@gajae-code/ai 0.14.2 → 0.15.0

package/src/providers/openai-completions.ts

@@ -525,7 +525,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 
 		try {
 			const apiKey = options?.apiKey || getEnvApiKey(model.provider) || "";
-			const idleTimeoutMs = options?.streamIdleTimeoutMs ?? getOpenAIStreamIdleTimeoutMs(model.provider);
+			const idleTimeoutMs = options?.streamIdleTimeoutMs ?? getOpenAIStreamIdleTimeoutMs(model.provider, model.id);
 			const {
 				client,
 				copilotPremiumRequests,
@@ -1239,7 +1239,7 @@ async function createClient(
 	// The OpenAI SDK's default is 10 minutes per attempt × `maxRetries`, which
 	// turns a stalled-before-headers fetch into a multi-minute hang invisible
 	// to the agent loop (the iterator watchdog only arms AFTER `create()` returns).
-	const sdkTimeoutMs = resolveOpenAISdkRequestTimeoutMs(model.provider, streamFirstEventTimeoutOverride);
+	const sdkTimeoutMs = resolveOpenAISdkRequestTimeoutMs(model.provider, streamFirstEventTimeoutOverride, model.id);
 	return {
 		client: new OpenAI({
 			apiKey,

package/src/providers/openai-responses-shared.ts

@@ -327,13 +327,57 @@ export function convertResponsesAssistantMessage<TApi extends Api>(
 
 export function appendResponsesToolResultMessages<TApi extends Api>(
 	messages: ResponseInput,
-	toolResult: ToolResultMessage,
+	toolResults: readonly ToolResultMessage[],
 	model: Model<TApi>,
 	strictResponsesPairing: boolean,
 	knownCallIds: ReadonlySet<string>,
 	customCallIds?: ReadonlySet<string>,
 ): void {
 	const supportsImages = model.input.includes("image");
+	const imageParts: ResponseInputContent[] = [];
+
+	for (const toolResult of toolResults) {
+		appendResponsesToolResultOutput(
+			messages,
+			imageParts,
+			toolResult,
+			supportsImages,
+			strictResponsesPairing,
+			knownCallIds,
+			customCallIds,
+		);
+	}
+
+	if (imageParts.length === 0) {
+		return;
+	}
+
+	messages.push({ role: "user", content: imageParts });
+}
+
+/**
+ * Append the Responses items for one tool result of a batch (#4807).
+ *
+ * Emits the paired `function_call_output` / `custom_tool_call_output` in
+ * `messages` — keeping every output of the batch contiguous — and collects
+ * supported image blocks into `imageParts` instead of emitting a standalone
+ * user message per result. A per-result image user message interleaves with
+ * sibling outputs of the same assistant tool-call turn; once an OpenAI
+ * Responses → Anthropic Messages proxy groups consecutive outputs into the
+ * single user message carrying `tool_result` blocks, the interleaved image
+ * user message splits that group and leaves a `tool_use` without its
+ * immediately-following `tool_result`, which Anthropic rejects with a 400 on
+ * every replay of the poisoned tail.
+ */
+function appendResponsesToolResultOutput(
+	messages: ResponseInput,
+	imageParts: ResponseInputContent[],
+	toolResult: ToolResultMessage,
+	supportsImages: boolean,
+	strictResponsesPairing: boolean,
+	knownCallIds: ReadonlySet<string>,
+	customCallIds?: ReadonlySet<string>,
+): void {
 	const textResult = toolResult.content
 		.filter((block): block is TextContent => block.type === "text")
 		.map(block => block.text)
@@ -370,19 +414,24 @@ export function appendResponsesToolResultMessages<TApi extends Api>(
 		return;
 	}
 
-	const contentParts: ResponseInputContent[] = [
-		{ type: "input_text", text: "Attached image(s) from tool result:" } satisfies ResponseInputText,
-	];
+	if (imageParts.length === 0) {
+		imageParts.push({ type: "input_text", text: "Attached image(s) from tool result:" } satisfies ResponseInputText);
+	}
+	// Label each result's image group with its call id so parallel results keep
+	// image-to-call attribution inside the single collected user message (#4807).
+	imageParts.push({
+		type: "input_text",
+		text: `call_id=${normalized.callId}`,
+	} satisfies ResponseInputText);
 	for (const block of toolResult.content) {
 		if (block.type === "image") {
-			contentParts.push({
+			imageParts.push({
 				type: "input_image",
 				detail: "auto",
 				image_url: `data:${block.mimeType};base64,${block.data}`,
 			} satisfies ResponseInputImage);
 		}
 	}
-	messages.push({ role: "user", content: contentParts });
 }
 
 export interface ProcessResponsesStreamOptions {

package/src/providers/openai-responses.ts

@@ -22,6 +22,7 @@ import {
 	type StreamOptions,
 	type Tool,
 	type ToolChoice,
+	type ToolResultMessage,
 } from "../types";
 import {
 	createOpenAIResponsesHistoryPayload,
@@ -389,7 +390,7 @@ export const streamOpenAIResponses: StreamFunction<"openai-responses"> = (
 			const premiumRequestsTotal = copilotPremiumRequests;
 			const providerSessionState = getOpenAIResponsesProviderSessionState(model, options?.providerSessionState);
 			const { params } = buildParams(model, context, options, providerSessionState, cacheRetention, baseUrl);
-			const idleTimeoutMs = options?.streamIdleTimeoutMs ?? getOpenAIStreamIdleTimeoutMs(model.provider);
+			const idleTimeoutMs = options?.streamIdleTimeoutMs ?? getOpenAIStreamIdleTimeoutMs(model.provider, model.id);
 			options?.onPayload?.(params, undefined, options?.attemptScope);
 			rawRequestDump = {
 				provider: model.provider,
@@ -623,7 +624,7 @@ function createClient(
 	);
 	// Bound HTTP request timeout to the first-event window so a stalled-before-headers
 	// fetch cannot wait the SDK's 10-minute default before the transport watchdog arms.
-	const sdkTimeoutMs = resolveOpenAISdkRequestTimeoutMs(model.provider, streamFirstEventTimeoutOverride);
+	const sdkTimeoutMs = resolveOpenAISdkRequestTimeoutMs(model.provider, streamFirstEventTimeoutOverride, model.id);
 	return {
 		client: new OpenAI({
 			apiKey,
@@ -800,7 +801,30 @@ function convertConversationMessages(
 	const transformedMessages = transformMessages(context.messages, model, normalizeResponsesToolCallIdForTransform);
 
 	let msgIndex = 0;
+	// Consecutive tool results are batched into one append call so every output
+	// of the turn stays contiguous before the collected image user message;
+	// per-result image user messages interleave with sibling outputs and break
+	// tool_use→tool_result adjacency through Anthropic-translating proxies (#4807).
+	let pendingToolResults: ToolResultMessage[] = [];
+	const flushPendingToolResults = (): void => {
+		if (pendingToolResults.length === 0) return;
+		appendResponsesToolResultMessages(
+			messages,
+			pendingToolResults,
+			model,
+			strictResponsesPairing,
+			knownCallIds,
+			customCallIds,
+		);
+		pendingToolResults = [];
+	};
 	for (const msg of transformedMessages) {
+		if (msg.role === "toolResult") {
+			pendingToolResults.push(msg);
+			msgIndex++;
+			continue;
+		}
+		flushPendingToolResults();
 		if (msg.role === "user" || msg.role === "developer") {
 			const providerPayload = (msg as { providerPayload?: AssistantMessage["providerPayload"] }).providerPayload;
 			const historyItems = getOpenAIResponsesHistoryItems(providerPayload, model.provider);
@@ -851,11 +875,10 @@ function convertConversationMessages(
 			);
 			if (outputItems.length === 0) continue;
 			messages.push(...outputItems);
-		} else if (msg.role === "toolResult") {
-			appendResponsesToolResultMessages(messages, msg, model, strictResponsesPairing, knownCallIds, customCallIds);
 		}
 		msgIndex++;
 	}
+	flushPendingToolResults();
 
 	return repairOrphanResponsesToolOutputs(messages);
 }

package/src/stream.ts

@@ -1,7 +1,12 @@
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
-import { $credentialEnv, $env, $pickCredentialEnv, extractHttpStatusFromError } from "@gajae-code/utils";
+import {
+	$credentialEnv,
+	$env,
+	$pickCredentialEnv,
+	extractHttpStatusFromError,
+	getTrustedHomeDir,
+} from "@gajae-code/utils";
 import { assertManagedAttempt, classifyFallbackTrigger, type TransportFailureFacts } from "./utils/fallback-transport";
 
 const managedAttemptValidated = Symbol("managedAttemptValidated");
@@ -77,7 +82,7 @@ function hasVertexAdcCredentials(): boolean {
 			cachedVertexAdcCredentialsExists = fs.existsSync(gacPath);
 		} else {
 			cachedVertexAdcCredentialsExists = fs.existsSync(
-				path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json"),
+				path.join(getTrustedHomeDir(), ".config", "gcloud", "application_default_credentials.json"),
 			);
 		}
 	}

package/src/types.ts

@@ -13,6 +13,20 @@ import type {
 	LsArgs,
 	LsResult,
 	McpResult,
+	PiBashExecArgs,
+	PiBashExecResult,
+	PiEditExecArgs,
+	PiEditExecResult,
+	PiFindExecArgs,
+	PiFindExecResult,
+	PiGrepExecArgs,
+	PiGrepExecResult,
+	PiLsExecArgs,
+	PiLsExecResult,
+	PiReadExecArgs,
+	PiReadExecResult,
+	PiWriteExecArgs,
+	PiWriteExecResult,
 	ReadArgs,
 	ReadResult,
 	ShellArgs,
@@ -669,6 +683,26 @@ export interface Usage {
 
 export type StopReason = "stop" | "length" | "toolUse" | "error" | "aborted";
 export type AssistantErrorKind = "provider_safety_stop" | "local_snapshot_failure" | "local_buffer_overflow";
+/**
+ * Structured, shape-only staging-buffer overflow diagnostic carried on the
+ * terminal `AssistantMessage`. Attached only by the agent runtime from its own
+ * identity-checked overflow error; every field is a closed vocabulary literal
+ * or a locally synthesized number.
+ */
+export interface AssistantBufferOverflowDiagnostic {
+	/** Rejecting stage from the closed managed-local-failure vocabulary. */
+	stage: string;
+	/** Which provisional cap tripped. */
+	exceeded: "events" | "bytes" | "both";
+	/** Events retained in the batch at rejection (post-compaction). */
+	stagedEventCount: number;
+	/** Bytes retained in the batch at rejection (post-compaction). */
+	stagedBytes: number;
+	/** Serialized size of the event that was rejected. */
+	incomingEventBytes: number;
+	maxStagedEvents: number;
+	maxStagedBytes: number;
+}
 
 export interface OpenAIResponsesHistoryPayload {
 	type: "openaiResponsesHistory";
@@ -712,6 +746,15 @@ export interface AssistantMessage {
 	stopReason: StopReason;
 	errorMessage?: string;
 	errorKind?: AssistantErrorKind;
+	/**
+	 * Structured, shape-only diagnostic for a terminal local staging-buffer
+	 * overflow (`errorKind: "local_buffer_overflow"`). Attached only by the
+	 * agent runtime from its own identity-checked overflow error, so a
+	 * foreign, self-labeled error cannot populate it. Every field is a closed
+	 * vocabulary literal or a locally synthesized number — parent surfaces
+	 * render this instead of trusting the free-form `errorMessage`.
+	 */
+	bufferOverflow?: AssistantBufferOverflowDiagnostic;
 	/** HTTP status surfaced by the provider when the request failed. Populated by every provider's catch block alongside `errorMessage` so consumers (auth retry, telemetry, UI) can branch without regex-scraping the message. */
 	errorStatus?: number;
 	/** Typed upstream failure facts retained for retry classification without parsing errorMessage. */
@@ -767,6 +810,11 @@ export interface CursorShellStreamCallbacks {
 	onStderr(data: string): void;
 }
 
+export interface CursorPiCall<TArgs> {
+	args: TArgs;
+	toolCallId: string;
+}
+
 export interface CursorExecHandlers {
 	read?: (args: ReadArgs) => Promise<CursorExecHandlerResult<ReadResult>>;
 	ls?: (args: LsArgs) => Promise<CursorExecHandlerResult<LsResult>>;
@@ -780,6 +828,13 @@ export interface CursorExecHandlers {
 	) => Promise<CursorExecHandlerResult<ShellResult>>;
 	diagnostics?: (args: DiagnosticsArgs) => Promise<CursorExecHandlerResult<DiagnosticsResult>>;
 	mcp?: (call: CursorMcpCall) => Promise<CursorExecHandlerResult<McpResult>>;
+	piRead?: (call: CursorPiCall<PiReadExecArgs>) => Promise<CursorExecHandlerResult<PiReadExecResult>>;
+	piBash?: (call: CursorPiCall<PiBashExecArgs>) => Promise<CursorExecHandlerResult<PiBashExecResult>>;
+	piEdit?: (call: CursorPiCall<PiEditExecArgs>) => Promise<CursorExecHandlerResult<PiEditExecResult>>;
+	piWrite?: (call: CursorPiCall<PiWriteExecArgs>) => Promise<CursorExecHandlerResult<PiWriteExecResult>>;
+	piGrep?: (call: CursorPiCall<PiGrepExecArgs>) => Promise<CursorExecHandlerResult<PiGrepExecResult>>;
+	piFind?: (call: CursorPiCall<PiFindExecArgs>) => Promise<CursorExecHandlerResult<PiFindExecResult>>;
+	piLs?: (call: CursorPiCall<PiLsExecArgs>) => Promise<CursorExecHandlerResult<PiLsExecResult>>;
 	onToolResult?: CursorToolResultHandler;
 }
 

package/src/utils/block-symbols.ts

@@ -0,0 +1,11 @@
+export const kCursorExecResolved = Symbol("provider.block.cursorExecResolved");
+
+export type CursorExecResolvedCarrier = object & { [kCursorExecResolved]?: true };
+
+export function isCursorExecResolved(block: CursorExecResolvedCarrier | null | undefined): boolean {
+	return block?.[kCursorExecResolved] === true;
+}
+
+export function copyCursorExecResolved(target: CursorExecResolvedCarrier, source: CursorExecResolvedCarrier): void {
+	if (source[kCursorExecResolved] === true) target[kCursorExecResolved] = true;
+}

package/src/utils/discovery/openai-compatible.ts

@@ -5,6 +5,17 @@ import { toNumber } from "../../utils";
 
 const MODELS_PATH = "/models";
 const MAX_MODELS_RESPONSE_BYTES = 1_000_000;
+const MAX_CATALOG_MODEL_ID_LENGTH = 200;
+
+/** Catalog identities are rendered and used for routing; unsafe values are dropped, never rewritten. */
+export function isSafeCatalogModelId(value: unknown): value is string {
+	return (
+		typeof value === "string" &&
+		value.trim().length > 0 &&
+		value.length <= MAX_CATALOG_MODEL_ID_LENGTH &&
+		!/[\u0000-\u001f\u007f-\u009f]/u.test(value)
+	);
+}
 
 /**
  * Minimal OpenAI-style model entry shape consumed by discovery.
@@ -186,6 +197,9 @@ export async function fetchOpenAICompatibleModels<TApi extends Api>(
 
 	const deduped = new Map<string, Model<TApi>>();
 	for (const entry of entries) {
+		if (!isSafeCatalogModelId(entry.id)) {
+			continue;
+		}
 		const rawContextWindow = firstPositiveModelNumber(
 			UNK_CONTEXT_WINDOW,
 			entry.max_model_len,
@@ -211,7 +225,7 @@ export async function fetchOpenAICompatibleModels<TApi extends Api>(
 		};
 
 		const mapped = options.mapModel?.(entry, defaults, context) ?? defaults;
-		if (!mapped || typeof mapped.id !== "string" || mapped.id.length === 0) {
+		if (!mapped || !isSafeCatalogModelId(mapped.id)) {
 			continue;
 		}
 		if (options.filterModel && !options.filterModel(entry, mapped)) {
@@ -314,16 +328,17 @@ function extractModelEntriesFromNode(node: unknown): ParsedOpenAICompatibleModel
 }
 
 /**
- * First finite positive number among candidates, else the fallback.
+ * First positive safe integer among candidates, else the fallback.
  *
- * Rejects non-numbers, non-finite values (JSON `1e400` parses to
- * `Infinity`), zero, and negatives so a malformed catalog field can never
- * poison compaction thresholds or output budgets with `Infinity`.
+ * Rejects non-numbers, non-finite values (JSON `1e400` parses to `Infinity`),
+ * fractions, values outside the safe integer range, zero, and negatives so a
+ * malformed catalog field can never poison compaction thresholds or output
+ * budgets.
  */
 function firstPositiveModelNumber(fallback: number, ...candidates: readonly unknown[]): number {
 	for (const candidate of candidates) {
 		const value = toNumber(candidate);
-		if (value !== undefined && value > 0 && Number.isFinite(value)) {
+		if (value !== undefined && Number.isSafeInteger(value) && value > 0) {
 			return value;
 		}
 	}

package/src/utils/idle-iterator.ts

@@ -15,6 +15,19 @@ export function getProviderStreamIdleTimeoutFallbackMs(provider: string): number
 	return undefined;
 }
 
+// Grok models behind OpenAI-compatible hosts keep the model id (or an
+// `x-ai/`-prefixed OpenRouter id) even when `provider` is openrouter, kilo,
+// litellm, zenmux, venice, and similar. The long-reasoning silence that
+// motivates the 300s floor is a property of the model, not the account
+// used to reach it, so the floor keys on the model when the provider alone
+// does not already grant it (#4797).
+const GROK_MODEL_ID_PATTERN = /(?:^|[/._-])grok(?:[/._-]|$)/i;
+
+export function isGrokModelId(modelId: string | undefined): boolean {
+	if (!modelId) return false;
+	return GROK_MODEL_ID_PATTERN.test(modelId);
+}
+
 export function getProviderFirstEventTimeoutFallbackMs(provider: string): number | undefined {
 	if (provider === "alibaba-token-plan") return ALIBABA_TOKEN_PLAN_FIRST_EVENT_TIMEOUT_MS;
 	return provider === "kimi-code" ? KIMI_CODE_FIRST_EVENT_TIMEOUT_MS : undefined;
@@ -50,11 +63,15 @@ export function getStreamIdleTimeoutMs(fallbackMs: number = DEFAULT_STREAM_IDLE_
  *
  * Honors `GJC_OPENAI_STREAM_IDLE_TIMEOUT_MS` first (`PI_OPENAI_STREAM_IDLE_TIMEOUT_MS` is the legacy alias). Set `=0` to disable.
  * When `provider` is given, long-reasoning hosts (xAI Grok and Grok Build) use that floor instead of the 120s default.
+ * Grok models reached through other OpenAI-compatible hosts (`openrouter/x-ai/grok-*`, kilo, litellm, …) get the
+ * same floor keyed on the model id, because long-reasoning silence is a property of the model (#4797).
  */
-export function getOpenAIStreamIdleTimeoutMs(provider?: string): number | undefined {
+export function getOpenAIStreamIdleTimeoutMs(provider?: string, modelId?: string): number | undefined {
 	return normalizeIdleTimeoutMs(
-		$env.GJC_OPENAI_STREAM_IDLE_TIMEOUT_MS ?? $env.PI_OPENAI_STREAM_IDLE_TIMEOUT_MS ?? $env.PI_STREAM_IDLE_TIMEOUT_MS,
-		getProviderStreamIdleTimeoutFallbackMs(provider ?? "") ?? DEFAULT_STREAM_IDLE_TIMEOUT_MS,
+		$env.GJC_OPENAI_STREAM_IDLE_TIMEOUT_MS ?? $env.PI_STREAM_IDLE_TIMEOUT_MS ?? $env.PI_OPENAI_STREAM_IDLE_TIMEOUT_MS,
+		getProviderStreamIdleTimeoutFallbackMs(provider ?? "") ??
+			(isGrokModelId(modelId) ? ANTHROPIC_STREAM_IDLE_TIMEOUT_MS : undefined) ??
+			DEFAULT_STREAM_IDLE_TIMEOUT_MS,
 	);
 }
 
@@ -97,10 +114,11 @@ export function getStreamFirstEventTimeoutMs(
 export function resolveOpenAISdkRequestTimeoutMs(
 	provider: string,
 	streamFirstEventTimeoutOverride?: number,
+	modelId?: string,
 ): number | undefined {
 	const providerFirstEventFallbackMs = getProviderFirstEventTimeoutFallbackMs(provider);
 	const envSdkTimeoutMs = getStreamFirstEventTimeoutMs(
-		getOpenAIStreamIdleTimeoutMs(provider),
+		getOpenAIStreamIdleTimeoutMs(provider, modelId),
 		providerFirstEventFallbackMs,
 	);
 	if (streamFirstEventTimeoutOverride === 0) return undefined;

package/src/utils/oauth/index.ts

@@ -180,6 +180,11 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "OpenCode Go",
 		available: true,
 	},
+	{
+		id: "openrouter",
+		name: "OpenRouter",
+		available: true,
+	},
 	{
 		id: "zai",
 		name: "Z.AI (GLM Coding Plan)",
@@ -408,6 +413,7 @@ export async function refreshOAuthToken(
 		case "zai":
 		case "qianfan":
 		case "venice":
+		case "openrouter":
 		case "minimax-code":
 		case "minimax-code-cn":
 		case "moonshot":

package/src/utils/oauth/kimi.ts

@@ -7,7 +7,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { scheduler } from "node:timers/promises";
-import { $pickCredentialEnv, getAgentDir, isEnoent } from "@gajae-code/utils";
+import { $pickCredentialEnv, getAgentDir, isEnoent, sanitizeHeaderComponent } from "@gajae-code/utils";
 import packageJson from "../../../package.json" with { type: "json" };
 import type { OAuthController, OAuthCredentials } from "./types";
 
@@ -90,18 +90,24 @@ let getDeviceId = (): string => {
 	return deviceId;
 };
 
-export let getKimiCommonHeaders = () => {
-	const headers = Object.freeze({
+/** @internal Exported for tests. Builds unsanitized-input-safe Kimi common headers. */
+export function buildKimiCommonHeaders(): Readonly<Record<string, string>> {
+	return Object.freeze({
 		"User-Agent": `KimiCLI/${packageJson.version}`,
 		"X-Msh-Platform": "kimi_cli",
 		"X-Msh-Version": packageJson.version,
-		"X-Msh-Device-Name": os.hostname(),
-		"X-Msh-Device-Model": getDeviceModel(),
-		"X-Msh-Os-Version": os.version(),
+		"X-Msh-Device-Name": sanitizeHeaderComponent(os.hostname()),
+		"X-Msh-Device-Model": sanitizeHeaderComponent(getDeviceModel()),
+		"X-Msh-Os-Version": sanitizeHeaderComponent(os.version()),
 		"X-Msh-Device-Id": getDeviceId(),
 	});
-	getKimiCommonHeaders = () => headers;
-	return headers;
+}
+
+let memoizedKimiCommonHeaders: Readonly<Record<string, string>> | undefined;
+
+export const getKimiCommonHeaders = () => {
+	memoizedKimiCommonHeaders ??= buildKimiCommonHeaders();
+	return memoizedKimiCommonHeaders;
 };
 
 async function requestDeviceAuthorization(): Promise<{

package/src/utils/oauth/kiro.ts

@@ -382,6 +382,7 @@ export async function loginKiro(options: KiroLoginOptions): Promise<OAuthCredent
 
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { getTrustedHomeDir } from "@gajae-code/utils";
 
 interface SsoCachedAccessToken {
 	accessToken: string;
@@ -398,8 +399,7 @@ interface SsoCachedAccessToken {
  * credential store.
  */
 export function importSsoCacheToken(): OAuthCredentials | undefined {
-	const homeDir = process.env.HOME ?? process.env.USERPROFILE;
-	if (!homeDir) return undefined;
+	const homeDir = getTrustedHomeDir();
 	const cacheDir = path.join(homeDir, ".aws", "sso", "cache");
 
 	let files: string[];

package/src/utils/oauth/openrouter.ts

@@ -0,0 +1,16 @@
+/** OpenRouter login flow (API key paste against https://openrouter.ai/api/v1). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginOpenRouter = createApiKeyLogin({
+	providerLabel: "OpenRouter",
+	authUrl: "https://openrouter.ai/keys",
+	instructions: "Copy your API key from the OpenRouter dashboard",
+	promptMessage: "Paste your OpenRouter API key",
+	placeholder: "sk-or-v1-...",
+	validation: {
+		kind: "chat-completions",
+		provider: "OpenRouter",
+		baseUrl: "https://openrouter.ai/api/v1",
+		model: "openrouter/auto",
+	},
+});

package/src/utils/oauth/types.ts

@@ -44,6 +44,7 @@ export type OAuthProvider =
 	| "opencode-go"
 	| "opencode-zen"
 	| "opengateway"
+	| "openrouter"
 	| "parallel"
 	| "perplexity"
 	| "qianfan"