QwenLM/qwen-code

Overview

Qwen Code is the Qwen team’s terminal coding agent. It started as a fork of Google’s Gemini CLI, and the lineage is still visible: many files keep the Copyright 2025 Google LLC header, the internal message format is @google/genai’s Content/Part, and LlmClient is still exported under the alias GeminiClient (client.ts). Since the fork it has grown a lot. At the pinned commit (v0.25.0) the pnpm monorepo has about twenty packages: the qwen CLI, the shared core, SDKs for TypeScript, Python and Java, a VS Code companion, a Zed extension, a web shell, a desktop app and a set of chat “channels” (Telegram, DingTalk, Feishu, WeCom, GitHub, GitLab, email and others).

The core is a classic tool-calling loop. The model returns text and function calls. The front end runs the calls through a permission pipeline and sends the results back. Almost every feature sits on top of that loop: around fifty built-in tools, sub-agents and “teams”, cron jobs, goals, auto-memory, skills, hooks, MCP and extensions. Many of these copy Claude Code’s design closely. The hook event names, the skills directory layout, the [Old tool result content cleared] microcompaction placeholder and the 13,000-token autocompact buffer are all documented in comments as matching Claude Code (chatCompressionService.ts).

Its real differentiators are the model layer, which speaks Qwen OAuth, OpenAI Chat Completions, OpenAI Responses, Anthropic and Gemini natively, and a safety stack that combines rule-based permissions, an LLM classifier for “auto” mode and an OS sandbox for shell commands.

Architecture

flowchart LR
  U["User / IDE / SDK / channel"] --> CLI["qwen CLI (llm.tsx main)"]
  CLI --> TUI["Interactive UI"]
  CLI --> NI["runNonInteractive"]
  CLI --> ACP["ACP agent"]
  TUI --> LC["LlmClient.sendMessageStream"]
  NI --> LC
  ACP --> LC
  LC --> CHAT["LlmChat + compression"]
  CHAT --> CG["ContentGenerator (OpenAI / Anthropic / Gemini / Qwen)"]
  LC -->|"ToolCallRequest events"| SCH["Tool scheduler"]
  SCH --> PERM["Permissions + AUTO classifier"]
  PERM --> TOOLS["Built-in tools / MCP / agents"]
  TOOLS --> SBX["Shell sandbox (bwrap / Landlock)"]
  TOOLS -->|"function responses"| LC

Component	Path	Role
CLI entry	packages/cli/index.ts, packages/cli/src/llm.tsx	Parses flags, picks interactive UI, non-interactive run or ACP mode
Non-interactive driver	packages/cli/src/nonInteractiveCli.ts	Headless loop: stream a turn, execute tool calls, feed results back
Agent client	packages/core/src/core/client.ts	LlmClient.sendMessageStream: one model turn plus loop guards, hooks, memory, IDE context
Turn / chat	packages/core/src/core/turn.ts, llm-chat.ts	Streams model output into typed events; owns history and auto-compaction
Content generators	packages/core/src/core/contentGenerator.ts and *ContentGenerator/	Per-protocol adapters behind one ContentGenerator interface
Providers	packages/core/src/providers/	Presets (Alibaba plans, DeepSeek, Grok, MiniMax, Z.ai, Moonshot, OpenRouter, …)
Tools	packages/core/src/tools/	Edit, write, read, grep, glob, shell, web, agent, cron, worktree, MCP bridge
Permissions	packages/core/src/permissions/	Rules, AUTO-mode classifier, destructive-command pre-filter
Sandbox	packages/core/src/sandbox/, packages/cli/src/config/sandboxConfig.ts	bwrap/Landlock for shell commands; Seatbelt/Docker/Podman for the whole CLI
Memory and compaction	packages/core/src/memory/, services/microcompaction/, services/chatCompressionService.ts	Auto-memory, old-output clearing, summarisation
Extensions	packages/core/src/extension/, skills/, hooks/	Installable bundles of MCP servers, skills, agents, hooks, commands

How a request flows

Take a headless run such as qwen -p "fix the failing test":

1. Entry. main() in llm.tsx builds the config and branches. With the ACP flag it imports runAcpAgent, in a TTY it calls startInteractiveUI, and otherwise it calls runNonInteractive (llm.tsx, L1463-L1468, L1650-L1662).
2. Send a turn. runNonInteractive enters a while (true) loop and calls llmClient.sendMessageStream(parts, signal, promptId, { type: sendType, … }) (nonInteractiveCli.ts). The SendMessageType tells the client whether this is a user query, a tool result, a retry, a cron prompt, a teammate message or a goal continuation (client.ts).
3. Guard the turn. sendMessageStream caps recursion at MAX_TURNS = 100 (client.ts), injects IDE context and recalled memories, and streams events from a Turn. On every ToolCallRequest it runs the always-on loop checks (identical consecutive calls, shell stagnation, per-turn call cap) before the optional heuristic LoopDetectionService (client.ts).
4. Execute tools. The client does not run tools itself. It yields ToolCallRequest events, and the front end runs them. Headless mode calls executeToolCall for each request (nonInteractiveCli.ts). The interactive UI does the same through useReactToolScheduler and CoreToolScheduler. Each call goes through permission rules, the approval mode, the AUTO classifier when it applies, and hooks.
5. Edit. For a file change the model calls edit with old_string/new_string. checkPriorRead rejects the edit unless the file was read in this session and has not changed on disk since. applyReplacement then does a literal replacement (edit.ts).
6. Feed back. The function responses become the next message (currentMessages = [{ role: 'user', parts: toolResponseParts }]) and the loop sends again as ToolResult (nonInteractiveCli.ts).
7. Finish or continue. A turn with no tool calls ends the run, but first a checkNextSpeaker side query asks whether the model meant to keep going. If so, the client recurses with a synthetic “Please continue.” (client.ts).

Key components

Model layer

createContentGenerator switches on AuthType and lazily imports one of five adapters: OpenAI chat, OpenAI Responses, Qwen OAuth, Anthropic, or Gemini/Vertex (contentGenerator.ts). Every adapter translates to and from the @google/genai shapes that the rest of the code uses. Thirteen provider presets supply base URLs, env keys and per-model defaults (all-providers.ts). For OpenAI-compatible providers a model can set wireApi: "responses" to switch to the Responses API (modelRegistry.ts). Local servers such as Ollama or vLLM go through the custom OpenAI-compatible provider.

Tool surface

ToolNames lists the built-ins: edit, write_file, read_file, grep_search, glob, run_shell_command, web_fetch/web_search, agent, skill, the plan-mode, cron, task and team tools, worktree tools, notebook_edit, lsp, and tool_search/tool_call for deferred MCP tools (tool-names.ts). Edits are always string replacement or whole-file writes. Nothing lints or runs tests automatically after an edit.

Context management

Three layers keep the window in check. Project instructions come from QWEN.md-style context files and .qwen/rules/. Microcompaction replaces old outputs of read, shell, grep, glob, web and edit tools with [Old tool result content cleared] (microcompact.ts). Full compression runs a side query that produces a <state_snapshot> summary when usage passes a threshold that defaults to 85% of the window (chatCompressionService.ts). Auto-memory under ~/.qwen/memories/ and a per-project root runs background extract, “dream” and recall cycles (paths.ts). There is no embedding index. Code is found with grep, glob and the optional LSP tool.

Safety

Approval modes are plan, default, auto-edit, auto and yolo (approval-mode.ts). In auto, a two-stage LLM classifier decides each risky call. A 32-token fast pass handles the common case, a reasoning pass reviews blocks, and any failure blocks the call (fail-closed) (classifier.ts). A regex layer runs before the classifier and blocks git reset --hard, git clean -f, a non-session --amend and terraform destroy unless the prompt clearly asks for them (destructive-commands.ts). Shell commands can additionally run under bwrap or Landlock with a read-only/workspace-write filesystem policy and an open/closed network policy (sandbox-execution.ts). Separately, the whole CLI can be relaunched under macOS Seatbelt, Docker or Podman (sandboxConfig.ts).

Extending it

• MCP. Stdio, SSE and streamable-HTTP servers, with OAuth. Large tool sets can be deferred behind tool_search/tool_call.
• Extensions. One installable unit (local path, git, GitHub release or npm) can ship MCP servers, LSP servers, context files, commands, skills, sub-agents, workflows, hooks and channel adapters (extensionManager.ts).
• Skills. SKILL.md directories in .qwen/skills/ or ~/.qwen/skills/, plus extension-provided and bundled skills (skills/index.ts). Bundled skills include browser-use, which drives the user’s Chrome through the Qwen Browser SDK (packages/browser-use), and computer-use, which is backed by the vendored Cua driver (packages/cua-driver) (browser-use SKILL.md).
• Hooks. Claude-Code-style events (PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, Stop, SubagentStart, PreCompact, …) (hooks/types.ts).
• Embedding. ACP mode for editors (Zed, the VS Code companion) and the TypeScript, Python and Java SDKs for programs that drive the agent.

Running it

• Install. The workspace root requires Node.js 22 or newer. The CLI publishes a qwen binary (cli package.json).
• Auth. Qwen OAuth, or an API key for any configured provider (OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY, or provider-specific keys), selected through settings.
• Modes. Interactive TUI by default, -p for headless runs, ACP for editors, and a serve daemon for the web and desktop shells.
• Sandbox. Shell sandboxing needs bwrap or Landlock on Linux. Whole-process sandboxing needs sandbox-exec on macOS, or Docker or Podman with the published image.

Strengths and caveats

• Strength: broad, native provider support. Anthropic, Gemini, OpenAI Chat and Responses are first-class adapters, not one OpenAI-compatible shim. That matters for thinking blocks and caching.
• Strength: layered, fail-closed safety. Deterministic rules come first, then the LLM classifier, then an OS sandbox for shell commands. A classifier outage blocks the call instead of allowing it.
• Strength: stale-write protection. Edits and writes are refused unless the file was read in this session and is unchanged on disk, with a recheck after reading to close the race window.
• Caveat: size and churn. client.ts alone is close to 6,000 lines, and features (goals, teams, cron, channels, omni media tools) keep piling onto one loop. Behaviour is hard to predict from the docs alone.
• Caveat: tool execution lives in the front ends. The headless driver and the React scheduler each implement the tool loop. Embedders have to go through the SDK or ACP rather than one core run() function.
• Caveat: Gemini-shaped internals. Every provider is translated through @google/genai types, so non-Gemini features depend on the fidelity of each adapter.
• Caveat: no built-in verification. There is no automatic lint or test step after edits. Checking the work is left to the model’s prompts and to hooks.

Sources: code at ac81c07, deepwiki-open wiki (12 pages), verified Q&A.