@yansigit/opencodex 2.36.1-dev.20260829.47 → 2.36.1-dev.20260829.48

package/src/generated/compatibility-version.json

@@ -10,7 +10,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "f144c82b1b83fe866cfa13a56819ec264953f5e228c08bf2df632f903a4be07d"
+      "sha256": "c223c9a248049f4e19e7dee2837311746d85ba6e2b79498d6b1a3b07a2201c03"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -526,7 +526,7 @@
     },
     {
       "path": "src/cli/config-command.ts",
-      "sha256": "fa4b09ccb9a24384520818d11510f0400679597ee2936bc180a2555c329689bc"
+      "sha256": "1fbca0cbbdfbdab499c354f4e76d063b709ee7da99ad2334061bea580506a04c"
     },
     {
       "path": "src/cli/debug.ts",
@@ -558,7 +558,7 @@
     },
     {
       "path": "src/cli/init.ts",
-      "sha256": "9eeb5b5916c35f5c3994b6ef3dd6e230b30c05605c7d463ff0a604635639cef2"
+      "sha256": "ced149008c298c1167f8e710055ec5a293522e81dcc9e3bba2c8049dd32d3ec5"
     },
     {
       "path": "src/cli/integrations.ts",
@@ -606,7 +606,7 @@
     },
     {
       "path": "src/cli/provider.ts",
-      "sha256": "8cb7c9364cdb40989af7ee267c87c5b3e04e6557cbad91c428074cd4a461bb5e"
+      "sha256": "51f3110937eb259c93e5e04d4a1cdb07b0d546be8c8adcc9c1a410f728265d2c"
     },
     {
       "path": "src/cli/ready.ts",
@@ -826,7 +826,7 @@
     },
     {
       "path": "src/codex/convergence.ts",
-      "sha256": "dfb4a900ca40eb4e112f5fd1b9ed73058301b0c6533a7a6d210b80aeef62c3ab"
+      "sha256": "f6ae4b0bdacfc59e9227d8bf3b5f118d9264abb1ec8224c8dc1203bcfacadf8e"
     },
     {
       "path": "src/codex/coordinator-doctor.ts",
@@ -1170,7 +1170,7 @@
     },
     {
       "path": "src/config.ts",
-      "sha256": "f5fb76e03c8e27883d2522cf78daf7ef4643e36625e126683d470f4f7616d3f8"
+      "sha256": "ab945b93888473c8165ca9cfe43b5ddca53c01d6de26b5c76b89903471aa7e24"
     },
     {
       "path": "src/config/atomic-write.ts",
@@ -2178,7 +2178,7 @@
     },
     {
       "path": "src/oauth/index.ts",
-      "sha256": "d2891b2d232f7c4821e6a83860f335a6179e82b7f4f58d840bd2be8e5e8ba701"
+      "sha256": "608e24a1883561d5638e21aa0cc66530c512e37afbf2917c9510c5ee19fac6b3"
     },
     {
       "path": "src/oauth/key-providers.ts",
@@ -2206,7 +2206,7 @@
     },
     {
       "path": "src/oauth/login-cli.ts",
-      "sha256": "7d98c1b8e45a36d367e7019733c8975f7fe562db2fb71f40798aa04c59f6bec0"
+      "sha256": "331024c25a8e2df86879dfa465b905bc35c5157b21f1da711c82618cb9f5e4c5"
     },
     {
       "path": "src/oauth/nous.ts",
@@ -2246,7 +2246,7 @@
     },
     {
       "path": "src/providers/alibaba-region-startup.ts",
-      "sha256": "310b2a0575bdaea6bd7fb5d5ac8dba1228f8e383e258755b7e93c72f7ef01ec1"
+      "sha256": "0915c6e813c955ddefbd610891a4d91e546f904aaf7777514563a66bff0b5cbe"
     },
     {
       "path": "src/providers/antigravity-models.ts",
@@ -2258,7 +2258,7 @@
     },
     {
       "path": "src/providers/api-keys.ts",
-      "sha256": "23d44706556147475ff87a71f409afcd201b656d3c62cb750a4cb6c60df44e80"
+      "sha256": "36e2b59bf5b61ef601426d507c09acd9df09854405c8c4dfda0afb9829709be8"
     },
     {
       "path": "src/providers/auto-compact-budget.ts",
@@ -2310,7 +2310,7 @@
     },
     {
       "path": "src/providers/key-failover.ts",
-      "sha256": "56ad909cc9007b644a737f0283fc4d4ae2819794446fa278187abd7841322904"
+      "sha256": "60bb2974bdda5825ad54974617c688139fceaa1c9d9b0d107fc06f8ba30ccc46"
     },
     {
       "path": "src/providers/kiro-models.ts",
@@ -2338,7 +2338,7 @@
     },
     {
       "path": "src/providers/model-rename-startup.ts",
-      "sha256": "8a143284d736759bf63c8cb296c19e61dec9596dfc781d8dd87038778153f55f"
+      "sha256": "6a98ec00772e7b45c056d7c4161a454cceeaa9780de58ca5e89b674c6cc58ca5"
     },
     {
       "path": "src/providers/new-model-policy.ts",
@@ -2350,7 +2350,7 @@
     },
     {
       "path": "src/providers/openai-tier-startup.ts",
-      "sha256": "41256c1ef4b2271168a52dcfb3ab986077cfa8edc0386230a01f5b196155ca42"
+      "sha256": "cb2631ad03a7727d34e7df97137848514b114790bb94276d71729efe9d605815"
     },
     {
       "path": "src/providers/openai-tiers.ts",
@@ -2686,7 +2686,7 @@
     },
     {
       "path": "src/server/index.ts",
-      "sha256": "e39a7d1b9812bdf91677f27be4b4ef0a486015170f41e69fb3d8c330970f0aba"
+      "sha256": "748a821368960a58228937a15582cb05a087bcc438849d367dc74c05eb5dbf6c"
     },
     {
       "path": "src/server/lifecycle.ts",
@@ -2742,7 +2742,7 @@
     },
     {
       "path": "src/server/management/context.ts",
-      "sha256": "48b53d840a12a08da2e22864d209099bb3832d9571360899f670956ed0e2a5fa"
+      "sha256": "13dfe2bb83ddc157d53b5e5e9340a677d9a80fbf0209f63d8598a8e9da44f269"
     },
     {
       "path": "src/server/management/integration-routes.ts",
@@ -2758,11 +2758,11 @@
     },
     {
       "path": "src/server/management/logs-usage-routes.ts",
-      "sha256": "24f5aec4c42a7ae0460d60acab8242facaa1b8f27d67d96f22ebb439a85955c2"
+      "sha256": "77bd7f6ffef94bea9b11a5c0bdefb30cce9d6c69a4bea0281db7e71ad1a48cbc"
     },
     {
       "path": "src/server/management/model-routes.ts",
-      "sha256": "eaa34ed610ea3651c48d36b47f1b34eaf7ac74b33ccfff1f5852f809d71845f2"
+      "sha256": "5651f71ad65fcc46d74176aa6119393ef074502e1b6c6d29a235c294850cd594"
     },
     {
       "path": "src/server/management/model-rows.ts",
@@ -2774,7 +2774,7 @@
     },
     {
       "path": "src/server/management/oauth-account-routes.ts",
-      "sha256": "2fd9233cd2994161950747fc771e67a5724d1a961ff474fd0cd2e4693638938f"
+      "sha256": "29050746283e3fd553e0de399fda85cbc9b0760e25e0dc3ba8e6fdbc4b33c7f6"
     },
     {
       "path": "src/server/management/provider-capability-config.ts",
@@ -2782,7 +2782,7 @@
     },
     {
       "path": "src/server/management/provider-routes.ts",
-      "sha256": "5e9d3b6985b2e498034a4d06336be2de6a6d77ddab7dc794ed3eb2979bd4ce25"
+      "sha256": "7abf9c86655670bc2de1383577b85e1a4cac5e92447d2a77421820e3126a2d97"
     },
     {
       "path": "src/server/management/replit-provider-routes.ts",
@@ -3080,6 +3080,10 @@
       "path": "src/storage/cleanup.ts",
       "sha256": "2a90e83983c7da9bdb2ac0134870dd7ba85d4469237fae798c60b34985c8e554"
     },
+    {
+      "path": "src/storage/policy-input.ts",
+      "sha256": "94537ac1a988156404ab598c644ed86f2ffac3b286ad73cbf5d84f5ee5b07f35"
+    },
     {
       "path": "src/storage/policy-job.ts",
       "sha256": "4fa9f2297feb1a9404af6173adbf875c19f5e79f4b1aca0056744e83d503ad8a"
@@ -3094,7 +3098,7 @@
     },
     {
       "path": "src/storage/policy.ts",
-      "sha256": "93050c0be848f0df9c7114d903272738fb817b62fb0cdd9d7a59e55b9b267601"
+      "sha256": "aaefd080cf74c38596134ac4a62ef16128c090b38e9bf13eaf749fbd82862204"
     },
     {
       "path": "src/storage/restore-job.ts",

package/src/oauth/index.ts

@@ -1,7 +1,7 @@
 import type { KiroOAuthMetadata, OAuthController, OAuthCredentials } from "./types";
 import { parseCallbackInput } from "./callback-server";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
-import { loadConfig, resolveEnvValue, saveConfig } from "../config";
+import { initializePersistedConfigIfMissing, loadConfig, mutatePersistedConfig, resolveEnvValue } from "../config";
 import { maskEmail } from "../lib/privacy";
 import { KiroTokenRefreshError, environmentKiroRoutingMetadata, loginKiro, refreshKiroToken, settleKiroLoginTransaction } from "./kiro";
 import { getAccountCredential, getAccountSet, removeAccount, saveAccountCredential, saveCredential, setActiveAccount, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, markOAuthRefreshIntentStaleOwner, clearOAuthRefreshIntent, normalizeAuthStoreBuffer, OAuthMutationBusyError } from "./store";
@@ -1023,42 +1023,107 @@ function migrateLegacyAntigravityStaticCatalog(config: OcxConfig): boolean {
   return true;
 }
 
-export function reconcileOAuthProviders(config: OcxConfig): boolean {
-  let changed = migrateLegacyAntigravityStaticCatalog(config);
-  for (const [name, prov] of Object.entries(config.providers)) {
+interface OAuthReconcileProjection {
+  config: OcxConfig;
+  changed: boolean;
+  touchedProviders: string[];
+  touchedAntigravityVersion: boolean;
+}
+
+function projectOAuthProviderReconciliation(config: OcxConfig): OAuthReconcileProjection {
+  const projected = structuredClone(config);
+  const touchedProviders = new Set<string>();
+  const beforeAntigravity = JSON.stringify(projected.providers[GOOGLE_ANTIGRAVITY_PROVIDER]);
+  const beforeAntigravityVersion = projected.googleAntigravityStaticCatalogVersion;
+  let changed = migrateLegacyAntigravityStaticCatalog(projected);
+  if (JSON.stringify(projected.providers[GOOGLE_ANTIGRAVITY_PROVIDER]) !== beforeAntigravity) {
+    touchedProviders.add(GOOGLE_ANTIGRAVITY_PROVIDER);
+  }
+  const touchedAntigravityVersion = projected.googleAntigravityStaticCatalogVersion !== beforeAntigravityVersion;
+
+  for (const [name, prov] of Object.entries(projected.providers)) {
+    const beforeProvider = JSON.stringify(prov);
     const def = OAUTH_PROVIDERS[name];
     if (name === "command-code" && isLegacyCommandCodeStaticCatalog(prov)) {
       // The former experimental preset was the exact three-model seed above. It was not a user
       // choice to disable discovery, so promote only that shape to the account live catalog.
       prov.liveModels = true;
-      changed = true;
     }
-    if (!def || prov.authMode !== "oauth") continue;
-    const preset = def.providerConfig;
-    for (const field of OAUTH_RECONCILE_FIELDS) {
-      if (JSON.stringify(prov[field]) === JSON.stringify(preset[field])) continue;
-      if (preset[field] !== undefined) {
-        prov[field] = cloneProviderField(preset[field]) as never;
-      } else {
-        delete prov[field];
+    if (def && prov.authMode === "oauth") {
+      const preset = def.providerConfig;
+      for (const field of OAUTH_RECONCILE_FIELDS) {
+        if (JSON.stringify(prov[field]) === JSON.stringify(preset[field])) continue;
+        if (preset[field] !== undefined) {
+          prov[field] = cloneProviderField(preset[field]) as never;
+        } else {
+          delete prov[field];
+        }
+      }
+      if (prov.liveModels === undefined && preset.liveModels !== undefined) {
+        prov.liveModels = preset.liveModels;
+      }
+      // Heal a defaultModel that no longer exists in the refreshed list (e.g. a deprecated snapshot).
+      // Skip providers without a static preset `models` list: for live-discovery providers
+      // (e.g. command-code OAuth) the account-scoped catalog is not enumerable here, so any
+      // persisted defaultModel is a user selection and must not be overwritten by the seed.
+      if (prov.defaultModel && preset.defaultModel && preset.models && preset.models.length > 0 && !(prov.models ?? []).includes(prov.defaultModel)) {
+        prov.defaultModel = preset.defaultModel;
       }
-      changed = true;
     }
-    if (prov.liveModels === undefined && preset.liveModels !== undefined) {
-      prov.liveModels = preset.liveModels;
+    if (JSON.stringify(prov) !== beforeProvider) {
       changed = true;
+      touchedProviders.add(name);
     }
-    // Heal a defaultModel that no longer exists in the refreshed list (e.g. a deprecated snapshot).
-    // Skip providers without a static preset `models` list: for live-discovery providers
-    // (e.g. command-code OAuth) the account-scoped catalog is not enumerable here, so any
-    // persisted defaultModel is a user selection and must not be overwritten by the seed.
-    if (prov.defaultModel && preset.defaultModel && preset.models && preset.models.length > 0 && !(prov.models ?? []).includes(prov.defaultModel)) {
-      prov.defaultModel = preset.defaultModel;
-      changed = true;
+  }
+
+  return {
+    config: projected,
+    changed,
+    touchedProviders: [...touchedProviders],
+    touchedAntigravityVersion,
+  };
+}
+
+function adoptOAuthReconciliation(config: OcxConfig, projection: OAuthReconcileProjection): void {
+  for (const name of projection.touchedProviders) {
+    const provider = projection.config.providers[name];
+    if (provider) config.providers[name] = structuredClone(provider);
+    else delete config.providers[name];
+  }
+  if (projection.touchedAntigravityVersion) {
+    config.googleAntigravityStaticCatalogVersion = projection.config.googleAntigravityStaticCatalogVersion;
+  }
+}
+
+function withOAuthReconciliationTouchedKeys(
+  projection: OAuthReconcileProjection,
+  required: OAuthReconcileProjection,
+): OAuthReconcileProjection {
+  return {
+    ...projection,
+    touchedProviders: [...new Set([...projection.touchedProviders, ...required.touchedProviders])],
+    touchedAntigravityVersion: projection.touchedAntigravityVersion || required.touchedAntigravityVersion,
+  };
+}
+
+export function reconcileOAuthProviders(config: OcxConfig, persist = true): boolean {
+  const projection = projectOAuthProviderReconciliation(config);
+  if (!projection.changed) return false;
+  if (!persist) {
+    adoptOAuthReconciliation(config, projection);
+    return true;
+  }
+  if (persist) {
+    const outcome = mutatePersistedConfig(fresh => {
+      const next = projectOAuthProviderReconciliation(fresh);
+      if (next.changed) adoptOAuthReconciliation(fresh, next);
+      return { changed: next.changed, value: next };
+    });
+    if (outcome.status !== "unavailable") {
+      adoptOAuthReconciliation(config, withOAuthReconciliationTouchedKeys(outcome.value, projection));
     }
   }
-  if (changed) saveConfig(config);
-  return changed;
+  return true;
 }
 
 /** Runtime guards: provider config is intentionally passthrough, so persisted fields may be malformed. */
@@ -1091,24 +1156,19 @@ function preservableApiKeyPool(value: unknown): NonNullable<OcxProviderConfig["a
   return pool.length > 0 ? pool : undefined;
 }
 
-/**
- * Add/refresh an OAuth provider's config entry on a config object (does not persist).
- *
- * Providers whose registry entry sets `allowKeyAuthOverride` (xai, github-copilot) can be
- * billed through a stored API key instead of the OAuth login (router.ts honors
- * `authMode: "key"` for them). A blind preset overwrite here deletes `apiKey`/`apiKeyPool`
- * on every OAuth login, silently destroying the stored key and forcing a re-paste — and it
- * flips billing back to the subscription without the user asking. Carry the key fields over
- * and keep key billing while usable key material remains and the user was not explicitly on
- * oauth. If the final key was removed and only the old key mode remains, let the OAuth
- * preset restore `authMode: "oauth"` so the newly saved OAuth credential can be used.
- *
- * After preservation, `apiKey` always has exactly one matching pool entry (inserting via the
- * same content-derived id as the API-key manager when the active key was missing from the
- * pool). Key mode reflects stored user intent (explicit `"key"` or omitted mode with safe
- * key material) — never whether the login CLI process can resolve an env reference. Env-backed
- * availability is decided at proxy routing time in `router.ts`.
- */
+const OAUTH_LOGIN_OWNED_PROVIDER_FIELDS = [
+  "adapter",
+  "baseUrl",
+  "authMode",
+  "headers",
+  "apiKeyTransport",
+  "responsesPath",
+  "tlsProfile",
+  "googleMode",
+  "keyOptional",
+] as const satisfies readonly (keyof OcxProviderConfig)[];
+
+/** Add/refresh only an OAuth provider's login-owned config fields (does not persist). */
 export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   if (provider === "chatgpt") return;
   const def = OAUTH_PROVIDERS[provider];
@@ -1117,35 +1177,16 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
   if (namespaceCollision) throw new Error(namespaceCollision);
   const existing = config.providers[provider];
-  const next: OcxProviderConfig = { ...def.providerConfig };
-  // `liveModels` is a user-facing provider toggle. Preserve either explicit setting across login;
-  // Antigravity's CCA discovery now uses its real RPC, so legacy `true` remains a valid choice.
-  if (typeof existing?.liveModels === "boolean" && !isLegacyCommandCodeStaticCatalog(existing)) {
-    next.liveModels = existing.liveModels;
-  }
-  // The Command Code protocol-version pin is an operator compatibility control. A re-login,
-  // add-account, or reauth rebuilds the row from the preset, which has no version; carry the
-  // existing pin so authentication changes do not silently revert the documented control.
-  if (existing?.commandCodeVersion !== undefined) {
-    next.commandCodeVersion = existing.commandCodeVersion;
-  }
-  if (existing?.projectContext !== undefined) {
-    next.projectContext = existing.projectContext;
-  }
-  // User-configured price overlays are operator data, not preset state; a
-  // re-login, add-account, or reauth must not silently drop them from the
-  // Logs/Usage estimates.
-  if (existing?.modelCosts !== undefined) {
-    next.modelCosts = existing.modelCosts;
-  }
-  // The per-provider account-failover opt-out is operator intent about SPENDING, and the login
-  // path is exactly where losing it does damage: adding a second account both rebuilds this row
-  // from the preset and creates the 2-account quorum that turns presence-driven rotation on
-  // (#2568d). Dropping the opt-out here would enable the thing the operator switched off, at the
-  // moment they were doing something unrelated.
-  if (existing?.oauthAccountFailover !== undefined) {
-    next.oauthAccountFailover = existing.oauthAccountFailover;
+  const next: OcxProviderConfig = structuredClone(existing ?? def.providerConfig);
+  for (const field of OAUTH_LOGIN_OWNED_PROVIDER_FIELDS) {
+    const value = def.providerConfig[field];
+    if (value === undefined) delete next[field];
+    else next[field] = structuredClone(value) as never;
   }
+  // OAuth-only providers must never retain credentials for a different auth mechanism.
+  delete next.apiKey;
+  delete next.apiKeyPool;
+  delete next.azureCredential;
   if (existing && getProviderRegistryEntry(provider)?.allowKeyAuthOverride === true) {
     // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
     let storedApiKey = sanitizeApiKeyValue(existing.apiKey);
@@ -1160,7 +1201,9 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
       // Keep routing and listProviderApiKeys in sync: never leave a hidden active key that
       // is absent from the pool (listing would fall back to pool[0] as "active").
       if (!pool.some(entry => entry.key === storedApiKey)) {
-        pool.push({ id: apiKeyPoolEntryId(storedApiKey), key: storedApiKey });
+        const id = apiKeyPoolEntryId(storedApiKey);
+        if (pool.some(entry => entry.id === id)) throw new Error("API-key pool ID collision");
+        pool.push({ id, key: storedApiKey });
       }
       next.apiKey = storedApiKey;
       next.apiKeyPool = pool;
@@ -1175,7 +1218,8 @@ interface RunLoginDeps {
   saveCredential?: typeof saveCredential;
   saveAccountCredential?: typeof saveAccountCredential;
   loadConfig?: typeof loadConfig;
-  saveConfig?: typeof saveConfig;
+  mutatePersistedConfig?: typeof mutatePersistedConfig;
+  initializePersistedConfigIfMissing?: typeof initializePersistedConfigIfMissing;
   settleKiroLoginTransaction?: typeof settleKiroLoginTransaction;
   removeAccount?: typeof removeAccount;
   setActiveAccount?: typeof setActiveAccount;
@@ -1210,7 +1254,8 @@ export async function runLogin(
   const def = OAUTH_PROVIDERS[provider];
   if (!def) throw new UnsupportedOAuthProviderError(provider);
   const loadLatestConfig = deps.loadConfig ?? loadConfig;
-  const saveLatestConfig = deps.saveConfig ?? saveConfig;
+  const mutateLatestConfig = deps.mutatePersistedConfig ?? mutatePersistedConfig;
+  const initializeLatestConfig = deps.initializePersistedConfigIfMissing ?? initializePersistedConfigIfMissing;
   if (provider !== "chatgpt") {
     const preflightConfig = loadLatestConfig();
     const namespaceCollision = codexAccountNamespaceProviderCollisionError(
@@ -1265,16 +1310,32 @@ export async function runLogin(
     if (provider !== "chatgpt") {
       // Re-run against post-credential state so same-provider API-key additions, removals,
       // and active-key switches survive. A late namespace claim wins over provider creation.
-      const latestConfig = loadLatestConfig();
-      const lateCollision = codexAccountNamespaceProviderCollisionError(
-        latestConfig.codexAccountNamespaces,
-        provider,
-      );
-      if (lateCollision) {
+      const publish = () => mutateLatestConfig<{ error: string } | { config: OcxConfig }>(fresh => {
+        const lateCollision = codexAccountNamespaceProviderCollisionError(
+          fresh.codexAccountNamespaces,
+          provider,
+        );
+        if (lateCollision) return { changed: false, value: { error: lateCollision } };
+        upsertOAuthProvider(fresh, provider);
+        return { changed: true, value: { config: structuredClone(fresh) } };
+      });
+      let outcome = publish();
+      let published = false;
+      if (outcome.status === "unavailable" && outcome.reason === "missing") {
+        const initial = loadLatestConfig();
+        const lateCollision = codexAccountNamespaceProviderCollisionError(
+          initial.codexAccountNamespaces,
+          provider,
+        );
+        if (lateCollision) throw new OAuthProviderPublicationError();
+        upsertOAuthProvider(initial, provider);
+        const initialized = initializeLatestConfig(initial);
+        published = initialized === "created";
+        if (initialized === "exists") outcome = publish();
+      }
+      if (!published && (outcome.status === "unavailable" || "error" in outcome.value)) {
         throw new OAuthProviderPublicationError();
       }
-      upsertOAuthProvider(latestConfig, provider);
-      saveLatestConfig(latestConfig);
     }
   } catch (error) {
     const errors: unknown[] = [error];

package/src/oauth/login-cli.ts

@@ -1,6 +1,6 @@
 import * as readline from "node:readline";
 import { openUrl } from "../lib/open-url";
-import { loadConfig, saveConfig } from "../config";
+import { initializePersistedConfigIfMissing, loadConfig, mutatePersistedConfig } from "../config";
 import { findLiveProxy } from "../server/proxy-liveness";
 import {
   requestBoundLocalProviderReload,
@@ -11,6 +11,7 @@ import { KEY_LOGIN_PROVIDERS, isKeyLoginProvider, validateApiKey, type KeyLoginP
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { configuredAdminToken } from "../lib/admin-secrets";
 import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
+import { apiKeyPoolEntryId } from "../providers/api-keys";
 
 const LIVE_RELOAD_PROVIDERS = new Set<string>([
   ...listOAuthProviders(),
@@ -121,7 +122,7 @@ async function handleAiStudioLogin(): Promise<void> {
 
   const config = loadConfig();
   if (!config.providers["google-aistudio"]) {
-    config.providers["google-aistudio"] = {
+    await commitKeyLoginProvider(config, "google-aistudio", {
       adapter: "google",
       googleMode: "ai-studio-web",
       baseUrl: "https://alkalimakersuite-pa.clients6.google.com",
@@ -129,8 +130,7 @@ async function handleAiStudioLogin(): Promise<void> {
       liveModels: false,
       defaultModel: "gemini-3.7-flash",
       models: ["gemini-3.7-flash", "gemini-3.1-pro-preview", "gemini-2.5-pro", "gemini-2.5-flash", "gemini-3.5-flash"],
-    };
-    saveConfig(config);
+    });
     console.log("\n   ✓ Configured 'google-aistudio' in ~/.opencodex/config.json");
   }
 
@@ -200,10 +200,28 @@ export function mergeKeyLoginProviderRow(
   provider: OcxProviderConfig,
   existing: OcxProviderConfig | undefined,
 ): OcxProviderConfig {
-  return {
-    ...provider,
-    ...(existing?.modelCosts !== undefined ? { modelCosts: existing.modelCosts } : {}),
-  };
+  if (!existing) return structuredClone(provider);
+  const merged = structuredClone(existing);
+  merged.adapter = provider.adapter;
+  merged.baseUrl = provider.baseUrl;
+  if (provider.authMode !== undefined) merged.authMode = provider.authMode;
+  else delete merged.authMode;
+  delete merged.azureCredential;
+  if (provider.apiKeyTransport !== undefined) merged.apiKeyTransport = provider.apiKeyTransport;
+  if (provider.apiKey) {
+    const pool = merged.apiKeyPool ?? (merged.apiKey
+      ? [{ id: apiKeyPoolEntryId(merged.apiKey), key: merged.apiKey }]
+      : []);
+    const existingKey = pool.find(entry => entry.key === provider.apiKey);
+    if (!existingKey) {
+      const id = apiKeyPoolEntryId(provider.apiKey);
+      if (pool.some(entry => entry.id === id)) throw new Error("API-key pool ID collision");
+      pool.push({ id, key: provider.apiKey, addedAt: Date.now() });
+    }
+    if (pool.length > 0) merged.apiKeyPool = pool;
+    merged.apiKey = provider.apiKey;
+  }
+  return merged;
 }
 
 /**
@@ -219,9 +237,33 @@ export async function commitKeyLoginProvider(
   provider: OcxProviderConfig,
   onLiveReload?: (result: LocalProviderReloadResult | null) => void,
 ): Promise<OcxProviderConfig> {
-  const mergedProvider = mergeKeyLoginProviderRow(provider, config.providers[name]);
-  config.providers[name] = mergedProvider;
-  saveConfig(config);
+  let mergedProvider = mergeKeyLoginProviderRow(provider, config.providers[name]);
+  const mutate = () => mutatePersistedConfig(fresh => {
+    const collision = codexAccountNamespaceProviderCollisionError(fresh.codexAccountNamespaces, name);
+    if (collision) throw new Error(collision);
+    mergedProvider = mergeKeyLoginProviderRow(provider, fresh.providers[name]);
+    fresh.providers[name] = mergedProvider;
+    return { changed: true, value: { config: structuredClone(fresh), provider: structuredClone(mergedProvider) } };
+  });
+  let outcome = mutate();
+  if (outcome.status === "unavailable" && outcome.reason === "missing") {
+    const initial = structuredClone(config);
+    const collision = codexAccountNamespaceProviderCollisionError(initial.codexAccountNamespaces, name);
+    if (collision) throw new Error(collision);
+    mergedProvider = mergeKeyLoginProviderRow(provider, initial.providers[name]);
+    initial.providers[name] = mergedProvider;
+    const initialized = initializePersistedConfigIfMissing(initial);
+    if (initialized === "invalid") throw new Error("config is invalid");
+    outcome = initialized === "created"
+      ? { status: "committed", value: { config: initial, provider: structuredClone(mergedProvider) } }
+      : mutate();
+  }
+  if (outcome.status === "unavailable") throw new Error(outcome.reason === "conflict"
+    ? "config changed while saving provider; retry"
+    : `config is ${outcome.reason}`);
+  for (const key of Object.keys(config)) delete (config as unknown as Record<string, unknown>)[key];
+  Object.assign(config, outcome.value.config);
+  mergedProvider = outcome.value.provider;
   // Evaluate the reload BEFORE the optional call: `onLiveReload?.(await ...)` short-circuits
   // the whole argument list when no callback is supplied, so the reload would never fire for
   // callers that do not care about the outcome.

package/src/providers/alibaba-region-startup.ts

@@ -1,4 +1,4 @@
-import { saveConfig } from "../config";
+import { mutatePersistedConfig } from "../config";
 import { backupConfigBeforeAlibabaRegionMigration } from "./alibaba-region-backup";
 import { projectAlibabaRegionMigration } from "./alibaba-region-migration";
 import type { OcxConfig } from "../types";
@@ -6,7 +6,7 @@ import type { OcxConfig } from "../types";
 export interface AlibabaRegionStartupDeps {
   project: typeof projectAlibabaRegionMigration;
   backup: () => void;
-  save: (config: OcxConfig) => void;
+  save?: (config: OcxConfig) => void;
 }
 
 /**
@@ -22,15 +22,35 @@ export function runAlibabaRegionStartupMigration(
   deps: AlibabaRegionStartupDeps = {
     project: projectAlibabaRegionMigration,
     backup: () => { backupConfigBeforeAlibabaRegionMigration(); },
-    save: saveConfig,
   },
 ): OcxConfig {
-  const projection = deps.project(config);
-  // Warnings are emitted even on a no-op: the collision case IS the warning.
-  for (const warning of projection.warnings) console.warn(`[alibaba-region-migration] ${warning}`);
-  if (!projection.changed) return projection.config;
-  // Strictly before the save: the snapshot must describe the config as it was.
-  deps.backup();
-  deps.save(projection.config);
-  return projection.config;
+  if (deps.save) {
+    const projection = deps.project(config);
+    if (!projection.changed) {
+      for (const warning of projection.warnings) console.warn(`[alibaba-region-migration] ${warning}`);
+      return projection.config;
+    }
+    deps.backup();
+    deps.save(projection.config);
+    for (const warning of projection.warnings) console.warn(`[alibaba-region-migration] ${warning}`);
+    return projection.config;
+  }
+
+  let previousSnapshot: string | undefined;
+  const outcome = mutatePersistedConfig(fresh => {
+    const snapshot = JSON.stringify(fresh);
+    const next = deps.project(fresh);
+    // The callback is repeated after freshness validation. Back up only the
+    // confirmed preimage that is about to be committed.
+    if (next.changed && snapshot === previousSnapshot) deps.backup();
+    previousSnapshot = snapshot;
+    if (next.changed) {
+      for (const key of Object.keys(fresh)) delete (fresh as unknown as Record<string, unknown>)[key];
+      Object.assign(fresh, next.config);
+    }
+    return { changed: next.changed, value: next };
+  });
+  if (outcome.status === "unavailable") return config;
+  for (const warning of outcome.value.warnings) console.warn(`[alibaba-region-migration] ${warning}`);
+  return outcome.value.config;
 }