Skip to content

Model providers

Capability separation

Providers are optional adapters around a browser-owned simulation. Text and image setup share one Model Setup panel, but neither adapter receives a state, DOM, navigation, or persistence write handle.

Capability Implementation Model Endpoint
Foreground conversation DeepSeek Responses deepseek-v4-flash-vision-exp POST https://api.deepseek.com/responses
Silent daily Curator DeepSeek Responses deepseek-v4-flash-vision-exp POST https://api.deepseek.com/responses
Image concept MiniMax international image-01 POST https://api.minimax.io/v1/image_generation
Offline conversation Deterministic local service Versioned browser logic No network
Offline Curator Deterministic runtime plan Run/day seed No network

DeepSeek vision capability is not used to generate images. MiniMax image output does not author campaign state. Deterministic text is the default and the entire seven-day run remains playable without either key.

Optional speech recognition and synthesis use browser Web Speech APIs, not model provider adapters. Recognition fills the same bounded conversation draft, and synthesis reads accepted coworker beats while captions remain primary.

Browser BYOK

The current static release makes direct browser BYOK calls. A player enters each key in Model Setup; no build-time secret is read by Vite and no VITE_ environment variable contains a provider key.

Provider-policy and exposure risk

MiniMax documentation says API keys must not be exposed in client-side code and leaked keys may be disabled. Any browser BYOK key is visible to scripts running in that origin and, if remembered, to people or extensions with local browser access. CORS acceptance does not make this safe. A same-origin relay or trusted local asset pipeline remains the recommended future boundary.

By default, keys live only in memory. Remember setup stores the provider and model choices plus raw keys in localStorage after a plain-language warning. Clear setup removes persisted provider data and generated in-memory image state. The UI hydrates stored keys as configured/not-configured placeholders, never back into visible password fields. Save or removal failure produces a manual clear-site-data warning rather than a false success message.

Public projections

The browser first builds a full, validated context with explicit knowledge audiences. A second projection is the only object passed to the network:

  • foreground requests retain only commitments, observations, conversation summaries, and memories that are public to every selected participant;
  • Curator requests retain only knowledge marked public and known by the whole authored cast;
  • API keys, storage records, full logs, hidden future state, and generated image data are never request fields.

Provider output is parsed first against the public request and then against the full browser context. This catches stale echoes, unknown IDs, invalid knowledge bases, impossible audiences, and proposals that became invalid against current private state without disclosing that private state to the provider.

Foreground DeepSeek

The foreground service is proximity-driven. The browser chooses Jesse, the focused coworker, and any additional eligible participants before constructing a strict response schema. DeepSeek cannot add people or target IDs outside that enumerated request.

The adapter uses:

  • reasoning.effort: "medium";
  • a 60-second default request timeout;
  • a 256,000-byte request cap and 512,000-byte response cap;
  • exact JSON Schema with no unknown response fields;
  • echoed conversation ID and expected world revision;
  • transport, schema, knowledge, campaign, Donna, timing, and domain validation;
  • one active UI conversation request at a time and caller-owned cancellation.

A valid response can propose bounded beats, task changes, commitments, relationship interpretations, memory statements, artifact briefs, and actor intents. The browser converts accepted material into finite events with browser-owned IDs, bounds, locations, deltas, and provenance. Actor intents are advisory output and are not persisted or executed by the released UI.

If deterministic text is selected, the browser creates a local response without network access. If DeepSeek is selected and its foreground call fails, the draft is restored and a bounded error is shown; the browser does not silently turn a failed paid conversation into a different accepted conversation.

Silent DeepSeek Curator

The Curator is not a visible or speaking character. Once per campaign day, it may propose one pressure plan for the five autonomous founders. The provider cannot target Jesse or Donna, invent room routes, mutate state, or schedule outside the current day.

The Curator adapter uses reasoning.effort: "high" and a 35-second default timeout. The living runtime applies the same 35-second Curator hold to campaign advancement, and only while that request remains current. Any missing hook, rejected promise, timeout, abort, stale revision, invalid proposal, or empty target set resolves through the deterministic run/day-seeded local plan.

Structured repair and paid calls

Both DeepSeek services request repair mode once. The first malformed structured output can therefore cause exactly one additional request containing the bounded previous output as inert repair input. There is no automatic transport retry and no loop after a failed repair. This distinction matters for cost authorization: one logical DeepSeek action can make up to two paid calls.

Errors expose bounded actionable messages without response headers, bearer tokens, or raw provider bodies. Abort and timeout invalidate request identity; late provider responses are ignored even if network cancellation is not honored.

MiniMax image

The adapter accepts only the exact versioned DEFAULT_DONNA_IMAGE_PROMPT. The request is fixed to the lowest documented dimensions and one result:

{
  "model": "image-01",
  "prompt": "<versioned DEFAULT_DONNA_IMAGE_PROMPT>",
  "width": 512,
  "height": 512,
  "response_format": "base64",
  "n": 1,
  "prompt_optimizer": false
}

image-01 exposes no quality enum. Returned data is displayed only after:

  • provider status reports success and exactly one Base64 item exists;
  • response and decoded-byte limits pass;
  • the complete Base64 payload decodes;
  • static JPEG or PNG structure, end marker, and 512 by 512 dimensions pass;
  • APNG animation chunks are absent;
  • native browser image decoding succeeds before its separate deadline;
  • any retained provider trace ID passes a printable identifier whitelist.

Generated portraits are memory-only. The reviewed built-in Donna portrait remains available when no key exists or generation fails. Model output is never interpreted as markup, a URL, executable data, or a campaign artifact.

Provider network tests require a separately authorized launcher. They are never part of pnpm run test, pnpm run validate, pnpm run build, ordinary browser tests, or deployment.

MiniMax image-01 was documented around $0.0035 per image when integrated. The initial three-request authorization is treated as exhausted after one Node success, one browser timeout, and one browser success. Do not run pnpm run smoke:minimax or pnpm run test:browser:paid without renewed authorization. pnpm run test:browser:deepseek likewise requires explicit DeepSeek authorization and awareness of the one-repair maximum.

Local .env values are Node launcher inputs only and are excluded from Git, Docker context, Vite, MkDocs, and assembled output. An authorized launcher forwards only the selected provider key to its Playwright worker; the Vite child receives neither provider key.

Sources