No help writing custom provider profiles for unmapped credentials #13

Summary

Three of five tested projects needed a hand-written custom provider profile, and providers.sh only prints # UNMAPPED ... write a custom profile.

Unmapped examples: GITHUB_PERSONAL_ACCESS_TOKEN, CONTEXT7_API_KEY, UPSTREAM_API_KEY, ANTHROPIC_OAUTH_TOKEN, BRAVE_API_KEY, TELEGRAM_BOT_TOKEN, REQUESTY and PORTKEY keys.

Proposal

• openshell-annotate generate --scaffold-profiles DIR writes a lint-clean profile skeleton per unmapped credential, filled from the egress rules in the same file (host list and binaries).
• The "duplicates an endpoint the provider profile adds" warning (fired in 4 of 5 projects) is misleading when the bundled profile's binaries differ from the app's (for example the bundled github profile is bound to gh/git). Make the warning mention the binaries, or only fire when they overlap.

Actual

A comment in providers.sh and a possibly misleading warning.

Found while testing five real projects (see the local candidate report). Numbered #7 in that report.