Merge commit 'refs/codex/pr1006/master' into worktree/pr1006-merge-20260731

# Conflicts: # docs/architecture.i18n.yaml # docs/config-catalog.md # docs/cordis-catalog/services.md # docs/core-data-structures/core.i18n.yaml # examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl # examples/headless-agent/cordis.yml # packages/cordis/tool-cordis/src/api-catalog.ts # packages/llm/llm-deepseek/README.i18n.yaml # packages/llm/llm-deepseek/README.md # packages/llm/llm-deepseek/README.zh.md # packages/llm/llm-deepseek/src/adapter.ts # packages/llm/llm-deepseek/src/index.ts # packages/llm/llm-deepseek/tests/adapter.spec.ts # packages/llm/llm/README.i18n.yaml # packages/llm/llm/README.md # packages/llm/llm/README.zh.md # packages/subagent/subagent-dsh-sdk/README.i18n.yaml # packages/ui/jsonrpc/README.i18n.yaml
2026-07-31 01:55:19 +08:00
parent 9a0ee6fbfe c61a05ca5f
commit 464a57d3ca
664 changed files with 19076 additions and 2562 deletions
--- a/packages/llm/llm-deepseek/tests/adapter.e2e.ts
+++ b/packages/llm/llm-deepseek/tests/adapter.e2e.ts
@@ -1,7 +1,11 @@
-import { afterEach, describe, expect, it } from 'vitest'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
 import LlmService, { createUserMessage, CallId, ReasoningEffortId , createMessage } from '@deepseek-ai/dsh-llm'
 import type { Message, ToolSchema } from '@deepseek-ai/dsh-llm'
+import { CredentialsLocal } from '@deepseek-ai/dsh-credentials-local'
 import * as LlmDeepSeek from '@deepseek-ai/dsh-llm-deepseek'
 import type { Config } from '@deepseek-ai/dsh-llm-deepseek'
 import { assemble, type AssembledResult } from './assemble.ts'
@@ -53,6 +57,34 @@ const weatherTool: ToolSchema = {
 }

 describe.skipIf(!process.env.DEEPSEEK_API_KEY)('llm-deepseek e2e (real API)', () => {
+  it('serves a real request with the key held only by a credentials-local document', async () => {
+    const key = process.env.DEEPSEEK_API_KEY
+    if (key === undefined) throw new Error('e2e ran without DEEPSEEK_API_KEY')
+    const dir = await mkdtemp(join(tmpdir(), 'dsh-e2e-credentials-'))
+    try {
+      await writeFile(join(dir, '.env'), `DEEPSEEK_API_KEY=${key}\n`, { mode: 0o600 })
+      // Scrub the ambient variable so only the credential seam can supply the
+      // key: this request proves the per-request resolution path end to end.
+      vi.stubEnv('DEEPSEEK_API_KEY', '')
+      const ctx = new Context()
+      contexts.push(ctx)
+      await ctx.plugin(LlmService)
+      await ctx.plugin(CredentialsLocal, { path: join(dir, '.env'), watch: false })
+      await ctx.plugin(LlmDeepSeek, {})
+
+      const result = await assemble(ctx, {
+        model: FLASH,
+        messages: ask('Reply with exactly the word: pong'),
+        maxTokens: 50,
+      })
+      expect(result.finish.kind).toBe('stop')
+      expect(textOf(result).toLowerCase()).toContain('pong')
+    } finally {
+      vi.unstubAllEnvs()
+      await rm(dir, { recursive: true, force: true })
+    }
+  })
+
  it('flash dynamically switches from off to high', async () => {
    const ctx = await harness(FLASH, { reasoningEffort: 'off' })
    const withoutThinking = await assemble(ctx,{
@@ -140,7 +172,7 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('llm-deepseek e2e (real API)', ()
    const ctx = await harness(FLASH, { thinking: 'disabled' })
    const kinds: string[] = []
    for await (const chunk of ctx.llm.stream({
-      provider: 'deepseek',
+      provider: 'deepseek-official',
      model: FLASH,
      messages: ask('Count from 1 to 5, digits only.'),
      maxTokens: 50,
--- a/packages/llm/llm-deepseek/tests/adapter.spec.ts
+++ b/packages/llm/llm-deepseek/tests/adapter.spec.ts
@@ -1,5 +1,3 @@
-import { createServer } from 'node:http'
-import type { IncomingMessage, Server, ServerResponse } from 'node:http'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
 import LlmService, { createUserMessage,
@@ -14,90 +12,18 @@ import LlmService, { createUserMessage,
 import { MAX_TIMER_DELAY_MS } from '@deepseek-ai/dsh-timeout'
 import { SessionId } from '@deepseek-ai/dsh-session'
 import * as LlmDeepSeek from '@deepseek-ai/dsh-llm-deepseek'
-import { DeepSeekAdapter } from '@deepseek-ai/dsh-llm-deepseek'
+import { DeepSeekAdapter, resolveAdapterOptions } from '@deepseek-ai/dsh-llm-deepseek'
 import { httpErrorCode } from '../src/adapter.ts'
 import { assemble } from './assemble.ts'
-
-/** One scripted behavior for the next request the mock server receives. */
-type Behavior =
-  | { kind: 'sse'; events: string[]; delayMs?: number }
-  | { kind: 'http-error'; status: number; body: string; contentType?: string; headers?: Record<string, string> }
-  | { kind: 'close-early'; events: string[] }
-
-interface MockServer {
-  url: string
-  /** Bodies of received requests, in order. */
-  requests: unknown[]
-  /** Header bags of received requests, in order (parallel to `requests`). */
-  headers: IncomingMessage['headers'][]
-  script: Behavior[]
-  close(): Promise<void>
-}
-
-const servers: Server[] = []
+import { closeMockServers, mockServer, textEvents } from './mock-server.ts'
+import type { Behavior } from './mock-server.ts'

 afterEach(async () => {
-  await Promise.all(servers.splice(0).map(server => new Promise(resolve => server.close(resolve))))
+  await closeMockServers()
  vi.unstubAllEnvs()
  vi.useRealTimers()
 })

-/** Local chat-completions stand-in: replays scripted behaviors per request. */
-async function mockServer(script: Behavior[]): Promise<MockServer> {
-  const requests: unknown[] = []
-  const headers: IncomingMessage['headers'][] = []
-  const server = createServer((request: IncomingMessage, response: ServerResponse) => {
-    let body = ''
-    request.on('data', (chunk: Buffer) => { body += chunk.toString('utf8') })
-    request.on('end', () => {
-      requests.push(JSON.parse(body))
-      headers.push(request.headers)
-      const behavior = script.shift()
-      if (!behavior) {
-        response.writeHead(500).end('mock script exhausted')
-        return
-      }
-      if (behavior.kind === 'http-error') {
-        response.writeHead(behavior.status, {
-          'content-type': behavior.contentType ?? 'application/json',
-          ...behavior.headers,
-        })
-        response.end(behavior.body)
-        return
-      }
-      response.writeHead(200, { 'content-type': 'text/event-stream' })
-      const write = (index: number): void => {
-        if (index >= behavior.events.length) {
-          if (behavior.kind === 'sse') response.end()
-          else response.destroy() // close-early: drop the socket mid-stream
-          return
-        }
-        response.write(`data: ${behavior.events[index]}\n\n`)
-        setTimeout(() => { write(index + 1) }, behavior.kind === 'sse' ? behavior.delayMs ?? 0 : 5)
-      }
-      write(0)
-    })
-  })
-  servers.push(server)
-  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
-  const address = server.address()
-  if (address === null || typeof address === 'string') throw new Error('no port')
-  return {
-    url: `http://127.0.0.1:${address.port}`,
-    requests,
-    headers,
-    script,
-    close: () => new Promise(resolve => server.close(() => { resolve() })),
-  }
-}
-
-const textEvents = [
-  '{"choices":[{"delta":{"role":"assistant","content":null,"reasoning_content":""}}]}',
-  '{"choices":[{"delta":{"content":"hello"}}]}',
-  '{"choices":[{"delta":{"content":""},"finish_reason":"stop"}],"usage":{"prompt_tokens":3,"completion_tokens":1}}',
-  '[DONE]',
-]
-
 async function harness(baseURL: string, config: object = {}) {
  const ctx = new Context()
  await ctx.plugin(LlmService)
@@ -105,6 +31,15 @@ async function harness(baseURL: string, config: object = {}) {
  return ctx
 }

+/** Direct adapter over the plugin's real resolve step, with a static key. */
+function adapterOf(config: Partial<LlmDeepSeek.Config> & { apiKey?: string } = {}): DeepSeekAdapter {
+  const { apiKey, ...rest } = config
+  return new DeepSeekAdapter({
+    options: () => resolveAdapterOptions(rest),
+    resolveApiKey: () => Promise.resolve(apiKey ?? 'k'),
+  })
+}
+
 describe('DeepSeekAdapter against a mock server', () => {
  it('streams a text generation end to end through the assembler', async () => {
    const server = await mockServer([{ kind: 'sse', events: textEvents }])
@@ -144,7 +79,7 @@ describe('DeepSeekAdapter against a mock server', () => {

    const kinds: string[] = []
    for await (const chunk of ctx.llm.stream({
-      provider: 'deepseek',
+      provider: 'deepseek-official',
      model: 'deepseek-v4-flash',
      messages: [createUserMessage({
        content: [{ type: 'text', text: 'hi' }],
@@ -262,7 +197,7 @@ describe('DeepSeekAdapter against a mock server', () => {
      thinking: { type: 'disabled' },
    })
    expect(server.requests[0]).not.toHaveProperty('reasoning_effort')
-    await expect(ctx.llm.resolveModelInfo('deepseek', 'deepseek-v4-flash'))
+    await expect(ctx.llm.resolveModelInfo('deepseek-official', 'deepseek-v4-flash'))
      .resolves.toMatchObject({
        reasoning: {
          efforts: [{ id: ReasoningEffortId('off'), name: 'Off' }],
@@ -290,14 +225,10 @@ describe('DeepSeekAdapter against a mock server', () => {
    'rejects direct adapter effort %s before I/O when thinking is disabled',
    async (effort) => {
      const server = await mockServer([])
-      const adapter = new DeepSeekAdapter({
-        apiKey: 'test-key',
-        baseURL: server.url,
-        defaults: { thinking: 'disabled' },
-      })
+      const adapter = adapterOf({ apiKey: 'test-key', baseURL: server.url, thinking: 'disabled' })

      const stream = adapter.stream({
-        provider: 'deepseek',
+        provider: 'deepseek-official',
        model: 'deepseek-v4-flash',
        reasoningEffort: ReasoningEffortId(effort),
        messages: [createUserMessage({
@@ -498,13 +429,13 @@ describe('DeepSeekAdapter against a mock server', () => {
  })

  it('throws EMPTY_RESPONSE when the response has no body', async () => {
-    const adapter = new DeepSeekAdapter({ apiKey: 'k', baseURL: 'http://127.0.0.1:1' })
+    const adapter = adapterOf({ baseURL: 'http://127.0.0.1:1' })
    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
      new Response(null, { status: 200 }),
    )
    try {
      const iterate = async (): Promise<void> => {
-        for await (const _chunk of adapter.stream({ provider: 'deepseek', model: 'm', messages: [] })) { /* drain */ }
+        for await (const _chunk of adapter.stream({ provider: 'deepseek-official', model: 'm', messages: [] })) { /* drain */ }
      }
      await expect(iterate()).rejects.toThrow(/no response body/)
    } finally {
@@ -536,7 +467,7 @@ describe('DeepSeekAdapter against a mock server', () => {
    const pending = (async () => {
      const chunks = []
      for await (const chunk of ctx.llm.stream({
-        provider: 'deepseek',
+        provider: 'deepseek-official',
        model: 'deepseek-v4-flash',
        messages: [],
        signal: controller.signal,
@@ -553,10 +484,10 @@ describe('DeepSeekAdapter against a mock server', () => {
  it('maps connection failures to TRANSPORT without losing the cause', async () => {
    const cause = new TypeError('connection refused')
    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockRejectedValue(cause)
-    const adapter = new DeepSeekAdapter({ apiKey: 'k', baseURL: 'https://example.invalid' })
+    const adapter = adapterOf({ baseURL: 'https://example.invalid' })
    try {
      const drain = async (): Promise<void> => {
-        for await (const _chunk of adapter.stream({ provider: 'deepseek', model: 'm', messages: [] })) { /* drain */ }
+        for await (const _chunk of adapter.stream({ provider: 'deepseek-official', model: 'm', messages: [] })) { /* drain */ }
      }
      await expect(drain()).rejects.toMatchObject({ code: 'TRANSPORT', cause })
    } finally {
@@ -570,10 +501,10 @@ describe('DeepSeekAdapter against a mock server', () => {
      failed.reject('offline')
      return failed.promise
    })
-    const adapter = new DeepSeekAdapter({ apiKey: 'k', baseURL: 'https://example.invalid' })
+    const adapter = adapterOf({ baseURL: 'https://example.invalid' })
    try {
      const drain = async (): Promise<void> => {
-        for await (const _chunk of adapter.stream({ provider: 'deepseek', model: 'm', messages: [] })) { /* drain */ }
+        for await (const _chunk of adapter.stream({ provider: 'deepseek-official', model: 'm', messages: [] })) { /* drain */ }
      }
      await expect(drain()).rejects.toMatchObject({
        message: 'DeepSeek API request to https://example.invalid failed',
@@ -600,14 +531,10 @@ describe('DeepSeekAdapter against a mock server', () => {
      })
      return Promise.resolve(new Response(body, { status: 200 }))
    })
-    const adapter = new DeepSeekAdapter({
-      apiKey: 'k',
-      baseURL: 'https://example.invalid',
-      streamIdleTimeoutMs: 100,
-    })
+    const adapter = adapterOf({ baseURL: 'https://example.invalid', streamIdleTimeoutMs: 100 })
    try {
      const drain = (async () => {
-        for await (const _chunk of adapter.stream({ provider: 'deepseek', model: 'm', messages: [] })) { /* drain */ }
+        for await (const _chunk of adapter.stream({ provider: 'deepseek-official', model: 'm', messages: [] })) { /* drain */ }
      })()
      const rejected = expect(drain).rejects.toMatchObject({ code: 'TIMEOUT' })
      await vi.advanceTimersByTimeAsync(0)
@@ -642,9 +569,16 @@ describe('plugin registration and config', () => {
      apiKey: 'k',
      baseURL: server.url,
    })
-    expect(ctx.llm.listProviders()).toEqual([{ id: 'deepseek', name: 'DeepSeek' }])
+    expect(ctx.llm.listProviders()).toEqual([{ id: 'deepseek-official', name: 'DeepSeek' }])
+    expect(ctx.llm.listConfigurableProviders()).toEqual([{
+      provider: 'deepseek-official',
+      displayName: 'DeepSeek',
+      settingsNs: 'llm-deepseek',
+      settingsPath: [],
+    }])
    await fiber.dispose()
    expect(ctx.llm.listProviders()).toEqual([])
+    expect(ctx.llm.listConfigurableProviders()).toEqual([])
  })

  it('registers retryPolicy from the provider config', async () => {
@@ -659,7 +593,7 @@ describe('plugin registration and config', () => {
      },
    })

-    expect(ctx.llm.providerRetryPolicy('deepseek')).toEqual({
+    expect(ctx.llm.providerRetryPolicy('deepseek-official')).toEqual({
      mode: 'always',
      initialDelayMs: 25,
      maxDelayMs: 100,
@@ -671,14 +605,14 @@ describe('plugin registration and config', () => {
    const ctx = new Context()
    await ctx.plugin(LlmService)
    await ctx.plugin(LlmDeepSeek, { apiKey: 'k', baseURL: 'http://127.0.0.1:1' })
-    expect(ctx.llm.listProviders()).toEqual([{ id: 'deepseek', name: 'DeepSeek' }])
-    await expect(ctx.llm.listModels('deepseek')).resolves.toEqual([
-      { provider: 'deepseek', id: 'deepseek-v4-flash', name: 'DeepSeek-V4-Flash' },
-      { provider: 'deepseek', id: 'deepseek-v4-pro', name: 'DeepSeek-V4-Pro' },
+    expect(ctx.llm.listProviders()).toEqual([{ id: 'deepseek-official', name: 'DeepSeek' }])
+    await expect(ctx.llm.listModels('deepseek-official')).resolves.toEqual([
+      { provider: 'deepseek-official', id: 'deepseek-v4-flash', name: 'DeepSeek-V4-Flash' },
+      { provider: 'deepseek-official', id: 'deepseek-v4-pro', name: 'DeepSeek-V4-Pro' },
    ])
-    await expect(ctx.llm.resolveModelInfo('deepseek', 'deepseek-v4-flash'))
+    await expect(ctx.llm.resolveModelInfo('deepseek-official', 'deepseek-v4-flash'))
      .resolves.toMatchObject({
-        provider: 'deepseek',
+        provider: 'deepseek-official',
        id: 'deepseek-v4-flash',
        name: 'DeepSeek-V4-Flash',
        context: { contextWindow: 1_000_000 },
@@ -702,7 +636,7 @@ describe('plugin registration and config', () => {
      baseURL: 'http://127.0.0.1:1',
      reasoningEffort: effort,
    })
-    await expect(ctx.llm.resolveModelInfo('deepseek', 'unlisted-pass-through'))
+    await expect(ctx.llm.resolveModelInfo('deepseek-official', 'unlisted-pass-through'))
      .resolves.toMatchObject({
        reasoning: {
          efforts: [
@@ -724,7 +658,7 @@ describe('plugin registration and config', () => {
      thinking: 'disabled',
      reasoningEffort: 'off',
    })
-    await expect(ctx.llm.resolveModelInfo('deepseek', 'unlisted-pass-through'))
+    await expect(ctx.llm.resolveModelInfo('deepseek-official', 'unlisted-pass-through'))
      .resolves.toMatchObject({
        reasoning: {
          efforts: [{ id: ReasoningEffortId('off'), name: 'Off' }],
@@ -749,23 +683,16 @@ describe('plugin registration and config', () => {
  )

  it.each(['high', 'max'] as const)(
-    'rejects disabled-thinking effort %s at the direct constructor boundary',
+    'rejects disabled-thinking effort %s at the resolver boundary',
    (reasoningEffort) => {
-      expect(() => new DeepSeekAdapter({
-        apiKey: 'k',
-        baseURL: 'http://127.0.0.1:1',
-        defaults: { thinking: 'disabled', reasoningEffort },
-      })).toThrow(/only reasoningEffort "off"/)
+      expect(() => resolveAdapterOptions({ thinking: 'disabled', reasoningEffort }))
+        .toThrow(/only reasoningEffort "off"/)
    },
  )

-  it('accepts disabled thinking with off at the direct constructor boundary', async () => {
-    const adapter = new DeepSeekAdapter({
-      apiKey: 'k',
-      baseURL: 'http://127.0.0.1:1',
-      defaults: { thinking: 'disabled', reasoningEffort: 'off' },
-    })
-    await expect(adapter.resolveModel('deepseek', 'pass-through')).resolves.toMatchObject({
+  it('accepts disabled thinking with off at the resolver boundary', async () => {
+    const adapter = adapterOf({ thinking: 'disabled', reasoningEffort: 'off' })
+    await expect(adapter.resolveModel('deepseek-official', 'pass-through')).resolves.toMatchObject({
      reasoning: {
        efforts: [{ id: ReasoningEffortId('off'), name: 'Off' }],
        defaultEffort: ReasoningEffortId('off'),
@@ -777,9 +704,9 @@ describe('plugin registration and config', () => {
    const ctx = new Context()
    await ctx.plugin(LlmService)
    LlmDeepSeek.apply(ctx, { apiKey: 'k', baseURL: 'http://127.0.0.1:1' })
-    await expect(ctx.llm.listModels('deepseek')).resolves.toEqual([
-      { provider: 'deepseek', id: 'deepseek-v4-flash', name: 'DeepSeek-V4-Flash' },
-      { provider: 'deepseek', id: 'deepseek-v4-pro', name: 'DeepSeek-V4-Pro' },
+    await expect(ctx.llm.listModels('deepseek-official')).resolves.toEqual([
+      { provider: 'deepseek-official', id: 'deepseek-v4-flash', name: 'DeepSeek-V4-Flash' },
+      { provider: 'deepseek-official', id: 'deepseek-v4-pro', name: 'DeepSeek-V4-Pro' },
    ])
  })

@@ -799,18 +726,18 @@ describe('plugin registration and config', () => {
        },
      ],
    })
-    await expect(ctx.llm.listModels('deepseek')).resolves.toEqual([
-      { provider: 'deepseek', id: 'private-fast', name: 'private-fast' },
-      { provider: 'deepseek', id: 'private-reasoner', name: 'Private Reasoner', description: 'Higher reasoning budget' },
+    await expect(ctx.llm.listModels('deepseek-official')).resolves.toEqual([
+      { provider: 'deepseek-official', id: 'private-fast', name: 'private-fast' },
+      { provider: 'deepseek-official', id: 'private-reasoner', name: 'Private Reasoner', description: 'Higher reasoning budget' },
    ])
-    await expect(ctx.llm.resolveModelInfo('deepseek', 'private-fast'))
+    await expect(ctx.llm.resolveModelInfo('deepseek-official', 'private-fast'))
      .resolves.toMatchObject({ context: { contextWindow: 32_000 } })
-    await expect(ctx.llm.resolveModelInfo('deepseek', 'private-reasoner'))
+    await expect(ctx.llm.resolveModelInfo('deepseek-official', 'private-reasoner'))
      .resolves.toMatchObject({
        name: 'Private Reasoner',
        description: 'Higher reasoning budget',
      })
-    await expect(ctx.llm.resolveModelInfo('deepseek', 'arbitrary-unlisted'))
+    await expect(ctx.llm.resolveModelInfo('deepseek-official', 'arbitrary-unlisted'))
      .resolves.toMatchObject({
        context: { contextWindow: 1_000_000 },
        defaultMaxTokens: 256_000,
@@ -830,11 +757,11 @@ describe('plugin registration and config', () => {
      ],
    })

-    await expect(ctx.llm.resolveModelInfo('deepseek', 'inherits-default'))
+    await expect(ctx.llm.resolveModelInfo('deepseek-official', 'inherits-default'))
      .resolves.toMatchObject({ context: { contextWindow: 256_000 } })
-    await expect(ctx.llm.resolveModelInfo('deepseek', 'exact-override'))
+    await expect(ctx.llm.resolveModelInfo('deepseek-official', 'exact-override'))
      .resolves.toMatchObject({ context: { contextWindow: 64_000 } })
-    await expect(ctx.llm.resolveModelInfo('deepseek', 'unlisted-pass-through'))
+    await expect(ctx.llm.resolveModelInfo('deepseek-official', 'unlisted-pass-through'))
      .resolves.toMatchObject({ context: { contextWindow: 256_000 } })
  })

@@ -846,7 +773,7 @@ describe('plugin registration and config', () => {
      baseURL: 'http://127.0.0.1:1',
      models: [],
    })
-    await expect(ctx.llm.listModels('deepseek')).resolves.toEqual([])
+    await expect(ctx.llm.listModels('deepseek-official')).resolves.toEqual([])
  })

  it.each([
@@ -882,11 +809,8 @@ describe('plugin registration and config', () => {
  it.each([0, 1.5])(
    'rejects invalid adapter-wide default context capacity %s',
    async (defaultContextWindow) => {
-      expect(() => new DeepSeekAdapter({
-        apiKey: 'k',
-        baseURL: 'http://127.0.0.1:1',
-        defaultContextWindow,
-      })).toThrow(/defaultContextWindow must be a positive integer/)
+      expect(() => resolveAdapterOptions({ defaultContextWindow }))
+        .toThrow(/defaultContextWindow must be a positive integer/)

      const ctx = new Context()
      await ctx.plugin(LlmService)
@@ -902,11 +826,8 @@ describe('plugin registration and config', () => {
  it.each([0, 1.5, Number.MAX_SAFE_INTEGER + 1])(
    'rejects invalid adapter-wide maxTokens %s',
    async (maxTokens) => {
-      expect(() => new DeepSeekAdapter({
-        apiKey: 'k',
-        baseURL: 'http://127.0.0.1:1',
-        maxTokens,
-      })).toThrow(/maxTokens must be a positive safe integer/)
+      expect(() => resolveAdapterOptions({ maxTokens }))
+        .toThrow(/maxTokens must be a positive safe integer/)

      const ctx = new Context()
      await ctx.plugin(LlmService)
@@ -925,16 +846,45 @@ describe('plugin registration and config', () => {
    const ctx = new Context()
    await ctx.plugin(LlmService)
    await ctx.plugin(LlmDeepSeek, {})
-    expect(ctx.llm.listProviders()).toEqual([{ id: 'deepseek', name: 'DeepSeek' }])
+    expect(ctx.llm.listProviders()).toEqual([{ id: 'deepseek-official', name: 'DeepSeek' }])
  })

-  it('throws a clear error when no API key is available', async () => {
+  it('loads keyless, keeps the catalog browsable, and fails the request actionably', async () => {
    vi.stubEnv('DEEPSEEK_API_KEY', '')
    const ctx = new Context()
    await ctx.plugin(LlmService)
-    await expect(ctx.plugin(LlmDeepSeek, {}))
-      .rejects.toThrow(/an API key is required/)
-    expect(ctx.llm.listProviders()).toEqual([])
+    await ctx.plugin(LlmDeepSeek, { baseURL: 'http://127.0.0.1:1' })
+    // First-boot onboarding: the route registers so models stay discoverable;
+    // only the request itself needs a key.
+    expect(ctx.llm.listProviders()).toEqual([{ id: 'deepseek-official', name: 'DeepSeek' }])
+    await expect(ctx.llm.listModels('deepseek-official')).resolves.toHaveLength(2)
+    await expect(assemble(ctx, { model: 'deepseek-v4-flash', messages: [] }))
+      .rejects.toMatchObject({ code: 'MISSING_CREDENTIAL' })
+    // The guidance leads with the credential store — the path that keeps the
+    // secret out of configuration files — and mentions a literal key last.
+    await expect(assemble(ctx, { model: 'deepseek-v4-flash', messages: [] }))
+      .rejects.toThrow(/store DEEPSEEK_API_KEY through the credentials service.*as a last resort.*"apiKey"/s)
+  })
+
+  it('reads the ambient variable when no credentials seam is mounted', async () => {
+    // The plain cordis.yml composition: no credential provider, the key in
+    // the launching environment.
+    vi.stubEnv('DEEPSEEK_API_KEY', 'ambient-key')
+    const server = await mockServer([{ kind: 'sse', events: textEvents }])
+    const ctx = new Context()
+    await ctx.plugin(LlmService)
+    await ctx.plugin(LlmDeepSeek, { baseURL: server.url })
+    await assemble(ctx, { model: 'deepseek-v4-flash', messages: [] })
+    expect(server.headers[0]?.authorization).toBe('Bearer ambient-key')
+  })
+
+  it('treats an empty ambient variable as no key when no credentials seam is mounted', async () => {
+    vi.stubEnv('DEEPSEEK_API_KEY', '')
+    const ctx = new Context()
+    await ctx.plugin(LlmService)
+    await ctx.plugin(LlmDeepSeek, { baseURL: 'http://127.0.0.1:1' })
+    await expect(assemble(ctx, { model: 'deepseek-v4-flash', messages: [] }))
+      .rejects.toMatchObject({ code: 'MISSING_CREDENTIAL' })
  })

  it('prefers explicit config over env for key and base URL', async () => {
@@ -963,26 +913,35 @@ describe('plugin registration and config', () => {
    await ctx.plugin(LlmService)
    // Registration succeeds; no call is made (would hit api.deepseek.com).
    await ctx.plugin(LlmDeepSeek, {})
-    expect(ctx.llm.listProviders()).toEqual([{ id: 'deepseek', name: 'DeepSeek' }])
+    expect(ctx.llm.listProviders()).toEqual([{ id: 'deepseek-official', name: 'DeepSeek' }])
  })

-  it('adapter is constructible directly for embedding', async () => {
-    const adapter = new DeepSeekAdapter({ apiKey: 'k', baseURL: 'http://127.0.0.1:1' })
+  it('adapter is constructible directly for embedding over the shared resolver', async () => {
+    const adapter = adapterOf()
    expect(adapter).toBeInstanceOf(DeepSeekAdapter)
-    await expect(adapter.listModels('deepseek')).resolves.toEqual([])
+    // Direct embedding shares the plugin's one resolve step, so it advertises
+    // the same default catalog instead of a divergent empty one.
+    await expect(adapter.listModels('deepseek-official')).resolves.toHaveLength(2)
+  })
+
+  it('resolves connection facts and the credential exactly once per stream call', async () => {
+    const server = await mockServer([{ kind: 'sse', events: textEvents }])
+    const options = vi.fn(() => resolveAdapterOptions({ baseURL: server.url }))
+    const resolveApiKey = vi.fn(() => Promise.resolve('per-request-key'))
+    const adapter = new DeepSeekAdapter({ options, resolveApiKey })
+
+    for await (const _chunk of adapter.stream({ provider: 'deepseek-official', model: 'm', messages: [] })) { /* drain */ }
+
+    expect(options).toHaveBeenCalledTimes(1)
+    expect(resolveApiKey).toHaveBeenCalledTimes(1)
+    expect(server.headers[0]?.authorization).toBe('Bearer per-request-key')
  })

  it('rejects invalid idle watchdog bounds for direct and plugin composition', async () => {
-    expect(() => new DeepSeekAdapter({
-      apiKey: 'k',
-      baseURL: 'http://127.0.0.1:1',
-      streamIdleTimeoutMs: Number.POSITIVE_INFINITY,
-    })).toThrow(/streamIdleTimeoutMs.*positive finite/)
-    expect(() => new DeepSeekAdapter({
-      apiKey: 'k',
-      baseURL: 'http://127.0.0.1:1',
-      streamIdleTimeoutMs: MAX_TIMER_DELAY_MS + 1,
-    })).toThrow(/streamIdleTimeoutMs.*no greater/)
+    expect(() => resolveAdapterOptions({ streamIdleTimeoutMs: Number.POSITIVE_INFINITY }))
+      .toThrow(/streamIdleTimeoutMs.*positive finite/)
+    expect(() => resolveAdapterOptions({ streamIdleTimeoutMs: MAX_TIMER_DELAY_MS + 1 }))
+      .toThrow(/streamIdleTimeoutMs.*no greater/)

    const ctx = new Context()
    await ctx.plugin(LlmService)
--- a/packages/llm/llm-deepseek/tests/assemble.ts
+++ b/packages/llm/llm-deepseek/tests/assemble.ts
@@ -17,7 +17,7 @@ export interface AssembledResult {

 export async function assemble(ctx: Context, options: Omit<GenerateOptions, 'provider'> & { provider?: string }): Promise<AssembledResult> {
  const assembler = new BlockAssembler()
-  const request = { provider: 'deepseek', ...options }
+  const request = { provider: 'deepseek-official', ...options }
  for await (const chunk of ctx.llm.stream(request)) assembler.push(chunk)
  return {
    message: assembler.message({
--- a/packages/llm/llm-deepseek/tests/dynamic-config.spec.ts
+++ b/packages/llm/llm-deepseek/tests/dynamic-config.spec.ts
@@ -0,0 +1,195 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Context } from 'cordis'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import LlmService from '@deepseek-ai/dsh-llm'
+import { credentialRef } from '@deepseek-ai/dsh-credentials'
+import { CredentialsLocal } from '@deepseek-ai/dsh-credentials-local'
+import { settingsNamespace } from '@deepseek-ai/dsh-settings'
+import { SettingsLocal } from '@deepseek-ai/dsh-settings-local'
+import * as LlmDeepSeek from '@deepseek-ai/dsh-llm-deepseek'
+import { assemble } from './assemble.ts'
+import { closeMockServers, mockServer, textEvents } from './mock-server.ts'
+
+const NS = settingsNamespace('llm-deepseek')
+const KEY_REF = credentialRef('DEEPSEEK_API_KEY')
+
+const cleanups: Array<() => Promise<void>> = []
+
+afterEach(async () => {
+  while (cleanups.length > 0) await cleanups.pop()!()
+  await closeMockServers()
+  vi.unstubAllEnvs()
+})
+
+async function home(): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), 'dsh-llm-dynamic-'))
+  cleanups.push(() => rm(dir, { recursive: true, force: true }))
+  return dir
+}
+
+interface Harness {
+  ctx: Context
+  settingsFiber: { dispose(): Promise<void> }
+}
+
+/**
+ * Real dynamic composition: llm + settings-local + credentials-local +
+ * llm-deepseek over one temp harness home. `watch: false` keeps every change
+ * flowing through the in-process write path, which is deterministic; external
+ * file watching is the providers' own covered concern.
+ */
+async function boot(dir: string, config: object): Promise<Harness> {
+  const ctx = new Context()
+  cleanups.push(async () => {
+    await ctx.fiber.dispose()
+  })
+  await ctx.plugin(LlmService)
+  const settingsFiber = ctx.plugin(SettingsLocal, { path: join(dir, 'settings.yaml'), watch: false })
+  await settingsFiber
+  await ctx.plugin(CredentialsLocal, { path: join(dir, '.env'), watch: false })
+  await ctx.plugin(LlmDeepSeek, config)
+  return { ctx, settingsFiber }
+}
+
+function prompt(ctx: Context) {
+  return assemble(ctx, { model: 'deepseek-v4-flash', messages: [] })
+}
+
+describe('request-level dynamic configuration', () => {
+  it('routes the next request with the freshly resolved base URL and credential', async () => {
+    vi.stubEnv('DEEPSEEK_API_KEY', '')
+    const dir = await home()
+    await writeFile(join(dir, '.env'), 'DEEPSEEK_API_KEY=first-key\n')
+    const serverA = await mockServer([{ kind: 'sse', events: textEvents }])
+    const serverB = await mockServer([{ kind: 'sse', events: textEvents }])
+    const { ctx } = await boot(dir, { baseURL: serverA.url })
+
+    await prompt(ctx)
+    expect(serverA.headers[0]?.authorization).toBe('Bearer first-key')
+
+    await ctx.settings.update(NS, { baseURL: serverB.url })
+    await ctx.credentials.set(KEY_REF, 'second-key')
+
+    await prompt(ctx)
+    // No restart, no re-registration: the next request resolved both facts.
+    expect(serverA.requests).toHaveLength(1)
+    expect(serverB.headers[0]?.authorization).toBe('Bearer second-key')
+  })
+
+  it('prefers a literal settings apiKey over the credential layers', async () => {
+    vi.stubEnv('DEEPSEEK_API_KEY', '')
+    const dir = await home()
+    await writeFile(join(dir, '.env'), 'DEEPSEEK_API_KEY=file-key\n')
+    const server = await mockServer([{ kind: 'sse', events: textEvents }])
+    const { ctx } = await boot(dir, { baseURL: server.url })
+
+    await ctx.settings.update(NS, { apiKey: 'literal-key' })
+    await prompt(ctx)
+    expect(server.headers[0]?.authorization).toBe('Bearer literal-key')
+  })
+
+  it('starts keyless and serves the next request once the key arrives', async () => {
+    vi.stubEnv('DEEPSEEK_API_KEY', '')
+    const dir = await home()
+    const server = await mockServer([{ kind: 'sse', events: textEvents }])
+    const { ctx } = await boot(dir, { baseURL: server.url })
+
+    await expect(prompt(ctx)).rejects.toMatchObject({ code: 'MISSING_CREDENTIAL' })
+    await ctx.credentials.set(KEY_REF, 'sk-arrived')
+    await prompt(ctx)
+    expect(server.headers[0]?.authorization).toBe('Bearer sk-arrived')
+  })
+
+  it('advertises a live settings catalog without re-registration', async () => {
+    const dir = await home()
+    const { ctx } = await boot(dir, { apiKey: 'k', baseURL: 'http://127.0.0.1:1' })
+
+    await expect(ctx.llm.listModels('deepseek-official')).resolves.toHaveLength(2)
+    await ctx.settings.update(NS, { models: [{ id: 'settings-model', name: 'From Settings' }] })
+    await expect(ctx.llm.listModels('deepseek-official')).resolves.toEqual([
+      { provider: 'deepseek-official', id: 'settings-model', name: 'From Settings' },
+    ])
+  })
+
+  it('re-registers the route in place when the captured retry policy changes, without an empty-registry window', async () => {
+    const dir = await home()
+    const { ctx } = await boot(dir, { apiKey: 'k', baseURL: 'http://127.0.0.1:1' })
+
+    // Observing the topology event, not just the end state: disposing and
+    // re-registering also lands on the right final registry, but publishes an
+    // empty route set in between, so an observer sees the provider disappear.
+    const observed: string[][] = []
+    ctx.on('llm/adapters-updated', () => {
+      observed.push(ctx.llm.listProviders().map(provider => provider.id))
+    })
+
+    await ctx.settings.update(NS, {
+      retryPolicy: { mode: 'always', backoff: { initialDelayMs: 25, maxDelayMs: 100, jitterRatio: 0.2 } },
+    })
+    expect(ctx.llm.providerRetryPolicy('deepseek-official')).toEqual({
+      mode: 'always',
+      initialDelayMs: 25,
+      maxDelayMs: 100,
+      jitterRatio: 0.2,
+    })
+    expect(ctx.llm.listProviders()).toEqual([{ id: 'deepseek-official', name: 'DeepSeek' }])
+    expect(observed).toEqual([['deepseek-official']])
+  })
+
+  it('keeps the last good options when a settings snapshot fails beyond-schema validation', async () => {
+    const dir = await home()
+    const { ctx } = await boot(dir, { apiKey: 'k', baseURL: 'http://127.0.0.1:1' })
+
+    // Schema-valid but resolver-invalid: duplicate catalog ids pass the array
+    // schema and fail the explicit resolve step.
+    await ctx.settings.update(NS, { models: [{ id: 'dup' }, { id: 'dup' }] })
+    await expect(ctx.llm.listModels('deepseek-official')).resolves.toHaveLength(2)
+    await ctx.settings.update(NS, { models: [{ id: 'recovered' }] })
+    await expect(ctx.llm.listModels('deepseek-official')).resolves.toEqual([
+      { provider: 'deepseek-official', id: 'recovered', name: 'recovered' },
+    ])
+  })
+
+  it('sends the whole last-good snapshot when a rejected one changed both the key and the URL', async () => {
+    vi.stubEnv('DEEPSEEK_API_KEY', '')
+    const dir = await home()
+    const good = await mockServer([{ kind: 'sse', events: textEvents }])
+    const rejected = await mockServer([{ kind: 'sse', events: textEvents }])
+    const { ctx } = await boot(dir, { apiKey: 'good-key', baseURL: good.url })
+
+    // One snapshot moves the endpoint AND the literal key, and fails the
+    // resolve step beyond the schema (duplicate catalog ids).
+    await ctx.settings.update(NS, {
+      apiKey: 'rejected-key',
+      baseURL: rejected.url,
+      models: [{ id: 'dup' }, { id: 'dup' }],
+    })
+
+    await prompt(ctx)
+    // The rejected generation contributes nothing: not its endpoint, and — the
+    // regression this pins — not its key either.
+    expect(rejected.requests).toHaveLength(0)
+    expect(good.requests).toHaveLength(1)
+    expect(good.headers[0]?.authorization).toBe('Bearer good-key')
+  })
+
+  it('falls back to the composition entry when settings detach', async () => {
+    vi.stubEnv('DEEPSEEK_API_KEY', '')
+    const dir = await home()
+    await writeFile(join(dir, '.env'), 'DEEPSEEK_API_KEY=steady-key\n')
+    const serverA = await mockServer([{ kind: 'sse', events: textEvents }])
+    const serverB = await mockServer([{ kind: 'sse', events: textEvents }])
+    const { ctx, settingsFiber } = await boot(dir, { baseURL: serverA.url })
+
+    await ctx.settings.update(NS, { baseURL: serverB.url })
+    await prompt(ctx)
+    expect(serverB.requests).toHaveLength(1)
+
+    await settingsFiber.dispose()
+    await prompt(ctx)
+    expect(serverA.requests).toHaveLength(1)
+    expect(serverA.headers[0]?.authorization).toBe('Bearer steady-key')
+  })
+})
--- a/packages/llm/llm-deepseek/tests/loader-composition.spec.ts
+++ b/packages/llm/llm-deepseek/tests/loader-composition.spec.ts
@@ -0,0 +1,174 @@
+/**
+ * Real-composition guard for the dynamic-configuration chain: LlmService,
+ * settings-local, credentials-local, and llm-deepseek boot from a test-only
+ * cordis.yml through the actual Loader + Include path, external edits of
+ * settings.yaml and .env hot-publish through their providers, and the very
+ * next request carries the fresh base URL and credential. The same adapter
+ * composition without settings or credentials entries keeps entry-config
+ * behavior — the documented optional-inject fallback.
+ */
+
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Context } from 'cordis'
+import Loader from '@cordisjs/plugin-loader'
+import Include from '@cordisjs/plugin-include'
+import LlmService from '@deepseek-ai/dsh-llm'
+import { credentialRef } from '@deepseek-ai/dsh-credentials'
+import CredentialsLocal from '@deepseek-ai/dsh-credentials-local'
+import { settingsNamespace } from '@deepseek-ai/dsh-settings'
+import SettingsLocal from '@deepseek-ai/dsh-settings-local'
+import * as LlmDeepSeek from '@deepseek-ai/dsh-llm-deepseek'
+import { assemble } from './assemble.ts'
+import { closeMockServers, mockServer, textEvents } from './mock-server.ts'
+
+const NS = settingsNamespace('llm-deepseek')
+const KEY_REF = credentialRef('DEEPSEEK_API_KEY')
+
+let root: string | undefined
+let context: Context | undefined
+
+afterEach(async () => {
+  await context?.fiber.dispose()
+  context = undefined
+  if (root !== undefined) await rm(root, { recursive: true, force: true })
+  root = undefined
+  await closeMockServers()
+  vi.unstubAllEnvs()
+})
+
+async function loadComposition(
+  options: { withDynamic: boolean; baseURL: string; reuseRoot?: string },
+): Promise<{ ctx: Context; settingsPath: string; envPath: string }> {
+  // A reused root is the restart case: the same harness home, its documents
+  // exactly as the previous process left them.
+  const fresh = options.reuseRoot === undefined
+  root = options.reuseRoot ?? await mkdtemp(join(tmpdir(), 'dsh-llm-composition-'))
+  const settingsPath = join(root, 'settings.yaml')
+  const envPath = join(root, '.env')
+  if (options.withDynamic && fresh) {
+    await writeFile(settingsPath, '# personal settings\n')
+    await writeFile(envPath, 'DEEPSEEK_API_KEY=boot-key\n')
+  }
+
+  const configPath = join(root, 'cordis.yml')
+  await writeFile(configPath, [
+    '- id: llm',
+    "  name: 'test-llm-service'",
+    ...options.withDynamic
+      ? [
+        '- id: settings',
+        "  name: '@deepseek-ai/dsh-settings-local'",
+        '  config:',
+        `    path: ${JSON.stringify(settingsPath)}`,
+        '    debounceMs: 10',
+        '- id: credentials',
+        "  name: '@deepseek-ai/dsh-credentials-local'",
+        '  config:',
+        `    path: ${JSON.stringify(envPath)}`,
+        '    debounceMs: 10',
+      ]
+      : [],
+    '- id: llm-deepseek',
+    "  name: '@deepseek-ai/dsh-llm-deepseek'",
+    '  config:',
+    `    baseURL: ${JSON.stringify(options.baseURL)}`,
+    ...options.withDynamic ? [] : ['    apiKey: entry-key'],
+    '',
+  ].join('\n'))
+
+  const ctx = new Context()
+  context = ctx
+  ctx.baseUrl = pathToFileURL(root).href + '/'
+  await ctx.plugin(Loader)
+  ctx.loader.builtins.include = Include
+  const modules = new Map<string, unknown>([
+    ['test-llm-service', LlmService],
+    ['@deepseek-ai/dsh-settings-local', SettingsLocal],
+    ['@deepseek-ai/dsh-credentials-local', CredentialsLocal],
+    ['@deepseek-ai/dsh-llm-deepseek', LlmDeepSeek],
+  ])
+  ctx.loader.internal = {
+    version: 'v2',
+    async import(specifier: string) {
+      if (!modules.has(specifier)) throw new Error(`unexpected Loader import: ${specifier}`)
+      return modules.get(specifier)
+    },
+  } as unknown as NonNullable<typeof ctx.loader.internal>
+  await ctx.loader.create({
+    name: 'cordis:include',
+    config: { path: pathToFileURL(configPath).href },
+  })
+  await ctx.loader.await()
+  return { ctx, settingsPath, envPath }
+}
+
+describe('llm-deepseek real dynamic composition', () => {
+  it('boots from cordis.yml and routes the next request after external settings and .env edits', async () => {
+    vi.stubEnv('DEEPSEEK_API_KEY', '')
+    const serverA = await mockServer([{ kind: 'sse', events: textEvents }])
+    const serverB = await mockServer([{ kind: 'sse', events: textEvents }])
+    const { ctx, settingsPath, envPath } = await loadComposition({ withDynamic: true, baseURL: serverA.url })
+
+    expect(ctx.get('settings')!.describe().map(entry => entry.ns)).toEqual([NS])
+    await assemble(ctx, { model: 'deepseek-v4-flash', messages: [] })
+    expect(serverA.headers[0]?.authorization).toBe('Bearer boot-key')
+
+    // External edits, exactly as a user or the web UI would leave them on disk.
+    await writeFile(settingsPath, `llm-deepseek:\n  baseURL: ${serverB.url}\n`)
+    await vi.waitFor(() => {
+      expect((ctx.get('settings')!.get(NS) as { baseURL?: string }).baseURL).toBe(serverB.url)
+    }, { timeout: 5000 })
+    await writeFile(envPath, 'DEEPSEEK_API_KEY=rotated-key\n')
+    await vi.waitFor(async () => {
+      expect(await ctx.get('credentials')!.resolve(KEY_REF)).toEqual({ value: 'rotated-key', source: 'file' })
+    }, { timeout: 5000 })
+
+    await assemble(ctx, { model: 'deepseek-v4-flash', messages: [] })
+    expect(serverA.requests).toHaveLength(1)
+    expect(serverB.headers[0]?.authorization).toBe('Bearer rotated-key')
+  })
+
+  it('keeps a stored key writable and rotatable across a real restart', async () => {
+    // No ambient DEEPSEEK_API_KEY: the shipped surfaces no longer hoist
+    // $DSH_HOME/.env into process.env, so a stored key must stay file-sourced.
+    vi.stubEnv('DEEPSEEK_API_KEY', '')
+    const first = await mockServer([{ kind: 'sse', events: textEvents }])
+    const second = await mockServer([{ kind: 'sse', events: textEvents }])
+    const boot = await loadComposition({ withDynamic: true, baseURL: first.url })
+    const home = root!
+    await boot.ctx.get('credentials')!.set(KEY_REF, 'stored-by-ui')
+    expect(await boot.ctx.get('credentials')!.describe(KEY_REF))
+      .toEqual({ configured: true, source: 'file', writable: true })
+    await assemble(boot.ctx, { model: 'deepseek-v4-flash', messages: [] })
+    expect(first.headers[0]?.authorization).toBe('Bearer stored-by-ui')
+    await boot.ctx.fiber.dispose()
+    context = undefined
+
+    // Restart over the same harness home.
+    const restarted = await loadComposition({ withDynamic: true, baseURL: second.url, reuseRoot: home })
+    const credentials = restarted.ctx.get('credentials')!
+    // The stored key is still the provider's own writable file entry — not a
+    // read-only launch override, which is what hoisting it would have made it.
+    expect(await credentials.resolve(KEY_REF)).toEqual({ value: 'stored-by-ui', source: 'file' })
+    expect(await credentials.describe(KEY_REF)).toEqual({ configured: true, source: 'file', writable: true })
+    // Rotation still works after the restart, and the next request uses it.
+    await credentials.set(KEY_REF, 'rotated-after-restart')
+    await assemble(restarted.ctx, { model: 'deepseek-v4-flash', messages: [] })
+    expect(second.headers[0]?.authorization).toBe('Bearer rotated-after-restart')
+  })
+
+  it('boots the same adapter without settings or credentials entries on entry config alone', async () => {
+    vi.stubEnv('DEEPSEEK_API_KEY', '')
+    const server = await mockServer([{ kind: 'sse', events: textEvents }])
+    const { ctx } = await loadComposition({ withDynamic: false, baseURL: server.url })
+
+    expect(ctx.get('settings')).toBeUndefined()
+    expect(ctx.get('credentials')).toBeUndefined()
+    await assemble(ctx, { model: 'deepseek-v4-flash', messages: [] })
+    expect(server.headers[0]?.authorization).toBe('Bearer entry-key')
+  })
+})
--- a/packages/llm/llm-deepseek/tests/mock-server.ts
+++ b/packages/llm/llm-deepseek/tests/mock-server.ts
@@ -0,0 +1,82 @@
+import { createServer } from 'node:http'
+import type { IncomingMessage, Server, ServerResponse } from 'node:http'
+
+/** One scripted behavior for the next request the mock server receives. */
+export type Behavior =
+  | { kind: 'sse'; events: string[]; delayMs?: number }
+  | { kind: 'http-error'; status: number; body: string; contentType?: string; headers?: Record<string, string> }
+  | { kind: 'close-early'; events: string[] }
+
+export interface MockServer {
+  url: string
+  /** Bodies of received requests, in order. */
+  requests: unknown[]
+  /** Header bags of received requests, in order (parallel to `requests`). */
+  headers: IncomingMessage['headers'][]
+  script: Behavior[]
+  close(): Promise<void>
+}
+
+const servers: Server[] = []
+
+/** Close every server opened since the last call; run from each spec's afterEach. */
+export async function closeMockServers(): Promise<void> {
+  await Promise.all(servers.splice(0).map(server => new Promise(resolve => server.close(resolve))))
+}
+
+/** A minimal complete text generation, reused by request-shape assertions. */
+export const textEvents = [
+  '{"choices":[{"delta":{"role":"assistant","content":null,"reasoning_content":""}}]}',
+  '{"choices":[{"delta":{"content":"hello"}}]}',
+  '{"choices":[{"delta":{"content":""},"finish_reason":"stop"}],"usage":{"prompt_tokens":3,"completion_tokens":1}}',
+  '[DONE]',
+]
+
+/** Local chat-completions stand-in: replays scripted behaviors per request. */
+export async function mockServer(script: Behavior[]): Promise<MockServer> {
+  const requests: unknown[] = []
+  const headers: IncomingMessage['headers'][] = []
+  const server = createServer((request: IncomingMessage, response: ServerResponse) => {
+    let body = ''
+    request.on('data', (chunk: Buffer) => { body += chunk.toString('utf8') })
+    request.on('end', () => {
+      requests.push(JSON.parse(body))
+      headers.push(request.headers)
+      const behavior = script.shift()
+      if (!behavior) {
+        response.writeHead(500).end('mock script exhausted')
+        return
+      }
+      if (behavior.kind === 'http-error') {
+        response.writeHead(behavior.status, {
+          'content-type': behavior.contentType ?? 'application/json',
+          ...behavior.headers,
+        })
+        response.end(behavior.body)
+        return
+      }
+      response.writeHead(200, { 'content-type': 'text/event-stream' })
+      const write = (index: number): void => {
+        if (index >= behavior.events.length) {
+          if (behavior.kind === 'sse') response.end()
+          else response.destroy() // close-early: drop the socket mid-stream
+          return
+        }
+        response.write(`data: ${behavior.events[index]}\n\n`)
+        setTimeout(() => { write(index + 1) }, behavior.kind === 'sse' ? behavior.delayMs ?? 0 : 5)
+      }
+      write(0)
+    })
+  })
+  servers.push(server)
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
+  const address = server.address()
+  if (address === null || typeof address === 'string') throw new Error('no port')
+  return {
+    url: `http://127.0.0.1:${address.port}`,
+    requests,
+    headers,
+    script,
+    close: () => new Promise(resolve => server.close(() => { resolve() })),
+  }
+}
--- a/packages/llm/llm-deepseek/tests/serialize.spec.ts
+++ b/packages/llm/llm-deepseek/tests/serialize.spec.ts
@@ -4,7 +4,7 @@ import type { ContentBlock, GenerateOptions, Message } from '@deepseek-ai/dsh-ll
 import { serializeMessages, serializeRequest } from '../src/serialize.ts'

 function request(overrides: Partial<GenerateOptions> = {}): GenerateOptions {
-  return { provider: 'deepseek', model: 'deepseek-v4-flash', messages: [], ...overrides }
+  return { provider: 'deepseek-official', model: 'deepseek-v4-flash', messages: [], ...overrides }
 }

 describe('serializeMessages', () => {