@lazyingart/agintiflow 0.20.187 → 0.20.189

package/README.md

@@ -85,11 +85,12 @@ aginti init --template aaps
 aginti init --template supervision
 ```
 
-On first interactive use, AgInTiFlow opens an auth wizard if no main model key is found. Pick DeepSeek, OpenAI, Qwen, or Venice, paste the key, and it saves to the ignored project-local `.aginti/.env` file with restricted permissions. You can rerun setup any time:
+On first interactive use, AgInTiFlow opens an auth wizard if no main model key is found. Pick DeepSeek, OpenAI, OpenRouter, Qwen, or Venice, paste the key, and it saves to the ignored project-local `.aginti/.env` file with restricted permissions. You can rerun setup any time:
 
 ```bash
 aginti auth
 aginti auth deepseek
+aginti auth openrouter
 aginti auth venice
 aginti login grsai
 ```
@@ -99,6 +100,7 @@ Provider signup and key pages:
 | Provider | Register / key page | API base URL used by AgInTiFlow |
 | --- | --- | --- |
 | DeepSeek | [https://platform.deepseek.com/api_keys](https://platform.deepseek.com/api_keys) | `https://api.deepseek.com` |
+| OpenRouter | [https://openrouter.ai/settings/keys](https://openrouter.ai/settings/keys) | `https://openrouter.ai/api/v1` |
 | Venice | [https://venice.ai/settings/api](https://venice.ai/settings/api) | `https://api.venice.ai/api/v1` |
 | OpenAI | [https://platform.openai.com/api-keys](https://platform.openai.com/api-keys) | `https://api.openai.com/v1` |
 | Qwen / DashScope | [https://bailian.console.aliyun.com/](https://bailian.console.aliyun.com/) | `https://dashscope-intl.aliyuncs.com/compatible-mode/v1` |
@@ -273,6 +275,7 @@ Useful selectors:
 ```
 
 Venice routes can be used for optional uncensored or less restricted creative work. DeepSeek remains the economic default for normal engineering workflows. See [docs/model-selection.md](docs/model-selection.md) and [references/venice-model-reference.md](references/venice-model-reference.md).
+OpenRouter is available as a first-class OpenAI-compatible provider with one key and company-grouped model buckets such as OpenRouter OpenAI, Anthropic, Google, DeepSeek, Qwen, Meta, Mistral, Moonshot, and xAI.
 
 ## AAPS And Large Workflows
 
@@ -348,6 +351,9 @@ Common environment variables:
 ```bash
 DEEPSEEK_API_KEY=...
 OPENAI_API_KEY=...
+OPENROUTER_API_KEY=...
+OPENROUTER_BASE_URL=https://openrouter.ai/api/v1
+OPENROUTER_MODEL=openrouter/auto
 QWEN_API_KEY=...
 VENICE_API_KEY=...
 GRSAI_API_KEY=...
@@ -365,6 +371,7 @@ Project-local keys:
 ```bash
 aginti init
 printf '%s' "$DEEPSEEK_API_KEY" | aginti keys set deepseek --stdin
+printf '%s' "$OPENROUTER_API_KEY" | aginti keys set openrouter --stdin
 printf '%s' "$VENICE_API_KEY" | aginti keys set venice --stdin
 ```
 

package/docs/model-selection.md

@@ -25,6 +25,8 @@ aginti --list-routes
 
 # one-shot overrides
 aginti --route-model deepseek-v4-flash --main-model deepseek-v4-pro "fix this project"
+aginti --provider openrouter --model openrouter/auto --routing manual "try a gateway route"
+aginti --provider openrouter --model anthropic/claude-sonnet-4.6 --routing manual "draft a design review"
 aginti --provider venice --model venice-uncensored-1-2 --routing manual "draft a note"
 aginti --spare-provider openai --spare-model gpt-5.4 --spare-reasoning medium "review this design"
 aginti --allow-wrappers --wrapper codex --wrapper-model gpt-5.5 "patch this bug"
@@ -63,6 +65,13 @@ Provider families:
 | DeepSeek | `deepseek-v4-flash`, `deepseek-v4-pro` |
 | Venice | `venice-uncensored-1-2`, `venice-uncensored`, `gemma-4-uncensored` |
 | OpenAI | `gpt-5.5`, `gpt-5.4`, `gpt-5.4-mini`, `gpt-5.3-codex`, `gpt-5.3-codex-spark`, `gpt-5.2`; each has low/medium/high/xhigh reasoning |
+| OpenRouter | `openrouter/auto`, `openrouter/pareto-code`, `openrouter/free` |
+| OpenRouter OpenAI | `openai/gpt-5.5`, `openai/gpt-5.4`, `openai/gpt-5.4-mini`, `openai/gpt-4o` |
+| OpenRouter Anthropic | Claude routes such as `anthropic/claude-sonnet-4.6`, `anthropic/claude-opus-4.7`, `anthropic/claude-opus-4.8-fast` |
+| OpenRouter Google | Gemini/Gemma routes such as `google/gemini-3.5-flash`, `google/gemini-3.1-flash-lite`, `google/gemma-4-31b-it` |
+| OpenRouter DeepSeek | `deepseek/deepseek-v4-flash`, `deepseek/deepseek-v4-pro`, `deepseek/deepseek-r1-0528` |
+| OpenRouter Qwen | Qwen routes such as `qwen/qwen3.7-max`, `qwen/qwen3.6-flash`, `qwen/qwen3.6-plus` |
+| OpenRouter Meta/Mistral/Moonshot/xAI | `meta-llama/llama-4-maverick`, `mistralai/mistral-medium-3-5`, `moonshotai/kimi-k2.6`, `x-ai/grok-4.3` |
 | Venice GPT | GPT-family Venice routes such as `openai-gpt-55`, `openai-gpt-54`, `openai-gpt-54-mini`, `openai-gpt-53-codex`, `openai-gpt-52` |
 | Venice Gemma | Gemma instruct routes such as `google-gemma-4-31b-it`, `google-gemma-4-26b-a4b-it`, `google-gemma-3-27b-it` |
 | Venice Claude | Claude Sonnet/Opus routes such as `claude-sonnet-4-6`, `claude-opus-4-7`, `claude-opus-4-6` |
@@ -96,6 +105,16 @@ It keeps smart routing enabled. If the Venice key is missing, run `/auth venice`
 | --- | --- | --- |
 | `deepseek` | DeepSeek | Default route/main because V4 Flash and V4 Pro are cheap and strong. |
 | `openai` | OpenAI | Spare/frontier checks, Codex-family work, and explicit manual routes. |
+| `openrouter` | OpenRouter | OpenAI-compatible gateway with auto/free/code routers. |
+| `openrouter-openai` | OpenRouter | OpenAI-family models through OpenRouter. |
+| `openrouter-anthropic` | OpenRouter | Claude-family models through OpenRouter. |
+| `openrouter-google` | OpenRouter | Gemini/Gemma models through OpenRouter. |
+| `openrouter-deepseek` | OpenRouter | DeepSeek models through OpenRouter. |
+| `openrouter-qwen` | OpenRouter | Qwen models through OpenRouter. |
+| `openrouter-meta` | OpenRouter | Meta Llama models through OpenRouter. |
+| `openrouter-mistral` | OpenRouter | Mistral models through OpenRouter. |
+| `openrouter-moonshot` | OpenRouter | Moonshot/Kimi models through OpenRouter. |
+| `openrouter-xai` | OpenRouter | xAI Grok models through OpenRouter. |
 | `qwen` | Qwen | Chinese and general-purpose OpenAI-compatible tasks. |
 | `venice` | Venice | Venice-native text shortcuts: Venice 1.2, Venice 1.1, and Gemma 4 Uncensored. |
 | `venice-gpt` | Venice | GPT-family models through Venice. |
@@ -118,8 +137,10 @@ Keys are set per project and stored only in ignored `.aginti/.env`:
 
 ```bash
 aginti auth
+aginti auth openrouter
 aginti auth venice
 aginti keys status
+printf '%s' "$OPENROUTER_API_KEY" | aginti keys set openrouter --stdin
 printf '%s' "$VENICE_API_KEY" | aginti keys set venice --stdin
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.187",
+  "version": "0.20.189",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/public/app.js

@@ -711,8 +711,10 @@ const modelRoleGridEl = document.querySelector("#model-role-grid");
 const modelRoutePillEl = document.querySelector("#model-route-pill");
 const routeProviderField = document.querySelector("#routeProvider");
 const routeModelField = document.querySelector("#routeModel");
+const routeReasoningField = document.querySelector("#routeReasoning");
 const mainProviderField = document.querySelector("#mainProvider");
 const mainModelField = document.querySelector("#mainModel");
+const mainReasoningField = document.querySelector("#mainReasoning");
 const spareProviderField = document.querySelector("#spareProvider");
 const spareModelField = document.querySelector("#spareModel");
 const spareReasoningField = document.querySelector("#spareReasoning");
@@ -820,6 +822,7 @@ const ariaLabelNodes = [...document.querySelectorAll("[data-i18n-aria-label]")];
 
 const defaults = {
   openai: "gpt-5.4-mini",
+  openrouter: "openrouter/auto",
   deepseek: "deepseek-v4-flash",
   qwen: "qwen-plus",
   venice: "venice-uncensored-1-2",
@@ -983,6 +986,7 @@ function renderKeyStatus(status = lastKeyStatus) {
   if (!status) return;
   const providers = [
     ["OpenAI", status.openai],
+    ["OpenRouter", status.openrouter],
     ["DeepSeek", status.deepseek],
     ["Qwen", status.qwen],
     ["Venice", status.venice],
@@ -1009,7 +1013,7 @@ function renderKeyStatus(status = lastKeyStatus) {
       })
     );
   }
-  if (setupCardEl) setupCardEl.hidden = Boolean(status.openai || status.deepseek || status.qwen || status.venice);
+  if (setupCardEl) setupCardEl.hidden = Boolean(status.openai || status.openrouter || status.deepseek || status.qwen || status.venice);
 }
 
 function renderProjectStatus(info = projectInfo) {
@@ -1611,6 +1615,7 @@ function fieldValue(field) {
 const providerLabels = {
   deepseek: "DeepSeek",
   openai: "OpenAI",
+  openrouter: "OpenRouter",
   qwen: "Qwen",
   venice: "Venice",
   mock: "Mock local",
@@ -1634,14 +1639,14 @@ function setChoiceOptions(select, options, selectedValue = "", fallbackValue = "
 }
 
 function configuredTextProviders({ includeMock = true } = {}) {
-  const base = ["deepseek", "openai", "qwen", "venice"];
+  const base = ["deepseek", "openai", "openrouter", "qwen", "venice"];
   if (includeMock) base.push("mock");
   if (Object.keys(modelCatalog || {}).length === 0) return base;
   return base.filter((provider) => provider === "mock" || Array.isArray(modelCatalog[provider]));
 }
 
 function refreshProviderDropdowns() {
-  setChoiceOptions(setupProviderField, ["deepseek", "openai", "qwen", "venice", "grsai"], setupProviderField?.value || "deepseek", "deepseek");
+  setChoiceOptions(setupProviderField, ["deepseek", "openai", "openrouter", "qwen", "venice", "grsai"], setupProviderField?.value || "deepseek", "deepseek");
   setChoiceOptions(providerField, configuredTextProviders({ includeMock: true }), providerField?.value || "deepseek", "deepseek");
   setChoiceOptions(routeProviderField, configuredTextProviders({ includeMock: true }), routeProviderField?.value || "deepseek", "deepseek");
   setChoiceOptions(mainProviderField, configuredTextProviders({ includeMock: false }), mainProviderField?.value || "deepseek", "deepseek");
@@ -1856,17 +1861,19 @@ function renderModelRoles() {
       ...(modelRoles.route || {}),
       provider: routeProviderField?.value || modelRoles.route?.provider || "deepseek",
       model: routeModelField?.value || modelRoles.route?.model || "deepseek-v4-flash",
+      reasoning: routeReasoningField?.value ?? modelRoles.route?.reasoning ?? "",
     },
     main: {
       ...(modelRoles.main || {}),
       provider: mainProviderField?.value || modelRoles.main?.provider || "deepseek",
       model: mainModelField?.value || modelRoles.main?.model || "deepseek-v4-pro",
+      reasoning: mainReasoningField?.value ?? modelRoles.main?.reasoning ?? "",
     },
     spare: {
       ...(modelRoles.spare || {}),
       provider: spareProviderField?.value || modelRoles.spare?.provider || "openai",
       model: spareModelField?.value || modelRoles.spare?.model || "gpt-5.4",
-      reasoning: spareReasoningField?.value || modelRoles.spare?.reasoning || "medium",
+      reasoning: spareReasoningField?.value ?? modelRoles.spare?.reasoning ?? "medium",
     },
     wrapper: {
       ...(modelRoles.wrapper || {}),
@@ -1882,7 +1889,7 @@ function renderModelRoles() {
   };
   modelRoleGridEl.innerHTML = Object.values(roles)
     .map((role) => {
-      const reasoning = role.reasoning ? ` · ${role.reasoning}` : "";
+      const reasoning = role.reasoning ? ` · ${role.reasoning}` : role.reasoning === "" ? " · Provider default" : "";
       return `
         <div class="model-role-card">
           <strong>${escapeHtml(role.label || role.id)}</strong>
@@ -2074,11 +2081,13 @@ function formPayload() {
     model: fieldValue(modelField),
     routeProvider: routeProviderField?.value || "deepseek",
     routeModel: fieldValue(routeModelField) || "deepseek-v4-flash",
+    routeReasoning: routeReasoningField?.value ?? "",
     mainProvider: mainProviderField?.value || "deepseek",
     mainModel: fieldValue(mainModelField) || "deepseek-v4-pro",
+    mainReasoning: mainReasoningField?.value ?? "",
     spareProvider: spareProviderField?.value || "openai",
     spareModel: fieldValue(spareModelField) || "gpt-5.4",
-    spareReasoning: spareReasoningField?.value || "medium",
+    spareReasoning: spareReasoningField?.value ?? "medium",
     wrapperModel: fieldValue(wrapperModelField) || "gpt-5.5",
     wrapperReasoning: wrapperReasoningField?.value || "medium",
     auxiliaryProvider: auxiliaryProviderField?.value || "grsai",
@@ -3874,7 +3883,13 @@ deleteSessionButton.addEventListener("click", () => {
 });
 
 providerField.addEventListener("change", () => {
-  if (providerField.value === "mock" || providerField.value === "venice" || providerField.value === "openai" || providerField.value === "qwen") {
+  if (
+    providerField.value === "mock" ||
+    providerField.value === "venice" ||
+    providerField.value === "openai" ||
+    providerField.value === "openrouter" ||
+    providerField.value === "qwen"
+  ) {
     routingModeField.value = "manual";
   }
 
@@ -3909,7 +3924,7 @@ veniceModeToggle?.addEventListener("change", () => {
 });
 
 modelField.addEventListener("change", updateRoutingHint);
-[routeProviderField, routeModelField, mainProviderField, mainModelField, spareProviderField, spareModelField, spareReasoningField, wrapperModelField, wrapperReasoningField, auxiliaryProviderField, auxiliaryModelField]
+[routeProviderField, routeModelField, routeReasoningField, mainProviderField, mainModelField, mainReasoningField, spareProviderField, spareModelField, spareReasoningField, wrapperModelField, wrapperReasoningField, auxiliaryProviderField, auxiliaryModelField]
   .filter(Boolean)
   .forEach((field) => {
     field.addEventListener("input", () => {
@@ -4208,6 +4223,7 @@ async function loadConfig() {
   taskProfiles = data.taskProfiles || [];
   projectInfo = data.project || null;
   defaults.openai = data.defaults?.openai?.model || defaults.openai;
+  defaults.openrouter = data.defaults?.openrouter?.model || defaults.openrouter;
   defaults.qwen = data.defaults?.qwen?.model || defaults.qwen;
   defaults.venice = data.defaults?.venice?.model || defaults.venice;
   defaults.deepseek = routingPresets.fast?.model || data.defaults?.deepseek?.model || defaults.deepseek;
@@ -4220,9 +4236,11 @@ async function loadConfig() {
   routingModeField.value = prefs.routingMode || "smart";
   providerField.value = prefs.provider || "deepseek";
   if (routeProviderField) routeProviderField.value = prefs.routeProvider || modelRoles.route?.provider || "deepseek";
+  if (routeReasoningField) routeReasoningField.value = prefs.routeReasoning ?? modelRoles.route?.reasoning ?? "";
   if (mainProviderField) mainProviderField.value = prefs.mainProvider || modelRoles.main?.provider || "deepseek";
+  if (mainReasoningField) mainReasoningField.value = prefs.mainReasoning ?? modelRoles.main?.reasoning ?? "";
   if (spareProviderField) spareProviderField.value = prefs.spareProvider || modelRoles.spare?.provider || "openai";
-  if (spareReasoningField) spareReasoningField.value = prefs.spareReasoning || modelRoles.spare?.reasoning || "medium";
+  if (spareReasoningField) spareReasoningField.value = prefs.spareReasoning ?? modelRoles.spare?.reasoning ?? "medium";
   if (wrapperReasoningField) wrapperReasoningField.value = prefs.wrapperReasoning || modelRoles.wrapper?.reasoning || "medium";
   if (auxiliaryProviderField) auxiliaryProviderField.value = prefs.auxiliaryProvider || modelRoles.auxiliary?.provider || "grsai";
   setSelectOptions(

package/public/index.html

@@ -65,10 +65,10 @@
           <div>
             <strong data-i18n="setupTitle">Provider setup</strong>
             <p class="subtle" data-i18n="setupHelp">
-              DeepSeek/OpenAI/Qwen/Venice keys are missing. Use mock mode, export an env var, or save a project-local key.
+              DeepSeek/OpenAI/OpenRouter/Qwen/Venice keys are missing. Use mock mode, export an env var, or save a project-local key.
             </p>
             <p class="subtle" data-i18n="setupEnvHelp">
-              Env vars: DEEPSEEK_API_KEY, OPENAI_API_KEY, QWEN_API_KEY, VENICE_API_KEY, or LLM_API_KEY. Mock mode remains available for local tests.
+              Env vars: DEEPSEEK_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, QWEN_API_KEY, VENICE_API_KEY, or LLM_API_KEY. Mock mode remains available for local tests.
             </p>
             <p class="subtle key-links">
               <span data-i18n="setupKeyLinksLabel">Get keys:</span>
@@ -76,6 +76,8 @@
               <span aria-hidden="true">·</span>
               <a href="https://platform.openai.com/api-keys" target="_blank" rel="noreferrer" data-i18n="openaiKeyLink">OpenAI API keys</a>
               <span aria-hidden="true">·</span>
+              <a href="https://openrouter.ai/settings/keys" target="_blank" rel="noreferrer">OpenRouter API keys</a>
+              <span aria-hidden="true">·</span>
               <a href="https://venice.ai" target="_blank" rel="noreferrer">Venice API</a>
             </p>
           </div>
@@ -85,6 +87,7 @@
               <select id="setup-provider">
                 <option value="deepseek">DeepSeek</option>
                 <option value="openai">OpenAI</option>
+                <option value="openrouter">OpenRouter</option>
                 <option value="qwen">Qwen</option>
                 <option value="venice">Venice</option>
                 <option value="grsai">GRS AI image</option>
@@ -132,6 +135,7 @@
             <select id="provider" name="provider">
               <option value="deepseek">DeepSeek</option>
               <option value="openai">OpenAI</option>
+              <option value="openrouter">OpenRouter</option>
               <option value="qwen">Qwen</option>
               <option value="venice">Venice</option>
               <option value="mock" data-i18n="mockProviderOption">Mock local</option>
@@ -414,6 +418,7 @@
               <select id="routeProvider" name="routeProvider">
                 <option value="deepseek">DeepSeek</option>
                 <option value="openai">OpenAI</option>
+                <option value="openrouter">OpenRouter</option>
                 <option value="qwen">Qwen</option>
                 <option value="venice">Venice</option>
                 <option value="mock">Mock</option>
@@ -421,23 +426,41 @@
               <select id="routeModel" name="routeModel">
                 <option value="deepseek-v4-flash">DeepSeek v4 flash</option>
               </select>
+              <select id="routeReasoning" name="routeReasoning">
+                <option value="">Provider default</option>
+                <option value="minimal">minimal</option>
+                <option value="low">low</option>
+                <option value="medium">medium</option>
+                <option value="high">high</option>
+                <option value="xhigh">xhigh</option>
+              </select>
             </label>
             <label>
               <span>Main</span>
               <select id="mainProvider" name="mainProvider">
                 <option value="deepseek">DeepSeek</option>
                 <option value="openai">OpenAI</option>
+                <option value="openrouter">OpenRouter</option>
                 <option value="qwen">Qwen</option>
                 <option value="venice">Venice</option>
               </select>
               <select id="mainModel" name="mainModel">
                 <option value="deepseek-v4-pro">DeepSeek v4 pro</option>
               </select>
+              <select id="mainReasoning" name="mainReasoning">
+                <option value="">Provider default</option>
+                <option value="minimal">minimal</option>
+                <option value="low">low</option>
+                <option value="medium">medium</option>
+                <option value="high">high</option>
+                <option value="xhigh">xhigh</option>
+              </select>
             </label>
             <label>
               <span>Spare</span>
               <select id="spareProvider" name="spareProvider">
                 <option value="openai">OpenAI</option>
+                <option value="openrouter">OpenRouter</option>
                 <option value="deepseek">DeepSeek</option>
                 <option value="qwen">Qwen</option>
                 <option value="venice">Venice</option>
@@ -446,6 +469,8 @@
                 <option value="gpt-5.4">GPT-5.4</option>
               </select>
               <select id="spareReasoning" name="spareReasoning">
+                <option value="">Provider default</option>
+                <option value="minimal">minimal</option>
                 <option value="low">low</option>
                 <option value="medium">medium</option>
                 <option value="high">high</option>

package/references/agintiflow-npm-publication-memory.md

@@ -10,6 +10,28 @@ This note records the working publication route for AgInTiFlow so future release
 
 Latest verified release:
 
+- Version: `0.20.188`
+- Commit: `939e2ec`
+- GitHub Actions run: `https://github.com/lazyingart/AgInTiFlow/actions/runs/26705729544`
+- Workflow result: success
+- npm registry check: `npm view @lazyingart/agintiflow version dist-tags.latest --registry=https://registry.npmjs.org` returned `0.20.188`.
+- Installed verification: `npm install -g @lazyingart/agintiflow@0.20.188` then `aginti --version` returned `0.20.188`.
+- Webapp verification: `aginti webapp restart --port 3210` then `curl -fsS http://127.0.0.1:3210/health` returned `version":"0.20.188"` from the global npm package path.
+- OpenRouter verification: `/api/config` reports the OpenRouter default provider as `openrouter/auto` with base URL `https://openrouter.ai/api/v1`; `aginti keys status` reports `openrouter=missing` because no local OpenRouter key was persisted during release verification.
+
+Previous verified release:
+
+- Version: `0.20.187`
+- Commit: `9339b2e`
+- GitHub Actions run: `https://github.com/lazyingart/AgInTiFlow/actions/runs/26701125864`
+- Workflow result: success
+- npm registry check: `npm view @lazyingart/agintiflow version dist-tags.latest --registry=https://registry.npmjs.org` returned `0.20.187`.
+- Installed verification: `npm install -g @lazyingart/agintiflow@0.20.187` then `aginti --version` returned `0.20.187`.
+- Webapp verification: `aginti webapp restart --port 3210` then `curl -fsS http://127.0.0.1:3210/health` returned `version":"0.20.187"` from the global npm package path.
+- Workspace explorer verification: `POST /api/workspace/snapshot` returned no `.aginti/`, `.aginti-work/`, `.sessions/`, or `.env` entries for the project root.
+
+Previous verified release:
+
 - Version: `0.20.186`
 - Commit: `f32a748`
 - GitHub Actions run: `https://github.com/lazyingart/AgInTiFlow/actions/runs/26700782132`

package/references/lazyingrouter-account-login-design.md

@@ -0,0 +1,259 @@
+# LazyingRouter Account Login Design For AgInTiFlow
+
+Date: 2026-05-31
+
+Purpose: define the later-stage integration where a user logs into LazyingRouter once, authorizes AgInTiFlow, and then uses AgInTiFlow without pasting OpenAI, DeepSeek, OpenRouter, Venice, GRS AI, or other upstream provider keys.
+
+## Product Goal
+
+AgInTiFlow should support two credential modes:
+
+1. Direct provider keys for local power users and development.
+2. LazyingRouter account login for normal users.
+
+In LazyingRouter mode, the user pays LazyingRouter, LazyingRouter owns upstream provider keys, LazyingRouter checks balance and quota, and AgInTiFlow only stores one LazyingRouter-issued user token.
+
+The user-facing experience should be:
+
+```text
+aginti login lazyingrouter
+-> browser opens router.lazying.art
+-> user signs in or registers
+-> user authorizes "AgInTiFlow on this computer"
+-> AgInTiFlow stores an implicit LazyingRouter token
+-> AgInTiFlow runs with provider=lazyingrouter and model=lazying/auto
+```
+
+No user should need to understand upstream provider keys for the normal paid product path.
+
+## Current AgInTiFlow State
+
+AgInTiFlow is currently provider-key oriented.
+
+Relevant files:
+
+- `src/auth-onboarding.js`: defines `MAIN_AUTH_PROVIDERS`, normalizes auth provider names, and prompts for pasted provider keys.
+- `src/project.js`: stores direct provider keys in ignored `.aginti/.env` with local permission control.
+- `src/config.js`: picks the active provider from environment variables such as `DEEPSEEK_API_KEY`, `OPENAI_API_KEY`, `OPENROUTER_API_KEY`, `QWEN_API_KEY`, and `VENICE_API_KEY`.
+- `src/model-routing.js`: returns provider defaults for `deepseek`, `openai`, `openrouter`, `qwen`, `venice`, and `mock`.
+- `src/model-client.js`: creates an OpenAI SDK client from `apiKey` and `baseURL`.
+- `web.js`: exposes key status and provider-key save APIs, and has a provider allow-list in preference normalization.
+- `src/auxiliary-tools.js`: calls image providers directly through GRS AI and Venice keys.
+
+This is a good base because LazyingRouter can be added as another OpenAI-compatible provider. The missing part is account login and a LazyingRouter-issued token.
+
+## Current Key Flow
+
+The current direct-key flow is:
+
+1. User runs `aginti auth`, `aginti login <provider>`, or `aginti keys set <provider> --stdin`.
+2. AgInTiFlow asks the user to paste a provider API key.
+3. `setProviderKey()` writes that secret into project-local `.aginti/.env`.
+4. `resolveRuntimeConfig()` selects a provider and builds `{provider, apiKey, baseURL, model}`.
+5. `createClient()` sends requests through the OpenAI SDK.
+
+This flow should stay available. It is useful for development, private labs, and users who intentionally bring their own keys.
+
+## Proposed Minimal Design
+
+Add `lazyingrouter` as a first-class provider, but do not ask the user to paste any upstream key.
+
+Recommended environment shape:
+
+```env
+LAZYINGROUTER_API_KEY=
+LAZYINGROUTER_BASE_URL=https://router.lazying.art/v1
+LAZYINGROUTER_MODEL=lazying/auto
+LAZYINGROUTER_ACCOUNT_URL=https://router.lazying.art
+LAZYINGROUTER_TOKEN_ID=
+LAZYINGROUTER_USER_ID=
+```
+
+Only `LAZYINGROUTER_API_KEY` is secret. `TOKEN_ID` and `USER_ID` are useful for status, logout, and support but should not be treated as credentials.
+
+Provider defaults:
+
+```js
+{
+  provider: "lazyingrouter",
+  apiKey: process.env.LAZYINGROUTER_API_KEY || "",
+  baseURL: process.env.LAZYINGROUTER_BASE_URL || "https://router.lazying.art/v1",
+  model: process.env.LAZYINGROUTER_MODEL || process.env.LLM_MODEL || "lazying/auto"
+}
+```
+
+AgInTiFlow model routing should remain role-based. LazyingRouter is supply and billing. It should not redefine AgInTiFlow's route/main/spare/SCS semantics.
+
+## Account Authorization Flow
+
+Use a simple device authorization flow instead of asking the user to copy keys.
+
+1. User runs `aginti login lazyingrouter`, clicks "Login with LazyingRouter" in web settings, or starts AgInTiFlow with no direct provider key.
+2. AgInTiFlow generates or reuses a local install id and calls:
+
+```http
+POST https://router.lazying.art/api/app-auth/device/start
+Content-Type: application/json
+
+{
+  "app": "agintiflow",
+  "device_name": "hostname/project",
+  "scopes": ["chat", "models", "usage", "artifacts"],
+  "client_nonce": "random"
+}
+```
+
+3. LazyingRouter returns:
+
+```json
+{
+  "login_url": "https://router.lazying.art/app-auth/authorize?device_code=...",
+  "device_code": "opaque",
+  "user_code": "ABCD-EFGH",
+  "expires_at": 1790000000,
+  "poll_interval_seconds": 3
+}
+```
+
+4. AgInTiFlow opens or prints `login_url`.
+5. User signs into LazyingRouter, tops up if needed, and approves "AgInTiFlow on this computer".
+6. AgInTiFlow polls:
+
+```http
+POST https://router.lazying.art/api/app-auth/device/poll
+Content-Type: application/json
+
+{
+  "device_code": "opaque",
+  "client_nonce": "same-random"
+}
+```
+
+7. On approval, LazyingRouter returns the token once:
+
+```json
+{
+  "ok": true,
+  "api_base": "https://router.lazying.art/v1",
+  "api_key": "sk-...",
+  "model": "lazying/auto",
+  "token_id": 123,
+  "user_id": 456,
+  "display_name": "Lachlan",
+  "quota": {
+    "available": 123456,
+    "display": "$12.34",
+    "topup_url": "https://router.lazying.art/topup"
+  }
+}
+```
+
+8. AgInTiFlow stores the token locally with `0600` permissions and sets provider `lazyingrouter`.
+
+The token should be a normal LazyingRouter user token, visible and revocable in LazyingRouter. It should be named like `AgInTiFlow - <hostname>`.
+
+## Runtime And Quota Behavior
+
+AgInTiFlow should use LazyingRouter as the authority for billing and quota.
+
+Before a run:
+
+- If provider is `lazyingrouter`, call a lightweight status endpoint such as `/api/app-auth/status` or existing `/api/usage/token/`.
+- If no usable balance exists, stop before starting the model loop and print a top-up URL.
+- If the status endpoint is unreachable but the token exists, allow one normal model request unless the user has configured strict preflight.
+
+During a run:
+
+- LazyingRouter remains the hard enforcement layer.
+- If LazyingRouter returns `401`, mark the local token invalid and suggest `aginti login lazyingrouter`.
+- If it returns quota/balance errors, stop gracefully and show the LazyingRouter top-up URL.
+- Do not fall back to direct upstream keys unless the user explicitly configured fallback.
+
+After a run:
+
+- Show spent quota if LazyingRouter returned usage metadata.
+- Store token status evidence in the session log without storing the raw token.
+
+## Commands And UI
+
+CLI additions:
+
+```text
+aginti login lazyingrouter
+aginti logout lazyingrouter
+aginti keys status
+aginti provider lazyingrouter
+/login lazyingrouter
+/logout lazyingrouter
+/provider lazyingrouter
+/balance
+```
+
+Web additions:
+
+- Provider dropdown includes `LazyingRouter`.
+- Settings has "Login with LazyingRouter", "Balance", "Top up", "Revoke this device", and "Use direct provider keys instead".
+- Header status can show `provider=lazyingrouter`, `model=lazying/auto`, and a compact balance label.
+
+## Implementation Points In AgInTiFlow
+
+Add provider identity:
+
+- Add `lazyingrouter` to `MAIN_AUTH_PROVIDERS` in `src/auth-onboarding.js`.
+- Add aliases: `lazying`, `lzy`, `lazying-router`, `lazyingrouter`.
+- Add `LAZYINGROUTER_*` keys to `LOCAL_ENV_KEYS` and provider key candidates in `src/project.js`.
+- Add key status fields and preview masking in `providerKeyStatus()` and `providerKeyPreview()`.
+- Add a `getProviderDefaults("lazyingrouter")` branch in `src/model-routing.js`.
+- Update `resolveRuntimeConfig()` in `src/config.js` to choose LazyingRouter when `LAZYINGROUTER_API_KEY` exists.
+- Update web preference allow-lists in `web.js`.
+- Add command and interactive handlers for login/logout/status.
+
+Do not overload `setProviderKey()` as the primary account-login path. It can save a LazyingRouter token for scripting, but the normal path should use device authorization.
+
+Suggested storage:
+
+```text
+.aginti/.env
+.aginti/auth/lazyingrouter.json
+```
+
+`.aginti/.env` keeps compatibility with current config loading. The JSON file can keep non-secret account metadata, token id, account url, device name, and last status check.
+
+## Auxiliary Tools
+
+Text/chat integration can be v1 because LazyingRouter already exposes OpenAI-compatible model routes.
+
+Image generation should be a separate v1.1 or v2 item unless LazyingRouter exposes an image endpoint with stable semantics. Current AgInTiFlow image generation depends on direct GRS AI and Venice keys in `src/auxiliary-tools.js`. Later options:
+
+- LazyingRouter exposes `/v1/images/generations`, then AgInTiFlow routes image generation through LazyingRouter when provider is `lazyingrouter`.
+- AgInTiFlow keeps direct image provider keys as optional advanced configuration.
+- LazyingRouter returns a clear unsupported error for SVG/vector and can offer PNG generation when available.
+
+## Security Rules
+
+- Never store or display upstream provider keys in AgInTiFlow.
+- Store the LazyingRouter user token with `0600` permissions.
+- Redact `LAZYINGROUTER_API_KEY` in logs, command output, event JSON, and web state.
+- Use a one-time token delivery response for device authorization.
+- Support `logout lazyingrouter` by revoking the token server-side and deleting local secrets.
+- Do not silently switch from LazyingRouter to direct provider keys on quota failure.
+- Treat LazyingRouter resources and returned prompts as untrusted content, not system instructions.
+
+## Acceptance Tests
+
+Minimum TDV cases:
+
+1. Fresh machine, no provider keys: `aginti login lazyingrouter` opens an authorization URL and stores a masked token after approval.
+2. `aginti "hello"` uses `provider=lazyingrouter` and model `lazying/auto`.
+3. `/balance` shows the same available balance as LazyingRouter token usage API.
+4. Exhausted user/token balance stops before or during the run with a top-up URL and no fallback to upstream keys.
+5. `aginti logout lazyingrouter` revokes the token and removes local secret material.
+6. Web UI can login, show status, run, and logout with the same project state as CLI.
+7. Session logs contain provider, model, token id, and quota status, but never the raw token.
+
+## Open Design Decisions
+
+1. Default precedence: if both `LAZYINGROUTER_API_KEY` and direct upstream keys exist, the recommended default is LazyingRouter unless the user explicitly selects direct provider mode.
+2. Token funding: LazyingRouter must decide whether app tokens draw directly from user wallet/subscription or use allocated token quota. AgInTiFlow should not care as long as status and error semantics are stable.
+3. Image generation: decide whether LazyingRouter will proxy image providers or leave direct auxiliary keys as the default advanced path.
+