feat(onboard): add Redpill non-interactive onboarding support

- Add --redpill-api-key CLI flag for non-interactive onboarding

- Add redpill-api-key auth choice handler

- Auto-configure all 18 GPU TEE models in agent allowlist

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/cli/program/register.onboard.ts

@@ -52,7 +52,7 @@ export function registerOnboardCommand(program: Command) {
     .option("--mode <mode>", "Wizard mode: local|remote")
     .option(
       "--auth-choice <choice>",
-      "Auth: setup-token|claude-cli|token|chutes|openai-codex|openai-api-key|openrouter-api-key|ai-gateway-api-key|moonshot-api-key|kimi-code-api-key|synthetic-api-key|codex-cli|gemini-api-key|zai-api-key|apiKey|minimax-api|minimax-api-lightning|opencode-zen|skip",
+      "Auth: setup-token|claude-cli|token|chutes|openai-codex|openai-api-key|openrouter-api-key|ai-gateway-api-key|moonshot-api-key|kimi-code-api-key|synthetic-api-key|redpill-api-key|codex-cli|gemini-api-key|zai-api-key|apiKey|minimax-api|minimax-api-lightning|opencode-zen|skip",
     )
     .option(
       "--token-provider <id>",
@@ -74,6 +74,7 @@ export function registerOnboardCommand(program: Command) {
     .option("--zai-api-key <key>", "Z.AI API key")
     .option("--minimax-api-key <key>", "MiniMax API key")
     .option("--synthetic-api-key <key>", "Synthetic API key")
+    .option("--redpill-api-key <key>", "Redpill AI API key")
     .option("--opencode-zen-api-key <key>", "OpenCode Zen API key")
     .option("--gateway-port <port>", "Gateway port")
     .option("--gateway-bind <mode>", "Gateway bind: loopback|tailnet|lan|auto|custom")
@@ -123,6 +124,7 @@ export function registerOnboardCommand(program: Command) {
             zaiApiKey: opts.zaiApiKey as string | undefined,
             minimaxApiKey: opts.minimaxApiKey as string | undefined,
             syntheticApiKey: opts.syntheticApiKey as string | undefined,
+            redpillApiKey: opts.redpillApiKey as string | undefined,
             opencodeZenApiKey: opts.opencodeZenApiKey as string | undefined,
             gatewayPort:
               typeof gatewayPort === "number" && Number.isFinite(gatewayPort)

src/commands/onboard-auth.config-core.ts

@@ -421,16 +421,19 @@ export function applyVeniceConfig(cfg: ClawdbotConfig): ClawdbotConfig {
  * Registers Redpill models and sets up the provider, but preserves existing model selection.
  */
 export function applyRedpillProviderConfig(cfg: ClawdbotConfig): ClawdbotConfig {
-  const models = { ...cfg.agents?.defaults?.models };
-  models[REDPILL_DEFAULT_MODEL_REF] = {
-    ...models[REDPILL_DEFAULT_MODEL_REF],
-    alias: models[REDPILL_DEFAULT_MODEL_REF]?.alias ?? "DeepSeek V3.2",
-  };
-
   const providers = { ...cfg.models?.providers };
   const existingProvider = providers.redpill;
   const existingModels = Array.isArray(existingProvider?.models) ? existingProvider.models : [];
   const redpillModels = discoverRedpillModels();
+
+  // Add all Redpill models to the agent's model allowlist
+  const models = { ...cfg.agents?.defaults?.models };
+  for (const model of redpillModels) {
+    const modelRef = `redpill/${model.id}`;
+    if (!models[modelRef]) {
+      models[modelRef] = { alias: model.name.replace(" (GPU TEE)", "") };
+    }
+  }
   const mergedModels = [
     ...existingModels,
     ...redpillModels.filter(

src/commands/onboard-non-interactive/local/auth-choice.ts

@@ -19,6 +19,7 @@ import {
   applyMoonshotConfig,
   applyOpencodeZenConfig,
   applyOpenrouterConfig,
+  applyRedpillConfig,
   applySyntheticConfig,
   applyVercelAiGatewayConfig,
   applyZaiConfig,
@@ -29,6 +30,7 @@ import {
   setMoonshotApiKey,
   setOpencodeZenApiKey,
   setOpenrouterApiKey,
+  setRedpillApiKey,
   setSyntheticApiKey,
   setVercelAiGatewayApiKey,
   setZaiApiKey,
@@ -272,6 +274,25 @@ export async function applyNonInteractiveAuthChoice(params: {
     return applySyntheticConfig(nextConfig);
   }
 
+  if (authChoice === "redpill-api-key") {
+    const resolved = await resolveNonInteractiveApiKey({
+      provider: "redpill",
+      cfg: baseConfig,
+      flagValue: opts.redpillApiKey,
+      flagName: "--redpill-api-key",
+      envVar: "REDPILL_API_KEY",
+      runtime,
+    });
+    if (!resolved) return null;
+    if (resolved.source !== "profile") await setRedpillApiKey(resolved.key);
+    nextConfig = applyAuthProfileConfig(nextConfig, {
+      profileId: "redpill:default",
+      provider: "redpill",
+      mode: "api_key",
+    });
+    return applyRedpillConfig(nextConfig);
+  }
+
   if (
     authChoice === "minimax-cloud" ||
     authChoice === "minimax-api" ||

src/commands/onboard-types.ts

@@ -71,6 +71,7 @@ export type OnboardOptions = {
   minimaxApiKey?: string;
   syntheticApiKey?: string;
   veniceApiKey?: string;
+  redpillApiKey?: string;
   opencodeZenApiKey?: string;
   gatewayPort?: number;
   gatewayBind?: GatewayBind;