feat(providers): add DeepInfra preset

[olddonkey]

Summary

• add a collision-safe deepinfra API-key preset, derived automatically into CLI init, key login, and dashboard provider surfaces
• pin discovery to DeepInfra's documented authenticated GET https://api.deepinfra.com/v1/models endpoint and keep only rows whose metadata.tags contain chat
• cap the mixed catalog at 512 KiB and 512 raw rows, preserve slash-containing model IDs, and parse DeepInfra's nested metadata.context_length
• add fixture-only provider, routing, validation, collision-preservation, and metadata tests plus synchronized docs in English, Japanese, Korean, Russian, and Simplified Chinese

Novita is intentionally no longer part of this canonical-preset PR. Its existing inert row in src/providers/free-directory.ts remains available; it can be promoted separately if primary sources establish the operating legal entity and routing authorization required by MAINTAINERS.md.

Safety and scope

• the credential destination is fixed to https://api.deepinfra.com/v1/openai, and the authenticated discovery destination is fixed to https://api.deepinfra.com/v1/models
• discovery URL/filter/limit policy remains registry-only and is never copied into config.json or the key-login projection
• preserveCustomDestination keeps an older same-named custom provider on its original host and adapter, including model discovery
• tests never call live provider endpoints
• the preset makes no static claims for reasoning, tools, structured output, or multimodal support beyond bounded model metadata
• this is independently based on dev and relates to the provider-expansion umbrella in [Provider] Promote a verified batch of OpenAI-compatible inference providers #572

Canonical-preset evidence

Verified on 2026-07-30:

Requirement	Primary-source evidence
Operating legal entity and terms	DeepInfra Terms of Service identify DEEP INFRA, INC., a Delaware corporation, as the provider of the website, APIs, and other services. The page says it was last modified July 4, 2024.
OpenAI-compatible inference destination	DeepInfra API reference documents OpenAI-compatible endpoints under /v1/openai, including chat completions.
Authenticated live-model destination	DeepInfra OpenAI models reference documents authenticated GET https://api.deepinfra.com/v1/models with Authorization: Bearer <token> and a response containing metadata.tags and metadata.context_length.
Third-party model routing authorization	The Terms state that DeepInfra provides production-ready APIs to open-source AI models, that each model remains subject to its own license, and that customers may use the Services for legal commercial purposes unless otherwise prohibited. This is the primary-source basis offered for the preset's routing use; maintainer/security confirmation is requested before merge.
Maintenance owner	@olddonkey owns this preset's evidence and breakage follow-up. Please tag me on endpoint, terms, ownership, or catalog changes; I will update or demote the preset if the evidence no longer supports it.
Contributor affiliation	I have no affiliation with DeepInfra and received no compensation for this contribution.

Verification

• bun run typecheck
• bun run privacy:scan
• bun test tests/deepinfra-provider.test.ts tests/provider-registry-parity.test.ts tests/provider-model-discovery-contract.test.ts tests/codex-catalog.test.ts — 169 pass, 0 fail
• bun run test — 6273 pass, 4 skip, 0 fail across 457 files
• bun run build in docs-site/ — 146 pages built
• registry count audit — 61 total / 50 key / 7 OAuth / 3 local / 1 forward

Relates to #572. This PR does not close the umbrella issue.

Summary by CodeRabbit

• New Features
  • Added DeepInfra as a supported provider with API-key authentication and OpenAI-compatible chat access.
  • Added live model discovery, including chat-only filtering and support for model IDs containing slashes.
  • Added context-window detection from model metadata.
• Documentation
  • Updated provider preset counts across supported languages.
  • Documented DeepInfra setup, model discovery behavior, limits, and dashboard access.
• Tests
  • Added comprehensive coverage for DeepInfra configuration, authentication, discovery, routing, and custom settings.

[coderabbitai]

Warning

Review limit reached

@olddonkey, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 28 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: dba04e79-bd61-4c75-8786-20b1506245b6

📥 Commits

Reviewing files that changed from the base of the PR and between 15a4336 and 75ac18d.

📒 Files selected for processing (15)

• docs-site/src/content/docs/getting-started/quickstart.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/getting-started/quickstart.md
• docs-site/src/content/docs/ja/guides/providers.md
• docs-site/src/content/docs/ko/getting-started/quickstart.md
• docs-site/src/content/docs/ko/guides/providers.md
• docs-site/src/content/docs/ru/getting-started/quickstart.md
• docs-site/src/content/docs/ru/guides/providers.md
• docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
• docs-site/src/content/docs/zh-cn/guides/providers.md
• src/codex/catalog/provider-fetch.ts
• src/providers/registry.ts
• tests/deepinfra-provider.test.ts
• tests/fixtures/deepinfra-models.json
• tests/provider-registry-parity.test.ts

📝 Walkthrough

Walkthrough

The PR adds DeepInfra as an OpenAI-compatible provider with API-key authentication, bounded live model discovery, slash-preserving routing, metadata support, registry parity, tests, and documentation in five languages.

Changes

DeepInfra provider integration

Layer / File(s)	Summary
Registry and model discovery src/codex/catalog/provider-fetch.ts, src/providers/registry.ts	DeepInfra defines fixed endpoints, Bearer authentication, chat-only discovery, response and model-count limits, and custom-destination handling. Discovery also reads metadata.context_length.
Provider behavior validation tests/deepinfra-provider.test.ts, tests/fixtures/deepinfra-models.json, tests/provider-registry-parity.test.ts	Tests cover configuration, discovery, authentication, redirects, slash-containing model IDs, fixed-host routing, custom configurations, fixture metadata, and registry parity.
Localized documentation updates docs-site/src/content/docs/**/getting-started/quickstart.md, docs-site/src/content/docs/**/guides/providers.md	English, Japanese, Korean, Russian, and Simplified Chinese documentation updates preset counts and describe DeepInfra discovery, limits, endpoint details, and API-key creation links.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ProviderRegistry
  participant DeepInfraModels
  participant DeepInfraInference
  Client->>ProviderRegistry: select deepinfra and provide API key
  ProviderRegistry->>DeepInfraModels: discover models with Bearer authentication
  DeepInfraModels-->>ProviderRegistry: return bounded chat-tagged models
  ProviderRegistry-->>Client: expose native model IDs and metadata
  Client->>DeepInfraInference: send chat completion with selected model ID
  DeepInfraInference-->>Client: return chat completion response

Loading

Possibly related PRs

• lidge-jun/opencodex#652 — Adds the registry-owned model-discovery contract used by DeepInfra.
• lidge-jun/opencodex#406 — Relates to the model metadata parsing extended by this PR.
• lidge-jun/opencodex#751 — Implements a similar API-key provider with bounded discovery, routing, tests, and localized documentation.

Suggested reviewers: wibias, ingwannu, lidge-jun

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the primary change: adding the DeepInfra provider preset.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

NEEDS-CHANGES + NEEDS-SECURITY-REVIEW (draft)

The code is in good shape. src/providers/registry.ts:831-872 adds the DeepInfra and Novita presets with fixed credential destinations and authenticated live-model endpoints, and the fixtures cover derivation, Bearer-authenticated discovery, catalog filtering, routing, slash-containing ids, and preservation of older same-named custom destinations. That last one is easy to forget and you did not.

What is missing is the evidence, not the implementation. MAINTAINERS.md:35 treats a new provider preset as a credential-destination change and requires, before merge: documented OpenAI-compatible endpoints including authenticated GET /v1/models where the entry declares liveModels, terms of service and the operating legal entity, resale or routing authorization if the service aggregates third-party models, a named maintenance owner, and a citable verification date. The endpoint documentation is here; the terms and legal entity, the maintenance owner, and the verification date are not.

The reason that list exists is that a canonical preset is where someone's API key gets sent. If a destination changes hands or its terms shift, we need to know who noticed and when. Both of these services aggregate third-party models, so the routing authorization item applies.

If the evidence turns out to be hard to pin down, an inert reference row in src/providers/free-directory.ts is a legitimate landing spot and does not carry the same gate.

What happens next: keep it in draft, add the missing primary-source evidence and a maintenance owner, then request security review.

---

CI context (shared across the current review round). dev is now at 62e937614. The baseline breakage that made every required check red is fixed: run 30545575865 has macos-latest, ubuntu-latest, and all three npm-global jobs green. The one remaining red is windows-latest, and it is not a test failure — it is a Bun 1.3.14 runtime panic (heap.zig:deleteMin reached through spawnSync with a timeout, triggered by our Windows ACL hardening path). That is a runtime defect being tracked separately, so please do not treat a red windows-latest as a signal about your change. Rebase onto current dev before your next push so your checks run against the repaired baseline.

[lidge-jun]

Formalizing the disposition so it shows on your dashboard.

Blocking on the MAINTAINERS.md:35 evidence gate rather than the code — the presets and fixture tests are well built.

Missing: terms of service and operating legal entity, a named maintenance owner, and a citable verification date. Both DeepInfra and Novita aggregate third-party models, so routing authorization applies as well. The endpoint documentation you supplied is fine.

Worth knowing before you invest more: deepinfra and novita both already have inert rows in src/providers/free-directory.ts. When the evidence is incomplete, the same clause prefers a directory row over a canonical registry entry — so the fallback here is "leave them where they already are", not "drop the work".

Full per-item walkthrough in my earlier comment.

[olddonkey]

Addressed the canonical-preset evidence gate and rebased onto current dev:

• narrowed the PR to DeepInfra only; Novita's canonical preset, tests, fixture, and docs were removed, while its existing inert free-directory row remains available
• added dated primary-source evidence for the operating entity and terms, the OpenAI-compatible inference endpoint, authenticated GET /v1/models, and the third-party-model routing basis
• named @olddonkey as maintenance owner and disclosed no DeepInfra affiliation or compensation
• consolidated the branch to one DeepInfra-only commit
• reran validation: focused tests 169/169, full suite 6273 pass / 4 skip / 0 fail, typecheck, privacy scan, and the 146-page docs build

@lidge-jun, could you please re-review and perform the required security review? In particular, please confirm whether the cited DeepInfra Terms satisfy the aggregator-routing evidence gate; the PR body identifies that point explicitly for maintainer/security confirmation.

@coderabbitai review

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
REPO="lidge-jun/opencodex"
PR=747

echo "=== PR info ==="
gh pr view $PR --repo $REPO --json title,state,isDraft,baseRefName,headRefName,mergeable,additions,deletions,changedFiles

echo "=== Files changed ==="
gh pr diff $PR --repo $REPO --name-only

echo "=== registry.ts DeepInfra section ==="
gh pr diff $PR --repo $REPO -- src/providers/registry.ts | sed -n '1,400p'

Length of output: 1770

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
REPO="lidge-jun/opencodex"
PR=747

gh pr diff $PR --repo $REPO > /tmp/pr747.diff
wc -l /tmp/pr747.diff

echo "=== registry.ts diff ==="
awk '/^diff --git a\/src\/providers\/registry.ts/{flag=1} /^diff --git a\/(?!src\/providers\/registry.ts)/{if(flag && $0!~/registry.ts/) flag=0} flag' /tmp/pr747.diff | head -300

echo "=== extract via csplit-like approach ==="
python3 - <<'EOF'
import re
with open('/tmp/pr747.diff') as f:
    content = f.read()
files = re.split(r'(?=^diff --git )', content, flags=re.M)
for f in files:
    header = f.splitlines()[0] if f.splitlines() else ''
    if 'registry.ts' in header or 'provider-fetch.ts' in header:
        print(f)
        print("=====END FILE=====")
EOF

Length of output: 15386

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "=== filter type defs ==="
rg -n "containsAny|allOf" src/providers/registry.ts src/codex/catalog -g '*.ts' -C2 | head -100

echo "=== docs providers.md diff (English) ==="
python3 - <<'EOF'
import re
with open('/tmp/pr747.diff') as f:
    content = f.read()
files = re.split(r'(?=^diff --git )', content, flags=re.M)
for f in files:
    header = f.splitlines()[0] if f.splitlines() else ''
    if 'docs-site/src/content/docs/guides/providers.md' in header:
        print(f)
EOF

Length of output: 4148

---

@olddonkey Thanks for the update. I checked the current diff against PR #747 (base dev, head codex/572-deepinfra-novita-model-apis, 15 files, +299/-11).

Registry entry — src/providers/registry.ts (added after the cerebras entry, around Line 831).
The deepinfra entry sets baseUrl: "https://api.deepinfra.com/v1/openai", adapter: "openai-chat", authKind: "key", liveModels: true, and preserveCustomDestination: true. modelDiscovery.url is hardcoded to https://api.deepinfra.com/v1/models, separate from baseUrl, with maxResponseBytes: 512 * 1024 and maxModels: 512. The filter is allOf: [{ path: ["metadata", "tags"], containsAny: ["chat"] }]. This matches the PR body's stated destinations and caps.

Context-window parsing — src/codex/catalog/provider-fetch.ts (near Line 348).
metadata?.context_length was added to the contextWindow precedence chain, ordered after limits?.max_context_length and before item.context_length, item.context_size, item.max_model_len. This is additive and optional-chained, so it does not change behavior for providers whose model-list items lack a metadata.context_length field.

Fixture and tests.
tests/fixtures/deepinfra-models.json has four rows: two chat models (one with extra vlm/vision tags, confirming containsAny keeps rows with additional tags), one embed-tagged row, and one image-gen-tagged row with no context_length at all. tests/deepinfra-provider.test.ts exercises: the registry shape, non-leak of modelDiscovery/preserveCustomDestination into providerConfigSeed and KEY_LOGIN_PROVIDERS.deepinfra, the Bearer-authenticated GET /v1/models request shape used by validateApiKey, catalog filtering down to the two chat rows with slash-containing IDs preserved (deepseek-ai/DeepSeek-V3, Qwen/Qwen2.5-VL-72B-Instruct), routing through both selector forms, chat-completion request building against the fixed /v1/openai host, and — importantly — that an older same-named custom provider on a different baseUrl or a different adapter keeps its own destination and discovery URL rather than being retargeted. One minor gap: the test only asserts contextWindow: 131_072 for the first filtered model and does not assert 65_536 for the second (Qwen2.5-VL-72B-Instruct). Not a blocker, but worth adding for full round-trip coverage of the metadata.context_length parsing path.

Registry parity — tests/provider-registry-parity.test.ts (Line 34).
"deepinfra" was inserted into EXPECTED_KEY_PROVIDER_IDS between "cerebras" and "together", matching the registry's insertion order.

Docs.
docs-site/src/content/docs/guides/providers.md updates the preset count from "53 built-in presets: 42 key-based" to "61 built-in presets: 50 key-based," which matches the registry-count audit in the PR body, adds a DeepInfra row to the endpoint table, and adds a discovery note describing the chat-only filter and the 512 KiB / 512-row caps. I did not deep-verify the Japanese, Korean, Russian, and Simplified Chinese translations beyond confirming the files are present in the diff.

Scope check.
No Novita-related registry, test, fixture, or doc changes appear in this diff, consistent with the claim that the canonical Novita preset was removed and only the pre-existing inert free-directory row remains untouched.

On the open item @lidge-jun raised — whether the DeepInfra Terms of Service satisfy the aggregator-routing evidence gate in MAINTAINERS.md:35 — that is a legal/policy determination on primary-source terms, not something I can adjudicate from the code diff. I'll defer to @lidge-jun's security review for that confirmation.

I'll kick off a full review pass now.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs-site/src/content/docs/guides/providers.md`:
- Line 210: Update the DeepInfra entries in
docs-site/src/content/docs/guides/providers.md:210-210,
docs-site/src/content/docs/ja/guides/providers.md:136-136,
docs-site/src/content/docs/ko/guides/providers.md:136-136,
docs-site/src/content/docs/ru/guides/providers.md:146-146, and
docs-site/src/content/docs/zh-cn/guides/providers.md:128-128 to state that
DeepInfra is a key-based OpenAI Chat Completions provider using openai-chat and
a Bearer API key, translating the description for each locale. Do not imply
OAuth, passthrough, or a custom wire protocol.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 29898596-2816-4a88-abbf-f9d82071edc5

📥 Commits

Reviewing files that changed from the base of the PR and between 6e1cdb7 and 33c6cfe.

📒 Files selected for processing (15)

• docs-site/src/content/docs/getting-started/quickstart.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/getting-started/quickstart.md
• docs-site/src/content/docs/ja/guides/providers.md
• docs-site/src/content/docs/ko/getting-started/quickstart.md
• docs-site/src/content/docs/ko/guides/providers.md
• docs-site/src/content/docs/ru/getting-started/quickstart.md
• docs-site/src/content/docs/ru/guides/providers.md
• docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
• docs-site/src/content/docs/zh-cn/guides/providers.md
• src/codex/catalog/provider-fetch.ts
• src/providers/registry.ts
• tests/deepinfra-provider.test.ts
• tests/fixtures/deepinfra-models.json
• tests/provider-registry-parity.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/deepinfra-provider.test.ts`:
- Around line 149-153: Update the assertions in the chat-model discovery test to
verify the second model’s parsed context window as well: assert contextWindow is
65_536 for the Qwen/Qwen2.5-VL-72B-Instruct entry, while preserving the existing
DeepSeek assertion and discovery checks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f6460bfa-b201-480c-9a3b-f6155d71a499

📥 Commits

Reviewing files that changed from the base of the PR and between 6e1cdb7 and 33c6cfe.

📒 Files selected for processing (15)

• docs-site/src/content/docs/getting-started/quickstart.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/getting-started/quickstart.md
• docs-site/src/content/docs/ja/guides/providers.md
• docs-site/src/content/docs/ko/getting-started/quickstart.md
• docs-site/src/content/docs/ko/guides/providers.md
• docs-site/src/content/docs/ru/getting-started/quickstart.md
• docs-site/src/content/docs/ru/guides/providers.md
• docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
• docs-site/src/content/docs/zh-cn/guides/providers.md
• src/codex/catalog/provider-fetch.ts
• src/providers/registry.ts
• tests/deepinfra-provider.test.ts
• tests/fixtures/deepinfra-models.json
• tests/provider-registry-parity.test.ts

[olddonkey]

Final follow-up after automated review and CI:

• both CodeRabbit threads are addressed and resolved: the five locale notes now state the exact key/Bearer/openai-chat contract, and the second fixture model's 65_536 context window is pinned
• the transient Windows failure was isolated to the pre-existing GET /api/github/star route tests timing out while invoking gh; no DeepInfra test failed
• dev then landed the targeted baseline fix in 600ef52f (test(sidebar): give github/star route tests room for gh timeouts), and this branch was restacked onto it
• final Cross-platform CI run 30612825281 is fully green, including Windows (12m21s), and every other check is green
• the PR remains a single DeepInfra-only commit (75ac18da) and GitHub reports the merge state as clean

The remaining gate is the maintainer/security determination requested above for the cited third-party-model routing evidence, followed by re-review/dismissal of the earlier evidence-based changes request.