refactor(llm): let a provider sign in with its own credential at a pinned endpoint

- a provider entry can supply a credential, a token callable per request, and pin its base URL
- such a provider never sends an API key, and refuses another backend_url or an explicit api_key

tests/test_provider_registry.py

@@ -58,3 +58,59 @@ def test_key_optionality():
     assert OPENAI_COMPATIBLE_PROVIDERS["xai"].key_optional is False
     # OLLAMA_BASE_URL is the only base-URL env override.
     assert OPENAI_COMPATIBLE_PROVIDERS["ollama"].base_url_env == "OLLAMA_BASE_URL"
+
+
+# --- a provider that signs in: its own credential, its own pinned endpoint ---------
+
+class _Recorder:
+    """Stands in for the chat class and records what the client built."""
+
+    def __init__(self, **kwargs):
+        self.kwargs = kwargs
+
+
+def _signed_in_provider(monkeypatch, token="plan-token"):
+    from tradingagents.llm_clients import openai_client
+
+    spec = openai_client.ProviderSpec(
+        base_url="https://api.openai.com/v1", pinned_base_url=True, use_responses_api=True,
+        credential=lambda: (lambda: token), chat_class=_Recorder,
+    )
+    monkeypatch.setitem(openai_client.OPENAI_COMPATIBLE_PROVIDERS, "signed-in", spec)
+    return openai_client
+
+
+@pytest.mark.unit
+def test_a_signed_in_provider_sends_its_own_credential_never_an_api_key(monkeypatch):
+    openai_client = _signed_in_provider(monkeypatch)
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-must-not-be-used")
+    llm = openai_client.OpenAIClient("gpt-x", provider="signed-in").get_llm()
+    assert callable(llm.kwargs["api_key"]) and llm.kwargs["api_key"]() == "plan-token"
+    assert llm.kwargs["base_url"] == "https://api.openai.com/v1"
+
+
+@pytest.mark.unit
+@pytest.mark.parametrize("client_kwargs", [
+    {"base_url": "https://relay.example/v1"},       # backend_url / TRADINGAGENTS_LLM_BACKEND_URL
+    {"api_key": "sk-explicit"},
+])
+def test_a_signed_in_provider_refuses_another_endpoint_or_key(monkeypatch, client_kwargs):
+    openai_client = _signed_in_provider(monkeypatch)
+    base_url = client_kwargs.pop("base_url", None)
+    client = openai_client.OpenAIClient("gpt-x", base_url=base_url, provider="signed-in", **client_kwargs)
+    with pytest.raises(ValueError):
+        client.get_llm()
+
+
+@pytest.mark.unit
+def test_a_missing_sign_in_fails_before_any_request(monkeypatch):
+    from tradingagents.llm_clients import openai_client
+
+    def not_signed_in():
+        raise ValueError("Not signed in; run `tradingagents login chatgpt`.")
+
+    spec = openai_client.ProviderSpec(base_url="https://api.openai.com/v1", pinned_base_url=True,
+                                      credential=not_signed_in, chat_class=_Recorder)
+    monkeypatch.setitem(openai_client.OPENAI_COMPATIBLE_PROVIDERS, "signed-in", spec)
+    with pytest.raises(ValueError, match="login chatgpt"):
+        openai_client.OpenAIClient("gpt-x", provider="signed-in").get_llm()