Add Groq platform (provider 4)

The 7th registry row and the first pure-pattern cycle: id "groq",
GROQ_API_KEY > auth.json "groq" scope, https://api.groq.com/openai/v1
with KIGI_GROQ_BASE_URL override, OpenAI listing + ChatCompletions +
Passthrough dialect (Groq accepts the OpenAI-style reasoning_effort
scalar verbatim), enrichment-backed metadata with the tool-calling
restriction (the listing carries whisper/tts/guard noise — 8 of 15
enrichment entries are non-chat).

Review verdict: faithful pattern repeat, zero blocking findings — row
facts verified against live Groq docs, registry integrity at 7, e2e
proven strong on both axes (restriction + dialect mapping). Added the
recommended pin: managed keys split on the FIRST slash, so Groq's
provider-native slashed ids (openai/gpt-oss-120b and 10 more) round-trip
as groq/openai/gpt-oss-120b → (Groq, openai/gpt-oss-120b).

Also fixes a pre-existing test race this cycle surfaced: the enterprise-
endpoints test asserted moonshot's fixed base while non-serial, racing
serial tests that legitimately point KIGI_MOONSHOT_CN_BASE_URL at
wiremock; now serial + env-unset like its documented siblings. Two
display-only advisories logged as tracked debt (Groq's delta.reasoning
field invisible in the TUI; platform-generic rate-limit copy).

crates/codegen/kigi-models/src/lib.rs

@@ -289,6 +289,33 @@ const DEEPSEEK_SPEC: PlatformSpec = PlatformSpec {
     restrict_to_enriched: false,
 };
 
+/// Base-URL override for Groq (dev/test escape hatch).
+pub const GROQ_BASE_URL_ENV: &str = "KIGI_GROQ_BASE_URL";
+
+const GROQ_SPEC: PlatformSpec = PlatformSpec {
+    id: "groq",
+    display_name: "Groq",
+    base_url: BaseUrlSource::EnvOr {
+        env: GROQ_BASE_URL_ENV,
+        default: "https://api.groq.com/openai/v1",
+    },
+    uses_oauth: false,
+    allowed_model_prefixes: None,
+    api_key_envs: &["GROQ_API_KEY"],
+    vendor: "Groq",
+    console_host: Some("console.groq.com"),
+    login_label: Some("Groq (API key)"),
+    models_dev_id: Some("groq"),
+    wire_serves_metadata: false,
+    wire_api: PlatformWireApi::ChatCompletions,
+    listing: ListingDialect::OpenAi,
+    chat_compat: PlatformChatCompat::Passthrough,
+    key_header: PlatformKeyHeader::Bearer,
+    // The listing carries whisper/tts entries; keep tool-calling chat
+    // models only.
+    restrict_to_enriched: true,
+};
+
 /// The platform registry. Platforms are compiled-in spec rows; there is no
 /// dynamic provider registration (PRD F2).
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
@@ -305,18 +332,21 @@ pub enum PlatformId {
     Anthropic,
     /// DeepSeek platform API (API key, ChatCompletions dialect).
     DeepSeek,
+    /// Groq platform API (API key, OpenAI-compatible ChatCompletions).
+    Groq,
 }
 
 impl PlatformId {
     /// All platforms, in catalog precedence order: the subscription channel
     /// first so "default model = first list item" favors it when present.
-    pub const ALL: [PlatformId; 6] = [
+    pub const ALL: [PlatformId; 7] = [
         Self::KimiCode,
         Self::MoonshotCn,
         Self::MoonshotAi,
         Self::OpenAi,
         Self::Anthropic,
         Self::DeepSeek,
+        Self::Groq,
     ];
 
     /// The registry row backing this platform (single source of per-platform
@@ -329,6 +359,7 @@ impl PlatformId {
             Self::OpenAi => &OPENAI_SPEC,
             Self::Anthropic => &ANTHROPIC_SPEC,
             Self::DeepSeek => &DEEPSEEK_SPEC,
+            Self::Groq => &GROQ_SPEC,
         }
     }
 
@@ -985,9 +1016,10 @@ mod tests {
                 PlatformId::OpenAi => 3,
                 PlatformId::Anthropic => 4,
                 PlatformId::DeepSeek => 5,
+                PlatformId::Groq => 6,
             }
         }
-        const VARIANT_COUNT: usize = 6; // update together with `ordinal`
+        const VARIANT_COUNT: usize = 7; // update together with `ordinal`
         let mut seen: Vec<usize> = PlatformId::ALL.iter().map(|&p| ordinal(p)).collect();
         seen.sort_unstable();
         seen.dedup();
@@ -1074,6 +1106,12 @@ mod tests {
             parse_managed_model_key("kimi-code/kimi-for-coding"),
             Some((PlatformId::KimiCode, "kimi-for-coding"))
         );
+        // FIRST-slash split: provider-native slashed ids (11 of 15 groq
+        // models, e.g. openai/gpt-oss-120b) must survive the round trip.
+        assert_eq!(
+            parse_managed_model_key("groq/openai/gpt-oss-120b"),
+            Some((PlatformId::Groq, "openai/gpt-oss-120b"))
+        );
         // No prefix / unknown platform / empty model id → None.
         assert_eq!(parse_managed_model_key("kimi-for-coding"), None);
         assert_eq!(parse_managed_model_key("not-a-platform/gpt"), None);

crates/codegen/kigi-shell/src/agent/auth_method.rs

@@ -594,7 +594,8 @@ mod tests {
                 MOONSHOT_AI_METHOD_ID,
                 "openai",
                 "anthropic",
-                "deepseek"
+                "deepseek",
+                "groq"
             ]
         );
         assert_eq!(default_id(&built), Some(XAI_API_KEY_METHOD_ID));
@@ -623,7 +624,8 @@ mod tests {
                 MOONSHOT_AI_METHOD_ID,
                 "openai",
                 "anthropic",
-                "deepseek"
+                "deepseek",
+                "groq"
             ]
         );
         assert_eq!(default_id(&built), Some(CACHED_TOKEN_AUTH_METHOD_ID));
@@ -645,7 +647,8 @@ mod tests {
                 MOONSHOT_AI_METHOD_ID,
                 "openai",
                 "anthropic",
-                "deepseek"
+                "deepseek",
+                "groq"
             ]
         );
         assert_eq!(default_id(&built), Some(CACHED_TOKEN_AUTH_METHOD_ID));
@@ -670,7 +673,8 @@ mod tests {
                 MOONSHOT_AI_METHOD_ID,
                 "openai",
                 "anthropic",
-                "deepseek"
+                "deepseek",
+                "groq"
             ]
         );
         assert_eq!(default_id(&built), None);

crates/codegen/kigi-shell/src/agent/config.rs

@@ -6638,7 +6638,12 @@ reasoning_effort = "low"
         );
     }
     #[test]
+    #[serial]
     fn e2e_enterprise_endpoints_only_no_model_override() {
+        // Hermetic: the moonshot-base assertion below races serial tests
+        // that legitimately point KIGI_MOONSHOT_CN_BASE_URL at wiremock —
+        // this test was non-serial and read the env mid-guard.
+        let _cn = EnvGuard::unset(kigi_models::MOONSHOT_CN_BASE_URL_ENV);
         let (_, models) = resolve_models_from_toml(
             r#"
             [endpoints]

crates/codegen/kigi-shell/src/agent/models_fetch.rs

@@ -1123,6 +1123,89 @@ mod tests {
         assert_eq!(cfg.chat_compat, kigi_sampling_types::ChatCompat::Kimi);
     }
 
+    /// Groq-cycle e2e: pure pattern — polluted listing restricted to
+    /// tool-calling enrichment models, Passthrough dialect (OpenAI-style
+    /// reasoning_effort untouched on this wire).
+    #[tokio::test(flavor = "multi_thread")]
+    #[serial_test::serial]
+    async fn groq_listing_restricts_and_maps_passthrough_dialect() {
+        let platform_server = wiremock::MockServer::start().await;
+        wiremock::Mock::given(wiremock::matchers::method("GET"))
+            .and(wiremock::matchers::path("/models"))
+            .and(wiremock::matchers::header("Authorization", "Bearer gsk-1"))
+            .respond_with(wiremock::ResponseTemplate::new(200).set_body_json(
+                serde_json::json!({ "data": [
+                    { "id": "llama-3.3-70b-versatile", "object": "model" },
+                    { "id": "whisper-large-v3", "object": "model" }
+                ]}),
+            ))
+            .expect(1)
+            .mount(&platform_server)
+            .await;
+        let modelsdev_server = wiremock::MockServer::start().await;
+        wiremock::Mock::given(wiremock::matchers::method("GET"))
+            .and(wiremock::matchers::path("/api.json"))
+            .respond_with(wiremock::ResponseTemplate::new(200).set_body_json(
+                serde_json::json!({ "groq": { "models": {
+                    "llama-3.3-70b-versatile": {
+                        "limit": {"context": 131072, "output": 32768},
+                        "tool_call": true
+                    },
+                    "whisper-large-v3": { "limit": {"context": 448} }
+                }}}),
+            ))
+            .expect(1)
+            .mount(&modelsdev_server)
+            .await;
+        let cache_dir = tempfile::tempdir().unwrap();
+        let _base =
+            kigi_test_support::EnvGuard::set(kigi_models::GROQ_BASE_URL_ENV, platform_server.uri());
+        let _mdev = kigi_test_support::EnvGuard::set(
+            crate::agent::enrichment_fetch::MODELS_DEV_URL_ENV,
+            format!("{}/api.json", modelsdev_server.uri()),
+        );
+        let _mdev_cache = kigi_test_support::EnvGuard::set(
+            crate::agent::enrichment_fetch::MODELS_DEV_CACHE_DIR_ENV,
+            cache_dir.path(),
+        );
+        let endpoints = crate::agent::config::EndpointsConfig::default();
+        let keys = crate::agent::models::PlatformApiKeys::test_single(
+            kigi_models::PlatformId::Groq,
+            "gsk-1",
+        );
+        let result = tokio::task::spawn_blocking(move || {
+            fetch_platform_models_blocking(&endpoints, None, &keys)
+        })
+        .await
+        .unwrap()
+        .expect("fetch must succeed");
+        assert_eq!(
+            result
+                .models
+                .iter()
+                .map(|m| m.id.as_deref().unwrap_or_default())
+                .collect::<Vec<_>>(),
+            vec!["groq/llama-3.3-70b-versatile"],
+            "whisper (enrichment-known, not tool-calling) must be dropped"
+        );
+        let entry = &result.models[0];
+        assert_eq!(entry.context_window.get(), 131_072);
+        assert_eq!(entry.max_completion_tokens, Some(32_768));
+        let model_entry = crate::agent::config::ModelEntry::from_config_entry(entry);
+        let creds = crate::agent::config::ResolvedCredentials {
+            api_key: Some("gsk-1".into()),
+            base_url: entry.base_url.clone(),
+            auth_type: kigi_chat_state::AuthType::ApiKey,
+            auth_scheme: Default::default(),
+        };
+        let cfg = crate::agent::config::sampling_config_for_model(&model_entry, creds, None);
+        assert_eq!(
+            cfg.chat_compat,
+            kigi_sampling_types::ChatCompat::Passthrough,
+            "groq entries must leave OpenAI-style bodies untouched"
+        );
+    }
+
     #[test]
     fn get_env_keys_parses_strings_and_rejects_non_strings() {
         use crate::agent::config::EnvKeys;

crates/codegen/kigi-tui/src/app/app_view.rs

@@ -6894,7 +6894,7 @@ pub(crate) mod tests {
     #[test]
     fn pending_menu_items_lists_interactive_methods_plus_quit() {
         let items = pending_menu_items(&fresh_user_auth_methods(), None);
-        assert_eq!(items.len(), 7, "6 login rows + Quit, got {items:?}");
+        assert_eq!(items.len(), 8, "7 login rows + Quit, got {items:?}");
         assert!(
             matches!(&items[0], PendingMenuItem::Login { label } if label == "Kimi Code (OAuth)"),
             "row 0 must be the OAuth login, got {:?}",
@@ -6936,7 +6936,14 @@ pub(crate) mod tests {
                 label: "DeepSeek (API key)".into(),
             }
         );
-        assert_eq!(items[6], PendingMenuItem::Quit);
+        assert_eq!(
+            items[6],
+            PendingMenuItem::ApiKey {
+                target: PlatformLogin(kigi_shell::models::PlatformId::Groq),
+                label: "Groq (API key)".into(),
+            }
+        );
+        assert_eq!(items[7], PendingMenuItem::Quit);
         // The non-interactive methods must never appear as rows.
         let byok = kigi_shell::agent::auth_method::build_auth_methods(
             kigi_shell::agent::auth_method::AuthMethodsBuildInputs {
@@ -6947,7 +6954,7 @@ pub(crate) mod tests {
         );
         assert_eq!(
             pending_menu_items(&byok.methods, None).len(),
-            7,
+            8,
             "xai.api_key / cached_token must not add rows"
         );
     }