fix(config-agent): 修复 Qwen Code 凭证写入与模型名处理

- 凭证同时写入 env 和 security.auth，避免系统 OPENAI_API_KEY 干扰
- modelProviders 中按 id + baseUrl 作为键，保持 name 为模型显示名
- 修复旧的 bailian-cli 名称，防止其覆盖用户自定义显示名
- model 配置中新增 baseUrl 字段，用于消歧同 id 但不同地址的模型
- 调整测试用例验证上述行为，确保配置一致性和兼容性

Author: lishengzxc

packages/commands/src/commands/config/agent/writers/qwen-code.ts

@@ -1,20 +1,23 @@
 import { homedir } from "os";
 import { join } from "path";
-import {
-  backup,
-  readJson,
-  writeJsonAtomic,
-  isAnthropicEndpoint,
-  type AgentDef,
-} from "./utils.ts";
+import { backup, readJson, writeJsonAtomic, isAnthropicEndpoint, type AgentDef } from "./utils.ts";
 
 const ENV_KEY = "BAILIAN_CLI_API_KEY";
 
 /**
  * Qwen Code keys `modelProviders` and `security.auth.selectedType` by the SDK
  * protocol (an AuthType string), not by a free-form provider id — the runtime
  * resolver indexes credentials/defaults by protocol. The `bailian-cli` brand
- * therefore lives in the model entry `name` and the env var name.
+ * therefore lives only in the env var name (`BAILIAN_CLI_API_KEY`); each model
+ * entry's `name` stays a human display label (Qwen Code keys models by
+ * id + baseUrl, never by name).
+ *
+ * Credentials are written to BOTH `env` (via the entry's `envKey`) and
+ * `security.auth` — the resolver reads `security.auth.apiKey/baseUrl` as a
+ * lower-priority layer, which stops a stray system `OPENAI_API_KEY` from being
+ * picked up when the provider→envKey path does not resolve first. The active
+ * `model` also carries its `baseUrl`, as Qwen Code requires to disambiguate
+ * same-id providers.
  */
 export default {
   label: "Qwen Code",
@@ -33,41 +36,47 @@ export default {
     env[ENV_KEY] = apiKey;
     settings.env = env;
 
-    // modelProviders[<protocol>] — upsert the bailian-cli model entry.
+    // modelProviders[<protocol>] — upsert this model's entry, keyed by
+    // id + baseUrl (the identity Qwen Code's registry uses). `name` is the
+    // model's DISPLAY label; keep an existing custom name, and heal the old
+    // "bailian-cli" sentinel a previous version wrote (it collided across every
+    // configured model in the picker).
     const providers = (settings.modelProviders ?? {}) as Record<
       string,
       Array<Record<string, unknown>>
     >;
-    const entries = (providers[protocol] ?? []) as Array<
-      Record<string, unknown>
-    >;
+    const entries = (providers[protocol] ?? []) as Array<Record<string, unknown>>;
+    const displayName = `[Bailian] ${model}`;
     const existing = entries.find(
       (entry) => entry.id === model && (entry.baseUrl ?? "") === baseUrl,
     );
     if (existing) {
-      existing.name = "bailian-cli";
       existing.baseUrl = baseUrl;
       existing.envKey = ENV_KEY;
+      const currentName = typeof existing.name === "string" ? existing.name.trim() : "";
+      if (!currentName || currentName === "bailian-cli") existing.name = displayName;
     } else {
       entries.push({
         id: model,
-        name: "bailian-cli",
+        name: displayName,
         baseUrl,
         envKey: ENV_KEY,
       });
     }
     providers[protocol] = entries;
     settings.modelProviders = providers;
 
-    // security.auth — select the protocol only. Credentials live in env (via
-    // each provider entry's envKey); writing apiKey/baseUrl here is not part of
-    // the v3 schema.
+    // security.auth — select the protocol AND keep credentials as a fallback
+    // layer (see the file-level note): without this, a stray system
+    // OPENAI_API_KEY can win when the provider→envKey lookup does not resolve.
     const security = (settings.security ?? {}) as Record<string, unknown>;
-    security.auth = { selectedType: protocol };
+    security.auth = { selectedType: protocol, apiKey, baseUrl };
     settings.security = security;
 
-    // model — active model id, resolved inside modelProviders[protocol].
-    settings.model = { name: model };
+    // model — active model. baseUrl MUST be written alongside name; Qwen Code
+    // uses it to disambiguate same-id providers, and omitting it can misroute
+    // to a different entry (and thus a different credential).
+    settings.model = { name: model, baseUrl };
 
     writeJsonAtomic(settingsPath, settings);
 

packages/commands/tests/config-agent-writers.test.ts

@@ -1,11 +1,4 @@
-import {
-  mkdtempSync,
-  rmSync,
-  readFileSync,
-  writeFileSync,
-  mkdirSync,
-  readdirSync,
-} from "fs";
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from "fs";
 import { tmpdir, homedir } from "os";
 import { join } from "path";
 import { afterEach, beforeEach, describe, expect, test } from "vite-plus/test";
@@ -90,12 +83,8 @@ describe("config agent writers", () => {
         apiKey: "sk-a",
         model: "qwen3-max",
       });
-      const settings = JSON.parse(
-        readFileSync(join(customDir, "settings.json"), "utf8"),
-      );
-      expect(
-        (settings.env as Record<string, string>).ANTHROPIC_AUTH_TOKEN,
-      ).toBe("sk-a");
+      const settings = JSON.parse(readFileSync(join(customDir, "settings.json"), "utf8"));
+      expect((settings.env as Record<string, string>).ANTHROPIC_AUTH_TOKEN).toBe("sk-a");
     } finally {
       delete process.env.CLAUDE_CONFIG_DIR;
     }
@@ -110,35 +99,82 @@ describe("config agent writers", () => {
     const settings = readJsonAt(".qwen", "settings.json");
     expect(settings.$version).toBe(3);
     const security = settings.security as { auth: Record<string, unknown> };
-    // security.auth 只携带 selectedType；凭证在 env + envKey 里
-    expect(security.auth).toEqual({ selectedType: "openai" });
-    expect((settings.env as Record<string, string>).BAILIAN_CLI_API_KEY).toBe(
-      "sk-q",
-    );
-    expect(settings.model).toEqual({ name: "qwen3-coder-plus" });
-    const providers = settings.modelProviders as Record<
-      string,
-      Array<Record<string, unknown>>
-    >;
+    // security.auth 携带 selectedType 以及凭证兜底（apiKey/baseUrl），
+    // 避免系统 OPENAI_API_KEY 抢占
+    expect(security.auth).toEqual({
+      selectedType: "openai",
+      apiKey: "sk-q",
+      baseUrl: OAI_URL,
+    });
+    expect((settings.env as Record<string, string>).BAILIAN_CLI_API_KEY).toBe("sk-q");
+    // model.name 必须与 baseUrl 一同写入（同 id provider 消歧契约）
+    expect(settings.model).toEqual({
+      name: "qwen3-coder-plus",
+      baseUrl: OAI_URL,
+    });
+    const providers = settings.modelProviders as Record<string, Array<Record<string, unknown>>>;
+    // name 是模型显示名（非 provider 品牌常量），品牌只在 envKey 里
     expect(providers.openai[0]).toMatchObject({
       id: "qwen3-coder-plus",
-      name: "bailian-cli",
+      name: "[Bailian] qwen3-coder-plus",
       baseUrl: OAI_URL,
       envKey: "BAILIAN_CLI_API_KEY",
     });
   });
 
+  test("qwen-code upsert 时治愈旧的 bailian-cli name 但保留用户自定义 name", () => {
+    mkdirSync(join(home, ".qwen"), { recursive: true });
+    writeFileSync(
+      join(home, ".qwen", "settings.json"),
+      JSON.stringify({
+        modelProviders: {
+          openai: [
+            {
+              id: "qwen3-coder-plus",
+              name: "bailian-cli",
+              baseUrl: OAI_URL,
+              envKey: "OLD",
+            },
+            {
+              id: "my-model",
+              name: "My Custom",
+              baseUrl: OAI_URL,
+              envKey: "OLD",
+            },
+          ],
+        },
+      }),
+    );
+
+    // 旧 sentinel 被治愈为显示名
+    qwenCode.write({
+      baseUrl: OAI_URL,
+      apiKey: "sk-q",
+      model: "qwen3-coder-plus",
+    });
+    // 用户自定义 name 不被覆盖
+    qwenCode.write({ baseUrl: OAI_URL, apiKey: "sk-q", model: "my-model" });
+
+    const settings = readJsonAt(".qwen", "settings.json");
+    const entries = (settings.modelProviders as Record<string, Array<Record<string, unknown>>>)
+      .openai;
+    const healed = entries.find((entry) => entry.id === "qwen3-coder-plus")!;
+    expect(healed.name).toBe("[Bailian] qwen3-coder-plus");
+    expect(healed.envKey).toBe("BAILIAN_CLI_API_KEY");
+    const custom = entries.find((entry) => entry.id === "my-model")!;
+    expect(custom.name).toBe("My Custom");
+  });
+
   test("qwen-code anthropic 端点走 anthropic 协议", () => {
     qwenCode.write({
       baseUrl: ANTHROPIC_URL,
       apiKey: "sk-q",
       model: "qwen3-max",
     });
     const settings = readJsonAt(".qwen", "settings.json");
-    expect(
-      (settings.security as { auth: { selectedType: string } }).auth
-        .selectedType,
-    ).toBe("anthropic");
+    expect((settings.security as { auth: { selectedType: string } }).auth.selectedType).toBe(
+      "anthropic",
+    );
     const providers = settings.modelProviders as Record<string, unknown>;
     expect(Array.isArray(providers.anthropic)).toBe(true);
     expect(providers.openai).toBeUndefined();
@@ -156,8 +192,7 @@ describe("config agent writers", () => {
       model: "qwen3-coder-plus",
     });
     const settings = readJsonAt(".qwen", "settings.json");
-    const openaiEntries = (settings.modelProviders as Record<string, unknown[]>)
-      .openai;
+    const openaiEntries = (settings.modelProviders as Record<string, unknown[]>).openai;
     expect(openaiEntries).toHaveLength(1);
   });
 
@@ -205,9 +240,7 @@ describe("config agent writers", () => {
     expect(options.baseURL).toBe(ANTHROPIC_URL);
     expect(options.apiKey).toBe("sk-o");
     expect(options.setCacheKey).toBe(true);
-    expect(
-      (provider["bailian-cli"].models as Record<string, unknown>)["qwen3-max"],
-    ).toBeDefined();
+    expect((provider["bailian-cli"].models as Record<string, unknown>)["qwen3-max"]).toBeDefined();
 
     // 非 anthropic 端点用 openai-compatible
     opencode.write({ baseUrl: OAI_URL, apiKey: "sk-o", model: "qwen3-max" });
@@ -230,9 +263,7 @@ describe("config agent writers", () => {
     const config = readJsonAt(".openclaw", "openclaw.json");
     const models = config.models as Record<string, unknown>;
     expect(models.mode).toBe("merge");
-    const bailian = (
-      models.providers as Record<string, Record<string, unknown>>
-    )["bailian-cli"];
+    const bailian = (models.providers as Record<string, Record<string, unknown>>)["bailian-cli"];
     expect(bailian.api).toBe("openai-completions");
     const entry = (bailian.models as Array<Record<string, unknown>>)[0];
     expect(entry.id).toBe("qwen3-coder-plus");
@@ -258,8 +289,7 @@ describe("config agent writers", () => {
       contextWindow: 1000000,
     });
     const config2 = readJsonAt(".openclaw", "openclaw.json");
-    const providers2 = (config2.models as Record<string, unknown>)
-      .providers as Record<
+    const providers2 = (config2.models as Record<string, unknown>).providers as Record<
       string,
       { api: string; models: Array<Record<string, unknown>> }
     >;
@@ -281,9 +311,7 @@ describe("config agent writers", () => {
       apiKey: "sk-h",
       model: "qwen3-coder-plus",
     });
-    const config = yaml.parse(
-      readFileSync(join(home, ".hermes", "config.yaml"), "utf8"),
-    );
+    const config = yaml.parse(readFileSync(join(home, ".hermes", "config.yaml"), "utf8"));
     // OpenAI 兼容端点：按官方文档省略 api_mode；无关顶层键不受影响
     expect(config.model).toEqual({
       default: "qwen3-coder-plus",
@@ -299,9 +327,7 @@ describe("config agent writers", () => {
       apiKey: "sk-h",
       model: "qwen3-max",
     });
-    const config2 = yaml.parse(
-      readFileSync(join(home, ".hermes", "config.yaml"), "utf8"),
-    );
+    const config2 = yaml.parse(readFileSync(join(home, ".hermes", "config.yaml"), "utf8"));
     expect(config2.model).toEqual({
       default: "qwen3-max",
       provider: "custom",
@@ -326,10 +352,7 @@ describe("config agent writers", () => {
       ].join("\n"),
     );
     // 预置 auth.json 无关键，验证合并保留
-    writeFileSync(
-      join(home, ".codex", "auth.json"),
-      JSON.stringify({ EXISTING: "keep" }),
-    );
+    writeFileSync(join(home, ".codex", "auth.json"), JSON.stringify({ EXISTING: "keep" }));
 
     codex.write({
       baseUrl: OAI_URL,
@@ -367,10 +390,7 @@ describe("config agent writers", () => {
 
   test("已存在的配置文件会被备份为 .bak.<epoch>", () => {
     mkdirSync(join(home, ".openclaw"), { recursive: true });
-    writeFileSync(
-      join(home, ".openclaw", "openclaw.json"),
-      JSON.stringify({ pre: 1 }),
-    );
+    writeFileSync(join(home, ".openclaw", "openclaw.json"), JSON.stringify({ pre: 1 }));
 
     openclaw.write({ baseUrl: OAI_URL, apiKey: "sk-c", model: "qwen3-max" });
     const backups = readdirSync(join(home, ".openclaw")).filter((name) =>