feat: add provider profile management api

scripts/src/cli.ts

@@ -39,6 +39,10 @@ async function dispatch(args: ParsedArgs): Promise<JsonValue> {
   if (group === "server" && command === "logs") return serverLogs(args);
   if (group === "server" && command === "stop") return stopServer(args);
   if (group === "backends" && command === "list") return client(args).get("/api/v1/backends");
+  if (group === "provider-profiles" && command === "list") return client(args).get("/api/v1/provider-profiles");
+  if (group === "provider-profiles" && command === "show" && id) return client(args).get(`/api/v1/provider-profiles/${encodeURIComponent(normalizeProfile(id))}`);
+  if (group === "provider-profiles" && command === "set-key" && id) return setProviderProfileKey(args, id);
+  if (group === "provider-profiles" && command === "validate" && id) return validateProviderProfileCli(args, id);
   if (group === "secrets" && command === "codex" && id === "render") return renderCodexSecret(args);
   if (group === "sessions" && command === "ps") return listSessions(args);
   if (group === "sessions" && command === "create") return sessionCreate(args, id ?? null);
@@ -391,6 +395,47 @@ async function renderCodexSecret(args: ParsedArgs): Promise<JsonRecord> {
   return renderCodexProviderSecretPlan(options);
 }
 
+async function setProviderProfileKey(args: ParsedArgs, profileValue: string): Promise<JsonRecord> {
+  const profile = normalizeProfile(profileValue);
+  if (args.flags.get("key-stdin") !== true) throw new AgentRunError("schema-invalid", "provider-profiles set-key requires --key-stdin", { httpStatus: 2 });
+  const apiKey = (await readStdinText()).trim();
+  if (apiKey.length === 0) throw new AgentRunError("schema-invalid", "stdin api key is empty", { httpStatus: 2 });
+  const body: JsonRecord = {
+    apiKey,
+    reason: optionalFlag(args, "reason") ?? "operator-cli",
+    delegatedBy: {
+      system: optionalFlag(args, "delegated-system") ?? "operator-cli",
+      userId: optionalFlag(args, "delegated-user-id") ?? null,
+      username: optionalFlag(args, "delegated-username") ?? null,
+      requestId: optionalFlag(args, "delegated-request-id") ?? null,
+    },
+  };
+  const config: JsonRecord = {};
+  copyOptionalFlag(args, config, "model");
+  copyOptionalFlag(args, config, "base-url", "baseUrl");
+  copyOptionalFlag(args, config, "provider-name", "providerName");
+  copyOptionalFlag(args, config, "env-key", "envKey");
+  if (Object.keys(config).length > 0) body.config = config;
+  return await client(args).put(`/api/v1/provider-profiles/${encodeURIComponent(profile)}/credential`, body) as JsonRecord;
+}
+
+async function validateProviderProfileCli(args: ParsedArgs, profileValue: string): Promise<JsonRecord> {
+  const profile = normalizeProfile(profileValue);
+  const started = await client(args).post(`/api/v1/provider-profiles/${encodeURIComponent(profile)}/validate`, {}) as JsonRecord;
+  if (args.flags.get("wait") !== true) return started;
+  const validationId = typeof started.validationId === "string" ? started.validationId : "";
+  if (!validationId) throw new AgentRunError("infra-failed", "provider profile validate response omitted validationId", { httpStatus: 1, details: started });
+  const timeoutMs = Math.max(1, Number(optionalFlag(args, "timeout-ms") ?? 60_000));
+  const deadline = Date.now() + timeoutMs;
+  let latest: JsonRecord = started;
+  while (Date.now() < deadline) {
+    await sleep(2_000);
+    latest = await client(args).get(`/api/v1/provider-profiles/${encodeURIComponent(profile)}/validations/${encodeURIComponent(validationId)}`) as JsonRecord;
+    if (latest.status === "completed" || latest.status === "failed" || latest.status === "cancelled") return { action: "provider-profile-validation", initial: started, latest, valuesPrinted: false };
+  }
+  return { action: "provider-profile-validation", initial: started, latest, timedOut: true, timeoutMs, valuesPrinted: false };
+}
+
 async function startServer(args: ParsedArgs): Promise<JsonRecord> {
   if (args.flags.get("foreground") === true) return startServerForeground(args);
   const port = Number(flag(args, "port", "8080"));
@@ -723,6 +768,10 @@ function help(): JsonRecord {
       "queue dispatch <taskId> [--json-file <dispatch.json>] [--idempotency-key <key>] [--image <image>] [--namespace <namespace>]",
       "queue refresh <taskId>",
       "secrets codex render --dry-run [--profile codex|deepseek|minimax-m3] [--codex-home <dir>] [--namespace agentrun-v01] [--secret-name <name>]",
+      "provider-profiles list",
+      "provider-profiles show <profile>",
+      "provider-profiles set-key <profile> --key-stdin [--model <model>] [--base-url <url>]",
+      "provider-profiles validate <profile> [--wait] [--timeout-ms <ms>]",
       "backends list",
       "server start [--port <port>] [--host <host>] [--foreground]",
       "server status [--port <port>]",