Merge origin/master into worktree/retire-fixmes-20260807

packages/sdk/create-sdk/tests/create.spec.ts

@@ -381,7 +381,7 @@ describe('CreateWizard and scaffolder', () => {
     }).run()
     await scaffoldProject(resolved.directory, resolved.request)
     expect(await readFile(join(resolved.directory, '.env'), 'utf8')).toBe(
-      '# Required before start; an empty value makes provider startup fail.\nDEEPSEEK_API_KEY=\n',
+      '# Required before the first model request.\nDEEPSEEK_API_KEY=\n',
     )
     expect(port.requests).toContain('Keep the API key empty and fill .env later?')
   })

packages/sdk/helper/src/features/builtin/provider.ts

@@ -4,7 +4,6 @@
  * @module @deepseek-ai/dsh-helper/features/builtin/provider
  */
 
-import { JsExpression } from '../../documents/cordis-yaml-file.ts'
 import { featureId } from '../../ids.ts'
 import type { FeatureSelection, ProjectProfile } from '../../project/types.ts'
 import {
@@ -17,7 +16,7 @@ import { npmCordisConfigEntry, environment } from './helpers.ts'
 
 const ID = featureId('provider')
 const DEFAULT_MODEL = 'deepseek-v4-flash'
-const API_KEY_COMMENT = 'Required before start; an empty value makes provider startup fail.'
+const API_KEY_COMMENT = 'Required before the first model request.'
 
 class DeepSeekOption extends FeatureOption {
   override readonly id = 'deepseek-official'
@@ -34,8 +33,7 @@ class DeepSeekOption extends FeatureOption {
       ...npmCordisConfigEntry(ID, {
         id: 'llm-deepseek',
         name: '@deepseek-ai/dsh-llm-deepseek',
-        config: { apiKey: new JsExpression('process.env.DEEPSEEK_API_KEY') },
-      }, ['apiKey', 'baseURL', 'models']),
+      }, ['baseURL', 'models']),
       environment(ID, 'DEEPSEEK_API_KEY', secrets.apiKey, API_KEY_COMMENT),
     ])
   }
@@ -60,8 +58,7 @@ class CustomOption extends FeatureOption {
       ...npmCordisConfigEntry(ID, {
         id: 'llm-pi-ai',
         name: '@deepseek-ai/dsh-llm-pi-ai',
-        config: { apiKey: new JsExpression('process.env.DEEPSEEK_API_KEY') },
-      }, ['apiKey', 'baseURL', 'models']),
+      }, ['baseURL', 'models']),
       environment(ID, 'DEEPSEEK_API_KEY', secrets.apiKey, API_KEY_COMMENT),
     ])
   }

packages/sdk/helper/tests/documents.spec.ts

@@ -86,20 +86,20 @@ config:
     expect(flow.serialize()).not.toContain('{')
     const document = CordisYamlFile.parse(`# lead
 - id: provider
-  name: '@deepseek-ai/dsh-llm-deepseek'
+  name: 'provider-package'
   config:
-    apiKey: !!js process.env.DEEPSEEK_API_KEY
+    endpoint: !!js process.env.PROVIDER_URL
     custom: keep
 `)
-    const apiKey = document.entry('provider')?.config?.apiKey
-    expect(apiKey).toBeInstanceOf(JsExpression)
-    document.updateOwnedConfig('provider', ['apiKey'], { apiKey: new JsExpression('process.env.NEXT_KEY') })
+    const endpoint = document.entry('provider')?.config?.endpoint
+    expect(endpoint).toBeInstanceOf(JsExpression)
+    document.updateOwnedConfig('provider', ['endpoint'], { endpoint: new JsExpression('process.env.NEXT_URL') })
     document.setDisabled('provider', true)
     document.addEntry({ id: 'tool', name: 'demo-tool' })
     document.validate()
     const text = document.serialize()
     expect(text).toContain('# lead')
-    expect(text).toContain('!!js process.env.NEXT_KEY')
+    expect(text).toContain('!!js process.env.NEXT_URL')
     expect(text).toContain('custom: keep')
     expect(document.removeEntry('tool')).toBe(true)
     expect(document.removeEntry('tool')).toBe(false)

packages/sdk/helper/tests/project.spec.ts

@@ -193,6 +193,7 @@ describe('SdkProject and ProjectEditSession', () => {
     expect(project.packageManifest().dependencies).not.toHaveProperty('@deepseek-ai/dsh-scope/invariant')
     expect(project.packageManifest().dependencies).not.toHaveProperty('node-addon-require-builtin')
     expect(project.cordis.entry('hmr')).toMatchObject({ name: '@cordisjs/plugin-hmr' })
+    expect(project.cordis.entry('llm-deepseek')).not.toHaveProperty('config.apiKey')
     expect(project.cordis.entry('llm-deepseek')?.config).not.toHaveProperty('baseURL')
     expect(project.cordis.entry('llm-deepseek')?.config).not.toHaveProperty('models')
   })
@@ -580,7 +581,7 @@ describe('SdkProject and ProjectEditSession', () => {
     await writeFile(join(partialRoot, 'cordis.yml'), `- id: llm-deepseek
   name: '@deepseek-ai/dsh-llm-deepseek'
   config:
-    apiKey: test
+    apiKeyEnv: DEEPSEEK_API_KEY
 `)
     const partial = await SdkProject.open(partialRoot)
     const installation = createBuiltinRegistry(partial.profile)

packages/sdk/scripts/tests/scripts.spec.ts

@@ -535,7 +535,7 @@ describe('ConfigWorkflow', () => {
     ]), outputBuffer().stream, async () => {})
     const result = await workflow.run(project, registry)
     const provider = result.commit?.project.cordis.entry('llm-pi-ai')
-    expect(provider?.config?.apiKey).toBeDefined()
+    expect(provider?.config).not.toHaveProperty('apiKey')
     expect(provider?.config?.baseURL).toBe('https://provider.example/v1')
     expect(result.commit?.project.cordis.entry('acp')).toBeDefined()
     expect(result.commit?.project.cordis.entry('agent-loop')).toBeDefined()

packages/sdk/telemetry/tests/consent-resolver.spec.ts

@@ -77,7 +77,8 @@ describe('ConsentResolver cordis.yml state', () => {
       '- id: llm',
       '  name: \'@deepseek-ai/dsh-llm-deepseek\'',
       '  config:',
-      '    apiKey: !!js process.env.DEEPSEEK_API_KEY',
+      '    apiKeyEnv: DEEPSEEK_API_KEY',
+      '    model: !!js process.env.DEEPSEEK_MODEL',
       '',
     ].join('\n')
     expect(await resolver.resolve(await projectDir(yml)))