@yansigit/opencodex 2.31.1 → 2.31.3

package/src/server/responses/core.ts

@@ -106,12 +106,26 @@ import {
   rotateAnthropicAccountOn429,
 } from "../../oauth/anthropic-routing";
 import {
+  antigravity429StickWaitMs,
+  antigravitySessionKeyFromParts,
   bindAntigravityProject,
-  isAntigravityAccountInCooldown,
-  nextAntigravityAccount,
+  bindAntigravitySessionAffinity,
+  resolveAntigravityAccountForSession,
+  rotateAntigravityAccountOn429,
 } from "../../oauth/antigravity-routing";
-import { getAccountCredential, getAccountSet, setActiveAccount } from "../../oauth/store";
-import { buildWebSearchTool, planWebSearch, runWithWebSearch, shouldResolveOpenAiWebSearchSidecar } from "../../web-search";
+import {
+  CURSOR_POOL_MAX_FAILOVERS_PER_REQUEST,
+  bindCursorSessionAffinity,
+  cursorSessionKeyFromParts,
+  formatCursorProviderForLog,
+  isCursorAccountPoolActive,
+  recordCursorAccountBillingCooldown,
+  resolveCursorAccountForSession,
+  rotateCursorAccountOn429,
+  rotateCursorAccountOnAuth,
+} from "../../oauth/cursor-routing";
+import { getAccountCredential } from "../../oauth/store";
+import { buildWebSearchTool, mediaBridgeWillRun, planWebSearch, resolveCcaInTurnGrounding, runWithWebSearch, shouldResolveOpenAiWebSearchSidecar } from "../../web-search";
 import { buildImageTool, buildVideoTool, planImageBridge, planVideoBridge, runWithImageBridge, clampImageMaxRounds, IMAGE_GEN_TOOL_NAME, VIDEO_GEN_TOOL_NAME } from "../../images";
 import { describeImagesInPlace, isModelTextOnly, planVisionSidecar, resolveOpenAiVisionModel, shouldResolveOpenAiVisionSidecar, stripImagesInPlace } from "../../vision";
 import { createAdapterEventQueue, preflightAdapterEvents, type AdapterEventQueue } from "../../adapters/run-turn-queue";
@@ -506,7 +520,7 @@ function bindRouteReasoningReplayScope(args: {
     // seed assigned before route binding. A Cursor conversation must be scoped to the exact
     // provider/destination/adapter/model/credential that serves it.
     if (continuationOwner) parsed._cursorIdentityScope = providerContinuationRouteScope(continuationOwner);
-    else if (!parsed._cursorIdentityScope?.startsWith("cursor-unowned:")) {
+    else if (!parsed._cursorIdentityScope?.trim()) {
       // Prevent the adapter's token-only fallback from recreating a provider-private id after the
       // route owner failed closed. The sentinel is per parsed request and contains no credential.
       parsed._cursorIdentityScope = `cursor-unowned:${randomUUID()}`;
@@ -1185,6 +1199,8 @@ export interface HandleResponsesOptions {
   admission?: DataPlaneAdmission;
   /** Called at most once after the complete client body is read and accepted for dispatch. */
   onRequestBodyRead?: () => void;
+  /** Internal combo handoff invoked after the final adapter accepts the parsed request. */
+  onRequestValidated?: () => void;
   forceEmptyResponseId?: boolean;
   abortSignal?: AbortSignal;
   /** One-shot TTFT callback: first non-empty model output observed (WP4). */
@@ -1820,6 +1836,7 @@ export async function handleComboResponses(
   let lastFailure: Response | null = null;
   while (pick) {
     if (options.abortSignal?.aborted) return clientCancelledResponse();
+    const selectedPick = pick;
     const childLog: RequestLogContext = {
       model: pick.target.model,
       provider: pick.target.provider,
@@ -1841,24 +1858,31 @@ export async function handleComboResponses(
     });
     let resolvedAuth: CodexAuthContext | undefined;
     let terminalRecorder: ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined;
-    const started = Date.now();
-    const attempt = beginRequestAttempt(
-      (logCtx.attempts?.length ?? 0) + 1,
-      pick.target.provider,
-      pick.target.model,
-      config.providers[pick.target.provider]!.adapter,
-    );
-    childLog.activeAttempt = attempt;
+    let started: number | undefined;
+    let attempt: ReturnType<typeof beginRequestAttempt> | undefined;
+    const beginAttempt = (): void => {
+      if (attempt) return;
+      started = Date.now();
+      attempt = beginRequestAttempt(
+        (logCtx.attempts?.length ?? 0) + 1,
+        selectedPick.target.provider,
+        selectedPick.target.model,
+        config.providers[selectedPick.target.provider]!.adapter,
+      );
+      childLog.activeAttempt = attempt;
+      childLog.activeAttemptStartedAt = started;
+      recordAttemptRequestedEffort(childLog);
+    };
     let attemptRetained = false;
     const retainCancelledAttempt = (): void => {
-      if (attemptRetained) return;
+      if (attemptRetained || !attempt) return;
       sealRequestAttemptIdentity(
         attempt,
         childLog.provider,
         childLog.providerAdapter ?? attempt.adapter,
         childLog.accountLogLabel,
       );
-      finishRequestAttempt(attempt, 499, Date.now() - started, childLog.usage);
+      finishRequestAttempt(attempt, 499, Date.now() - (started ?? Date.now()), childLog.usage);
       (logCtx.attempts ??= []).push(attempt);
       attemptRetained = true;
     };
@@ -1878,10 +1902,11 @@ export async function handleComboResponses(
         comboAttempt: true,
         comboReplaySnapshot,
         deferCodexResetDerivedCooldown,
+        onRequestValidated: beginAttempt,
         // Attempt-relative TTFT is recorded HERE (not via childLog.firstOutputMs — a later
         // Object.assign(logCtx, childLog) would overwrite the request-relative value).
         onFirstOutput: () => {
-          if (attempt.firstOutputMs === undefined) {
+          if (attempt && started !== undefined && attempt.firstOutputMs === undefined) {
             attempt.firstOutputMs = Math.max(0, Date.now() - started);
           }
           options.onFirstOutput?.();
@@ -1908,6 +1933,7 @@ export async function handleComboResponses(
     }
 
     if (response.ok) {
+      if (!attempt) return response;
       sealRequestAttemptIdentity(
         attempt,
         childLog.provider,
@@ -1954,20 +1980,22 @@ export async function handleComboResponses(
       retainCancelledAttempt();
       return clientCancelledResponse();
     }
-    sealRequestAttemptIdentity(
-      attempt,
-      childLog.provider,
-      childLog.providerAdapter ?? attempt.adapter,
-      childLog.accountLogLabel,
-    );
-    finishRequestAttempt(
-      attempt,
-      response.status,
-      Date.now() - started,
-      failure.usage,
-    );
-    (logCtx.attempts ??= []).push(attempt);
-    attemptRetained = true;
+    if (attempt) {
+      sealRequestAttemptIdentity(
+        attempt,
+        childLog.provider,
+        childLog.providerAdapter ?? attempt.adapter,
+        childLog.accountLogLabel,
+      );
+      finishRequestAttempt(
+        attempt,
+        response.status,
+        Date.now() - (started ?? Date.now()),
+        failure.usage,
+      );
+      (logCtx.attempts ??= []).push(attempt);
+      attemptRetained = true;
+    }
     lastFailure = failure.response;
     if (comboFailureDecision(failure.response.status, failure.classificationText, {
       code: failure.upstreamCode,
@@ -1976,7 +2004,7 @@ export async function handleComboResponses(
       return lastFailure;
     }
     console.warn(
-      `[combo] ${comboId}: ${targetKey(pick.target)} failed with ${response.status} after ${Date.now() - started}ms`,
+      `[combo] ${comboId}: ${targetKey(pick.target)} failed with ${response.status} after ${started === undefined ? 0 : Date.now() - started}ms`,
     );
     const nextPick = advanceComboAfterFailure(config, pick, {
       retryAfter: failure.retryAfter,
@@ -2589,13 +2617,27 @@ async function handleResponsesInner(
   let anthropicPoolFailovers = 0;
   let antigravityAccountId: string | undefined;
   let antigravityFailovers = 0;
+  let cursorPoolAccountId: string | null = null;
+  let cursorPoolFailovers = 0;
+  const oauthSessionKeyParts = {
+    sessionIdHeader: sessionIdHeaderFromRequest(req.headers),
+    threadIdHeader: req.headers.get("thread-id"),
+    promptCacheKey: typeof parsed.options.promptCacheKey === "string" ? parsed.options.promptCacheKey : null,
+    clientThreadId: typeof parsed._clientThreadId === "string" ? parsed._clientThreadId : null,
+    promptCacheKeyIsSharedCohort: options.promptCacheKeyIsSharedCohort === true,
+  };
   const anthropicSessionKey = route.providerName === "anthropic" && route.provider.authMode === "oauth"
-    ? anthropicSessionKeyFromParts({
-      sessionIdHeader: sessionIdHeaderFromRequest(req.headers),
-      threadIdHeader: req.headers.get("thread-id"),
-      promptCacheKey: typeof parsed.options.promptCacheKey === "string" ? parsed.options.promptCacheKey : null,
+    ? anthropicSessionKeyFromParts(oauthSessionKeyParts)
+    : null;
+  const antigravitySessionKey = route.providerName === "google-antigravity"
+    && route.provider.authMode === "oauth"
+    && route.provider.googleMode === "cloud-code-assist"
+    ? antigravitySessionKeyFromParts(oauthSessionKeyParts)
+    : null;
+  const cursorSessionKey = route.providerName === "cursor"
+    && route.provider.authMode === "oauth"
+    ? cursorSessionKeyFromParts({
       clientThreadId: typeof parsed._clientThreadId === "string" ? parsed._clientThreadId : null,
-      promptCacheKeyIsSharedCohort: options.promptCacheKeyIsSharedCohort === true,
     })
     : null;
   if (route.provider.authMode === "oauth") {
@@ -2620,48 +2662,88 @@ async function handleResponsesInner(
         promoteAnthropicActiveAccount(selection.accountId);
         route.provider = { ...route.provider, apiKey: accessToken };
         logCtx.provider = formatAnthropicProviderForLog("anthropic", selection.accountId, config);
-      } else {
-        let resolved = await getValidAccessTokenSnapshot(route.providerName);
-        let skippedAntigravityCooldown = false;
-        if (route.providerName === "google-antigravity"
-          && route.provider.googleMode === "cloud-code-assist"
-          && isAntigravityAccountInCooldown(resolved.accountId)) {
-          const accountIds = getAccountSet("google-antigravity")?.accounts.map(account => account.id) ?? [];
-          const nextAccountId = nextAntigravityAccount(accountIds, resolved.accountId);
-          if (!nextAccountId) {
-            return formatErrorResponse(429, "rate_limit_error", "All Google Antigravity OAuth accounts are temporarily unavailable");
+      } else if (
+        route.providerName === "google-antigravity"
+        && route.provider.googleMode === "cloud-code-assist"
+      ) {
+        const selection = resolveAntigravityAccountForSession(antigravitySessionKey);
+        if (!selection.accountId) {
+          if (selection.reason === "all-cooled") {
+            return formatErrorResponse(
+              429,
+              "rate_limit_error",
+              "All Google Antigravity OAuth accounts are temporarily unavailable",
+            );
           }
-          const accessToken = await getValidAccessTokenForAccount("google-antigravity", nextAccountId);
-          const nextCredential = getAccountCredential("google-antigravity", nextAccountId);
+          return formatErrorResponse(
+            401,
+            "authentication_error",
+            "No eligible Google Antigravity OAuth account available",
+          );
+        }
+        let resolved = await getValidAccessTokenSnapshot(route.providerName);
+        if (selection.accountId !== resolved.accountId) {
+          const accessToken = await getValidAccessTokenForAccount("google-antigravity", selection.accountId);
+          const nextCredential = getAccountCredential("google-antigravity", selection.accountId);
           resolved = {
             ...resolved,
-            accountId: nextAccountId,
+            accountId: selection.accountId,
             accessToken,
             // Always replace; omitting a missing id would keep the previous account's projectId.
             projectId: nextCredential?.projectId,
           };
-          skippedAntigravityCooldown = true;
         }
         replayOAuthCredentialSnapshot = {
           accountId: resolved.accountId,
           generation: resolved.generation,
         };
-        if (skippedAntigravityCooldown) replayOAuthCredentialSnapshot = undefined;
-        if (isOAuth401ReplayProvider) sentOAuthSnapshot = resolved;
+        if (selection.reason === "failover") replayOAuthCredentialSnapshot = undefined;
         route.provider = { ...route.provider, apiKey: resolved.accessToken };
-        if (route.providerName === "google-antigravity" && route.provider.googleMode === "cloud-code-assist") {
-          antigravityAccountId = resolved.accountId;
-          // Always overwrite `project` from the credential in use. A missing id fails closed
-          // so a rotated account cannot inherit the previous account's Cloud Code Assist project.
-          const bound = bindAntigravityProject(route.provider, resolved.projectId);
-          if (!bound.ok) {
-            return formatErrorResponse(bound.status, bound.type, bound.message);
-          }
-          route.provider = bound.provider;
-          if (skippedAntigravityCooldown) {
-            void setActiveAccount("google-antigravity", resolved.accountId).catch(() => { /* best-effort promotion */ });
+        antigravityAccountId = selection.accountId;
+        bindAntigravitySessionAffinity(antigravitySessionKey, selection.accountId);
+        const bound = bindAntigravityProject(route.provider, resolved.projectId);
+        if (!bound.ok) {
+          return formatErrorResponse(bound.status, bound.type, bound.message);
+        }
+        route.provider = bound.provider;
+      } else if (
+        route.providerName === "cursor"
+        && route.provider.authMode === "oauth"
+        && isCursorAccountPoolActive(config)
+      ) {
+        const selection = resolveCursorAccountForSession(cursorSessionKey, config);
+        if (!selection.accountId) {
+          if (selection.reason === "all-cooled") {
+            return formatErrorResponse(
+              429,
+              "rate_limit_error",
+              "All Cursor OAuth accounts are temporarily rate-limited",
+            );
           }
+          return formatErrorResponse(401, "authentication_error", "No eligible Cursor OAuth account available");
+        }
+        let resolved = await getValidAccessTokenSnapshot("cursor");
+        if (selection.accountId !== resolved.accountId) {
+          const accessToken = await getValidAccessTokenForAccount("cursor", selection.accountId);
+          resolved = { ...resolved, accountId: selection.accountId, accessToken };
         }
+        cursorPoolAccountId = selection.accountId;
+        parsed._cursorIdentityScope = selection.accountId;
+        bindCursorSessionAffinity(cursorSessionKey, selection.accountId);
+        replayOAuthCredentialSnapshot = {
+          accountId: resolved.accountId,
+          generation: resolved.generation,
+        };
+        route.provider = { ...route.provider, apiKey: resolved.accessToken };
+        logCtx.provider = formatCursorProviderForLog("cursor", selection.accountId);
+      } else {
+        const resolved = await getValidAccessTokenSnapshot(route.providerName);
+        replayOAuthCredentialSnapshot = {
+          accountId: resolved.accountId,
+          generation: resolved.generation,
+        };
+        if (isOAuth401ReplayProvider) sentOAuthSnapshot = resolved;
+        route.provider = { ...route.provider, apiKey: resolved.accessToken };
         if (route.providerName === "kiro") {
           // `{}` is intentional: this is an account-scoped request with no stored routing metadata.
           // Only genuinely accountless adapter calls leave the context undefined and use local/env fallback.
@@ -2719,6 +2801,16 @@ async function handleResponsesInner(
     logCtx.conversationId = normalizeLogConversationId(parsed._cursorConversationId);
   }
   logCtx.providerAdapter = adapter.name;
+  try {
+    adapter.validateRequest?.(parsed);
+  } catch (err) {
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      redactSecretString(err instanceof Error ? err.message : String(err)),
+    );
+  }
+  options.onRequestValidated?.();
   // Ordinary requests receive one durable attempt only after their final initial
   // adapter is resolved. Combo children own their attempt and retries keep it.
   if (!options.comboAttempt && !logCtx.activeAttempt) {
@@ -3969,13 +4061,23 @@ async function handleResponsesInner(
   //   - non-runTurn: web-search wins over image when both eligible (documented priority)
   //   - runTurn: image bridge may run (it supports runTurn); web-search is skipped so runTurn
   //     can proceed for web-search-only turns
-  const wsPlan = !routedCompaction
-    ? planWebSearch(config, parsed, false, route.provider, route.modelId, openAiSidecar)
-    : undefined;
   const imgPlan = !routedCompaction ? await planImageBridge(config, parsed, route.provider) : undefined;
   const vidPlan = !routedCompaction ? await planVideoBridge(config, parsed, route.provider) : undefined;
-  const canRunWebSearch = !!wsPlan && !adapter.runTurn;
-  if ((imgPlan || vidPlan) && canRunWebSearch) {
+  const hasMediaPlan = !!(imgPlan || vidPlan);
+  // A media plan is not enough to suppress Gemini 2.x grounding: both bridges inject tools only
+  // on streaming turns. This is the potential-injection value used to resolve sidecar precedence.
+  const mediaMayInject = mediaBridgeWillRun(hasMediaPlan, false, !!adapter.runTurn, parsed.stream);
+  const wsPlan = !routedCompaction
+    ? planWebSearch(config, parsed, false, route.provider, route.modelId, openAiSidecar, mediaMayInject)
+    : undefined;
+  const webSearchWinsMedia = !!wsPlan && !adapter.runTurn;
+  const mediaWillRun = mediaBridgeWillRun(hasMediaPlan, !!wsPlan, !!adapter.runTurn, parsed.stream);
+  const ccaInTurnGrounding = !routedCompaction
+    ? resolveCcaInTurnGrounding(config, parsed, false, route.provider, route.modelId, mediaWillRun)
+    : undefined;
+  if (ccaInTurnGrounding) parsed._ccaInTurnGrounding = ccaInTurnGrounding;
+  const canRunWebSearch = webSearchWinsMedia && !ccaInTurnGrounding;
+  if (hasMediaPlan && webSearchWinsMedia) {
     // Web search takes priority when both are active — the media bridge cannot run
     // alongside runWithWebSearch. Surface a runtime signal so the user knows their
     // configured video/image bridge was skipped for this turn, rather than silently
@@ -3983,7 +4085,7 @@ async function handleResponsesInner(
     if (vidPlan) console.warn("[videos] video bridge skipped: web search is active for this turn");
     if (imgPlan) console.warn("[images] image bridge skipped: web search is active for this turn");
   }
-  if ((imgPlan || vidPlan) && (!wsPlan || adapter.runTurn)) {
+  if (mediaWillRun || (imgPlan && !parsed.stream && !webSearchWinsMedia)) {
     // The image bridge detects a hosted image_generation tool and requires streaming.
     // The video bridge activates from config and injects a tool — it also needs streaming
     // (the loop returns SSE). For video-only (no imgPlan) on a non-streaming request, skip
@@ -4782,8 +4884,29 @@ async function handleResponsesInner(
         && antigravityAccountId
         && antigravityFailovers < 3
       ) {
-        const accountIds = getAccountSet("google-antigravity")?.accounts.map(account => account.id) ?? [];
-        const nextAccountId = nextAntigravityAccount(accountIds, antigravityAccountId);
+        const stickWaitMs = antigravity429StickWaitMs(antigravityAccountId);
+        if (stickWaitMs !== null) {
+          await Bun.sleep(stickWaitMs);
+          try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+          invalidateSameTargetRequest();
+          activeAdapter = resolveAdapter(
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+            config.cacheRetention,
+          );
+          bindRouteReasoningReplayScope({
+            parsed,
+            providerName: route.providerName,
+            provider: route.provider,
+            adapterName: activeAdapter.name,
+            codexAuthContext: authCtx,
+            forwardHeaders: selectedForwardHeaders,
+          });
+          const result = await rebuildAndRefetch("rate-limit-429");
+          if ("failed" in result) return result.failed;
+          upstreamResponse = result;
+          continue;
+        }
+        const nextAccountId = rotateAntigravityAccountOn429(antigravityAccountId, antigravitySessionKey);
         if (!nextAccountId) break;
         try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
         try {
@@ -4813,7 +4936,6 @@ async function handleResponsesInner(
             codexAuthContext: authCtx,
             forwardHeaders: selectedForwardHeaders,
           });
-          void setActiveAccount("google-antigravity", nextAccountId).catch(() => { /* best-effort promotion */ });
           const result = await rebuildAndRefetch("rate-limit-429");
           if ("failed" in result) return result.failed;
           upstreamResponse = result;
@@ -4821,6 +4943,105 @@ async function handleResponsesInner(
           break;
         }
       }
+      if (
+        upstreamResponse.status === 402
+        && cursorPoolAccountId
+        && isCursorAccountPoolActive(config)
+      ) {
+        recordCursorAccountBillingCooldown(
+          cursorPoolAccountId,
+          upstreamResponse.headers.get("retry-after"),
+        );
+      }
+      while (
+        (upstreamResponse.status === 401 || upstreamResponse.status === 403)
+        && route.providerName === "cursor"
+        && route.provider.authMode === "oauth"
+        && cursorPoolAccountId
+        && isCursorAccountPoolActive(config)
+        && cursorPoolFailovers < CURSOR_POOL_MAX_FAILOVERS_PER_REQUEST
+      ) {
+        const nextAccountId = rotateCursorAccountOnAuth(
+          config,
+          cursorPoolAccountId,
+          cursorSessionKey,
+        );
+        if (!nextAccountId) break;
+        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+        try {
+          const accessToken = await getValidAccessTokenForAccount("cursor", nextAccountId);
+          cursorPoolAccountId = nextAccountId;
+          cursorPoolFailovers += 1;
+          parsed._cursorIdentityScope = nextAccountId;
+          route.provider = { ...route.provider, apiKey: accessToken };
+          replayOAuthCredentialSnapshot = undefined;
+          invalidateSameTargetRequest();
+          activeAdapter = resolveAdapter(
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+            config.cacheRetention,
+          );
+          bindRouteReasoningReplayScope({
+            parsed,
+            providerName: route.providerName,
+            provider: route.provider,
+            adapterName: activeAdapter.name,
+            codexAuthContext: authCtx,
+            forwardHeaders: selectedForwardHeaders,
+          });
+          logCtx.provider = formatCursorProviderForLog("cursor", nextAccountId);
+          sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, activeAdapter.name, logCtx.accountLogLabel);
+          const result = await rebuildAndRefetch("cursor-oauth-auth");
+          if ("failed" in result) return result.failed;
+          upstreamResponse = result;
+        } catch {
+          break;
+        }
+      }
+      while (
+        upstreamResponse.status === 429
+        && route.providerName === "cursor"
+        && route.provider.authMode === "oauth"
+        && cursorPoolAccountId
+        && isCursorAccountPoolActive(config)
+        && cursorPoolFailovers < CURSOR_POOL_MAX_FAILOVERS_PER_REQUEST
+      ) {
+        const nextAccountId = rotateCursorAccountOn429(
+          config,
+          cursorPoolAccountId,
+          upstreamResponse.headers.get("retry-after"),
+          cursorSessionKey,
+        );
+        if (!nextAccountId) break;
+        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+        try {
+          const accessToken = await getValidAccessTokenForAccount("cursor", nextAccountId);
+          cursorPoolAccountId = nextAccountId;
+          cursorPoolFailovers += 1;
+          parsed._cursorIdentityScope = nextAccountId;
+          route.provider = { ...route.provider, apiKey: accessToken };
+          replayOAuthCredentialSnapshot = undefined;
+          invalidateSameTargetRequest();
+          activeAdapter = resolveAdapter(
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+            config.cacheRetention,
+          );
+          bindRouteReasoningReplayScope({
+            parsed,
+            providerName: route.providerName,
+            provider: route.provider,
+            adapterName: activeAdapter.name,
+            codexAuthContext: authCtx,
+            forwardHeaders: selectedForwardHeaders,
+          });
+          logCtx.provider = formatCursorProviderForLog("cursor", nextAccountId);
+          sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, activeAdapter.name, logCtx.accountLogLabel);
+          const result = await rebuildAndRefetch("cursor-oauth-429");
+          if ("failed" in result) return result.failed;
+          upstreamResponse = result;
+        } catch {
+          break;
+        }
+      }
       // Unknown provenance is deliberately fail-soft in pre-flight: after a restart, TTL expiry,
       // or LRU eviction, a valid same-backend blob must survive. A decoder's own 4xx identity is
       // the missing authoritative signal. Rebuild once through the same sanitation path used by a
@@ -5155,6 +5376,113 @@ async function handleResponsesInner(
           }
         }
       }
+      if (
+        response.status === 402
+        && cursorPoolAccountId
+        && isCursorAccountPoolActive(config)
+      ) {
+        recordCursorAccountBillingCooldown(
+          cursorPoolAccountId,
+          response.headers.get("retry-after"),
+        );
+      }
+      if (
+        (response.status === 401 || response.status === 403)
+        && route.providerName === "cursor"
+        && route.provider.authMode === "oauth"
+        && cursorPoolAccountId
+        && isCursorAccountPoolActive(config)
+        && cursorPoolFailovers < CURSOR_POOL_MAX_FAILOVERS_PER_REQUEST
+      ) {
+        const nextAccountId = rotateCursorAccountOnAuth(
+          config,
+          cursorPoolAccountId,
+          cursorSessionKey,
+        );
+        if (nextAccountId) {
+          try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+          try {
+            const accessToken = await getValidAccessTokenForAccount("cursor", nextAccountId);
+            cursorPoolAccountId = nextAccountId;
+            cursorPoolFailovers += 1;
+            parsed._cursorIdentityScope = nextAccountId;
+            route.provider = { ...route.provider, apiKey: accessToken };
+            replayOAuthCredentialSnapshot = undefined;
+            invalidateSameTargetRequest();
+            activeAdapter = resolveAdapter(
+              resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+              config.cacheRetention,
+            );
+            bindRouteReasoningReplayScope({
+              parsed: nextParsed,
+              providerName: route.providerName,
+              provider: route.provider,
+              adapterName: activeAdapter.name,
+            });
+            bindRouteReasoningReplayScope({
+              parsed,
+              providerName: route.providerName,
+              provider: route.provider,
+              adapterName: activeAdapter.name,
+            });
+            logCtx.provider = formatCursorProviderForLog("cursor", nextAccountId);
+            sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, activeAdapter.name, logCtx.accountLogLabel);
+            nextContinuationRecoveryKind = "cursor-oauth-auth";
+            continue;
+          } catch {
+            // fall through to emit continuation error below
+          }
+        }
+      }
+      if (
+        response.status === 429
+        && route.providerName === "cursor"
+        && route.provider.authMode === "oauth"
+        && cursorPoolAccountId
+        && isCursorAccountPoolActive(config)
+        && cursorPoolFailovers < CURSOR_POOL_MAX_FAILOVERS_PER_REQUEST
+      ) {
+        const nextAccountId = rotateCursorAccountOn429(
+          config,
+          cursorPoolAccountId,
+          response.headers.get("retry-after"),
+          cursorSessionKey,
+        );
+        if (nextAccountId) {
+          try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+          try {
+            const accessToken = await getValidAccessTokenForAccount("cursor", nextAccountId);
+            cursorPoolAccountId = nextAccountId;
+            cursorPoolFailovers += 1;
+            parsed._cursorIdentityScope = nextAccountId;
+            route.provider = { ...route.provider, apiKey: accessToken };
+            replayOAuthCredentialSnapshot = undefined;
+            invalidateSameTargetRequest();
+            activeAdapter = resolveAdapter(
+              resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+              config.cacheRetention,
+            );
+            bindRouteReasoningReplayScope({
+              parsed: nextParsed,
+              providerName: route.providerName,
+              provider: route.provider,
+              adapterName: activeAdapter.name,
+            });
+            bindRouteReasoningReplayScope({
+              parsed,
+              providerName: route.providerName,
+              provider: route.provider,
+              adapterName: activeAdapter.name,
+            });
+            logCtx.provider = formatCursorProviderForLog("cursor", nextAccountId);
+            sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, activeAdapter.name, logCtx.accountLogLabel);
+            nextContinuationRecoveryKind = "cursor-oauth-429";
+            continue;
+          } catch {
+            // fall through to emit continuation error below
+          }
+        }
+      }
       if (shouldAttemptImageTierRetry({
         status: response.status,
         adapterName: activeAdapter.name,

package/src/types/config.ts

@@ -601,6 +601,14 @@ export interface OcxConfig {
     /** Successful new-session binds retained on one round-robin selection. Default 1; range 1..100. */
     stickyLimit?: number;
   };
+  /**
+   * Opt-in Cursor OAuth account pool. Default OFF.
+   * Sticky `_clientThreadId` affinity + bounded 429/auth failover when ≥2 OAuth accounts exist.
+   * Does not wire weighted-round-robin `CursorCredentialRouter`.
+   */
+  cursorAccountPool?: {
+    enabled?: boolean;
+  };
   /** Virtual `combo/<id>` models spanning concrete provider/model targets (issue #133). */
   combos?: Record<string, OcxComboConfig>;
   /**

package/src/types/provider.ts

@@ -169,6 +169,13 @@ export interface OcxProviderConfig {
    * version here instead of waiting for a code change. Absent uses the adapter's current default.
    */
   commandCodeVersion?: string;
+  /**
+   * Command Code OAuth `/alpha/generate` project-context envelope. When `"on"`, the adapter
+   * fills `memory`, `taste`, and `skills` from bounded files under `process.cwd()`. Absent or
+   * `"off"` keeps the empty envelope (`memory: ""`, `taste: null`, `skills: null`). Does not
+   * enable taste learning (`x-taste-learning` stays `"false"`).
+   */
+  projectContext?: "off" | "on";
   /**
    * Responses upstream that stores nothing server-side (DeepSeek documents "the API
    * is stateless"). Stateful request parameters are dropped, `store` is pinned false,