[luvs01]

Summary

• Preserve an explicitly configured API-key auth lane for dual-auth providers when the active key is paused or cannot be resolved, instead of unintentionally switching to a stored OAuth account.
• Keep explicit OAuth and registry-default behavior unchanged. Cover xAI and Copilot pause/resume, unavailable environment references, and healthy key-pool rotation; align initial model selection with the same auth-mode decision.

Verification

Recorded implementation checks; no tests were rerun during publication:

• Focused provider/routing regressions on the initial candidate: baseline 100 passed, 9 failed; candidate 109 passed, 0 failed.
• Initial-candidate TypeScript, privacy scan, and structure checks: PASS.
• Previous-head Linux CI: at 8354d6fb, test 4/4 batch 33/62 reported 215 passed, 2 failed. Both failures were in tests/oauth/oauth-upsert-preserves-api-key.test.ts: the unavailable-key cases still expected oauth although they explicitly preserved saved authMode: "key". This follow-up updates those two expectations and their descriptions, and restores the split-env fixture in finally. Explicit OAuth behavior and env-key recovery contrasts are preserved.
• Follow-up focused verification: official Bun 1.4.3, through scripts/test.ts ./tests/oauth/oauth-upsert-preserves-api-key.test.ts with repository preload and shared test lock: 33 passed, 0 failed, 169 assertions. The explicit OAuth contrast passed. The earlier 109-test set was not repeated.
• Follow-up tsc --noEmit and privacy scan: PASS, executed with the existing Bun 1.4.2 launcher. Scoped file-size ratchet for all 12 candidate files: PASS using Bun 1.4.3. git diff --check and full-patch reverse applicability check: PASS.
• Separate local Windows adjacent OAuth/account-auto-pause set: 29 passed, 43 failed, 44 errors. These failures remain unresolved.
• One isolated adjacent case failed under its original 5-second timeout on both baseline and candidate. An extended 30-second baseline diagnostic measured startServer at 6.75 seconds and mocks at 0.5 seconds; this diagnostic does not replace or turn the original failure into a pass.
• test:changed and the full suite remain unrun under the shared-host resource exception. The previous failed CI run was not rerun.
• Publication readback verified the follow-up changes exactly one file, has the previous PR head as its sole parent, carries a GitHub-verified signature, and leaves all 12 remote blobs matching the candidate manifest.
• Current-head Linux CI: run 39119217985 completed successfully at 4644880893953aab7e733ed4f9571889c00703aa, including test shards 1–4 and the aggregate ci check. This current-head success is separate from the previous-head CI failure and the local 33-test result. Skipped platform lanes are not passing cross-platform evidence.
• Review readiness uses the documented shared-host resource exception and the scoped local regressions plus current-head Linux CI. The separate Windows adjacent failures and unrun full/import-connected suites above remain limitations. There are no current review threads or submitted reviews; CodeRabbit explicitly skipped Draft review and still needs to review after Ready. Maintainer review, including the required authentication/security review, remains outstanding.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• The owning structure documentation was updated.
• Authentication changes were independently reviewed for secrets and unsafe defaults.

Review readiness

• Required local validation passed with its scope documented.
• Branch is on the latest dev commit.
• All correct Codex and CodeRabbit findings are fixed.
• Ready-for-review confirmation.

Summary by CodeRabbit

• Bug Fixes
  • Explicit key authentication remains selected even when a configured credential is temporarily unavailable, instead of silently switching to OAuth.
  • Requests without a usable key are rejected; restored or alternate available keys can be used when present. Explicit OAuth mode and default provider behavior remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 885f6b1d-5215-4044-8b35-e4234400d504

📥 Commits

Reviewing files that changed from the base of the PR and between 8640c2f and 4644880.

📒 Files selected for processing: 12

• scripts/test-layout/layout.json
• src/providers/initial-model-selection.ts
• src/providers/key-store.ts
• src/providers/quota-routing-cache.ts
• src/providers/routed-config.ts
• structure/subagents.md
• tests/fixtures/test-layout-expected.json
• tests/oauth/oauth-upsert-preserves-api-key.test.ts
• tests/providers/explicit-key-pause-oauth-boundary.test.ts
• tests/providers/initial-model-selection.test.ts
• tests/providers/resolved-model-policy.test.ts
• tests/routing/router.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

📝 Walkthrough

Provider override checks now preserve configured key mode for eligible OAuth providers even when a key is unavailable. Routing, registration, and tests cover unresolved keys, paused keys, and OAuth-mode behavior.

Changes: Explicit key mode

Layer / File(s)	Summary
Apply configured key-mode override src/providers/key-store.ts, src/providers/initial-model-selection.ts, src/providers/quota-routing-cache.ts, src/providers/routed-config.ts, structure/subagents.md	providerUsesKeyAuthOverride now checks registry eligibility and configured authMode, without requiring a resolved key. Routing and initial model selection use the updated check. The registration documentation describes unresolved key-mode providers as pending.
Verify key-mode routing boundaries tests/providers/explicit-key-pause-oauth-boundary.test.ts, tests/oauth/oauth-upsert-preserves-api-key.test.ts, tests/providers/initial-model-selection.test.ts, tests/providers/resolved-model-policy.test.ts, tests/routing/router.test.ts, tests/fixtures/test-layout-expected.json, scripts/test-layout/layout.json	Tests cover unresolved credentials, paused and restored keys, multiple-key pools, and OAuth-mode behavior. Updated expectations verify key mode remains selected when a key cannot resolve, and transport construction rejects a missing credential. The fixture mapping adds the new test; the layout mapping has no semantic change.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 46448

The change preserves explicit key mode when a credential is unavailable. No actionable issue has been identified that should block merge after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 42.86% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 9 files. (3 skipped: 3…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: preserving explicit key mode when provider credentials are unavailable. This matches the routing, model-selection, and OAuth regression-test …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title clearly and concisely describes the main change: preserving explicit key mode when provider credentials are unavailable. This matches the routing, model-selection, and OAuth regression-test changes.

Full details: Docstring Coverage

Explanation

Docstring coverage is 42.86% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 9 files. (3 skipped: 3 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[Ingwannu]

Scoped code review at 4644880893: treating explicit authMode:key as intent rather than successful credential resolution addresses the lane-switch trigger; the four updated consumers now use the same predicate. The important acceptance boundary is zero OAuth selection/spend when the last key is paused, missing from env/keychain or disabled, with an OAuth record still present. Preserve explicit OAuth and registry rows that disallow key override as controls, including initial catalog selection and quota binding. Current Ubuntu CI is successful. I have not completed the credential-boundary review or independently executed the regression suite, so this comment is not approval/sponsorship.

[lidge-jun]

Carried into #7397 (squash dbb908f) on dev with a Co-authored-by trailer, as part of the B5 OAuth/accounts/service hardening bundle. It ships in the next release (2.90.0). Thanks!