fix: harden provider alias normalization

src/cliproxy/quota/quota-manager.ts

@@ -483,9 +483,8 @@ export async function reconcileExhaustedRotationAccounts(
     return [];
   }
 
-  const { pauseAccountForQuotaCooldown, restoreExpiredQuotaPauses } = await import(
+  const { pauseAccountForQuotaCooldown, restoreExpiredQuotaPauses } =
-    '../accounts/account-safety'
+    await import('../accounts/account-safety');
-  );
   restoreExpiredQuotaPauses();
 
   const config = loadOrCreateUnifiedConfig();
@@ -593,9 +592,8 @@ export async function preflightCheck(provider: CLIProxyProvider): Promise<Prefli
     return { proceed: true, accountId: defaultAccount?.id || '' };
   }
 
-  const { pauseAccountForQuotaCooldown, restoreExpiredQuotaPauses } = await import(
+  const { pauseAccountForQuotaCooldown, restoreExpiredQuotaPauses } =
-    '../accounts/account-safety'
+    await import('../accounts/account-safety');
-  );
   restoreExpiredQuotaPauses();
 
   const config = loadOrCreateUnifiedConfig();

src/management/checks/image-analysis-check.ts

@@ -112,9 +112,8 @@ export async function runImageAnalysisCheck(results: HealthCheck): Promise<void>
  * Fix image analysis configuration issues
  */
 export async function fixImageAnalysisConfig(): Promise<boolean> {
-  const { updateConfig, loadOrCreateUnifiedConfig } = await import(
+  const { updateConfig, loadOrCreateUnifiedConfig } =
-    '../../config/config-loader-facade'
+    await import('../../config/config-loader-facade');
-  );
 
   const config = loadOrCreateUnifiedConfig();
   let fixed = false;

src/web-server/models-dev/pricing-resolver.ts

@@ -18,19 +18,19 @@ export interface ModelsDevPricingLookupOptions {
   provider?: string;
 }
 
-const PROVIDER_ALIASES: Record<string, string> = {
+const PROVIDER_ALIASES = new Map<string, string>([
-  agy: 'google',
+  ['agy', 'google'],
-  antigravity: 'google',
+  ['antigravity', 'google'],
-  claude: 'anthropic',
+  ['claude', 'anthropic'],
-  codex: 'openai',
+  ['codex', 'openai'],
-  copilot: 'github-copilot',
+  ['copilot', 'github-copilot'],
-  gemini: 'google',
+  ['gemini', 'google'],
-  ghcp: 'github-copilot',
+  ['ghcp', 'github-copilot'],
-  github: 'github-copilot',
+  ['github', 'github-copilot'],
-  kimi: 'moonshotai',
+  ['kimi', 'moonshotai'],
-  moonshot: 'moonshotai',
+  ['moonshot', 'moonshotai'],
-  qwen: 'alibaba',
+  ['qwen', 'alibaba'],
-};
+]);
 
 function normalizeId(value: string): string {
   return value.trim().toLowerCase();
@@ -45,7 +45,7 @@ export function normalizeModelsDevProviderId(
 ): string | undefined {
   if (!provider) return undefined;
   const normalized = normalizeId(provider);
-  return PROVIDER_ALIASES[normalized] ?? normalized;
+  return PROVIDER_ALIASES.get(normalized) ?? normalized;
 }
 
 function splitProviderPrefix(model: string): { provider?: string; model: string } {

tests/unit/data-aggregator.test.ts

@@ -150,6 +150,40 @@ describe('aggregateDailyUsage', () => {
     expect(result[0].modelBreakdowns[0].provider).toBe('github-copilot');
     expect(result[0].modelBreakdowns[0].inputTokens).toBe(3000);
   });
+
+  test('handles provider names inherited from Object.prototype', () => {
+    const entries: RawUsageEntry[] = [
+      createEntry({ model: 'model-a', target: '__proto__' }),
+      createEntry({ model: 'model-b', target: 'constructor' }),
+      createEntry({ model: 'model-c', target: 'toString' }),
+    ];
+
+    const daily = aggregateDailyUsage(entries);
+    const hourly = aggregateHourlyUsage(entries);
+    const monthly = aggregateMonthlyUsage(entries);
+    const session = aggregateSessionUsage(entries);
+
+    expect(daily[0].modelBreakdowns.map((item) => item.provider)).toEqual([
+      '__proto__',
+      'constructor',
+      'tostring',
+    ]);
+    expect(hourly[0].modelBreakdowns.map((item) => item.provider)).toEqual([
+      '__proto__',
+      'constructor',
+      'tostring',
+    ]);
+    expect(monthly[0].modelBreakdowns.map((item) => item.provider)).toEqual([
+      '__proto__',
+      'constructor',
+      'tostring',
+    ]);
+    expect(session[0].modelBreakdowns.map((item) => item.provider)).toEqual([
+      '__proto__',
+      'constructor',
+      'tostring',
+    ]);
+  });
 });
 
 // ============================================================================