@oh-my-pi/pi-ai 17.3.2 → 17.3.4

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [17.3.4] - 2026-08-14
+
+### Fixed
+
+- Fixed `omp usage invalidate` to discard stale OAuth and API-key usage snapshots, then force a cache-bypassing, per-provider serialized refresh with a broker request budget sized for the full unfiltered account batch, so upgraded subscriptions do not silently retain pre-change quota data.
+- Fixed quota reporting and Cookie capture guidance for China (Beijing) Alibaba Token Plan credentials ([#8509](https://github.com/can1357/oh-my-pi/issues/8509)).
+
+## [17.3.3] - 2026-08-14
+
+### Fixed
+
+- Distinguished Gemini thought-only `STOP` responses from empty transports, avoiding repeated identical reasoning requests and duplicate Antigravity endpoint streams while surfacing the missing final output for session-level recovery.
+
 ## [17.3.2] - 2026-08-13
 
 ### Fixed

package/dist/types/auth-broker/client.d.ts

@@ -66,7 +66,14 @@ export declare class AuthBrokerClient {
     openSnapshotStream(opts?: {
         signal?: AbortSignal;
     }): AsyncGenerator<SnapshotStreamEvent>;
-    fetchUsage(signal?: AbortSignal): Promise<UsageResponse>;
+    /**
+     * Fetch aggregate broker usage with a timeout sized for serialized
+     * same-provider account probes.
+     */
+    fetchUsage(options?: {
+        signal?: AbortSignal;
+        maxAccountsPerProvider?: number;
+    }): Promise<UsageResponse>;
     /** Recorded usage-limit snapshots from the broker host, oldest first. */
     fetchUsageHistory(query?: {
         sinceMs?: number;

package/dist/types/auth-storage.d.ts

@@ -1111,10 +1111,9 @@ export declare class AuthStorage {
         signal?: AbortSignal;
     }): Promise<ResetCreditRedeemOutcome>;
     /**
-     * Force-invalidate cached usage reports so the next fetch retrieves fresh
-     * values from upstream providers. If `provider` is specified, only that
-     * provider's credentials are invalidated; otherwise, all credentials in the
-     * store are invalidated.
+     * Discard cached usage reports before a user-requested refresh. The next
+     * read probes upstream serially per provider; a failure reports no fresh
+     * usage instead of replaying an invalidated last-good snapshot.
      */
     invalidateUsageCache(provider?: string, signal?: AbortSignal): Promise<void>;
     invalidateCredentialMatching(provider: string, apiKey: string, options?: InvalidateCredentialMatchingOptions): Promise<boolean>;

package/dist/types/error/flags.d.ts

@@ -8,6 +8,7 @@ export declare const Flag: {
     readonly StaleResponsesItem: 1048576;
     readonly MalformedFunctionCall: 2097152;
     readonly ProviderFinishError: 4194304;
+    readonly EmptyResponse: 8192;
     readonly ContentBlocked: 32768;
     /** Account-scoped provider policy denial that may succeed with another credential. */
     readonly AccountPolicy: 16384;

package/dist/types/error/provider.d.ts

@@ -7,6 +7,8 @@ export type ProviderResponseErrorKind =
  | "output"
 /** Response body was empty/missing when content was required. */
  | "empty-body"
+/** Response completed without actionable output (for example, thoughts only). */
+ | "empty-output"
 /** Malformed wire envelope (unexpected message ordering / shape). */
  | "envelope"
 /** Content was blocked by a provider safety filter. */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.3.2",
+	"version": "17.3.4",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,10 +38,10 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/omptype": "17.3.2",
-		"@oh-my-pi/pi-catalog": "17.3.2",
-		"@oh-my-pi/pi-utils": "17.3.2",
-		"@oh-my-pi/pi-wire": "17.3.2"
+		"@oh-my-pi/omptype": "17.3.4",
+		"@oh-my-pi/pi-catalog": "17.3.4",
+		"@oh-my-pi/pi-utils": "17.3.4",
+		"@oh-my-pi/pi-wire": "17.3.4"
 	},
 	"devDependencies": {
 		"@bufbuild/protoc-gen-es": "^2.12.1",

package/src/auth-broker/client.ts

@@ -249,12 +249,23 @@ export class AuthBrokerClient {
 		}
 	}
 
-	fetchUsage(signal?: AbortSignal): Promise<UsageResponse> {
-		// Validates the envelope (`generatedAt`, `reports[].provider`, `limits`,
-		// `metadata`) but leaves provider-specific extension fields permissive so
-		// the broker can ship new shapes ahead of the client. `raw` is accepted
-		// but normally stripped by the broker before send.
-		return this.#request<UsageResponse>("GET", "/v1/usage", { schema: "usageResponseSchema", signal });
+	/**
+	 * Fetch aggregate broker usage with a timeout sized for serialized
+	 * same-provider account probes.
+	 */
+	fetchUsage(options: { signal?: AbortSignal; maxAccountsPerProvider?: number } = {}): Promise<UsageResponse> {
+		const requestedAccountCount = options.maxAccountsPerProvider;
+		const accountCount =
+			typeof requestedAccountCount === "number" && Number.isFinite(requestedAccountCount)
+				? Math.max(1, Math.floor(requestedAccountCount))
+				: 1;
+		const perAccountTimeoutMs = Math.max(DEFAULT_TIMEOUT_MS, this.#timeoutMs);
+		const timeoutMs = perAccountTimeoutMs * (accountCount + 1);
+		return this.#request<UsageResponse>("GET", "/v1/usage", {
+			schema: "usageResponseSchema",
+			signal: options.signal,
+			timeoutMs,
+		});
 	}
 
 	/** Recorded usage-limit snapshots from the broker host, oldest first. */
@@ -369,7 +380,13 @@ export class AuthBrokerClient {
 	async #request<t>(
 		method: "GET" | "POST" | "DELETE",
 		path: string,
-		opts: { schema: AuthBrokerResponseSchemaName; auth?: boolean; body?: unknown; signal?: AbortSignal },
+		opts: {
+			schema: AuthBrokerResponseSchemaName;
+			auth?: boolean;
+			body?: unknown;
+			signal?: AbortSignal;
+			timeoutMs?: number;
+		},
 	): Promise<t> {
 		const response = await this.#fetchRaw(method, path, opts);
 		const text = await response.text();

package/src/auth-broker/remote-store.ts

@@ -253,6 +253,9 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	#usageInflight?: Promise<UsageReport[] | null>;
 	#credentialBlockReconcileAfter: Map<string, number> = new Map();
 	#usageCacheEpoch = 0;
+	/** Raw broker credentials retained to size aggregate usage requests before account-pool filtering. */
+	#brokerUsageProviderByCredentialId = new Map<number, Provider>();
+	#brokerUsageAccountCounts = new Map<Provider, number>();
 	/** Per-snapshot lookup of oauth credentials by provider; rebuilt when `#snapshot` is replaced. */
 	#usageFilterLookup?: { snapshot: SnapshotResponse; byProvider: Map<Provider, OAuthCredential[]> };
 	/** Memoized `#filterUsageReports` output, keyed on (input identity, lookup identity). */
@@ -296,6 +299,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 
 	#applySnapshot(snapshot: SnapshotResponse, generation: number, protectNewBlocks = true): void {
 		const nowMs = Date.now();
+		this.#replaceBrokerUsageAccounts(snapshot.credentials);
 		const previousCredentials = this.#snapshot.credentials;
 		const credentials = snapshot.credentials
 			.filter(entry => isCredentialInAccountPool(entry, this.#accountPool))
@@ -427,8 +431,9 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		generation: number,
 		serverNowMs: number,
 	): void {
+		this.#upsertBrokerUsageAccount(entry);
 		if (!isCredentialInAccountPool(entry, this.#accountPool)) {
-			this.#removeStreamCredential(entry.id, refresher, generation, serverNowMs);
+			this.#removeStreamCredential(entry.id, refresher, generation, serverNowMs, { retainBrokerUsageAccount: true });
 			return;
 		}
 		const incoming = this.#normalizeSnapshotEntryBlocks(entry, Date.now());
@@ -446,7 +451,14 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		this.#snapshotReceivedAt = Date.now();
 	}
 
-	#removeStreamCredential(id: number, refresher: RefresherSchedule, generation: number, serverNowMs: number): void {
+	#removeStreamCredential(
+		id: number,
+		refresher: RefresherSchedule,
+		generation: number,
+		serverNowMs: number,
+		options?: { retainBrokerUsageAccount?: boolean },
+	): void {
+		if (!options?.retainBrokerUsageAccount) this.#removeBrokerUsageAccount(id);
 		const removed = this.#snapshot.credentials.find(entry => entry.id === id);
 		if (removed?.blocks && removed.blocks.length > 0) this.#invalidateUsageCache();
 		const credentials = this.#snapshot.credentials.filter(entry => entry.id !== id);
@@ -1066,6 +1078,39 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		});
 	}
 
+	#replaceBrokerUsageAccounts(entries: readonly SnapshotEntry[]): void {
+		this.#brokerUsageProviderByCredentialId.clear();
+		this.#brokerUsageAccountCounts.clear();
+		for (const entry of entries) this.#upsertBrokerUsageAccount(entry);
+	}
+
+	#upsertBrokerUsageAccount(entry: Pick<SnapshotEntry, "id" | "provider">): void {
+		const previous = this.#brokerUsageProviderByCredentialId.get(entry.id);
+		if (previous === entry.provider) return;
+		if (previous !== undefined) {
+			const count = this.#brokerUsageAccountCounts.get(previous) ?? 0;
+			if (count <= 1) this.#brokerUsageAccountCounts.delete(previous);
+			else this.#brokerUsageAccountCounts.set(previous, count - 1);
+		}
+		this.#brokerUsageProviderByCredentialId.set(entry.id, entry.provider);
+		this.#brokerUsageAccountCounts.set(entry.provider, (this.#brokerUsageAccountCounts.get(entry.provider) ?? 0) + 1);
+	}
+
+	#removeBrokerUsageAccount(id: number): void {
+		const provider = this.#brokerUsageProviderByCredentialId.get(id);
+		if (provider === undefined) return;
+		this.#brokerUsageProviderByCredentialId.delete(id);
+		const count = this.#brokerUsageAccountCounts.get(provider) ?? 0;
+		if (count <= 1) this.#brokerUsageAccountCounts.delete(provider);
+		else this.#brokerUsageAccountCounts.set(provider, count - 1);
+	}
+
+	#maxBrokerUsageAccounts(): number {
+		let maximum = 1;
+		for (const count of this.#brokerUsageAccountCounts.values()) maximum = Math.max(maximum, count);
+		return maximum;
+	}
+
 	#loadUsageReports(): Promise<UsageReport[] | null> {
 		const cached = this.#usageCache;
 		if (cached && Date.now() - cached.fetchedAt < USAGE_CACHE_TTL_MS) {
@@ -1074,7 +1119,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		if (this.#usageInflight) return this.#usageInflight;
 		const epoch = this.#usageCacheEpoch;
 		const inflight = this.#client
-			.fetchUsage()
+			.fetchUsage({ maxAccountsPerProvider: this.#maxBrokerUsageAccounts() })
 			.then(body => {
 				if (epoch !== this.#usageCacheEpoch) return this.#loadUsageReports();
 				this.#usageCache = { reports: body.reports, fetchedAt: Date.now() };

package/src/auth-broker/server.ts

@@ -741,7 +741,7 @@ export function startAuthBroker(opts: AuthBrokerServerOptions): AuthBrokerServer
 				}
 				if (req.method === "POST" && pathname === "/v1/usage/stale") {
 					try {
-						opts.storage.invalidateUsageCache?.();
+						await opts.storage.invalidateUsageCache?.();
 						logger.info("auth-broker usage cache invalidated", { peer });
 						return json(200, { ok: true });
 					} catch (error) {

package/src/auth-storage.ts

@@ -677,6 +677,7 @@ const DEFAULT_USAGE_PROVIDER_MAP = new Map<Provider, UsageProvider>(
 );
 
 const USAGE_CACHE_PREFIX = "usage_cache:";
+const USAGE_FORCE_REFRESH_CACHE_PREFIX = "force-refresh:";
 const USAGE_HEADER_INGEST_INTERVAL_MS = 60_000;
 const USAGE_LAST_GOOD_RETENTION_MS = 24 * 60 * 60_000;
 /**
@@ -686,6 +687,12 @@ const USAGE_LAST_GOOD_RETENTION_MS = 24 * 60 * 60_000;
  * on the next poll.
  */
 const USAGE_FAILURE_BACKOFF_MS = 10_000;
+/**
+ * A manual invalidation persists across the next CLI process and serializes
+ * same-provider probes, avoiding a cold-account burst against IP-limited
+ * upstream usage endpoints.
+ */
+const USAGE_FORCE_REFRESH_TTL_MS = 5 * 60_000;
 // Bumped from 3s — Claude usage retries up to 3 times with exponential backoff
 // (~3.5s total worst case); a tight per-request budget aborts retries mid-cycle.
 const DEFAULT_USAGE_REQUEST_TIMEOUT_MS = 10_000;
@@ -782,6 +789,7 @@ interface UsageCache {
 	get<T>(key: string): UsageCacheEntry<T> | undefined;
 	getStale<T>(key: string): UsageCacheEntry<T> | undefined;
 	set<T>(key: string, entry: UsageCacheEntry<T>): void;
+	deletePrefix(prefix: string): boolean;
 	cleanup?(): void;
 }
 
@@ -791,6 +799,11 @@ type UsageRequestDescriptor = {
 	baseUrl?: string;
 };
 
+type ForcedUsageRefresh = {
+	all: boolean;
+	providers: Set<Provider>;
+};
+
 type AuthApiKeyOptions = {
 	baseUrl?: string;
 	modelId?: string;
@@ -1185,6 +1198,12 @@ class AuthStorageUsageCache implements UsageCache {
 		this.store.setCache(`${USAGE_CACHE_PREFIX}${key}`, payload, Math.floor(durableExpiresAt / 1000));
 	}
 
+	deletePrefix(prefix: string): boolean {
+		if (!this.store.deleteCachePrefix) return false;
+		this.store.deleteCachePrefix(`${USAGE_CACHE_PREFIX}${prefix}`);
+		return true;
+	}
+
 	cleanup(): void {
 		this.store.cleanExpiredCache();
 	}
@@ -2955,20 +2974,63 @@ export class AuthStorage {
 		return baseUrl?.trim().replace(/\/+$/, "") ?? "";
 	}
 
+	#usageCacheProviderKey(provider: Provider): string {
+		const versionOverride = USAGE_REPORT_CACHE_KEY_VERSION_OVERRIDES[provider];
+		return versionOverride === undefined ? provider : `${versionOverride}:${provider}`;
+	}
+
+	#usageForceRefreshCacheKey(provider?: Provider): string {
+		return provider
+			? `${USAGE_FORCE_REFRESH_CACHE_PREFIX}provider:${provider}`
+			: `${USAGE_FORCE_REFRESH_CACHE_PREFIX}all`;
+	}
+
+	#markUsageForceRefresh(provider?: Provider): void {
+		this.#usageCache.set(this.#usageForceRefreshCacheKey(provider), {
+			value: true,
+			expiresAt: Date.now() + USAGE_FORCE_REFRESH_TTL_MS,
+		});
+	}
+
+	#hasUsageForceRefresh(provider?: Provider): boolean {
+		const key = this.#usageForceRefreshCacheKey(provider);
+		const entry = this.#usageCache.get<boolean>(key);
+		if (entry?.value !== true) return false;
+		if (entry.expiresAt > Date.now()) return true;
+		this.#usageCache.set(key, { value: null, expiresAt: 0 });
+		return false;
+	}
+
+	#usageForceRefresh(requests: readonly UsageRequestDescriptor[]): ForcedUsageRefresh {
+		const all = this.#hasUsageForceRefresh();
+		const providers = new Set<Provider>();
+		for (const request of requests) providers.add(request.provider);
+		if (!all) {
+			for (const provider of providers) {
+				if (!this.#hasUsageForceRefresh(provider)) providers.delete(provider);
+			}
+		}
+		return { all, providers };
+	}
+
+	#clearUsageForceRefresh(refresh: ForcedUsageRefresh): void {
+		if (refresh.all) this.#usageCache.set(this.#usageForceRefreshCacheKey(), { value: null, expiresAt: 0 });
+		for (const provider of refresh.providers) {
+			this.#usageCache.set(this.#usageForceRefreshCacheKey(provider), { value: null, expiresAt: 0 });
+		}
+	}
+
 	#buildUsageReportCacheKey(request: UsageRequestDescriptor): string {
 		const baseUrl = this.#normalizeUsageBaseUrl(request.baseUrl) || "default";
 		const identity = this.#buildUsageCacheIdentity(request.credential);
-		const versionOverride = USAGE_REPORT_CACHE_KEY_VERSION_OVERRIDES[request.provider];
-		const providerKey = versionOverride === undefined ? request.provider : `${versionOverride}:${request.provider}`;
+		const providerKey = this.#usageCacheProviderKey(request.provider);
 		return `report:${providerKey}:${baseUrl}:${identity}`;
 	}
 
 	#buildUsageReportsCacheKey(requests: ReadonlyArray<UsageRequestDescriptor>): string {
 		const snapshot = requests
 			.map(request => {
-				const versionOverride = USAGE_REPORT_CACHE_KEY_VERSION_OVERRIDES[request.provider];
-				const providerKey =
-					versionOverride === undefined ? request.provider : `${versionOverride}:${request.provider}`;
+				const providerKey = this.#usageCacheProviderKey(request.provider);
 				return `${providerKey}:${this.#normalizeUsageBaseUrl(request.baseUrl) || "default"}:${this.#buildUsageCacheIdentity(request.credential)}`;
 			})
 			.sort()
@@ -3210,19 +3272,24 @@ export class AuthStorage {
 		}
 	}
 
-	async #fetchUsageCached(request: UsageRequestDescriptor, timeoutMs?: number): Promise<UsageReport | null> {
+	async #fetchUsageCached(
+		request: UsageRequestDescriptor,
+		options: { timeoutMs?: number; forceRefresh?: boolean } = {},
+	): Promise<UsageReport | null> {
+		const timeoutMs = options.timeoutMs;
+		const forceRefresh = options.forceRefresh ?? false;
 		const cacheKey = this.#buildUsageReportCacheKey(request);
 		const now = Date.now();
-		const cached = this.#usageCache.get<UsageReport | null>(cacheKey);
+		const cached = forceRefresh ? undefined : this.#usageCache.get<UsageReport | null>(cacheKey);
 		// Fresh cache hit: return whatever's there (success or null fallback).
 		if (cached && cached.expiresAt > now) {
 			return cached.value;
 		}
 
-		const inFlight = this.#usageRequestInFlight.get(cacheKey);
-		if (inFlight) return inFlight;
-
 		const usageCacheEpoch = this.#usageCacheEpoch;
+		const inFlightKey = `${cacheKey}\0${usageCacheEpoch}`;
+		const inFlight = this.#usageRequestInFlight.get(inFlightKey);
+		if (inFlight) return inFlight;
 		const promise = (async () => {
 			const report = await this.#fetchUsageUncached(request, timeoutMs);
 			if (usageCacheEpoch !== this.#usageCacheEpoch) return report;
@@ -3242,7 +3309,8 @@ export class AuthStorage {
 			// re-hit the endpoint on every poll. Most providers serve the last good
 			// value through transient failures. Session-cookie providers can opt out
 			// so an expired login does not display stale quota indefinitely.
-			const retainLastGood = this.#usageProviderResolver?.(request.provider)?.retainLastGoodOnFailure !== false;
+			const retainLastGood =
+				!forceRefresh && this.#usageProviderResolver?.(request.provider)?.retainLastGoodOnFailure !== false;
 			const lastGood = retainLastGood
 				? (this.#usageCache.getStale<UsageReport | null>(cacheKey)?.value ?? null)
 				: null;
@@ -3251,10 +3319,10 @@ export class AuthStorage {
 			this.#usageCache.set(cacheKey, { value: lastGood, expiresAt: coolDown });
 			return lastGood;
 		})().finally(() => {
-			this.#usageRequestInFlight.delete(cacheKey);
+			this.#usageRequestInFlight.delete(inFlightKey);
 		});
 
-		this.#usageRequestInFlight.set(cacheKey, promise);
+		this.#usageRequestInFlight.set(inFlightKey, promise);
 		return promise;
 	}
 
@@ -3730,10 +3798,9 @@ export class AuthStorage {
 			if (!resolvedApiKey) return null;
 			usageCredential.apiKey = resolvedApiKey;
 		}
-		return this.#fetchUsageCached(
-			this.#buildUsageRequest(provider, usageCredential, options?.baseUrl),
-			options?.timeoutMs ?? this.#usageRequestTimeoutMs,
-		);
+		return this.#fetchUsageCached(this.#buildUsageRequest(provider, usageCredential, options?.baseUrl), {
+			timeoutMs: options?.timeoutMs ?? this.#usageRequestTimeoutMs,
+		});
 	}
 
 	/**
@@ -3927,6 +3994,37 @@ export class AuthStorage {
 		return true;
 	}
 
+	/**
+	 * Fetch every requested report, keeping normal polls parallel while a
+	 * manually invalidated provider probes accounts one at a time.
+	 */
+	#fetchUsageRequests(
+		requests: readonly UsageRequestDescriptor[],
+		serializedProviders: ReadonlySet<Provider>,
+	): Promise<Array<UsageReport | null>> {
+		const tails = new Map<Provider, Promise<void>>();
+		return Promise.all(
+			requests.map(request => {
+				const forceRefresh = serializedProviders.has(request.provider);
+				if (!forceRefresh) {
+					return this.#fetchUsageCached(request, { timeoutMs: this.#usageRequestTimeoutMs });
+				}
+				const tail = tails.get(request.provider) ?? Promise.resolve();
+				const current = tail.then(() =>
+					this.#fetchUsageCached(request, { timeoutMs: this.#usageRequestTimeoutMs, forceRefresh: true }),
+				);
+				tails.set(
+					request.provider,
+					current.then(
+						() => undefined,
+						() => undefined,
+					),
+				);
+				return current;
+			}),
+		);
+	}
+
 	async fetchUsageReports(options?: {
 		baseUrlResolver?: (provider: Provider) => string | undefined;
 		/** Caller's cancel signal; only rejects this caller, never the shared upstream fetch. */
@@ -3945,15 +4043,15 @@ export class AuthStorage {
 			// dispatch + credential selection) coalesce into one upstream call.
 			// Each caller's `signal` only cancels THAT caller's await; the
 			// shared upstream fetch runs to completion so peers aren't punished.
-			const OVERRIDE_KEY = "__override__";
-			let shared = this.#usageReportsInFlight.get(OVERRIDE_KEY);
+			const overrideKey = `__override__\0${this.#usageCacheEpoch}`;
+			let shared = this.#usageReportsInFlight.get(overrideKey);
 			if (!shared) {
 				// Don't forward the caller signal into the shared fetch — first caller's
 				// abort would otherwise cancel the upstream for every peer.
 				shared = override().finally(() => {
-					this.#usageReportsInFlight.delete(OVERRIDE_KEY);
+					this.#usageReportsInFlight.delete(overrideKey);
 				});
-				this.#usageReportsInFlight.set(OVERRIDE_KEY, shared);
+				this.#usageReportsInFlight.set(overrideKey, shared);
 			}
 			const reports = await raceUsageWithSignal(shared, options?.signal);
 			if (shouldReconcileStoreHookReports && reports) this.#reconcileCodexUsageBlocksFromReports(reports);
@@ -3973,7 +4071,8 @@ export class AuthStorage {
 		// a single decorrelation snapshot for 30s, defeating the jitter (some
 		// accounts can be missing from one fetch and present in the next; the
 		// aggregate cache freezes whichever set landed first).
-		const cacheKey = this.#buildUsageReportsCacheKey(requests);
+		const forcedRefresh = this.#usageForceRefresh(requests);
+		const cacheKey = `${this.#buildUsageReportsCacheKey(requests)}\0${this.#usageCacheEpoch}`;
 
 		const inFlight = this.#usageReportsInFlight.get(cacheKey);
 		if (inFlight) return inFlight;
@@ -3989,9 +4088,7 @@ export class AuthStorage {
 				});
 			}
 
-			const results = await Promise.all(
-				requests.map(request => this.#fetchUsageCached(request, this.#usageRequestTimeoutMs)),
-			);
+			const results = await this.#fetchUsageRequests(requests, forcedRefresh.providers);
 			const reports = results.filter((report): report is UsageReport => report !== null);
 			const deduped = this.#dedupeUsageReports(reports);
 			// no outer cache write — see comment above.
@@ -4012,6 +4109,7 @@ export class AuthStorage {
 					};
 				}),
 			});
+			this.#clearUsageForceRefresh(forcedRefresh);
 			return resolved;
 		})().finally(() => {
 			this.#usageReportsInFlight.delete(cacheKey);
@@ -5729,31 +5827,32 @@ export class AuthStorage {
 	}
 
 	/**
-	 * Force-invalidate cached usage reports so the next fetch retrieves fresh
-	 * values from upstream providers. If `provider` is specified, only that
-	 * provider's credentials are invalidated; otherwise, all credentials in the
-	 * store are invalidated.
+	 * Drop report snapshots for a user-requested refresh so a failed probe
+	 * cannot replay the pre-invalidation last-good value. The persisted marker
+	 * makes the next same-provider refresh serial rather than a cold fan-out.
 	 */
-	async invalidateUsageCache(provider?: string, signal?: AbortSignal): Promise<void> {
-		if (provider) {
-			this.#invalidateUsageReportCache(provider);
-		} else {
-			this.#usageCacheEpoch += 1;
-			const expired = Date.now() - 1;
-			try {
-				const credentials = this.#store.listAuthCredentials();
-				for (const entry of credentials) {
-					if (entry.credential.type !== "oauth") continue;
-					const cacheKey = this.#buildUsageReportCacheKey(
-						this.#buildUsageRequestForOauth(entry.provider, entry.credential),
-					);
-					const existing = this.#usageCache.getStale<UsageReport | null>(cacheKey);
-					this.#usageCache.set(cacheKey, { value: existing?.value ?? null, expiresAt: expired });
-				}
-			} catch (err) {
-				logger.debug("Failed to list auth credentials for complete usage cache invalidation", { err });
+	async #clearUsageReportCache(provider?: string): Promise<void> {
+		this.#usageCacheEpoch += 1;
+		const prefix = provider ? `report:${this.#usageCacheProviderKey(provider)}:` : "report:";
+		if (!this.#usageCache.deletePrefix(prefix)) {
+			// Third-party stores may not support prefix deletion. Clear every active
+			// request key instead, including API-key and environment credentials.
+			const requests = await this.#collectUsageRequests();
+			for (const request of requests) {
+				if (provider && request.provider !== provider) continue;
+				this.#usageCache.set(this.#buildUsageReportCacheKey(request), { value: null, expiresAt: 0 });
 			}
 		}
+		if (!this.#fetchUsageReportsOverride && !this.#store.fetchUsageReports) this.#markUsageForceRefresh(provider);
+	}
+
+	/**
+	 * Discard cached usage reports before a user-requested refresh. The next
+	 * read probes upstream serially per provider; a failure reports no fresh
+	 * usage instead of replaying an invalidated last-good snapshot.
+	 */
+	async invalidateUsageCache(provider?: string, signal?: AbortSignal): Promise<void> {
+		await this.#clearUsageReportCache(provider);
 
 		if (this.#store.invalidateUsageCache) {
 			await this.#store.invalidateUsageCache(signal).catch(err => {

package/src/error/flags.ts

@@ -24,6 +24,7 @@ export const Flag = {
 	StaleResponsesItem: 0x0010_0000,
 	MalformedFunctionCall: 0x0020_0000,
 	ProviderFinishError: 0x0040_0000,
+	EmptyResponse: 0x0000_2000,
 	ContentBlocked: 0x0000_8000,
 	/** Account-scoped provider policy denial that may succeed with another credential. */
 	AccountPolicy: 0x0000_4000,
@@ -50,6 +51,7 @@ const KIND_MASK =
 	Flag.StaleResponsesItem |
 	Flag.MalformedFunctionCall |
 	Flag.ProviderFinishError |
+	Flag.EmptyResponse |
 	Flag.ContentBlocked |
 	Flag.AccountPolicy |
 	Flag.ContextOverflow |
@@ -62,7 +64,12 @@ const KIND_MASK =
 	Flag.OAuthExpiry;
 
 const RETRIABLE_KINDS =
-	Flag.Transient | Flag.UsageLimit | Flag.ThinkingLoop | Flag.StaleResponsesItem | Flag.ProviderFinishError;
+	Flag.Transient |
+	Flag.UsageLimit |
+	Flag.ThinkingLoop |
+	Flag.StaleResponsesItem |
+	Flag.ProviderFinishError |
+	Flag.EmptyResponse;
 
 const OVERFLOW_PATTERNS = [
 	/prompt is too long/i, // Anthropic
@@ -104,6 +111,7 @@ const AUTH_FAILURE_PATTERN =
 	/\b(?:401|403|unauthorized|forbidden|authentication|auth[_ ]?unavailable|no auth available|(?:invalid|no)[_ ]?api[_ ]?key)\b/i;
 const MALFORMED_FUNCTION_CALL_PATTERN = /\bmalformed.?function.?call\b/i;
 const PROVIDER_FINISH_ERROR_PATTERN = /\bProvider (?:returned error finish_reason|finish_reason:\s*error)\b/i;
+const EMPTY_RESPONSE_PATTERN = /\bthought-only response without final output\b/i;
 const CONTENT_FILTER_PATTERN = /\b(?:incomplete:\s*)?content_filter\b/i;
 const ACCOUNT_POLICY_PATTERN = /\bcyber_policy\b|trusted access for cyber/i;
 const STALE_RESPONSE_ITEM_PATTERNS = [/\bItem with id ['"][^'"]+['"] not found\.?/i, /previous[ _]?response/i] as const;
@@ -197,6 +205,7 @@ const ERROR_KIND_LABELS: readonly [Flag, string][] = [
 	[Flag.StaleResponsesItem, "stale-responses-item"],
 	[Flag.MalformedFunctionCall, "malformed-function-call"],
 	[Flag.ProviderFinishError, "provider-finish-error"],
+	[Flag.EmptyResponse, "empty-response"],
 	[Flag.ContentBlocked, "content-blocked"],
 	[Flag.AccountPolicy, "account-policy"],
 	[Flag.ContextOverflow, "context-overflow"],
@@ -340,6 +349,7 @@ function classifyText(errorMessage: string | undefined, errorStatus: number | un
 		if (matchesOverflowText(errorMessage)) kinds |= Flag.ContextOverflow;
 		if (isMalformedFunctionCallText(errorMessage)) kinds |= Flag.MalformedFunctionCall;
 		if (isProviderFinishErrorText(errorMessage)) kinds |= Flag.ProviderFinishError;
+		if (EMPTY_RESPONSE_PATTERN.test(errorMessage)) kinds |= Flag.EmptyResponse | Flag.Transient;
 		if (isContentBlockedText(errorMessage)) kinds |= Flag.ContentBlocked;
 		if (ACCOUNT_POLICY_PATTERN.test(errorMessage)) kinds |= Flag.AccountPolicy | Flag.ContentBlocked;
 		if (isAuthFailureText(errorMessage)) kinds |= Flag.AuthFailed;

package/src/error/provider.ts

@@ -9,6 +9,8 @@ export type ProviderResponseErrorKind =
 	| "output"
 	/** Response body was empty/missing when content was required. */
 	| "empty-body"
+	/** Response completed without actionable output (for example, thoughts only). */
+	| "empty-output"
 	/** Malformed wire envelope (unexpected message ordering / shape). */
 	| "envelope"
 	/** Content was blocked by a provider safety filter. */
@@ -38,11 +40,10 @@ export class ProviderResponseError extends Error {
 		this.kind = options.kind ?? "output";
 		// A safety filter block is terminal and intentionally non-retryable.
 		if (this.kind === "content-blocked") attach(this, create(Flag.ContentBlocked));
-		// An incomplete stream (connection dropped / truncated before any terminal
-		// event) or an empty body never produced any content — the request didn't
-		// complete, so it is safe to retry and eligible for model fallback. The
-		// retry layer's replay-unsafe guard still blocks a retry when partial tool
-		// output was already emitted.
+		// A logically empty completed output needs a session-level reminder that
+		// asks for the missing final answer. Empty bodies and incomplete streams
+		// stay on the generic transient retry/model-fallback path.
+		else if (this.kind === "empty-output") attach(this, create(Flag.Transient, Flag.EmptyResponse));
 		else if (this.kind === "incomplete-stream" || this.kind === "empty-body") attach(this, create(Flag.Transient));
 	}
 }

package/src/providers/google-gemini-cli.ts

@@ -622,11 +622,8 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 			const isFlashLeakModel = model.id.includes("flash");
 
 			let started = false;
-			// Tracks whether *visible* content (text delta or tool call) has been
-			// pushed downstream. `started` alone is a poor failover guard because a
-			// hidden thought part also flips it (via `ensureStarted`); a thinking-only
-			// STOP must still fail over to the alternate Antigravity endpoint (#8480).
-			let emittedVisibleContent = false;
+			// Once any stream event starts, the endpoint is committed downstream.
+			// Failover remains safe only while `started` is false.
 			let sawFinishReason = false;
 			let lastResponseId: string | undefined;
 			const ensureStarted = () => {
@@ -705,7 +702,6 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 
 				const emitVisibleText = (delta: string, thoughtSignature?: string): void => {
 					if (!delta) return;
-					emittedVisibleContent = true;
 					const block = startTextBlock();
 					block.text += delta;
 					block.textSignature = retainThoughtSignature(block.textSignature, thoughtSignature);
@@ -864,7 +860,6 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 								};
 
 								output.content.push(toolCall);
-								emittedVisibleContent = true;
 								ensureStarted();
 								pushToolCallEvents(toolCall, blockIndex(), output, stream);
 							}
@@ -932,13 +927,17 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 			};
 
 			let receivedContent = false;
+			const hasThinkingOutput = () =>
+				output.content.some(
+					block =>
+						block.type === "thinking" && (block.thinking.trim().length > 0 || Boolean(block.thinkingSignature)),
+				);
 
 			for (let i = 0; i < endpoints.length; i++) {
 				const endpoint = endpoints[i];
 				const isLastEndpoint = i === endpoints.length - 1;
 				try {
 					started = false;
-					emittedVisibleContent = false;
 					resetOutput();
 
 					// Per attempt: arm a pre-response (TTFT) timer, cleared the instant
@@ -1022,17 +1021,26 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 						}
 
 						const streamed = await streamResponse(currentResponse);
-						// Only accept an empty STOP as valid silence once every fallback
-						// endpoint is exhausted: an earlier endpoint returning empty
-						// successful streams must still fail over (Antigravity auto mode)
-						// rather than be recorded as a real silent review.
+						// Eventless silence may fail over to the alternate Antigravity
+						// endpoint. Once thinking has streamed, the endpoint is already
+						// committed downstream; Advisor mode may accept that silence,
+						// while normal sessions surface it to final-output recovery.
+						const thoughtOnly = hasThinkingOutput();
 						const acceptedSilence =
-							options?.acceptEmptyResponse === true && !streamed.strippedPlanningLeak && isLastEndpoint;
+							options?.acceptEmptyResponse === true &&
+							!streamed.strippedPlanningLeak &&
+							(isLastEndpoint || thoughtOnly);
 						if (output.stopReason !== "stop" || streamed.meaningful || acceptedSilence) {
 							receivedContent = streamed.meaningful || acceptedSilence;
 							break;
 						}
 
+						// A thought-only STOP is a complete provider response, not a
+						// transiently empty transport. Replaying the identical request
+						// burns another full reasoning pass; let session recovery add
+						// an explicit final-output reminder instead.
+						if (thoughtOnly) break;
+
 						if (emptyAttempt < MAX_EMPTY_STREAM_RETRIES) {
 							resetOutput();
 						}
@@ -1046,10 +1054,16 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 					}
 
 					if (!receivedContent) {
-						throw new AIError.ProviderResponseError("Cloud Code Assist API returned an empty response", {
-							provider: model.provider,
-							kind: "empty-body",
-						});
+						const thoughtOnly = hasThinkingOutput();
+						throw new AIError.ProviderResponseError(
+							thoughtOnly
+								? "Cloud Code Assist API returned a thought-only response without final output"
+								: "Cloud Code Assist API returned an empty response",
+							{
+								provider: model.provider,
+								kind: thoughtOnly ? "empty-output" : "empty-body",
+							},
+						);
 					}
 
 					if (options?.signal?.aborted) {
@@ -1081,7 +1095,7 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 					const status = extractHttpStatusFromError(error);
 					if (
 						!isLastEndpoint &&
-						!emittedVisibleContent &&
+						!started &&
 						(AIError.isTransientStatus(status) ||
 							(status === undefined &&
 								!(error instanceof AIError.ProviderResponseError && error.kind === "output") &&

package/src/registry/alibaba-token-plan.ts

@@ -86,9 +86,13 @@ export async function loginAlibabaTokenPlan(options: OAuthController): Promise<s
 		fetch: options.fetch,
 	});
 
+	const cookieRequestHost =
+		baseUrl === ALIBABA_TOKEN_PLAN_CN_BASE_URL ? "bailian-cs.console.aliyun.com" : "cs-data.qwencloud.com";
 	const rawCookie = await options.onPrompt({
 		message:
-			"Optional quota reporting: open browser DevTools → Network, reload the Token Plan page, filter for api.json, and select the cs-data.qwencloud.com/data/api.json request whose api query ends in /tokenplan/personal/api/v2/usage. Copy Request Headers → Cookie, then paste the complete name=value; ... value here, or press Enter to skip.",
+			baseUrl === ALIBABA_TOKEN_PLAN_CN_BASE_URL
+				? "Optional quota reporting: open browser DevTools → Network, reload the Token Plan page, filter for api.json, and select the bailian-cs.console.aliyun.com/data/api.json request whose api query ends in /tokenplan/personal/api/v2/usage. Copy Request Headers → Cookie, then paste the complete name=value; ... value here, or press Enter to skip."
+				: "Optional quota reporting: open browser DevTools → Network, reload the Token Plan page, filter for api.json, and select the cs-data.qwencloud.com/data/api.json request whose api query ends in /tokenplan/personal/api/v2/usage. Copy Request Headers → Cookie, then paste the complete name=value; ... value here, or press Enter to skip.",
 		placeholder: "name=value; name=value; ...",
 		allowEmpty: true,
 	});
@@ -107,7 +111,7 @@ export async function loginAlibabaTokenPlan(options: OAuthController): Promise<s
 		})
 	) {
 		throw new AIError.ConfigurationError(
-			"Invalid QwenCloud Cookie header. Copy the complete Cookie request header from the cs-data.qwencloud.com usage request, not a single cookie value.",
+			`Invalid QwenCloud Cookie header. Copy the complete Cookie request header from the ${cookieRequestHost} usage request, not a single cookie value.`,
 		);
 	}
 

package/src/registry/oauth/github-copilot.ts

@@ -5,10 +5,10 @@ import { scheduler } from "node:timers/promises";
 import { getBundledModels } from "@oh-my-pi/pi-catalog/models";
 import {
 	COPILOT_API_HEADERS,
+	discoverGitHubCopilotApiEndpoint,
 	getGitHubCopilotBaseUrl,
 	isPublicGitHubHost,
 	normalizeDomain,
-	normalizeGitHubCopilotApiEndpoint,
 	normalizeGitHubCopilotEnterpriseDomain,
 	OPENCODE_HEADERS,
 } from "@oh-my-pi/pi-catalog/wire/github-copilot";
@@ -226,27 +226,6 @@ export function refreshGitHubCopilotToken(
 	};
 }
 
-async function discoverGitHubCopilotApiEndpoint(token: string, fetchImpl: FetchImpl): Promise<string | undefined> {
-	try {
-		const data = await fetchJson(
-			"https://api.github.com/copilot_internal/user",
-			{
-				headers: {
-					Accept: "application/json",
-					Authorization: `token ${token}`,
-					...OPENCODE_HEADERS,
-				},
-			},
-			fetchImpl,
-		);
-		if (!data || typeof data !== "object") return undefined;
-		const endpoints = (data as { endpoints?: { api?: unknown } }).endpoints;
-		return typeof endpoints?.api === "string" ? normalizeGitHubCopilotApiEndpoint(endpoints.api) : undefined;
-	} catch {
-		return undefined;
-	}
-}
-
 /**
  * Enable a model for the user's GitHub Copilot account.
  * This is required for some models (like Claude, Grok) before they can be used.

package/src/usage/alibaba-token-plan.ts

@@ -1,5 +1,8 @@
 import { toNumber } from "@oh-my-pi/pi-catalog/utils";
-import { parseAlibabaTokenPlanCredential } from "@oh-my-pi/pi-catalog/wire/alibaba-token-plan";
+import {
+	ALIBABA_TOKEN_PLAN_CN_BASE_URL,
+	parseAlibabaTokenPlanCredential,
+} from "@oh-my-pi/pi-catalog/wire/alibaba-token-plan";
 import type {
 	CredentialRankingStrategy,
 	UsageFetchContext,
@@ -12,21 +15,45 @@ import { isRecord } from "../utils";
 import { HOUR_MS, parsePositiveTimestamp, WEEK_MS } from "./shared";
 
 const PROVIDER = "alibaba-token-plan";
-const CONSOLE_ORIGIN = "https://home.qwencloud.com";
-const DASHBOARD_URL = `${CONSOLE_ORIGIN}/billing/subscription/token-plan-individual`;
-const USER_INFO_URL = `${CONSOLE_ORIGIN}/tool/user/info.json`;
-const GATEWAY_ACTION = "IntlBroadScopeAspnGateway";
 const USAGE_API = "zeldaHttp.apikeyMgr./tokenplan/personal/api/v2/usage";
-const USAGE_URL = `https://cs-data.qwencloud.com/data/api.json?product=sfm_bailian&action=${GATEWAY_ACTION}&api=${encodeURIComponent(USAGE_API)}`;
 const BROWSER_USER_AGENT =
 	"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36";
-const CONSOLE_CORNERSTONE_PARAM = {
-	domain: "home.qwencloud.com",
-	consoleSite: "QWENCLOUD",
-	console: "ONE_CONSOLE",
-	xsp_lang: "en-US",
-	protocol: "V2",
-	productCode: "p_efm",
+const INTERNATIONAL_CONSOLE = {
+	origin: "https://home.qwencloud.com",
+	dashboardUrl: "https://home.qwencloud.com/billing/subscription/token-plan-individual",
+	sessionUrl: "https://home.qwencloud.com/tool/user/info.json",
+	gatewayAction: "IntlBroadScopeAspnGateway",
+	region: "ap-southeast-1",
+	usageUrl: `https://cs-data.qwencloud.com/data/api.json?product=sfm_bailian&action=IntlBroadScopeAspnGateway&api=${encodeURIComponent(USAGE_API)}`,
+	cornerstoneParam: {
+		domain: "home.qwencloud.com",
+		consoleSite: "QWENCLOUD",
+		console: "ONE_CONSOLE",
+		xsp_lang: "en-US",
+		protocol: "V2",
+		productCode: "p_efm",
+	},
+} as const;
+const CHINA_CONSOLE = {
+	origin: "https://bailian.console.aliyun.com",
+	dashboardUrl: "https://bailian.console.aliyun.com/cn-beijing?tab=plan",
+	sessionUrl: "https://bailian.console.aliyun.com/cn-beijing?tab=plan",
+	gatewayAction: "BroadScopeAspnGateway",
+	region: "cn-beijing",
+	usageUrl: `https://bailian-cs.console.aliyun.com/data/api.json?action=BroadScopeAspnGateway&product=sfm_bailian&api=${encodeURIComponent(USAGE_API)}`,
+	cornerstoneParam: {
+		feURL: "https://bailian.console.aliyun.com/cn-beijing?tab=plan#/efm/subscription/token-plan/personal",
+		protocol: "V2",
+		console: "ONE_CONSOLE",
+		productCode: "p_efm",
+		switchAgent: 12608464,
+		switchUserType: 3,
+		domain: "bailian.console.aliyun.com",
+		consoleSite: "BAILIAN_ALIYUN",
+		userNickName: "",
+		userPrincipalName: "",
+		xsp_lang: "zh-CN",
+	},
 } as const;
 
 function extractCookieValue(header: string, name: string): string | undefined {
@@ -102,35 +129,56 @@ async function fetchAlibabaTokenPlanUsage(
 	const credential = parseAlibabaTokenPlanCredential(params.credential.apiKey);
 	if (!credential?.cookie) return null;
 	const cookie = credential.cookie;
+	const isChina = credential.baseUrl === ALIBABA_TOKEN_PLAN_CN_BASE_URL;
+	const consoleConfig = isChina ? CHINA_CONSOLE : INTERNATIONAL_CONSOLE;
 
 	try {
-		const userResponse = await ctx.fetch(USER_INFO_URL, {
+		const sessionResponse = await ctx.fetch(consoleConfig.sessionUrl, {
 			headers: {
-				Accept: "application/json, text/plain, */*",
+				Accept: isChina
+					? "text/html,application/xhtml+xml,application/json;q=0.9,*/*;q=0.8"
+					: "application/json, text/plain, */*",
 				Cookie: cookie,
-				Referer: `${CONSOLE_ORIGIN}/`,
+				Referer: `${consoleConfig.origin}/`,
 				"User-Agent": BROWSER_USER_AGENT,
 			},
 			redirect: "manual",
 			signal: params.signal,
 		});
-		if (!userResponse.ok) {
-			ctx.logger?.warn("QwenCloud session lookup failed", { provider: PROVIDER, status: userResponse.status });
+		if (!sessionResponse.ok) {
+			ctx.logger?.warn("Alibaba Token Plan session lookup failed", {
+				provider: PROVIDER,
+				status: sessionResponse.status,
+			});
 			return null;
 		}
-		const userPayload: unknown = await userResponse.json();
-		if (!isRecord(userPayload) || !isRecord(userPayload.data) || typeof userPayload.data.secToken !== "string") {
-			ctx.logger?.warn("QwenCloud session response invalid", { provider: PROVIDER });
-			return null;
+
+		let secToken: string | undefined;
+		let accountId: string | undefined;
+		if (isChina) {
+			const html = await sessionResponse.text();
+			secToken = /\bSEC_TOKEN\s*:\s*"([^"]+)"/.exec(html)?.[1];
+			if (!secToken) {
+				ctx.logger?.warn("Alibaba Token Plan China session response invalid", { provider: PROVIDER });
+				return null;
+			}
+		} else {
+			const userPayload: unknown = await sessionResponse.json();
+			if (!isRecord(userPayload) || !isRecord(userPayload.data) || typeof userPayload.data.secToken !== "string") {
+				ctx.logger?.warn("QwenCloud session response invalid", { provider: PROVIDER });
+				return null;
+			}
+			secToken = userPayload.data.secToken;
+			accountId = accountIdFromUserData(userPayload.data);
 		}
-		const secToken = userPayload.data.secToken;
+
 		const csrf = extractCookieValue(cookie, "login_aliyunid_csrf") ?? extractCookieValue(cookie, "csrf");
 		const headers: Record<string, string> = {
 			Accept: "application/json, text/plain, */*",
 			"Content-Type": "application/x-www-form-urlencoded",
 			Cookie: cookie,
-			Origin: CONSOLE_ORIGIN,
-			Referer: DASHBOARD_URL,
+			Origin: consoleConfig.origin,
+			Referer: consoleConfig.dashboardUrl,
 			"User-Agent": BROWSER_USER_AGENT,
 			"X-Requested-With": "XMLHttpRequest",
 		};
@@ -140,16 +188,21 @@ async function fetchAlibabaTokenPlanUsage(
 		}
 		const body = new URLSearchParams({
 			product: "sfm_bailian",
-			action: GATEWAY_ACTION,
-			region: "ap-southeast-1",
+			action: consoleConfig.gatewayAction,
+			region: consoleConfig.region,
 			sec_token: secToken,
 			params: JSON.stringify({
 				Api: USAGE_API,
-				Data: { cornerstoneParam: CONSOLE_CORNERSTONE_PARAM },
+				Data: {
+					cornerstoneParam: {
+						...(isChina ? { feTraceId: crypto.randomUUID() } : {}),
+						...consoleConfig.cornerstoneParam,
+					},
+				},
 				V: "1.0",
 			}),
 		});
-		const usageResponse = await ctx.fetch(USAGE_URL, {
+		const usageResponse = await ctx.fetch(consoleConfig.usageUrl, {
 			method: "POST",
 			headers,
 			body,
@@ -157,16 +210,18 @@ async function fetchAlibabaTokenPlanUsage(
 			signal: params.signal,
 		});
 		if (!usageResponse.ok) {
-			ctx.logger?.warn("QwenCloud usage fetch failed", { provider: PROVIDER, status: usageResponse.status });
+			ctx.logger?.warn("Alibaba Token Plan usage fetch failed", {
+				provider: PROVIDER,
+				status: usageResponse.status,
+			});
 			return null;
 		}
 		const payload: unknown = await usageResponse.json();
 		if (!isRecord(payload) || payload.successResponse === false || !isRecord(payload.data)) {
-			ctx.logger?.warn("QwenCloud usage response invalid", { provider: PROVIDER });
+			ctx.logger?.warn("Alibaba Token Plan usage response invalid", { provider: PROVIDER });
 			return null;
 		}
 		const responseData = unwrapGatewayData(payload.data);
-		const accountId = accountIdFromUserData(userPayload.data);
 		const limits = [
 			buildLimit(
 				"5h",
@@ -190,10 +245,10 @@ async function fetchAlibabaTokenPlanUsage(
 			provider: PROVIDER,
 			fetchedAt: Date.now(),
 			limits,
-			metadata: { source: "qwencloud-console", ...(accountId ? { accountId } : {}) },
+			metadata: { source: isChina ? "bailian-console" : "qwencloud-console", ...(accountId ? { accountId } : {}) },
 		};
 	} catch (error) {
-		ctx.logger?.warn("QwenCloud usage request failed", {
+		ctx.logger?.warn("Alibaba Token Plan usage request failed", {
 			provider: PROVIDER,
 			error: error instanceof Error ? error.name : "unknown",
 		});