fix(core): normalize model base URLs across all sources

- preserve custom gateway path prefixes
- strip query, fragment, trailing slash, and known SDK suffixes
- normalize flag, environment, config, and fallback sources
- normalize auth and config writes before persistence
- add resolver, login, config, and UI coverage

Author: XXPermanentXX

docs/agents/auth-change.md

@@ -43,7 +43,7 @@ defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx
 解析分工:
 
 - `resolveApiKey()` — `auth: "apiKey"` 命令;优先级 `--api-key` > `DASHSCOPE_API_KEY` > config `api_key`
-- `resolveModelBaseUrl()` — model base URL;优先级 `--base-url` > `DASHSCOPE_BASE_URL` > config `base_url` > `REGIONS.cn`
+- `resolveModelBaseUrl()` — model base URL;优先级 `--base-url` > `DASHSCOPE_BASE_URL` > config `base_url` > `REGIONS.cn`，返回前统一去除 query、fragment、尾斜杠和已知 SDK/API Base 后缀，同时保留自定义网关前缀
 - `--config` 只选择 config 文件 block，不提升该 block 的字段优先级；内置套餐 Profile（当前为 `token-plan`）的预设仅在登录时物化写入，运行时继续走统一的 flag > env > selected config file > 默认值
 - `resolveConsole()` — `auth: "console"` 命令;当前 token 来自 config `access_token`,region/site/switchAgent 来自 flag > config > 默认
 - `resolveOpenApi()` — `auth: "openapi"` 命令;优先级 `--access-key-id/--access-key-secret` > `ALIBABA_CLOUD_ACCESS_KEY_ID/ALIBABA_CLOUD_ACCESS_KEY_SECRET` > config `access_key_*`。兼容读取旧字段 `openapi_access_key_*`,新写入只写短字段

docs/token-plan-profile-integration.md

@@ -1,6 +1,6 @@
 # Token Plan Profile 与激活配置接入方案
 
-> 状态：Token Plan 模型消费 MVP 与 Config 激活状态已实现；通用 Base URL 归一化待实现。
+> 状态：Token Plan 模型消费、Config 激活状态与通用 Base URL 归一化均已实现。
 >
 > 目标分支：`feat/cli-access-token`。
 
@@ -96,7 +96,7 @@ bl auth login \
 https://proxy.example.com/bailian
 ```
 
-紧急交付阶段以“不传 `--base-url`”的推荐登录路径为准，直接使用 `token-plan` 预设中的 canonical 根地址。完整的 SDK Base URL、自定义代理前缀和其他输入来源归一化在独立的通用 Base URL commit 中完成。在该 commit 合入前，如需显式覆盖，用户必须传入已经规范化的根地址，不能传 `/compatible-mode/v1` 或 `/apps/anthropic` 后缀。
+推荐路径仍是不传 `--base-url`，直接使用 `token-plan` 预设中的 canonical 根地址。显式覆盖时可以传服务根地址、自定义代理前缀，或带 `/compatible-mode/v1`、`/apps/anthropic` 的 SDK Base URL；CLI 会在验证和落盘前统一归一化。
 
 ### 2. 单次选择 Config
 
@@ -273,7 +273,7 @@ Selected Profile
 
 ## 通用模型 Base URL 归一化
 
-Base URL 归一化是独立的通用能力，必须在 Token Plan 接入前完成，不能只针对 Token Plan hostname 实现。
+Base URL 归一化是独立的通用能力，不针对 Token Plan hostname 做特判。
 
 ### 语义
 
@@ -480,7 +480,7 @@ feat(config): add active profile selection
 
 激活项选择的是完整 Config，而不是只选择模型消费凭证。激活 `token-plan` 后，Token Plan 管控命令也会从该 Profile 解析 OpenAPI AK/SK，Console 命令也会从该 Profile 解析 Console 凭证。如果相应凭证仍保存在顶层 `default`，用户需要为单次命令显式传入 `--config default`，或将对应凭证域登录到 `token-plan`；CLI 不为不同鉴权域做隐式跨 Profile 回退。
 
-### Commit 5：通用模型 Base URL 归一化（待实现）
+### Commit 5：通用模型 Base URL 归一化（已实现）
 
 建议提交信息：
 

packages/commands/src/commands/auth/login-api-key.ts

@@ -3,6 +3,7 @@ import {
   ExitCode,
   chatPath,
   requestJson,
+  normalizeModelBaseUrl,
   type AuthPersistPatch,
   type AuthStore,
   type Identity,
@@ -49,8 +50,12 @@ export async function validateAndPersistApiKey(
 ): Promise<void> {
   process.stderr.write("Testing key... ");
   const httpDeps = { identity: deps.identity, settings: deps.settings };
+  const baseUrl = normalizeModelBaseUrl(profile.baseUrl);
+  const persistBaseUrl = profile.persistBaseUrl
+    ? normalizeModelBaseUrl(profile.persistBaseUrl)
+    : undefined;
   const requestOpts = {
-    url: profile.baseUrl + chatPath(),
+    url: baseUrl + chatPath(),
     method: "POST",
     headers: { Authorization: `Bearer ${key}` },
     timeout: Math.min(deps.settings.timeout, 30),
@@ -81,7 +86,7 @@ export async function validateAndPersistApiKey(
   await deps.authStore.login({
     ...profile.persistPatch,
     api_key: key,
-    base_url: profile.persistBaseUrl,
+    base_url: persistBaseUrl,
     default_text_model: profile.defaultTextModel,
     default_image_model: profile.defaultImageModel,
   });

packages/commands/src/commands/auth/login.ts

@@ -1,4 +1,9 @@
-import { defineCommand, generateCLIAccessToken, getModelProfilePreset } from "bailian-cli-core";
+import {
+  defineCommand,
+  generateCLIAccessToken,
+  getModelProfilePreset,
+  normalizeModelBaseUrl,
+} from "bailian-cli-core";
 import { emitBare } from "bailian-cli-runtime";
 import { validateAndPersistApiKey } from "./login-api-key.ts";
 import { resolveConsoleOrigin, runConsoleLogin } from "./login-console.ts";
@@ -88,7 +93,7 @@ export default defineCommand({
     const store = ctx.authStore;
     const deps = { identity, settings, authStore: store };
     const key = flags.apiKey;
-    const baseUrl = flags.baseUrl || undefined;
+    const baseUrl = flags.baseUrl ? normalizeModelBaseUrl(flags.baseUrl) : undefined;
 
     if (flags.console) {
       if (settings.dryRun) {

packages/commands/src/commands/config/set.ts

@@ -35,7 +35,7 @@ export default defineCommand({
     if (settings.dryRun) {
       emitResult(
         {
-          would_set: { [resolvedKey]: value },
+          would_set: { [resolvedKey]: coerced },
           config: settings.configName ?? "default",
           config_file: ctx.configStore.path,
         },

packages/commands/src/commands/config/shared.ts

@@ -1,4 +1,4 @@
-import { BailianError, ExitCode } from "bailian-cli-core";
+import { BailianError, ExitCode, normalizeModelBaseUrl } from "bailian-cli-core";
 
 /** Config keys that `config set` / `config ui` accept for read/write. */
 export const VALID_KEYS = [
@@ -84,5 +84,7 @@ export function validateAndCoerce(key: string, value: string): string | number {
     return num;
   }
 
+  if (resolvedKey === "base_url") return normalizeModelBaseUrl(value);
+
   return value;
 }

packages/commands/tests/config-ui.test.ts

@@ -1,10 +1,11 @@
 import http from "node:http";
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { expect, test } from "vite-plus/test";
 import {
   activateConfigProfile,
+  getConfigPath,
   makeConfigStore,
   writeConfigFile,
   readConfigFile,
@@ -98,10 +99,23 @@ test("鉴权：错误 token 401、非 loopback Host 403", async () => {
 test("POST /api/profile 写命名 profile（timeout 强制为 number），空串清除键", async () => {
   await withServer(async (port) => {
     const save = await httpJson(port, "POST", `/api/profile?token=${TOKEN}`, {
-      body: { name: "stage", data: { api_key: "sk-stage", timeout: "90" } },
+      body: {
+        name: "stage",
+        data: {
+          api_key: "sk-stage",
+          timeout: "90",
+          base_url: "https://proxy.example.com/team/compatible-mode/v1/?x=1#fragment",
+        },
+      },
     });
     expect(save.status).toBe(200);
-    expect(readConfigFile("stage")).toMatchObject({ api_key: "sk-stage", timeout: 90 });
+    expect(readConfigFile("stage")).toMatchObject({
+      api_key: "sk-stage",
+      timeout: 90,
+      base_url: "https://proxy.example.com/team",
+    });
+    const rawConfig = JSON.parse(readFileSync(getConfigPath(), "utf8"));
+    expect(rawConfig.stage.base_url).toBe("https://proxy.example.com/team");
 
     // 空串清除 api_key（整块替换）
     const clear = await httpJson(port, "POST", `/api/profile?token=${TOKEN}`, {

packages/commands/tests/e2e/auth.e2e.test.ts

@@ -175,20 +175,28 @@ describe("e2e: auth", () => {
     expect(stdout).toContain("Would validate and save API key.");
   });
 
+  test("auth login --dry-run 仍校验显式 Base URL", async () => {
+    const { stderr, exitCode } = await runCommandE2e(AUTH_ROUTES, [
+      "auth",
+      "login",
+      "--dry-run",
+      "--api-key",
+      "sk-e2e-dry-run-placeholder",
+      "--base-url",
+      "ftp://example.com/models",
+    ]);
+    expect(exitCode).toBe(2);
+    expect(stderr).toMatch(/Invalid model base URL/);
+  });
+
   test("auth login --api-key 验证后原子保存凭证和 Base URL", async () => {
     const validationServer = await startValidationServer();
     const configDir = makeE2eOutputDir("auth-api-key-login");
+    const sdkBaseUrl = `${validationServer.baseUrl}/compatible-mode/v1/?source=login#fragment`;
     try {
       const login = await runCommandE2e(
         AUTH_ROUTES,
-        [
-          "auth",
-          "login",
-          "--api-key",
-          "sk-e2e-placeholder",
-          "--base-url",
-          validationServer.baseUrl,
-        ],
+        ["auth", "login", "--api-key", "sk-e2e-placeholder", "--base-url", sdkBaseUrl],
         {
           BAILIAN_CONFIG_DIR: configDir,
           DASHSCOPE_API_KEY: "",
@@ -217,6 +225,47 @@ describe("e2e: auth", () => {
     }
   });
 
+  test("auth login --config token-plan 接受 Anthropic SDK Base URL", async () => {
+    const validationServer = await startValidationServer();
+    const configDir = makeE2eOutputDir("auth-token-plan-anthropic-base-url");
+    try {
+      const login = await runCommandE2e(
+        AUTH_ROUTES,
+        [
+          "auth",
+          "login",
+          "--config",
+          "token-plan",
+          "--api-key",
+          "sk-sp-e2e-placeholder",
+          "--base-url",
+          `${validationServer.baseUrl}/apps/anthropic?source=sdk#fragment`,
+        ],
+        {
+          BAILIAN_CONFIG_DIR: configDir,
+          DASHSCOPE_API_KEY: "",
+          DASHSCOPE_BASE_URL: "",
+        },
+      );
+      expect(login.exitCode, login.stderr).toBe(0);
+      expect(validationServer.requests).toHaveLength(1);
+      expect(validationServer.requests[0].path).toBe("/compatible-mode/v1/chat/completions");
+
+      const config = JSON.parse(readFileSync(join(configDir, "config.json"), "utf8")) as Record<
+        string,
+        unknown
+      >;
+      expect(config["token-plan"]).toMatchObject({
+        api_key: "sk-sp-e2e-placeholder",
+        base_url: validationServer.baseUrl,
+        default_text_model: "qwen3.7-max",
+        default_image_model: "qwen-image-2.0",
+      });
+    } finally {
+      await validationServer.close();
+    }
+  });
+
   test("auth login --config token-plan 物化并重置内置预设", async () => {
     const validationServer = await startValidationServer();
     const configDir = makeE2eOutputDir("auth-token-plan-preset-login");

packages/commands/tests/e2e/config.e2e.test.ts

@@ -205,6 +205,43 @@ describe("e2e: config", () => {
     expect(stderr).toMatch(/Invalid timeout|positive/i);
   });
 
+  test("config set 归一化 Base URL 并拒绝非法协议", async () => {
+    const configDir = mkdtempSync(join(tmpdir(), "bl-config-base-url-"));
+    try {
+      const setResult = await runCommandE2e(
+        CONFIG_ROUTES,
+        [
+          "config",
+          "set",
+          "--key",
+          "base_url",
+          "--value",
+          "https://proxy.example.com/bailian/compatible-mode/v1/?x=1#fragment",
+          "--output",
+          "json",
+        ],
+        { BAILIAN_CONFIG_DIR: configDir },
+      );
+      expect(setResult.exitCode, setResult.stderr).toBe(0);
+      expect(parseStdoutJson<{ base_url?: string }>(setResult.stdout).base_url).toBe(
+        "https://proxy.example.com/bailian",
+      );
+      expect(JSON.parse(readFileSync(join(configDir, "config.json"), "utf8")).base_url).toBe(
+        "https://proxy.example.com/bailian",
+      );
+
+      const invalidResult = await runCommandE2e(
+        CONFIG_ROUTES,
+        ["config", "set", "--key", "base_url", "--value", "ftp://example.com/models"],
+        { BAILIAN_CONFIG_DIR: configDir },
+      );
+      expect(invalidResult.exitCode).toBe(2);
+      expect(invalidResult.stderr).toMatch(/Invalid model base URL/);
+    } finally {
+      rmSync(configDir, { recursive: true, force: true });
+    }
+  });
+
   test("config set --dry-run 不落盘（仅输出 would_set）", async () => {
     const { stdout, stderr, exitCode } = await runCommandE2e(CONFIG_ROUTES, [
       "config",
@@ -239,6 +276,23 @@ describe("e2e: config", () => {
     expect(data.would_set?.default_text_model).toBe("qwen3.7-max");
   });
 
+  test("config set --dry-run 展示归一化后的 Base URL", async () => {
+    const { stdout, stderr, exitCode } = await runCommandE2e(CONFIG_ROUTES, [
+      "config",
+      "set",
+      "--dry-run",
+      "--key",
+      "base-url",
+      "--value",
+      "https://proxy.example.com/apps/anthropic/?x=1#fragment",
+      "--output",
+      "json",
+    ]);
+    expect(exitCode, stderr).toBe(0);
+    const data = parseStdoutJson<{ would_set?: { base_url?: string } }>(stdout);
+    expect(data.would_set?.base_url).toBe("https://proxy.example.com");
+  });
+
   test("config set --dry-run 支持 AccessKey 短字段别名", async () => {
     const { stdout, stderr, exitCode } = await runCommandE2e(CONFIG_ROUTES, [
       "config",

packages/core/src/auth/resolver.ts

@@ -1,4 +1,5 @@
 import { REGIONS } from "../config/schema.ts";
+import { normalizeModelBaseUrl } from "../config/model-base-url.ts";
 import type { ResolutionSources } from "../config/loader.ts";
 import type { ApiKeyCredential, ConsoleCredential, OpenApiCredential, AuthState } from "./types.ts";
 import { BailianError } from "../errors/base.ts";
@@ -9,7 +10,9 @@ import { ExitCode } from "../errors/codes.ts";
 
 /** Model-domain baseUrl(flag > env > config file > fallback);无需 key 也可解析。 */
 export function resolveModelBaseUrl(s: ResolutionSources, fallback: string = REGIONS.cn): string {
-  return s.flags.baseUrl || s.env.DASHSCOPE_BASE_URL || s.file.base_url || fallback;
+  return normalizeModelBaseUrl(
+    s.flags.baseUrl || s.env.DASHSCOPE_BASE_URL || s.file.base_url || fallback,
+  );
 }
 
 /**