Check Qwen OAuth readiness against its own credentials

Avoid treating unrelated provider API keys as a Qwen OAuth login.

Checks: 113 readiness and native configuration tests; git diff --check.

desktop/src/agents/local-agent-readiness.cjs

@@ -11,7 +11,7 @@ const { nativeSecretEnvKeys } = require('./cli/native-secret-environment.cjs')
 const { OCR_PROVIDER_KEYS } = require('./cli/ocr-provider-environment.cjs')
 const { deepseekNativeConfig } = require('./cli/deepseek-native-config.cjs')
 const { hermesProviderFromConfig, hermesProviderEnvironment } = require('./hermes-config-summary.cjs')
-const { qwenCredentialSelection } = require('./cli/qwen-native-config.cjs')
+const { qwenCredentialSelection, qwenConfiguredAuth } = require('./cli/qwen-native-config.cjs')
 const { prepareCommand, searchPath } = require('./cli/cli-discovery.cjs')
 const { isOpenClawSecretReference } = require('./cli/openclaw-runtime.cjs')
 const { NETWORK_ENV_KEYS, networkEnvironment } = require('./cli/cli-network-environment.cjs')
@@ -813,6 +813,11 @@ function nativeCredentialState(kind, options = {}) {
   if (kind === 'qwen' && qwenCredentialSelection({ home, env, workdir: options.workdir, platform: options.platform }).unsupported) {
     return { state: 'unknown', source: 'unverified' }
   }
+  if (kind === 'qwen' && qwenConfiguredAuth({ home, env, workdir: options.workdir, platform: options.platform }) === 'qwen-oauth') {
+    return jsonContainsCredential(path.join(effectiveUserHome, '.qwen', 'oauth_creds.json'))
+      ? { state: 'ready', source: 'native-credential' }
+      : { state: 'unknown', source: 'unverified' }
+  }
   if (kind === 'qwen' && options.nativeCredentialKeys?.length) {
     const [key] = nativeSecretEnvKeys(options.nativeCredentialKeys)
     const inherited = key && Object.hasOwn(env, key)

desktop/test/agents/cli/qwen-native-config.test.cjs

@@ -123,3 +123,15 @@ test('Qwen readiness follows the selected standard provider credential', t => {
       { state: 'ready', source: 'native-credential' })
   }
 })
+
+test('Qwen OAuth readiness ignores unrelated provider keys', t => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'meldwork-qwen-oauth-'))
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }))
+  const root = path.join(home, '.qwen')
+  fs.mkdirSync(root)
+  fs.writeFileSync(path.join(root, 'settings.json'), JSON.stringify({ security: { auth: { selectedType: 'qwen-oauth' } } }))
+  const env = { HOME: home, QWEN_CODE_SYSTEM_SETTINGS_PATH: path.join(home, 'missing.json'), OPENAI_API_KEY: 'unrelated' }
+  assert.deepEqual(nativeCredentialState('qwen', { home, env }), { state: 'unknown', source: 'unverified' })
+  fs.writeFileSync(path.join(root, 'oauth_creds.json'), JSON.stringify({ access_token: 'oauth-token' }))
+  assert.deepEqual(nativeCredentialState('qwen', { home, env }), { state: 'ready', source: 'native-credential' })
+})