diff --git a/video-ai-system/tools/qwen-vision.py b/video-ai-system/tools/qwen-vision.py
index 4b7ea08..795c2a9 100644
--- a/video-ai-system/tools/qwen-vision.py
+++ b/video-ai-system/tools/qwen-vision.py
@@ -2,6 +2,13 @@
 """铸渊之眼 · 通义千问视觉分析器
 用阿里百炼 qwen-vl 模型看图片，输出风格/色调/构图分析
 
+⚠️ 密钥不在代码仓库里。读取规则见 LOCAL-SECRETS-PATH.hdlp。
+密钥变量: ALIYUN_QWEN_VL_KEY + ALIYUN_QWEN_VL_ENDPOINT
+读取顺序:
+  1. /Users/bingshuolingdianyuanhe/Documents/guanghulab-local-secrets/video-ai-system.env
+  2. ~/guanghulab/video-ai-system/.env
+  3. 当前进程环境变量
+
 用法:
   python3 qwen-vision.py <image.jpg>                     # 单图分析
   python3 qwen-vision.py <image1.jpg> <image2.jpg>       # 双图对比
@@ -11,23 +18,46 @@ import sys, os, json, base64
 from urllib.request import Request, urlopen
 from urllib.error import URLError
 
-# === 配置 ===
-# 从 .env 读 key
-env_path = os.path.expanduser("~/guanghulab/video-ai-system/.env")
+# === 密钥加载 ===
+# 按 LOCAL-SECRETS-PATH.hdlp 规定的顺序加载
+SECRET_PATHS = [
+    "/Users/bingshuolingdianyuanhe/Documents/guanghulab-local-secrets/video-ai-system.env",
+    os.path.expanduser("~/guanghulab/video-ai-system/.env"),
+]
+
 api_key = None
-if os.path.exists(env_path):
-    for line in open(env_path):
-        line = line.strip()
-        if line.startswith("ALIYUN_API_KEY="):
-            api_key = line.split("=", 1)[1].strip()
-            break
+endpoint = None
+
+# 先试环境变量
+api_key = os.environ.get("ALIYUN_QWEN_VL_KEY") or os.environ.get("ALIYUN_BAILIAN_API_KEY")
+endpoint = os.environ.get("ALIYUN_QWEN_VL_ENDPOINT") or "https://ws-umd6xwlovzmshuat.cn-beijing.maas.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation"
+
+# 再从文件读
+if not api_key:
+    for secret_path in SECRET_PATHS:
+        if os.path.exists(secret_path):
+            for line in open(secret_path):
+                line = line.strip()
+                if not line or line.startswith("#"):
+                    continue
+                if "=" in line:
+                    k, v = line.split("=", 1)
+                    k = k.strip()
+                    v = v.strip()
+                    if k in ("ALIYUN_QWEN_VL_KEY", "ALIYUN_API_KEY", "ALIYUN_BAILIAN_API_KEY") and v and not api_key:
+                        api_key = v
+                    if k == "ALIYUN_QWEN_VL_ENDPOINT" and v and not os.environ.get("ALIYUN_QWEN_VL_ENDPOINT"):
+                        endpoint = v
+            if api_key:
+                break
 
 if not api_key:
-    print(json.dumps({"error": "未找到ALIYUN_API_KEY"}))
+    print(json.dumps({"error": "未找到ALIYUN_QWEN_VL_KEY。请确认密钥文件存在。路径: LOCAL-SECRETS-PATH.hdlp"}))
     sys.exit(1)
 
-# 端点：先试公网，再试北京
+# 端点
 ENDPOINTS = [
+    endpoint,
     "https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation",
 ]
 MODELS = ["qwen-vl-max", "qwen3-vl-plus", "qwen-vl-plus"]