@gajae-code/ai 0.17.2 → 0.17.5

package/src/auth-storage.ts

@@ -481,6 +481,10 @@ export interface AuthCredentialStore {
 	deleteAuthCredentialsForProvider(provider: string, disabledCause: string): void;
 	getCache(key: string, options?: { includeExpired?: boolean }): string | null;
 	setCache(key: string, value: string, expiresAtSec: number): void;
+	/** Atomically claim a cross-process usage poll lease for a bounded interval. */
+	tryAcquireUsageFetchLease?(key: string, owner: string, nowMs: number, leaseMs: number): boolean | undefined;
+	/** Release a usage poll lease owned by this process. */
+	releaseUsageFetchLease?(key: string, owner: string): void;
 	/** Atomically allocate a durable sequence for broker restart epochs. */
 	allocateMonotonicSequence(key: string, expiresAtSec: number): number;
 	deleteCachePrefix?(prefix: string): void;
@@ -929,6 +933,21 @@ const DEFAULT_RANKING_STRATEGIES = new Map<Provider, CredentialRankingStrategy>(
 ]);
 
 const USAGE_CACHE_PREFIX = "usage_cache:";
+function hashUsageDiagnosticValue(value: unknown): string | undefined {
+	if (typeof value !== "string" || value.length === 0) return undefined;
+	return Bun.hash(value).toString(16);
+}
+
+function redactUsageDiagnosticUrl(value: string | undefined): string | undefined {
+	if (!value) return undefined;
+	try {
+		const parsed = new URL(value);
+		return `${parsed.protocol}//${parsed.host}`;
+	} catch {
+		return "[invalid-url]";
+	}
+}
+
 // 5 min stale tolerance. Anthropic / OpenAI rate-limit /usage hard at the IP
 // level so we can't fetch all N credentials every cycle; with a long cache
 // each credential's last-known value sticks visible while peers retry. UI
@@ -945,6 +964,9 @@ const USAGE_FAILURE_BACKOFF_MS = 10_000;
 // Bumped from 3s — Anthropic model usage retries up to 3 times with exponential backoff
 // (~3.5s total worst case); a tight per-request budget aborts retries mid-cycle.
 const DEFAULT_USAGE_REQUEST_TIMEOUT_MS = 10_000;
+/** Grace period after the configured provider timeout before peers retry a poll. */
+const USAGE_FETCH_LEASE_GRACE_MS = 5_000;
+const USAGE_FETCH_WAIT_POLL_MS = 25;
 const DEFAULT_OAUTH_REFRESH_TIMEOUT_MS = 10_000;
 /** Maximum provider ownership window; expiry recovers a crashed process without indefinite blocking. */
 const OAUTH_REFRESH_LEASE_MS = DEFAULT_OAUTH_REFRESH_TIMEOUT_MS + 5_000;
@@ -1407,6 +1429,7 @@ export class AuthStorage {
 	#usageReportsInFlight: Map<string, Promise<UsageReport[] | null>> = new Map();
 	#usageFetch: typeof fetch;
 	#usageRequestTimeoutMs: number;
+	#usageFetchLeaseMs: number;
 	#credentialRankingMode: CredentialRankingMode = "balanced";
 	#usageLogger?: UsageLogger;
 	#fallbackResolver?: (provider: string) => string | undefined;
@@ -1459,6 +1482,13 @@ export class AuthStorage {
 		this.#usageCache = new AuthStorageUsageCache(this.#store);
 		this.#usageFetch = options.usageFetch ?? fetch;
 		this.#usageRequestTimeoutMs = options.usageRequestTimeoutMs ?? DEFAULT_USAGE_REQUEST_TIMEOUT_MS;
+		const usageTimeoutForLease =
+			typeof this.#usageRequestTimeoutMs === "number" &&
+			Number.isFinite(this.#usageRequestTimeoutMs) &&
+			this.#usageRequestTimeoutMs > 0
+				? this.#usageRequestTimeoutMs
+				: DEFAULT_USAGE_REQUEST_TIMEOUT_MS;
+		this.#usageFetchLeaseMs = usageTimeoutForLease + USAGE_FETCH_LEASE_GRACE_MS;
 		this.#credentialRankingMode = options.credentialRankingMode ?? "balanced";
 		this.#refreshOAuthCredentialOverride = options.refreshOAuthCredential;
 		this.#fetchUsageReportsOverride = options.fetchUsageReports;
@@ -1548,8 +1578,15 @@ export class AuthStorage {
 	getProviderEvidenceGeneration(provider: string, resolvedApiKey?: string, owner?: object): string {
 		const storageProvider = resolveOAuthStorageProvider(provider);
 		provider = storageProvider;
-		const evidenceApiKey = resolvedApiKey;
 		const configOverride = this.#configOverrideRegistration(storageProvider, owner);
+		const runtimeOverride = this.#runtimeOverrides.get(storageProvider);
+		const environmentOverride = runtimeOverride || configOverride?.apiKey ? undefined : getEnvApiKey(storageProvider);
+		// Discovery callers may fingerprint the provider before resolving its
+		// already-effective override or environment key, then pass that resolved
+		// key on the live path. Use the same effective key for the omitted form
+		// so both paths share one credential-sensitive generation.
+		const evidenceApiKey =
+			resolvedApiKey ?? (runtimeOverride || configOverride?.apiKey || environmentOverride || undefined);
 		const storedLiteral =
 			evidenceApiKey === undefined || this.#runtimeOverrides.has(storageProvider) || configOverride !== undefined
 				? undefined
@@ -1585,9 +1622,7 @@ export class AuthStorage {
 				credential.type === "oauth" && Number.isFinite(credential.expires) && credential.expires > Date.now(),
 		);
 		const effectiveEnvKey =
-			this.#runtimeOverrides.get(provider) || configOverride?.apiKey || hasApiKey || hasUsableOAuth
-				? undefined
-				: getEnvApiKey(provider);
+			runtimeOverride || configOverride?.apiKey || hasApiKey || hasUsableOAuth ? undefined : getEnvApiKey(provider);
 		const storedApiKeyFingerprint = credentials
 			.filter(
 				(credential): credential is Extract<AuthCredential, { type: "api_key" }> => credential.type === "api_key",
@@ -2009,6 +2044,7 @@ export class AuthStorage {
 		this.#usageRequestInFlight.clear();
 		this.#usageReportsInFlight.clear();
 		this.#usageCache.deletePrefix?.(`report:${storageProvider}:`);
+		this.#usageCache.deletePrefix?.("reports:");
 		for (const [scopeId, selectors] of this.#sessionCredentialSelectors) {
 			const selector = selectors.get(storageProvider);
 			const selected = selector
@@ -2422,6 +2458,7 @@ export class AuthStorage {
 			this.#data.set(provider, credentials);
 		}
 		if (identityOrderChanged) this.#resetProviderAssignments(storageProvider);
+		if (!tokenRotationOnly) this.#invalidateUsageCacheForProvider(storageProvider);
 		if (tokenRotationOnly) this.#bumpGeneration("oauth-token-rotation");
 		else this.#bumpGeneration("credentials", provider);
 	}
@@ -3111,6 +3148,7 @@ export class AuthStorage {
 		this.#usageRequestInFlight.clear();
 		this.#usageReportsInFlight.clear();
 		this.#usageCache.deletePrefix?.(`report:${provider}:`);
+		this.#usageCache.deletePrefix?.("reports:");
 	}
 
 	/**
@@ -4037,6 +4075,8 @@ export class AuthStorage {
 		logDetails: boolean = true,
 	): Promise<UsageReport | null> {
 		const cacheKey = this.#buildUsageReportCacheKey(request);
+		const provider = resolveOAuthStorageProvider(request.provider);
+		const credentialGeneration = this.#getProviderGeneration(provider);
 		const now = Date.now();
 		const cached = this.#usageCache.get<UsageReport | null>(cacheKey);
 		// Fresh cache hit: return whatever's there (success or null fallback).
@@ -4049,6 +4089,7 @@ export class AuthStorage {
 
 		const promise = (async () => {
 			const report = await this.#fetchUsageUncached(request, timeoutMs, logDetails);
+			if (this.#getProviderGeneration(provider) !== credentialGeneration) return null;
 			const ttlJitter = USAGE_REPORT_TTL_MS * (Math.random() * 0.5 - 0.25);
 			if (report !== null) {
 				// Success: stagger per-credential cache expiry so all accounts don't
@@ -4080,6 +4121,51 @@ export class AuthStorage {
 		return promise;
 	}
 
+	#captureUsageProviderGenerations(requests: ReadonlyArray<UsageRequestDescriptor>): Map<string, number> {
+		const generations = new Map<string, number>();
+		for (const request of requests) {
+			const provider = resolveOAuthStorageProvider(request.provider);
+			if (!generations.has(provider)) generations.set(provider, this.#getProviderGeneration(provider));
+		}
+		return generations;
+	}
+
+	#usageProviderGenerationsMatch(generations: ReadonlyMap<string, number>): boolean {
+		for (const [provider, generation] of generations) {
+			if (this.#getProviderGeneration(provider) !== generation) return false;
+		}
+		return true;
+	}
+
+	#readAggregateUsageCache(cacheKey: string): UsageReport[] | undefined {
+		const cached = this.#usageCache.get<UsageReport[]>(cacheKey);
+		if (!cached || cached.expiresAt <= Date.now() || !Array.isArray(cached.value)) return undefined;
+		return cached.value;
+	}
+
+	#tryAcquireUsageFetchLease(cacheKey: string): boolean | undefined {
+		const claim = this.#store.tryAcquireUsageFetchLease;
+		if (!claim) return undefined;
+		return claim.call(this.#store, cacheKey, this.#oauthRefreshLeaseOwner, Date.now(), this.#usageFetchLeaseMs);
+	}
+
+	async #waitForAggregateUsagePoll(
+		cacheKey: string,
+	): Promise<{ cached: UsageReport[] | undefined; leaseAcquired: boolean }> {
+		const deadline = Date.now() + this.#usageFetchLeaseMs;
+		while (Date.now() < deadline) {
+			const cached = this.#readAggregateUsageCache(cacheKey);
+			if (cached !== undefined) return { cached, leaseAcquired: false };
+			if (this.#tryAcquireUsageFetchLease(cacheKey) === true) return { cached: undefined, leaseAcquired: true };
+			await Bun.sleep(USAGE_FETCH_WAIT_POLL_MS);
+		}
+		return { cached: this.#readAggregateUsageCache(cacheKey), leaseAcquired: false };
+	}
+
+	#releaseUsageFetchLease(cacheKey: string): void {
+		this.#store.releaseUsageFetchLease?.(cacheKey, this.#oauthRefreshLeaseOwner);
+	}
+
 	#collectUsageRequests(options?: {
 		provider?: Provider;
 		baseUrlResolver?: (provider: Provider) => string | undefined;
@@ -4297,10 +4383,15 @@ export class AuthStorage {
 	async fetchUsageReports(options?: {
 		provider?: Provider;
 		baseUrlResolver?: (provider: Provider) => string | undefined;
-		/** Caller's cancel signal; only rejects this caller, never the shared upstream fetch. */
+		/** Caller’s cancel signal; only rejects this caller, never the shared upstream fetch. */
 		signal?: AbortSignal;
 		/** Disable provider/account/error logging for secret-safe control surfaces. */
 		logDetails?: boolean;
+		/**
+		 * Enable identity correlation diagnostics. Values are one-way hashed and
+		 * URLs are reduced to their origin; the default logs provider/type/count only.
+		 */
+		logIdentity?: boolean;
 	}): Promise<UsageReport[] | null> {
 		// Caller override > store-level hook > local per-credential fan-out.
 		// `RemoteAuthCredentialStore` implements the store hook so a gateway
@@ -4340,63 +4431,87 @@ export class AuthStorage {
 		const requests = this.#collectUsageRequests(options);
 		if (requests.length === 0) return [];
 
-		if (options?.logDetails !== false) {
-			this.#usageLogger?.debug("Usage fetch requested", {
-				providers: [...new Set(requests.map(request => request.provider))].sort(),
-			});
-		}
-
 		// Per-credential caching with jitter lives in #fetchUsageCached, so we
-		// don't store the aggregated result here — doing so locks the widget to
-		// a single decorrelation snapshot for 30s, defeating the jitter (some
-		// accounts can be missing from one fetch and present in the next; the
-		// aggregate cache freezes whichever set landed first).
+		// also retain the completed aggregate in the durable store. The aggregate
+		// cache is what lets another process reuse this poll instead of starting a
+		// second provider fan-out while the first process is still collecting rows.
 		const cacheKey = this.#buildUsageReportsCacheKey(requests);
-
+		const providerGenerations = this.#captureUsageProviderGenerations(requests);
 		const inFlight = this.#usageReportsInFlight.get(cacheKey);
 		if (inFlight) return raceUsageWithSignal(inFlight, options?.signal);
 
 		const promise = (async () => {
-			if (options?.logDetails !== false) {
-				for (const request of requests) {
-					this.#usageLogger?.debug("Usage fetch queued", {
-						provider: request.provider,
-						credentialType: request.credential.type,
-						baseUrl: request.baseUrl,
-						accountId: request.credential.accountId,
-						email: request.credential.email,
+			let leaseOwned = false;
+			try {
+				const initialLeaseClaim = this.#tryAcquireUsageFetchLease(cacheKey);
+				const leaseSupported = initialLeaseClaim !== undefined;
+				if (leaseSupported) {
+					leaseOwned = initialLeaseClaim === true;
+					if (!leaseOwned) {
+						const shared = await this.#waitForAggregateUsagePoll(cacheKey);
+						if (shared.cached !== undefined) return shared.cached;
+						leaseOwned = shared.leaseAcquired || this.#tryAcquireUsageFetchLease(cacheKey) === true;
+					}
+				}
+
+				if (options?.logDetails !== false) {
+					this.#usageLogger?.debug("Usage fetch requested", {
+						providers: [...new Set(requests.map(request => request.provider))].sort(),
+						credentialTypes: [...new Set(requests.map(request => request.credential.type))].sort(),
+						credentials: requests.length,
 					});
+					if (options?.logIdentity === true) {
+						for (const request of requests) {
+							this.#usageLogger?.debug("Usage fetch queued", {
+								provider: request.provider,
+								credentialType: request.credential.type,
+								baseUrl: redactUsageDiagnosticUrl(request.baseUrl),
+								accountId: hashUsageDiagnosticValue(request.credential.accountId),
+								email: hashUsageDiagnosticValue(request.credential.email),
+							});
+						}
+					}
 				}
-			}
 
-			const results = await Promise.all(
-				requests.map(request =>
-					this.#fetchUsageCached(request, this.#usageRequestTimeoutMs, options?.logDetails !== false),
-				),
-			);
-			const reports = results.filter((report): report is UsageReport => report !== null);
-			const deduped = this.#dedupeUsageReports(reports);
-			// no outer cache write — see comment above.
-			const resolved = deduped;
-			if (options?.logDetails !== false) {
-				this.#usageLogger?.debug("Usage fetch resolved", {
-					reports: resolved.map(report => {
-						const accountLabel =
-							this.#getUsageReportMetadataValue(report, "email") ??
-							this.#getUsageReportMetadataValue(report, "accountId") ??
-							this.#getUsageReportMetadataValue(report, "account") ??
-							this.#getUsageReportMetadataValue(report, "user") ??
-							this.#getUsageReportMetadataValue(report, "username") ??
-							this.#getUsageReportScopeAccountId(report);
-						return {
-							provider: report.provider,
-							limits: report.limits.length,
-							account: accountLabel,
-						};
-					}),
-				});
+				const results = await Promise.all(
+					requests.map(request =>
+						this.#fetchUsageCached(request, this.#usageRequestTimeoutMs, options?.logDetails !== false),
+					),
+				);
+				const reports = results.filter((report): report is UsageReport => report !== null);
+				const resolved = this.#dedupeUsageReports(reports);
+				if (this.#usageProviderGenerationsMatch(providerGenerations)) {
+					// This is a lease-scoped handoff for concurrent processes, not a
+					// long-lived aggregate cache: per-credential jitter remains active
+					// on the next poll.
+					this.#usageCache.set(cacheKey, { value: resolved, expiresAt: Date.now() + this.#usageFetchLeaseMs });
+				}
+				if (options?.logDetails !== false) {
+					this.#usageLogger?.debug("Usage fetch resolved", {
+						reports:
+							options?.logIdentity === true
+								? resolved.map(report => ({
+										provider: report.provider,
+										limits: report.limits.length,
+										account: hashUsageDiagnosticValue(
+											this.#getUsageReportMetadataValue(report, "email") ??
+												this.#getUsageReportMetadataValue(report, "accountId") ??
+												this.#getUsageReportMetadataValue(report, "account") ??
+												this.#getUsageReportMetadataValue(report, "user") ??
+												this.#getUsageReportMetadataValue(report, "username") ??
+												this.#getUsageReportScopeAccountId(report),
+										),
+									}))
+								: {
+										count: resolved.length,
+										providers: [...new Set(resolved.map(report => report.provider))].sort(),
+									},
+					});
+				}
+				return resolved;
+			} finally {
+				if (leaseOwned) this.#releaseUsageFetchLease(cacheKey);
 			}
-			return resolved;
 		})().finally(() => {
 			if (this.#usageReportsInFlight.get(cacheKey) === promise) {
 				this.#usageReportsInFlight.delete(cacheKey);
@@ -6669,6 +6784,8 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 	#getCacheStmt: Statement;
 	#getCacheIncludingExpiredStmt: Statement;
 	#upsertCacheStmt: Statement;
+	#claimUsageFetchLeaseStmt: Statement;
+	#releaseUsageFetchLeaseStmt: Statement;
 	#deleteCachePrefixStmt: Statement;
 	#deleteExpiredCacheStmt: Statement;
 	#closed = false;
@@ -6718,6 +6835,10 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		this.#upsertCacheStmt = this.#db.prepare(
 			"INSERT INTO cache (key, value, expires_at) VALUES (?, ?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, expires_at = excluded.expires_at",
 		);
+		this.#claimUsageFetchLeaseStmt = this.#db.prepare(
+			"INSERT INTO cache (key, value, expires_at) VALUES (?, ?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, expires_at = excluded.expires_at WHERE cache.expires_at <= ?",
+		);
+		this.#releaseUsageFetchLeaseStmt = this.#db.prepare("DELETE FROM cache WHERE key = ? AND value = ?");
 		this.#deleteCachePrefixStmt = this.#db.prepare("DELETE FROM cache WHERE substr(key, 1, ?) = ?");
 		this.#deleteExpiredCacheStmt = this.#db.prepare(`DELETE FROM cache WHERE expires_at <= ${SQLITE_NOW_EPOCH}`);
 	}
@@ -7431,6 +7552,27 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		}
 	}
 
+	tryAcquireUsageFetchLease(key: string, owner: string, nowMs: number, leaseMs: number): boolean | undefined {
+		try {
+			const nowSec = Math.floor(nowMs / 1000);
+			const expiresAtSec = Math.ceil((nowMs + leaseMs) / 1000);
+			const result = this.#claimUsageFetchLeaseStmt.run(`usage_fetch_lease:${key}`, owner, expiresAtSec, nowSec) as {
+				changes: number;
+			};
+			return result.changes === 1;
+		} catch {
+			return undefined;
+		}
+	}
+
+	releaseUsageFetchLease(key: string, owner: string): void {
+		try {
+			this.#releaseUsageFetchLeaseStmt.run(`usage_fetch_lease:${key}`, owner);
+		} catch {
+			// Ignore cache lease cleanup failures; the bounded expiry recovers it.
+		}
+	}
+
 	allocateMonotonicSequence(key: string, expiresAtSec: number): number {
 		const allocate = this.#db.transaction(() => {
 			const row = this.#getCacheIncludingExpiredStmt.get(key) as { value?: string } | undefined;

package/src/model-pricing.ts

@@ -25,9 +25,31 @@ const GPT_6_ASTRA_PRICING: TieredPricing = {
 	},
 };
 
+// GPT-6 Sol: $2/$10 standard, cache read $0.20, cache write $2.50; inputs past
+// 272K apply 2x to input/cache and 1.5x to output.
+const GPT_6_SOL_PRICING: TieredPricing = {
+	cost: { input: 2, output: 10, cacheRead: 0.2, cacheWrite: 2.5 },
+	longContextPricing: {
+		threshold: LONG_CONTEXT_THRESHOLD,
+		cost: { input: 4, output: 15, cacheRead: 0.4, cacheWrite: 5 },
+	},
+};
+
+// GPT-6 Luna: $0.10/$0.50 standard, cache read $0.01, cache write $0.125;
+// inputs past 272K apply 2x to input/cache and 1.5x to output.
+const GPT_6_LUNA_PRICING: TieredPricing = {
+	cost: { input: 0.1, output: 0.5, cacheRead: 0.01, cacheWrite: 0.125 },
+	longContextPricing: {
+		threshold: LONG_CONTEXT_THRESHOLD,
+		cost: { input: 0.2, output: 0.75, cacheRead: 0.02, cacheWrite: 0.25 },
+	},
+};
+
 // OpenAI Standard pricing: https://developers.openai.com/api/docs/pricing
 const OPENAI_GPT_5_6_PRICING: ReadonlyMap<string, TieredPricing> = new Map([
 	["gpt-6-astra", GPT_6_ASTRA_PRICING],
+	["gpt-6-sol", GPT_6_SOL_PRICING],
+	["gpt-6-luna", GPT_6_LUNA_PRICING],
 	["gpt-5.6", GPT_5_6_SOL_PRICING],
 	["gpt-5.6-sol", GPT_5_6_SOL_PRICING],
 	[

package/src/model-thinking.ts

@@ -66,6 +66,17 @@ const GPT_5_6_PLUS_EFFORTS: readonly Effort[] = [Effort.Low, Effort.Medium, Effo
 const GPT_5_5_DEFAULT_EFFORT = Effort.XHigh;
 const KIMI_K3_EFFORTS: readonly Effort[] = [Effort.Low, Effort.High, Effort.Max];
 const DEEPSEEK_V4_FLASH_0731_EFFORTS: readonly Effort[] = [Effort.Low, Effort.High, Effort.Max];
+const ALIBABA_GLM_53_EFFORTS: readonly Effort[] = [Effort.Low, Effort.High, Effort.Max];
+const ALIBABA_DEEPSEEK_V4_PINNED_IDS = new Set([
+	"deepseek-v4-flash-0731",
+	"deepseek-v4-pro-0813",
+	"deepseek-v4.1-flash",
+]);
+const ALIBABA_DEEPSEEK_V4_PINNED_NAMES: Record<string, string> = {
+	"deepseek-v4-flash-0731": "DeepSeek V4 Flash 0731",
+	"deepseek-v4-pro-0813": "DeepSeek V4 Pro 0813",
+	"deepseek-v4.1-flash": "DeepSeek V4.1 Flash",
+};
 const GROK_4_5_EFFORTS: readonly Effort[] = [Effort.Low, Effort.Medium, Effort.High];
 const GROK_4_6_EFFORTS: readonly Effort[] = [Effort.Low, Effort.Medium, Effort.High, Effort.XHigh];
 const GROK_4_20_EFFORTS: readonly Effort[] = [Effort.Minimal, Effort.Low, Effort.Medium, Effort.High];
@@ -320,9 +331,13 @@ export function applyGeneratedModelPolicies(models: ApiModel<Api>[]): void {
 		if (source.provider === "xai" && (source.id === "grok-4.5" || source.id === "grok-4.6")) {
 			source.reasoning = true;
 		}
-		if (source.provider === "alibaba-token-plan" && source.id === "deepseek-v4-flash-0731") {
+		if (source.provider === "alibaba-token-plan" && ALIBABA_DEEPSEEK_V4_PINNED_IDS.has(source.id)) {
+			source.reasoning = true;
+			source.name = ALIBABA_DEEPSEEK_V4_PINNED_NAMES[source.id] ?? source.name;
+		}
+		if (source.provider === "alibaba-token-plan" && source.id === "glm-5.3") {
 			source.reasoning = true;
-			source.name = "DeepSeek V4 Flash 0731";
+			source.name = "GLM-5.3";
 		}
 		if (source.id.split("/").at(-1)?.toLowerCase() === "muse-spark-1.2") {
 			source.reasoning = true;
@@ -669,7 +684,7 @@ function applyGeneratedModelPolicy(model: ApiModel<Api>): void {
 			levels: [Effort.Low, Effort.High, Effort.Max],
 		};
 	}
-	if (model.provider === "alibaba-token-plan" && model.id === "deepseek-v4-flash-0731") {
+	if (model.provider === "alibaba-token-plan" && ALIBABA_DEEPSEEK_V4_PINNED_IDS.has(model.id)) {
 		model.contextWindow = 1_000_000;
 		model.maxTokens = 384_000;
 		model.compat = {
@@ -680,6 +695,24 @@ function applyGeneratedModelPolicy(model: ApiModel<Api>): void {
 			requiresReasoningContentForToolCalls: true,
 		};
 	}
+	if (model.provider === "alibaba-token-plan" && model.id === "glm-5.3") {
+		model.contextWindow = 1_000_000;
+		model.maxTokens = 131_072;
+		model.compat = {
+			...(model.compat ?? {}),
+			supportsDeveloperRole: false,
+			supportsReasoningEffort: true,
+			reasoningContentField: "reasoning_content",
+			requiresReasoningContentForToolCalls: true,
+		};
+		model.thinking = {
+			mode: "effort",
+			minLevel: Effort.Low,
+			maxLevel: Effort.Max,
+			defaultLevel: Effort.Max,
+			levels: [Effort.Low, Effort.High, Effort.Max],
+		};
+	}
 	if (model.provider === "xai" && (model.id === "grok-4.5" || model.id === "grok-4.6")) {
 		model.maxTokens = Math.min(model.maxTokens, 64_000);
 	}
@@ -898,9 +931,12 @@ function inferSupportedEfforts<TApi extends Api>(parsedModel: ParsedModel, model
 	if (model.provider === "kimi-code" && model.id === "k3") {
 		return KIMI_K3_EFFORTS;
 	}
-	if (model.provider === "alibaba-token-plan" && model.id === "deepseek-v4-flash-0731") {
+	if (model.provider === "alibaba-token-plan" && ALIBABA_DEEPSEEK_V4_PINNED_IDS.has(model.id)) {
 		return DEEPSEEK_V4_FLASH_0731_EFFORTS;
 	}
+	if (model.provider === "alibaba-token-plan" && model.id === "glm-5.3") {
+		return ALIBABA_GLM_53_EFFORTS;
+	}
 	switch (parsedModel.family) {
 		case "openai":
 			return inferOpenAISupportedEfforts(parsedModel);