fix(run): canonical credential guidance — hint cloud login / set-key, unhide set-key (BE-3362)

[mattmillerai]

ELI-5

When you try to run a workflow that needs a Comfy Cloud / partner-API key and you don't have one, the CLI used to tell you to run comfy auth set comfy-cloud-api-key --key …. That command only "works" as a side effect — auth set actually rejects the cloud provider and prints a "not a well-known provider; stored anyway" warning. The real, sanctioned command is comfy cloud set-key (or better, comfy cloud login). But comfy cloud set-key was hidden=True, so you couldn't even find it in comfy cloud --help.

This PR fixes the steering: the missing-credential hints now point at the canonical path (comfy cloud login → COMFY_API_KEY env → comfy cloud set-key), and set-key is now discoverable in the help output.

What changed

1. comfy_cli/command/run/__init__.py — the partner_node_requires_credential hint now reads:
   run: comfy cloud login (or set COMFY_API_KEY in the environment, or persist a key with comfy cloud set-key --key …; cloud runs auto-inject via --where cloud). This is the hint comfy-local-mcp passes through verbatim to agents (BE-3344), so it's the primary agent-facing steering — it now names the canonical order.
2. comfy_cli/cloud/command.py — removed hidden=True from set-key so it appears in comfy cloud --help. Help text keeps the "canonical sign-in is comfy cloud login" / testing-path framing. Not added to SUPPORTED_PROVIDERS / comfy auth list (the store deliberately excludes cloud; OAuth-first per credentials.py).
3. comfy_cli/error_codes.py — the registry entry for the same error code, updated to the canonical order (dropped the comfy auth set comfy-cloud-api-key reference).
4. comfy_cli/help_json.py (judgment call) — the agent copy/paste example for comfy auth set was comfy auth set comfy-cloud --key sk-…, which is the exact path that ERRORS (auth_use_login_for_cloud). Changed to a real third-party provider (civitai), matching the sibling example on line 33. This is squarely the ticket's "steer away from the rejected back door" intent.
5. comfy_cli/credentials.py (judgment call) — dropped the now-stale word "hidden" from two docstring/comment references to comfy cloud set-key (accuracy only, tied to unhiding).

Tests

• Added test_cloud_set_key_visible_in_help — asserts set-key appears in comfy cloud --help.
• The existing test_auth_set_comfy_cloud_rejected already asserts auth set comfy-cloud still errors with auth_use_login_for_cloud and hints comfy cloud login — left intact (deliberately unchanged; the rejection path is preserved).
• No test asserted the old hint string (grep of tests/ for comfy auth set comfy-cloud-api-key was empty).
• Ran the auth / cloud / run / output / credentials / help_json suites — all green; ruff check + ruff format --check clean on the touched files.

Notes / judgment calls

• Items 4 and 5 are beyond the literal grep in the ticket but directly serve its goal (canonical guidance + no undiscoverable/misleading back-door references). Flagged here for review.
• Negative-claim check: this change adds no capability denial — the partner_node_requires_credential and auth_use_login_for_cloud deny/reject paths already existed; the diff only improves the guidance toward working paths (cloud login / set-key), so there is no dead-end to falsify.
• Kept set-key out of SUPPORTED_PROVIDERS / comfy auth list per the ticket (OAuth-first, deprecation-path stance preserved).

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 44 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1b1bb468-81b0-4f5f-98b8-67601f08be89

📥 Commits

Reviewing files that changed from the base of the PR and between a732f5c and 32bd72a.

📒 Files selected for processing (6)

• comfy_cli/cloud/command.py
• comfy_cli/command/run/__init__.py
• comfy_cli/credentials.py
• comfy_cli/error_codes.py
• comfy_cli/help_json.py
• tests/comfy_cli/auth/test_auth_command.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch matt/be-3362-canonical-cred-guidance

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch matt/be-3362-canonical-cred-guidance

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Cursor Review — Consolidated panel

Triggered by @mattmillerai.

✅ No high-signal findings.

Panel: 6/8 reviewers contributed findings.

Reviewers that did not contribute: kimi-k2.5:adversarial (empty), kimi-k2.5:edge-case (empty)