feat(providers): add Chutes preset

[olddonkey]

Summary

• Add a canonical chutes key preset for Chutes' shared OpenAI-compatible LLM gateway at https://llm.chutes.ai/v1.
• Discover models through the registry-owned public catalog, admit only rows whose supported_features include tools, preserve slash-containing model ids and safe live metadata, and bound the raw response to 256 KiB / 128 rows.
• Keep capability claims conservative: no reasoning-effort ladder, no provider-wide parallel tool-call claim, and no false key-validation success from a public catalog.
• Preserve older same-named custom destinations/adapters, add fixture-only regression coverage, and sync the provider catalog across all five docs locales. The docs count is corrected to the current 79 total / 67 key presets.

Relates to #572. This PR intentionally does not close the umbrella issue.

Canonical preset evidence

Primary sources checked on 2026-08-08:

• Chutes pricing documents the shared https://llm.chutes.ai/v1/chat/completions gateway, Bearer key, and pay-per-token public inference.
• Chutes authentication docs document dashboard/CLI API-key creation and Bearer authentication.
• The official public /v1/models endpoint returned 13 rows (about 11 KiB); 11 explicitly advertised tools in supported_features. Tests use a checked-in representative fixture and never call this endpoint.
• Chutes Terms of Service identify Chutes Global Corp as the operator, expressly cover API consumers, and direct production/high-volume automated inference to PAYGO.

Maintenance owner: @olddonkey. No affiliation with Chutes.

Security and scope

• preserveCustomDestination prevents an existing same-named custom provider/key from being silently retargeted to Chutes.
• Discovery policy stays registry-only and is not copied into config.json or the key-login map.
• The shared discovery contract enforces HTTPS destination checks, redirect refusal, response-byte bounds, and raw-row bounds before catalog admission.
• Because /v1/models is public, apiKeyValidation is explicitly unknown; chat requests still send the configured Bearer key only to the matching fixed transport.
• User-deployed custom Chute hosts and Chutes' non-LLM APIs remain out of scope and require a custom provider.
• This credential-destination change requests explicit maintainer security review.

Verification

• bun test tests/chutes-provider.test.ts tests/provider-registry-parity.test.ts tests/provider-model-discovery-contract.test.ts — 67 pass, 0 fail
• bun run typecheck
• bun run test — 10,061 pass, 7 skip, 0 fail across 628 files
• bun run privacy:scan
• cd docs-site && bun run build — 221 pages
• git diff --check
• Registry count audit — 79 total, 67 key, 8 OAuth, 3 local, 1 forward

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

Summary by CodeRabbit

• New Features

  • Added Chutes as an API provider with OpenAI-compatible endpoint support.
  • Added live discovery of tool-capable models with bounded results and metadata.
  • Added support for custom Chutes hosts and Bearer key authentication.
  • Increased built-in provider presets from 76 to 77.

• Documentation

  • Updated setup and provider guides in all supported languages with Chutes configuration, discovery, limits, authentication, and custom-provider details.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3a2c5232-0fad-4889-923d-08f03f9920f3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change adds Chutes as an API-key provider with bounded discovery of tool-capable models. It adds provider-specific tests and fixture data. Provider counts and Chutes usage details are documented in five locales.

Changes

Chutes Provider

Layer / File(s)	Summary
Registry integration and parity validation src/providers/registry.ts, tests/provider-registry-parity.test.ts	Registers the Chutes OpenAI-compatible gateway with Bearer authentication, bounded model discovery, tool-support filtering, conservative capabilities, and custom-destination preservation.
Provider discovery and routing tests tests/chutes-provider.test.ts, tests/fixtures/chutes-models.json	Tests registry metadata, derived presets, authenticated requests, unknown key validation, bounded discovery, tool-capable filtering, model routing, request field filtering, and custom provider preservation.
Localized provider documentation docs-site/src/content/docs/...	Updates preset counts and documents the Chutes endpoint, discovery rules, response limits, authentication behavior, custom-host scope, and a6api-backed custom providers in English, Japanese, Korean, Russian, and Simplified Chinese.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related issues

• [Provider] Finish remaining OpenAI-compatible provider batch: Chutes, Featherless, Novita #572 — Directly covers Chutes provider promotion, registry integration, bounded discovery, routing, tests, and documentation.

Possibly related PRs

• lidge-jun/opencodex#1317 — Adds a comparable OpenAI-compatible provider preset with discovery, parity updates, localized documentation, and tests.
• lidge-jun/opencodex#1318 — Adds a comparable provider preset with registry metadata, discovery, fixtures, localized documentation, and tests.
• lidge-jun/opencodex#923 — Uses the same API-key provider pattern with bounded discovery and unknown key validation.

Suggested labels: review-ready

Suggested reviewers: ingwannu, lidge-jun

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ProviderRegistry
  participant ChutesGateway
  Client->>ProviderRegistry: load Chutes preset
  ProviderRegistry->>ChutesGateway: fetch public /v1/models
  ChutesGateway-->>ProviderRegistry: return model metadata
  ProviderRegistry-->>Client: expose tool-capable models
  Client->>ChutesGateway: send chat request with Bearer key

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding the Chutes provider preset.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/chutes-provider.test.ts`:
- Around line 197-220: Extend the test "does not retarget an older same-named
custom provider or adapter" with a near-miss custom provider using adapter
"openai-chat" and baseUrl "https://llm.chutes.ai/v2", then assert
resolveProviderModelDiscovery("chutes", that provider).spec is undefined to
verify it is excluded from registry discovery.
- Around line 50-51: Remove the file-wide allowPrivateNetwork: true from the
Chutes provider configuration passed through providerConfig(). If fixture-only
discovery requires the bypass, apply it only in the specific fixture-fetch
helper or test and update the comment to explicitly identify it as a DNS
classification bypass.

In `@tests/fixtures/chutes-models.json`:
- Around line 28-49: Add a fixture row in chutes-models.json with
supported_features including tools while leaving context_length and
input_modalities null or omitted, so it passes the tool filter and exercises
metadata fallback handling. Update the expected model ID list in the relevant
chutes-provider test to include the new fixture, preserving existing
expectations.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 35ba7001-f728-410b-b76b-ad49124305fb

📥 Commits

Reviewing files that changed from the base of the PR and between 6a7e5f0 and 085b2df.

📒 Files selected for processing (14)

• docs-site/src/content/docs/getting-started/quickstart.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/getting-started/quickstart.md
• docs-site/src/content/docs/ja/guides/providers.md
• docs-site/src/content/docs/ko/getting-started/quickstart.md
• docs-site/src/content/docs/ko/guides/providers.md
• docs-site/src/content/docs/ru/getting-started/quickstart.md
• docs-site/src/content/docs/ru/guides/providers.md
• docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
• docs-site/src/content/docs/zh-cn/guides/providers.md
• src/providers/registry.ts
• tests/chutes-provider.test.ts
• tests/fixtures/chutes-models.json
• tests/provider-registry-parity.test.ts

[Wibias]

Maintainer + security review verdict: REQUEST CHANGES.

I reviewed the provider registry entry, discovery contract, request path, collision-preservation tests, fixture admission logic, docs, current CodeRabbit state, current dev, and the linked primary-source evidence.

Security/correctness findings: I did not find a credential leak, silent credential retarget, SSRF/path-injection route, unbounded catalog read, or unsafe trust inheritance in the Chutes implementation. preserveCustomDestination, exact transport matching, registry-only discovery policy, 256 KiB/128-row bounds, fail-closed tool filtering, and apiKeyValidation: "unknown" are the right shape. I also independently rechecked the current Chutes first-party docs: the shared https://llm.chutes.ai/v1 gateway, Bearer auth, and live GET /v1/models contract are now explicitly documented; the current ToS identifies Chutes Global Corp and covers API consumers/PAYGO automation. The preset is useful and directly serves #572.

Blocking changes:

1. Rebase onto current dev and rerun CI. This head is now ~54 dev commits behind. The existing green CI proves 8f4201f5, not the current integration result; provider/catalog contracts have moved materially since this branch point.
2. Fix the standalone provider counts. Current dev documents 76 total / 64 key presets. This PR adds one provider, but changes every locale to 79 / 67. Merged by itself, that publishes a count two providers ahead of the registry. Update the counts to the actual post-rebase/post-merge state (or avoid batch-count churn until the three provider PRs are integrated sequentially).

All earlier CodeRabbit findings on this PR are resolved, and I found no additional production/security blocker beyond the two items above. Re-request review on the rebased exact head with fresh CI.

[Wibias]

Addressed on 09397db9:

1. Rebased onto current dev and force-pushed; focused provider tests + typecheck pass locally.
2. Corrected standalone preset counts from the batch 79/67 figures to 77/65 across all five locales (this PR adds one key preset to the current 76/64 baseline).

CodeRabbit threads were already resolved on the prior head; no additional production/security issues found beyond the maintainer rebase/count items.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

UI screenshot waived by the gui-screenshot-waived label.
This pull request is already Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently. If no CodeRabbit review appears, comment @coderabbitai review to request one.
Maintainers: @lidge-jun @Ingwannu @Wibias

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@github-actions[bot] Noted. The PR is marked ready for review at 09397db970b3f63e1060772beaa5e5f474faefed.

_{You are interacting with an AI system.}

[coderabbitai]

@github-actions[bot] The PR is ready for review. I will review pull request #1315.

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

@github-actions[bot] Acknowledged. Pull request #1315 is ready for review at 09397db970b3f63e1060772beaa5e5f474faefed.

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Wibias]

Merged — thank you @olddonkey for the careful Chutes preset work: bounded public-catalog discovery, conservative capability claims, collision preservation, fixture-only coverage, and synced docs all landed cleanly on dev. This directly helps #572.