@lazyingart/agintiflow 0.14.1 → 0.15.0

package/README.md

@@ -46,13 +46,15 @@ aginti --list-profiles
 aginti --sandbox-status
 ```
 
-On first interactive use, if no DeepSeek key is detected, `aginti` asks you to paste it and saves it to the project-local ignored file `.aginti/.env` with `0600` permissions. You can also set it explicitly:
+On first interactive use, if no main model key is detected, `aginti` opens an auth wizard. Use Up/Down to choose DeepSeek, OpenAI, or Qwen, paste the key, and press Enter to save it to the project-local ignored file `.aginti/.env` with `0600` permissions. The wizard then offers the optional auxiliary image key; press Esc to skip. You can rerun it even when keys already exist:
 
 ```bash
-aginti login deepseek
-# inside chat, use /login or /auth
+aginti auth
+aginti auth openai
+# inside chat, use /login or /auth for the same wizard
 # or non-interactively:
 printf '%s' "$DEEPSEEK_API_KEY" | aginti keys set deepseek --stdin
+printf '%s' "$QWEN_API_KEY" | aginti keys set qwen --stdin
 
 # optional image-generation auxiliary skill:
 aginti login grsai
@@ -269,7 +271,7 @@ Defaults:
 | `smart` | DeepSeek | Fast for normal tasks, pro for complex tasks | `AGENT_ROUTING_MODE=smart` |
 | `fast` | DeepSeek | `deepseek-v4-flash` | `DEEPSEEK_FAST_MODEL` |
 | `complex` | DeepSeek | `deepseek-v4-pro` | `DEEPSEEK_PRO_MODEL` |
-| `manual` | DeepSeek/OpenAI | user supplied | `AGENT_PROVIDER`, `LLM_MODEL` |
+| `manual` | DeepSeek/OpenAI/Qwen | user supplied | `AGENT_PROVIDER`, `LLM_MODEL` |
 
 Provider credentials:
 
@@ -277,6 +279,7 @@ Provider credentials:
 | --- | --- | --- |
 | OpenAI | `OPENAI_API_KEY` | `https://api.openai.com/v1` |
 | DeepSeek | `DEEPSEEK_API_KEY` | `https://api.deepseek.com/v1` |
+| Qwen | `QWEN_API_KEY` | `QWEN_BASE_URL` or DashScope compatible mode |
 
 Project-local credentials can be stored without committing secrets:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "type": "module",
   "description": "AgInTiFlow is a resumable Playwright website-control agent with OpenAI-compatible tool calling.",
   "license": "Apache-2.0",
@@ -42,6 +42,7 @@
     "scripts/setup-agent-toolchain-docker.sh",
     "scripts/real-deepseek-capabilities.js",
     "scripts/smoke-auxiliary-tools.js",
+    "scripts/smoke-auth.js",
     "scripts/smoke-cli-chat.js",
     "scripts/smoke-coding-tools.js",
     "scripts/smoke-capabilities.js",
@@ -65,13 +66,14 @@
     "setup:toolchain-docker": "scripts/setup-agent-toolchain-docker.sh",
     "smoke:coding-tools": "node scripts/smoke-coding-tools.js",
     "smoke:auxiliary-tools": "node scripts/smoke-auxiliary-tools.js",
+    "smoke:auth": "node scripts/smoke-auth.js",
     "smoke:cli-chat": "node scripts/smoke-cli-chat.js",
     "smoke:skills": "node scripts/smoke-skills.js",
     "smoke:toolchain-docker": "node scripts/smoke-toolchain-docker.js",
     "smoke:inbox": "node scripts/smoke-inbox.js",
     "smoke:web-api": "node scripts/smoke-web-api.js",
     "real:deepseek": "node scripts/real-deepseek-capabilities.js",
-    "test": "npm run check && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:auxiliary-tools && npm run smoke:capabilities && npm run smoke:skills && npm run smoke:cli-chat && npm run smoke:inbox",
+    "test": "npm run check && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:auxiliary-tools && npm run smoke:auth && npm run smoke:capabilities && npm run smoke:skills && npm run smoke:cli-chat && npm run smoke:inbox",
     "pack:dry-run": "npm pack --dry-run",
     "smoke:capabilities": "node scripts/smoke-capabilities.js"
   },

package/public/app.js

@@ -22,9 +22,9 @@ const translations = {
     projectStatusTitle: "Project folder",
     setupTitle: "Provider setup",
     setupHelp:
-      "DeepSeek/OpenAI keys are missing. Use mock mode, export an env var, or save a project-local DeepSeek key.",
+      "DeepSeek/OpenAI/Qwen keys are missing. Use mock mode, export an env var, or save a project-local model key.",
     setupEnvHelp:
-      "Env vars: DEEPSEEK_API_KEY, OPENAI_API_KEY, LLM_API_KEY, and optional GRSAI for image generation. Mock mode remains available for local tests.",
+      "Env vars: DEEPSEEK_API_KEY, OPENAI_API_KEY, QWEN_API_KEY, LLM_API_KEY, and optional GRSAI for image generation. Mock mode remains available for local tests.",
     setupProviderLabel: "Provider",
     setupKeyLabel: "API key",
     saveKeyButton: "Save local key",
@@ -714,6 +714,7 @@ const ariaLabelNodes = [...document.querySelectorAll("[data-i18n-aria-label]")];
 const defaults = {
   openai: "gpt-5.4-mini",
   deepseek: "deepseek-v4-flash",
+  qwen: "qwen-plus",
   mock: "mock-agent",
 };
 
@@ -783,12 +784,14 @@ function renderKeyStatus(status = lastKeyStatus) {
   if (!status) return;
   keyStatusEl.textContent = `${t("keysLabel")}: OpenAI ${
     status.openai ? t("availableLabel") : t("missingLabel")
-  } · DeepSeek ${status.deepseek ? t("availableLabel") : t("missingLabel")} · GRS AI ${
+  } · DeepSeek ${status.deepseek ? t("availableLabel") : t("missingLabel")} · Qwen ${
+    status.qwen ? t("availableLabel") : t("missingLabel")
+  } · GRS AI ${
     status.grsai ? t("availableLabel") : t("missingLabel")
   } · ${t("mockLabel")} ${
     status.mock ? t("availableLabel") : t("missingLabel")
   }`;
-  if (setupCardEl) setupCardEl.hidden = Boolean(status.openai || status.deepseek);
+  if (setupCardEl) setupCardEl.hidden = Boolean(status.openai || status.deepseek || status.qwen);
 }
 
 function renderProjectStatus(info = projectInfo) {
@@ -2278,6 +2281,7 @@ providerField.addEventListener("change", () => {
     !modelField.value.trim() ||
     modelField.value === defaults.openai ||
     modelField.value === defaults.deepseek ||
+    modelField.value === defaults.qwen ||
     modelField.value === defaults.mock
   ) {
     modelField.value = defaults[providerField.value] || "";
@@ -2513,6 +2517,7 @@ async function loadConfig() {
   taskProfiles = data.taskProfiles || [];
   projectInfo = data.project || null;
   defaults.openai = data.defaults?.openai?.model || defaults.openai;
+  defaults.qwen = data.defaults?.qwen?.model || defaults.qwen;
   defaults.deepseek = routingPresets.fast?.model || data.defaults?.deepseek?.model || defaults.deepseek;
   defaults.mock = data.defaults?.mock?.model || defaults.mock;
 

package/public/index.html

@@ -48,7 +48,7 @@
               DeepSeek/OpenAI keys are missing. Use mock mode, export an env var, or save a project-local DeepSeek key.
             </p>
             <p class="subtle" data-i18n="setupEnvHelp">
-              Env vars: DEEPSEEK_API_KEY, OPENAI_API_KEY, or LLM_API_KEY. Mock mode remains available for local tests.
+              Env vars: DEEPSEEK_API_KEY, OPENAI_API_KEY, QWEN_API_KEY, or LLM_API_KEY. Mock mode remains available for local tests.
             </p>
           </div>
           <div class="grid">
@@ -57,6 +57,7 @@
               <select id="setup-provider">
                 <option value="deepseek">DeepSeek</option>
                 <option value="openai">OpenAI</option>
+                <option value="qwen">Qwen</option>
                 <option value="grsai">GRS AI image</option>
               </select>
             </label>
@@ -88,6 +89,7 @@
             <select id="provider" name="provider">
               <option value="deepseek">DeepSeek</option>
               <option value="openai">OpenAI</option>
+              <option value="qwen">Qwen</option>
               <option value="mock" data-i18n="mockProviderOption">Mock local</option>
             </select>
             </label>

package/scripts/smoke-auth.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { normalizeAuthProvider } from "../src/auth-onboarding.js";
+import { getProviderDefaults } from "../src/model-routing.js";
+import { providerKeyStatus, setProviderKey } from "../src/project.js";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-auth-"));
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+async function runCli(args, stdin = "") {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [path.join(repoRoot, "bin/aginti-cli.js"), ...args], {
+      cwd: tempRoot,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: {
+        ...process.env,
+        AGINTIFLOW_RUNTIME_DIR: "",
+      },
+    });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      reject(new Error("auth smoke command timed out"));
+    }, 12000);
+    child.stdout.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve(stdout);
+      else reject(new Error(`auth smoke command failed ${code}\n${stdout}\n${stderr}`));
+    });
+    child.stdin.end(stdin);
+  });
+}
+
+try {
+  assert(normalizeAuthProvider("auxilliary") === "grsai", "auxilliary alias did not normalize to grsai");
+  assert(normalizeAuthProvider("qwen") === "qwen", "qwen provider did not normalize");
+  const qwenDefaults = getProviderDefaults("qwen");
+  assert(qwenDefaults.provider === "qwen" && qwenDefaults.model, "qwen provider defaults are not available");
+
+  await setProviderKey(tempRoot, "qwen", "test-qwen-key");
+  let status = providerKeyStatus(tempRoot);
+  assert(status.qwen, "qwen key status was not detected");
+  assert(status.envVars.qwen.includes("QWEN_API_KEY"), "qwen env var name was not reported");
+
+  await runCli(["keys", "set", "openai", "--stdin"], "test-openai-key");
+  await runCli(["keys", "set", "grsai", "--stdin"], "test-grsai-key");
+  status = providerKeyStatus(tempRoot);
+  assert(status.openai && status.grsai && status.qwen, "stored auth keys were not detected");
+
+  const keysOutput = await runCli(["keys", "status"]);
+  assert(keysOutput.includes("qwen=available"), "keys status did not include qwen");
+  assert(!keysOutput.includes("test-openai-key") && !keysOutput.includes("test-qwen-key"), "keys status leaked a raw key");
+
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        projectRoot: tempRoot,
+        checks: ["normalize-auth-provider", "qwen-defaults", "qwen-key-status", "cli-key-status-redacted"],
+      },
+      null,
+      2
+    )
+  );
+} finally {
+  await fs.rm(tempRoot, { recursive: true, force: true });
+}

package/scripts/smoke-capabilities.js

@@ -37,6 +37,7 @@ try {
   assert(capabilities.project.instructionsPresent, "capabilities did not report AGINTI.md");
   assert(capabilities.project.sharedSessionFolder, "capabilities did not report shared session folder");
   assert(capabilities.keys?.mock === true, "capabilities did not report mock availability");
+  assert(typeof capabilities.keys?.qwen === "boolean", "capabilities did not report qwen key status");
   assert(
     capabilities.checks.some((check) => check.name === "npm-prefix-test-policy" && check.ok),
     "npm --prefix test policy is not allowed"

package/scripts/smoke-web-api.js

@@ -87,6 +87,7 @@ try {
 
   const keyStatus = await fetchJson("/api/keys/status");
   if (typeof keyStatus.keyStatus?.deepseek !== "boolean") throw new Error("key status endpoint is invalid");
+  if (typeof keyStatus.keyStatus?.qwen !== "boolean") throw new Error("qwen key status is missing");
   if ("localEnvPath" in keyStatus.keyStatus) throw new Error("key status leaked a local env path");
   const capabilities = await fetchJson("/api/capabilities");
   if (capabilities.project?.root !== runtimeDir || !Array.isArray(capabilities.checks)) {
@@ -106,6 +107,14 @@ try {
   if (!savedKey.ok || !savedKey.keyStatus?.deepseek || "apiKey" in savedKey || "key" in savedKey) {
     throw new Error("local key save endpoint returned invalid or sensitive data");
   }
+  const savedQwenKey = await fetchJson("/api/keys/qwen", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ apiKey: "test-qwen-key-not-real" }),
+  });
+  if (!savedQwenKey.ok || !savedQwenKey.keyStatus?.qwen || "apiKey" in savedQwenKey || "key" in savedQwenKey) {
+    throw new Error("qwen local key save endpoint returned invalid or sensitive data");
+  }
 
   const status = await fetchJson("/api/sandbox/status");
   if (!status.status?.workspaceReadable) throw new Error("sandbox status did not report a readable workspace");

package/src/auth-onboarding.js

@@ -1,8 +1,60 @@
 import readline from "node:readline/promises";
+import { emitKeypressEvents } from "node:readline";
 import { stdin as input, stdout as output } from "node:process";
 import { Writable } from "node:stream";
 import { providerKeyStatus, setProviderKey } from "./project.js";
 
+export const MAIN_AUTH_PROVIDERS = [
+  {
+    id: "deepseek",
+    label: "DeepSeek",
+    keyName: "DEEPSEEK_API_KEY",
+    description: "default fast/pro route",
+  },
+  {
+    id: "openai",
+    label: "OpenAI",
+    keyName: "OPENAI_API_KEY",
+    description: "OpenAI-compatible fallback",
+  },
+  {
+    id: "qwen",
+    label: "Qwen",
+    keyName: "QWEN_API_KEY",
+    description: "Qwen OpenAI-compatible route",
+  },
+];
+
+const AUXILIARY_AUTH_PROVIDER = {
+  id: "grsai",
+  label: "GRS AI / Nano Banana",
+  keyName: "GRSAI",
+  description: "optional image generation",
+};
+
+const AUTH_ALIASES = {
+  auxiliary: "grsai",
+  auxilliary: "grsai",
+  image: "grsai",
+  imagegen: "grsai",
+  grs: "grsai",
+  grsai: "grsai",
+  deepseek: "deepseek",
+  ds: "deepseek",
+  openai: "openai",
+  qwen: "qwen",
+};
+
+export function normalizeAuthProvider(provider = "", fallback = "deepseek") {
+  const normalized = AUTH_ALIASES[String(provider || "").trim().toLowerCase()] || String(provider || "").trim().toLowerCase();
+  return ["deepseek", "openai", "qwen", "grsai"].includes(normalized) ? normalized : fallback;
+}
+
+function providerLabel(provider = "") {
+  const match = [...MAIN_AUTH_PROVIDERS, AUXILIARY_AUTH_PROVIDER].find((item) => item.id === provider);
+  return match?.label || provider;
+}
+
 class MutedWritable extends Writable {
   constructor(target) {
     super();
@@ -16,8 +68,55 @@ class MutedWritable extends Writable {
   }
 }
 
-export async function promptHidden(promptText) {
-  if (!input.isTTY || !output.isTTY) return "";
+export async function promptSecret(promptText, { allowEscape = true } = {}) {
+  if (!input.isTTY || !output.isTTY) return { value: "", skipped: true };
+
+  if (typeof input.setRawMode === "function") {
+    return new Promise((resolve, reject) => {
+      emitKeypressEvents(input);
+      const wasRaw = Boolean(input.isRaw);
+      let value = "";
+
+      const cleanup = () => {
+        input.off("keypress", handler);
+        if (typeof input.setRawMode === "function") input.setRawMode(wasRaw);
+        input.pause();
+      };
+
+      const finish = (result) => {
+        cleanup();
+        output.write("\n");
+        resolve(result);
+      };
+
+      const handler = (str = "", key = {}) => {
+        if (key.ctrl && key.name === "c") {
+          cleanup();
+          reject(Object.assign(new Error("Interrupted by ctrl-c."), { name: "AbortError", code: "ABORT_ERR" }));
+          return;
+        }
+        if (allowEscape && key.name === "escape") {
+          finish({ value: "", skipped: true });
+          return;
+        }
+        if (key.name === "return" || key.name === "enter" || key.sequence === "\r" || str === "\r") {
+          finish({ value: value.trim(), skipped: !value.trim() });
+          return;
+        }
+        if (key.name === "backspace" || key.name === "delete") {
+          value = value.slice(0, -1);
+          return;
+        }
+        if (key.ctrl || key.meta || key.sequence?.startsWith("\x1b")) return;
+        if (str) value += str.replace(/\r|\n/g, "");
+      };
+
+      output.write(promptText);
+      input.resume();
+      input.setRawMode(true);
+      input.on("keypress", handler);
+    });
+  }
 
   const mutedOutput = new MutedWritable(output);
   const rl = readline.createInterface({
@@ -31,19 +130,132 @@ export async function promptHidden(promptText) {
     mutedOutput.muted = true;
     const value = await rl.question("");
     output.write("\n");
-    return String(value || "").trim();
+    const text = String(value || "").trim();
+    return { value: text, skipped: !text };
   } finally {
     mutedOutput.muted = false;
     rl.close();
   }
 }
 
+export async function promptHidden(promptText) {
+  const result = await promptSecret(promptText, { allowEscape: true });
+  return typeof result === "string" ? result : result.value || "";
+}
+
+function renderProviderPicker({ providers, selected, title, status }) {
+  const lines = [
+    `\n${title}`,
+    "Use Up/Down to choose, Enter to confirm, Esc to go back/skip.",
+    `Current key status: ${status}`,
+    "",
+    ...providers.map((provider, index) => {
+      const cursor = index === selected ? ">" : " ";
+      return `${cursor} ${provider.label.padEnd(10)} ${provider.keyName.padEnd(16)} ${provider.description}`;
+    }),
+  ];
+  return lines.join("\n");
+}
+
+export async function chooseAuthProvider({
+  providers = MAIN_AUTH_PROVIDERS,
+  title = "Choose main model API key",
+  initialProvider = "deepseek",
+  projectRoot = process.cwd(),
+} = {}) {
+  if (!input.isTTY || !output.isTTY || typeof input.setRawMode !== "function") {
+    return normalizeAuthProvider(initialProvider, providers[0]?.id || "deepseek");
+  }
+
+  return new Promise((resolve, reject) => {
+    emitKeypressEvents(input);
+    const wasRaw = Boolean(input.isRaw);
+    const status = providerKeyStatus(projectRoot);
+    let selected = Math.max(
+      providers.findIndex((provider) => provider.id === normalizeAuthProvider(initialProvider, providers[0]?.id)),
+      0
+    );
+    let renderedLines = 0;
+
+    const cleanup = () => {
+      input.off("keypress", handler);
+      if (typeof input.setRawMode === "function") input.setRawMode(wasRaw);
+      input.pause();
+      output.write("\x1b[?25h");
+    };
+
+    const clear = () => {
+      if (renderedLines <= 0) return;
+      output.write(`\x1b[${renderedLines - 1}A`);
+      for (let index = 0; index < renderedLines; index += 1) {
+        output.write("\r\x1b[2K");
+        if (index < renderedLines - 1) output.write("\x1b[1B");
+      }
+      output.write(`\x1b[${renderedLines - 1}A\r`);
+    };
+
+    const render = () => {
+      clear();
+      const providerStatus = providers
+        .map((provider) => `${provider.label}=${status[provider.id] ? "available" : "missing"}`)
+        .join(" · ");
+      const text = renderProviderPicker({
+        providers,
+        selected,
+        title,
+        status: providerStatus,
+      });
+      const lines = text.split("\n");
+      renderedLines = lines.length;
+      output.write(`\x1b[?25l${text}`);
+    };
+
+    const finish = (value) => {
+      clear();
+      cleanup();
+      resolve(value);
+    };
+
+    const handler = (_str = "", key = {}) => {
+      if (key.ctrl && key.name === "c") {
+        clear();
+        cleanup();
+        reject(Object.assign(new Error("Interrupted by ctrl-c."), { name: "AbortError", code: "ABORT_ERR" }));
+        return;
+      }
+      if (key.name === "escape") {
+        finish("");
+        return;
+      }
+      if (key.name === "up") {
+        selected = (selected - 1 + providers.length) % providers.length;
+        render();
+        return;
+      }
+      if (key.name === "down") {
+        selected = (selected + 1) % providers.length;
+        render();
+        return;
+      }
+      if (key.name === "return" || key.name === "enter" || key.sequence === "\r") {
+        finish(providers[selected].id);
+      }
+    };
+
+    input.resume();
+    input.setRawMode(true);
+    input.on("keypress", handler);
+    render();
+  });
+}
+
 export function shouldPromptForDeepSeek(args = {}, projectRoot = process.cwd()) {
   const provider = String(args.provider || "").toLowerCase();
-  if (provider === "mock" || provider === "openai") return false;
+  if (provider === "mock" || provider === "openai" || provider === "qwen") return false;
   if (process.env.AGINTIFLOW_NO_AUTH_PROMPT === "1") return false;
   if (!input.isTTY || !output.isTTY) return false;
-  return !providerKeyStatus(projectRoot).deepseek;
+  const status = providerKeyStatus(projectRoot);
+  return !status.deepseek && !status.openai && !status.qwen;
 }
 
 export async function promptAndSaveDeepSeekKey(projectRoot = process.cwd(), options = {}) {
@@ -60,3 +272,60 @@ export async function promptAndSaveDeepSeekKey(projectRoot = process.cwd(), opti
     path: result.path,
   };
 }
+
+export async function runAuthWizard(projectRoot = process.cwd(), options = {}) {
+  const status = providerKeyStatus(projectRoot);
+  const initialProvider = normalizeAuthProvider(options.provider || options.initialProvider || "deepseek", "deepseek");
+  const directProvider =
+    options.provider && ["deepseek", "openai", "qwen", "grsai"].includes(normalizeAuthProvider(options.provider, ""))
+      ? normalizeAuthProvider(options.provider)
+      : "";
+  const mainProvider =
+    directProvider === "grsai"
+      ? ""
+      : directProvider ||
+        (await chooseAuthProvider({
+          projectRoot,
+          initialProvider,
+          title: "Choose the main model API key to save",
+        }));
+
+  const saved = [];
+  const skipped = [];
+
+  if (mainProvider) {
+    const current = status[mainProvider] ? "currently available; paste a new key to replace, or Esc to keep existing" : "missing";
+    const prompt = `${providerLabel(mainProvider)} main API key (${current}) [hidden]: `;
+    const secret = await promptSecret(prompt, { allowEscape: true });
+    if (secret.value) {
+      const result = await setProviderKey(projectRoot, mainProvider, secret.value);
+      saved.push(result);
+    } else {
+      skipped.push({ provider: mainProvider, reason: secret.skipped ? "skipped" : "empty" });
+    }
+  } else {
+    skipped.push({ provider: "main", reason: "skipped" });
+  }
+
+  if (options.includeAuxiliary !== false && directProvider !== "grsai") {
+    const auxStatus = providerKeyStatus(projectRoot);
+    const current = auxStatus.grsai ? "currently available; paste a new key to replace, or Esc to skip" : "optional; paste key or Esc to skip";
+    const secret = await promptSecret(`${AUXILIARY_AUTH_PROVIDER.label} auxiliary image key (${current}) [hidden]: `, {
+      allowEscape: true,
+    });
+    if (secret.value) {
+      const result = await setProviderKey(projectRoot, "grsai", secret.value);
+      saved.push(result);
+    } else {
+      skipped.push({ provider: "grsai", reason: "skipped" });
+    }
+  } else if (directProvider === "grsai") {
+    const secret = await promptSecret(`${AUXILIARY_AUTH_PROVIDER.label} auxiliary image key [hidden]: `, {
+      allowEscape: true,
+    });
+    if (secret.value) saved.push(await setProviderKey(projectRoot, "grsai", secret.value));
+    else skipped.push({ provider: "grsai", reason: "skipped" });
+  }
+
+  return { saved, skipped };
+}

package/src/capabilities.js

@@ -147,6 +147,7 @@ export async function buildCapabilityReport(projectRoot, packageVersion, config)
     capability("docker", Boolean(dockerStatus?.dockerAvailable), dockerStatus || {}),
     capability("deepseek-key", keyStatus.deepseek, { envVars: keyStatus.envVars.deepseek }),
     capability("openai-key", keyStatus.openai, { envVars: keyStatus.envVars.openai }),
+    capability("qwen-key", keyStatus.qwen, { envVars: keyStatus.envVars.qwen }),
     capability("grsai-key", keyStatus.grsai, {
       envVars: keyStatus.envVars.grsai,
       setup: "Optional for image generation. Run `aginti login grsai` or use `/auxilliary grsai` in chat.",
@@ -202,6 +203,7 @@ export async function buildCapabilityReport(projectRoot, packageVersion, config)
     keys: {
       deepseek: keyStatus.deepseek,
       openai: keyStatus.openai,
+      qwen: keyStatus.qwen,
       grsai: keyStatus.grsai,
       mock: true,
       localEnv: keyStatus.localEnv,
@@ -266,7 +268,9 @@ export function printCapabilityReport(report) {
   console.log(
     `keys: deepseek=${report.keys.deepseek ? "available" : "missing"} openai=${
       report.keys.openai ? "available" : "missing"
-    } grsai=${report.keys.grsai ? "available" : "missing"} mock=available localEnv=${report.keys.localEnv}`
+    } qwen=${report.keys.qwen ? "available" : "missing"} grsai=${
+      report.keys.grsai ? "available" : "missing"
+    } mock=available localEnv=${report.keys.localEnv}`
   );
   for (const check of report.checks) {
     const suffix = check.version ? ` ${check.version}` : check.reason ? ` ${check.reason}` : check.hint ? ` ${check.hint}` : "";

package/src/cli.js

@@ -16,7 +16,7 @@ import {
 } from "./project.js";
 import { listTaskProfiles } from "./task-profiles.js";
 import { recommendedMaxStepsForTask } from "./engineering-guidance.js";
-import { promptAndSaveDeepSeekKey, promptHidden, shouldPromptForDeepSeek } from "./auth-onboarding.js";
+import { normalizeAuthProvider, promptHidden, runAuthWizard, shouldPromptForDeepSeek } from "./auth-onboarding.js";
 import { listSkills, selectSkillsForGoal } from "./skill-library.js";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -267,13 +267,14 @@ export function parseArgs(argv) {
 
 function printUsage() {
   console.log(
-    'Usage: aginti [chat] OR aginti web [--port 3210] OR aginti skills [query] OR aginti login deepseek|openai|grsai OR aginti resume [latest|<session-id>] ["prompt"] OR aginti queue <session-id> "message" OR aginti [--image] [--latex] [--routing smart|fast|complex|manual] [--provider deepseek|openai|mock] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell|--no-shell] [--allow-file-tools|--no-file-tools] [--web-search|--no-web-search] [--parallel-scouts|--no-parallel-scouts --scout-count 1..10] [--allow-auxiliary-tools|--no-auxiliary-tools] [--allow-wrappers --wrapper codex] [--list-skills] [--sandbox-status|--sandbox-preflight] "your task"'
+    'Usage: aginti [chat] OR aginti web [--port 3210] OR aginti skills [query] OR aginti auth [deepseek|openai|qwen|grsai] OR aginti login [deepseek|openai|qwen|grsai] OR aginti resume [latest|<session-id>] ["prompt"] OR aginti queue <session-id> "message" OR aginti [--image] [--latex] [--routing smart|fast|complex|manual] [--provider deepseek|openai|qwen|mock] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell|--no-shell] [--allow-file-tools|--no-file-tools] [--web-search|--no-web-search] [--parallel-scouts|--no-parallel-scouts --scout-count 1..10] [--allow-auxiliary-tools|--no-auxiliary-tools] [--allow-wrappers --wrapper codex] [--list-skills] [--sandbox-status|--sandbox-preflight] "your task"'
   );
 }
 
 function providerLabel(provider) {
   const normalized = String(provider || "").toLowerCase();
   if (normalized === "openai") return "OpenAI";
+  if (normalized === "qwen") return "Qwen";
   if (normalized === "grsai" || normalized === "auxiliary" || normalized === "auxilliary") return "GRSAI";
   return "DeepSeek";
 }
@@ -355,7 +356,9 @@ function printDoctorReport(report) {
   console.log(
     `keys: deepseek=${report.keys.deepseek ? "available" : "missing"} openai=${
       report.keys.openai ? "available" : "missing"
-    } grsai=${report.keys.grsai ? "available" : "missing"} mock=available localEnv=${report.project.localEnvPresent}`
+    } qwen=${report.keys.qwen ? "available" : "missing"} grsai=${
+      report.keys.grsai ? "available" : "missing"
+    } mock=available localEnv=${report.project.localEnvPresent}`
   );
   console.log(
     `sandbox=${report.sandbox?.sandboxMode || "unknown"} docker=${
@@ -377,16 +380,14 @@ async function readStdin() {
 
 async function ensureDeepSeekKeyForOneShot(args) {
   if (!shouldPromptForDeepSeek(args, process.cwd())) return true;
-  console.log("DeepSeek API key is not configured for this project.");
-  console.log("Paste it once to save it in `.aginti/.env` with 0600 permissions, or press Enter to cancel.");
-  const result = await promptAndSaveDeepSeekKey(process.cwd(), {
-    promptText: "DeepSeek API key: ",
-  });
-  if (result.saved) {
-    console.log(`saved ${result.keyName} to project-local ignored env`);
+  console.log("No main model API key is configured for this project.");
+  console.log("Choose DeepSeek, OpenAI, or Qwen, then paste a key to save in `.aginti/.env` with 0600 permissions.");
+  const result = await runAuthWizard(process.cwd(), { provider: args.provider || "" });
+  printAuthWizardResult(result);
+  if (result.saved.some((item) => item.provider !== "grsai")) {
     return true;
   }
-  console.error("No DeepSeek key saved. Run `aginti login deepseek` later, or use `--provider mock` for local tests.");
+  console.error("No main key saved. Run `aginti auth` later, or use `--provider mock` for local tests.");
   return false;
 }
 
@@ -397,9 +398,9 @@ async function handleKeyCommand(argv) {
     console.log(
       `keys: deepseek=${status.deepseek ? "available" : "missing"} openai=${
         status.openai ? "available" : "missing"
-      } grsai=${status.grsai ? "available" : "missing"} mock=available localEnv=${status.localEnv}`
+      } qwen=${status.qwen ? "available" : "missing"} grsai=${status.grsai ? "available" : "missing"} mock=available localEnv=${status.localEnv}`
     );
-    console.log("env vars: DeepSeek=DEEPSEEK_API_KEY or LLM_API_KEY; OpenAI=OPENAI_API_KEY or LLM_API_KEY; image=GRSAI or GRSAI_API_KEY");
+    console.log("env vars: DeepSeek=DEEPSEEK_API_KEY or LLM_API_KEY; OpenAI=OPENAI_API_KEY or LLM_API_KEY; Qwen=QWEN_API_KEY; image=GRSAI or GRSAI_API_KEY");
     return;
   }
 
@@ -415,10 +416,22 @@ async function handleKeyCommand(argv) {
     return;
   }
 
-  console.error("Usage: aginti keys status OR aginti keys set deepseek|openai|grsai [--stdin]");
+  console.error("Usage: aginti keys status OR aginti keys set deepseek|openai|qwen|grsai [--stdin]");
   process.exit(1);
 }
 
+function printAuthWizardResult(result) {
+  if (result.saved.length > 0) {
+    for (const item of result.saved) {
+      console.log(`saved ${item.provider} key to project-local ignored env (${item.keyName})`);
+    }
+  }
+  if (result.saved.length === 0) console.log("No key saved.");
+  if (result.skipped.length > 0) {
+    console.log(`skipped: ${result.skipped.map((item) => item.provider).join(", ")}`);
+  }
+}
+
 async function handleSessionsCommand(argv) {
   const [verb = "list", sessionId = ""] = argv;
   if (verb === "list") {
@@ -532,16 +545,22 @@ export async function main(argv = process.argv.slice(2)) {
     return;
   }
 
-  if (argv[0] === "login") {
-    const provider = argv[1] || "deepseek";
+  if (argv[0] === "auth" || argv[0] === "login") {
+    const provider = normalizeAuthProvider(argv[1] || "", "");
+    if (argv[0] === "auth" || (!provider && process.stdin.isTTY)) {
+      const result = await runAuthWizard(process.cwd(), { provider });
+      printAuthWizardResult(result);
+      return;
+    }
+    const target = provider || "deepseek";
     const key = argv.includes("--stdin") || !process.stdin.isTTY
       ? await readStdin()
-      : await promptHidden(`${providerLabel(provider)} API key/token: `);
+      : await promptHidden(`${providerLabel(target)} API key/token: `);
     if (!key) {
       console.error("No key saved.");
       process.exit(1);
     }
-    const result = await setProviderKey(process.cwd(), provider, key);
+    const result = await setProviderKey(process.cwd(), target, key);
     console.log(`saved ${result.provider} key to project-local ignored env (${result.keyName})`);
     return;
   }

package/src/interactive-cli.js

@@ -3,11 +3,11 @@ import { emitKeypressEvents } from "node:readline";
 import { stdin as input, stdout as output } from "node:process";
 import { runAgent } from "./agent-runner.js";
 import { loadConfig } from "./config.js";
-import { initProject, listProjectSessions, projectPaths, providerKeyStatus, readProjectInstructions, setProviderKey } from "./project.js";
+import { initProject, listProjectSessions, projectPaths, providerKeyStatus, readProjectInstructions } from "./project.js";
 import { normalizePackageInstallPolicy, normalizeSandboxMode } from "./command-policy.js";
 import { defaultMaxStepsForProfile, normalizeTaskProfile } from "./task-profiles.js";
 import { recommendedMaxStepsForTask } from "./engineering-guidance.js";
-import { promptAndSaveDeepSeekKey, promptHidden, shouldPromptForDeepSeek } from "./auth-onboarding.js";
+import { normalizeAuthProvider, runAuthWizard, shouldPromptForDeepSeek } from "./auth-onboarding.js";
 import { SessionStore } from "./session-store.js";
 import { listSkills, selectSkillsForGoal } from "./skill-library.js";
 
@@ -474,8 +474,8 @@ function printHelp() {
       "Commands:",
       "  /help                     Show this help.",
       "  /status                   Show active route, workspace, sandbox, and session.",
-      "  /login [deepseek|openai|grsai]  Paste and save a project-local API key.",
-      "  /auth [deepseek|openai|grsai]   Alias for /login.",
+      "  /login [deepseek|openai|qwen|grsai]  Pick, paste, and save project-local API keys.",
+      "  /auth [deepseek|openai|qwen|grsai]   Alias for /login.",
       "  /instructions             Show AGINTI.md project instructions status.",
       "  /memory                   Alias for /instructions.",
       "  /auxilliary [status|grsai|on|off|image]",
@@ -488,7 +488,7 @@ function printHelp() {
       "  /web-search on|off        Enable or disable the web_search tool.",
       "  /scouts on|off|<1-10>     Enable parallel DeepSeek scouts and set scout count.",
       "  /routing <mode>           Set routing: smart, fast, complex, manual.",
-      "  /provider <name>          Set provider: deepseek, openai, mock.",
+      "  /provider <name>          Set provider: deepseek, openai, qwen, mock.",
       "  /model <name>             Set an explicit model, or /model auto.",
       "  /docker on                Use docker-workspace with approved package installs.",
       "  /docker off               Use host shell policy.",
@@ -1440,48 +1440,46 @@ async function maybeOnboardDeepSeekKey(state) {
 
   printAgentMessage(
     [
-      "DeepSeek API key is not configured for this project.",
-      "Paste it once to save it in `.aginti/.env` with 0600 permissions, or press Enter to continue in mock mode.",
+      "No main model API key is configured for this project.",
+      "Choose DeepSeek, OpenAI, or Qwen, then paste a key to save in `.aginti/.env` with 0600 permissions.",
+      "After that, you can optionally paste the auxiliary image key. Press Esc to skip.",
     ].join("\n")
   );
-  const result = await promptAndSaveDeepSeekKey(process.cwd(), {
-    promptText: "DeepSeek API key: ",
-  });
-  if (result.saved) {
-    printAgentMessage(`Saved ${result.keyName} to project-local ignored env.`);
+  const result = await runAuthWizard(process.cwd(), { provider: state.provider || "", includeAuxiliary: true });
+  applyAuthWizardResult(result, state);
+  if (result.saved.some((item) => item.provider !== "grsai")) {
     return;
   }
 
   state.provider = "mock";
   state.routingMode = "manual";
   state.model = "mock-agent";
-  printAgentMessage("No key saved. Continuing in local mock mode. Use `/provider deepseek` after running `aginti login deepseek`.");
-}
-
-async function promptAndSaveProviderKey(provider = "deepseek", state = null) {
-  const aliases = { auxiliary: "grsai", auxilliary: "grsai", image: "grsai", imagegen: "grsai" };
-  const candidate = aliases[String(provider || "").toLowerCase()] || String(provider || "").toLowerCase();
-  const normalized = ["openai", "deepseek", "grsai"].includes(candidate)
-    ? String(provider || "").toLowerCase()
-    : "deepseek";
-  const canonical = aliases[normalized] || normalized;
-  const labelText = canonical === "openai" ? "OpenAI" : canonical === "grsai" ? "GRSAI" : "DeepSeek";
-  const key = await promptHidden(`${labelText} API key/token (paste, Enter to save): `);
-  if (!key) {
-    printAgentMessage("No key saved.");
-    return;
-  }
+  printAgentMessage("No main key saved. Continuing in local mock mode. Use `/auth` later to save DeepSeek, OpenAI, or Qwen.");
+}
 
-  const result = await setProviderKey(process.cwd(), canonical, key);
+function applyAuthWizardResult(result, state = null) {
   if (state) {
-    if (canonical !== "grsai") state.provider = canonical;
+    const main = result.saved.find((item) => item.provider !== "grsai");
+    if (main) state.provider = main.provider;
     if (state.routingMode === "manual" && state.model === "mock-agent") {
       state.routingMode = "smart";
       state.model = "";
     }
-    if (canonical === "grsai") state.allowAuxiliaryTools = true;
+    if (result.saved.some((item) => item.provider === "grsai")) state.allowAuxiliaryTools = true;
+  }
+  if (result.saved.length > 0) {
+    printAgentMessage(
+      result.saved.map((item) => `Saved ${item.keyName} to project-local ignored env. Raw key was not printed.`).join("\n")
+    );
+  } else {
+    printAgentMessage("No key saved.");
   }
-  printAgentMessage(`Saved ${result.keyName} to project-local ignored env. Raw key was not printed.`);
+}
+
+async function promptAndSaveProviderKey(provider = "", state = null) {
+  const canonical = normalizeAuthProvider(provider || "", "");
+  const result = await runAuthWizard(process.cwd(), { provider: canonical, includeAuxiliary: canonical !== "grsai" });
+  applyAuthWizardResult(result, state);
 }
 
 async function handleCommand(line, state, packageDir) {
@@ -1499,7 +1497,7 @@ async function handleCommand(line, state, packageDir) {
     printSystemLine(
       `keys deepseek=${keys.deepseek ? "available" : "missing"} openai=${keys.openai ? "available" : "missing"} grsai=${
         keys.grsai ? "available" : "missing"
-      }`
+      } qwen=${keys.qwen ? "available" : "missing"}`
     );
     return true;
   }

package/src/model-routing.js

@@ -88,6 +88,15 @@ export function getProviderDefaults(provider = "deepseek") {
     };
   }
 
+  if (provider === "qwen") {
+    return {
+      provider: "qwen",
+      apiKey: process.env.QWEN_API_KEY || "",
+      baseURL: process.env.QWEN_BASE_URL || process.env.LLM_BASE_URL || "https://dashscope.aliyuncs.com/compatible-mode/v1",
+      model: process.env.QWEN_DEFAULT_MODEL || process.env.LLM_MODEL || "qwen-plus",
+    };
+  }
+
   return {
     provider: "deepseek",
     apiKey: process.env.LLM_API_KEY || process.env.DEEPSEEK_API_KEY || "",

package/src/project.js

@@ -252,6 +252,7 @@ export function providerKeyStatus(projectRoot = process.cwd()) {
   return {
     openai: Boolean(process.env.OPENAI_API_KEY || process.env.LLM_API_KEY),
     deepseek: Boolean(process.env.DEEPSEEK_API_KEY || process.env.LLM_API_KEY),
+    qwen: Boolean(process.env.QWEN_API_KEY),
     grsai: Boolean(process.env.GRSAI || process.env.GRSAI_API_KEY),
     mock: true,
     localEnv: env.loaded,
@@ -259,6 +260,7 @@ export function providerKeyStatus(projectRoot = process.cwd()) {
     envVars: {
       openai: ["OPENAI_API_KEY", "LLM_API_KEY"],
       deepseek: ["DEEPSEEK_API_KEY", "LLM_API_KEY"],
+      qwen: ["QWEN_API_KEY"],
       grsai: ["GRSAI", "GRSAI_API_KEY"],
     },
   };
@@ -274,9 +276,15 @@ export async function setProviderKey(projectRoot, provider, value) {
   };
   const canonicalProvider = aliases[normalizedProvider] || normalizedProvider;
   const keyName =
-    canonicalProvider === "openai" ? "OPENAI_API_KEY" : canonicalProvider === "grsai" ? "GRSAI" : "DEEPSEEK_API_KEY";
-  if (!["deepseek", "openai", "grsai"].includes(canonicalProvider)) {
-    throw new Error("Provider must be deepseek, openai, or grsai.");
+    canonicalProvider === "openai"
+      ? "OPENAI_API_KEY"
+      : canonicalProvider === "qwen"
+        ? "QWEN_API_KEY"
+        : canonicalProvider === "grsai"
+          ? "GRSAI"
+          : "DEEPSEEK_API_KEY";
+  if (!["deepseek", "openai", "qwen", "grsai"].includes(canonicalProvider)) {
+    throw new Error("Provider must be deepseek, openai, qwen, or grsai.");
   }
 
   const keyValue = String(value || "").trim();
@@ -412,6 +420,7 @@ export async function doctorReport(projectRoot, packageVersion, config) {
     keys: {
       openai: keyStatus.openai,
       deepseek: keyStatus.deepseek,
+      qwen: keyStatus.qwen,
       grsai: keyStatus.grsai,
       mock: true,
     },

package/web.js

@@ -113,7 +113,7 @@ function serializeRun(run) {
 function normalizePreferencePayload(body = {}, current = db.getPreferences()) {
   const modelPresets = getModelPresets();
   const providerCandidate = body.provider || current.provider || "deepseek";
-  const provider = ["openai", "deepseek", "mock"].includes(providerCandidate) ? providerCandidate : "deepseek";
+  const provider = ["openai", "deepseek", "qwen", "mock"].includes(providerCandidate) ? providerCandidate : "deepseek";
   const routingMode =
     provider === "mock" ? "manual" : normalizeRoutingMode(body.routingMode || current.routingMode || "smart");
   const providerDefaults = getProviderDefaults(provider);
@@ -195,6 +195,7 @@ function publicKeyStatus(projectRoot = baseDir) {
   return {
     openai: status.openai,
     deepseek: status.deepseek,
+    qwen: status.qwen,
     grsai: status.grsai,
     mock: true,
     localEnv: status.localEnv,
@@ -570,6 +571,7 @@ app.get("/api/config", async (_req, res) => {
     defaults: {
       openai: publicProviderDefault("openai"),
       deepseek: publicProviderDefault("deepseek"),
+      qwen: publicProviderDefault("qwen"),
       mock: publicProviderDefault("mock"),
       headless: true,
       maxSteps: 24,