feat(providers): add DeepInfra preset

[olddonkey]

Summary

• add a collision-safe deepinfra API-key preset, derived automatically into CLI init, key login, and dashboard provider surfaces
• pin discovery to DeepInfra's documented authenticated GET https://api.deepinfra.com/v1/models endpoint and keep only rows whose metadata.tags contain chat
• cap the mixed catalog at 512 KiB and 512 raw rows, preserve slash-containing model IDs, and parse DeepInfra's nested metadata.context_length
• add fixture-only provider, routing, validation, collision-preservation, and metadata tests plus synchronized docs in English, Japanese, Korean, Russian, and Simplified Chinese

Novita is intentionally no longer part of this canonical-preset PR. Its existing inert row in src/providers/free-directory.ts remains available; it can be promoted separately if primary sources establish the operating legal entity and routing authorization required by MAINTAINERS.md.

Safety and scope

• the credential destination is fixed to https://api.deepinfra.com/v1/openai, and the authenticated discovery destination is fixed to https://api.deepinfra.com/v1/models
• discovery URL/filter/limit policy remains registry-only and is never copied into config.json or the key-login projection
• preserveCustomDestination keeps an older same-named custom provider on its original host and adapter, including model discovery
• tests never call live provider endpoints
• the preset makes no static claims for reasoning, tools, structured output, or multimodal support beyond bounded model metadata
• this is independently based on dev and relates to the provider-expansion umbrella in [Provider] Promote a verified batch of OpenAI-compatible inference providers #572

Canonical-preset evidence

Verified on 2026-07-30:

Requirement	Primary-source evidence
Operating legal entity and terms	DeepInfra Terms of Service identify DEEP INFRA, INC., a Delaware corporation, as the provider of the website, APIs, and other services. The page says it was last modified July 4, 2024.
OpenAI-compatible inference destination	DeepInfra API reference documents OpenAI-compatible endpoints under /v1/openai, including chat completions.
Authenticated live-model destination	DeepInfra OpenAI models reference documents authenticated GET https://api.deepinfra.com/v1/models with Authorization: Bearer <token> and a response containing metadata.tags and metadata.context_length.
Third-party model routing authorization	The Terms state that DeepInfra provides production-ready APIs to open-source AI models, that each model remains subject to its own license, and that customers may use the Services for legal commercial purposes unless otherwise prohibited. This is the primary-source basis offered for the preset's routing use; maintainer/security confirmation is requested before merge.
Maintenance owner	@olddonkey owns this preset's evidence and breakage follow-up. Please tag me on endpoint, terms, ownership, or catalog changes; I will update or demote the preset if the evidence no longer supports it.
Contributor affiliation	I have no affiliation with DeepInfra and received no compensation for this contribution.

Verification

• bun run typecheck
• bun run privacy:scan
• bun test tests/deepinfra-provider.test.ts tests/provider-registry-parity.test.ts tests/provider-model-discovery-contract.test.ts tests/codex-catalog.test.ts — 169 pass, 0 fail
• bun run test — 6273 pass, 4 skip, 0 fail across 457 files
• bun run build in docs-site/ — 146 pages built
• registry count audit — 61 total / 50 key / 7 OAuth / 3 local / 1 forward

Relates to #572. This PR does not close the umbrella issue.

Summary by CodeRabbit

• New Features
  • Added DeepInfra as a supported provider with API-key authentication and OpenAI-compatible chat access.
  • Added live model discovery with chat-only filtering, preserved model IDs containing slashes, and bounded discovery results.
  • Improved context-window detection using model metadata when available.
• Documentation
  • Updated provider preset, authentication, and OAuth counts across supported languages.
  • Documented DeepInfra setup, discovery behavior, response limits, and dashboard access.
• Tests
  • Added coverage for DeepInfra configuration, authentication, discovery, routing, and custom settings.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds DeepInfra as an OpenAI-compatible provider with API-key authentication, bounded live model discovery, slash-preserving routing, metadata support, registry parity, tests, and documentation in five languages.

Changes

DeepInfra provider integration

Layer / File(s)	Summary
Registry and model discovery src/codex/catalog/provider-fetch.ts, src/providers/registry.ts	DeepInfra defines fixed endpoints, Bearer authentication, chat-only discovery, response and model-count limits, and custom-destination handling. Discovery also reads metadata.context_length.
Provider behavior validation tests/deepinfra-provider.test.ts, tests/fixtures/deepinfra-models.json, tests/provider-registry-parity.test.ts	Tests cover configuration, discovery, authentication, redirects, slash-containing model IDs, fixed-host routing, custom configurations, fixture metadata, and registry parity.
Localized documentation updates docs-site/src/content/docs/**/getting-started/quickstart.md, docs-site/src/content/docs/**/guides/providers.md	English, Japanese, Korean, Russian, and Simplified Chinese documentation update preset counts and describe DeepInfra discovery, limits, endpoint details, and API-key creation links.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ProviderRegistry
  participant DeepInfraModels
  participant DeepInfraInference
  Client->>ProviderRegistry: select deepinfra and provide API key
  ProviderRegistry->>DeepInfraModels: discover models with Bearer authentication
  DeepInfraModels-->>ProviderRegistry: return bounded chat-tagged models
  ProviderRegistry-->>Client: expose native model IDs and metadata
  Client->>DeepInfraInference: send chat completion with selected model ID
  DeepInfraInference-->>Client: return chat completion response

Loading

Possibly related PRs

• lidge-jun/opencodex#652 — Adds the registry-owned model-discovery contract used by DeepInfra.
• lidge-jun/opencodex#406 — Relates to the model metadata parsing extended by this PR.
• lidge-jun/opencodex#743 — Relates to the bounded provider model-discovery behavior covered by this PR.

Suggested reviewers: wibias, lidge-jun

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the primary change: adding the DeepInfra provider preset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

NEEDS-CHANGES + NEEDS-SECURITY-REVIEW (draft)

The code is in good shape. src/providers/registry.ts:831-872 adds the DeepInfra and Novita presets with fixed credential destinations and authenticated live-model endpoints, and the fixtures cover derivation, Bearer-authenticated discovery, catalog filtering, routing, slash-containing ids, and preservation of older same-named custom destinations. That last one is easy to forget and you did not.

What is missing is the evidence, not the implementation. MAINTAINERS.md:35 treats a new provider preset as a credential-destination change and requires, before merge: documented OpenAI-compatible endpoints including authenticated GET /v1/models where the entry declares liveModels, terms of service and the operating legal entity, resale or routing authorization if the service aggregates third-party models, a named maintenance owner, and a citable verification date. The endpoint documentation is here; the terms and legal entity, the maintenance owner, and the verification date are not.

The reason that list exists is that a canonical preset is where someone's API key gets sent. If a destination changes hands or its terms shift, we need to know who noticed and when. Both of these services aggregate third-party models, so the routing authorization item applies.

If the evidence turns out to be hard to pin down, an inert reference row in src/providers/free-directory.ts is a legitimate landing spot and does not carry the same gate.

What happens next: keep it in draft, add the missing primary-source evidence and a maintenance owner, then request security review.

---

CI context (shared across the current review round). dev is now at 62e937614. The baseline breakage that made every required check red is fixed: run 30545575865 has macos-latest, ubuntu-latest, and all three npm-global jobs green. The one remaining red is windows-latest, and it is not a test failure — it is a Bun 1.3.14 runtime panic (heap.zig:deleteMin reached through spawnSync with a timeout, triggered by our Windows ACL hardening path). That is a runtime defect being tracked separately, so please do not treat a red windows-latest as a signal about your change. Rebase onto current dev before your next push so your checks run against the repaired baseline.

[lidge-jun]

Formalizing the disposition so it shows on your dashboard.

Blocking on the MAINTAINERS.md:35 evidence gate rather than the code — the presets and fixture tests are well built.

Missing: terms of service and operating legal entity, a named maintenance owner, and a citable verification date. Both DeepInfra and Novita aggregate third-party models, so routing authorization applies as well. The endpoint documentation you supplied is fine.

Worth knowing before you invest more: deepinfra and novita both already have inert rows in src/providers/free-directory.ts. When the evidence is incomplete, the same clause prefers a directory row over a canonical registry entry — so the fallback here is "leave them where they already are", not "drop the work".

Full per-item walkthrough in my earlier comment.

[olddonkey]

Addressed the canonical-preset evidence gate and rebased onto current dev:

• narrowed the PR to DeepInfra only; Novita's canonical preset, tests, fixture, and docs were removed, while its existing inert free-directory row remains available
• added dated primary-source evidence for the operating entity and terms, the OpenAI-compatible inference endpoint, authenticated GET /v1/models, and the third-party-model routing basis
• named @olddonkey as maintenance owner and disclosed no DeepInfra affiliation or compensation
• consolidated the branch to one DeepInfra-only commit
• reran validation: focused tests 169/169, full suite 6273 pass / 4 skip / 0 fail, typecheck, privacy scan, and the 146-page docs build

@lidge-jun, could you please re-review and perform the required security review? In particular, please confirm whether the cited DeepInfra Terms satisfy the aggregator-routing evidence gate; the PR body identifies that point explicitly for maintainer/security confirmation.

@coderabbitai review

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
REPO="lidge-jun/opencodex"
PR=747

echo "=== PR info ==="
gh pr view $PR --repo $REPO --json title,state,isDraft,baseRefName,headRefName,mergeable,additions,deletions,changedFiles

echo "=== Files changed ==="
gh pr diff $PR --repo $REPO --name-only

echo "=== registry.ts DeepInfra section ==="
gh pr diff $PR --repo $REPO -- src/providers/registry.ts | sed -n '1,400p'

Length of output: 1770

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
REPO="lidge-jun/opencodex"
PR=747

gh pr diff $PR --repo $REPO > /tmp/pr747.diff
wc -l /tmp/pr747.diff

echo "=== registry.ts diff ==="
awk '/^diff --git a\/src\/providers\/registry.ts/{flag=1} /^diff --git a\/(?!src\/providers\/registry.ts)/{if(flag && $0!~/registry.ts/) flag=0} flag' /tmp/pr747.diff | head -300

echo "=== extract via csplit-like approach ==="
python3 - <<'EOF'
import re
with open('/tmp/pr747.diff') as f:
    content = f.read()
files = re.split(r'(?=^diff --git )', content, flags=re.M)
for f in files:
    header = f.splitlines()[0] if f.splitlines() else ''
    if 'registry.ts' in header or 'provider-fetch.ts' in header:
        print(f)
        print("=====END FILE=====")
EOF

Length of output: 15386

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "=== filter type defs ==="
rg -n "containsAny|allOf" src/providers/registry.ts src/codex/catalog -g '*.ts' -C2 | head -100

echo "=== docs providers.md diff (English) ==="
python3 - <<'EOF'
import re
with open('/tmp/pr747.diff') as f:
    content = f.read()
files = re.split(r'(?=^diff --git )', content, flags=re.M)
for f in files:
    header = f.splitlines()[0] if f.splitlines() else ''
    if 'docs-site/src/content/docs/guides/providers.md' in header:
        print(f)
EOF

Length of output: 4148

---

@olddonkey Thanks for the update. I checked the current diff against PR #747 (base dev, head codex/572-deepinfra-novita-model-apis, 15 files, +299/-11).

Registry entry — src/providers/registry.ts (added after the cerebras entry, around Line 831).
The deepinfra entry sets baseUrl: "https://api.deepinfra.com/v1/openai", adapter: "openai-chat", authKind: "key", liveModels: true, and preserveCustomDestination: true. modelDiscovery.url is hardcoded to https://api.deepinfra.com/v1/models, separate from baseUrl, with maxResponseBytes: 512 * 1024 and maxModels: 512. The filter is allOf: [{ path: ["metadata", "tags"], containsAny: ["chat"] }]. This matches the PR body's stated destinations and caps.

Context-window parsing — src/codex/catalog/provider-fetch.ts (near Line 348).
metadata?.context_length was added to the contextWindow precedence chain, ordered after limits?.max_context_length and before item.context_length, item.context_size, item.max_model_len. This is additive and optional-chained, so it does not change behavior for providers whose model-list items lack a metadata.context_length field.

Fixture and tests.
tests/fixtures/deepinfra-models.json has four rows: two chat models (one with extra vlm/vision tags, confirming containsAny keeps rows with additional tags), one embed-tagged row, and one image-gen-tagged row with no context_length at all. tests/deepinfra-provider.test.ts exercises: the registry shape, non-leak of modelDiscovery/preserveCustomDestination into providerConfigSeed and KEY_LOGIN_PROVIDERS.deepinfra, the Bearer-authenticated GET /v1/models request shape used by validateApiKey, catalog filtering down to the two chat rows with slash-containing IDs preserved (deepseek-ai/DeepSeek-V3, Qwen/Qwen2.5-VL-72B-Instruct), routing through both selector forms, chat-completion request building against the fixed /v1/openai host, and — importantly — that an older same-named custom provider on a different baseUrl or a different adapter keeps its own destination and discovery URL rather than being retargeted. One minor gap: the test only asserts contextWindow: 131_072 for the first filtered model and does not assert 65_536 for the second (Qwen2.5-VL-72B-Instruct). Not a blocker, but worth adding for full round-trip coverage of the metadata.context_length parsing path.

Registry parity — tests/provider-registry-parity.test.ts (Line 34).
"deepinfra" was inserted into EXPECTED_KEY_PROVIDER_IDS between "cerebras" and "together", matching the registry's insertion order.

Docs.
docs-site/src/content/docs/guides/providers.md updates the preset count from "53 built-in presets: 42 key-based" to "61 built-in presets: 50 key-based," which matches the registry-count audit in the PR body, adds a DeepInfra row to the endpoint table, and adds a discovery note describing the chat-only filter and the 512 KiB / 512-row caps. I did not deep-verify the Japanese, Korean, Russian, and Simplified Chinese translations beyond confirming the files are present in the diff.

Scope check.
No Novita-related registry, test, fixture, or doc changes appear in this diff, consistent with the claim that the canonical Novita preset was removed and only the pre-existing inert free-directory row remains untouched.

On the open item @lidge-jun raised — whether the DeepInfra Terms of Service satisfy the aggregator-routing evidence gate in MAINTAINERS.md:35 — that is a legal/policy determination on primary-source terms, not something I can adjudicate from the code diff. I'll defer to @lidge-jun's security review for that confirmation.

I'll kick off a full review pass now.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs-site/src/content/docs/guides/providers.md`:
- Line 210: Update the DeepInfra entries in
docs-site/src/content/docs/guides/providers.md:210-210,
docs-site/src/content/docs/ja/guides/providers.md:136-136,
docs-site/src/content/docs/ko/guides/providers.md:136-136,
docs-site/src/content/docs/ru/guides/providers.md:146-146, and
docs-site/src/content/docs/zh-cn/guides/providers.md:128-128 to state that
DeepInfra is a key-based OpenAI Chat Completions provider using openai-chat and
a Bearer API key, translating the description for each locale. Do not imply
OAuth, passthrough, or a custom wire protocol.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 29898596-2816-4a88-abbf-f9d82071edc5

📥 Commits

Reviewing files that changed from the base of the PR and between 6e1cdb7 and 33c6cfe.

📒 Files selected for processing (15)

• docs-site/src/content/docs/getting-started/quickstart.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/getting-started/quickstart.md
• docs-site/src/content/docs/ja/guides/providers.md
• docs-site/src/content/docs/ko/getting-started/quickstart.md
• docs-site/src/content/docs/ko/guides/providers.md
• docs-site/src/content/docs/ru/getting-started/quickstart.md
• docs-site/src/content/docs/ru/guides/providers.md
• docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
• docs-site/src/content/docs/zh-cn/guides/providers.md
• src/codex/catalog/provider-fetch.ts
• src/providers/registry.ts
• tests/deepinfra-provider.test.ts
• tests/fixtures/deepinfra-models.json
• tests/provider-registry-parity.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/deepinfra-provider.test.ts`:
- Around line 149-153: Update the assertions in the chat-model discovery test to
verify the second model’s parsed context window as well: assert contextWindow is
65_536 for the Qwen/Qwen2.5-VL-72B-Instruct entry, while preserving the existing
DeepSeek assertion and discovery checks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f6460bfa-b201-480c-9a3b-f6155d71a499

📥 Commits

Reviewing files that changed from the base of the PR and between 6e1cdb7 and 33c6cfe.

📒 Files selected for processing (15)

• docs-site/src/content/docs/getting-started/quickstart.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/getting-started/quickstart.md
• docs-site/src/content/docs/ja/guides/providers.md
• docs-site/src/content/docs/ko/getting-started/quickstart.md
• docs-site/src/content/docs/ko/guides/providers.md
• docs-site/src/content/docs/ru/getting-started/quickstart.md
• docs-site/src/content/docs/ru/guides/providers.md
• docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
• docs-site/src/content/docs/zh-cn/guides/providers.md
• src/codex/catalog/provider-fetch.ts
• src/providers/registry.ts
• tests/deepinfra-provider.test.ts
• tests/fixtures/deepinfra-models.json
• tests/provider-registry-parity.test.ts

[olddonkey]

Final follow-up after automated review and CI:

• both CodeRabbit threads are addressed and resolved: the five locale notes now state the exact key/Bearer/openai-chat contract, and the second fixture model's 65_536 context window is pinned
• the transient Windows failure was isolated to the pre-existing GET /api/github/star route tests timing out while invoking gh; no DeepInfra test failed
• dev then landed the targeted baseline fix in 600ef52f (test(sidebar): give github/star route tests room for gh timeouts), and this branch was restacked onto it
• final Cross-platform CI run 30612825281 is fully green, including Windows (12m21s), and every other check is green
• the PR remains a single DeepInfra-only commit (75ac18da) and GitHub reports the merge state as clean

The remaining gate is the maintainer/security determination requested above for the cited third-party-model routing evidence, followed by re-review/dismissal of the earlier evidence-based changes request.

[Ingwannu]

Security review completed against 75ac18da8b1bd598691b48f08466913d28ba0806.

No blocking security finding was identified.

• The canonical inference destination is fixed to https://api.deepinfra.com/v1/openai, and authenticated discovery is registry-owned at https://api.deepinfra.com/v1/models.
• preserveCustomDestination prevents a pre-existing same-name custom provider and its API key from being silently retargeted.
• Redirects are rejected/manual at the existing validation and discovery boundaries, and catalog input is bounded to 512 KiB / 512 rows before filtering.
• Model IDs remain data, not URL destinations; slash-containing IDs do not alter the fixed provider host.
• The updated PR evidence identifies DEEP INFRA, INC., documents both endpoints and Bearer authentication, names a maintenance owner, gives a verification date, and explains the direct user-key routing basis.

This approval is the explicit credential-destination security review required by MAINTAINERS.md. It does not dismiss or override another maintainer's earlier change request.

[shipping-github] Dismissing as obsolete: the 2026-07-30 evidence gate is addressed on tip 6d97a9f. PR body now cites DEEP INFRA, INC. ToS (2024-07-04), fixed openai + /v1/models endpoints, aggregator routing basis, maintenance owner @olddonkey, and verification date 2026-07-30. @Ingwannu already APPROVED security on 75ac18d; live GET /v1/models returns metadata.tags (chat filter works without with_meta). CodeRabbit threads resolved. Tip restacked onto current dev.

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/providers/registry.ts (1)

823-825: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Prevent registry defaults from applying to custom DeepSeek destinations.

src/providers/registry.ts:812-826 does not set preserveCustomDestination: true, so deepseek-v4-flash receives openai-responses for custom baseUrl values. Add the flag and cover canonical, explicit modelAdapters, and custom-baseUrl cases in tests/adapter-resolve.test.ts:103-129.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/providers/registry.ts` around lines 823 - 825, Update the DeepSeek
V4-Flash registry entry near modelWireDefaults to set preserveCustomDestination:
true, preventing the default adapter from applying when a custom baseUrl is
used. Extend the relevant adapter resolution tests in adapter-resolve.test.ts to
cover canonical resolution, explicit modelAdapters, and custom-baseUrl behavior
for deepseek-v4-flash.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs-site/src/content/docs/ko/guides/providers.md`:
- Around line 119-120: Synchronize the OAuth section with the documented
seven-provider count by adding the `github-copilot` login command and its
corresponding provider row, matching the English documentation and existing
formatting. Update the OAuth count from six to seven only as part of this
complete list change, or consistently document GitHub Copilot as excluded if
that is the intended behavior.

---

Outside diff comments:
In `@src/providers/registry.ts`:
- Around line 823-825: Update the DeepSeek V4-Flash registry entry near
modelWireDefaults to set preserveCustomDestination: true, preventing the default
adapter from applying when a custom baseUrl is used. Extend the relevant adapter
resolution tests in adapter-resolve.test.ts to cover canonical resolution,
explicit modelAdapters, and custom-baseUrl behavior for deepseek-v4-flash.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3700b149-4996-4202-8050-2196bba50dda

📥 Commits

Reviewing files that changed from the base of the PR and between 15a4336 and 6d97a9f.

📒 Files selected for processing (15)

• docs-site/src/content/docs/getting-started/quickstart.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/getting-started/quickstart.md
• docs-site/src/content/docs/ja/guides/providers.md
• docs-site/src/content/docs/ko/getting-started/quickstart.md
• docs-site/src/content/docs/ko/guides/providers.md
• docs-site/src/content/docs/ru/getting-started/quickstart.md
• docs-site/src/content/docs/ru/guides/providers.md
• docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
• docs-site/src/content/docs/zh-cn/guides/providers.md
• src/codex/catalog/provider-fetch.ts
• src/providers/registry.ts
• tests/deepinfra-provider.test.ts
• tests/fixtures/deepinfra-models.json
• tests/provider-registry-parity.test.ts

[Wibias]

[shipping-github] Security review

PR / issue: #747 @ 06a974f9
Decision: Pass
Risk: Low

Findings

none confirmed

Summary

Reviewed the DeepInfra canonical preset on tip 06a974f9 (fixed https://api.deepinfra.com/v1/openai inference host, registry-owned https://api.deepinfra.com/v1/models discovery, preserveCustomDestination, 512 KiB / 512-row bounds, Bearer key auth). Live unauthenticated probe of GET /v1/models returns metadata.tags (including chat) without requiring filter=with_meta, so the chat-only filter is viable on the documented URL. Model IDs remain catalog data, not fetch destinations; discovery policy is not projected into config.json / key-login seeds. @Ingwannu had already APPROVED security on 75ac18da; this pass re-checked the tip merge and CI harden.

Residual

• Aggregator routing authorization remains a maintainer judgment on DeepInfra ToS language (primary-source evidence is in the PR body; no code defect).

Fixes this session

• 06a974f9 — widened Windows stalled-400 body test budget; synced ko/ja/zh-cn OAuth Copilot docs (not a security control change)

[Wibias]

[shipping-github] Verdict: approve-comment

PR: #747 — feat(providers): add DeepInfra preset
Head: 06a974f9 on dev (mergeStateStatus: CLEAN)
Linked: relates to #572 (does not close)

Usefulness

Yes — promotes a collision-safe DeepInfra API-key preset with live chat-only discovery into CLI init, key login, and dashboard surfaces; Novita correctly left out of this PR.

Bugs / correctness

• Method: bug-review.md — Bugbot: yes (one candidate); complementary: done (silent_failures / resource_leaks / edge_cases); Must-probe n/a (no locks/OAuth/detached/finally/error-mapping in diff)
• Findings: Bugbot claimed missing filter=with_meta would empty the catalog — disproven by live GET https://api.deepinfra.com/v1/models (179 rows, all with metadata.tags, 96 chat). No confirmed High/Critical bugs in the DeepInfra path.
• Fixed this session: 06a974f9 — Windows CI flake in tests/server-auth.test.ts (stalled 400 body timeout, budget 7s → SERVER_BUDGET_MS) plus OAuth Copilot docs sync in ko/ja/zh-cn

Security

• Scope reviewed: credential destinations, SSRF/outbound discovery URL, secrets/config projection, AI catalog metadata, authn (Bearer), authz/injection baselines, removed-controls (docs count strings only)
• Findings: none confirmed (Pass / Low)
• Fixed this session: none security-specific

Spec / standards

• Spec source: PR body evidence table + MAINTAINERS.md:35 / contributing canonical-preset gate; umbrella #572
• Gaps: none material — destinations, chat filter, bounds, slash IDs, metadata.context_length, preserveCustomDestination, locale docs, fixture tests all match claims; Novita excluded as stated

Reviews

• Owners/maintainers: @lidge-jun evidence CR dismissed as obsolete after primary-source table + owner @olddonkey; @Ingwannu APPROVED security; reviewDecision: APPROVED
• Bots: CodeRabbit OAuth ko thread fixed/resolved; earlier docs/contextWindow threads already cleared by author

Base / CI

• Behind/conflicts: restacked onto upstream/dev then tip harden (06a974f9); clean
• Required checks: green on 06a974f9 (ubuntu/macos/windows + npm-global + enforce-target)
• Local tip: bun test DeepInfra + registry parity; bun run typecheck; bun run privacy:scan; focused stalled-400 test

Gate

none

Bottom line

Ship-ready DeepInfra preset: useful, evidence gate satisfied, security Pass, CI green on tip. Merge when you want (not merging unless asked).

[Wibias]

[shipping-github] Merge ready

PR: #747 — feat(providers): add DeepInfra preset
Head: 06a974f9 → dev (mergeStateStatus: CLEAN)
Linked issues: relates to #572 (no auto-close)

Reviews

• Humans (owners first): @lidge-jun evidence CR dismissed after ToS/entity/owner/date/routing evidence landed; @Ingwannu security APPROVED
• Bots: 0 unresolved useful threads; CodeRabbit OAuth docs note addressed in 06a974f9
• Own bug + security + spec/standards: Bugbot + complementary clean (with_meta false positive); security Pass; spec matches PR body / MAINTAINERS.md:35

Tip freshness

• Updated from dev: yes (6d97a9f3 merge + 06a974f9 harden)
• Compiles/tests against tip: typecheck + focused DeepInfra/parity + stalled-400 test pass
• Conflicts: none

Checks

• Local/CLI: typecheck, privacy:scan, DeepInfra + registry parity tests
• Required CI: green on 06a974f9
• Policy: reviewDecision: APPROVED; thin settle quiet

Residual

Aggregator routing authorization remains a documented maintainer judgment on cited DeepInfra ToS language — not a code blocker.

Ready to merge.

[Wibias]

Thanks @olddonkey — merging this.

Why it helps: users can pick DeepInfra as a first-class API-key provider in init, key login, and the dashboard, with live chat-only model discovery from the documented /v1/models catalog. The registry pins credential traffic to api.deepinfra.com, keeps discovery policy out of config.json, and preserveCustomDestination avoids retargeting an older same-named custom host. This advances the provider-expansion work in #572 without closing that umbrella.

Ship it.