Problem Statement
AI agents building OpenShell workflows cannot discover the provider credential-hiding path. The provider system is powerful but invisible — agents take the path of least resistance (--env) because --provider requires multi-step setup knowledge that isn't in their context.
Human developers face the same problem: the CLI help for sandbox create doesn't prioritize --provider over --env for credentials, error messages don't suggest providers when connections fail, and there's no command to bridge from "I have these env vars" to "here are the providers I should use."
Proposed Design
1. openshell provider suggest command
New subcommand that matches env var names to built-in profile credential declarations:
$ openshell provider suggest --env JIRA_API_TOKEN=... --env MLFLOW_TRACKING_TOKEN=...
Suggested providers:
JIRA_API_TOKEN → jira (built-in profile)
MLFLOW_TRACKING_TOKEN → mlflow (built-in profile)
To set up:
openshell provider create --name my-jira --type jira --credential JIRA_API_TOKEN
openshell provider create --name my-mlflow --type mlflow --credential MLFLOW_TRACKING_TOKEN
This gives agents a direct command to discover the right path without reading docs.
2. Updated CLI help text
Reorder openshell sandbox create --help to recommend --provider before --env for credentials. Currently --env appears without context about its security implications.
3. Connection failure hints
When a sandbox connection to a host fails and that host matches a built-in profile's endpoint, include a hint in the error message suggesting the matching profile.
Dependencies
Motivation
In opendatahub-io/agent-ops#7, the AI agent building the demo workflow did not know about providers v2. It passed all credentials as --env because that path is obvious and immediately works. provider suggest would have bridged the gap.
Agent Investigation
- Built-in profile credential env var names available via
builtin_profiles() in crates/openshell-providers/src/profiles.rs
openshell provider list-profiles already exists — suggest would add env-var-to-profile matching- CLI help templates in
crates/openshell-cli/src/main.rs (PROVIDER_EXAMPLES, sandbox create help)
Checklist
Problem Statement
AI agents building OpenShell workflows cannot discover the provider credential-hiding path. The provider system is powerful but invisible — agents take the path of least resistance (
--env) because--providerrequires multi-step setup knowledge that isn't in their context.Human developers face the same problem: the CLI help for
sandbox createdoesn't prioritize--providerover--envfor credentials, error messages don't suggest providers when connections fail, and there's no command to bridge from "I have these env vars" to "here are the providers I should use."Proposed Design
1.
openshell provider suggestcommandNew subcommand that matches env var names to built-in profile credential declarations:
$ openshell provider suggest --env JIRA_API_TOKEN=... --env MLFLOW_TRACKING_TOKEN=... Suggested providers: JIRA_API_TOKEN → jira (built-in profile) MLFLOW_TRACKING_TOKEN → mlflow (built-in profile) To set up: openshell provider create --name my-jira --type jira --credential JIRA_API_TOKEN openshell provider create --name my-mlflow --type mlflow --credential MLFLOW_TRACKING_TOKENThis gives agents a direct command to discover the right path without reading docs.
2. Updated CLI help text
Reorder
openshell sandbox create --helpto recommend--providerbefore--envfor credentials. Currently--envappears without context about its security implications.3. Connection failure hints
When a sandbox connection to a host fails and that host matches a built-in profile's endpoint, include a hint in the error message suggesting the matching profile.
Dependencies
provider suggestneeds profiles to match againstMotivation
In opendatahub-io/agent-ops#7, the AI agent building the demo workflow did not know about providers v2. It passed all credentials as
--envbecause that path is obvious and immediately works.provider suggestwould have bridged the gap.Agent Investigation
builtin_profiles()incrates/openshell-providers/src/profiles.rsopenshell provider list-profilesalready exists —suggestwould add env-var-to-profile matchingcrates/openshell-cli/src/main.rs(PROVIDER_EXAMPLES, sandbox create help)Checklist