jeopi-ai 16.2.13

package/src/providers/vision-guard.ts

@@ -0,0 +1,54 @@
+import { isDashscopeCompatibleModeUrl } from "jeopi-catalog/hosts";
+import { isQwenModelId } from "jeopi-catalog/identity";
+
+import type { ImageContent, Model, TextContent } from "../types";
+
+export const NON_VISION_IMAGE_PLACEHOLDER = "[image omitted: model does not support vision]";
+
+export function partitionVisionContent(
+	content: ReadonlyArray<TextContent | ImageContent>,
+	supportsImages: boolean,
+): {
+	textBlocks: TextContent[];
+	imageBlocks: ImageContent[];
+	omittedImages: boolean;
+} {
+	const textBlocks = content.filter((block): block is TextContent => block.type === "text");
+	const imageBlocks = content.filter((block): block is ImageContent => block.type === "image");
+	return {
+		textBlocks,
+		imageBlocks: supportsImages ? imageBlocks : [],
+		omittedImages: !supportsImages && imageBlocks.length > 0,
+	};
+}
+
+export function joinTextWithImagePlaceholder(text: string, omittedImages: boolean): string {
+	const parts: string[] = [];
+	if (text.length > 0) {
+		parts.push(text);
+	}
+	if (omittedImages) {
+		parts.push(NON_VISION_IMAGE_PLACEHOLDER);
+	}
+	return parts.join("\n");
+}
+
+/**
+ * Detect known text-only Qwen models served via Alibaba DashScope's consumer
+ * `compatible-mode` endpoint that the upstream chat-completions API rejects
+ * multimodal content arrays for. The compatible-mode endpoint also serves
+ * multimodal Qwen SKUs without `vl` in the id (e.g. `qwen3.7-plus`), so this
+ * guard only covers families verified to be text-only for issue #1859:
+ * `qwen*-max` and `qwen*-coder*`.
+ *
+ * Used as a defensive override in `convertMessages` so a misconfigured custom
+ * provider (issue #1859) can't drive the request into an unrecoverable 400.
+ */
+export function isDashscopeCompatibleModeTextOnlyQwen(model: Model<"openai-completions">): boolean {
+	if (!isDashscopeCompatibleModeUrl(model.baseUrl)) {
+		return false;
+	}
+	const id = model.id.toLowerCase();
+	if (!isQwenModelId(model.id)) return false;
+	return /\bqwen(?:[\d.]+)?-max\b/.test(id) || /\bqwen(?:[\d.]+)?-coder\b/.test(id);
+}

package/src/registry/aimlapi.ts

@@ -0,0 +1,6 @@
+import type { ProviderDefinition } from "./types";
+
+export const aimlApiProvider = {
+	id: "aimlapi",
+	name: "AIML API",
+} as const satisfies ProviderDefinition;

package/src/registry/alibaba-coding-plan.ts

@@ -0,0 +1,95 @@
+import * as AIError from "../error";
+import * as apiKeyValidation from "./api-key-validation";
+import type { OAuthController, OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const DEFAULT_AUTH_URL = "https://modelstudio.console.alibabacloud.com/";
+const CHINA_AUTH_URL = "https://dashscope.console.aliyun.com/";
+const DEFAULT_API_BASE_URL = "https://coding-intl.dashscope.aliyuncs.com/v1";
+const CHINA_API_BASE_URL = "https://coding.dashscope.aliyuncs.com/v1";
+const VALIDATION_MODEL = "qwen3.5-plus";
+
+export async function loginAlibabaCodingPlan(options: OAuthController): Promise<OAuthCredentials> {
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError("Alibaba Coding Plan");
+	}
+
+	// Ask which endpoint to use
+	const endpointChoice = await options.onPrompt({
+		message: "Select Alibaba Coding Plan endpoint: 1=International (default), 2=China, 3=Custom — enter 1, 2, or 3",
+		placeholder: "1",
+	});
+
+	// Check for abort after endpoint selection (Escape returns "")
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	const choice = endpointChoice.trim();
+	let baseUrl: string;
+	let authUrl: string;
+	let instructions: string;
+	if (choice === "2") {
+		baseUrl = CHINA_API_BASE_URL;
+		authUrl = CHINA_AUTH_URL;
+		instructions = "Copy your API key from the Alibaba Cloud DashScope console (China mainland)";
+	} else if (choice === "3") {
+		const customUrl = await options.onPrompt({
+			message: "Enter custom base URL",
+			placeholder: "https://your-proxy.com/v1",
+		});
+		const trimmedUrl = customUrl.trim().replace(/\/+$/, "");
+		if (!trimmedUrl) {
+			throw new AIError.ConfigurationError("Custom URL is required for option 3");
+		}
+		baseUrl = trimmedUrl;
+		authUrl = DEFAULT_AUTH_URL;
+		instructions = "Copy your API key from the Alibaba Cloud DashScope console";
+	} else {
+		baseUrl = DEFAULT_API_BASE_URL;
+		authUrl = DEFAULT_AUTH_URL;
+		instructions = "Copy your API key from the Alibaba Cloud DashScope console (International)";
+	}
+
+	options.onAuth?.({
+		url: authUrl,
+		instructions,
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Alibaba Coding Plan API key",
+		placeholder: "sk-...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new AIError.ApiKeyRequiredError();
+	}
+
+	options.onProgress?.("Validating API key...");
+	await apiKeyValidation.validateOpenAICompatibleApiKey({
+		provider: "Alibaba Coding Plan",
+		apiKey: trimmed,
+		baseUrl,
+		model: VALIDATION_MODEL,
+		signal: options.signal,
+	});
+
+	return {
+		access: trimmed,
+		refresh: trimmed,
+		expires: Number.MAX_SAFE_INTEGER,
+		enterpriseUrl: baseUrl,
+	};
+}
+
+export const alibabaCodingPlanProvider = {
+	id: "alibaba-coding-plan",
+	name: "Alibaba Coding Plan",
+	login: (cb: OAuthLoginCallbacks) => loginAlibabaCodingPlan(cb),
+	getApiKey: credentials => credentials.access,
+} as const satisfies ProviderDefinition;

package/src/registry/amazon-bedrock.ts

@@ -0,0 +1,22 @@
+import { $env } from "jeopi-utils";
+import type { ProviderDefinition } from "./types";
+
+export const amazonBedrockProvider = {
+	id: "amazon-bedrock",
+	name: "Amazon Bedrock",
+	// Amazon Bedrock accepts bearer tokens, IAM keys, profiles, ECS/IRSA credential chains.
+	envKeys: () => {
+		const hasEcsCredentials =
+			!!$env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || !!$env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+		const hasWebIdentity = !!$env.AWS_WEB_IDENTITY_TOKEN_FILE && !!$env.AWS_ROLE_ARN;
+		if (
+			$env.AWS_PROFILE ||
+			($env.AWS_ACCESS_KEY_ID && $env.AWS_SECRET_ACCESS_KEY) ||
+			$env.AWS_BEARER_TOKEN_BEDROCK ||
+			hasEcsCredentials ||
+			hasWebIdentity
+		) {
+			return "<authenticated>";
+		}
+	},
+} as const satisfies ProviderDefinition;

package/src/registry/anthropic.ts

@@ -0,0 +1,26 @@
+import { $pickenv } from "jeopi-utils";
+import { isFoundryEnabled } from "../utils/foundry";
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const anthropicProvider = {
+	id: "anthropic",
+	name: "Anthropic (Claude Pro/Max)",
+	// Foundry mode optionally switches Anthropic auth to enterprise gateway credentials.
+	envKeys: () =>
+		isFoundryEnabled()
+			? $pickenv("ANTHROPIC_FOUNDRY_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY")
+			: $pickenv("ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"),
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginAnthropic } = await import("./oauth/anthropic");
+		return loginAnthropic(cb);
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { refreshAnthropicToken } = await import("./oauth/anthropic");
+		return refreshAnthropicToken(credentials.refresh);
+	},
+	callbackPort: 54545,
+	pasteCodeFlow: true,
+} as const satisfies ProviderDefinition;

package/src/registry/api-key-login.ts

@@ -0,0 +1,112 @@
+/**
+ * Shared factory for API-key-paste "login" flows.
+ *
+ * Several providers (Cerebras, Synthetic, Moonshot, Together, NanoGPT, ZenMux)
+ * don't actually implement OAuth — they just ask the user to paste an API key,
+ * optionally validate it, and return the trimmed key.
+ */
+
+import * as AIError from "../error";
+import {
+	validateAnthropicCompatibleApiKey,
+	validateApiKeyAgainstModelsEndpoint,
+	validateOpenAICompatibleApiKey,
+} from "./api-key-validation";
+import type { OAuthController } from "./oauth/types";
+
+type ChatCompletionsValidation = {
+	kind: "chat-completions";
+	provider: string;
+	baseUrl: string;
+	model: string;
+};
+
+type AnthropicMessagesValidation = {
+	kind: "anthropic-messages";
+	provider: string;
+	baseUrl: string;
+	model: string;
+};
+
+type ModelsEndpointValidation = {
+	kind: "models-endpoint";
+	provider: string;
+	modelsUrl: string;
+	headers?: Record<string, string> | (() => Record<string, string> | undefined);
+};
+
+export type ApiKeyLoginConfig = {
+	/** Display name used in error messages, e.g. "Cerebras", "NanoGPT". */
+	providerLabel: string;
+	/** URL opened in browser for the user to grab their key. */
+	authUrl: string;
+	/** Instructions shown with the onAuth callback. */
+	instructions: string;
+	/** Prompt message shown when asking for the key paste. */
+	promptMessage: string;
+	/** Placeholder string for the prompt (e.g. "sk-...", "csk-..."). */
+	placeholder: string;
+	/** Validation strategy, or `null` to skip validation. */
+	validation: ChatCompletionsValidation | AnthropicMessagesValidation | ModelsEndpointValidation | null;
+};
+
+export function createApiKeyLogin(config: ApiKeyLoginConfig): (options: OAuthController) => Promise<string> {
+	return async function login(options: OAuthController): Promise<string> {
+		if (!options.onPrompt) {
+			throw new AIError.OnPromptRequiredError(config.providerLabel);
+		}
+
+		options.onAuth?.({
+			url: config.authUrl,
+			instructions: config.instructions,
+		});
+
+		const apiKey = await options.onPrompt({
+			message: config.promptMessage,
+			placeholder: config.placeholder,
+		});
+
+		if (options.signal?.aborted) {
+			throw new AIError.LoginCancelledError();
+		}
+
+		const trimmed = apiKey.trim();
+		if (!trimmed) {
+			throw new AIError.ApiKeyRequiredError();
+		}
+
+		if (config.validation) {
+			options.onProgress?.("Validating API key...");
+			if (config.validation.kind === "chat-completions") {
+				await validateOpenAICompatibleApiKey({
+					provider: config.validation.provider,
+					apiKey: trimmed,
+					baseUrl: config.validation.baseUrl,
+					model: config.validation.model,
+					signal: options.signal,
+					fetch: options.fetch,
+				});
+			} else if (config.validation.kind === "anthropic-messages") {
+				await validateAnthropicCompatibleApiKey({
+					provider: config.validation.provider,
+					apiKey: trimmed,
+					baseUrl: config.validation.baseUrl,
+					model: config.validation.model,
+					signal: options.signal,
+					fetch: options.fetch,
+				});
+			} else {
+				await validateApiKeyAgainstModelsEndpoint({
+					provider: config.validation.provider,
+					apiKey: trimmed,
+					modelsUrl: config.validation.modelsUrl,
+					headers: config.validation.headers,
+					signal: options.signal,
+					fetch: options.fetch,
+				});
+			}
+		}
+
+		return trimmed;
+	};
+}

package/src/registry/api-key-validation.ts

@@ -0,0 +1,161 @@
+import * as AIError from "../error";
+import type { FetchImpl } from "../types";
+
+type OpenAICompatibleValidationOptions = {
+	provider: string;
+	apiKey: string;
+	baseUrl: string;
+	model: string;
+	signal?: AbortSignal;
+	fetch?: FetchImpl;
+};
+type AnthropicCompatibleValidationOptions = {
+	provider: string;
+	apiKey: string;
+	baseUrl: string;
+	model: string;
+	signal?: AbortSignal;
+	fetch?: FetchImpl;
+};
+
+type ModelListValidationOptions = {
+	provider: string;
+	apiKey: string;
+	modelsUrl: string;
+	headers?: Record<string, string> | (() => Record<string, string> | undefined);
+	signal?: AbortSignal;
+	fetch?: FetchImpl;
+};
+
+const VALIDATION_TIMEOUT_MS = 15_000;
+
+function normalizeAnthropicCompatibleBaseUrl(baseUrl: string): string {
+	const trimmed = baseUrl.trim().replace(/\/+$/, "");
+	return trimmed.endsWith("/v1") ? trimmed.slice(0, -3) : trimmed;
+}
+
+function resolveValidationHeaders(
+	headers: Record<string, string> | (() => Record<string, string> | undefined) | undefined,
+): Record<string, string> | undefined {
+	return typeof headers === "function" ? headers() : headers;
+}
+
+/**
+ * Validate an API key against an OpenAI-compatible chat completions endpoint.
+ *
+ * Performs a minimal request to verify credentials and endpoint access.
+ */
+export async function validateOpenAICompatibleApiKey(options: OpenAICompatibleValidationOptions): Promise<void> {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const fetchImpl = options.fetch ?? fetch;
+
+	const response = await fetchImpl(`${options.baseUrl}/chat/completions`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${options.apiKey}`,
+		},
+		body: JSON.stringify({
+			model: options.model,
+			messages: [{ role: "user", content: "ping" }],
+			max_tokens: 1,
+			temperature: 0,
+		}),
+		signal,
+	});
+
+	if (response.ok) {
+		return;
+	}
+
+	let details = "";
+	try {
+		details = (await response.text()).trim();
+	} catch {
+		// ignore body parse errors, status is enough
+	}
+
+	const message = details
+		? `${options.provider} API key validation failed (${response.status}): ${details}`
+		: `${options.provider} API key validation failed (${response.status})`;
+	throw new AIError.ApiKeyRequiredError(message);
+}
+
+/**
+ * Validate an API key against an Anthropic-compatible messages endpoint.
+ */
+export async function validateAnthropicCompatibleApiKey(options: AnthropicCompatibleValidationOptions): Promise<void> {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const baseUrl = normalizeAnthropicCompatibleBaseUrl(options.baseUrl);
+	const fetchImpl = options.fetch ?? fetch;
+
+	const response = await fetchImpl(`${baseUrl}/v1/messages`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"anthropic-version": "2023-06-01",
+			"x-api-key": options.apiKey,
+		},
+		body: JSON.stringify({
+			model: options.model,
+			messages: [{ role: "user", content: "ping" }],
+			max_tokens: 1,
+		}),
+		signal,
+	});
+
+	if (response.ok) {
+		return;
+	}
+
+	let details = "";
+	try {
+		details = (await response.text()).trim();
+	} catch {
+		// ignore body parse errors, status is enough
+	}
+
+	const message = details
+		? `${options.provider} API key validation failed (${response.status}): ${details}`
+		: `${options.provider} API key validation failed (${response.status})`;
+	throw new AIError.ApiKeyRequiredError(message);
+}
+
+/**
+ * Validate an API key against a provider models endpoint.
+ *
+ * Useful for providers where access to specific models may vary by plan and
+ * should not block key validation.
+ */
+export async function validateApiKeyAgainstModelsEndpoint(options: ModelListValidationOptions): Promise<void> {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const fetchImpl = options.fetch ?? fetch;
+
+	const response = await fetchImpl(options.modelsUrl, {
+		method: "GET",
+		headers: {
+			...(resolveValidationHeaders(options.headers) ?? {}),
+			Authorization: `Bearer ${options.apiKey}`,
+		},
+		signal,
+	});
+
+	if (response.ok) {
+		return;
+	}
+
+	let details = "";
+	try {
+		details = (await response.text()).trim();
+	} catch {
+		// ignore body parse errors, status is enough
+	}
+
+	const message = details
+		? `${options.provider} API key validation failed (${response.status}): ${details}`
+		: `${options.provider} API key validation failed (${response.status})`;
+	throw new AIError.ApiKeyRequiredError(message);
+}

package/src/registry/azure.ts

@@ -0,0 +1,6 @@
+import type { ProviderDefinition } from "./types";
+
+export const azureProvider = {
+	id: "azure",
+	name: "Azure OpenAI",
+} as const satisfies ProviderDefinition;

package/src/registry/cerebras.ts

@@ -0,0 +1,23 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginCerebras = createApiKeyLogin({
+	providerLabel: "Cerebras",
+	authUrl: "https://cloud.cerebras.ai/platform/",
+	instructions: "Copy your API key from the Cerebras dashboard",
+	promptMessage: "Paste your Cerebras API key",
+	placeholder: "csk-...",
+	validation: {
+		kind: "chat-completions",
+		provider: "Cerebras",
+		baseUrl: "https://api.cerebras.ai/v1",
+		model: "gpt-oss-120b",
+	},
+});
+
+export const cerebrasProvider = {
+	id: "cerebras",
+	name: "Cerebras",
+	login: (cb: OAuthLoginCallbacks) => loginCerebras(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/cloudflare-ai-gateway.ts

@@ -0,0 +1,45 @@
+import * as AIError from "../error";
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const AUTH_URL = "https://developers.cloudflare.com/ai-gateway/configuration/authentication/";
+
+/**
+ * Login to Cloudflare AI Gateway.
+ *
+ * Opens browser to Cloudflare AI Gateway authentication docs and prompts for a gateway token/API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginCloudflareAiGateway(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError("Cloudflare AI Gateway");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions:
+			"Copy your Cloudflare AI Gateway token/API key. Configure account/gateway base URL in models config.",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Cloudflare AI Gateway token/API key",
+		placeholder: "cf-aig-...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new AIError.ApiKeyRequiredError();
+	}
+
+	return trimmed;
+}
+
+export const cloudflareAiGatewayProvider = {
+	id: "cloudflare-ai-gateway",
+	name: "Cloudflare AI Gateway",
+	login: (cb: OAuthLoginCallbacks) => loginCloudflareAiGateway(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/coreweave.ts

@@ -0,0 +1,40 @@
+import { coreWeaveProjectHeaders } from "jeopi-catalog/wire/coreweave";
+import { $env } from "jeopi-utils";
+import * as AIError from "../error";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const PROJECT_PERSIST_INSTRUCTIONS =
+	"add export COREWEAVE_PROJECT=<team>/<project> to your shell startup file (for example ~/.zshrc, ~/.bashrc, or your shell's profile/rc file)";
+const PROJECT_SETUP_INSTRUCTIONS = `Create or select a CoreWeave Serverless Inference project, ${PROJECT_PERSIST_INSTRUCTIONS} for the OpenAI-Project header, then copy your API key from account settings`;
+
+function requireCoreWeaveProjectHeaders(): Record<string, string> {
+	const headers = coreWeaveProjectHeaders($env);
+	if (!headers) {
+		throw new AIError.ConfigurationError(
+			`CoreWeave Serverless Inference requires OpenAI-Project. Set COREWEAVE_PROJECT=<team>/<project> before running /login coreweave. To persist it, ${PROJECT_PERSIST_INSTRUCTIONS}.`,
+		);
+	}
+	return headers;
+}
+
+export const loginCoreWeave = createApiKeyLogin({
+	providerLabel: "CoreWeave Serverless Inference",
+	authUrl: "https://wandb.ai/settings",
+	instructions: PROJECT_SETUP_INSTRUCTIONS,
+	promptMessage: "Paste your CoreWeave Serverless Inference API key",
+	placeholder: "api-key",
+	validation: {
+		kind: "models-endpoint",
+		provider: "CoreWeave Serverless Inference",
+		modelsUrl: "https://api.inference.wandb.ai/v1/models",
+		headers: requireCoreWeaveProjectHeaders,
+	},
+});
+
+export const coreWeaveProvider = {
+	id: "coreweave",
+	name: "CoreWeave Serverless Inference",
+	login: (cb: OAuthLoginCallbacks) => loginCoreWeave(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/cursor.ts

@@ -0,0 +1,20 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const cursorProvider = {
+	id: "cursor",
+	name: "Cursor (Claude, GPT, etc.)",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginCursor } = await import("./oauth/cursor");
+		return loginCursor(
+			url => cb.onAuth({ url }),
+			cb.onProgress ? () => cb.onProgress?.("Waiting for browser authentication...") : undefined,
+		);
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { refreshCursorToken } = await import("./oauth/cursor");
+		return refreshCursorToken(credentials.refresh);
+	},
+} as const satisfies ProviderDefinition;

package/src/registry/deepseek.ts

@@ -0,0 +1,46 @@
+import * as AIError from "../error";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthController, OAuthLoginCallbacks, OAuthPrompt } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const innerLogin = createApiKeyLogin({
+	providerLabel: "DeepSeek",
+	authUrl: "https://platform.deepseek.com/api_keys",
+	instructions: "Create or copy your API key from the DeepSeek dashboard",
+	promptMessage: "Paste your DeepSeek API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "deepseek",
+		modelsUrl: "https://api.deepseek.com/v1/models",
+	},
+});
+
+export function normalizeDeepSeekApiKey(raw: string): string {
+	const trimmed = raw.trim();
+	if (!trimmed) {
+		return trimmed;
+	}
+	const stripped = trimmed.replace(/^bearer\b\s*/i, "");
+	if (!stripped) {
+		throw new AIError.ApiKeyRequiredError("DeepSeek API key is empty after stripping Bearer prefix");
+	}
+	return stripped;
+}
+
+export const loginDeepSeek = async (options: OAuthController): Promise<string> => {
+	const userOnPrompt = options.onPrompt;
+	const wrapped: OAuthController = userOnPrompt
+		? {
+				...options,
+				onPrompt: async (prompt: OAuthPrompt) => normalizeDeepSeekApiKey(await userOnPrompt(prompt)),
+			}
+		: options;
+	return innerLogin(wrapped);
+};
+
+export const deepseekProvider = {
+	id: "deepseek",
+	name: "DeepSeek",
+	login: (cb: OAuthLoginCallbacks) => loginDeepSeek(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/derived.ts

@@ -0,0 +1,9 @@
+import { PROVIDER_REGISTRY } from "./registry";
+
+/**
+ * Providers whose OAuth flow needs a pasted code/redirect URL rather than a
+ * local callback server. Consumed by the coding-agent login UX.
+ */
+export const PASTE_CODE_LOGIN_PROVIDERS: ReadonlySet<string> = new Set(
+	PROVIDER_REGISTRY.filter(p => p.pasteCodeFlow).map(p => p.id),
+);