@desplega.ai/agent-swarm 2.5.4 → 2.7.0

package/dist/{cli-k4tjsdx9.js → cli-j3y0x2n4.js}

@@ -1,14 +1,14 @@
 import {
   renderSteeringDelivery
-} from "./cli-sxgtf5fw.js";
+} from "./cli-07q03xm2.js";
 import {
   authJsonToCredentialSelection,
   credentialsToAuthJson,
   loadAllCodexOAuthSlots
-} from "./cli-kxpfx2xr.js";
+} from "./cli-0z1xjzwa.js";
 import {
   effectiveReasoningEffort
-} from "./cli-bn0rewsy.js";
+} from "./cli-c081bj3b.js";
 import {
   isSkillLoaderCall,
   skillFromToolArgs,
@@ -19,8 +19,15 @@ import {
   orgIdentityStatus,
   renderMemoriesPrompt,
   isUnknownModelError,
+  timedFetch,
+  checkAnthropicApiKey,
+  checkOpenAiApiKey,
+  checkXaiApiKey,
+  checkOpenRouter,
+  checkDeepSeekApiKey,
+  checkOpenAICompatibleProvider,
   writeSkillsToFilesystem
-} from "./cli-277c31dw.js";
+} from "./cli-6mgdba42.js";
 import {
   isPollTracingEnabled,
   initOtel,
@@ -30,7 +37,7 @@ import {
   injectTraceContext2,
   initialize,
   ensure
-} from "./cli-abs8ndtr.js";
+} from "./cli-m30k9777.js";
 import {
   MAX_RATE_LIMIT_RESET_MS,
   isRateLimitMessage,
@@ -38,7 +45,7 @@ import {
   CODEX_CREDITS_EXHAUSTED_COOLDOWN_MS,
   resolveCodexCreditsExhaustedCooldownMs,
   parseRateLimitResetTime
-} from "./cli-gx4rm0qx.js";
+} from "./cli-vz78s5wm.js";
 import {
   terminateRegisteredProcessGroups
 } from "./cli-3ggwdtb0.js";
@@ -48,44 +55,44 @@ import {
   canonicalAzureDevOpsRepoUrl,
   parseAzureDevOpsRepoUrl,
   resolveScriptsOnlyMode
-} from "./cli-asq5ydm4.js";
+} from "./cli-6a9qfa8b.js";
 import {
   ACP_TARGET_IDS,
   isAcpTarget
-} from "./cli-5kqnemen.js";
+} from "./cli-yvy48785.js";
 import {
   checkAmpCredentials2,
   liveTestAmpCredentials2
-} from "./cli-wx2nj19m.js";
+} from "./cli-kv7sbc2c.js";
 import {
   checkClaudeCredentials2
-} from "./cli-g9vd9ece.js";
+} from "./cli-1hhbzkbb.js";
 import {
   checkClaudeManagedCredentials2
-} from "./cli-4b2z6n0m.js";
+} from "./cli-yd2nreqw.js";
 import {
   codexUserHome,
   checkCodexCredentials2
-} from "./cli-64mh9mf3.js";
+} from "./cli-ymjpkxgn.js";
 import {
   checkCursorCredentials2
-} from "./cli-25n3mv5d.js";
+} from "./cli-h5jeg46p.js";
 import {
   checkDevinCredentials2
-} from "./cli-g1cw7xtt.js";
+} from "./cli-39rrw8yp.js";
 import {
   checkDshCredentials2
-} from "./cli-5bnsc0e1.js";
+} from "./cli-gsfk58nw.js";
 import {
   checkOpencodeCredentials2
-} from "./cli-hh5we352.js";
+} from "./cli-86ehn4s5.js";
 import {
   checkGrokCredentials2
-} from "./cli-621ce7kw.js";
+} from "./cli-f12mr20z.js";
 import {
   getContextWindowSize,
   init_context_window
-} from "./cli-0shx9j93.js";
+} from "./cli-pfk92eqz.js";
 import {
   CODEX_OAUTH_POOL_SLOTS_ENV,
   isCodexOAuthConfigKey,
@@ -94,7 +101,7 @@ import {
 } from "./cli-j4bwnpkm.js";
 import {
   validateJsonSchema
-} from "./cli-gbfxp48k.js";
+} from "./cli-j0ppywdr.js";
 import {
   mapTriggerSurface,
   init_telemetry_context,
@@ -112,7 +119,7 @@ import {
   init_vcs_repo_match,
   isApiDrainingResponse,
   init_api_drain
-} from "./cli-jb30dzvk.js";
+} from "./cli-48gxjmcz.js";
 import {
   parseWorkerModelTierOverrides,
   resolveTaskModelSelection,
@@ -120,7 +127,7 @@ import {
   ProviderNameSchema,
   WorkerNudgeSchema,
   init_types
-} from "./cli-mz9afxxf.js";
+} from "./cli-9pshx6rd.js";
 import {
   generateDefaultClaudeMd2,
   generateDefaultSoulMd2,
@@ -144,50 +151,43 @@ import {
   resolveClaudeMdPath,
   syncProfileFilesToServer,
   init_profile_sync
-} from "./cli-e42vss7b.js";
+} from "./cli-x37r7qwf.js";
 import {
   isSteeringEnabled2,
   init_steering_enabled
 } from "./cli-4sydckyj.js";
-import {
-  normalizeProviderKeyAliases,
-  ModelWindowExhaustedError,
-  CLAUDE_CREDENTIALS_HINT,
-  resolveCredentialPools,
-  init_credentials
-} from "./cli-zw88zjba.js";
 import {
   init_templates3
-} from "./cli-j6rktc91.js";
+} from "./cli-v6shg7na.js";
 import {
+  validateRoute,
+  deriveDefaultRoute,
+  init_src,
   modelFamilyOf,
   windowForModelFamily,
   parseModelLimitMessage,
   parseCreditsRequiredMessage,
-  init_model_rate_limit_windows
-} from "./cli-7421jzsw.js";
-import {
-  validateRoute,
-  deriveDefaultRoute,
-  init_src
-} from "./cli-e45e4m6b.js";
-import {
-  getOpenRouterBaseUrl,
-  getOpenRouterAttributionHeaders,
-  init_openrouter_base_url
-} from "./cli-dfyv0jdy.js";
+  init_model_rate_limit_windows,
+  CREDENTIAL_POOL_VARS,
+  normalizeProviderKeyAliases,
+  ModelWindowExhaustedError,
+  splitCredentialPool,
+  CLAUDE_CREDENTIALS_HINT,
+  resolveCredentialPools,
+  init_credentials
+} from "./cli-gt4h8cxw.js";
 import {
   interpolate,
   init_template,
   configureHttpResolver,
   resolveTemplateAsync,
   init_resolver
-} from "./cli-dqygeeh5.js";
+} from "./cli-f1e0ptjj.js";
 import {
   runtimeHarnessSections,
   refreshRuntimeModelCatalog,
   init_runtime_model_catalog
-} from "./cli-6x9ma5w5.js";
+} from "./cli-803188pb.js";
 import {
   getMcpBaseUrl,
   init_constants2
@@ -205,7 +205,7 @@ import {
   registerEnvSecrets,
   registerSensitiveKeyName,
   init_secret_scrubber
-} from "./cli-n4c8e3s5.js";
+} from "./cli-708wdy32.js";
 import {
   harnessModelMismatch,
   openAICompatibleProviders,
@@ -213,9 +213,10 @@ import {
   providerBaseUrl,
   providerKeyFromEnv,
   init_src2
-} from "./cli-nwyw3zhg.js";
+} from "./cli-gxee0bqa.js";
 
 // src/commands/runner.ts
+init_src();
 import { existsSync, statSync } from "node:fs";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 init_base_prompt();
@@ -247,47 +248,47 @@ async function materializeCodexAuthJson(_slot, creds, deps = {}) {
 async function createProviderAdapter(provider) {
   switch (provider) {
     case "claude": {
-      const { ClaudeAdapter } = await import("./claude-adapter-f0afqnne.js");
+      const { ClaudeAdapter } = await import("./claude-adapter-wqt4hfkq.js");
       return new ClaudeAdapter;
     }
     case "pi": {
-      const { PiMonoAdapter } = await import("./pi-mono-adapter-fk8fkcf6.js");
+      const { PiMonoAdapter } = await import("./pi-mono-adapter-qn6qbga1.js");
       return new PiMonoAdapter;
     }
     case "codex": {
-      const { CodexAdapter } = await import("./codex-adapter-wch12q99.js");
+      const { CodexAdapter } = await import("./codex-adapter-zk59x2zh.js");
       return new CodexAdapter;
     }
     case "claude-managed": {
-      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-x81a7r65.js");
+      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-6fjqtr2z.js");
       return new ClaudeManagedAdapter;
     }
     case "devin": {
-      const { DevinAdapter } = await import("./devin-adapter-4ycy4vrf.js");
+      const { DevinAdapter } = await import("./devin-adapter-byen2cxt.js");
       return new DevinAdapter;
     }
     case "opencode": {
-      const { OpencodeAdapter } = await import("./opencode-adapter-jmpst4q4.js");
+      const { OpencodeAdapter } = await import("./opencode-adapter-26b2frdf.js");
       return new OpencodeAdapter;
     }
     case "dsh": {
-      const { DshAdapter } = await import("./dsh-adapter-2ezw3xea.js");
+      const { DshAdapter } = await import("./dsh-adapter-46wawff9.js");
       return new DshAdapter;
     }
     case "amp": {
-      const { AmpAdapter } = await import("./amp-adapter-9gaxg015.js");
+      const { AmpAdapter } = await import("./amp-adapter-sxqqvmdk.js");
       return new AmpAdapter;
     }
     case "cursor": {
-      const { CursorAdapter } = await import("./cursor-adapter-623qxqew.js");
+      const { CursorAdapter } = await import("./cursor-adapter-yss3pg7t.js");
       return new CursorAdapter;
     }
     case "grok": {
-      const { GrokAdapter } = await import("./grok-adapter-ys7gaqee.js");
+      const { GrokAdapter } = await import("./grok-adapter-ag4wks2a.js");
       return new GrokAdapter;
     }
     case "acp": {
-      const { ACPAdapter } = await import("./acp-adapter-ek38cwsv.js");
+      const { ACPAdapter } = await import("./acp-adapter-ma1js5n7.js");
       return new ACPAdapter;
     }
     default:
@@ -1222,11 +1223,15 @@ async function reportCredentialOutcomeThenFinish(input, finish) {
   await finish();
 }
 
+// src/commands/credential-refresh.ts
+init_credentials();
+init_secret_scrubber();
+
 // src/commands/provider-credentials.ts
 init_src2();
 init_src();
 init_credentials();
-init_openrouter_base_url();
+init_env_flag();
 init_secret_scrubber();
 function isBedrockMode(env) {
   const mode = env.BEDROCK_AUTH_MODE?.toLowerCase();
@@ -1269,7 +1274,7 @@ var CREDENTIAL_PROVIDER_CHECKERS = {
   devin: (env) => checkDevinCredentials2(env),
   opencode: (env, opts) => checkOpencodeCredentials2(env, opts),
   pi: async (env, opts) => {
-    const { checkPiMonoCredentials, listPiOpencodeGoModelIds } = await import("./pi-mono-adapter-fk8fkcf6.js");
+    const { checkPiMonoCredentials, listPiOpencodeGoModelIds } = await import("./pi-mono-adapter-qn6qbga1.js");
     return {
       ...await checkPiMonoCredentials(env, opts),
       opencodeGoModels: listPiOpencodeGoModelIds()
@@ -1302,27 +1307,6 @@ async function checkProviderCredentials(provider, env, opts) {
   }
   return checker(env, opts);
 }
-var LIVE_TEST_TIMEOUT_MS = 5000;
-async function timedFetch(url, init) {
-  const controller = new AbortController;
-  const timer = setTimeout(() => controller.abort(), LIVE_TEST_TIMEOUT_MS);
-  const start = Date.now();
-  try {
-    const res = await fetch(url, { ...init, signal: controller.signal });
-    let bodyText = "";
-    try {
-      bodyText = await res.text();
-    } catch {}
-    return {
-      ok: res.ok,
-      status: res.status,
-      bodyText,
-      latency_ms: Date.now() - start
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
 function asLiveError(err, latency_ms) {
   const raw = err instanceof Error ? err.message : String(err);
   return {
@@ -1331,75 +1315,56 @@ function asLiveError(err, latency_ms) {
     latency_ms
   };
 }
-async function checkAnthropicApiKey(apiKey) {
-  const r = await timedFetch("https://api.anthropic.com/v1/models", {
-    method: "GET",
-    headers: { "x-api-key": apiKey, "anthropic-version": "2023-06-01" }
-  });
-  if (r.ok)
-    return { ok: true, latency_ms: r.latency_ms };
-  return {
-    ok: false,
-    error: scrubSecrets(`HTTP ${r.status}: ${r.bodyText.slice(0, 200)}`),
-    latency_ms: r.latency_ms
-  };
+async function checkEachKey(keyType, value, check) {
+  const members = splitCredentialPool(value);
+  if (members.length === 0)
+    members.push(value.trim());
+  const results = await Promise.all(members.map(async (member) => {
+    const startedAt = Date.now();
+    try {
+      return await check(member);
+    } catch (err) {
+      return asLiveError(err, Date.now() - startedAt);
+    }
+  }));
+  const latency_ms = Math.max(...results.map((result) => result.latency_ms));
+  if (results.every((result) => result.skipped))
+    return { ok: true, skipped: true, latency_ms };
+  const keys = results.map((result, index) => ({
+    keyType,
+    index,
+    suffix: members[index].slice(-5),
+    ok: result.ok,
+    ...result.error !== undefined ? { error: result.error } : {},
+    ...result.httpStatus !== undefined ? { httpStatus: result.httpStatus } : {},
+    latency_ms: result.latency_ms
+  }));
+  const failed = keys.filter((key) => !key.ok);
+  if (failed.length === 0)
+    return { ok: true, latency_ms, keys };
+  const failures = failed.map((key) => `key ending ${key.suffix} (${key.httpStatus !== undefined ? `HTTP ${key.httpStatus}` : key.error ?? "Unknown error"})`).join(", ");
+  if (failed.length < keys.length) {
+    return {
+      ok: true,
+      latency_ms,
+      keys,
+      warning: `${failed.length} of ${keys.length} keys failed: ${failures}.`
+    };
+  }
+  if (keys.length === 1) {
+    return {
+      ok: false,
+      error: failed[0].error,
+      httpStatus: failed[0].httpStatus,
+      latency_ms,
+      keys
+    };
+  }
+  return { ok: false, error: `All ${keys.length} keys failed: ${failures}.`, latency_ms, keys };
 }
 function presenceCheckOk() {
   return { ok: true, latency_ms: 0 };
 }
-async function checkOpenAiApiKey(apiKey) {
-  const r = await timedFetch("https://api.openai.com/v1/models", {
-    method: "GET",
-    headers: { Authorization: `Bearer ${apiKey}` }
-  });
-  if (r.ok)
-    return { ok: true, latency_ms: r.latency_ms };
-  return {
-    ok: false,
-    error: scrubSecrets(`HTTP ${r.status}: ${r.bodyText.slice(0, 200)}`),
-    latency_ms: r.latency_ms
-  };
-}
-async function checkXaiApiKey(apiKey) {
-  const r = await timedFetch("https://api.x.ai/v1/models", {
-    method: "GET",
-    headers: { Authorization: `Bearer ${apiKey}` }
-  });
-  if (r.ok)
-    return { ok: true, latency_ms: r.latency_ms };
-  return {
-    ok: false,
-    error: scrubSecrets(`HTTP ${r.status}: ${r.bodyText.slice(0, 200)}`),
-    latency_ms: r.latency_ms
-  };
-}
-async function checkOpenRouter(apiKey) {
-  const url = `${getOpenRouterBaseUrl()}/models`;
-  const r = await timedFetch(url, {
-    method: "GET",
-    headers: { ...getOpenRouterAttributionHeaders(url), Authorization: `Bearer ${apiKey}` }
-  });
-  if (r.ok)
-    return { ok: true, latency_ms: r.latency_ms };
-  return {
-    ok: false,
-    error: scrubSecrets(`HTTP ${r.status}: ${r.bodyText.slice(0, 200)}`),
-    latency_ms: r.latency_ms
-  };
-}
-async function checkOpenAICompatibleProvider(provider, apiKey, baseUrl = provider.baseUrl) {
-  const r = await timedFetch(`${baseUrl.replace(/\/+$/, "")}/models`, {
-    method: "GET",
-    headers: { Authorization: `Bearer ${apiKey}` }
-  });
-  if (r.ok)
-    return { ok: true, latency_ms: r.latency_ms };
-  return {
-    ok: false,
-    error: scrubSecrets(`HTTP ${r.status}: ${r.bodyText.slice(0, 200)}`),
-    latency_ms: r.latency_ms
-  };
-}
 function codexAuthFileExists(env) {
   return checkCodexCredentials2(env).satisfiedBy === "file";
 }
@@ -1426,17 +1391,32 @@ async function validateProviderCredentials(provider, env = process.env, presence
             latency_ms: Date.now() - startedAt
           };
         }
-        const result = await validateRoute(route, env);
-        const latency_ms = Date.now() - startedAt;
-        if (result.status === "verified")
-          return { ok: true, latency_ms };
-        if (result.status === "configured")
-          return { ok: true, skipped: true, latency_ms };
-        return { ok: false, error: scrubSecrets(result.reason), latency_ms };
+        const checkRoute = async (routeEnv) => {
+          const start = Date.now();
+          const result = await validateRoute(route, routeEnv);
+          const latency_ms = Date.now() - start;
+          if (result.status === "verified")
+            return { ok: true, latency_ms };
+          if (result.status === "configured")
+            return { ok: true, skipped: true, latency_ms };
+          return {
+            ok: false,
+            error: scrubSecrets(result.reason),
+            httpStatus: result.httpStatus,
+            latency_ms
+          };
+        };
+        const keyVar = route.auth.kind === "subscription" ? "CLAUDE_CODE_OAUTH_TOKEN" : ("secretKey" in route.auth) ? route.auth.secretKey : undefined;
+        const value = keyVar ? env[keyVar] : undefined;
+        if (keyVar && value && CREDENTIAL_POOL_VARS.includes(keyVar)) {
+          return checkEachKey(keyVar, value, (member) => checkRoute({ ...env, [keyVar]: member }));
+        }
+        return checkRoute(env);
       }
       case "claude-managed": {
-        if (env.ANTHROPIC_API_KEY)
-          return checkAnthropicApiKey(env.ANTHROPIC_API_KEY);
+        if (env.ANTHROPIC_API_KEY) {
+          return checkEachKey("ANTHROPIC_API_KEY", env.ANTHROPIC_API_KEY, checkAnthropicApiKey);
+        }
         return {
           ok: false,
           error: "ANTHROPIC_API_KEY is not set.",
@@ -1444,14 +1424,30 @@ async function validateProviderCredentials(provider, env = process.env, presence
         };
       }
       case "codex": {
+        const gateway = deriveDefaultRoute("codex", env);
+        if (gateway) {
+          const result = await validateRoute(gateway, env);
+          const latency_ms = Date.now() - startedAt;
+          if (result.status === "verified")
+            return { ok: true, latency_ms };
+          if (result.status === "configured")
+            return { ok: true, skipped: true, latency_ms };
+          return {
+            ok: false,
+            error: scrubSecrets(result.reason),
+            httpStatus: result.httpStatus,
+            latency_ms
+          };
+        }
         if (codexAuthFileExists(env))
           return presenceCheckOk();
         if (parseCodexOAuthAccess(env.CODEX_OAUTH))
           return presenceCheckOk();
         if (hasCodexOAuthPoolSlots(env))
           return presenceCheckOk();
-        if (env.OPENAI_API_KEY)
-          return checkOpenAiApiKey(env.OPENAI_API_KEY);
+        if (env.OPENAI_API_KEY) {
+          return checkEachKey("OPENAI_API_KEY", env.OPENAI_API_KEY, checkOpenAiApiKey);
+        }
         return {
           ok: false,
           error: "No codex credential found (no ~/.codex/auth.json, CODEX_OAUTH, or OPENAI_API_KEY).",
@@ -1466,16 +1462,19 @@ async function validateProviderCredentials(provider, env = process.env, presence
         const status = presence ?? await checkProviderCredentials(provider, env);
         if (status.ready && status.satisfiedBy === "file")
           return presenceCheckOk();
-        if (env.OPENROUTER_API_KEY)
-          return checkOpenRouter(env.OPENROUTER_API_KEY);
-        if (env.ANTHROPIC_API_KEY)
-          return checkAnthropicApiKey(env.ANTHROPIC_API_KEY);
-        if (env.OPENAI_API_KEY)
-          return checkOpenAiApiKey(env.OPENAI_API_KEY);
+        if (env.OPENROUTER_API_KEY) {
+          return checkEachKey("OPENROUTER_API_KEY", env.OPENROUTER_API_KEY, checkOpenRouter);
+        }
+        if (env.ANTHROPIC_API_KEY) {
+          return checkEachKey("ANTHROPIC_API_KEY", env.ANTHROPIC_API_KEY, checkAnthropicApiKey);
+        }
+        if (env.OPENAI_API_KEY) {
+          return checkEachKey("OPENAI_API_KEY", env.OPENAI_API_KEY, checkOpenAiApiKey);
+        }
         for (const direct of openAICompatibleProviders()) {
           const key = providerKeyFromEnv(direct, env);
           if (key) {
-            return checkOpenAICompatibleProvider(direct, key, providerBaseUrl(direct, env));
+            return checkEachKey(direct.envVar, key, (member) => checkOpenAICompatibleProvider(direct, member, providerBaseUrl(direct, env)));
           }
         }
         if (status.ready)
@@ -1496,27 +1495,37 @@ async function validateProviderCredentials(provider, env = process.env, presence
           };
         }
         const baseUrl = env.DEVIN_API_BASE_URL ?? "https://api.devin.ai";
-        const r = await timedFetch(`${baseUrl.replace(/\/+$/, "")}/v3/self`, {
-          method: "GET",
-          headers: {
-            Authorization: `Bearer ${apiKey}`,
-            "Content-Type": "application/json"
-          }
+        return checkEachKey("DEVIN_API_KEY", apiKey, async (member) => {
+          const r = await timedFetch(`${baseUrl.replace(/\/+$/, "")}/v3/self`, {
+            method: "GET",
+            headers: {
+              Authorization: `Bearer ${member}`,
+              "Content-Type": "application/json"
+            }
+          });
+          if (r.ok)
+            return { ok: true, latency_ms: r.latency_ms };
+          return {
+            ok: false,
+            error: scrubSecrets(`HTTP ${r.status}: ${r.bodyText.slice(0, 200)}`),
+            httpStatus: r.status,
+            latency_ms: r.latency_ms
+          };
         });
-        if (r.ok)
-          return { ok: true, latency_ms: r.latency_ms };
-        return {
-          ok: false,
-          error: scrubSecrets(`HTTP ${r.status}: ${r.bodyText.slice(0, 200)}`),
-          latency_ms: r.latency_ms
-        };
       }
-      case "dsh":
-        return checkDshCredentials2(env).ready ? presenceCheckOk() : {
+      case "dsh": {
+        const deepseekKey = env.DEEPSEEK_API_KEY?.trim();
+        if (deepseekKey)
+          return checkEachKey("DEEPSEEK_API_KEY", deepseekKey, checkDeepSeekApiKey);
+        const openRouterKey = env.OPENROUTER_API_KEY?.trim();
+        if (openRouterKey)
+          return checkEachKey("OPENROUTER_API_KEY", openRouterKey, checkOpenRouter);
+        return {
           ok: false,
           error: "Set DEEPSEEK_API_KEY or OPENROUTER_API_KEY for dsh.",
           latency_ms: Date.now() - startedAt
         };
+      }
       case "amp": {
         if (!checkAmpCredentials2(env).ready) {
           return {
@@ -1525,12 +1534,15 @@ async function validateProviderCredentials(provider, env = process.env, presence
             latency_ms: Date.now() - startedAt
           };
         }
-        const live = await liveTestAmpCredentials2(env);
-        return live.ok ? { ok: true, latency_ms: Date.now() - startedAt } : {
-          ok: false,
-          error: live.error ?? "amp usage failed",
-          latency_ms: Date.now() - startedAt
-        };
+        return checkEachKey("AMP_API_KEY", env.AMP_API_KEY, async (member) => {
+          const start = Date.now();
+          const live = await liveTestAmpCredentials2({ ...env, AMP_API_KEY: member });
+          return live.ok ? { ok: true, latency_ms: Date.now() - start } : {
+            ok: false,
+            error: live.error ?? "amp usage failed",
+            latency_ms: Date.now() - start
+          };
+        });
       }
       case "cursor": {
         const apiKey = env.CURSOR_API_KEY?.trim();
@@ -1541,17 +1553,21 @@ async function validateProviderCredentials(provider, env = process.env, presence
             latency_ms: Date.now() - startedAt
           };
         }
-        const { liveTestCursorKey } = await import("./cursor-adapter-623qxqew.js");
-        const result = await liveTestCursorKey(apiKey);
-        return result.ok ? { ok: true, latency_ms: Date.now() - startedAt } : { ok: false, error: result.error, latency_ms: Date.now() - startedAt };
+        const { liveTestCursorKey } = await import("./cursor-adapter-yss3pg7t.js");
+        return checkEachKey("CURSOR_API_KEY", apiKey, async (member) => {
+          const start = Date.now();
+          const result = await liveTestCursorKey(member);
+          return result.ok ? { ok: true, latency_ms: Date.now() - start } : { ok: false, error: result.error, latency_ms: Date.now() - start };
+        });
       }
       case "grok": {
         const apiKey = env.XAI_API_KEY?.trim();
         if (apiKey)
-          return checkXaiApiKey(apiKey);
+          return checkEachKey("XAI_API_KEY", apiKey, checkXaiApiKey);
         const openRouterKey = env.OPENROUTER_API_KEY?.trim();
-        if (openRouterKey)
-          return checkOpenRouter(openRouterKey);
+        if (openRouterKey) {
+          return checkEachKey("OPENROUTER_API_KEY", openRouterKey, checkOpenRouter);
+        }
         return {
           ok: false,
           error: "Set XAI_API_KEY or OPENROUTER_API_KEY for grok.",
@@ -1572,7 +1588,7 @@ async function validateProviderCredentials(provider, env = process.env, presence
   }
 }
 function isCredCheckDisabled(env) {
-  return env.CRED_CHECK_DISABLE === "1";
+  return isEnvFlagEnabled("CRED_CHECK_DISABLE", false, env);
 }
 async function buildCredStatusReport(provider, env, opts = {}, kind) {
   const presence = await checkProviderCredentials(provider, env, opts);
@@ -1583,7 +1599,9 @@ async function buildCredStatusReport(provider, env, opts = {}, kind) {
       ok: live.ok,
       error: live.error ?? null,
       latency_ms: live.latency_ms,
-      testedAt: Date.now()
+      testedAt: Date.now(),
+      ...live.warning !== undefined ? { warning: live.warning } : {},
+      ...live.keys !== undefined ? { keys: live.keys } : {}
     };
   }
   const bedrock = presence.bedrockRegion !== undefined ? {
@@ -1678,13 +1696,56 @@ function buildLatestModelReport(opts) {
 
 // src/commands/credential-refresh.ts
 var CREDENTIAL_RETRY_INTERVAL_MS = 30000;
+var KEY_RECHECK_INTERVAL_MS = 10 * 60000;
 var BEDROCK_REFRESH_INTERVAL_MS = 5 * 60 * 1000;
+function credentialFingerprint(env) {
+  return Bun.hash(JSON.stringify([...CREDENTIAL_POOL_VARS, "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL"].map((key) => env[key] ?? null))).toString();
+}
+function recheckableFailures(liveTest) {
+  const keys = liveTest?.keys;
+  if (keys?.length) {
+    return keys.filter((key) => !key.ok && key.keyType !== "CLAUDE_CODE_OAUTH_TOKEN").length;
+  }
+  return liveTest?.ok === false ? 1 : 0;
+}
+async function reportKeyValidation(api, keys) {
+  for (const keyType of new Set(keys.map((key) => key.keyType))) {
+    try {
+      const response = await fetch(`${api.apiUrl}/api/keys/report-validation`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${api.apiKey}`,
+          "X-Agent-ID": api.agentId
+        },
+        body: JSON.stringify({
+          keyType,
+          keys: keys.filter((key) => key.keyType === keyType).map((key) => ({
+            keyIndex: key.index,
+            keySuffix: key.suffix,
+            ok: key.ok,
+            httpStatus: key.httpStatus
+          }))
+        }),
+        signal: AbortSignal.timeout(5000)
+      });
+      if (!response.ok)
+        throw new Error(`HTTP ${response.status}`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.warn(scrubSecrets(`[credentials] Failed to report key validation: ${message}`));
+    }
+  }
+}
 async function refreshCredentialStatus(api, state, harnessProvider, env, now = Date.now()) {
   if (isCredCheckDisabled(env) || state.inFlight)
     return;
   const providerChanged = state.harnessProvider !== harnessProvider;
+  const fingerprint = credentialFingerprint(env);
+  const fingerprintChanged = state.fingerprint !== fingerprint;
   const retryDue = state.ready !== true && now - state.lastRefreshAt >= CREDENTIAL_RETRY_INTERVAL_MS;
-  if (!providerChanged && !retryDue && !shouldRefreshBedrockStatus({
+  const keyRecheckDue = state.rejectedKeys > 0 && now - state.lastRefreshAt >= KEY_RECHECK_INTERVAL_MS;
+  if (!providerChanged && !fingerprintChanged && !retryDue && !keyRecheckDue && !shouldRefreshBedrockStatus({
     harnessProvider,
     env,
     lastRefreshAt: state.lastRefreshAt,
@@ -1706,8 +1767,14 @@ async function refreshCredentialStatus(api, state, harnessProvider, env, now = D
       missing: snapshot.missing,
       credStatus: snapshot
     });
-    if (state.harnessProvider === harnessProvider)
+    if (state.harnessProvider === harnessProvider) {
       state.ready = snapshot.ready;
+      state.fingerprint = fingerprint;
+      state.rejectedKeys = recheckableFailures(snapshot.liveTest);
+      const keys = snapshot.liveTest?.keys;
+      if (keys?.length)
+        await reportKeyValidation(api, keys);
+    }
   } finally {
     state.inFlight = false;
   }
@@ -1735,7 +1802,7 @@ function resolveBackoff(override, env) {
   };
   return {
     initialMs: override?.initialMs ?? parsePositive(env.BOOT_INITIAL_BACKOFF_MS, 2000),
-    maxMs: override?.maxMs ?? parsePositive(env.BOOT_MAX_BACKOFF_MS, 30000),
+    maxMs: override?.maxMs ?? parsePositive(env.BOOT_MAX_BACKOFF_MS, 1e4),
     maxWaitSeconds: override?.maxWaitSeconds ?? parsePositive(env.BOOT_MAX_WAIT_SECONDS, 0)
   };
 }
@@ -2499,6 +2566,7 @@ async function fetchResolvedEnv(apiUrl, apiKey, agentId, baseEnv = process.env,
     env
   });
   const effectiveModel = modelSelection.model || env.MODEL_OVERRIDE || "";
+  const credentialEnv = { ...env };
   const credentialSelections = await resolveCredentialPools(env, {
     apiUrl,
     apiKey,
@@ -2507,7 +2575,7 @@ async function fetchResolvedEnv(apiUrl, apiKey, agentId, baseEnv = process.env,
     localBlocks: sessionContext?.localBlocks,
     enforceModelCapacity: sessionContext?.enforceModelCapacity
   });
-  return { env, credentialSelections, resolvedProvider, scriptsOnlyConfigValue };
+  return { env, credentialEnv, credentialSelections, resolvedProvider, scriptsOnlyConfigValue };
 }
 async function ensureAgentFsCredentials(apiUrl, apiKey, agentId) {
   if (!apiUrl || !apiKey || !agentId || agentId === "unknown")
@@ -4324,7 +4392,7 @@ async function spawnProviderProcess(adapter, opts, logDir, isYolo) {
   const sessionEffort = effectiveReasoningEffort(adapter.name, model, reasoningEffortOverride);
   let oauthSelection;
   let oauthIsPoolBacked = false;
-  if (adapter.name === "codex") {
+  if (adapter.name === "codex" && !deriveDefaultRoute("codex", freshEnv)) {
     const oauthInfo = await resolveCodexOAuthCredentialInfo(opts.apiUrl, opts.apiKey);
     oauthSelection = oauthInfo?.selection;
     oauthIsPoolBacked = oauthInfo?.isPoolBacked ?? false;
@@ -5434,8 +5502,11 @@ ${additionalSystemPrompt}` : basePrompt;
     harnessProvider: null,
     ready: null,
     lastRefreshAt: 0,
-    inFlight: false
+    inFlight: false,
+    fingerprint: null,
+    rejectedKeys: 0
   };
+  let latestCredentialEnv;
   let lastHarnessReconcileAt = 0;
   const HARNESS_RECONCILE_INTERVAL_MS = 1e4;
   let lastServerCapsRefreshAt = 0;
@@ -5650,6 +5721,11 @@ ${additionalSystemPrompt}` : basePrompt;
       credentialRefreshState.harnessProvider = state.harnessProvider;
       credentialRefreshState.ready = bootCredSnapshot?.ready ?? true;
       credentialRefreshState.lastRefreshAt = Date.now();
+      credentialRefreshState.fingerprint = credentialFingerprint(process.env);
+      credentialRefreshState.rejectedKeys = recheckableFailures(bootCredSnapshot?.liveTest);
+      const keys = bootCredSnapshot?.liveTest?.keys;
+      if (keys?.length)
+        await reportKeyValidation(apiConfig, keys);
     } catch (error) {
       console.error(`[${role}] Failed to report credential readiness after recovery: ${error}`);
       process.exit(1);
@@ -6074,9 +6150,11 @@ ${additionalSystemPrompt}` : basePrompt;
       try {
         const {
           env: freshEnv,
+          credentialEnv,
           resolvedProvider,
           scriptsOnlyConfigValue
         } = await fetchResolvedEnv(apiUrl, apiKey, agentId);
+        latestCredentialEnv = credentialEnv;
         const nextScriptsOnly = resolveScriptsOnlyMode({
           env: process.env.SCRIPTS_ONLY_MCP,
           configValue: scriptsOnlyConfigValue
@@ -6089,7 +6167,7 @@ ${additionalSystemPrompt}` : basePrompt;
         console.warn(`[${role}] [harness] Reconcile fetch failed (non-fatal): ${err}`);
       }
     }
-    refreshCredentialStatus(apiConfig, credentialRefreshState, state.harnessProvider, process.env).catch((err) => console.warn(`[${role}] cred_status post_task refresh failed (non-fatal): ${err}`));
+    refreshCredentialStatus(apiConfig, credentialRefreshState, state.harnessProvider, latestCredentialEnv ?? process.env).catch((err) => console.warn(`[${role}] cred_status post_task refresh failed (non-fatal): ${err}`));
     const now = Date.now();
     for (const [taskId, task] of state.activeTasks) {
       if (vcsDetectedTasks.has(taskId))