Repository navigation
fix(providers): validate bailian-coding-plan against the Token Plan host - #10634
Merged
diegosouzapw merged 2 commits intoAug 18, 2026
Merged
Conversation
The catalog entry is the personal Alibaba Token Plan, but the region map still resolved the retired Coding Plan hosts. #10290 moved only the open-sse registry (inference) to token-plan.ap-southeast-1.maas.aliyuncs.com, leaving the dashboard's key validation pointed at coding-intl.dashscope.aliyuncs.com. That host rejects Token Plan keys with 401, and validateBailianCodingPlanProvider maps 401/403 to "Invalid API key" — so adding a working key failed at the modal while the same key served inference fine. Verified live 2026-08-18 with a valid key: legacy host 401 invalid_api_key, Token Plan host 429 quota (auth OK). - point both regions of ALIBABA_PROVIDER_ENDPOINTS at the Token Plan hosts, matching what docs/providers/ALIBABA-QWEN-PROVIDER-FAMILIES.md already stated - keep the retired hosts recognized as presets, so connections saved with the old URL still follow the region selector instead of being pinned to a dead host - keep image/video generation on the DashScope AIGC hosts, which the Token Plan host does not serve - probe with a model this plan actually serves (qwen3-coder-plus was Coding Plan)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL flags URL .includes() checks as js/incomplete-url-substring-sanitization. The guard is an assertion, not a sanitizer, but comparing new URL().hostname is strictly more precise anyway — same coverage, no substring pattern.
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
…ost (cheaper-inference#10634) * fix(providers): validate bailian-coding-plan against the Token Plan host The catalog entry is the personal Alibaba Token Plan, but the region map still resolved the retired Coding Plan hosts. cheaper-inference#10290 moved only the open-sse registry (inference) to token-plan.ap-southeast-1.maas.aliyuncs.com, leaving the dashboard's key validation pointed at coding-intl.dashscope.aliyuncs.com. That host rejects Token Plan keys with 401, and validateBailianCodingPlanProvider maps 401/403 to "Invalid API key" — so adding a working key failed at the modal while the same key served inference fine. Verified live 2026-08-18 with a valid key: legacy host 401 invalid_api_key, Token Plan host 429 quota (auth OK). - point both regions of ALIBABA_PROVIDER_ENDPOINTS at the Token Plan hosts, matching what docs/providers/ALIBABA-QWEN-PROVIDER-FAMILIES.md already stated - keep the retired hosts recognized as presets, so connections saved with the old URL still follow the region selector instead of being pinned to a dead host - keep image/video generation on the DashScope AIGC hosts, which the Token Plan host does not serve - probe with a model this plan actually serves (qwen3-coder-plus was Coding Plan) * test(providers): compare parsed hostnames in the legacy-host guard CodeQL flags URL .includes() checks as js/incomplete-url-substring-sanitization. The guard is an assertion, not a sanitizer, but comparing new URL().hostname is strictly more precise anyway — same coverage, no substring pattern. --------- Co-authored-by: Xiangzhe <bakryun0718@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Adding a valid Alibaba Token Plan key to
bailian-coding-planfails in the dashboard with"Invalid API key", even with Singapore selected. Reported by the operator on the .17 box.
The catalog entry is the personal Token Plan (
providers/apikey/regional.ts→ name"Alibaba Token Plan"), but two code paths disagreed on where it lives:
token-plan.ap-southeast-1.maas.aliyuncs.comcoding-intl.dashscope.aliyuncs.comvalidateBailianCodingPlanProvidermaps 401/403 to "Invalid API key", so the legacy host'srejection surfaced as a bad key — while the very same key served inference fine.
docs/providers/ALIBABA-QWEN-PROVIDER-FAMILIES.mdalready documents the Token Plan hostsfor this provider, so this aligns code to the documented contract.
Live verification (2026-08-18, real Token Plan key)
coding-intl.dashscope.aliyuncs.com/apps/anthropic/v1/messages401 invalid_api_keytoken-plan.ap-southeast-1.maas.aliyuncs.com/apps/anthropic/v1/messages429 Throttling.AllocationQuotaThe 429 is the positive signal: auth succeeded, only the weekly quota was spent. Validation
treats non-auth 4xx as valid, so the fixed path accepts the key.
Changes
ALIBABA_PROVIDER_ENDPOINTS["bailian-coding-plan"]→ Token Plan hosts, both regions,keeping
/apps/anthropic/v1(registryformat: "claude").old URL in
providerSpecificData.baseUrl; without this it would be read as a deliberate customURL and stay pinned to the dead host, deaf to the region selector.
resolveAlibabaProviderMediaBaseUrlderived media from thechat root, so this change would have silently repointed every Bailian image/video call at a host
that does not serve
/api/v1/services/aigc/…. Media now has an explicit override.qwen3-coder-plus→qwen3.7-max(the former belonged to the Coding Plan and isabsent from
BAILIAN_CODING_PLAN_MODELS); overridable viavalidationModelId.PROVIDER_ENDPOINTS+DEFAULT_PROVIDER_BASE_URLS(dashboard placeholder) updated; pl mirrorof the provider-families doc synced with the EN original.
Tests (TDD — RED before the fix)
New
tests/unit/bailian-token-plan-endpoint-parity.test.ts(5 tests) pins validation andinference to the same host, forbids the legacy host in every default, and guards both the
retired-preset migration and the custom-URL escape hatch. Sibling suites updated where they
pinned the old host (assertions unchanged — only the URL).
bailian-token-plan-endpoint-parity+alibaba-provider-regions+bailian-coding-plan-{provider,media}+provider-validation-specialty+executor-default-base+provider-translate-path-golden: 247 pass / 0 failcheck:docs-all,check:docs-sync,check:provider-consistency: PASSno-explicit-anyinexecutor-default-base.test.tsare pre-existing and exactly match the frozen suppression count)typecheck:corefails onopen-sse/services/compression/engines/omniglyphAdapter.ts, untouched by this PR.