@gajae-code/coding-agent 0.12.7 → 0.12.10

package/src/sdk/host/query/handlers.ts

@@ -1,4 +1,6 @@
 import { PROMPT_CLIENT_REF_MAX_LENGTH } from "../../prompt-status.js";
+import type { ActiveProviderDescriptor } from "../../providers.js";
+import { ActiveProviderResolutionError } from "../../providers.js";
 import {
 	assertCursorSelector,
 	type CursorEnvelope,
@@ -22,6 +24,7 @@ export interface SessionSurface {
 	getUsage(): unknown | Promise<unknown>;
 	getModels(): unknown | Promise<unknown>;
 	getSkillState(): unknown | Promise<unknown>;
+	getActiveProviders?(): ActiveProviderDescriptor[] | Promise<ActiveProviderDescriptor[]>;
 	/** Q12 rows preserve workflow gate fields and include stable durable gate metadata. */
 	getGates(): unknown | Promise<unknown>;
 	getConfigItems(): unknown | Promise<unknown>;
@@ -102,6 +105,7 @@ const sources: Record<string, { resource: string; method: keyof SessionSurface;
 	Q21: { resource: "queue", method: "getQueueMessages", mvcc: true },
 	Q22: { resource: "extensions", method: "getExtensions", mvcc: true },
 	Q25: { resource: "jobs", method: "getJobs", mvcc: false },
+	Q29: { resource: "activeProviders", method: "getActiveProviders", mvcc: false },
 	Q27: { resource: "modelProfiles", method: "getModelProfiles", mvcc: true },
 };
 const names = [
@@ -133,6 +137,7 @@ const names = [
 	"turn.prompt_status",
 	"models.profiles.list",
 	"skill.invoke_status",
+	"providers.list/active",
 ];
 
 export class QueryHandlers {
@@ -168,6 +173,15 @@ export class QueryHandlers {
 				return this.#error(request, "invalid_request", false, "models.profiles.list does not accept input fields.");
 			if (query === "Q27" && typeof this.surface.getModelProfiles !== "function")
 				return this.#error(request, "unavailable", false, "models.profiles.list is unavailable for this session.");
+			if (query === "Q29" && request.input && Object.keys(request.input).length > 0)
+				return this.#error(
+					request,
+					"invalid_request",
+					false,
+					"providers.list/active does not accept input fields.",
+				);
+			if (query === "Q29" && typeof this.surface.getActiveProviders !== "function")
+				return this.#error(request, "unavailable", false, "providers.list/active is unavailable for this session.");
 			const source = sources[query];
 			if (!source) return this.#error(request, "invalid_request");
 			return await this.#pageSource(request, query, source);
@@ -257,7 +271,12 @@ export class QueryHandlers {
 				source.resource === "transcript" ? { highWatermark: cursor.highWatermark } : {},
 			);
 		} else {
-			snapshot = await (this.surface[source.method] as () => unknown)();
+			try {
+				snapshot = await (this.surface[source.method] as () => unknown)();
+			} catch (error) {
+				if (queryId === "Q29") throw new ActiveProviderResolutionError();
+				throw error;
+			}
 			revision = await this.revisions.createRevision(source.resource, resourceId, snapshot);
 		}
 		if (snapshot === undefined) return this.#error(request, "resource_gone");

package/src/sdk/index.ts

@@ -22,5 +22,6 @@ export type {
 	Q10ThinkingMode,
 } from "./models";
 export * from "./prompt-status";
+export type { ActiveProviderConnectionKind, ActiveProviderDescriptor } from "./providers";
 export * from "./session";
 export * from "./session-directory";

package/src/sdk/protocol/operation-inventory.generated.json

@@ -1583,6 +1583,24 @@
 			"packages/coding-agent/test/sdk-operation-inventory.test.ts"
 		]
 	},
+	{
+		"sourceId": "registry:Q29",
+		"sourceFile": "packages/coding-agent/src/sdk/protocol/operation-registry.ts",
+		"sourceKind": "registry",
+		"decision": "include",
+		"sdkId": "providers.list/active",
+		"adapterMappings": {
+			"telegram": "prohibited",
+			"discord": "prohibited",
+			"slack": "prohibited",
+			"mcp": "generic_safe",
+			"acp": "generic_safe",
+			"daemonCli": "generic_safe"
+		},
+		"testIds": [
+			"packages/coding-agent/test/sdk-operation-inventory.test.ts"
+		]
+	},
 	{
 		"sourceId": "registry:R01",
 		"sourceFile": "packages/coding-agent/src/sdk/protocol/operation-registry.ts",

package/src/sdk/protocol/operation-registry.ts

@@ -164,6 +164,7 @@ const queries = [
 		"skill.invoke_status",
 		"Read the authoritative reconciliation status of a skill.invoke by command/turn IDs or clientRef.",
 	],
+	["providers.list/active", "List active providers."],
 ] as const;
 
 const reverse = [
@@ -243,7 +244,7 @@ function queryContinuityClass(id: string): QueryContinuityClass {
 }
 
 function queryDisposition(id: string): Record<Adapter, AdapterDisposition> {
-	if (["Q23", "Q24", "Q25", "Q26", "Q27", "Q28"].includes(id))
+	if (["Q23", "Q24", "Q25", "Q26", "Q27", "Q28", "Q29"].includes(id))
 		return dispositions({ telegram: "prohibited", discord: "prohibited", slack: "prohibited" });
 	return dispositions();
 }
@@ -306,7 +307,9 @@ export const OPERATIONS: readonly Operation[] = [
 			errorCodes:
 				id === "Q27"
 					? ["invalid_request", "resource_gone", "model_profile_registry_error"]
-					: ["invalid_request", "resource_gone"],
+					: id === "Q29"
+						? ["invalid_request", "resource_gone", "internal"]
+						: ["invalid_request", "resource_gone"],
 			continuityClass: queryContinuityClass(id),
 			adapterDispositions: queryDisposition(id),
 			testIds: ["packages/coding-agent/test/sdk-operation-inventory.test.ts"],

package/src/sdk/providers.ts

@@ -0,0 +1,51 @@
+export type ActiveProviderConnectionKind = "credential" | "credentialless";
+
+export interface ActiveProviderDescriptor {
+	provider: string;
+	connectionKind: ActiveProviderConnectionKind;
+}
+function compareProviderIdsByUtf8(left: string, right: string): number {
+	const leftBytes = new TextEncoder().encode(left);
+	const rightBytes = new TextEncoder().encode(right);
+	const length = Math.min(leftBytes.length, rightBytes.length);
+	for (let index = 0; index < length; index += 1) {
+		const difference = leftBytes[index]! - rightBytes[index]!;
+		if (difference !== 0) return difference;
+	}
+	return leftBytes.length - rightBytes.length;
+}
+
+/**
+ * Project active-provider inputs to the exact public DTO shape.
+ *
+ * Connection credentials take precedence when the same provider is reported
+ * more than once. Provider IDs are sorted by their UTF-8 bytes without
+ * normalization.
+ */
+export function projectActiveProviderDescriptors(
+	descriptors: readonly { provider: string; connectionKind: unknown }[],
+): ActiveProviderDescriptor[] {
+	const active = new Map<string, ActiveProviderConnectionKind>();
+	for (const descriptor of descriptors) {
+		if (descriptor.connectionKind !== "credential" && descriptor.connectionKind !== "credentialless") {
+			throw new Error("Invalid active provider connection kind.");
+		}
+		if (active.get(descriptor.provider) === "credential") continue;
+		active.set(descriptor.provider, descriptor.connectionKind);
+	}
+	return [...active.entries()]
+		.sort(([left], [right]) => compareProviderIdsByUtf8(left, right))
+		.map(([provider, connectionKind]) => ({ provider, connectionKind }));
+}
+
+export const ACTIVE_PROVIDER_RESOLUTION_ERROR_CODE = "internal" as const;
+export const ACTIVE_PROVIDER_RESOLUTION_ERROR_MESSAGE = "Unable to resolve active providers.";
+
+export class ActiveProviderResolutionError extends Error {
+	readonly code = ACTIVE_PROVIDER_RESOLUTION_ERROR_CODE;
+
+	constructor() {
+		super(ACTIVE_PROVIDER_RESOLUTION_ERROR_MESSAGE);
+		this.name = "ActiveProviderResolutionError";
+	}
+}

package/src/sdk/session-directory.ts

@@ -39,6 +39,7 @@ export type ResolveManagedSessionScopeResult =
 				| "sessions_root_unavailable"
 				| "binding_conflict"
 				| "binding_invalid"
+				| "migration_busy"
 				| "atomic_unavailable"
 				| "durability_not_provable"
 				| "durability_failed"

package/src/sdk/session.ts

@@ -108,10 +108,10 @@ import { MCPManager } from "../runtime-mcp";
 import { createNotificationsExtension } from "../sdk/bus";
 import {
 	getNotificationConfig,
-	isNotificationHostEligible,
+	isGenericNotificationHostEligible,
 	type NotificationConfig,
 	SPAWN_PROVENANCE_ENV,
-	shouldRegisterNotificationsExtension,
+	shouldRegisterGenericNotificationsExtension,
 } from "../sdk/bus/config";
 import { NotificationSessionController } from "../sdk/bus/session-control";
 import { shouldHostSdk } from "../sdk/host";
@@ -136,6 +136,7 @@ import {
 	buildSystemPrompt as buildSystemPromptInternal,
 	buildSystemPromptToolMetadata,
 	loadProjectContextFiles as loadContextFilesInternal,
+	loadProjectContextFilesResult as loadContextFilesResultInternal,
 } from "../system-prompt";
 import { AgentOutputManager } from "../task/output-manager";
 import { parseThinkingLevel, resolveThinkingLevelForModel, toReasoningEffort } from "../thinking";
@@ -184,6 +185,7 @@ import {
 
 type AsyncResultEntry = {
 	jobId: string;
+	generation: string;
 	result: string;
 	job: AsyncJob | undefined;
 	durationMs: number | undefined;
@@ -1165,10 +1167,10 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		// Independent discoveries that depend only on cwd/agentDir — kicked off in parallel and awaited
 		// at their respective consumer sites. Their work can overlap with model resolution, secret loading,
 		// session-context build, tool creation, MCP discovery, and extension discovery.
-		const contextFilesPromise = options.contextFiles
-			? Promise.resolve(options.contextFiles)
-			: logger.time("discoverContextFiles", discoverContextFiles, cwd, agentDir);
-		contextFilesPromise.catch(() => {});
+		const contextFilesResultPromise = options.contextFiles
+			? Promise.resolve({ contextFiles: options.contextFiles, warnings: [] })
+			: logger.time("discoverContextFiles", loadContextFilesResultInternal, { cwd });
+		contextFilesResultPromise.catch(() => {});
 		const promptTemplatesPromise = options.promptTemplates
 			? Promise.resolve(options.promptTemplates)
 			: logger.time("discoverPromptTemplates", discoverPromptTemplates, cwd, agentDir);
@@ -1464,10 +1466,12 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			}
 			return result;
 		};
-		const [contextFiles, resolvedWorkspaceTree] = await Promise.all([
-			contextFilesPromise,
+		const [contextFilesResult, resolvedWorkspaceTree] = await Promise.all([
+			contextFilesResultPromise,
 			raceWithDeadline("buildWorkspaceTree", workspaceTreePromise),
 		]);
+		const contextFiles = contextFilesResult.contextFiles;
+		const discoveredContextFileWarnings = contextFilesResult.warnings;
 
 		const backgroundJobsEnabled = isBackgroundJobSupportEnabled(settings);
 		const asyncMaxJobs = Math.min(100, Math.max(1, settings.get("async.maxJobs") ?? 100));
@@ -1502,13 +1506,14 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				? new AsyncJobManager({
 						maxRunningJobs: asyncMaxJobs,
 						onJobComplete: async (jobId, result, job) => {
-							if (!session || asyncJobManager!.isDeliverySuppressed(jobId)) return;
+							if (!session) return;
 							const formattedResult = await formatAsyncResultForFollowUp(result);
-							if (asyncJobManager!.isDeliverySuppressed(jobId)) return;
+							if (asyncJobManager!.isDeliverySuppressed(jobId, job?.generation)) return;
 
 							const durationMs = job ? jobElapsedMs(job) : undefined;
 							session.yieldQueue.enqueue<AsyncResultEntry>("async-result", {
 								jobId,
+								generation: job?.generation ?? "",
 								result: formattedResult,
 								job,
 								durationMs,
@@ -1907,7 +1912,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		const spawnProvenance = process.env[SPAWN_PROVENANCE_ENV];
 		const spawnedByGjc = typeof spawnProvenance === "string" && spawnProvenance.trim().length > 0;
 		delete process.env[SPAWN_PROVENANCE_ENV];
-		const notificationHostEligible = isNotificationHostEligible({
+		const notificationHostEligible = isGenericNotificationHostEligible({
 			env: process.env,
 			hostModeSupported: options.notificationHostModeSupported ?? true,
 			taskDepth,
@@ -1919,10 +1924,11 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		const notificationSessionController = new NotificationSessionController({
 			eligible: notificationHostEligible,
 			getConfig: () => getNotificationConfig(settings),
+			spawnedByGjc,
 		});
 		if (
 			lifecycleStartupCapability ||
-			shouldRegisterNotificationsExtension({
+			shouldRegisterGenericNotificationsExtension({
 				env: process.env,
 				cfg: notificationCfg,
 				taskDepth,
@@ -2230,6 +2236,11 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			settings.get("tools.intentTracing"),
 			options.hasUI ?? false,
 		);
+		const emittedContextFileWarnings = new Set(discoveredContextFileWarnings);
+		const contextFileWarnings = [...discoveredContextFileWarnings];
+		for (const warning of discoveredContextFileWarnings) {
+			logger.warn("Context file discovery warning", { warning });
+		}
 		const intentField = intentTracingEnabled ? INTENT_FIELD : undefined;
 		const rebuildSystemPrompt = async (
 			toolNames: string[],
@@ -2308,14 +2319,22 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				subagent: options.parentTaskPrefix !== undefined,
 			});
 
+			for (const warning of defaultPrompt.warnings) {
+				if (emittedContextFileWarnings.has(warning)) continue;
+				emittedContextFileWarnings.add(warning);
+				contextFileWarnings.push(warning);
+				if (hasSession) session.configWarnings.push(warning);
+				logger.warn("Context file discovery warning", { warning });
+			}
 			if (options.systemPrompt === undefined) {
 				return defaultPrompt;
 			}
 			if (Array.isArray(options.systemPrompt)) {
-				return { systemPrompt: options.systemPrompt };
+				return { systemPrompt: options.systemPrompt, warnings: defaultPrompt.warnings };
 			}
 			return {
 				systemPrompt: options.systemPrompt(defaultPrompt.systemPrompt),
+				warnings: defaultPrompt.warnings,
 			};
 		};
 
@@ -2794,10 +2813,11 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			forkContextSeed: options.forkContextSeed,
 			providerSessionState: options.providerSessionState,
 		});
+		session.configWarnings.push(...contextFileWarnings);
 		hasSession = true;
 		if (asyncJobManager) {
 			session.yieldQueue.register<AsyncResultEntry>("async-result", {
-				isStale: entry => asyncJobManager.isDeliverySuppressed(entry.jobId),
+				isStale: entry => asyncJobManager.isDeliverySuppressed(entry.jobId, entry.generation),
 				build: buildAsyncResultBatchMessage,
 			});
 		}

package/src/session/agent-session.ts

@@ -109,6 +109,7 @@ import {
 	streamSimple,
 } from "@gajae-code/ai";
 import {
+	type AuthDisposition,
 	beginAttempt,
 	classifyFallbackTrigger,
 	type FallbackAttemptToken,
@@ -1869,13 +1870,6 @@ export class AgentSession {
 		this.#retryReplayEpoch++;
 		this.#retryReplayUnsafeEpoch = undefined;
 		this.#firstEventTimeoutRetryStartedAt = Date.now();
-		if (
-			this.#extensionRunner?.hasHandlers("context") ||
-			this.#extensionRunner?.hasHandlers("before_provider_request") ||
-			this.#extensionRunner?.hasHandlers("after_provider_response")
-		) {
-			this.#markRetryReplayUnsafe();
-		}
 	}
 
 	#markRetryReplayUnsafe(): void {
@@ -1885,6 +1879,14 @@ export class AgentSession {
 	get #hasCleanRetryReplaySafety(): boolean {
 		return this.#retryReplayEpoch > 0 && this.#retryReplayUnsafeEpoch !== this.#retryReplayEpoch;
 	}
+	#bindAttemptScope(scope: AttemptScope | undefined): void {
+		if (!scope) return;
+		this.#attemptRecordStore.register(scope);
+		this.#attemptRecordStore.establishClean(scope);
+	}
+	#isRetryScopeClean(scope: AttemptScope | undefined): boolean {
+		return scope !== undefined && this.#attemptRecordStore.isClean(scope);
+	}
 	#prePromptContextCheckPromise: Promise<void> | undefined = undefined;
 	/** Display-only context snapshot; pre-prompt compaction estimates deliberately remain uncached. */
 	#contextUsageCache: { key: string; value: ContextUsage } | undefined;
@@ -1898,6 +1900,8 @@ export class AgentSession {
 	// Handoff state
 	#handoffAbortController: AbortController | undefined = undefined;
 	#skipPostTurnMaintenanceAssistantTimestamp: number | undefined = undefined;
+	/** Scope cleanliness captured after message_end extension delivery and before terminal agent_end retirement. */
+	#assistantAttemptScopes = new WeakMap<AssistantMessage, { scope?: AttemptScope; wasClean: boolean }>();
 
 	// Retry state
 	#retryAbortController: AbortController | undefined = undefined;
@@ -2606,6 +2610,7 @@ export class AgentSession {
 		if (this.#extensionRunner && typeof this.#extensionRunner.setAttemptRecordStore === "function") {
 			this.#extensionRunner.setAttemptRecordStore(this.#attemptRecordStore);
 		}
+		this.agent.setMainAttemptScopeObserver(scope => this.#bindAttemptScope(scope));
 		this.#skills = config.skills ?? [];
 		this.#skillWarnings = config.skillWarnings ?? [];
 		this.#customCommands = config.customCommands ?? [];
@@ -3739,11 +3744,7 @@ export class AgentSession {
 	/** Internal handler for agent events - shared by subscribe and reconnect */
 	#handleAgentEvent = async (event: AgentEvent, activePromptHandle?: string): Promise<void> => {
 		const attemptScope = (event as AgentEvent & { scope?: AttemptScope }).scope;
-		if ((event.type === "agent_start" || event.type === "turn_start") && attemptScope) {
-			this.#attemptRecordStore.register(attemptScope);
-			this.#attemptRecordStore.establishClean(attemptScope);
-		}
-		if (this.#extensionRunner?.hasHandlers(event.type)) this.#markRetryReplayUnsafe();
+
 		if (
 			event.type === "tool_execution_start" ||
 			event.type === "tool_execution_update" ||
@@ -3947,6 +3948,12 @@ export class AgentSession {
 		}
 
 		await this.#emitSessionEvent(displayEvent);
+		if (event.type === "message_end" && event.message.role === "assistant") {
+			this.#assistantAttemptScopes.set(event.message, {
+				scope: attemptScope,
+				wasClean: this.#isRetryScopeClean(attemptScope),
+			});
+		}
 		if (
 			displayEvent !== event &&
 			displayEvent.type === "message_end" &&
@@ -4321,7 +4328,14 @@ export class AgentSession {
 			if (this.#isRetryableError(msg)) {
 				const transportFailure = (msg as AssistantMessage & { transportFailure?: TransportFailureFacts })
 					.transportFailure;
-				const didRetry = await this.#handleRetryableError(msg, false, transportFailure);
+				const messageScope = this.#assistantAttemptScopes.get(msg);
+				const didRetry = await this.#handleRetryableError(
+					msg,
+					false,
+					transportFailure,
+					messageScope?.scope ?? event.scope,
+					messageScope?.wasClean ?? false,
+				);
 				if (didRetry) return; // Retry was initiated, don't proceed to compaction
 			}
 			if (this.#retryAttempt > 0) {
@@ -5838,6 +5852,7 @@ export class AgentSession {
 		this.#abortActiveMidRunBarriers();
 		this.abortCompaction();
 		this.agent.abort();
+		this.agent.setMainAttemptScopeObserver(undefined);
 		// Disconnect the Agent event bridge NOW — before the maintenance join and the
 		// bounded idle / forceAbort below — so no agent_end emitted during teardown
 		// (including the one forceAbort emits) can re-enter #handleAgentEvent and start
@@ -14214,6 +14229,12 @@ export class AgentSession {
 			);
 		}
 		const trigger = classifyFallbackTrigger(transportFailure ?? { status: message.errorStatus });
+		// A plain `forbidden` is terminal. Without this, the blanket
+		// `transportFailure` admission below re-admits a committed forbidden
+		// failure into retry policy: credential mutation is vetoed downstream, but
+		// the chain would still retry and advance models on a request the caller is
+		// simply not authorized to make.
+		if (trigger.class === "auth" && trigger.authDisposition === "forbidden") return false;
 		if (transportFailure) return true;
 		if (
 			trigger.class === "rate_limit" ||
@@ -14573,6 +14594,8 @@ export class AgentSession {
 			outcome.failure.message,
 			true,
 			outcome.failure.transportFailure,
+			outcome.scope,
+			this.#isRetryScopeClean(outcome.scope),
 		) as Promise<ManagedAttemptDecision>;
 	}
 
@@ -14600,7 +14623,10 @@ export class AgentSession {
 		message: AssistantMessage,
 		allowLegacyUsageLimit: boolean,
 		transportFailure?: TransportFailureFacts,
-	): { class: FallbackTriggerClass; retryAfterMs?: number } | undefined {
+		// `authDisposition` is carried through from `classifyFallbackTrigger`, whose
+		// result is returned verbatim below. Narrowing it away here would silently
+		// disable the terminal-403 guard in `#markFailedCredential`.
+	): { class: FallbackTriggerClass; retryAfterMs?: number; authDisposition?: AuthDisposition } | undefined {
 		if (classifyContextOverflow(message, transportFailure, this.model?.contextWindow ?? 0)) return undefined;
 		const transport = classifyFallbackTrigger(transportFailure ?? { status: message.errorStatus });
 		if (transport.class !== "other") return transport;
@@ -14707,25 +14733,60 @@ export class AgentSession {
 		return `Model fallback chain exhausted; models tried: ${tried}; models skipped: ${skipped}`;
 	}
 
-	async #markFailedCredential(trigger: { class: FallbackTriggerClass; retryAfterMs?: number }): Promise<boolean> {
+	/**
+	 * Marks the credential that just failed and reports whether the session
+	 * actually moved to a DIFFERENT stored credential.
+	 *
+	 * Three invariants this enforces, in order:
+	 *
+	 * 1. **Pin guard, first and for every trigger class.** A pinned credential
+	 *    (`--api-key` or `--credential`) must never be mutated or rotated away
+	 *    from. Both overrides are consulted: they live in separate maps, so
+	 *    checking only `hasRuntimeApiKey` would silently rotate a `--credential`
+	 *    pin. Previously the guard existed only on the quota path, so the `auth`
+	 *    path invalidated pinned credentials outright.
+	 * 2. **A terminal `forbidden` never mutates credential state.** Rotation
+	 *    would hide an authorization defect and cycle through healthy rows.
+	 * 3. **Distinct-row proof in BOTH branches.** `invalidateCredentialMatching`
+	 *    reports "I matched and blocked a row", which is not the same as "the
+	 *    session now uses a different credential" — with a single-row pool it is
+	 *    true while nothing rotated. Both branches therefore re-resolve and
+	 *    require the active key to have actually changed.
+	 */
+	async #markFailedCredential(trigger: {
+		class: FallbackTriggerClass;
+		retryAfterMs?: number;
+		authDisposition?: AuthDisposition;
+	}): Promise<boolean> {
 		if (!this.model || (trigger.class !== "auth" && trigger.class !== "quota" && trigger.class !== "rate_limit")) {
 			return false;
 		}
+		// (2) Terminal forbidden: no credential state may change.
+		if (trigger.class === "auth" && trigger.authDisposition === "forbidden") return false;
+
 		const authStorage = this.#modelRegistry.authStorage;
+		const provider = this.model.provider;
+		// (1) Pin guard, before any mutation and for every branch.
+		if (authStorage.hasRuntimeApiKey(provider) || authStorage.hasRuntimeCredentialSelector(provider)) return false;
+
 		const providerAffinitySessionId = this.agent.providerSessionId ?? this.agent.sessionId ?? this.sessionId;
+		const activeApiKey = await this.#modelRegistry.getApiKey(this.model, providerAffinitySessionId);
+
+		let mutated: boolean;
 		if (trigger.class === "auth") {
-			const apiKey = await this.#modelRegistry.getApiKey(this.model, providerAffinitySessionId);
-			if (!isAuthenticated(apiKey)) return false;
-			return authStorage.invalidateCredentialMatching(this.model.provider, apiKey, {
+			if (!isAuthenticated(activeApiKey)) return false;
+			mutated = await authStorage.invalidateCredentialMatching(provider, activeApiKey, {
 				sessionId: providerAffinitySessionId,
 			});
+		} else {
+			mutated = await authStorage.markUsageLimitReached(provider, providerAffinitySessionId, {
+				retryAfterMs: trigger.retryAfterMs,
+			});
 		}
-		if (authStorage.hasRuntimeApiKey(this.model.provider)) return false;
-		const activeApiKey = await this.#modelRegistry.getApiKey(this.model, providerAffinitySessionId);
-		const rotated = await authStorage.markUsageLimitReached(this.model.provider, providerAffinitySessionId, {
-			retryAfterMs: trigger.retryAfterMs,
-		});
-		return rotated && (await this.#modelRegistry.getApiKey(this.model, providerAffinitySessionId)) !== activeApiKey;
+		if (!mutated) return false;
+
+		// (3) Distinct-row proof.
+		return (await this.#modelRegistry.getApiKey(this.model, providerAffinitySessionId)) !== activeApiKey;
 	}
 
 	/** Handle retryable errors with exponential backoff. */
@@ -14733,6 +14794,8 @@ export class AgentSession {
 		message: AssistantMessage,
 		managedOutcome = false,
 		transportFailure?: TransportFailureFacts,
+		scope?: AttemptScope,
+		scopeWasClean = this.#isRetryScopeClean(scope),
 	): Promise<boolean | ManagedAttemptDecision> {
 		const controller = this.#defaultFallbackChain();
 		const managedFallback = controller.chain.entries.length > 1;
@@ -14747,12 +14810,16 @@ export class AgentSession {
 		if (!managedFallback && !retrySettings.enabled) return false;
 		const classification = this.#classifyErrorForRetry(message);
 		const firstEventTimeout = classification === "first_event_timeout";
-		if (!managedFallback && firstEventTimeout) {
-			this.#firstEventTimeoutRetryStartedAt ??= Date.now();
+		if (!managedFallback && firstEventTimeout && this.#retryAttempt === 0) {
+			this.#firstEventTimeoutRetryStartedAt = Date.now();
 		}
-		// First-event timeouts are replay-safe only before any model progress,
-		// abort, or extension/provider lifecycle participation.
-		if (firstEventTimeout && (!this.#hasCleanRetryReplaySafety || assistantMessageHasVisibleOrToolContent(message))) {
+		const requiresScopedFirstEventTimeout = managedFallback || !legacyRetryConfigured;
+		if (
+			firstEventTimeout &&
+			(assistantMessageHasVisibleOrToolContent(message) ||
+				(this.#retryAttempt > 0 && !this.#hasCleanRetryReplaySafety) ||
+				(requiresScopedFirstEventTimeout && (!this.#isTypedFirstEventTimeout(message) || !scope || !scopeWasClean)))
+		) {
 			return managedOutcome
 				? {
 						type: "terminal",
@@ -14780,14 +14847,12 @@ export class AgentSession {
 		// before the failure. This bypasses #hasCleanRetryReplaySafety because the
 		// content-free check is the replay-safety guarantee for credential rotation.
 		const canReplayRotatedCredential = credentialRotated;
-		// Bare defaults admit only clean, side-effect-free canonical stream watchdog failures,
-		// content-free quota/rate-limit credential rotations, and the explicit Codex
-		// capacity-overload event.
+		// Bare defaults retain their narrow watchdog and Codex admissions. A
+		// first-event timeout adds the typed, content-free, current-clean-scope
+		// requirement above; other transient watchdogs preserve legacy behavior.
 		if (!managedFallback && !legacyRetryConfigured && !canReplayRotatedCredential) {
 			const bareDefaultCodexOverload = isBareDefaultCodexOverload(message);
 			const bareDefaultWrappedFirstEventTimeout = isBareDefaultWrappedFirstEventTimeout(message);
-			// Content-free Codex overload is replay-safe by the same reasoning as
-			// credential rotation: no partial output means no observable state.
 			const canReplayCodexOverload = bareDefaultCodexOverload;
 			if (
 				(!canReplayCodexOverload &&
@@ -14796,7 +14861,7 @@ export class AgentSession {
 					(hasBareDefaultRetryDisqualifyingFacts(message) ||
 						(classification !== "transient" && classification !== "first_event_timeout") ||
 						!BARE_DEFAULT_WATCHDOG_ERROR.test(message.errorMessage ?? ""))) ||
-				(!canReplayCodexOverload && !this.#hasCleanRetryReplaySafety)
+				(!canReplayCodexOverload && !firstEventTimeout && !this.#hasCleanRetryReplaySafety)
 			) {
 				return false;
 			}
@@ -14816,8 +14881,15 @@ export class AgentSession {
 			credentialRotated = await this.#markFailedCredential(trigger);
 		}
 		if (credentialRotated) {
-			if (managedFallback) controller.restorePreviousEntryForRetry();
-			outcome = "retry";
+			// A rotation only becomes a same-model retry if the controller can
+			// actually be rewound. `restorePreviousEntryForRetry()` refuses once an
+			// entry's restore budget is consumed or attempts are exhausted; ignoring
+			// that would force `outcome = "retry"` while `activeIndex` stays on the
+			// next entry and `this.model` stays on the previous one — splitting
+			// attempt attribution, exhaustion, and sticky selection across two models.
+			if (!managedFallback || controller.restorePreviousEntryForRetry()) {
+				outcome = "retry";
+			}
 		}
 		if (outcome === "exhausted") {
 			if (managedFallback) {