Proxy and sync every LLM provider through one definition

[coval-cale]

The proxy, Coval agent, sync command, and fetch specs all hardcoded Phonely. Route turns at /llm/{provider}, derive the Coval agent names and endpoints from the provider slug, and drive sync-llm and the LLM fetch specs from one provider-to-model mapping. Phonely's generated names and paths match its live values, so this deploys as a no-op.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 45971b3d-91cb-4615-9005-181fb6b9561f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seribaymadina]

Findings

• P1: LLM_MODELS now controls accepted routes, but app startup still initializes only PhonelyClient. Adding another provider will create/sync an agent whose /llm/{provider} endpoint always returns 503. Keep the provider registry and client initialization in sync.
• P1: simulation_id is caller-controlled and used directly for timing inserts. A caller with the proxy secret can attribute turns to another simulation. Validate ownership/existence or derive the simulation identity server-side.

I found no obvious new auth bypass, SSRF, or secret-leak regression.

[seribaymadina]

NOICE! left couple comments