feat(llm): add Requesty provider support

[Thibaultjaigu]

Summary

Adds Requesty as a built in provider. Requesty is an OpenAI compatible gateway, so it reuses the existing OpenAiCompletions path and follows the same shorthand provider pattern as Kilo Gateway and OpenRouter. No new dependencies and no new request code.

Changes

• src/config/providers.rs: REQUESTY_PROVIDER_BASE_URL (https://router.requesty.ai) and a requesty entry in default_provider_config.
• src/config/{types,toml_schema,load}.rs: requesty_key in [llm] with REQUESTY_API_KEY env fallback, shorthand provider registration, onboarding env detection, redacted Debug output and secret field.
• src/config/onboarding.rs: Requesty in the CLI provider picker.
• src/api/providers.rs: provider status, toml key mapping, connection test config and provider id list.
• src/api/models.rs: requesty mapped to the models.dev requesty provider so the model picker lists its models.
• src/llm/routing.rs, src/llm/model.rs: routing defaults (requesty/anthropic/claude-sonnet-4-5 channel, requesty/anthropic/claude-haiku-4-5 worker, no fallbacks), requesty/ prefix and display name.
• interface/: settings entry, model select label and order, icon, and requesty in the ProviderStatus type.
• Docs: README provider list, config reference (key, model name format, env fallback) and quickstart.
• Config tests: added Requesty cases to the toml and env shorthand provider tests.

Requesty is not added to the routing inference priority list, so it is only picked up automatically when it is the only configured provider (same fallback as custom providers).

How to test

[llm]
requesty_key = "env:REQUESTY_API_KEY"

[defaults.routing]
channel = "requesty/openai/gpt-4o-mini"

Set REQUESTY_API_KEY (key from https://app.requesty.ai/api-keys) and send a message, or use Settings, Providers, Requesty and run the connection test. Any vendor/model id from Requesty works after the requesty/ prefix.

Validation

• cargo fmt --all -- --check: pass.
• cargo check, clippy and cargo test --lib were not run locally (not enough free disk for the full dependency tree). I reviewed every changed line by hand against the Kilo Gateway wiring (all LlmConfig and ProviderStatus literals, the onboarding index, match arms), so CI will be the first real compile.
• Frontend tsc was not run locally for the same reason; the changes are additive entries in existing typed maps and one inline SVG component.
• Live request against https://router.requesty.ai/v1/chat/completions with the same body spacebot sends (system preamble, streaming, model openai/gpt-4o-mini after stripping requesty/): 200, streamed reply received. Default routing model ids were checked against the live /v1/models list.

Disclosure: I work at Requesty. Happy to adjust anything to match project conventions.

Note

Adds Requesty as an OpenAI-compatible LLM provider with minimal changes—leveraging existing OpenAI integration path, adding config entries, frontend UI components, and routing defaults. Reuses the same shorthand provider pattern as other gateways. Includes config tests and documentation updates.

_{Written by Tembo for commit 42f2dda. This will update automatically on new commits.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 1b9f95ff-155a-4557-b5d2-a30483f3e518

📥 Commits

Reviewing files that changed from the base of the PR and between 5c2ee47 and 42f2dda.

📒 Files selected for processing (17)

• README.md
• docs/content/docs/(configuration)/config.mdx
• docs/content/docs/(getting-started)/quickstart.mdx
• interface/src/api/schema.d.ts
• interface/src/components/ModelSelect.tsx
• interface/src/components/settings/constants.ts
• interface/src/lib/providerIcons.tsx
• src/api/models.rs
• src/api/providers.rs
• src/config.rs
• src/config/load.rs
• src/config/onboarding.rs
• src/config/providers.rs
• src/config/toml_schema.rs
• src/config/types.rs
• src/llm/model.rs
• src/llm/routing.rs

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

This change adds Requesty as an LLM provider across configuration, provider discovery and status, interface presentation, and model routing. It also updates setup documentation. The README separately adds OpenCode Zen to the prerequisite provider list.

Changes

Requesty Provider

Layer / File(s)	Summary
Requesty configuration and registration src/config/toml_schema.rs, src/config/types.rs, src/config/providers.rs, src/config/load.rs, src/config/onboarding.rs, src/config.rs, docs/content/docs/(configuration)/config.mdx, docs/content/docs/(getting-started)/quickstart.mdx	Adds requesty_key to TOML and LLM configuration, resolves it from REQUESTY_API_KEY, and registers Requesty with its base URL. Onboarding, configuration tests, and documentation include the provider. Credential debug output redacts the key.
Provider discovery and status src/api/models.rs, src/api/providers.rs, interface/src/api/schema.d.ts, interface/src/components/ModelSelect.tsx, interface/src/components/settings/constants.ts, interface/src/lib/providerIcons.tsx	Adds Requesty to configured-provider discovery and provider status reporting. The interface adds its provider flag, label, settings entry, and icon.
Model mapping and routing defaults src/api/models.rs, src/llm/model.rs, src/llm/routing.rs	Maps models.dev’s Requesty provider ID, adds the Requesty display name and model prefix, and defines Requesty model defaults and a 60-second rate-limit cooldown.

OpenCode Zen Prerequisite

Layer / File(s)	Summary
Prerequisite provider list README.md	Adds OpenCode Zen as an LLM API key option.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Suggested reviewers: jamiepine

Merge Risk: ⚪ Minimal · up to 42f2d

Requesty’s defaults are forwarded using model identifiers its router documents as supported. No actionable merge risk remains in the reviewed changes.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 42f2d

Requesty introduces a new destination for agent conversations and tool context. It uses the established provider transport and a fixed HTTPS endpoint, and no security bypass was established. The main design question is whether selecting it from a configured credential alone meets the deployment’s data-handling expectations.

Retained concerns

• Medium · security · inferred: When Requesty is the only configured provider, its credential can cause inferred routing to send agent requests to the new external gateway without an explicit Requesty routing setting. This is an expected provider-selection pattern, not a demonstrated bypass, but its suitability for deployments with data-destination restrictions is unverified.

Security review details

Security Blast Radius

• inferred — The independently affected scope is any instance that configures and selects Requesty: its routed agent requests can reach the Requesty gateway. The evidence does not establish cross-tenant reach or a change to agent tool privileges.

Security Findings and Attack Paths

• inferred — No Requesty-specific endpoint injection or authorization bypass was established: the new shorthand uses a fixed HTTPS URL and the existing bearer-auth request path. Whether deployment policy permits this new data destination remains unknown.

Trust Boundaries and Controls

• observed — A configured key crosses from local configuration into an outbound credentialed LLM request. The key has secret metadata and redacted Debug presentation; these controls do not determine whether sending request content to the new gateway satisfies a deployment’s data policy.

Resilience and Maintainability Implications

• inferred — Concurrent generic provider configuration writes could lose an update, including a Requesty credential change. This derives from an existing shared lifecycle rather than a new Requesty branch; the watcher offers reload after file changes but does not serialize writes.

Hardening Proposals

• proposed — Confirm that deployment egress and data-handling policy permits the Requesty destination, particularly where a sole configured credential is sufficient to infer default routing.
• proposed — For the shared provider lifecycle, serialize config mutations and verify that clearing a provider reaches the intended live and persisted terminal state, including concurrent and interrupted operations.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 53.85% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 26 functions across 14 files. (3 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding Requesty provider support for LLMs.
Description check	✅ Passed	The description directly explains the Requesty provider integration, configuration, UI, routing, documentation, tests, and validation status.

Full details: Docstring Coverage

Explanation

Docstring coverage is 53.85% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 26 functions across 14 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}