@lazyingart/agintiflow 0.20.190 → 0.20.192

package/README.md

@@ -85,7 +85,7 @@ aginti init --template aaps
 aginti init --template supervision
 ```
 
-On first interactive use, AgInTiFlow opens an auth wizard if no main model key is found. Pick DeepSeek, OpenAI, OpenRouter, Qwen, or Venice, paste the key, and it saves to the ignored project-local `.aginti/.env` file with restricted permissions. You can rerun setup any time:
+On first interactive use, AgInTiFlow opens an auth wizard if no main model key is found. Pick DeepSeek, OpenAI, OpenRouter, Qwen, or Venice, paste the key, and it saves account-wide to `~/.agintiflow/.env` with restricted permissions. Current project `.aginti/.env` files can still override account defaults when needed. You can rerun setup any time:
 
 ```bash
 aginti auth
@@ -93,6 +93,7 @@ aginti auth deepseek
 aginti auth openrouter
 aginti auth venice
 aginti login grsai
+aginti auth --project openai   # project override in .aginti/.env
 ```
 
 Provider signup and key pages:
@@ -328,9 +329,10 @@ AgInTiFlow stores canonical sessions centrally and keeps only project-local poin
 
 | Location | Purpose |
 | --- | --- |
+| `~/.agintiflow/.env` | Account-wide provider keys usable from any project. Local to the user account. |
 | `~/.agintiflow/sessions/<session-id>/` | Canonical state, events, browser state, artifacts, snapshots, canvas files. |
 | `<project>/.aginti-sessions/` | Project-local session pointers and web UI database. Ignored by git. |
-| `<project>/.aginti/.env` | Optional project-local API keys with restricted permissions. Ignored by git. |
+| `<project>/.aginti/.env` | Optional project-local API key overrides with restricted permissions. Ignored by git. |
 | `<project>/AGINTI.md` | Editable project instructions and durable local preferences. Safe to commit if it contains no secrets. |
 
 Safety defaults:
@@ -366,13 +368,14 @@ PACKAGE_INSTALL_POLICY=allow
 COMMAND_CWD=/path/to/project
 ```
 
-Project-local keys:
+Account-wide keys:
 
 ```bash
 aginti init
 printf '%s' "$DEEPSEEK_API_KEY" | aginti keys set deepseek --stdin
 printf '%s' "$OPENROUTER_API_KEY" | aginti keys set openrouter --stdin
 printf '%s' "$VENICE_API_KEY" | aginti keys set venice --stdin
+printf '%s' "$OPENAI_API_KEY" | aginti keys set --project openai --stdin  # optional project override
 ```
 
 More detail:

package/docs/auxiliary-image-generation.md

@@ -13,7 +13,7 @@ editable vectors, use AgInTiFlow file tools to write deterministic SVG/LaTeX/HTM
 
 ## Setup
 
-Store a GRS AI or Venice key project-locally:
+Store a GRS AI or Venice image key account-wide:
 
 ```bash
 aginti login grsai
@@ -21,6 +21,7 @@ aginti login venice
 # or
 printf '%s' "$GRSAI" | aginti keys set grsai --stdin
 printf '%s' "$VENICE_API_KEY" | aginti keys set venice --stdin
+printf '%s' "$VENICE_API_KEY" | aginti keys set --project venice --stdin  # optional project override
 ```
 
 Inside interactive chat, use either spelling:
@@ -29,7 +30,7 @@ Inside interactive chat, use either spelling:
 /auxiliary grsai
 ```
 
-Keys are saved in `.aginti/.env` as `GRSAI` or `VENICE_API_KEY` with `0600` permissions. The CLI and web app only report whether a key exists; they never return raw values.
+Keys are saved in `~/.agintiflow/.env` by default as `GRSAI` or `VENICE_API_KEY` with `0600` permissions. Project `.aginti/.env` can override them. The CLI and web app only report whether a key exists; they never return raw values.
 
 ## Runtime Flow
 

package/docs/model-selection.md

@@ -133,7 +133,7 @@ It keeps smart routing enabled. If the Venice key is missing, run `/auth venice`
 
 ## Keys
 
-Keys are set per project and stored only in ignored `.aginti/.env`:
+Keys are saved account-wide in `~/.agintiflow/.env` by default. Use `--project` only when the current project needs an override in ignored `.aginti/.env`:
 
 ```bash
 aginti auth
@@ -142,6 +142,7 @@ aginti auth venice
 aginti keys status
 printf '%s' "$OPENROUTER_API_KEY" | aginti keys set openrouter --stdin
 printf '%s' "$VENICE_API_KEY" | aginti keys set venice --stdin
+printf '%s' "$OPENAI_API_KEY" | aginti keys set --project openai --stdin
 ```
 
 The web UI mirrors the same roles with dropdowns. Keep the left panel for daily controls: routing policy, provider/model, profile, goal, workspace, sandbox, and common tools. Use **Advanced settings** for model roles, browser start URL, wrapper/scout settings, Docker image, password/destructive toggles, and auxiliary image models. Runtime logs stay in the right column, followed by wrapper, workspace, and sandbox capability panels.

package/docs/real-deepseek-capabilities.md

@@ -6,7 +6,7 @@ AgInTiFlow keeps deterministic mock smoke tests for CI, but Round 9 added an opt
 
 - Node.js 22+
 - A project folder initialized with `aginti init`
-- `DEEPSEEK_API_KEY` in the environment or project-local `.aginti/.env`
+- `DEEPSEEK_API_KEY` in the environment, account `~/.agintiflow/.env`, or project-local `.aginti/.env`
 - Optional web UI running from the same project folder
 
 Never print or commit API keys. The suite reports only provider availability.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.190",
+  "version": "0.20.192",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/public/app.js

@@ -22,17 +22,17 @@ const translations = {
     projectStatusTitle: "Project folder",
     setupTitle: "Provider setup",
     setupHelp:
-      "DeepSeek/OpenAI/Qwen/Venice keys are missing. Use mock mode, export an env var, or save a project-local model key.",
+      "DeepSeek/OpenAI/Qwen/Venice keys are missing. Use mock mode, export an env var, or save an account-wide model key.",
     setupEnvHelp:
-      "Env vars: DEEPSEEK_API_KEY, OPENAI_API_KEY, QWEN_API_KEY, VENICE_API_KEY, LLM_API_KEY, and optional GRSAI for image generation. Mock mode remains available for local tests.",
+      "Env vars: DEEPSEEK_API_KEY, OPENAI_API_KEY, QWEN_API_KEY, VENICE_API_KEY, LLM_API_KEY, and optional GRSAI/VENICE_API_KEY for image generation. Saved keys live in ~/.agintiflow/.env; project .aginti/.env can override.",
     setupKeyLinksLabel: "Get keys:",
     deepseekKeyLink: "DeepSeek API keys",
     openaiKeyLink: "OpenAI API keys",
     setupProviderLabel: "Provider",
     setupKeyLabel: "API key",
-    saveKeyButton: "Save local key",
-    keySavedStatus: "Local key saved. Raw values are never returned by the API.",
-    keySaveFailed: "Failed to save local key.",
+    saveKeyButton: "Save account key",
+    keySavedStatus: "Account key saved. Raw values are never returned by the API.",
+    keySaveFailed: "Failed to save account key.",
     taskProfileLabel: "Task profile",
     routingModeLabel: "Routing policy",
     routingSmartOption: "Smart: flash/pro/wrappers",

package/references/agintiflow-npm-publication-memory.md

@@ -10,6 +10,17 @@ This note records the working publication route for AgInTiFlow so future release
 
 Latest verified release:
 
+- Version: `0.20.190`
+- Commit: `f192f8e`
+- GitHub Actions run: `https://github.com/lazyingart/AgInTiFlow/actions/runs/26736284533`
+- Workflow result: success
+- npm registry check: `npm view @lazyingart/agintiflow version dist-tags.latest --registry=https://registry.npmjs.org` returned `0.20.190`.
+- Installed verification: `npm install -g @lazyingart/agintiflow@0.20.190` then `aginti --version` returned `0.20.190`.
+- Webapp verification: `aginti webapp restart --port 3210` then `curl -fsS http://127.0.0.1:3210/health` returned `version":"0.20.190"` from the global npm package path.
+- Feature verification: `aginti --provider mock --routing manual --model mock-agent --no-shell --allow-file-tools --scs off "hello"` returned a direct greeting and did not create `hello.py`.
+
+Previous verified release:
+
 - Version: `0.20.189`
 - Commit: `0095284`
 - GitHub Actions run: `https://github.com/lazyingart/AgInTiFlow/actions/runs/26734901522`

package/references/lazyedit-publish-skill-installation-2026-06-03.md

@@ -0,0 +1,88 @@
+# LazyEdit Publish Skill Installation
+
+Date: 2026-06-03
+
+## Installed Skill
+
+Skill id:
+
+- `lazyedit-publish-workflow`
+
+Source skill:
+
+- `/home/lachlan/.codex/skills/lazyedit-publish-workflow/SKILL.md`
+
+AgInTiFlow project-local copy:
+
+- `/home/lachlan/ProjectsLFS/Agent/AgInTiFlow/.aginti/skills/lazyedit-publish-workflow/SKILL.md`
+
+Global AgInTiFlow custom copy:
+
+- Skill Mesh storage under `/home/lachlan/.agintiflow/skillmesh/skills/lazyedit-publish-workflow/`
+- Installed as a local-reviewed enabled Skill Mesh skill.
+
+## Why Both Copies Exist
+
+The project-local `.aginti/skills/` copy documents the skill in the AgInTiFlow repository and lets local development sessions load it as `source=project-local`.
+
+The Skill Mesh copy makes the same skill available from other working directories such as LALACHAN, RARACHAN, LazyEdit, or Agent without requiring the user to start AgInTiFlow from the AgInTiFlow repo.
+
+## Verification
+
+Project-local loader:
+
+```bash
+node -e "import { listSkills, selectSkillsForGoal } from './src/skill-library.js'; const skill=listSkills({projectRoot:process.cwd(), includeBody:true}).find(s=>s.id==='lazyedit-publish-workflow'); if(!skill) throw new Error('missing'); console.log(skill.source);"
+```
+
+Expected result:
+
+```text
+project-local
+```
+
+Global Skill Mesh install:
+
+```bash
+node bin/aginti-cli.js skillmesh export lazyedit-publish-workflow --out /tmp/lazyedit-publish-workflow.skillpack.json
+node bin/aginti-cli.js skillmesh import /tmp/lazyedit-publish-workflow.skillpack.json --enable
+node bin/aginti-cli.js skillmesh status
+```
+
+Expected result includes:
+
+```text
+enabled  lazyedit-publish-workflow: LazyEdit Publish Workflow
+```
+
+Cross-directory discovery:
+
+```bash
+cd /home/lachlan/ProjectsLFS/Agent
+aginti skills lazyedit
+
+cd /home/lachlan/ProjectsLFS/LALACHAN
+node /home/lachlan/ProjectsLFS/Agent/AgInTiFlow/bin/aginti-cli.js skills lazyedit
+```
+
+Expected result:
+
+```text
+lazyedit-publish-workflow ... source=skillmesh
+```
+
+Selection check:
+
+```bash
+node -e "import { selectSkillsForGoal } from '/home/lachlan/ProjectsLFS/Agent/AgInTiFlow/src/skill-library.js'; const selected=selectSkillsForGoal('publish latest LALACHAN generated video through LazyEdit to Shipinhao YouTube Instagram with corrected subtitles', {projectRoot:'/home/lachlan/ProjectsLFS/LALACHAN', includeBody:true}).map(s=>s.id); console.log(selected); if(!selected.includes('lazyedit-publish-workflow')) throw new Error('not selected');"
+```
+
+Expected result:
+
+- `lazyedit-publish-workflow` appears in the selected skill list.
+
+## Operational Notes
+
+The skill is prompt guidance, not a privileged tool. LazyEdit publishing still runs through normal AgInTiFlow permission policy and shell/tmux safeguards.
+
+The subtitle correction rule is preserved: generated video scripts/stories are reference context for correcting ASR recognition errors, not verbatim targets. The agent should compare ASR output against the script, infer intended wording, preserve timing/line structure, and avoid blindly copying script text when the audio differs.

package/references/paper-revision-skill-installation-2026-06-03.md

@@ -0,0 +1,62 @@
+# Paper Revision Skill Installation
+
+Date: 2026-06-03
+
+Source repository:
+
+- `/home/lachlan/ProjectsLFS/paper-revision-skill`
+- `https://github.com/lachlanchen/paper-revision-skill`
+
+Purpose:
+
+- Add plan-gated academic manuscript revision as a reusable skill.
+- Keep manuscript-specific revision policy in the skill, not in AgInTiFlow core.
+- Let Codex, AgInTiFlow, Claude, Gemini, and Copilot consume the same workflow guidance with tool-specific entry files.
+
+AgInTiFlow integration:
+
+- The repository's root `SKILL.md` is Codex-style and uses `name:` plus `description:`.
+- AgInTiFlow SkillMesh now accepts that dialect by normalizing `name:` to native `id:` and deriving `label:` when missing.
+- Install the root `SKILL.md` as a reviewed local SkillMesh skill and enable it.
+
+Suggested install command from the AgInTiFlow repository:
+
+```bash
+node --input-type=module - <<'NODE'
+import fs from "node:fs/promises";
+import {
+  buildSkillPackFromMarkdown,
+  enableSkillMeshSkill,
+  installSkillPack,
+} from "./src/skillmesh.js";
+
+const content = await fs.readFile("/home/lachlan/ProjectsLFS/paper-revision-skill/SKILL.md", "utf8");
+const pack = await buildSkillPackFromMarkdown(content, { valueScore: 95 });
+await installSkillPack(pack, { enabled: true });
+await enableSkillMeshSkill("paper-revision-skill", true);
+console.log(JSON.stringify({ ok: true, installedSkills: pack.skills.map((skill) => skill.id), packHash: pack.packHash }, null, 2));
+NODE
+```
+
+Validation:
+
+```bash
+node scripts/smoke-skillmesh.js
+node --input-type=module - <<'NODE'
+import { selectSkillsForGoal } from "./src/skill-library.js";
+const selected = selectSkillsForGoal(
+  "Use the paper revision workflow to answer reviewer comments before editing LaTeX.",
+  { limit: 8, includeBody: false }
+);
+console.log(JSON.stringify(selected.map((skill) => ({ id: skill.id, source: skill.source })), null, 2));
+if (!selected.some((skill) => skill.id === "paper-revision-skill")) {
+  throw new Error("paper-revision-skill was not selected");
+}
+NODE
+```
+
+Boundary:
+
+- Do not move manuscript-revision details into AgInTiFlow core.
+- Improve AgInTiFlow core only when the issue is general skill compatibility, skill discovery, SkillMesh validation, evidence tracking, PDF/build tooling, or tool invocation reliability.
+- Keep the skill's plan-first, edit-second, PDF-verified revision workflow in the skill repository.

package/scripts/real-deepseek-capabilities.js

@@ -223,7 +223,7 @@ if (!keyStatus.deepseek) {
       {
         ok: false,
         skipped: true,
-        reason: "DeepSeek key is not available by env or project-local .aginti/.env.",
+        reason: "DeepSeek key is not available by env, account ~/.agintiflow/.env, or project-local .aginti/.env.",
       },
       null,
       2

package/scripts/smoke-auth.js

@@ -21,7 +21,9 @@ const envKeys = [
   "GRSAI_API_KEY",
 ];
 const originalEnv = Object.fromEntries(envKeys.map((key) => [key, process.env[key]]));
+const originalAgintiflowHome = process.env.AGINTIFLOW_HOME;
 for (const key of envKeys) delete process.env[key];
+process.env.AGINTIFLOW_HOME = path.join(tempRoot, ".agintiflow-home");
 
 function assert(condition, message) {
   if (!condition) throw new Error(message);
@@ -85,18 +87,32 @@ try {
   const veniceDefaults = getProviderDefaults("venice");
   assert(veniceDefaults.provider === "venice" && veniceDefaults.model === "venice-uncensored-1-2", "venice provider defaults are not available");
 
+  const projectOnlyRoot = path.join(tempRoot, "project-only");
+  await fs.mkdir(path.join(projectOnlyRoot, ".aginti"), { recursive: true });
+  await fs.writeFile(path.join(projectOnlyRoot, ".aginti", ".env"), 'OPENAI_API_KEY="project-only-openai-key"\n', "utf8");
+  let projectOnlyStatus = providerKeyStatus(projectOnlyRoot);
+  assert(projectOnlyStatus.openai && projectOnlyStatus.projectEnv, "project-only key was not loaded");
+  await fs.access(path.join(tempRoot, ".agintiflow-home", ".env"))
+    .then(() => {
+      throw new Error("project-only key was incorrectly promoted into account-wide env");
+    })
+    .catch((error) => {
+      if (error?.code !== "ENOENT") throw error;
+    });
+  delete process.env.OPENAI_API_KEY;
+
   process.env.DEEPSEEK_API_KEY = "ambient-deepseek-key";
   process.env.OPENROUTER_API_KEY = "ambient-openrouter-key";
   process.env.VENICE_API_KEY = "ambient-venice-key";
   process.env.GRSAI_API_KEY = "ambient-grsai-key";
   let status = providerKeyStatus(tempRoot);
   assert(status.deepseek && status.openrouter && status.venice && status.grsai, "ambient provider keys were not detected");
-  assert(status.localEnv, "ambient provider keys were not persisted into local .aginti/.env");
-  const localEnv = await fs.readFile(path.join(tempRoot, ".aginti", ".env"), "utf8");
-  assert(localEnv.includes("DEEPSEEK_API_KEY="), "ambient DeepSeek key was not saved locally");
-  assert(localEnv.includes("OPENROUTER_API_KEY="), "ambient OpenRouter key was not saved locally");
-  assert(localEnv.includes("VENICE_API_KEY="), "ambient Venice key was not saved locally");
-  assert(localEnv.includes("GRSAI_API_KEY="), "ambient GRS AI key was not saved locally");
+  assert(status.globalEnv, "ambient provider keys were not persisted into account-wide ~/.agintiflow/.env");
+  const globalEnv = await fs.readFile(path.join(tempRoot, ".agintiflow-home", ".env"), "utf8");
+  assert(globalEnv.includes("DEEPSEEK_API_KEY="), "ambient DeepSeek key was not saved globally");
+  assert(globalEnv.includes("OPENROUTER_API_KEY="), "ambient OpenRouter key was not saved globally");
+  assert(globalEnv.includes("VENICE_API_KEY="), "ambient Venice key was not saved globally");
+  assert(globalEnv.includes("GRSAI_API_KEY="), "ambient GRS AI key was not saved globally");
   delete process.env.DEEPSEEK_API_KEY;
   delete process.env.OPENROUTER_API_KEY;
   delete process.env.VENICE_API_KEY;
@@ -126,8 +142,12 @@ try {
 
   await runCli(["keys", "set", "openai", "--stdin"], "test-openai-key");
   await runCli(["keys", "set", "grsai", "--stdin"], "test-grsai-key");
+  await runCli(["keys", "set", "--project", "deepseek", "--stdin"], "project-deepseek-key");
   status = providerKeyStatus(tempRoot);
-  assert(status.openai && status.openrouter && status.grsai && status.qwen && status.venice, "stored auth keys were not detected");
+  assert(status.openai && status.openrouter && status.grsai && status.qwen && status.venice && status.deepseek, "stored auth keys were not detected");
+  assert(status.projectEnv, "project-scoped key was not recorded as project env");
+  const projectEnv = await fs.readFile(path.join(tempRoot, ".aginti", ".env"), "utf8");
+  assert(projectEnv.includes("DEEPSEEK_API_KEY="), "project-scoped DeepSeek key was not saved in .aginti/.env");
   const openaiPreview = providerKeyPreview(tempRoot, "openai");
   assert(openaiPreview.preview === "test…-key (15 chars)", "openai key preview was not masked correctly");
   assert(openaiPreview.preview !== "test-openai-key", "openai key preview leaked raw key");
@@ -136,6 +156,8 @@ try {
   assert(keysOutput.includes("openrouter=available"), "keys status did not include openrouter");
   assert(keysOutput.includes("qwen=available"), "keys status did not include qwen");
   assert(keysOutput.includes("venice=available"), "keys status did not include venice");
+  assert(keysOutput.includes("globalEnv=yes"), "keys status did not show global env");
+  assert(keysOutput.includes("projectEnv=yes"), "keys status did not show project env");
   assert(
     !keysOutput.includes("test-openai-key") &&
       !keysOutput.includes("test-openrouter-key") &&
@@ -157,7 +179,9 @@ try {
           "qwen-defaults",
           "openrouter-defaults",
           "venice-defaults",
-          "ambient-key-autopersist",
+          "project-key-not-auto-promoted",
+          "ambient-key-global-autopersist",
+          "project-key-override",
           "qwen-key-status",
           "openrouter-key-status",
           "venice-key-status",
@@ -173,5 +197,7 @@ try {
     if (originalEnv[key] === undefined) delete process.env[key];
     else process.env[key] = originalEnv[key];
   }
+  if (originalAgintiflowHome === undefined) delete process.env.AGINTIFLOW_HOME;
+  else process.env.AGINTIFLOW_HOME = originalAgintiflowHome;
   await fs.rm(tempRoot, { recursive: true, force: true });
 }

package/scripts/smoke-auxiliary-tools.js

@@ -14,7 +14,18 @@ import { SessionStore } from "../src/session-store.js";
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const execFile = promisify(execFileCallback);
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-auxiliary-"));
+const originalImageEnv = {
+  AGINTIFLOW_HOME: process.env.AGINTIFLOW_HOME,
+  GRSAI: process.env.GRSAI,
+  GRSAI_API_KEY: process.env.GRSAI_API_KEY,
+  VENICE_API_KEY: process.env.VENICE_API_KEY,
+  AGINTI_AUX_PROVIDER: process.env.AGINTI_AUX_PROVIDER,
+};
 process.env.AGINTIFLOW_HOME = path.join(tempRoot, ".agintiflow-home");
+delete process.env.GRSAI;
+delete process.env.GRSAI_API_KEY;
+delete process.env.VENICE_API_KEY;
+delete process.env.AGINTI_AUX_PROVIDER;
 const runtimeDir = path.join(tempRoot, "runtime");
 const workspace = path.join(tempRoot, "workspace");
 await fs.mkdir(workspace, { recursive: true });
@@ -24,8 +35,21 @@ function assert(condition, message) {
 }
 
 try {
-  await setProviderKey(workspace, "grsai", "test-grsai-key");
   await setProviderKey(workspace, "venice", "test-venice-key");
+  const autoVeniceDryRun = await generateImage(
+    {
+      prompt: "A small cyan robot holding a paintbrush, clean bright product illustration.",
+      outputDir: "artifacts/images/auto-venice-dry-run",
+      outputStem: "robot",
+      dryRun: true,
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(autoVeniceDryRun.ok && autoVeniceDryRun.provider === "venice", "generate_image did not auto-select Venice when only Venice image key was available");
+  await setProviderKey(workspace, "grsai", "test-grsai-key");
   const keyStatus = providerKeyStatus(workspace);
   assert(keyStatus.grsai, "GRSAI key status was not detected");
   assert(keyStatus.venice, "Venice key status was not detected");
@@ -163,6 +187,7 @@ try {
           "image_skill_listed",
           "venice_image_skill_listed",
           "generate_image_dry_run",
+          "auto_venice_when_grsai_missing",
           "venice_generate_image_dry_run",
           "svg_request_png_fallback",
           "direct_image_cli_svg_request_png_fallback",
@@ -175,5 +200,9 @@ try {
     )
   );
 } finally {
+  for (const [key, value] of Object.entries(originalImageEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
   await fs.rm(tempRoot, { recursive: true, force: true });
 }

package/scripts/smoke-skillmesh.js

@@ -64,6 +64,28 @@ assert(!listSkills({ includeBody: false }).some((skill) => skill.id === "mesh-an
 await setSkillMeshMode("share");
 const config = await loadSkillMeshConfig();
 assert(config.mode === "share", "share mode should persist");
+
+const codexStyleMarkdown = [
+  "---",
+  "name: paper-revision-skill",
+  "description: Plan-gated academic manuscript revision workflow for LaTeX papers, reviewer responses, proof corrections, redlines, PDF-backed audits, and submission packaging.",
+  "---",
+  "",
+  "Plan first, edit second, verify from compiled PDFs, and keep revision evidence under references/.",
+  "",
+].join("\n");
+const codexPack = await buildSkillPackFromMarkdown(codexStyleMarkdown, { valueScore: 90 });
+assert(codexPack.skills[0].id === "paper-revision-skill", "Codex-style name should become SkillMesh id");
+assert(codexPack.skills[0].content.includes("id: paper-revision-skill"), "Codex-style skill should be normalized with id");
+assert(codexPack.skills[0].content.includes("label: Paper Revision Skill"), "Codex-style skill should receive a label");
+await installSkillPack(codexPack, { enabled: true });
+assert(
+  selectSkillsForGoal("use the paper revision workflow to answer reviewer comments before editing latex", { limit: 8 }).some(
+    (skill) => skill.id === "paper-revision-skill"
+  ),
+  "Codex-style imported skill should be selectable"
+);
+
 const serviceUnit = buildSkillMeshServiceUnit({
   dataDir: path.join(tempRoot, "relay-service"),
   runScript: path.join(tempRoot, "relay-service", "aginti-skill-relay.run.sh"),
@@ -120,6 +142,7 @@ console.log(
         "metadata-sync",
         "soft-unreachable-node",
         "systemd-service-unit",
+        "codex-style-skill-import",
       ],
     },
     null,

package/src/auth-onboarding.js

@@ -420,7 +420,7 @@ export async function promptAndSaveDeepSeekKey(projectRoot = process.cwd(), opti
   );
   if (!key) return { saved: false, skipped: true };
 
-  const result = await setProviderKey(projectRoot, "deepseek", key);
+  const result = await setProviderKey(projectRoot, "deepseek", key, { scope: options.scope || "global" });
   return {
     saved: true,
     provider: result.provider,
@@ -431,6 +431,8 @@ export async function promptAndSaveDeepSeekKey(projectRoot = process.cwd(), opti
 
 export async function runAuthWizard(projectRoot = process.cwd(), options = {}) {
   const status = providerKeyStatus(projectRoot);
+  const scope = ["project", "local"].includes(String(options.scope || "").toLowerCase()) ? "project" : "global";
+  const scopeLabel = scope === "project" ? "project .aginti/.env" : "account ~/.agintiflow/.env";
   const initialProvider = normalizeAuthProvider(options.provider || options.initialProvider || "deepseek", "deepseek");
   const directProvider =
     options.provider && ["deepseek", "openai", "openrouter", "qwen", "venice", "grsai"].includes(normalizeAuthProvider(options.provider, ""))
@@ -454,7 +456,7 @@ export async function runAuthWizard(projectRoot = process.cwd(), options = {}) {
     const current = preview.available ? `available: ${preview.preview}` : "missing";
     const keyHelp = authProviderKeyHelp(mainProvider);
     const title = `${providerLabel(mainProvider)} main API key`;
-    const prompt = `${keyHelp ? `${keyHelp}\n` : ""}${title} (${current}) [hidden]: `;
+    const prompt = `${keyHelp ? `${keyHelp}\n` : ""}${title} (${current}) [hidden, saves to ${scopeLabel}]: `;
     const secret = await promptSecret(prompt, {
       allowEscape: true,
       box: {
@@ -463,12 +465,12 @@ export async function runAuthWizard(projectRoot = process.cwd(), options = {}) {
         statusText: preview.available ? `Existing ${preview.keyName}: ${preview.preview}` : `Missing ${preview.keyName || "provider key"}`,
         currentPreview: preview.preview,
         actionText: preview.available
-          ? "Existing key is selected. Type to replace, Enter/Esc to keep existing."
-          : "Paste key and Enter to save, or Esc/Enter to skip.",
+          ? `Existing key is selected. Type to replace in ${scopeLabel}, Enter/Esc to keep existing.`
+          : `Paste key and Enter to save to ${scopeLabel}, or Esc/Enter to skip.`,
       },
     });
     if (secret.value) {
-      const result = await setProviderKey(projectRoot, mainProvider, secret.value);
+      const result = await setProviderKey(projectRoot, mainProvider, secret.value, { scope });
       saved.push(result);
     } else {
       skipped.push({ provider: mainProvider, reason: secret.skipped ? "skipped" : "empty" });
@@ -481,18 +483,18 @@ export async function runAuthWizard(projectRoot = process.cwd(), options = {}) {
     const preview = providerKeyPreview(projectRoot, "grsai");
     const current = preview.available ? `available: ${preview.preview}` : "optional";
     const title = `${AUXILIARY_AUTH_PROVIDER.label} auxiliary image key`;
-    const secret = await promptSecret(`${title} (${current}) [hidden]: `, {
+    const secret = await promptSecret(`${title} (${current}) [hidden, saves to ${scopeLabel}]: `, {
       allowEscape: true,
       box: {
         title,
         helpText: "Optional image generation key for GRS AI / Nano Banana.",
         statusText: preview.available ? `Existing ${preview.keyName}: ${preview.preview}` : "Optional; no auxiliary key saved.",
         currentPreview: preview.preview,
-        actionText: preview.available ? "Existing key is selected. Type to replace, Enter/Esc to keep existing." : "Paste key and Enter to save, or Esc/Enter to skip.",
+        actionText: preview.available ? `Existing key is selected. Type to replace in ${scopeLabel}, Enter/Esc to keep existing.` : `Paste key and Enter to save to ${scopeLabel}, or Esc/Enter to skip.`,
       },
     });
     if (secret.value) {
-      const result = await setProviderKey(projectRoot, "grsai", secret.value);
+      const result = await setProviderKey(projectRoot, "grsai", secret.value, { scope });
       saved.push(result);
     } else {
       skipped.push({ provider: "grsai", reason: "skipped" });
@@ -500,17 +502,17 @@ export async function runAuthWizard(projectRoot = process.cwd(), options = {}) {
   } else if (directProvider === "grsai") {
     const preview = providerKeyPreview(projectRoot, "grsai");
     const title = `${AUXILIARY_AUTH_PROVIDER.label} auxiliary image key`;
-    const secret = await promptSecret(`${title} [hidden]: `, {
+    const secret = await promptSecret(`${title} [hidden, saves to ${scopeLabel}]: `, {
       allowEscape: true,
       box: {
         title,
         helpText: "Optional image generation key for GRS AI / Nano Banana.",
         statusText: preview.available ? `Existing ${preview.keyName}: ${preview.preview}` : "Missing auxiliary key.",
         currentPreview: preview.preview,
-        actionText: preview.available ? "Existing key is selected. Type to replace, Enter/Esc to keep existing." : "Paste key and Enter to save, or Esc/Enter to skip.",
+        actionText: preview.available ? `Existing key is selected. Type to replace in ${scopeLabel}, Enter/Esc to keep existing.` : `Paste key and Enter to save to ${scopeLabel}, or Esc/Enter to skip.`,
       },
     });
-    if (secret.value) saved.push(await setProviderKey(projectRoot, "grsai", secret.value));
+    if (secret.value) saved.push(await setProviderKey(projectRoot, "grsai", secret.value, { scope }));
     else skipped.push({ provider: "grsai", reason: "skipped" });
   }
 

package/src/auxiliary-tools.js

@@ -324,14 +324,28 @@ function resultUrls(payload) {
 
 function normalizeImageProvider(value = "") {
   const normalized = String(value || "").trim().toLowerCase();
+  if (!normalized || ["auto", "default"].includes(normalized)) return "";
   if (["venice", "venice-image", "venice-ai", "veniceai"].includes(normalized)) return "venice";
+  if (["grsai", "grs", "nano-banana", "nanobanana"].includes(normalized)) return "grsai";
+  if (["openai", "deepseek", "qwen", "openrouter", "mock"].includes(normalized)) {
+    throw new Error(
+      `Unsupported image provider "${normalized}". generate_image is raster-only through GRS AI or Venice image keys; text-model keys for ${normalized} do not enable image generation.`
+    );
+  }
+  throw new Error("Unsupported image provider. Use grsai, venice, or auto.");
+}
+
+function autoImageProvider() {
+  if (grsaiKey()) return "grsai";
+  if (veniceKey()) return "venice";
   return "grsai";
 }
 
 function defaultImageProvider(config = {}) {
-  return normalizeImageProvider(
+  const explicit = normalizeImageProvider(
     config.auxiliaryProvider || process.env.AGINTI_AUX_PROVIDER || process.env.VENICE_IMAGE_PROVIDER || process.env.GRSAI_IMAGE_PROVIDER || ""
   );
+  return explicit || autoImageProvider();
 }
 
 function veniceBaseUrl(value = "") {
@@ -343,7 +357,7 @@ function veniceBaseUrl(value = "") {
 async function generateVeniceImages({ prompt, args, target, outputStem, manifest, manifestPath, formatInfo, signal = null }) {
   const apiKey = veniceKey();
   if (!apiKey) {
-    throw new Error("Missing VENICE_API_KEY. Run `aginti login venice` or `aginti keys set venice --stdin`.");
+    throw new Error("Missing VENICE_API_KEY for image generation. Run `aginti login venice` or `aginti keys set venice --stdin`; text-model keys do not enable raster image generation.");
   }
 
   const model =
@@ -511,7 +525,19 @@ export async function generateImage(args = {}, config = {}) {
 
   const apiKey = grsaiKey();
   if (!apiKey) {
-    throw new Error("Missing GRSAI key. Run `aginti login grsai`, `aginti keys set grsai --stdin`, or `/auxiliary grsai`.");
+    if (veniceKey()) {
+      return generateVeniceImages({ prompt, args, target, outputStem, manifest, manifestPath, formatInfo, signal: config.abortSignal });
+    }
+    const textKeys = [
+      process.env.OPENAI_API_KEY || process.env.LLM_API_KEY ? "OpenAI/LLM" : "",
+      process.env.DEEPSEEK_API_KEY ? "DeepSeek" : "",
+      process.env.OPENROUTER_API_KEY ? "OpenRouter" : "",
+      process.env.QWEN_API_KEY ? "Qwen" : "",
+    ].filter(Boolean);
+    const suffix = textKeys.length
+      ? ` Text-model keys are available (${textKeys.join(", ")}), but raster image generation requires GRSAI or VENICE_API_KEY.`
+      : "";
+    throw new Error(`Missing image-generation key. Run \`aginti login grsai\`, \`aginti login venice\`, \`aginti keys set grsai --stdin\`, or \`/auxiliary grsai\`.${suffix}`);
   }
 
   const submitUrl = `${host}/v1/draw/nano-banana`;

package/src/capabilities.js

@@ -245,6 +245,8 @@ export async function buildCapabilityReport(projectRoot, packageVersion, config)
       grsai: keyStatus.grsai,
       mock: true,
       localEnv: keyStatus.localEnv,
+      globalEnv: keyStatus.globalEnv,
+      projectEnv: keyStatus.projectEnv,
       envVars: keyStatus.envVars,
     },
     tools: {
@@ -327,7 +329,7 @@ export function printCapabilityReport(report) {
       report.keys.venice ? "available" : "missing"
     } grsai=${
       report.keys.grsai ? "available" : "missing"
-    } mock=available localEnv=${report.keys.localEnv}`
+    } mock=available globalEnv=${report.keys.globalEnv ? "yes" : "no"} projectEnv=${report.keys.projectEnv ? "yes" : "no"}`
   );
   for (const check of report.checks) {
     const suffix = check.version ? ` ${check.version}` : check.reason ? ` ${check.reason}` : check.hint ? ` ${check.hint}` : "";

package/src/cli.js

@@ -776,7 +776,7 @@ function exitOnUnknownOptions(parsed) {
 
 function printUsage() {
   console.log(
-    'Usage: aginti [chat] OR aginti init [--template minimal|disciplined|coding|research|writing|design|aaps|supervision] OR aginti web [--port 3210] OR aginti docker [status|setup|install-host] OR aginti update OR aginti image [--json] [--dry-run] [--format png|webp|svg] "prompt" OR aginti models OR aginti aaps [status|init|files|validate|compile|check|run] OR aginti mcp [status|config|inspect|tools|resources|read|prompts|prompt|call|restart] OR aginti skills [query] OR aginti skillmesh [status|off|record|share|sync|serve|service] OR aginti housekeeping [--json] OR aginti auth [deepseek|openai|openrouter|qwen|venice|grsai] OR aginti resume [--all-sessions] [latest|<session-id>] ["prompt"] OR aginti --remove-empty-sessions OR aginti --remove-sessions OR aginti queue <session-id> "message" OR aginti [--no-auto-update] [-s safe|normal|danger] [--language en|ja|zh-Hans|zh-Hant|ko|fr|es|ar|vi|de|ru] [--image] [--latex] [--scs|--scs auto|--no-scs] [--dynamic-steps auto|on|off] [--routing smart|fast|complex|manual] [--provider deepseek|openai|openrouter|qwen|venice|mock] [--model MODEL] [--route-model MODEL --route-reasoning provider-default|minimal|low|medium|high|xhigh] [--main-model MODEL --main-reasoning provider-default|minimal|low|medium|high|xhigh] [--spare-model MODEL --spare-reasoning medium] [--aux-provider grsai|venice --aux-model MODEL] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell|--no-shell] [--allow-file-tools|--no-file-tools] [--web-search|--no-web-search] [--mcp|--no-mcp] [--parallel-scouts|--no-parallel-scouts --scout-count 1..10] [--allow-auxiliary-tools|--no-auxiliary-tools] [--allow-wrappers --wrapper codex --wrapper-model gpt-5.5] [--list-models|--list-routes] "your task"'
+    'Usage: aginti [chat] OR aginti init [--template minimal|disciplined|coding|research|writing|design|aaps|supervision] OR aginti web [--port 3210] OR aginti docker [status|setup|install-host] OR aginti update OR aginti image [--json] [--dry-run] [--format png|webp|svg] "prompt" OR aginti models OR aginti aaps [status|init|files|validate|compile|check|run] OR aginti mcp [status|config|inspect|tools|resources|read|prompts|prompt|call|restart] OR aginti skills [query] OR aginti skillmesh [status|off|record|share|sync|serve|service] OR aginti housekeeping [--json] OR aginti auth [--project] [deepseek|openai|openrouter|qwen|venice|grsai] OR aginti resume [--all-sessions] [latest|<session-id>] ["prompt"] OR aginti --remove-empty-sessions OR aginti --remove-sessions OR aginti queue <session-id> "message" OR aginti [--no-auto-update] [-s safe|normal|danger] [--language en|ja|zh-Hans|zh-Hant|ko|fr|es|ar|vi|de|ru] [--image] [--latex] [--scs|--scs auto|--no-scs] [--dynamic-steps auto|on|off] [--routing smart|fast|complex|manual] [--provider deepseek|openai|openrouter|qwen|venice|mock] [--model MODEL] [--route-model MODEL --route-reasoning provider-default|minimal|low|medium|high|xhigh] [--main-model MODEL --main-reasoning provider-default|minimal|low|medium|high|xhigh] [--spare-model MODEL --spare-reasoning medium] [--aux-provider grsai|venice --aux-model MODEL] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell|--no-shell] [--allow-file-tools|--no-file-tools] [--web-search|--no-web-search] [--mcp|--no-mcp] [--parallel-scouts|--no-parallel-scouts --scout-count 1..10] [--allow-auxiliary-tools|--no-auxiliary-tools] [--allow-wrappers --wrapper codex --wrapper-model gpt-5.5] [--list-models|--list-routes] "your task"'
   );
   console.log("Permission shortcuts: -s safe asks before writes/setup; -s normal allows current-project writes and Docker setup; -s danger enables trusted host/full-access mode.");
   console.log(`Languages: ${["en", "ja", "zh-Hans", "zh-Hant", "ko", "fr", "es", "ar", "vi", "de", "ru"].map((code) => `${code}=${languageLabel(code)}`).join(", ")}`);
@@ -1382,7 +1382,7 @@ function printDoctorReport(report) {
       report.keys.venice ? "available" : "missing"
     } grsai=${
       report.keys.grsai ? "available" : "missing"
-    } mock=available localEnv=${report.project.localEnvPresent}`
+    } mock=available globalEnv=${report.keys.globalEnv ? "yes" : "no"} projectEnv=${report.keys.projectEnv ? "yes" : "no"}`
   );
   console.log(
     `sandbox=${report.sandbox?.sandboxMode || "unknown"} docker=${
@@ -1412,8 +1412,8 @@ async function readStdin() {
 
 async function ensureDeepSeekKeyForOneShot(args) {
   if (!shouldPromptForDeepSeek(args, process.cwd())) return true;
-  console.log("No main model API key is configured for this project.");
-  console.log("Choose DeepSeek, OpenAI, OpenRouter, Qwen, or Venice, then paste a key to save in `.aginti/.env` with 0600 permissions.");
+  console.log("No main model API key is configured for this account or project.");
+  console.log("Choose DeepSeek, OpenAI, OpenRouter, Qwen, or Venice, then paste a key to save account-wide in `~/.agintiflow/.env` with 0600 permissions. Use `aginti auth --project` for a project override.");
   const result = await runAuthWizard(process.cwd(), { provider: args.provider || "" });
   printAuthWizardResult(result);
   if (result.saved.some((item) => item.provider !== "grsai")) {
@@ -1424,7 +1424,9 @@ async function ensureDeepSeekKeyForOneShot(args) {
 }
 
 async function handleKeyCommand(argv) {
-  const [verb = "status", provider = ""] = argv;
+  const scope = argv.includes("--project") || argv.includes("--local") ? "project" : "global";
+  const cleanArgv = argv.filter((item) => !["--project", "--local", "--global"].includes(item));
+  const [verb = "status", provider = ""] = cleanArgv;
   if (verb === "status") {
     const status = providerKeyStatus(process.cwd());
     console.log(
@@ -1432,9 +1434,10 @@ async function handleKeyCommand(argv) {
         status.openai ? "available" : "missing"
       } qwen=${status.qwen ? "available" : "missing"} venice=${
         status.venice ? "available" : "missing"
-      } openrouter=${status.openrouter ? "available" : "missing"} grsai=${status.grsai ? "available" : "missing"} mock=available localEnv=${status.localEnv}`
+      } openrouter=${status.openrouter ? "available" : "missing"} grsai=${status.grsai ? "available" : "missing"} mock=available globalEnv=${status.globalEnv ? "yes" : "no"} projectEnv=${status.projectEnv ? "yes" : "no"}`
     );
     console.log("env vars: DeepSeek=DEEPSEEK_API_KEY or LLM_API_KEY; OpenAI=OPENAI_API_KEY or LLM_API_KEY; OpenRouter=OPENROUTER_API_KEY; Qwen=QWEN_API_KEY; Venice=VENICE_API_KEY; image=GRSAI or GRSAI_API_KEY");
+    console.log("storage: `aginti keys set` saves account-wide to ~/.agintiflow/.env; add --project for current .aginti/.env override.");
     return;
   }
 
@@ -1445,19 +1448,19 @@ async function handleKeyCommand(argv) {
       console.error("No key saved.");
       process.exit(1);
     }
-    const result = await setProviderKey(process.cwd(), target, key);
-    console.log(`saved ${result.provider} key to project-local ignored env (${result.keyName})`);
+    const result = await setProviderKey(process.cwd(), target, key, { scope });
+    console.log(`saved ${result.provider} key to ${result.scope === "project" ? "project-local ignored env" : "account-wide ignored env"} (${result.keyName})`);
     return;
   }
 
-  console.error("Usage: aginti keys status OR aginti keys set deepseek|openai|openrouter|qwen|venice|grsai [--stdin]");
+  console.error("Usage: aginti keys status OR aginti keys set [--project|--global] deepseek|openai|openrouter|qwen|venice|grsai [--stdin]");
   process.exit(1);
 }
 
 function printAuthWizardResult(result) {
   if (result.saved.length > 0) {
     for (const item of result.saved) {
-      console.log(`saved ${item.provider} key to project-local ignored env (${item.keyName})`);
+      console.log(`saved ${item.provider} key to ${item.scope === "project" ? "project-local ignored env" : "account-wide ignored env"} (${item.keyName})`);
     }
   }
   if (result.saved.length === 0) console.log("No key saved.");
@@ -2184,9 +2187,11 @@ export async function main(argv = process.argv.slice(2)) {
   }
 
   if (commandArgv[0] === "auth" || commandArgv[0] === "login") {
-    const provider = normalizeAuthProvider(commandArgv[1] || "", "");
+    const scope = commandArgv.includes("--project") || commandArgv.includes("--local") ? "project" : "global";
+    const authArgv = commandArgv.slice(1).filter((item) => !["--project", "--local", "--global"].includes(item));
+    const provider = normalizeAuthProvider(authArgv[0] || "", "");
     if (commandArgv[0] === "auth" || (!provider && process.stdin.isTTY)) {
-      const result = await runAuthWizard(commandCwd, { provider });
+      const result = await runAuthWizard(commandCwd, { provider, scope });
       printAuthWizardResult(result);
       return;
     }
@@ -2198,8 +2203,8 @@ export async function main(argv = process.argv.slice(2)) {
       console.error("No key saved.");
       process.exit(1);
     }
-    const result = await setProviderKey(commandCwd, target, key);
-    console.log(`saved ${result.provider} key to project-local ignored env (${result.keyName})`);
+    const result = await setProviderKey(commandCwd, target, key, { scope });
+    console.log(`saved ${result.provider} key to ${result.scope === "project" ? "project-local ignored env" : "account-wide ignored env"} (${result.keyName})`);
     return;
   }
 

package/src/i18n.js

@@ -121,7 +121,7 @@ const TRANSLATIONS = {
     helpTitle: "Commands:",
     helpHelp: "Show this help.",
     helpStatus: "Show active route, workspace, sandbox, and session.",
-    helpLogin: "Pick, paste, and save project-local API keys.",
+    helpLogin: "Pick, paste, and save account-wide API keys.",
     helpInstructions: "Show AGINTI.md project instructions status.",
     helpModels: "Show route/main/spare/wrapper/auxiliary model roles.",
     helpVenice: "Pick Venice route/main models, or restore DeepSeek defaults.",

package/src/interactive-cli.js

@@ -1091,7 +1091,7 @@ function printHelp() {
       tr("helpTitle"),
       `  ${command("/help", "Show this help.", "helpHelp")}`,
       `  ${command("/status", "Show active route, workspace, sandbox, and session.", "helpStatus")}`,
-      `  ${command("/login [deepseek|openai|openrouter|qwen|venice|grsai]", "Pick, paste, and save project-local API keys.", "helpLogin")}`,
+      `  ${command("/login [deepseek|openai|openrouter|qwen|venice|grsai]", "Pick, paste, and save account-wide API keys.", "helpLogin")}`,
       `  ${command("/auth [deepseek|openai|openrouter|qwen|venice|grsai]", "Alias for /login.", "helpLogin")}`,
       `  ${command("/instructions", "Show AGINTI.md project instructions status.", "helpInstructions")}`,
       `  ${command("/memory", "Alias for /instructions.", "helpInstructions")}`,
@@ -3506,8 +3506,9 @@ async function maybeOnboardDeepSeekKey(state) {
 
   printAgentMessage(
     [
-      "No main model API key is configured for this project.",
-      "Choose DeepSeek, OpenAI, OpenRouter, or Qwen, then paste a key to save in `.aginti/.env` with 0600 permissions.",
+      "No main model API key is configured for this account or project.",
+      "Choose DeepSeek, OpenAI, OpenRouter, Qwen, or Venice, then paste a key to save account-wide in `~/.agintiflow/.env` with 0600 permissions.",
+      "Use `aginti auth --project` when a project needs an override in `.aginti/.env`.",
       "After that, you can optionally paste the auxiliary image key. Press Esc to skip.",
     ].join("\n")
   );
@@ -3535,7 +3536,9 @@ function applyAuthWizardResult(result, state = null) {
   }
   if (result.saved.length > 0) {
     printAgentMessage(
-      result.saved.map((item) => `Saved ${item.keyName} to project-local ignored env. Raw key was not printed.`).join("\n")
+      result.saved
+        .map((item) => `Saved ${item.keyName} to ${item.scope === "project" ? "project-local ignored env" : "account-wide ignored env"}. Raw key was not printed.`)
+        .join("\n")
     );
   } else {
     printAgentMessage("No key saved.");

package/src/project.js

@@ -110,6 +110,7 @@ export function projectPaths(projectRoot = process.cwd()) {
     sessionDbPath: path.join(root, PROJECT_SESSIONS_DIR_NAME, "web-state.sqlite"),
     legacySessionDbPath: path.join(root, LEGACY_PROJECT_SESSIONS_DIR_NAME, "web-state.sqlite"),
     agintiflowHome: globalPaths.home,
+    globalEnvPath: path.join(globalPaths.home, ".env"),
     globalSessionsDir: globalPaths.sessionsDir,
     globalSessionIndexPath: globalPaths.indexDbPath,
     gitignorePath: path.join(root, ".gitignore"),
@@ -257,18 +258,38 @@ function ensureSecretGitignoreLinesSync(gitignorePath) {
   fs.writeFileSync(gitignorePath, `${current}${prefix}${missing.join("\n")}\n`, "utf8");
 }
 
-function persistAmbientProviderKeysSync(paths) {
-  let parsed = {};
+function envTextFromParsed(parsed = {}) {
+  return Object.entries(parsed)
+    .filter(([key]) => LOCAL_ENV_KEYS.has(key))
+    .map(([key, value]) => `${key}=${JSON.stringify(value)}`)
+    .join("\n");
+}
+
+function readEnvFileSync(envPath) {
   try {
-    parsed = parseEnvText(fs.readFileSync(paths.envPath, "utf8"));
+    return parseEnvText(fs.readFileSync(envPath, "utf8"));
   } catch {
-    parsed = {};
+    return {};
+  }
+}
+
+function writeEnvFileSync(envPath, parsed = {}) {
+  fs.mkdirSync(path.dirname(envPath), { recursive: true });
+  fs.writeFileSync(envPath, `${envTextFromParsed(parsed)}\n`, { mode: 0o600 });
+  try {
+    fs.chmodSync(envPath, 0o600);
+  } catch {
+    // chmod can fail on non-POSIX filesystems; the file still remains local to the user account.
   }
+}
+
+function persistAmbientProviderKeysSync(paths, sourceEnv = process.env) {
+  const parsed = readEnvFileSync(paths.globalEnvPath);
 
   let changed = false;
   const persistedKeys = [];
   for (const keyName of AMBIENT_PROVIDER_KEYS) {
-    const value = String(process.env[keyName] || "").trim();
+    const value = String(sourceEnv[keyName] || "").trim();
     if (!value || parsed[keyName]) continue;
     parsed[keyName] = value;
     persistedKeys.push(keyName);
@@ -276,43 +297,46 @@ function persistAmbientProviderKeysSync(paths) {
   }
   if (!changed) return { persisted: false, keys: [] };
 
-  fs.mkdirSync(paths.controlDir, { recursive: true });
-  ensureSecretGitignoreLinesSync(paths.gitignorePath);
-  const output = Object.entries(parsed)
-    .filter(([key]) => LOCAL_ENV_KEYS.has(key))
-    .map(([key, value]) => `${key}=${JSON.stringify(value)}`)
-    .join("\n");
-  fs.writeFileSync(paths.envPath, `${output}\n`, { mode: 0o600 });
-  try {
-    fs.chmodSync(paths.envPath, 0o600);
-  } catch {
-    // chmod can fail on non-POSIX filesystems; the file still remains local and gitignored.
-  }
+  writeEnvFileSync(paths.globalEnvPath, parsed);
   return { persisted: true, keys: persistedKeys };
 }
 
 export function loadProjectEnv(projectRoot = process.cwd(), { override = false } = {}) {
   const paths = projectPaths(projectRoot);
-  const envPaths = [paths.rootEnvPath, paths.envPath];
+  const originalEnvKeys = new Set(
+    [...LOCAL_ENV_KEYS].filter((key) => String(process.env[key] || "").trim())
+  );
+  const ambientSourceEnv = {};
+  for (const key of AMBIENT_PROVIDER_KEYS) {
+    if (String(process.env[key] || "").trim()) ambientSourceEnv[key] = process.env[key];
+  }
+  const envPaths = [paths.globalEnvPath, paths.rootEnvPath, paths.envPath];
   const loadedPaths = [];
   for (const envPath of envPaths) {
     try {
       const parsed = parseEnvText(fs.readFileSync(envPath, "utf8"));
       if (Object.keys(parsed).length === 0) continue;
+      const isProjectEnv = envPath === paths.rootEnvPath || envPath === paths.envPath;
       for (const [key, value] of Object.entries(parsed)) {
-        if (override || !process.env[key]) process.env[key] = value;
+        if (override || !process.env[key] || (isProjectEnv && !originalEnvKeys.has(key))) {
+          process.env[key] = value;
+        }
       }
       loadedPaths.push(envPath);
     } catch {
       // Ignore missing or unreadable optional local env files.
     }
   }
-  const ambient = persistAmbientProviderKeysSync(paths);
-  if (ambient.persisted && !loadedPaths.includes(paths.envPath)) loadedPaths.push(paths.envPath);
+  const ambient = persistAmbientProviderKeysSync(paths, ambientSourceEnv);
+  if (ambient.persisted && !loadedPaths.includes(paths.globalEnvPath)) loadedPaths.unshift(paths.globalEnvPath);
   return {
     loaded: loadedPaths.length > 0,
     path: paths.envPath,
     paths: loadedPaths,
+    globalEnv: loadedPaths.includes(paths.globalEnvPath),
+    globalEnvPath: paths.globalEnvPath,
+    projectEnv: loadedPaths.includes(paths.rootEnvPath) || loadedPaths.includes(paths.envPath),
+    projectEnvPaths: loadedPaths.filter((item) => item === paths.rootEnvPath || item === paths.envPath),
     ambientPersisted: ambient.persisted,
     ambientKeys: ambient.keys,
   };
@@ -387,6 +411,7 @@ export async function initProject(projectRoot = process.cwd(), { template = "dis
     paths.envExamplePath,
     [
       "# Copy values into .aginti/.env. Never commit real secrets.",
+      "# Account-wide defaults can be saved with `aginti auth`; this project file overrides them.",
       "DEEPSEEK_API_KEY=",
       "OPENAI_API_KEY=",
       "OPENAI_BASE_URL=https://api.openai.com/v1",
@@ -467,7 +492,12 @@ export function providerKeyStatus(projectRoot = process.cwd()) {
     grsai: Boolean(process.env.GRSAI || process.env.GRSAI_API_KEY),
     mock: true,
     localEnv: env.loaded,
+    globalEnv: env.globalEnv,
+    projectEnv: env.projectEnv,
     localEnvPath: env.path,
+    globalEnvPath: env.globalEnvPath,
+    ambientPersisted: env.ambientPersisted,
+    ambientKeys: env.ambientKeys,
     envVars: {
       openai: ["OPENAI_API_KEY", "LLM_API_KEY"],
       deepseek: ["DEEPSEEK_API_KEY", "LLM_API_KEY"],
@@ -522,7 +552,7 @@ export function providerKeyPreview(projectRoot = process.cwd(), provider = "") {
   };
 }
 
-export async function setProviderKey(projectRoot, provider, value) {
+export async function setProviderKey(projectRoot, provider, value, options = {}) {
   const normalizedProvider = String(provider || "").toLowerCase();
   const aliases = {
     auxiliary: "grsai",
@@ -555,31 +585,34 @@ export async function setProviderKey(projectRoot, provider, value) {
   if (!keyValue) throw new Error("Key value is required.");
 
   const paths = projectPaths(projectRoot);
-  await fsp.mkdir(paths.controlDir, { recursive: true });
-  await ensureLine(paths.gitignorePath, [
-    ".aginti/.env",
-    ".aginti/.env.*",
-    "!.aginti/.env.example",
-  ]);
+  const requestedScope = String(options.scope || process.env.AGINTI_KEY_SCOPE || process.env.AGINTIFLOW_KEY_SCOPE || "global").toLowerCase();
+  const scope = ["project", "local"].includes(requestedScope) ? "project" : "global";
+  const targetPath = scope === "project" ? paths.envPath : paths.globalEnvPath;
+  if (scope === "project") {
+    await fsp.mkdir(paths.controlDir, { recursive: true });
+    await ensureLine(paths.gitignorePath, [
+      ".aginti/.env",
+      ".aginti/.env.*",
+      "!.aginti/.env.example",
+    ]);
+  }
   let parsed = {};
   try {
-    parsed = parseEnvText(await fsp.readFile(paths.envPath, "utf8"));
+    parsed = parseEnvText(await fsp.readFile(targetPath, "utf8"));
   } catch {
     parsed = {};
   }
   parsed[keyName] = keyValue;
-  const output = Object.entries(parsed)
-    .filter(([key]) => LOCAL_ENV_KEYS.has(key))
-    .map(([key, envValue]) => `${key}=${JSON.stringify(envValue)}`)
-    .join("\n");
-  await fsp.writeFile(paths.envPath, `${output}\n`, { mode: 0o600 });
-  await fsp.chmod(paths.envPath, 0o600).catch(() => {});
+  await fsp.mkdir(path.dirname(targetPath), { recursive: true });
+  await fsp.writeFile(targetPath, `${envTextFromParsed(parsed)}\n`, { mode: 0o600 });
+  await fsp.chmod(targetPath, 0o600).catch(() => {});
   loadProjectEnv(projectRoot, { override: true });
   return {
     ok: true,
     provider: canonicalProvider,
     keyName,
-    path: paths.envPath,
+    path: targetPath,
+    scope,
   };
 }
 
@@ -911,13 +944,18 @@ export async function doctorReport(projectRoot, packageVersion, config) {
       globalSessionsDir: paths.globalSessionsDir,
       globalSessionIndexPath: paths.globalSessionIndexPath,
       localEnvPresent: keyStatus.localEnv,
+      globalEnvPresent: keyStatus.globalEnv,
+      projectEnvPresent: keyStatus.projectEnv,
     },
     keys: {
       openai: keyStatus.openai,
       deepseek: keyStatus.deepseek,
+      openrouter: keyStatus.openrouter,
       qwen: keyStatus.qwen,
       venice: keyStatus.venice,
       grsai: keyStatus.grsai,
+      globalEnv: keyStatus.globalEnv,
+      projectEnv: keyStatus.projectEnv,
       mock: true,
     },
     sandbox: dockerStatus,

package/src/skill-library.js

@@ -100,15 +100,19 @@ function normalizeExternalTools(value) {
 export function loadSkillFile(filePath) {
   const text = fs.readFileSync(filePath, "utf8");
   const { meta, body } = parseFrontmatter(text, filePath);
-  for (const field of ["id", "label", "description"]) {
-    if (typeof meta[field] !== "string" || !meta[field].trim()) {
-      throw new Error(`${filePath}: ${field} must be a non-empty string`);
-    }
+  const id = String(meta.id || meta.name || "").trim();
+  if (!id) {
+    throw new Error(`${filePath}: id or name must be a non-empty string`);
+  }
+  const label = String(meta.label || titleCaseSkillId(id)).trim();
+  const description = String(meta.description || "").trim();
+  if (!description) {
+    throw new Error(`${filePath}: description must be a non-empty string`);
   }
   return {
-    id: meta.id.trim(),
-    label: meta.label.trim(),
-    description: meta.description.trim(),
+    id,
+    label,
+    description,
     triggers: normalizeList(meta.triggers),
     tools: normalizeList(meta.tools),
     body,

package/src/skillmesh.js

@@ -321,6 +321,60 @@ function canonicalSkillContent(content = "") {
   return String(content || "").replace(/\r\n/g, "\n").trim();
 }
 
+function titleCaseSkillId(id = "") {
+  return String(id || "")
+    .split(/[-_\s/]+/)
+    .filter(Boolean)
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ");
+}
+
+function parseSkillMarkdownContent(content = "", context = "SKILL.md") {
+  const text = String(content || "");
+  if (!text.trim()) throw new Error(`${context}: empty skill`);
+  if (Buffer.byteLength(text, "utf8") > MAX_SKILL_BYTES) throw new Error(`${context}: skill is too large`);
+  if (redactSensitiveText(text) !== text) throw new Error(`${context}: contains token-like secret text`);
+  const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
+  if (!match) throw new Error(`${context}: missing YAML frontmatter`);
+  const frontmatter = match[1].replace(/\r\n/g, "\n");
+  const fields = {};
+  const passthrough = [];
+  for (const line of frontmatter.split(/\n/)) {
+    const scalar = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
+    if (scalar) {
+      const key = scalar[1];
+      const value = scalar[2].trim().replace(/^['"]|['"]$/g, "");
+      if (value) fields[key] = value;
+      if (["id", "name", "label", "description"].includes(key)) continue;
+    }
+    passthrough.push(line);
+  }
+  const id = fields.id || fields.name || "";
+  if (!id) throw new Error(`${context}: id or name is required`);
+  if (!safeSkillId(id)) throw new Error(`${context}: invalid skill id ${id}`);
+  const description = fields.description || "";
+  if (!description) throw new Error(`${context}: description is required`);
+  const label = fields.label || titleCaseSkillId(id);
+  return {
+    fields: { ...fields, id, label, description },
+    body: text.slice(match[0].length).trim(),
+    passthrough: passthrough.join("\n").trim(),
+  };
+}
+
+function normalizeSkillMarkdownForSkillMesh(content = "", context = "SKILL.md") {
+  const parsed = parseSkillMarkdownContent(content, context);
+  const frontmatter = [
+    "---",
+    `id: ${parsed.fields.id}`,
+    `label: ${parsed.fields.label}`,
+    `description: ${parsed.fields.description}`,
+    parsed.passthrough,
+    "---",
+  ].filter((line) => line !== "");
+  return `${frontmatter.join("\n")}\n\n${parsed.body}`.trim();
+}
+
 function canonicalPackForSignature(pack) {
   const copy = { ...pack };
   delete copy.signature;
@@ -382,25 +436,7 @@ function verifyPackSignature(pack) {
 }
 
 function validateSkillMarkdownContent(content = "", context = "SKILL.md") {
-  const text = String(content || "");
-  if (!text.trim()) throw new Error(`${context}: empty skill`);
-  if (Buffer.byteLength(text, "utf8") > MAX_SKILL_BYTES) throw new Error(`${context}: skill is too large`);
-  if (redactSensitiveText(text) !== text) throw new Error(`${context}: contains token-like secret text`);
-  const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
-  if (!match) throw new Error(`${context}: missing YAML frontmatter`);
-  const frontmatter = match[1];
-  const fields = {};
-  for (const line of frontmatter.split(/\r?\n/)) {
-    const scalar = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
-    if (!scalar) continue;
-    const value = scalar[2].trim().replace(/^['"]|['"]$/g, "");
-    if (value) fields[scalar[1]] = value;
-  }
-  for (const field of ["id", "label", "description"]) {
-    if (!fields[field]) throw new Error(`${context}: ${field} is required`);
-  }
-  if (!safeSkillId(fields.id)) throw new Error(`${context}: invalid skill id ${fields.id}`);
-  return fields;
+  return parseSkillMarkdownContent(content, context).fields;
 }
 
 function builtInSkillIds() {
@@ -420,7 +456,7 @@ export async function buildSkillPack(skillId, { home = agintiflowHome(), author
 export async function buildSkillPackFromMarkdown(content, { home = agintiflowHome(), author = "local-user", valueScore = 80 } = {}) {
   const fields = validateSkillMarkdownContent(content, "SKILL.md");
   const id = fields.id;
-  const normalized = canonicalSkillContent(content);
+  const normalized = normalizeSkillMarkdownForSkillMesh(content, "SKILL.md");
   const entry = {
     id,
     path: `skills/${id}/SKILL.md`,

package/web.js

@@ -652,6 +652,8 @@ function publicKeyStatus(projectRoot = baseDir) {
     grsai: status.grsai,
     mock: true,
     localEnv: status.localEnv,
+    globalEnv: status.globalEnv,
+    projectEnv: status.projectEnv,
     envVars: status.envVars,
   };
 }
@@ -1444,6 +1446,8 @@ app.get("/api/config", async (_req, res) => {
       sharedSessionFolder: path.resolve(config.sessionsDir) === path.resolve(sessionsDir),
       globalSessionIndexPath: paths.globalSessionIndexPath,
       localEnvPresent: keyStatus.localEnv,
+      globalEnvPresent: keyStatus.globalEnv,
+      projectEnvPresent: keyStatus.projectEnv,
       platform: {
         ...platform,
         label: platformLabel(platform),
@@ -1648,6 +1652,7 @@ app.post("/api/keys/:provider", async (req, res) => {
       ok: true,
       provider: result.provider,
       keyName: result.keyName,
+      scope: result.scope,
       keyStatus: publicKeyStatus(baseDir),
     });
   } catch (error) {