fix: preserve charset detection and block CGNAT range in parse-url SSRF fix

Follow-up to the multi-reviewer review of the SSRF fix:

- Restore charset handling lost when switching from extract() to
  response.text(): non-UTF-8 pages (Shift_JIS/GBK/EUC/Big5, common on CJK
  sites this project targets) decoded as mojibake. Now read the body as
  bytes, detect charset from Content-Type / <meta charset>, and decode
  with TextDecoder before extractFromHtml.
- Wrap extractFromHtml in try/catch: it throws (not returns null) on
  empty/non-HTML bodies, which previously surfaced as a 500 instead of the
  intended 400.
- Add 100.64.0.0/10 (RFC 6598 CGNAT) to isPrivateIp; it is routable inside
  some cloud internal networks and was a residual SSRF target.
- Add tests for CGNAT, its boundaries, 0.0.0.0, and DNS-resolved IPv6.

.github/workflows/publish-mcp.yml

@@ -1,67 +0,0 @@
-name: Publish MCP Server
-
-# Publishes @next-ai-drawio/mcp-server to npm via OIDC trusted publishing
-# (no token, no OTP). Triggers when packages/mcp-server changes on main;
-# skips silently if the package.json version is already on npm — so a
-# release is just "bump the version in a PR and merge".
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - "packages/mcp-server/**"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  id-token: write # OIDC token for npm trusted publishing
-
-concurrency:
-  group: publish-mcp
-  cancel-in-progress: false
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: packages/mcp-server
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: "npm"
-          cache-dependency-path: packages/mcp-server/package-lock.json
-          registry-url: "https://registry.npmjs.org"
-
-      # Trusted publishing requires npm >= 11.5.1
-      - name: Update npm
-        run: npm install -g npm@latest
-
-      - name: Check if version is already published
-        id: version
-        run: |
-          LOCAL=$(node -p "require('./package.json').version")
-          if npm view "@next-ai-drawio/mcp-server@${LOCAL}" version >/dev/null 2>&1; then
-            echo "Version ${LOCAL} already on npm - nothing to publish"
-            echo "publish=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "Version ${LOCAL} not on npm - publishing"
-            echo "publish=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Install dependencies
-        if: steps.version.outputs.publish == 'true'
-        run: npm ci
-
-      - name: Test
-        if: steps.version.outputs.publish == 'true'
-        run: npm test
-
-      - name: Publish to npm
-        if: steps.version.outputs.publish == 'true'
-        run: npm publish

app/api/chat/route.ts

@@ -15,6 +15,7 @@ import { z } from "zod"
 import {
     getAIModel,
     SINGLE_SYSTEM_PROVIDERS,
+    supportsImageInput,
     supportsPromptCaching,
 } from "@/lib/ai-providers"
 import { findCachedResponse } from "@/lib/cached-responses"
@@ -265,10 +266,16 @@ async function handleChatRequest(req: Request): Promise<Response> {
         lastUserMessage?.parts?.filter((part: any) => part.type === "file") ||
         []
 
-    // Note: we used to pre-emptively reject images for models we guessed were
-    // text-only (by name matching). That heuristic misfired on newer models
-    // (see issue #874), so we now let the request through and surface the real
-    // provider error if the model genuinely can't accept images.
+    // Check if user is sending images to a model that doesn't support them
+    // AI SDK silently drops unsupported parts, so we need to catch this early
+    if (fileParts.length > 0 && !supportsImageInput(modelId)) {
+        return Response.json(
+            {
+                error: `The model "${modelId}" does not support image input. Please use a vision-capable model (e.g., GPT-4o, Claude, Gemini) or remove the image.`,
+            },
+            { status: 400 },
+        )
+    }
 
     // User input only - XML is now in a separate cached system message
     const formattedUserInput = `User input:

app/api/validate-model/route.ts

@@ -372,13 +372,12 @@ export async function POST(req: Request) {
                 break
             }
 
-            // GLM, Qwen, Kimi, Qiniu, Novita, MiMo - OpenAI compatible
+            // GLM, Qwen, Kimi, Qiniu, Novita - OpenAI compatible
             case "glm":
             case "qwen":
             case "kimi":
             case "qiniu":
-            case "novita":
-            case "mimo": {
+            case "novita": {
                 const baseURL =
                     baseUrl ||
                     PROVIDER_INFO[provider as ProviderName]?.defaultBaseUrl ||

components/provider-credentials-fields.tsx

@@ -249,11 +249,6 @@ export function ProviderCredentialsFields({
                                 {dict.modelConfig.minimaxBaseUrlHint}
                             </p>
                         )}
-                        {provider === "mimo" && (
-                            <p className="text-xs text-muted-foreground">
-                                {dict.modelConfig.mimoBaseUrlHint}
-                            </p>
-                        )}
                     </div>
                 </>
             )}

docs/cn/ai-providers.md

@@ -308,19 +308,6 @@ AI_MODEL=your_model_id
 QINIU_BASE_URL=https://your-custom-endpoint
 ```
 
-### MiMo (小米)
-
-```bash
-MIMO_API_KEY=your_api_key
-AI_MODEL=mimo-v2.5-pro
-```
-
-可选的自定义端点（Token Plan 订阅用户请设置专属 Base URL）：
-
-```bash
-MIMO_BASE_URL=https://token-plan-cn.xiaomimimo.com/v1
-```
-
 ## 自动检测
 
 如果您只配置了**一个**提供商的 API 密钥，系统将自动检测并使用该提供商。无需设置 `AI_PROVIDER`。
@@ -328,7 +315,7 @@ MIMO_BASE_URL=https://token-plan-cn.xiaomimimo.com/v1
 如果您配置了**多个** API 密钥，则必须显式设置 `AI_PROVIDER`：
 
 ```bash
-AI_PROVIDER=google  # 或：openai, anthropic, aihubmix, deepseek, siliconflow, doubao, azure, bedrock, openrouter, ollama, gateway, sglang, modelscope, minimax, glm, qwen, kimi, qiniu, mimo
+AI_PROVIDER=google  # 或：openai, anthropic, aihubmix, deepseek, siliconflow, doubao, azure, bedrock, openrouter, ollama, gateway, sglang, modelscope, minimax, glm, qwen, kimi, qiniu
 ```
 
 ## 服务端多模型配置

docs/en/ai-providers.md

@@ -323,19 +323,6 @@ Optional custom endpoint:
 QINIU_BASE_URL=https://your-custom-endpoint
 ```
 
-### MiMo (Xiaomi)
-
-```bash
-MIMO_API_KEY=your_api_key
-AI_MODEL=mimo-v2.5-pro
-```
-
-Optional custom endpoint (Token Plan subscribers should set their dedicated Base URL):
-
-```bash
-MIMO_BASE_URL=https://token-plan-cn.xiaomimimo.com/v1
-```
-
 ## Auto-Detection
 
 If you only configure **one** provider's API key, the system will automatically detect and use that provider. No need to set `AI_PROVIDER`.
@@ -343,7 +330,7 @@ If you only configure **one** provider's API key, the system will automatically
 If you configure **multiple** API keys, you must explicitly set `AI_PROVIDER`:
 
 ```bash
-AI_PROVIDER=google  # or: openai, anthropic, aihubmix, deepseek, siliconflow, doubao, azure, bedrock, openrouter, ollama, gateway, sglang, modelscope, minimax, glm, qwen, kimi, qiniu, mimo
+AI_PROVIDER=google  # or: openai, anthropic, aihubmix, deepseek, siliconflow, doubao, azure, bedrock, openrouter, ollama, gateway, sglang, modelscope, minimax, glm, qwen, kimi, qiniu
 ```
 
 ## Server-Side Multi-Model Configuration

docs/ja/ai-providers.md

@@ -308,19 +308,6 @@ AI_MODEL=your_model_id
 QINIU_BASE_URL=https://your-custom-endpoint
 ```
 
-### MiMo (Xiaomi)
-
-```bash
-MIMO_API_KEY=your_api_key
-AI_MODEL=mimo-v2.5-pro
-```
-
-オプションのカスタムエンドポイント（Token Plan 加入者は専用の Base URL を設定してください）：
-
-```bash
-MIMO_BASE_URL=https://token-plan-cn.xiaomimimo.com/v1
-```
-
 ## 自動検出
 
 **1つ**のプロバイダーの API キーのみを設定した場合、システムはそのプロバイダーを自動的に検出して使用します。`AI_PROVIDER` を設定する必要はありません。
@@ -328,7 +315,7 @@ MIMO_BASE_URL=https://token-plan-cn.xiaomimimo.com/v1
 **複数**の API キーを設定する場合は、`AI_PROVIDER` を明示的に設定する必要があります:
 
 ```bash
-AI_PROVIDER=google  # または: openai, anthropic, aihubmix, deepseek, siliconflow, doubao, azure, bedrock, openrouter, ollama, gateway, sglang, modelscope, minimax, glm, qwen, kimi, qiniu, mimo
+AI_PROVIDER=google  # または: openai, anthropic, aihubmix, deepseek, siliconflow, doubao, azure, bedrock, openrouter, ollama, gateway, sglang, modelscope, minimax, glm, qwen, kimi, qiniu
 ```
 
 ## サーバーサイドマルチモデル設定

env.example

@@ -189,8 +189,3 @@ AI_MODEL=global.anthropic.claude-sonnet-4-5-20250929-v1:0
 # Get your API key from: https://novita.ai/dashboard/key
 # NOVITA_API_KEY=your_novita_api_key
 # NOVITA_BASE_URL=https://api.novita.ai/openai  # Optional, default
-
-# MiMo (Xiaomi) Configuration (Optional)
-# Get your API key from: https://platform.xiaomimimo.com/
-# MIMO_API_KEY=your_mimo_api_key
-# MIMO_BASE_URL=https://api.xiaomimimo.com/v1  # Optional, default. Token Plan users: https://token-plan-cn.xiaomimimo.com/v1

lib/ai-providers.ts

@@ -32,7 +32,6 @@ export const SINGLE_SYSTEM_PROVIDERS = new Set<ProviderName>([
     "kimi",
     "qiniu",
     "novita",
-    "mimo",
 ])
 
 /**
@@ -117,7 +116,6 @@ const ALLOWED_CLIENT_PROVIDERS: ProviderName[] = [
     "kimi",
     "minimax",
     "novita",
-    "mimo",
 ]
 
 // Bedrock provider options for Anthropic beta features
@@ -542,8 +540,7 @@ function buildProviderOptions(
         case "qwen":
         case "kimi":
         case "qiniu":
-        case "novita":
-        case "mimo": {
+        case "novita": {
             // These providers don't have reasoning configs in AI SDK yet
             // Gateway passes through to underlying providers which handle their own configs
             break
@@ -580,7 +577,6 @@ export const PROVIDER_ENV_VARS: Record<ProviderName, string | null> = {
     kimi: "KIMI_API_KEY",
     minimax: "MINIMAX_API_KEY",
     novita: "NOVITA_API_KEY",
-    mimo: "MIMO_API_KEY",
 }
 
 /**
@@ -1350,23 +1346,6 @@ export function getAIModel(overrides?: ClientOverrides): ModelConfig {
             break
         }
 
-        case "mimo": {
-            const apiKey = resolveApiKey(overrides, "MIMO_API_KEY")
-            const baseURL = resolveBaseURL(
-                overrides?.apiKey,
-                overrides?.baseUrl,
-                resolveBaseUrlEnv(overrides, "MIMO_BASE_URL"),
-                PROVIDER_INFO.mimo?.defaultBaseUrl,
-            )
-            // Use createDeepSeek to properly handle reasoning_content for MiMo
-            // thinking models (e.g., mimo-v2.5-pro). MiMo's API requires
-            // reasoning_content to be passed back during multi-turn tool calls
-            // (returns 400 otherwise), same convention as DeepSeek and Kimi.
-            const mimoProvider = createDeepSeek({ apiKey, baseURL })
-            model = mimoProvider(modelId)
-            break
-        }
-
         case "glm":
         case "qwen":
         case "qiniu":
@@ -1414,7 +1393,7 @@ export function getAIModel(overrides?: ClientOverrides): ModelConfig {
 
         default:
             throw new Error(
-                `Unknown AI provider: ${provider}. Supported providers: bedrock, openai, anthropic, google, azure, ollama, openrouter, aihubmix, deepseek, siliconflow, sglang, gateway, edgeone, doubao, modelscope, glm, qwen, qiniu, kimi, minimax, novita, mimo`,
+                `Unknown AI provider: ${provider}. Supported providers: bedrock, openai, anthropic, google, azure, ollama, openrouter, aihubmix, deepseek, siliconflow, sglang, gateway, edgeone, doubao, modelscope, glm, qwen, qiniu, kimi, minimax, novita`,
             )
     }
 
@@ -1440,14 +1419,77 @@ export function supportsPromptCaching(modelId: string): boolean {
     )
 }
 
+/**
+ * Check if a model supports image/vision input.
+ * Some models silently drop image parts without error (AI SDK warning only).
+ */
+export function supportsImageInput(modelId: string): boolean {
+    const lowerModelId = modelId.toLowerCase()
+
+    // Helper to check if model has vision capability indicator
+    const hasVisionIndicator =
+        lowerModelId.includes("vision") || lowerModelId.includes("vl")
+
+    // Models that DON'T support image/vision input (unless vision variant)
+    // Kimi K2 doesn't support images, but K2.5 does
+    // Only block kimi-k2 specifically, not other Kimi models
+    if (
+        (lowerModelId.includes("kimi-k2") ||
+            lowerModelId.includes("kimi_k2")) &&
+        !hasVisionIndicator &&
+        !lowerModelId.includes("2.5") &&
+        !lowerModelId.includes("k2.5")
+    ) {
+        return false
+    }
+
+    // Moonshot text models (moonshot-v1 series are text-only)
+    if (lowerModelId.includes("moonshot-v1") && !hasVisionIndicator) {
+        return false
+    }
+
+    // MiniMax text models (MiniMax-M2.x series are text-only; M3 supports image input)
+    if (
+        lowerModelId.includes("minimax") &&
+        !hasVisionIndicator &&
+        !lowerModelId.includes("m3")
+    ) {
+        return false
+    }
+
+    // DeepSeek text models (not vision variants)
+    if (lowerModelId.includes("deepseek") && !hasVisionIndicator) {
+        return false
+    }
+
+    // Qwen text models (not vision variants like qwen-vl)
+    // Qwen3.5 series (qwen3.5, qwen3.5-plus, qwen3.5-flash) natively support image input
+    // QvQ (Qwen Visual QA) models are vision models — exclude them even when prefixed with "qwen/"
+    if (
+        lowerModelId.includes("qwen") &&
+        !hasVisionIndicator &&
+        !lowerModelId.includes("qwen3.5") &&
+        !lowerModelId.includes("qvq")
+    ) {
+        return false
+    }
+
+    // GLM text models (not vision variants)
+    // GLM vision models: glm-4v, glm-4v-9b, glm-4.1v-9b-thinking
+    if (lowerModelId.includes("glm") && !hasVisionIndicator) {
+        if (!/[\d.]v/.test(lowerModelId)) {
+            return false
+        }
+    }
+
+    // Default: assume model supports images
+    return true
+}
+
 /**
  * Get the AI model for diagram validation.
  * Uses VALIDATION_MODEL env var if set, otherwise falls back to AI_MODEL.
- *
- * Note: we no longer guess whether the model supports image input from its
- * name — that heuristic misfired on newer models (see issue #874). If a
- * configured validation model can't handle images, the API call simply errors
- * and the validate-diagram route falls back to "valid".
+ * Throws if the model doesn't support image input.
  */
 export function getValidationModel(): ReturnType<typeof getAIModel>["model"] {
     // AI_MODEL may be comma-separated (multi-model fallback); pick the first.
@@ -1460,6 +1502,12 @@ export function getValidationModel(): ReturnType<typeof getAIModel>["model"] {
         )
     }
 
+    if (!supportsImageInput(modelId)) {
+        throw new Error(
+            `Validation requires a vision-capable model. Model "${modelId}" does not support image input.`,
+        )
+    }
+
     const { model } = getAIModel({ modelId })
     return model
 }

lib/i18n/dictionaries/en.json

@@ -34,8 +34,7 @@
         "glm": "GLM",
         "qwen": "Qwen",
         "kimi": "Kimi",
-        "qiniu": "Qiniu",
-        "mimo": "MiMo (Xiaomi)"
+        "qiniu": "Qiniu"
     },
     "chat": {
         "placeholder": "Describe your diagram or upload a file...",
@@ -372,7 +371,6 @@
         "baseUrlWithExample": "Base URL (optional, e.g. {example})",
         "customEndpoint": "Custom endpoint URL",
         "minimaxBaseUrlHint": "Use /anthropic for Anthropic-compatible API (recommended), or /v1 for OpenAI-compatible API",
-        "mimoBaseUrlHint": "Default works with pay-as-you-go keys (sk-...). Token Plan subscribers (tp-... keys) must set https://token-plan-cn.xiaomimimo.com/v1",
         "models": "Models",
         "customModelId": "Custom model ID...",
         "allAdded": "All added",

lib/i18n/dictionaries/ja.json

@@ -34,8 +34,7 @@
         "glm": "GLM",
         "qwen": "Qwen",
         "kimi": "Kimi",
-        "qiniu": "Qiniu",
-        "mimo": "MiMo (Xiaomi)"
+        "qiniu": "Qiniu"
     },
     "chat": {
         "placeholder": "ダイアグラムを説明するか、ファイルをアップロード...",
@@ -326,7 +325,6 @@
         "baseUrlWithExample": "ベース URL（オプション、例: {example}）",
         "customEndpoint": "カスタムエンドポイント URL",
         "minimaxBaseUrlHint": "/anthropic で Anthropic 互換 API（推奨）、または /v1 で OpenAI 互換 API を使用",
-        "mimoBaseUrlHint": "デフォルトは従量課金キー（sk-...）用です。Token Plan 加入者（tp-... キー）は https://token-plan-cn.xiaomimimo.com/v1 を設定してください",
         "models": "モデル",
         "customModelId": "カスタムモデル ID...",
         "allAdded": "すべて追加済み",

lib/i18n/dictionaries/zh-Hant.json

@@ -34,8 +34,7 @@
         "glm": "GLM",
         "qwen": "Qwen",
         "kimi": "Kimi",
-        "qiniu": "Qiniu",
-        "mimo": "MiMo (小米)"
+        "qiniu": "Qiniu"
     },
     "chat": {
         "placeholder": "描述您的圖表或上傳檔案...",
@@ -372,7 +371,6 @@
         "baseUrlWithExample": "基礎 URL（可選，例如 {example}）",
         "customEndpoint": "自訂端點 URL",
         "minimaxBaseUrlHint": "使用 /anthropic 端點為 Anthropic 相容 API（推薦），或使用 /v1 端點為 OpenAI 相容 API",
-        "mimoBaseUrlHint": "預設地址適用於按量付費金鑰（sk-...）。Token Plan 訂閱用戶（tp-... 金鑰）請設定為 https://token-plan-cn.xiaomimimo.com/v1",
         "models": "模型",
         "customModelId": "自訂模型 ID...",
         "allAdded": "已全部新增",

lib/i18n/dictionaries/zh.json

@@ -34,8 +34,7 @@
         "glm": "GLM",
         "qwen": "Qwen",
         "kimi": "Kimi",
-        "qiniu": "Qiniu",
-        "mimo": "MiMo (小米)"
+        "qiniu": "Qiniu"
     },
     "chat": {
         "placeholder": "描述您的图表或上传文件...",
@@ -372,7 +371,6 @@
         "baseUrlWithExample": "基础 URL（可选，例如 {example}）",
         "customEndpoint": "自定义端点 URL",
         "minimaxBaseUrlHint": "使用 /anthropic 端点为 Anthropic 兼容 API（推荐），或使用 /v1 端点为 OpenAI 兼容 API",
-        "mimoBaseUrlHint": "默认地址适用于按量付费密钥（sk-...）。Token Plan 订阅用户（tp-... 密钥）请设置为 https://token-plan-cn.xiaomimimo.com/v1",
         "models": "模型",
         "customModelId": "自定义模型 ID...",
         "allAdded": "已全部添加",

lib/types/model-config.ts

@@ -23,7 +23,6 @@ export type ProviderName =
     | "kimi"
     | "minimax"
     | "novita"
-    | "mimo"
 
 // Individual model configuration
 export interface ModelConfig {
@@ -115,7 +114,6 @@ export const PROVIDER_LOGO_MAP: Record<string, string> = {
     modelscope: "modelscope",
     minimax: "minimax",
     novita: "novita",
-    mimo: "xiaomi",
 }
 
 // Provider metadata
@@ -202,10 +200,6 @@ export const PROVIDER_INFO: Record<
         label: "Novita AI",
         defaultBaseUrl: "https://api.novita.ai/openai",
     },
-    mimo: {
-        label: "MiMo (Xiaomi)",
-        defaultBaseUrl: "https://api.xiaomimimo.com/v1",
-    },
 }
 
 // Suggested models per provider for quick add
@@ -443,7 +437,6 @@ export const SUGGESTED_MODELS: Partial<Record<ProviderName, string[]>> = {
         "moonshotai/kimi-k2.6",
         "deepseek/deepseek-v4-flash",
     ],
-    mimo: ["mimo-v2.5-pro", "mimo-v2.5"],
 }
 
 // Helper to generate UUID

tests/unit/ai-providers.test.ts

@@ -3,6 +3,7 @@ import {
     getAIModel,
     isAihubmixStandardBaseURL,
     resolveBaseURL,
+    supportsImageInput,
     supportsPromptCaching,
 } from "@/lib/ai-providers"
 import { extractAihubmixModelIds } from "@/lib/aihubmix-models"
@@ -182,6 +183,89 @@ describe("supportsPromptCaching", () => {
     })
 })
 
+describe("supportsImageInput", () => {
+    it("returns true for models with vision capability", () => {
+        expect(supportsImageInput("gpt-4-vision")).toBe(true)
+        expect(supportsImageInput("qwen-vl")).toBe(true)
+        expect(supportsImageInput("deepseek-vl")).toBe(true)
+    })
+
+    it("returns false for Kimi K2 models without vision", () => {
+        expect(supportsImageInput("kimi-k2")).toBe(false)
+        expect(supportsImageInput("moonshot/kimi-k2")).toBe(false)
+    })
+
+    it("returns true for Kimi K2.5 models (supports vision)", () => {
+        expect(supportsImageInput("kimi-k2.5")).toBe(true)
+        expect(supportsImageInput("moonshotai/kimi-k2.5")).toBe(true)
+    })
+
+    it("returns false for Moonshot v1 text models", () => {
+        expect(supportsImageInput("moonshot-v1-8k")).toBe(false)
+        expect(supportsImageInput("moonshot-v1-32k")).toBe(false)
+        expect(supportsImageInput("moonshot-v1-128k")).toBe(false)
+    })
+
+    it("returns false for MiniMax M2 text models", () => {
+        expect(supportsImageInput("MiniMax-M2.7")).toBe(false)
+        expect(supportsImageInput("MiniMax-M2.7-highspeed")).toBe(false)
+        expect(supportsImageInput("MiniMax-M2")).toBe(false)
+    })
+
+    it("returns true for MiniMax M3 (supports image input)", () => {
+        expect(supportsImageInput("MiniMax-M3")).toBe(true)
+    })
+
+    it("returns false for DeepSeek text models", () => {
+        expect(supportsImageInput("deepseek-chat")).toBe(false)
+        expect(supportsImageInput("deepseek-coder")).toBe(false)
+    })
+
+    it("returns false for Qwen text models", () => {
+        expect(supportsImageInput("qwen-turbo")).toBe(false)
+        expect(supportsImageInput("qwen-plus")).toBe(false)
+        expect(supportsImageInput("qwen3-max")).toBe(false)
+    })
+
+    it("returns true for Qwen vision models", () => {
+        expect(supportsImageInput("qwen-vl")).toBe(true)
+        expect(supportsImageInput("Qwen3.5")).toBe(true)
+        expect(supportsImageInput("qwen3.5")).toBe(true)
+        expect(supportsImageInput("qwen3.5-plus")).toBe(true)
+        expect(supportsImageInput("qwen3.5-flash")).toBe(true)
+        expect(supportsImageInput("qwen3-vl-plus")).toBe(true)
+        expect(supportsImageInput("qwen3-vl-flash")).toBe(true)
+    })
+
+    it("returns true for QvQ (Qwen Visual QA) models including OpenRouter-prefixed names", () => {
+        expect(supportsImageInput("qvq-72b-preview")).toBe(true)
+        expect(supportsImageInput("qvq-max")).toBe(true)
+        expect(supportsImageInput("qwen/qvq-72b-preview")).toBe(true)
+        expect(supportsImageInput("qwen/qvq-max")).toBe(true)
+    })
+
+    it("returns false for GLM text models", () => {
+        expect(supportsImageInput("glm-4")).toBe(false)
+        expect(supportsImageInput("glm-4-plus")).toBe(false)
+        expect(supportsImageInput("glm-4-flash")).toBe(false)
+        expect(supportsImageInput("glm-4-long")).toBe(false)
+        expect(supportsImageInput("glm-4.7")).toBe(false)
+        expect(supportsImageInput("glm-5")).toBe(false)
+    })
+
+    it("returns true for GLM vision models", () => {
+        expect(supportsImageInput("glm-4v")).toBe(true)
+        expect(supportsImageInput("glm-4v-9b")).toBe(true)
+        expect(supportsImageInput("glm-4.1v-9b-thinking")).toBe(true)
+    })
+
+    it("returns true for Claude and GPT models by default", () => {
+        expect(supportsImageInput("claude-sonnet-4-5")).toBe(true)
+        expect(supportsImageInput("gpt-4o")).toBe(true)
+        expect(supportsImageInput("gemini-pro")).toBe(true)
+    })
+})
+
 vi.mock("ollama-ai-provider-v2", () => {
     const mockModel = { modelId: "test-model" }
     const mockProviderFn = vi.fn(() => mockModel)