fix(backend): allow configured local Qwen provider

backend/src/pi/provider-credentials.ts

@@ -42,7 +42,9 @@ const PROVIDER_KEY_ENV: Readonly<Record<string, string>> = {
 const COMPOUND_PROVIDERS = new Set([
   "amazon-bedrock", "azure-openai-responses", "cloudflare-ai-gateway", "cloudflare-workers-ai",
 ]);
-const LOCAL_PROVIDERS = new Set(["ollama", "lmstudio", "local", "aritmolab", "faux"]);
+const LOCAL_PROVIDERS = new Set([
+  "ollama", "lmstudio", "local", "aritmolab", "local-qwen", "faux",
+]);
 
 export function canonicalPiProvider(provider: string | undefined): string | undefined {
   const value = provider?.trim().toLowerCase();

backend/test/pi-process-manager.test.ts

@@ -289,7 +289,9 @@ test.each([["OpenAI", "openai"], ["gemini", "google"]])(
   },
 );
 
-test("local providers spawn without a model key and scrub ambient generic credentials", async () => {
+test.each(["ollama", "local-qwen"])(
+  "local provider %s spawns without a model key and scrubs ambient credentials",
+  async (provider) => {
     vi.stubEnv("PI_PROVIDER_API_KEY", "ambient-secret");
     vi.stubEnv("THT_MODEL_API_KEY_FILE", "/ambient/secret-path");
     vi.stubEnv("OPENAI_API_KEY", "unselected-provider-secret");
@@ -300,15 +302,16 @@ test("local providers spawn without a model key and scrub ambient generic creden
       spawnFn: (...args: any[]) => { calls.push(args); return child as any; },
     });
     try {
-    await mgr.spawnFor("local-session", { provider: "ollama" });
+      await mgr.spawnFor(`local-session-${provider}`, { provider });
       expect(calls[0][2].env).not.toHaveProperty("PI_PROVIDER_API_KEY");
       expect(calls[0][2].env).not.toHaveProperty("THT_MODEL_API_KEY_FILE");
       expect(calls[0][2].env).not.toHaveProperty("OPENAI_API_KEY");
     } finally {
-    mgr.teardown("local-session");
+      mgr.teardown(`local-session-${provider}`);
       vi.unstubAllEnvs();
     }
-});
+  },
+);
 
 test.each(["amazon-bedrock", "azure-openai-responses", "cloudflare-workers-ai", "cloudflare-ai-gateway"])(
   "session spawn rejects compound provider %s before spawning Pi", async (provider) => {

backend/test/provider-credentials.test.ts

@@ -116,6 +116,20 @@ test("single-key providers scrub ambient compound companions before injecting th
   expect(env).not.toHaveProperty("CLOUDFLARE_GATEWAY_ID");
 });
 
+test("local-qwen is an explicit local provider and needs no generic key", () => {
+  const env = buildPiChildEnv({
+    ambient: {
+      PI_PROVIDER_API_KEY: "must-not-leak",
+      OPENAI_API_KEY: "must-not-leak",
+      THT_MODEL_API_KEY_FILE: "/must/not/leak",
+    },
+    provider: "local-qwen",
+  });
+  expect(env).not.toHaveProperty("PI_PROVIDER_API_KEY");
+  expect(env).not.toHaveProperty("OPENAI_API_KEY");
+  expect(env).not.toHaveProperty("THT_MODEL_API_KEY_FILE");
+});
+
 test("bundle value is injected without exposing bundle metadata to Pi", () => {
   const env = buildPiChildEnv({
     ambient: {