fix(qoder): Cosy auth fallback for PAT tokens + vision support for qwen3-vl-plus

[herjarsa]

Summary

Qoder PAT tokens (pt-\* prefix) are not accepted as Bearer tokens by api.qoder.com/v1/chat/completions — the endpoint returns TOKEN_INVALID. PR #2559 changed routing from DashScope to api.qoder.com but the PAT auth still fails.

Additionally, qwen3-vl-plus lacked supportsVision: true, blocking clipboard image paste in the Qoder AI client.

Changes

File	Change	Reason
open-sse/config/providerRegistry.ts	supportsVision: true on qwen3-vl-plus	Enables vision in /v1/models response
open-sse/services/qoderCli.ts	Exported buildCosyHeadersForValidation	Needed by executor
open-sse/executors/qoder.ts	Cosy auth fallback for PAT tokens	Bearer fails → falls back to Cosy auth
tests/unit/qoder-executor.test.ts	Tests for Cosy fallback + existing	18/18 pass

Review feedback addressed

1. ✅ Static imports for extractTextFromQoderEnvelope and buildQoderCompletionPayload (no more dynamic imports in execution path)
2. ✅ Streaming: when stream=true, Cosy SSE response is piped directly; no buffering
3. ✅ Fixed redundant mappedModel || resolvedModel to mappedModel

Test Plan

• 18/18 qoder-executor tests pass
• Verified api.qoder.com returns TOKEN_INVALID for PAT tokens
• Cosy fallback test proves: 401 → Cosy auth → 200 with correct output

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.

[gemini-code-assist]

Code Review

This pull request enables vision support for the Qwen3 Vision Plus model and introduces a fallback authentication mechanism for Qoder PAT tokens using the Cosy endpoint. Feedback focuses on the fallback implementation, which currently buffers SSE streams and breaks the streaming experience for clients. Additionally, the use of dynamic imports within the execution path and loops should be replaced with static imports to improve performance, and a redundancy in the model selection logic was identified.

[gemini-code-assist]

The functions extractTextFromQoderEnvelope and buildQoderCompletionPayload should be imported statically at the top level. Dynamic imports during request execution, especially within loops, introduce unnecessary performance overhead and latency.

import { 
  buildCosyHeadersForValidation, 
  extractTextFromQoderEnvelope, 
  buildQoderCompletionPayload 
} from "../services/qoderCli.ts";

[gemini-code-assist]

This fallback implementation buffers the entire SSE stream from the Cosy endpoint into fullContent and returns it as a single JSON response. If the original request had stream: true, this breaks the streaming experience for the client and changes the response Content-Type from text/event-stream to application/json. Consider implementing a streaming transformer to unwrap the Qoder envelope chunks and pipe them to the client in real-time.

[gemini-code-assist]

Dynamic imports inside a loop are highly inefficient as they trigger module resolution on every iteration. Use the static import suggested at the top of the file.

Suggested change

	const { extractTextFromQoderEnvelope } = await import("../services/qoderCli.ts");
	const chunkText = extractTextFromQoderEnvelope(jsonData);
	const chunkText = extractTextFromQoderEnvelope(jsonData);

[gemini-code-assist]

Replace the dynamic import with a static one. Additionally, mappedModel || resolvedModel is redundant here because mappedModel is initialized to resolvedModel and is guaranteed to be a non-falsy string.

Suggested change

	const { buildQoderCompletionPayload } = await import("../services/qoderCli.ts");
	const cosyPayload = buildQoderCompletionPayload({ model: mappedModel || resolvedModel, text: fullContent });
	const cosyPayload = buildQoderCompletionPayload({ model: mappedModel, text: fullContent });

[diegosouzapw]

🎉 Thank you @herjarsa! The Cosy auth fallback for PAT tokens and qwen3-vl-plus vision support have been merged into release/v3.8.3. Great work on the encrypted header integration! 🚀