@doitian/dsh-provider-aliyun 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 doitian
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,209 @@
+# @doitian/dsh-provider-aliyun
+
+Aliyun **DashScope (Bailian)** as a model provider for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness).
+
+The plugin registers one provider route, `aliyun`, and **owns it outright** — endpoint, credential reference, protocol, and the Qwen model catalog. The catalog is a file in this package, so the model list moves forward with `pnpm update` and never has to be written into a profile.
+
+```yaml
+provider: aliyun
+model: qwen3.8-max
+```
+
+## Why a plugin and not a config snippet
+
+An OpenAI-compatible provider *can* be added to DSH with configuration alone — declare a route under `llm-pi-ai`'s `providers` and hand-write its model list. That works, and then the model list lives in your profile forever: every new Qwen release is a hand edit, and a profile patch replaces an entry's whole `config`, so nothing can merge models into it later.
+
+This package takes the other route. It registers its own route on the LLM seam and ships the catalog as data:
+
+| | Config-only route | This plugin |
+|---|---|---|
+| Where the model list lives | your `cordis.patch.yml` | `lib/catalog.js` in this package |
+| Adding a new Qwen model | edit your profile | `pnpm update` |
+| Can a profile patch shadow it | — | no |
+| Your profile config | the whole provider block | nothing |
+
+The trade-off is honest: the plugin depends on an internal shape of the adapter it reuses (see [How it works](#how-it-works)), which a config-only route does not.
+
+## Requirements
+
+- DeepSeek Harness `0.2.0-rc.2` with the `@deepseek-ai/dsh-base` bundle, which mounts the LLM seam this plugin registers on.
+- An Aliyun DashScope / Bailian API key.
+- **No `aliyun` route configured through `llm-pi-ai`.** Two adapters cannot declare the same route: mounting this plugin while a profile still configures one fails with `configurable provider "aliyun" is already declared`. Remove that block from your profile patch first — that is the whole point of the plugin.
+
+## Install
+
+**Desktop app.** Sidebar **Plugins** → install `@doitian/dsh-provider-aliyun`. A newly installed bundle is enabled by default.
+
+**Any other profile.** `dsh plugin` forwards its arguments to pnpm in the profile directory:
+
+```bash
+dsh plugin --profile <name> add @doitian/dsh-provider-aliyun
+```
+
+Then make sure the bundle is *selected* — a raw `add` installs the dependency but does not add it to `dsh.profile.bundles` in the profile's `package.json`:
+
+```json
+{
+  "dsh": {
+    "profile": {
+      "bundles": ["@deepseek-ai/dsh-base", "@doitian/dsh-provider-aliyun"]
+    }
+  }
+}
+```
+
+> The `dsh plugin` CLI refuses the `desktop` profile (`profile "desktop" is managed exclusively by the Electron application`); use the Plugins page there.
+
+## Configure the API key
+
+Nothing is needed to make the route exist, and no key is stored in this package or in any profile patch. The route resolves a credential reference per request:
+
+```
+apiKeyEnv: ALIYUN_API_KEY   # the default
+```
+
+**Settings → Models → Aliyun DashScope** → paste the key into the **API key** field. It is written write-only to `$DSH_HOME/.credentials.yaml` under `ALIYUN_API_KEY`, and never read back.
+
+Or export `ALIYUN_API_KEY` in the environment that launches DSH. Until the key resolves, selecting an Aliyun model fails immediately with `MISSING_CREDENTIAL`, before any network I/O.
+
+### Endpoints
+
+| Region | Endpoint |
+|---|---|
+| Mainland China (default) | `https://dashscope.aliyuncs.com/compatible-mode/v1` |
+| International | `https://dashscope-intl.aliyuncs.com/compatible-mode/v1` |
+
+Set it in the Models page, or by adding `baseURL` to this entry's `config`:
+
+```yaml
+- id: llm-aliyun
+  name: '@doitian/dsh-provider-aliyun'
+  config:
+    baseURL: https://dashscope-intl.aliyuncs.com/compatible-mode/v1
+```
+
+## Models
+
+`lib/catalog.js` is the catalog. It ships six Qwen models:
+
+`qwen3.8-max`, `qwen3.8-flash`, `qwen3.7-max`, `qwen3.7-plus`, `qwen3.6-plus`, `qwen3.6-flash`
+
+Capacities and thinking levels mirror the facts Aliyun publishes for its Qwen lineup. A catalog entry states only what is true of the *model* — id, display name, context window, output cap, accepted modalities, and thinking levels. The route, endpoint, protocol, and compatibility switches are filled in from configuration by `lib/models.js`, so updating the catalog never means touching pi-ai plumbing.
+
+**Verify capacities against your endpoint when you upgrade.** A wrong `contextWindow` is the failure that hurts, because the harness trusts it when it decides to compact history.
+
+### Updating the catalog
+
+Edit `lib/catalog.js` and publish. Consumers get the new list with `pnpm update`.
+
+### Overriding models for one profile
+
+`models` is a normal configuration field whose default is the shipped catalog, so a profile can replace it without forking:
+
+```yaml
+- id: llm-aliyun
+  name: '@doitian/dsh-provider-aliyun'
+  config:
+    models:
+      - id: qwen3.8-max
+        name: Qwen3.8 Max
+        contextWindow: 1000000
+        maxTokens: 131072
+        input: [text, image]
+        reasoning: true
+        thinkingLevelMap: { low: low, medium: medium, high: high }
+```
+
+The Models page edits the same field, showing the shipped catalog as inherited rows until the first edit materializes an override.
+
+### Thinking
+
+Aliyun turns thinking on with a boolean `enable_thinking` rather than a reasoning-effort field, which is what `compat.thinkingFormat: 'qwen'` sends, and `supportsReasoningEffort: false` keeps an effort value off the wire where this endpoint would refuse it. The selected level still drives the boolean, so `off` genuinely turns thinking off.
+
+`thinkingLevelMap` on each catalog entry declares which levels a model offers and the wire spelling of each. A level left out is not offered; `off` is offered unless it is named in the map.
+
+## Uninstall
+
+Remove it from `dsh.profile.bundles` (or delete the row on the Plugins page), then:
+
+```bash
+dsh plugin --profile <name> remove @doitian/dsh-provider-aliyun
+```
+
+The credential in `$DSH_HOME/.credentials.yaml` is left untouched. Deleting the route on the Models page removes it only when its reference is exactly the page-derived `ALIYUN_API_KEY`; a custom reference is retained deliberately, because the page cannot prove it owns it.
+
+## How it works
+
+`package.json` declares a bundle patch:
+
+```json
+{ "dsh": { "bundle": { "patch": "./cordis.patch.yml" } } }
+```
+
+and the patch inserts this package's own plugin entry:
+
+```yaml
+- insert:
+    - id: llm-aliyun
+      name: '@doitian/dsh-provider-aliyun'
+```
+
+On mount, `lib/index.js` registers two things on the LLM seam: the `aliyun` route with an adapter, and a configurable-provider directory entry — the latter is what gives the route a row, and an API-key field, on the Models page.
+
+The adapter is `PiAiAdapter`, exported by `@deepseek-ai/dsh-llm-pi-ai`. It owns the hard part — harness history into pi-ai context, pi-ai events into harness stream chunks, image budgets, replay metadata, idle watchdogs — and reusing it is what keeps this package a catalog plus a few dozen lines instead of a second adapter implementation.
+
+**The one thing to know if you maintain this.** `PiAiAdapter` is driven by a route's *resolved profile*, a shape its package does not export as a type; `lib/adapter.js` reproduces it and documents every field it must carry. Model metadata is not read from that profile — it comes from the pi-ai model descriptors built out of the catalog, which is why the catalog can live here at all. A DSH upgrade that starts reading a new profile field breaks this plugin. `test/adapter.test.mjs` drives the real published adapter against the factory, so that break shows up as a failing test rather than as a broken route in someone's profile.
+
+The engine is pinned to the harness's own pi-ai: the dependency is `^0.87.1`, which resolves to exactly the `0.87.1` the harness installs, so both share one copy.
+
+## Development
+
+```bash
+npm install
+npm run validate   # manifest, patch wiring, catalog integrity
+npm test           # drives the real PiAiAdapter against the catalog
+```
+
+`scripts/validate.mjs` catches what would otherwise fail silently: a tarball that drops the patch, a patch that names the wrong package, a duplicate model id, a non-integer capacity, a level map pi-ai would read as offering nothing.
+
+`npm test` needs the peer packages installed — that is the point, since it exercises the real adapter rather than a stub. A live request is out of scope: that needs a real key and endpoint.
+
+## Publishing
+
+Publishing uses **npm trusted publishing** (OIDC) from `.github/workflows/publish.yml`. There is no npm token anywhere: no `NODE_AUTH_TOKEN`, no `NPM_TOKEN`, no secret. The workflow declares `id-token: write` and runs `npm publish`, which exchanges that OIDC identity for a short-lived publish token.
+
+One-time setup, as the package owner. npm 11.6 or later creates the publisher from the CLI — the same operation as the website form, without the form:
+
+```bash
+npm login   # as doitian
+
+npm trust github @doitian/dsh-provider-aliyun \
+  --file publish.yml \
+  --repo doitian/dsh-provider-aliyun \
+  --allow-publish
+```
+
+`--allow-publish` is required: it grants the `CREATE_PACKAGE` permission, and the command refuses without it or `--allow-stage-publish`. It infers `owner/repo` from `package.json` when `--repo` is omitted, warns when the two disagree, requires 2FA, and prompts for an OTP. Add `--dry-run` first to see exactly what it would create without committing it.
+
+`--environment` is deliberately omitted, matching the publish job, which declares no `environment:`.
+
+If the registry reports the package as missing, a trusted publisher cannot be attached to a name that does not exist yet: publish `0.1.0` once by hand, then run the command above and let the workflow own every release after that.
+
+Then release:
+
+```bash
+npm version patch
+git push --follow-tags
+gh release create v0.1.1 --generate-notes
+```
+
+The publish job requires the release tag to match `package.json` (`v0.1.1` ↔ `0.1.1`) and re-runs validation and tests before uploading.
+
+Two things that will bite when editing the workflow:
+
+- **`pnpm publish` does not work here.** It performs no OIDC exchange. Use `npm publish`.
+- **Pushing `.github/workflows/` needs the `workflow` token scope.** An OAuth token without it is rejected for workflow files even though it can push everything else; add the scope with `gh auth refresh -h github.com -s workflow`, or use an SSH remote, which is not scope-limited.
+
+## License
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,12 @@
+# Aliyun DashScope (Bailian) provider bundle for DeepSeek Harness.
+#
+# This bundle inserts its own plugin entry. The endpoint, the credential
+# reference, and the Qwen model catalog are all defaults inside the package, so
+# nothing about the models belongs in a profile — the catalog moves forward with
+# `pnpm update`, and no profile patch can shadow it.
+#
+# Configure it on the Models page, or by adding fields under this entry's
+# `config` (displayName, apiKeyEnv, baseURL, models, reasoning, headers).
+- insert:
+    - id: llm-aliyun
+      name: '@doitian/dsh-provider-aliyun'

package/lib/adapter.js

@@ -0,0 +1,133 @@
+/**
+ * Wire the shipped catalog into the harness LLM seam.
+ *
+ * The engine is `PiAiAdapter`, exported by `@deepseek-ai/dsh-llm-pi-ai`. It
+ * owns the hard part — harness history into pi-ai context, pi-ai events into
+ * harness stream chunks, image budgets, replay metadata, idle watchdogs — and
+ * is driven entirely through the `config` object below. Reusing it is what
+ * keeps this package a catalog plus a few dozen lines instead of a second
+ * adapter implementation.
+ *
+ * ## The contract this file depends on
+ *
+ * `PiAiAdapter` consumes a route's *resolved profile*. That type is not part of
+ * the package's exported surface: it is the shape `resolveProfiles` produces
+ * internally, and it is reproduced here. The fields, all of them, are:
+ *
+ *   provider, displayName, apiKeyEnv, piProvider, catalogError, modelErrors,
+ *   configuredMaxTokens, reasoning, thinkingBudgets, retryPolicy, headers,
+ *   timeoutMs, websocketConnectTimeoutMs, streamIdleTimeoutMs, transport,
+ *   cacheRetention, maxRequestImageBytes, requestImagePixelBudget,
+ *   requestImageMaxBytes
+ *
+ * Model metadata — context window, modalities, thinking levels — is *not* read
+ * from the profile. It is read from the pi-ai model descriptors inside
+ * `piProvider`, which is why the catalog can live in this package.
+ *
+ * The risk this carries: a DSH upgrade that starts reading a new profile field
+ * breaks this plugin. `test/adapter.test.mjs` drives the real `PiAiAdapter`
+ * against this factory so that such a break shows up as a failing test rather
+ * than as a broken route in someone's profile.
+ */
+import { PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai'
+import { openAICompletionsApi } from '@earendil-works/pi-ai/api/openai-completions.lazy'
+
+import { QWEN_COMPAT, ROUTE } from './catalog.js'
+import { materializeModels } from './models.js'
+import { createPiProvider } from './provider.js'
+
+/** Idle bound on one outstanding stream read, matching the adapter's own default. */
+export const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 300_000
+
+/** Aggregate base64 image payload a request may retain before offload is required. */
+export const DEFAULT_MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024
+
+/** Total-pixel budget for each deterministic request image. */
+export const DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET = 4 * 1024 * 1024
+
+/** Encoded-byte target for each request image before base64 expansion. */
+export const DEFAULT_REQUEST_IMAGE_MAX_BYTES = 1024 * 1024
+
+/**
+ * Build the resolved profile for this route.
+ *
+ * Everything is computed once, when the plugin mounts: the configuration
+ * carries no volatile field, so a configuration change remounts the plugin and
+ * rebuilds this. That keeps `profiles()` returning one stable map, which is
+ * what the adapter's snapshot memoization compares by identity.
+ *
+ * @param {object} options - route facts.
+ * @param {string} options.displayName - label for selectors.
+ * @param {string} options.apiKeyEnv - credential reference to resolve per request.
+ * @param {string} options.baseURL - endpoint for every model on the route.
+ * @param {readonly import('./catalog.js').AliyunModel[]} options.models - the shipped catalog.
+ * @param {string} [options.reasoning] - route default thinking level.
+ * @param {Record<string, string>} [options.headers] - extra request headers.
+ * @returns {object} the resolved profile.
+ */
+export function buildAliyunProfile(options) {
+  const models = materializeModels({
+    catalog: options.models,
+    provider: ROUTE,
+    baseUrl: options.baseURL,
+    compat: QWEN_COMPAT,
+  })
+  return {
+    provider: ROUTE,
+    displayName: options.displayName,
+    apiKeyEnv: options.apiKeyEnv,
+    piProvider: createPiProvider({
+      id: ROUTE,
+      name: options.displayName,
+      baseUrl: options.baseURL,
+      models,
+      api: openAICompletionsApi(),
+    }),
+    // `piProvider` is always defined here, so the adapter never consults the
+    // catalog diagnostic; it exists to keep the profile shape complete.
+    catalogError: undefined,
+    modelErrors: new Map(),
+    // Empty on purpose: the adapter reports these as *explicit* per-model caps,
+    // and the catalog's own `maxTokens` already governs the request.
+    configuredMaxTokens: new Map(),
+    reasoning: options.reasoning,
+    headers: options.headers,
+    streamIdleTimeoutMs: DEFAULT_STREAM_IDLE_TIMEOUT_MS,
+    maxRequestImageBytes: DEFAULT_MAX_REQUEST_IMAGE_BYTES,
+    requestImagePixelBudget: DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET,
+    requestImageMaxBytes: DEFAULT_REQUEST_IMAGE_MAX_BYTES,
+  }
+}
+
+/**
+ * Create the adapter for this route.
+ *
+ * `auth` is deliberately omitted. The harness resolves the credential reference
+ * itself and hands the key to pi-ai as the stream's `apiKey` option, so the
+ * credential stores and OAuth context the adapter would otherwise carry are
+ * never consulted; `createModels` falls back to in-memory ones.
+ *
+ * @param {object} options - route facts plus the harness callbacks.
+ * @param {string} options.displayName - label for selectors.
+ * @param {string} options.apiKeyEnv - credential reference to resolve per request.
+ * @param {string} options.baseURL - endpoint for every model on the route.
+ * @param {readonly import('./catalog.js').AliyunModel[]} options.models - the shipped catalog.
+ * @param {string} [options.reasoning] - route default thinking level.
+ * @param {Record<string, string>} [options.headers] - extra request headers.
+ * @param {(provider: string, profile: object) => Promise<string | undefined>} options.resolveApiKey - credential resolver.
+ * @param {() => object | undefined} [options.resolveAttachments] - durable attachment service accessor.
+ * @param {(attachments: object, ref: object) => unknown} [options.resolveImageAccess] - image access resolver.
+ * @param {(event: object) => void} [options.onReplayDegrade] - replay degradation reporter.
+ * @returns {PiAiAdapter} the adapter to register on the LLM seam.
+ */
+export function createAliyunAdapter(options) {
+  const profile = buildAliyunProfile(options)
+  const profiles = () => new Map([[ROUTE, profile]])
+  return new PiAiAdapter({
+    profiles,
+    resolveApiKey: options.resolveApiKey,
+    resolveAttachments: options.resolveAttachments,
+    resolveImageAccess: options.resolveImageAccess,
+    onReplayDegrade: options.onReplayDegrade,
+  })
+}

package/lib/catalog.js

@@ -0,0 +1,123 @@
+/**
+ * The Aliyun DashScope (Bailian) model catalog this plugin ships.
+ *
+ * This file is the whole point of the package: the model list lives here, in
+ * the plugin, so `pnpm update` refreshes it. Nothing about it needs to be
+ * written into a profile, and no profile patch can shadow it.
+ *
+ * It is plain data on purpose. {@link ./models.js} turns each entry into the
+ * pi-ai model descriptor the adapter dispatches with, filling in the route,
+ * endpoint, protocol, and compatibility switches from configuration — so an
+ * entry here states only what is true of the *model*, never of the deployment.
+ *
+ * The entries mirror the facts Aliyun publishes for its Qwen lineup. Verify
+ * them against your endpoint when you upgrade; a wrong `contextWindow` is the
+ * failure that hurts, because the harness trusts it when it compacts history.
+ */
+
+/** Route name every request selects with `GenerateOptions.provider`. */
+export const ROUTE = 'aliyun'
+
+/** Label shown by provider selectors. */
+export const DISPLAY_NAME = 'Aliyun DashScope'
+
+/** Mainland-China DashScope endpoint, OpenAI-compatible mode. */
+export const DEFAULT_BASE_URL = 'https://dashscope.aliyuncs.com/compatible-mode/v1'
+
+/** International Model Studio endpoint. */
+export const INTL_BASE_URL = 'https://dashscope-intl.aliyuncs.com/compatible-mode/v1'
+
+/** Credential reference the route resolves through the harness credential seam. */
+export const DEFAULT_API_KEY_ENV = 'ALIYUN_API_KEY'
+
+/**
+ * Wire compatibility for Aliyun's OpenAI-compatible endpoint.
+ *
+ * `thinkingFormat: "qwen"` is the load-bearing switch: Aliyun turns thinking on
+ * with a boolean `enable_thinking` rather than a reasoning-effort field, and
+ * that is what pi-ai's `qwen` format sends. `supportsReasoningEffort: false`
+ * keeps an effort value off the wire, where this endpoint would reject it,
+ * while the selected level still drives the boolean. The remaining switches
+ * describe what the endpoint does not implement, so the request does not carry
+ * fields it would refuse.
+ */
+export const QWEN_COMPAT = Object.freeze({
+  thinkingFormat: 'qwen',
+  supportsReasoningEffort: false,
+  supportsDeveloperRole: false,
+  supportsStore: false,
+  supportsStrictMode: true,
+})
+
+/**
+ * One shipped model.
+ *
+ * @typedef {object} AliyunModel
+ * @property {string} id - request id, and the id the harness records.
+ * @property {string} name - display name for selectors.
+ * @property {number} contextWindow - total tokens the model accepts.
+ * @property {number} maxTokens - output cap for one response.
+ * @property {string[]} input - accepted modalities, `text` and/or `image`.
+ * @property {boolean} reasoning - whether the model can think.
+ * @property {Record<string, string>} [thinkingLevelMap] - selectable thinking
+ *   levels and the wire spelling each one sends. A level left out is not
+ *   offered; `off` is offered unless it is named here.
+ */
+
+/** @type {readonly AliyunModel[]} */
+export const ALIYUN_MODELS = Object.freeze([
+  {
+    id: 'qwen3.8-max',
+    name: 'Qwen3.8 Max',
+    contextWindow: 1_000_000,
+    maxTokens: 131_072,
+    input: ['text', 'image'],
+    reasoning: true,
+    thinkingLevelMap: { low: 'low', medium: 'medium', high: 'high' },
+  },
+  {
+    id: 'qwen3.8-flash',
+    name: 'Qwen3.8 Flash',
+    contextWindow: 1_000_000,
+    maxTokens: 131_072,
+    input: ['text', 'image'],
+    reasoning: true,
+    thinkingLevelMap: { low: 'low', medium: 'medium', high: 'high' },
+  },
+  {
+    id: 'qwen3.7-max',
+    name: 'Qwen3.7 Max',
+    contextWindow: 1_000_000,
+    maxTokens: 131_072,
+    input: ['text'],
+    reasoning: true,
+    thinkingLevelMap: { low: 'low', medium: 'medium', high: 'high' },
+  },
+  {
+    id: 'qwen3.7-plus',
+    name: 'Qwen3.7 Plus',
+    contextWindow: 1_000_000,
+    maxTokens: 65_536,
+    input: ['text', 'image'],
+    reasoning: true,
+    thinkingLevelMap: { low: 'low', medium: 'medium', high: 'high' },
+  },
+  {
+    id: 'qwen3.6-plus',
+    name: 'Qwen3.6 Plus',
+    contextWindow: 1_000_000,
+    maxTokens: 65_536,
+    input: ['text', 'image'],
+    reasoning: true,
+    thinkingLevelMap: { low: 'low', medium: 'medium', high: 'high' },
+  },
+  {
+    id: 'qwen3.6-flash',
+    name: 'Qwen3.6 Flash',
+    contextWindow: 1_000_000,
+    maxTokens: 65_536,
+    input: ['text', 'image'],
+    reasoning: true,
+    thinkingLevelMap: { low: 'low', medium: 'medium', high: 'high' },
+  },
+])

package/lib/index.js

@@ -0,0 +1,133 @@
+/**
+ * Aliyun DashScope (Bailian) as a DeepSeek Harness model provider.
+ *
+ * This plugin registers one provider route, `aliyun`, on the harness LLM seam.
+ * It owns the route outright — endpoint, credential reference, protocol, and
+ * the Qwen model catalog in {@link ./catalog.js} — so a profile needs no model
+ * list, and `pnpm update` is how the catalog moves forward.
+ *
+ * @module @doitian/dsh-provider-aliyun
+ */
+import { LlmError, resolveImageAttachmentAccess } from '@deepseek-ai/dsh-llm'
+import z from '@deepseek-ai/schemastery'
+
+import { createAliyunAdapter } from './adapter.js'
+import {
+  ALIYUN_MODELS,
+  DEFAULT_API_KEY_ENV,
+  DEFAULT_BASE_URL,
+  DISPLAY_NAME,
+  ROUTE,
+} from './catalog.js'
+
+/** Entry name, used for logging and as the settings namespace fallback. */
+export const name = 'llm-aliyun'
+
+/** This plugin registers routes; it needs the LLM seam and nothing else. */
+export const inject = ['llm']
+
+/** Every thinking level a model's `thinkingLevelMap` may name. */
+const THINKING_LEVELS = ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']
+
+/** Accepted input modalities. */
+const MODALITIES = ['text', 'image']
+
+/** One catalog entry, as a profile may override it. */
+const modelSchema = z.object({
+  id: z.string().required(),
+  name: z.string(),
+  contextWindow: z.number().step(1).min(1),
+  maxTokens: z.number().step(1).min(1),
+  input: z.array(z.union(MODALITIES)),
+  reasoning: z.boolean(),
+  thinkingLevelMap: z.dict(z.union([z.string(), z.const(null)])),
+})
+
+/**
+ * Plugin configuration.
+ *
+ * Every field defaults to something serviceable, so the bundle's patch mounts
+ * this plugin with an empty config and the route works as soon as a key
+ * resolves. `models` defaults to the shipped catalog, which is what the
+ * settings surface shows as inherited rows until someone edits them.
+ */
+export const Config = z.object({
+  displayName: z.string().default(DISPLAY_NAME),
+  apiKeyEnv: z.string().role('credential-ref').default(DEFAULT_API_KEY_ENV),
+  baseURL: z.string().default(DEFAULT_BASE_URL),
+  models: z.array(modelSchema).default(ALIYUN_MODELS),
+  reasoning: z.union(THINKING_LEVELS),
+  headers: z.dict(z.string()),
+})
+
+/**
+ * Resolve this route's credential reference for one request.
+ *
+ * The reference is resolved through the harness credential seam, which reads
+ * the managed credential document and the launching environment. A reference
+ * that resolves to nothing fails the request before any network I/O, naming
+ * the reference to store — the alternative, sending no key, turns a
+ * configuration mistake into an opaque upstream 401.
+ *
+ * @param {import('@deepseek-ai/cordis').Context} ctx - the plugin context.
+ * @returns {(provider: string, profile: object) => Promise<string | undefined>} the resolver.
+ */
+function apiKeyResolver(ctx) {
+  return async (provider, profile) => {
+    const ref = profile.apiKeyEnv
+    if (ref === undefined) return undefined
+    const credentials = ctx.get('credentials')
+    const hit = credentials === undefined ? undefined : (await credentials.resolve(ref))?.value
+    if (hit !== undefined && hit.length > 0) return hit
+    throw new LlmError(
+      `llm-aliyun: no credential for provider route "${provider}"; its profile resolves ${ref}, which is not set — store ${ref} through the credentials service (the Web Models page writes it) or export it in the launching environment`,
+      'MISSING_CREDENTIAL',
+    )
+  }
+}
+
+/**
+ * Mount the route.
+ *
+ * @param {import('@deepseek-ai/cordis').Context} ctx - the plugin context.
+ * @param {object} config - the resolved {@link Config}.
+ */
+export function apply(ctx, config) {
+  // The settings namespace is the entry id, so the Models page addresses this
+  // plugin's own row rather than any other adapter's section.
+  const settingsNs = ctx.fiber?.entry?.options.id ?? name
+
+  const adapter = createAliyunAdapter({
+    displayName: config.displayName,
+    apiKeyEnv: config.apiKeyEnv,
+    baseURL: config.baseURL,
+    models: config.models,
+    reasoning: config.reasoning,
+    headers: config.headers,
+    resolveApiKey: apiKeyResolver(ctx),
+    resolveAttachments: () => ctx.get('attachments'),
+    resolveImageAccess: (attachments, ref) => resolveImageAttachmentAccess(
+      attachments,
+      (hostPath) => ctx.get('fs')?.processPathFromHostPath(hostPath),
+      ref,
+    ),
+    onReplayDegrade: ({ provider, model, reason }) => {
+      ctx.logger?.warn?.(`llm-aliyun: unusable replay state on assistant history for route "${provider}/${model}"; sending that message as provider-neutral content (${reason})`)
+    },
+  })
+
+  // Both registrations are disposed with the plugin's fiber.
+  ctx.llm.registerAdapter([ROUTE], adapter)
+
+  // The directory entry is what gives the route a row on the Models page, and
+  // with it the API-key field. It is refused if another adapter already
+  // declares `aliyun` — which is what happens when a profile still configures
+  // an `aliyun` route through `llm-pi-ai`; remove that route to use this plugin.
+  ctx.llm.registerConfigurableProviders([{
+    provider: ROUTE,
+    displayName: config.displayName,
+    settingsNs,
+    settingsPath: [],
+    declared: true,
+  }])
+}

package/lib/models.js

@@ -0,0 +1,48 @@
+/**
+ * Turn shipped catalog entries into the pi-ai model descriptors the adapter
+ * dispatches with.
+ *
+ * A catalog entry states only model facts; everything deployment-specific —
+ * the route it belongs to, the endpoint, the protocol, the compatibility
+ * switches — is supplied here from configuration. That split is what lets the
+ * catalog stay a plain data file that a script or a human can update without
+ * knowing anything about pi-ai.
+ */
+
+/** Aliyun bills per token; the harness's cost surfaces are not fed from here. */
+const NO_COST = Object.freeze({ input: 0, output: 0, cacheRead: 0, cacheWrite: 0 })
+
+/**
+ * Materialize one route's models.
+ *
+ * @param {object} input - catalog and route facts.
+ * @param {readonly import('./catalog.js').AliyunModel[]} input.catalog - shipped entries.
+ * @param {string} input.provider - route name every model is stamped with.
+ * @param {string} input.baseUrl - endpoint every model is stamped with.
+ * @param {Record<string, unknown>} input.compat - compatibility switches to copy onto each model.
+ * @returns {object[]} pi-ai model descriptors.
+ */
+export function materializeModels({ catalog, provider, baseUrl, compat }) {
+  return catalog.map((entry) => {
+    const reasoning = entry.reasoning === true
+    return {
+      id: entry.id,
+      name: entry.name,
+      api: 'openai-completions',
+      provider,
+      baseUrl,
+      reasoning,
+      input: [...entry.input],
+      cost: { ...NO_COST },
+      contextWindow: entry.contextWindow,
+      maxTokens: entry.maxTokens,
+      // Only a thinking model carries a level map. pi-ai reads an absent map as
+      // "no levels beyond off", and a model declared non-reasoning must not
+      // advertise levels a selector would then offer.
+      ...reasoning && entry.thinkingLevelMap !== undefined
+        ? { thinkingLevelMap: { ...entry.thinkingLevelMap } }
+        : {},
+      compat: { ...compat },
+    }
+  })
+}

package/lib/provider.js

@@ -0,0 +1,53 @@
+/**
+ * Build the pi-ai `Provider` the adapter registers for this route.
+ *
+ * The shape is pi-ai's own provider interface: an id, an endpoint, an auth
+ * descriptor, and the protocol implementation every model on the route
+ * dispatches through. It mirrors what `@deepseek-ai/dsh-llm-pi-ai` constructs
+ * for a route pi-ai ships no catalog for.
+ */
+
+/**
+ * Api-key auth for a route the harness authenticates itself.
+ *
+ * The harness resolves the route's credential reference before the request
+ * enters pi-ai and passes the key as the stream's `apiKey` option, which pi-ai
+ * treats as the highest-priority override. This descriptor is therefore only
+ * the fallback pi-ai consults when that option is absent — it deliberately
+ * reports no key rather than inventing one, so a missing credential stays the
+ * harness's loud failure instead of becoming a confusing upstream 401.
+ *
+ * @param {string} name - label used as the resolution's status name.
+ * @returns {object} pi-ai api-key auth.
+ */
+function harnessApiKeyAuth(name) {
+  return {
+    name,
+    resolve: ({ credential }) => Promise.resolve({
+      auth: credential?.key === undefined ? {} : { apiKey: credential.key },
+    }),
+  }
+}
+
+/**
+ * Construct one static, single-protocol provider.
+ *
+ * @param {object} input - route identity and dispatch.
+ * @param {string} input.id - route name.
+ * @param {string} input.name - display name.
+ * @param {string} input.baseUrl - endpoint every model on the route uses.
+ * @param {object[]} input.models - pi-ai model descriptors.
+ * @param {object} input.api - pi-ai protocol implementation.
+ * @returns {object} the pi-ai provider.
+ */
+export function createPiProvider({ id, name, baseUrl, models, api }) {
+  return {
+    id,
+    name,
+    baseUrl,
+    auth: { apiKey: harnessApiKeyAuth(name) },
+    getModels: () => models,
+    stream: (model, context, options) => api.stream(model, context, options),
+    streamSimple: (model, context, options) => api.streamSimple(model, context, options),
+  }
+}

package/package.json

@@ -0,0 +1,85 @@
+{
+  "name": "@doitian/dsh-provider-aliyun",
+  "version": "0.1.0",
+  "description": "Aliyun DashScope (Bailian) model provider for DeepSeek Harness: registers an `aliyun` route carrying the Qwen model catalog, so the model list ships in the package instead of a profile.",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "dsh-bundle",
+    "deepseek-harness",
+    "aliyun",
+    "aliyuncs",
+    "dashscope",
+    "bailian",
+    "qwen",
+    "llm",
+    "provider"
+  ],
+  "license": "MIT",
+  "author": "doitian",
+  "homepage": "https://github.com/doitian/dsh-provider-aliyun#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/doitian/dsh-provider-aliyun.git"
+  },
+  "bugs": {
+    "url": "https://github.com/doitian/dsh-provider-aliyun/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./catalog": "./lib/catalog.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/adapter.js",
+    "lib/catalog.js",
+    "lib/models.js",
+    "lib/provider.js",
+    "cordis.patch.yml"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "validate": "node scripts/validate.mjs",
+    "test": "node --test",
+    "prepack": "npm run validate && npm run test"
+  },
+  "dependencies": {
+    "@earendil-works/pi-ai": "^0.87.1"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.0-rc.2",
+    "@deepseek-ai/schemastery": "~3.18.4"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.4",
+    "@deepseek-ai/dsh-attachment": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-authorization": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-brand": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-timeout": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.2.0-rc.2",
+    "@deepseek-ai/schemastery": "3.18.4",
+    "@earendil-works/pi-ai": "0.87.1",
+    "js-yaml": "^4.1.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  }
+}