feat(providers): add MiniMax provider

.claude/skills/harness-test-writer/SKILL.md

@@ -0,0 +1,174 @@
+---
+name: harness-test-writer
+description: Add regression test cases to the Bifrost provider harness (the Postman collection run via `make run-provider-harness-test`) based on a merged PR or a GitHub issue. Fetches the PR/issue, traces the affected wire path in the codebase, checks existing harness coverage, designs cases following harness conventions, inserts them into tests/e2e/api/collections/provider-harness.json without reformatting the file, and validates via the augment and filter scripts. Invoked with /harness-test-writer <PR# | issue# | URL> or /harness-test-writer (prompts for a reference).
+allowed-tools: Read, Grep, Glob, Bash, WebFetch, Task, AskUserQuestion, TodoWrite, Edit, Write
+---
+
+# Provider Harness Test Writer
+
+Turn a PR or GitHub issue into regression coverage in the provider harness: the Postman
+collection at `tests/e2e/api/collections/provider-harness.json`, executed by newman via
+`make run-provider-harness-test`.
+
+This is NOT the Go test harness in `core/internal/llmtests/` (that one is run via
+`make test-core PROVIDER=...`). If the user seems to want Go-level scenario tests,
+confirm before proceeding.
+
+## Step 1 - Resolve the reference
+
+The argument may be a PR number, an issue number, or a GitHub URL.
+
+- URL containing `/pull/` => PR. URL containing `/issues/` => issue.
+- A bare number is ambiguous: try `gh pr view <N> --repo maximhq/bifrost` first; if it
+  404s, try `gh issue view <N>`. If BOTH exist and refer to different things, ask the
+  user which one they mean with AskUserQuestion.
+- No argument at all => ask the user for the PR/issue reference.
+
+Fetch full context:
+
+```bash
+gh pr view <N> --repo maximhq/bifrost --json title,body,state,files,baseRefName
+gh pr diff <N> --repo maximhq/bifrost
+# or
+gh issue view <N> --repo maximhq/bifrost --json title,body,state,labels,comments
+```
+
+For a PR, also note any `Closes #X` issue and fetch that issue too - the issue usually
+contains the client-visible reproduction (exact request shapes, error bodies, status
+codes) that the harness case must mirror.
+
+## Step 2 - Understand the wire-level behavior to pin
+
+The harness tests Bifrost from the outside: HTTP requests against gateway routes, with
+assertions on status codes and response/SSE bodies. Translate the PR/issue into that
+frame:
+
+1. Which route(s)? (`/v1/chat/completions`, `/v1/responses`, drop-ins like
+   `/openai`, `/anthropic`, `/bedrock`, `/genai`, passthrough routes, ...)
+2. Which provider(s) and model(s)?
+3. What request shape triggers the bug/feature? Reconstruct it from the issue repro or
+   from the code path in the diff (read the changed functions and their callers).
+4. What is the observable failure signature before the fix (status code, error body
+   substring) and the expected behavior after?
+
+Trace the chain in code with Grep/Read until you can state it in one sentence, e.g.:
+"`x-bf-compat` header -> compat plugin marks `ChangeRequestType=ResponsesRequest` ->
+`ToResponsesRequest()` -> `ToOpenAIResponsesRequest` strips role -> OpenAI 200".
+
+Useful switches the harness relies on:
+- `x-bf-compat` header: `true` enables all compat features; a JSON array like
+  `["convert_chat_to_responses"]` enables only specific ones (parsed in
+  `transports/bifrost-http/lib/ctx.go`, consumed by `plugins/compat/main.go`). Prefer
+  the targeted array form in regression cases so only the feature under test is active.
+  Note: when the suite runs with `COMPAT=on`, a collection-level prerequest script
+  upserts `x-bf-compat: true` over any per-request value - the targeted form matters
+  for `COMPAT=off` runs, which is exactly when a forced-conversion case needs it.
+- `x-bf-passthrough-extra-params: true` for passthrough extra-param cases.
+
+## Step 3 - Check existing coverage
+
+Search the collection for the feature's keywords before writing anything:
+
+```bash
+cd tests/e2e/api
+grep -c '<keyword>' collections/provider-harness.json
+node -e "
+const c = require('./collections/provider-harness.json');
+function walk(items, path) { for (const it of items) {
+  if (it.item) walk(it.item, path + '/' + it.name);
+  else if (JSON.stringify(it).includes('<keyword>')) console.log(path + ' :: ' + it.name);
+} }
+walk(c.item, '');"
+```
+
+Also skim `HARNESS_COVERAGE_BACKLOG.md` - if the gap is listed there as `[ ]`, flip it
+to `[x]` as part of the change (and if you find adjacent gaps worth noting, leave them,
+do not scope-creep).
+
+If coverage already exists, report where and stop - do not add duplicates.
+
+## Step 4 - Design the cases
+
+Conventions (match the existing collection exactly):
+
+- **Folder**: issue-pinned regressions get their own top-level folder named
+  `<N>. <Short Title> (#<issue> / PR #<pr>)` where `<N>` is the next unused top-level
+  number (folders 17, 18, 19 are prior examples). Give the folder a `description`
+  explaining the bug, the production path, and what each case pins.
+- **Case names** must contain the provider keyword and model so
+  `runners/filter-collection.mjs` PROVIDER filtering catches them - check
+  `PROVIDER_KEYWORDS` in that file (e.g. openai matches "openai", "gpt-"). Suffix each
+  name with ` - #<issue>`.
+- **Coverage shape**: typically 2-3 cases - the real production route (non-streaming),
+  a streaming variant if the route streams, and where applicable a second route that
+  pins the same invariant independently (e.g. native `/v1/responses` alongside the
+  converted `/v1/chat/completions` path).
+- **Test scripts** (Postman `event[].script.exec`, plain ES5 JavaScript):
+  - Start with an infra guard so auth/rate/server noise skips instead of false-failing:
+    `if ([401, 403, 429, 500, 502, 503, 504].indexOf(pm.response.code) !== -1) { return; }`
+    Do NOT guard on 400 when a 400 IS the regression signature - that must fail loudly.
+  - Assert the specific failure signature is absent (error substring, param name) AND
+    that the happy path succeeded (status below 400, expected fields present).
+  - Include the response text in failure messages:
+    `pm.expect(pm.response.code, 'failed: ' + pm.response.text()).to.be.below(400);`
+- **Variables**: use `{{baseUrl}}` for the gateway. Inline `provider/model` strings
+  (e.g. `openai/gpt-4o-mini`) like the cross-cut folders do; only use variables such as
+  `{{bedrockModel}}`, `{{genaiModel}}`, `{{vertexModel}}` where existing folders do.
+- Keep request bodies minimal and cheap (small `max_tokens`/`max_output_tokens`,
+  gpt-4o-mini-class models) - the harness runs as a paid live sweep.
+
+Present the designed cases (names, route, body, assertions) to the user for approval
+before editing the collection.
+
+## Step 5 - Insert without reformatting
+
+CRITICAL: `provider-harness.json` is ~1.5MB and is NOT byte-stable under
+`JSON.stringify(JSON.parse(raw), null, 2)` (escape differences). Never rewrite the
+whole file - the diff must contain only your added lines.
+
+Use a Node script that appends the new folder textually before the closing `]` of the
+top-level `item` array:
+
+```js
+const raw = fs.readFileSync(PATH, 'utf8');
+const before = JSON.parse(raw);
+// abort if the folder already exists (idempotence)
+const indented = JSON.stringify(folder, null, 2).split('\n').map(l => '    ' + l).join('\n');
+const tail = '\n  ]\n}';
+if (!raw.endsWith(tail)) throw new Error('unexpected file tail');
+const out = raw.slice(0, -tail.length) + ',\n' + indented + tail;
+const after = JSON.parse(out); // must parse; item count must be before + 1
+fs.writeFileSync(PATH, out);
+```
+
+Adding cases INSIDE an existing folder is harder to do textually; if that is truly the
+right placement, locate the folder's closing bracket precisely and verify the diff is
+additions-only afterward. Default to a new top-level folder for issue regressions.
+
+## Step 6 - Validate
+
+All from `tests/e2e/api/`:
+
+```bash
+git diff --stat   # must show only additions in provider-harness.json (+ backlog md if touched)
+node runners/augment-provider-harness.mjs --source collections/provider-harness.json --out /tmp/aug.json
+node runners/filter-collection.mjs --source /tmp/aug.json --out /tmp/filtered.json --provider <provider>
+node -e "const c=require('/tmp/filtered.json'); const f=c.item.find(i=>i.name.startsWith('<N>.')); console.log('kept:', !!f, f && f.item.length);"
+```
+
+The augment script only regenerates its own "(generated)" folders, so a new top-level
+folder passes through untouched - but run it anyway to catch parse breakage.
+
+Do NOT auto-run the live suite: it starts a gateway and makes paid provider calls.
+Report the run command and offer to execute it:
+
+```bash
+make run-provider-harness-test PROVIDER=<provider> FEATURE="<distinctive keyword from your case names>"
+```
+
+## Step 7 - Report
+
+Summarize: what the PR/issue changed, the coverage gap found (cite evidence, e.g.
+"tool_call_id appeared zero times in the collection"), each added case and what it
+pins, validation results, and the run command. Leave the change unstaged - never
+commit.

.github/workflows/release-pipeline.yml

@@ -3,7 +3,7 @@ name: Release Pipeline
 # Triggers automatically on push to main when any version file changes
 on:
   push:
-    branches: ["main"]
+    branches: ["main", "v2.0.0"]
   workflow_dispatch:
     inputs:
       skip_tests:

.github/workflows/scripts/validate-helm-templates.sh

@@ -54,7 +54,7 @@ test_template() {
 
 # 1. Storage Combinations (9 tests)
 echo ""
-echo -e "${CYAN}📦 1/6 - Testing Storage Combinations (9 tests)...${NC}"
+echo -e "${CYAN}📦 1/7 - Testing Storage Combinations (9 tests)...${NC}"
 echo "---------------------------------------------------"
 
 # config=no, logs=no
@@ -126,7 +126,7 @@ test_template "config=postgres, logs=postgres" \
 
 # 2. Vector Store Combinations (6 tests)
 echo ""
-echo -e "${CYAN}🗄️  2/6 - Testing Vector Store Combinations (6 tests)...${NC}"
+echo -e "${CYAN}🗄️  2/7 - Testing Vector Store Combinations (6 tests)...${NC}"
 echo "--------------------------------------------------------"
 
 # Weaviate
@@ -175,7 +175,7 @@ test_template "sqlite + qdrant" \
 
 # 3. Special Configurations (7 tests)
 echo ""
-echo -e "${CYAN}⚙️  3/6 - Testing Special Configurations (7 tests)...${NC}"
+echo -e "${CYAN}⚙️  3/7 - Testing Special Configurations (7 tests)...${NC}"
 echo "-----------------------------------------------------"
 
 # semantic cache: direct mode (dimension: 1, no provider/keys)
@@ -251,7 +251,7 @@ test_template "production-like config" \
 
 # 4. New Property Rendering (Gap 1-8 tests)
 echo ""
-echo -e "${CYAN}🆕 4/6 - Testing New Property Rendering (Gap 1-8)...${NC}"
+echo -e "${CYAN}🆕 4/7 - Testing New Property Rendering (Gap 1-8)...${NC}"
 echo "-----------------------------------------------------"
 
 # Gap 1+2: Client new properties
@@ -337,7 +337,7 @@ test_template "combined: all new Gap 1-9 fields" \
 
 # 5. Plugin Name Validation
 echo ""
-echo -e "${CYAN}🔌 5/6 - Validating Plugin Names Match Go Registry...${NC}"
+echo -e "${CYAN}🔌 5/7 - Validating Plugin Names Match Go Registry...${NC}"
 echo "------------------------------------------------------"
 
 # Verify semantic cache plugin renders with correct name ("semantic_cache", not "semantic_cache")
@@ -366,7 +366,7 @@ fi
 
 # 6. Custom Plugin Placement and Order Rendering
 echo ""
-echo -e "${CYAN}🔧 6/6 - Validating Custom Plugin placement and order Rendering...${NC}"
+echo -e "${CYAN}🔧 6/7 - Validating Custom Plugin placement and order Rendering...${NC}"
 echo "-------------------------------------------------------------------"
 
 # Test custom plugin renders successfully with placement and order
@@ -421,6 +421,48 @@ else
   head -10 /tmp/helm-template-output.yaml | sed 's/^/    /'
 fi
 
+# 7. Security Context Rendering
+echo ""
+echo -e "${CYAN}🔒 7/7 - Validating OpenShift-compatible Security Contexts...${NC}"
+echo "----------------------------------------------------------------"
+
+test_name="default Bifrost pod does not set runAsUser (SCC assigns UID)"
+if helm template bifrost ./helm-charts/bifrost \
+  --set image.tag=v1.0.0 \
+  > /tmp/helm-template-output.yaml 2>&1; then
+  if grep -Eq '^[[:space:]]*runAsUser:' /tmp/helm-template-output.yaml; then
+    report_result "$test_name" 1
+    echo -e "${YELLOW}  runAsUser found in default render (must stay unset so OpenShift can assign a UID)${NC}"
+  else
+    report_result "$test_name" 0
+  fi
+else
+  report_result "$test_name" 1
+  echo -e "${YELLOW}  Error output:${NC}"
+  head -10 /tmp/helm-template-output.yaml | sed 's/^/    /'
+fi
+
+# Postgres mode renders a Deployment (not the sqlite StatefulSet); assert the
+# pinned-UID regression can't sneak in on that code path either.
+test_name="postgres-mode Bifrost pod does not set runAsUser (SCC assigns UID)"
+if helm template bifrost ./helm-charts/bifrost \
+  --set image.tag=v1.0.0 \
+  --set storage.mode=postgres \
+  --set postgresql.enabled=true \
+  --set postgresql.auth.password=testpass \
+  > /tmp/helm-template-output.yaml 2>&1; then
+  if grep -Eq '^[[:space:]]*runAsUser:' /tmp/helm-template-output.yaml; then
+    report_result "$test_name" 1
+    echo -e "${YELLOW}  runAsUser found in postgres render (must stay unset so OpenShift can assign a UID)${NC}"
+  else
+    report_result "$test_name" 0
+  fi
+else
+  report_result "$test_name" 1
+  echo -e "${YELLOW}  Error output:${NC}"
+  head -10 /tmp/helm-template-output.yaml | sed 's/^/    /'
+fi
+
 # Cleanup
 rm -f /tmp/helm-template-output.yaml
 

README.md

@@ -1,6 +1,7 @@
 # Bifrost AI Gateway
 
-[![Go Report Card](https://goreportcard.com/badge/github.com/maximhq/bifrost/core)](https://goreportcard.com/report/github.com/maximhq/bifrost/core)
+<a href="https://trendshift.io/repositories/14529?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-14529" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/14529" alt="maximhq%2Fbifrost | Trendshift" width="250" height="55"/></a>
+
 [![Discord badge](https://dcbadge.limes.pink/api/server/https://discord.gg/exN5KAydbU?style=flat)](https://discord.gg/exN5KAydbU)
 [![codecov](https://codecov.io/gh/maximhq/bifrost/branch/main/graph/badge.svg)](https://codecov.io/gh/maximhq/bifrost)
 ![Docker Pulls](https://img.shields.io/docker/pulls/maximhq/bifrost)

core/bifrost.go

@@ -33,6 +33,7 @@ import (
 	"github.com/maximhq/bifrost/core/providers/gemini"
 	"github.com/maximhq/bifrost/core/providers/groq"
 	"github.com/maximhq/bifrost/core/providers/huggingface"
+	"github.com/maximhq/bifrost/core/providers/minimax"
 	"github.com/maximhq/bifrost/core/providers/mistral"
 	"github.com/maximhq/bifrost/core/providers/nebius"
 	"github.com/maximhq/bifrost/core/providers/ollama"
@@ -4267,6 +4268,8 @@ func (bifrost *Bifrost) createBaseProvider(providerKey schemas.ModelProvider, co
 		return perplexity.NewPerplexityProvider(config, bifrost.logger)
 	case schemas.Cerebras:
 		return cerebras.NewCerebrasProvider(config, bifrost.logger)
+	case schemas.Minimax:
+		return minimax.NewMinimaxProvider(config, bifrost.logger)
 	case schemas.DeepSeek:
 		return deepseek.NewDeepSeekProvider(config, bifrost.logger)
 	case schemas.Gemini:
@@ -7951,6 +7954,18 @@ func (bifrost *Bifrost) drainQueueWithErrors(pq *ProviderQueue) {
 
 // releaseChannelMessage returns a ChannelMessage and its channels to their respective pools.
 func (bifrost *Bifrost) releaseChannelMessage(msg *ChannelMessage) {
+	// Drain any undelivered values before pooling so an idle pooled channel
+	// doesn't pin a full response/error until its next reuse. getChannelMessage
+	// drains again on acquire as defense in depth.
+	select {
+	case <-msg.Response:
+	default:
+	}
+	select {
+	case <-msg.Err:
+	default:
+	}
+
 	// Put channels back in pools
 	bifrost.responseChannelPool.Put(msg.Response)
 	bifrost.errorChannelPool.Put(msg.Err)
@@ -7965,9 +7980,17 @@ func (bifrost *Bifrost) releaseChannelMessage(msg *ChannelMessage) {
 		bifrost.responseStreamPool.Put(msg.ResponseStream)
 	}
 
-	// Release of Bifrost Request is handled in handle methods as they are required for fallbacks
+	// Release of the pooled *BifrostRequest object is handled in handle methods
+	// as it is required for fallbacks; msg.BifrostRequest is a value copy, so
+	// zeroing it here only drops this message's references.
 
-	// Clear references and return to pool
+	// Clear all references before returning to the pool. The embedded
+	// BifrostRequest holds pointers to the fully parsed request body and
+	// Context holds per-request user values; leaving them set pins those
+	// allocations for as long as the message sits idle in the pool.
+	// getChannelMessage overwrites both on acquire.
+	msg.BifrostRequest = schemas.BifrostRequest{}
+	msg.Context = nil
 	msg.Response = nil
 	msg.ResponseStream = nil
 	msg.Err = nil