fix(openshell): reconcile existing provider profiles

ci/source-shape-test-budget.json

@@ -91,6 +91,11 @@
       "test": "restores exact locked posture after root-separated repair and later failure (#7033)",
       "category": "security"
     },
+    {
+      "file": "test/agents/hermes/hermes-final-image-layout.test.ts",
+      "test": "pins $source to its current bytes at $target",
+      "category": "security"
+    },
     {
       "file": "test/platform/images/muse-glimmer-vllm-image-provenance.test.ts",
       "test": "binds the checked-in provenance to the selected runtime",

src/commands/credentials.test.ts

@@ -219,4 +219,81 @@ describe("credentials oclif adapter source coverage", () => {
       mocks.runOpenshellProviderCommand.mock.invocationCallOrder[0],
     );
   });
+
+  it("rejects an incompatible OpenAI profile before provider creation", async () => {
+    vi.stubEnv("OPENAI_API_KEY", "host-only-secret");
+    mocks.runOpenshellProviderCommand.mockReturnValueOnce({
+      status: 0,
+      stdout: JSON.stringify({
+        id: "openai",
+        credentials: [],
+        endpoints: [{ name: "untrusted", url: "https://example.invalid" }],
+        binaries: [],
+        inference_capable: true,
+      }),
+      stderr: "",
+    });
+
+    const result = await runCredentialsAddAction({
+      provider: "openai-prod",
+      type: "openai",
+      credentials: ["OPENAI_API_KEY"],
+      configPairs: [],
+      fromExisting: false,
+    });
+
+    expect(result.exitCode).toBe(1);
+    expect(result.failureLines.join("\n")).toContain(
+      "does not match NemoClaw's endpointless inference contract",
+    );
+    expect(result.failureLines.join("\n")).not.toContain("host-only-secret");
+    expect(mocks.runOpenshellProviderCommand).toHaveBeenCalledTimes(1);
+    expect(mocks.runOpenshellProviderCommand).toHaveBeenCalledWith(
+      ["provider", "profile", "export", "openai", "--output", "json"],
+      {
+        ignoreError: true,
+        suppressOutput: true,
+        stdio: ["ignore", "pipe", "pipe"],
+      },
+    );
+    expect(mocks.recordExtraProvider).not.toHaveBeenCalled();
+  });
+
+  it("imports a missing OpenAI profile before provider creation", async () => {
+    vi.stubEnv("OPENAI_API_KEY", "host-only-secret");
+    mocks.runOpenshellProviderCommand
+      .mockReturnValueOnce({ status: 1, stdout: "", stderr: "provider profile not found" })
+      .mockReturnValueOnce({ status: 0, stdout: "", stderr: "" })
+      .mockReturnValueOnce({ status: 0, stdout: "", stderr: "" });
+
+    const result = await runCredentialsAddAction({
+      provider: "openai-prod",
+      type: "openai",
+      credentials: ["OPENAI_API_KEY"],
+      configPairs: [],
+      fromExisting: false,
+    });
+
+    expect(result.exitCode).toBe(0);
+    expect(mocks.runOpenshellProviderCommand.mock.calls.map(([args]) => args)).toEqual([
+      ["provider", "profile", "export", "openai", "--output", "json"],
+      [
+        "provider",
+        "profile",
+        "import",
+        "--file",
+        expect.stringMatching(/provider-profiles\/openai\.yaml$/u),
+      ],
+      [
+        "provider",
+        "create",
+        "--name",
+        "openai-prod",
+        "--type",
+        "openai",
+        "--credential",
+        "OPENAI_API_KEY",
+      ],
+    ]);
+  });
 });

src/lib/actions/credentials-add.ts

@@ -12,6 +12,8 @@ import {
 } from "../credentials/command-support";
 import { redact } from "../security/redact";
 import { SECRET_PATTERNS } from "../security/secret-patterns";
+import { ensureEndpointlessProviderProfile } from "../messaging/provider-profile";
+import { OPENAI_GATEWAY_PROVIDER_TYPE } from "../onboard/inference-providers/provider-profile";
 import { withMcpCredentialOwnershipLock } from "../state/mcp-lifecycle-lock/credential-ownership";
 import { ROOT } from "../state/paths";
 import {
@@ -121,6 +123,32 @@ function ensureBundledProviderProfile(type: string): CredentialsAddResult | null
   const profilePath = bundledProviderProfilePath(type);
   if (!fs.existsSync(profilePath)) return null;
 
+  if (type.toLowerCase() === OPENAI_GATEWAY_PROVIDER_TYPE) {
+    const result = ensureEndpointlessProviderProfile({
+      profileId: OPENAI_GATEWAY_PROVIDER_TYPE,
+      inferenceCapable: true,
+      profilePath,
+      runOpenshell: runOpenshellProviderCommand,
+    });
+    if (result.ok) return null;
+    if (result.reason === "import-failed") {
+      return fail([
+        `  Could not import bundled provider profile '${OPENAI_GATEWAY_PROVIDER_TYPE}'.`,
+        "  Update OpenShell with scripts/install-openshell.sh and retry.",
+      ]);
+    }
+    if (result.reason === "export-failed") {
+      return fail([
+        `  Could not read OpenShell provider profile '${OPENAI_GATEWAY_PROVIDER_TYPE}' for validation.`,
+        "  Repair or remove that profile, then retry.",
+      ]);
+    }
+    return fail([
+      `  OpenShell provider profile '${OPENAI_GATEWAY_PROVIDER_TYPE}' already exists but does not match NemoClaw's endpointless inference contract.`,
+      "  Remove the conflicting profile, then retry.",
+    ]);
+  }
+
   const result = runOpenshellProviderCommand(
     ["provider", "profile", "import", "--file", profilePath],
     {

src/lib/actions/inference-set-compatible-provider.test.ts

@@ -15,6 +15,20 @@ type ProbeSandboxRoute = NonNullable<
   Parameters<typeof createDeps>[0]["probeSandboxRoute"]
 >;
 
+const OPENAI_PROFILE_OUTPUT = JSON.stringify({
+  id: "openai",
+  credentials: [],
+  endpoints: [],
+  binaries: [],
+  inference_capable: true,
+});
+const OPENAI_PROFILE_RESULT = {
+  status: 0,
+  output: OPENAI_PROFILE_OUTPUT,
+  stdout: OPENAI_PROFILE_OUTPUT,
+  stderr: "",
+};
+
 async function runRejectedCompatibleSwitchScenario(options: {
   targetFamily: "openai" | "anthropic";
   probeSandboxRoute: ProbeSandboxRoute;
@@ -295,6 +309,8 @@ describe("runInferenceSet compatible providers", () => {
     let providerCreated = false;
     const captureOpenshell = vi.fn((args: string[]) => {
       switch (`${args[0]}:${args[1]}`) {
+        case "provider:profile":
+          return OPENAI_PROFILE_RESULT;
         case "inference:set":
           return providerCreated
             ? { status: 0, output: "", stdout: "", stderr: "" }
@@ -407,6 +423,8 @@ describe("runInferenceSet compatible providers", () => {
     let providerPresent = false;
     const captureOpenshell = vi.fn((args: string[]) => {
       switch (`${args[0]}:${args[1]}`) {
+        case "provider:profile":
+          return OPENAI_PROFILE_RESULT;
         case "provider:get": {
           const missingOutput =
             "Error: code: 'Some requested entity was not found', message: \"provider not found\"";
@@ -599,6 +617,8 @@ describe("runInferenceSet compatible providers", () => {
     let providerVersion = 1;
     const captureOpenshell = vi.fn((args: string[]) => {
       switch (`${args[0]}:${args[1]}`) {
+        case "provider:profile":
+          return OPENAI_PROFILE_RESULT;
         case "provider:get": {
           const output = [
             "Name: compatible-endpoint",

src/lib/actions/inference-set-https-pin-runtime.test.ts

@@ -15,6 +15,20 @@ const OLD_ROUTE_ID = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 const ADAPTER_BASE_URL = `http://host.openshell.internal:11438/route/${NEW_ROUTE_ID}`;
 const OLD_ADAPTER_BASE_URL = `http://host.openshell.internal:11438/route/${OLD_ROUTE_ID}`;
 const PROVIDER_ID = "11111111-2222-4333-8444-555555555555";
+const OPENAI_PROFILE_OUTPUT = JSON.stringify({
+  id: "openai",
+  credentials: [],
+  endpoints: [],
+  binaries: [],
+  inference_capable: true,
+});
+const ANTHROPIC_PROFILE_OUTPUT = JSON.stringify({
+  id: "anthropic",
+  credentials: [],
+  endpoints: [],
+  binaries: [],
+  inference_capable: true,
+});
 
 function mockAdapter() {
   return vi.fn(async (_options: EnsureHttpsPinRuntimeAdapterOptions) => ({
@@ -43,6 +57,16 @@ function providerCapture(options: {
     ].join("\n");
   return vi.fn((args: string[]) => {
     switch (`${args[0]}:${args[1]}`) {
+      case "provider:profile": {
+        const profile =
+          options.providerType === "anthropic" ? ANTHROPIC_PROFILE_OUTPUT : OPENAI_PROFILE_OUTPUT;
+        return {
+          status: 0,
+          output: profile,
+          stdout: profile,
+          stderr: "",
+        };
+      }
       case "provider:get": {
         const text = output();
         return { status: 0, stdout: text, stderr: "", output: text };

src/lib/actions/inference-set-provider.test.ts

@@ -7,6 +7,21 @@ import { __test, prepareInferenceSetProviderBinding } from "./inference-set-prov
 import type { HttpsPinProviderBinding } from "./inference-set-route-containment";
 
 const PROVIDER_ID = "11111111-2222-4333-8444-555555555555";
+const OPENAI_ENDPOINTLESS_PROFILE = JSON.stringify({
+  id: "openai",
+  credentials: [],
+  endpoints: [],
+  binaries: [],
+  inference_capable: true,
+});
+
+const OPENAI_ENDPOINTLESS_PROFILE_RESULT = {
+  status: 0,
+  stdout: OPENAI_ENDPOINTLESS_PROFILE,
+  stderr: "",
+  output: OPENAI_ENDPOINTLESS_PROFILE,
+};
+
 function binding(overrides: Partial<HttpsPinProviderBinding> = {}): HttpsPinProviderBinding {
   return {
     baseUrl: "http://host.openshell.internal:11438/route/route-a/v1",
@@ -42,7 +57,7 @@ function captureSequence(
   return vi.fn(
     (args: string[]) =>
       (args[0] === "provider" && args[1] === "profile"
-        ? { status: 0, stdout: "", stderr: "" }
+        ? OPENAI_ENDPOINTLESS_PROFILE_RESULT
         : results.shift()) ??
       (() => {
         throw new Error("unexpected OpenShell call");
@@ -76,9 +91,10 @@ describe("inference set provider binding", () => {
       "profile",
       "-g",
       "nemoclaw",
-      "import",
-      "--file",
-      expect.stringMatching(/openai\.yaml$/u),
+      "export",
+      "openai",
+      "--output",
+      "json",
     ]);
     expect(capture.mock.calls[2]).toEqual([
       [
@@ -121,14 +137,17 @@ describe("inference set provider binding", () => {
 
   it("stops before an OpenAI provider mutation when profile registration fails (#9895)", () => {
     const before = providerOutput({ resourceVersion: 4 });
-    const responses = new Map([
-      ["get", { status: 0, stdout: before, stderr: "", output: before }],
-      ["profile", { status: 1, stdout: "", stderr: "sensitive profile failure" }],
-    ]);
-    const capture = vi.fn((args: string[]) =>
-      responses.get(args[1]) ?? (() => {
-        throw new Error("provider mutation must not run");
-      })(),
+    const responses = [
+      { status: 0, stdout: before, stderr: "", output: before },
+      { status: 1, stdout: "", stderr: "provider profile not found" },
+      { status: 1, stdout: "", stderr: "sensitive profile failure" },
+    ];
+    const capture = vi.fn(
+      () =>
+        responses.shift() ??
+        (() => {
+          throw new Error("provider mutation must not run");
+        })(),
     ) as InferenceSetDeps["captureOpenshell"] & ReturnType<typeof vi.fn>;
 
     const mutation = prepareInferenceSetProviderBinding({
@@ -141,7 +160,7 @@ describe("inference set provider binding", () => {
     expect(() => mutation.commit()).toThrow(
       "could not import the checked-in 'openai' inference provider profile",
     );
-    expect(capture.mock.calls.map(([args]) => args[1])).toEqual(["get", "profile"]);
+    expect(capture.mock.calls.map(([args]) => args[1])).toEqual(["get", "profile", "profile"]);
   });
 
   it("does not register the OpenAI profile before an Anthropic provider mutation", () => {
@@ -282,7 +301,7 @@ describe("inference set provider binding", () => {
       return (args, opts) => {
         switch (args[1]) {
           case "profile":
-            return { status: 0, stdout: "", stderr: "", output: "" };
+            return OPENAI_ENDPOINTLESS_PROFILE_RESULT;
           case "get": {
             const output = providerOutput({ id, resourceVersion: version });
             return { status: 0, stdout: output, stderr: "", output };

src/lib/actions/inference-set-reasoning-effort.test.ts

@@ -5,7 +5,11 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 import { REASONING_EFFORT_ENV } from "../onboard/reasoning-mode";
 import type { ConfigObject } from "../security/credential-filter";
 import { patchOpenClawInferenceConfig, runInferenceSet } from "./inference-set";
-import { baseSession, createDeps } from "./inference-set.test-support";
+import {
+  baseSession,
+  createDeps,
+  OPENAI_ENDPOINTLESS_PROFILE,
+} from "./inference-set.test-support";
 
 function compatibleEndpointConfig(modelOverrides: ConfigObject = {}): ConfigObject {
   return {
@@ -331,6 +335,13 @@ describe("inference set reasoning effort (#7659)", () => {
         case "provider:update":
           providerVersion += 1;
           return { status: 0, output: "", stdout: "", stderr: "" };
+        case "provider:profile":
+          return {
+            status: 0,
+            output: OPENAI_ENDPOINTLESS_PROFILE,
+            stdout: OPENAI_ENDPOINTLESS_PROFILE,
+            stderr: "",
+          };
         default:
           return { status: 0, output: "", stdout: "", stderr: "" };
       }