
Security News
GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.
pi-provider-alibaba-complete
Advanced tools
Alibaba Cloud provider for Pi with Coding Plan, Token Plan, pay-as-you-go, dynamic catalogs, and verified reasoning controls
Alibaba Cloud Model Studio provider for Pi and hosts that implement the Pi extension ABI, including DeepSeek Harness through pi2dsh.
It supports all six route families exposed by Alibaba:
The provider owns authentication, dynamic /models discovery, the
OpenAI-compatible transport, and model-specific request compatibility. It does
not proxy requests through another service.
The original pi-provider-alibaba@1.0.1 correctly implemented the route and
transport layer, but marked every dynamically discovered model as
reasoning: false, text-only, 128K context and 8K output. That made native Pi
and downstream hosts hide reasoning controls even for models that support
them.
This maintained package keeps the original provider architecture and adds the missing capability projection:
system role instead of OpenAI developer;enable_thinking and reasoning_effort;Do not install this package together with pi-provider-alibaba: both register
the same provider IDs.
pi install npm:pi-provider-alibaba-complete
Set the credential belonging to the product you purchased, restart Pi, then select the matching provider and model:
# Token Plan
export ALIBABA_TOKEN_PLAN_API_KEY='<your-token-plan-key>'
# Coding Plan
export ALIBABA_CODING_API_KEY='<your-coding-plan-key>'
# Pay-as-you-go DashScope API
export ALIBABA_API_KEY='<your-api-key>'
China and international routes use different endpoints. A key that can list models on the wrong route can still fail the real completion request, so always select the route matching the key's product and region.
dsh plugin --profile web add pi2dsh
dsh plugin --profile web add pi-provider-alibaba-complete
export ALIBABA_TOKEN_PLAN_API_KEY='<your-token-plan-key>'
NODE_USE_ENV_PROXY=1 dsh web
The NODE_USE_ENV_PROXY=1 prefix is needed only when your network requires the
Node process to use HTTP_PROXY / HTTPS_PROXY.
The models appear as native DSH routes, including groups such as
Alibaba Token Plan (CN). The DSH model picker reads the provider's Pi metadata
and exposes only meaningful reasoning levels.
| Model family | Selectable levels | Alibaba wire format |
|---|---|---|
| DeepSeek V4 Pro / Flash | Off, High, Max | enable_thinking + reasoning_effort |
| dated DeepSeek V4 variants | Off, Low, High, Max | enable_thinking + reasoning_effort |
| Qwen 3.8 Max | Off, Low, Medium, XHigh | enable_thinking + reasoning_effort |
| Qwen 3.6 / 3.7 hybrid models | Off, High | enable_thinking |
| always-thinking models | their real non-disableable level | no fake Off control |
Unknown models stay conservative until their protocol is known. The provider does not guess a reasoning format which a newly released model might reject.
npm install
npm run verify
The release was additionally verified against a real China Token Plan:
high and off requests;medium request;enable_thinking: true,
reasoning_effort: "high", and a system message;Based on dinhe/pi-provider-alibaba.
The reasoning and capability fix is also submitted upstream so the ecosystem
can converge on one package.
MIT
FAQs
Alibaba Cloud provider for Pi with Coding Plan, Token Plan, pay-as-you-go, dynamic catalogs, and verified reasoning controls
The npm package pi-provider-alibaba-complete receives a total of 7 weekly downloads. As such, pi-provider-alibaba-complete popularity was classified as not popular.
We found that pi-provider-alibaba-complete demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.

Research
/Security News
A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.