feat: add Fireworks AI built-in model provider#15
Open
Delqhi wants to merge 1 commit into
Open
Conversation
Fireworks AI provider plugin for OpenCodex. - New provider: FireworksAiModelProvider (based on NvidiaNimModelProvider) - OpenAI-compatible Chat Completions API (wire_api: chat) - Remote model catalog via /v1/models endpoint - Hardcoded fallback for router models not in API response - Supports 10+ models: kimi-k2p6, deepseek-v4-pro, glm-5p1, qwen3p6-plus, minimax-m2p7, gpt-oss-120b, etc. - Image input support via InputModality::Image - Fast search instructions for shell work - Full test suite (model parsing, capabilities, provider creation) - Registered as built-in provider with config.toml support
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:L
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| const NVIDIA_NIM_API_KEY_INSTRUCTIONS: &str = "Create an API key in the NVIDIA API Catalog at https://build.nvidia.com and set NVIDIA_API_KEY."; | ||
| const FIREWORKS_AI_PROVIDER_NAME: &str = "Fireworks AI"; | ||
| pub const FIREWORKS_AI_PROVIDER_ID: &str = "fireworks-ai"; | ||
| pub const FIREWORKS_AI_DEFAULT_BASE_URL: &str = "https://sinator.delqhi.com/inference/v1"; |
There was a problem hiding this comment.
Suggestion: The default Fireworks base URL points to an unrelated host, so requests will not reach Fireworks and the provider will send bearer credentials to the wrong domain. Replace this default with the official Fireworks API base URL to avoid broken connectivity and credential exfiltration risk. [security]
Severity Level: Critical 🚨
- ❌ Fireworks AI HTTP requests sent to non-Fireworks host domain.
- ❌ FIREWORKS_AI_API_KEY bearer token exposed to wrong host.
- ⚠️ Fireworks provider unusable without overriding Fireworks base URL.Steps of Reproduction ✅
1. Construct the built‑in Fireworks provider by calling
`ModelProviderInfo::create_fireworks_ai_provider()` at
`codex-rs/model-provider-info/src/lib.rs:439-463` without setting
`CODEX_FIREWORKS_AI_BASE_URL` in the environment; this uses
`FIREWORKS_AI_DEFAULT_BASE_URL` from `codex-rs/model-provider-info/src/lib.rs:52`.
2. Create a runtime provider with `create_model_provider(...)` at
`codex-rs/model-provider/src/provider.rs:150-163` using this `ModelProviderInfo`; because
`ModelProviderInfo::is_fireworks_ai()` at
`codex-rs/model-provider-info/src/lib.rs:466-467` matches on the provider name,
`create_model_provider` instantiates `FireworksAiModelProvider`.
3. When any code calls `FireworksAiModelProvider::api_provider()` at
`codex-rs/model-provider/src/fireworks_ai.rs:113-117`, it delegates to
`ModelProviderInfo::to_api_provider(...)` at
`codex-rs/model-provider-info/src/lib.rs:251-263`, which sets the HTTP `base_url` field on
`codex_api::Provider` to `https://sinator.delqhi.com/inference/v1` from
`FIREWORKS_AI_DEFAULT_BASE_URL`.
4. Downstream Fireworks usage, such as `FireworksAiModelsEndpoint::list_models()` at
`codex-rs/model-provider/src/fireworks_ai.rs:188-215`, builds a GET `models` request from
this `Provider` and passes it through `api_auth.apply_auth(...)` (same function, lines
194-201), which attaches credentials derived from `FIREWORKS_AI_API_KEY_ENV_VAR` set in
`ModelProviderInfo::create_fireworks_ai_provider()` at
`codex-rs/model-provider-info/src/lib.rs:448-449`, causing authenticated Fireworks traffic
and API keys to be sent to the non‑Fireworks host `sinator.delqhi.com`.Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** codex-rs/model-provider-info/src/lib.rs
**Line:** 52:52
**Comment:**
*Security: The default Fireworks base URL points to an unrelated host, so requests will not reach Fireworks and the provider will send bearer credentials to the wrong domain. Replace this default with the official Fireworks API base URL to avoid broken connectivity and credential exfiltration risk.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
Comment on lines
+246
to
+249
| // Always include hardcoded models | ||
| for slug in FIREWORKS_AI_HARDCODED_MODELS { | ||
| seen.insert(slug.to_string()); | ||
| } |
There was a problem hiding this comment.
Suggestion: Preloading seen with hardcoded slugs causes API-returned entries for those same models to be skipped, so real catalog metadata/order from the provider is discarded and replaced by fallback metadata. Build seen from actual API items first, then add fallback entries only for slugs that were truly missing. [incorrect condition logic]
Severity Level: Major ⚠️
- ⚠️ Fireworks model catalog drops provider metadata for router models.
- ⚠️ Model ordering diverges from Fireworks /v1/models response.Steps of Reproduction ✅
1. Note the hardcoded Fireworks router slugs defined in `FIREWORKS_AI_HARDCODED_MODELS` at
`codex-rs/model-provider/src/fireworks_ai.rs:230-236`, which includes
`"accounts/fireworks/routers/glm-5p1-fast"`.
2. In the unit test `parses_standard_openai_models_response()` at
`codex-rs/model-provider/src/fireworks_ai.rs:328-345`, construct an OpenAI-compatible
`/v1/models` JSON response whose `data` array contains both
`"accounts/fireworks/models/kimi-k2p6"` and `"accounts/fireworks/routers/glm-5p1-fast"`
(lines 330-335), then call `parse_fireworks_ai_models(body)` (line 338).
3. Inside `parse_fireworks_ai_models` at
`codex-rs/model-provider/src/fireworks_ai.rs:238-271`, execution follows the OpenAI list
branch (lines 243-244); the function initializes `seen` and then preloads it with every
slug from `FIREWORKS_AI_HARDCODED_MODELS` (lines 244-249), so
`"accounts/fireworks/routers/glm-5p1-fast"` is already in `seen` before iterating API
results.
4. When iterating API models (lines 251-262), `"accounts/fireworks/models/kimi-k2p6"` is
accepted and converted into a `ModelInfo`, but `"accounts/fireworks/routers/glm-5p1-fast"`
fails the `seen.insert(id.to_string())` check at line 254 and is skipped, meaning the
router model's catalog entry—along with any provider-specified ordering or metadata—is
discarded and later replaced only by the fallback entry built in the final loop (lines
265-269).Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** codex-rs/model-provider/src/fireworks_ai.rs
**Line:** 246:249
**Comment:**
*Incorrect Condition Logic: Preloading `seen` with hardcoded slugs causes API-returned entries for those same models to be skipped, so real catalog metadata/order from the provider is discarded and replaced by fallback metadata. Build `seen` from actual API items first, then add fallback entries only for slugs that were truly missing.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
Comment on lines
+265
to
+269
| // Add hardcoded models at the end (lower priority) | ||
| for slug in FIREWORKS_AI_HARDCODED_MODELS { | ||
| let priority = i32::try_from(models.len()).unwrap_or(i32::MAX); | ||
| models.push(fireworks_ai_model_info(slug, Some("fireworks"), priority)); | ||
| } |
There was a problem hiding this comment.
Suggestion: The fallback list is appended unconditionally, so the catalog always includes every hardcoded model even when the remote catalog already defines availability and ordering. This inflates model lists and can expose models that are not actually available for the current account; only append fallback models that are absent. [logic error]
Severity Level: Major ⚠️
- ⚠️ Fireworks catalog includes hardcoded models regardless of remote availability.
- ⚠️ Users may see and select models that error at runtime.Steps of Reproduction ✅
1. Observe that Fireworks model discovery for this provider goes through
`FireworksAiModelsEndpoint::list_models()` at
`codex-rs/model-provider/src/fireworks_ai.rs:188-215`, which is wired into
`FireworksAiModelProvider::models_manager()` at
`codex-rs/model-provider/src/fireworks_ai.rs:124-149` via
`OpenAiModelsManager::new_with_base_catalog(...)`.
2. In the async test `models_manager_fetches_standard_openai_models_endpoint()` at
`codex-rs/model-provider/src/fireworks_ai.rs:364-391`, a `wiremock::MockServer` serves a
`/v1/models` response whose `data` array contains only
`"accounts/fireworks/models/deepseek-v4-pro"` (lines 366-374), and the provider's
`base_url` is set to that mock server (lines 378-381).
3. When `manager.raw_model_catalog(RefreshStrategy::Online).await` is called at lines
382-387, the `OpenAiModelsManager` uses `FireworksAiModelsEndpoint::list_models()`, which
in turn calls `parse_fireworks_ai_models(&response.body)` at line 214; this runs through
the OpenAI list branch in `parse_fireworks_ai_models` at
`codex-rs/model-provider/src/fireworks_ai.rs:238-271`.
4. After adding a `ModelInfo` for the single remote model in the API response,
`parse_fireworks_ai_models` unconditionally iterates `FIREWORKS_AI_HARDCODED_MODELS` at
lines 265-269 and appends a `ModelInfo` for each hardcoded slug, regardless of whether
those models were present in the `/v1/models` response or enabled for the current account,
causing the resulting catalog used by `raw_model_catalog` to always include every
hardcoded router/model even when Fireworks does not advertise them.Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** codex-rs/model-provider/src/fireworks_ai.rs
**Line:** 265:269
**Comment:**
*Logic Error: The fallback list is appended unconditionally, so the catalog always includes every hardcoded model even when the remote catalog already defines availability and ordering. This inflates model lists and can expose models that are not actually available for the current account; only append fallback models that are absent.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
|
CodeAnt AI finished reviewing your PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
What
Adds Fireworks AI as a built-in model provider for OpenCodex.
Why
Fireworks AI provides access to 10+ high-quality models (kimi-k2p6, deepseek-v4-pro, glm-5p1, qwen3p6-plus, minimax-m2p7, etc.) via a shared API key pool. This PR follows the exact same pattern as the existing NVIDIA NIM provider.
Changes
model-provider/src/fireworks_ai.rsmodel-provider/src/lib.rsmod fireworks_ai;model-provider/src/provider.rsmodel-provider-info/src/lib.rsbuilt_in_model_providersregistrationconfig/src/config_toml.rsFIREWORKS_AI_PROVIDER_IDto reserved listFeatures
Usage
Tested
All models verified working on macOS with real API key.
CodeAnt-AI Description
Add Fireworks AI as a built-in model provider
What Changed
Impact
✅ Shorter provider setup✅ Fewer missing-model surprises✅ Clearer Fireworks AI selection in config💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.