fix(providers): restore unrelated files to main versions

The vertex-provider branch diverged from main on three unrelated PRs:
- PR NVIDIA#1526: OCSF builder macro and shared driver helpers (reverted here
  to match main's macro-based approach)
- PR NVIDIA#1547: Python SDK FileNotFoundError -> SandboxError translation
  (restores user-friendly error messages for missing gateway files)
- PR NVIDIA#1539: bash 3.2-compatible read loop in helm-k3s-local.sh
  (restores mapfile -> while IFS= read for macOS compat)

Author: maxamillion

crates/openshell-cli/src/run.rs

@@ -4445,7 +4445,7 @@ pub async fn provider_create(
         if let Err(configure_err) = client
             .configure_provider_refresh(ConfigureProviderRefreshRequest {
                 provider: name.to_string(),
-                credential_key: "GOOGLE_VERTEX_AI_TOKEN".to_string(),
+                credential_key: openshell_core::inference::VERTEX_AI_ADC_TOKEN_KEY.to_string(),
                 strategy: ProviderCredentialRefreshStrategy::Oauth2RefreshToken as i32,
                 material,
                 secret_material_keys: vec![

crates/openshell-cli/tests/provider_commands_integration.rs

@@ -2262,3 +2262,157 @@ async fn provider_create_from_existing_vertex_config_only_reports_missing_vertex
             .contains_key("vertex-config-only")
     );
 }
+
+#[tokio::test]
+async fn provider_create_from_gcloud_adc_with_config_keys() {
+    let ts = run_server().await;
+
+    // Write a valid authorized_user ADC file.
+    let adc_content = serde_json::json!({
+        "type": "authorized_user",
+        "client_id": "test-client-id.apps.googleusercontent.com",
+        "client_secret": "test-client-secret",
+        "refresh_token": "1//test-refresh-token"
+    });
+    let adc_file = tempfile::NamedTempFile::new().unwrap();
+    serde_json::to_writer(&adc_file, &adc_content).unwrap();
+    let adc_path = adc_file.path().to_str().unwrap().to_string();
+    let _guard = EnvVarGuard::set(&[("GOOGLE_APPLICATION_CREDENTIALS", &adc_path)]);
+
+    run::provider_create(
+        &ts.endpoint,
+        "vertex-with-config",
+        "google-vertex-ai",
+        false,
+        &[],  // no explicit credentials; ADC flow
+        true, // from_gcloud_adc
+        &[
+            "VERTEX_AI_PROJECT_ID=my-gcp-project".to_string(),
+            "VERTEX_AI_REGION=us-east1".to_string(),
+        ],
+        &ts.tls,
+    )
+    .await
+    .expect("provider_create with --from-gcloud-adc and --config keys should succeed");
+
+    // Verify provider was created with the config keys.
+    let providers = ts.state.providers.lock().await;
+    let provider = providers
+        .get("vertex-with-config")
+        .expect("provider should be stored after create");
+    assert_eq!(provider.r#type, "google-vertex-ai");
+    assert_eq!(
+        provider
+            .config
+            .get("VERTEX_AI_PROJECT_ID")
+            .map(String::as_str),
+        Some("my-gcp-project"),
+        "VERTEX_AI_PROJECT_ID must be stored in provider config"
+    );
+    assert_eq!(
+        provider.config.get("VERTEX_AI_REGION").map(String::as_str),
+        Some("us-east1"),
+        "VERTEX_AI_REGION must be stored in provider config"
+    );
+    drop(providers);
+
+    // Verify configure_provider_refresh was called (ADC flow always configures refresh).
+    let refresh_requests = ts.state.refresh_requests.lock().await.clone();
+    assert_eq!(
+        refresh_requests.len(),
+        1,
+        "exactly one refresh configure call expected"
+    );
+    assert_eq!(
+        refresh_requests[0],
+        ProviderRefreshRequestLog::Configure {
+            provider_name: "vertex-with-config".to_string(),
+            credential_key: "GOOGLE_VERTEX_AI_TOKEN".to_string(),
+            expires_at_ms: None,
+        }
+    );
+}
+
+#[tokio::test]
+async fn provider_create_from_gcloud_adc_missing_refresh_token() {
+    let ts = run_server().await;
+
+    // ADC file is valid authorized_user type but missing refresh_token.
+    let adc_content = serde_json::json!({
+        "type": "authorized_user",
+        "client_id": "test-client-id.apps.googleusercontent.com",
+        "client_secret": "test-client-secret"
+    });
+    let adc_file = tempfile::NamedTempFile::new().unwrap();
+    serde_json::to_writer(&adc_file, &adc_content).unwrap();
+    let adc_path = adc_file.path().to_str().unwrap().to_string();
+    let _guard = EnvVarGuard::set(&[("GOOGLE_APPLICATION_CREDENTIALS", &adc_path)]);
+
+    let err = run::provider_create(
+        &ts.endpoint,
+        "vertex-missing-refresh",
+        "google-vertex-ai",
+        false,
+        &[],
+        true,
+        &[],
+        &ts.tls,
+    )
+    .await
+    .expect_err("missing refresh_token should produce an error");
+
+    let err_msg = err.to_string();
+    assert!(
+        err_msg.contains("refresh_token"),
+        "error must mention 'refresh_token', got: {err_msg}"
+    );
+
+    // No provider should have been created.
+    let providers = ts.state.providers.lock().await;
+    assert!(
+        providers.is_empty(),
+        "no provider must be created when ADC validation fails"
+    );
+}
+
+#[tokio::test]
+async fn provider_create_from_gcloud_adc_missing_client_secret() {
+    let ts = run_server().await;
+
+    // ADC file is valid authorized_user type but missing client_secret.
+    let adc_content = serde_json::json!({
+        "type": "authorized_user",
+        "client_id": "test-client-id.apps.googleusercontent.com",
+        "refresh_token": "1//test-refresh-token"
+    });
+    let adc_file = tempfile::NamedTempFile::new().unwrap();
+    serde_json::to_writer(&adc_file, &adc_content).unwrap();
+    let adc_path = adc_file.path().to_str().unwrap().to_string();
+    let _guard = EnvVarGuard::set(&[("GOOGLE_APPLICATION_CREDENTIALS", &adc_path)]);
+
+    let err = run::provider_create(
+        &ts.endpoint,
+        "vertex-missing-secret",
+        "google-vertex-ai",
+        false,
+        &[],
+        true,
+        &[],
+        &ts.tls,
+    )
+    .await
+    .expect_err("missing client_secret should produce an error");
+
+    let err_msg = err.to_string();
+    assert!(
+        err_msg.contains("client_secret"),
+        "error must mention 'client_secret', got: {err_msg}"
+    );
+
+    // No provider should have been created.
+    let providers = ts.state.providers.lock().await;
+    assert!(
+        providers.is_empty(),
+        "no provider must be created when ADC validation fails"
+    );
+}

crates/openshell-core/src/driver_utils.rs

@@ -3,7 +3,9 @@
 
 //! Utility helpers shared across compute-driver crates.
 
-use crate::proto::compute::v1::DriverSandbox;
+use std::path::PathBuf;
+
+use crate::proto::compute::v1::{DriverSandbox, GetCapabilitiesResponse};
 
 // ---------------------------------------------------------------------------
 // Sandbox container/pod label keys (openshell.ai/ namespace)
@@ -34,6 +36,50 @@ pub const LABEL_SANDBOX_NAMESPACE: &str = "openshell.ai/sandbox-namespace";
 /// path used when building the `openshell-sandbox` image layer.
 pub const SUPERVISOR_IMAGE_BINARY_PATH: &str = "/openshell-sandbox";
 
+/// Return the XDG state path for a driver's sandbox JWT token file.
+///
+/// The resulting path is `$XDG_STATE_HOME/openshell/<driver_subdir>[/<namespace>]/<sandbox_id>/sandbox.jwt`.
+///
+/// `driver_subdir` is driver-specific, e.g. `"docker-sandbox-tokens"` or
+/// `"podman-sandbox-tokens"`.  When `namespace` is `Some`, it is appended as
+/// an additional path component (with `/` and `\` replaced by `-`).
+///
+/// # Errors
+/// Returns an error if the XDG state directory cannot be resolved.
+pub fn sandbox_token_path(
+    driver_subdir: &str,
+    namespace: Option<&str>,
+    sandbox_id: &str,
+) -> miette::Result<PathBuf> {
+    let mut path = crate::paths::xdg_state_dir()?
+        .join("openshell")
+        .join(driver_subdir);
+    if let Some(ns) = namespace {
+        path = path.join(ns.replace(['/', '\\'], "-"));
+    }
+    Ok(path.join(sandbox_id).join("sandbox.jwt"))
+}
+
+/// Build a [`GetCapabilitiesResponse`] from the common driver capability fields.
+///
+/// Every compute driver constructs this response with the same fields. Shared
+/// here to avoid repeating the struct literal (and the always-zero `gpu_count`
+/// default) in each driver crate.
+pub fn build_capabilities_response(
+    driver_name: &str,
+    driver_version: impl Into<String>,
+    default_image: impl Into<String>,
+    supports_gpu: bool,
+) -> GetCapabilitiesResponse {
+    GetCapabilitiesResponse {
+        driver_name: driver_name.to_string(),
+        driver_version: driver_version.into(),
+        default_image: default_image.into(),
+        supports_gpu,
+        gpu_count: 0,
+    }
+}
+
 /// Return the effective log level for a sandbox.
 ///
 /// Uses the level from the sandbox spec when non-empty, falling back to

crates/openshell-core/src/inference.rs

@@ -101,6 +101,36 @@ pub const VERTEX_AI_CREDENTIAL_KEY_NAMES: &[&str] = &[
     "VERTEX_AI_TOKEN",
 ];
 
+/// The credential key used for tokens minted from gcloud Application Default Credentials.
+///
+/// This is the key written by the gateway's `OAuth2` refresh worker when using the
+/// `--from-gcloud-adc` CLI flow. It must match `VERTEX_AI_CREDENTIAL_KEY_NAMES[2]`.
+pub const VERTEX_AI_ADC_TOKEN_KEY: &str = "GOOGLE_VERTEX_AI_TOKEN";
+
+/// GCP project ID config key for Vertex AI providers.
+pub const VERTEX_AI_PROJECT_ID_KEY: &str = "VERTEX_AI_PROJECT_ID";
+
+/// GCP region/location config key for Vertex AI providers.
+pub const VERTEX_AI_REGION_KEY: &str = "VERTEX_AI_REGION";
+
+/// Publisher override config key for Vertex AI providers.
+///
+/// Set to `"anthropic"` to force Anthropic Messages API routing regardless of model name,
+/// or any other value to force OpenAI-compatible routing.
+pub const VERTEX_AI_PUBLISHER_KEY: &str = "VERTEX_AI_PUBLISHER";
+
+/// Config key names scanned during provider discovery, in addition to credential keys.
+///
+/// These are referenced by the provider discovery plugin in `openshell-providers` to
+/// collect Vertex AI config from the environment during `--from-existing` flows.
+pub const VERTEX_AI_CONFIG_KEY_NAMES: &[&str] = &[
+    VERTEX_AI_PROJECT_ID_KEY,
+    VERTEX_AI_REGION_KEY,
+    "GOOGLE_VERTEX_AI_BASE_URL",
+    "VERTEX_AI_BASE_URL",
+    VERTEX_AI_PUBLISHER_KEY,
+];
+
 static VERTEX_AI_PROFILE: InferenceProviderProfile = InferenceProviderProfile {
     provider_type: "google-vertex-ai",
     // Base URL is project/region specific and built at route resolution time.

crates/openshell-driver-docker/src/lib.rs

@@ -320,13 +320,12 @@ impl DockerComputeDriver {
     }
 
     fn capabilities(&self) -> GetCapabilitiesResponse {
-        GetCapabilitiesResponse {
-            driver_name: "docker".to_string(),
-            driver_version: self.config.daemon_version.clone(),
-            default_image: self.config.default_image.clone(),
-            supports_gpu: self.config.supports_gpu,
-            gpu_count: 0,
-        }
+        openshell_core::driver_utils::build_capabilities_response(
+            "docker",
+            &self.config.daemon_version,
+            &self.config.default_image,
+            self.config.supports_gpu,
+        )
     }
 
     fn validate_sandbox(
@@ -962,17 +961,16 @@ fn sandbox_token_host_path_by_id(
     sandbox_id: &str,
     config: &DockerDriverRuntimeConfig,
 ) -> Result<PathBuf, Status> {
-    let base = openshell_core::paths::xdg_state_dir().map_err(|err| {
+    openshell_core::driver_utils::sandbox_token_path(
+        "docker-sandbox-tokens",
+        Some(&config.sandbox_namespace),
+        sandbox_id,
+    )
+    .map_err(|err| {
         Status::internal(format!(
             "resolve sandbox token state directory failed: {err}"
         ))
-    })?;
-    Ok(base
-        .join("openshell")
-        .join("docker-sandbox-tokens")
-        .join(config.sandbox_namespace.replace(['/', '\\'], "-"))
-        .join(sandbox_id)
-        .join("sandbox.jwt"))
+    })
 }
 
 async fn write_sandbox_token_file(

crates/openshell-driver-kubernetes/src/driver.rs

@@ -160,13 +160,12 @@ impl KubernetesComputeDriver {
     }
 
     pub async fn capabilities(&self) -> Result<GetCapabilitiesResponse, String> {
-        Ok(GetCapabilitiesResponse {
-            driver_name: "kubernetes".to_string(),
-            driver_version: openshell_core::VERSION.to_string(),
-            default_image: self.config.default_image.clone(),
-            supports_gpu: self.has_gpu_capacity().await.unwrap_or(false),
-            gpu_count: 0,
-        })
+        Ok(openshell_core::driver_utils::build_capabilities_response(
+            "kubernetes",
+            openshell_core::VERSION,
+            &self.config.default_image,
+            self.has_gpu_capacity().await.unwrap_or(false),
+        ))
     }
 
     pub fn default_image(&self) -> &str {

crates/openshell-driver-podman/src/driver.rs

@@ -57,13 +57,8 @@ fn validated_container_name(sandbox_name: &str) -> Result<String, ComputeDriverE
 }
 
 fn sandbox_token_host_path(sandbox_id: &str) -> Result<PathBuf, ComputeDriverError> {
-    let base = openshell_core::paths::xdg_state_dir()
-        .map_err(|err| ComputeDriverError::Message(format!("resolve state dir failed: {err}")))?;
-    Ok(base
-        .join("openshell")
-        .join("podman-sandbox-tokens")
-        .join(sandbox_id)
-        .join("sandbox.jwt"))
+    openshell_core::driver_utils::sandbox_token_path("podman-sandbox-tokens", None, sandbox_id)
+        .map_err(|err| ComputeDriverError::Message(format!("resolve state dir failed: {err}")))
 }
 
 async fn write_sandbox_token_file(
@@ -257,14 +252,12 @@ impl PodmanComputeDriver {
 
     /// Report driver capabilities.
     pub fn capabilities(&self) -> Result<GetCapabilitiesResponse, ComputeDriverError> {
-        let supports_gpu = Self::has_gpu_capacity();
-        Ok(GetCapabilitiesResponse {
-            driver_name: "podman".to_string(),
-            driver_version: openshell_core::VERSION.to_string(),
-            default_image: self.config.default_image.clone(),
-            supports_gpu,
-            gpu_count: 0,
-        })
+        Ok(openshell_core::driver_utils::build_capabilities_response(
+            "podman",
+            openshell_core::VERSION,
+            &self.config.default_image,
+            Self::has_gpu_capacity(),
+        ))
     }
 
     #[must_use]