@vellumai/assistant 0.8.0 → 0.8.2

package/src/providers/model-catalog.ts

@@ -1,8 +1,37 @@
+import { PLATFORM_PROVIDER_META } from "./platform-proxy/constants.js";
+
 export type LongContextMode =
   | "native-model"
   | "provider-request-option"
   | "unsupported";
 
+export interface CatalogModelPricingTier {
+  /**
+   * Threshold in total prompt input tokens above which this tier's rates
+   * apply. The largest matched threshold wins when usage exceeds multiple
+   * tiers (single-step staircase, not progressive bracketing).
+   */
+  inputTokenThreshold: number;
+  inputPer1mTokens: number;
+  outputPer1mTokens: number;
+  cacheReadPer1mTokens?: number;
+  cacheWritePer1mTokens?: number;
+}
+
+export interface CatalogModelPricing {
+  inputPer1mTokens: number;
+  outputPer1mTokens: number;
+  cacheWritePer1mTokens?: number;
+  cacheReadPer1mTokens?: number;
+  /**
+   * Optional long-context pricing tiers. Selected by total prompt input
+   * tokens. When set, the base fields above apply at the low-context tier
+   * (below every tier threshold) and tier entries override at higher
+   * thresholds.
+   */
+  tiers?: CatalogModelPricingTier[];
+}
+
 export interface CatalogModel {
   id: string;
   displayName: string;
@@ -15,12 +44,9 @@ export interface CatalogModel {
   supportsCaching?: boolean;
   supportsVision?: boolean;
   supportsToolUse?: boolean;
-  pricing?: {
-    inputPer1mTokens: number;
-    outputPer1mTokens: number;
-    cacheWritePer1mTokens?: number;
-    cacheReadPer1mTokens?: number;
-  };
+  pricing?: CatalogModelPricing;
+  /** When set, this model is only visible when the named feature flag is enabled. */
+  featureFlag?: string;
 }
 
 const DEFAULT_CONTEXT_WINDOW_TOKENS = 200000;
@@ -64,6 +90,17 @@ export interface ProviderCatalogEntry {
     url: string;
     linkLabel: string;
   };
+  /**
+   * Whether this provider supports the `platform` auth type (Vellum-managed
+   * keys routed through the platform proxy). Derived from
+   * `PLATFORM_PROVIDER_META` at catalog build time so the two stay in lock
+   * step. Clients use this field to hide the "Platform (managed by Vellum)"
+   * option from the auth-type dropdown for providers like Fireworks or
+   * OpenRouter where managed keys are not available.
+   */
+  supportsPlatformAuth?: boolean;
+  /** When set, this provider is only visible when the named feature flag is enabled. */
+  featureFlag?: string;
 }
 
 /**
@@ -201,6 +238,14 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
           inputPer1mTokens: 5.0,
           outputPer1mTokens: 30.0,
           cacheReadPer1mTokens: 0.5,
+          tiers: [
+            {
+              inputTokenThreshold: OPENAI_LONG_CONTEXT_PRICING_THRESHOLD_TOKENS,
+              inputPer1mTokens: 10,
+              outputPer1mTokens: 45,
+              cacheReadPer1mTokens: 1,
+            },
+          ],
         },
       },
       {
@@ -217,6 +262,13 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
         pricing: {
           inputPer1mTokens: 30.0,
           outputPer1mTokens: 180.0,
+          tiers: [
+            {
+              inputTokenThreshold: OPENAI_LONG_CONTEXT_PRICING_THRESHOLD_TOKENS,
+              inputPer1mTokens: 60,
+              outputPer1mTokens: 270,
+            },
+          ],
         },
       },
       {
@@ -234,6 +286,14 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
           inputPer1mTokens: 2.5,
           outputPer1mTokens: 15.0,
           cacheReadPer1mTokens: 0.25,
+          tiers: [
+            {
+              inputTokenThreshold: OPENAI_LONG_CONTEXT_PRICING_THRESHOLD_TOKENS,
+              inputPer1mTokens: 5,
+              outputPer1mTokens: 22.5,
+              cacheReadPer1mTokens: 0.5,
+            },
+          ],
         },
       },
       {
@@ -315,6 +375,14 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
           inputPer1mTokens: 2.0,
           outputPer1mTokens: 12.0,
           cacheReadPer1mTokens: 0.2,
+          tiers: [
+            {
+              inputTokenThreshold: 200_000,
+              inputPer1mTokens: 4,
+              outputPer1mTokens: 18,
+              cacheReadPer1mTokens: 0.4,
+            },
+          ],
         },
       },
       {
@@ -331,6 +399,14 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
           inputPer1mTokens: 2.0,
           outputPer1mTokens: 12.0,
           cacheReadPer1mTokens: 0.2,
+          tiers: [
+            {
+              inputTokenThreshold: 200_000,
+              inputPer1mTokens: 4,
+              outputPer1mTokens: 18,
+              cacheReadPer1mTokens: 0.4,
+            },
+          ],
         },
       },
       {
@@ -407,6 +483,14 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
           inputPer1mTokens: 1.25,
           outputPer1mTokens: 10.0,
           cacheReadPer1mTokens: 0.3125,
+          tiers: [
+            {
+              inputTokenThreshold: 200_000,
+              inputPer1mTokens: 2.5,
+              outputPer1mTokens: 15,
+              cacheReadPer1mTokens: 0.625,
+            },
+          ],
         },
       },
     ],
@@ -613,6 +697,39 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
         supportsToolUse: true,
         pricing: { inputPer1mTokens: 0.27, outputPer1mTokens: 1.1 },
       },
+      {
+        id: "deepseek/deepseek-v4-pro",
+        displayName: "DeepSeek V4 Pro",
+        contextWindowTokens: 1048576,
+        maxOutputTokens: 384000,
+        supportsThinking: true,
+        supportsCaching: false,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: { inputPer1mTokens: 0.435, outputPer1mTokens: 0.87 },
+      },
+      {
+        id: "deepseek/deepseek-v4-flash",
+        displayName: "DeepSeek V4 Flash",
+        contextWindowTokens: 1048576,
+        maxOutputTokens: 384000,
+        supportsThinking: true,
+        supportsCaching: false,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: { inputPer1mTokens: 0.14, outputPer1mTokens: 0.28 },
+      },
+      {
+        id: "deepseek/deepseek-v3.2-speciale",
+        displayName: "DeepSeek V3.2 Speciale",
+        contextWindowTokens: 163840,
+        maxOutputTokens: 163840,
+        supportsThinking: true,
+        supportsCaching: false,
+        supportsVision: false,
+        supportsToolUse: false,
+        pricing: { inputPer1mTokens: 0.287, outputPer1mTokens: 0.431 },
+      },
       // Qwen
       {
         id: "qwen/qwen3.5-plus-02-15",
@@ -755,12 +872,265 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
     apiKeyUrl: "https://openrouter.ai/keys",
     apiKeyPlaceholder: "sk-or-v1-...",
   },
+  {
+    id: "zai",
+    displayName: "z.ai",
+    featureFlag: "provider-zai",
+    subtitle: "GLM models from z.ai (Zhipu AI). Requires a z.ai API key.",
+    setupMode: "api-key",
+    setupHint: "Enter your z.ai API key to enable GLM models.",
+    envVar: "ZAI_API_KEY",
+    credentialsGuide: {
+      description:
+        "Sign in to the z.ai open platform, navigate to API Keys, and create a new key.",
+      url: "https://open.z.ai/open/api/paas/v4/apiKey",
+      linkLabel: "Open z.ai Platform",
+    },
+    models: [
+      {
+        id: "glm-5.1",
+        displayName: "GLM-5.1",
+        contextWindowTokens: 200000,
+        maxOutputTokens: 128000,
+        supportsThinking: false,
+        supportsCaching: false,
+        supportsVision: true,
+        supportsToolUse: true,
+      },
+      {
+        id: "glm-5",
+        displayName: "GLM-5",
+        contextWindowTokens: 200000,
+        maxOutputTokens: 128000,
+        supportsThinking: false,
+        supportsCaching: false,
+        supportsVision: true,
+        supportsToolUse: true,
+      },
+      {
+        id: "glm-5-turbo",
+        displayName: "GLM-5 Turbo",
+        contextWindowTokens: 200000,
+        maxOutputTokens: 128000,
+        supportsThinking: false,
+        supportsCaching: false,
+        supportsVision: true,
+        supportsToolUse: true,
+      },
+      {
+        id: "glm-4.7",
+        displayName: "GLM-4.7",
+        contextWindowTokens: 200000,
+        maxOutputTokens: 128000,
+        supportsThinking: false,
+        supportsCaching: false,
+        supportsVision: true,
+        supportsToolUse: true,
+      },
+      {
+        id: "glm-4.7-flash",
+        displayName: "GLM-4.7 Flash",
+        contextWindowTokens: 200000,
+        maxOutputTokens: 128000,
+        supportsThinking: false,
+        supportsCaching: false,
+        supportsVision: true,
+        supportsToolUse: true,
+      },
+    ],
+    defaultModel: "glm-5.1",
+    apiKeyPlaceholder: "your-api-key",
+  },
+  {
+    id: "deepseek",
+    displayName: "DeepSeek",
+    subtitle:
+      "DeepSeek reasoning and chat models. Requires a DeepSeek API key.",
+    setupMode: "api-key",
+    setupHint: "Enter your DeepSeek API key to enable DeepSeek models.",
+    envVar: "DEEPSEEK_API_KEY",
+    featureFlag: "provider-deepseek",
+    credentialsGuide: {
+      description:
+        "Sign in to the DeepSeek platform, navigate to API Keys, and create a new key.",
+      url: "https://platform.deepseek.com/api_keys",
+      linkLabel: "Open DeepSeek Platform",
+    },
+    models: [
+      {
+        id: "deepseek-v4-pro",
+        displayName: "DeepSeek V4 Pro",
+        contextWindowTokens: 1000000,
+        maxOutputTokens: 384000,
+        supportsThinking: true,
+        supportsCaching: false,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 1.74,
+          outputPer1mTokens: 3.48,
+        },
+      },
+      {
+        id: "deepseek-v4-flash",
+        displayName: "DeepSeek V4 Flash",
+        contextWindowTokens: 1000000,
+        maxOutputTokens: 384000,
+        supportsThinking: true,
+        supportsCaching: false,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 0.14,
+          outputPer1mTokens: 0.28,
+        },
+      },
+    ],
+    defaultModel: "deepseek-v4-pro",
+    apiKeyPlaceholder: "sk-...",
+  },
+  {
+    id: "minimax",
+    displayName: "MiniMax",
+    subtitle: "MiniMax models. Requires a MiniMax API key.",
+    featureFlag: "provider-minimax",
+    setupMode: "api-key",
+    setupHint: "Enter your MiniMax API key to enable MiniMax models.",
+    envVar: "MINIMAX_API_KEY",
+    credentialsGuide: {
+      description:
+        "Sign in to the MiniMax platform, navigate to API Keys, and create a new key.",
+      url: "https://platform.minimax.io/user-center/basic-information/interface-key",
+      linkLabel: "Open MiniMax Platform",
+    },
+    models: [
+      {
+        id: "MiniMax-M2.7",
+        displayName: "MiniMax M2.7",
+        contextWindowTokens: 204800,
+        maxOutputTokens: 131072,
+        supportsThinking: true,
+        supportsCaching: true,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 0.3,
+          outputPer1mTokens: 1.2,
+          cacheReadPer1mTokens: 0.06,
+          cacheWritePer1mTokens: 0.375,
+        },
+      },
+      {
+        id: "MiniMax-M2.7-highspeed",
+        displayName: "MiniMax M2.7 Highspeed",
+        contextWindowTokens: 204800,
+        maxOutputTokens: 131072,
+        supportsThinking: true,
+        supportsCaching: true,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 0.6,
+          outputPer1mTokens: 2.4,
+          cacheReadPer1mTokens: 0.06,
+          cacheWritePer1mTokens: 0.375,
+        },
+      },
+      {
+        id: "MiniMax-M2.5",
+        displayName: "MiniMax M2.5",
+        contextWindowTokens: 204800,
+        maxOutputTokens: 196608,
+        supportsThinking: true,
+        supportsCaching: true,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 0.3,
+          outputPer1mTokens: 1.2,
+          cacheReadPer1mTokens: 0.03,
+          cacheWritePer1mTokens: 0.375,
+        },
+      },
+      {
+        id: "MiniMax-M2.5-highspeed",
+        displayName: "MiniMax M2.5 Highspeed",
+        contextWindowTokens: 204800,
+        maxOutputTokens: 196608,
+        supportsThinking: true,
+        supportsCaching: true,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 0.6,
+          outputPer1mTokens: 2.4,
+          cacheReadPer1mTokens: 0.03,
+          cacheWritePer1mTokens: 0.375,
+        },
+      },
+      {
+        id: "MiniMax-M2.1",
+        displayName: "MiniMax M2.1",
+        contextWindowTokens: 204800,
+        maxOutputTokens: 131072,
+        supportsThinking: true,
+        supportsCaching: true,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 0.3,
+          outputPer1mTokens: 1.2,
+          cacheReadPer1mTokens: 0.03,
+          cacheWritePer1mTokens: 0.375,
+        },
+      },
+      {
+        id: "MiniMax-M2.1-highspeed",
+        displayName: "MiniMax M2.1 Highspeed",
+        contextWindowTokens: 204800,
+        maxOutputTokens: 131072,
+        supportsThinking: true,
+        supportsCaching: true,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 0.6,
+          outputPer1mTokens: 2.4,
+          cacheReadPer1mTokens: 0.03,
+          cacheWritePer1mTokens: 0.375,
+        },
+      },
+      {
+        id: "MiniMax-M2",
+        displayName: "MiniMax M2",
+        contextWindowTokens: 204800,
+        maxOutputTokens: 131072,
+        supportsThinking: true,
+        supportsCaching: true,
+        supportsVision: false,
+        supportsToolUse: true,
+        pricing: {
+          inputPer1mTokens: 0.3,
+          outputPer1mTokens: 1.2,
+          cacheReadPer1mTokens: 0.03,
+          cacheWritePer1mTokens: 0.375,
+        },
+      },
+    ],
+    defaultModel: "MiniMax-M2.7",
+    apiKeyPlaceholder: "eyJ...",
+  },
 ];
 
 export const PROVIDER_CATALOG: ProviderCatalogEntry[] =
   RAW_PROVIDER_CATALOG.map((entry) => ({
     ...entry,
     models: entry.models.map(catalogModel),
+    // Derive supportsPlatformAuth from PLATFORM_PROVIDER_META so the catalog
+    // and the proxy routing table can never drift. Adding a provider to
+    // PLATFORM_PROVIDER_META with `managed: true` automatically opts it into
+    // the Platform auth-type dropdown in the clients.
+    supportsPlatformAuth: PLATFORM_PROVIDER_META[entry.id]?.managed === true,
   }));
 
 /** Check if a model ID is in the catalog for a given provider. */
@@ -768,3 +1138,13 @@ export function isModelInCatalog(provider: string, modelId: string): boolean {
   const entry = PROVIDER_CATALOG.find((p) => p.id === provider);
   return entry?.models.some((m) => m.id === modelId) ?? false;
 }
+
+/** Return the unique catalog provider that owns a model ID, if known. */
+export function getCatalogProviderForModel(
+  modelId: string,
+): string | undefined {
+  const matches = PROVIDER_CATALOG.filter((p) =>
+    p.models.some((m) => m.id === modelId),
+  );
+  return matches.length === 1 ? matches[0]?.id : undefined;
+}

package/src/providers/openai/chat-completions-provider.ts

@@ -60,6 +60,8 @@ export interface OpenAIChatCompletionsProviderOptions {
   providerName?: string;
   providerLabel?: string;
   streamTimeoutMs?: number;
+  /** Provider-level request headers merged into every API request. */
+  requestHeaders?: Record<string, string>;
   /** Extra params spread into every chat.completions.create call (e.g. reasoning). */
   extraCreateParams?: Record<string, unknown>;
   /** Upper bound for `reasoning_effort` sent on the wire. Defaults to "xhigh"
@@ -110,6 +112,7 @@ export class OpenAIChatCompletionsProvider implements Provider {
   private streamTimeoutMs: number;
   private extraCreateParams: Record<string, unknown>;
   private maxReasoningEffort: "high" | "xhigh";
+  private requestHeaders: Record<string, string>;
 
   constructor(
     apiKey: string,
@@ -126,6 +129,7 @@ export class OpenAIChatCompletionsProvider implements Provider {
     this.streamTimeoutMs = options.streamTimeoutMs ?? 1_800_000;
     this.extraCreateParams = options.extraCreateParams ?? {};
     this.maxReasoningEffort = options.maxReasoningEffort ?? "xhigh";
+    this.requestHeaders = options.requestHeaders ?? {};
   }
 
   async sendMessage(
@@ -197,10 +201,14 @@ export class OpenAIChatCompletionsProvider implements Provider {
       let cachedPromptTokens = 0;
 
       try {
+        const requestHeaders = {
+          ...this.requestHeaders,
+          ...(usageAttributionHeaders ?? {}),
+        };
         const stream = await this.client.chat.completions.create(params, {
           signal: timeoutSignal,
-          ...(usageAttributionHeaders
-            ? { headers: usageAttributionHeaders }
+          ...(Object.keys(requestHeaders).length > 0
+            ? { headers: requestHeaders }
             : {}),
         });
 

package/src/providers/openai/responses-provider.ts

@@ -49,9 +49,11 @@ const VALID_VERBOSITIES = new Set<string>(["low", "medium", "high"]);
  *  Responses API (o-series, etc.) reject unknown wire fields with HTTP 400, so
  *  gate forwarding by model name here. The retry layer can't make this call
  *  because verbosity defaults to "medium" in the LLM schema, so every
- *  callSite-resolved request would otherwise carry it regardless of model. */
+ *  callSite-resolved request would otherwise carry it regardless of model.
+ *  Also matches OpenAI fine-tune IDs of the form `ft:gpt-5.x:org::id` so users
+ *  on GPT-5 fine-tunes keep explicit verbosity control. */
 function modelSupportsVerbosity(model: string): boolean {
-  return /^gpt-5(\b|[-.])/i.test(model);
+  return /^(ft:)?gpt-5(\b|[-.])/i.test(model);
 }
 
 /** Loosely-typed Responses stream event to avoid `any` while the SDK types settle. */

package/src/providers/openrouter/client.ts

@@ -18,6 +18,11 @@ export interface OpenRouterProviderOptions {
 }
 
 const DEFAULT_OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1";
+const OPENROUTER_APP_ATTRIBUTION_HEADERS = {
+  "HTTP-Referer": "https://www.vellum.ai",
+  "X-OpenRouter-Title": "Vellum Assistant",
+  "X-OpenRouter-Categories": "personal-agent,cli-agent",
+};
 
 // Models on OpenRouter prefixed `anthropic/` are routed through OpenRouter's
 // Anthropic-compatible Messages API at `<root>/v1/messages` (where `<root>` is
@@ -93,6 +98,7 @@ export class OpenRouterProvider extends OpenAIChatCompletionsProvider {
       providerName: "openrouter",
       providerLabel: "OpenRouter",
       streamTimeoutMs: options.streamTimeoutMs,
+      requestHeaders: OPENROUTER_APP_ATTRIBUTION_HEADERS,
     });
     this.openRouterApiKey = apiKey;
     this.defaultModel = model;
@@ -192,6 +198,7 @@ export class OpenRouterProvider extends OpenAIChatCompletionsProvider {
           streamTimeoutMs: this.providerStreamTimeoutMs,
           authToken: this.openRouterApiKey,
           useNativeWebSearch: this.useNativeWebSearch,
+          requestHeaders: OPENROUTER_APP_ATTRIBUTION_HEADERS,
         },
       );
     }

package/src/providers/{managed-proxy → platform-proxy}/constants.ts

@@ -25,7 +25,7 @@ export interface ManagedProviderMeta {
  * managed credentials are present; that policy lives in the registry/context
  * fallback allowlists.
  */
-export const MANAGED_PROVIDER_META: Record<string, ManagedProviderMeta> = {
+export const PLATFORM_PROVIDER_META: Record<string, ManagedProviderMeta> = {
   openai: {
     name: "openai",
     managed: true,
@@ -50,4 +50,7 @@ export const MANAGED_PROVIDER_META: Record<string, ManagedProviderMeta> = {
     managed: false,
   },
   ollama: { name: "ollama", managed: false },
+  zai: { name: "zai", managed: false },
+  deepseek: { name: "deepseek", managed: false },
+  minimax: { name: "minimax", managed: false },
 };

package/src/providers/{managed-proxy → platform-proxy}/context.ts

@@ -12,7 +12,7 @@
 import { getPlatformBaseUrl } from "../../config/env.js";
 import { credentialKey } from "../../security/credential-key.js";
 import { getSecureKeyAsync } from "../../security/secure-keys.js";
-import { MANAGED_PROVIDER_META } from "./constants.js";
+import { PLATFORM_PROVIDER_META } from "./constants.js";
 
 /** Storage key for the assistant API key credential. */
 const ASSISTANT_API_KEY_STORAGE_KEY = credentialKey(
@@ -70,7 +70,7 @@ export async function hasManagedProxyPrereqs(): Promise<boolean> {
 export async function buildManagedBaseUrl(
   provider: string,
 ): Promise<string | undefined> {
-  const meta = MANAGED_PROVIDER_META[provider];
+  const meta = PLATFORM_PROVIDER_META[provider];
   if (!meta?.managed || !meta.proxyPath) return undefined;
 
   const ctx = await resolveManagedProxyContext();
@@ -88,7 +88,7 @@ export async function buildManagedBaseUrl(
 export async function managedFallbackEnabledFor(
   provider: string,
 ): Promise<boolean> {
-  const meta = MANAGED_PROVIDER_META[provider];
+  const meta = PLATFORM_PROVIDER_META[provider];
   if (!meta?.managed) return false;
   return await hasManagedProxyPrereqs();
 }

package/src/providers/provider-availability.ts

@@ -5,9 +5,11 @@
  * environment variable fallbacks, and managed proxy availability.
  */
 
-import { API_KEY_PROVIDERS } from "../config/loader.js";
+import { API_KEY_PROVIDERS, getConfig } from "../config/loader.js";
 import { getProviderKeyAsync } from "../security/secure-keys.js";
-import { managedFallbackEnabledFor } from "./managed-proxy/context.js";
+import { PROVIDER_CATALOG } from "./model-catalog.js";
+import { managedFallbackEnabledFor } from "./platform-proxy/context.js";
+import { getVisibleProviderCatalog } from "./provider-catalog-visibility.js";
 
 /**
  * Check whether a single provider is usable — via a user-provided key
@@ -25,11 +27,24 @@ export async function isProviderAvailable(provider: string): Promise<boolean> {
 /**
  * Build the list of providers that are usable — via a user-provided key
  * (secure storage or env var) or via the managed proxy fallback.
+ * Feature-flagged LLM providers that are currently disabled are excluded.
  * Ollama is always included because it does not require an API key.
  */
 export async function getConfiguredProviders(): Promise<string[]> {
+  // Build the set of LLM providers hidden by feature flags so we can
+  // exclude them while leaving non-LLM providers (search, STT, TTS)
+  // in API_KEY_PROVIDERS unchanged.
+  const allLlmIds = new Set(PROVIDER_CATALOG.map((p) => p.id));
+  const visibleLlmIds = new Set(
+    getVisibleProviderCatalog(getConfig()).map((p) => p.id),
+  );
+  const hiddenLlmIds = new Set(
+    [...allLlmIds].filter((id) => !visibleLlmIds.has(id)),
+  );
+
   const configured: string[] = [];
   for (const p of API_KEY_PROVIDERS) {
+    if (hiddenLlmIds.has(p)) continue;
     if (await isProviderAvailable(p)) {
       configured.push(p);
     }

package/src/providers/provider-catalog-visibility.ts

@@ -0,0 +1,36 @@
+/**
+ * Feature-flag-aware provider catalog filtering.
+ *
+ * User-facing catalog consumers (model info, slash commands, provider
+ * availability) use `getVisibleProviderCatalog()` to hide providers and
+ * models gated behind disabled feature flags. Internal consumers
+ * (adapter-factory, pricing, auth) continue using the unfiltered
+ * `PROVIDER_CATALOG` directly.
+ */
+
+import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
+import type { AssistantConfig } from "../config/schema.js";
+import {
+  PROVIDER_CATALOG,
+  type ProviderCatalogEntry,
+} from "./model-catalog.js";
+
+export function getVisibleProviderCatalog(
+  config: AssistantConfig,
+): ProviderCatalogEntry[] {
+  return PROVIDER_CATALOG.filter(
+    (entry) =>
+      !entry.featureFlag ||
+      isAssistantFeatureFlagEnabled(entry.featureFlag, config),
+  )
+    .map((entry) => {
+      const visibleModels = entry.models.filter(
+        (m) =>
+          !m.featureFlag ||
+          isAssistantFeatureFlagEnabled(m.featureFlag, config),
+      );
+      if (visibleModels.length === entry.models.length) return entry;
+      return { ...entry, models: visibleModels };
+    })
+    .filter((entry) => entry.models.length > 0);
+}