[Feature] Add Cloudflare AI Gateway and Workers AI as separate providers

README.md

@@ -83,6 +83,7 @@ cleans up after itself.
    the models included in your subscription.
 2. **API keys (BYOK).** Paste a key from OpenRouter, Anthropic, OpenAI, xAI,
    Google Gemini, Amazon Bedrock, Vercel AI Gateway,
+   Cloudflare AI Gateway, Cloudflare Workers AI,
    Baseten, Together AI, Moonshot AI (Kimi), Kimi for Coding, MiniMax,
    Z.AI (including Coding Plan), OpenCode Zen / Go, or GitHub Copilot.
 
@@ -232,7 +233,8 @@ it runs.
 **What models does it support?**
 Two options. Connect your ChatGPT Plus or Pro subscription directly (no API key
 needed), or paste an API key from OpenRouter, Anthropic, OpenAI, xAI, Google
-Gemini, Amazon Bedrock, Vercel AI Gateway, Baseten,
+Gemini, Amazon Bedrock, Vercel AI Gateway, Cloudflare AI Gateway,
+Cloudflare Workers AI, Baseten,
 Together AI, Moonshot AI (Kimi), Kimi for Coding, MiniMax, Z.AI (including
 Coding Plan), OpenCode Zen / Go, or GitHub Copilot.
 

SELF_HOSTING.md

@@ -396,11 +396,19 @@ model. When unset, exploration falls back to the task's active coding model:
 R_EXPLORE_MODEL=openrouter/openai/gpt-5.6-luna
 ```
 
-The provider is the first segment of the model id. Roomote forwards these
-common provider keys into worker containers:
+The provider is the first segment of the model id. Configure these common
+provider keys on the Roomote control plane. When the inference gateway is
+enabled, API tokens stay on the control plane and sandboxes authenticate with
+a run token. Non-secret identity values such as account IDs, gateway IDs, and
+regions remain available to the task runtime:
 
 - `OPENROUTER_API_KEY`
 - `AI_GATEWAY_API_KEY` (Vercel AI Gateway, `vercel/...` models)
+- `CLOUDFLARE_AI_GATEWAY_API_TOKEN`, `CLOUDFLARE_AI_GATEWAY_ACCOUNT_ID`,
+  and `CLOUDFLARE_AI_GATEWAY_ID` (Cloudflare AI Gateway,
+  `cloudflare-ai-gateway/...` models)
+- `CLOUDFLARE_WORKERS_AI_API_TOKEN` and `CLOUDFLARE_WORKERS_AI_ACCOUNT_ID`
+  (Cloudflare Workers AI, `cloudflare-workers-ai/...` models)
 - `OPENAI_API_KEY`
 - `ANTHROPIC_API_KEY`
 - `MOONSHOT_API_KEY`
@@ -421,10 +429,11 @@ R_MODEL_ENV_KEYS=CUSTOM_PROVIDER_API_KEY
 CUSTOM_PROVIDER_API_KEY=...
 ```
 
-The checked-in Compose files forward the common provider keys above and the
-sample `CUSTOM_PROVIDER_API_KEY`. If you use a different custom provider key
-name in a Compose deployment, add that key to the service environment block or
-provide it through your deployment secret mechanism.
+The checked-in Compose files accept the common provider keys above and the
+sample `CUSTOM_PROVIDER_API_KEY` on the control-plane services. If you use a
+different custom provider key name in a Compose deployment, add that key to
+the service environment block or provide it through your deployment secret
+mechanism.
 
 ## Artifact Storage
 

apps/api/src/handlers/inference/index.ts

@@ -1,6 +1,9 @@
 import { Hono } from 'hono';
 
-import { formatSingleLineLog } from '@roomote/types';
+import {
+  formatSingleLineLog,
+  rewriteCloudflareAiGatewayRequestBody,
+} from '@roomote/types';
 import { db, eq, taskRuns } from '@roomote/db/server';
 import { recordLlmUsage } from '@roomote/sdk/server';
 
@@ -381,6 +384,12 @@ inference.on(['POST', 'GET'], '/:provider/*', async (c) => {
     }
   }
 
+  if (providerId === 'cloudflare-ai-gateway' && method === 'POST') {
+    const bodyText = await c.req.text();
+    requestBody = rewriteCloudflareAiGatewayRequestBody(bodyText);
+    useDuplexHalf = false;
+  }
+
   try {
     const upstreamResponse = await fetchWithLongLivedStreamDispatcher(
       upstreamUrl,

apps/api/src/handlers/inference/registry.ts

@@ -1,6 +1,7 @@
 import {
   CHATGPT_ACCOUNT_ID_HEADER,
   getInferenceGatewayProvider,
+  INFERENCE_GATEWAY_IDENTITY_PATTERN,
   INFERENCE_GATEWAY_RESOURCE_PATTERN,
   INFERENCE_GATEWAY_REGION_PATTERN,
   type InferenceGatewayProvider,
@@ -79,23 +80,57 @@ export async function resolveGatewayUpstream(
     };
   }
 
+  const requiredHeaders = await resolveRequiredForwardHeaders(provider);
+
   return {
     ok: true,
     resolved: {
       upstreamUrl: `${upstreamBaseUrl}${upstreamPath}${search}`,
-      headers:
-        apiKey && provider.authHeader
+      headers: {
+        ...requiredHeaders,
+        ...(apiKey && provider.authHeader
           ? {
               [provider.authHeader.name]: formatProviderAuthHeaderValue(
                 provider,
                 apiKey,
               ),
             }
-          : {},
+          : {}),
+      },
     },
   };
 }
 
+async function resolveRequiredForwardHeaders(
+  provider: InferenceGatewayProvider,
+): Promise<Record<string, string>> {
+  if (!provider.requiredHeaders?.length) {
+    return {};
+  }
+
+  const headers: Record<string, string> = {};
+
+  for (const spec of provider.requiredHeaders) {
+    const value = await resolveModelProviderEnvValue([spec.envVarName]);
+
+    if (!value) {
+      throw new Error(
+        `${spec.envVarName} must be configured for ${provider.name}.`,
+      );
+    }
+
+    if (!INFERENCE_GATEWAY_IDENTITY_PATTERN.test(value)) {
+      throw new Error(
+        `${spec.envVarName} must be a valid identity value for ${provider.name}. Received "${value}".`,
+      );
+    }
+
+    headers[spec.headerName] = value;
+  }
+
+  return headers;
+}
+
 /**
  * xAI supports both SuperGrok OAuth and a BYOK API key. Prefer a connected
  * subscription (fresh access token) so subscription users never need a key;

apps/docs/docs.json

@@ -74,6 +74,8 @@
               "providers/inference/azure-openai",
               "providers/inference/baseten",
               "providers/inference/chatgpt",
+              "providers/inference/cloudflare-ai-gateway",
+              "providers/inference/cloudflare-workers-ai",
               "providers/inference/github-copilot",
               "providers/inference/google-gemini",
               "providers/inference/kimi-for-coding",

apps/docs/environment-variables.mdx

@@ -188,6 +188,11 @@ as per-task auth tokens or workspace paths.
 | `AI_GATEWAY_API_KEY`                   | Provider key | Vercel AI Gateway API key.                                                                                                              |
 | `BASETEN_API_KEY`                      | Provider key | Baseten API key.                                                                                                                        |
 | `TOGETHER_API_KEY`                     | Provider key | Together AI API key.                                                                                                                    |
+| `CLOUDFLARE_AI_GATEWAY_API_TOKEN`      | Provider key | Cloudflare AI Gateway API token. Does not connect Workers AI.                                                                           |
+| `CLOUDFLARE_AI_GATEWAY_ACCOUNT_ID`     | Provider config | Cloudflare account ID for AI Gateway requests.                                                                                      |
+| `CLOUDFLARE_AI_GATEWAY_ID`             | Provider config | Cloudflare AI Gateway ID, for example `default`.                                                                                    |
+| `CLOUDFLARE_WORKERS_AI_API_TOKEN`      | Provider key | Cloudflare Workers AI API token. Does not connect AI Gateway.                                                                           |
+| `CLOUDFLARE_WORKERS_AI_ACCOUNT_ID`     | Provider config | Cloudflare account ID for Workers AI requests. A gateway ID is not used.                                                            |
 | `OPENAI_API_KEY`                       | Provider key | OpenAI API key.                                                                                                                         |
 | `AZURE_API_KEY`                        | Provider key | Azure OpenAI API key.                                                                                                                   |
 | `AZURE_RESOURCE_NAME`                  | Provider config | Azure OpenAI resource name, without the domain or URL.                                                                                |