feat(provider): native Kimi OAuth + 5 API-key providers

Adds six built-in providers to the data-driven registry.

Native OAuth (like Claude/ChatGPT/Copilot):
- Kimi Code — RFC 8628 device-flow OAuth against auth.kimi.com,
  access_token used directly as the API bearer (no proxy exchange),
  refreshed via refresh_token. New provider/kimi/{kimi_oauth,provider},
  KimiWaiting login state, KimiDeviceCodeReady/LoginDone msgs,
  cmd::kimi_login_async, waiting panel, picker badge, and full
  multi-account wiring in account_switch. Selection::is_kimi() +
  LongLived::Kimi dispatch slot.

API-key OpenAI-compat rows (registry array 10 -> 16), each with a
dedicated Endpoint::from_spec arm:
- deepseek  (api.deepseek.com, root path, DEEPSEEK_API_KEY)
- xai       (api.x.ai/v1, XAI_API_KEY)
- mistral   (api.mistral.ai/v1, MISTRAL_API_KEY)
- gemini    (generativelanguage.googleapis.com/v1beta/openai,
             GEMINI_API_KEY|GOOGLE_API_KEY|OPENAI_API_KEY)
- fireworks (api.fireworks.ai/inference/v1, FIREWORKS_API_KEY)

catalog.hpp capability inference now recognizes the deepseek-v4/
reasoner/chat, grok, gemini, and magistral families as native
tool-callers. Endpoints locked in openai_transport_test; Kimi wire
parsing/expiry in kimi_token_test. All six verified routing
end-to-end. 274/274 tests green.

Author: 1ay1

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to agentty. Versions follow [SemVer](https://semver.org/).
 
 ## [Unreleased]
 
+### Added
+- **Four more built-in providers: xAI (Grok), Mistral, Google Gemini, and Fireworks** (`--provider xai|mistral|gemini|fireworks`, or pick in `^P`). All are API-key OpenAI-compat rows — set the provider's key (`XAI_API_KEY`, `MISTRAL_API_KEY`, `GEMINI_API_KEY`/`GOOGLE_API_KEY`, `FIREWORKS_API_KEY`), `-k`, or the in-app prompt. Each gets a dedicated `Endpoint::from_spec` arm for its host/path (Gemini's OpenAI shim nests under `/v1beta/openai`; Fireworks under `/inference/v1`); capability inference now recognizes the `grok`, `gemini`, and `magistral` families as native tool-callers. (`registry.hpp`, `openai/transport.cpp`, `catalog.hpp`; `openai_transport_test`.)
+- **DeepSeek as a built-in provider (`--provider deepseek`, or pick it in `^P`).** Point agentty at DeepSeek's OpenAI-compatible API (`api.deepseek.com`) with a `DEEPSEEK_API_KEY` (or `-k`) — no new login flow, since DeepSeek issues static API keys, not developer OAuth. Its endpoints live at the root (no `/v1` prefix), so it gets a dedicated `Endpoint::from_spec` arm; the V4 model family (`deepseek-v4-pro`/`-flash`, `deepseek-chat`/`-reasoner`) is recognized as native tool-callers by the capability inference. (`include/agentty/provider/registry.hpp`, `src/provider/openai/transport.cpp`, `include/agentty/domain/catalog.hpp`; `openai_transport_test`.)
+
 ## [0.3.1] - 2026-08-21
 
 ### Added

README.md

@@ -23,7 +23,7 @@ Most terminal coding agents ship as a Node or Python app and send big chunks of
 
 - **It's one native binary.** 16.7 MB, ~3 ms cold start, zero runtime dependencies — no Node, no Python, no `npm install`, no `node_modules`. Download and run.
 - **It sends only the relevant code.** Built-in retrieval (hybrid BM25 + dense embeddings, code-aware chunking, GraphRAG) fetches just the slices that matter — often cutting context by 80%+ vs. whole-repo dumping.
-- **It's not locked to one vendor.** Sign in with your Claude Pro/Max, or point it at OpenAI, Groq, OpenRouter, Cerebras, or a fully local Ollama model. Switch live with `^P`.
+- **It's not locked to one vendor.** Sign in with your Claude Pro/Max, or point it at OpenAI, Groq, OpenRouter, Cerebras, DeepSeek, xAI (Grok), Mistral, Gemini, Fireworks, or a fully local Ollama model. Switch live with `^P`.
 - **It's safe by default.** Shell and build commands run in a sandbox; air-gap an entire session over SSH with one command.
 - **It's open source (MIT)** and runs inside Zed over ACP.
 
@@ -81,6 +81,9 @@ agentty --provider openai -m gpt-4o        # GPT
 agentty --provider groq -m llama-3.3-70b   # Groq
 agentty --provider ollama -m qwen2.5-coder # local model, no key
 agentty --provider openrouter              # any model via OpenRouter
+agentty --provider deepseek -m deepseek-v4-pro  # DeepSeek (DEEPSEEK_API_KEY)
+agentty --provider xai -m grok-4.6         # xAI Grok (XAI_API_KEY)
+agentty --provider gemini -m gemini-3.7-flash   # Google Gemini (GEMINI_API_KEY)
 agentty -m claude-opus-4-5                 # Claude (API key or Pro/Max OAuth)
 ```
 

cmake/AgenttySources.cmake

@@ -59,6 +59,8 @@ set(AGENTTY_PROVIDER_SOURCES
     src/provider/chatgpt/responses.cpp
     src/provider/copilot/provider.cpp
     src/provider/copilot/copilot_oauth.cpp
+    src/provider/kimi/provider.cpp
+    src/provider/kimi/kimi_oauth.cpp
     src/provider/openai/transport.cpp
     src/provider/ollama/transport.cpp
     src/provider/selection.cpp

cmake/AgenttyTests.cmake

@@ -19,7 +19,7 @@ set(_AGENTTY_CONSOLIDATED
     custom_host_key_prompt_test decomposition_memory_test dispatch_route_test
     model_label_test cache_anchor_test composer_edit_test hooks_gate_test
     midrun_freeze_test smart_mode_test stream_liveness_test wire_golden_test
-    wire_shared_test complexity_test copilot_token_test routing_memory_test
+    wire_shared_test complexity_test copilot_token_test kimi_token_test routing_memory_test
     smart_cascade_gate_test chatgpt_bundled_models_test settings_default_test
     update_check_test
     workspace_index_test

docs/website/providers.md

@@ -42,6 +42,11 @@ Even a 1M window eventually fills on a long session. When it does, you can [fork
 | `openrouter` | Any model via `openrouter.ai` | `OPENROUTER_API_KEY` |
 | `together` | Open models on `together.ai` | `TOGETHER_API_KEY` |
 | `cerebras` | Wafer-scale inference — very fast | `CEREBRAS_API_KEY` |
+| `deepseek` | DeepSeek V4 on `api.deepseek.com` | `DEEPSEEK_API_KEY` |
+| `xai` | xAI Grok models on `api.x.ai` | `XAI_API_KEY` |
+| `mistral` | Mistral / Codestral / Magistral on `api.mistral.ai` | `MISTRAL_API_KEY` |
+| `gemini` | Google Gemini via the OpenAI-compat API | `GEMINI_API_KEY` |
+| `fireworks` | Open models on `fireworks.ai` | `FIREWORKS_API_KEY` |
 | `ollama` | Local models at `localhost:11434` | None |
 | `host:port` | Any raw OpenAI-compatible endpoint | `OPENAI_API_KEY` |
 | `https://host[:port]/path` | Any OpenAI-compatible endpoint with a custom path prefix (e.g. a gateway serving on `/api` instead of `/v1`) | `OPENAI_API_KEY` |

include/agentty/domain/catalog.hpp

@@ -392,7 +392,7 @@ struct ModelCapabilities {
     //   - Local families with native/trained tool-calling: qwen3, llama3.1,
     //     llama3.3, mistral / mixtral / ministral, command-r, hermes,
     //     firefunction, functionary, devstral, codestral, gpt-oss, granite,
-    //     glm-4, deepseek (v3/r1).
+    //     glm-4, deepseek (v3/v4/r1/reasoner/chat), grok, gemini, magistral.
     //   - Any model >= ~14B parameters (large enough to follow tool schemas).
     //
     // Weak (treat with guards):
@@ -473,7 +473,10 @@ struct ModelCapabilities {
             contains(id, "devstral")     || contains(id, "codestral")  ||
             contains(id, "gpt-oss")      || contains(id, "granite")    ||
             contains(id, "glm-4")        || contains(id, "deepseek-v3")||
-            contains(id, "deepseek-r1");
+            contains(id, "deepseek-v4")  || contains(id, "deepseek-r1")||
+            contains(id, "deepseek-reasoner") || contains(id, "deepseek-chat") ||
+            contains(id, "grok")         || contains(id, "gemini")      ||
+            contains(id, "magistral");
         // A strong family at >= ~7B is reliable; only flag it weak if it's
         // explicitly tiny (<= 3B), where even good families struggle.
         if (strong_family) return params_b != 0 && params_b <= 3;

include/agentty/provider/dispatch.hpp

@@ -47,7 +47,7 @@ using StreamFn = std::function<StreamResult(Request, EventSink)>;
 // Adding a long-lived provider = one enumerator here + one slot in Router +
 // one `slot_for` arm. Adding a per-call provider needs NONE of this — it flows
 // through the generic OpenAI-compat builder purely from its registry row.
-enum class LongLived : std::uint8_t { None, Anthropic, ChatGpt, Copilot };
+enum class LongLived : std::uint8_t { None, Anthropic, ChatGpt, Copilot, Kimi };
 
 // Map a selection to its long-lived slot, purely from registry data: the
 // oauth_native flag (ChatGPT/Codex) and the Anthropic dialect. No label
@@ -62,7 +62,7 @@ enum class LongLived : std::uint8_t { None, Anthropic, ChatGpt, Copilot };
 // (OpenAI-compat / Ollama) are built inside dispatch from the active Endpoint,
 // so they need no slot here.
 struct ProviderRouter {
-    StreamFn long_lived[4]{};   // indexed by LongLived: [None]=unused, [Anthropic], [ChatGpt], [Copilot]
+    StreamFn long_lived[5]{};   // indexed by LongLived: [None]=unused, [Anthropic], [ChatGpt], [Copilot], [Kimi]
 
     // Kind::ExternalAcp — drive an external ACP agent subprocess. Bound in
     // main() to stream_external_acp(agent_id, …); erased here so dispatch has

include/agentty/provider/kimi/kimi_oauth.hpp

@@ -0,0 +1,95 @@
+#pragma once
+// agentty::provider::kimi — Kimi Code OAuth (device flow).
+//
+// Kimi Code (Moonshot AI) authenticates terminal clients with the OAuth 2.0
+// Device Authorization Grant (RFC 8628) against `https://auth.kimi.com`, then
+// serves an OpenAI-compatible chat API at `https://api.kimi.com/coding/v1`.
+//
+// Unlike GitHub Copilot, Kimi's device-flow access_token is used DIRECTLY as
+// the API bearer — there is no separate proxy-token exchange step. When the
+// access_token expires it is refreshed via the standard `refresh_token` grant.
+// So this module is the simpler sibling of copilot_oauth: request a device
+// code, poll for the token bundle, persist it, and refresh transparently.
+//
+// Three OAuth endpoints, all POST form-encoded to the OAuth host:
+//   POST /api/oauth/device_authorization        → device + user code
+//   POST /api/oauth/token (grant=device_code)   → token bundle (polling)
+//   POST /api/oauth/token (grant=refresh_token) → refreshed token bundle
+//
+// The persisted bundle lives in `config_dir()/kimi_credentials.json`, sealed
+// with the same cred_crypt seam as every other provider credential.
+
+#include <cstdint>
+#include <expected>
+#include <filesystem>
+#include <functional>
+#include <optional>
+#include <string>
+#include <string_view>
+
+#include "agentty/auth/auth.hpp"   // OAuthError
+
+namespace agentty::provider::kimi {
+
+// The persisted Kimi token bundle. `access_token` is the API bearer;
+// `refresh_token` mints a fresh one when it expires.
+struct KimiToken {
+    std::string access_token;        // send as `Authorization: Bearer <token>`
+    std::string refresh_token;       // used with grant_type=refresh_token
+    std::int64_t expires_at_ms = 0;  // skew-safe LOCAL expiry (now + expires_in)
+    std::string token_type;          // "Bearer"
+    std::string scope;               // granted scopes (informational)
+
+    [[nodiscard]] bool expired(std::int64_t skew_ms = 0) const noexcept {
+        return expires_at_ms != 0 && now_ms() >= expires_at_ms - skew_ms;
+    }
+    [[nodiscard]] bool valid() const noexcept { return !access_token.empty(); }
+
+    static std::int64_t now_ms() noexcept;
+};
+
+// The UI seam: agentty shows this to the user ("go to <url> and enter <code>").
+struct DeviceCode {
+    std::string verification_uri;            // https://auth.kimi.com/device (fallback)
+    std::string verification_uri_complete;   // pre-filled URL with the code embedded
+    std::string user_code;                   // e.g. "WDJB-MJHT"
+    int         expires_in = 900;
+};
+using DeviceCodeSink = std::function<void(const DeviceCode&)>;
+using CancelProbe    = std::function<bool()>;
+
+// ── Device-flow login ─────────────────────────────────────────────────────
+// Requests a device code (delivered to `on_device_code` so the modal can show
+// it), then block-polls the token endpoint until the user approves, the code
+// expires, or `cancelled()` trips. On success the token bundle is persisted
+// and returned. `timeout_s` bounds the whole poll loop.
+[[nodiscard]] std::expected<KimiToken, auth::OAuthError>
+login(int timeout_s, DeviceCodeSink on_device_code, CancelProbe cancelled);
+
+// ── Credential store ───────────────────────────────────────────────────────
+[[nodiscard]] std::filesystem::path credentials_path();
+[[nodiscard]] std::optional<KimiToken> load_token();
+bool save_token(const KimiToken& tok);
+bool clear_credentials();
+
+// Cheap "is a Kimi credential present?" for the picker view (stat-cached).
+[[nodiscard]] bool signed_in();
+
+// Force the next fresh_token() to refresh even if the cached token looks valid
+// (called after the API returns 401 mid-turn).
+void invalidate_cached_token();
+
+// ── Per-turn token ─────────────────────────────────────────────────────────
+// Returns a valid access token for the API, refreshing via refresh_token when
+// the persisted one is expired (or a forced refresh was requested). nullopt
+// when not signed in or the refresh failed.
+[[nodiscard]] std::optional<KimiToken> fresh_token();
+
+// ── Testing seam ───────────────────────────────────────────────────────────
+// Parse a token-endpoint JSON body into a KimiToken (expiry computed from
+// `expires_in` relative to `now_ms`). nullopt when the required fields are
+// missing. Exposed so the wire parsing is unit-testable without a network.
+[[nodiscard]] std::optional<KimiToken>
+parse_token_response(std::string_view json_body, std::int64_t now_ms);
+
+} // namespace agentty::provider::kimi

include/agentty/provider/kimi/provider.hpp

@@ -0,0 +1,45 @@
+#pragma once
+// agentty::provider::kimi::KimiProvider — native Kimi Code provider.
+//
+// Kimi Code's inference API is OpenAI-Chat-compatible, served at a fixed base
+// URL (https://api.kimi.com/coding/v1), so this is a THIN wrapper over the
+// shared openai transport: on each turn it ensures a fresh OAuth access token
+// (auto-refreshed via refresh_token from the persisted device-flow bundle),
+// builds the Endpoint, stamps the token as the request auth, and delegates
+// streaming to openai::run_stream_sync. A 401 (token revoked early) triggers
+// one forced refresh + retry.
+//
+// It is a LongLived provider (owns the token cache) — constructed once in
+// main() like the Anthropic / ChatGPT / Copilot providers.
+
+#include <string>
+#include <vector>
+
+#include "agentty/domain/catalog.hpp"       // ModelInfo
+#include "agentty/provider/provider.hpp"
+#include "agentty/provider/openai/transport.hpp"  // openai::Endpoint
+#include "agentty/provider/stream_epilogue.hpp"
+
+namespace agentty::provider::kimi {
+
+class KimiProvider {
+public:
+    KimiProvider() = default;
+
+    provider::StreamResult stream(provider::Request req, provider::EventSink sink);
+
+    // Builds the Kimi inference Endpoint. Shared by stream() and list_models().
+    static provider::openai::Endpoint make_endpoint();
+};
+
+// The account's live model catalog from Kimi's /models (falls back to a small
+// bundled list when offline / not signed in).
+[[nodiscard]] std::vector<ModelInfo> list_models();
+
+// The account's default model slug (first catalog entry) or a safe fallback.
+[[nodiscard]] std::string default_model();
+
+// Drop the cached model catalog so the next list_models() re-fetches.
+void invalidate_model_cache();
+
+} // namespace agentty::provider::kimi

include/agentty/provider/registry.hpp

@@ -144,7 +144,7 @@ using ProviderPreset = ProviderDescriptor;
 // To add a provider: append a row here, and — if it's OpenAI-compatible with
 // a non-default wire path — add the matching `Endpoint` arm in
 // openai/transport.cpp::from_spec keyed on the same `id`.
-inline constexpr std::array<ProviderDescriptor, 10> kProviders{{
+inline constexpr std::array<ProviderDescriptor, 16> kProviders{{
     {"anthropic",  "Anthropic",  "Claude — OAuth (Pro/Max) or API key",
      Wire::AnthropicMessages, Lifetime::LongLived, AuthStyle::OAuthOrKey, false, {"", "", ""}, "api.anthropic.com"},
     {"openai",     "OpenAI",     "GPT / Codex — api.openai.com",
@@ -153,6 +153,8 @@ inline constexpr std::array<ProviderDescriptor, 10> kProviders{{
      Wire::OpenAIResponses,   Lifetime::LongLived, AuthStyle::None,       true,  {"", "", ""}, "chatgpt.com", /*oauth_native=*/true},
     {"copilot",   "GitHub Copilot", "Sign in with GitHub — Copilot models, no API key",
      Wire::OpenAIChat,        Lifetime::LongLived, AuthStyle::None,       false, {"", "", ""}, "api.githubcopilot.com", /*oauth_native=*/true},
+    {"kimi",      "Kimi",       "Sign in with Kimi — Kimi K2 models, no API key",
+     Wire::OpenAIChat,        Lifetime::LongLived, AuthStyle::None,       false, {"", "", ""}, "api.kimi.com", /*oauth_native=*/true},
     {"groq",       "Groq",       "Llama/Mixtral on Groq LPUs — very fast",
      Wire::OpenAIChat,        Lifetime::PerCall,   AuthStyle::ApiKey,     false, {"GROQ_API_KEY", "OPENAI_API_KEY", ""}, ""},
     {"openrouter", "OpenRouter", "Any model via openrouter.ai",
@@ -161,6 +163,16 @@ inline constexpr std::array<ProviderDescriptor, 10> kProviders{{
      Wire::OpenAIChat,        Lifetime::PerCall,   AuthStyle::ApiKey,     false, {"TOGETHER_API_KEY", "OPENAI_API_KEY", ""}, ""},
     {"cerebras",   "Cerebras",   "Wafer-scale inference — very fast",
      Wire::OpenAIChat,        Lifetime::PerCall,   AuthStyle::ApiKey,     false, {"CEREBRAS_API_KEY", "OPENAI_API_KEY", ""}, ""},
+    {"deepseek",   "DeepSeek",   "DeepSeek V4 — api.deepseek.com",
+     Wire::OpenAIChat,        Lifetime::PerCall,   AuthStyle::ApiKey,     false, {"DEEPSEEK_API_KEY", "OPENAI_API_KEY", ""}, ""},
+    {"xai",        "xAI (Grok)", "Grok models — api.x.ai",
+     Wire::OpenAIChat,        Lifetime::PerCall,   AuthStyle::ApiKey,     false, {"XAI_API_KEY", "OPENAI_API_KEY", ""}, ""},
+    {"mistral",    "Mistral",    "Mistral / Codestral / Magistral — api.mistral.ai",
+     Wire::OpenAIChat,        Lifetime::PerCall,   AuthStyle::ApiKey,     false, {"MISTRAL_API_KEY", "OPENAI_API_KEY", ""}, ""},
+    {"gemini",     "Google Gemini", "Gemini models via the OpenAI-compat API",
+     Wire::OpenAIChat,        Lifetime::PerCall,   AuthStyle::ApiKey,     false, {"GEMINI_API_KEY", "GOOGLE_API_KEY", "OPENAI_API_KEY"}, ""},
+    {"fireworks",  "Fireworks",  "Open models on fireworks.ai",
+     Wire::OpenAIChat,        Lifetime::PerCall,   AuthStyle::ApiKey,     false, {"FIREWORKS_API_KEY", "OPENAI_API_KEY", ""}, ""},
     {"ollama",     "Ollama",     "Local models at localhost:11434",
      Wire::OpenAIChat,        Lifetime::PerCall,   AuthStyle::None,       true,  {"", "", ""}, ""},
     {"llama.cpp",  "llama.cpp",  "Local llama.cpp server at localhost:8080",