feat(agentstudio): add providers commands via official SDK

[cmarguta-alg]

🤔 What

Adds algolia agentstudio providers so you can list, get, create, update, delete, and inspect models for Agent Studio LLM providers through the official Go SDK.

🤷 Why

#289 shipped agents and #288 shipped conversations. Providers is the next sibling under agentstudio. Create/update take an inline --json object because input varies by provider type (apiKey, baseUrl, Azure fields).

🔍 How

Section Group	Change
Commands	Register algolia agentstudio providers with list/get/create/update/delete/models.
Input	create requires --json (name, providerName, input). update takes --name or a JSON patch (name and/or input). providerName cannot be patched.
Models	models with no args lists models by provider type. models <provider-id> lists models for that configured provider.
Safety	delete requires --confirm off TTY.

IDs in examples are UUID-shaped. No file reads. Anthropic keys must be workspace-scoped; Agent Studio does not send anthropic-workspace-id.

🧪 Testing

Stacked on #288. Merge #289 then #288 first, or check out this branch which includes them.

Reads need settings. Writes need editSettings (admin keys skip the CLI ACL check). Replace <APP_ID> with an Agent Studio app. Provider IDs are UUIDs. Pass --application-id if the selected profile app does not resolve. Anthropic keys must be scoped to a single workspace.

Quick checks

task build
go test ./pkg/cmd/providers/... ./pkg/cmd/agentstudio ./pkg/cmd/root -count=1
./algolia agentstudio providers --help
./algolia agentstudio providers create --help
./algolia agentstudio providers update --help

Expect tests green, providers beside agents and conversations, and subcommands list, get, create, update, delete, models.

Scenario 1 — create, list, get, models

Action: create a provider, then list/get/models.

./algolia agentstudio providers create --application-id <APP_ID> --json '{
  "name": "cli-openai",
  "providerName": "openai",
  "input": {"apiKey": "<api-key>"}
}'

./algolia agentstudio providers list --application-id <APP_ID> --page 1 --limit 20
./algolia agentstudio providers get <provider-id> --application-id <APP_ID>
./algolia agentstudio providers models --application-id <APP_ID>
./algolia agentstudio providers models <provider-id> --application-id <APP_ID>

Expectation: create returns JSON with id and providerName: "openai". list includes that id. get matches. models with no ID is an object keyed by type; models <provider-id> is a JSON array of model names.

Scenario 2 — update name and input

Action: rename, then rotate the key.

./algolia agentstudio providers update <provider-id> --application-id <APP_ID> --name "cli-openai-renamed"
./algolia agentstudio providers update <provider-id> --application-id <APP_ID> --json '{"input":{"apiKey":"<api-key>"}}'
./algolia agentstudio providers get <provider-id> --application-id <APP_ID>

Expectation: first update changes name. Second accepts the new input. get shows the new name. providerName is unchanged.

Scenario 3 — delete confirmation (failure mode)

Action: delete without --confirm in a non-TTY, then with --confirm.

./algolia agentstudio providers delete <provider-id> --application-id <APP_ID>
./algolia agentstudio providers delete <provider-id> --application-id <APP_ID> --confirm
./algolia agentstudio providers get <provider-id> --application-id <APP_ID>

Expectation: the first command errors with --confirm required when non-interactive shell is detected and the provider still exists. The second exits 0. get then fails because the provider is gone.

⚠️ Dependencies

• Stacked on #288 (lw-oct-agent-studio-2).
• Target application must have Agent Studio.
• No new environment variables. --json will contain an API key; avoid committing real keys.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 85 complexity · 79 duplication

Metric	Results
Complexity	85
Duplication	79

View in Codacy

_{TIP This summary will be updated as you push new changes.}

[cmarguta-alg]

Status: 🟢 pass · 🔴 fail · 🟡 inconclusive (unable to test full functionality due to missing required data)

Personal QA Agent — retest of #290 (bcc7d27, create/update added)

Verdict: merge-ready for the command surface. Create/rotate with a valid LLM key is 🟡 (no OpenAI/Anthropic key in this environment). Live delete is now 🟢.

Retested bcc7d27 on app VUX4PAGOPD via --application-id.

Results

Check	Status	Notes
task build	🟢
go test ./pkg/cmd/providers/... ./pkg/cmd/agentstudio ./pkg/cmd/root -count=1	🟢	Includes create/update packages
Subcommands list/get/create/update/delete/models	🟢	Completion matches
Scenario 1 create --json with a dummy apiKey	🟡	API 422 Invalid API key provided. No real LLM key in env, so a successful create of a new provider was not run
Scenario 1 list / get / catalog models	🟢	Prior run + this run. After delete, list is empty with pagination 1/20
Scenario 1 models <provider-id>	🟢	Prior run against Anthropic (14 model names)
Scenario 2 update --name then --json '{"name":…}'	🟢	Renamed Anthropic → qa-pr290-renamed → restored Anthropic. providerName stayed anthropic
Scenario 2 rotate input.apiKey via --json	🟡	Same as create: dummy key is rejected; no live key to rotate to
Create/update validation (missing --json, invalid JSON, missing name/input, bad providerName, --json+--name, empty {})	🟢
Scenario 3 delete without --confirm in non-TTY	🟢	Confirm required; get still succeeded
Scenario 3 delete --confirm while an agent still referenced the provider	🟢	API 422 Cannot delete provider because it is still used by the following agents: renamed-bot. CLI surfaces it
Scenario 3 delete --confirm after that agent was removed	🟢	Exit 0; subsequent get 404; list empty
Interactive delete prompt	🟡	Non-TTY; --confirm / -y tested

Leftover agent renamed-bot was deleted only so provider delete could complete. App now has 0 providers.

Security / DX notes (not 🔴)

• --json puts the LLM key on argv (shell history). Matches the PR warning.
• list/get still print input.apiKey (short/masked string in this API).
• Dummy keys are rejected at create time (422), so we could not leave a throwaway provider to delete instead of the real one.

— Personal QA Agent