openmausbot 0.1.68 → 0.1.69

package/dist-server/server/avatar-image.js

@@ -1,4 +1,6 @@
 import { z } from "zod";
+import { normalizeImageGenerationUrl } from "../shared/image-generation.js";
+import { decodeGeneratedImage } from "./generated-image.js";
 export const AVATAR_DIRECTION_MAX_CHARS = 400;
 export const AVATAR_IMAGE_TIMEOUT_MS = 120_000;
 const MAX_UPSTREAM_RESPONSE_BYTES = 15 * 1024 * 1024;
@@ -6,8 +8,34 @@ export const avatarGenerationRequestSchema = z.object({
     prompt: z.string().trim().max(AVATAR_DIRECTION_MAX_CHARS).default(""),
 });
 const generatedImageResponseSchema = z.object({
-    data: z.array(z.object({ b64_json: z.string().min(1) })).min(1),
+    data: z.array(z.object({ b64_json: z.string().min(1).optional(), url: z.string().optional() })).min(1),
 });
+/** Public settings describe availability without returning provider secrets. */
+export function avatarImageStatus(cfg) {
+    const provider = cfg.imageGen?.provider ?? "openai";
+    const openaiConfigured = Boolean(cfg.imageGen?.key?.trim());
+    const xaiConfigured = Boolean(cfg.xai?.key?.trim());
+    const customKeyConfigured = Boolean(cfg.imageGen?.customApiKey?.trim());
+    const customModel = cfg.imageGen?.customModel?.trim() ?? "";
+    let customUrl = "";
+    try {
+        if (cfg.imageGen?.customUrl?.trim())
+            customUrl = normalizeImageGenerationUrl(cfg.imageGen.customUrl);
+    }
+    catch {
+        // A manually edited invalid URL must not become an outbound request.
+    }
+    return {
+        provider,
+        configured: provider === "openai" ? openaiConfigured : provider === "xai" ? xaiConfigured : Boolean(customUrl && customModel),
+        model: provider === "openai" ? "gpt-image-2" : provider === "xai" ? "grok-imagine-image-2.0" : customModel,
+        customUrl,
+        customModel,
+        openaiConfigured,
+        xaiConfigured,
+        customKeyConfigured,
+    };
+}
 /** Copy the mutable avatar fields before an asynchronous generation starts. */
 export function snapshotAvatarGenerationState(bot) {
     return { avatarUrl: bot.avatarUrl, avatarCrop: bot.avatarCrop };
@@ -53,7 +81,14 @@ async function boundedResponseText(response) {
     let received = 0;
     try {
         for (;;) {
-            const { done, value } = await reader.read();
+            let chunk;
+            try {
+                chunk = await reader.read();
+            }
+            catch {
+                throw Object.assign(new Error("Could not read the generated avatar response"), { status: 502 });
+            }
+            const { done, value } = chunk;
             if (done)
                 break;
             received += value.byteLength;
@@ -70,31 +105,45 @@ async function boundedResponseText(response) {
         reader.releaseLock();
     }
 }
-export async function generateAvatarImage(apiKey, bot, direction, fetchImpl = fetch, timeoutMs = AVATAR_IMAGE_TIMEOUT_MS) {
-    if (!apiKey.trim())
-        throw Object.assign(new Error("Add an OpenAI image API key first"), { status: 409 });
+export async function generateAvatarImage(cfg, bot, direction, fetchImpl = fetch, timeoutMs = AVATAR_IMAGE_TIMEOUT_MS) {
+    const settings = avatarImageStatus(cfg);
+    const { provider, model } = settings;
+    if (!settings.configured) {
+        const message = provider === "openai" ? "Add an OpenAI image API key first"
+            : provider === "xai" ? "Add an xAI API key first"
+                : "Set a valid custom image API URL and model first";
+        throw Object.assign(new Error(message), { status: 409 });
+    }
+    const apiKey = (provider === "openai" ? cfg.imageGen?.key
+        : provider === "xai" ? cfg.xai?.key : cfg.imageGen?.customApiKey)?.trim();
+    const providerName = provider === "openai" ? "OpenAI" : provider === "xai" ? "xAI" : "Custom";
+    const url = provider === "openai" ? "https://api.openai.com/v1/images/generations"
+        : provider === "xai" ? "https://api.x.ai/v1/images/generations"
+            : `${settings.customUrl}/images/generations`;
+    const headers = { "content-type": "application/json" };
+    if (apiKey)
+        headers.authorization = `Bearer ${apiKey}`;
+    const body = {
+        model,
+        prompt: avatarGenerationPrompt(bot, direction),
+        ...(provider === "openai" ? { size: "1024x1024", quality: "low", output_format: "webp" }
+            : provider === "xai" ? { response_format: "b64_json", aspect_ratio: "1:1" }
+                : { response_format: "b64_json", size: "1024x1024", n: 1 }),
+    };
     const timeoutSignal = AbortSignal.timeout(timeoutMs);
     let response;
     try {
-        response = await fetchImpl("https://api.openai.com/v1/images/generations", {
+        response = await fetchImpl(url, {
             method: "POST",
-            headers: {
-                authorization: `Bearer ${apiKey.trim()}`,
-                "content-type": "application/json",
-            },
-            body: JSON.stringify({
-                model: "gpt-image-2",
-                prompt: avatarGenerationPrompt(bot, direction),
-                size: "1024x1024",
-                quality: "low",
-                output_format: "webp",
-            }),
+            headers,
+            body: JSON.stringify(body),
+            redirect: "error",
             signal: timeoutSignal,
         });
     }
     catch (error) {
         const timedOut = timeoutSignal.aborted || (error instanceof Error && error.name === "TimeoutError");
-        throw Object.assign(new Error(timedOut ? "Avatar generation timed out" : "Could not reach OpenAI image generation"), { status: 502 });
+        throw Object.assign(new Error(timedOut ? "Avatar generation timed out" : `Could not reach ${providerName} image generation`), { status: 502 });
     }
     let text;
     try {
@@ -110,15 +159,9 @@ export async function generateAvatarImage(apiKey, bot, direction, fetchImpl = fe
         throw error;
     }
     if (!response.ok) {
-        let message = `OpenAI image generation failed (HTTP ${response.status})`;
-        try {
-            const parsed = z.object({ error: z.object({ message: z.string() }) }).safeParse(JSON.parse(text));
-            if (parsed.success)
-                message = parsed.data.error.message.slice(0, 500);
-        }
-        catch {
-            // Keep the bounded status-only message for malformed upstream errors.
-        }
+        // Upstream errors can repeat authorization headers, signed URLs, or other
+        // secrets. Return only the provider and HTTP status, never its raw body.
+        const message = `${providerName} image generation failed (HTTP ${response.status})`;
         throw Object.assign(new Error(message), { status: response.status === 401 ? 401 : 502 });
     }
     let parsedJson;
@@ -126,19 +169,28 @@ export async function generateAvatarImage(apiKey, bot, direction, fetchImpl = fe
         parsedJson = JSON.parse(text);
     }
     catch {
-        throw Object.assign(new Error("OpenAI returned an invalid image response"), { status: 502 });
+        throw Object.assign(new Error(`${providerName} returned an invalid image response`), { status: 502 });
     }
     const parsed = generatedImageResponseSchema.safeParse(parsedJson);
     if (!parsed.success) {
-        throw Object.assign(new Error("OpenAI returned no generated image"), { status: 502 });
+        throw Object.assign(new Error(`${providerName} returned no generated image`), { status: 502 });
     }
     const encoded = parsed.data.data[0].b64_json;
+    if (!encoded) {
+        // Do not fetch arbitrary URLs returned by a provider. Compatible gateways
+        // must support the requested inline base64 response format.
+        throw Object.assign(new Error(`${providerName} image generation must return base64 image data (b64_json)`), { status: 502 });
+    }
     if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || encoded.length % 4 !== 0) {
-        throw Object.assign(new Error("OpenAI returned invalid image data"), { status: 502 });
+        throw Object.assign(new Error(`${providerName} returned invalid image data`), { status: 502 });
     }
-    const bytes = Buffer.from(encoded, "base64");
-    if (bytes.byteLength === 0) {
-        throw Object.assign(new Error("OpenAI returned an empty image"), { status: 502 });
+    try {
+        const image = decodeGeneratedImage(encoded);
+        if (image.mime === "image/gif")
+            throw new Error("unsupported avatar format");
+        return { bytes: image.bytes, mime: image.mime };
+    }
+    catch {
+        throw Object.assign(new Error(`${providerName} returned invalid or oversized image data; expected PNG, JPEG, or WebP`), { status: 502 });
     }
-    return { bytes, mime: "image/webp" };
 }

package/dist-server/server/bot-package.js

@@ -27,6 +27,52 @@ const key = requiredText(64).regex(/^[a-z0-9][a-z0-9_-]*$/, {
     message: "may only contain lowercase letters, numbers, - and _",
 });
 const MAX_DATE_MS = 8_640_000_000_000_000;
+const CLOCK_TIME = /^([01]\d|2[0-3]):[0-5]\d$/;
+const intervalWeekdays = z.array(z.number().int().min(0).max(6)).min(1).max(7).refine((weekdays) => new Set(weekdays).size === weekdays.length, "must contain unique weekdays");
+const intervalWindow = z.object({
+    start: z.string().regex(CLOCK_TIME, { message: "must use HH:MM" }),
+    end: z.string().regex(CLOCK_TIME, { message: "must use HH:MM" }),
+}).strict().refine(({ start, end }) => start < end, {
+    message: "must end later on the same day",
+});
+const packageRoutineScheduleSchema = z.discriminatedUnion("type", [
+    z.object({ type: z.literal("once"), at: z.number().int() }),
+    z.object({
+        type: z.literal("daily"),
+        time: requiredText(5).regex(CLOCK_TIME, { message: "must use HH:MM" }),
+        weekdays: z.array(z.number().int().min(0).max(6)).min(1).max(7),
+    }),
+    z.object({
+        type: z.literal("interval"),
+        everyMinutes: z.number().int().min(5).max(1_440),
+        anchorAt: z.number().int().nonnegative().max(MAX_DATE_MS),
+        weekdays: intervalWeekdays.optional(),
+        window: intervalWindow.optional(),
+        endsAt: z.number().int().nonnegative().max(MAX_DATE_MS).optional(),
+    }),
+]).superRefine((schedule, context) => {
+    if (schedule.type !== "interval")
+        return;
+    if (schedule.window) {
+        const [startHour, startMinute] = schedule.window.start.split(":").map(Number);
+        const [endHour, endMinute] = schedule.window.end.split(":").map(Number);
+        const windowMinutes = endHour * 60 + endMinute - (startHour * 60 + startMinute);
+        if (windowMinutes < schedule.everyMinutes) {
+            context.addIssue({
+                code: "custom",
+                message: "must be at least as long as the interval cadence",
+                path: ["window"],
+            });
+        }
+    }
+    if (schedule.endsAt !== undefined && schedule.endsAt < schedule.anchorAt) {
+        context.addIssue({
+            code: "custom",
+            message: "must not be before the interval anchor",
+            path: ["endsAt"],
+        });
+    }
+});
 const packageSchema = z.object({
     format: z.literal(BOT_PACKAGE_FORMAT, { error: "This is not an OpenMaus package" }),
     version: z.literal(BOT_PACKAGE_VERSION, { error: "Package version is not supported" }),
@@ -86,19 +132,7 @@ const packageSchema = z.object({
             agent: key,
             prompt: requiredText(20_000),
             runOn: z.enum(["maus", "cloud"]),
-            schedule: z.discriminatedUnion("type", [
-                z.object({ type: z.literal("once"), at: z.number().int() }),
-                z.object({
-                    type: z.literal("daily"),
-                    time: requiredText(5).regex(/^([01]\d|2[0-3]):[0-5]\d$/, { message: "must use HH:MM" }),
-                    weekdays: z.array(z.number().int().min(0).max(6)).min(1).max(7),
-                }),
-                z.object({
-                    type: z.literal("interval"),
-                    everyMinutes: z.number().int().min(5).max(1_440),
-                    anchorAt: z.number().int().nonnegative().max(MAX_DATE_MS),
-                }),
-            ]),
+            schedule: packageRoutineScheduleSchema,
             durationMinutes: z.number().int().min(5).max(240),
             timeoutMinutes: z.number().int().min(5).max(240).optional(),
             enabledAfterInstall: z.literal(false),
@@ -200,6 +234,18 @@ export function parseBotPackage(value) {
     return parsed.data;
 }
 const list = (values) => values.map((value) => `- ${value}`).join("\n");
+const WEEKDAY_NAMES = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+function intervalScheduleText(schedule) {
+    const restrictions = [
+        schedule.weekdays?.length
+            ? `on ${schedule.weekdays.map((day) => WEEKDAY_NAMES[day]).join(", ")}`
+            : null,
+        schedule.window ? `during ${schedule.window.start}–${schedule.window.end}` : null,
+        schedule.endsAt !== undefined ? `until ${new Date(schedule.endsAt).toISOString()}` : null,
+    ].filter((part) => part !== null);
+    const cadence = `every ${schedule.everyMinutes} minutes from ${new Date(schedule.anchorAt).toISOString()}`;
+    return restrictions.length ? `${cadence}; ${restrictions.join("; ")}` : cadence;
+}
 /** Render the public artifact. The frontmatter enables deterministic imports;
  * the body is deliberately complete enough for any Chief-of-Staff agent to
  * run without OpenMausBot or another proprietary parser. */
@@ -226,7 +272,7 @@ export function renderBotPackageMarkdown(document) {
         `**Schedule:** ${routine.schedule.type === "daily"
             ? `${routine.schedule.time} on weekdays ${routine.schedule.weekdays.join(", ")}`
             : routine.schedule.type === "interval"
-                ? `every ${routine.schedule.everyMinutes} minutes from ${new Date(routine.schedule.anchorAt).toISOString()}`
+                ? intervalScheduleText(routine.schedule)
                 : `once at ${routine.schedule.at}`}  `,
         `**Run limit:** ${routine.timeoutMinutes === undefined ? "none" : `${routine.timeoutMinutes} minutes`}  `,
         "**Initial state:** paused — the user must enable it",

package/dist-server/server/config.js

@@ -5,6 +5,7 @@ import { readFileSync, mkdirSync, existsSync, renameSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { z } from "zod";
+import { normalizeImageGenerationUrl } from "../shared/image-generation.js";
 import { writeFileAtomic } from "./atomic.js";
 import { EFFORT_LEVELS } from "./contracts.js";
 import { parseStoredMcpServer } from "./mcp-registry.js";
@@ -247,8 +248,24 @@ const appConfigSchema = z.object({
      * engine: "elevenlabs" (default; needs a key) or "system" (the Mac's
      * built-in voices, no key). */
     tts: z.object({ key: optionalText, voice: optionalText, provider: z.enum(["elevenlabs", "system"]).optional() }).optional(),
-    /** OpenAI key used only by the in-process avatar image generator. */
-    imageGen: z.object({ key: optionalText }).optional(),
+    /** Avatar provider credentials stay separate; choosing a router never reuses a cloud key. */
+    imageGen: z.object({
+        provider: z.enum(["openai", "xai", "custom"]).optional(),
+        key: optionalText,
+        customApiKey: optionalText,
+        customUrl: z.string().trim().max(2048).transform((value, ctx) => {
+            if (!value)
+                return "";
+            try {
+                return normalizeImageGenerationUrl(value);
+            }
+            catch (error) {
+                ctx.addIssue({ code: "custom", message: error.message });
+                return z.NEVER;
+            }
+        }).optional(),
+        customModel: z.string().trim().max(200).refine((value) => !["\r", "\n", "\0"].some((character) => value.includes(character)), "Use a model ID without control characters").optional(),
+    }).optional(),
     /** Non-secret profile details shown in the sidebar. */
     profile: z.object({ name: optionalText, email: optionalText }).optional(),
     /** UI language override (BCP-47, lowercase). Empty/absent = follow the
@@ -433,6 +450,8 @@ export function loadConfig() {
     cfg.imageGen = { ...cfg.imageGen };
     if (process.env.OMB_OPENAI_IMAGE_KEY !== undefined)
         cfg.imageGen.key = process.env.OMB_OPENAI_IMAGE_KEY;
+    if (process.env.OMB_CUSTOM_IMAGE_KEY !== undefined)
+        cfg.imageGen.customApiKey = process.env.OMB_CUSTOM_IMAGE_KEY;
     // The sign-in allow-list: env is how a headless box or a container is
     // bootstrapped before anyone can reach Settings.
     const splitEmails = (value) => value.split(/[,\s]+/).map((entry) => entry.trim().toLowerCase()).filter(Boolean);
@@ -461,6 +480,7 @@ export function syncCredentialEnv(patch) {
         [patch.opencodeGo?.apiKey, "OPENCODE_API_KEY"],
         [patch.tts?.key, "OMB_TTS_KEY"],
         [patch.imageGen?.key, "OMB_OPENAI_IMAGE_KEY"],
+        [patch.imageGen?.customApiKey, "OMB_CUSTOM_IMAGE_KEY"],
     ];
     for (const [value, name] of secrets) {
         if (value === undefined)
@@ -499,6 +519,7 @@ export const WORKSPACE_CREDENTIAL_ENV = [
     "OPENCODE_API_KEY",
     "OMB_TTS_KEY",
     "OMB_OPENAI_IMAGE_KEY",
+    "OMB_CUSTOM_IMAGE_KEY",
     "COMPOSIO_API_KEY",
     "OMB_COMPOSIO_BROKER_TOKEN",
     // Harness-private filesystem hints are not credentials themselves, but

package/dist-server/server/drivers/acp/qwen.js

@@ -2,13 +2,109 @@
 // the official pane has no Qwen Cloud catalog; live local hosts land in
 // Custom and are written into ~/.qwen/settings.json modelProviders.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { decodeInjectId, hostApiKey, localHost, mergeLocalInject } from "../local-inject.js";
 import { createAcpDriver } from "./core.js";
 const EMPTY = { default: "", options: [] };
 function qwenHome(env) {
-    return join(env.HOME || env.USERPROFILE || homedir(), ".qwen");
+    const home = process.platform === "win32"
+        ? env.USERPROFILE || env.HOME || homedir()
+        : env.HOME || env.USERPROFILE || homedir();
+    return join(home, ".qwen");
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function qwenModelLabel(id, name) {
+    if (!name || name.toLocaleLowerCase().endsWith(id.toLocaleLowerCase()))
+        return id;
+    return `${id} — ${name}`;
+}
+const PROTOCOLS = new Set(["openai", "anthropic", "gemini", "vertex-ai"]);
+function readQwenRoutes(env) {
+    let settings;
+    try {
+        settings = JSON.parse(readFileSync(join(qwenHome(env), "settings.json"), "utf8"));
+    }
+    catch {
+        return [];
+    }
+    if (!isRecord(settings) || !isRecord(settings.modelProviders))
+        return [];
+    const routes = [];
+    const seen = new Set();
+    const mappings = isRecord(settings.providerProtocol) ? settings.providerProtocol : {};
+    for (const [provider, rows] of Object.entries(settings.modelProviders)) {
+        const protocol = Object.hasOwn(mappings, provider) ? mappings[provider] : provider;
+        if (typeof protocol !== "string" || !PROTOCOLS.has(protocol) || !Array.isArray(rows))
+            continue;
+        for (const row of rows) {
+            if (!isRecord(row) || typeof row.id !== "string")
+                continue;
+            const model = row.id;
+            if (!model.trim())
+                continue;
+            if (row.baseUrl !== undefined && typeof row.baseUrl !== "string")
+                continue;
+            const baseUrl = typeof row.baseUrl === "string" && row.baseUrl ? row.baseUrl : undefined;
+            if (baseUrl) {
+                try {
+                    new URL(baseUrl);
+                }
+                catch {
+                    throw new Error("A Qwen model has an invalid endpoint. Fix its baseUrl in Qwen settings and refresh models.");
+                }
+            }
+            const identity = JSON.stringify([protocol, model, baseUrl ?? null]);
+            if (seen.has(identity))
+                continue;
+            seen.add(identity);
+            if (row.imageOnly === true || row.voiceOnly === true || row.fastOnly === true)
+                continue;
+            routes.push({ id: `${model}(${protocol})`, model, provider, protocol, baseUrl,
+                label: typeof row.name === "string" && row.name ? row.name : model,
+                envKey: typeof row.envKey === "string" ? row.envKey : undefined });
+        }
+    }
+    // Qwen's ACP route identity, from QwenLM/qwen-code acpModelUtils.ts
+    // (Copyright 2025 Qwen Team, Apache-2.0). Never publish endpoints or env keys.
+    const counts = new Map();
+    for (const route of routes)
+        counts.set(route.id, (counts.get(route.id) ?? 0) + 1);
+    for (const route of routes) {
+        if (counts.get(route.id) === 1)
+            continue;
+        const endpoint = route.baseUrl ?? (route.protocol === "openai" ? "https://api.openai.com/v1" : "");
+        let publicEndpoint = null;
+        if (endpoint) {
+            try {
+                const url = new URL(endpoint);
+                url.username = "";
+                url.password = "";
+                url.search = "";
+                url.hash = "";
+                publicEndpoint = url.href;
+            }
+            catch {
+                throw new Error("A Qwen model has an invalid endpoint. Fix its baseUrl in Qwen settings and refresh models.");
+            }
+        }
+        const identity = [route.id, route.label, route.envKey ?? null, route.baseUrl === undefined, publicEndpoint];
+        route.id = `qwen-route:v1:${createHash("sha256").update(JSON.stringify(identity)).digest("base64url").slice(0, 16)}`;
+    }
+    if (new Set(routes.map((route) => route.id)).size !== routes.length) {
+        throw new Error("Qwen has indistinguishable model routes. Give them distinct names, envKey values, or public endpoints in Qwen settings.");
+    }
+    return routes;
+}
+/** Public metadata only. Use Qwen's provider-qualified ACP selectors, not raw model IDs. */
+export function readQwenModelCatalog(env = process.env) {
+    const options = readQwenRoutes(env).map(({ id, model, label, provider }) => ({
+        id, label: qwenModelLabel(model, label), custom: true, provider,
+    }));
+    return { default: options[0]?.id ?? "", options };
 }
 function envKeyFor(hostId) {
     return `OPENMAUSBOT_QWEN_${hostId.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_API_KEY`;
@@ -68,8 +164,46 @@ export function ensureQwenInjectModel(modelId, env = process.env) {
     return inject.model;
 }
 async function resolveModels(env) {
-    const catalog = await mergeLocalInject(EMPTY, env);
-    return { default: catalog.options[0]?.id ?? "", options: catalog.options };
+    const catalog = await mergeLocalInject(readQwenModelCatalog(env), env);
+    const routes = readQwenRoutes(env);
+    const replacements = new Map();
+    for (const option of catalog.options) {
+        const injected = decodeInjectId(option.id);
+        if (!injected)
+            continue;
+        const endpoint = localHost(injected.host)?.baseUrl;
+        for (const route of routes) {
+            if (route.protocol === "openai" && route.model === injected.model && route.baseUrl === endpoint) {
+                replacements.set(route.id, option.id);
+            }
+        }
+    }
+    const options = catalog.options.filter((option) => !replacements.has(option.id));
+    const preferred = replacements.get(catalog.default) ?? catalog.default;
+    return { default: options.some((option) => option.id === preferred) ? preferred : options[0]?.id ?? "", options };
+}
+export function resolveQwenTurnModel(model, env) {
+    if (!model)
+        return model;
+    const injected = decodeInjectId(model);
+    if (injected)
+        ensureQwenInjectModel(model, env);
+    const routes = readQwenRoutes(env);
+    if (injected) {
+        const route = routes.find((row) => row.protocol === "openai" && row.model === injected.model
+            && row.baseUrl === localHost(injected.host)?.baseUrl);
+        if (!route)
+            throw new Error("Qwen could not configure this local model. Refresh models and select it again.");
+        return route.id;
+    }
+    if (routes.some((route) => route.id === model))
+        return model;
+    const matches = routes.filter((route) => route.model === model);
+    if (matches.length > 1)
+        throw new Error("This Qwen model has multiple providers. Refresh models and select the intended provider again.");
+    if (!matches.length)
+        throw new Error("This Qwen model is no longer configured. Refresh models and select it again.");
+    return matches[0].id;
 }
 const support = {
     driverKind: "qwenAgent",
@@ -77,7 +211,7 @@ const support = {
     access: "custom",
     models: EMPTY,
     resolveModels,
-    resolveTurnModel: (model, env) => (model ? ensureQwenInjectModel(model, env) : model),
+    resolveTurnModel: resolveQwenTurnModel,
     defaultCli: "qwen",
     nativeSource: "qwen.acp",
     loginNote: "Qwen Code CLI is not installed",
@@ -89,7 +223,10 @@ const support = {
         },
         docsUrl: "https://qwenlm.github.io/qwen-code-docs/en/users/overview/",
     },
-    spawnArgs: (_config, turn) => ["--acp", ...(turn.model ? ["-m", turn.model] : [])],
+    // A raw -m only changes the model within the saved provider. ACP switches
+    // the complete route and confirms it before any prompt leaves OMB.
+    spawnArgs: () => ["--acp"],
+    selectModel: { configId: "model" },
     pickAuthMethod: () => null,
     authFailure: "continue",
     isAuthenticated: () => true,