[aiapienthusiast]

Summary

This PR adds Cheaper Inference as an inference provider for scans.
It uses the same pattern as the OpenRouter and Fireworks AI providers (#245).

Cheaper Inference is an OpenAI-compatible LLM gateway.
One API key gives access to models from several labs.

Usage:

export CHEAPER_INFERENCE_API_KEY="<your-cheaper-inference-api-key>"
codex-security scan . --provider cheaperinference --model gpt-5.4

Changes

• Add CHEAPERINFERENCE_CODEX_PROVIDER to EXTERNAL_CODEX_PROVIDERS (Responses wire API).
• Public CLI change: --provider accepts the new value cheaperinference. The default stays openai.
• Treat CHEAPER_INFERENCE_API_KEY like the other external provider keys (selection, isolation, plugin helper secrets, MCP env passthrough).
• Update the README, CLI docs, and Bedrock QA unset line.

Details

Files:

• sdk/typescript/src/config.ts, cli.ts, api.ts, runtime.ts
• plugins/codex-security/.mcp.json, plugins/codex-security/mcp-app/tests/test_mcp_app_smoke.ts
• README.md, sdk/typescript/docs/cli.md, docs/bedrock.md
• Tests: api-preflight-config, api, api-events, cli, runtime (new provider rows in the existing provider tables)

Testing

• tsc --noEmit (SDK and MCP app): pass.
• pnpm run build:ci: pass.
• prettier --check on changed files and node scripts/check-markdown.mjs: pass.
• node .github/scripts/check_plugin_source_compatibility.mjs and its node --test suite: pass.
• bun test on the five changed SDK test files: the new rows pass where the OpenRouter and Fireworks rows pass. Tests that need _bundled_plugin fail the same way on main without the native payload.
• Live check: gpt-5.4-mini returned a reply through the Codex SDK with EXTERNAL_CODEX_PROVIDERS.cheaperinference as the model provider.

Risk and rollout

Additive change.
Existing providers and defaults do not change.
The new key is only read when --provider cheaperinference is selected.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

The new provider uses the existing explicit provider/model selection and credential-isolation paths. The preset matches the provider's documented Responses API, and synthetic checks cover API-key selection, MCP forwarding, and fresh/resumed Deep Scan workers without changing the default provider. I found no actionable correctness or simplification issues.