@gajae-code/ai 0.12.4 → 0.12.5

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [0.12.5] - 2026-07-30
+### Fixed
+
+- Alibaba Token Plan requests now carry Qwen Code's canonical DashScope request fingerprint on both transports. The built-in `alibaba-token-plan` provider (openai-responses `qwen3.8-max-preview` and openai-completions `glm-5.2`/`deepseek-v4-pro`) now emits the four upstream identity/cache/auth headers (`User-Agent`, `X-DashScope-CacheControl: enable`, `X-DashScope-UserAgent`, `X-DashScope-AuthType: openai`) matching `QwenLM/qwen-code` v0.21.1 (commit `f4cd6e1`) exactly, via a shared helper. DashScope is compatibility-sensitive to this client fingerprint, so a non-identical set can cause request instability and affect first-event latency. Caller headers still win per key (upstream `{...default, ...customHeaders}` precedence); non-Alibaba providers are byte-unchanged (#3557).
+
+### Added
+
+- Reproducible Alibaba Token Plan header-parity A/B latency benchmark (`packages/ai/scripts/alibaba-token-plan-latency-ab.ts`): a fixed-seed interleaved A/B comparison of legacy vs Qwen-identical headers against a deterministic local HTTP server, reporting n/success/error/timeout and TTFT/total latency median/p90/p95/mean/stddev. No live credentials are required; a public-safe blocked-live-data receipt is included (`packages/ai/test/fixtures/alibaba-token-plan-latency-blocked-receipt.md`) (#3557).
+
+
 ## [0.12.4] - 2026-07-30
 
 ### Fixed

package/dist/types/providers/dashscope-token-plan-headers.d.ts

@@ -0,0 +1,57 @@
+/**
+ * DashScope Token Plan canonical request headers.
+ *
+ * Reproduces QwenLM/qwen-code's DashScopeOpenAICompatibleProvider.buildHeaders()
+ * defaultHeaders so the built-in `alibaba-token-plan` provider emits the same
+ * client identity / cache / auth-type fingerprint upstream sends. DashScope is
+ * compatibility-sensitive to this fingerprint; a non-identical set can cause
+ * request instability and affect first-event latency (gajae-code #3557).
+ *
+ * Upstream pin (reproduce EXACTLY here):
+ *   Repository:    QwenLM/qwen-code
+ *   Commit:        f4cd6e1d8bbb1c24e7e5d1a40187d8e28aa7c4fb
+ *   Version:       0.21.1
+ *   Source:        packages/core/src/core/openaiContentGenerator/provider/dashscope.ts
+ *   buildHeaders():
+ *     const userAgent = `QwenCode/${version} (${process.platform}; ${process.arch})`;
+ *     const defaultHeaders = {
+ *       'User-Agent': userAgent,
+ *       'X-DashScope-CacheControl': 'enable',
+ *       'X-DashScope-UserAgent': userAgent,
+ *       'X-DashScope-AuthType': authType,
+ *     };
+ *     return customHeaders ? { ...defaultHeaders, ...customHeaders } : defaultHeaders;
+ *
+ * The Token Plan preset authenticates with AuthType.USE_OPENAI ('openai'), so
+ * X-DashScope-AuthType is the constant 'openai'. Pin the version so an upstream
+ * bump is an explicit parity update rather than silent drift.
+ */
+export declare const QWEN_CODE_UPSTREAM_REPO = "QwenLM/qwen-code";
+export declare const QWEN_CODE_UPSTREAM_COMMIT = "f4cd6e1d8bbb1c24e7e5d1a40187d8e28aa7c4fb";
+export declare const QWEN_CODE_UPSTREAM_VERSION = "0.21.1";
+/**
+ * The Qwen Code CLI version string used in identity headers. Pinned to the
+ * upstream version at {@link QWEN_CODE_UPSTREAM_COMMIT}; change both together
+ * as an explicit parity update.
+ */
+export declare function qwenCodeUserAgent(version?: string): string;
+/**
+ * Canonical DashScope Token Plan headers (upstream defaultHeaders, no caller
+ * overrides applied). Exposed for tests/fixtures so the pinned wire set lives
+ * in exactly one place.
+ */
+export declare function dashscopeTokenPlanDefaultHeaders(version?: string): Readonly<Record<string, string>>;
+/**
+ * Merge canonical DashScope Token Plan identity headers onto a caller's header
+ * map, reproducing upstream buildHeaders() precedence EXACTLY:
+ *   `{ ...defaultHeaders, ...customHeaders }` — caller wins per header.
+ *
+ * This mirrors GJC's existing kimi-code injection order
+ * (`headers = { ...getKimiCommonHeaders(), ...headers }`): canonical identity as
+ * the base, caller-supplied headers overriding individual keys. A caller that
+ * pins `User-Agent` takes that key; the other canonicals still apply.
+ *
+ * A null/undefined `callerHeaders` returns the canonical set alone (upstream
+ * `customHeaders ? {...} : defaultHeaders` shortcut).
+ */
+export declare function mergeDashScopeTokenPlanHeaders(callerHeaders: Record<string, string> | undefined, version?: string): Record<string, string>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.12.4",
+	"version": "0.12.5",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.12.4",
+		"@gajae-code/utils": "0.12.5",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/providers/dashscope-token-plan-headers.ts

@@ -0,0 +1,84 @@
+/**
+ * DashScope Token Plan canonical request headers.
+ *
+ * Reproduces QwenLM/qwen-code's DashScopeOpenAICompatibleProvider.buildHeaders()
+ * defaultHeaders so the built-in `alibaba-token-plan` provider emits the same
+ * client identity / cache / auth-type fingerprint upstream sends. DashScope is
+ * compatibility-sensitive to this fingerprint; a non-identical set can cause
+ * request instability and affect first-event latency (gajae-code #3557).
+ *
+ * Upstream pin (reproduce EXACTLY here):
+ *   Repository:    QwenLM/qwen-code
+ *   Commit:        f4cd6e1d8bbb1c24e7e5d1a40187d8e28aa7c4fb
+ *   Version:       0.21.1
+ *   Source:        packages/core/src/core/openaiContentGenerator/provider/dashscope.ts
+ *   buildHeaders():
+ *     const userAgent = `QwenCode/${version} (${process.platform}; ${process.arch})`;
+ *     const defaultHeaders = {
+ *       'User-Agent': userAgent,
+ *       'X-DashScope-CacheControl': 'enable',
+ *       'X-DashScope-UserAgent': userAgent,
+ *       'X-DashScope-AuthType': authType,
+ *     };
+ *     return customHeaders ? { ...defaultHeaders, ...customHeaders } : defaultHeaders;
+ *
+ * The Token Plan preset authenticates with AuthType.USE_OPENAI ('openai'), so
+ * X-DashScope-AuthType is the constant 'openai'. Pin the version so an upstream
+ * bump is an explicit parity update rather than silent drift.
+ */
+export const QWEN_CODE_UPSTREAM_REPO = "QwenLM/qwen-code";
+export const QWEN_CODE_UPSTREAM_COMMIT = "f4cd6e1d8bbb1c24e7e5d1a40187d8e28aa7c4fb";
+export const QWEN_CODE_UPSTREAM_VERSION = "0.21.1";
+
+// Upstream Token Plan preset uses AuthType.USE_OPENAI = 'openai'.
+const QWEN_CODE_TOKEN_PLAN_AUTH_TYPE = "openai";
+
+/**
+ * The Qwen Code CLI version string used in identity headers. Pinned to the
+ * upstream version at {@link QWEN_CODE_UPSTREAM_COMMIT}; change both together
+ * as an explicit parity update.
+ */
+export function qwenCodeUserAgent(version: string = QWEN_CODE_UPSTREAM_VERSION): string {
+	// process.platform / process.arch are read verbatim, matching upstream
+	// (e.g. "linux", "darwin", "win32"; "x64", "arm64"). No normalization.
+	return `QwenCode/${version} (${process.platform}; ${process.arch})`;
+}
+
+/**
+ * Canonical DashScope Token Plan headers (upstream defaultHeaders, no caller
+ * overrides applied). Exposed for tests/fixtures so the pinned wire set lives
+ * in exactly one place.
+ */
+export function dashscopeTokenPlanDefaultHeaders(
+	version: string = QWEN_CODE_UPSTREAM_VERSION,
+): Readonly<Record<string, string>> {
+	const userAgent = qwenCodeUserAgent(version);
+	return Object.freeze({
+		"User-Agent": userAgent,
+		"X-DashScope-CacheControl": "enable",
+		"X-DashScope-UserAgent": userAgent,
+		"X-DashScope-AuthType": QWEN_CODE_TOKEN_PLAN_AUTH_TYPE,
+	});
+}
+
+/**
+ * Merge canonical DashScope Token Plan identity headers onto a caller's header
+ * map, reproducing upstream buildHeaders() precedence EXACTLY:
+ *   `{ ...defaultHeaders, ...customHeaders }` — caller wins per header.
+ *
+ * This mirrors GJC's existing kimi-code injection order
+ * (`headers = { ...getKimiCommonHeaders(), ...headers }`): canonical identity as
+ * the base, caller-supplied headers overriding individual keys. A caller that
+ * pins `User-Agent` takes that key; the other canonicals still apply.
+ *
+ * A null/undefined `callerHeaders` returns the canonical set alone (upstream
+ * `customHeaders ? {...} : defaultHeaders` shortcut).
+ */
+export function mergeDashScopeTokenPlanHeaders(
+	callerHeaders: Record<string, string> | undefined,
+	version: string = QWEN_CODE_UPSTREAM_VERSION,
+): Record<string, string> {
+	const defaults = dashscopeTokenPlanDefaultHeaders(version);
+	if (!callerHeaders) return { ...defaults };
+	return { ...defaults, ...callerHeaders };
+}

package/src/providers/openai-codex-responses.ts

@@ -43,6 +43,7 @@ import {
 	createOpenAIResponsesHistoryPayload,
 	getOpenAIResponsesHistoryItems,
 	getOpenAIResponsesHistoryPayload,
+	neutralizeReservedControlTokens,
 	neutralizeResponsesInputControlTokens,
 	normalizeSystemPrompts,
 	sanitizeOpenAIResponsesHistoryItemsForReplay,
@@ -746,7 +747,12 @@ async function buildTransformedCodexRequestBody(
 		}
 	}
 
-	const systemPrompts = normalizeSystemPrompts(context.systemPrompt);
+	// Neutralize leaked Harmony control tokens in the system prompt too:
+	// `params.instructions` and the developer messages prepended inside
+	// `transformRequestBody` bypass the `input` sanitizer above, so a poisoned
+	// system prompt rejects every turn with
+	// `Request blocked (code=invalid_prompt)`.
+	const systemPrompts = normalizeSystemPrompts(context.systemPrompt).map(neutralizeReservedControlTokens);
 	if (systemPrompts.length > 0) {
 		params.instructions = systemPrompts[0];
 	}

package/src/providers/openai-completions.ts

@@ -68,6 +68,7 @@ import {
 	resolveToolChoice,
 } from "../utils/tool-choice-capability";
 import { COMPOSER_EDIT_DISCIPLINE_PROMPT, isComposerHarnessModel } from "./composer-discipline";
+import { mergeDashScopeTokenPlanHeaders } from "./dashscope-token-plan-headers";
 import {
 	buildCopilotDynamicHeaders,
 	hasCopilotVisionInput,
@@ -1071,6 +1072,14 @@ async function createClient(
 	if (model.provider === "kimi-code") {
 		headers = { ...getKimiCommonHeaders(), ...headers };
 	}
+	if (model.provider === "alibaba-token-plan") {
+		// Emit Qwen Code's canonical DashScope request fingerprint (User-Agent /
+		// X-DashScope-CacheControl / X-DashScope-UserAgent / X-DashScope-AuthType)
+		// so DashScope treats the caller identically to upstream QwenLM/qwen-code.
+		// Canonical identity is the base; caller headers win per key (upstream
+		// `{...default, ...customHeaders}`). #3557.
+		headers = mergeDashScopeTokenPlanHeaders(headers);
+	}
 	headers = applyOpenAIRequestTransformHeaders(headers, model.requestTransform, `Gajae-Code/${packageJson.version}`);
 	let copilotPremiumRequests: number | undefined;
 

package/src/providers/openai-responses.ts

@@ -27,6 +27,7 @@ import {
 	getOpenAIResponsesHistoryItems,
 	getOpenAIResponsesHistoryPayload,
 	isInvalidPromptError,
+	neutralizeReservedControlTokens,
 	neutralizeResponsesInputControlTokens,
 	normalizeSystemPrompts,
 	resolveCacheRetention,
@@ -60,6 +61,7 @@ import {
 	resolveToolChoice,
 } from "../utils/tool-choice-capability";
 import { COMPOSER_EDIT_DISCIPLINE_PROMPT, isComposerHarnessModel } from "./composer-discipline";
+import { mergeDashScopeTokenPlanHeaders } from "./dashscope-token-plan-headers";
 import {
 	buildCopilotDynamicHeaders,
 	hasCopilotVisionInput,
@@ -446,8 +448,17 @@ function createClient(
 	}
 	const rawApiKey = apiKey;
 
+	const baseHeaders =
+		model.provider === "alibaba-token-plan"
+			? // Emit Qwen Code's canonical DashScope request fingerprint (User-Agent /
+				// X-DashScope-CacheControl / X-DashScope-UserAgent / X-DashScope-AuthType)
+				// so DashScope treats the caller identically to upstream QwenLM/qwen-code.
+				// Canonical identity is the base; caller headers win per key (upstream
+				// `{...default, ...customHeaders}`). #3557.
+				mergeDashScopeTokenPlanHeaders({ ...(model.headers ?? {}), ...(extraHeaders ?? {}) })
+			: { ...(model.headers ?? {}), ...(extraHeaders ?? {}) };
 	const headers = applyOpenAIRequestTransformHeaders(
-		{ ...(model.headers ?? {}), ...(extraHeaders ?? {}) },
+		baseHeaders,
 		model.requestTransform,
 		`Gajae-Code/${packageJson.version}`,
 	);
@@ -523,7 +534,13 @@ function buildParams(
 	);
 	const messages: ResponseInput = neutralizeResponsesInputControlTokens(conversationMessages);
 
-	const systemPrompts = normalizeSystemPrompts(context.systemPrompt);
+	// Neutralize leaked Harmony control tokens in the system prompt too: the
+	// `instructions` field and developer-role messages bypass the `input`
+	// request-boundary sanitizer above, and a poisoned system prompt (e.g.
+	// injected project context quoting `<|channel|>` markers) rejects EVERY
+	// turn with `Request blocked (code=invalid_prompt)` — unrepairable by the
+	// history circuit breaker.
+	const systemPrompts = normalizeSystemPrompts(context.systemPrompt).map(neutralizeReservedControlTokens);
 	if (isComposerHarnessModel(model.id)) {
 		systemPrompts.unshift(COMPOSER_EDIT_DISCIPLINE_PROMPT);
 	}