Qwen Code is an open-source CLI coding agent from Alibaba's Qwen team, forked from Gemini CLI and co-evolved with the Qwen3-Coder model family. The flagship Qwen3-Coder-480B-A35B achieves SWE-Bench results comparable to Claude Sonnet 4, with 1,000 free requests/day via Qwen OAuth.
Why It's in Assess
Qwen Code is relevant primarily as the official CLI for Qwen3-Coder — Alibaba's open-weight coding model series. The combination of a strong open-weight model and a free-tier CLI makes it worth watching, especially for teams with data residency or cost constraints:
- Qwen3-Coder-480B-A35B: 480B-parameter Mixture-of-Experts (35B active parameters), 256K native context (1M with extrapolation). Benchmarks comparable to Claude Sonnet 4 on agentic coding, browser use, and tool use
- Qwen3-Coder-Next: 80B total / 3B active parameters — achieves 70%+ on SWE-Bench Verified using SWE-Agent scaffold, performance comparable to models with 10–20× more active parameters
- 1,000 free requests/day: Via Qwen OAuth sign-in — unusually generous free tier for a frontier-class model
- Forked from Gemini CLI: Familiar workflow for anyone already using Gemini CLI; customized prompts and function calling for Qwen3-Coder's capabilities
- MCP + LSP + SubAgents: Full MCP support, LSP integration for code-aware context, SubAgents for task delegation
- Sandbox execution: Run commands safely in isolated Docker/Podman containers
- Open-weight model: Qwen3-Coder weights are publicly available — usable on-premise, with Ollama, or on your own inference infrastructure
August 2026: Review and Trust-Boundary Hardening
Qwen Code v0.21.8 is a material operational update rather than a model refresh. It fixes explicitly distrusted workspaces inheriting trust from parent directories, makes forced AutoFix admission fail closed when takeover permissions cannot be verified, prevents daemon sessions from inheriting loader-affecting variables such as NODE_OPTIONS and LD_*, and wraps review transcripts so workflow-like commands found in logged file contents are not executed accidentally. Teams using Qwen Code in CI, daemon, or automated-review lanes should upgrade and re-test workspace-trust and credential boundaries. (v0.21.8)
The same release adds repository context manifests for bounded /review domains, related paths, and recommended tests; restores real-time autofix for fork pull requests by bridging review events into a credentialed workflow lane; lets ACP tool calls run concurrently up to the configured limit; and checkpoints evidence during long-running goals. It also shares compression caches across OpenAI-compatible, Gemini, and Vertex providers. The release reports up to a 93.3% prompt-cache hit rate after moving remote matching into a deterministic CLI subcommand, but that figure is project-reported and should be validated against your own repositories and provider cache semantics. (v0.21.8)
Versions 0.21.9 and 0.21.10 extend the same operational thesis. Qwen Code now confirms read-only Git commands when repository configuration can execute external programs, evaluates trust separately for every project .env, expands the subprocess environment-variable denylist, fences asynchronous attachment work by attachment identity, reaps stalled sandbox containers, and makes Web UI session switching transactional. The releases also add native plugin installation from local paths, archives, Git, URLs, and npm packages; ACP reasoning-effort controls; bounded recovery for ACP restore and AutoFix; and a pause after repeated tool failures. Plugin supply chains and enterprise .env hierarchies remain reasons to keep Qwen Code in Assess rather than treating the new surface as mature by default. (v0.21.9, v0.21.10)
Version 0.21.11 adds Agent Plugins v1 and a native /coordinate workflow whose read-only teammates automatically return results to a leader. ACP sessions move onto the Goal v3 runtime for create, edit, pause, resume, and clear operations; standard OpenTelemetry session lifecycle events, bounded daemon buffers and tool-result previews, cancellation propagation, and earlier resource-ownership validation make those sessions more operable. The release also scopes project memory to the workspace for serve runtimes and makes review output disclose coverage gaps. This is meaningful interoperability and multi-agent progress, but it enlarges the plugin and coordination surface before provenance, signing, and composition-aware controls are mature, so the ring remains Assess. (v0.21.11)
Versions 0.21.12 and 0.21.13 turn automated review and autofix into a more explicit evidence pipeline. Confirmed Critical findings now require an executed witness with observed output; review markers bind certification to an anchor commit, later runs record session IDs and diff hashes, and dedicated platform subcommands replace raw gh commands embedded in review prompts. Cross-worktree model-issued Git mutations and out-of-footprint autofixes fail closed, worktree leases protect active reviews from concurrent cleanup, stopped takeovers escalate to humans, and findings outside the current PR survive in a follow-up queue. Durable conversation forks, bounded ACP pre-attach buffers, and an External Context Provider profile broaden the runtime without resolving plugin-level signature or immutable-source pinning, so Assess remains appropriate. (v0.21.12, v0.21.13)
Version 0.21.14 (published August 19) extends operability and review evidence. It adds a live-session registry and qwen sessions ps command with JSON output for listing running interactive sessions, an /advisor slash command for an independent read-only second opinion that does not mutate history, and workflow agents that can pin a specific working directory via agent({workingDir}) to operate outside default bounds. Review gains a second provider (Aone Code) for GitLab-based repositories, a deterministic flakiness gate that re-runs modified unit tests in the sandboxed verification lane, and review pipeline repairs (incremental anchor logic, multi-call build-and-test dimensions, paginated thread resolution). Autofix failure handoffs now write decisional evidence to failure.md instead of a wrapper file, and privacy-safe diagnostics correlate oversized or mutated tool results using size measurements and HMAC hashes without exposing content. Local Control consolidates into a single daemon-owned implementation with revocable pairing credentials. The review surface continues to grow faster than provenance and signing maturity for plugins themselves, so the ring remains Assess. (v0.21.14)
Version 0.21.15 (published August 20) is a lighter operational pass. The --resume flag now continues interrupted reviews and CI retries when the PR head has not moved, hybrid thinking-capable Qwen models expose a simple Thinking toggle with stable qwen3.8-max selectable via /model, authenticated HTTPS Git extension installs gain configurable credential persistence for private clones, and Web Shell attachments become persistently storable with real-time sidebar synchronization. It also fixes /rewind dropping conversation history and duplicate tool-call IDs causing execution errors. Review continuation for long-running PRs and private-repository onboarding are the meaningful deltas; evidence pipelines continue to outpace plugin dependency provenance, so the ring remains Assess. (v0.21.15)
Version 0.22.0 (published August 22) is the next stable release and expands the Web Shell's operational envelope and review-loop transparency. Web Shell now bounds daemon transcript retention and trims oversized replays to prevent renderer out-of-memory crashes, keeps conversation turns expanded while their background shells run, and routes ordinary messages by session activity rather than Goal status for steadier turn handling. Review loops now explain instability by naming the specific files with recurring findings or non-shrinking comment volumes, Autofix audits the PR approach for simplicity instead of stopping at the first growth-budget breach, and created GitHub PRs are bound to their originating sessions with a searchable list and sidebar badge (latest-first, up to 10 per session). Non-blocking slash commands grow to eleven built-ins (/theme, /tools, and others) that execute during streaming, and review agents get a dedicated subagent type with only six required tools to trim token use. Aone-targeted fixes cover AGit-Flow caching, presubmit self-MR detection, and Round-5 finding write-through; a secure fallback path installs public GitHub extensions on older Git versions by resolving commits via GitHub's anonymous API. The release declares no known breaking changes. Improvement is fastest on the review-and-autofix loop and Web Shell; plugin dependency provenance and signed-extension guarantees remain the unclosed maturity gap, so the ring stays Assess. (v0.22.0)
Version 0.22.2 (published August 26) pivots the runtime toward manageability of background and multi-agent work. A managed background shell pool debuts with a /tasks command, and background agents get their own UI — a pill-status, a combined dialog, and a detail view — wired into the task_stop tool so the model can bound its own background jobs. Model-facing agent control (task_stop, send_message, per-agent transcripts) makes Qwen Code's sub-agents scriptable from the model itself; conversation rewind (double-Esc or /rewind) and LLM-generated summary labels for tool-call batches round out session ergonomics. The release also lands a Python SDK, /skills as a slash command with a secondary picker, OpenRouter auth, API preconnect for lower first-call latency, QWEN_CODE_API_TIMEOUT_MS support across OAuth and non-OAuth paths, DeepSeek V4 context fixed to 1M/384K, and adds Traditional Chinese (zh-TW) and Catalan UI languages. Progress here is on agent-managed concurrency and SDK reach, while plugin dependency provenance and signed-extension guarantees remain the open maturity gap, so the ring stays Assess. (v0.22.2)
Version 0.22.3 (published August 28; no known breaking changes) is a smaller feature pass. Channels gain owner-scoped named sessions managing up to eight persistent tasks per chat; the /review pipeline gains successor-chain warnings when a subsystem's Critical findings re-grow across rounds, per-project --effort recall, ten-minute progress status comments on long runs, an optional fixConstraint on findings, and an ab-drive subcommand for execution-grade verification against PR and base trees; and a daemon session API (create, list, resume, archive, delete) plus an opt-in Web Shell composer menu and interactive browser PTY land as well. Daemon extension installs now accept absolute local paths while rejecting relative ones, [FILE:] output markers are safely projected, and a Mem0 retrieval-only extension skeleton debuts. Plugin dependency provenance and signed-extension guarantees remain the open maturity gap, so the ring stays Assess. (v0.22.3)
When to Consider
- You want a strong coding model without Anthropic/OpenAI lock-in
- Data residency requirements prevent sending code to US-based providers
- Cost sensitivity — 1K free requests/day and cheap inference via Alibaba Cloud
- You already use Qwen models and want the CLI that's co-optimized for them
Key Characteristics
| Property | Value |
|---|---|
| Interface | CLI, VS Code/Zed/JetBrains integration |
| License | Open source (Apache-2.0) |
| Underlying model | Qwen3-Coder series (open-weight) |
| Sandbox | Docker/Podman containers |
| Free tier | 1,000 requests/day via Qwen OAuth |
| Pricing | Free (OAuth) / API key (Alibaba Cloud ModelStudio) |
| Provider | Alibaba / Qwen team |
| Website | qwen.ai/qwencode |
| GitHub | QwenLM/qwen-code |