@@ -436,7 +436,21 @@ func (g *geminiClient) shouldRetry(attempts int, err error) (bool, int64, error)
437 // Check for token expiration (401 Unauthorized)
437 // Check for token expiration (401 Unauthorized)
438 if contains(errMsg, "unauthorized", "invalid api key", "api key expired") {
438 if contains(errMsg, "unauthorized", "invalid api key", "api key expired") {
439+ prev := g.providerOptions.apiKey
440+ // in case the key comes from a script, we try to re-evaluate it.
441+ g.providerOptions.apiKey, err = config.Get().Resolve(g.providerOptions.config.APIKey)
443+ return false, 0, fmt.Errorf("failed to resolve API key: %w", err)
445+ // if it didn't change, do not retry.
446+ if prev == g.providerOptions.apiKey {
439− return false, 0, err
447+ return false, 0, err
449+ g.client, err = createGeminiClient(g.providerOptions)
451+ return false, 0, fmt.Errorf("failed to create Gemini client after API key refresh: %w", err)
442 // Check for common rate limit error messages
456 // Check for common rate limit error messages