diff --git a/.gitignore b/.gitignore
index 5544937..ba770a4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,4 +40,9 @@ reasonix.toml
 opencode.json
 .claude/
 .opencode/
-.hermers/
\ No newline at end of file
+.hermers/
+
+# Build output (Makefile)
+bin/
+coverage.out
+coverage.html
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..a12349e
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,43 @@
+.PHONY: all build test vet fmt lint cover install tidy clean help
+
+BINARY   := ry
+MAIN_PKG := ./cmd/ry
+GO       := go
+GOFLAGS  :=
+OUTPUT   := bin/$(BINARY)
+
+VERSION  := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
+COMMIT   := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+LDFLAGS  := -X main.version=$(VERSION) -X main.commit=$(COMMIT)
+BUILD_FLAGS := -ldflags "$(LDFLAGS)"
+
+all: build
+
+build: ## Build the CLI binary into bin/
+	$(GO) build $(GOFLAGS) $(BUILD_FLAGS) -o $(OUTPUT) $(MAIN_PKG)
+
+install: ## Install the CLI binary to GOPATH/bin
+	$(GO) install $(GOFLAGS) $(BUILD_FLAGS) $(MAIN_PKG)
+
+test: ## Run all tests
+	$(GO) test $(GOFLAGS) -race ./...
+
+vet: ## Run go vet
+	$(GO) vet ./...
+
+fmt: ## Format all Go source files
+	gofmt -s -w .
+	$(GO) mod tidy
+
+cover: ## Run tests with coverage and generate HTML report
+	$(GO) test $(GOFLAGS) -race -coverprofile=coverage.out ./...
+	$(GO) tool cover -html=coverage.out -o coverage.html
+
+tidy: ## Run go mod tidy
+	$(GO) mod tidy
+
+clean: ## Remove build artifacts and coverage files
+	rm -rf bin/ coverage.out coverage.html
+
+help: ## Show this help message
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-10s\033[0m %s\n", $$1, $$2}'
diff --git a/cmd/ry/commands/configcmd/config.go b/cmd/ry/commands/configcmd/config.go
index 52c5271..a6a06c8 100644
--- a/cmd/ry/commands/configcmd/config.go
+++ b/cmd/ry/commands/configcmd/config.go
@@ -34,12 +34,33 @@ func Cmd(cfg **config.Config, cfgPath string) *cobra.Command {
 	}
 
 	configSetCmd := &cobra.Command{
-		Use:         "set <key> <value>",
+		Use:         "set <key> [value]",
 		Short:       "Set a config value",
-		Args:        cobra.ExactArgs(2),
+		Args:        cobra.RangeArgs(1, 2),
 		Annotations: map[string]string{"skipSDK": "true"},
 		RunE: func(cmd *cobra.Command, args []string) error {
-			key, value := args[0], args[1]
+			key := args[0]
+			var value string
+
+			if len(args) == 2 {
+				value = args[1]
+			} else {
+				// Interactive mode — prompt for the value.
+				if key == "apikey" {
+					v, err := config.ReadSecret("Enter API key: ")
+					if err != nil {
+						return fmt.Errorf("read API key: %w", err)
+					}
+					value = v
+				} else {
+					v, err := config.ReadLine("Enter " + key + ": ")
+					if err != nil {
+						return fmt.Errorf("read %s: %w", key, err)
+					}
+					value = v
+				}
+			}
+
 			c := *cfg
 			switch key {
 			case "apikey":
@@ -52,7 +73,11 @@ func Cmd(cfg **config.Config, cfgPath string) *cobra.Command {
 			if err := config.Save(cfgPath, c); err != nil {
 				return fmt.Errorf("save config: %w", err)
 			}
-			fmt.Printf("Set %s = %s\n", key, value)
+			if key == "apikey" {
+				fmt.Printf("Set %s = %s\n", key, "(hidden)")
+			} else {
+				fmt.Printf("Set %s = %s\n", key, value)
+			}
 			return nil
 		},
 	}
diff --git a/cmd/ry/internal/config/interactive.go b/cmd/ry/internal/config/interactive.go
new file mode 100644
index 0000000..e08ead3
--- /dev/null
+++ b/cmd/ry/internal/config/interactive.go
@@ -0,0 +1,43 @@
+package config
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+
+	"golang.org/x/term"
+)
+
+// ReadSecret prompts the user with msg and reads a line from stdin.
+// When stdin is a terminal, echo is disabled so the typed value stays
+// invisible. When stdin is piped (non-TTY) it falls back to a normal
+// read so scripting still works.
+func ReadSecret(msg string) (string, error) {
+	fmt.Fprint(os.Stderr, msg)
+	var value string
+	if term.IsTerminal(int(os.Stdin.Fd())) {
+		b, err := term.ReadPassword(int(os.Stdin.Fd()))
+		if err != nil {
+			return "", err
+		}
+		value = string(b)
+	} else {
+		sc := bufio.NewScanner(os.Stdin)
+		if !sc.Scan() {
+			return "", sc.Err()
+		}
+		value = sc.Text()
+	}
+	fmt.Fprintln(os.Stderr)
+	return value, nil
+}
+
+// ReadLine prompts the user with msg and reads a normal (echo-enabled) line.
+func ReadLine(msg string) (string, error) {
+	fmt.Fprint(os.Stderr, msg)
+	sc := bufio.NewScanner(os.Stdin)
+	if !sc.Scan() {
+		return "", sc.Err()
+	}
+	return sc.Text(), nil
+}
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index a799bdf..96c49af 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -10,6 +10,9 @@ The format loosely follows Keep a Changelog and can be adapted to the team's hab
 
 ### Added / 新增
 
+- `config set <key>` 支持交互式输入：省略 value 时交互式提示，`apikey` 使用隐藏输入避免敏感信息暴露在终端/历史中。
+- 新增 `Makefile`（build/test/vet/fmt/cover/tidy/clean/help）。
+
 - 迁移 rainyun-cli 到仓库内 `cmd/ry/`：新增 `main.go`、`root.go`、`commands/{server,domain,storage,billing,configcmd}`、`internal/{config,model,output}`。
 - CLI 直接调用 `sdk.New(apiKey)`，删除 CLI 自带 provider/HTTP 层。
 - 配置简化为单一 `apikey` + `output`（table/json/yaml），落盘到 `~/.config/ry/config.toml`。
@@ -24,6 +27,8 @@ The format loosely follows Keep a Changelog and can be adapted to the team's hab
 
 - 命令 ID 参数统一为 `int`，显示层 model ID 保持 `string`。
 - `server reinstall` flag 从 `--os` 改为 `--os-id int`。
+- `.gitignore` 新增 `bin/`、`coverage.out`、`coverage.html`。
+- 新增 `golang.org/x/term` 依赖（交互式隐藏输入）。
 
 ## [0.2.0] - 2026-08-05
 
diff --git a/go.mod b/go.mod
index 171b8bf..05bd7b5 100644
--- a/go.mod
+++ b/go.mod
@@ -7,6 +7,7 @@ require (
 	github.com/bytedance/sonic v1.15.2
 	github.com/go-resty/resty/v2 v2.17.2
 	github.com/spf13/cobra v1.10.2
+	golang.org/x/term v0.34.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
diff --git a/go.sum b/go.sum
index b8afeb9..7da8984 100644
--- a/go.sum
+++ b/go.sum
@@ -43,6 +43,8 @@ golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
 golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
 golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=