fix(qwen): update auth guidance for Qwen CLI 0.19.x removal of qwen auth

[mudrii]

Summary

The qwen auth CLI subcommand was removed in Qwen CLI 0.19.x. Installed
qwen --help now reports qwen auth Configure authentication (removed).
Hermes was still telling users to run qwen auth qwen-oauth in five
places — every one of those messages now points users at the supported
replacement (qwen interactively + /auth, or manual editing of
~/.qwen/oauth_creds.json / ~/.qwen/settings.json).

The OAuth token protocol is unchanged: cached tokens at
~/.qwen/oauth_creds.json still work for existing sessions. Only the
setup surface moved.

Why

qwen --help (installed 0.19.11) shows:

qwen auth                  Configure authentication (removed)

…and the upstream docs confirm:

Removed `qwen auth` CLI command
The standalone `qwen auth` CLI command has been removed. Use these
replacements instead:
- Interactive authentication setup → Run `qwen`, then use `/auth`
- Coding Plan setup → Use `/auth`, or set BAILIAN_CODING_PLAN_API_KEY …

Source: https://qwenlm.github.io/qwen-code-docs/en/users/configuration/auth/

Hermes still reads ~/.qwen/oauth_creds.json for the qwen-oauth
provider, so users who already logged in keep working. The fix is only
about not breaking their next re-auth attempt.

Changes

File	Change
hermes_cli/auth.py	Four AuthError messages: qwen_auth_missing, qwen_refresh_token_missing, qwen_refresh_failed, qwen_access_token_missing now mention 0.19.x and point at qwen + /auth (and manual oauth_creds.json editing).
hermes_cli/model_setup_flows.py	_model_flow_qwen_oauth() not-logged-in prompt now prints Run: qwen (then use /auth to re-authenticate) + manual-file hint.
hermes_cli/status.py	hermes status Qwen OAuth row now reads not logged in (run: qwen, then /auth — qwen auth was removed in 0.19.x).
agent/credential_sources.py	_remove_qwen_cli() suppression hints replaced Run hermes auth add qwen-oauth with `Run `qwen` interactively and use `/auth`, or edit `~/.qwen/oauth_creds.json` / `~/.qwen/settings.json.
agent/credential_pool.py	Comment updated to reflect the new setup path.
tests/hermes_cli/test_auth_qwen_provider.py	Two existing tests updated + seven new focused tests pinning the new wording.

Tests

$ python -m pytest tests/hermes_cli/test_auth_qwen_provider.py -v
============================= 39 passed in 1.16s ==============================

New tests (one per affected surface):

• test_missing_credentials_message_points_at_qwen_and_slash_auth — qwen_auth_missing AuthError
• test_refresh_token_missing_message_points_at_qwen_and_slash_auth — qwen_refresh_token_missing AuthError
• test_refresh_failed_message_mentions_removed_subcommand_and_replacement — qwen_refresh_failed AuthError + 4xx body propagation
• test_access_token_missing_message_points_at_qwen_and_slash_auth — qwen_access_token_missing AuthError
• test_model_flow_qwen_oauth_not_logged_in_guidance — _model_flow_qwen_oauth not-logged-in stdout
• test_status_command_qwen_row_uses_slash_auth_guidance — hermes status row literal + source-grep regression guard
• test_qwen_cli_remove_hints_use_supported_replacement — _remove_qwen_cli hints

Each test explicitly asserts both that the new guidance is present
(0.19.x, /auth, Run: qwen) and that the removed guidance
(qwen auth qwen-oauth) is not present — so a future regression
that re-introduces the removed subcommand fails immediately.

Broader sanity (unchanged areas, must stay green):

$ python -m pytest tests/hermes_cli/test_status.py tests/tools/test_credential_files.py tests/agent/test_credential_pool*.py
84 passed in 1.99s

Unrelated PRs left untouched

Per task instructions, I noted these existing open PRs but did not
close or merge them — they're orthogonal to Qwen OAuth guidance:

• fix(gateway): clear stale status for disabled platforms on startup #63101 — fix(gateway): clear stale status for disabled platforms on startup (mergeable)
• fix(doctor): recognize configured MoA orchestration #64203 — fix(doctor): recognize configured MoA orchestration (duplicate of local MoA work, can be closed separately if desired)

Checklist

• No OAuth token protocol changes — only user-facing strings/comments.
• No secrets touched.
• Branch is non-force; pushed to mudrii:fix/qwen-oauth-guidance.
• All new guidance strings also assert absence of the removed qwen auth qwen-oauth literal.
• Local test suite for the touched modules is green.

[Copilot]

Pull request overview

Updates Hermes’ Qwen OAuth user guidance to reflect Qwen CLI 0.19.x removing the qwen auth subcommand, ensuring re-auth instructions point to the supported interactive /auth flow (or manual credential-file edits) across CLI surfaces and credential handling.

Changes:

• Update Qwen OAuth error/help strings and status output to reference qwen + /auth (and relevant ~/.qwen/*.json files) instead of qwen auth qwen-oauth.
• Adjust Qwen OAuth model setup flow messaging to match the new supported re-auth path.
• Expand and update tests to pin the new guidance and prevent regressions to the removed subcommand.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
hermes_cli/auth.py	Updates Qwen OAuth AuthError guidance strings to the new qwen + /auth re-auth flow and manual file-edit options.
hermes_cli/model_setup_flows.py	Updates the qwen-oauth model setup prompt text for “not logged in” to the new guidance.
hermes_cli/status.py	Updates hermes status Qwen OAuth row text to mention qwen + /auth and the 0.19.x removal.
agent/credential_sources.py	Updates suppression/removal hints for qwen-cli sourced credentials to point at the supported replacement auth path.
agent/credential_pool.py	Updates inline comments to reflect the new Qwen CLI authentication workflow.
tests/hermes_cli/test_auth_qwen_provider.py	Updates existing assertions and adds focused tests to pin new wording and ensure removed guidance doesn’t reappear.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alt-glitch]

This was generated by AI during triage.

Related: #46851 implements the separate modern-Qwen settings.json credential fallback. This PR only corrects the removed-command guidance, so both changes can be useful.

[teknium1]

Thanks for tracing the obsolete Qwen CLI command across the user-facing paths. The stale guidance is present on current main, but this needs a correction before salvage.

Problems

• agent/credential_sources.py removes hermes auth add qwen-oauth from the suppression hint. That command is not the removed Qwen subcommand: hermes_cli/auth_commands.py:180-193 clears the provider's suppressed sources, including qwen-cli. The proposed qwen//auth instruction does not clear Hermes suppression, so a removed credential remains disabled.
• The new settings.json guidance is not implemented on main. hermes_cli/auth.py:2303-2316 reads only oauth_creds.json, and resolve_qwen_runtime_credentials() calls that reader at hermes_cli/auth.py:2468. As noted in the existing MEMBER comment, fix(auth): support modern Qwen CLI v0.18+ API-key authentication #46851 is the separate still-open fallback implementation.
• PR commit 19f400c3bc6e6e07d200eab8792ed32098e29a09 adds a source-reading status regression test instead of exercising show_status().

Suggested changes

• Preserve a Hermes-side unsuppression path, and defer settings.json wording until its runtime support lands.
• Test the status command behavior directly.

Automated hermes-sweeper review.

[GottZ]

This was generated by AI during triage.

Summary

Five PRs are associated with this Qwen authentication complex. #7751 and #7782 add User-Agent headers and diagnostics to the legacy OAuth refresh path, #28244 addresses its redirect-driven empty-body failure, #46851 adds modern settings.json credential discovery, and #66872 updates guidance for the removed qwen auth command.

Related pull requests

• fix(auth): add User-Agent header to Qwen OAuth refresh (closes #7746) #7751 [closed] partial — (+62/-1) — n/a: Adds a Hermes User-Agent and invalid-JSON diagnostics, but does not enable redirect following or add modern settings.json routing. Although closed, it remains relevant as a focused legacy-refresh attempt substantially overlapping fix(qwen): add User-Agent to OAuth refresh request #7782 and superseded on the identified redirect cause by fix(qwen-oauth): add follow_redirects=True and diagnostic logging #28244.
• fix(qwen): add User-Agent to OAuth refresh request #7782 [closed] partial — (+49/-3) — n/a: Adds a QwenCode-style User-Agent and diagnostics but leaves redirects disabled and includes unrelated test/tool changes. It remains relevant despite being closed because the contributor explicitly cited that excess scope, and its Qwen portion substantially duplicates fix(auth): add User-Agent header to Qwen OAuth refresh (closes #7746) #7751.
• fix(qwen-oauth): add follow_redirects=True and diagnostic logging #28244 best fix — (+1016/-103) — n/a: The recorded best existing fix for [Bug]: qwen-oauth refresh fails with invalid JSON, while the same ~/.qwen/oauth_creds.json works in qwen-code-api #7746 adds follow_redirects=True, directly addressing the documented 302 empty-body path, plus diagnostics; however, its diff also contains extensive unrelated auth changes and no focused regression test. Consistent with the COMMENTED keep_open contributor review and maintainer-bot verdict, only the Qwen hunk is salvageable after narrowing and test coverage.
• fix(auth): support modern Qwen CLI v0.18+ API-key authentication #46851 best fix — (+230/-12) — n/a: The recorded best existing fix for [Bug]: Hermes appears incompatible with modern Qwen CLI authentication. #46771 uniquely adds settings.json API-key discovery and tests, but force_refresh=True can still invoke OAuth refresh and selectedType=openai credentials remain routed through qwen-oauth with the Portal base URL. Its COMMENTED keep_open contributor review therefore supports retaining the credential-loading work only after correcting refresh suppression and DashScope/OpenAI-compatible routing.
• fix(qwen): update auth guidance for Qwen CLI 0.19.x removal of qwen auth #66872 partial — (+206/-16) — n/a: Updates obsolete qwen auth guidance across six files, but removes the valid hermes auth add qwen-oauth unsuppression path, advertises settings.json before runtime support exists on main, and tests status wording by reading source rather than exercising show_status(). Consistent with the maintainer-bot keep_open verdict, the guidance is salvageable after those three corrections.

Duplicates

#7751 and #7782 are substantially duplicate User-Agent-plus-diagnostics attempts for the legacy refresh failure; #28244 uses the distinct causal redirect fix. #46851 and #66872 overlap in modern-Qwen guidance but are not duplicates because #46851 adds credential loading while #66872 changes user-facing instructions.

Suggested consolidation

Author action: rebase #46851 onto main, or split out the part that can merge, preserving settings.json discovery while routing selectedType=openai/DASHSCOPE_API_KEY through the correct DashScope/OpenAI-compatible path and suppressing OAuth refresh even with force_refresh=True. Keep #66872 open with a salvage path limited to accurate removed-command guidance, restoration of hermes auth add qwen-oauth for unsuppression, deferral of unsupported settings.json claims, and direct show_status() coverage; keep #28244 open separately for #7746 after isolating follow_redirects=True and adding focused tests, while #7751 and #7782 remain closed as overlapping superseded attempts.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I46771(["issue #46771 (open)"])
    P66872["PR #66872 (open)"]
    P66872 -.->|partial| I46771
    class I46771 open
    class P66872 open
    class P66872 target
    click I46771 "https://github.com/NousResearch/hermes-agent/issues/46771"
    click P66872 "https://github.com/NousResearch/hermes-agent/pull/66872"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 5 pull requests and 2 issues in this complex. Each diff was read against this issue; Assessment working set: 62 kB of PR diffs, 20 kB of issue/PR text, 8 kB of discussion (11 comments), 7 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.