Summary

• Add canonical key presets for SambaNova Cloud and Nebius Token Factory, the next same-shape batch under umbrella issue [Provider] Promote a verified batch of OpenAI-compatible inference providers #572.
• Pin registry-owned model discovery to each provider's first-party HTTPS API host while preserving an older same-named custom provider's destination and adapter.
• Keep discovery bounded and fixture-tested:
  • SambaNova: GET https://api.sambanova.ai/v1/models, 128 KiB / 128 raw rows.
  • Nebius: authenticated GET https://api.tokenfactory.nebius.com/v1/models?verbose=true, 512 KiB / 512 raw rows, retaining only architecture.modality values that produce text.
• Preserve native slash-containing ids and consume Nebius context-window, feature, and safe input-modality metadata.
• Update the provider directory and all five documentation locales; registry totals are now 71 presets / 60 key presets.

Relates to #572. This PR intentionally does not close the umbrella issue.

Canonical preset evidence

Maintenance owner: @olddonkey. No affiliation with either provider.

Verification date: 2026-08-02.

SambaNova's models catalog is currently public: the key-login probe verifies the canonical endpoint/catalog is reachable, but that public response alone cannot prove a supplied key is valid. Chat requests still authenticate with the configured Bearer key.

The shared apiKeyValidation: "unknown" contract is inherited from merged PR #923; this PR only opts the SambaNova registry entry into that policy and retains the provider regression test.

Security and compatibility

• These presets create new credential destinations, so explicit maintainer security review is requested.
• Discovery policy stays registry-only and is not copied into config.json or the key-login map.
• preserveCustomDestination prevents an existing same-named custom provider from silently sending its stored key to a newly canonical host.
• Existing redirect denial and bounded-before-parse discovery behavior are retained.
• Renamed canonical presets recover discovery policy only through an exact fixed-key baseUrl + adapter match; custom endpoints, OAuth rows, templates, and overridable destinations do not inherit it.
• Shared text-generation APIs only; private SambaStudio and dedicated Nebius deployment hosts are out of scope.
• Parallel tool calls are conservatively disabled: SambaNova documents them as unsupported, while Nebius's public tools contract does not establish parallel execution.

Verification

• bun run typecheck
• bun test tests/sambanova-nebius-provider.test.ts tests/provider-model-discovery-contract.test.ts tests/provider-registry-parity.test.ts
• bun run test — 7600 pass, 8 skip, 0 fail
• bun run privacy:scan
• cd docs-site && bun run build
• git diff --check

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs were updated in English, Japanese, Korean, Russian, and Simplified Chinese.
• Security-sensitive behavior was author-reviewed for secrets, auth, redirects, and unsafe destination changes.
• Explicit maintainer security sign-off (required by MAINTAINERS.md).

Summary by CodeRabbit

• New Features

  • Added SambaNova Cloud and Nebius Token Factory as built-in provider presets.
  • Expanded provider setup to 71 presets with live model discovery, filtering, authentication, and custom destination support.
  • Improved detection of text, image, and audio inputs from model metadata.
  • Disabled unsupported parallel tool calls for the new providers.

• Documentation

  • Updated quickstart and provider guides in five languages with provider capabilities, limits, endpoints, authentication, and discovery details.