feat(providers): add Novita AI preset

[olddonkey]

Summary

• add a canonical novita API-key preset for the fixed OpenAI-compatible Chat Completions host
• discover only rows that independently report both model_type: chat and the chat/completions endpoint
• cap discovery at 512 KiB / 256 raw rows and preserve provider-native slash IDs plus safe live metadata
• treat the public model catalog as not proving API-key validity
• conservatively disable provider-wide parallel tool calls and OpenAI reasoning_effort
• add fixture-only derivation, discovery, filtering, routing, collision-preservation, sparse-metadata, and request-shape tests
• document the preset in all five maintained locales

Relates to #572. This PR intentionally does not close the umbrella issue.

Why the previous evidence blocker changed

Novita was removed from the earlier #747 batch because the then-current legal page did not establish the inference-API contract or operating entity strongly enough. The primary-source record materially changed after that review:

• Terms of Service, updated 2026-08-05, now expressly covers AI inference APIs, third-party “Model Providers,” customer Input/Output processing, and Delaware governing law.
• The official USPTO TSDR record for NOVITA AI identifies Hivemind Labs, Inc. as the owner/applicant, a Delaware corporation, and records use in commerce beginning 2023-09-18.
  • Disclosure: that service-mark application was abandoned in 2026. It is cited only as the government-hosted public record connecting the NOVITA AI brand to Hivemind Labs, Inc.; this PR does not claim an active registration.
• The California Secretary of State Business Search provides the current corporate-status lookup for Hivemind Labs, Inc. under entity number 6475302.
• Hugging Face independently lists Novita as an Inference Providers partner and supports Novita chat/VLM routing in its official SDK/catalog. Novita's own Serverless API documentation says it aggregates open-source and proprietary foundation models for pay-as-you-go API access.

This evidence is intentionally exposed for maintainer/security judgment rather than presented as a silent assumption.

Maintainer: @olddonkey. No affiliation with Novita AI or Hivemind Labs, Inc.

Canonical API evidence

Primary sources checked 2026-08-08:

• Chat Completions reference: POST https://api.novita.ai/openai/v1/chat/completions, streaming, tools, and structured output
• List Models reference: GET https://api.novita.ai/openai/v1/models with Bearer authentication
• Authentication reference: Bearer API keys and the official key manager

A read-only live probe on 2026-08-08 found:

• /openai/v1/models: HTTP 200 without credentials, 170,867 bytes, 146 rows
• all 146 rows reported model_type: chat and endpoints containing chat/completions
• 107 rows reported function-calling; capability claims therefore remain per-model
• /v1/models: HTTP 404, so the preset follows the endpoint-specific List Models reference rather than the overview page's stale shortcut

Because the catalog currently succeeds without authentication, apiKeyValidation is deliberately unknown. Runtime inference still sends the configured Bearer key only to a transport matching the canonical preset.

Security and behavior

• fixed HTTPS transport with preserveCustomDestination; older same-named custom destinations/adapters keep their own routing and inherit no registry discovery policy
• exact canonical-path near-miss coverage prevents accidental trust inheritance
• response-byte and raw-row ceilings apply before parsing/caching
• registry trust policy is not copied into config.json or the key-login map
• server fields are treated as untrusted admission data; both chat type and the configured endpoint must match
• no provider-wide claim for parallel tool calls or OpenAI reasoning_effort
• all tests are fixture-only and make no live provider requests

This is a credential-destination change and explicitly requests maintainer security review, including confirmation that the updated operator and routing evidence satisfies MAINTAINERS.md.

Verification

• bun test tests/novita-provider.test.ts tests/provider-registry-parity.test.ts tests/provider-model-discovery-contract.test.ts — 67 pass, 0 fail
• bun run typecheck
• bun run privacy:scan
• bun run test — 10,061 pass, 7 skip, 0 fail
• docs build — 221 pages
• registry audit — 79 total / 67 key / 8 OAuth / 3 local / 1 forward
• git diff --check

No GUI source changed, so there is no screenshot.

Review readiness

• Local CI is green on d8b055ac: focused tests, typecheck, privacy scan, docs build, and the full suite all passed.
• The branch is based on the latest dev commit available when this checklist was completed (f310cc20).
• All currently available correct Codex and CodeRabbit findings are addressed; the old feat(providers): add DeepInfra preset #747 implementation was re-audited rather than copied unchanged.
• Ready for maintainer and explicit security review on this exact head commit.

Summary by CodeRabbit

• New Features

  • Added Novita AI as a supported provider with an OpenAI-compatible endpoint.
  • Added live model discovery, including filtering for supported chat models.
  • Added Novita AI setup and API key guidance across supported documentation languages.

• Documentation

  • Updated provider preset counts from 76 to 79.
  • Documented Novita AI authentication, model discovery behavior, limitations, and key acquisition.

• Tests

  • Added coverage for Novita AI configuration, discovery, requests, and supported capabilities.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds Novita AI as an OpenAI-compatible provider with live model discovery, filtered chat-model support, conservative capabilities, validation rules, tests, registry parity, and synchronized multilingual documentation.

Changes

Novita AI provider

Layer / File(s)	Summary
Registry and discovery configuration src/providers/registry.ts	Adds the novita provider with a fixed OpenAI-compatible endpoint, Bearer authentication, live discovery limits, chat-completion filtering, unknown key validation, and disabled parallel-tool and reasoning metadata.
Provider behavior and regression coverage tests/fixtures/novita-models.json, tests/novita-provider.test.ts, tests/provider-registry-parity.test.ts	Adds model fixtures and tests for registry metadata, derived presets, discovery filtering, routing, request construction, validation, unsupported options, custom destinations, custom adapters, and registry parity.
Documentation and localization docs-site/src/content/docs/**/getting-started/quickstart.md, docs-site/src/content/docs/**/guides/providers.md	Updates provider counts from 76 to 79 and documents Novita endpoints, discovery filters, response limits, authentication, validation behavior, capabilities, and key management in English, Japanese, Korean, Russian, and Chinese.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• [Provider] Finish remaining OpenAI-compatible provider batch: Chutes, Featherless, Novita #572 — Directly related Novita provider work covering registry configuration, discovery, parity, tests, and documentation.

Possibly related PRs

• lidge-jun/opencodex#1315 — Adds a similar OpenAI-compatible provider with discovery, filtering, conservative capabilities, validation behavior, and registry tests.
• lidge-jun/opencodex#1317 — Uses the same provider integration pattern with registry updates, discovery tests, fixtures, parity checks, and localized documentation.
• lidge-jun/opencodex#751 — Adds an OpenAI-compatible API-key provider with live discovery, fixtures, parity updates, and localized documentation.

Suggested reviewers: lidge-jun, wibias, ingwannu

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding the Novita AI provider preset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/providers/registry.ts`:
- Around line 1649-1652: Remove parallelToolCalls: false from the Novita
provider configuration in src/providers/registry.ts lines 1649-1652 so the
adapter omits parallel_tool_calls. Update the request assertion in
tests/novita-provider.test.ts lines 177-200 to verify the property is absent,
and ensure docs-site/src/content/docs/reference/adapters.md reflects that
unsupported parallel-tool options are omitted from generated requests.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e3d4af54-b2ae-4072-85af-2ad5ad16e607

📥 Commits

Reviewing files that changed from the base of the PR and between f310cc2 and d8b055a.

📒 Files selected for processing (14)

• docs-site/src/content/docs/getting-started/quickstart.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/getting-started/quickstart.md
• docs-site/src/content/docs/ja/guides/providers.md
• docs-site/src/content/docs/ko/getting-started/quickstart.md
• docs-site/src/content/docs/ko/guides/providers.md
• docs-site/src/content/docs/ru/getting-started/quickstart.md
• docs-site/src/content/docs/ru/guides/providers.md
• docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
• docs-site/src/content/docs/zh-cn/guides/providers.md
• src/providers/registry.ts
• tests/fixtures/novita-models.json
• tests/novita-provider.test.ts
• tests/provider-registry-parity.test.ts

[Wibias]

Maintainer + security review verdict: REQUEST CHANGES.

I reviewed the registry/discovery contract, request shape, credential destination and collision behavior, model admission/filtering, bounds, fixtures/tests, the earlier #747 evidence concern, current upstream documentation, current CodeRabbit thread, CI state, and current dev.

Security/evidence assessment: the implementation is conservative in the right places. apiKeyValidation: "unknown" avoids treating the currently public catalog as proof of key validity; exact transport matching plus preserveCustomDestination prevents silent credential retargeting; discovery is bounded before catalog admission; and the chat+endpoint predicates fail closed. Current Novita first-party docs explicitly document the OpenAI-compatible chat and Bearer-authenticated model-list contracts. The Aug 5, 2026 ToS now explicitly covers AI inference APIs and underlying Model Providers, and Hugging Face currently lists Novita as an Inference Providers partner for chat/VLM routing. Combined with the operator records supplied in the PR, I consider the prior evidence gap materially addressed for maintainer review.

I also independently rechecked the unresolved CodeRabbit parallel_tool_calls finding and resolved it as a false positive. The repository's later authoritative parallel-tools contract makes openai-chat default-on and explicitly defines parallelToolCalls: false as the per-provider opt-out; the adapter is therefore supposed to serialize parallel_tool_calls: false. Removing it would enable the capability by default, the opposite of this PR's conservative intent.

Blocking changes:

1. Rebase onto current dev and rerun CI. This head is ~53 dev commits behind. The branch needs current integration validation before a credential-destination preset can be approved.
2. Fix the standalone provider counts. Current dev documents 76 total / 64 key presets; this one-provider PR changes all locales to 79 / 67. Merged alone, that is wrong by two providers. Update counts to the actual post-rebase/post-merge state or handle the three provider PRs sequentially.
3. Get actual GitHub CI on the rebased head. The current head's Cross-platform CI / React Doctor runs are action_required; there is no executed green GitHub CI result for d8b055ac to satisfy maintainer merge policy. Local verification is useful but not a substitute for required current-head CI.

I found no additional production leak/security blocker in the code itself. Re-request review once the branch is current, counts are correct, and CI has actually run green.