Provider concept

[feloy]

kdn lacks a "Provider" concept.

Currently, to configure the connection of agents to models providers, the user needs to provides secrets / env vars / files in the configuration.

For example:

• to connect to Anthropic models: an anthropic secret
• to connect to Google Vertex AI: a couple of env vars (to define gcp project and region), and a config file for authentication
• etc

Depending on the agent, the info to pass can be different. For example the env vars to define for Vertex AI provider are different for Claude and for OpenCode: ANTHROPIC_VERTEX_PROJECT_ID + CLAUDE_CODE_USE_VERTEX + CLOUD_ML_REGION (Claude) vs GOOGLE_CLOUD_PROJECT + VERTEX_LOCATION (OpenCode).

Introducing the concept of Providers will help the user define only once the connection to providers and use them with any agent (supporting the provider).

When the user has given information for a provider, agents will have the knowledge to choose which secrets / env vars / mounted files to add to the workspace.

Also, providers will be able to contribute a list of whitelist hosts for network filtering (which may not be contributed by secrets attached to provider)

Because the provider is the only "limited" resource (the one the user is paying for), compared to agents, runtimes, etc which are all available (given a platform). The user will configure one or more providers, and he will be proposed the agents and models compatible with the configured providers only.

With the providers defined, it should be able to get the list of models from them, to help the user choose one model.

[jeffmaury]

Can you describe what would be the steps and commands for a user/ui to start a workspace, what's inside the workspace.json and what's outside (commands).

I see 2 use cases:

• llm providers: API token + optional url
• vertex AI: region + project + credentials file

[feloy]

API token (+ url)

# 1. Create a connection for anthropic
# In the background, kdn will create a 'my-anthropic' secret
# of type 'anthropic' 
kdn provider create --type anthropic my-anthropic --key my-secret-token --url http://my-private-anthropic-url

# the 'my-anthropic' secret will be automatically passed when the my-anthropic provider is used
kdn init --provider my-anthropic --model opus-4-6 --agent claude --runtime podman

(nothing in workspace.json)

Vertex AI

kdn provider create my-vertexai --type vertexai --project my-project --region my-region --auth-file ~/.config/gcloud/application_default_credentials.jso

# the claude / goose agent driver will receive the provider's connection info and set the appropriate env vars for the agent binary
kdn init --provider my-vertexai --model opus-4-6 --agent claude --runtime podman
or
kdn init --provider my-vertexai --model opus-4-6 --agent goose --runtime podman

(nothing in workspace.json)

Notes

• in any case, the --provider flag may be optional if the agent supports only one provider and the user defined only one connection for this provider