[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider

.env.example

@@ -895,9 +895,6 @@ CODEX_OAUTH_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann
 # ANTIGRAVITY_OAUTH_CLIENT_SECRET=
 # WINDSURF_FIREBASE_API_KEY=
 
-# ── Qwen (Alibaba) ──
-QWEN_OAUTH_CLIENT_ID=f0304373b74a44d2b584a3fb70ca9e56
-
 # ── Kimi Coding (Moonshot) ──
 KIMI_CODING_OAUTH_CLIENT_ID=17e5f671-d194-4dfb-9706-5516cb48c098
 
@@ -1038,7 +1035,6 @@ KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
 # Used by: open-sse/executors/kiro.ts
 # KIRO_VERIFY_FULL_CRC=false
 QODER_USER_AGENT="Qoder-Cli"
-QWEN_USER_AGENT="QwenCode/0.19.3 (linux; x64)"
 CURSOR_USER_AGENT="Cursor/3.4"
 
 # Override Codex client version sent in headers independently of the
@@ -1068,8 +1064,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # CLI_COMPAT_KIMI_CODING=1
 # CLI_COMPAT_KILOCODE=1
 # CLI_COMPAT_CLINE=1
-# CLI_COMPAT_QWEN=1
-
 # Or enable for all providers at once:
 # CLI_COMPAT_ALL=1
 

AGENTS.md

@@ -267,8 +267,8 @@ Zod schemas, and unit tests aligned when editing.
 
 ### Provider Categories
 
-- **Free** (3): Qoder AI, Qwen Code, Kiro AI
-- **OAuth** (14): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Qwen (⚠️ free tier discontinued 2026-04-15), Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
+- **Free** (2): Qoder AI, Kiro AI
+- **OAuth** (13): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
 - **API Key** (120+): OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Perplexity,
   Together, Fireworks, Cerebras, Cohere, NVIDIA, Nebius, SiliconFlow, Hyperbolic,
   HuggingFace, OpenRouter, Vertex AI, Cloudflare AI, Scaleway, AI/ML API, Pollinations,

README.md

@@ -292,7 +292,6 @@ All **18** strategies — mix & match per combo step:
     <td align="center" width="76"><a href="https://github.com/Kilo-Org/kilocode"><img src="./public/providers/kilocode.svg" width="40" alt="Kilo Code"/><br/><sub><b>Kilo Code</b></sub><br/><sub>                           </sub></a></td>
     <td align="center" width="76"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-png@1.91.0/dark/roocode.png#gh-dark-mode-only" width="40" alt="Roo Code"/><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/roocode.svg#gh-light-mode-only" width="40" alt="Roo Code"/><br/><sub><b>Roo Code</b></sub><br/><sub>                           </sub></td>
     <td align="center" width="76"><img src="./public/providers/continue.svg" width="40" alt="Continue"/><br/><sub><b>Continue</b></sub><br/><sub>                           </sub></td>
-    <td align="center" width="76"><img src="./public/providers/qwen.svg" width="40" alt="Qwen Code"/><br/><sub><b>Qwen Code</b></sub><br/><sub>                           </sub></td>
     <td align="center" width="76"><img src="./public/providers/cli-generic.svg" width="40" alt="Aider"/><br/><sub><b>Aider</b></sub><br/><sub>                           </sub></td>
     <td align="center" width="76"><img src="./public/providers/cli-generic.svg" width="40" alt="ForgeCode"/><br/><sub><b>ForgeCode</b></sub><br/><sub>                           </sub></td>
   </tr>

SECURITY.md

@@ -42,7 +42,7 @@ Request → CORS → Authz pipeline (classify → policies → enforce)
 | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
 | **Dashboard Login**   | Password-based auth with JWT tokens (HttpOnly cookies)                                                                                    |
 | **API Key Auth**      | HMAC-signed keys with CRC validation                                                                                                      |
-| **OAuth 2.0 + PKCE**  | 14 providers (Claude, Codex, GitHub, Cursor, Antigravity, Gemini, Kimi Coding, Kilo Code, Cline, Qwen, Kiro, Qoder, Windsurf, GitLab Duo) |
+| **OAuth 2.0 + PKCE**  | 13 providers (Claude, Codex, GitHub, Cursor, Antigravity, Gemini, Kimi Coding, Kilo Code, Cline, Kiro, Qoder, Windsurf, GitLab Duo)       |
 | **Token Refresh**     | Automatic OAuth token refresh before expiry                                                                                               |
 | **Secure Cookies**    | `AUTH_COOKIE_SECURE=true` for HTTPS environments                                                                                          |
 | **Authz Pipeline**    | Route classification (PUBLIC / CLIENT_API / MANAGEMENT) — see `docs/architecture/AUTHZ_GUIDE.md`                                          |

bin/cli/commands/oauth.mjs

@@ -7,7 +7,6 @@ const PROVIDERS_WITH_OAUTH = [
   { id: "gemini", name: "Google Gemini", flow: "browser" },
   { id: "antigravity", name: "Antigravity", flow: "browser" },
   { id: "windsurf", name: "Windsurf", flow: "browser" },
-  { id: "qwen", name: "Qwen Code", flow: "browser" },
   { id: "cursor", name: "Cursor", flow: "import" },
   { id: "zed", name: "Zed", flow: "import" },
   { id: "kiro", name: "Amazon Kiro", flow: "social" },

bin/cli/commands/registry.mjs

@@ -70,8 +70,8 @@ import { registerSetupCursor } from "./setup-cursor.mjs";
 import { registerSetupRoo } from "./setup-roo.mjs";
 import { registerSetupCrush } from "./setup-crush.mjs";
 import { registerSetupGoose } from "./setup-goose.mjs";
-import { registerSetupQwen } from "./setup-qwen.mjs";
 import { registerSetupAider } from "./setup-aider.mjs";
+import { registerSetupQwen } from "./setup-qwen.mjs";
 import { registerConnect } from "./connect.mjs";
 import { registerContexts } from "./contexts.mjs";
 import { registerTokens } from "./tokens.mjs";
@@ -153,8 +153,8 @@ export function registerCommands(program) {
   registerSetupRoo(program);
   registerSetupCrush(program);
   registerSetupGoose(program);
-  registerSetupQwen(program);
   registerSetupAider(program);
+  registerSetupQwen(program);
   registerConnect(program);
   registerContexts(program);
   registerTokens(program);

bin/cli/commands/setup-qwen.mjs

@@ -1,156 +1,166 @@
-/**
- * omniroute setup-qwen — configure Qwen Code (QwenLM/qwen-code) for OmniRoute.
- *
- * Qwen Code is a terminal AI agent with a file-based config at
- * ~/.qwen/settings.json. For a custom OpenAI-compatible endpoint it uses a
- * `modelProviders` entry with authType "openai", baseUrl WITH /v1, and an
- * `envKey` naming the env var holding the key (secret stays in the env, never the
- * file). Remote-aware; headless test via `qwen -p "..."`.
- */
-
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+/** Configure Qwen Code's OpenAI-compatible provider for OmniRoute. */
+
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
 import os from "node:os";
-import { printHeading, printInfo, printSuccess, printError, createPrompt } from "../io.mjs";
-import { resolveActiveContext } from "../contexts.mjs";
+import path from "node:path";
 
-function ensureV1(url) {
-  const s = String(url || "").replace(/\/+$/, "");
-  return s.endsWith("/v1") ? s : `${s}/v1`;
-}
+import {
+  mergeQwenCodeEnv,
+  mergeQwenCodeSettings,
+  normalizeQwenCodeBaseUrl,
+} from "../../../src/shared/services/qwenCodeConfig.ts";
+import { resolveActiveContext } from "../contexts.mjs";
+import { createPrompt, printError, printHeading, printInfo, printSuccess } from "../io.mjs";
 
-/** Resolve baseUrl (WITH /v1) + apiKey from flags → active context → localhost. */
+/** Resolve base URL and key from flags, active context, then local defaults. */
 export function resolveQwenTarget(opts = {}) {
-  let root;
-  if (opts.remote) root = String(opts.remote).replace(/\/+$/, "");
-  else {
+  let root = opts.remote ? String(opts.remote) : "";
+  let context;
+
+  if (!root || !(opts.apiKey ?? opts["api-key"])) {
     try {
-      root = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT)?.baseUrl;
+      context = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
     } catch {
-      /* none */
+      // An active context is optional for local setup.
     }
-    if (!root) root = `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
   }
-  let apiKey = opts.apiKey ?? opts["api-key"];
-  if (!apiKey) {
-    try {
-      const c = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      apiKey = c?.accessToken || c?.apiKey;
-    } catch {
-      /* none */
-    }
+
+  if (!root) root = context?.baseUrl || "";
+  if (!root) {
+    const port = Number(opts.port ?? process.env.PORT ?? 20128) || 20128;
+    root = `http://localhost:${port}`;
   }
-  if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
-  return { baseUrl: ensureV1(root), apiKey };
+
+  const apiKey =
+    opts.apiKey ??
+    opts["api-key"] ??
+    context?.accessToken ??
+    context?.apiKey ??
+    process.env.OMNIROUTE_API_KEY ??
+    "sk_omniroute";
+
+  return { baseUrl: normalizeQwenCodeBaseUrl(root), apiKey };
 }
 
-/** Merge the OmniRoute modelProvider into Qwen's settings.json (preserve rest). */
-export function buildQwenSettings(existing, { baseUrl, model }) {
-  const s = existing && typeof existing === "object" ? { ...existing } : {};
-  const providers = Array.isArray(s.modelProviders)
-    ? s.modelProviders.filter((p) => p?.id !== "omniroute")
-    : [];
-  providers.push({
-    id: "omniroute",
-    name: "OmniRoute",
-    authType: "openai",
-    baseUrl,
-    envKey: "OMNIROUTE_API_KEY",
-  });
-  s.modelProviders = providers;
-  if (model) {
-    s.selectedProvider = "omniroute";
-    s.model = model;
+const readSettings = (filePath) => {
+  if (!existsSync(filePath)) return {};
+  const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Qwen Code settings.json must contain a JSON object");
   }
-  return s;
-}
+  return parsed;
+};
+
+const readText = (filePath) => (existsSync(filePath) ? readFileSync(filePath, "utf8") : "");
 
-function readJson(path) {
+const writeAtomic = (filePath, content, mode) => {
+  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
   try {
-    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    /* corrupt/missing */
+    writeFileSync(tempPath, content, { encoding: "utf8", mode });
+    if (mode !== undefined) chmodSync(tempPath, mode);
+    renameSync(tempPath, filePath);
+  } catch (error) {
+    try {
+      unlinkSync(tempPath);
+    } catch {
+      // The temporary file may not have been created.
+    }
+    throw error;
   }
-  return {};
-}
+};
 
-async function fetchModelIds(baseUrl, apiKey) {
+const fetchModelIds = async (baseUrl, apiKey) => {
   try {
-    const headers = { "Content-Type": "application/json" };
-    if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-    const res = await fetch(`${baseUrl.replace(/\/v1$/, "")}/v1/models`, {
-      headers,
+    const response = await fetch(`${baseUrl}/models`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
       signal: AbortSignal.timeout(8000),
     });
-    if (!res.ok) return [];
-    const body = await res.json();
-    const list = Array.isArray(body) ? body : (body.data ?? body.models ?? []);
-    return list.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
+    if (!response.ok) return [];
+    const body = await response.json();
+    const models = Array.isArray(body) ? body : (body.data ?? body.models ?? []);
+    return models.map((entry) => (typeof entry === "string" ? entry : entry?.id)).filter(Boolean);
   } catch {
     return [];
   }
-}
+};
 
 export async function runSetupQwenCommand(opts = {}) {
   const { baseUrl, apiKey } = resolveQwenTarget(opts);
   const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const configPath =
-    opts.configPath ?? opts["config-path"] ?? join(os.homedir(), ".qwen", "settings.json");
+  const settingsPath =
+    opts.configPath ?? opts["config-path"] ?? path.join(os.homedir(), ".qwen", "settings.json");
+  const envPath = opts.envPath ?? opts["env-path"] ?? path.join(path.dirname(settingsPath), ".env");
 
-  printHeading("OmniRoute → Qwen Code (openai-compatible)");
+  printHeading("OmniRoute → Qwen Code (OpenAI-compatible)");
   printInfo(`baseUrl: ${baseUrl}`);
 
-  let model = opts.model;
-  if (!model) {
-    const ids = await fetchModelIds(baseUrl, apiKey);
-    if (ids.length && !opts.yes) {
-      printInfo(`Examples: ${ids.slice(0, 20).join(", ")}${ids.length > 20 ? " …" : ""}`);
-      const prompt = createPrompt();
-      try {
-        model = await prompt.ask("Model id for Qwen");
-      } finally {
-        prompt.close();
-      }
+  let model = String(opts.model || "").trim();
+  if (!model && !opts.yes) {
+    const modelIds = await fetchModelIds(baseUrl, apiKey);
+    if (modelIds.length > 0) {
+      printInfo(`Examples: ${modelIds.slice(0, 20).join(", ")}${modelIds.length > 20 ? " …" : ""}`);
+    }
+    const prompt = createPrompt();
+    try {
+      model = String(await prompt.ask("Model id for Qwen Code")).trim();
+    } finally {
+      prompt.close();
     }
   }
+
   if (!model) {
     printError("A model is required. Pass --model <id>.");
     return 2;
   }
 
-  const merged = buildQwenSettings(readJson(configPath), { baseUrl, model });
-  const out = JSON.stringify(merged, null, 2) + "\n";
+  try {
+    const settings = mergeQwenCodeSettings(readSettings(settingsPath), { baseUrl, model });
+    const envText = mergeQwenCodeEnv(readText(envPath), apiKey);
+    const settingsText = `${JSON.stringify(settings, null, 2)}\n`;
+
+    if (dryRun) {
+      console.log(`\n${settingsText}`);
+      printInfo(`[dry-run] settings → ${settingsPath}`);
+      printInfo(`[dry-run] credential → ${envPath} (OMNIROUTE_API_KEY)`);
+      return 0;
+    }
 
-  if (dryRun) {
-    console.log("\n" + out);
-    printInfo(`[dry-run] → ${configPath}`);
-  } else {
-    mkdirSync(join(configPath, ".."), { recursive: true });
-    writeFileSync(configPath, out, "utf8");
-    printSuccess(`Wrote ${configPath}`);
+    mkdirSync(path.dirname(settingsPath), { recursive: true, mode: 0o700 });
+    mkdirSync(path.dirname(envPath), { recursive: true, mode: 0o700 });
+    writeAtomic(settingsPath, settingsText);
+    writeAtomic(envPath, envText, 0o600);
+    printSuccess(`Wrote ${settingsPath}`);
+    printSuccess(`Updated ${envPath} (OMNIROUTE_API_KEY only)`);
+    printInfo('Run: qwen   (or headless: qwen -p "reply OK")');
+    return 0;
+  } catch (error) {
+    printError(`Failed to configure Qwen Code: ${error?.message || error}`);
+    return 1;
   }
-  printInfo(
-    "\nProvide the key (settings reference OMNIROUTE_API_KEY):  export OMNIROUTE_API_KEY=..."
-  );
-  printInfo('Then run:  qwen        (or headless: qwen -p "reply OK")');
-  return 0;
 }
 
 export function registerSetupQwen(program) {
   program
     .command("setup-qwen")
-    .description(
-      "Configure Qwen Code for OmniRoute: write ~/.qwen/settings.json (openai modelProvider)"
-    )
+    .description("Configure Qwen Code's upstream V4 modelProviders format for OmniRoute")
     .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
-    .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
-    .option("--model <id>", "Model id for Qwen (required unless picked interactively)")
-    .option("--config-path <path>", "settings.json path (default: ~/.qwen/settings.json)")
-    .option("--yes", "Non-interactive: do not prompt (requires --model)")
-    .option("--dry-run", "Print what would be written without touching the filesystem")
+    .option("--remote <url>", "Remote OmniRoute URL")
+    .option("--api-key <key>", "OmniRoute API key")
+    .option("--model <id>", "Model id for Qwen Code")
+    .option("--config-path <path>", "Qwen Code settings.json path")
+    .option("--env-path <path>", "Qwen Code .env path")
+    .option("--yes", "Non-interactive; requires --model")
+    .option("--dry-run", "Print settings without writing files or secrets")
     .action(async (opts) => {
       const code = await runSetupQwenCommand(opts);
-      if (code !== 0) process.exit(code);
+      if (code !== 0) process.exitCode = code;
     });
 }

changelog.d/maintenance/7690-basered-full-suite-realignment.md

@@ -1 +1 @@
-- Realigned 13 test files that had drifted red on the release tip after the 102-PR merge campaign (full-suite sweep): provider counts/goldens/docs regenerated, qwen OAuth + 1M-beta assertions caught up with the live-validated behavior, and two real fixes — legacy `refresh_token` column healed before its index is created, and `shouldSkipCloudSyncInitialization` no longer swaps its `(env, argv)` arguments.
+- Realigned 13 test files that had drifted red on the release tip after the 102-PR merge campaign (full-suite sweep): provider counts/goldens/docs regenerated, 1M-beta assertions caught up with the live-validated behavior, and two real fixes — legacy `refresh_token` column healed before its index is created, and `shouldSkipCloudSyncInitialization` no longer swaps its `(env, argv)` arguments.

changelog.d/maintenance/tokenrefresh-provider-extraction.md

@@ -1 +1 @@
-- **chore(quality):** split `open-sse/services/tokenRefresh.ts` (2249 lines, frozen) into per-provider leaves — `open-sse/services/tokenRefresh/providers/{windsurf,codebuddyCn,cline,kimiCoding,gitlabDuo,claudeOAuth,google,qwen,codex,kiro,qoder,github,copilot}.ts` plus a `tokenRefresh/shared.ts` for the cross-provider OAuth-error classifier and form-body helper — pure move, zero behavior change; the file shrinks to ~989 lines and every previously-public export (`refreshCopilotToken`, `getAccessToken`, `extractOAuthErrorCode`, etc.) is re-exported unchanged so no importer needed to change. Idea originally proposed by @KooshaPari in #7338 against a much older base; redone here against the current tip.
+- **chore(quality):** split `open-sse/services/tokenRefresh.ts` (2249 lines, frozen) into per-provider leaves — `open-sse/services/tokenRefresh/providers/{windsurf,codebuddyCn,cline,kimiCoding,gitlabDuo,claudeOAuth,google,codex,kiro,qoder,github,copilot}.ts` plus a `tokenRefresh/shared.ts` for the cross-provider OAuth-error classifier and form-body helper — pure move, zero behavior change; the file shrinks to ~989 lines and every previously-public export (`refreshCopilotToken`, `getAccessToken`, `extractOAuthErrorCode`, etc.) is re-exported unchanged so no importer needed to change. Idea originally proposed by @KooshaPari in #7338 against a much older base; redone here against the current tip.