@link-assistant/agent 0.8.22 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/agent",
-  "version": "0.8.22",
+  "version": "0.10.0",
   "description": "A minimal, public domain AI CLI agent compatible with OpenCode's JSON interface. Bun-only runtime.",
   "main": "src/index.js",
   "type": "module",

package/src/auth/plugins.ts

@@ -1277,9 +1277,40 @@ const GooglePlugin: AuthPlugin = {
      *
      * @see https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/code_assist/server.ts
      * @see https://github.com/link-assistant/agent/issues/100
+     * @see https://github.com/link-assistant/agent/issues/102
      */
-    const CLOUD_CODE_ENDPOINT = 'https://cloudcode-pa.googleapis.com';
-    const CLOUD_CODE_API_VERSION = 'v1internal';
+    const CLOUD_CODE_ENDPOINT =
+      process.env['CODE_ASSIST_ENDPOINT'] ||
+      'https://cloudcode-pa.googleapis.com';
+    const CLOUD_CODE_API_VERSION =
+      process.env['CODE_ASSIST_API_VERSION'] || 'v1internal';
+
+    /**
+     * Synthetic thought signature used for Gemini 3+ function calls.
+     * The Cloud Code API requires function call parts in the active loop
+     * to have a thoughtSignature. This bypass value is accepted by the API.
+     *
+     * @see https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/core/geminiChat.ts
+     */
+    const SYNTHETIC_THOUGHT_SIGNATURE = 'skip_thought_signature_validator';
+
+    /**
+     * Retry configuration for transient Cloud Code API errors.
+     * Matches patterns from Gemini CLI and opencode-gemini-auth plugin.
+     */
+    const MAX_RETRIES = 2;
+    const RETRY_BASE_DELAY_MS = 800;
+    const RETRY_MAX_DELAY_MS = 8000;
+
+    /**
+     * Cached project context from Cloud Code API onboarding.
+     * Persists across requests to avoid repeated loadCodeAssist calls.
+     * Keyed by refresh token to invalidate when auth changes.
+     */
+    let cachedProjectContext: {
+      projectId?: string;
+      refreshToken: string;
+    } | null = null;
 
     log.debug(() => ({
       message: 'google oauth loader initialized',
@@ -1287,13 +1318,187 @@ const GooglePlugin: AuthPlugin = {
       apiVersion: CLOUD_CODE_API_VERSION,
     }));
 
+    /**
+     * Ensure project context is available for Cloud Code API requests.
+     * Calls loadCodeAssist to check user tier and onboards if necessary.
+     * Results are cached to avoid repeated API calls.
+     *
+     * @see https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/code_assist/setup.ts
+     */
+    const ensureProjectContext = async (
+      accessToken: string,
+      refreshToken: string
+    ): Promise<string | undefined> => {
+      // Check for explicit project ID from environment
+      const envProjectId =
+        process.env['GOOGLE_CLOUD_PROJECT'] ||
+        process.env['GOOGLE_CLOUD_PROJECT_ID'];
+      if (envProjectId) {
+        return envProjectId;
+      }
+
+      // Return cached context if still valid (same refresh token)
+      if (
+        cachedProjectContext &&
+        cachedProjectContext.refreshToken === refreshToken
+      ) {
+        return cachedProjectContext.projectId;
+      }
+
+      // Call loadCodeAssist to discover project and tier
+      try {
+        const loadUrl = `${CLOUD_CODE_ENDPOINT}/${CLOUD_CODE_API_VERSION}:loadCodeAssist`;
+        const loadRes = await fetch(loadUrl, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${accessToken}`,
+          },
+          body: JSON.stringify({
+            metadata: {
+              ideType: 'IDE_UNSPECIFIED',
+              platform: 'PLATFORM_UNSPECIFIED',
+              pluginType: 'GEMINI',
+            },
+          }),
+        });
+
+        if (!loadRes.ok) {
+          const errorText = await loadRes.text().catch(() => 'unknown');
+          log.warn(() => ({
+            message: 'loadCodeAssist failed, proceeding without project',
+            status: loadRes.status,
+            error: errorText.substring(0, 200),
+          }));
+          // Cache empty result to avoid retrying on every request
+          cachedProjectContext = { refreshToken };
+          return undefined;
+        }
+
+        const loadData = await loadRes.json();
+        log.debug(() => ({
+          message: 'loadCodeAssist response',
+          hasCurrentTier: !!loadData.currentTier,
+          tierId: loadData.currentTier?.id,
+          hasProject: !!loadData.cloudaicompanionProject,
+        }));
+
+        // If user already has a tier and project, use it
+        if (loadData.currentTier && loadData.cloudaicompanionProject) {
+          cachedProjectContext = {
+            projectId: loadData.cloudaicompanionProject,
+            refreshToken,
+          };
+          log.info(() => ({
+            message: 'user already onboarded',
+            tier: loadData.currentTier.id,
+            projectId: loadData.cloudaicompanionProject,
+          }));
+          return loadData.cloudaicompanionProject;
+        }
+
+        // If user has a tier but no project, and paidTier exists
+        if (loadData.currentTier) {
+          cachedProjectContext = { refreshToken };
+          return undefined;
+        }
+
+        // User needs onboarding - find default tier
+        let targetTierId = 'free-tier';
+        for (const tier of loadData.allowedTiers || []) {
+          if (tier.isDefault) {
+            targetTierId = tier.id;
+            break;
+          }
+        }
+
+        log.info(() => ({
+          message: 'onboarding user to tier',
+          tier: targetTierId,
+        }));
+
+        // Call onboardUser
+        const onboardUrl = `${CLOUD_CODE_ENDPOINT}/${CLOUD_CODE_API_VERSION}:onboardUser`;
+        const onboardReq =
+          targetTierId === 'free-tier'
+            ? {
+                tierId: targetTierId,
+                metadata: {
+                  ideType: 'IDE_UNSPECIFIED',
+                  platform: 'PLATFORM_UNSPECIFIED',
+                  pluginType: 'GEMINI',
+                },
+              }
+            : {
+                tierId: targetTierId,
+                cloudaicompanionProject: envProjectId,
+                metadata: {
+                  ideType: 'IDE_UNSPECIFIED',
+                  platform: 'PLATFORM_UNSPECIFIED',
+                  pluginType: 'GEMINI',
+                  duetProject: envProjectId,
+                },
+              };
+
+        let lroRes = await fetch(onboardUrl, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${accessToken}`,
+          },
+          body: JSON.stringify(onboardReq),
+        }).then((r) => r.json());
+
+        // Poll until onboarding completes (max 10 attempts)
+        let attempts = 0;
+        while (!lroRes.done && attempts < 10) {
+          await new Promise((resolve) => setTimeout(resolve, 5000));
+          if (lroRes.name) {
+            // Poll operation status
+            const opUrl = `${CLOUD_CODE_ENDPOINT}/${CLOUD_CODE_API_VERSION}/${lroRes.name}`;
+            lroRes = await fetch(opUrl, {
+              headers: { Authorization: `Bearer ${accessToken}` },
+            }).then((r) => r.json());
+          } else {
+            lroRes = await fetch(onboardUrl, {
+              method: 'POST',
+              headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${accessToken}`,
+              },
+              body: JSON.stringify(onboardReq),
+            }).then((r) => r.json());
+          }
+          attempts++;
+        }
+
+        const projectId =
+          lroRes.response?.cloudaicompanionProject?.id || undefined;
+        cachedProjectContext = { projectId, refreshToken };
+
+        log.info(() => ({
+          message: 'user onboarding complete',
+          projectId,
+          attempts,
+        }));
+
+        return projectId;
+      } catch (error) {
+        log.warn(() => ({
+          message: 'project context setup failed, proceeding without project',
+          error: String(error),
+        }));
+        cachedProjectContext = { refreshToken };
+        return undefined;
+      }
+    };
+
     /**
      * Check if we have a fallback API key available.
      * This allows trying API key authentication if Cloud Code API fails.
      * See: https://github.com/link-assistant/agent/issues/100
      */
     const getFallbackApiKey = (): string | undefined => {
-      // Check for API key in environment variables
       const envKey =
         process.env['GOOGLE_GENERATIVE_AI_API_KEY'] ||
         process.env['GEMINI_API_KEY'];
@@ -1309,19 +1514,11 @@ const GooglePlugin: AuthPlugin = {
         return envKey;
       }
 
-      log.debug(() => ({
-        message: 'no fallback api key available',
-        hint: 'Set GOOGLE_GENERATIVE_AI_API_KEY or GEMINI_API_KEY for fallback',
-      }));
-
-      // Check for API key in auth storage (async, so we need to handle this differently)
-      // For now, we only support env var fallback synchronously
       return undefined;
     };
 
     /**
      * Detect if an error is a scope-related authentication error.
-     * This is triggered when OAuth token doesn't have the required scopes.
      */
     const isScopeError = (response: Response): boolean => {
       if (response.status !== 403) return false;
@@ -1341,15 +1538,44 @@ const GooglePlugin: AuthPlugin = {
       return isScope;
     };
 
+    /**
+     * Check if a response status is retryable (transient error).
+     */
+    const isRetryableStatus = (status: number): boolean => {
+      return status === 429 || status === 503;
+    };
+
+    /**
+     * Extract retry delay from response headers or error body.
+     */
+    const getRetryDelay = (response: Response, attempt: number): number => {
+      // Check Retry-After header
+      const retryAfter = response.headers.get('retry-after');
+      if (retryAfter) {
+        const seconds = parseInt(retryAfter, 10);
+        if (!isNaN(seconds)) return seconds * 1000;
+      }
+
+      // Check retry-after-ms header
+      const retryAfterMs = response.headers.get('retry-after-ms');
+      if (retryAfterMs) {
+        const ms = parseInt(retryAfterMs, 10);
+        if (!isNaN(ms)) return ms;
+      }
+
+      // Exponential backoff
+      const delay = Math.min(
+        RETRY_BASE_DELAY_MS * Math.pow(2, attempt),
+        RETRY_MAX_DELAY_MS
+      );
+      return delay;
+    };
+
     /**
      * Transform a Generative Language API URL to Cloud Code API URL
      *
      * Input:  https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent
      * Output: https://cloudcode-pa.googleapis.com/v1internal:generateContent
-     *
-     * The Cloud Code API uses a different URL structure:
-     * - Model is passed in request body, not URL path
-     * - Method is directly after version: /v1internal:methodName
      */
     const transformToCloudCodeUrl = (url: string): string | null => {
       try {
@@ -1360,18 +1586,16 @@ const GooglePlugin: AuthPlugin = {
               'url is not generativelanguage api, skipping cloud code transform',
             hostname: parsed.hostname,
           }));
-          return null; // Not a Generative Language API URL
+          return null;
         }
 
-        // Extract the method from the path
-        // Path format: /v1beta/models/gemini-2.0-flash:generateContent
         const pathMatch = parsed.pathname.match(/:(\w+)$/);
         if (!pathMatch) {
           log.debug(() => ({
             message: 'could not extract method from url path',
             pathname: parsed.pathname,
           }));
-          return null; // Can't determine method
+          return null;
         }
 
         const method = pathMatch[1];
@@ -1395,6 +1619,14 @@ const GooglePlugin: AuthPlugin = {
       }
     };
 
+    /**
+     * Check if a URL is for a streaming request.
+     * The AI SDK appends alt=sse for streaming or uses streamGenerateContent method.
+     */
+    const isStreamingRequest = (url: string): boolean => {
+      return url.includes('streamGenerateContent') || url.includes('alt=sse');
+    };
+
     /**
      * Extract model name from Generative Language API URL
      *
@@ -1404,7 +1636,6 @@ const GooglePlugin: AuthPlugin = {
     const extractModelFromUrl = (url: string): string | null => {
       try {
         const parsed = new URL(url);
-        // Path format: /v1beta/models/gemini-2.0-flash:generateContent
         const pathMatch = parsed.pathname.match(/\/models\/([^:]+):/);
         const model = pathMatch ? pathMatch[1] : null;
 
@@ -1425,6 +1656,69 @@ const GooglePlugin: AuthPlugin = {
       }
     };
 
+    /**
+     * Inject thoughtSignature into function call parts for Gemini 3+ models.
+     *
+     * The Cloud Code API requires function call parts in model turns within
+     * the active loop to have a `thoughtSignature` property. Without this,
+     * requests with function calls will fail with 400 errors.
+     *
+     * @see https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/core/geminiChat.ts
+     * @see https://github.com/sst/opencode/issues/4832
+     */
+    const injectThoughtSignatures = (request: any): any => {
+      if (!request?.contents || !Array.isArray(request.contents)) {
+        return request;
+      }
+
+      // Find the start of the active loop (last user turn with text)
+      let activeLoopStartIndex = -1;
+      for (let i = request.contents.length - 1; i >= 0; i--) {
+        const content = request.contents[i];
+        if (
+          content.role === 'user' &&
+          content.parts?.some((p: any) => p.text)
+        ) {
+          activeLoopStartIndex = i;
+          break;
+        }
+      }
+
+      if (activeLoopStartIndex === -1) {
+        return request;
+      }
+
+      // Inject thoughtSignature into the first functionCall in each model turn
+      const newContents = [...request.contents];
+      let modified = false;
+      for (let i = activeLoopStartIndex; i < newContents.length; i++) {
+        const content = newContents[i];
+        if (content.role === 'model' && content.parts) {
+          const newParts = [...content.parts];
+          for (let j = 0; j < newParts.length; j++) {
+            const part = newParts[j];
+            if (part.functionCall && !part.thoughtSignature) {
+              newParts[j] = {
+                ...part,
+                thoughtSignature: SYNTHETIC_THOUGHT_SIGNATURE,
+              };
+              newContents[i] = { ...content, parts: newParts };
+              modified = true;
+              break; // Only the first functionCall in each turn
+            }
+          }
+        }
+      }
+
+      if (modified) {
+        log.debug(() => ({
+          message: 'injected thoughtSignature into function call parts',
+        }));
+      }
+
+      return { ...request, contents: newContents };
+    };
+
     /**
      * Transform request body for Cloud Code API
      *
@@ -1432,29 +1726,30 @@ const GooglePlugin: AuthPlugin = {
      * {
      *   model: "gemini-2.0-flash",
      *   project: "optional-project-id",
-     *   user_prompt_id: "optional-prompt-id",
      *   request: { contents: [...], generationConfig: {...}, ... }
      * }
-     *
-     * The standard AI SDK sends:
-     * { contents: [...], generationConfig: {...}, ... }
      */
-    const transformRequestBody = (body: string, model: string): string => {
+    const transformRequestBody = (
+      body: string,
+      model: string,
+      projectId?: string
+    ): string => {
       try {
-        const parsed = JSON.parse(body);
+        let parsed = JSON.parse(body);
 
-        // Get project ID from environment if available
-        const projectId =
-          process.env['GOOGLE_CLOUD_PROJECT'] ||
-          process.env['GOOGLE_CLOUD_PROJECT_ID'];
+        // Inject thoughtSignature for function calls
+        parsed = injectThoughtSignatures(parsed);
 
         // Wrap in Cloud Code API format
-        const cloudCodeRequest = {
+        const cloudCodeRequest: Record<string, unknown> = {
           model,
-          ...(projectId && { project: projectId }),
           request: parsed,
         };
 
+        if (projectId) {
+          cloudCodeRequest.project = projectId;
+        }
+
         log.debug(() => ({
           message: 'transformed request body for cloud code api',
           model,
@@ -1469,7 +1764,7 @@ const GooglePlugin: AuthPlugin = {
           message: 'failed to transform request body, using original',
           error: String(error),
         }));
-        return body; // Return original if parsing fails
+        return body;
       }
     };
 
@@ -1495,10 +1790,7 @@ const GooglePlugin: AuthPlugin = {
         isStreaming,
       }));
 
-      // For streaming responses, we need to transform each chunk
       if (isStreaming) {
-        // The Cloud Code API returns SSE with data: { response: {...} } format
-        // We need to transform each chunk to unwrap the response
         const reader = response.body?.getReader();
         if (!reader) {
           log.debug(() => ({
@@ -1528,12 +1820,10 @@ const GooglePlugin: AuthPlugin = {
                 const text = decoder.decode(value, { stream: true });
                 chunkCount++;
 
-                // Split by SSE event boundaries
                 const events = text.split('\n\n');
                 for (const event of events) {
                   if (!event.trim()) continue;
 
-                  // Check if this is a data line
                   if (event.startsWith('data: ')) {
                     try {
                       const jsonStr = event.slice(6).trim();
@@ -1543,8 +1833,6 @@ const GooglePlugin: AuthPlugin = {
                       }
 
                       const parsed = JSON.parse(jsonStr);
-
-                      // Unwrap Cloud Code response format if present
                       const unwrapped = parsed.response || parsed;
                       controller.enqueue(
                         encoder.encode(
@@ -1552,11 +1840,9 @@ const GooglePlugin: AuthPlugin = {
                         )
                       );
                     } catch {
-                      // If parsing fails, pass through as-is
                       controller.enqueue(encoder.encode(event + '\n\n'));
                     }
                   } else {
-                    // Non-data lines (like event type), pass through
                     controller.enqueue(encoder.encode(event + '\n\n'));
                   }
                 }
@@ -1634,6 +1920,10 @@ const GooglePlugin: AuthPlugin = {
               ? 'no access token'
               : 'token expiring soon',
           }));
+
+          // Invalidate project cache when token changes
+          cachedProjectContext = null;
+
           const response = await fetch(GOOGLE_TOKEN_URL, {
             method: 'POST',
             headers: {
@@ -1698,50 +1988,94 @@ const GooglePlugin: AuthPlugin = {
 
         // If this is a Generative Language API request, route through Cloud Code API
         if (cloudCodeUrl && model) {
+          // Ensure project context is available (onboard if needed)
+          const projectId = await ensureProjectContext(
+            currentAuth.access,
+            currentAuth.refresh
+          );
+
           log.info(() => ({
             message: 'routing google oauth request through cloud code api',
             originalUrl: originalUrl.substring(0, 100) + '...',
             cloudCodeUrl,
             model,
+            projectId: projectId || '(none)',
           }));
 
           // Transform request body to Cloud Code format
           let body = init?.body;
           if (typeof body === 'string') {
-            body = transformRequestBody(body, model);
+            body = transformRequestBody(body, model, projectId);
           }
 
-          // Make request to Cloud Code API with Bearer token
+          // Build Cloud Code API URL with alt=sse for streaming
+          let finalCloudCodeUrl = cloudCodeUrl;
+          if (isStreamingRequest(originalUrl)) {
+            const separator = finalCloudCodeUrl.includes('?') ? '&' : '?';
+            finalCloudCodeUrl = `${finalCloudCodeUrl}${separator}alt=sse`;
+          }
+
+          // Make request to Cloud Code API with Bearer token and retry logic
           const headers: Record<string, string> = {
             ...(init?.headers as Record<string, string>),
             Authorization: `Bearer ${currentAuth.access}`,
-            'x-goog-api-client': 'agent/0.6.3',
+            'x-goog-api-client': `agent/${process.env['npm_package_version'] || '0.7.0'}`,
           };
-          // Remove any API key header if present since we're using OAuth
           delete headers['x-goog-api-key'];
 
           log.debug(() => ({
             message: 'sending request to cloud code api',
-            url: cloudCodeUrl,
+            url: finalCloudCodeUrl,
             hasBody: !!body,
           }));
 
-          const cloudCodeResponse = await fetch(cloudCodeUrl, {
-            ...init,
-            body,
-            headers,
-          });
+          // Retry loop for transient errors
+          let lastResponse: Response | null = null;
+          for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+            if (attempt > 0) {
+              const delay = getRetryDelay(lastResponse!, attempt - 1);
+              log.info(() => ({
+                message: 'retrying cloud code api request',
+                attempt,
+                delayMs: delay,
+                previousStatus: lastResponse?.status,
+              }));
+              await new Promise((resolve) => setTimeout(resolve, delay));
+            }
 
-          log.debug(() => ({
-            message: 'cloud code api response received',
-            status: cloudCodeResponse.status,
-            statusText: cloudCodeResponse.statusText,
-            contentType: cloudCodeResponse.headers.get('content-type'),
-          }));
+            const cloudCodeResponse = await fetch(finalCloudCodeUrl, {
+              ...init,
+              body,
+              headers,
+            });
 
-          // Check for errors and handle fallback
-          if (!cloudCodeResponse.ok) {
-            // Try to get error details for logging
+            log.debug(() => ({
+              message: 'cloud code api response received',
+              status: cloudCodeResponse.status,
+              statusText: cloudCodeResponse.statusText,
+              contentType: cloudCodeResponse.headers.get('content-type'),
+              attempt,
+            }));
+
+            // Success - transform and return
+            if (cloudCodeResponse.ok) {
+              log.debug(() => ({
+                message:
+                  'cloud code api request successful, transforming response',
+              }));
+              return transformResponseBody(cloudCodeResponse);
+            }
+
+            // Retryable error
+            if (
+              isRetryableStatus(cloudCodeResponse.status) &&
+              attempt < MAX_RETRIES
+            ) {
+              lastResponse = cloudCodeResponse;
+              continue;
+            }
+
+            // Non-retryable error or max retries reached
             const errorBody = await cloudCodeResponse
               .clone()
               .text()
@@ -1751,6 +2085,7 @@ const GooglePlugin: AuthPlugin = {
               status: cloudCodeResponse.status,
               statusText: cloudCodeResponse.statusText,
               errorBody: errorBody.substring(0, 500),
+              attempt,
             }));
 
             const fallbackApiKey = getFallbackApiKey();
@@ -1762,18 +2097,12 @@ const GooglePlugin: AuthPlugin = {
                 fallbackTarget: originalUrl.substring(0, 100),
               }));
 
-              // Fall back to standard API with API key
               const apiKeyHeaders: Record<string, string> = {
                 ...(init?.headers as Record<string, string>),
                 'x-goog-api-key': fallbackApiKey,
               };
               delete apiKeyHeaders['Authorization'];
 
-              log.debug(() => ({
-                message: 'sending fallback request with api key',
-                url: originalUrl.substring(0, 100),
-              }));
-
               return fetch(originalUrl, {
                 ...init,
                 headers: apiKeyHeaders,
@@ -1786,16 +2115,11 @@ const GooglePlugin: AuthPlugin = {
               hint: 'Set GOOGLE_GENERATIVE_AI_API_KEY or GEMINI_API_KEY environment variable for fallback',
             }));
 
-            // No fallback available, return the error response
             return cloudCodeResponse;
           }
 
-          log.debug(() => ({
-            message: 'cloud code api request successful, transforming response',
-          }));
-
-          // Transform response back to standard format
-          return transformResponseBody(cloudCodeResponse);
+          // Should not reach here, but return last response as safety net
+          return lastResponse!;
         }
 
         // Not a Generative Language API request, use standard OAuth flow
@@ -1857,6 +2181,455 @@ const GooglePlugin: AuthPlugin = {
   },
 };
 
+/**
+ * Qwen OAuth Configuration
+ * Used for Qwen Coder subscription authentication via chat.qwen.ai
+ *
+ * Based on the official Qwen Code CLI (QwenLM/qwen-code)
+ * and qwen-auth-opencode reference implementation:
+ * https://github.com/QwenLM/Qwen3-Coder
+ * https://github.com/lion-lef/qwen-auth-opencode
+ */
+const QWEN_OAUTH_CLIENT_ID = 'f0304373b74a44d2b584a3fb70ca9e56';
+const QWEN_OAUTH_SCOPE = 'openid profile email model.completion';
+const QWEN_OAUTH_DEVICE_CODE_ENDPOINT =
+  'https://chat.qwen.ai/api/v1/oauth2/device/code';
+const QWEN_OAUTH_TOKEN_ENDPOINT = 'https://chat.qwen.ai/api/v1/oauth2/token';
+const QWEN_OAUTH_DEFAULT_API_URL = 'https://portal.qwen.ai/v1';
+
+/**
+ * Detect if running in a headless environment (no GUI)
+ */
+function isHeadlessEnvironment(): boolean {
+  // Check common headless indicators
+  if (!process.stdout.isTTY) return true;
+  if (process.env.SSH_CLIENT || process.env.SSH_TTY) return true;
+  if (process.env.CI) return true;
+  if (!process.env.DISPLAY && process.platform === 'linux') return true;
+  return false;
+}
+
+/**
+ * Open URL in the default browser
+ */
+function openBrowser(url: string): void {
+  const platform = process.platform;
+  let command: string;
+
+  if (platform === 'darwin') {
+    command = 'open';
+  } else if (platform === 'win32') {
+    command = 'start';
+  } else {
+    command = 'xdg-open';
+  }
+
+  Bun.spawn([command, url], { stdout: 'ignore', stderr: 'ignore' });
+}
+
+/**
+ * Qwen OAuth Plugin
+ * Supports Qwen Coder subscription via OAuth device flow.
+ *
+ * Uses OAuth 2.0 Device Authorization Grant (RFC 8628) with PKCE (RFC 7636),
+ * matching the official Qwen Code CLI implementation.
+ *
+ * @see https://github.com/QwenLM/Qwen3-Coder
+ */
+const QwenPlugin: AuthPlugin = {
+  provider: 'qwen-coder',
+  methods: [
+    {
+      label: 'Qwen Coder Subscription (OAuth)',
+      type: 'oauth',
+      async authorize() {
+        // Generate PKCE pair
+        const codeVerifier = generateRandomString(32);
+        const codeChallenge = generateCodeChallenge(codeVerifier);
+
+        // Request device code
+        const deviceResponse = await fetch(QWEN_OAUTH_DEVICE_CODE_ENDPOINT, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+          },
+          body: new URLSearchParams({
+            client_id: QWEN_OAUTH_CLIENT_ID,
+            scope: QWEN_OAUTH_SCOPE,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+          }).toString(),
+        });
+
+        if (!deviceResponse.ok) {
+          const errorText = await deviceResponse.text();
+          log.error(() => ({
+            message: 'qwen oauth device code request failed',
+            status: deviceResponse.status,
+            error: errorText,
+          }));
+          throw new Error(
+            `Device authorization failed: ${deviceResponse.status}`
+          );
+        }
+
+        const deviceData = (await deviceResponse.json()) as {
+          device_code: string;
+          user_code: string;
+          verification_uri: string;
+          verification_uri_complete: string;
+          expires_in: number;
+          interval?: number;
+        };
+
+        const pollInterval = (deviceData.interval || 2) * 1000;
+        const maxPollAttempts = Math.ceil(
+          deviceData.expires_in / (pollInterval / 1000)
+        );
+
+        // Try to open browser in non-headless environments
+        if (!isHeadlessEnvironment()) {
+          try {
+            openBrowser(deviceData.verification_uri_complete);
+          } catch {
+            // Ignore browser open errors
+          }
+        }
+
+        const instructions = isHeadlessEnvironment()
+          ? `Visit: ${deviceData.verification_uri}\nEnter code: ${deviceData.user_code}`
+          : `Opening browser for authentication...\nIf browser doesn't open, visit: ${deviceData.verification_uri}\nEnter code: ${deviceData.user_code}`;
+
+        return {
+          url: deviceData.verification_uri_complete,
+          instructions,
+          method: 'auto' as const,
+          async callback(): Promise<AuthResult> {
+            // Poll for authorization completion
+            for (let attempt = 0; attempt < maxPollAttempts; attempt++) {
+              const tokenResponse = await fetch(QWEN_OAUTH_TOKEN_ENDPOINT, {
+                method: 'POST',
+                headers: {
+                  'Content-Type': 'application/x-www-form-urlencoded',
+                  Accept: 'application/json',
+                },
+                body: new URLSearchParams({
+                  client_id: QWEN_OAUTH_CLIENT_ID,
+                  device_code: deviceData.device_code,
+                  grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                  code_verifier: codeVerifier,
+                }).toString(),
+              });
+
+              if (!tokenResponse.ok) {
+                const errorText = await tokenResponse.text();
+                try {
+                  const errorJson = JSON.parse(errorText);
+                  if (
+                    errorJson.error === 'authorization_pending' ||
+                    errorJson.error === 'slow_down'
+                  ) {
+                    await new Promise((resolve) =>
+                      setTimeout(
+                        resolve,
+                        errorJson.error === 'slow_down'
+                          ? pollInterval * 1.5
+                          : pollInterval
+                      )
+                    );
+                    continue;
+                  }
+                } catch {
+                  // JSON parse failed, treat as regular error
+                }
+
+                log.error(() => ({
+                  message: 'qwen oauth token poll failed',
+                  status: tokenResponse.status,
+                  error: errorText,
+                }));
+                return { type: 'failed' };
+              }
+
+              const tokenData = (await tokenResponse.json()) as {
+                access_token: string;
+                refresh_token?: string;
+                token_type: string;
+                expires_in: number;
+                resource_url?: string;
+              };
+
+              return {
+                type: 'success',
+                refresh: tokenData.refresh_token || '',
+                access: tokenData.access_token,
+                expires: Date.now() + tokenData.expires_in * 1000,
+              };
+            }
+
+            log.error(() => ({
+              message: 'qwen oauth authorization timeout',
+            }));
+            return { type: 'failed' };
+          },
+        };
+      },
+    },
+  ],
+  async loader(getAuth, provider) {
+    const auth = await getAuth();
+    if (!auth || auth.type !== 'oauth') return {};
+
+    // Zero out cost for subscription users (free tier)
+    if (provider?.models) {
+      for (const model of Object.values(provider.models)) {
+        (model as any).cost = {
+          input: 0,
+          output: 0,
+          cache: {
+            read: 0,
+            write: 0,
+          },
+        };
+      }
+    }
+
+    return {
+      apiKey: 'oauth-token-used-via-custom-fetch',
+      baseURL: QWEN_OAUTH_DEFAULT_API_URL,
+      async fetch(input: RequestInfo | URL, init?: RequestInit) {
+        let currentAuth = await getAuth();
+        if (!currentAuth || currentAuth.type !== 'oauth')
+          return fetch(input, init);
+
+        // Refresh token if expired (with 5 minute buffer)
+        const FIVE_MIN_MS = 5 * 60 * 1000;
+        if (
+          !currentAuth.access ||
+          currentAuth.expires < Date.now() + FIVE_MIN_MS
+        ) {
+          if (!currentAuth.refresh) {
+            log.error(() => ({
+              message:
+                'qwen oauth token expired and no refresh token available',
+            }));
+            throw new Error(
+              'Qwen OAuth token expired. Please re-authenticate with: agent auth login'
+            );
+          }
+
+          log.info(() => ({
+            message: 'refreshing qwen oauth token',
+            reason: !currentAuth.access
+              ? 'no access token'
+              : 'token expiring soon',
+          }));
+
+          const response = await fetch(QWEN_OAUTH_TOKEN_ENDPOINT, {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/x-www-form-urlencoded',
+              Accept: 'application/json',
+            },
+            body: new URLSearchParams({
+              grant_type: 'refresh_token',
+              refresh_token: currentAuth.refresh,
+              client_id: QWEN_OAUTH_CLIENT_ID,
+            }),
+          });
+
+          if (!response.ok) {
+            const errorText = await response.text().catch(() => 'unknown');
+            log.error(() => ({
+              message: 'qwen oauth token refresh failed',
+              status: response.status,
+              error: errorText.substring(0, 200),
+            }));
+            throw new Error(
+              `Qwen token refresh failed: ${response.status}. Please re-authenticate with: agent auth login`
+            );
+          }
+
+          const json = await response.json();
+          log.info(() => ({
+            message: 'qwen oauth token refreshed successfully',
+            expiresIn: json.expires_in,
+          }));
+
+          await Auth.set('qwen-coder', {
+            type: 'oauth',
+            refresh: json.refresh_token || currentAuth.refresh,
+            access: json.access_token,
+            expires: Date.now() + json.expires_in * 1000,
+          });
+          currentAuth = {
+            type: 'oauth',
+            refresh: json.refresh_token || currentAuth.refresh,
+            access: json.access_token,
+            expires: Date.now() + json.expires_in * 1000,
+          };
+        }
+
+        const headers: Record<string, string> = {
+          ...(init?.headers as Record<string, string>),
+          Authorization: `Bearer ${currentAuth.access}`,
+        };
+        delete headers['x-api-key'];
+
+        return fetch(input, {
+          ...init,
+          headers,
+        });
+      },
+    };
+  },
+};
+
+/**
+ * Alibaba Plugin (alias for Qwen Coder)
+ * This provides a separate menu entry for Alibaba
+ * with the same Qwen Coder subscription authentication.
+ */
+const AlibabaPlugin: AuthPlugin = {
+  provider: 'alibaba',
+  methods: [
+    {
+      label: 'Qwen Coder Subscription (OAuth)',
+      type: 'oauth',
+      async authorize() {
+        // Delegate to QwenPlugin's OAuth method
+        const qwenMethod = QwenPlugin.methods[0];
+        if (qwenMethod?.authorize) {
+          const result = await qwenMethod.authorize({});
+          // Override the callback to save as alibaba provider
+          if ('callback' in result) {
+            const originalCallback = result.callback;
+            return {
+              ...result,
+              async callback(code?: string): Promise<AuthResult> {
+                const authResult = await originalCallback(code);
+                if (authResult.type === 'success' && 'refresh' in authResult) {
+                  return {
+                    ...authResult,
+                    provider: 'alibaba',
+                  };
+                }
+                return authResult;
+              },
+            };
+          }
+        }
+        return {
+          method: 'auto' as const,
+          async callback(): Promise<AuthResult> {
+            return { type: 'failed' };
+          },
+        };
+      },
+    },
+  ],
+  async loader(getAuth, provider) {
+    const auth = await getAuth();
+    if (!auth || auth.type !== 'oauth') return {};
+
+    // Zero out cost for subscription users (free tier)
+    if (provider?.models) {
+      for (const model of Object.values(provider.models)) {
+        (model as any).cost = {
+          input: 0,
+          output: 0,
+          cache: {
+            read: 0,
+            write: 0,
+          },
+        };
+      }
+    }
+
+    return {
+      apiKey: 'oauth-token-used-via-custom-fetch',
+      baseURL: QWEN_OAUTH_DEFAULT_API_URL,
+      async fetch(input: RequestInfo | URL, init?: RequestInit) {
+        let currentAuth = await getAuth();
+        if (!currentAuth || currentAuth.type !== 'oauth')
+          return fetch(input, init);
+
+        // Refresh token if expired (with 5 minute buffer)
+        const FIVE_MIN_MS = 5 * 60 * 1000;
+        if (
+          !currentAuth.access ||
+          currentAuth.expires < Date.now() + FIVE_MIN_MS
+        ) {
+          if (!currentAuth.refresh) {
+            log.error(() => ({
+              message:
+                'qwen oauth token expired and no refresh token available (alibaba)',
+            }));
+            throw new Error(
+              'Qwen OAuth token expired. Please re-authenticate with: agent auth login'
+            );
+          }
+
+          log.info(() => ({
+            message: 'refreshing qwen oauth token (alibaba provider)',
+          }));
+
+          const response = await fetch(QWEN_OAUTH_TOKEN_ENDPOINT, {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/x-www-form-urlencoded',
+              Accept: 'application/json',
+            },
+            body: new URLSearchParams({
+              grant_type: 'refresh_token',
+              refresh_token: currentAuth.refresh,
+              client_id: QWEN_OAUTH_CLIENT_ID,
+            }),
+          });
+
+          if (!response.ok) {
+            const errorText = await response.text().catch(() => 'unknown');
+            log.error(() => ({
+              message: 'qwen oauth token refresh failed (alibaba)',
+              status: response.status,
+              error: errorText.substring(0, 200),
+            }));
+            throw new Error(
+              `Qwen token refresh failed: ${response.status}. Please re-authenticate with: agent auth login`
+            );
+          }
+
+          const json = await response.json();
+          await Auth.set('alibaba', {
+            type: 'oauth',
+            refresh: json.refresh_token || currentAuth.refresh,
+            access: json.access_token,
+            expires: Date.now() + json.expires_in * 1000,
+          });
+          currentAuth = {
+            type: 'oauth',
+            refresh: json.refresh_token || currentAuth.refresh,
+            access: json.access_token,
+            expires: Date.now() + json.expires_in * 1000,
+          };
+        }
+
+        const headers: Record<string, string> = {
+          ...(init?.headers as Record<string, string>),
+          Authorization: `Bearer ${currentAuth.access}`,
+        };
+        delete headers['x-api-key'];
+
+        return fetch(input, {
+          ...init,
+          headers,
+        });
+      },
+    };
+  },
+};
+
 /**
  * Registry of all auth plugins
  */
@@ -1865,6 +2638,8 @@ const plugins: Record<string, AuthPlugin> = {
   'github-copilot': GitHubCopilotPlugin,
   openai: OpenAIPlugin,
   google: GooglePlugin,
+  'qwen-coder': QwenPlugin,
+  alibaba: AlibabaPlugin,
 };
 
 /**

package/src/cli/output.ts

@@ -199,5 +199,24 @@ export function outputInput(
   writeStdout(message, compact);
 }
 
+/**
+ * Output a help/informational message to stdout
+ * Used for CLI help text display (not an error condition)
+ */
+export function outputHelp(
+  help: {
+    message: string;
+    hint?: string;
+    [key: string]: unknown;
+  },
+  compact?: boolean
+): void {
+  const message: OutputMessage = {
+    type: 'status',
+    ...help,
+  };
+  writeStdout(message, compact);
+}
+
 // Re-export for backward compatibility
 export { output as write };

package/src/index.js

@@ -31,9 +31,11 @@ import { createBusEventSubscription } from './cli/event-handler.js';
 import {
   outputStatus,
   outputError,
+  outputHelp,
   setCompactJson,
   outputInput,
 } from './cli/output.ts';
+import stripAnsi from 'strip-ansi';
 import { createRequire } from 'module';
 import { readFileSync } from 'fs';
 import { dirname, join } from 'path';
@@ -899,14 +901,14 @@ async function main() {
           process.exit(1);
         }
 
-        // Handle validation errors (msg without err)
+        // Handle validation messages (msg without err) - informational, not an error
+        // Display help text on stdout (industry standard: git, gh, npm all use stdout for help)
         if (msg) {
-          outputError({
-            errorType: 'ValidationError',
+          outputHelp({
             message: msg,
-            hint: yargs.help(),
+            hint: stripAnsi(yargs.help()),
           });
-          process.exit(1);
+          process.exit(0);
         }
       })
       .help();

package/src/provider/google-cloudcode.ts

@@ -19,8 +19,11 @@ import { Auth } from '../auth';
 const log = Log.create({ service: 'google-cloudcode' });
 
 // Cloud Code API endpoints (from gemini-cli)
-const CODE_ASSIST_ENDPOINT = 'https://cloudcode-pa.googleapis.com';
-const CODE_ASSIST_API_VERSION = 'v1internal';
+// Configurable via environment variables for testing or alternative endpoints
+const CODE_ASSIST_ENDPOINT =
+  process.env['CODE_ASSIST_ENDPOINT'] || 'https://cloudcode-pa.googleapis.com';
+const CODE_ASSIST_API_VERSION =
+  process.env['CODE_ASSIST_API_VERSION'] || 'v1internal';
 
 // Google OAuth endpoints
 const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
@@ -216,14 +219,16 @@ export class CloudCodeClient {
   ): Promise<T | Response> {
     await this.ensureValidToken();
 
-    const url = `${CODE_ASSIST_ENDPOINT}/${CODE_ASSIST_API_VERSION}:${method}`;
+    // Add alt=sse query param for streaming requests (matches Gemini CLI behavior)
+    const baseUrl = `${CODE_ASSIST_ENDPOINT}/${CODE_ASSIST_API_VERSION}:${method}`;
+    const url = options.stream ? `${baseUrl}?alt=sse` : baseUrl;
 
     const response = await fetch(url, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
         Authorization: `Bearer ${this.accessToken}`,
-        'x-goog-api-client': 'agent/0.6.3',
+        'x-goog-api-client': `agent/${process.env['npm_package_version'] || '0.7.0'}`,
       },
       body: JSON.stringify(body),
     });

package/src/provider/provider.ts

@@ -321,6 +321,66 @@ export namespace Provider {
         options: {},
       };
     },
+    /**
+     * Qwen Coder OAuth provider for Qwen subscription users
+     * Uses OAuth credentials from agent auth login (Qwen Coder Subscription)
+     *
+     * To authenticate, run: agent auth login (select Qwen Coder)
+     */
+    'qwen-coder': async (input) => {
+      const auth = await Auth.get('qwen-coder');
+      if (auth?.type === 'oauth') {
+        log.info(() => ({
+          message: 'using qwen-coder oauth credentials',
+        }));
+        const loaderFn = await AuthPlugins.getLoader('qwen-coder');
+        if (loaderFn) {
+          const result = await loaderFn(() => Auth.get('qwen-coder'), input);
+          if (result.fetch) {
+            return {
+              autoload: true,
+              options: {
+                apiKey: result.apiKey || '',
+                baseURL: result.baseURL,
+                fetch: result.fetch,
+              },
+            };
+          }
+        }
+      }
+      // Default: not auto-loaded without OAuth
+      return { autoload: false };
+    },
+    /**
+     * Alibaba OAuth provider (alias for Qwen Coder)
+     * Uses OAuth credentials from agent auth login (Alibaba / Qwen Coder Subscription)
+     *
+     * To authenticate, run: agent auth login (select Alibaba)
+     */
+    alibaba: async (input) => {
+      const auth = await Auth.get('alibaba');
+      if (auth?.type === 'oauth') {
+        log.info(() => ({
+          message: 'using alibaba oauth credentials',
+        }));
+        const loaderFn = await AuthPlugins.getLoader('alibaba');
+        if (loaderFn) {
+          const result = await loaderFn(() => Auth.get('alibaba'), input);
+          if (result.fetch) {
+            return {
+              autoload: true,
+              options: {
+                apiKey: result.apiKey || '',
+                baseURL: result.baseURL,
+                fetch: result.fetch,
+              },
+            };
+          }
+        }
+      }
+      // Default: not auto-loaded without OAuth
+      return { autoload: false };
+    },
     /**
      * Google OAuth provider for Gemini subscription users
      * Uses OAuth credentials from agent auth login (Google AI Pro/Ultra)