Qwen Code 0.25.2 lets Mods intercept agent tool calls

Qwen Code 0.25.2 gives developers a new place to customize an agent: the moment it calls a tool. The October 15 release expands experimental Mods with tool interception, TypeScript authoring, ordered middleware and selected Claude tool input contracts.

A Mod can inspect a request, rewrite its arguments, refuse it or return a synthetic result. The tagged guide demonstrates a file-writing guard that accepts only text files and a permission hook that denies shell operations. These are application-level customization examples, not a claim that installing a Mod automatically makes an agent secure.

Headless automation is the supported target

Mods are off by default. The documented setup requires a trusted workspace, an enabled Claude-format or native Qwen extension, and experimental.mods: true in Qwen settings. A plugin supplies its manifest, a hooks manifest and a JavaScript or TypeScript registration module. The guide installs its example with qwen extensions install ./hello-mod --consent, then runs a command through qwen -p.

The feature currently applies to headless main sessions. It does not run in the interactive TUI, ACP, managed/SSH, sandbox or session-agent entry points. Child agents and nested code-mode schedulers do not inherit the tool middleware. Agent Plugins v1 packages also continue to ignore hooks.

TypeScript modules can use relative imports and typed, non-secret configuration. The compiler does not type-check the code or load a project’s TypeScript configuration. Mod environments use QuickJS without direct Node, filesystem or network APIs, although an allowed continuation can still invoke a host tool under the host’s permissions.

Permission hooks can tighten, but not grant, access

Qwen’s tool.check merges a Mod’s answer restrictively: it cannot upgrade a native denial or approval requirement into permission to run. Native validation, hooks, approval and invocation guards remain on the execution path.

The fallback behavior also matters. The guide warns that an uncaught hook error can allow the original native request to proceed. A guard should explicitly return a denial when it intends to block. Changing a result after a tool has executed cannot undo the operation, and native errors or cancellation cannot be rewritten into successful execution facts.

For authors adapting existing Claude Mods, an optional Claude input dialect covers selected Bash, Edit and Write fields. Other tools, including Read and custom/MCP tools, bypass that plugin’s Claude tool hooks. Results remain Qwen-native. This is a limited input contract, not full support for every Claude tool, Mod or interface.

Installation and costs

The npm registry confirms version 0.25.2. The documented npm route requires Node.js 22 or newer:

npm install -g @qwen-code/qwen-code@0.25.2

Normal provider authentication is still required at startup, including for the example command that makes no model request itself. The README uses /auth to configure a provider and API key, and documents multiple cloud protocols and compatible local endpoints. Qwen Code is the agent harness; the chosen provider supplies the model. Its Apache-2.0 code license does not include cloud inference charges.

AITrending reviewed the release, pinned English guide and package metadata but has not executed these Mods. The accompanying README screenshot shows an older terminal authentication interface, not the new headless middleware in action.