@gajae-code/ai 0.12.2 → 0.12.5

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [0.12.5] - 2026-07-30
+### Fixed
+
+- Alibaba Token Plan requests now carry Qwen Code's canonical DashScope request fingerprint on both transports. The built-in `alibaba-token-plan` provider (openai-responses `qwen3.8-max-preview` and openai-completions `glm-5.2`/`deepseek-v4-pro`) now emits the four upstream identity/cache/auth headers (`User-Agent`, `X-DashScope-CacheControl: enable`, `X-DashScope-UserAgent`, `X-DashScope-AuthType: openai`) matching `QwenLM/qwen-code` v0.21.1 (commit `f4cd6e1`) exactly, via a shared helper. DashScope is compatibility-sensitive to this client fingerprint, so a non-identical set can cause request instability and affect first-event latency. Caller headers still win per key (upstream `{...default, ...customHeaders}` precedence); non-Alibaba providers are byte-unchanged (#3557).
+
+### Added
+
+- Reproducible Alibaba Token Plan header-parity A/B latency benchmark (`packages/ai/scripts/alibaba-token-plan-latency-ab.ts`): a fixed-seed interleaved A/B comparison of legacy vs Qwen-identical headers against a deterministic local HTTP server, reporting n/success/error/timeout and TTFT/total latency median/p90/p95/mean/stddev. No live credentials are required; a public-safe blocked-live-data receipt is included (`packages/ai/test/fixtures/alibaba-token-plan-latency-blocked-receipt.md`) (#3557).
+
+
+## [0.12.4] - 2026-07-30
+
+### Fixed
+
+- Mara Cloud login now validates pasted credentials against the authenticated chat-completions endpoint instead of the public `/v1/models` catalog. The catalog returns `200` even for random invalid bearer tokens, so the previous check could persist unusable keys.
+
+## [0.12.3] - 2026-07-30
+
+### Added
+
+- Added first-class support for **Mara Cloud**, an OpenAI-compatible enterprise AI inference platform. Registers the `mara` provider descriptor, `/login` entry (API-key paste validated against `https://api.cloud.mara.com/v1/models`), `MARA_API_KEY` environment resolution, and bundled `models.json` seed models. Models are discovered dynamically from `GET /v1/models` (base URL `https://api.cloud.mara.com/v1`).
+
 ## [0.12.2] - 2026-07-30
 
 ## [0.12.1] - 2026-07-29

package/README.md

@@ -71,6 +71,7 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 - **ZenMux** (requires `ZENMUX_API_KEY`)
 - **OpenGateway by Sionic AI** (requires `OPENGATEWAY_API_KEY`)
 - **BizRouter** (requires `BIZROUTER_API_KEY`)
+- **Mara Cloud** (requires `MARA_API_KEY`)
 - **Qwen Portal** (supports `QWEN_OAUTH_TOKEN` or `QWEN_PORTAL_API_KEY`)
 - **Cloudflare AI Gateway** (requires `CLOUDFLARE_AI_GATEWAY_API_KEY` and provider-specific gateway base URL)
 - **Ollama** (local OpenAI-compatible runtime; optional `OLLAMA_API_KEY`)
@@ -958,6 +959,7 @@ In Node.js environments, you can set environment variables to avoid passing API
 | ZenMux         | `ZENMUX_API_KEY`                                                             |
 | OpenGateway    | `OPENGATEWAY_API_KEY`                                                        |
 | BizRouter      | `BIZROUTER_API_KEY`                                                          |
+| Mara Cloud     | `MARA_API_KEY`                                                               |
 | vLLM           | `VLLM_API_KEY`                                                               |
 | Cloudflare AI Gateway | `CLOUDFLARE_AI_GATEWAY_API_KEY`                                      |
 | GitHub Copilot | `COPILOT_GITHUB_TOKEN` or `GH_TOKEN` or `GITHUB_TOKEN`                      |
@@ -983,6 +985,7 @@ Provider endpoint defaults for the current OpenAI-compatible integrations:
 - ZenMux (Anthropic models): `https://zenmux.ai/api/anthropic`
 - OpenGateway by Sionic AI: `https://apis.opengateway.ai/v1`
 - BizRouter: `https://api.bizrouter.ai/v1`
+- Mara Cloud: `https://api.cloud.mara.com/v1`
 - vLLM: `http://127.0.0.1:8000/v1`
 - Ollama: local OpenAI-compatible runtime (`http://127.0.0.1:11434/v1`)
 - Ollama Cloud: native Ollama API host (`https://ollama.com/api`, configured here as base URL `https://ollama.com`)

package/dist/types/provider-models/openai-compat.d.ts

@@ -128,6 +128,15 @@ export interface BizRouterModelManagerConfig {
     baseUrl?: string;
 }
 export declare function bizrouterModelManagerOptions(config?: BizRouterModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export interface MaraModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+}
+/**
+ * Mara Cloud — an OpenAI-compatible enterprise AI inference platform. Models
+ * are discovered from the OpenAI-compatible `/v1/models` endpoint.
+ */
+export declare function maraModelManagerOptions(config?: MaraModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface KiloModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/providers/dashscope-token-plan-headers.d.ts

@@ -0,0 +1,57 @@
+/**
+ * DashScope Token Plan canonical request headers.
+ *
+ * Reproduces QwenLM/qwen-code's DashScopeOpenAICompatibleProvider.buildHeaders()
+ * defaultHeaders so the built-in `alibaba-token-plan` provider emits the same
+ * client identity / cache / auth-type fingerprint upstream sends. DashScope is
+ * compatibility-sensitive to this fingerprint; a non-identical set can cause
+ * request instability and affect first-event latency (gajae-code #3557).
+ *
+ * Upstream pin (reproduce EXACTLY here):
+ *   Repository:    QwenLM/qwen-code
+ *   Commit:        f4cd6e1d8bbb1c24e7e5d1a40187d8e28aa7c4fb
+ *   Version:       0.21.1
+ *   Source:        packages/core/src/core/openaiContentGenerator/provider/dashscope.ts
+ *   buildHeaders():
+ *     const userAgent = `QwenCode/${version} (${process.platform}; ${process.arch})`;
+ *     const defaultHeaders = {
+ *       'User-Agent': userAgent,
+ *       'X-DashScope-CacheControl': 'enable',
+ *       'X-DashScope-UserAgent': userAgent,
+ *       'X-DashScope-AuthType': authType,
+ *     };
+ *     return customHeaders ? { ...defaultHeaders, ...customHeaders } : defaultHeaders;
+ *
+ * The Token Plan preset authenticates with AuthType.USE_OPENAI ('openai'), so
+ * X-DashScope-AuthType is the constant 'openai'. Pin the version so an upstream
+ * bump is an explicit parity update rather than silent drift.
+ */
+export declare const QWEN_CODE_UPSTREAM_REPO = "QwenLM/qwen-code";
+export declare const QWEN_CODE_UPSTREAM_COMMIT = "f4cd6e1d8bbb1c24e7e5d1a40187d8e28aa7c4fb";
+export declare const QWEN_CODE_UPSTREAM_VERSION = "0.21.1";
+/**
+ * The Qwen Code CLI version string used in identity headers. Pinned to the
+ * upstream version at {@link QWEN_CODE_UPSTREAM_COMMIT}; change both together
+ * as an explicit parity update.
+ */
+export declare function qwenCodeUserAgent(version?: string): string;
+/**
+ * Canonical DashScope Token Plan headers (upstream defaultHeaders, no caller
+ * overrides applied). Exposed for tests/fixtures so the pinned wire set lives
+ * in exactly one place.
+ */
+export declare function dashscopeTokenPlanDefaultHeaders(version?: string): Readonly<Record<string, string>>;
+/**
+ * Merge canonical DashScope Token Plan identity headers onto a caller's header
+ * map, reproducing upstream buildHeaders() precedence EXACTLY:
+ *   `{ ...defaultHeaders, ...customHeaders }` — caller wins per header.
+ *
+ * This mirrors GJC's existing kimi-code injection order
+ * (`headers = { ...getKimiCommonHeaders(), ...headers }`): canonical identity as
+ * the base, caller-supplied headers overriding individual keys. A caller that
+ * pins `User-Agent` takes that key; the other canonicals still apply.
+ *
+ * A null/undefined `callerHeaders` returns the canonical set alone (upstream
+ * `customHeaders ? {...} : defaultHeaders` shortcut).
+ */
+export declare function mergeDashScopeTokenPlanHeaders(callerHeaders: Record<string, string> | undefined, version?: string): Record<string, string>;

package/dist/types/types.d.ts

@@ -51,7 +51,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
+export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "mara" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
 export type Provider = KnownProvider | string;
 import type { Effort } from "./model-thinking";
 /** Token budgets for each thinking level (token-based providers only) */

package/dist/types/utils/oauth/mara.d.ts

@@ -0,0 +1 @@
+export declare const loginMara: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
+export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.12.2",
+	"version": "0.12.5",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.12.2",
+		"@gajae-code/utils": "0.12.5",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-storage.ts

@@ -2042,6 +2042,12 @@ export class AuthStorage {
 				await saveApiKeyCredential(apiKey);
 				return;
 			}
+			case "mara": {
+				const { loginMara } = await import("./utils/oauth/mara");
+				const apiKey = await loginMara(ctrl);
+				await saveApiKeyCredential(apiKey);
+				return;
+			}
 			case "opengateway": {
 				const { loginOpenGateway } = await import("./utils/oauth/opengateway");
 				const apiKey = await loginOpenGateway(ctrl);

package/src/cli.ts

@@ -120,6 +120,7 @@ Providers:
   zenmux            ZenMux
   opengateway       OpenGateway by Sionic AI
   bizrouter         BizRouter
+  mara              Mara Cloud
   ollama-cloud      Ollama Cloud
 
 Examples:

package/src/models.json

@@ -39882,6 +39882,94 @@
 			"maxTokens": 8888
 		}
 	},
+	"mara": {
+		"DeepSeek-V3.1": {
+			"id": "DeepSeek-V3.1",
+			"name": "DeepSeek V3.1",
+			"api": "openai-completions",
+			"provider": "mara",
+			"baseUrl": "https://api.cloud.mara.com/v1",
+			"reasoning": true,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0.6,
+				"output": 1.7,
+				"cacheRead": 0,
+				"cacheWrite": 0
+			},
+			"contextWindow": 131072,
+			"maxTokens": 16384,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		},
+		"MiniMax-M2.5": {
+			"id": "MiniMax-M2.5",
+			"name": "MiniMax M2.5",
+			"api": "openai-completions",
+			"provider": "mara",
+			"baseUrl": "https://api.cloud.mara.com/v1",
+			"reasoning": false,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0.3,
+				"output": 1.2,
+				"cacheRead": 0,
+				"cacheWrite": 0
+			},
+			"contextWindow": 196608,
+			"maxTokens": 16384
+		},
+		"MiniMax-M2.7": {
+			"id": "MiniMax-M2.7",
+			"name": "MiniMax M2.7",
+			"api": "openai-completions",
+			"provider": "mara",
+			"baseUrl": "https://api.cloud.mara.com/v1",
+			"reasoning": false,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0.3,
+				"output": 1.2,
+				"cacheRead": 0,
+				"cacheWrite": 0
+			},
+			"contextWindow": 196608,
+			"maxTokens": 16384
+		},
+		"gpt-oss-120b": {
+			"id": "gpt-oss-120b",
+			"name": "GPT OSS 120B",
+			"api": "openai-completions",
+			"provider": "mara",
+			"baseUrl": "https://api.cloud.mara.com/v1",
+			"reasoning": true,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0.15,
+				"output": 0.75,
+				"cacheRead": 0,
+				"cacheWrite": 0
+			},
+			"contextWindow": 131072,
+			"maxTokens": 16384,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		}
+	},
 	"minimax": {
 		"MiniMax-M2": {
 			"id": "MiniMax-M2",
@@ -85423,4 +85511,4 @@
 			}
 		}
 	}
-}
+}

package/src/provider-models/descriptors.ts

@@ -26,6 +26,7 @@ import {
 	kimiCodeModelManagerOptions,
 	litellmModelManagerOptions,
 	lmStudioModelManagerOptions,
+	maraModelManagerOptions,
 	mistralModelManagerOptions,
 	moonshotModelManagerOptions,
 	nanoGptModelManagerOptions,
@@ -326,6 +327,12 @@ export const PROVIDER_DESCRIPTORS: readonly ProviderDescriptor[] = [
 		config => bizrouterModelManagerOptions(config),
 		catalog("BizRouter", ["BIZROUTER_API_KEY"]),
 	),
+	catalogDescriptor(
+		"mara",
+		"DeepSeek-V3.1",
+		config => maraModelManagerOptions(config),
+		catalog("Mara Cloud", ["MARA_API_KEY"]),
+	),
 	catalogDescriptor("zai", "glm-5.2", config => zaiModelManagerOptions(config), catalog("zAI", ["ZAI_API_KEY"])),
 	catalogDescriptor(
 		"glm-zcode",

package/src/provider-models/openai-compat.ts

@@ -1180,6 +1180,22 @@ export function bizrouterModelManagerOptions(
 	};
 }
 
+// ---------------------------------------------------------------------------
+// 10.5.3 Mara Cloud
+// ---------------------------------------------------------------------------
+
+export interface MaraModelManagerConfig {
+	apiKey?: string;
+	baseUrl?: string;
+}
+
+/**
+ * Mara Cloud — an OpenAI-compatible enterprise AI inference platform. Models
+ * are discovered from the OpenAI-compatible `/v1/models` endpoint.
+ */
+export function maraModelManagerOptions(config?: MaraModelManagerConfig): ModelManagerOptions<"openai-completions"> {
+	return createSimpleOpenAICompletionsOptions("mara", "https://api.cloud.mara.com/v1", config);
+}
 // ---------------------------------------------------------------------------
 // 10.6 Kilo Gateway
 // ---------------------------------------------------------------------------

package/src/providers/dashscope-token-plan-headers.ts

@@ -0,0 +1,84 @@
+/**
+ * DashScope Token Plan canonical request headers.
+ *
+ * Reproduces QwenLM/qwen-code's DashScopeOpenAICompatibleProvider.buildHeaders()
+ * defaultHeaders so the built-in `alibaba-token-plan` provider emits the same
+ * client identity / cache / auth-type fingerprint upstream sends. DashScope is
+ * compatibility-sensitive to this fingerprint; a non-identical set can cause
+ * request instability and affect first-event latency (gajae-code #3557).
+ *
+ * Upstream pin (reproduce EXACTLY here):
+ *   Repository:    QwenLM/qwen-code
+ *   Commit:        f4cd6e1d8bbb1c24e7e5d1a40187d8e28aa7c4fb
+ *   Version:       0.21.1
+ *   Source:        packages/core/src/core/openaiContentGenerator/provider/dashscope.ts
+ *   buildHeaders():
+ *     const userAgent = `QwenCode/${version} (${process.platform}; ${process.arch})`;
+ *     const defaultHeaders = {
+ *       'User-Agent': userAgent,
+ *       'X-DashScope-CacheControl': 'enable',
+ *       'X-DashScope-UserAgent': userAgent,
+ *       'X-DashScope-AuthType': authType,
+ *     };
+ *     return customHeaders ? { ...defaultHeaders, ...customHeaders } : defaultHeaders;
+ *
+ * The Token Plan preset authenticates with AuthType.USE_OPENAI ('openai'), so
+ * X-DashScope-AuthType is the constant 'openai'. Pin the version so an upstream
+ * bump is an explicit parity update rather than silent drift.
+ */
+export const QWEN_CODE_UPSTREAM_REPO = "QwenLM/qwen-code";
+export const QWEN_CODE_UPSTREAM_COMMIT = "f4cd6e1d8bbb1c24e7e5d1a40187d8e28aa7c4fb";
+export const QWEN_CODE_UPSTREAM_VERSION = "0.21.1";
+
+// Upstream Token Plan preset uses AuthType.USE_OPENAI = 'openai'.
+const QWEN_CODE_TOKEN_PLAN_AUTH_TYPE = "openai";
+
+/**
+ * The Qwen Code CLI version string used in identity headers. Pinned to the
+ * upstream version at {@link QWEN_CODE_UPSTREAM_COMMIT}; change both together
+ * as an explicit parity update.
+ */
+export function qwenCodeUserAgent(version: string = QWEN_CODE_UPSTREAM_VERSION): string {
+	// process.platform / process.arch are read verbatim, matching upstream
+	// (e.g. "linux", "darwin", "win32"; "x64", "arm64"). No normalization.
+	return `QwenCode/${version} (${process.platform}; ${process.arch})`;
+}
+
+/**
+ * Canonical DashScope Token Plan headers (upstream defaultHeaders, no caller
+ * overrides applied). Exposed for tests/fixtures so the pinned wire set lives
+ * in exactly one place.
+ */
+export function dashscopeTokenPlanDefaultHeaders(
+	version: string = QWEN_CODE_UPSTREAM_VERSION,
+): Readonly<Record<string, string>> {
+	const userAgent = qwenCodeUserAgent(version);
+	return Object.freeze({
+		"User-Agent": userAgent,
+		"X-DashScope-CacheControl": "enable",
+		"X-DashScope-UserAgent": userAgent,
+		"X-DashScope-AuthType": QWEN_CODE_TOKEN_PLAN_AUTH_TYPE,
+	});
+}
+
+/**
+ * Merge canonical DashScope Token Plan identity headers onto a caller's header
+ * map, reproducing upstream buildHeaders() precedence EXACTLY:
+ *   `{ ...defaultHeaders, ...customHeaders }` — caller wins per header.
+ *
+ * This mirrors GJC's existing kimi-code injection order
+ * (`headers = { ...getKimiCommonHeaders(), ...headers }`): canonical identity as
+ * the base, caller-supplied headers overriding individual keys. A caller that
+ * pins `User-Agent` takes that key; the other canonicals still apply.
+ *
+ * A null/undefined `callerHeaders` returns the canonical set alone (upstream
+ * `customHeaders ? {...} : defaultHeaders` shortcut).
+ */
+export function mergeDashScopeTokenPlanHeaders(
+	callerHeaders: Record<string, string> | undefined,
+	version: string = QWEN_CODE_UPSTREAM_VERSION,
+): Record<string, string> {
+	const defaults = dashscopeTokenPlanDefaultHeaders(version);
+	if (!callerHeaders) return { ...defaults };
+	return { ...defaults, ...callerHeaders };
+}

package/src/providers/openai-codex-responses.ts

@@ -43,6 +43,7 @@ import {
 	createOpenAIResponsesHistoryPayload,
 	getOpenAIResponsesHistoryItems,
 	getOpenAIResponsesHistoryPayload,
+	neutralizeReservedControlTokens,
 	neutralizeResponsesInputControlTokens,
 	normalizeSystemPrompts,
 	sanitizeOpenAIResponsesHistoryItemsForReplay,
@@ -746,7 +747,12 @@ async function buildTransformedCodexRequestBody(
 		}
 	}
 
-	const systemPrompts = normalizeSystemPrompts(context.systemPrompt);
+	// Neutralize leaked Harmony control tokens in the system prompt too:
+	// `params.instructions` and the developer messages prepended inside
+	// `transformRequestBody` bypass the `input` sanitizer above, so a poisoned
+	// system prompt rejects every turn with
+	// `Request blocked (code=invalid_prompt)`.
+	const systemPrompts = normalizeSystemPrompts(context.systemPrompt).map(neutralizeReservedControlTokens);
 	if (systemPrompts.length > 0) {
 		params.instructions = systemPrompts[0];
 	}

package/src/providers/openai-completions.ts

@@ -68,6 +68,7 @@ import {
 	resolveToolChoice,
 } from "../utils/tool-choice-capability";
 import { COMPOSER_EDIT_DISCIPLINE_PROMPT, isComposerHarnessModel } from "./composer-discipline";
+import { mergeDashScopeTokenPlanHeaders } from "./dashscope-token-plan-headers";
 import {
 	buildCopilotDynamicHeaders,
 	hasCopilotVisionInput,
@@ -1071,6 +1072,14 @@ async function createClient(
 	if (model.provider === "kimi-code") {
 		headers = { ...getKimiCommonHeaders(), ...headers };
 	}
+	if (model.provider === "alibaba-token-plan") {
+		// Emit Qwen Code's canonical DashScope request fingerprint (User-Agent /
+		// X-DashScope-CacheControl / X-DashScope-UserAgent / X-DashScope-AuthType)
+		// so DashScope treats the caller identically to upstream QwenLM/qwen-code.
+		// Canonical identity is the base; caller headers win per key (upstream
+		// `{...default, ...customHeaders}`). #3557.
+		headers = mergeDashScopeTokenPlanHeaders(headers);
+	}
 	headers = applyOpenAIRequestTransformHeaders(headers, model.requestTransform, `Gajae-Code/${packageJson.version}`);
 	let copilotPremiumRequests: number | undefined;
 

package/src/providers/openai-responses.ts

@@ -27,6 +27,7 @@ import {
 	getOpenAIResponsesHistoryItems,
 	getOpenAIResponsesHistoryPayload,
 	isInvalidPromptError,
+	neutralizeReservedControlTokens,
 	neutralizeResponsesInputControlTokens,
 	normalizeSystemPrompts,
 	resolveCacheRetention,
@@ -60,6 +61,7 @@ import {
 	resolveToolChoice,
 } from "../utils/tool-choice-capability";
 import { COMPOSER_EDIT_DISCIPLINE_PROMPT, isComposerHarnessModel } from "./composer-discipline";
+import { mergeDashScopeTokenPlanHeaders } from "./dashscope-token-plan-headers";
 import {
 	buildCopilotDynamicHeaders,
 	hasCopilotVisionInput,
@@ -446,8 +448,17 @@ function createClient(
 	}
 	const rawApiKey = apiKey;
 
+	const baseHeaders =
+		model.provider === "alibaba-token-plan"
+			? // Emit Qwen Code's canonical DashScope request fingerprint (User-Agent /
+				// X-DashScope-CacheControl / X-DashScope-UserAgent / X-DashScope-AuthType)
+				// so DashScope treats the caller identically to upstream QwenLM/qwen-code.
+				// Canonical identity is the base; caller headers win per key (upstream
+				// `{...default, ...customHeaders}`). #3557.
+				mergeDashScopeTokenPlanHeaders({ ...(model.headers ?? {}), ...(extraHeaders ?? {}) })
+			: { ...(model.headers ?? {}), ...(extraHeaders ?? {}) };
 	const headers = applyOpenAIRequestTransformHeaders(
-		{ ...(model.headers ?? {}), ...(extraHeaders ?? {}) },
+		baseHeaders,
 		model.requestTransform,
 		`Gajae-Code/${packageJson.version}`,
 	);
@@ -523,7 +534,13 @@ function buildParams(
 	);
 	const messages: ResponseInput = neutralizeResponsesInputControlTokens(conversationMessages);
 
-	const systemPrompts = normalizeSystemPrompts(context.systemPrompt);
+	// Neutralize leaked Harmony control tokens in the system prompt too: the
+	// `instructions` field and developer-role messages bypass the `input`
+	// request-boundary sanitizer above, and a poisoned system prompt (e.g.
+	// injected project context quoting `<|channel|>` markers) rejects EVERY
+	// turn with `Request blocked (code=invalid_prompt)` — unrepairable by the
+	// history circuit breaker.
+	const systemPrompts = normalizeSystemPrompts(context.systemPrompt).map(neutralizeReservedControlTokens);
 	if (isComposerHarnessModel(model.id)) {
 		systemPrompts.unshift(COMPOSER_EDIT_DISCIPLINE_PROMPT);
 	}

package/src/stream.ts

@@ -164,6 +164,7 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 	zenmux: "ZENMUX_API_KEY",
 	opengateway: "OPENGATEWAY_API_KEY",
 	bizrouter: "BIZROUTER_API_KEY",
+	mara: "MARA_API_KEY",
 	venice: "VENICE_API_KEY",
 	vllm: "VLLM_API_KEY",
 	xiaomi: "XIAOMI_API_KEY",

package/src/types.ts

@@ -149,6 +149,7 @@ export type KnownProvider =
 	| "opencode-zen"
 	| "opengateway"
 	| "bizrouter"
+	| "mara"
 	| "synthetic"
 	| "cloudflare-ai-gateway"
 	| "huggingface"

package/src/utils/oauth/index.ts

@@ -245,6 +245,11 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "BizRouter",
 		available: true,
 	},
+	{
+		id: "mara",
+		name: "Mara Cloud",
+		available: true,
+	},
 	{
 		id: "opengateway",
 		name: "OpenGateway by Sionic AI",
@@ -393,6 +398,7 @@ export async function refreshOAuthToken(
 		case "moonshot":
 		case "kagi":
 		case "cloudflare-ai-gateway":
+		case "mara":
 		case "vercel-ai-gateway":
 		case "qwen-portal":
 		case "zenmux":

package/src/utils/oauth/mara.ts

@@ -0,0 +1,16 @@
+/** Mara Cloud login flow (API key paste, validated via chat completions). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginMara = createApiKeyLogin({
+	providerLabel: "Mara Cloud",
+	authUrl: "https://cloud.mara.com/apis",
+	instructions: "Create or copy your Mara Cloud API key",
+	promptMessage: "Paste your Mara Cloud API key",
+	placeholder: "<your-mara-api-key>",
+	validation: {
+		kind: "chat-completions",
+		provider: "Mara Cloud",
+		baseUrl: "https://api.cloud.mara.com/v1",
+		model: "DeepSeek-V3.1",
+	},
+});

package/src/utils/oauth/types.ts

@@ -12,6 +12,7 @@ export type OAuthProvider =
 	| "alibaba-token-plan"
 	| "anthropic"
 	| "bizrouter"
+	| "mara"
 	| "cerebras"
 	| "cloudflare-ai-gateway"
 	| "cursor"