@bitkyc08/opencodex 2.14.0 → 2.14.2

package/src/lib/tool-argument-integers.ts

@@ -0,0 +1,158 @@
+// Schema-aware repair for integer tool arguments that arrive as floats (issue #1611).
+//
+// Grok serializes integer tool-call arguments through a float representation, so
+// `yield_time_ms: 120000` leaves the provider as `120000.0`. Codex declares those
+// fields as Rust integer types, so it rejects the call BEFORE running the tool:
+//
+//   failed to parse function arguments: invalid type: floating point `120000.0`, expected u64
+//
+// That is a hard failure, not a degradation — the model gets no result and retries
+// the same float. Nothing on the routed path reconciled argument values against the
+// declared schema, so the `.0` passed straight through.
+//
+// The boundary this file draws is INTENT, not convenience:
+//   - an integral float in an integer-typed field is a representation artifact, and
+//     `120000.0` has exactly one integer reading, so it is repaired;
+//   - `1.5` in an integer field is a genuine disagreement with the schema and is left
+//     alone so it still fails, rather than being truncated into a plausible lie.
+// Anything without a declared `integer` type is never touched.
+
+/** JSON Schema subset we need; provider tool schemas are untrusted input. */
+type SchemaNode = Record<string, unknown>;
+
+function asSchema(value: unknown): SchemaNode | undefined {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as SchemaNode
+    : undefined;
+}
+
+/** True when the node declares `integer`, including `["integer","null"]` unions. */
+function declaresInteger(schema: SchemaNode): boolean {
+  const type = schema.type;
+  if (type === "integer") return true;
+  return Array.isArray(type) && type.includes("integer");
+}
+
+/**
+ * Resolve a local `$ref` (`#/$defs/Foo`, `#/definitions/Foo`).
+ *
+ * Only same-document refs are followed: a remote ref is not fetchable here, and a
+ * schema we cannot resolve must leave its values untouched rather than guessed at.
+ */
+function resolveRef(schema: SchemaNode, root: SchemaNode, seen: Set<string>): SchemaNode | undefined {
+  const ref = schema.$ref;
+  if (typeof ref !== "string" || !ref.startsWith("#/")) return schema;
+  if (seen.has(ref)) return undefined; // cyclic $ref: stop rather than recurse forever
+  seen.add(ref);
+  let node: unknown = root;
+  for (const rawSegment of ref.slice(2).split("/")) {
+    const segment = rawSegment.replace(/~1/g, "/").replace(/~0/g, "~");
+    const current = asSchema(node);
+    if (!current) return undefined;
+    node = current[segment];
+  }
+  const resolved = asSchema(node);
+  return resolved ? resolveRef(resolved, root, seen) : undefined;
+}
+
+/** Composition keywords whose branches may carry the integer declaration. */
+const COMPOSITION_KEYS = ["anyOf", "oneOf", "allOf"] as const;
+
+function compositionBranches(schema: SchemaNode): SchemaNode[] {
+  const branches: SchemaNode[] = [];
+  for (const key of COMPOSITION_KEYS) {
+    const value = schema[key];
+    if (!Array.isArray(value)) continue;
+    for (const branch of value) {
+      const node = asSchema(branch);
+      if (node) branches.push(node);
+    }
+  }
+  return branches;
+}
+
+/**
+ * A JS number can only represent integers exactly up to 2^53-1. Beyond that a
+ * rewrite would emit a silently different value, so the original text stays.
+ */
+function safelyIntegral(value: number): boolean {
+  return Number.isInteger(value) && Math.abs(value) <= Number.MAX_SAFE_INTEGER;
+}
+
+interface CoerceResult {
+  value: unknown;
+  changed: boolean;
+}
+
+function coerceValue(value: unknown, schema: SchemaNode | undefined, root: SchemaNode, depth: number): CoerceResult {
+  // A hostile or deeply nested schema must not blow the stack.
+  if (depth > 64) return { value, changed: false };
+  const resolved = schema ? resolveRef(schema, root, new Set()) : undefined;
+
+  if (typeof value === "number") {
+    if (!resolved) return { value, changed: false };
+    const integerDeclared = declaresInteger(resolved)
+      || compositionBranches(resolved).some(declaresInteger);
+    // Not an integer field, already an integer, non-integral, or unrepresentable:
+    // in every one of those cases the received value is the right thing to keep.
+    if (!integerDeclared || !safelyIntegral(value)) return { value, changed: false };
+    // `120000.0` and `120000` are the same JS number; the difference is only in the
+    // serialized text, which is repaired by re-stringifying the parsed value.
+    return { value, changed: true };
+  }
+
+  if (Array.isArray(value)) {
+    const itemSchema = resolved ? asSchema(resolved.items) : undefined;
+    let changed = false;
+    const next = value.map(entry => {
+      const result = coerceValue(entry, itemSchema, root, depth + 1);
+      if (result.changed) changed = true;
+      return result.value;
+    });
+    return changed ? { value: next, changed } : { value, changed: false };
+  }
+
+  const object = asSchema(value);
+  if (!object) return { value, changed: false };
+
+  const properties = resolved ? asSchema(resolved.properties) : undefined;
+  const additional = resolved ? asSchema(resolved.additionalProperties) : undefined;
+  let changed = false;
+  const next: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(object)) {
+    const childSchema = asSchema(properties?.[key]) ?? additional;
+    const result = coerceValue(entry, childSchema, root, depth + 1);
+    if (result.changed) changed = true;
+    next[key] = result.value;
+  }
+  return changed ? { value: next, changed } : { value, changed: false };
+}
+
+/**
+ * Repair integral floats in a tool-call arguments STRING against the tool's declared
+ * parameter schema.
+ *
+ * Returns the original string unchanged when there is no schema, the payload does not
+ * parse, or nothing needed repair — so an unaffected call keeps its exact bytes and
+ * this stays a no-op for every provider that already emits real integers.
+ */
+export function coerceIntegerToolArguments(
+  args: string,
+  parameters: Record<string, unknown> | undefined,
+): string {
+  if (!parameters || !args) return args;
+  // Cheap reject: a payload with no fractional-looking number cannot need repair.
+  if (!/\d\.\d/.test(args)) return args;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(args);
+  } catch {
+    // Malformed or still-streaming arguments are not this function's problem; the
+    // existing paths already handle them.
+    return args;
+  }
+  const root = parameters as SchemaNode;
+  const result = coerceValue(parsed, root, root, 0);
+  if (!result.changed) return args;
+  return JSON.stringify(result.value);
+}

package/src/oauth/nous.ts

@@ -39,6 +39,7 @@ import { join } from "node:path";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { getAuthStorePath } from "./store";
 import { atomicWriteFile, hardenConfigDir, hardenExistingSecret } from "../config";
+import { BOUNDED_BODY_MAX_BYTES, readBoundedResponseBytes } from "../lib/bounded-body";
 
 export const NOUS_PORTAL_BASE_URL = "https://portal.nousresearch.com";
 export const NOUS_INFERENCE_BASE_URL = "https://inference-api.nousresearch.com/v1";
@@ -87,6 +88,44 @@ interface NousJwtPayload {
   [key: string]: unknown;
 }
 
+async function readOAuthBytes(response: Response, signal: AbortSignal): Promise<Uint8Array> {
+  const { bytes, oversized } = await readBoundedResponseBytes(response, {
+    maxBytes: BOUNDED_BODY_MAX_BYTES,
+    signal,
+  });
+  if (oversized) {
+    throw new NousTokenError(
+      response.status,
+      "response_too_large",
+      `Nous Portal OAuth response exceeded the ${BOUNDED_BODY_MAX_BYTES}-byte limit`,
+    );
+  }
+  return bytes;
+}
+
+function parseOAuthJson(bytes: Uint8Array): unknown {
+  const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+    ? parsed as Record<string, unknown>
+    : {};
+}
+
+async function readOAuthJson(response: Response, signal: AbortSignal): Promise<unknown> {
+  return parseOAuthJson(await readOAuthBytes(response, signal));
+}
+
+async function readOAuthJsonOrEmpty(response: Response, signal: AbortSignal): Promise<unknown> {
+  const bytes = await readOAuthBytes(response, signal);
+  try {
+    return parseOAuthJson(bytes);
+  } catch {
+    // Preserve the pre-PR behavior for empty/HTML/malformed JSON only. Body
+    // read failures, timeouts, caller cancellation, and size-limit errors have
+    // already escaped readOAuthBytes and must retain their real identity.
+    return {};
+  }
+}
+
 // ── Durable refresh-intent (review blocker #2) ──────────────────────────────
 // A refresh-intent file records that we submitted `refreshToken` to the Portal
 // and whether we are certain the rotated token was persisted. It lives next to
@@ -495,6 +534,7 @@ async function requestDeviceAuthorization(signal?: AbortSignal): Promise<{
   expiresInMs: number;
   intervalMs: number;
 }> {
+  const effectiveSignal = requestSignal(signal);
   const response = await fetch(`${resolvePortalBaseUrl()}/api/oauth/device/code`, {
     method: "POST",
     headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
@@ -503,14 +543,16 @@ async function requestDeviceAuthorization(signal?: AbortSignal): Promise<{
       scope: NOUS_OAUTH_SCOPE,
     }),
     redirect: "error",
-    signal: requestSignal(signal),
+    signal: effectiveSignal,
   });
-  if (!response.ok) throw tokenErrorFromPayload(response.status, await response.json().catch(() => ({})));
+  if (!response.ok) {
+    throw tokenErrorFromPayload(response.status, await readOAuthJsonOrEmpty(response, effectiveSignal));
+  }
   // A successful HTTP response may still carry an empty/HTML/non-JSON body.
   // Fall back to an empty object so the required-field check below produces the
   // clear "missing required fields" validation error instead of leaking a raw
   // JSON parser exception.
-  const payload = (await response.json().catch(() => ({}))) as NousDeviceAuthorizationResponse;
+  const payload = await readOAuthJsonOrEmpty(response, effectiveSignal) as NousDeviceAuthorizationResponse;
   const userCode = nonEmptyString(payload.user_code);
   const deviceCode = nonEmptyString(payload.device_code);
   const verificationUri = nonEmptyString(payload.verification_uri_complete) ?? nonEmptyString(payload.verification_uri);
@@ -549,6 +591,7 @@ async function pollForToken(
   while (Date.now() < deadline) {
     if (signal?.aborted) throw new Error("Login cancelled");
     let response: Response;
+    const effectiveSignal = requestSignal(signal);
     try {
       response = await fetch(`${resolvePortalBaseUrl()}/api/oauth/token`, {
         method: "POST",
@@ -559,7 +602,7 @@ async function pollForToken(
           grant_type: "urn:ietf:params:oauth:grant-type:device_code",
         }),
         redirect: "error",
-        signal: requestSignal(signal),
+        signal: effectiveSignal,
       });
     } catch (netErr) {
       // Genuine cancellation must abort immediately. Any other transport-level
@@ -571,13 +614,15 @@ async function pollForToken(
       if (await sleepUntilDeadline(waitMs)) continue;
       break;
     }
+    // Parse under the same deadline that covered the request headers. Keep the
+    // read outside the fetch retry catch: a bounded-reader error or caller
+    // cancellation is an observed response failure, not a safe poll retry.
+    const payload = await readOAuthJsonOrEmpty(response, effectiveSignal) as NousTokenResponse;
     // Parse once and pass the payload through to the failure path (review #8),
     // so we never try to re-read a body that has already been consumed.
     // Normalize a successful-but-non-object body (for example valid JSON
     // `null`) to an empty object so the required-field validation below
     // produces a terminal NousTokenError instead of a raw TypeError.
-    const parsed = (await response.json().catch(() => ({}))) as unknown;
-    const payload = (parsed && typeof parsed === "object" ? parsed : {}) as NousTokenResponse;
     if (Date.now() >= deadline) break;
     if (response.ok) return parseTokenPayload(payload, "");
     const error = payload.error;
@@ -670,6 +715,7 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
   }
 
   let response: Response;
+  const effectiveSignal = requestSignal(signal);
   try {
     response = await fetch(`${baseUrl}/api/oauth/token`, {
       method: "POST",
@@ -683,7 +729,7 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
         client_id: NOUS_OAUTH_CLIENT_ID,
       }),
       redirect: "error",
-      signal: requestSignal(signal),
+      signal: effectiveSignal,
     });
   } catch (netErr) {
     // The request may have reached the server and rotated the token even on a
@@ -703,7 +749,6 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
 
   if (!response.ok) {
     const status = response.status;
-    const payload = await response.json().catch(() => ({}));
     // The request reached the Portal's token endpoint. A non-2xx response does
     // NOT establish that the single-use refresh token was not consumed: 429
     // rate limits, unknown/custom 4xx, and gateway-generated client-class
@@ -719,6 +764,7 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
       // The pre-dispatch "submitted" intent is still on disk, which also
       // blocks replay; surface the original HTTP error below.
     }
+    const payload = await readOAuthJsonOrEmpty(response, effectiveSignal);
     throw tokenErrorFromPayload(status, payload);
   }
 
@@ -727,7 +773,10 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
   // replay it. On success we deliberately LEAVE the intent as "submitted"
   // (the store clears it once the rotated token is persisted).
   try {
-    const creds = parseTokenPayload((await response.json()) as NousTokenResponse, refreshToken);
+    const creds = parseTokenPayload(
+      (await readOAuthJson(response, effectiveSignal)) as NousTokenResponse,
+      refreshToken,
+    );
     return creds;
   } catch (e) {
     try {

package/src/providers/base-url-choices.ts

@@ -62,3 +62,13 @@ export function matchBaseUrlChoice(
   }
   return choices.some(c => c.id === "custom") ? "custom" : choices[0]!.id;
 }
+
+/** Moonshot/Kimi API endpoint presets (international default; China selectable). */
+export const MOONSHOT_INTL_BASE_URL = "https://api.moonshot.ai/v1";
+export const MOONSHOT_CN_BASE_URL = "https://api.moonshot.cn/v1";
+
+export const MOONSHOT_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
+  { id: "international", label: "International (.ai)", baseUrl: MOONSHOT_INTL_BASE_URL },
+  { id: "china", label: "China (.cn)", baseUrl: MOONSHOT_CN_BASE_URL },
+  { id: "custom", label: "Custom" },
+];

package/src/providers/command-code-efforts.ts

@@ -13,6 +13,24 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     efforts: ["high", "max"],
     profileUrl: "https://commandcode.ai/models/glm-5-2",
   },
+  // Muse Spark: CLI currently prints "has no adjustable reasoning effort" and
+  // blocks --effort locally, but the upstream /alpha/generate endpoint accepts
+  // reasoning_effort low..max for meta/muse-spark-1.2-contributor (verified
+  // 2026-08-13: direct upstream POST with low/medium/high/xhigh/max all 200,
+  // ultra 400; reasoningTokens differentiated 114..253; proxy previously stripped
+  // the field so effort changes had no effect).
+  "meta/muse-spark-1.2": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.2",
+  },
+  "meta/muse-spark-1.2-contributor": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.2-contributor",
+  },
+  "meta/muse-spark-1.1": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.1",
+  },
 } as const;
 
 /**

package/src/providers/model-rename-migration.ts

@@ -0,0 +1,202 @@
+// Registry model renames do not reach a saved provider config on their own.
+//
+// `reconcileOAuthProviders` refuses to touch a row whose `authMode` is not
+// `oauth` (src/oauth/index.ts), and `enrichProviderFromRegistry` is fill-only by
+// design: it backfills a MISSING field and never rewrites a present one, so a
+// user's hand-edited model list survives an upgrade. Both postures are correct.
+// Their gap is the case where the registry did not ADD a model but RENAMED one:
+// the saved row keeps a retired id forever, the supported id never appears, and
+// the capability metadata stays keyed to an id the vendor is taking offline
+// (issue #1610 — `qwen3.8-max-preview` persisted through the `qwen3.8-max`
+// rename in six separate fields, including a reasoning ladder that had since
+// diverged from the registry's).
+//
+// This migration is deliberately NOT general reconciliation. It rewrites exactly
+// one thing: an id this file declares retired, on a provider that still carries
+// the registry's transport, and only when the registry currently seeds the
+// replacement. Everything else in the row is left alone.
+
+import { PROVIDER_REGISTRY } from "./registry";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+
+export interface ModelRename {
+  /** Registry provider id whose saved rows may carry the retired model id. */
+  provider: string;
+  from: string;
+  to: string;
+  /** Why the vendor retired it, for the startup warning and future readers. */
+  reason: string;
+}
+
+/**
+ * Renames already applied to `PROVIDER_REGISTRY`. An entry stays here after the
+ * registry moves on: it is what repairs configs saved before that move. Removing
+ * one strands every config that has not started since the rename shipped.
+ */
+export const MODEL_RENAMES: readonly ModelRename[] = [
+  {
+    provider: "alibaba-token-plan",
+    from: "qwen3.8-max-preview",
+    to: "qwen3.8-max",
+    reason: "Alibaba shipped Qwen3.8-Max as stable and documents the preview endpoint as liable to be taken offline once preview concludes",
+  },
+  {
+    provider: "alibaba-token-plan-intl",
+    from: "qwen3.8-max-preview",
+    to: "qwen3.8-max",
+    reason: "Alibaba shipped Qwen3.8-Max as stable and documents the preview endpoint as liable to be taken offline once preview concludes",
+  },
+];
+
+/** Provider fields that key metadata by model id. */
+const MODEL_KEYED_RECORDS = [
+  "modelContextWindows",
+  "modelMaxOutputTokens",
+  "modelInputModalities",
+  "modelReasoningEfforts",
+  "modelDefaultReasoningEfforts",
+  "modelReasoningEffortMap",
+] as const;
+
+/** Provider fields that are flat lists of model ids. */
+const MODEL_ID_LISTS = [
+  "models",
+  "noVisionModels",
+  "noReasoningModels",
+  "noTemperatureModels",
+  "noTopPModels",
+  "noPenaltyModels",
+  "autoToolChoiceOnlyModels",
+  "preserveReasoningContentModels",
+  "thinkingBudgetModels",
+  "directReasoningEffortModels",
+] as const;
+
+function renameInList(value: unknown, from: string, to: string): string[] | null {
+  if (!Array.isArray(value) || !value.includes(from)) return null;
+  const seen = new Set<string>();
+  const next: string[] = [];
+  // Rename in place to preserve ordering, and collapse a duplicate if the target
+  // id was already present alongside the retired one.
+  for (const entry of value) {
+    if (typeof entry !== "string") continue;
+    const mapped = entry === from ? to : entry;
+    if (seen.has(mapped)) continue;
+    seen.add(mapped);
+    next.push(mapped);
+  }
+  return next;
+}
+
+function renameInRecord(value: unknown, from: string, to: string): Record<string, unknown> | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value as Record<string, unknown>;
+  if (!(from in record)) return null;
+  const next: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(record)) {
+    const mapped = key === from ? to : key;
+    if (mapped in next) continue;
+    // An explicit entry already saved under the new id is the newer intent.
+    next[mapped] = key === from && to in record ? record[to] : entry;
+  }
+  return next;
+}
+
+/**
+ * `provider/model` rows in the top-level `disabledModels` list.
+ *
+ * The retired row is DROPPED rather than renamed: carrying its disabled state to
+ * the new id would hide the supported model behind a toggle the user set for a
+ * different model. An existing row for the new id is left untouched.
+ */
+function renameDisabledModels(config: OcxConfig, rename: ModelRename): boolean {
+  const list = config.disabledModels;
+  if (!Array.isArray(list)) return false;
+  const retired = `${rename.provider}/${rename.from}`;
+  if (!list.includes(retired)) return false;
+  config.disabledModels = list.filter(entry => entry !== retired);
+  return true;
+}
+
+/**
+ * Only migrate a row that still points at the registry's own endpoint. A user who
+ * repointed `baseUrl` at a different vendor owns their model ids.
+ */
+function providerStillMatchesRegistry(name: string, prov: OcxProviderConfig): boolean {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === name);
+  if (!entry) return false;
+  if (!prov.baseUrl || !entry.baseUrl) return true;
+  const choices = entry.baseUrlChoices?.map(choice => choice.baseUrl) ?? [];
+  const known = [entry.baseUrl, ...choices]
+    .filter((url): url is string => typeof url === "string")
+    .map(url => url.replace(/\/+$/, ""));
+  return known.includes(prov.baseUrl.replace(/\/+$/, ""));
+}
+
+/** Guard against a stale rename: only apply when the registry actually seeds `to`. */
+function registrySeedsTarget(rename: ModelRename): boolean {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === rename.provider);
+  return !!entry?.models?.includes(rename.to);
+}
+
+export interface ModelRenameProjection {
+  config: OcxConfig;
+  changed: boolean;
+  warnings: string[];
+}
+
+/**
+ * Pure projection: apply every applicable rename and report what changed. The
+ * caller decides whether to persist.
+ */
+export function projectModelRenames(
+  config: OcxConfig,
+  renames: readonly ModelRename[] = MODEL_RENAMES,
+): ModelRenameProjection {
+  const warnings: string[] = [];
+  let changed = false;
+
+  for (const rename of renames) {
+    const prov = config.providers?.[rename.provider];
+    if (!prov) continue;
+    if (!registrySeedsTarget(rename)) {
+      warnings.push(
+        `registry no longer seeds "${rename.to}" for "${rename.provider}"; skipping the `
+        + `"${rename.from}" rename rather than writing an id the registry does not know.`,
+      );
+      continue;
+    }
+    if (!providerStillMatchesRegistry(rename.provider, prov)) continue;
+
+    // Provider config is a closed interface, so index through one unknown-cast
+    // view rather than casting at each assignment.
+    const row = prov as unknown as Record<string, unknown>;
+    let touched = false;
+    for (const field of MODEL_ID_LISTS) {
+      const next = renameInList(row[field], rename.from, rename.to);
+      if (!next) continue;
+      row[field] = next;
+      touched = true;
+    }
+    for (const field of MODEL_KEYED_RECORDS) {
+      const next = renameInRecord(row[field], rename.from, rename.to);
+      if (!next) continue;
+      row[field] = next;
+      touched = true;
+    }
+    if (prov.defaultModel === rename.from) {
+      prov.defaultModel = rename.to;
+      touched = true;
+    }
+    if (renameDisabledModels(config, rename)) touched = true;
+
+    if (touched) {
+      changed = true;
+      warnings.push(
+        `renamed "${rename.provider}/${rename.from}" to "${rename.to}" in the saved config: ${rename.reason}.`,
+      );
+    }
+  }
+
+  return { config, changed, warnings };
+}

package/src/providers/model-rename-startup.ts

@@ -0,0 +1,28 @@
+import { saveConfig } from "../config";
+import { projectModelRenames } from "./model-rename-migration";
+import type { OcxConfig } from "../types";
+
+export interface ModelRenameStartupDeps {
+  project: typeof projectModelRenames;
+  save: (config: OcxConfig) => void;
+}
+
+/**
+ * Apply registry model renames to the saved config at startup (issue #1610).
+ *
+ * No backup is taken, unlike the OpenAI tier and Alibaba region migrations: those
+ * rewrite credentials and provider identity, where a bad projection is not
+ * recoverable from the config alone. This one only rewrites model ids that the
+ * registry itself no longer seeds, and the pre-migration value is a string this
+ * file still names, so the change is reversible by hand.
+ */
+export function runModelRenameStartupMigration(
+  config: OcxConfig,
+  deps: ModelRenameStartupDeps = { project: projectModelRenames, save: saveConfig },
+): OcxConfig {
+  const projection = deps.project(config);
+  for (const warning of projection.warnings) console.warn(`[model-rename-migration] ${warning}`);
+  if (!projection.changed) return projection.config;
+  deps.save(projection.config);
+  return projection.config;
+}

package/src/providers/openai-tier-startup.ts

@@ -1,4 +1,10 @@
-import { backupConfigBeforeOpenAiTierMigration, saveConfig } from "../config";
+import {
+  backupConfigBeforeOpenAiTierMigration,
+  OpenAiTierBackupCollisionError,
+  OpenAiTierRollbackPreserveError,
+  preserveOpenAiTierRollbackSnapshot,
+  saveConfig,
+} from "../config";
 import type { OcxConfig } from "../types";
 import { projectOpenAiTierMigration } from "./openai-tiers";
 
@@ -6,6 +12,23 @@ export interface OpenAiTierStartupDeps {
   project: typeof projectOpenAiTierMigration;
   backup: () => void;
   save: (config: OcxConfig) => void;
+  preserveRollback?: (error: OpenAiTierBackupCollisionError) => void;
+}
+
+function defaultPreserveRollback(error: OpenAiTierBackupCollisionError): void {
+  if (!error.configPath) throw error;
+  try {
+    const preserved = preserveOpenAiTierRollbackSnapshot(error.configPath);
+    console.warn(`[openai-provider-migration] Preserved rollback snapshot at ${preserved}`);
+  } catch (cause) {
+    if (
+      cause instanceof OpenAiTierRollbackPreserveError
+      && (cause.code === "missing" || cause.code === "not-rollback")
+    ) {
+      throw error;
+    }
+    throw cause;
+  }
 }
 
 const DEFAULT_DEPS: OpenAiTierStartupDeps = {
@@ -20,7 +43,13 @@ export function runOpenAiTierStartupMigration(
 ): OcxConfig {
   const projection = deps.project(config);
   if (!projection.changed) return projection.config;
-  deps.backup();
+  try {
+    deps.backup();
+  } catch (error) {
+    if (!(error instanceof OpenAiTierBackupCollisionError)) throw error;
+    (deps.preserveRollback ?? defaultPreserveRollback)(error);
+    deps.backup();
+  }
   deps.save(projection.config);
   for (const warning of projection.warnings) console.warn(`[openai-provider-migration] ${warning}`);
   return projection.config;

package/src/providers/quota.ts

@@ -783,9 +783,16 @@ async function fetchMoonshotQuota(provider: string, config: OcxProviderConfig):
   if (available === undefined || available < 0) return null;
   // Moonshot exposes no per-window quota ceiling, only a balance — report it
   // as a balance-only window (percent 0) rather than a fabricated utilization.
+  // Currency is host-scoped: China platform (api.moonshot.cn) bills in CNY;
+  // the international platform (api.moonshot.ai) bills in USD. Do not force
+  // either side into the other unit — the number is correct, only the unit
+  // must match the host.
+  const isChinaHost = host.startsWith("https://api.moonshot.cn");
+  const money = (n: number) => isChinaHost ? `¥${n.toFixed(2)}` : `$${n.toFixed(2)}`;
+  const unit = isChinaHost ? "CNY" : "USD";
   const label = voucher !== undefined && cash !== undefined
-    ? `Balance ($${available.toFixed(2)} available, $${voucher.toFixed(2)} voucher)`
-    : `Balance ($${available.toFixed(2)} available)`;
+    ? `Balance (${money(available)} ${unit} available, ${money(voucher)} voucher)`
+    : `Balance (${money(available)} ${unit} available)`;
   return report(provider, "moonshot:balance", {
     customWindows: [{ label, percent: 0 }],
     updatedAt: Date.now(),