@bitkyc08/opencodex 2.59.0 → 2.61.0-preview.20260922

package/src/providers/model-rename-migration.ts

@@ -14,9 +14,13 @@
 // This migration is deliberately NOT general reconciliation. It rewrites exactly
 // one thing: an id this file declares retired, on a provider that still carries
 // the registry's transport, and only when the registry currently seeds the
-// replacement. Everything else in the row is left alone.
+// replacement — and it skips a field where the retired entry is registry residue
+// with nothing left to carry forward (see `isRegistryResidue`, issue #5066).
+// Everything else in the row is left alone.
 
 import { PROVIDER_REGISTRY } from "./registry";
+import { MODEL_KEYED_RECORDS, MODEL_ID_LISTS, MODEL_ID_SCALARS, MODEL_NESTED_RECORDS } from "./model-rename-fields";
+import { providerConfigSeed } from "./derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
 export interface ModelRename {
@@ -42,6 +46,52 @@ export interface ModelRename {
    * but lose the reasoning picker entirely.
    */
   dropReasoningEffortMap?: boolean;
+  /**
+   * Remove both the retired id and its replacement from `noReasoningModels`.
+   *
+   * Use this only when the rename also marks a capability change: carrying the old
+   * no-reasoning classification onto a newly adjustable alias would keep the picker
+   * disabled after the model id itself was repaired.
+   */
+  dropNoReasoningModels?: boolean;
+  /** Refresh exact registry defaults already saved under the replacement id. */
+  targetSeedRefresh?: {
+    contextWindow?: { from: number; to: number };
+    reasoning?: {
+      fromEfforts: readonly string[];
+      toEfforts: readonly string[];
+      defaultEffort: string;
+      effortMap: Readonly<Record<string, string>>;
+    };
+  };
+}
+
+const KIMI_K28_ALIAS = "kimi-for-coding";
+const KIMI_RETIRED_CODING_IDS = [
+  "kimi-k2.7-code",
+  "kimi-k2.7-code-highspeed",
+  "kimi-k2.6",
+  "kimi-k2.5",
+] as const;
+const KIMI_K28_TARGET_SEED_REFRESH: NonNullable<ModelRename["targetSeedRefresh"]> = {
+  contextWindow: { from: 262_144, to: 1_048_576 },
+  reasoning: {
+    fromEfforts: [],
+    toEfforts: ["low", "high", "max"],
+    defaultEffort: "max",
+    effortMap: { none: "none", low: "low", medium: "high", high: "high", xhigh: "max", max: "max" },
+  },
+};
+
+function kimiCodingRenames(provider: "kimi" | "kimi-code", endpoint: string): ModelRename[] {
+  return KIMI_RETIRED_CODING_IDS.map(from => ({
+    provider,
+    from,
+    to: KIMI_K28_ALIAS,
+    reason: `Moonshot retired the k2.x coding ids from the ${endpoint}; kimi-for-coding is the stable alias the endpoint still serves`,
+    dropNoReasoningModels: true,
+    targetSeedRefresh: KIMI_K28_TARGET_SEED_REFRESH,
+  }));
 }
 
 /**
@@ -62,6 +112,14 @@ export const MODEL_RENAMES: readonly ModelRename[] = [
     to: "qwen3.8-max",
     reason: "Alibaba shipped Qwen3.8-Max as stable and documents the preview endpoint as liable to be taken offline once preview concludes",
   },
+  // Kimi coding renames. Moonshot retired the k2.x ids from the subscription/coding
+  // endpoint when K2.8 Preview shipped (live /coding/v1/models lists only
+  // kimi-for-coding[-highspeed], k3, k3-256k); kimi-for-coding is the stable alias the
+  // endpoint still serves and currently routes to K2.8 Preview. The registry picker no
+  // longer seeds the retired ids, so a saved defaultModel naming one is a dead selection
+  // rather than a merely outdated one.
+  ...kimiCodingRenames("kimi", "subscription endpoint after K2.8 Preview shipped"),
+  ...kimiCodingRenames("kimi-code", "coding endpoint after K2.8 Preview shipped"),
   // Antigravity Flash generations. Google takes the previous Flash model off Cloud Code
   // Assist almost immediately when the next ships, so a saved 3.6 (or older 3.5) id is a
   // dead selection rather than a merely outdated one. Routing already redirects these ids
@@ -80,40 +138,6 @@ export const MODEL_RENAMES: readonly ModelRename[] = [
   })),
 ];
 
-/** Provider fields that key metadata by model id. */
-const MODEL_KEYED_RECORDS = [
-  "modelContextWindows",
-  "modelMaxOutputTokens",
-  "modelInputModalities",
-  "modelReasoningEfforts",
-  "modelSuppressSyntheticMax",
-  "modelDefaultReasoningEfforts",
-  "modelReasoningEffortMap",
-] as const;
-
-/** Provider fields that are flat lists of model ids. */
-const MODEL_ID_LISTS = [
-  "models",
-  // A retired id left here is worse than a stale label: `filterCatalogModels` treats
-  // `selectedModels` as an exact-match allowlist, so a user who allowlisted only the
-  // retired model gets NO replacement row at all — the model silently vanishes from
-  // their catalog instead of being renamed. OAuth reconciliation does not cover this
-  // field, so the rename has to.
-  "selectedModels",
-  // Same reasoning as `selectedModels`: a retired id pinned here would be resurrected as a
-  // ghost row on every discovery instead of following the rename (#1690).
-  "retainModels",
-  "noVisionModels",
-  "noReasoningModels",
-  "noTemperatureModels",
-  "noTopPModels",
-  "noPenaltyModels",
-  "autoToolChoiceOnlyModels",
-  "preserveReasoningContentModels",
-  "thinkingBudgetModels",
-  "directReasoningEffortModels",
-] as const;
-
 function renameInList(value: unknown, from: string, to: string): string[] | null {
   if (!Array.isArray(value) || !value.includes(from)) return null;
   const seen = new Set<string>();
@@ -130,6 +154,18 @@ function renameInList(value: unknown, from: string, to: string): string[] | null
   return next;
 }
 
+function dropRenamedIdsFromList(
+  value: unknown,
+  from: string,
+  to: string,
+  dropStaleTarget: boolean,
+): string[] | null {
+  if (!Array.isArray(value)) return null;
+  const hasRetired = value.includes(from);
+  if (!hasRetired && !(dropStaleTarget && value.includes(to))) return null;
+  return value.filter(entry => typeof entry === "string" && entry !== from && entry !== to);
+}
+
 function renameInRecord(value: unknown, from: string, to: string): Record<string, unknown> | null {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const record = value as Record<string, unknown>;
@@ -157,6 +193,42 @@ function dropFromRecord(value: unknown, from: string): Record<string, unknown> |
   return next;
 }
 
+function sameStringArray(value: unknown, expected: readonly string[]): boolean {
+  return Array.isArray(value)
+    && value.length === expected.length
+    && value.every((entry, index) => entry === expected[index]);
+}
+
+function targetReasoningMatchesStaleSeed(row: Record<string, unknown>, rename: ModelRename): boolean {
+  const reasoning = rename.targetSeedRefresh?.reasoning;
+  const efforts = row.modelReasoningEfforts as Record<string, unknown> | undefined;
+  return !!reasoning && !!efforts && sameStringArray(efforts[rename.to], reasoning.fromEfforts);
+}
+
+/** Refresh only exact defaults emitted by the previous registry; preserve user overrides. */
+function refreshTargetSeed(row: Record<string, unknown>, rename: ModelRename): boolean {
+  const refresh = rename.targetSeedRefresh;
+  if (!refresh) return false;
+  let changed = false;
+
+  const windows = row.modelContextWindows as Record<string, unknown> | undefined;
+  if (windows && refresh.contextWindow && windows[rename.to] === refresh.contextWindow.from) {
+    windows[rename.to] = refresh.contextWindow.to;
+    changed = true;
+  }
+
+  const reasoning = refresh.reasoning;
+  const efforts = row.modelReasoningEfforts as Record<string, unknown> | undefined;
+  if (!reasoning || !efforts || !sameStringArray(efforts[rename.to], reasoning.fromEfforts)) return changed;
+  efforts[rename.to] = [...reasoning.toEfforts];
+
+  const defaults = (row.modelDefaultReasoningEfforts ??= {}) as Record<string, unknown>;
+  if (!(rename.to in defaults)) defaults[rename.to] = reasoning.defaultEffort;
+  const maps = (row.modelReasoningEffortMap ??= {}) as Record<string, unknown>;
+  if (!(rename.to in maps)) maps[rename.to] = { ...reasoning.effortMap };
+  return true;
+}
+
 /**
  * `provider/model` rows in the top-level `disabledModels` list.
  *
@@ -194,6 +266,54 @@ function registrySeedsTarget(rename: ModelRename): boolean {
   return !!entry?.models?.includes(rename.to);
 }
 
+/** The row the registry contributes to a saved config, or `undefined` when it dropped the id. */
+function registrySeed(provider: string): Record<string, unknown> | undefined {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === provider);
+  return entry ? (providerConfigSeed(entry) as unknown as Record<string, unknown>) : undefined;
+}
+
+/** Whether a saved list or model-keyed record names this id at all. */
+function publishes(container: unknown, id: string): boolean {
+  if (Array.isArray(container)) return container.includes(id);
+  if (!container || typeof container !== "object") return false;
+  return id in (container as Record<string, unknown>);
+}
+
+/**
+ * Whether this field’s retired entry is registry residue rather than something to repair.
+ *
+ * Two things have to be true. The registry’s own seed — `providerConfigSeed`, the row both the
+ * OAuth preset (`deriveOAuthProviderConfig`) and `enrichProviderFromRegistry` contribute — must
+ * still publish the retired id in this field, so the entry arrives in the config on its own. And
+ * the saved field must already carry the supported id, so the rename would only DELETE a key,
+ * with nothing to carry forward.
+ *
+ * Under those two conditions the rewrite is worse than a no-op, because it never converges.
+ * `startServer` runs this migration and then `reconcileOAuthProviders`, and
+ * `applyOAuthPresetCatalog` copies the preset’s record over the saved one whenever the two
+ * differ. The deletion is undone inside the same boot, the config is written twice, and the user
+ * is told about a rename that never sticks on every single start. Issue #5066 is exactly that:
+ * `ANTIGRAVITY_MODEL_CONTEXT_WINDOWS` derives a window for every compatibility alias, so
+ * `modelContextWindows` holds a key for all nine retired Flash ids beside the live ones — the
+ * nine `[model-rename-migration]` lines the reporter saw at every `ocx start`, none of which
+ * required them to have selected any of those nine models.
+ *
+ * Those registry entries are deliberate and stay: a request that still names `gemini-3.6-flash`
+ * routes to 3.7 and needs a context window under the id it asked for. The second condition is
+ * what keeps this narrow. A row that saved `{ "gemini-3.6-flash": 1048576 }` and nothing else
+ * still gets the value carried onto the supported id, because dropping it there would blank the
+ * record instead of moving it (`tests/adapters/google/gemini-37-flash-migration.test.ts`).
+ */
+function isRegistryResidue(
+  seed: Record<string, unknown> | undefined,
+  field: string,
+  saved: unknown,
+  rename: ModelRename,
+): boolean {
+  if (!seed) return false;
+  return publishes(seed[field], rename.from) && publishes(saved, rename.to);
+}
+
 export interface ModelRenameProjection {
   config: OcxConfig;
   changed: boolean;
@@ -226,14 +346,24 @@ export function projectModelRenames(
     // Provider config is a closed interface, so index through one unknown-cast
     // view rather than casting at each assignment.
     const row = prov as unknown as Record<string, unknown>;
+    const seed = registrySeed(rename.provider);
     let touched = false;
     for (const field of MODEL_ID_LISTS) {
-      const next = renameInList(row[field], rename.from, rename.to);
+      if (isRegistryResidue(seed, field, row[field], rename)) continue;
+      const next = rename.dropNoReasoningModels && field === "noReasoningModels"
+        ? dropRenamedIdsFromList(
+          row[field],
+          rename.from,
+          rename.to,
+          targetReasoningMatchesStaleSeed(row, rename),
+        )
+        : renameInList(row[field], rename.from, rename.to);
       if (!next) continue;
       row[field] = next;
       touched = true;
     }
     for (const field of MODEL_KEYED_RECORDS) {
+      if (isRegistryResidue(seed, field, row[field], rename)) continue;
       const next = rename.dropReasoningEffortMap && field === "modelReasoningEffortMap"
         ? dropFromRecord(row[field], rename.from)
         : renameInRecord(row[field], rename.from, rename.to);
@@ -241,11 +371,22 @@ export function projectModelRenames(
       row[field] = next;
       touched = true;
     }
-    if (prov.defaultModel === rename.from) {
-      prov.defaultModel = rename.to;
+    for (const field of MODEL_NESTED_RECORDS) {
+      const container = row[field];
+      if (!container || typeof container !== "object" || Array.isArray(container)) continue;
+      const nested = container as Record<string, unknown>;
+      const next = renameInRecord(nested.models, rename.from, rename.to);
+      if (!next) continue;
+      row[field] = { ...nested, models: next };
+      touched = true;
+    }
+    for (const field of MODEL_ID_SCALARS) {
+      if (row[field] !== rename.from) continue;
+      row[field] = rename.to;
       touched = true;
     }
     if (renameDisabledModels(config, rename)) touched = true;
+    if (touched && refreshTargetSeed(row, rename)) touched = true;
 
     if (touched) {
       changed = true;

package/src/providers/model-rename-startup.ts

@@ -1,12 +1,13 @@
 import { mutatePersistedConfig } from "../config";
 import { projectModelRenames } from "./model-rename-migration";
 import { projectStaleContextWindows } from "./stale-context-window-migration";
+import { projectStaleVisionClassifications } from "./stale-vision-classification-migration";
 import { projectDevinCliAuthMode } from "./devin-cli-authmode-migration";
 import type { OcxConfig } from "../types";
 
 /**
- * The startup projection: registry model renames, then the context-window
- * repair. Both fix a saved row the registry can no longer reach on its own —
+ * The startup projection: registry model renames, then the context-window and
+ * vision-classification repairs. All three fix a saved row the registry can no longer reach on its own —
  * `enrichProviderFromRegistry` backfills a missing field and never rewrites a
  * present one — so they share this pass rather than adding a second boot step
  * with its own persistence, adopt, and failure handling.
@@ -14,11 +15,12 @@ import type { OcxConfig } from "../types";
 export function projectStartupConfigRepairs(config: OcxConfig): ReturnType<typeof projectModelRenames> {
   const renames = projectModelRenames(config);
   const windows = projectStaleContextWindows(renames.config);
-  const devinCli = projectDevinCliAuthMode(windows.config);
+  const vision = projectStaleVisionClassifications(windows.config);
+  const devinCli = projectDevinCliAuthMode(vision.config);
   return {
     config: devinCli.config,
-    changed: renames.changed || windows.changed || devinCli.changed,
-    warnings: [...renames.warnings, ...windows.warnings, ...devinCli.warnings],
+    changed: renames.changed || windows.changed || vision.changed || devinCli.changed,
+    warnings: [...renames.warnings, ...windows.warnings, ...vision.warnings, ...devinCli.warnings],
   };
 }
 

package/src/providers/openai-virtual-models.ts

@@ -3,6 +3,9 @@ import { OPENAI_API_PROVIDER_ID } from "./openai-tiers";
 import type { OcxParsedRequest } from "../types";
 import type { RouteResult } from "../router";
 import type { RequestLogContext } from "../server/request-log";
+import type { InboundWire } from "./registry/types";
+import { providerMatchesRegistryTransportWithStaticGuards } from "./static-model-discovery";
+import { resolveModelPolicy } from "./resolved-model-policy";
 
 export interface OpenAiVirtualModelResolution {
   selectedModelId: string;
@@ -49,18 +52,55 @@ export function resolveOpenAiVirtualModel(
   return validateOpenAiVirtualModelDefinition(selectedModelId, definition);
 }
 
+export function captureOpenAiVirtualWirePolicy(
+  route: RouteResult,
+  resolution: OpenAiVirtualModelResolution,
+  inboundWire: InboundWire = "responses",
+): void {
+  // applyOpenAiVirtualModel is also a public mutation helper with older focused callers that
+  // construct only providerName/modelId/provider. Production RouteResult builders always capture
+  // staticPolicy; a legacy partial shape has no authority to recapture and keeps the old rewrite.
+  if (!route.staticPolicy) return;
+  const entry = PROVIDER_REGISTRY.find(candidate => candidate.id === route.providerName);
+  route.staticPolicy = resolveModelPolicy({
+    providerName: route.providerName,
+    modelId: resolution.wireModelId,
+    provider: route.provider,
+    registryEntry: entry,
+    transportMatchedRegistry: !!entry
+      && providerMatchesRegistryTransportWithStaticGuards(route.providerName, route.provider),
+    inboundWire,
+    modelCapabilities: route.provider.modelCapabilities?.[resolution.wireModelId],
+    ...(route.provider.authMode ? { effectiveAuth: { authMode: route.provider.authMode } } : {}),
+    ...(route.staticPolicy?.effectiveAlias !== undefined
+      ? { effectiveAlias: route.staticPolicy.effectiveAlias }
+      : {}),
+  });
+}
+
 export function applyOpenAiVirtualModel(
   parsed: OcxParsedRequest,
   route: RouteResult,
   logCtx: RequestLogContext,
+  inboundWire: InboundWire = "responses",
 ): OpenAiVirtualModelResolution | undefined {
-  const selectedModelId = logCtx.model && logCtx.model !== route.modelId ? logCtx.model : route.modelId;
-  const resolution = resolveOpenAiVirtualModel(route.providerName, selectedModelId);
+  // Routing has already removed the provider namespace and resolved model aliases. Never use
+  // logCtx.model for identity: it is reporting state and can still contain a namespaced selector.
+  const resolution = resolveOpenAiVirtualModel(route.providerName, route.modelId)
+    ?? (() => {
+      // Preserve the public helper's idempotent second-call contract from its own mutation
+      // provenance, without promoting reporting state back into routing authority.
+      const selected = parsed._openAiVirtualSelectedModelId;
+      if (typeof selected !== "string") return undefined;
+      const remembered = resolveOpenAiVirtualModel(route.providerName, selected);
+      return remembered?.wireModelId === route.modelId ? remembered : undefined;
+    })();
   if (!resolution) return undefined;
 
   logCtx.model = resolution.selectedModelId;
   logCtx.resolvedModel = resolution.wireModelId;
   route.modelId = resolution.wireModelId;
+  captureOpenAiVirtualWirePolicy(route, resolution, inboundWire);
   parsed.modelId = resolution.wireModelId;
   parsed._openAiVirtualSelectedModelId = resolution.selectedModelId;
 

package/src/providers/quota/antigravity.ts

@@ -1,6 +1,6 @@
 import { antigravityUserAgent } from "../../adapters/client-fingerprint";
 import { DestinationDnsResolutionError } from "../../lib/destination-policy";
-import { PinnedHttpError } from "../../lib/pinned-http";
+import { PinnedHttpError, type PinnedHttpErrorCode } from "../../lib/pinned-http";
 import { ProviderOutboundPolicyError, providerOutboundPost, providerRedirectError, type ProviderOutboundDependencies } from "../../lib/provider-outbound";
 import { getValidAccessToken } from "../../oauth";
 import { getAccountCredential, getCredential } from "../../oauth/store";
@@ -193,10 +193,30 @@ type AntigravityQuotaProbeResult =
   | { kind: "available"; quota: ProviderQuota; source: "google-antigravity:retrieveUserQuotaSummary" | "google-antigravity:fetchAvailableModels" }
   | { kind: "unavailable"; failure: QuotaFailureCode; legacy: { kind: "null" } | { kind: "throw"; error: unknown } };
 
+/**
+ * Every pinned-transport failure code, classified once.
+ *
+ * A conditional that named one code and sent the rest to `timeout` was correct only for as long
+ * as the union held exactly the codes it was written against. When the transport learned to
+ * report a coding it cannot undo, that answer was reported as a timeout, which is a different
+ * operational story entirely. A total map makes a new code a compile error here rather than a
+ * quiet misdiagnosis.
+ */
+const PINNED_QUOTA_FAILURES = {
+  connect_timeout: "timeout",
+  first_byte_timeout: "timeout",
+  inactivity_timeout: "timeout",
+  // The response arrived and cannot be used: too large, coded in a format this transport cannot
+  // undo, or coded bytes that did not decode. None of these is a timing failure.
+  output_byte_limit: "response_unusable",
+  unsupported_content_encoding: "response_unusable",
+  content_decode_failed: "response_unusable",
+} satisfies Record<PinnedHttpErrorCode, QuotaFailureCode>;
+
 function quotaTransportFailure(error: unknown): QuotaFailureCode {
   if (error instanceof ProviderOutboundPolicyError) return "destination_blocked";
   if (error instanceof DestinationDnsResolutionError) return "dns_failed";
-  if (error instanceof PinnedHttpError) return error.code === "output_byte_limit" ? "response_unusable" : "timeout";
+  if (error instanceof PinnedHttpError) return PINNED_QUOTA_FAILURES[error.code];
   if (error instanceof DOMException && error.name === "TimeoutError") return "timeout";
   return "transport_error";
 }

package/src/providers/quota/vendor-probes-key.ts

@@ -1,6 +1,8 @@
 import { resolveProviderApiKey } from "../key-store";
 import { getProviderRegistryEntry, registryEntryForProviderDestination } from "../registry";
 import { isCanonicalOllamaCloudUrl } from "../../adapters/ollama-native-url";
+import { providerEgressFetchInit, resolveProviderEgress } from "../../lib/provider-egress";
+import { configuredOutboundFetch } from "../../lib/proxy-env";
 import { QUOTA_JSON_READ_FAILURE, asRecord, normalizePercent, normalizeResetAt, readQuotaJson, REQUEST_TIMEOUT_MS, toFiniteNumber } from "../quota-wire";
 import {
   AUTHORITATIVE_EMPTY_QUOTA,
@@ -15,6 +17,12 @@ import { getTokenForAccountQuotaProbe } from "./account-cache";
 import type { AccountQuotaMode, ProviderQuota, ProviderQuotaCreditsUsd } from "../quota-types";
 import type { OcxProviderConfig } from "../../types";
 
+// A quota probe must use the provider's inference route so it neither reports a false healthy path nor leaks a key through another exit.
+async function quotaFetch(providerName: string, config: OcxProviderConfig, url: string, init: RequestInit): Promise<Response> {
+  const egress = resolveProviderEgress({ providerName, provider: config, url });
+  return configuredOutboundFetch(url, { ...init, ...providerEgressFetchInit(egress) });
+}
+
 const KIMI_CODE_BASE_URL = "https://api.kimi.com/coding/v1";
 const KIMI_CODE_USAGE_URL = `${KIMI_CODE_BASE_URL}/usages`;
 const COMMAND_CODE_BASE_URL = "https://api.commandcode.ai";
@@ -144,10 +152,10 @@ async function fetchA6apiQuota(provider: string, config: OcxProviderConfig): Pro
   if (!apiKey) return null;
   const headers = { Accept: "application/json", Authorization: `Bearer ${apiKey}` } as const;
   const [subscriptionResponse, tokenResponse] = await Promise.all([
-    fetch(`${A6API_BASE_URL}/dashboard/billing/subscription`, {
+    quotaFetch(provider, config, `${A6API_BASE_URL}/dashboard/billing/subscription`, {
       headers, redirect: "error", signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     }),
-    fetch(`${A6API_BASE_URL}/api/usage/token/`, {
+    quotaFetch(provider, config, `${A6API_BASE_URL}/api/usage/token/`, {
       headers, redirect: "error", signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     }),
   ]);
@@ -241,7 +249,7 @@ async function fetchOpenCodeGoQuota(provider: string, config: OcxProviderConfig)
   if (!isCanonicalOpenCodeGoBaseUrl(config.baseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await fetch(OPENCODE_GO_USAGE_URL, {
+  const response = await quotaFetch(provider, config, OPENCODE_GO_USAGE_URL, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -287,7 +295,7 @@ async function fetchOpenRouterQuota(provider: string, config: OcxProviderConfig)
   if (!isCanonicalOpenRouterBaseUrl(config.baseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await fetch(`${OPENROUTER_BASE_URL}/key`, {
+  const response = await quotaFetch(provider, config, `${OPENROUTER_BASE_URL}/key`, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -337,7 +345,7 @@ async function fetchDeepSeekQuota(provider: string, config: OcxProviderConfig):
   if (!isCanonicalDeepSeekBaseUrl(config.baseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await fetch(`${DEEPSEEK_BASE_URL}/user/balance`, {
+  const response = await quotaFetch(provider, config, `${DEEPSEEK_BASE_URL}/user/balance`, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -382,7 +390,7 @@ async function fetchClineQuota(provider: string, config: OcxProviderConfig): Pro
   if (!isCanonicalClineBaseUrl(config.baseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await fetch(`${CLINE_BASE_URL}/api/v1/users/me/plan/usage-limits`, {
+  const response = await quotaFetch(provider, config, `${CLINE_BASE_URL}/api/v1/users/me/plan/usage-limits`, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -480,7 +488,7 @@ async function fetchOllamaCloudQuota(provider: string, config: OcxProviderConfig
   if (!isCanonicalOllamaCloudBaseUrl(effectiveBaseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await fetch(OLLAMA_CLOUD_USAGE_URL, {
+  const response = await quotaFetch(provider, config, OLLAMA_CLOUD_USAGE_URL, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -604,7 +612,7 @@ async function fetchZaiQuota(provider: string, config: OcxProviderConfig): Promi
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
   const authorization = monitorHost === ZAI_CN_BASE_URL ? apiKey : `Bearer ${apiKey}`;
-  const response = await fetch(`${monitorHost}/api/monitor/usage/quota/limit`, {
+  const response = await quotaFetch(provider, config, `${monitorHost}/api/monitor/usage/quota/limit`, {
     headers: { Accept: "application/json", Authorization: authorization },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -652,7 +660,7 @@ async function fetchMinimaxQuota(provider: string, config: OcxProviderConfig): P
   if (!apiKey) return null;
   const cnHost = normalizedBaseUrl(config.baseUrl)?.startsWith("https://api.minimaxi.com");
   const remainsUrl = cnHost ? "https://api.minimaxi.com/v1/token_plan/remains" : MINIMAX_REMAINS_URL;
-  const response = await fetch(remainsUrl, {
+  const response = await quotaFetch(provider, config, remainsUrl, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -695,7 +703,7 @@ async function fetchMoonshotQuota(provider: string, config: OcxProviderConfig):
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
   const host = normalizedBaseUrl(config.baseUrl)?.startsWith("https://api.moonshot.cn") ? "https://api.moonshot.cn/v1" : MOONSHOT_BASE_URL;
-  const response = await fetch(`${host}/users/me/balance`, {
+  const response = await quotaFetch(provider, config, `${host}/users/me/balance`, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -738,7 +746,7 @@ async function fetchVeniceQuota(provider: string, config: OcxProviderConfig): Pr
   if (!isCanonicalVeniceBaseUrl(config.baseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await fetch(`${VENICE_BASE_URL}/billing/balance`, {
+  const response = await quotaFetch(provider, config, `${VENICE_BASE_URL}/billing/balance`, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -781,7 +789,7 @@ async function fetchSyntheticQuota(provider: string, config: OcxProviderConfig):
   if (!isCanonicalSyntheticBaseUrl(config.baseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await fetch(`${SYNTHETIC_BASE_URL}/quotas`, {
+  const response = await quotaFetch(provider, config, `${SYNTHETIC_BASE_URL}/quotas`, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -831,7 +839,7 @@ async function fetchDeepInfraQuota(provider: string, config: OcxProviderConfig):
   if (!isCanonicalDeepInfraBaseUrl(config.baseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await fetch(`${DEEPINFRA_BASE_URL}/payment/checklist?compute_owed=true`, {
+  const response = await quotaFetch(provider, config, `${DEEPINFRA_BASE_URL}/payment/checklist?compute_owed=true`, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -873,7 +881,7 @@ async function fetchNeuralwattQuota(provider: string, config: OcxProviderConfig)
   if (!isCanonicalNeuralwattBaseUrl(config.baseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await fetch(`${NEURALWATT_BASE_URL}/quota`, {
+  const response = await quotaFetch(provider, config, `${NEURALWATT_BASE_URL}/quota`, {
     headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -915,7 +923,7 @@ async function fetchNeuralwattQuota(provider: string, config: OcxProviderConfig)
 }
 
 
-function normalizedBaseUrl(value: string): string | null {
+export function normalizedBaseUrl(value: string): string | null {
   try {
     const url = new URL(value);
     if (url.username || url.password || url.search || url.hash) return null;
@@ -1050,7 +1058,7 @@ export async function fetchKimiQuota(provider: string, config: OcxProviderConfig
   // Never release credentials to a user-edited or lookalike provider host.
   if (!isCanonicalKimiCodeBaseUrl(config.baseUrl)) return null;
   if (!accessToken) return null;
-  const response = await fetch(KIMI_CODE_USAGE_URL, {
+  const response = await quotaFetch(provider, config, KIMI_CODE_USAGE_URL, {
     headers: { Accept: "application/json", Authorization: `Bearer ${accessToken}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -1077,9 +1085,14 @@ function parseCommandCodeWindow(value: unknown): { percent: number; resetAt?: nu
 }
 
 /** Soft-fail GET returning a parsed record, or null when unavailable. */
-async function fetchCommandCodeJson(url: string, bearer: string): Promise<Record<string, unknown> | null> {
+async function fetchCommandCodeJson(
+  provider: string,
+  config: OcxProviderConfig,
+  url: string,
+  bearer: string,
+): Promise<Record<string, unknown> | null> {
   try {
-    const response = await fetch(url, {
+    const response = await quotaFetch(provider, config, url, {
       headers: { Accept: "application/json", Authorization: `Bearer ${bearer}` },
       redirect: "error",
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -1097,12 +1110,14 @@ async function fetchCommandCodeJson(url: string, bearer: string): Promise<Record
  * pools' billing cycle, and `currentPeriodEnd` becomes expiresAt.
  */
 async function fetchCommandCodeSpend(
+  provider: string,
+  config: OcxProviderConfig,
   bearer: string,
   credits: Record<string, unknown> | null,
   orgQuery: string,
 ): Promise<ProviderQuotaCreditsUsd | undefined> {
   if (!credits) return undefined;
-  const subscriptionBody = await fetchCommandCodeJson(`${COMMAND_CODE_SUBSCRIPTIONS_URL}${orgQuery}`, bearer);
+  const subscriptionBody = await fetchCommandCodeJson(provider, config, `${COMMAND_CODE_SUBSCRIPTIONS_URL}${orgQuery}`, bearer);
   const subscription = asRecord(subscriptionBody?.data) ?? subscriptionBody;
   const periodStart = typeof subscription?.currentPeriodStart === "string" ? subscription.currentPeriodStart.trim() : "";
   // Unscoped /usage/summary is lifetime spend; mixing it with current-cycle
@@ -1110,7 +1125,7 @@ async function fetchCommandCodeSpend(
   if (!periodStart) return undefined;
   const sinceQuery = `${orgQuery ? "&" : "?"}since=${encodeURIComponent(periodStart)}`;
   const expiresAt = normalizeResetAt(subscription?.currentPeriodEnd);
-  const summaryBody = await fetchCommandCodeJson(`${COMMAND_CODE_USAGE_URL}${orgQuery}${sinceQuery}`, bearer);
+  const summaryBody = await fetchCommandCodeJson(provider, config, `${COMMAND_CODE_USAGE_URL}${orgQuery}${sinceQuery}`, bearer);
   const summary = asRecord(summaryBody?.data) ?? summaryBody;
   const used = toFiniteNumber(summary?.totalCost) ?? toFiniteNumber(summary?.totalMonthlyCredits);
   if (used === undefined || used < 0) return undefined;
@@ -1161,12 +1176,12 @@ export async function fetchCommandCodeQuota(provider: string, config: OcxProvide
   // Never release credentials to a user-edited or lookalike provider host.
   if (!isCanonicalCommandCodeBaseUrl(config.baseUrl)) return null;
   if (!bearer) return null;
-  const whoamiBody = await fetchCommandCodeJson(COMMAND_CODE_WHOAMI_URL, bearer);
+  const whoamiBody = await fetchCommandCodeJson(provider, config, COMMAND_CODE_WHOAMI_URL, bearer);
   const whoami = asRecord(whoamiBody?.data) ?? whoamiBody;
   const org = asRecord(whoami?.org);
   const orgId = typeof org?.id === "string" && org.id.trim() ? org.id.trim() : null;
   const orgQuery = orgId ? `?orgId=${encodeURIComponent(orgId)}` : "";
-  const response = await fetch(`${COMMAND_CODE_CREDITS_URL}${orgQuery}`, {
+  const response = await quotaFetch(provider, config, `${COMMAND_CODE_CREDITS_URL}${orgQuery}`, {
     headers: { Accept: "application/json", Authorization: `Bearer ${bearer}` },
     redirect: "error",
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -1183,7 +1198,7 @@ export async function fetchCommandCodeQuota(provider: string, config: OcxProvide
   if (!credits && !limits) return null;
   const fiveHour = parseCommandCodeWindow(limits?.fiveHour);
   const weekly = parseCommandCodeWindow(limits?.weekly);
-  const creditsUsd = await fetchCommandCodeSpend(bearer, credits, orgQuery);
+  const creditsUsd = await fetchCommandCodeSpend(provider, config, bearer, credits, orgQuery);
   const quota: ProviderQuota = {
     ...(fiveHour ? {
       fiveHourPercent: fiveHour.percent,