Skip to content

feat(providers): add SambaNova and Nebius presets - #870

Merged
lidge-jun merged 3 commits into
lidge-jun:devfrom
olddonkey:codex/572-sambanova-nebius-model-apis
Aug 6, 2026
Merged

feat(providers): add SambaNova and Nebius presets#870
lidge-jun merged 3 commits into
lidge-jun:devfrom
olddonkey:codex/572-sambanova-nebius-model-apis

Conversation

@olddonkey

@olddonkey olddonkey commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add canonical key presets for SambaNova Cloud and Nebius Token Factory, the next same-shape batch under umbrella issue [Provider] Finish remaining OpenAI-compatible provider batch: Chutes, Featherless, Novita #572.
  • Pin registry-owned model discovery to each provider's first-party HTTPS API host while preserving an older same-named custom provider's destination and adapter.
  • Keep discovery bounded and fixture-tested:
    • SambaNova: GET https://api.sambanova.ai/v1/models, 128 KiB / 128 raw rows.
    • Nebius: authenticated GET https://api.tokenfactory.nebius.com/v1/models?verbose=true, 512 KiB / 512 raw rows, retaining only architecture.modality values that produce text.
  • Preserve native slash-containing ids and consume Nebius context-window, feature, and safe input-modality metadata.
  • Update the provider directory and all five documentation locales; registry totals are now 71 presets / 60 key presets.

Relates to #572. This PR intentionally does not close the umbrella issue.

Canonical preset evidence

Provider Evidence
SambaNova Cloud First-party API host and Bearer-key setup: API keys and URLs; OpenAI compatibility; function calling. The service terms identify SambaNova Systems, Inc. and permit customer/authorized-user service use while excluding resale: SambaCloud agreement.
Nebius Token Factory First-party Bearer-key quickstart and authenticated verbose catalog: quickstart, models.list, function calling. The terms identify Nebius B.V. and expressly permit incorporating the service into a Customer Product for End Users: terms.

Maintenance owner: @olddonkey. No affiliation with either provider.

Verification date: 2026-08-02.

SambaNova's models catalog is currently public: the key-login probe verifies the canonical endpoint/catalog is reachable, but that public response alone cannot prove a supplied key is valid. Chat requests still authenticate with the configured Bearer key.

The shared apiKeyValidation: "unknown" contract is inherited from merged PR #923; this PR only opts the SambaNova registry entry into that policy and retains the provider regression test.

Security and compatibility

  • These presets create new credential destinations, so explicit maintainer security review is requested.
  • Discovery policy stays registry-only and is not copied into config.json or the key-login map.
  • preserveCustomDestination prevents an existing same-named custom provider from silently sending its stored key to a newly canonical host.
  • Existing redirect denial and bounded-before-parse discovery behavior are retained.
  • Renamed canonical presets recover discovery policy only through an exact fixed-key baseUrl + adapter match; custom endpoints, OAuth rows, templates, and overridable destinations do not inherit it.
  • Shared text-generation APIs only; private SambaStudio and dedicated Nebius deployment hosts are out of scope.
  • Parallel tool calls are conservatively disabled: SambaNova documents them as unsupported, while Nebius's public tools contract does not establish parallel execution.

Verification

  • bun run typecheck
  • bun test tests/sambanova-nebius-provider.test.ts tests/provider-model-discovery-contract.test.ts tests/provider-registry-parity.test.ts
  • bun run test — 8343 pass, 8 skip, 0 fail
  • bun run privacy:scan
  • cd docs-site && bun run build
  • git diff --check

Checklist

  • Scope stays focused and avoids unrelated cleanup.
  • Docs were updated in English, Japanese, Korean, Russian, and Simplified Chinese.
  • Security-sensitive behavior was author-reviewed for secrets, auth, redirects, and unsafe destination changes.
  • Explicit maintainer security sign-off (required by MAINTAINERS.md).

Summary by CodeRabbit

  • New Features

    • Added SambaNova Cloud and Nebius Token Factory as built-in providers.
    • Expanded the catalog to 72 presets, including live model discovery, filtering, authentication, and custom destination support.
    • Added Command Code browser OAuth login.
    • Improved detection of text, image, and audio inputs from model metadata.
    • Disabled unsupported parallel tool calls for the new providers.
  • Documentation

    • Updated quickstart and provider guides in five languages with provider capabilities, limits, endpoints, authentication, and discovery details.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

  • All CI tests are green on my local testing.

  • I pushed my PR to the latest dev commit.

  • I resolved all correct Codex and CodeRabbit findings.

  • My PR is ready for review.

@github-actions github-actions Bot added the enhancement New feature or request label Aug 2, 2026
@coderabbitai

coderabbitai Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 214004c8-c279-4c43-9579-259abe3cfb07

📥 Commits

Reviewing files that changed from the base of the PR and between efdfd1c and 4c9c64b.

📒 Files selected for processing (19)
  • docs-site/src/content/docs/getting-started/quickstart.md
  • docs-site/src/content/docs/guides/providers.md
  • docs-site/src/content/docs/ja/getting-started/quickstart.md
  • docs-site/src/content/docs/ja/guides/providers.md
  • docs-site/src/content/docs/ko/getting-started/quickstart.md
  • docs-site/src/content/docs/ko/guides/providers.md
  • docs-site/src/content/docs/ru/getting-started/quickstart.md
  • docs-site/src/content/docs/ru/guides/providers.md
  • docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
  • docs-site/src/content/docs/zh-cn/guides/providers.md
  • src/codex/catalog/provider-fetch.ts
  • src/providers/free-directory.ts
  • src/providers/model-discovery.ts
  • src/providers/registry.ts
  • tests/fixtures/nebius-models.json
  • tests/fixtures/sambanova-models.json
  • tests/provider-model-discovery-contract.test.ts
  • tests/provider-registry-parity.test.ts
  • tests/sambanova-nebius-provider.test.ts

📝 Walkthrough

Walkthrough

Added SambaNova Cloud and Nebius Token Factory provider presets with live model discovery, filtering, routing, authentication, modality handling, tests, and localized documentation.

Changes

Provider support

Layer / File(s) Summary
Architecture modality inference
src/codex/catalog/provider-fetch.ts, tests/provider-model-discovery-contract.test.ts
Discovery parses input modalities from architecture.modality values and validates unsupported or unsafe metadata.
Provider registry and directory wiring
src/providers/registry.ts, src/providers/free-directory.ts, tests/provider-registry-parity.test.ts
Added SambaNova Cloud and Nebius Token Factory presets with bounded discovery, authentication, routing, metadata, and disabled parallel tool calls.
Destination-based discovery resolution
src/providers/model-discovery.ts, tests/provider-model-discovery-contract.test.ts
Discovery resolves registry metadata from provider destinations and preserves canonical discovery settings for renamed presets.
Provider routing and discovery validation
tests/fixtures/*.json, tests/sambanova-nebius-provider.test.ts
Added fixture-backed coverage for model discovery, filtering, metadata, endpoint authentication, routing, initialization, tool settings, and custom-provider preservation.
Provider catalog documentation
docs-site/src/content/docs/**
Updated preset counts and documented both providers across English, Japanese, Korean, Russian, and Simplified Chinese locales.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

Possibly related PRs

  • lidge-jun/opencodex#358 — Modifies provider model-discovery parsing and resolution behavior in related code paths.
  • lidge-jun/opencodex#652 — Provides related bounded and filtered model-discovery infrastructure.
  • lidge-jun/opencodex#751 — Adds comparable API-key provider presets with discovery, routing tests, fixtures, and documentation updates.

Suggested reviewers: lidge-jun, wibias, ingwannu

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ProviderRegistry
  participant ModelDiscovery
  participant ProviderAPI

  Client->>ProviderRegistry: select SambaNova or Nebius
  ProviderRegistry->>ModelDiscovery: apply endpoint and filtering rules
  ModelDiscovery->>ProviderAPI: fetch provider model catalog
  ProviderAPI-->>ModelDiscovery: return model metadata
  ModelDiscovery-->>ProviderRegistry: return filtered models and modalities
  ProviderRegistry-->>Client: route requests with provider credentials
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely identifies the primary change: adding SambaNova and Nebius provider presets.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs-site/src/content/docs/guides/providers.md`:
- Around line 263-267: Use the canonical provider name “SambaNova Cloud” in the
discovery paragraphs at docs-site/src/content/docs/guides/providers.md:263-267,
docs-site/src/content/docs/ja/guides/providers.md:186-190,
docs-site/src/content/docs/ko/guides/providers.md:185-188,
docs-site/src/content/docs/ru/guides/providers.md:195-199, and
docs-site/src/content/docs/zh-cn/guides/providers.md:174-177, replacing
“SambaCloud” while preserving the surrounding content.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 166f3977-fc25-44f9-a43f-bacb1df2498e

📥 Commits

Reviewing files that changed from the base of the PR and between 6edec46 and 42d08ac.

📒 Files selected for processing (18)
  • docs-site/src/content/docs/getting-started/quickstart.md
  • docs-site/src/content/docs/guides/providers.md
  • docs-site/src/content/docs/ja/getting-started/quickstart.md
  • docs-site/src/content/docs/ja/guides/providers.md
  • docs-site/src/content/docs/ko/getting-started/quickstart.md
  • docs-site/src/content/docs/ko/guides/providers.md
  • docs-site/src/content/docs/ru/getting-started/quickstart.md
  • docs-site/src/content/docs/ru/guides/providers.md
  • docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
  • docs-site/src/content/docs/zh-cn/guides/providers.md
  • src/codex/catalog/provider-fetch.ts
  • src/providers/free-directory.ts
  • src/providers/registry.ts
  • tests/fixtures/nebius-models.json
  • tests/fixtures/sambanova-models.json
  • tests/provider-model-discovery-contract.test.ts
  • tests/provider-registry-parity.test.ts
  • tests/sambanova-nebius-provider.test.ts

Comment thread docs-site/src/content/docs/guides/providers.md Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 42d08ac5a0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/providers/registry.ts
Comment thread src/providers/registry.ts

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs-site/src/content/docs/ja/getting-started/quickstart.md`:
- Around line 16-17: Update the Japanese setup step in the quickstart so it uses
“71 個の組み込みレジストリプリセット” and places “ベース URL とアダプター” before “入力します”, preserving the
English source meaning and natural Japanese grammar.

In `@src/providers/free-directory.ts`:
- Line 135: Add a modelsUrl property to the nebius entry in the provider
directory, using the discovery URL
https://api.tokenfactory.nebius.com/v1/models?verbose=true with the required
verbose=true query parameter, consistent with the modelDiscovery configuration
and the SambaNova entry.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a06896d4-b5e7-47ee-a497-c59b14199378

📥 Commits

Reviewing files that changed from the base of the PR and between 0c41341 and 1213c09.

📒 Files selected for processing (18)
  • docs-site/src/content/docs/getting-started/quickstart.md
  • docs-site/src/content/docs/guides/providers.md
  • docs-site/src/content/docs/ja/getting-started/quickstart.md
  • docs-site/src/content/docs/ja/guides/providers.md
  • docs-site/src/content/docs/ko/getting-started/quickstart.md
  • docs-site/src/content/docs/ko/guides/providers.md
  • docs-site/src/content/docs/ru/getting-started/quickstart.md
  • docs-site/src/content/docs/ru/guides/providers.md
  • docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
  • docs-site/src/content/docs/zh-cn/guides/providers.md
  • src/codex/catalog/provider-fetch.ts
  • src/providers/free-directory.ts
  • src/providers/registry.ts
  • tests/fixtures/nebius-models.json
  • tests/fixtures/sambanova-models.json
  • tests/provider-model-discovery-contract.test.ts
  • tests/provider-registry-parity.test.ts
  • tests/sambanova-nebius-provider.test.ts

Comment thread docs-site/src/content/docs/ja/getting-started/quickstart.md Outdated
Comment thread src/providers/free-directory.ts Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1213c092b9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/providers/registry.ts
@olddonkey
olddonkey force-pushed the codex/572-sambanova-nebius-model-apis branch 2 times, most recently from 51cb9d1 to 7baee6e Compare August 3, 2026 08:22

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/providers/model-discovery.ts`:
- Around line 128-134: Restrict the fallback in model-discovery.ts around
getProviderRegistryEntry and registryEntryForProviderDestination so
destination-based discovery is used only when the provider name is unknown;
known names with a transport mismatch must return no registry discovery spec.
Add focused regression coverage in tests/sambanova-nebius-provider.test.ts at
lines 278-303 using a sambanova-named Nebius-endpoint configuration and assert
it does not inherit Nebius discovery metadata.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d9fce4c7-3b48-4578-aac3-a7442cc34a80

📥 Commits

Reviewing files that changed from the base of the PR and between 51cb9d1 and 7baee6e.

📒 Files selected for processing (5)
  • docs-site/src/content/docs/ja/getting-started/quickstart.md
  • src/providers/free-directory.ts
  • src/providers/model-discovery.ts
  • tests/provider-model-discovery-contract.test.ts
  • tests/sambanova-nebius-provider.test.ts

Comment thread src/providers/model-discovery.ts Outdated
@olddonkey
olddonkey force-pushed the codex/572-sambanova-nebius-model-apis branch from 7baee6e to b454bba Compare August 3, 2026 08:53

Copy link
Copy Markdown
Contributor Author

Author update — current head b454bbad

All review feedback received through this revision has been addressed:

  • Restacked onto current dev; the shared public-catalog key-validation contract is inherited from merged feat(providers): add Command Code preset with live model discovery #923 rather than duplicated.
  • SambaNova key validation now reports unknown for its public catalog, and both providers conservatively disable unverified reasoning controls.
  • Canonical naming, the Japanese quickstart wording, and Nebius's modelsUrl (including verbose=true) are synchronized.
  • Renamed canonical presets recover discovery only for an unknown provider name with an exact fixed-key baseUrl + adapter match. A known preset name with any transport mismatch remains custom and cannot inherit another preset's URL, query, or filter.
  • Every review thread is resolved.

Validation: bun run typecheck; 61 focused tests; full suite 7600 pass / 8 skip / 0 fail; privacy scan; 216-page docs build; git diff --check.

This PR is Ready for review. Explicit maintainer security sign-off remains requested because it adds canonical credential destinations. It relates to #572 and does not close the umbrella issue.

@Wibias

Wibias commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator

[GD] Verdict: changes-requested

PR: #870 - feat(providers): add SambaNova and Nebius presets
Head: b454bbad on dev (mergeStateStatus: UNSTABLE, mergeable, not draft)

Semantic propagation

  • Concepts audited: provider preset catalog (sambanova/nebius); registry-owned discovery policy; key-validation policy; reasoning-effort default; parallel-tool-call default; input-modality inference; discovery bounds; docs totals (71/60).
  • Authoritative sources: src/providers/registry.ts entries + ProviderModelDiscoverySpec validation; tests/provider-registry-parity.test.ts; MAINTAINERS.md preset evidence bar.
  • Producers/consumers checked: src/providers/derive.ts seeds, src/router.ts backfill, src/oauth/index.ts buildModelsRequest, src/oauth/key-providers.ts validateApiKey, src/codex/catalog/provider-fetch.ts catalog hints, src/server/auth-cors.ts note resolution, src/providers/free-directory.ts rows and label map.
  • Public/derived representations checked: all five doc locales (totals 71/60, base URLs, dashboard URLs, discovery caps), KEY_LOGIN_PROVIDERS, FREE_PROVIDER_DIRECTORY modelsUrl.
  • Material variant partitions: canonical vs renamed preset (nebius-team), known-name transport mismatch (sambanova at the Nebius endpoint), custom destinations, OAuth/adapter rows.
  • Positive/negative assertions: fixtures keep text rows and drop embedding/image rows; slash-containing ids preserved through discovery and routing; no reasoning_effort sent; parallel_tool_calls: false; SambaNova's public catalog never proves a key (validation short-circuits, no fetch).
  • Unmapped surfaces: none (repo-wide rg for sambanova/nebius, modelsUrl, lastVerified, and preset counts in gui/tests/docs completed).
  • Unproven equivalence assumptions: none - the new parity test loops every discovery-bearing fixed-key registry entry.
  • Representation mismatches: minor - src/providers/free-directory.ts label map still shows Nebius (registry: Nebius Token Factory) and sambanova falls back to Sambanova; lastVerified: 2026-08-01 vs PR-body 2026-08-02.
  • Variant coverage gaps: none blocking (live Nebius catalog casing cannot be probed without a key; fails closed if it ever differs).
  • Axis verdict: pass

Linked: none (relates to #572; umbrella intentionally not closed; issue #870 is the same-title tracking issue)

Usefulness

Real value: two widely used first-party providers become canonical key presets with registry-owned discovery, correct key-validation semantics, conservative reasoning/parallel-tool defaults, and documentation parity across five locales. Matches the next same-shape batch under #572.

Bugs / correctness

  • Method: bug-review.md - Bugbot: n/a (Codex host, no Cursor Bugbot); complementary: done (silent_failures, resource_leaks, edge_cases, network_cancellation, error_propagation, parsing_serialization, concurrency, state_consistency).
  • Findings: none blocking. Residual/info:
    • src/providers/registry.ts Nebius filter comment says text- and vision-input rows, but containsAny: ["->text"] also keeps audio->text and multi-hop strings - comment vs behavior mismatch (behavior itself is conservative).
    • src/codex/catalog/provider-fetch.ts modelInputModalities: an image->text row would report ["image"] without text; the closed enum is valid, but fixtures do not cover that shape.
    • The Nebius filter is case-sensitive (->text); the fixture matches the captured lowercase catalog. If casing ever changes, discovery fails closed to an empty authoritative catalog.
  • Fixed this session: none (foreign PR; no edits made).

Security

  • Scope reviewed (per security-scope.mjs): authn, authz, secrets/config, SSRF/outbound, credential destinations, logging/privacy, supply chain, AI/agent surface (ai-agent-security loaded), removed controls.
  • Findings: none confirmed. Controls verified: validateApiKey returns unknown for SambaNova without issuing a probe; the Nebius probe is authenticated with redirect: "error"; discovery stays registry-only (never seeded into config.json or the key-login map); renamed presets recover discovery only via an exact fixed-key baseUrl + adapter match; outbound discovery GETs deny redirects and pin public addresses; catalog metadata is parsed under strict bounds (control chars, length caps, closed enums).
  • Decision: Pass - the MAINTAINERS.md credential-destination evidence bar is met (documented endpoints, terms/legal entity, named maintenance owner, verification date). Formal maintainer security sign-off remains required by repo policy before merge.
  • Fixed this session: none.

Spec / standards

  • Spec source: PR body + umbrella #572.
  • Gaps: none blocking. Minor: docs do not mention that SambaNova keys are reported unverifiable (Command Code's note does); PR-body verification date (2026-08-02) differs from lastVerified: 2026-08-01.
  • Standards: repo AGENTS.md, MAINTAINERS.md, structure/00_overview.md ADR precedent, advisory code-smell baseline. No violations; both entries follow the existing commandcode pattern (apiKeyValidation, reasoningEfforts: [], preserveCustomDestination).

Reviews

  • Owners/maintainers: no open human threads.
  • Bots (CodeRabbit/Codex): all 7 threads resolved on head b454bbad; fixes verified against code (canonical name, unknown key validation, reasoningEfforts: [], Japanese wording, modelsUrl incl. verbose=true, renamed-preset policy, destination-fallback restriction).

Base / CI

  • Behind/conflicts: no conflicts (MERGEABLE), but owner action: update from dev - head was restacked at 08:49Z, dev moved to e337390e at 20:28Z, and the head is 134 commits behind current dev (GitHub baseRefOid still 6a7351b4).
  • Required checks: green on head (enforce-target, label, CodeRabbit).
  • Local tip compile/tests: bun run typecheck pass; focused provider tests 61 pass / 0 fail; full bun run test 7502 pass / 20 fail / 6 errors - every failure reproduces on base tip e337390e (Windows symlink EPERM + one base parity failure), none PR-caused; bun run privacy:scan pass; docs build 216 pages pass; git diff --check clean.

Simplification (for the PR owner)

Nothing structural worth changing. Optional micro-candidates (behavior-preserving; not applied - foreign PR):

  1. src/codex/catalog/provider-fetch.ts (~L370): if (inferred && inferred.length > 0) - inferred is always an array after split("->"), so the truthiness guard is dead; if (inferred.length > 0) suffices. Risk: negligible. Validation: tests/provider-model-discovery-contract.test.ts modality test.
  2. src/providers/registry.ts (Nebius modelDiscovery.filter comment): reword to "Keep rows whose reported architecture output includes text (e.g. text->text, text+image->text); embedding/image-generation rows are excluded" - current wording does not match the predicate. Risk: none (comment only).
  3. Optional label sync in src/providers/free-directory.ts LABELS: add sambanova: "SambaNova Cloud" and change nebius to Nebius Token Factory so the free-provider picker matches canonical registry labels. Risk: none (display-only).

Gate

none (not draft/WIP)

Bottom line

Useful, well-tested, security-sound preset batch. Ship after: (1) update from latest dev (134 commits behind at review time), (2) formal maintainer security sign-off per MAINTAINERS.md, and optionally (3) the three micro items above. No blocking code defects found.

@Wibias
Wibias marked this pull request as draft August 3, 2026 22:41
@olddonkey
olddonkey force-pushed the codex/572-sambanova-nebius-model-apis branch from b454bba to 59d551c Compare August 5, 2026 01:07
@olddonkey
olddonkey marked this pull request as ready for review August 5, 2026 01:07

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 59d551c0ad

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

const namedEntry = getProviderRegistryEntry(providerName);
const entry = namedEntry
? (providerMatchesRegistryTransport(providerName, provider) ? namedEntry : undefined)
: registryEntryForProviderDestination(provider);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Apply defaults to renamed fixed presets

Although this recovers the registry-owned discovery URL/filter for a renamed SambaNova or Nebius row, the same destination-resolved entry is not used by the POST enrichment or by routeModel, both of which still key off the saved provider name. When the dashboard preset is saved as nebius-team, the row gets the verbose filtered catalog but does not inherit reasoningEfforts: [] or parallelToolCalls: false, so the catalog/request path falls back to advertising reasoning/parallel tools and the OpenAI chat adapter can send reasoning_effort and parallel_tool_calls: true to the exact provider this preset says cannot use them. Reuse the destination-resolved registry entry for the non-discovery defaults as well, or persist those defaults when saving a renamed preset.

Useful? React with 👍 / 👎.

Comment thread src/providers/registry.ts
preserveCustomDestination: true,
apiKeyValidation: "unknown",
// SambaNova documents this request field but does not yet support parallel function calls.
parallelToolCalls: false,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve tool-call opt-out in key-login configs

When a user runs ocx login sambanova or ocx login nebius before a proxy is already running, providerConfigFromKeyLoginProvider writes the key-login DTO directly to disk and never passes through the POST enrichment path; that DTO carries reasoningEfforts: [] but does not include parallelToolCalls. The saved canonical provider still routes requests with the registry opt-out, but gatherRoutedModels reads the un-enriched config and applyProviderConfigHints defaults openai-chat rows to parallelToolCalls: true, so the Codex catalog advertises an unsupported tool capability until the provider is re-added through a path that seeds the full registry config. Add parallelToolCalls to the key-login derivation/copy path for registry presets that set it.

Useful? React with 👍 / 👎.

@Wibias
Wibias marked this pull request as draft August 5, 2026 22:59
@Wibias

Wibias commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Please update to latest branch. Then i will review.

olddonkey and others added 3 commits August 6, 2026 19:11
The destination fallback added here lets a canonical preset saved under an
unknown name recover its registry-owned discovery policy by transport. The
existing coverage proved only that a renamed row picks up a path and query; it
never asserted the filter, and it had no negative cases at all.

Adds five tests, each driven red once against a real sabotage:

- recovers path, query AND filter (literal expectations, not a re-read of the
  same registry row \u2014 the first formulation compared the spec against itself
  and stayed green when the filter was replaced)
- refuses a name that matches a registry entry whose transport does not
- refuses OAuth destinations reached by an unknown name
- refuses non-key auth modes, templated base URLs, and overridable destinations
- keeps every fallback-eligible absolute discovery URL same-origin with its own
  base URL

The last one closes a real gap: an absolute spec.url overrides the configured
base, so a cross-origin one on a fallback-eligible row would send a user's key
to an origin they never configured. DeepInfra is the current instance (base
/v1/openai, discovery /v1/models, same origin) and the test pins that invariant.

Also corrects the OAuth narrative in all five locales: it said six presets plus
Copilot while the registry has eight OAuth rows, and the command list omitted
ocx login command-code. Pre-existing on dev, corrected here because this change
rewrites the surrounding preset counts.
@lidge-jun
lidge-jun force-pushed the codex/572-sambanova-nebius-model-apis branch from 59d551c to 4c9c64b Compare August 6, 2026 10:12
@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

✅ READY

  • all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

  • ✅ All CI tests are green on my local testing.
  • ✅ I pushed my PR to the latest dev commit.
  • ✅ I resolved all correct Codex and CodeRabbit findings.
  • ✅ My PR is ready for review.

4/4 boxes ticked.

This pull request is already Ready for Review.
CodeRabbit/Codex review was requested via the review-ready label. If no review appears, comment @coderabbitai review to request one.
Maintainers: @lidge-jun @Ingwannu @Wibias

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Deterministic PR hygiene checks passed.

@lidge-jun

Copy link
Copy Markdown
Owner

Maintainer rebase and merge preparation (2026-08-06)

Rebased onto current dev (efdfd1cf5) and verified. All conflicts were in the ten locale documentation files; every source file applied cleanly.

Preset totals were regenerated from the executed registry, not from this PR's body

bun -e 'const {PROVIDER_REGISTRY} = await import("./src/providers/registry.ts"); ...'
total 72 { forward: 1, oauth: 8, key: 60, local: 3 }

This mattered. The incoming diff wrote 71 built-in presets: 60 key-based, seven OAuth against a base where OAuth was still 7, but dev now has eight OAuth rows (command-code landed as an OAuth preset). Taking either side of that conflict verbatim would have regressed a correct number in all five locales. Every count is now the measured value: 72 = 60 key + 8 OAuth + 3 local + 1 forward.

Two corrections folded in

  1. OAuth narrative (pre-existing dev defect). Section 2 of providers.md said "Six provider presets use OAuth login — plus GitHub Copilot" in all five locales, while the registry has eight OAuth rows. Corrected to seven plus the experimental Copilot bridge, and ocx login command-code was added to the command list where it was missing. This is not introduced by this PR, but it sits in the exact sentences the rebase rewrites, and a count contract that leaves an adjacent count wrong is not a contract.

  2. Destination-fallback test coverage. This PR changes resolveProviderModelDiscovery so a canonical preset saved under an unknown name recovers its registry-owned discovery policy by transport. The existing coverage proved only that a renamed row picks up a path and query — it never asserted the filter, and had no negative cases. Five tests were added, each driven red once against a real sabotage:

    • recovers path, query and filter
    • refuses a name that matches a registry entry whose transport does not
    • refuses OAuth destinations reached by an unknown name
    • refuses non-key auth modes, templated base URLs, and overridable destinations
    • keeps every fallback-eligible absolute discovery URL same-origin with its own base URL

    The last one closes a real gap. An absolute spec.url overrides the configured base URL, so a cross-origin one on a fallback-eligible row would send a user's key to an origin they never configured. deepinfra is the current instance (base /v1/openai, discovery /v1/models, same origin) and the invariant is now pinned.

    Worth recording: the first version of the filter assertion was vacuous — it compared the resolved spec against the same registry row, so replacing the filter outright stayed green. It was rewritten with literal expectations and re-verified red.

Verification on efdfd1cf5

  • bun run typecheck — exit 0
  • bun test --isolate tests/sambanova-nebius-provider.test.ts tests/provider-registry-parity.test.ts tests/provider-model-discovery-contract.test.ts69 pass, 0 fail
  • bun run privacy:scan — passed
  • git diff --check origin/dev...HEAD — clean
  • 15-site count read-back — 5 quickstart totals, 5 providers.md totals, 5 OAuth narratives, all agreeing with the measured registry

Security review (MAINTAINERS.md)

Reviewed as a credential-destination change. Both entries use Bearer transport on their documented first-party hosts (https://api.sambanova.ai/v1, https://api.tokenfactory.nebius.com/v1), set preserveCustomDestination, keep parallelToolCalls: false, and advertise no reasoning ladder. apiKeyValidation: "unknown" on SambaNova is correct and load-bearing: its catalog answers unauthenticated, so a 200 there is not proof the user's key is valid, and reporting "unknown" rather than "valid" is the honest behavior. Registry-only discovery policy is not serialized into config.json.

Planning record: devlog/_plan/260806_provider_preset_stack/010_wp1_pr870.md.

Thanks @olddonkey — the conservatism here (bounded discovery, fail-closed metadata, no unverified capability claims) is exactly the shape these presets should have.

@lidge-jun
lidge-jun marked this pull request as ready for review August 6, 2026 10:12
@github-actions
github-actions Bot marked this pull request as draft August 6, 2026 10:12
@github-actions
github-actions Bot marked this pull request as ready for review August 6, 2026 10:20
@coderabbitai

coderabbitai Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

@github-actions[bot] The readiness gate is complete. I will review pull request #870.

⚠️ Action not completed

Pull request is closed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai

coderabbitai Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@lidge-jun
lidge-jun merged commit bbd82e7 into lidge-jun:dev Aug 6, 2026
23 of 25 checks passed
@coderabbitai

coderabbitai Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Tip

For best results, initiate chat on the files or code changes.

@github-actions[bot] Acknowledged. The readiness gate is complete, and the pull request is ready for review.

You are interacting with an AI system.

lidge-jun added a commit that referenced this pull request Aug 7, 2026
Roadmap unit for the four open provider-preset PRs under umbrella issue #572,
produced by a docs-only PABCD cycle and hardened through five rounds of
independent adversarial audit.

- 000_plan.md: dependency-ordered work-phase map (#870 -> #872 -> #937, then
  #812), measured ground truth (dev registry = 70 presets: 58 key, 8 oauth,
  3 local, 1 forward), the count-regeneration contract, and amendments A1-A8.
- 010/020/030: diff-level rebase, verification, and merge docs per PR.
- 040: the Apertis evidence gate and its resolved disposition.

Findings that changed the plan: the OAuth narrative in all five locales states
six-plus-Copilot while the registry has eight oauth rows including command-code
(pre-existing defect, folded into WP1); the measured #870 rebase conflicts only
in the ten locale docs while all code applies cleanly; deepinfra is
destination-fallback-eligible with an absolute discovery URL, so the invariant
is same-origin rather than same-URL; and #870's destination-fallback tests lack
negative cases, which WP1 now builds rather than confirms.

Refs #572, #870, #872, #937, #812.
lidge-jun added a commit that referenced this pull request Aug 7, 2026
Three PRs landed on dev: #870 (bbd82e7), #872 (e50f580), #937 (8ed03e7).
The registry went 70 -> 76 presets, measured by executing the module.

#812 (Apertis) is not merged and not closed. It meets four of the five canonical
preset requirements and fails exactly the aggregator resale/routing
authorization clause in MAINTAINERS.md. The prescribed free-directory fallback
does not apply either, because that directory only admits free-access groups.

Records what the process actually caught: the count contract stopped three real
regressions (a stale OAuth number in the incoming diff, a pre-existing wrong
OAuth narrative in five locales, and git rerere replaying a stale total), while
a dropped documentation paragraph in WP3 was invisible to every automated gate
and surfaced only from a grep.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request review-ready

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants