Skip to main content
The @premai/api-sdk package contains confidential-qwen. This launcher starts the Confidential Proxy in Anthropic mode. Then it runs the installed Qwen Code CLI against the proxy.
The local proxy encrypts supported model traffic before network egress. Qwen Code, repository files, shell commands, MCP servers, and tool results remain on your machine or in their own external systems.
Use confidential-qwen to connect Qwen Code through the local Confidential Proxy. Go to the confidential setup.

​
How the launcher works

The launcher does these steps on every run:
  1. Requires an interactive terminal (TTY).
  2. Reads the endpoint, key, and KEK configuration.
  3. Starts or reuses the proxy in Anthropic mode with attestation enabled.
  4. Displays the list of your enabled models.
  5. Prepares an isolated Qwen home and chooses the anthropic authentication type.
  6. Sets the Qwen Code Anthropic base URL and the model environment variables.
  7. Sends every remaining argument to the installed qwen command.
Qwen Code connects to Prem through its Anthropic provider. It does not use Qwen OAuth or a DashScope key. The launcher passes --auth-type anthropic and removes all OAuth, OpenAI, Gemini, and Google credentials from the child environment.

​
Before you start

You need:
  • Qwen Code installed and available as qwen on PATH.
  • A Prem API key.
  • A 32-byte KEK encoded as 64 hexadecimal characters.
  • A terminal with interactive input.
  • @premai/api-sdk.
Check the installed Qwen Code version:
confidential-qwen is present in @premai/api-sdk@1.0.61 and later. The docs use @premai/api-sdk@1.0.64. Confirm the binary with npx -p @premai/api-sdk confidential-qwen --help.

​
1. Set the launcher values

Generate the KEK once if you do not have one:
confidential-qwen reads API_KEY, not PREM_API_KEY. Supply it through the environment. This also prevents the launcher from prompting for the API key and saving it in the application-data .env file. The launcher still saves the selected model ID there.
confidential-qwen uses its own application-data directory. The directory is separate from the one that confidential-claude uses. Configure each launcher once.

​
2. Run the first request

Use --prompt for a bounded first test:
Choose an enabled model in the picker. Use the arrow keys or j and k. Then press Enter.
--prompt still needs a TTY. The launcher always shows the model list before it starts Qwen Code.

​
3. Start an interactive session

Qwen Code uses the Anthropic-compatible Messages route. It receives Server-Sent Events while it works.

​
Arguments the launcher owns

The launcher sets the model and the authentication type itself. It removes these flags from the arguments that you pass. It removes both the --flag value and --flag=value forms: The launcher sends every other argument to qwen without changes. Choose a different model by restarting the launcher and selecting it in the picker.

​
Model selection

The picker calls the model-list endpoint on every run. This guide documents these chat models: The Anthropic adapter returns the requested alias in the message model field. It does not show the backend-resolved model ID or an assurance profile. Do not infer an assurance class from the picker label. See Platform Status.
A Qwen picker label names a Prem catalogue model. It does not show that Qwen Code connects to an Alibaba-hosted Qwen endpoint.

​
Isolated Qwen home

The launcher does not write Prem credentials into ~/.qwen/settings.json. It builds a private QWEN_HOME under its application-data directory for the session:
  • The launcher links your existing ~/.qwen entries into the private home. Extensions, commands, and history remain available.
  • The launcher copies settings.json. Then the copy sets the anthropic authentication type.
  • The launcher merges your settings changes back into ~/.qwen/settings.json when Qwen Code exits. It restores your original authentication and model keys. It removes the local endpoint and the API key from anything it writes back.
  • The launcher removes the private home on exit. A later run also removes directories that a previous run leaves behind after a crash.
The launcher prints a warning if it cannot parse ~/.qwen/settings.json. It leaves the file unchanged. It does not sync anything back.
Set QWEN_HOME before you start the launcher. The launcher reads that location as your real Qwen home. It still isolates the session from it.

​
Environment the launcher sets

The launcher removes ANTHROPIC_AUTH_TOKEN, QWEN_OAUTH, QWEN_MODEL, and the OPENAI_, GEMINI_, and GOOGLE_ credential and model variables from the child environment. A stale credential cannot redirect traffic away from the proxy.

​
Stop the local proxy

The launcher starts a detached proxy. The proxy continues to run when Qwen Code exits. Stop it explicitly when you finish:
Check the status before another run when the default proxy port appears occupied:
confidential-claude and confidential-qwen share one proxy in Anthropic mode. You do not need a second proxy to run both at the same time. One confidential-proxy stop ends the session for both.

​
Plaintext and tool boundary

Review Qwen Code permissions, MCP servers, extensions, and egress separately. A confidential model route does not protect local tool execution.

​
Troubleshooting

Run the command directly in an interactive terminal. Piping input or starting it from a non-interactive CI process does not supply the interactive terminal that model selection needs.
Install Qwen Code and confirm that qwen --version succeeds in the same shell. See the Qwen Code documentation.
Check API_KEY, PROXY_URL, ENCLAVE_URL, network access, and proxy logs. Make sure that the key can list models.
The launcher needs an Anthropic Messages route. It refuses to use a proxy that cannot serve one. Run confidential-proxy stop. Then start the launcher again. Pre-start the proxy with confidential-proxy start --compat anthropic or --compat both.
Run confidential-proxy status. Then stop the managed proxy. The launcher refuses to take over an unknown process on that port.
A stale credential or authentication setting overrides the Anthropic provider. Confirm that you did not pass --auth-type. Check ~/.qwen/settings.json for a pinned authentication type.
The launcher still runs. But it does not sync settings back. Repair the JSON. Then start it again.
Do not add --no-attest to work around the failure. Capture the error. Verify the current Reticle boundary in Attestation.

​
Frequently asked questions

​
Does confidential-qwen install Qwen Code?

No. It checks for an existing qwen command. It exits if Qwen Code is not installed.

​
Does it use my Qwen or DashScope credentials?

No. API_KEY is the Prem API key. The launcher clears all Qwen OAuth, OpenAI, Gemini, and Google variables. It passes the Prem key to Qwen Code as the Anthropic provider token.

​
Does it change my Qwen Code configuration?

It runs the session against a private home. It merges your settings changes back into ~/.qwen/settings.json on exit. It does not write the local endpoint or the API key. Your original authentication and model keys are restored.

​
Can I pass normal Qwen Code arguments?

Yes, except --model, -m, and --auth-type. The launcher sets those values and removes them.

​
Can I run it beside confidential-claude?

Yes. Both use Anthropic mode and share one proxy.

​
Is the full coding session inside an enclave?

No. Only supported inference traffic uses the encrypted Prem path. Files and tools remain in their own local or external trust boundaries.

Claude Code

Review the sibling launcher that shares the same proxy mode.

Anthropic-compatible clients

Review the Messages translation and compatibility limits.

Confidential Proxy

Review proxy modes, routes, keys, and daemon controls.

Security Model

Review the protected and unprotected parts of the data flow.