fix(agent): route gateway-served qwen models through Veryfront Cloud

[kwakayama]

Hosted agent runs on qwen/qwen3.8-27b failed before inference with Model provider "qwen" not registered. resolveRuntimeModel only rewrites <provider>/<model> to veryfront-cloud/... for providers in HOSTED_PROVIDER_NAMES, a hand-kept set that predates Qwen, so qwen/... fell through to direct resolution.

Change

• model-catalog.ts exports VERYFRONT_CLOUD_CATALOG_PROVIDER_NAMES: every provider name the catalog data routes (alias keys, routing rows, chat model providers). It equals the previous hand-kept set.
• model-resolution.ts builds HOSTED_PROVIDER_NAMES from it, plus qwen, which the gateway serves ahead of the catalog snapshot shipped in this package. The entry notes it goes once deno task generate:model-catalog adds Qwen. Unlisted providers already route on the default OpenAI surface, so Qwen goes to the vendor-neutral /ai/v1 route (the gateway refuses Qwen on the vendor-scoped route).

The gateway catalog (GET /ai/models) serves anthropic, openai, google, mistral, deepseek and qwen. Qwen was the only one missing. Deepseek was already routed.

Tests

• model-resolution.test.ts: every catalog provider routes through Veryfront Cloud with hosted bootstrap; every vendor the gateway catalog serves (including qwen/qwen3.8-27b) resolves to veryfront-cloud/...; Qwen stays unrouted without bootstrap.
• provider.test.ts: agent({ model: "qwen/qwen3.8-27b" }) with hosted bootstrap sends to https://api.veryfront.com/ai/v1/chat/completions with body model qwen/qwen3.8-27b. On the old code this fails with the exact staging error.

Local: deno fmt/lint/check on the changed files, the affected test files, deno task lint:ci (includes lint:testing-front-door and lint:test-semantic-dispositions) all pass.

Part of veryfront/veryfront-issue-inbox#1859.

Closes veryfront/veryfront-issue-inbox#1913

Summary by CodeRabbit

• New Features
  • Hosted routing now supports providers listed in the Veryfront Cloud model catalog, including Qwen.
  • Qwen models can be used through the gateway’s Chat Completions interface.
• Bug Fixes
  • Qwen continues to use its standard routing when hosted bootstrap is not enabled.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T10:57:23.966811Z	b8229c1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
src/index.client.ts	289	2321 KiB	✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 26289b56-8e2f-448f-862c-087348d0076a

📥 Commits

Reviewing files that changed from the base of the PR and between 2129428 and b8229c1.

📒 Files selected for processing (4)

• src/agent/runtime/model-resolution.test.ts
• src/agent/runtime/model-resolution.ts
• src/provider/veryfront-cloud/model-catalog.ts
• src/provider/veryfront-cloud/provider.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The runtime now derives hosted-routing eligibility from the Veryfront Cloud catalog and adds Qwen. Tests cover catalog-provider routing, Qwen routing conditions, and a Qwen request through the Veryfront Cloud provider.

Changes

Hosted model routing

Layer / File(s)	Summary
Catalog-based hosted routing src/provider/veryfront-cloud/model-catalog.ts, src/agent/runtime/model-resolution.ts, src/agent/runtime/model-resolution.test.ts	The catalog exports a frozen, deduplicated list of provider names. The runtime uses this list, plus qwen, for hosted-provider eligibility. Tests cover catalog-provider routing, named providers, and Qwen routing with and without hosted bootstrap.
Qwen provider request src/provider/veryfront-cloud/provider.test.ts	A provider test checks that an agent request with qwen/qwen3.8-27b uses the Veryfront Cloud Chat Completions URL, preserves the model ID, and returns the generated text.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b8229

The routing change adds Qwen without changing eligibility for existing providers. No issue requiring a fix before merge was identified.

Security Architecture Review

Security architecture risk: 🔵 Low · up to b8229

This expands which hosted models can be reached without evidence that it changes who can authenticate or which credentials are used. Alternate routing configurations and upstream acceptance remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The newly reachable path is scoped to hosted runs selecting a Qwen model with cloud bootstrap. The repository evidence does not establish the gateway's final model allowlist or the number of affected deployments.

Trust Boundaries and Controls

• observed — Hosted request preparation follows caller authentication and project-access verification; the provider subsequently requires gateway credentials and applies the shared outbound controls.

Hardening Proposals

• proposed — If vendor-route mode is deployed, confirm that Qwen remains on a gateway route that accepts it; the mocked neutral-route test does not establish behavior in that alternate mode.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: routing gateway-served Qwen models through Veryfront Cloud.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[kwakayama]

Code review: 90/100 — solid, narrowly-scoped fix that correctly closes the qwen routing gap

Strengths:

• Root cause is diagnosed precisely: HOSTED_PROVIDER_NAMES was a hand-kept set that drifted from the catalog. Deriving VERYFRONT_CLOUD_CATALOG_PROVIDER_NAMES from VERYFRONT_CLOUD_PROVIDER_ALIASES + VERYFRONT_CLOUD_PROVIDER_ROUTING + chat model providers reproduces the exact old set (verified against model-catalog.data.ts: anthropic, openai, google, google-ai-studio, mistral, moonshotai, deepseek all still present via aliases/routing), so this is a behavior-preserving refactor plus one additive entry (qwen), not a silent widening.
• The qwen routing path checks out end-to-end: unlisted in the routing table → default openai surface, non-native → pinned to chat-completions, and resolveVeryfrontCloudGatewayRoute sends OpenAI-surface, non-vendor-scoped providers to the neutral ai/v1 path with wireModelProvider set — matching the new provider.test.ts assertion that the request body's model is qwen/qwen3.8-27b against https://api.veryfront.com/ai/v1/chat/completions.
• Test coverage is strong and targeted: one test asserts every derived catalog provider still routes, one exercises the exact set of vendors the gateway serves (including qwen), one confirms qwen stays unrouted without hosted bootstrap (preserving the "no substitution" invariant), and the provider.test.ts addition reproduces the reported staging failure at the HTTP-request level.
• Minimal diff, no public API breakage (the new export is purely additive), commit message and PR description are clear and link the originating issue.

Minor concerns:

• GATEWAY_PROVIDERS_AHEAD_OF_CATALOG reintroduces a small hand-kept list (currently just qwen) — it narrows the problem this PR is fixing rather than eliminating the class of bug, though the comment explicitly flags it as temporary pending deno task generate:model-catalog and that's a reasonable stopgap.
• I traced the logic by hand (no Deno runtime available in this review environment to execute deno task test:file), so I'd rely on CI (currently still running at review time) to confirm the fmt/lint/test results the PR description claims locally.

This is a clean, well-tested fix — nothing here blocks merge pending green CI.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud