> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prem.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Qwen Code

> Launch Qwen Code through Prem's Confidential Proxy with the bundled confidential-qwen wrapper.

The `@premai/api-sdk` package contains `confidential-qwen`. This launcher starts the Confidential Proxy in Anthropic mode. Then it runs the installed Qwen Code CLI against the proxy.

<Warning>
  The local proxy encrypts supported model traffic before network egress. Qwen Code, repository files, shell commands, MCP servers, and tool results remain on your machine or in their own external systems.
</Warning>

<Tabs>
  <Tab title="Confidential API">
    Use `confidential-qwen` to connect Qwen Code through the local Confidential Proxy. [Go to the confidential setup](#before-you-start).
  </Tab>

  <Tab title="ZDR">
    ZDR is not available for `confidential-qwen`. The launcher drives Qwen Code over the Anthropic Messages API. ZDR supports only OpenAI-compatible Chat Completions. Use [OpenCode](/guides/opencode), [OpenClaw](/guides/openclaw), [Hermes Agent](/guides/hermes), or [Goose](/guides/goose) for a ZDR coding workflow.
  </Tab>
</Tabs>

## How the launcher works

```mermaid theme={"system"}
flowchart TB
    subgraph Local["Your machine: plaintext is available"]
        C["Qwen Code"] -->|"Anthropic Messages API"| P["Confidential Proxy<br/>127.0.0.1:8787"]
        T["Local tools and MCP servers"] <--> C
    end

    P -->|"Encrypt before network egress"| G["Prem API Gateway<br/>ciphertext and metadata"]
    G -->|"Encrypted request"| E["Prem confidential runtime<br/>decrypt, infer, encrypt"]
    E -.->|"Encrypted response"| P
    P -.->|"Anthropic SSE or message"| C
```

The launcher does these steps on every run:

1. Requires an interactive terminal (TTY).
2. Reads the endpoint, key, and KEK configuration.
3. Starts or reuses the proxy in Anthropic mode with attestation enabled.
4. Displays the list of your enabled models.
5. Prepares an isolated Qwen home and chooses the `anthropic` authentication type.
6. Sets the Qwen Code Anthropic base URL and the model environment variables.
7. Sends every remaining argument to the installed `qwen` command.

<Note>
  Qwen Code connects to Prem through its Anthropic provider. It does not use Qwen OAuth or a DashScope key. The launcher passes `--auth-type anthropic` and removes all OAuth, OpenAI, Gemini, and Google credentials from the child environment.
</Note>

## Before you start

You need:

* Qwen Code installed and available as `qwen` on `PATH`.
* A Prem API key.
* A 32-byte KEK encoded as 64 hexadecimal characters.
* A terminal with interactive input.
* `@premai/api-sdk`.

Check the installed Qwen Code version:

```bash theme={"system"}
qwen --version
```

<Warning>
  `confidential-qwen` is present in `@premai/api-sdk@1.0.61` and later. The docs use `@premai/api-sdk@1.0.64`. Confirm the binary with `npx -p @premai/api-sdk confidential-qwen --help`.
</Warning>

## 1. Set the launcher values

```bash theme={"system"}
export API_KEY="your-prem-api-key"
export CLIENT_KEK="your-64-character-hex-kek"
export PROXY_URL="https://gateway.prem.io"
export ENCLAVE_URL="https://conf-engine.prem.io"
```

Generate the KEK once if you do not have one:

```bash theme={"system"}
openssl rand -hex 32
```

`confidential-qwen` reads `API_KEY`, not `PREM_API_KEY`. Supply it through the environment. This also prevents the launcher from prompting for the API key and saving it in the application-data `.env` file. The launcher still saves the selected model ID there.

<Note>
  `confidential-qwen` uses its own application-data directory. The directory is separate from the one that `confidential-claude` uses. Configure each launcher once.
</Note>

## 2. Run the first request

Use `--prompt` for a bounded first test:

```bash theme={"system"}
npx -p @premai/api-sdk confidential-qwen \
  --prompt "Reply with exactly OK. Do not use tools."
```

Choose an enabled model in the picker. Use the arrow keys or `j` and `k`. Then press Enter.

<Note>
  `--prompt` still needs a TTY. The launcher always shows the model list before it starts Qwen Code.
</Note>

## 3. Start an interactive session

```bash theme={"system"}
npx -p @premai/api-sdk confidential-qwen
```

Qwen Code uses the Anthropic-compatible Messages route. It receives Server-Sent Events while it works.

## Arguments the launcher owns

The launcher sets the model and the authentication type itself. It removes these flags from the arguments that you pass. It removes both the `--flag value` and `--flag=value` forms:

| Flag          | Reason                            |
| ------------- | --------------------------------- |
| `--model`     | The picker sets the model         |
| `-m`          | Short form of `--model`           |
| `--auth-type` | The launcher requires `anthropic` |

The launcher sends every other argument to `qwen` without changes. Choose a different model by restarting the launcher and selecting it in the picker.

## Model selection

The picker calls the model-list endpoint on every run. This guide documents these chat models:

| Picker ID           | Display name                    | Current catalogue behavior                                                          |
| ------------------- | ------------------------------- | ----------------------------------------------------------------------------------- |
| `qwen38-27b`        | Qwen 3.8                        | Text, image, and video input metadata                                               |
| `deepseek-v4-flash` | DeepSeek v4 Flash (Abliterated) | Text chat alias that resolves to `prem-research/DeepSeek-V4-Flash-0731-abliterated` |

The Anthropic adapter returns the requested alias in the message `model` field. It does not show the backend-resolved model ID or an assurance profile. Do not infer an assurance class from the picker label. See [Platform Status](/platform-status).

<Note>
  A Qwen picker label names a Prem catalogue model. It does not show that Qwen Code connects to an Alibaba-hosted Qwen endpoint.
</Note>

## Isolated Qwen home

The launcher does not write Prem credentials into `~/.qwen/settings.json`. It builds a private `QWEN_HOME` under its application-data directory for the session:

* The launcher links your existing `~/.qwen` entries into the private home. Extensions, commands, and history remain available.
* The launcher copies `settings.json`. Then the copy sets the `anthropic` authentication type.
* The launcher merges your settings changes back into `~/.qwen/settings.json` when Qwen Code exits. It restores your original authentication and model keys. It removes the local endpoint and the API key from anything it writes back.
* The launcher removes the private home on exit. A later run also removes directories that a previous run leaves behind after a crash.

The launcher prints a warning if it cannot parse `~/.qwen/settings.json`. It leaves the file unchanged. It does not sync anything back.

<Note>
  Set `QWEN_HOME` before you start the launcher. The launcher reads that location as your real Qwen home. It still isolates the session from it.
</Note>

## Environment the launcher sets

| Variable                      | Value                                               |
| ----------------------------- | --------------------------------------------------- |
| `ANTHROPIC_BASE_URL`          | The local proxy root, including the route prefix    |
| `ANTHROPIC_API_KEY`           | Your Prem API key                                   |
| `ANTHROPIC_MODEL`             | The model that you selected                         |
| `QWEN_HOME`                   | The private session home                            |
| `QWEN_STREAM_IDLE_TIMEOUT_MS` | `600000`, which permits long confidential responses |

The launcher removes `ANTHROPIC_AUTH_TOKEN`, `QWEN_OAUTH`, `QWEN_MODEL`, and the `OPENAI_`, `GEMINI_`, and `GOOGLE_` credential and model variables from the child environment. A stale credential cannot redirect traffic away from the proxy.

## Stop the local proxy

The launcher starts a detached proxy. The proxy continues to run when Qwen Code exits. Stop it explicitly when you finish:

```bash theme={"system"}
npx -p @premai/api-sdk confidential-proxy stop
```

Check the status before another run when the default proxy port appears occupied:

```bash theme={"system"}
npx -p @premai/api-sdk confidential-proxy status
```

`confidential-claude` and `confidential-qwen` share one proxy in Anthropic mode. You do not need a second proxy to run both at the same time. One `confidential-proxy stop` ends the session for both.

## Plaintext and tool boundary

| Component                          | Plaintext access                  | Notes                                                              |
| ---------------------------------- | --------------------------------- | ------------------------------------------------------------------ |
| Qwen Code                          | Yes                               | Reads prompts, selected repository files, and tool results locally |
| Confidential Proxy                 | Yes, locally                      | Translates, encrypts, and decrypts model traffic                   |
| Prem API Gateway                   | No content access                 | Receives ciphertext, authentication, and routing metadata          |
| Prem confidential runtime          | Yes, inside the protected runtime | Runs the selected model and encrypts the response                  |
| Shell, MCP servers, and extensions | Depends on the tool               | Outside the Prem inference boundary                                |

Review Qwen Code permissions, MCP servers, extensions, and egress separately. A confidential model route does not protect local tool execution.

## Troubleshooting

<AccordionGroup>
  <Accordion title="TTY environment required">
    Run the command directly in an interactive terminal. Piping input or starting it from a non-interactive CI process does not supply the interactive terminal that model selection needs.
  </Accordion>

  <Accordion title="install qwen code">
    Install Qwen Code and confirm that `qwen --version` succeeds in the same shell. See the [Qwen Code documentation](https://qwenlm.github.io/qwen-code-docs/en/users/overview/).
  </Accordion>

  <Accordion title="Failed to fetch models from proxy">
    Check `API_KEY`, `PROXY_URL`, `ENCLAVE_URL`, network access, and proxy logs. Make sure that the key can list models.
  </Accordion>

  <Accordion title="A proxy is running in OpenAI-only mode">
    The launcher needs an Anthropic Messages route. It refuses to use a proxy that cannot serve one. Run `confidential-proxy stop`. Then start the launcher again. Pre-start the proxy with `confidential-proxy start --compat anthropic` or `--compat both`.
  </Accordion>

  <Accordion title="The default proxy port is occupied">
    Run `confidential-proxy status`. Then stop the managed proxy. The launcher refuses to take over an unknown process on that port.
  </Accordion>

  <Accordion title="Qwen Code asks for OAuth or a DashScope key">
    A stale credential or authentication setting overrides the Anthropic provider. Confirm that you did not pass `--auth-type`. Check `~/.qwen/settings.json` for a pinned authentication type.
  </Accordion>

  <Accordion title="could not parse ~/.qwen/settings.json">
    The launcher still runs. But it does not sync settings back. Repair the JSON. Then start it again.
  </Accordion>

  <Accordion title="Attestation fails">
    Do not add `--no-attest` to work around the failure. Capture the error. Verify the current Reticle boundary in [Attestation](/attestation).
  </Accordion>
</AccordionGroup>

## Frequently asked questions

### Does `confidential-qwen` install Qwen Code?

No. It checks for an existing `qwen` command. It exits if Qwen Code is not installed.

### Does it use my Qwen or DashScope credentials?

No. `API_KEY` is the Prem API key. The launcher clears all Qwen OAuth, OpenAI, Gemini, and Google variables. It passes the Prem key to Qwen Code as the Anthropic provider token.

### Does it change my Qwen Code configuration?

It runs the session against a private home. It merges your settings changes back into `~/.qwen/settings.json` on exit. It does not write the local endpoint or the API key. Your original authentication and model keys are restored.

### Can I pass normal Qwen Code arguments?

Yes, except `--model`, `-m`, and `--auth-type`. The launcher sets those values and removes them.

### Can I run it beside `confidential-claude`?

Yes. Both use Anthropic mode and share one proxy.

### Is the full coding session inside an enclave?

No. Only supported inference traffic uses the encrypted Prem path. Files and tools remain in their own local or external trust boundaries.

## Related

<CardGroup cols={2}>
  <Card title="Claude Code" icon="terminal" href="/guides/claude-code" arrow="true">
    Review the sibling launcher that shares the same proxy mode.
  </Card>

  <Card title="Anthropic-compatible clients" icon="comments" href="/guides/anthropic-compatible-clients" arrow="true">
    Review the Messages translation and compatibility limits.
  </Card>

  <Card title="Confidential Proxy" icon="server" href="/confidential-proxy" arrow="true">
    Review proxy modes, routes, keys, and daemon controls.
  </Card>

  <Card title="Security Model" icon="shield-halved" href="/security-model" arrow="true">
    Review the protected and unprotected parts of the data flow.
  </Card>
</CardGroup>