feat(qwen): add ZERO-294 Qwen Code adapter

[spencercharest]

Summary

Subtask: ZERO-299 (Qwen Code adapter — Gemini-style extension with Claude-style hooks)

Adds a native Qwen Code extension overlay for Zero:

• plugins/zero-qwen/qwen-extension.json with Zero remote MCP, extension skill, /zero command, and Qwen SessionStart / UserPromptSubmit / PreToolUse hooks
• plugins/zero-qwen/commands/zero.md slash command
• scripts/build-qwen.sh to assemble dist/zero-qwen/ from the Qwen overlay plus the shared Zero skill and hooks
• scripts/build-gemini.sh now builds one combined release archive with both gemini-extension.json and qwen-extension.json at the root, so the existing single GitHub Release asset can serve both Gemini CLI and Qwen Code
• release workflow notes/paths updated for the combined Gemini/Qwen archive
• Qwen standalone guide plus README link
• version bump 1.3.3 -> 1.4.0 across versioned plugin manifests via make minor

This PR intentionally does not modify guides/agent-install.md. Proposed runbook notes are documented below for the later agent-install rework.

Official sources used

• Qwen Code extension overview: https://qwenlm.github.io/qwen-code-docs/en/users/extension/introduction/
• Qwen Code extension release/archive rules: https://qwenlm.github.io/qwen-code-docs/en/users/extension/extension-releasing/
• Qwen Code hooks: https://qwenlm.github.io/qwen-code-docs/en/users/features/hooks/
• Qwen Code skills: https://qwenlm.github.io/qwen-code-docs/en/users/features/skills/
• Qwen Code MCP: https://qwenlm.github.io/qwen-code-docs/en/users/features/mcp/
• Qwen Code commands: https://qwenlm.github.io/qwen-code-docs/en/users/features/commands/
• Current npm package inspected: @qwen-code/qwen-code@0.18.0

Install and update surfaces

Terminal install after this ships through the latest release asset:

qwen extensions install https://github.com/officialzeroxyz/zero-plugins
qwen extensions update zero

Local development/install path verified in Docker:

scripts/build-qwen.sh
qwen extensions install dist/zero-qwen

The release archive path verified in Docker:

scripts/build-gemini.sh
qwen extensions install dist/zero-gemini

Proposed guides/agent-install.md notes

Do not apply in this PR. Suggested section for the later runbook rework:

### Qwen Code

1. **Install the Zero extension** from its GitHub repository:

   ```bash
   qwen extensions install https://github.com/officialzeroxyz/zero-plugins

2. Find the installed extension root. It lives under ~/.qwen/extensions/
   unless Qwen Code is configured with a different home directory. You have the
   right directory when it contains skills/zero/SKILL.md. Continue with
   Step 2 below.

## Docker verification

Environment:

- Docker image: `node:22-bookworm`
- Qwen Code package: `@qwen-code/qwen-code@0.18.0`
- OpenAI BYOK loaded with `--env-file ~/zeroclick/env` for headless Qwen checks
- Mounted branch worktree at `/repo`
- Host `~/.zero` was checked on the host and still returned `Authentication required`; full paid E2E was not possible from this environment

Local Qwen artifact install/load:

```bash
scripts/build-qwen.sh
printf "y\n" | qwen extensions install /repo/dist/zero-qwen
qwen extensions list

Result:

• Extension zero installed successfully at version 1.4.0
• Qwen listed /zero, the zero skill, and the zero remote MCP server
• Installed files included qwen-extension.json, commands/zero.md, skills/zero/SKILL.md, and all three hook scripts

Combined release artifact install/load:

scripts/build-gemini.sh
printf "y\n" | qwen extensions install /repo/dist/zero-gemini
qwen extensions list

Result:

• Qwen installed the combined artifact successfully
• Qwen listed /zero, the zero skill, and the zero remote MCP server
• Tarball root contains both gemini-extension.json and qwen-extension.json, plus shared skills/ and hooks/

Hook checks from the installed Qwen extension root:

ZERO_CLI_SPEC=1.1.0 bash "$ROOT/hooks/ensure-runner.sh"
"$HOME/.zero/runtime/bin/zero" --version
printf '{"prompt":"hello"}' | bash "$ROOT/hooks/zero-context.sh"
printf '{"hookEventName":"PreToolUse","tool_name":"Bash","tool_input":{"command":"zero search weather"}}' | bash "$ROOT/hooks/auto-approve-zero.sh"
printf '{"hookEventName":"PreToolUse","tool_name":"Bash","tool_input":{"command":"zero fetch https://example.com"}}' | bash "$ROOT/hooks/auto-approve-zero.sh"

Results:

• SessionStart hook provisioned @zeroxyz/cli@1.1.0
• UserPromptSubmit emitted Qwen-compatible hookSpecificOutput.additionalContext
• PreToolUse allowed read-only zero search
• PreToolUse stayed silent for paid zero fetch

Qwen startup/debug check:

QWEN_CODE_DEBUG=1 QWEN_CODE_SUPPRESS_YOLO_WARNING=1 \
  qwen --approval-mode yolo --max-wall-time 20 --output-format text \
  --prompt "Reply with only QWEN_ZERO_SMOKE."

Debug result:

• [HOOK_REGISTRY] Hook registry initialized with 3 hook entries
• prepare-zero-runner ran successfully for SessionStart
• zero-context ran successfully for UserPromptSubmit
• Zero MCP discovery failed with {"error":"invalid_token"} because the Zero account/profile was not authenticated in this environment

Local checks

make version
bash -n scripts/build-gemini.sh scripts/build-qwen.sh plugins/zero/hooks/*.sh
scripts/build-gemini.sh --tar /tmp/zero-combined-final.tgz
scripts/build-qwen.sh --tar /tmp/zero-qwen-final.tgz
jq -e . plugins/zero-qwen/qwen-extension.json dist/zero-gemini/qwen-extension.json dist/zero-qwen/qwen-extension.json
git diff --check

Results:

• versioned manifests all at 1.4.0
• shell syntax passed
• Qwen/Gemini build scripts passed
• JSON manifests passed
• whitespace check passed

Claude-style plugin compatibility and simpler install option

Full Claude Code plugin package support: No. Qwen Code follows the Gemini-style extension model with Qwen-specific config paths and hook names. It does not install Claude Code .claude-plugin packages directly.

What this means for users:

• End users should not run build scripts. The consumer path should be a prebuilt Qwen extension artifact or source install from the Zero plugins repo once published.

• The intended simple install flow should look like a Qwen extension install/update, not a local build/copy flow, for example:

  qwen extension install officialzeroxyz/zero-plugins/zero-qwen
  qwen extension update zero

  Verify the final command against the current Qwen extension CLI before marking the PR ready.

• If the custom extension is too much maintenance, the alternative is to ship only Qwen-native skill/MCP/command snippets. That is simpler, but it gives up Claude-style plugin reuse because Qwen does not read .claude-plugin packages.

GitHub Releases / no-build install check

Result: Yes, Qwen Code explicitly supports GitHub Releases with custom prebuilt archives. Source: Qwen's extension releasing docs say GitHub Releases can be used for faster installs, custom archives may be attached as assets, and custom archives are useful for larger repositories where the installable extension has a different layout from the repo.

Best no-build consumer path should mirror Gemini:

qwen extensions install https://github.com/officialzeroxyz/zero-plugins --auto-update
# or, if using GitHub shorthand:
qwen extensions install officialzeroxyz/zero-plugins --auto-update

Release workflow target: add a Qwen release job analogous to .github/workflows/release-gemini.yml that runs scripts/build-qwen.sh --tar zero-qwen.tar.gz and publishes a self-contained archive with qwen-extension.json at the archive root. Before shipping from the monorepo's shared latest release, verify Qwen's asset-selection behavior if multiple adapter assets exist on the same release; otherwise use a dedicated release tag/channel or dedicated distribution repo.

PR status

Draft. Native Qwen install/load and hooks are verified in Docker, including the combined release artifact. Full Qwen-driven Zero E2E is blocked because Zero auth/MCP is not connected in this environment (zero auth whoami --json returns Authentication required; Qwen MCP discovery returns invalid_token). Move to ready after testing with an authenticated Zero profile and confirming the latest GitHub release install path after merge.

[spencercharest]

Folded into #63 as a matrix entry (qwen-code in plugins/zero/agents.json) — the one new plugin-installable host: qwen extensions install https://github.com/officialzeroxyz/zero-plugins:zero --auto-update --consent was verified live (non-interactive, scratch $HOME; the :zero marketplace form skips the plugin picker, --consent skips the consent prompt). Also carries a full Claude-compatible hooks fragment (ms timeouts) into ~/.qwen/settings.json. Excluded from the update sweep per the Gemini consent precedent — freshness comes from --auto-update. The adapter-template work here stays available on this branch if we later ship per-host templates.