@bitkyc08/opencodex 2.14.1 → 2.15.0

package/src/oauth/nous.ts

@@ -39,6 +39,7 @@ import { join } from "node:path";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { getAuthStorePath } from "./store";
 import { atomicWriteFile, hardenConfigDir, hardenExistingSecret } from "../config";
+import { BOUNDED_BODY_MAX_BYTES, readBoundedResponseBytes } from "../lib/bounded-body";
 
 export const NOUS_PORTAL_BASE_URL = "https://portal.nousresearch.com";
 export const NOUS_INFERENCE_BASE_URL = "https://inference-api.nousresearch.com/v1";
@@ -87,6 +88,44 @@ interface NousJwtPayload {
   [key: string]: unknown;
 }
 
+async function readOAuthBytes(response: Response, signal: AbortSignal): Promise<Uint8Array> {
+  const { bytes, oversized } = await readBoundedResponseBytes(response, {
+    maxBytes: BOUNDED_BODY_MAX_BYTES,
+    signal,
+  });
+  if (oversized) {
+    throw new NousTokenError(
+      response.status,
+      "response_too_large",
+      `Nous Portal OAuth response exceeded the ${BOUNDED_BODY_MAX_BYTES}-byte limit`,
+    );
+  }
+  return bytes;
+}
+
+function parseOAuthJson(bytes: Uint8Array): unknown {
+  const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+    ? parsed as Record<string, unknown>
+    : {};
+}
+
+async function readOAuthJson(response: Response, signal: AbortSignal): Promise<unknown> {
+  return parseOAuthJson(await readOAuthBytes(response, signal));
+}
+
+async function readOAuthJsonOrEmpty(response: Response, signal: AbortSignal): Promise<unknown> {
+  const bytes = await readOAuthBytes(response, signal);
+  try {
+    return parseOAuthJson(bytes);
+  } catch {
+    // Preserve the pre-PR behavior for empty/HTML/malformed JSON only. Body
+    // read failures, timeouts, caller cancellation, and size-limit errors have
+    // already escaped readOAuthBytes and must retain their real identity.
+    return {};
+  }
+}
+
 // ── Durable refresh-intent (review blocker #2) ──────────────────────────────
 // A refresh-intent file records that we submitted `refreshToken` to the Portal
 // and whether we are certain the rotated token was persisted. It lives next to
@@ -495,6 +534,7 @@ async function requestDeviceAuthorization(signal?: AbortSignal): Promise<{
   expiresInMs: number;
   intervalMs: number;
 }> {
+  const effectiveSignal = requestSignal(signal);
   const response = await fetch(`${resolvePortalBaseUrl()}/api/oauth/device/code`, {
     method: "POST",
     headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
@@ -503,14 +543,16 @@ async function requestDeviceAuthorization(signal?: AbortSignal): Promise<{
       scope: NOUS_OAUTH_SCOPE,
     }),
     redirect: "error",
-    signal: requestSignal(signal),
+    signal: effectiveSignal,
   });
-  if (!response.ok) throw tokenErrorFromPayload(response.status, await response.json().catch(() => ({})));
+  if (!response.ok) {
+    throw tokenErrorFromPayload(response.status, await readOAuthJsonOrEmpty(response, effectiveSignal));
+  }
   // A successful HTTP response may still carry an empty/HTML/non-JSON body.
   // Fall back to an empty object so the required-field check below produces the
   // clear "missing required fields" validation error instead of leaking a raw
   // JSON parser exception.
-  const payload = (await response.json().catch(() => ({}))) as NousDeviceAuthorizationResponse;
+  const payload = await readOAuthJsonOrEmpty(response, effectiveSignal) as NousDeviceAuthorizationResponse;
   const userCode = nonEmptyString(payload.user_code);
   const deviceCode = nonEmptyString(payload.device_code);
   const verificationUri = nonEmptyString(payload.verification_uri_complete) ?? nonEmptyString(payload.verification_uri);
@@ -549,6 +591,7 @@ async function pollForToken(
   while (Date.now() < deadline) {
     if (signal?.aborted) throw new Error("Login cancelled");
     let response: Response;
+    const effectiveSignal = requestSignal(signal);
     try {
       response = await fetch(`${resolvePortalBaseUrl()}/api/oauth/token`, {
         method: "POST",
@@ -559,7 +602,7 @@ async function pollForToken(
           grant_type: "urn:ietf:params:oauth:grant-type:device_code",
         }),
         redirect: "error",
-        signal: requestSignal(signal),
+        signal: effectiveSignal,
       });
     } catch (netErr) {
       // Genuine cancellation must abort immediately. Any other transport-level
@@ -571,13 +614,15 @@ async function pollForToken(
       if (await sleepUntilDeadline(waitMs)) continue;
       break;
     }
+    // Parse under the same deadline that covered the request headers. Keep the
+    // read outside the fetch retry catch: a bounded-reader error or caller
+    // cancellation is an observed response failure, not a safe poll retry.
+    const payload = await readOAuthJsonOrEmpty(response, effectiveSignal) as NousTokenResponse;
     // Parse once and pass the payload through to the failure path (review #8),
     // so we never try to re-read a body that has already been consumed.
     // Normalize a successful-but-non-object body (for example valid JSON
     // `null`) to an empty object so the required-field validation below
     // produces a terminal NousTokenError instead of a raw TypeError.
-    const parsed = (await response.json().catch(() => ({}))) as unknown;
-    const payload = (parsed && typeof parsed === "object" ? parsed : {}) as NousTokenResponse;
     if (Date.now() >= deadline) break;
     if (response.ok) return parseTokenPayload(payload, "");
     const error = payload.error;
@@ -670,6 +715,7 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
   }
 
   let response: Response;
+  const effectiveSignal = requestSignal(signal);
   try {
     response = await fetch(`${baseUrl}/api/oauth/token`, {
       method: "POST",
@@ -683,7 +729,7 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
         client_id: NOUS_OAUTH_CLIENT_ID,
       }),
       redirect: "error",
-      signal: requestSignal(signal),
+      signal: effectiveSignal,
     });
   } catch (netErr) {
     // The request may have reached the server and rotated the token even on a
@@ -703,7 +749,6 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
 
   if (!response.ok) {
     const status = response.status;
-    const payload = await response.json().catch(() => ({}));
     // The request reached the Portal's token endpoint. A non-2xx response does
     // NOT establish that the single-use refresh token was not consumed: 429
     // rate limits, unknown/custom 4xx, and gateway-generated client-class
@@ -719,6 +764,7 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
       // The pre-dispatch "submitted" intent is still on disk, which also
       // blocks replay; surface the original HTTP error below.
     }
+    const payload = await readOAuthJsonOrEmpty(response, effectiveSignal);
     throw tokenErrorFromPayload(status, payload);
   }
 
@@ -727,7 +773,10 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
   // replay it. On success we deliberately LEAVE the intent as "submitted"
   // (the store clears it once the rotated token is persisted).
   try {
-    const creds = parseTokenPayload((await response.json()) as NousTokenResponse, refreshToken);
+    const creds = parseTokenPayload(
+      (await readOAuthJson(response, effectiveSignal)) as NousTokenResponse,
+      refreshToken,
+    );
     return creds;
   } catch (e) {
     try {

package/src/providers/antigravity-models.ts

@@ -10,10 +10,39 @@ import { isValidModelDiscoveryModelId, MODEL_DISCOVERY_MAX_MODELS } from "./mode
 // returned wire id remains visible so an unavailable tier cannot be selected.
 
 // ── Wire IDs (what CCA :fetchAvailableModels returns) ──
+
+/** Current Antigravity Flash generation. */
+const GEMINI_FLASH_CURRENT = "gemini-3.7-flash";
+
+/**
+ * Retired Flash ids → the reasoning tier they used to encode.
+ *
+ * Google pulls the previous Flash model from CCA almost immediately when the next
+ * one ships, so a saved selection cannot keep pointing at it. A flat alias would
+ * strand the user's tier: `resolveAntigravityEffortWireModel` rule 1 treats any
+ * alias as "the suffix IS the effort" and deliberately sends no thinkingConfig, so
+ * `gemini-3.6-flash-high` would silently become an untiered 3.7 call. Carrying the
+ * level here preserves what the user actually chose.
+ *
+ * 3.7 exposes tiers through `thinkingLevel` on ONE wire id rather than through
+ * suffixed wire ids, which is why the mapping is id → level and not id → id.
+ */
+const RETIRED_FLASH_TIERS: Record<string, string> = {
+  // 3.6 generation.
+  "gemini-3.6-flash": "medium", // bare base carried a medium default
+  "gemini-3.6-flash-low": "low",
+  "gemini-3.6-flash-medium": "medium",
+  "gemini-3.6-flash-high": "high",
+  // 3.5 generation — these already pointed at 3.6 wire ids, which are now dead too.
+  "gemini-3.5-flash-extra-low": "low",
+  "gemini-3.5-flash-low": "medium",
+  "gemini-3.5-flash-mid": "medium",
+  "gemini-3.5-flash-high": "high",
+  "gemini-3-flash-agent": "high",
+};
+
 const ANTIGRAVITY_WIRE_MODELS = [
-  "gemini-3.6-flash-low",
-  "gemini-3.6-flash-medium",
-  "gemini-3.6-flash-high",
+  "gemini-3.7-flash",
   "gemini-3.1-pro-low",
   "gemini-pro-agent",
   "gemini-3.1-flash-image",
@@ -23,9 +52,6 @@ const ANTIGRAVITY_WIRE_MODELS = [
 ];
 
 const ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID: Record<string, string> = {
-  "gemini-3.6-flash-low": "gemini-3.6-flash",
-  "gemini-3.6-flash-medium": "gemini-3.6-flash",
-  "gemini-3.6-flash-high": "gemini-3.6-flash",
   "gemini-3.1-pro-low": "gemini-3.1-pro",
   "gemini-pro-agent": "gemini-3.1-pro",
 };
@@ -41,7 +67,7 @@ const ANTIGRAVITY_WIRE_IDS_BY_PICKER_MODEL: Record<string, string[]> = Object.en
 // Gemini models: effort → wire model suffix (official agy UI pattern).
 // Claude Opus: effort → thinkingConfig.thinkingLevel (CLIProxyAPI proven pattern).
 export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
-  "gemini-3.6-flash": ["low", "medium", "high"],
+  "gemini-3.7-flash": ["low", "medium", "high"],
   "gemini-3.1-pro": ["low", "high"],
   "claude-sonnet-4-6": ["low", "medium", "high", "max"],
   "claude-opus-4-6-thinking": ["low", "medium", "high", "max"],
@@ -49,11 +75,6 @@ export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
 
 // ── Effort → wire model map for Gemini base models ──
 const ANTIGRAVITY_EFFORT_WIRE_MAP: Record<string, Record<string, string>> = {
-  "gemini-3.6-flash": {
-    low: "gemini-3.6-flash-low",
-    medium: "gemini-3.6-flash-medium",
-    high: "gemini-3.6-flash-high",
-  },
   "gemini-3.1-pro": {
     low: "gemini-3.1-pro-low",
     high: "gemini-pro-agent",
@@ -62,11 +83,20 @@ const ANTIGRAVITY_EFFORT_WIRE_MAP: Record<string, Record<string, string>> = {
 
 // ── Default effort per Gemini base model ──
 const ANTIGRAVITY_DEFAULT_EFFORT: Record<string, string> = {
-  "gemini-3.6-flash": "medium",
   "gemini-3.1-pro": "high",
 };
 
-const ANTIGRAVITY_THINKING_LEVELS = new Set(["minimal", "low", "medium", "high"]);
+/**
+ * Gemini base models whose efforts ride on `thinkingLevel` against a single wire id
+ * instead of suffixed wire ids, with the level applied when the caller names none.
+ */
+const ANTIGRAVITY_THINKING_LEVEL_MODELS: Record<string, string> = {
+  "gemini-3.7-flash": "medium",
+};
+
+// `minimal` is deliberately absent: Google documents it as unsupported for the current
+// Flash generation, where it is an error rather than a quieter tier.
+const ANTIGRAVITY_THINKING_LEVELS = new Set(["low", "medium", "high"]);
 
 function resolveAntigravityThinkingLevel(effort: string): string | undefined {
   if (effort === "xhigh" || effort === "max" || effort === "ultra") return "high";
@@ -83,16 +113,17 @@ const ANTIGRAVITY_VISIBLE_MODEL_ALIASES: Record<string, string> = {
 // Wire suffix IDs are identity aliases — they resolve to themselves so saved configs
 // with explicit suffixes (e.g. gemini-3.6-flash-low) continue to work.
 const ANTIGRAVITY_COMPATIBILITY_MODEL_ALIASES: Record<string, string> = {
-  "gemini-3.6-flash-low": "gemini-3.6-flash-low",
-  "gemini-3.6-flash-medium": "gemini-3.6-flash-medium",
-  "gemini-3.6-flash-high": "gemini-3.6-flash-high",
   "gemini-3.1-pro-low": "gemini-3.1-pro-low",
   "gemini-pro-agent": "gemini-pro-agent",
-  "gemini-3.5-flash-extra-low": "gemini-3.6-flash-low",
-  "gemini-3.5-flash-low": "gemini-3.6-flash-medium",
-  "gemini-3.5-flash-mid": "gemini-3.6-flash-medium",
-  "gemini-3.5-flash-high": "gemini-3.6-flash-high",
-  "gemini-3-flash-agent": "gemini-3.6-flash-high",
+  // ── Retired Flash generations ──
+  // Google takes the previous Antigravity Flash model offline almost immediately
+  // once its successor ships, so 3.6 (and the 3.5 ids that used to land on it)
+  // route to 3.7. These stay in the alias map — not only in the tier map below —
+  // because `parseAntigravityAvailableModels` uses THIS map to keep a stale CCA
+  // payload from republishing a dead wire id as a picker row.
+  ...Object.fromEntries(
+    Object.keys(RETIRED_FLASH_TIERS).map(retired => [retired, GEMINI_FLASH_CURRENT]),
+  ),
 };
 
 export const ANTIGRAVITY_MODEL_ALIASES: Record<string, string> = {
@@ -102,7 +133,7 @@ export const ANTIGRAVITY_MODEL_ALIASES: Record<string, string> = {
 
 // Picker-visible: collapsed base models only.
 export const ANTIGRAVITY_MODELS = [
-  "gemini-3.6-flash",
+  GEMINI_FLASH_CURRENT,
   "gemini-3.1-pro",
   "gemini-3.1-flash-image",
   "claude-sonnet-4-6",
@@ -112,9 +143,7 @@ export const ANTIGRAVITY_MODELS = [
 
 // Context windows from the upstream `:fetchAvailableModels` maxTokens per model.
 const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
-  "gemini-3.6-flash-low": 1_048_576,
-  "gemini-3.6-flash-medium": 1_048_576,
-  "gemini-3.6-flash-high": 1_048_576,
+  "gemini-3.7-flash": 1_048_576,
   "gemini-3.1-pro-low": 1_048_576,
   "gemini-pro-agent": 1_048_576,
   "gemini-3.1-flash-image": 1_048_576,
@@ -125,7 +154,7 @@ const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 
 export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   // Collapsed base IDs — explicit entries for the picker.
-  "gemini-3.6-flash": 1_048_576,
+  "gemini-3.7-flash": 1_048_576,
   "gemini-3.1-pro": 1_048_576,
   // Wire IDs and aliases via derivation.
   ...ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS,
@@ -138,7 +167,11 @@ export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 };
 
 export const ANTIGRAVITY_MODEL_INPUT_MODALITIES: Record<string, string[]> = {
-  "gemini-3.6-flash": ["text", "image"],
+  // Google documents 3.7 Flash as also accepting video, audio and PDF, but this proxy
+  // carries only text and image parts (`OcxImageContent`, src/types.ts) and the Codex
+  // catalog normalizes `input_modalities` against a closed enum. Advertising a modality
+  // the wire cannot carry would be a promise we break at request time.
+  "gemini-3.7-flash": ["text", "image"],
   "gemini-3.1-pro": ["text", "image"],
   "gemini-3.1-flash-image": ["text", "image"],
   "claude-sonnet-4-6": ["text", "image"],
@@ -244,6 +277,11 @@ export function isAntigravitySuffixModelId(modelId: string): boolean {
   return !(ANTIGRAVITY_MODELS as string[]).includes(modelId);
 }
 
+/** The reasoning tier a retired Flash id used to encode, if it is one. */
+export function retiredAntigravityFlashTier(modelId: string): string | undefined {
+  return RETIRED_FLASH_TIERS[modelId];
+}
+
 /**
  * Resolve a picker-visible base model + optional reasoning effort to the CCA wire model ID.
  *
@@ -258,11 +296,32 @@ export function resolveAntigravityEffortWireModel(
   modelId: string,
   effort?: string,
 ): { wireModelId: string; thinkingLevel?: string } {
+  // Rule 0: retired Flash id — Google has taken the wire id offline, so route to the
+  // current generation and carry the tier the retired id encoded. This runs BEFORE the
+  // suffix check because those ids are aliases, and rule 1 would drop the tier.
+  const retiredTier = RETIRED_FLASH_TIERS[modelId];
+  if (retiredTier) {
+    return {
+      wireModelId: GEMINI_FLASH_CURRENT,
+      thinkingLevel: effort ? resolveAntigravityThinkingLevel(effort) ?? retiredTier : retiredTier,
+    };
+  }
+
   // Rule 1: suffix/compat alias — suffix IS the effort.
   if (isAntigravitySuffixModelId(modelId)) {
     return { wireModelId: resolveAntigravityWireModelId(modelId) };
   }
 
+  // Rule 1b: single-wire-id Gemini model whose tiers ride on thinkingLevel. Without
+  // this the model falls to rule 5 and silently loses reasoning control entirely.
+  const defaultLevel = ANTIGRAVITY_THINKING_LEVEL_MODELS[modelId];
+  if (defaultLevel) {
+    return {
+      wireModelId: modelId,
+      thinkingLevel: effort ? resolveAntigravityThinkingLevel(effort) ?? defaultLevel : defaultLevel,
+    };
+  }
+
   // Rule 2/3: mapped Gemini base model.
   const effortMap = ANTIGRAVITY_EFFORT_WIRE_MAP[modelId];
   if (effortMap) {
@@ -301,6 +360,12 @@ const ANTIGRAVITY_USAGE_BASE_BY_ID: Record<string, string> = (() => {
     // If alias is itself a base/wire already mapped, keep that mapping.
     else if (rev[wire]) rev[alias] = rev[wire]!;
   }
+  // Retired ids keep their OWN identity for usage aggregation, overriding the alias
+  // pass above. Routing sends new 3.6 calls to 3.7, but a usage row written months ago
+  // records a model the user actually called: relabelling it would move historical spend
+  // onto a model that did not exist then, and away from the 3.6 price row that still
+  // prices it correctly. Retirement changes what we CALL, not what we RECORD.
+  for (const retired of Object.keys(RETIRED_FLASH_TIERS)) rev[retired] = retired;
   // Visible aliases that only appear in ANTIGRAVITY_VISIBLE_MODEL_ALIASES are already
   // included via ANTIGRAVITY_MODEL_ALIASES. Identity bases without effort maps remain.
   return rev;

package/src/providers/base-url-choices.ts

@@ -62,3 +62,13 @@ export function matchBaseUrlChoice(
   }
   return choices.some(c => c.id === "custom") ? "custom" : choices[0]!.id;
 }
+
+/** Moonshot/Kimi API endpoint presets (international default; China selectable). */
+export const MOONSHOT_INTL_BASE_URL = "https://api.moonshot.ai/v1";
+export const MOONSHOT_CN_BASE_URL = "https://api.moonshot.cn/v1";
+
+export const MOONSHOT_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
+  { id: "international", label: "International (.ai)", baseUrl: MOONSHOT_INTL_BASE_URL },
+  { id: "china", label: "China (.cn)", baseUrl: MOONSHOT_CN_BASE_URL },
+  { id: "custom", label: "Custom" },
+];

package/src/providers/command-code-efforts.ts

@@ -13,6 +13,24 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     efforts: ["high", "max"],
     profileUrl: "https://commandcode.ai/models/glm-5-2",
   },
+  // Muse Spark: CLI currently prints "has no adjustable reasoning effort" and
+  // blocks --effort locally, but the upstream /alpha/generate endpoint accepts
+  // reasoning_effort low..max for meta/muse-spark-1.2-contributor (verified
+  // 2026-08-13: direct upstream POST with low/medium/high/xhigh/max all 200,
+  // ultra 400; reasoningTokens differentiated 114..253; proxy previously stripped
+  // the field so effort changes had no effect).
+  "meta/muse-spark-1.2": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.2",
+  },
+  "meta/muse-spark-1.2-contributor": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.2-contributor",
+  },
+  "meta/muse-spark-1.1": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.1",
+  },
 } as const;
 
 /**

package/src/providers/model-rename-migration.ts

@@ -0,0 +1,255 @@
+// Registry model renames do not reach a saved provider config on their own.
+//
+// `reconcileOAuthProviders` refuses to touch a row whose `authMode` is not
+// `oauth` (src/oauth/index.ts), and `enrichProviderFromRegistry` is fill-only by
+// design: it backfills a MISSING field and never rewrites a present one, so a
+// user's hand-edited model list survives an upgrade. Both postures are correct.
+// Their gap is the case where the registry did not ADD a model but RENAMED one:
+// the saved row keeps a retired id forever, the supported id never appears, and
+// the capability metadata stays keyed to an id the vendor is taking offline
+// (issue #1610 — `qwen3.8-max-preview` persisted through the `qwen3.8-max`
+// rename in six separate fields, including a reasoning ladder that had since
+// diverged from the registry's).
+//
+// This migration is deliberately NOT general reconciliation. It rewrites exactly
+// one thing: an id this file declares retired, on a provider that still carries
+// the registry's transport, and only when the registry currently seeds the
+// replacement. Everything else in the row is left alone.
+
+import { PROVIDER_REGISTRY } from "./registry";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+
+export interface ModelRename {
+  /** Registry provider id whose saved rows may carry the retired model id. */
+  provider: string;
+  from: string;
+  to: string;
+  /** Why the vendor retired it, for the startup warning and future readers. */
+  reason: string;
+  /**
+   * Drop the retired key from `modelReasoningEffortMap` instead of renaming it.
+   *
+   * Renaming preserves the VALUE, which is right for records whose values describe the
+   * model — a context window or an effort ladder survives a rename — and wrong for the
+   * one record whose values are themselves wire ids. An effort map saved as
+   * `high -> gemini-3.6-flash-high` would keep naming a dead wire id under the new key,
+   * and the adapter maps effort BEFORE resolving CCA routing, so that value arrives as
+   * an unrecognised effort and silently degrades to the default tier.
+   *
+   * Only that one record is dropped. Emptying the others would be worse than the bug:
+   * catalog enrichment treats an existing `{}` as "already populated" and will not
+   * restore the registry's records, so the migrated user would keep routing correctly
+   * but lose the reasoning picker entirely.
+   */
+  dropReasoningEffortMap?: boolean;
+}
+
+/**
+ * Renames already applied to `PROVIDER_REGISTRY`. An entry stays here after the
+ * registry moves on: it is what repairs configs saved before that move. Removing
+ * one strands every config that has not started since the rename shipped.
+ */
+export const MODEL_RENAMES: readonly ModelRename[] = [
+  {
+    provider: "alibaba-token-plan",
+    from: "qwen3.8-max-preview",
+    to: "qwen3.8-max",
+    reason: "Alibaba shipped Qwen3.8-Max as stable and documents the preview endpoint as liable to be taken offline once preview concludes",
+  },
+  {
+    provider: "alibaba-token-plan-intl",
+    from: "qwen3.8-max-preview",
+    to: "qwen3.8-max",
+    reason: "Alibaba shipped Qwen3.8-Max as stable and documents the preview endpoint as liable to be taken offline once preview concludes",
+  },
+  // Antigravity Flash generations. Google takes the previous Flash model off Cloud Code
+  // Assist almost immediately when the next ships, so a saved 3.6 (or older 3.5) id is a
+  // dead selection rather than a merely outdated one. Routing already redirects these ids
+  // at request time; this migration repairs the saved config so the picker, the allowlist
+  // and the capability maps stop naming a model the backend no longer serves.
+  ...(["gemini-3.6-flash", "gemini-3.6-flash-low", "gemini-3.6-flash-medium", "gemini-3.6-flash-high",
+    "gemini-3.5-flash-extra-low", "gemini-3.5-flash-low", "gemini-3.5-flash-mid", "gemini-3.5-flash-high",
+    "gemini-3-flash-agent"] as const).map(from => ({
+    provider: "google-antigravity",
+    from,
+    to: "gemini-3.7-flash",
+    reason: "Google retires the previous Antigravity Flash generation from Cloud Code Assist when its successor ships, so the saved id no longer resolves to a live model",
+    // The retired Flash tiers were wire ids, so any saved per-model record keyed by one
+    // may also hold one as a value. 3.7 expresses tiers as thinkingLevel names instead.
+    dropReasoningEffortMap: true,
+  })),
+];
+
+/** Provider fields that key metadata by model id. */
+const MODEL_KEYED_RECORDS = [
+  "modelContextWindows",
+  "modelMaxOutputTokens",
+  "modelInputModalities",
+  "modelReasoningEfforts",
+  "modelDefaultReasoningEfforts",
+  "modelReasoningEffortMap",
+] as const;
+
+/** Provider fields that are flat lists of model ids. */
+const MODEL_ID_LISTS = [
+  "models",
+  // A retired id left here is worse than a stale label: `filterCatalogModels` treats
+  // `selectedModels` as an exact-match allowlist, so a user who allowlisted only the
+  // retired model gets NO replacement row at all — the model silently vanishes from
+  // their catalog instead of being renamed. OAuth reconciliation does not cover this
+  // field, so the rename has to.
+  "selectedModels",
+  "noVisionModels",
+  "noReasoningModels",
+  "noTemperatureModels",
+  "noTopPModels",
+  "noPenaltyModels",
+  "autoToolChoiceOnlyModels",
+  "preserveReasoningContentModels",
+  "thinkingBudgetModels",
+  "directReasoningEffortModels",
+] as const;
+
+function renameInList(value: unknown, from: string, to: string): string[] | null {
+  if (!Array.isArray(value) || !value.includes(from)) return null;
+  const seen = new Set<string>();
+  const next: string[] = [];
+  // Rename in place to preserve ordering, and collapse a duplicate if the target
+  // id was already present alongside the retired one.
+  for (const entry of value) {
+    if (typeof entry !== "string") continue;
+    const mapped = entry === from ? to : entry;
+    if (seen.has(mapped)) continue;
+    seen.add(mapped);
+    next.push(mapped);
+  }
+  return next;
+}
+
+function renameInRecord(value: unknown, from: string, to: string): Record<string, unknown> | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value as Record<string, unknown>;
+  if (!(from in record)) return null;
+  const next: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(record)) {
+    const mapped = key === from ? to : key;
+    if (mapped in next) continue;
+    // An explicit entry already saved under the new id is the newer intent.
+    next[mapped] = key === from && to in record ? record[to] : entry;
+  }
+  return next;
+}
+
+/** Drop the retired key entirely, leaving any entry already saved under the new id. */
+function dropFromRecord(value: unknown, from: string): Record<string, unknown> | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value as Record<string, unknown>;
+  if (!(from in record)) return null;
+  const next: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(record)) {
+    if (key === from) continue;
+    next[key] = entry;
+  }
+  return next;
+}
+
+/**
+ * `provider/model` rows in the top-level `disabledModels` list.
+ *
+ * The retired row is DROPPED rather than renamed: carrying its disabled state to
+ * the new id would hide the supported model behind a toggle the user set for a
+ * different model. An existing row for the new id is left untouched.
+ */
+function renameDisabledModels(config: OcxConfig, rename: ModelRename): boolean {
+  const list = config.disabledModels;
+  if (!Array.isArray(list)) return false;
+  const retired = `${rename.provider}/${rename.from}`;
+  if (!list.includes(retired)) return false;
+  config.disabledModels = list.filter(entry => entry !== retired);
+  return true;
+}
+
+/**
+ * Only migrate a row that still points at the registry's own endpoint. A user who
+ * repointed `baseUrl` at a different vendor owns their model ids.
+ */
+function providerStillMatchesRegistry(name: string, prov: OcxProviderConfig): boolean {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === name);
+  if (!entry) return false;
+  if (!prov.baseUrl || !entry.baseUrl) return true;
+  const choices = entry.baseUrlChoices?.map(choice => choice.baseUrl) ?? [];
+  const known = [entry.baseUrl, ...choices]
+    .filter((url): url is string => typeof url === "string")
+    .map(url => url.replace(/\/+$/, ""));
+  return known.includes(prov.baseUrl.replace(/\/+$/, ""));
+}
+
+/** Guard against a stale rename: only apply when the registry actually seeds `to`. */
+function registrySeedsTarget(rename: ModelRename): boolean {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === rename.provider);
+  return !!entry?.models?.includes(rename.to);
+}
+
+export interface ModelRenameProjection {
+  config: OcxConfig;
+  changed: boolean;
+  warnings: string[];
+}
+
+/**
+ * Pure projection: apply every applicable rename and report what changed. The
+ * caller decides whether to persist.
+ */
+export function projectModelRenames(
+  config: OcxConfig,
+  renames: readonly ModelRename[] = MODEL_RENAMES,
+): ModelRenameProjection {
+  const warnings: string[] = [];
+  let changed = false;
+
+  for (const rename of renames) {
+    const prov = config.providers?.[rename.provider];
+    if (!prov) continue;
+    if (!registrySeedsTarget(rename)) {
+      warnings.push(
+        `registry no longer seeds "${rename.to}" for "${rename.provider}"; skipping the `
+        + `"${rename.from}" rename rather than writing an id the registry does not know.`,
+      );
+      continue;
+    }
+    if (!providerStillMatchesRegistry(rename.provider, prov)) continue;
+
+    // Provider config is a closed interface, so index through one unknown-cast
+    // view rather than casting at each assignment.
+    const row = prov as unknown as Record<string, unknown>;
+    let touched = false;
+    for (const field of MODEL_ID_LISTS) {
+      const next = renameInList(row[field], rename.from, rename.to);
+      if (!next) continue;
+      row[field] = next;
+      touched = true;
+    }
+    for (const field of MODEL_KEYED_RECORDS) {
+      const next = rename.dropReasoningEffortMap && field === "modelReasoningEffortMap"
+        ? dropFromRecord(row[field], rename.from)
+        : renameInRecord(row[field], rename.from, rename.to);
+      if (!next) continue;
+      row[field] = next;
+      touched = true;
+    }
+    if (prov.defaultModel === rename.from) {
+      prov.defaultModel = rename.to;
+      touched = true;
+    }
+    if (renameDisabledModels(config, rename)) touched = true;
+
+    if (touched) {
+      changed = true;
+      warnings.push(
+        `renamed "${rename.provider}/${rename.from}" to "${rename.to}" in the saved config: ${rename.reason}.`,
+      );
+    }
+  }
+
+  return { config, changed, warnings };
+}