Credential-less provider profiles cannot be instantiated without a credential source

issue に示されている provider profile lint、import、create コマンドを、credentials: [] を持つプロファイルで使って動作を再現します。provider の作成エントリポイントと、その credential source の検証を追跡します。認証情報のないプロファイルを作成して sandbox にアタッチでき、認証情報のあるプロファイルでは引き続き設定されたソースが必要で、エンドポイントが有効なネットワークポリシーに残ることを完了条件とします。

User Story

As an OpenShell user, I want to create a provider instance from a provider profile that declares no credentials, so that I can use the provider solely to distribute network access policies to sandboxes.
This is useful for internal services and public endpoints where authentication is not required, but where the provider profile is still useful for managing and attaching network policy.

Problem Statement

A valid provider profile with credentials: [] can be linted and imported successfully, but a provider instance cannot be created from that profile without supplying one of the credential-source options.
For example, a profile containing only a TCP endpoint and no credentials is accepted by the profile validation/import commands, but:
openshell provider create --name example --type example
fails because the CLI requires a credential source.
This prevents credential-less, policy-only provider profiles from being instantiated.

Impact / Why This Matters

Users who want to use provider profiles purely to distribute network policies must currently provide a credential source even when the provider profile does not require credentials.
As a workaround, users have to provide a dummy/fake secret when creating the provider instance.
This creates unnecessary configuration and makes the provider appear to have credentials when it does not actually require or use any.
For policy-only providers, this also makes it impossible to use the provider model as intended without introducing artificial credentials into the configuration.

Acceptance Criteria

• A provider profile containing credentials: [] can be instantiated without providing a credential source.
• The following command succeeds for a credential-less provider profile:

openshell provider create --name example --type example

• No dummy, fake, or otherwise unnecessary credential is required.
• The resulting provider instance can be attached to a sandbox.
• Endpoints defined by the provider profile are included in the sandbox's effective network policy.
• Existing provider profiles that require credentials continue to require their appropriate credential sources.

Reproduction Steps

Create /tmp/example-provider.yaml:

id: example
display_name: Example
description: Credential-less TCP access to example.com
category: other
inference_capable: false

credentials: []

endpoints:
  - host: example.com
    port: 443
    protocol: tcp

binaries:
  - /usr/bin/curl

2. Validate the profile

openshell provider profile lint -f /tmp/example-provider.yaml

Expected:

Provider profile lint passed.

3. Import the profile

openshell provider profile import \
  -f /tmp/example-provider.yaml

The profile is imported successfully.

4. Try to create a provider without credentials

openshell provider create \
  --name example \
  --type example

Actual result:

error: the following required arguments were not provided:
<--from-existing|--credential ...|--from-gcloud-adc|--runtime-credentials|--from-oidc-token>

The profile explicitly declares:

credentials: []

but the provider creation command still requires a credential-source option.

5. Workaround

The provider can only be created by supplying a credential source, for example by using a dummy/fake secret.

This is unnecessary because the provider profile itself declares that it has no credentials.

Environment

• OpenShell: 0.0.116
• OS: macOS 26.6.2
• Deployment: OpenShell gateway running locally, docker desktop 4.90.0, docker engine 29.7.2,
• Provider type: custom provider profile
• Provider profile: credential-less (credentials: [])
• Network policy: TCP endpoint example.com:443

Logs

$ openshell provider create --name example --type example

error: the following required arguments were not provided:
<--from-existing|--credential ...|--from-gcloud-adc|--runtime-credentials|--from-oidc-token>