feat(providers): add SambaNova and Nebius presets

[olddonkey]

Summary

• Add canonical key presets for SambaNova Cloud and Nebius Token Factory, the next same-shape batch under umbrella issue [Provider] Promote a verified batch of OpenAI-compatible inference providers #572.
• Pin registry-owned model discovery to each provider's first-party HTTPS API host while preserving an older same-named custom provider's destination and adapter.
• Keep discovery bounded and fixture-tested:
  • SambaNova: GET https://api.sambanova.ai/v1/models, 128 KiB / 128 raw rows.
  • Nebius: authenticated GET https://api.tokenfactory.nebius.com/v1/models?verbose=true, 512 KiB / 512 raw rows, retaining only architecture.modality values that produce text.
• Preserve native slash-containing ids and consume Nebius context-window, feature, and safe input-modality metadata.
• Update the provider directory and all five documentation locales; registry totals are now 71 presets / 60 key presets.

Relates to #572. This PR intentionally does not close the umbrella issue.

Canonical preset evidence

Provider	Evidence
SambaNova Cloud	First-party API host and Bearer-key setup: API keys and URLs; OpenAI compatibility; function calling. The service terms identify SambaNova Systems, Inc. and permit customer/authorized-user service use while excluding resale: SambaCloud agreement.
Nebius Token Factory	First-party Bearer-key quickstart and authenticated verbose catalog: quickstart, models.list, function calling. The terms identify Nebius B.V. and expressly permit incorporating the service into a Customer Product for End Users: terms.

Maintenance owner: @olddonkey. No affiliation with either provider.

Verification date: 2026-08-02.

SambaNova's models catalog is currently public: the key-login probe verifies the canonical endpoint/catalog is reachable, but that public response alone cannot prove a supplied key is valid. Chat requests still authenticate with the configured Bearer key.

The shared apiKeyValidation: "unknown" contract is inherited from merged PR #923; this PR only opts the SambaNova registry entry into that policy and retains the provider regression test.

Security and compatibility

• These presets create new credential destinations, so explicit maintainer security review is requested.
• Discovery policy stays registry-only and is not copied into config.json or the key-login map.
• preserveCustomDestination prevents an existing same-named custom provider from silently sending its stored key to a newly canonical host.
• Existing redirect denial and bounded-before-parse discovery behavior are retained.
• Renamed canonical presets recover discovery policy only through an exact fixed-key baseUrl + adapter match; custom endpoints, OAuth rows, templates, and overridable destinations do not inherit it.
• Shared text-generation APIs only; private SambaStudio and dedicated Nebius deployment hosts are out of scope.
• Parallel tool calls are conservatively disabled: SambaNova documents them as unsupported, while Nebius's public tools contract does not establish parallel execution.

Verification

• bun run typecheck
• bun test tests/sambanova-nebius-provider.test.ts tests/provider-model-discovery-contract.test.ts tests/provider-registry-parity.test.ts
• bun run test — 7600 pass, 8 skip, 0 fail
• bun run privacy:scan
• cd docs-site && bun run build
• git diff --check

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs were updated in English, Japanese, Korean, Russian, and Simplified Chinese.
• Security-sensitive behavior was author-reviewed for secrets, auth, redirects, and unsafe destination changes.
• Explicit maintainer security sign-off (required by MAINTAINERS.md).

Summary by CodeRabbit

• New Features

  • Added SambaNova Cloud and Nebius Token Factory as built-in provider presets.
  • Expanded provider setup to 71 presets with live model discovery, filtering, authentication, and custom destination support.
  • Improved detection of text, image, and audio inputs from model metadata.
  • Disabled unsupported parallel tool calls for the new providers.

• Documentation

  • Updated quickstart and provider guides in five languages with provider capabilities, limits, endpoints, authentication, and discovery details.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Added SambaNova Cloud and Nebius Token Factory provider presets with live model discovery, filtering, routing, authentication, modality handling, tests, and localized documentation.

Changes

Provider support

Layer / File(s)	Summary
Architecture modality inference src/codex/catalog/provider-fetch.ts, tests/provider-model-discovery-contract.test.ts	Discovery parses input modalities from architecture.modality values and validates unsupported or unsafe metadata.
Provider registry and directory wiring src/providers/registry.ts, src/providers/free-directory.ts, tests/provider-registry-parity.test.ts	Added SambaNova Cloud and Nebius Token Factory presets with bounded discovery, authentication, routing, metadata, and disabled parallel tool calls.
Destination-based discovery resolution src/providers/model-discovery.ts, tests/provider-model-discovery-contract.test.ts, tests/sambanova-nebius-provider.test.ts	Discovery resolves registry metadata from provider destinations and preserves canonical discovery settings for renamed presets.
Provider routing and discovery validation tests/fixtures/*.json, tests/sambanova-nebius-provider.test.ts	Added fixture-backed coverage for model discovery, filtering, metadata, endpoint authentication, routing, initialization, tool settings, and custom-provider preservation.
Provider catalog documentation docs-site/src/content/docs/**	Updated preset counts and documented both providers across English, Japanese, Korean, Russian, and Simplified Chinese locales.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

• [Provider] Promote a verified batch of OpenAI-compatible inference providers #572 — Promotes SambaNova Cloud and Nebius Token Factory to first-class providers with registry, discovery, test, and documentation support.

Possibly related PRs

• lidge-jun/opencodex#406 — Introduces related provider model-discovery metadata and live discovery flow.
• lidge-jun/opencodex#652 — Adds bounded model-discovery infrastructure used by these provider entries.
• lidge-jun/opencodex#751 — Adds comparable provider presets with discovery, routing tests, and fixtures.

Suggested reviewers: ingwannu, lidge-jun, wibias

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ProviderRegistry
  participant ModelDiscovery
  participant ProviderAPI

  Client->>ProviderRegistry: select SambaNova or Nebius
  ProviderRegistry->>ModelDiscovery: apply endpoint and filtering rules
  ModelDiscovery->>ProviderAPI: fetch provider model catalog
  ProviderAPI-->>ModelDiscovery: return model metadata
  ModelDiscovery-->>ProviderRegistry: return filtered models and modalities
  ProviderRegistry-->>Client: route requests with provider credentials

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: adding SambaNova and Nebius provider presets.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs-site/src/content/docs/guides/providers.md`:
- Around line 263-267: Use the canonical provider name “SambaNova Cloud” in the
discovery paragraphs at docs-site/src/content/docs/guides/providers.md:263-267,
docs-site/src/content/docs/ja/guides/providers.md:186-190,
docs-site/src/content/docs/ko/guides/providers.md:185-188,
docs-site/src/content/docs/ru/guides/providers.md:195-199, and
docs-site/src/content/docs/zh-cn/guides/providers.md:174-177, replacing
“SambaCloud” while preserving the surrounding content.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 166f3977-fc25-44f9-a43f-bacb1df2498e

📥 Commits

Reviewing files that changed from the base of the PR and between 6edec46 and 42d08ac.

📒 Files selected for processing (18)

• docs-site/src/content/docs/getting-started/quickstart.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/getting-started/quickstart.md
• docs-site/src/content/docs/ja/guides/providers.md
• docs-site/src/content/docs/ko/getting-started/quickstart.md
• docs-site/src/content/docs/ko/guides/providers.md
• docs-site/src/content/docs/ru/getting-started/quickstart.md
• docs-site/src/content/docs/ru/guides/providers.md
• docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
• docs-site/src/content/docs/zh-cn/guides/providers.md
• src/codex/catalog/provider-fetch.ts
• src/providers/free-directory.ts
• src/providers/registry.ts
• tests/fixtures/nebius-models.json
• tests/fixtures/sambanova-models.json
• tests/provider-model-discovery-contract.test.ts
• tests/provider-registry-parity.test.ts
• tests/sambanova-nebius-provider.test.ts

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 42d08ac5a0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs-site/src/content/docs/ja/getting-started/quickstart.md`:
- Around line 16-17: Update the Japanese setup step in the quickstart so it uses
“71 個の組み込みレジストリプリセット” and places “ベース URL とアダプター” before “入力します”, preserving the
English source meaning and natural Japanese grammar.

In `@src/providers/free-directory.ts`:
- Line 135: Add a modelsUrl property to the nebius entry in the provider
directory, using the discovery URL
https://api.tokenfactory.nebius.com/v1/models?verbose=true with the required
verbose=true query parameter, consistent with the modelDiscovery configuration
and the SambaNova entry.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a06896d4-b5e7-47ee-a497-c59b14199378

📥 Commits

Reviewing files that changed from the base of the PR and between 0c41341 and 1213c09.

📒 Files selected for processing (18)

• docs-site/src/content/docs/getting-started/quickstart.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/getting-started/quickstart.md
• docs-site/src/content/docs/ja/guides/providers.md
• docs-site/src/content/docs/ko/getting-started/quickstart.md
• docs-site/src/content/docs/ko/guides/providers.md
• docs-site/src/content/docs/ru/getting-started/quickstart.md
• docs-site/src/content/docs/ru/guides/providers.md
• docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
• docs-site/src/content/docs/zh-cn/guides/providers.md
• src/codex/catalog/provider-fetch.ts
• src/providers/free-directory.ts
• src/providers/registry.ts
• tests/fixtures/nebius-models.json
• tests/fixtures/sambanova-models.json
• tests/provider-model-discovery-contract.test.ts
• tests/provider-registry-parity.test.ts
• tests/sambanova-nebius-provider.test.ts

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1213c092b9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/providers/model-discovery.ts`:
- Around line 128-134: Restrict the fallback in model-discovery.ts around
getProviderRegistryEntry and registryEntryForProviderDestination so
destination-based discovery is used only when the provider name is unknown;
known names with a transport mismatch must return no registry discovery spec.
Add focused regression coverage in tests/sambanova-nebius-provider.test.ts at
lines 278-303 using a sambanova-named Nebius-endpoint configuration and assert
it does not inherit Nebius discovery metadata.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d9fce4c7-3b48-4578-aac3-a7442cc34a80

📥 Commits

Reviewing files that changed from the base of the PR and between 51cb9d1 and 7baee6e.

📒 Files selected for processing (5)

• docs-site/src/content/docs/ja/getting-started/quickstart.md
• src/providers/free-directory.ts
• src/providers/model-discovery.ts
• tests/provider-model-discovery-contract.test.ts
• tests/sambanova-nebius-provider.test.ts

[olddonkey]

Author update — current head b454bbad

All review feedback received through this revision has been addressed:

• Restacked onto current dev; the shared public-catalog key-validation contract is inherited from merged feat(providers): add Command Code preset with live model discovery #923 rather than duplicated.
• SambaNova key validation now reports unknown for its public catalog, and both providers conservatively disable unverified reasoning controls.
• Canonical naming, the Japanese quickstart wording, and Nebius's modelsUrl (including verbose=true) are synchronized.
• Renamed canonical presets recover discovery only for an unknown provider name with an exact fixed-key baseUrl + adapter match. A known preset name with any transport mismatch remains custom and cannot inherit another preset's URL, query, or filter.
• Every review thread is resolved.

Validation: bun run typecheck; 61 focused tests; full suite 7600 pass / 8 skip / 0 fail; privacy scan; 216-page docs build; git diff --check.

This PR is Ready for review. Explicit maintainer security sign-off remains requested because it adds canonical credential destinations. It relates to #572 and does not close the umbrella issue.