@iislee/opencodex 2.11.0

package/src/providers/alibaba-region-migration.ts

@@ -0,0 +1,156 @@
+import { ALIBABA_INTL_BASE_URL_CHOICES } from "./base-url-choices";
+import { providerConfigSeed } from "./derive";
+import { rewriteProviderReferences } from "./provider-id-rewrite";
+import { PROVIDER_REGISTRY } from "./registry";
+import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+
+const BEIJING_ID = "alibaba-token-plan";
+const INTL_ID = "alibaba-token-plan-intl";
+
+/**
+ * Credentials and switches the user owns directly. Everything else on the moved
+ * row is registry-derived Beijing metadata (`ocx provider add` and the GUI persist
+ * it, and registry enrichment only fills absent fields) and must NOT travel to the
+ * international id — carrying it would leave the intl provider serving Singapore
+ * while advertising the six-model Beijing Personal Edition catalog.
+ *
+ * `baseUrl` is carried deliberately: the migration only fires for a URL that
+ * `ALIBABA_INTL_BASE_URL_CHOICES` recognises, so it is nonblank and
+ * placeholder-free and satisfies the override guard in the router.
+ * `liveModels` is carried because it is directly user-editable, so resetting it
+ * to the seed's `false` would silently undo a deliberate choice.
+ * `authMode` is NOT carried — both entries are key-auth and the seed's value is
+ * the one matching the destination's registry contract.
+ * `defaultModel` and `note` are user-editable too and are handled below.
+ */
+const USER_OWNED_FIELDS = ["apiKey", "apiKeyPool", "disabled", "baseUrl", "allowPrivateNetwork", "liveModels"] as const;
+
+export interface AlibabaRegionMigrationProjection {
+  config: OcxConfig;
+  changed: boolean;
+  warnings: string[];
+}
+
+const normalize = (url: string): string => url.trim().replace(/\/+$/, "").toLowerCase();
+
+/** True when the saved URL is one the international entry actually serves. */
+function isInternationalEndpoint(baseUrl: string): boolean {
+  return ALIBABA_INTL_BASE_URL_CHOICES.some(
+    choice => choice.baseUrl && normalize(choice.baseUrl) === normalize(baseUrl),
+  );
+}
+
+/**
+ * Seed the destination from the international registry entry, then overlay only
+ * what the user owns. `providerConfigSeed` is the same function `ocx provider add`
+ * uses, so the migrated row is indistinguishable from one the user had created
+ * against the international provider directly.
+ */
+function buildIntlRow(source: OcxProviderConfig): OcxProviderConfig {
+  const entry = PROVIDER_REGISTRY.find(e => e.id === INTL_ID);
+  // Fail fast rather than fabricate a row: a missing registry entry means the
+  // destination this migration targets no longer exists.
+  if (!entry) throw new Error(`registry entry "${INTL_ID}" not found; cannot migrate "${BEIJING_ID}"`);
+  const seeded = providerConfigSeed(entry);
+  const writable = seeded as unknown as Record<string, unknown>;
+  const readable = source as unknown as Record<string, unknown>;
+  for (const field of USER_OWNED_FIELDS) {
+    if (readable[field] !== undefined) writable[field] = readable[field];
+  }
+
+  const servable = new Set(entry.models ?? []);
+  // A user-chosen default survives only when the destination can actually serve
+  // it; otherwise the international default already on the seed stands.
+  if (source.defaultModel && servable.has(source.defaultModel)) seeded.defaultModel = source.defaultModel;
+  // Same rule for the allowlist, handled here where the destination catalog is
+  // known — never by the generic reference rewriter.
+  const selected = source.selectedModels?.filter(id => servable.has(id));
+  if (selected && selected.length > 0) seeded.selectedModels = selected;
+  else delete seeded.selectedModels;
+
+  // `providerConfigSeed` does not carry `note`, so seed the destination's registry
+  // note explicitly, then let a genuinely user-authored note win. Comparing
+  // against the SOURCE registry note is what distinguishes "the user typed this"
+  // from "the Beijing entry's stock note came along for the ride".
+  const beijingNote = PROVIDER_REGISTRY.find(e => e.id === BEIJING_ID)?.note;
+  if (entry.note) seeded.note = entry.note;
+  if (source.note && source.note !== beijingNote) seeded.note = source.note;
+
+  return seeded;
+}
+
+/**
+ * Repair a config whose `alibaba-token-plan` entry points at an international
+ * endpoint (issue #457). The Beijing entry is pinned to cn-beijing and does not
+ * take a baseUrl override by design, so such a config routes an international key
+ * to Beijing and fails with 401 on every request.
+ *
+ * The entry is MOVED to `alibaba-token-plan-intl` rather than the Beijing entry
+ * being taught to serve Singapore: the two ids carry different model lists,
+ * context windows, modality maps and dashboards, and a URL override cannot carry
+ * those contracts across. That override fix shipped once, was backed out twice,
+ * and was refused again when PR #459 closed.
+ *
+ * Refuses to act when the destination is reserved by an account namespace or
+ * already holds a value — a provider row or a key the reference rewrite would
+ * land on — because choosing which setting wins is a user decision, not a
+ * migration's.
+ */
+export function projectAlibabaRegionMigration(config: OcxConfig): AlibabaRegionMigrationProjection {
+  const beijing = config.providers[BEIJING_ID];
+  const savedBaseUrl = typeof beijing?.baseUrl === "string" ? beijing.baseUrl : "";
+  if (!beijing || !savedBaseUrl || !isInternationalEndpoint(savedBaseUrl)) {
+    return { config, changed: false, warnings: [] };
+  }
+  if (codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, INTL_ID)) {
+    return {
+      config,
+      changed: false,
+      warnings: [
+        `provider "${BEIJING_ID}" needs to move to "${INTL_ID}", but that destination is reserved `
+        + `by a configured Codex account namespace. Nothing was changed. Rename the account `
+        + `selector or move the provider manually, then restart.`,
+      ],
+    };
+  }
+  if (config.providers[INTL_ID]) {
+    return {
+      config,
+      changed: false,
+      warnings: [
+        `provider "${BEIJING_ID}" is configured with an international endpoint, but "${INTL_ID}" `
+        + `already exists. Both were left untouched: merging two credential sets is not a decision `
+        + `this migration can make. Move the key to "${INTL_ID}" and delete the unused entry.`,
+      ],
+    };
+  }
+
+  const projected = structuredClone(config);
+  delete projected.providers[BEIJING_ID];
+  projected.providers[INTL_ID] = buildIntlRow(beijing);
+  const { changed: rewritten, collisions } = rewriteProviderReferences(projected, BEIJING_ID, INTL_ID);
+  // The rewriter is not transactional, so the clone is already partly rewritten
+  // here. Returning the ORIGINAL config discards it.
+  if (collisions.length > 0) {
+    return {
+      config,
+      changed: false,
+      warnings: [
+        `provider "${BEIJING_ID}" needs to move to "${INTL_ID}", but ${collisions.join(", ")} `
+        + `already hold values for the destination. Nothing was changed: choosing which value `
+        + `survives is not a decision this migration can make. Resolve those entries and restart.`,
+      ],
+    };
+  }
+
+  return {
+    config: projected,
+    changed: true,
+    warnings: [
+      `moved provider "${BEIJING_ID}" to "${INTL_ID}": its saved endpoint is the international one, `
+      + `which the Beijing entry cannot serve. ${rewritten} reference(s) were re-pointed; the `
+      + `international model catalog now applies.`,
+    ],
+  };
+}

package/src/providers/alibaba-region-startup.ts

@@ -0,0 +1,36 @@
+import { saveConfig } from "../config";
+import { backupConfigBeforeAlibabaRegionMigration } from "./alibaba-region-backup";
+import { projectAlibabaRegionMigration } from "./alibaba-region-migration";
+import type { OcxConfig } from "../types";
+
+export interface AlibabaRegionStartupDeps {
+  project: typeof projectAlibabaRegionMigration;
+  backup: () => void;
+  save: (config: OcxConfig) => void;
+}
+
+/**
+ * Run the #457 recovery migration at startup.
+ *
+ * Fail-closed: a backup failure throws, and nothing between here and
+ * `startServer` catches it, so the proxy does not start rather than rewriting
+ * credentials without a rollback point. That is the same posture the OpenAI tier
+ * migration takes.
+ */
+export function runAlibabaRegionStartupMigration(
+  config: OcxConfig,
+  deps: AlibabaRegionStartupDeps = {
+    project: projectAlibabaRegionMigration,
+    backup: () => { backupConfigBeforeAlibabaRegionMigration(); },
+    save: saveConfig,
+  },
+): OcxConfig {
+  const projection = deps.project(config);
+  // Warnings are emitted even on a no-op: the collision case IS the warning.
+  for (const warning of projection.warnings) console.warn(`[alibaba-region-migration] ${warning}`);
+  if (!projection.changed) return projection.config;
+  // Strictly before the save: the snapshot must describe the config as it was.
+  deps.backup();
+  deps.save(projection.config);
+  return projection.config;
+}

package/src/providers/antigravity-models.ts

@@ -0,0 +1,205 @@
+// Google Antigravity (Cloud Code Assist) bundled model list.
+//
+// Single source of truth: the Antigravity `:fetchAvailableModels` backend, the same one the `agy`
+// CLI resolves labels against. The ids below separate CCA wire ids, collapsed picker entries,
+// and hidden compatibility aliases for saved selections. The CCA envelope's `model` field must
+// receive the wire id (for example "Gemini 3.1 Pro (High)" => gemini-pro-agent), while the
+// picker exposes collapsed base models with reasoning-effort routing.
+
+// ── Wire IDs (what CCA :fetchAvailableModels returns) ──
+const ANTIGRAVITY_WIRE_MODELS = [
+  "gemini-3.6-flash-low",
+  "gemini-3.6-flash-medium",
+  "gemini-3.6-flash-high",
+  "gemini-3.1-pro-low",
+  "gemini-pro-agent",
+  "gemini-3.1-flash-image",
+  "claude-sonnet-4-6",
+  "claude-opus-4-6-thinking",
+  "gpt-oss-120b-medium",
+];
+
+// ── Effort ladders per collapsed base model ──
+// Gemini models: effort → wire model suffix (official agy UI pattern).
+// Claude Opus: effort → thinkingConfig.thinkingLevel (CLIProxyAPI proven pattern).
+export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
+  "gemini-3.6-flash": ["low", "medium", "high"],
+  "gemini-3.1-pro": ["low", "high"],
+  "claude-sonnet-4-6": ["low", "medium", "high", "max"],
+  "claude-opus-4-6-thinking": ["low", "medium", "high", "max"],
+};
+
+// ── Effort → wire model map for Gemini base models ──
+const ANTIGRAVITY_EFFORT_WIRE_MAP: Record<string, Record<string, string>> = {
+  "gemini-3.6-flash": {
+    low: "gemini-3.6-flash-low",
+    medium: "gemini-3.6-flash-medium",
+    high: "gemini-3.6-flash-high",
+  },
+  "gemini-3.1-pro": {
+    low: "gemini-3.1-pro-low",
+    high: "gemini-pro-agent",
+  },
+};
+
+// ── Default effort per Gemini base model ──
+const ANTIGRAVITY_DEFAULT_EFFORT: Record<string, string> = {
+  "gemini-3.6-flash": "medium",
+  "gemini-3.1-pro": "high",
+};
+
+const ANTIGRAVITY_THINKING_LEVELS = new Set(["minimal", "low", "medium", "high"]);
+
+function resolveAntigravityThinkingLevel(effort: string): string | undefined {
+  if (effort === "xhigh" || effort === "max" || effort === "ultra") return "high";
+  return ANTIGRAVITY_THINKING_LEVELS.has(effort) ? effort : undefined;
+}
+
+// ── Visible client aliases (kept for saved-config compat, not picker-visible) ──
+const ANTIGRAVITY_VISIBLE_MODEL_ALIASES: Record<string, string> = {
+  "gemini-3.1-pro-high": "gemini-pro-agent",
+  "gemini-3.1-pro-preview": "gemini-pro-agent",
+};
+
+// ── Hidden compatibility aliases for saved selections ──
+// Wire suffix IDs are identity aliases — they resolve to themselves so saved configs
+// with explicit suffixes (e.g. gemini-3.6-flash-low) continue to work.
+const ANTIGRAVITY_COMPATIBILITY_MODEL_ALIASES: Record<string, string> = {
+  "gemini-3.6-flash-low": "gemini-3.6-flash-low",
+  "gemini-3.6-flash-medium": "gemini-3.6-flash-medium",
+  "gemini-3.6-flash-high": "gemini-3.6-flash-high",
+  "gemini-3.1-pro-low": "gemini-3.1-pro-low",
+  "gemini-pro-agent": "gemini-pro-agent",
+  "gemini-3.5-flash-extra-low": "gemini-3.6-flash-low",
+  "gemini-3.5-flash-low": "gemini-3.6-flash-medium",
+  "gemini-3.5-flash-mid": "gemini-3.6-flash-medium",
+  "gemini-3.5-flash-high": "gemini-3.6-flash-high",
+  "gemini-3-flash-agent": "gemini-3.6-flash-high",
+};
+
+export const ANTIGRAVITY_MODEL_ALIASES: Record<string, string> = {
+  ...ANTIGRAVITY_VISIBLE_MODEL_ALIASES,
+  ...ANTIGRAVITY_COMPATIBILITY_MODEL_ALIASES,
+};
+
+// Picker-visible: collapsed base models only.
+export const ANTIGRAVITY_MODELS = [
+  "gemini-3.6-flash",
+  "gemini-3.1-pro",
+  "gemini-3.1-flash-image",
+  "claude-sonnet-4-6",
+  "claude-opus-4-6-thinking",
+  "gpt-oss-120b-medium",
+];
+
+// Context windows from the upstream `:fetchAvailableModels` maxTokens per model.
+const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "gemini-3.6-flash-low": 1_048_576,
+  "gemini-3.6-flash-medium": 1_048_576,
+  "gemini-3.6-flash-high": 1_048_576,
+  "gemini-3.1-pro-low": 1_048_576,
+  "gemini-pro-agent": 1_048_576,
+  "gemini-3.1-flash-image": 1_048_576,
+  "claude-sonnet-4-6": 200_000,
+  "claude-opus-4-6-thinking": 1_000_000,
+  "gpt-oss-120b-medium": 131_072,
+};
+
+export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  // Collapsed base IDs — explicit entries for the picker.
+  "gemini-3.6-flash": 1_048_576,
+  "gemini-3.1-pro": 1_048_576,
+  // Wire IDs and aliases via derivation.
+  ...ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS,
+  ...Object.fromEntries(
+    Object.entries(ANTIGRAVITY_MODEL_ALIASES).map(([alias, wire]) => [
+      alias,
+      ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS[wire],
+    ]),
+  ),
+};
+
+export function resolveAntigravityWireModelId(modelId: string): string {
+  return ANTIGRAVITY_MODEL_ALIASES[modelId] ?? modelId;
+}
+
+/**
+ * Whether the given model ID is a suffix wire ID or compat alias that already encodes
+ * an effort level. For these IDs, the caller must NOT send thinkingConfig — the suffix
+ * IS the effort, and sending both creates a contradictory request.
+ */
+export function isAntigravitySuffixModelId(modelId: string): boolean {
+  return !(ANTIGRAVITY_MODELS as string[]).includes(modelId);
+}
+
+/**
+ * Resolve a picker-visible base model + optional reasoning effort to the CCA wire model ID.
+ *
+ * Precedence (evaluated in order):
+ * 1. Suffix wire ID or compat alias → resolve via `resolveAntigravityWireModelId`, no thinkingConfig.
+ * 2. Mapped Gemini base with effort → return mapped wire ID + thinkingLevel.
+ * 3. Mapped Gemini base without effort → return default-effort wire ID, no thinkingConfig.
+ * 4. Claude Opus with effort → return identity + thinkingLevel (no suffix variants exist).
+ * 5. All other IDs → return `resolveAntigravityWireModelId(modelId)`, no thinkingConfig.
+ */
+export function resolveAntigravityEffortWireModel(
+  modelId: string,
+  effort?: string,
+): { wireModelId: string; thinkingLevel?: string } {
+  // Rule 1: suffix/compat alias — suffix IS the effort.
+  if (isAntigravitySuffixModelId(modelId)) {
+    return { wireModelId: resolveAntigravityWireModelId(modelId) };
+  }
+
+  // Rule 2/3: mapped Gemini base model.
+  const effortMap = ANTIGRAVITY_EFFORT_WIRE_MAP[modelId];
+  if (effortMap) {
+    if (effort && effort in effortMap) {
+      return { wireModelId: effortMap[effort]!, thinkingLevel: effort };
+    }
+    const defaultEffort = ANTIGRAVITY_DEFAULT_EFFORT[modelId]!;
+    return { wireModelId: effortMap[defaultEffort]! };
+  }
+
+  // Rule 4: Claude models — effort via thinkingConfig only (no suffix variants).
+  // CCA validates this field as Google's ThinkingLevel enum, whose highest value is `high`.
+  if (/^claude-/.test(modelId) && effort) {
+    return { wireModelId: modelId, thinkingLevel: resolveAntigravityThinkingLevel(effort) };
+  }
+
+  // Rule 5: everything else.
+  return { wireModelId: resolveAntigravityWireModelId(modelId) };
+}
+
+
+// ── Usage aggregation reverse map (picker/call base identity) ──
+// Effort wire IDs and compatibility aliases must collapse to the same picker-visible
+// base model that users invoke after effort routing. Historical logs store suffix IDs;
+// summary aggregation consults this reverse map so one call model = one usage row.
+const ANTIGRAVITY_USAGE_BASE_BY_ID: Record<string, string> = (() => {
+  const rev: Record<string, string> = {};
+  for (const base of ANTIGRAVITY_MODELS) rev[base] = base;
+  for (const [base, effortMap] of Object.entries(ANTIGRAVITY_EFFORT_WIRE_MAP)) {
+    rev[base] = base;
+    for (const wire of Object.values(effortMap)) rev[wire] = base;
+  }
+  for (const [alias, wire] of Object.entries(ANTIGRAVITY_MODEL_ALIASES)) {
+    const base = rev[wire] ?? rev[alias];
+    if (base) rev[alias] = base;
+    // If alias is itself a base/wire already mapped, keep that mapping.
+    else if (rev[wire]) rev[alias] = rev[wire]!;
+  }
+  // Visible aliases that only appear in ANTIGRAVITY_VISIBLE_MODEL_ALIASES are already
+  // included via ANTIGRAVITY_MODEL_ALIASES. Identity bases without effort maps remain.
+  return rev;
+})();
+
+/**
+ * Canonical picker/call model id for usage aggregation.
+ * Unknown ids stay identity so future CCA models do not invent mappings.
+ */
+export function canonicalAntigravityUsageModel(modelId: string): string {
+  const id = modelId.trim();
+  if (!id) return modelId;
+  return ANTIGRAVITY_USAGE_BASE_BY_ID[id] ?? id;
+}

package/src/providers/api-keys.ts

@@ -0,0 +1,140 @@
+/**
+ * Multi-key pool for key-auth providers (the API-key twin of OAuth multiauth).
+ *
+ * `provider.apiKey` stays the single source of truth for routing — it always mirrors the
+ * ACTIVE pool entry, so the router/adapters never learn about the pool. The pool itself
+ * lives in `provider.apiKeyPool` in config.json (same file that already holds apiKey).
+ * A provider with a legacy bare `apiKey` is seeded into a one-entry pool on first touch.
+ */
+import { createHash } from "node:crypto";
+import { saveConfigPreservingClaudeCode } from "../config";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+
+export interface ProviderApiKeyInfo {
+  id: string;
+  label?: string;
+  /** First/last 4 chars only; env references (`${VAR}`) are shown verbatim (not secrets). */
+  masked: string;
+  active: boolean;
+  addedAt?: number;
+}
+
+function isEnvReference(value: string): boolean {
+  return /^\$\{?\w+\}?$/.test(value);
+}
+
+export function maskApiKey(value: string): string {
+  if (isEnvReference(value)) return value;
+  if (value.length <= 8) return "****";
+  return `${value.slice(0, 4)}****${value.slice(-4)}`;
+}
+
+/** Content-derived id: re-adding the same key upserts instead of duplicating. */
+export function apiKeyPoolEntryId(key: string): string {
+  return createHash("sha256").update(key).digest("hex").slice(0, 8);
+}
+
+/** True for providers whose upstream auth is a configured API key (not oauth/forward). */
+export function isKeyAuthProvider(provider: OcxProviderConfig): boolean {
+  return provider.authMode !== "oauth" && provider.authMode !== "forward";
+}
+
+/** Trim and reject blank / CRLF-bearing secrets. Shared by pool writes and OAuth upsert. */
+export function sanitizeApiKeyValue(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed && !/[\r\n]/.test(trimmed) ? trimmed : undefined;
+}
+
+/** Seed the pool from a legacy bare `apiKey`, and keep `apiKey` mirrored to the active entry. */
+function ensurePool(provider: OcxProviderConfig): NonNullable<OcxProviderConfig["apiKeyPool"]> {
+  if (!provider.apiKeyPool) provider.apiKeyPool = [];
+  if (provider.apiKeyPool.length === 0 && provider.apiKey) {
+    provider.apiKeyPool.push({ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey });
+  }
+  return provider.apiKeyPool;
+}
+
+function activeEntryId(provider: OcxProviderConfig): string | null {
+  const pool = provider.apiKeyPool ?? [];
+  if (pool.length === 0) return null;
+  return (pool.find(e => e.key === provider.apiKey) ?? pool[0]!).id;
+}
+
+export function listProviderApiKeys(config: OcxConfig, name: string): { activeId: string | null; keys: ProviderApiKeyInfo[] } {
+  const provider = config.providers[name];
+  if (!provider || !isKeyAuthProvider(provider)) return { activeId: null, keys: [] };
+  const pool = ensurePool(provider);
+  const activeId = activeEntryId(provider);
+  return {
+    activeId,
+    keys: pool.map(entry => ({
+      id: entry.id,
+      ...(entry.label ? { label: entry.label } : {}),
+      masked: maskApiKey(entry.key),
+      active: entry.id === activeId,
+      ...(entry.addedAt !== undefined ? { addedAt: entry.addedAt } : {}),
+    })),
+  };
+}
+
+/** Add (or upsert) a key and make it ACTIVE. Persists config. */
+export function addProviderApiKey(config: OcxConfig, name: string, key: string, label?: string): { id: string } | { error: string } {
+  const provider = config.providers[name];
+  if (!provider || !isKeyAuthProvider(provider)) return { error: "provider does not use API-key auth" };
+  if (typeof key !== "string" || !key.trim()) return { error: "key is required" };
+  const trimmed = sanitizeApiKeyValue(key);
+  if (!trimmed) return { error: "key must not include line breaks" };
+  const pool = ensurePool(provider);
+  const id = apiKeyPoolEntryId(trimmed);
+  const existing = pool.find(e => e.id === id);
+  if (existing) {
+    if (label?.trim()) existing.label = label.trim();
+  } else {
+    pool.push({ id, key: trimmed, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
+  }
+  provider.apiKey = trimmed;
+  saveConfigPreservingClaudeCode(config);
+  return { id };
+}
+
+/** Switch the ACTIVE key (mirrors into `provider.apiKey`). Persists config. */
+export function setActiveProviderApiKey(config: OcxConfig, name: string, id: string): boolean {
+  const provider = config.providers[name];
+  if (!provider || !isKeyAuthProvider(provider)) return false;
+  const entry = ensurePool(provider).find(e => e.id === id);
+  if (!entry) return false;
+  provider.apiKey = entry.key;
+  saveConfigPreservingClaudeCode(config);
+  return true;
+}
+
+/** Rename a key slot without changing its id, secret, or active routing state. */
+export function setProviderApiKeyLabel(config: OcxConfig, name: string, id: string, label: string | undefined): boolean {
+  const provider = config.providers[name];
+  if (!provider || !isKeyAuthProvider(provider)) return false;
+  const entry = ensurePool(provider).find(e => e.id === id);
+  if (!entry) return false;
+  if (label) entry.label = label;
+  else delete entry.label;
+  saveConfigPreservingClaudeCode(config);
+  return true;
+}
+
+/** Remove one key; removing the active one promotes the first remaining. Persists config. */
+export function removeProviderApiKey(config: OcxConfig, name: string, id: string): boolean {
+  const provider = config.providers[name];
+  if (!provider || !isKeyAuthProvider(provider)) return false;
+  const pool = ensurePool(provider);
+  const entry = pool.find(e => e.id === id);
+  if (!entry) return false;
+  provider.apiKeyPool = pool.filter(e => e.id !== id);
+  if (provider.apiKey === entry.key) {
+    const next = provider.apiKeyPool[0];
+    if (next) provider.apiKey = next.key;
+    else delete provider.apiKey;
+  }
+  if (provider.apiKeyPool.length === 0) delete provider.apiKeyPool;
+  saveConfigPreservingClaudeCode(config);
+  return true;
+}

package/src/providers/base-url-choices.ts

@@ -0,0 +1,64 @@
+/**
+ * Qwen Cloud OpenAI-compatible endpoint presets.
+ * Token plan is the GUI default; pay-as-you-go and custom are selectable.
+ */
+export const QWEN_CLOUD_TOKEN_PLAN_BASE_URL =
+  "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1";
+export const QWEN_CLOUD_PAYG_BASE_URL =
+  "https://dashscope.aliyuncs.com/compatible-mode/v1";
+
+export type ProviderBaseUrlChoice = {
+  id: string;
+  /** English label projected to the GUI; GUI may i18n by `id`. */
+  label: string;
+  /** Omitted for `custom` — user supplies the URL. */
+  baseUrl?: string;
+};
+
+export const QWEN_CLOUD_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
+  { id: "token-plan", label: "Token plan", baseUrl: QWEN_CLOUD_TOKEN_PLAN_BASE_URL },
+  { id: "payg", label: "Pay as you go", baseUrl: QWEN_CLOUD_PAYG_BASE_URL },
+  { id: "custom", label: "Custom" },
+];
+
+/**
+ * Alibaba Token Plan International (ap-southeast-1) endpoint presets.
+ * Same product as the Beijing Token Plan but for international accounts.
+ * Note: ALIBABA_INTL_TOKEN_PLAN_BASE_URL intentionally duplicates
+ * QWEN_CLOUD_TOKEN_PLAN_BASE_URL — same host, different product branding
+ * and model lineup. Kept as a separate constant for clarity.
+ */
+export const ALIBABA_INTL_TOKEN_PLAN_BASE_URL =
+  "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1";
+export const ALIBABA_INTL_PAYG_BASE_URL =
+  "https://dashscope-intl.aliyuncs.com/compatible-mode/v1";
+
+export const ALIBABA_INTL_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
+  { id: "token-plan", label: "Token plan", baseUrl: ALIBABA_INTL_TOKEN_PLAN_BASE_URL },
+  { id: "payg", label: "Pay as you go", baseUrl: ALIBABA_INTL_PAYG_BASE_URL },
+  { id: "custom", label: "Custom" },
+];
+
+/** Alibaba Coding Plan endpoint presets (international default; China mainland selectable). */
+export const ALIBABA_CODING_INTL_BASE_URL = "https://coding-intl.dashscope.aliyuncs.com/v1";
+export const ALIBABA_CODING_CN_BASE_URL = "https://coding.dashscope.aliyuncs.com/v1";
+
+export const ALIBABA_CODING_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
+  { id: "intl", label: "International", baseUrl: ALIBABA_CODING_INTL_BASE_URL },
+  { id: "china", label: "China", baseUrl: ALIBABA_CODING_CN_BASE_URL },
+  { id: "custom", label: "Custom" },
+];
+
+/** Match a saved baseUrl to a known choice id (`custom` when it does not match). */
+export function matchBaseUrlChoice(
+  choices: readonly ProviderBaseUrlChoice[],
+  baseUrl: string,
+): string {
+  if (!choices.length) return "custom";
+  const normalized = baseUrl.trim().replace(/\/+$/, "");
+  for (const choice of choices) {
+    if (!choice.baseUrl) continue;
+    if (choice.baseUrl.trim().replace(/\/+$/, "") === normalized) return choice.id;
+  }
+  return choices.some(c => c.id === "custom") ? "custom" : choices[0]!.id;
+}

package/src/providers/context-cap.ts

@@ -0,0 +1,65 @@
+import type { OcxConfig } from "../types";
+
+export const DEFAULT_PROVIDER_CONTEXT_CAP = 350_000;
+
+function isValidContextCap(value: unknown): value is number {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+
+export function providerContextCap(config: Pick<OcxConfig, "providerContextCaps">, provider: string): number | undefined {
+  const value = config.providerContextCaps?.[provider];
+  return isValidContextCap(value) ? value : undefined;
+}
+
+export function providerContextCaps(config: Pick<OcxConfig, "providerContextCaps">): Record<string, number> {
+  const caps = config.providerContextCaps;
+  if (!caps || typeof caps !== "object" || Array.isArray(caps)) return {};
+  const out: Record<string, number> = {};
+  for (const [provider, value] of Object.entries(caps)) {
+    if (isValidContextCap(value)) out[provider] = value;
+  }
+  return out;
+}
+
+export function applyProviderContextCap(contextWindow: number | undefined, cap: number | undefined): number | undefined {
+  if (!isValidContextCap(cap)) return contextWindow;
+  if (!isValidContextCap(contextWindow)) return contextWindow;
+  return contextWindow > cap ? cap : contextWindow;
+}
+
+/** Effective global cap value: explicit config value, else the built-in default. */
+export function globalContextCapValue(config: Pick<OcxConfig, "contextCapValue">): number {
+  const value = config.contextCapValue;
+  return isValidContextCap(value) ? Math.floor(value) : DEFAULT_PROVIDER_CONTEXT_CAP;
+}
+
+export function setProviderContextCap(config: OcxConfig, provider: string, enabled: boolean): void {
+  const next = providerContextCaps(config);
+  if (enabled) next[provider] = globalContextCapValue(config);
+  else delete next[provider];
+  if (Object.keys(next).length > 0) config.providerContextCaps = next;
+  else delete config.providerContextCaps;
+}
+
+/** Set the global cap value and re-point every already-enabled provider to it. */
+export function setGlobalContextCapValue(config: OcxConfig, value: number): void {
+  if (!isValidContextCap(value)) return;
+  const next = Math.floor(value);
+  config.contextCapValue = next;
+  const caps = providerContextCaps(config);
+  for (const provider of Object.keys(caps)) caps[provider] = next;
+  if (Object.keys(caps).length > 0) config.providerContextCaps = caps;
+}
+
+/** Enable the cap for every named provider at the current value, or clear all caps. */
+export function setAllProviderContextCaps(config: OcxConfig, providerNames: string[], enabled: boolean): void {
+  if (!enabled) {
+    delete config.providerContextCaps;
+    return;
+  }
+  const value = globalContextCapValue(config);
+  const next: Record<string, number> = {};
+  for (const name of providerNames) next[name] = value;
+  if (Object.keys(next).length > 0) config.providerContextCaps = next;
+  else delete config.providerContextCaps;
+}