24 +704,35 @@ export function providerRequestPacingStatus(
   if (state && state.queue.length > 0) {
     let earliestQueuedSlotAt = Number.POSITIVE_INFINITY;
     for (const waiter of state.queue) {
-      earliestQueuedSlotAt = Math.min(earliestQueuedSlotAt, waiterReadyAt(state, waiter.modelId));
+      earliestQueuedSlotAt = Math.min(earliestQueuedSlotAt, waiterReadyAt(state, waiter.modelId, waiter.keyId));
     }
     if (Number.isFinite(earliestQueuedSlotAt)) nextSlotAt = earliestQueuedSlotAt;
   }
-  const providerConcurrencyCap = requestPacingMaxConcurrentRequests(provider);
+  const providerConcurrencyCap = normalizedMaxConcurrent(provider.requestPacing);
+  const hasKeyAccounting = provider.requestPacing?.enabled === true && keyBucket(provider) !== undefined;
   // Gate on enabled so the status surface agrees with enforcement: a disabled requestPacing
   // block must not report in-flight leases alongside enabled: false.
-  const anyConcurrencyCap = provider.requestPacing?.enabled === true && (providerConcurrencyCap > 0
+  const anyConcurrencyCap = provider.requestPacing?.enabled === true && (hasKeyAccounting || providerConcurrencyCap > 0
     || Object.values(provider.requestPacing?.models ?? {}).some(rule => normalizedMaxConcurrent(rule) > 0));
   return {
     provider: providerName,
     enabled: provider.requestPacing?.enabled === true,
     queued: state?.queue.length ?? 0,
     nextSlotInMs: Math.max(0, Math.ceil(nextSlotAt - now)),
+    ...(provider.requestPacing?.enabled && (provider.requestPacing.keys || provider.requestPacing.keySelection === "round-robin") ? {
+      keys: (provider.apiKeyPool ?? []).map(entry => {
+        const bucket = keyBucket({ ...provider, apiKey: entry.key, _apiKeyAttempt: undefined })!;
+        return { id: entry.id, starts: state?.keyStarts.get(bucket) ?? 0, inFlight: state?.keyInFlight.get(bucket) ?? 0,
+          queued: state?.queue.filter(waiter => waiter.keyId === bucket).length ?? 0,
+          nextSlotInMs: Math.max(0, Math.ceil((state?.keyNextStartAt.get(bucket) ?? 0) - now)) };
+      }),
+    } : {}),
     // A provider cap counts every paced send in providerInFlight; model-only caps keep
     // providerInFlight at zero, so report the per-model sum for those providers instead.
     ...(anyConcurrencyCap ? {
-      inFlight: providerConcurrencyCap > 0
+      inFlight: hasKeyAccounting
+        ? [...(state?.keyInFlight.values() ?? [])].reduce((sum, count) => sum + count, 0)
+        : providerConcurrencyCap > 0
         ? state?.providerInFlight ?? 0
         : [...(state?.modelInFlight.values() ?? [])].reduce((sum, count) => sum + count, 0),
     } : {}),