fix(runtime): keep HERMES_QWEN_BASE_URL for a supplied Qwen OAuth token

The explicit qwen-oauth builder fell back to DEFAULT_QWEN_BASE_URL when
a token came without a URL, so a profile's HERMES_QWEN_BASE_URL proxy
was dropped. The URL now comes from the explicit URL, then the same
_qwen_base_url() helper the Qwen CLI resolver uses, then the default.

Refs #143547

hermes_cli/auth.py

@@ -84,7 +84,7 @@ from hermes_cli.auth_codex import (
 from hermes_cli.auth_openrouter import _openrouter_pkce_login
 from hermes_cli.guest_handoff import note_store_write
 from hermes_cli.auth_qwen import (
-    _qwen_access_token_is_expiring, _qwen_cli_auth_path, _read_qwen_cli_tokens,
+    _qwen_access_token_is_expiring, _qwen_base_url, _qwen_cli_auth_path, _read_qwen_cli_tokens,
     _refresh_qwen_cli_tokens, _save_qwen_cli_tokens, get_qwen_auth_status,
     resolve_qwen_runtime_credentials)
 from hermes_cli.auth_constants import (

hermes_cli/auth_qwen.py

@@ -111,6 +111,10 @@ def _mark_qwen_oauth_active(creds: dict[str, Any]) -> None:
         _save_auth_store(auth_store)
 
 
+def _qwen_base_url() -> str:
+    return os.getenv("HERMES_QWEN_BASE_URL", "").strip().rstrip("/") or DEFAULT_QWEN_BASE_URL
+
+
 def resolve_qwen_runtime_credentials(
     *, force_refresh: bool = False, refresh_if_expiring: bool = True,
     refresh_skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,
@@ -128,7 +132,7 @@ def resolve_qwen_runtime_credentials(
 
     return {
         "provider": "qwen-oauth",
-        "base_url": os.getenv("HERMES_QWEN_BASE_URL", "").strip().rstrip("/") or DEFAULT_QWEN_BASE_URL,
+        "base_url": _qwen_base_url(),
         "api_key": access_token, "source": "qwen-cli", "expires_at_ms": tokens.get("expiry_date"),
         "auth_file": str(_qwen_cli_auth_path()),
     }

hermes_cli/runtime_provider.py

@@ -25,7 +25,7 @@ from agent.credential_pool import (  # custom_provider_pool_key_candidates is re
 from agent.secret_scope import get_secret_str
 from hermes_cli.auth import (  # resolve_external_process_provider_credentials is read via origin by runtime_provider_backends
     ACTUAL_LOCAL_NOAUTH_PLACEHOLDER, AuthError, DEFAULT_CODEX_BASE_URL, DEFAULT_QWEN_BASE_URL, DEFAULT_XAI_OAUTH_BASE_URL,
-    PROVIDER_REGISTRY, _agent_key_is_usable, _nous_inference_env_override, format_auth_error, resolve_provider,
+    PROVIDER_REGISTRY, _agent_key_is_usable, _nous_inference_env_override, _qwen_base_url, format_auth_error, resolve_provider,
     resolve_nous_runtime_credentials, resolve_codex_runtime_credentials, resolve_xai_oauth_runtime_credentials,
     resolve_qwen_runtime_credentials, resolve_api_key_provider_credentials,
     resolve_external_process_provider_credentials,
@@ -740,7 +740,7 @@ def _explicit_codex(requested_provider, model_cfg, api_key, explicit_base_url, t
 
 def _explicit_qwen(requested_provider, model_cfg, api_key, explicit_base_url, target_model):
     # A supplied token is the credential: the Qwen CLI login is read only when none was given.
-    api_key, base_url, expires_at_ms = _creds_fallback(api_key, explicit_base_url, explicit_base_url or DEFAULT_QWEN_BASE_URL,
+    api_key, base_url, expires_at_ms = _creds_fallback(api_key, explicit_base_url, explicit_base_url or _qwen_base_url(),
                                                        None, "expires_at_ms", resolve_qwen_runtime_credentials)
     return _runtime("qwen-oauth", "chat_completions", base_url, api_key, source="explicit", expires_at_ms=expires_at_ms,
                     requested_provider=requested_provider)

tests/hermes_cli/test_runtime_provider_qwen.py

@@ -0,0 +1,11 @@
+from hermes_cli import runtime_provider as rp
+
+
+def test_qwen_oauth_supplied_token_keeps_the_base_url_override(monkeypatch):
+    """A supplied token replaces the Qwen CLI login, not the HERMES_QWEN_BASE_URL endpoint."""
+    monkeypatch.setattr(rp, "_get_model_config", dict)
+    monkeypatch.setenv("HERMES_QWEN_BASE_URL", "https://qwen-proxy.example.test/v1/")
+
+    resolved = rp.resolve_runtime_provider(requested="qwen-oauth", explicit_api_key="fake-qwen-token")
+
+    assert (resolved["api_key"], resolved["base_url"]) == ("fake-qwen-token", "https://qwen-proxy.example.test/v1")