opencode-qwen-cli-auth 2.3.3 → 2.3.5

package/README.md

@@ -50,10 +50,10 @@ The plugin stores each successful login in the multi-account store and can auto-
 
 ## Supported Models
 
-| Model | ID | Context | Max Output | Cost |
-|-------|-----|---------|------------|---------|
-| Qwen Coder (Qwen 3.5 Plus) | `coder-model` | 1M tokens | 65,536 tokens | Free |
-| Qwen VL Plus (Vision) | `vision-model` | 128K tokens | 8,192 tokens | Free |
+| Model | ID | Input | Output | Context | Max Output | Cost |
+|-------|-----|-------|--------|---------|------------|---------|
+| Qwen Coder (Qwen 3.5 Plus) | `coder-model` | text | text | 1M tokens | 65,536 tokens | Free |
+| Qwen VL Plus (Vision) | `vision-model` | text, image | text | 128K tokens | 8,192 tokens | Free |
 
 ## Configuration
 
@@ -124,7 +124,8 @@ When hitting a `429 insufficient_quota` error, the plugin automatically:
 1. **Marks current account exhausted** for cooldown window
 2. **Switches to next healthy account** and retries with same payload
 3. **Degrades payload** if no healthy account can be switched
-4. **CLI fallback** (optional) - invokes `qwen` CLI if `OPENCODE_QWEN_ENABLE_CLI_FALLBACK=1` is set
+4. **CLI fallback** (optional) - invokes `qwen` CLI only for text-only payloads when `OPENCODE_QWEN_ENABLE_CLI_FALLBACK=1` is set
+5. **Multimodal safety guard** - skips CLI fallback for non-text parts (image/audio/file/video) to avoid semantic loss
 
 ### Token Expiration
 

package/README.vi.md

@@ -50,10 +50,10 @@ Plugin sẽ lưu từng lần đăng nhập thành công vào kho đa tài kho
 
 ## Models hỗ trợ
 
-| Model | ID | Context | Max Output | Chi phí |
-|-------|-----|---------|------------|---------|
-| Qwen Coder (Qwen 3.5 Plus) | `coder-model` | 1M tokens | 65,536 tokens | Miễn phí |
-| Qwen VL Plus (Vision) | `vision-model` | 128K tokens | 8,192 tokens | Miễn phí |
+| Model | ID | Input | Output | Context | Max Output | Chi phí |
+|-------|-----|-------|--------|---------|------------|---------|
+| Qwen Coder (Qwen 3.5 Plus) | `coder-model` | text | text | 1M tokens | 65,536 tokens | Miễn phí |
+| Qwen VL Plus (Vision) | `vision-model` | text, image | text | 128K tokens | 8,192 tokens | Miễn phí |
 
 ## Cấu hình
 
@@ -124,7 +124,8 @@ Khi gặp lỗi `429 insufficient_quota`, plugin sẽ tự động:
 1. **Đánh dấu tài khoản hiện tại đã hết quota** trong cửa sổ cooldown
 2. **Đổi sang tài khoản khỏe tiếp theo** và retry với payload ban đầu
 3. **Degrade payload** nếu không còn tài khoản khỏe để đổi
-4. **CLI fallback** (tùy chọn) - gọi `qwen` CLI nếu biến `OPENCODE_QWEN_ENABLE_CLI_FALLBACK=1` được bật
+4. **CLI fallback** (tùy chọn) - chỉ gọi `qwen` CLI cho payload chỉ có text khi bật `OPENCODE_QWEN_ENABLE_CLI_FALLBACK=1`
+5. **Guard multimodal an toàn** - bỏ qua CLI fallback khi payload có phần non-text (image/audio/file/video) để tránh mất ngữ nghĩa
 
 ### Token Hết Hạn
 

package/dist/index.js

@@ -11,7 +11,7 @@
  * 
  * @license MIT with Usage Disclaimer (see LICENSE file)
  * @repository https://github.com/TVD-00/opencode-qwen-cli-auth
- * @version 2.2.9
+ * @version 2.3.5
  */
 
 import { randomUUID } from "node:crypto";
@@ -22,7 +22,7 @@ import { PROVIDER_ID, AUTH_LABELS, DEVICE_FLOW, PORTAL_HEADERS } from "./lib/con
 import { logError, logInfo, logWarn, LOGGING_ENABLED } from "./lib/logger.js";
 
 /** Request timeout for chat completions in milliseconds */
-const CHAT_REQUEST_TIMEOUT_MS = 120000;
+const CHAT_REQUEST_TIMEOUT_MS = 30000;
 /** Maximum number of retry attempts for failed requests */
 const CHAT_MAX_RETRIES = 3;
 /** Output token cap for coder-model (64K tokens) */
@@ -40,7 +40,7 @@ const CLI_FALLBACK_MAX_BUFFER_CHARS = 1024 * 1024;
 /** Enable CLI fallback feature via environment variable */
 const ENABLE_CLI_FALLBACK = process.env.OPENCODE_QWEN_ENABLE_CLI_FALLBACK === "1";
 /** User agent string for plugin identification */
-const PLUGIN_USER_AGENT = "opencode-qwen-cli-auth/2.2.1";
+const PLUGIN_USER_AGENT = "opencode-qwen-cli-auth/2.3.4";
 /** Output token limits per model for DashScope OAuth */
 const DASH_SCOPE_OUTPUT_LIMITS = {
     "coder-model": 65536,
@@ -415,19 +415,19 @@ function sanitizeOutgoingPayload(payload) {
 function createQuotaDegradedPayload(payload) {
     const degraded = { ...payload };
     let changed = false;
-    // Remove tool-related fields (skip removing tools so Agents don't break)
-    // if ("tools" in degraded) {
-    //     delete degraded.tools;
-    //     changed = true;
-    // }
-    // if ("tool_choice" in degraded) {
-    //     delete degraded.tool_choice;
-    //     changed = true;
-    // }
-    // if ("parallel_tool_calls" in degraded) {
-    //     delete degraded.parallel_tool_calls;
-    //     changed = true;
-    // }
+    // Remove tool-related fields
+    if ("tools" in degraded) {
+        delete degraded.tools;
+        changed = true;
+    }
+    if ("tool_choice" in degraded) {
+        delete degraded.tool_choice;
+        changed = true;
+    }
+    if ("parallel_tool_calls" in degraded) {
+        delete degraded.parallel_tool_calls;
+        changed = true;
+    }
     // Disable streaming
     if (degraded.stream !== false) {
         degraded.stream = false;
@@ -490,6 +490,54 @@ function extractMessageText(content) {
         return "";
     }).filter(Boolean).join("\n").trim();
 }
+
+/**
+ * Checks whether content contains non-text parts
+ * @param {*} content - Message content
+ * @returns {boolean} True if any non-text part is present
+ */
+function hasNonTextContentPart(content) {
+    if (typeof content === "string") {
+        return false;
+    }
+    if (Array.isArray(content)) {
+        return content.some((part) => {
+            if (typeof part === "string") {
+                return false;
+            }
+            if (!part || typeof part !== "object") {
+                return true;
+            }
+            if (typeof part.text === "string") {
+                return false;
+            }
+            const partType = typeof part.type === "string" ? part.type.toLowerCase() : "";
+            if (partType === "text" && typeof part.text === "string") {
+                return false;
+            }
+            return true;
+        });
+    }
+    if (content && typeof content === "object") {
+        return typeof content.text !== "string";
+    }
+    return false;
+}
+
+/**
+ * Checks whether payload contains any multimodal message content
+ * @param {Object} payload - Request payload
+ * @returns {boolean} True if payload contains non-text message parts
+ */
+function payloadContainsNonTextMessages(payload) {
+    const messages = Array.isArray(payload?.messages) ? payload.messages : [];
+    for (const message of messages) {
+        if (hasNonTextContentPart(message?.content)) {
+            return true;
+        }
+    }
+    return false;
+}
 /**
  * Builds prompt text from chat messages for CLI fallback
  * @param {Object} payload - Request payload with messages
@@ -595,7 +643,7 @@ function createSseResponseChunk(data) {
  * @param {boolean} streamMode - Whether to return streaming response
  * @returns {Response} Formatted completion response
  */
-function makeQwenCliCompletionResponse(model, content, context, streamMode, abortSignal) {
+function makeQwenCliCompletionResponse(model, content, context, streamMode) {
     if (LOGGING_ENABLED) {
         logInfo("Qwen CLI fallback returned completion", {
             request_id: context.requestId,
@@ -609,7 +657,7 @@ function makeQwenCliCompletionResponse(model, content, context, streamMode, abor
         const encoder = new TextEncoder();
         const stream = new ReadableStream({
             start(controller) {
-                // Send first chunk with empty content
+                // Send first chunk with content
                 controller.enqueue(encoder.encode(createSseResponseChunk({
                     id: completionId,
                     object: "chat.completion.chunk",
@@ -618,51 +666,28 @@ function makeQwenCliCompletionResponse(model, content, context, streamMode, abor
                     choices: [
                         {
                             index: 0,
-                            delta: { role: "assistant", content: "" },
+                            delta: { role: "assistant", content },
                             finish_reason: null,
                         },
                     ],
                 })));
-
-                const CHUNK_SIZE = 15;
-                const DELAY_MS = 20;
-                let position = 0;
-
-                function pushNextChunk() {
-                    if (abortSignal?.aborted) {
-                        try { controller.close(); } catch (e) { }
-                        return;
-                    }
-
-                    if (position >= content.length) {
-                        // Send stop chunk
-                        controller.enqueue(encoder.encode(createSseResponseChunk({
-                            id: completionId,
-                            object: "chat.completion.chunk",
-                            created,
-                            model,
-                            choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
-                        })));
-                        controller.enqueue(encoder.encode("data: [DONE]\n\n"));
-                        try { controller.close(); } catch (e) { }
-                        return;
-                    }
-
-                    const nextSlice = content.slice(position, position + CHUNK_SIZE);
-                    position += CHUNK_SIZE;
-
-                    controller.enqueue(encoder.encode(createSseResponseChunk({
-                        id: completionId,
-                        object: "chat.completion.chunk",
-                        created,
-                        model,
-                        choices: [{ index: 0, delta: { content: nextSlice }, finish_reason: null }],
-                    })));
-
-                    setTimeout(pushNextChunk, DELAY_MS);
-                }
-
-                pushNextChunk();
+                // Send stop chunk
+                controller.enqueue(encoder.encode(createSseResponseChunk({
+                    id: completionId,
+                    object: "chat.completion.chunk",
+                    created,
+                    model,
+                    choices: [
+                        {
+                            index: 0,
+                            delta: {},
+                            finish_reason: "stop",
+                        },
+                    ],
+                })));
+                // Send DONE marker
+                controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+                controller.close();
             },
         });
         return new Response(stream, {
@@ -714,6 +739,20 @@ function makeQwenCliCompletionResponse(model, content, context, streamMode, abor
 async function runQwenCliFallback(payload, context, abortSignal) {
     const model = typeof payload?.model === "string" && payload.model.length > 0 ? payload.model : "coder-model";
     const streamMode = payload?.stream === true;
+    if (payloadContainsNonTextMessages(payload)) {
+        if (LOGGING_ENABLED) {
+            logWarn("Skipping qwen CLI fallback for multimodal payload", {
+                request_id: context.requestId,
+                sessionID: context.sessionID,
+                modelID: model,
+                accountID: context.accountID,
+            });
+        }
+        return {
+            ok: false,
+            reason: "cli_fallback_unsupported_multimodal_payload",
+        };
+    }
     const prompt = buildQwenCliPrompt(payload);
     const args = [prompt, "-o", "json", "--max-session-turns", "1", "--model", model];
     if (LOGGING_ENABLED) {
@@ -724,8 +763,12 @@ async function runQwenCliFallback(payload, context, abortSignal) {
             command: QWEN_CLI_COMMAND,
         });
     }
-    // Use secure spawn logic across ALL OS, allowing .cmd locally on Windows by injecting shell correctly.
-    const isShellRequired = requiresShellExecution(QWEN_CLI_COMMAND);
+    if (requiresShellExecution(QWEN_CLI_COMMAND)) {
+        return {
+            ok: false,
+            reason: "cli_shell_execution_blocked_for_security",
+        };
+    }
     return await new Promise((resolve) => {
         let settled = false;
         let stdout = "";
@@ -755,7 +798,7 @@ async function runQwenCliFallback(payload, context, abortSignal) {
         }
         try {
             child = spawn(QWEN_CLI_COMMAND, args, {
-                shell: isShellRequired,
+                shell: false,
                 windowsHide: true,
                 stdio: ["ignore", "pipe", "pipe"],
             });
@@ -810,7 +853,7 @@ async function runQwenCliFallback(payload, context, abortSignal) {
             if (content) {
                 finalize({
                     ok: true,
-                    response: makeQwenCliCompletionResponse(model, content, context, streamMode, abortSignal),
+                    response: makeQwenCliCompletionResponse(model, content, context, streamMode),
                 });
                 return;
             }
@@ -1360,6 +1403,7 @@ export const QwenAuthPlugin = async (_input) => {
                         name: "Qwen Coder (Qwen 3.5 Plus)",
                         // Qwen does not support reasoning_effort from OpenCode UI
                         // Thinking is always enabled by default on server side (qwen3.5-plus)
+                        attachment: false,
                         reasoning: false,
                         limit: { context: 1048576, output: CHAT_MAX_TOKENS_CAP },
                         cost: { input: 0, output: 0 },
@@ -1368,10 +1412,11 @@ export const QwenAuthPlugin = async (_input) => {
                     "vision-model": {
                         id: "vision-model",
                         name: "Qwen VL Plus (vision)",
+                        attachment: true,
                         reasoning: false,
                         limit: { context: 131072, output: DASH_SCOPE_OUTPUT_LIMITS["vision-model"] },
                         cost: { input: 0, output: 0 },
-                        modalities: { input: ["text"], output: ["text"] },
+                        modalities: { input: ["text", "image"], output: ["text"] },
                     },
                 },
             };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-qwen-cli-auth",
-  "version": "2.3.3",
+  "version": "2.3.5",
   "description": "Qwen OAuth authentication plugin for opencode - use your Qwen account instead of API keys",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",