Qwen Code 0.18 Preview Fixes the Exact BYOK Failure Mode That Makes Local Agents Feel Flaky

Qwen Code's v0.18.0-preview.1 shipped five commits on June 9, and not one of them is exciting. That is the point. The release fixes three bugs that are collectively a case study in why "bring your own model" is a much harder promise to keep than it sounds: runtime model names corrupting settings.json, background auto-updates breaking lazy-loaded provider chunks, and auth refresh replacing a user-supplied baseUrl with baked-in defaults. If you are running Qwen Code with a local vLLM endpoint, an OpenRouter route, a corporate DashScope gateway, or any non-default inference endpoint, these bugs are not theoretical. They are the difference between a tool you can leave running all day and one that randomly punishes you for using the feature it advertised.

The baseUrl fix in PR #4828 is the most consequential. Before this release, applyResolvedModelDefaults() could replace a user-provided shared endpoint with the model entry's baked-in default during auth refresh. For teams running local or governed inference, the user-provided endpoint is usually not optional. It may be a corporate gateway, a local vLLM box, an OpenRouter route, a DashScope-compatible endpoint, or a policy-enforcing proxy. Replacing that endpoint with a baked-in default after auth refresh is not just a UX bug. It can route traffic to the wrong provider, break audit controls, or — in the worst case — leak prompts outside the intended inference boundary. If your "local" agent is actually sending requests to the default public endpoint because auth refresh silently overwrote your baseUrl, you do not have a local agent. You have a local UI with a remote privacy problem.

The settings.json corruption bug in PR #4734 is the most user-visible of the three. Runtime models were keyed internally as $runtime|${authType}|${modelId}. When that lookup key got persisted as model.name, subsequent restarts would try to resolve a model ID that only made sense inside the runtime's internal map. The result was 404s and model-not-found errors that worsened after each restart, because each restart wrote another corrupted entry. The PR touched 12 files, added 240 lines, and drew 10 review comments. It is a good reminder that internal identifier schemes should stay internal. Once they leak into user-facing configuration files, you own that contract forever.

The auto-update chunk bug in PR #4760 is the kind of failure that makes local tools feel haunted. Qwen Code lazy-loads content generators per auth type through dynamic import(). When a background npm install -g auto-update replaces the chunks/ directory with new content-hash filenames, the old lazy imports still point at the old filenames. Everything works fine until the user switches auth type — say, from API-key to OAuth — at which point the runtime tries to load a chunk that no longer exists and throws ERR_MODULE_NOT_FOUND. This is a race condition between a live runtime and a background installer. The fix adds 258 lines across 6 files and had 8 review comments. Teams adopting Qwen Code should decide explicitly whether auto-update is acceptable in their environment: on developer laptops where the user expects freshness, fine; in CI boxes where reproducibility matters, probably not; in managed enterprise deployments, almost certainly not without a staged rollout policy.

These fixes land inside the larger v0.18 release train, which Qwen Code has been building for some time. That broader context matters. The v0.18 train includes standalone auto-update (not background), installer asset verification, retry and subagent telemetry, a skills picker, multimodal support, ACP background notifications, PR review automation, and — importantly — hardened Auto Mode self-modification checks from PR #4572. That PR was large: 43 commits, 27 changed files, 4,377 additions, and 64 review comments. It hardens Auto Mode so writes to configuration, instructions, hooks, commands, skills, MCP configuration, and other persistence surfaces cannot bypass the classifier via workspace edit fast paths or broad permission allow rules. Qwen's classifier split into allow, soft block, hard block, and environment sections is a sign the maintainers understand what "Auto Mode" actually means in security terms: an agent that can modify its own instructions is an agent that can change its own behavior. That is not always bad, but it must be governed.

The model-provider support in Qwen Code is worth examining closely. The docs describe modelProviders as the mechanism for switching between OpenAI-compatible, Anthropic, Gemini, Qwen OAuth, and local self-hosted endpoints via /model. The supported local options include Ollama (http://localhost:11434/v1), vLLM (http://localhost:8000/v1), and LM Studio (http://localhost:1234/v1) through OpenAI-compatible APIs. The auth docs also note that Qwen OAuth free tier was discontinued on April 15, 2026, and that credentials stored in settings.json are plaintext fallback — shell exports and .env files take precedence. For local-agent deployments, that plaintext fallback is a risk worth addressing explicitly, because settings.json is not a secrets manager.

What the Qwen Code 0.18 preview release actually demonstrates is that local-agent reliability is not a solved problem. Model switching, endpoint fidelity, auth persistence, background updates, and self-modification hardening are all separate engineering problems that happen to share a release note. The fixes are individually small but collectively important: they are the seams where "it works in the happy path" breaks down into "it fails in production." Teams evaluating Qwen Code alongside Claude Code, Codex, Cursor, or any other coding agent should test the failure modes, not just the happy path. Configure a BYOK endpoint, switch between auth types, restart mid-session, trigger a background update while a session is live, and verify that Auto Mode cannot rewrite its own guardrails. If those tests pass, you have a local-agent stack worth trusting. If they fail — or if the agent silently behaves differently in protocol mode — you have a tool that needs more hardening before it goes near production.

The BYOK promise is real, but it comes with obligations. Pin your model-provider config, test /model switching across every configured auth type, verify settings.json contains real model IDs rather than internal lookup keys, and simulate auth refresh while watching baseUrl. Local coding agents win only when model and provider switching is boring, endpoint fidelity is strict, and Auto Mode cannot rewrite the agent's own guardrails. This release is a step in that direction.

Sources: Qwen Code v0.18.0-preview.1, PR #4828, PR #4734, PR #4760, PR #4572, Qwen Code auth documentation