refactor(cli): provider-first auth registry with unified install pipeline

docs/design/auth/motivation.md

@@ -0,0 +1,111 @@
+# Auth Provider Registry Motivation
+
+The auth module used to model each setup path as a separate flow: API key,
+OAuth, subscription plans, and custom providers. In practice, all of these paths
+produce the same kind of output: updates to the user's provider configuration in
+`~/.qwen/settings.json`.
+
+This refactor makes provider setup the shared abstraction. A provider describes
+how it is shown, how credentials are collected, which models it installs, and
+which settings patch should be applied. API keys, OAuth, coding plans, token
+plans, and custom wizards are setup methods for a provider, not separate auth
+architectures.
+
+## Goals
+
+- Keep `/auth` user-facing flows easy to understand:
+  - Alibaba ModelStudio for first-party Qwen setup.
+  - Third-party providers for common built-in integrations such as DeepSeek,
+    MiniMax, and Z.AI.
+  - OAuth providers such as OpenRouter.
+  - Custom providers for local servers, proxies, or providers that are not built
+    in.
+- Move provider-specific data into small declarative provider configs.
+- Make third-party provider contributions simple: adding a common provider
+  should usually mean adding one provider config plus tests.
+- Centralize settings writes through `ProviderInstallPlan` and
+  `applyProviderInstallPlan`.
+- Keep UI grouping separate from install behavior. Groups help users navigate
+  `/auth`; they should not drive settings logic.
+- Preserve a path for model list ownership and provider metadata so provider
+  model updates can be detected and applied safely.
+
+## Architecture
+
+The new structure separates provider definitions, install logic, and UI state:
+
+```text
+packages/cli/src/auth/
+├── allProviders.ts
+├── providerConfig.ts
+├── types.ts
+├── install/
+│   └── applyProviderInstallPlan.ts
+└── providers/
+    ├── alibaba/
+    ├── custom/
+    ├── oauth/
+    └── thirdParty/
+```
+
+`ProviderConfig` is the declarative contract for built-in providers. It contains
+the provider label, protocol, base URL options, environment key, model list,
+model metadata, UI grouping, and setup behavior.
+
+`buildInstallPlan` converts a provider config and collected setup inputs into a
+`ProviderInstallPlan`. The install plan is the only object the settings writer
+needs to understand.
+
+`applyProviderInstallPlan` applies that plan by updating environment settings,
+`modelProviders`, selected auth type, optional model selection, and provider
+metadata. This keeps settings persistence independent from the UI flow that
+collected the inputs.
+
+## User flows
+
+`/auth` can still present different entry points, but they should all converge on
+the same provider install path:
+
+1. **Alibaba ModelStudio**
+   - Coding Plan
+   - Token Plan
+   - Standard API key
+
+2. **Third-party Providers**
+   - Common providers with built-in defaults.
+   - Each provider should own its base URL, env key, default models, and model
+     metadata.
+   - Z.AI must use the setup-specific base URL:
+     - Coding Plan: `https://api.z.ai/api/coding/paas/v4`
+     - Standard API key: `https://api.z.ai/api/paas/v4`
+
+3. **OAuth**
+   - Browser-based authorization for routing platforms such as OpenRouter.
+   - OAuth-specific mechanics can live in the provider implementation, but the
+     final result should still be a provider install plan.
+
+4. **Custom Provider**
+   - Manual setup for local servers, proxies, or unsupported providers.
+   - The wizard collects protocol, base URL, API key, model IDs, and advanced
+     model options such as thinking, multimodal input, context window, and max
+     tokens.
+
+## Model ownership and updates
+
+Static built-in providers can persist provider metadata under
+`providerMetadata.<providerId>`, including the model list version and base URL.
+This lets Qwen Code detect when a provider's built-in model list changes and
+prompt the user to update owned models without overwriting unrelated custom
+models.
+
+Custom providers are different: their model list is user-authored and should not
+be treated as an auto-updatable built-in model list.
+
+## Non-goals
+
+- Do not make API key, OAuth, coding plan, or token plan the top-level settings
+  architecture.
+- Do not couple settings writes to React components or CLI command handlers.
+- Do not make UI groups a business-logic axis.
+- Do not require contributors to understand the full auth UI to add a simple
+  third-party provider.

docs/users/configuration/model-providers.md

@@ -10,9 +10,9 @@ Use `modelProviders` to declare curated model lists per auth type that the `/mod
 >
 > Only the `/model` command exposes non-default auth types. Anthropic, Gemini, etc., must be defined via `modelProviders`. The `/auth` command lists Qwen OAuth, Alibaba Cloud Coding Plan, and API Key as the built-in authentication options.
 
-> [!warning]
+> [!note]
 >
-> **Duplicate model IDs within the same authType:** Defining multiple models with the same `id` under a single `authType` (e.g., two entries with `"id": "gpt-4o"` in `openai`) is currently not supported. If duplicates exist, **the first occurrence wins** and subsequent duplicates are skipped with a warning. Note that the `id` field is used both as the configuration identifier and as the actual model name sent to the API, so using unique IDs (e.g., `gpt-4o-creative`, `gpt-4o-balanced`) is not a viable workaround. This is a known limitation that we plan to address in a future release.
+> **Model uniqueness:** Models within the same `authType` are uniquely identified by the combination of `id` + `baseUrl`. This means you can define the same model ID (e.g., `"gpt-4o"`) multiple times under a single `authType` as long as each entry has a different `baseUrl` — for example, one pointing to OpenAI directly and another to a proxy endpoint. If two entries share both the same `id` and the same `baseUrl` (or both omit `baseUrl`), the first occurrence wins and subsequent duplicates are skipped with a warning.
 
 ## Configuration Examples by Auth Type
 

packages/cli/src/auth/allProviders.ts

@@ -0,0 +1,96 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Provider registry — imports all provider definitions and assembles the
+ * lookup tables used by the UI and CLI commands.
+ */
+
+import {
+  providerMatchesCredentials,
+  type ProviderConfig,
+} from './providerConfig.js';
+import { codingPlanProvider } from './providers/alibaba/codingPlan.js';
+import { tokenPlanProvider } from './providers/alibaba/tokenPlan.js';
+import { alibabaStandardProvider } from './providers/alibaba/alibabaStandard.js';
+import { openRouterProvider } from './providers/oauth/openrouter.js';
+import { deepseekProvider } from './providers/thirdParty/deepseek.js';
+import { minimaxProvider } from './providers/thirdParty/minimax.js';
+import { zaiProvider } from './providers/thirdParty/zai.js';
+import { customProvider } from './providers/custom/customProvider.js';
+
+// Re-export all providers
+export {
+  codingPlanProvider,
+  tokenPlanProvider,
+  alibabaStandardProvider,
+  openRouterProvider,
+  deepseekProvider,
+  minimaxProvider,
+  zaiProvider,
+  customProvider,
+};
+export {
+  CUSTOM_API_KEY_ENV_PREFIX,
+  generateCustomEnvKey,
+} from './providers/custom/customProvider.js';
+
+// ---------------------------------------------------------------------------
+// Provider Registry
+// ---------------------------------------------------------------------------
+
+/** All known providers, in display order. */
+export const ALL_PROVIDERS: readonly ProviderConfig[] = [
+  codingPlanProvider,
+  tokenPlanProvider,
+  alibabaStandardProvider,
+  openRouterProvider,
+  deepseekProvider,
+  minimaxProvider,
+  zaiProvider,
+  customProvider,
+];
+
+/** Providers grouped by uiGroup. */
+export const ALIBABA_PROVIDERS = ALL_PROVIDERS.filter(
+  (p) => p.uiGroup === 'alibaba',
+);
+export const THIRD_PARTY_PROVIDERS = ALL_PROVIDERS.filter(
+  (p) => p.uiGroup === 'third-party',
+);
+export const OAUTH_PROVIDERS = ALL_PROVIDERS.filter(
+  (p) => p.uiGroup === 'oauth',
+);
+
+export function findProviderById(id: string): ProviderConfig | undefined {
+  return ALL_PROVIDERS.find((p) => p.id === id);
+}
+
+/** Find a provider by model credentials (baseUrl + envKey). */
+export function findProviderByCredentials(
+  baseUrl: string | undefined,
+  envKey: string | undefined,
+): ProviderConfig | undefined {
+  return ALL_PROVIDERS.find((p) =>
+    providerMatchesCredentials(p, baseUrl, envKey),
+  );
+}
+
+/** All known provider base URLs (for preconnect, validation, etc.). */
+export function getAllProviderBaseUrls(): string[] {
+  return ALL_PROVIDERS.flatMap((p) => {
+    if (typeof p.baseUrl === 'string') return [p.baseUrl];
+    if (Array.isArray(p.baseUrl)) return p.baseUrl.map((o) => o.url);
+    return [];
+  });
+}
+
+// Re-export providerConfig utilities for convenience
+export {
+  buildInstallPlan,
+  resolveBaseUrl,
+  getDefaultModelIds,
+  shouldShowStep,
+  computeModelListVersion,
+} from './providerConfig.js';