feat(providers): SDK-native gcloud-ADC provider create for Vertex AI

cmd/executor.go

@@ -76,7 +76,7 @@ func upLocal(opts upLocalOpts) error {
 		return fmt.Errorf("no active gateway is reachable — provision one with the OpenShell installer or 'helm install openshell', then select it with 'openshell gateway select <name>': %w", err)
 	}
 
-	registered := ensureProviders(opts.harnessDir, gw, agentCfg, opts.harness)
+	registered := ensureProviders(opts.harnessDir, gw, opts.target, agentCfg, opts.harness)
 
 	if needsInference(agentCfg.EffectiveEntrypoint()) && !hasInferenceProvider(agentCfg.Providers) {
 		status.Warn("No inference provider configured — the agent will not be able to authenticate. Add google-vertex-ai to providers.")

cmd/providers.go

@@ -1,20 +1,34 @@
 package cmd
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/stackrox/harness-openshell/internal/agent"
 	"github.com/stackrox/harness-openshell/internal/config"
 	"github.com/stackrox/harness-openshell/internal/gateway"
+	"github.com/stackrox/harness-openshell/internal/openshell"
+	"github.com/stackrox/harness-openshell/internal/openshell/sdkclient"
 	"github.com/stackrox/harness-openshell/internal/status"
 	"gopkg.in/yaml.v3"
 )
 
+// vertexADCCreate is the SDK-native gcloud-ADC provider create, injected as a
+// package var so tests can substitute it without a live gateway. Production
+// binds it to sdkclient.CreateVertexProviderFromADC — the sole credentialed
+// create path, which reads the ADC refresh token and hands it to the gateway
+// (Create carries no secret; the refresh token rides Refresh().Configure). The
+// ADC flow is the one credentialed create the harness now owns directly rather
+// than shelling to the CLI bridge; gws OAuth and reference (--from-existing)
+// still bootstrap on the bridge.
+var vertexADCCreate = sdkclient.CreateVertexProviderFromADC
+
 // createStrategy names how a not-yet-existing provider is bootstrapped on the CLI
 // bridge. Credentialed creation (ADC/OAuth) has to stay on the bridge — the
 // firewall Provider type cannot carry a secret (invariant 26) — so this is the one
@@ -56,7 +70,7 @@ func providerCreatePlan(p config.Provider) createStrategy {
 // adoption are the SDK reconcile's job (reconcile.ReconcileProviders, run from
 // upLocal after this). The register* helpers each no-op when their provider
 // already exists, so this is safe to call on every apply.
-func registerProviders(harnessDir string, gw gateway.Gateway, desired []config.Provider) error {
+func registerProviders(harnessDir string, gw gateway.Gateway, target openshell.Target, desired []config.Provider) error {
 	status.Header("Providers")
 
 	profilesDir := filepath.Join(harnessDir, "profiles", "providers")
@@ -65,18 +79,18 @@ func registerProviders(harnessDir string, gw gateway.Gateway, desired []config.P
 	}
 
 	for _, p := range desired {
-		if err := bootstrapProvider(harnessDir, gw, p); err != nil {
+		if err := bootstrapProvider(harnessDir, gw, target, p); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
 // bootstrapProvider creates one absent provider via its create strategy.
-func bootstrapProvider(harnessDir string, gw gateway.Gateway, p config.Provider) error {
+func bootstrapProvider(harnessDir string, gw gateway.Gateway, target openshell.Target, p config.Provider) error {
 	switch providerCreatePlan(p) {
 	case strategyADC:
-		return registerADC(p.Name, p.Type, gw, adcConfigs())
+		return registerADC(gw, target, p.Name, adcConfigs())
 	case strategyOAuth:
 		return registerGWS(harnessDir, gw)
 	default:
@@ -86,22 +100,22 @@ func bootstrapProvider(harnessDir string, gw gateway.Gateway, p config.Provider)
 
 // adcConfigs resolves the Vertex project/region config passed to the ADC create,
 // preserving the legacy resolution order: explicit env overrides first, then the
-// ADC file's quota project, then a "global" region default.
-func adcConfigs() []string {
-	home, _ := os.UserHomeDir()
-	adcPath := envOr("GOOGLE_APPLICATION_CREDENTIALS",
-		filepath.Join(home, ".config", "gcloud", "application_default_credentials.json"))
+// ADC file's quota project, then a "global" region default. The ADC file is
+// resolved via the same path resolver ReadGcloudADC uses (which honors
+// CLOUDSDK_CONFIG), so the quota project is read from the same file the refresh
+// material comes from.
+func adcConfigs() map[string]string {
+	adcPath, _ := sdkclient.DefaultADCPath()
 	project := envOr("ANTHROPIC_VERTEX_PROJECT_ID", readADCProject(adcPath))
 	region := envOr("CLOUD_ML_REGION", "global")
-	var configs []string
+	configs := map[string]string{"VERTEX_AI_REGION": region}
 	if project != "" {
-		configs = append(configs, "VERTEX_AI_PROJECT_ID="+project)
+		configs["VERTEX_AI_PROJECT_ID"] = project
 	}
-	configs = append(configs, "VERTEX_AI_REGION="+region)
 	return configs
 }
 
-func ensureProviders(harnessDir string, gw gateway.Gateway, agentCfg *agent.AgentConfig, h *agent.Harness) []string {
+func ensureProviders(harnessDir string, gw gateway.Gateway, target openshell.Target, agentCfg *agent.AgentConfig, h *agent.Harness) []string {
 	providerNames := agentCfg.ProviderNames()
 	if len(providerNames) == 0 {
 		return nil
@@ -123,7 +137,7 @@ func ensureProviders(harnessDir string, gw gateway.Gateway, agentCfg *agent.Agen
 	registered, missing := gateway.ValidateProviders(providerNames, gw)
 	if len(missing) > 0 {
 		desired, _ := desiredFromAgent(agentCfg, os.Getenv)
-		if err := registerProviders(harnessDir, gw, desired); err != nil {
+		if err := registerProviders(harnessDir, gw, target, desired); err != nil {
 			status.Warnf("provider registration: %v", err)
 		}
 		registered, missing = gateway.ValidateProviders(providerNames, gw)
@@ -153,19 +167,25 @@ func registerStandard(name, profileType string, gw gateway.Gateway, configs []st
 	return nil
 }
 
-// registerADC creates a provider from gcloud Application Default Credentials.
-// It no longer sets the inference route: that write moved to the SDK reconcile
-// path (reconcileGateway in executor.go) as part of PR4a S5/S6, so provider
-// registration and inference reconciliation are now separate concerns.
-func registerADC(name, profileType string, gw gateway.Gateway, configs []string) error {
+// registerADC creates a google-vertex-ai provider from gcloud Application
+// Default Credentials via the SDK (sdkclient.CreateVertexProviderFromADC),
+// replacing the former `openshell provider create --from-gcloud-adc` shell-out.
+// It reads the ADC refresh token and the gateway mints/rotates the Vertex access
+// token server-side. It does not set the inference route: that write is the SDK
+// reconcile path's job (reconcileGateway in executor.go), so provider
+// registration and inference reconciliation stay separate concerns.
+func registerADC(gw gateway.Gateway, target openshell.Target, name string, configs map[string]string) error {
 	if gw.ProviderGet(name) == nil {
 		status.Infof("%s: exists", name)
 		return nil
 	}
-	if err := gw.ProviderCreate(name, profileType, gateway.ProviderCreateOpts{
-		FromADC: true,
-		Configs: configs,
-	}); err != nil {
+	adc, err := sdkclient.ReadGcloudADC("")
+	if err != nil {
+		return fmt.Errorf("%s: %w", name, err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+	if err := vertexADCCreate(ctx, target, name, configs, adc); err != nil {
 		return fmt.Errorf("%s: registration failed: %w", name, err)
 	}
 	status.OKf("%s: registered", name)

cmd/providers_test.go

@@ -1,11 +1,14 @@
 package cmd
 
 import (
+	"context"
 	"os"
 	"path/filepath"
 	"testing"
 
 	"github.com/stackrox/harness-openshell/internal/config"
+	"github.com/stackrox/harness-openshell/internal/openshell"
+	"github.com/stackrox/harness-openshell/internal/openshell/sdkclient"
 )
 
 func setupProvidersTest(t *testing.T) string {
@@ -15,6 +18,28 @@ func setupProvidersTest(t *testing.T) string {
 	return dir
 }
 
+// swapVertexADCCreate substitutes the SDK-native ADC create seam for a test
+// double and restores it afterward, so registerADC can be exercised without a
+// live gateway.
+func swapVertexADCCreate(t *testing.T, fn func(context.Context, openshell.Target, string, map[string]string, sdkclient.ADC) error) {
+	t.Helper()
+	orig := vertexADCCreate
+	vertexADCCreate = fn
+	t.Cleanup(func() { vertexADCCreate = orig })
+}
+
+// writeValidADC writes an authorized_user ADC file and points
+// GOOGLE_APPLICATION_CREDENTIALS at it so registerADC's ReadGcloudADC("")
+// resolves deterministically in tests.
+func writeValidADC(t *testing.T) {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "application_default_credentials.json")
+	if err := os.WriteFile(path, []byte(`{"type":"authorized_user","client_id":"c","client_secret":"s","refresh_token":"r"}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", path)
+}
+
 // TestProviderCreatePlan pins the single owner of "which create strategy": it keys
 // on Credentials.Source and provider type, never on a hard-coded profile switch.
 func TestProviderCreatePlan(t *testing.T) {
@@ -45,7 +70,7 @@ func TestRegisterProviders_BootstrapsAbsentReference(t *testing.T) {
 	dir := setupProvidersTest(t)
 	gw := &mockGW{providers: map[string]bool{}}
 
-	err := registerProviders(dir, gw, []config.Provider{
+	err := registerProviders(dir, gw, openshell.Target{}, []config.Provider{
 		{Name: "github", Type: "github"},
 	})
 	if err != nil {
@@ -63,30 +88,54 @@ func TestRegisterProviders_BootstrapsAbsentReference(t *testing.T) {
 	}
 }
 
+// TestRegisterProviders_VertexUsesADC pins that the vertex strategy now creates
+// via the SDK-native ADC seam (not the CLI bridge): the seam is invoked with the
+// provider name, the resolved Vertex config, and the ADC material, and the CLI
+// bridge ProviderCreate is never touched for it.
 func TestRegisterProviders_VertexUsesADC(t *testing.T) {
 	dir := setupProvidersTest(t)
 	gw := &mockGW{providers: map[string]bool{}}
+	writeValidADC(t)
+	t.Setenv("ANTHROPIC_VERTEX_PROJECT_ID", "test-proj")
+
+	var gotName string
+	var gotConfig map[string]string
+	var gotADC sdkclient.ADC
+	calls := 0
+	swapVertexADCCreate(t, func(_ context.Context, _ openshell.Target, name string, config map[string]string, adc sdkclient.ADC) error {
+		calls++
+		gotName, gotConfig, gotADC = name, config, adc
+		return nil
+	})
 
-	err := registerProviders(dir, gw, []config.Provider{
+	err := registerProviders(dir, gw, openshell.Target{Gateway: "openshell"}, []config.Provider{
 		{Name: "google-vertex-ai", Type: "google-vertex-ai", Credentials: &config.SecretRef{Source: "gcloud-adc"}},
 	})
 	if err != nil {
 		t.Fatalf("registerProviders: %v", err)
 	}
-	if len(gw.providerCreates) != 1 {
-		t.Fatalf("providerCreates = %d, want 1", len(gw.providerCreates))
+	if calls != 1 {
+		t.Fatalf("SDK ADC create called %d times, want 1", calls)
 	}
-	c := gw.providerCreates[0]
-	if c.name != "google-vertex-ai" || !c.opts.FromADC {
-		t.Errorf("vertex create = %q FromADC=%v, want google-vertex-ai FromADC=true", c.name, c.opts.FromADC)
+	if len(gw.providerCreates) != 0 {
+		t.Errorf("CLI bridge ProviderCreate called %d times, want 0 (ADC is SDK-native)", len(gw.providerCreates))
+	}
+	if gotName != "google-vertex-ai" {
+		t.Errorf("create name = %q, want google-vertex-ai", gotName)
+	}
+	if gotConfig["VERTEX_AI_PROJECT_ID"] != "test-proj" || gotConfig["VERTEX_AI_REGION"] != "global" {
+		t.Errorf("config = %v, want project=test-proj region=global", gotConfig)
+	}
+	if gotADC.RefreshToken != "r" {
+		t.Errorf("adc.RefreshToken = %q, want r", gotADC.RefreshToken)
 	}
 }
 
 func TestRegisterProviders_SkipsExistingProvider(t *testing.T) {
 	dir := setupProvidersTest(t)
 	gw := &mockGW{providers: map[string]bool{"github": true}}
 
-	err := registerProviders(dir, gw, []config.Provider{
+	err := registerProviders(dir, gw, openshell.Target{}, []config.Provider{
 		{Name: "github", Type: "github"},
 	})
 	if err != nil {
@@ -101,7 +150,7 @@ func TestRegisterProviders_EmptyList(t *testing.T) {
 	dir := setupProvidersTest(t)
 	gw := &mockGW{providers: map[string]bool{}}
 
-	err := registerProviders(dir, gw, nil)
+	err := registerProviders(dir, gw, openshell.Target{}, nil)
 	if err != nil {
 		t.Fatalf("registerProviders: %v", err)
 	}

internal/gateway/cli.go

@@ -103,8 +103,6 @@ func (c *CLI) ProviderCreate(name, providerType string, opts ProviderCreateOpts)
 	args := []string{"provider", "create", "--name", name, "--type", providerType}
 	if opts.FromExisting {
 		args = append(args, "--from-existing")
-	} else if opts.FromADC {
-		args = append(args, "--from-gcloud-adc")
 	}
 	for _, cred := range opts.Credentials {
 		args = append(args, "--credential", cred)

internal/gateway/cli_test.go

@@ -272,24 +272,26 @@ printf '%s\n' "$*" > `+argsFile+`
 	}
 }
 
+// TestProviderCreate_Args covers the bridge's credential+config passthrough
+// (the shape gws uses: a placeholder credential and config, no --from-* flag).
+// The gcloud-ADC create is no longer a bridge concern — it is SDK-native
+// (sdkclient.CreateVertexProviderFromADC), so no --from-gcloud-adc flag exists.
 func TestProviderCreate_Args(t *testing.T) {
 	dir := t.TempDir()
 	argsFile := filepath.Join(dir, "args")
 	bin := writeStub(t, `#!/bin/bash
 printf '%s\n' "$*" > `+argsFile+`
 `)
 	gw := New(bin)
-	gw.ProviderCreate("google-vertex-ai", "google-vertex-ai", ProviderCreateOpts{
-		FromADC:     true,
+	gw.ProviderCreate("google-workspace", "google-workspace", ProviderCreateOpts{
 		Credentials: []string{"TOKEN=abc"},
 		Configs:     []string{"PROJECT=my-proj", "REGION=us-east5"},
 	})
 	data, _ := os.ReadFile(argsFile)
 	args := strings.TrimSpace(string(data))
 	for _, want := range []string{
-		"--name google-vertex-ai",
-		"--type google-vertex-ai",
-		"--from-gcloud-adc",
+		"--name google-workspace",
+		"--type google-workspace",
 		"--credential TOKEN=abc",
 		"--config PROJECT=my-proj",
 		"--config REGION=us-east5",
@@ -298,6 +300,9 @@ printf '%s\n' "$*" > `+argsFile+`
 			t.Errorf("missing %q in: %s", want, args)
 		}
 	}
+	if strings.Contains(args, "--from-gcloud-adc") {
+		t.Errorf("bridge must not emit --from-gcloud-adc (ADC is SDK-native): %s", args)
+	}
 }
 
 // Test sandboxCreateArgs with all new fields set to verify pinned argv order.

internal/gateway/gateway.go

@@ -6,9 +6,11 @@ package gateway
 // inference, health, and get/describe/delete — is on the SDK
 // (internal/openshell/sdkclient); no CLI stdout/table parsing remains here.
 type Gateway interface {
-	// Providers. Credentialed create + profile import + refresh stay on the CLI
-	// because the firewall Provider type cannot carry a secret (invariant 26);
-	// once a provider exists the SDK reconcile owns verify/update/adoption.
+	// Providers. Reference (--from-existing) create, gws OAuth refresh, and
+	// profile import stay on the CLI bridge; the gcloud-ADC create is SDK-native
+	// (sdkclient.CreateVertexProviderFromADC — the refresh token rides the
+	// gateway's refresh config, never the firewall Provider type). Once a
+	// provider exists the SDK reconcile owns verify/update/adoption.
 	ProviderGet(name string) error
 	ProviderCreate(name, providerType string, opts ProviderCreateOpts) error
 	ProviderProfileImport(dir string) error
@@ -43,7 +45,6 @@ func ValidateProviders(providers []string, gw ProviderChecker) (registered, miss
 type ProviderCreateOpts struct {
 	Credentials  []string
 	Configs      []string
-	FromADC      bool
 	FromExisting bool
 }