opencode-qwen-cli-auth 2.2.0 → 2.2.2

package/dist/index.js

@@ -1,68 +1,90 @@
-/**
- * Alibaba Qwen OAuth Authentication Plugin for opencode
- *
- * Plugin don gian: chi xu ly OAuth login + tra apiKey/baseURL cho SDK.
- * SDK tu xu ly streaming, headers, request format.
- *
- * @license MIT with Usage Disclaimer (see LICENSE file)
- * @repository https://github.com/TVD-00/opencode-qwen-cli-auth
- */
-import { createPKCE, requestDeviceCode, pollForToken, getApiBaseUrl, saveToken, refreshAccessToken, loadStoredToken } from "./lib/auth/auth.js";
-import { PROVIDER_ID, AUTH_LABELS, DEVICE_FLOW, DEFAULT_QWEN_BASE_URL } from "./lib/constants.js";
-import { logError, logInfo, LOGGING_ENABLED } from "./lib/logger.js";
-/**
- * Lay access token hop le tu SDK auth state, refresh neu het han
- * Dung getAuth() cua SDK thay vi doc file truc tiep
- *
- * @param getAuth - Ham lay auth state tu SDK
- * @returns access token hoac null
- */
-async function getValidAccessToken(getAuth) {
-    const auth = await getAuth();
-    if (!auth || auth.type !== "oauth") {
-        return null;
-    }
-    let accessToken = auth.access;
-    // Refresh neu het han (buffer 60 giay)
-    if (accessToken && auth.expires && Date.now() > auth.expires - 60000 && auth.refresh) {
-        try {
-            const refreshResult = await refreshAccessToken(auth.refresh);
-            if (refreshResult.type === "success") {
-                accessToken = refreshResult.access;
-                saveToken(refreshResult);
-            }
-            else {
-                if (LOGGING_ENABLED) {
-                    logError("Token refresh failed");
-                }
-                accessToken = undefined;
-            }
-        }
-        catch (e) {
-            if (LOGGING_ENABLED) {
-                logError("Token refresh error:", e);
-            }
-            accessToken = undefined;
-        }
-    }
-    return accessToken ?? null;
-}
-/**
- * Lay base URL tu token luu tren disk (resource_url)
- * Fallback ve portal.qwen.ai/v1 neu khong co
- */
-function getBaseUrl() {
-    try {
-        const stored = loadStoredToken();
-        if (stored?.resource_url) {
-            return getApiBaseUrl(stored.resource_url);
-        }
-    }
-    catch (_) {
-        // Loi doc file, dung default
-    }
-    return getApiBaseUrl();
-}
+/**
+ * Alibaba Qwen OAuth Authentication Plugin for opencode
+ *
+ * Simple plugin: handles OAuth login + provides apiKey/baseURL to SDK.
+ * SDK handles streaming, headers, and request format.
+ *
+ * @license MIT with Usage Disclaimer (see LICENSE file)
+ * @repository https://github.com/TVD-00/opencode-qwen-cli-auth
+ */
+import { randomUUID } from "node:crypto";
+import { createPKCE, requestDeviceCode, pollForToken, getApiBaseUrl, saveToken, refreshAccessToken, loadStoredToken, getValidToken } from "./lib/auth/auth.js";
+import { PROVIDER_ID, AUTH_LABELS, DEVICE_FLOW, PORTAL_HEADERS } from "./lib/constants.js";
+import { logError, logInfo, logWarn, LOGGING_ENABLED } from "./lib/logger.js";
+const CHAT_REQUEST_TIMEOUT_MS = 30000;
+const CHAT_MAX_RETRIES = 0;
+const MAX_CONSECUTIVE_POLL_FAILURES = 3;
+const PLUGIN_USER_AGENT = "opencode-qwen-cli-auth/2.2.1";
+/**
+ * Get valid access token from SDK auth state, refresh if expired.
+ * Uses getAuth() from SDK instead of reading file directly.
+ *
+ * @param getAuth - Function to get auth state from SDK
+ * @returns Access token or null
+ */
+async function getValidAccessToken(getAuth) {
+    const diskToken = await getValidToken();
+    if (diskToken?.accessToken) {
+        return diskToken.accessToken;
+    }
+    const auth = await getAuth();
+    if (!auth || auth.type !== "oauth") {
+        return null;
+    }
+    let accessToken = auth.access;
+    // Refresh if expired (60 second buffer)
+    if (accessToken && auth.expires && Date.now() > auth.expires - 60000 && auth.refresh) {
+        try {
+            const refreshResult = await refreshAccessToken(auth.refresh);
+            if (refreshResult.type === "success") {
+                accessToken = refreshResult.access;
+                saveToken(refreshResult);
+            }
+            else {
+                if (LOGGING_ENABLED) {
+                    logError("Token refresh failed");
+                }
+                accessToken = undefined;
+            }
+        }
+        catch (e) {
+            if (LOGGING_ENABLED) {
+                logError("Token refresh error:", e);
+            }
+            accessToken = undefined;
+        }
+    }
+    if (auth.access && auth.refresh) {
+        try {
+            saveToken({
+                type: "success",
+                access: accessToken || auth.access,
+                refresh: auth.refresh,
+                expires: typeof auth.expires === "number" ? auth.expires : Date.now() + 3600 * 1000,
+            });
+        }
+        catch (e) {
+            logWarn("Failed to bootstrap .qwen token from SDK auth state:", e);
+        }
+    }
+    return accessToken ?? null;
+}
+/**
+ * Get base URL from token stored on disk (resource_url).
+ * Falls back to portal.qwen.ai/v1 if not available.
+ */
+function getBaseUrl() {
+    try {
+        const stored = loadStoredToken();
+        if (stored?.resource_url) {
+            return getApiBaseUrl(stored.resource_url);
+        }
+    }
+    catch (e) {
+        logWarn("Failed to load stored token for baseURL, using default:", e);
+    }
+    return getApiBaseUrl();
+}
 /**
  * Alibaba Qwen OAuth authentication plugin for opencode
  *
@@ -78,25 +100,31 @@ export const QwenAuthPlugin = async (_input) => {
     return {
         auth: {
             provider: PROVIDER_ID,
-            /**
-             * Loader: lay token + base URL, tra ve cho SDK
-             * Pattern giong plugin tham chieu opencode-qwencode-auth
-             */
+            /**
+             * Loader: get token + base URL, return to SDK.
+             * Pattern similar to opencode-qwencode-auth reference plugin.
+             */
             async loader(getAuth, provider) {
-                // Zero cost cho OAuth models (mien phi)
-                if (provider?.models) {
+                // Zero cost for OAuth models (free)
+                if (provider?.models) {
                     for (const model of Object.values(provider.models)) {
                         if (model) model.cost = { input: 0, output: 0 };
                     }
-                }
-                const accessToken = await getValidAccessToken(getAuth);
-                if (!accessToken) return null;
-                return {
-                    apiKey: accessToken,
-                    baseURL: DEFAULT_QWEN_BASE_URL,
-                };
-            },
-            methods: [
+                }
+                const accessToken = await getValidAccessToken(getAuth);
+                if (!accessToken) return null;
+                const baseURL = getBaseUrl();
+                if (LOGGING_ENABLED) {
+                    logInfo("Using Qwen baseURL:", baseURL);
+                }
+                return {
+                    apiKey: accessToken,
+                    baseURL,
+                    timeout: CHAT_REQUEST_TIMEOUT_MS,
+                    maxRetries: CHAT_MAX_RETRIES,
+                };
+            },
+            methods: [
                 {
                     label: AUTH_LABELS.OAUTH,
                     type: "oauth",
@@ -111,10 +139,10 @@ export const QwenAuthPlugin = async (_input) => {
                         if (!deviceAuth) {
                             throw new Error("Failed to request device code");
                         }
-                        // Hien thi user code
-                        console.log(`\nPlease visit: ${deviceAuth.verification_uri}`);
-                        console.log(`And enter code: ${deviceAuth.user_code}\n`);
-                        // URL xac thuc - SDK se tu mo browser khi method=auto
+                        // Display user code
+                        console.log(`\nPlease visit: ${deviceAuth.verification_uri}`);
+                        console.log(`And enter code: ${deviceAuth.user_code}\n`);
+                        // Verification URL - SDK will open browser automatically when method=auto
                         const verificationUrl = deviceAuth.verification_uri_complete || deviceAuth.verification_uri;
                         return {
                             url: verificationUrl,
@@ -123,61 +151,93 @@ export const QwenAuthPlugin = async (_input) => {
                             callback: async () => {
                                 // Poll for token
                                 let pollInterval = (deviceAuth.interval || 5) * 1000;
-                                const POLLING_MARGIN_MS = 3000;
-                                const maxInterval = DEVICE_FLOW.MAX_POLL_INTERVAL;
-                                const startTime = Date.now();
-                                const expiresIn = deviceAuth.expires_in * 1000;
-                                while (Date.now() - startTime < expiresIn) {
-                                    await new Promise(resolve => setTimeout(resolve, pollInterval + POLLING_MARGIN_MS));
-                                    const result = await pollForToken(deviceAuth.device_code, pkce.verifier);
-                                    if (result.type === "success") {
-                                        saveToken(result);
-                                        // Tra ve cho SDK luu auth state
-                                        return {
+                                const POLLING_MARGIN_MS = 3000;
+                                const maxInterval = DEVICE_FLOW.MAX_POLL_INTERVAL;
+                                const startTime = Date.now();
+                                const expiresIn = deviceAuth.expires_in * 1000;
+                                let consecutivePollFailures = 0;
+                                while (Date.now() - startTime < expiresIn) {
+                                    await new Promise(resolve => setTimeout(resolve, pollInterval + POLLING_MARGIN_MS));
+                                    const result = await pollForToken(deviceAuth.device_code, pkce.verifier);
+                                    if (result.type === "success") {
+                                        saveToken(result);
+                                        // Return to SDK to save auth state
+                                        return {
                                             type: "success",
                                             access: result.access,
                                             refresh: result.refresh,
-                                            expires: result.expires,
-                                        };
-                                    }
-                                    if (result.type === "slow_down") {
-                                        pollInterval = Math.min(pollInterval + 5000, maxInterval);
-                                        continue;
-                                    }
-                                    if (result.type === "pending") {
-                                        continue;
-                                    }
-                                    // denied, expired, failed -> dung lai
-                                    return { type: "failed" };
-                                }
-                                console.error("[qwen-oauth-plugin] Device authorization timed out");
-                                return { type: "failed" };
-                            },
+                                            expires: result.expires,
+                                        };
+                                    }
+                                    if (result.type === "slow_down") {
+                                        consecutivePollFailures = 0;
+                                        pollInterval = Math.min(pollInterval + 5000, maxInterval);
+                                        continue;
+                                    }
+                                    if (result.type === "pending") {
+                                        consecutivePollFailures = 0;
+                                        continue;
+                                    }
+                                    if (result.type === "failed") {
+                                        if (result.fatal) {
+                                            logError("OAuth token polling failed with fatal error", {
+                                                status: result.status,
+                                                error: result.error,
+                                                description: result.description,
+                                            });
+                                            return { type: "failed" };
+                                        }
+                                        consecutivePollFailures += 1;
+                                        logWarn(`OAuth token polling failed (${consecutivePollFailures}/${MAX_CONSECUTIVE_POLL_FAILURES})`);
+                                        if (consecutivePollFailures >= MAX_CONSECUTIVE_POLL_FAILURES) {
+                                            console.error("[qwen-oauth-plugin] OAuth token polling failed repeatedly");
+                                            return { type: "failed" };
+                                        }
+                                        continue;
+                                    }
+                                    if (result.type === "denied") {
+                                        console.error("[qwen-oauth-plugin] Device authorization was denied");
+                                        return { type: "failed" };
+                                    }
+                                    if (result.type === "expired") {
+                                        console.error("[qwen-oauth-plugin] Device authorization code expired");
+                                        return { type: "failed" };
+                                    }
+                                    return { type: "failed" };
+                                }
+                                console.error("[qwen-oauth-plugin] Device authorization timed out");
+                                return { type: "failed" };
+                            },
                         };
                     },
                 },
             ],
         },
-        /**
-         * Dang ky provider qwen-code voi danh sach model
-         * Chi dang ky model ma Portal API (OAuth) chap nhan:
-         * coder-model va vision-model (theo QWEN_OAUTH_ALLOWED_MODELS cua CLI goc)
-         */
+        /**
+         * Register qwen-code provider with model list.
+         * Only register models that Portal API (OAuth) accepts:
+         * coder-model and vision-model (according to QWEN_OAUTH_ALLOWED_MODELS from original CLI)
+         */
         config: async (config) => {
             const providers = config.provider || {};
             providers[PROVIDER_ID] = {
-                npm: "@ai-sdk/openai-compatible",
-                name: "Qwen Code",
-                options: { baseURL: "https://portal.qwen.ai/v1" },
-                models: {
+                npm: "@ai-sdk/openai-compatible",
+                name: "Qwen Code",
+                options: {
+                    baseURL: getBaseUrl(),
+                    timeout: CHAT_REQUEST_TIMEOUT_MS,
+                    maxRetries: CHAT_MAX_RETRIES,
+                },
+                models: {
                     "coder-model": {
                         id: "coder-model",
                         name: "Qwen Coder (Qwen 3.5 Plus)",
-                        reasoning: true,
+                        // Qwen does not support reasoning_effort from OpenCode UI
+                        // Thinking is always enabled by default on server side (qwen3.5-plus)
+                        reasoning: false,
                         limit: { context: 1048576, output: 65536 },
                         cost: { input: 0, output: 0 },
                         modalities: { input: ["text"], output: ["text"] },
-                        options: { extraBody: { enable_thinking: true } },
                     },
                     "vision-model": {
                         id: "vision-model",
@@ -188,24 +248,57 @@ export const QwenAuthPlugin = async (_input) => {
                         modalities: { input: ["text"], output: ["text"] },
                     },
                 },
-            };
-            config.provider = providers;
-        },
-        /**
-         * Gui header DashScope giong CLI goc
-         * X-DashScope-CacheControl: enable prompt caching, giam token tieu thu
-         * X-DashScope-AuthType: xac dinh auth method cho server
-         */
-        "chat.headers": async (_input, output) => {
-            try {
-                if (output?.headers) {
-                    output.headers["X-DashScope-CacheControl"] = "enable";
-                    output.headers["X-DashScope-AuthType"] = "qwen-oauth";
-                }
-            }
-            catch (_) { /* khong de loi hook lam treo request */ }
-        },
-    };
-};
+            };
+            config.provider = providers;
+        },
+        "chat.params": async (input, output) => {
+            try {
+                output.options = output.options || {};
+                output.options.maxRetries = CHAT_MAX_RETRIES;
+                if (typeof output.options.timeout !== "number" || output.options.timeout > CHAT_REQUEST_TIMEOUT_MS) {
+                    output.options.timeout = CHAT_REQUEST_TIMEOUT_MS;
+                }
+                if (LOGGING_ENABLED) {
+                    logInfo("Applied chat.params hotfix", {
+                        sessionID: input?.sessionID,
+                        modelID: input?.model?.id,
+                        timeout: output.options.timeout,
+                        maxRetries: output.options.maxRetries,
+                    });
+                }
+            }
+            catch (e) {
+                logWarn("Failed to apply chat params hotfix:", e);
+            }
+        },
+        /**
+         * Send DashScope headers like original CLI.
+         * X-DashScope-CacheControl: enable prompt caching, reduce token consumption.
+         * X-DashScope-AuthType: specify auth method for server.
+         */
+        "chat.headers": async (input, output) => {
+            try {
+                output.headers = output.headers || {};
+                const requestId = randomUUID();
+                output.headers["X-DashScope-CacheControl"] = "enable";
+                output.headers[PORTAL_HEADERS.AUTH_TYPE] = PORTAL_HEADERS.AUTH_TYPE_VALUE;
+                output.headers["User-Agent"] = PLUGIN_USER_AGENT;
+                output.headers["X-DashScope-UserAgent"] = PLUGIN_USER_AGENT;
+                output.headers["x-request-id"] = requestId;
+                if (LOGGING_ENABLED) {
+                    logInfo("Applied chat.headers", {
+                        request_id: requestId,
+                        sessionID: input?.sessionID,
+                        modelID: input?.model?.id,
+                        providerID: input?.provider?.info?.id,
+                    });
+                }
+            }
+            catch (e) {
+                logWarn("Failed to set chat headers:", e);
+            }
+        },
+    };
+};
 export default QwenAuthPlugin;
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/lib/auth/auth.js

@@ -1,27 +1,52 @@
 import { generatePKCE } from "@openauthjs/openauth/pkce";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from "fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, renameSync, statSync } from "fs";
 import { QWEN_OAUTH, DEFAULT_QWEN_BASE_URL, TOKEN_REFRESH_BUFFER_MS, VERIFICATION_URI } from "../constants.js";
-import { getTokenPath, getConfigDir } from "../config.js";
+import { getTokenPath, getQwenDir, getTokenLockPath, getLegacyTokenPath } from "../config.js";
 import { logError, logWarn, logInfo, LOGGING_ENABLED } from "../logger.js";
-// So lan retry toi da khi refresh token that bai
-const MAX_REFRESH_RETRIES = 2;
+const MAX_REFRESH_RETRIES = 1;
 const REFRESH_RETRY_DELAY_MS = 1000;
-/**
- * Normalize and validate resource_url from OAuth response
- * @param resourceUrl - Resource URL from token response
- * @returns Normalized URL or undefined if invalid
- */
+const OAUTH_REQUEST_TIMEOUT_MS = 15000;
+const LOCK_TIMEOUT_MS = 10000;
+const LOCK_ATTEMPT_INTERVAL_MS = 100;
+const LOCK_BACKOFF_MULTIPLIER = 1.5;
+const LOCK_MAX_INTERVAL_MS = 2000;
+const LOCK_MAX_ATTEMPTS = 20;
+function isAbortError(error) {
+    return typeof error === "object" && error !== null && ("name" in error) && error.name === "AbortError";
+}
+function hasErrorCode(error, code) {
+    return typeof error === "object" && error !== null && ("code" in error) && error.code === code;
+}
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+async function fetchWithTimeout(url, init, timeoutMs = OAUTH_REQUEST_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(url, {
+            ...init,
+            signal: controller.signal,
+        });
+    }
+    catch (error) {
+        if (isAbortError(error)) {
+            throw new Error(`OAuth request timed out after ${timeoutMs}ms`);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+}
 function normalizeResourceUrl(resourceUrl) {
     if (!resourceUrl)
         return undefined;
     try {
-        // Qwen returns resource_url without protocol (e.g., "portal.qwen.ai")
-        // Normalize it by adding https:// if missing
         let normalizedUrl = resourceUrl;
         if (!normalizedUrl.startsWith("http://") && !normalizedUrl.startsWith("https://")) {
             normalizedUrl = `https://${normalizedUrl}`;
         }
-        // Validate the normalized URL
         new URL(normalizedUrl);
         if (LOGGING_ENABLED) {
             logInfo("Valid resource_url found and normalized:", normalizedUrl);
@@ -33,35 +58,168 @@ function normalizeResourceUrl(resourceUrl) {
         return undefined;
     }
 }
-/**
- * Validate token response fields
- * @param json - Token response JSON
- * @param context - Context for logging (e.g., "token response" or "refresh response")
- * @returns True if valid, false otherwise
- */
 function validateTokenResponse(json, context) {
-    // Check required fields
-    if (!json.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
-        logError(`${context} missing fields:`, json);
+    if (!json.access_token || typeof json.access_token !== "string") {
+        logError(`${context} missing access_token`);
         return false;
     }
-    // Validate expires_in is positive
-    if (json.expires_in <= 0) {
-        logError(`invalid expires_in value in ${context}:`, json.expires_in);
+    if (!json.refresh_token || typeof json.refresh_token !== "string") {
+        logError(`${context} missing refresh_token`);
+        return false;
+    }
+    if (typeof json.expires_in !== "number" || json.expires_in <= 0) {
+        logError(`${context} invalid expires_in:`, json.expires_in);
         return false;
     }
     return true;
 }
-/**
- * Request device authorization code
- * @param pkce - PKCE challenge/verifier pair
- * @returns Device authorization response with user code and verification URL
- */
+function toStoredTokenData(data) {
+    if (!data || typeof data !== "object") {
+        return null;
+    }
+    const raw = data;
+    const accessToken = typeof raw.access_token === "string" ? raw.access_token : undefined;
+    const refreshToken = typeof raw.refresh_token === "string" ? raw.refresh_token : undefined;
+    const tokenType = typeof raw.token_type === "string" && raw.token_type.length > 0 ? raw.token_type : "Bearer";
+    const expiryDate = typeof raw.expiry_date === "number"
+        ? raw.expiry_date
+        : typeof raw.expires === "number"
+            ? raw.expires
+            : typeof raw.expiry_date === "string"
+                ? Number(raw.expiry_date)
+                : undefined;
+    const resourceUrl = typeof raw.resource_url === "string" ? raw.resource_url : undefined;
+    if (!accessToken || !refreshToken || typeof expiryDate !== "number" || !Number.isFinite(expiryDate) || expiryDate <= 0) {
+        return null;
+    }
+    return {
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        token_type: tokenType,
+        expiry_date: expiryDate,
+        resource_url: resourceUrl,
+    };
+}
+function buildTokenSuccessFromStored(stored) {
+    return {
+        type: "success",
+        access: stored.access_token,
+        refresh: stored.refresh_token,
+        expires: stored.expiry_date,
+        resourceUrl: stored.resource_url,
+    };
+}
+function writeStoredTokenData(tokenData) {
+    const qwenDir = getQwenDir();
+    if (!existsSync(qwenDir)) {
+        mkdirSync(qwenDir, { recursive: true, mode: 0o700 });
+    }
+    const tokenPath = getTokenPath();
+    const tempPath = `${tokenPath}.tmp.${Date.now().toString(36)}-${Math.random().toString(16).slice(2)}`;
+    try {
+        writeFileSync(tempPath, JSON.stringify(tokenData, null, 2), {
+            encoding: "utf-8",
+            mode: 0o600,
+        });
+        renameSync(tempPath, tokenPath);
+    }
+    catch (error) {
+        try {
+            if (existsSync(tempPath)) {
+                unlinkSync(tempPath);
+            }
+        }
+        catch (_cleanupError) {
+        }
+        throw error;
+    }
+}
+function migrateLegacyTokenIfNeeded() {
+    const tokenPath = getTokenPath();
+    if (existsSync(tokenPath)) {
+        return;
+    }
+    const legacyPath = getLegacyTokenPath();
+    if (!existsSync(legacyPath)) {
+        return;
+    }
+    try {
+        const legacyRaw = readFileSync(legacyPath, "utf-8");
+        const legacyData = JSON.parse(legacyRaw);
+        const converted = toStoredTokenData(legacyData);
+        if (!converted) {
+            logWarn("Legacy token found but invalid, skipping migration");
+            return;
+        }
+        writeStoredTokenData(converted);
+        logInfo("Migrated token from legacy path to ~/.qwen/oauth_creds.json");
+    }
+    catch (error) {
+        logWarn("Failed to migrate legacy token:", error);
+    }
+}
+async function acquireTokenLock() {
+    const lockPath = getTokenLockPath();
+    const lockValue = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+    let waitMs = LOCK_ATTEMPT_INTERVAL_MS;
+    for (let attempt = 0; attempt < LOCK_MAX_ATTEMPTS; attempt++) {
+        try {
+            writeFileSync(lockPath, lockValue, {
+                encoding: "utf-8",
+                flag: "wx",
+                mode: 0o600,
+            });
+            return lockPath;
+        }
+        catch (error) {
+            if (!hasErrorCode(error, "EEXIST")) {
+                throw error;
+            }
+            try {
+                const stats = statSync(lockPath);
+                const ageMs = Date.now() - stats.mtimeMs;
+                if (ageMs > LOCK_TIMEOUT_MS) {
+                    try {
+                        unlinkSync(lockPath);
+                        logWarn("Removed stale token lock file", { lockPath, ageMs });
+                    }
+                    catch (staleError) {
+                        if (!hasErrorCode(staleError, "ENOENT")) {
+                            logWarn("Failed to remove stale token lock", staleError);
+                        }
+                    }
+                    continue;
+                }
+            }
+            catch (statError) {
+                if (!hasErrorCode(statError, "ENOENT")) {
+                    logWarn("Failed to inspect token lock file", statError);
+                }
+            }
+            await sleep(waitMs);
+            waitMs = Math.min(Math.floor(waitMs * LOCK_BACKOFF_MULTIPLIER), LOCK_MAX_INTERVAL_MS);
+        }
+    }
+    throw new Error("Token refresh lock timeout");
+}
+function releaseTokenLock(lockPath) {
+    try {
+        unlinkSync(lockPath);
+    }
+    catch (error) {
+        if (!hasErrorCode(error, "ENOENT")) {
+            logWarn("Failed to release token lock file", error);
+        }
+    }
+}
 export async function requestDeviceCode(pkce) {
     try {
-        const res = await fetch(QWEN_OAUTH.DEVICE_CODE_URL, {
+        const res = await fetchWithTimeout(QWEN_OAUTH.DEVICE_CODE_URL, {
             method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
             body: new URLSearchParams({
                 client_id: QWEN_OAUTH.CLIENT_ID,
                 scope: QWEN_OAUTH.SCOPE,
@@ -82,11 +240,9 @@ export async function requestDeviceCode(pkce) {
             logError("device code response missing fields:", json);
             return null;
         }
-        // Ensure verification_uri_complete includes the client parameter
-        // Qwen's OAuth server requires client=qwen-code for proper authentication
         if (!json.verification_uri_complete || !json.verification_uri_complete.includes(VERIFICATION_URI.CLIENT_PARAM_KEY)) {
             const baseUrl = json.verification_uri_complete || json.verification_uri;
-            const separator = baseUrl.includes('?') ? '&' : '?';
+            const separator = baseUrl.includes("?") ? "&" : "?";
             json.verification_uri_complete = `${baseUrl}${separator}${VERIFICATION_URI.CLIENT_PARAM_VALUE}`;
             if (LOGGING_ENABLED) {
                 logInfo("Fixed verification_uri_complete:", json.verification_uri_complete);
@@ -99,18 +255,14 @@ export async function requestDeviceCode(pkce) {
         return null;
     }
 }
-/**
- * Poll for token using device code
- * @param deviceCode - Device code from authorization response
- * @param verifier - PKCE verifier
- * @param interval - Polling interval in seconds (from device response)
- * @returns Token result or null if still pending
- */
 export async function pollForToken(deviceCode, verifier, interval = 2) {
     try {
-        const res = await fetch(QWEN_OAUTH.TOKEN_URL, {
+        const res = await fetchWithTimeout(QWEN_OAUTH.TOKEN_URL, {
             method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
             body: new URLSearchParams({
                 grant_type: QWEN_OAUTH.GRANT_TYPE_DEVICE,
                 client_id: QWEN_OAUTH.CLIENT_ID,
@@ -120,26 +272,35 @@ export async function pollForToken(deviceCode, verifier, interval = 2) {
         });
         if (!res.ok) {
             const json = await res.json().catch(() => ({}));
-            const error = json.error;
-            // Handle expected errors
-            if (error === "authorization_pending") {
+            const errorCode = typeof json.error === "string" ? json.error : undefined;
+            const errorDescription = typeof json.error_description === "string" ? json.error_description : "No details provided";
+            if (errorCode === "authorization_pending") {
                 return { type: "pending" };
             }
-            if (error === "slow_down") {
+            if (errorCode === "slow_down") {
                 return { type: "slow_down" };
             }
-            if (error === "expired_token") {
+            if (errorCode === "expired_token") {
                 return { type: "expired" };
             }
-            if (error === "access_denied") {
+            if (errorCode === "access_denied") {
                 return { type: "denied" };
             }
-            logError("token poll failed:", { status: res.status, json });
-            return { type: "failed" };
+            logError("token poll failed:", {
+                status: res.status,
+                error: errorCode,
+                description: errorDescription,
+            });
+            return {
+                type: "failed",
+                status: res.status,
+                error: errorCode || "unknown_error",
+                description: errorDescription,
+                fatal: true,
+            };
         }
         const json = await res.json();
         if (LOGGING_ENABLED) {
-            // Log the full token response for debugging
             logInfo("Token response received:", {
                 has_access_token: !!json.access_token,
                 has_refresh_token: !!json.refresh_token,
@@ -148,39 +309,46 @@ export async function pollForToken(deviceCode, verifier, interval = 2) {
                 all_fields: Object.keys(json),
             });
         }
-        // Validate token response fields
         if (!validateTokenResponse(json, "token response")) {
-            return { type: "failed" };
+            return {
+                type: "failed",
+                error: "invalid_token_response",
+                description: "Token response missing required fields",
+                fatal: true,
+            };
         }
-        // Validate and normalize resource_url if present
         json.resource_url = normalizeResourceUrl(json.resource_url);
         if (!json.resource_url) {
             logWarn("No valid resource_url in token response, will use default DashScope endpoint");
         }
-        // At this point, validation ensures these fields exist
         return {
             type: "success",
             access: json.access_token,
             refresh: json.refresh_token,
             expires: Date.now() + json.expires_in * 1000,
-            resourceUrl: json.resource_url, // Dynamic API base URL
+            resourceUrl: json.resource_url,
         };
     }
     catch (error) {
-        logError("token poll error:", error);
-        return { type: "failed" };
+        const message = error instanceof Error ? error.message : String(error);
+        const lowered = message.toLowerCase();
+        const transient = lowered.includes("timed out") || lowered.includes("network") || lowered.includes("fetch");
+        logWarn("token poll failed:", { message, transient });
+        return {
+            type: "failed",
+            error: message,
+            fatal: !transient,
+        };
     }
 }
-/**
- * Refresh access token using refresh token (1 lan duy nhat, khong retry)
- * @param refreshToken - Refresh token
- * @returns Token result
- */
 async function refreshAccessTokenOnce(refreshToken) {
     try {
-        const res = await fetch(QWEN_OAUTH.TOKEN_URL, {
+        const res = await fetchWithTimeout(QWEN_OAUTH.TOKEN_URL, {
             method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
             body: new URLSearchParams({
                 grant_type: QWEN_OAUTH.GRANT_TYPE_REFRESH,
                 client_id: QWEN_OAUTH.CLIENT_ID,
@@ -189,8 +357,17 @@ async function refreshAccessTokenOnce(refreshToken) {
         });
         if (!res.ok) {
             const text = await res.text().catch(() => "");
+            const lowered = text.toLowerCase();
+            const isUnauthorized = res.status === 401 || res.status === 403;
+            const isRateLimited = res.status === 429;
+            const transient = res.status >= 500 || lowered.includes("timed out") || lowered.includes("network");
             logError("token refresh failed:", { status: res.status, text });
-            return { type: "failed", status: res.status };
+            return {
+                type: "failed",
+                status: res.status,
+                error: text || `HTTP ${res.status}`,
+                fatal: isUnauthorized || isRateLimited || !transient,
+            };
         }
         const json = await res.json();
         if (LOGGING_ENABLED) {
@@ -202,11 +379,14 @@ async function refreshAccessTokenOnce(refreshToken) {
                 all_fields: Object.keys(json),
             });
         }
-        // Validate token response fields
         if (!validateTokenResponse(json, "refresh response")) {
-            return { type: "failed" };
+            return {
+                type: "failed",
+                error: "invalid_refresh_response",
+                description: "Refresh response missing required fields",
+                fatal: true,
+            };
         }
-        // Validate and normalize resource_url if present
         json.resource_url = normalizeResourceUrl(json.resource_url);
         if (!json.resource_url) {
             logWarn("No valid resource_url in refresh response, will use default DashScope endpoint");
@@ -220,200 +400,180 @@ async function refreshAccessTokenOnce(refreshToken) {
         };
     }
     catch (error) {
-        logError("token refresh error:", error);
-        return { type: "failed" };
+        const message = error instanceof Error ? error.message : String(error);
+        const lowered = message.toLowerCase();
+        const transient = lowered.includes("timed out") || lowered.includes("network") || lowered.includes("fetch");
+        logError("token refresh error:", { message, transient });
+        return {
+            type: "failed",
+            error: message,
+            fatal: !transient,
+        };
     }
 }
-/**
- * Refresh access token voi retry logic
- * Retry toi da MAX_REFRESH_RETRIES lan voi delay giua cac lan
- * @param refreshToken - Refresh token
- * @returns Token result
- */
 export async function refreshAccessToken(refreshToken) {
-    for (let attempt = 0; attempt <= MAX_REFRESH_RETRIES; attempt++) {
-        const result = await refreshAccessTokenOnce(refreshToken);
-        if (result.type === "success") {
-            return result;
-        }
-        // Neu loi 401/403 thi refresh token da bi revoke, khong can retry
-        if (result.status === 401 || result.status === 403) {
-            logError("Refresh token bi reject (" + result.status + "), can dang nhap lai");
-            return { type: "failed" };
+    const lockPath = await acquireTokenLock();
+    try {
+        const latest = loadStoredToken();
+        if (latest && !isTokenExpired(latest.expiry_date)) {
+            return buildTokenSuccessFromStored(latest);
         }
-        // Con retry thi cho delay roi thu lai
-        if (attempt < MAX_REFRESH_RETRIES) {
-            if (LOGGING_ENABLED) {
-                logInfo(`Token refresh that bai, thu lai lan ${attempt + 2}/${MAX_REFRESH_RETRIES + 1}...`);
+        const effectiveRefreshToken = latest?.refresh_token || refreshToken;
+        for (let attempt = 0; attempt <= MAX_REFRESH_RETRIES; attempt++) {
+            const result = await refreshAccessTokenOnce(effectiveRefreshToken);
+            if (result.type === "success") {
+                saveToken(result);
+                return result;
+            }
+            if (result.status === 401 || result.status === 403) {
+                logError(`Refresh token rejected (${result.status}), re-authentication required`);
+                clearStoredToken();
+                return { type: "failed", status: result.status, error: "refresh_token_rejected", fatal: true };
+            }
+            if (result.status === 429) {
+                logError("Token refresh rate-limited (429), aborting retries");
+                return { type: "failed", status: 429, error: "rate_limited", fatal: true };
+            }
+            if (result.fatal) {
+                logError("Token refresh failed with fatal error", result);
+                return result;
+            }
+            if (attempt < MAX_REFRESH_RETRIES) {
+                if (LOGGING_ENABLED) {
+                    logInfo(`Token refresh transient failure, retrying attempt ${attempt + 2}/${MAX_REFRESH_RETRIES + 1}...`);
+                }
+                await sleep(REFRESH_RETRY_DELAY_MS);
             }
-            await new Promise(resolve => setTimeout(resolve, REFRESH_RETRY_DELAY_MS));
         }
+        logError("Token refresh failed after retry limit");
+        return { type: "failed", error: "refresh_failed" };
+    }
+    finally {
+        releaseTokenLock(lockPath);
     }
-    logError("Token refresh that bai sau " + (MAX_REFRESH_RETRIES + 1) + " lan thu");
-    return { type: "failed" };
 }
-/**
- * Generate PKCE challenge and verifier
- * @returns PKCE pair
- */
 export async function createPKCE() {
     const { challenge, verifier } = await generatePKCE();
     return { challenge, verifier };
 }
-/**
- * Load stored token from disk
- * @returns Stored token data or null if not found
- */
 export function loadStoredToken() {
+    migrateLegacyTokenIfNeeded();
     const tokenPath = getTokenPath();
     if (!existsSync(tokenPath)) {
         return null;
     }
     try {
         const content = readFileSync(tokenPath, "utf-8");
-        const data = JSON.parse(content);
-        // Validate required fields
-        if (!data.access_token || !data.refresh_token || typeof data.expires !== "number") {
+        const parsed = JSON.parse(content);
+        const normalized = toStoredTokenData(parsed);
+        if (!normalized) {
             logWarn("Invalid token data, re-authentication required");
             return null;
         }
-        return data;
+        const needsRewrite = typeof parsed.expiry_date !== "number" || typeof parsed.token_type !== "string" || typeof parsed.expires === "number";
+        if (needsRewrite) {
+            try {
+                writeStoredTokenData(normalized);
+            }
+            catch (rewriteError) {
+                logWarn("Failed to normalize token file format:", rewriteError);
+            }
+        }
+        return normalized;
     }
     catch (error) {
         logError("Failed to load token:", error);
         return null;
     }
 }
-/**
- * Xoa token luu tren disk khi token khong con hop le
- */
 export function clearStoredToken() {
-    const tokenPath = getTokenPath();
-    if (existsSync(tokenPath)) {
+    const targets = [getTokenPath(), getLegacyTokenPath()];
+    for (const tokenPath of targets) {
+        if (!existsSync(tokenPath)) {
+            continue;
+        }
         try {
             unlinkSync(tokenPath);
-            logWarn("Da xoa token cu, can dang nhap lai");
+            logWarn(`Deleted token file: ${tokenPath}`);
         }
         catch (error) {
-            logError("Khong the xoa token file:", error);
+            logError("Unable to delete token file:", { tokenPath, error });
         }
     }
 }
-/**
- * Save token to disk
- * @param tokenResult - Token result from OAuth flow
- */
 export function saveToken(tokenResult) {
     if (tokenResult.type !== "success") {
         throw new Error("Cannot save non-success token result");
     }
-    const configDir = getConfigDir();
-    // Ensure directory exists
-    if (!existsSync(configDir)) {
-        mkdirSync(configDir, { recursive: true, mode: 0o700 });
-    }
     const tokenData = {
         access_token: tokenResult.access,
         refresh_token: tokenResult.refresh,
-        expires: tokenResult.expires,
+        token_type: "Bearer",
+        expiry_date: tokenResult.expires,
         resource_url: tokenResult.resourceUrl,
     };
-    const tokenPath = getTokenPath();
     try {
-        writeFileSync(tokenPath, JSON.stringify(tokenData, null, 2), {
-            encoding: "utf-8",
-            mode: 0o600, // Secure permissions
-        });
+        writeStoredTokenData(tokenData);
     }
     catch (error) {
         logError("Failed to save token:", error);
         throw error;
     }
 }
-/**
- * Check if token is expired (with 5 minute buffer)
- * @param expiresAt - Expiration timestamp in milliseconds
- * @returns True if token is expired or will expire soon
- */
 export function isTokenExpired(expiresAt) {
     return Date.now() >= expiresAt - TOKEN_REFRESH_BUFFER_MS;
 }
-/**
- * Get valid access token, refreshing if necessary
- * Khi refresh that bai, xoa token cu de user biet can dang nhap lai
- * @returns Access token and resource URL, or null if authentication required
- */
 export async function getValidToken() {
     const stored = loadStoredToken();
     if (!stored) {
-        return null; // Khong co token, can dang nhap
+        return null;
     }
-    // Token con hieu luc
-    if (!isTokenExpired(stored.expires)) {
+    if (!isTokenExpired(stored.expiry_date)) {
         return {
             accessToken: stored.access_token,
             resourceUrl: stored.resource_url,
         };
     }
-    // Token het han, thu refresh (co retry ben trong)
     if (LOGGING_ENABLED) {
         logInfo("Token expired, refreshing...");
     }
     const refreshResult = await refreshAccessToken(stored.refresh_token);
     if (refreshResult.type !== "success") {
         logError("Token refresh failed, re-authentication required");
-        // Xoa token cu de tranh loop loi
         clearStoredToken();
         return null;
     }
-    // Luu token moi
-    saveToken(refreshResult);
     return {
         accessToken: refreshResult.access,
         resourceUrl: refreshResult.resourceUrl,
     };
 }
-/**
- * Get Portal API base URL from token or use default
- * @param resourceUrl - Resource URL from token (optional)
- * @returns Portal API base URL
- *
- * IMPORTANT: Portal API uses /v1 path (not /api/v1)
- * - OAuth endpoints: /api/v1/oauth2/ (for authentication)
- * - Chat API: /v1/ (for completions)
- */
 export function getApiBaseUrl(resourceUrl) {
     if (resourceUrl) {
-        // Validate URL format
         try {
             const url = new URL(resourceUrl);
-            if (!url.protocol.startsWith('http')) {
-                logWarn('Invalid resource_url protocol, using default Portal API URL');
+            if (!url.protocol.startsWith("http")) {
+                logWarn("Invalid resource_url protocol, using default Portal API URL");
                 return DEFAULT_QWEN_BASE_URL;
             }
-            // Construct the Portal API endpoint from resource_url
-            // Qwen returns "portal.qwen.ai" which should become "https://portal.qwen.ai/v1"
-            // Remove trailing slash if present
             let baseUrl = resourceUrl.replace(/\/$/, "");
-            // Add /v1 suffix if not already present
-            const suffix = '/v1';
+            const suffix = "/v1";
             if (!baseUrl.endsWith(suffix)) {
                 baseUrl = `${baseUrl}${suffix}`;
             }
             if (LOGGING_ENABLED) {
-                logInfo('Constructed Portal API base URL from resource_url:', baseUrl);
+                logInfo("Constructed Portal API base URL from resource_url:", baseUrl);
             }
             return baseUrl;
         }
         catch (error) {
-            logWarn('Invalid resource_url format, using default Portal API URL:', error);
+            logWarn("Invalid resource_url format, using default Portal API URL:", error);
             return DEFAULT_QWEN_BASE_URL;
         }
     }
-    // Fall back to default Portal API URL
     if (LOGGING_ENABLED) {
-        logInfo('No resource_url provided, using default Portal API URL');
+        logInfo("No resource_url provided, using default Portal API URL");
     }
     return DEFAULT_QWEN_BASE_URL;
 }
-//# sourceMappingURL=auth.js.map
+//# sourceMappingURL=auth.js.map

package/dist/lib/auth/browser.js

@@ -30,8 +30,8 @@ export function openBrowserUrl(url) {
         });
     }
     catch (error) {
-        // Log canh bao de ho tro debug, user van co the mo URL thu cong
-        console.warn("[qwen-oauth-plugin] Khong the mo trinh duyet:", error?.message || error);
+        // Log warning for debugging, user can still open URL manually
+        console.warn("[qwen-oauth-plugin] Unable to open browser:", error?.message || error);
     }
 }
 //# sourceMappingURL=browser.js.map

package/dist/lib/config.d.ts

@@ -3,6 +3,10 @@ import type { PluginConfig } from "./types.js";
  * Get plugin configuration directory
  */
 export declare function getConfigDir(): string;
+/**
+ * Get Qwen CLI credential directory (~/.qwen)
+ */
+export declare function getQwenDir(): string;
 /**
  * Get plugin configuration file path
  */
@@ -21,8 +25,16 @@ export declare function getQwenMode(config: PluginConfig): boolean;
  * Get token storage path
  */
 export declare function getTokenPath(): string;
+/**
+ * Get token lock path for multi-process refresh coordination
+ */
+export declare function getTokenLockPath(): string;
+/**
+ * Get legacy token storage path used by old plugin versions
+ */
+export declare function getLegacyTokenPath(): string;
 /**
  * Get cache directory for prompts
  */
 export declare function getCacheDir(): string;
-//# sourceMappingURL=config.d.ts.map
+//# sourceMappingURL=config.d.ts.map

package/dist/lib/config.js

@@ -7,6 +7,12 @@ import { readFileSync, existsSync } from "fs";
 export function getConfigDir() {
     return join(homedir(), ".opencode", "qwen");
 }
+/**
+ * Get Qwen CLI credential directory (~/.qwen)
+ */
+export function getQwenDir() {
+    return join(homedir(), ".qwen");
+}
 /**
  * Get plugin configuration file path
  */
@@ -20,7 +26,7 @@ export function getConfigPath() {
 export function loadPluginConfig() {
     const configPath = getConfigPath();
     if (!existsSync(configPath)) {
-        return { qwenMode: true }; // Default to QWEN_MODE enabled
+        return { qwenMode: true }; // Default: QWEN_MODE enabled
     }
     try {
         const content = readFileSync(configPath, "utf-8");
@@ -40,9 +46,9 @@ export function getQwenMode(config) {
     if (envValue !== undefined) {
         return envValue === "1" || envValue.toLowerCase() === "true";
     }
-    // Ep kieu boolean chac chan, tranh string "false" bi truthy
+    // Ensure boolean type, avoid string "false" being truthy
     const val = config.qwenMode;
-    if (val === undefined || val === null) return true; // mac dinh bat
+    if (val === undefined || val === null) return true; // default: enabled
     if (typeof val === "string") {
         return val === "1" || val.toLowerCase() === "true";
     }
@@ -52,6 +58,18 @@ export function getQwenMode(config) {
  * Get token storage path
  */
 export function getTokenPath() {
+    return join(getQwenDir(), "oauth_creds.json");
+}
+/**
+ * Get token lock path for multi-process refresh coordination
+ */
+export function getTokenLockPath() {
+    return join(getQwenDir(), "oauth_creds.lock");
+}
+/**
+ * Get legacy token storage path used by old plugin versions
+ */
+export function getLegacyTokenPath() {
     return join(getConfigDir(), "oauth_token.json");
 }
 /**
@@ -60,4 +78,4 @@ export function getTokenPath() {
 export function getCacheDir() {
     return join(homedir(), ".opencode", "cache");
 }
-//# sourceMappingURL=config.js.map
+//# sourceMappingURL=config.js.map

package/dist/lib/constants.d.ts

@@ -45,7 +45,7 @@ export declare const HTTP_STATUS: {
  */
 export declare const PORTAL_HEADERS: {
     readonly AUTH_TYPE: "X-DashScope-AuthType";
-    readonly AUTH_TYPE_VALUE: "qwen_oauth";
+    readonly AUTH_TYPE_VALUE: "qwen-oauth";
 };
 /** Device flow polling configuration */
 export declare const DEVICE_FLOW: {
@@ -85,7 +85,7 @@ export declare const PLATFORM_OPENERS: {
 };
 /** OAuth authorization labels */
 export declare const AUTH_LABELS: {
-    readonly OAUTH: "Qwen Account (OAuth)";
+    readonly OAUTH: "Qwen Code (qwen.ai OAuth)";
     readonly INSTRUCTIONS: "Visit the URL shown in your browser to complete authentication.";
 };
 /** OAuth verification URI parameters */
@@ -102,4 +102,4 @@ export declare const STREAM_CONFIG: {
     /** Maximum buffer size for SSE pass-through mode (1MB) */
     readonly MAX_BUFFER_SIZE: number;
 };
-//# sourceMappingURL=constants.d.ts.map
+//# sourceMappingURL=constants.d.ts.map

package/dist/lib/constants.js

@@ -45,7 +45,7 @@ export const HTTP_STATUS = {
  */
 export const PORTAL_HEADERS = {
     AUTH_TYPE: "X-DashScope-AuthType",
-    AUTH_TYPE_VALUE: "qwen_oauth",
+    AUTH_TYPE_VALUE: "qwen-oauth",
 };
 /** Device flow polling configuration */
 export const DEVICE_FLOW = {
@@ -95,11 +95,11 @@ export const VERIFICATION_URI = {
     /** Full query parameter for Qwen Code client */
     CLIENT_PARAM_VALUE: "client=qwen-code",
 };
-/** Token refresh buffer (refresh 5 minutes before expiry) */
-export const TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000; // 5 minutes
+/** Token refresh buffer (refresh 30 seconds before expiry) */
+export const TOKEN_REFRESH_BUFFER_MS = 30 * 1000; // 30 seconds
 /** Stream processing configuration */
 export const STREAM_CONFIG = {
     /** Maximum buffer size for SSE pass-through mode (1MB) */
     MAX_BUFFER_SIZE: 1024 * 1024,
 };
-//# sourceMappingURL=constants.js.map
+//# sourceMappingURL=constants.js.map

package/dist/lib/types.d.ts

@@ -68,7 +68,9 @@ export interface QwenTokenResponse {
 export interface StoredTokenData {
     access_token: string;
     refresh_token: string;
-    expires: number;
+    token_type?: string;
+    expiry_date: number;
+    expires?: number;
     resource_url?: string;
 }
 /**
@@ -86,6 +88,10 @@ export interface TokenSuccess {
  */
 export interface TokenFailure {
     type: "failed";
+    status?: number;
+    error?: string;
+    description?: string;
+    fatal?: boolean;
 }
 /**
  * Token exchange pending result (device flow)
@@ -177,4 +183,4 @@ export interface ErrorResponse {
     code?: string;
 }
 export type { Auth, Provider, Model };
-//# sourceMappingURL=types.d.ts.map
+//# sourceMappingURL=types.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-qwen-cli-auth",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Qwen OAuth authentication plugin for opencode - use your Qwen account instead of API keys",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",