@lazyingart/agintiflow 0.17.2 → 0.17.4

package/README.md

@@ -79,7 +79,7 @@ For larger repositories, use `--profile large-codebase` or choose **Large codeba
 
 AgInTiFlow can also spend cheap DeepSeek calls on parallel scout notes before the main executor starts a complicated task. It first writes a bounded project map to `.aginti/codebase-map.json`, then runs scouts for architecture, implementation, review, research, context mapping, tests, git workflow, integration, symbol tracing, and dependency risks. A coordinator Swarm Board is injected for the main agent and saved as `artifacts/scout-blackboard.json` in the session. The executor still does the real file/shell/browser work itself. Disable with `--no-parallel-scouts` or set `--scout-count 1..10`.
 
-The next productive-agent roadmap is tracked in [docs/productive-agent-roadmap.md](docs/productive-agent-roadmap.md): durable codebase maps, stronger scout blackboards, long-run checkpoints, LSP/symbol tools, test triage, and release automation. Runtime choices, Docker persistence, host full-access tradeoffs, tmux sessions, and rolling-plan autonomy are documented in [docs/runtime-modes-and-autonomy.md](docs/runtime-modes-and-autonomy.md).
+The next productive-agent roadmap is tracked in [docs/productive-agent-roadmap.md](docs/productive-agent-roadmap.md): durable codebase maps, stronger scout blackboards, long-run checkpoints, LSP/symbol tools, test triage, and release automation. Runtime choices, Docker persistence, host full-access tradeoffs, tmux sessions, and rolling-plan autonomy are documented in [docs/runtime-modes-and-autonomy.md](docs/runtime-modes-and-autonomy.md). The supervised self-development protocol is in [docs/self-development-supervision.md](docs/self-development-supervision.md).
 
 For current docs, install errors, package/toolchain setup, and source discovery, the agent has a guarded `web_search` tool. It returns compact search results without browser search-engine loops and respects configured domain allowlists. Disable with `--no-web-search`.
 

package/docs/self-development-supervision.md

@@ -0,0 +1,95 @@
+# Self-Development Supervision
+
+This document defines how to let AgInTiFlow work on its own source code under Codex supervision.
+
+## Readiness Verdict
+
+AgInTiFlow is ready for supervised self-development on small and medium tasks. It has the required primitives:
+
+- Project-local sessions and web/CLI sync.
+- DeepSeek flash/pro routing with mock fallback.
+- Workspace file tools, deterministic `apply_patch`, and compact diffs.
+- Docker workspace mode for package installs and checks.
+- Host tmux tools for durable monitored sessions.
+- Guardrails for secrets, npm publishing, `.git`, `node_modules`, and destructive commands.
+- Full test, smoke, and pack dry-run scripts.
+
+It is not ready for fully unsupervised release or system-level work. Codex should remain the supervisor for commits, pushes, npm publishing, high-risk host commands, and ambiguous git states.
+
+## Recommended Launch
+
+Start AgInTiFlow in a separate tmux session from the source repo:
+
+```bash
+tmux new-session -d -s agintiflow-selfdev -c /home/lachlan/ProjectsLFS/Agent/AgInTiFlow
+tmux send-keys -t agintiflow-selfdev 'aginti --profile large-codebase --parallel-scouts --scout-count 5' Enter
+```
+
+For a single supervised task:
+
+```bash
+aginti --profile large-codebase --parallel-scouts --scout-count 5 \
+  "inspect this repo, implement the requested change, run focused checks, and stop before commit"
+```
+
+Use `aginti web --port 3221` from the same folder if a browser UI is preferred. CLI and web will share `.sessions/`.
+
+## Supervisor Duties
+
+Codex should supervise by:
+
+1. Capturing tmux output before sending input.
+2. Keeping the task scoped and testable.
+3. Reviewing diffs before commit.
+4. Running or verifying `npm test`, `npm run pack:dry-run`, and `git diff --check` when package behavior changes.
+5. Rejecting changes that weaken guardrails without explicit reasoning.
+6. Handling commit, push, and publish steps itself unless Lachlan explicitly delegates them to AgInTiFlow.
+
+## Safe Task Types
+
+Good first self-development tasks:
+
+- Add or improve docs.
+- Add smoke tests around existing behavior.
+- Improve prompt wording or task profiles.
+- Make small CLI/web UI polish changes.
+- Add capability reports or non-invasive diagnostics.
+
+Use stronger supervision for:
+
+- Model-client tool schemas.
+- Guardrails and command policy.
+- Docker runtime changes.
+- Npm publishing workflow.
+- Git automation.
+- Session persistence and database changes.
+
+## Stop Conditions
+
+AgInTiFlow should stop and ask for supervision when it sees:
+
+- Dirty unrelated files.
+- Failing tests it cannot explain.
+- Git conflicts, divergence, rebase/merge choices, or reset/checkout suggestions.
+- Requests to publish npm, push tags, delete files, rotate secrets, or run host sudo.
+- A plan that exceeds the current step budget without a completed checkpoint.
+
+## Housekeeping Before Each Self-Dev Session
+
+Run:
+
+```bash
+git status --short
+aginti doctor
+aginti doctor --capabilities
+npm run check
+```
+
+For larger changes also run:
+
+```bash
+npm test
+npm run pack:dry-run
+git diff --check
+```
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.17.2",
+  "version": "0.17.4",
   "type": "module",
   "description": "AgInTiFlow is a resumable Playwright website-control agent with OpenAI-compatible tool calling.",
   "license": "Apache-2.0",

package/public/app.js

@@ -901,7 +901,7 @@ function renderWorkspacePanel(workspace = lastWorkspace, activity = lastWorkspac
       const label = blocked ? t("blockedLabel") : t("changedLabel");
       const path = escapeHtml(item.path || "");
       const reason = blocked ? `<div class="subtle">${escapeHtml(item.reason || "")}</div>` : "";
-      const diff = item.diff ? `<pre class="change-diff">${escapeHtml(item.diff).slice(0, 1200)}</pre>` : "";
+      const diff = item.diff ? `<pre class="change-diff">${renderDiffHtml(item.diff, 1200)}</pre>` : "";
       const hashes =
         item.beforeHash || item.afterHash
           ? `<div class="change-meta"><span>before=${escapeHtml((item.beforeHash || "new").slice(0, 10))}</span><span>after=${escapeHtml((item.afterHash || "").slice(0, 10))}</span></div>`
@@ -1123,6 +1123,22 @@ function escapeHtml(value) {
   );
 }
 
+function renderDiffHtml(value, maxChars = 1200) {
+  return String(value || "")
+    .slice(0, maxChars)
+    .split(/\r?\n/)
+    .map((line) => {
+      const escaped = escapeHtml(line);
+      if (/^\+(?!\+\+)/.test(line)) return `<span class="diff-add">${escaped}</span>`;
+      if (/^-(?!--)/.test(line)) return `<span class="diff-del">${escaped}</span>`;
+      if (/^\+\+\+/.test(line)) return `<span class="diff-file-add">${escaped}</span>`;
+      if (/^---/.test(line)) return `<span class="diff-file-del">${escaped}</span>`;
+      if (/^@@/.test(line)) return `<span class="diff-hunk">${escaped}</span>`;
+      return escaped;
+    })
+    .join("\n");
+}
+
 function safeLinkHref(value) {
   const raw = String(value || "").trim();
   try {

package/public/styles.css

@@ -481,6 +481,20 @@ button.danger {
   overflow-wrap: anywhere;
 }
 
+.change-diff .diff-add,
+.change-diff .diff-file-add {
+  color: #86efac;
+}
+
+.change-diff .diff-del,
+.change-diff .diff-file-del {
+  color: #fca5a5;
+}
+
+.change-diff .diff-hunk {
+  color: #67e8f9;
+}
+
 .sandbox-card h2 {
   margin: 0 0 4px;
   font-size: 1.05rem;

package/scripts/smoke-auth.js

@@ -6,10 +6,13 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { authProviderKeyHelp, authProviderKeyUrl, normalizeAuthProvider } from "../src/auth-onboarding.js";
 import { getProviderDefaults } from "../src/model-routing.js";
-import { providerKeyStatus, setProviderKey } from "../src/project.js";
+import { maskProviderKey, providerKeyPreview, providerKeyStatus, setProviderKey } from "../src/project.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-auth-"));
+const envKeys = ["DEEPSEEK_API_KEY", "OPENAI_API_KEY", "LLM_API_KEY", "QWEN_API_KEY", "GRSAI", "GRSAI_API_KEY"];
+const originalEnv = Object.fromEntries(envKeys.map((key) => [key, process.env[key]]));
+for (const key of envKeys) delete process.env[key];
 
 function assert(condition, message) {
   if (!condition) throw new Error(message);
@@ -55,6 +58,8 @@ try {
   assert(normalizeAuthProvider("qwen") === "qwen", "qwen provider did not normalize");
   assert(authProviderKeyUrl("deepseek") === "https://platform.deepseek.com/api_keys", "DeepSeek key URL is missing");
   assert(authProviderKeyHelp("openai").includes("https://platform.openai.com/api-keys"), "OpenAI key help is missing");
+  assert(maskProviderKey("short") === "s…t (5 chars)", "short key mask was not compact");
+  assert(maskProviderKey("test-openai-key") === "test…-key (15 chars)", "long key mask did not preserve prefix/suffix");
   const qwenDefaults = getProviderDefaults("qwen");
   assert(qwenDefaults.provider === "qwen" && qwenDefaults.model, "qwen provider defaults are not available");
 
@@ -62,11 +67,16 @@ try {
   let status = providerKeyStatus(tempRoot);
   assert(status.qwen, "qwen key status was not detected");
   assert(status.envVars.qwen.includes("QWEN_API_KEY"), "qwen env var name was not reported");
+  const qwenPreview = providerKeyPreview(tempRoot, "qwen");
+  assert(qwenPreview.available && qwenPreview.preview === "test…-key (13 chars)", "qwen key preview was not masked correctly");
 
   await runCli(["keys", "set", "openai", "--stdin"], "test-openai-key");
   await runCli(["keys", "set", "grsai", "--stdin"], "test-grsai-key");
   status = providerKeyStatus(tempRoot);
   assert(status.openai && status.grsai && status.qwen, "stored auth keys were not detected");
+  const openaiPreview = providerKeyPreview(tempRoot, "openai");
+  assert(openaiPreview.preview === "test…-key (15 chars)", "openai key preview was not masked correctly");
+  assert(openaiPreview.preview !== "test-openai-key", "openai key preview leaked raw key");
 
   const keysOutput = await runCli(["keys", "status"]);
   assert(keysOutput.includes("qwen=available"), "keys status did not include qwen");
@@ -77,12 +87,24 @@ try {
       {
         ok: true,
         projectRoot: tempRoot,
-        checks: ["normalize-auth-provider", "provider-key-links", "qwen-defaults", "qwen-key-status", "cli-key-status-redacted"],
+        checks: [
+          "normalize-auth-provider",
+          "provider-key-links",
+          "provider-key-mask",
+          "provider-key-preview",
+          "qwen-defaults",
+          "qwen-key-status",
+          "cli-key-status-redacted",
+        ],
       },
       null,
       2
     )
   );
 } finally {
+  for (const key of envKeys) {
+    if (originalEnv[key] === undefined) delete process.env[key];
+    else process.env[key] = originalEnv[key];
+  }
   await fs.rm(tempRoot, { recursive: true, force: true });
 }

package/scripts/smoke-cli-chat.js

@@ -4,7 +4,7 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { buildPromptLayout, classifyEscapeAction, stripMarkdown } from "../src/interactive-cli.js";
+import { buildPromptLayout, classifyEscapeAction, formatWorkspaceChange, stripMarkdown } from "../src/interactive-cli.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-cli-chat-"));
@@ -85,6 +85,21 @@ try {
   if (!renderedDiff.includes("-old") || !renderedDiff.includes("+new")) {
     throw new Error("terminal markdown renderer dropped patch diff lines");
   }
+  const renderedPatchEvent = formatWorkspaceChange({
+    toolName: "apply_patch",
+    path: "test_cli.py",
+    beforeHash: "aaaaaaaa11111111",
+    afterHash: "bbbbbbbb22222222",
+    diff: ["--- a/test_cli.py", "+++ b/test_cli.py", "@@ line 10 @@", "-old line", "+new line"].join("\n"),
+  });
+  if (
+    renderedPatchEvent.label !== "patch" ||
+    !renderedPatchEvent.summary.includes("test_cli.py") ||
+    !renderedPatchEvent.lines.join("\n").includes("-old line") ||
+    !renderedPatchEvent.lines.join("\n").includes("+new line")
+  ) {
+    throw new Error("workspace patch event formatter did not preserve red/green diff content");
+  }
 
   const promptLayout = buildPromptLayout(`${"x".repeat(180)}\nsecond line`, 95, 80, 24);
   const promptText = promptLayout.renderedRows
@@ -185,7 +200,27 @@ try {
       {
         ok: true,
         projectRoot: tempRoot,
-        checks: ["markdown-render", "markdown-table-no-duplicate", "patch-diff-render", "prompt-layout", "user-prompt-label", "escape-policy", "live-input-status-layout", "agent-response-gutter", "aginti-md", "instructions-command", "skills-command", "slash-prefix-autoselect", "instructions-chat-edit", "interactive-chat", "mock-file-write", "run-status", "resume-latest", "resume-history-full"],
+        checks: [
+          "markdown-render",
+          "markdown-table-no-duplicate",
+          "patch-diff-render",
+          "workspace-patch-event-render",
+          "prompt-layout",
+          "user-prompt-label",
+          "escape-policy",
+          "live-input-status-layout",
+          "agent-response-gutter",
+          "aginti-md",
+          "instructions-command",
+          "skills-command",
+          "slash-prefix-autoselect",
+          "instructions-chat-edit",
+          "interactive-chat",
+          "mock-file-write",
+          "run-status",
+          "resume-latest",
+          "resume-history-full",
+        ],
       },
       null,
       2

package/src/auth-onboarding.js

@@ -2,7 +2,24 @@ import readline from "node:readline/promises";
 import { emitKeypressEvents } from "node:readline";
 import { stdin as input, stdout as output } from "node:process";
 import { Writable } from "node:stream";
-import { providerKeyStatus, setProviderKey } from "./project.js";
+import { providerKeyPreview, providerKeyStatus, setProviderKey } from "./project.js";
+
+const useColor = Boolean(input.isTTY && output.isTTY && process.env.AGINTIFLOW_NO_COLOR !== "1");
+const ansi = {
+  reset: "\x1b[0m",
+  bold: "\x1b[1m",
+  dim: "\x1b[2m",
+  cyan: "\x1b[36m",
+  green: "\x1b[32m",
+  yellow: "\x1b[33m",
+  selected: "\x1b[48;5;31m\x1b[38;5;231m",
+  border: "\x1b[38;5;45m",
+  muted: "\x1b[38;5;245m",
+  inputBg: "\x1b[48;5;236m\x1b[38;5;231m",
+  clearLine: "\x1b[2K",
+  cursorHide: "\x1b[?25l",
+  cursorShow: "\x1b[?25h",
+};
 
 export const MAIN_AUTH_PROVIDERS = [
   {
@@ -57,6 +74,68 @@ function providerLabel(provider = "") {
   return match?.label || provider;
 }
 
+function color(value, ...codes) {
+  if (!useColor || codes.length === 0) return String(value);
+  return `${codes.join("")}${value}${ansi.reset}`;
+}
+
+function stripAnsi(value) {
+  return String(value || "").replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "");
+}
+
+function visibleLength(value) {
+  return stripAnsi(value).length;
+}
+
+function terminalWidth() {
+  return Math.max(Number(output.columns) || 80, 50);
+}
+
+function padVisible(value, width) {
+  return `${value}${" ".repeat(Math.max(width - visibleLength(value), 0))}`;
+}
+
+function compactLine(value = "", limit = 92) {
+  const text = String(value || "").replace(/\s+/g, " ").trim();
+  return text.length <= limit ? text : `${text.slice(0, Math.max(limit - 1, 1))}…`;
+}
+
+function boxedLine(content, width) {
+  return `${color("│", ansi.border)} ${padVisible(content, width - 4)} ${color("│", ansi.border)}`;
+}
+
+function secretInputDisplay({ value, selectedPreview, placeholder }) {
+  if (value) return color(`${"•".repeat(Math.min(value.length, 24))} (${value.length} chars)`, ansi.inputBg);
+  if (selectedPreview) return `${color(` ${selectedPreview} `, ansi.selected, ansi.bold)} ${color("selected", ansi.yellow)}`;
+  return color(placeholder || "paste key here", ansi.dim);
+}
+
+function renderSecretBox({ title, helpText, statusText, currentPreview, value, selected, actionText }) {
+  const width = Math.min(Math.max(terminalWidth() - 2, 58), 96);
+  const inner = width - 4;
+  const selectedPreview = selected && currentPreview ? currentPreview : "";
+  const lines = [
+    `${color("╭", ansi.border)}${color("─", ansi.border).repeat(width - 2)}${color("╮", ansi.border)}`,
+    boxedLine(color(compactLine(title, inner), ansi.bold, ansi.cyan), width),
+    helpText ? boxedLine(`${color("key", ansi.muted)}   ${compactLine(helpText, inner - 6)}`, width) : "",
+    statusText ? boxedLine(`${color("status", ansi.muted)} ${compactLine(statusText, inner - 8)}`, width) : "",
+    boxedLine(`${color("input", ansi.muted)}  ${secretInputDisplay({ value, selectedPreview, placeholder: "hidden input" })}`, width),
+    boxedLine(color(compactLine(actionText, inner), ansi.dim), width),
+    `${color("╰", ansi.border)}${color("─", ansi.border).repeat(width - 2)}${color("╯", ansi.border)}`,
+  ].filter(Boolean);
+  return lines.join("\n");
+}
+
+function clearRenderedLines(count) {
+  if (!count) return;
+  output.write(`\x1b[${count - 1}A`);
+  for (let index = 0; index < count; index += 1) {
+    output.write(`\r${ansi.clearLine}`);
+    if (index < count - 1) output.write("\x1b[1B");
+  }
+  output.write(`\x1b[${count - 1}A\r`);
+}
+
 export function authProviderKeyUrl(provider = "") {
   const normalized = normalizeAuthProvider(provider, "");
   const match = [...MAIN_AUTH_PROVIDERS, AUXILIARY_AUTH_PROVIDER].find((item) => item.id === normalized);
@@ -83,7 +162,7 @@ class MutedWritable extends Writable {
   }
 }
 
-export async function promptSecret(promptText, { allowEscape = true } = {}) {
+export async function promptSecret(promptText, { allowEscape = true, box = null } = {}) {
   if (!input.isTTY || !output.isTTY) return { value: "", skipped: true };
 
   if (typeof input.setRawMode === "function") {
@@ -91,21 +170,38 @@ export async function promptSecret(promptText, { allowEscape = true } = {}) {
       emitKeypressEvents(input);
       const wasRaw = Boolean(input.isRaw);
       let value = "";
+      let selectedExisting = Boolean(box?.currentPreview);
+      let renderedLines = 0;
+
+      const render = () => {
+        if (!box) return;
+        clearRenderedLines(renderedLines);
+        const text = renderSecretBox({
+          ...box,
+          value,
+          selected: selectedExisting,
+        });
+        renderedLines = text.split("\n").length;
+        output.write(`${ansi.cursorHide}${text}`);
+      };
 
       const cleanup = () => {
         input.off("keypress", handler);
         if (typeof input.setRawMode === "function") input.setRawMode(wasRaw);
         input.pause();
+        output.write(ansi.cursorShow);
       };
 
       const finish = (result) => {
+        if (box) clearRenderedLines(renderedLines);
         cleanup();
-        output.write("\n");
+        if (!box) output.write("\n");
         resolve(result);
       };
 
       const handler = (str = "", key = {}) => {
         if (key.ctrl && key.name === "c") {
+          if (box) clearRenderedLines(renderedLines);
           cleanup();
           reject(Object.assign(new Error("Interrupted by ctrl-c."), { name: "AbortError", code: "ABORT_ERR" }));
           return;
@@ -119,14 +215,34 @@ export async function promptSecret(promptText, { allowEscape = true } = {}) {
           return;
         }
         if (key.name === "backspace" || key.name === "delete") {
-          value = value.slice(0, -1);
+          if (selectedExisting) {
+            selectedExisting = false;
+            value = "";
+          } else {
+            value = value.slice(0, -1);
+          }
+          render();
+          return;
+        }
+        if (key.ctrl && key.name === "u") {
+          selectedExisting = false;
+          value = "";
+          render();
           return;
         }
         if (key.ctrl || key.meta || key.sequence?.startsWith("\x1b")) return;
-        if (str) value += str.replace(/\r|\n/g, "");
+        if (str) {
+          if (selectedExisting) {
+            selectedExisting = false;
+            value = "";
+          }
+          value += str.replace(/\r|\n/g, "");
+          render();
+        }
       };
 
-      output.write(promptText);
+      if (box) render();
+      else output.write(promptText);
       input.resume();
       input.setRawMode(true);
       input.on("keypress", handler);
@@ -313,10 +429,23 @@ export async function runAuthWizard(projectRoot = process.cwd(), options = {}) {
   const skipped = [];
 
   if (mainProvider) {
-    const current = status[mainProvider] ? "currently available; paste a new key to replace, or Esc to keep existing" : "missing";
+    const preview = providerKeyPreview(projectRoot, mainProvider);
+    const current = preview.available ? `available: ${preview.preview}` : "missing";
     const keyHelp = authProviderKeyHelp(mainProvider);
-    const prompt = `${keyHelp ? `${keyHelp}\n` : ""}${providerLabel(mainProvider)} main API key (${current}) [hidden]: `;
-    const secret = await promptSecret(prompt, { allowEscape: true });
+    const title = `${providerLabel(mainProvider)} main API key`;
+    const prompt = `${keyHelp ? `${keyHelp}\n` : ""}${title} (${current}) [hidden]: `;
+    const secret = await promptSecret(prompt, {
+      allowEscape: true,
+      box: {
+        title,
+        helpText: keyHelp || "Paste the provider API key.",
+        statusText: preview.available ? `Existing ${preview.keyName}: ${preview.preview}` : `Missing ${preview.keyName || "provider key"}`,
+        currentPreview: preview.preview,
+        actionText: preview.available
+          ? "Existing key is selected. Type to replace, Enter/Esc to keep existing."
+          : "Paste key and Enter to save, or Esc/Enter to skip.",
+      },
+    });
     if (secret.value) {
       const result = await setProviderKey(projectRoot, mainProvider, secret.value);
       saved.push(result);
@@ -328,10 +457,18 @@ export async function runAuthWizard(projectRoot = process.cwd(), options = {}) {
   }
 
   if (options.includeAuxiliary !== false && directProvider !== "grsai") {
-    const auxStatus = providerKeyStatus(projectRoot);
-    const current = auxStatus.grsai ? "currently available; paste a new key to replace, or Esc to skip" : "optional; paste key or Esc to skip";
-    const secret = await promptSecret(`${AUXILIARY_AUTH_PROVIDER.label} auxiliary image key (${current}) [hidden]: `, {
+    const preview = providerKeyPreview(projectRoot, "grsai");
+    const current = preview.available ? `available: ${preview.preview}` : "optional";
+    const title = `${AUXILIARY_AUTH_PROVIDER.label} auxiliary image key`;
+    const secret = await promptSecret(`${title} (${current}) [hidden]: `, {
       allowEscape: true,
+      box: {
+        title,
+        helpText: "Optional image generation key for GRS AI / Nano Banana.",
+        statusText: preview.available ? `Existing ${preview.keyName}: ${preview.preview}` : "Optional; no auxiliary key saved.",
+        currentPreview: preview.preview,
+        actionText: preview.available ? "Existing key is selected. Type to replace, Enter/Esc to keep existing." : "Paste key and Enter to save, or Esc/Enter to skip.",
+      },
     });
     if (secret.value) {
       const result = await setProviderKey(projectRoot, "grsai", secret.value);
@@ -340,8 +477,17 @@ export async function runAuthWizard(projectRoot = process.cwd(), options = {}) {
       skipped.push({ provider: "grsai", reason: "skipped" });
     }
   } else if (directProvider === "grsai") {
-    const secret = await promptSecret(`${AUXILIARY_AUTH_PROVIDER.label} auxiliary image key [hidden]: `, {
+    const preview = providerKeyPreview(projectRoot, "grsai");
+    const title = `${AUXILIARY_AUTH_PROVIDER.label} auxiliary image key`;
+    const secret = await promptSecret(`${title} [hidden]: `, {
       allowEscape: true,
+      box: {
+        title,
+        helpText: "Optional image generation key for GRS AI / Nano Banana.",
+        statusText: preview.available ? `Existing ${preview.keyName}: ${preview.preview}` : "Missing auxiliary key.",
+        currentPreview: preview.preview,
+        actionText: preview.available ? "Existing key is selected. Type to replace, Enter/Esc to keep existing." : "Paste key and Enter to save, or Esc/Enter to skip.",
+      },
     });
     if (secret.value) saved.push(await setProviderKey(projectRoot, "grsai", secret.value));
     else skipped.push({ provider: "grsai", reason: "skipped" });

package/src/interactive-cli.js

@@ -356,6 +356,36 @@ function printAgentMessage(text) {
   for (const line of lines) outputLine(`${responsePrefix()}${line}`);
 }
 
+export function formatWorkspaceChange(change = {}) {
+  const toolName = String(change.toolName || change.action || "change");
+  const path = String(change.path || "");
+  const summary = [
+    toolName,
+    path,
+    change.created ? "created" : "",
+    change.beforeHash ? `before=${String(change.beforeHash).slice(0, 8)}` : "before=new",
+    change.afterHash ? `after=${String(change.afterHash).slice(0, 8)}` : "",
+  ]
+    .filter(Boolean)
+    .join(" ");
+  const diff = String(change.diff || "").trim();
+  const renderedDiff = diff ? stripMarkdown(`Diff:\n${diff}`).split("\n") : [];
+  return {
+    label: toolName === "apply_patch" || toolName.startsWith("apply_patch") ? "patch" : "write",
+    summary,
+    lines: renderedDiff,
+  };
+}
+
+function printWorkspaceChange(change = {}) {
+  if (!change?.diff) return;
+  const formatted = formatWorkspaceChange(change);
+  const bg = formatted.label === "patch" ? ansi.magenta : ansi.systemBg;
+  outputLine(`${label(formatted.label, bg)} ${compactLine(formatted.summary, 92)}`);
+  const gutter = `${color(" | ", bg)} `;
+  for (const line of formatted.lines) outputLine(`${gutter}${line}`);
+}
+
 function printPreviewBlock(role, text, { time = "", bg = ansi.systemBg, maxLines = 5 } = {}) {
   const header = [label(role, bg).trimEnd(), time ? color(time, ansi.dim) : ""].filter(Boolean).join(" ");
   outputLine(header);
@@ -1795,6 +1825,8 @@ async function runPrompt(prompt, state, packageDir) {
           printStatusEvent(state, "tool", data.toolName || "unknown");
         } else if (type === "tool.completed") {
           printStatusEvent(state, "tool_done", data.toolName || "unknown");
+        } else if (type === "file.changed") {
+          printWorkspaceChange(data);
         } else if (type === "tool.blocked") {
           printStatusEvent(state, "tool_blocked", data.toolName || data.reason || "unknown");
         } else if (type === "loop.guard") {

package/src/project.js

@@ -16,10 +16,18 @@ const LOCAL_ENV_KEYS = new Set([
   "DEEPSEEK_FAST_MODEL",
   "DEEPSEEK_PRO_MODEL",
   "OPENAI_DEFAULT_MODEL",
+  "QWEN_API_KEY",
   "GRSAI",
   "GRSAI_API_KEY",
 ]);
 
+const PROVIDER_KEY_CANDIDATES = {
+  openai: ["OPENAI_API_KEY", "LLM_API_KEY"],
+  deepseek: ["DEEPSEEK_API_KEY", "LLM_API_KEY"],
+  qwen: ["QWEN_API_KEY"],
+  grsai: ["GRSAI", "GRSAI_API_KEY"],
+};
+
 export function resolveProjectRoot(input = process.cwd()) {
   return path.resolve(input || process.cwd());
 }
@@ -267,6 +275,45 @@ export function providerKeyStatus(projectRoot = process.cwd()) {
   };
 }
 
+export function maskProviderKey(value = "") {
+  const text = String(value || "").trim();
+  if (!text) return "";
+  if (text.length <= 8) return `${text.slice(0, 1)}…${text.slice(-1)} (${text.length} chars)`;
+  return `${text.slice(0, 4)}…${text.slice(-4)} (${text.length} chars)`;
+}
+
+export function providerKeyPreview(projectRoot = process.cwd(), provider = "") {
+  loadProjectEnv(projectRoot);
+  const normalized = String(provider || "").trim().toLowerCase();
+  const aliases = {
+    auxiliary: "grsai",
+    auxilliary: "grsai",
+    image: "grsai",
+    imagegen: "grsai",
+  };
+  const canonical = aliases[normalized] || normalized;
+  const keys = PROVIDER_KEY_CANDIDATES[canonical] || [];
+  for (const keyName of keys) {
+    const value = process.env[keyName];
+    if (value) {
+      return {
+        available: true,
+        provider: canonical,
+        keyName,
+        preview: maskProviderKey(value),
+        length: String(value).trim().length,
+      };
+    }
+  }
+  return {
+    available: false,
+    provider: canonical,
+    keyName: keys[0] || "",
+    preview: "",
+    length: 0,
+  };
+}
+
 export async function setProviderKey(projectRoot, provider, value) {
   const normalizedProvider = String(provider || "").toLowerCase();
   const aliases = {