feat(providers): add Volcengine Ark provider presets - #611
Conversation
📝 WalkthroughWalkthroughAdds Volcengine Ark pay-as-you-go, Coding Plan, and Agent Plan provider presets with curated models, Responses routing metadata, localized GUI names, validation coverage, and multilingual documentation. ChangesVolcengine provider integration
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant OcxConfig
participant routeModel
participant createResponsesPassthroughAdapter
participant VolcengineAgentPlan
OcxConfig->>routeModel: route volcengine-agent-plan model
routeModel->>createResponsesPassthroughAdapter: use responsesPath /responses
createResponsesPassthroughAdapter->>VolcengineAgentPlan: build request
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@gui/src/provider-icons.ts`:
- Around line 90-92: Replace the hardcoded Volcengine labels in provider-icons
with stable provider/translation keys resolved through the existing GUI i18n
locale layer, while keeping catalog-ID detection separate from display-label
resolution. Update tests/volcengine-providers.test.ts lines 150-155 to use the
localized resolver with an English locale fixture and assert the resulting
labels.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 8b47bc4c-9989-4cf7-9ded-8e1d769b17db
📒 Files selected for processing (12)
docs-site/src/content/docs/guides/providers.mddocs-site/src/content/docs/ja/guides/providers.mddocs-site/src/content/docs/ko/guides/providers.mddocs-site/src/content/docs/ru/guides/providers.mddocs-site/src/content/docs/zh-cn/guides/providers.mdgui/src/provider-icons.tssrc/providers/derive.tssrc/providers/registry.tssrc/router.tsstructure/00_overview.mdtests/provider-registry-parity.test.tstests/volcengine-providers.test.ts
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 403cf31a15
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Wibias
left a comment
Wibias
left a comment
There was a problem hiding this comment.
Maintainer review (bug + security)
Verdict: REQUEST CHANGES
Security
No medium+ findings on the new Volcengine presets (static catalog + key auth). No new secret handling.
Bug review / open bot threads
| Item | Status |
|---|---|
| Rabbit: localize Volcengine labels | Fixed (i18n keys + locale files) |
| Codex P1: preserve DeepSeek reasoning on Coding Plan tool turns | Still open — volcengine-coding-plan has no preserveReasoningContentModels for deepseek-v4-pro / deepseek-v4-flash |
| Codex P1: DeepSeek V4 effort mappings on Coding Plan | Still open — no modelReasoningEfforts / modelReasoningEffortMap on that preset (will advertise/send raw Codex ladder) |
| Codex P2: image inputs for multimodal Coding Plan models | Still open — kimi-k2.6 / minimax-m3 lack modelInputModalities while liveModels: false |
Codex P2: carry responsesPath on custom rename |
Partially fixed — Agent Plan declares responsesPath: "/responses" and derive seeds it by registry id; rename-away-from-id still needs confirmation |
Please mirror the metadata already present on volcengine / Alibaba DeepSeek presets onto volcengine-coding-plan (and Agent Plan where applicable), with focused registry/parity tests.
Notes
- Fork PR: CI surface incomplete on head SHA; blockers above are from code review of
upstream/dev...HEAD.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df46842c51
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@Wibias check this |
|
NEEDS-CHANGES — one of the items is a real credential-safety gap, not paperwork. The conflict is smaller than it looks. GitHub shows 29 changed files, but const addModalAccountRows = buildAddModalAccountRows(config, oauthProviders, t);
const accountLoginStatus = buildAccountLoginStatus(config, oauthStatusWithCodex);Everything else auto-merges. The gap worth fixing regardless of the evidence question. None of the three presets sets Add The evidence gate.
If that evidence proves hard to assemble, the same clause points at an inert The three-way split ( What happens next: resolve the single GUI hunk, add |
lidge-jun
left a comment
lidge-jun
left a comment
There was a problem hiding this comment.
Formalizing the disposition so it shows on your dashboard.
Two blocking items beyond the evidence gate:
- None of the three presets sets
preserveCustomDestination. A user who already saved a custom provider namedvolcenginewith a matching adapter and auth shape can have their destination canonicalized onto Ark — that is their API key going somewhere they did not choose. Add it to all three plus a regression. - The merge conflict is one hunk in
gui/src/pages/Providers.tsx; keep both thebuildAddModalAccountRowsandbuildAccountLoginStatusdeclarations.
Evidence gate items still missing: primary-source endpoint documentation, ToS and operating legal entity, routing authorization (the Coding and Agent catalogs bundle DeepSeek, GLM, Kimi and MiniMax), a named maintenance owner, and a citable verification date.
Full reasoning in my earlier comment.
Ingwannu
left a comment
Ingwannu
left a comment
There was a problem hiding this comment.
Security review completed against bdfc05c230fde700e531ea2bae339a96ffb3df64.
Requesting changes because the canonical credential-destination evidence gate in MAINTAINERS.md:35-42 is still incomplete.
The earlier code-level credential-retargeting issue is fixed: all three presets now set preserveCustomDestination, and the focused regression covers a same-name custom destination. The requested DeepSeek reasoning metadata, multimodal declarations, localized labels, and Agent Plan responsesPath propagation are also present on the current head.
The remaining blocker is evidence, not implementation shape. The PR body still provides endpoint strings and private probe results, but no citable primary-source package for:
- documented Ark pay-as-you-go, Coding Plan, and Agent Plan endpoints;
- Volcengine's applicable terms and operating legal entity;
- authorization for the Coding/Agent Plan routes to expose the bundled DeepSeek, GLM, Kimi, and MiniMax catalogs;
- a named maintenance owner; and
- a citable verification date.
Please add those sources to the PR description. If public routing authorization cannot be established, keep the entry inert/non-canonical as required by the repository policy. Do not merge the current head as a canonical preset.
|
Evidence package for the remaining security-review gate, verified on 2026-07-31 by @yrooogerg.
One boundary to call out: I found public Volcengine documentation that these Plan catalogs expose the listed third-party model families, but I did not find a separate public legal authorization document for Volcengine's third-party model routing beyond the product docs and Ark terms above. |
0a96a62 to
5c52f16
Compare
lidge-jun
left a comment
lidge-jun
left a comment
There was a problem hiding this comment.
Approving after rebasing this onto current dev and re-running the gates myself.
What I changed on your branch
Rebased feat/volcengine-providers from its 234-commit-old base onto current dev (now 8c8832137), and resolved the conflicts:
- Preset counts across five locales. Both sides had moved:
devwas at 62/51 and this branch claimed 63/52 against an older base. Neither was right after the rebase, so I counted the registry directly (PROVIDER_REGISTRY.length= 65: 54 key, 7 OAuth, 3 local, 1 forward) and set en/ja/ko/ru/zh-cn to 65/54. gui/src/pages/Providers.tsx.devhad switchedbuildAccountLoginStatustooauthStatusWithCodexwhile this branch added thetargument tobuildAddModalAccountRows. Kept both.
I also pushed one commit of my own:
glm-5.1→glm-5.2inVOLCENGINE_CODING_PLAN_MODELSandVOLCENGINE_AGENT_PLAN_MODELS, plus the matching assertions intests/volcengine-providers.test.ts. Volcengine's current published Plan model list carriesglm-5.2;glm-5.1is not in it. Because both presets areliveModels: false, discovery cannot repair a stale id — it reaches the user as an upstream model error at request time. This is exactly the maintenance cost a static catalog takes on, so please keep an eye on that list going forward.
Verification on the rebased head
bun run typecheckbun run test— 6415 pass, 4 skip, 0 fail across 463 filesgui:bun test tests— 463 pass, 0 failbun run lint:gui,bun run privacy:scan,bun run build:gui- Focused:
volcengine-providers,provider-registry-parity,tencent-siliconflow-providers,provider-workspace-data— 92 pass
On the credential-destination policy
MAINTAINERS.md asks for an evidence ledger on any new preset. Your PR body documents the endpoints, the three-way billing split, and your authenticated /models probe results, which covers the substance. What it does not state explicitly is the operating legal entity, a citable verification date, and a named maintenance owner. Please add those to the description — for the record, the entity behind the Ark terms is 北京火山引擎科技有限公司.
The three presets keep discovery registry-owned, set liveModels: false against a mixed 126-resource catalog rather than publishing embeddings and video models into the picker, and use preserveCustomDestination so an existing same-name custom provider is not silently retargeted. That is the right shape for this integration.
One note on the Plan endpoints: Volcengine documents them as subscription routes for AI coding tools. That is precisely what opencodex is, so the preset is inside the documented use, and it matches how tencent-coding-plan already ships. The note field is the surface that tells users which route they are on — keep it accurate if Volcengine changes those terms.
5c52f16 to
983b7b6
Compare
The Coding Plan and Agent Plan static catalogs advertised `glm-5.1`, which is absent from Volcengine's current published Plan model list. Because both presets are `liveModels: false`, a stale id cannot be corrected by discovery and surfaces to the user as an upstream model error at request time.
Volcengine documents Coding Plan and Agent Plan quota as valid only inside supported AI coding tools, and warns that using a plan key for general API calls may suspend the subscription or ban the account. Routing Codex or Claude Code through opencodex is the vendor's documented use, so the presets stay canonical — but the user was never told about the boundary they must not cross. `tencent-coding-plan` already ships this disclosure; these two entries did not. - carry the restriction in both Plan `note` strings, worded per product so Agent Plan does not quote Coding-Plan-specific policy - resolve the DTO note by DESTINATION rather than by provider name. The dashboard lets a preset be saved under any name, and a renamed row kept the credential destination while silently losing the warning about it - declare the text-only Plan models so the vision sidecar cannot advertise image input for models that cannot accept it, matching the Tencent precedent - document the restriction in the provider guide The custom-name regression fails on the previous name-only lookup, verified by reverting the resolver and re-running the test.
983b7b6 to
688fd77
Compare
Credential-destination evidence ledgerPosting this as owner because @Ingwannu's security review blocked on the
On routing authorizationThe gate asks for "resale or routing authorization for aggregators".
I ran a deliberate counter-search for evidence against this — enforcement actions, key revocations, proxy crackdowns, and third-party model-owner objections across V2EX, 掘金, CSDN, Zhihu, GitHub, Reddit, and HN. No incident was found. Absence of a reported ban is not authorization on its own, which is why the disclosure below is part of this decision rather than optional. The defect this review foundVolcengine states plainly that plan quota is valid only inside supported AI coding tools, and that other API use of the key may suspend the subscription or ban the account (article/37156, 2026-04-09; The presets did not say so.
Also landed on this branch
Verification
One note on CI history: an earlier head was cancelled on Merging. @yrooogerg — please add the maintenance owner line to the description; that is the one gate item still outstanding, and it is yours to own going forward since these catalogs are static and will need updating when Volcengine changes its plan model list. |
|
Owner decision on the credential-destination evidence gate, with the primary-source ledger it asks for. I also pushed one more commit to this branch; details below. Evidence ledger (verification date 2026-08-01, sources opened)
On routing authorization@Ingwannu — this is the item your review blocked on, so here is the reasoning rather than an assertion. Volcengine publishes a Codex CLI integration guide for Coding Plan that instructs users to put a plan key into The gate's phrase is "resale or routing authorization for aggregators", and A counter-search across V2EX, 掘金, CSDN, Zhihu, GitHub, Reddit, and HN found no report of a plan key revoked for routing through a proxy. Absence of a reported ban is not authorization, which is why the restriction is now disclosed rather than assumed away. The one real defect this review foundVolcengine states plainly that Plan quota is valid only inside supported AI coding tools, and that other API use of the key may suspend the subscription or ban the account (article 37156, 2026-04-09; Commit
Earlier I also pushed VerificationRebased onto current
The custom-name regression was proven non-vacuous by ablation: reverting the resolver makes it fail (15 pass / 1 fail), restoring it returns 16/16. Two CI jobs failed once before passing on rerun. Both were diagnosed rather than blind-retried, and neither file appears in this diff: macOS exited 133 on a Bun segfault immediately after Ask for @yrooogergPlease add a named maintenance owner line to the PR description — the person who owns this preset's evidence and breakage follow-up, as |
Superseded by my own APPROVED review on the current head. The evidence gate I blocked on is answered in the ledger comment: endpoints, legal entity (北京火山引擎科技有限公司), ToS dates, and routing authorization for the documented coding-tool use are all cited from opened primary sources, with a 2026-08-01 verification date.
4 participants
Summary
responsesPathsupport for the Agent Plan native Responses endpointdoubao-seed-2-1-pro-260628as the pay-as-you-go defaultWhy
Volcengine Ark is a major model and cloud provider, particularly for developers using Doubao and China-region model services. A built-in preset removes substantial manual configuration and gives the three products clear billing boundaries:
volcengine:https://ark.cn-beijing.volces.com/api/v3volcengine-coding-plan:https://ark.cn-beijing.volces.com/api/coding/v3volcengine-agent-plan:https://ark.cn-beijing.volces.com/api/plan/v3/responsesThe ordinary
/api/v3route may incur pay-as-you-go charges even when the user has a Plan subscription, so keeping these as separate provider IDs is important for billing safety.Model discovery findings
Authenticated, read-only
/modelsprobes showed:ark-code-latest/modelsThe 126-resource catalog mixes chat models with embeddings, image generation, video generation, 3D generation, and historical model versions. Publishing it directly would expose resources that the Codex chat adapter cannot call and models that a Plan subscription may not authorize. The three presets therefore use curated static catalogs with
liveModels: false.A minimal pay-as-you-go smoke request against
doubao-seed-2-1-pro-260628succeeded. The available test key did not include Coding Plan or Agent Plan entitlements: the Coding request returnedInvalidSubscription, and the Agent request returnedUnsupportedModel. No credential is stored in the repository, test fixtures, or PR content.Validation
bun run typecheckbun run test— 5,705 passed, 0 failedbun run privacy:scangit diff --checkFollow-up opportunities
Volcengine also has strong multimodal generation products. Follow-up work can evaluate dedicated integrations for:
Those APIs have different request/response shapes and media lifecycle requirements, so they are intentionally outside this provider-preset PR and should be designed as explicit image/video capabilities.
Summary by CodeRabbit