fix(run): canonical credential guidance — hint cloud login / set-key, unhide set-key (BE-3362)

comfy_cli/cloud/command.py

@@ -307,7 +307,6 @@ def set_base_url_cmd(
 
 @app.command(
     "set-key",
-    hidden=True,
     help="Persist a Comfy Cloud API key (testing path; canonical sign-in is `comfy cloud login`).",
 )
 @tracking.track_command("cloud")

comfy_cli/command/run/__init__.py

@@ -229,8 +229,9 @@ def execute(
                 code="partner_node_requires_credential",
                 message=msg,
                 hint=(
-                    "re-submit with `--where cloud` (the CLI auto-injects the key there), "
-                    "or store the key locally with `comfy auth set comfy-cloud-api-key --key …`"
+                    "run: comfy cloud login   (or set COMFY_API_KEY in the environment, "
+                    "or persist a key with `comfy cloud set-key --key …`; "
+                    "cloud runs auto-inject via --where cloud)"
                 ),
                 details={
                     "partner_nodes": partner_nodes,

comfy_cli/credentials.py

@@ -19,7 +19,7 @@
   matching the historical ``comfy generate`` chain.
 
 Both purposes fall back to the same stored key (provider
-``comfy-cloud-api-key``, persisted via the hidden ``comfy cloud set-key``).
+``comfy-cloud-api-key``, persisted via ``comfy cloud set-key``).
 
 This module is also the only sanctioned *read* gateway to the OAuth session
 (:func:`get_session`) and the ambient API key (:func:`find_api_key`) — a
@@ -37,7 +37,7 @@
     from comfy_cli.auth.store import CloudSession
 
 # Provider name under which a Comfy Cloud API key is persisted in the auth
-# store. Hidden / testing-only path; the canonical sign-in is OAuth.
+# store. Testing-only path; the canonical sign-in is OAuth.
 # (Re-exported by ``comfy_cli.target`` for back-compat.)
 CLOUD_API_KEY_PROVIDER = "comfy-cloud-api-key"
 

comfy_cli/error_codes.py

@@ -146,8 +146,9 @@ class ErrorCode:
         "Workflow uses a partner-API node (category `partner/*` — Veo, Kling, BFL, Gemini, etc.) "
         "but no `api_key_comfy_org` credential is available. Local submit would succeed at /prompt "
         "and then fail opaquely at execute time with `Unauthorized: Please login first`.",
-        "re-submit with `--where cloud` (the CLI auto-injects the credential there), or run "
-        "`comfy auth set comfy-cloud-api-key --key …` so the local submit path can inject it too",
+        "run: comfy cloud login (or set COMFY_API_KEY in the environment, or persist a key with "
+        "`comfy cloud set-key --key …` so the local submit path can inject it too; cloud runs "
+        "auto-inject via --where cloud)",
     ),
     ErrorCode(
         "workflow_empty",

comfy_cli/help_json.py

@@ -31,7 +31,7 @@
         "comfy query --input object_info.json --query 'from nodes where category=\"loaders\"'",
     ],
     "comfy auth": ["comfy auth list", "comfy auth set civitai --key ..."],
-    "comfy auth set": ["comfy auth set comfy-cloud --key sk-…"],
+    "comfy auth set": ["comfy auth set civitai --key sk-…"],
     "comfy auth list": ["comfy auth list", "comfy --json auth list"],
     "comfy auth remove": ["comfy auth remove civitai"],
     "comfy install": [

tests/comfy_cli/auth/test_auth_command.py

@@ -172,6 +172,15 @@ def test_auth_set_comfy_cloud_rejected(cli_env):
     assert "comfy cloud login" in (env["error"]["hint"] or "")
 
 
+def test_cloud_set_key_visible_in_help(cli_env):
+    """`set-key` is no longer hidden — it must show up in `comfy cloud --help`.
+    The ecosystem (and comfy-local-mcp's missing-credential guidance) routes
+    users to `comfy cloud set-key`, so it can't be an undiscoverable back door."""
+    res = _run(["cloud", "--help"], cli_env)
+    assert res.returncode == 0, res.stderr
+    assert "set-key" in res.stdout
+
+
 def test_cloud_whoami_not_signed_in(cli_env):
     """`whoami` lives under the `cloud` namespace now, not `auth`."""
     res = _run(["--json", "cloud", "whoami"], cli_env)