@yansigit/opencodex 2.36.1-dev.20260829.47 → 2.36.1-dev.20260829.50

package/src/oauth/login-cli.ts

@@ -1,6 +1,6 @@
 import * as readline from "node:readline";
 import { openUrl } from "../lib/open-url";
-import { loadConfig, saveConfig } from "../config";
+import { initializePersistedConfigIfMissing, loadConfig, mutatePersistedConfig } from "../config";
 import { findLiveProxy } from "../server/proxy-liveness";
 import {
   requestBoundLocalProviderReload,
@@ -11,6 +11,7 @@ import { KEY_LOGIN_PROVIDERS, isKeyLoginProvider, validateApiKey, type KeyLoginP
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { configuredAdminToken } from "../lib/admin-secrets";
 import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
+import { apiKeyPoolEntryId } from "../providers/api-keys";
 
 const LIVE_RELOAD_PROVIDERS = new Set<string>([
   ...listOAuthProviders(),
@@ -121,7 +122,7 @@ async function handleAiStudioLogin(): Promise<void> {
 
   const config = loadConfig();
   if (!config.providers["google-aistudio"]) {
-    config.providers["google-aistudio"] = {
+    await commitKeyLoginProvider(config, "google-aistudio", {
       adapter: "google",
       googleMode: "ai-studio-web",
       baseUrl: "https://alkalimakersuite-pa.clients6.google.com",
@@ -129,8 +130,7 @@ async function handleAiStudioLogin(): Promise<void> {
       liveModels: false,
       defaultModel: "gemini-3.7-flash",
       models: ["gemini-3.7-flash", "gemini-3.1-pro-preview", "gemini-2.5-pro", "gemini-2.5-flash", "gemini-3.5-flash"],
-    };
-    saveConfig(config);
+    });
     console.log("\n   ✓ Configured 'google-aistudio' in ~/.opencodex/config.json");
   }
 
@@ -200,10 +200,28 @@ export function mergeKeyLoginProviderRow(
   provider: OcxProviderConfig,
   existing: OcxProviderConfig | undefined,
 ): OcxProviderConfig {
-  return {
-    ...provider,
-    ...(existing?.modelCosts !== undefined ? { modelCosts: existing.modelCosts } : {}),
-  };
+  if (!existing) return structuredClone(provider);
+  const merged = structuredClone(existing);
+  merged.adapter = provider.adapter;
+  merged.baseUrl = provider.baseUrl;
+  if (provider.authMode !== undefined) merged.authMode = provider.authMode;
+  else delete merged.authMode;
+  delete merged.azureCredential;
+  if (provider.apiKeyTransport !== undefined) merged.apiKeyTransport = provider.apiKeyTransport;
+  if (provider.apiKey) {
+    const pool = merged.apiKeyPool ?? (merged.apiKey
+      ? [{ id: apiKeyPoolEntryId(merged.apiKey), key: merged.apiKey }]
+      : []);
+    const existingKey = pool.find(entry => entry.key === provider.apiKey);
+    if (!existingKey) {
+      const id = apiKeyPoolEntryId(provider.apiKey);
+      if (pool.some(entry => entry.id === id)) throw new Error("API-key pool ID collision");
+      pool.push({ id, key: provider.apiKey, addedAt: Date.now() });
+    }
+    if (pool.length > 0) merged.apiKeyPool = pool;
+    merged.apiKey = provider.apiKey;
+  }
+  return merged;
 }
 
 /**
@@ -219,9 +237,33 @@ export async function commitKeyLoginProvider(
   provider: OcxProviderConfig,
   onLiveReload?: (result: LocalProviderReloadResult | null) => void,
 ): Promise<OcxProviderConfig> {
-  const mergedProvider = mergeKeyLoginProviderRow(provider, config.providers[name]);
-  config.providers[name] = mergedProvider;
-  saveConfig(config);
+  let mergedProvider = mergeKeyLoginProviderRow(provider, config.providers[name]);
+  const mutate = () => mutatePersistedConfig(fresh => {
+    const collision = codexAccountNamespaceProviderCollisionError(fresh.codexAccountNamespaces, name);
+    if (collision) throw new Error(collision);
+    mergedProvider = mergeKeyLoginProviderRow(provider, fresh.providers[name]);
+    fresh.providers[name] = mergedProvider;
+    return { changed: true, value: { config: structuredClone(fresh), provider: structuredClone(mergedProvider) } };
+  });
+  let outcome = mutate();
+  if (outcome.status === "unavailable" && outcome.reason === "missing") {
+    const initial = structuredClone(config);
+    const collision = codexAccountNamespaceProviderCollisionError(initial.codexAccountNamespaces, name);
+    if (collision) throw new Error(collision);
+    mergedProvider = mergeKeyLoginProviderRow(provider, initial.providers[name]);
+    initial.providers[name] = mergedProvider;
+    const initialized = initializePersistedConfigIfMissing(initial);
+    if (initialized === "invalid") throw new Error("config is invalid");
+    outcome = initialized === "created"
+      ? { status: "committed", value: { config: initial, provider: structuredClone(mergedProvider) } }
+      : mutate();
+  }
+  if (outcome.status === "unavailable") throw new Error(outcome.reason === "conflict"
+    ? "config changed while saving provider; retry"
+    : `config is ${outcome.reason}`);
+  for (const key of Object.keys(config)) delete (config as unknown as Record<string, unknown>)[key];
+  Object.assign(config, outcome.value.config);
+  mergedProvider = outcome.value.provider;
   // Evaluate the reload BEFORE the optional call: `onLiveReload?.(await ...)` short-circuits
   // the whole argument list when no callback is supplied, so the reload would never fire for
   // callers that do not care about the outcome.

package/src/oauth/store.ts

@@ -591,24 +591,34 @@ export async function upsertCredentialByIdentity(
   }, [provider, safe]);
 }
 
-/** Remove the ACTIVE account; remaining accounts promote the first one. */
-export async function removeCredential(provider: string): Promise<void> {
+/**
+ * Remove the ACTIVE account; remaining accounts promote the first one.
+ *
+ * Returns what actually happened, which a caller cannot otherwise know. A read-then-remove
+ * preflight is not equivalent: `mutateStore` serializes mutations, so between a caller's
+ * `getAccountSet` check and its `removeCredential` call another process can remove the same
+ * account, and both callers would then report a removal that only one of them performed.
+ * Deciding inside the mutation is the only place the answer is true when it is returned.
+ */
+export async function removeCredential(provider: string): Promise<"removed" | "not-found"> {
   let removedAccountId: string | undefined;
-  await mutateStore(store => {
+  const result = await mutateStore(store => {
     const set = store[provider];
-    if (!set) return;
+    if (!set) return "not-found" as const;
     removedAccountId = set.activeAccountId;
     set.accounts = set.accounts.filter(a => a.id !== set.activeAccountId);
     if (set.accounts.length === 0) {
       delete store[provider];
-      return;
+      return "removed" as const;
     }
     set.activeAccountId = set.accounts[0]!.id;
+    return "removed" as const;
   }, [provider]);
-  if (provider === "google-antigravity" && removedAccountId) {
+  if (result === "removed" && provider === "google-antigravity" && removedAccountId) {
     const { clearAntigravityRoutingStateForAccount } = await import("./antigravity-routing");
     clearAntigravityRoutingStateForAccount(removedAccountId);
   }
+  return result;
 }
 
 // ---------------------------------------------------------------------------

package/src/providers/alibaba-region-startup.ts

@@ -1,4 +1,4 @@
-import { saveConfig } from "../config";
+import { mutatePersistedConfig } from "../config";
 import { backupConfigBeforeAlibabaRegionMigration } from "./alibaba-region-backup";
 import { projectAlibabaRegionMigration } from "./alibaba-region-migration";
 import type { OcxConfig } from "../types";
@@ -6,7 +6,7 @@ import type { OcxConfig } from "../types";
 export interface AlibabaRegionStartupDeps {
   project: typeof projectAlibabaRegionMigration;
   backup: () => void;
-  save: (config: OcxConfig) => void;
+  save?: (config: OcxConfig) => void;
 }
 
 /**
@@ -22,15 +22,35 @@ export function runAlibabaRegionStartupMigration(
   deps: AlibabaRegionStartupDeps = {
     project: projectAlibabaRegionMigration,
     backup: () => { backupConfigBeforeAlibabaRegionMigration(); },
-    save: saveConfig,
   },
 ): OcxConfig {
-  const projection = deps.project(config);
-  // Warnings are emitted even on a no-op: the collision case IS the warning.
-  for (const warning of projection.warnings) console.warn(`[alibaba-region-migration] ${warning}`);
-  if (!projection.changed) return projection.config;
-  // Strictly before the save: the snapshot must describe the config as it was.
-  deps.backup();
-  deps.save(projection.config);
-  return projection.config;
+  if (deps.save) {
+    const projection = deps.project(config);
+    if (!projection.changed) {
+      for (const warning of projection.warnings) console.warn(`[alibaba-region-migration] ${warning}`);
+      return projection.config;
+    }
+    deps.backup();
+    deps.save(projection.config);
+    for (const warning of projection.warnings) console.warn(`[alibaba-region-migration] ${warning}`);
+    return projection.config;
+  }
+
+  let previousSnapshot: string | undefined;
+  const outcome = mutatePersistedConfig(fresh => {
+    const snapshot = JSON.stringify(fresh);
+    const next = deps.project(fresh);
+    // The callback is repeated after freshness validation. Back up only the
+    // confirmed preimage that is about to be committed.
+    if (next.changed && snapshot === previousSnapshot) deps.backup();
+    previousSnapshot = snapshot;
+    if (next.changed) {
+      for (const key of Object.keys(fresh)) delete (fresh as unknown as Record<string, unknown>)[key];
+      Object.assign(fresh, next.config);
+    }
+    return { changed: next.changed, value: next };
+  });
+  if (outcome.status === "unavailable") return config;
+  for (const warning of outcome.value.warnings) console.warn(`[alibaba-region-migration] ${warning}`);
+  return outcome.value.config;
 }

package/src/providers/api-keys.ts

@@ -7,7 +7,7 @@
  * A provider with a legacy bare `apiKey` is seeded into a one-entry pool on first touch.
  */
 import { createHash } from "node:crypto";
-import { saveConfigPreservingClaudeCode } from "../config";
+import { mutatePersistedConfig } from "../config";
 import { isAzureIdentityProvider } from "../config/provider-validation";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
@@ -62,6 +62,23 @@ function activeEntryId(provider: OcxProviderConfig): string | null {
   return (pool.find(e => e.key === provider.apiKey) ?? pool[0]!).id;
 }
 
+function mutateProvider<T>(
+  config: OcxConfig,
+  name: string,
+  mutate: (provider: OcxProviderConfig) => T | null,
+): T | null {
+  const outcome = mutatePersistedConfig(fresh => {
+    const provider = fresh.providers[name];
+    if (!provider || !isKeyAuthProvider(provider)) return { changed: false, value: null };
+    const before = JSON.stringify(provider);
+    const value = mutate(provider);
+    return { changed: value !== null && JSON.stringify(provider) !== before, value: value === null ? null : { provider, value } };
+  });
+  if (outcome.status === "unavailable" || outcome.value === null) return null;
+  config.providers[name] = structuredClone(outcome.value.provider);
+  return outcome.value.value;
+}
+
 export function listProviderApiKeys(config: OcxConfig, name: string): { activeId: string | null; keys: ProviderApiKeyInfo[] } {
   const provider = config.providers[name];
   if (!provider || !isKeyAuthProvider(provider)) return { activeId: null, keys: [] };
@@ -86,56 +103,63 @@ export function addProviderApiKey(config: OcxConfig, name: string, key: string,
   if (typeof key !== "string" || !key.trim()) return { error: "key is required" };
   const trimmed = sanitizeApiKeyValue(key);
   if (!trimmed) return { error: "key must not include line breaks" };
-  const pool = ensurePool(provider);
-  const id = apiKeyPoolEntryId(trimmed);
-  const existing = pool.find(e => e.id === id);
-  if (existing) {
-    if (label?.trim()) existing.label = label.trim();
-  } else {
+  const saved = mutateProvider(config, name, fresh => {
+    const pool = ensurePool(fresh);
+    const existing = pool.find(entry => entry.key === trimmed);
+    if (existing) {
+      if (label?.trim()) existing.label = label.trim();
+      fresh.apiKey = trimmed;
+      return { id: existing.id };
+    }
+    const id = apiKeyPoolEntryId(trimmed);
+    if (pool.some(entry => entry.id === id)) return { error: "key id collision" };
     pool.push({ id, key: trimmed, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
-  }
-  provider.apiKey = trimmed;
-  saveConfigPreservingClaudeCode(config);
-  return { id };
+    fresh.apiKey = trimmed;
+    return { id };
+  });
+  return saved === null ? { error: "config is unavailable" } : saved;
 }
 
 /** Switch the ACTIVE key (mirrors into `provider.apiKey`). Persists config. */
 export function setActiveProviderApiKey(config: OcxConfig, name: string, id: string): boolean {
   const provider = config.providers[name];
   if (!provider || !isKeyAuthProvider(provider)) return false;
-  const entry = ensurePool(provider).find(e => e.id === id);
-  if (!entry) return false;
-  provider.apiKey = entry.key;
-  saveConfigPreservingClaudeCode(config);
-  return true;
+  return mutateProvider(config, name, fresh => {
+    const entry = ensurePool(fresh).find(candidate => candidate.id === id);
+    if (!entry) return null;
+    fresh.apiKey = entry.key;
+    return true;
+  }) === true;
 }
 
 /** Rename a key slot without changing its id, secret, or active routing state. */
 export function setProviderApiKeyLabel(config: OcxConfig, name: string, id: string, label: string | undefined): boolean {
   const provider = config.providers[name];
   if (!provider || !isKeyAuthProvider(provider)) return false;
-  const entry = ensurePool(provider).find(e => e.id === id);
-  if (!entry) return false;
-  if (label) entry.label = label;
-  else delete entry.label;
-  saveConfigPreservingClaudeCode(config);
-  return true;
+  return mutateProvider(config, name, fresh => {
+    const entry = ensurePool(fresh).find(candidate => candidate.id === id);
+    if (!entry) return null;
+    if (label) entry.label = label;
+    else delete entry.label;
+    return true;
+  }) === true;
 }
 
 /** Remove one key; removing the active one promotes the first remaining. Persists config. */
 export function removeProviderApiKey(config: OcxConfig, name: string, id: string): boolean {
   const provider = config.providers[name];
   if (!provider || !isKeyAuthProvider(provider)) return false;
-  const pool = ensurePool(provider);
-  const entry = pool.find(e => e.id === id);
-  if (!entry) return false;
-  provider.apiKeyPool = pool.filter(e => e.id !== id);
-  if (provider.apiKey === entry.key) {
-    const next = provider.apiKeyPool[0];
-    if (next) provider.apiKey = next.key;
-    else delete provider.apiKey;
-  }
-  if (provider.apiKeyPool.length === 0) delete provider.apiKeyPool;
-  saveConfigPreservingClaudeCode(config);
-  return true;
+  return mutateProvider(config, name, fresh => {
+    const pool = ensurePool(fresh);
+    const entry = pool.find(candidate => candidate.id === id);
+    if (!entry) return null;
+    fresh.apiKeyPool = pool.filter(candidate => candidate.id !== id);
+    if (fresh.apiKey === entry.key) {
+      const next = fresh.apiKeyPool[0];
+      if (next) fresh.apiKey = next.key;
+      else delete fresh.apiKey;
+    }
+    if (fresh.apiKeyPool.length === 0) delete fresh.apiKeyPool;
+    return true;
+  }) === true;
 }

package/src/providers/key-failover.ts

@@ -8,8 +8,9 @@
  *
  * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
  */
-import { saveConfigPreservingClaudeCode } from "../config";
+import { mutatePersistedConfig } from "../config";
 import { isAzureIdentityProvider } from "../config/provider-validation";
+import { routedProviderConfig } from "../router";
 import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy } from "../types";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
@@ -159,50 +160,66 @@ export function rotateKeyOn429(
   if (isAzureIdentityProvider(provider)) return null;
   if (provider.authMode === "oauth" || provider.authMode === "forward") return null;
 
-  const pool = provider.apiKeyPool;
-  if (!pool || pool.length < 2) return null;
-
-  // Cool the key that ACTUALLY failed. Under concurrent 429s another request may already have
-  // rotated provider.apiKey — cooling the live key would punish an innocent replacement and can
-  // exhaust a 2-key pool from a single bad key. CAS semantics: callers pass the key they used.
   const failedKey = attemptedKey ?? provider.apiKey;
-  const currentEntry = pool.find(e => e.key === failedKey);
-  if (currentEntry) {
-    const cooldownMs = parseRetryAfterMs(retryAfterHeader, now) ?? DEFAULT_COOLDOWN_MS;
-    keyCooldowns.set(cooldownKey(providerName, currentEntry.id), {
-      cooldownUntil: now + cooldownMs,
-    });
-    sweepExpiredOnWrite(now);
-  }
+  type Rotation =
+    | { provider: OcxProviderConfig; failedId?: string; candidateId?: string }
+    | { exhaustedCount: number };
+  const outcome = mutatePersistedConfig<Rotation | null>(fresh => {
+    const freshProvider = fresh.providers[providerName];
+    if (!freshProvider || isAzureIdentityProvider(freshProvider)
+      || freshProvider.authMode === "oauth" || freshProvider.authMode === "forward") {
+      return { changed: false, value: null };
+    }
+    const pool = freshProvider.apiKeyPool;
+    if (!pool || pool.length < 2) return { changed: false, value: null };
 
-  // Lost the race: someone already rotated away from the failed key. If the live key is healthy,
-  // retry with it as-is instead of rotating a second time.
-  if (attemptedKey !== undefined && provider.apiKey !== attemptedKey) {
-    const liveEntry = pool.find(e => e.key === provider.apiKey);
-    if (liveEntry && !isKeyInCooldown(providerName, liveEntry.id, now)) {
-      return { ...provider };
+    // Cool the key that actually failed. The callback is rerun after rebasing,
+    // so both the id and the active-key comparison come from the commit preimage.
+    const failedEntry = pool.find(entry => entry.key === failedKey);
+    if (failedEntry) {
+      const cooldownMs = parseRetryAfterMs(retryAfterHeader, now) ?? DEFAULT_COOLDOWN_MS;
+      keyCooldowns.set(cooldownKey(providerName, failedEntry.id), { cooldownUntil: now + cooldownMs });
+      sweepExpiredOnWrite(now);
     }
-  }
 
-  // Pick the next key that is NOT in cooldown
-  const currentIndex = currentEntry ? pool.indexOf(currentEntry) : -1;
-  for (let i = 1; i < pool.length; i++) {
-    const candidate = pool[(currentIndex + i) % pool.length]!;
-    if (!isKeyInCooldown(providerName, candidate.id, now)) {
-      // Swap active key
-      provider.apiKey = candidate.key;
-      saveConfigPreservingClaudeCode(config);
-      console.warn(
-        // Log ids only — labels are user-supplied free text and could carry secret material.
-        `[key-failover] ${providerName}: 429 on key ${currentEntry?.id ?? "?"}; rotating to key ${candidate.id}`,
-      );
-      return { ...provider };
+    if (freshProvider.apiKey !== failedKey) {
+      const activeEntry = pool.find(entry => entry.key === freshProvider.apiKey);
+      if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) {
+        return {
+          changed: false,
+          value: { provider: structuredClone(freshProvider), failedId: failedEntry?.id, candidateId: undefined },
+        };
+      }
     }
+
+    const currentIndex = failedEntry ? pool.indexOf(failedEntry) : -1;
+    const candidateCount = failedEntry ? pool.length - 1 : pool.length;
+    for (let offset = 1; offset <= candidateCount; offset += 1) {
+      const candidate = pool[(currentIndex + offset) % pool.length]!;
+      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      freshProvider.apiKey = candidate.key;
+      return {
+        changed: true,
+        value: { provider: structuredClone(freshProvider), failedId: failedEntry?.id, candidateId: candidate.id },
+      };
+    }
+    return { changed: false, value: { exhaustedCount: pool.length } };
+  });
+  if (outcome.status === "unavailable" || outcome.value === null) return null;
+  if ("exhaustedCount" in outcome.value) {
+    console.warn(`[key-failover] ${providerName}: all ${outcome.value.exhaustedCount} keys in cooldown; returning 429 to client`);
+    return null;
   }
 
-  // All keys in cooldown
-  console.warn(`[key-failover] ${providerName}: all ${pool.length} keys in cooldown; returning 429 to client`);
-  return null;
+  const committed = structuredClone(outcome.value.provider);
+  config.providers[providerName] = committed;
+  if (outcome.value.candidateId) {
+    console.warn(
+      // Log ids only — labels are user-supplied free text and could carry secret material.
+      `[key-failover] ${providerName}: 429 on key ${outcome.value.failedId ?? "?"}; rotating to key ${outcome.value.candidateId}`,
+    );
+  }
+  return structuredClone(committed);
 }
 
 export function sweepExpiredApiKeyCooldowns(now = Date.now()): number {
@@ -225,13 +242,9 @@ interface RotateProviderTransportOptions {
 /**
  * Rotate a failed key and re-apply provider-specific transport metadata to the replacement.
  *
- * `routedProvider` is the request's active provider (the `routedProviderConfig` output the
- * route was built with). The result inherits it and swaps ONLY the API key: the persisted
- * config that `rotateKeyOn429` snapshots predates registry backfill, so building the retry
- * provider from that snapshot would silently drop every field the registry merged in at
- * routing time (scalar flags like `promptCacheKey`/`parallelToolCalls`, merged model
- * metadata such as `noTemperatureModels`, a pinned baseUrl). Mirrors the OAuth-401 replay
- * path in src/server/responses/core.ts, which spreads `route.provider` for the same reason.
+ * Put the authoritative committed row over request-only fields and registry backfills, then
+ * route it again so concurrent provider edits take effect without losing either kind of runtime
+ * metadata.
  */
 export function rotateProviderTransportOn429(
   config: OcxConfig,
@@ -249,7 +262,7 @@ export function rotateProviderTransportOn429(
   return rotated
     ? resolveProviderTransport(
         providerName,
-        { ...routedProvider, apiKey: rotated.apiKey },
+        routedProviderConfig(providerName, { ...routedProvider, ...rotated }),
         options.promptCacheKey,
       )
     : null;

package/src/providers/label.ts

@@ -1,4 +1,5 @@
-import { CODEX_ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
+import { CODEX_ACCOUNT_LOG_LABEL_RE, oauthAccountLogLabel } from "../codex/account-label";
+import type { OcxProviderConfig } from "../types";
 
 export function canonicalUsageProviderLabel(provider: string): string {
   return provider === "chatgpt" || provider === "openai-multi" ? "openai" : provider;
@@ -17,3 +18,35 @@ export function baseProviderLabel(provider: string): string {
   if (suffix === "main") return canonicalUsageProviderLabel(provider.slice(0, cut));
   return CODEX_ACCOUNT_LOG_LABEL_RE.test(suffix) ? canonicalUsageProviderLabel(provider.slice(0, cut)) : provider;
 }
+
+/**
+ * Stamp the per-account usage label for a non-Codex OAuth provider (#2699).
+ *
+ * Call this where the resolved credential is known and NOT inside a failover gate. The obvious
+ * place -- next to the `genericFailoverAccountId` assignment in `core.ts` -- sits inside
+ * `isGenericFailoverProvider`, and the rotation paths additionally require two or more stored
+ * accounts. Stamping there would leave the ordinary case (one xai account, failover off) with no
+ * label at all while every test still passed, which is the bug this fixes rather than a variant
+ * of it.
+ *
+ * Two providers are skipped because they already have attribution:
+ * - `openai` produces its own `p`-labels through `codexAuthContextLogLabel`.
+ * - `anthropic` folds the account into the provider label (`formatAnthropicProviderForLog`).
+ *
+ * It lives here rather than in `account-label.ts` because it needs `baseProviderLabel`, and this
+ * module already imports from that one -- the reverse direction would be an import cycle. This
+ * file stays Lab-clean, which matters because `core.ts` is one of the three files
+ * `tests/core-lab-boundary.test.ts` guards.
+ */
+export function stampOAuthAccountLabel(
+  logCtx: { accountLogLabel?: string },
+  providerName: string,
+  provider: Pick<OcxProviderConfig, "authMode">,
+  accountId: string | undefined,
+): void {
+  if (!accountId) return;
+  if (provider.authMode !== "oauth") return;
+  const base = baseProviderLabel(providerName);
+  if (base === "openai" || base === "anthropic") return;
+  logCtx.accountLogLabel = oauthAccountLogLabel(accountId, base);
+}

package/src/providers/model-rename-startup.ts

@@ -1,10 +1,16 @@
-import { saveConfig } from "../config";
+import { mutatePersistedConfig } from "../config";
 import { projectModelRenames } from "./model-rename-migration";
 import type { OcxConfig } from "../types";
 
 export interface ModelRenameStartupDeps {
   project: typeof projectModelRenames;
-  save: (config: OcxConfig) => void;
+  save?: (config: OcxConfig) => void;
+}
+
+function adoptConfig(target: OcxConfig, source: OcxConfig): void {
+  if (target === source) return;
+  for (const key of Object.keys(target)) delete (target as unknown as Record<string, unknown>)[key];
+  Object.assign(target, structuredClone(source));
 }
 
 /**
@@ -18,11 +24,23 @@ export interface ModelRenameStartupDeps {
  */
 export function runModelRenameStartupMigration(
   config: OcxConfig,
-  deps: ModelRenameStartupDeps = { project: projectModelRenames, save: saveConfig },
+  deps: ModelRenameStartupDeps = { project: projectModelRenames },
 ): OcxConfig {
-  const projection = deps.project(config);
-  for (const warning of projection.warnings) console.warn(`[model-rename-migration] ${warning}`);
+  const projection = deps.project(structuredClone(config));
   if (!projection.changed) return projection.config;
-  deps.save(projection.config);
-  return projection.config;
+  if (deps.save) {
+    deps.save(projection.config);
+    adoptConfig(config, projection.config);
+    for (const warning of projection.warnings) console.warn(`[model-rename-migration] ${warning}`);
+    return config;
+  }
+  const outcome = mutatePersistedConfig(fresh => {
+    const next = deps.project(fresh);
+    if (next.changed) adoptConfig(fresh, next.config);
+    return { changed: next.changed, value: next };
+  });
+  if (outcome.status === "unavailable") return config;
+  adoptConfig(config, outcome.value.config);
+  for (const warning of outcome.value.warnings) console.warn(`[model-rename-migration] ${warning}`);
+  return config;
 }

package/src/providers/openai-tier-startup.ts

@@ -2,8 +2,8 @@ import {
   backupConfigBeforeOpenAiTierMigration,
   OpenAiTierBackupCollisionError,
   OpenAiTierRollbackPreserveError,
+  mutatePersistedConfig,
   preserveOpenAiTierRollbackSnapshot,
-  saveConfig,
 } from "../config";
 import type { OcxConfig } from "../types";
 import { projectOpenAiTierMigration } from "./openai-tiers";
@@ -11,7 +11,7 @@ import { projectOpenAiTierMigration } from "./openai-tiers";
 export interface OpenAiTierStartupDeps {
   project: typeof projectOpenAiTierMigration;
   backup: () => void;
-  save: (config: OcxConfig) => void;
+  save?: (config: OcxConfig) => void;
   preserveRollback?: (error: OpenAiTierBackupCollisionError) => void;
 }
 
@@ -34,23 +34,47 @@ function defaultPreserveRollback(error: OpenAiTierBackupCollisionError): void {
 const DEFAULT_DEPS: OpenAiTierStartupDeps = {
   project: projectOpenAiTierMigration,
   backup: backupConfigBeforeOpenAiTierMigration,
-  save: saveConfig,
 };
 
 export function runOpenAiTierStartupMigration(
   config: OcxConfig,
   deps: OpenAiTierStartupDeps = DEFAULT_DEPS,
 ): OcxConfig {
-  const projection = deps.project(config);
-  if (!projection.changed) return projection.config;
-  try {
-    deps.backup();
-  } catch (error) {
-    if (!(error instanceof OpenAiTierBackupCollisionError)) throw error;
-    (deps.preserveRollback ?? defaultPreserveRollback)(error);
-    deps.backup();
+  const backup = (): void => {
+    try {
+      deps.backup();
+    } catch (error) {
+      if (!(error instanceof OpenAiTierBackupCollisionError)) throw error;
+      (deps.preserveRollback ?? defaultPreserveRollback)(error);
+      deps.backup();
+    }
+  };
+  if (deps.save) {
+    const projection = deps.project(config);
+    if (!projection.changed) return projection.config;
+    backup();
+    deps.save(projection.config);
+    for (const warning of projection.warnings) console.warn(`[openai-provider-migration] ${warning}`);
+    return projection.config;
+  }
+
+  let previousSnapshot: string | undefined;
+  const outcome = mutatePersistedConfig(fresh => {
+    const snapshot = JSON.stringify(fresh);
+    const next = deps.project(fresh);
+    // mutatePersistedConfig confirms a candidate by invoking us again with the same
+    // snapshot after rebasing. Back up only that confirmed preimage.
+    if (next.changed && snapshot === previousSnapshot) backup();
+    previousSnapshot = snapshot;
+    if (next.changed) {
+      for (const key of Object.keys(fresh)) delete (fresh as unknown as Record<string, unknown>)[key];
+      Object.assign(fresh, next.config);
+    }
+    return { changed: next.changed, value: next };
+  });
+  if (outcome.status === "unavailable") return config;
+  if (outcome.status === "committed") {
+    for (const warning of outcome.value.warnings) console.warn(`[openai-provider-migration] ${warning}`);
   }
-  deps.save(projection.config);
-  for (const warning of projection.warnings) console.warn(`[openai-provider-migration] ${warning}`);
-  return projection.config;
+  return outcome.value.config;
 }