A CLI to migrate & modernize onto Tencent Cloud

tmb's engine (tmb/llm.py) speaks only the OpenAI Chat Completions protocol — it appends /chat/completions to endpoint and adds an Authorization: Bearer <key> header. There is no Tencent-official-TokenHub-specific logic, so any OpenAI-compatible gateway works out of the box. Below: from zero to a working run against th.quickpapa.com (a self-hosted OpenAI/Claude dual-protocol LLM relay).

① Register an account

1. Open https://th.quickpapa.com/register and enter email + password (min 8 chars).
2. A verification email is sent; click the link (valid for 24h) to activate.
3. After verifying, a ¥10 trial credit is auto-credited and usable immediately.
4. Existing accounts log in at /login; "Forgot password?" for resets.

② Create an API key

1. After login, open the Keys / Tokens tab (/api/keys) and click New key — an optional note name (e.g. tmb-prod) helps.
2. The full key (sk-…) is shown only once at creation — copy it immediately; the list later shows only a prefix. You can revoke anytime.

③ Point tmb at this gateway

# persist to config (recommended)
tmb config set endpoint https://th.quickpapa.com/v1
tmb config set api_key  sk-xxxxxxxx                # the key from step 2
tmb config set model    tokenhub-pro               # see model ids below; also glm-5.3 / deepseek-v4.1-flash / kimi-k3 / qwen3.5 / minimax-m3
tmb config                                         # confirm
tmb models                                         # list gateway models; verifies connectivity

# ad-hoc (env vars, not persisted):
#   export TMB_ENDPOINT=https://th.quickpapa.com/v1  TMB_API_KEY=sk-…  TMB_MODEL=tokenhub-pro

# team-wide: add an entry to PRESETS in tmb/config.py, then switch with one command
#   tmb config use tokenhub-self   # preset sets endpoint+model only; api_key is not overwritten

Quick self-check (without tmb): curl -H "Authorization: Bearer sk-…" https://th.quickpapa.com/v1/models — if it lists models, you're connected.

④ Notes

• endpoint must include /v1. tmb appends /chat/completions and /models automatically — stop at /v1, don't include /chat/completions.
• model is whatever the gateway actually serves, not Tencent's official TokenHub name. List with tmb models or the curl above (e.g. tokenhub-pro, glm-5.3, deepseek-v4.1-flash, kimi-k3, qwen3.5, minimax-m3, claude-sonnet-4-5, gpt-5).
• api_key is never overwritten by a preset. tmb config use <name> sets endpoint+model only and preserves the key — switch between official and self-built TokenHub without re-entering credentials.
• Billing: this relay bills per token with peak (09:00–18:00) / off-peak tiers; cache hits billed at cache rate, up to 90% off input cost; failed requests are not charged. Trial credit is limited — run tmb plan first to gauge scale before a large run.
• Same gateway also feeds Claude Code / Codex: the relay speaks Anthropic (/v1/messages + x-api-key) and OpenAI Responses (/v1/responses) protocols too — set ANTHROPIC_BASE_URL=https://th.quickpapa.com + ANTHROPIC_API_KEY for Claude Code. tmb uses only the OpenAI path.
• Identical capabilities: blue/green/red grading, verify gates, creates[] / services[], the Agent self-heal loop — all behave exactly the same on every backend.

Every call = shared system (00-system.md) + one phase user prompt. The Transform phase has two user templates:

04-transform.md  -> items[]   rewrite an EXISTING source file (carries {{FILE_CONTENT}}, edits in place)
04b-create.md     -> creates[] generate a BRAND-NEW file (no original, built from CHANGE_SPEC)

Ex 1 — generate a Dockerfile (containerize-tencent · kind=containerfile)

File: Dockerfile   Kind: containerfile
CHANGE_SPEC: Multi-stage: builder FROM maven:3.9-eclipse-temurin-21
  mvn -q -o package -DskipTests; runtime FROM eclipse-temurin:21-jre
  COPY target/*.jar; ENTRYPOINT java -jar; EXPOSE 8080;
  HEALTHCHECK /actuator/health; USER 1000
GLOBAL_CONVENTIONS: images -> TCR; credentials via Secret/env only, never literal;
  /actuator/health probes; 12-factor (PORT/DB_URL externalized)
DOMAIN_GUIDE: domains/container.md (base only)
-> outputs the full Dockerfile, no fences/commentary

Ex 2 — generate an OpenAPI contract (monolith-to-microservices · kind=contract)

File: contracts/order-svc.openapi.yaml   Kind: contract
CHANGE_SPEC: OpenAPI 3: POST /orders, GET /orders/{id};
  schemas; auth; idempotency-key header
GLOBAL_CONVENTIONS: each service self-contained; no in-process import across services;
  per-service DB/schema; shared code in common-lib
DOMAIN_GUIDE: domains/microservice.md (base only)

Contrast — rewriting an existing OrderService.java (billingService.charge() -> HTTP to billing-svc /charge) goes through 04-transform.md, which additionally injects {{FILE_CONTENT}} (the original) so it edits in place rather than generating from scratch.

# before: test/py-aws-multi/app.py
import boto3
s3  = boto3.client("s3",       region_name="us-east-1")
sqs = boto3.client("sqs",      region_name="us-east-1")
dyn = boto3.client("dynamodb", region_name="us-east-1")

Source cloud = AWS, app code → aws-sdk-to-tencent. S3→COS, SQS→CKafka/CMQ, DynamoDB→TencentDB. The DB is NoSQL, so no SQL-dialect migration — one recipe covers it. Gate: residual boto3 = 0.

tmb run ./py-aws-multi -r aws-sdk-to-tencent

# before: test/java-aws-s3/S3Uploader.java
static AmazonS3 s3 = AmazonS3ClientBuilder.standard().withRegion("us-east-1").build();
Class.forName("oracle.jdbc.OracleDriver");
DriverManager.getConnection("jdbc:oracle:thin:@dbhost:1521:ORCL", "u", "p");

Key: the app-SDK swap (S3→COS) is aws-sdk-to-tencent; but the Oracle DB is a SQL migration, out of that recipe's scope. Embedded SQL is converted in-app; stored procs / packages need a separate oracle-to-tdsql-pg-ora pass. Different DB dialect → split into an app pass + a SQL pass.

tmb run ./java-aws-s3 -r aws-sdk-to-tencent      # app + embedded SQL
tmb run ./db        -r oracle-to-tdsql-pg-ora    # PL/SQL packages

# before: test/onprem-py-app/app.py
DB_URL = "mysql+pymysql://app:secret@127.0.0.1:3306/orders"
r = redis.Redis(host="localhost", port=6379, db=0)
producer = KafkaProducer(bootstrap_servers="localhost:9092")
minio_client = Minio("localhost:9000", access_key="miniokey", secret_key="miniosecret")
celery_app = Celery("worker", broker="redis://localhost:6379/1", ...)

Self-hosted middleware → managed → onprem-to-tencent. MySQL→TencentDB for MySQL, Redis→TencentDB for Redis, Kafka→CKafka, ES→Tencent Cloud ES, MinIO→COS, Celery kept (broker→Redis/CKafka). Most data-plane libs stay; configs retarget; MinIO→COS is an SDK swap. Gate: no literal 127.0.0.1 / localhost.

tmb run ./onprem-py-app -r onprem-to-tencent

Same Oracle, different targets: TDSQL PG Oracle-compat mode → oracle-to-tdsql-pg-ora (light, most PL/SQL kept); pure PG / community PG → oracle-to-tdsql-pg-pure (strict PL/pgSQL); TDSQL-C → oracle-to-tdsql-c. UTL_FILE & other non-portable bits → red, preserved + tmb-uncertain. Gate: sqlfluff + pglast.

tmb run ./db -r oracle-to-tdsql-pg-ora

# before: test/java-springboot/application.yml
server:
  port: 8080
spring:
  datasource:
    url: jdbc:postgresql://localhost:5432/orders
    password: changeme

This is packaging, not an SDK migration → containerize-tencent. Emits brand-new creates[]: multi-stage Dockerfile, k8s/deployment.yaml + service.yaml, Secret; and externalizes config (port→${PORT:8080}, url→${DB_URL}, password→${DB_PASS}). Image→TCR, probes hit /actuator/health. --build/--test validate the new artifacts.

tmb run ./java-springboot -r containerize-tencent \
  --build "docker build -t v ." --test "kubectl apply --dry-run=client -f k8s/"

# before: test/java-monolith/OrderService.java — in-process cross-boundary calls
private final BillingService billingService = new BillingService();
private final InventoryService inventoryService = new InventoryService();
public String placeOrder(String order) {
    inventoryService.check(order);
    billingService.charge(order);
    return "ok";
}

Structural refactor → monolith-to-microservices (split along orders/billing/inventory bounded contexts). creates[]: per-service pom + entrypoint, OpenAPI contracts, common-lib; items[]: billingService.charge() → HTTP to billing-svc /charge (timeout/retry/idempotency); services[] is the decomposition map. A cross-context @Transactional → red (saga/outbox). Then containerize each service.

tmb run ./java-monolith -r monolith-to-microservices --apply --yes
tmb run ./java-monolith/services/order-svc -r containerize-tencent

Three passes, each consuming the previous output: 1. lang-modernize (javax→jakarta, 8→21) 2. aws-sdk-to-tencent (SDK→Tencent) 3. containerize-tencent (package on TKE).

tmb run ./app -r lang-modernize        --apply --yes   # 1. language
tmb run ./app -r aws-sdk-to-tencent   --apply --yes   # 2. cloud
tmb run ./app -r containerize-tencent --apply --yes   # 3. package