Pin open web models to Novita

[lewtun]

Pins Kimi, MiniMax, GLM, and DeepSeek to the Novita HF Router provider in backend and frontend model lists. Verified with focused pytest, Ruff, and frontend build.

[github-actions]

Claude Code is working…

I'll analyze this and get back to you.

View job run

[github-actions]

Claude finished @lewtun's task in 1m 57s —— View job

---

PR Review: Pin open web models to Novita

No blocking issues — LGTM (1 P2)

I traced the :novita suffix end-to-end through the routing chain. The change is correct and consistent across backend and frontend.

What I verified

• Routing passthrough works. _resolve_llm_params (agent/core/llm_params.py:124-138) strips only the huggingface/ prefix and prepends openai/, so moonshotai/Kimi-K2.6:novita reaches the HF Router as openai/moonshotai/Kimi-K2.6:novita. The :novita provider suffix survives — identical to the pre-existing :fal-ai / :deepinfra pattern, so this is an established, working code path, not a new one.
• Backend stays in sync. _available_models() (backend/routes/agent.py:94-128) and _valid_model_ids() both derive from the same model_ids.py constants, so the model picker, session validation (_validate_model_id, agent/core/agent_loop.py callers), and HOSTED_MODEL_IDS all move together. No bare/suffixed mismatch.
• Frontend stays in sync. ChatInput.tsx now references the suffixed *_MODEL_PATH constants from utils/model.ts instead of inline literals — these are the values posted on session create, and they match the backend's accepted set.
• Token-limit lookup unaffected. _get_max_tokens_safe (agent/core/session.py:40) splits off the : suffix before litellm.get_model_info, so the bare repo id is still used for the catalog lookup.
• Avatars intentionally bare. getHfAvatarUrl('MiniMaxAI/MiniMax-M2.7') etc. (ChatInput.tsx:74,80,86) correctly keep the unsuffixed repo path — avatars are keyed by repo, not provider.

Findings

P2 — Resumed pre-merge sessions may fail model validation. Any web session persisted before this merge stores the bare id (e.g. MiniMaxAI/MiniMax-M2.7), which is no longer in _valid_model_ids() (backend/routes/agent.py:134-141). If resume re-validates the stored model, those sessions could 400 until the user reselects. I didn't trace the resume path to confirm it hits _validate_model_id, so this is informational — worth a quick check, not a blocker.

No test asserts the pinned values, but for a config-only pin that's low-value coverage and not worth gating on.