refactor: Convert Tanzu provider to declarative JSON config

Replace the dedicated ~1,000-line Rust Tanzu provider with a 21-line
declarative JSON config. Add generic env_vars and dynamic_models support
to the declarative provider framework so all providers benefit.

- Add EnvVarConfig struct and expand_env_vars() helper for ${VAR}
  substitution in declarative provider base_url templates
- Add dynamic_models field to enable allows_unlisted_models in registry
- Wire env var expansion into OpenAI, Ollama, and Anthropic engines'
  from_custom_config() methods
- Create declarative/tanzu.json with env var-driven endpoint config
- Delete dedicated tanzu.rs provider (562 lines) and tests (449 lines)
- Fix latent bug in ollama.rs port check using raw template vs resolved URL
- Add 9 new tests (deserialization, env var expansion, registry wiring)

Net: +265 -1,027 lines. 582 tests pass, clippy clean.
Manually verified end-to-end against live Tanzu AI Services endpoint.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Nick Kuhn <nick.kuhn@broadcom.com>

Author: nkuhn-vmw

crates/goose-server/src/openapi.rs

@@ -17,7 +17,7 @@ use rmcp::model::{
 use utoipa::{OpenApi, ToSchema};
 
 use goose::config::declarative_providers::{
-    DeclarativeProviderConfig, LoadedProvider, ProviderEngine,
+    DeclarativeProviderConfig, EnvVarConfig, LoadedProvider, ProviderEngine,
 };
 use goose::conversation::message::{
     ActionRequired, ActionRequiredData, FrontendToolRequest, Message, MessageContent,
@@ -490,6 +490,7 @@ derive_utoipa!(Icon as IconSchema);
         LoadedProvider,
         ProviderEngine,
         DeclarativeProviderConfig,
+        EnvVarConfig,
         ExtensionEntry,
         ExtensionConfig,
         ConfigKey,

crates/goose/src/config/declarative_providers.rs

@@ -27,6 +27,17 @@ pub enum ProviderEngine {
     Anthropic,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+pub struct EnvVarConfig {
+    pub name: String,
+    #[serde(default)]
+    pub required: bool,
+    #[serde(default)]
+    pub secret: bool,
+    pub description: Option<String>,
+    pub default: Option<String>,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
 pub struct DeclarativeProviderConfig {
     pub name: String,
@@ -42,6 +53,10 @@ pub struct DeclarativeProviderConfig {
     pub supports_streaming: Option<bool>,
     #[serde(default = "default_requires_auth")]
     pub requires_auth: bool,
+    #[serde(default)]
+    pub env_vars: Option<Vec<EnvVarConfig>>,
+    #[serde(default)]
+    pub dynamic_models: Option<bool>,
 }
 
 fn default_requires_auth() -> bool {
@@ -62,6 +77,40 @@ impl DeclarativeProviderConfig {
     }
 }
 
+/// Expand `${VAR_NAME}` placeholders in a template string using the given env var configs.
+/// Resolves values via Config (secret if `secret`, param otherwise), falls back to `default`.
+/// Returns an error if a `required` var is missing.
+pub fn expand_env_vars(template: &str, env_vars: &[EnvVarConfig]) -> Result<String> {
+    let config = Config::global();
+    let mut result = template.to_string();
+    for var in env_vars {
+        let placeholder = format!("${{{}}}", var.name);
+        if !result.contains(&placeholder) {
+            continue;
+        }
+        let value = if var.secret {
+            config.get_secret::<String>(&var.name).ok()
+        } else {
+            config.get_param::<String>(&var.name).ok()
+        };
+        let value = match value {
+            Some(v) => v,
+            None => match &var.default {
+                Some(d) => d.clone(),
+                None if var.required => {
+                    return Err(anyhow::anyhow!(
+                        "Required environment variable {} is not set",
+                        var.name
+                    ));
+                }
+                None => continue,
+            },
+        };
+        result = result.replace(&placeholder, &value);
+    }
+    Ok(result)
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
 pub struct LoadedProvider {
     pub config: DeclarativeProviderConfig,
@@ -154,6 +203,8 @@ pub fn create_custom_provider(
         timeout_seconds: None,
         supports_streaming: params.supports_streaming,
         requires_auth: params.requires_auth,
+        env_vars: None,
+        dynamic_models: None,
     };
 
     let custom_providers_dir = custom_providers_dir();
@@ -211,6 +262,8 @@ pub fn update_custom_provider(params: UpdateCustomProviderParams) -> Result<()>
             timeout_seconds: existing_config.timeout_seconds,
             supports_streaming: params.supports_streaming,
             requires_auth: params.requires_auth,
+            env_vars: existing_config.env_vars,
+            dynamic_models: existing_config.dynamic_models,
         };
 
         let file_path = custom_providers_dir().join(format!("{}.json", updated_config.name));
@@ -351,3 +404,133 @@ pub fn register_declarative_provider(
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_tanzu_json_deserializes() {
+        let json = include_str!("../providers/declarative/tanzu.json");
+        let config: DeclarativeProviderConfig =
+            serde_json::from_str(json).expect("tanzu.json should parse");
+        assert_eq!(config.name, "tanzu_ai");
+        assert_eq!(config.display_name, "Tanzu AI Services");
+        assert!(matches!(config.engine, ProviderEngine::OpenAI));
+        assert_eq!(config.api_key_env, "TANZU_AI_API_KEY");
+        assert_eq!(
+            config.base_url,
+            "${TANZU_AI_ENDPOINT}/openai/v1/chat/completions"
+        );
+        assert_eq!(config.dynamic_models, Some(true));
+        assert_eq!(config.supports_streaming, Some(false));
+
+        let env_vars = config.env_vars.as_ref().expect("env_vars should be set");
+        assert_eq!(env_vars.len(), 1);
+        assert_eq!(env_vars[0].name, "TANZU_AI_ENDPOINT");
+        assert!(env_vars[0].required);
+        assert!(!env_vars[0].secret);
+
+        assert_eq!(config.models.len(), 1);
+        assert_eq!(config.models[0].name, "openai/gpt-oss-120b");
+    }
+
+    #[test]
+    fn test_existing_json_files_still_deserialize_without_new_fields() {
+        let json = include_str!("../providers/declarative/groq.json");
+        let config: DeclarativeProviderConfig =
+            serde_json::from_str(json).expect("groq.json should parse without env_vars");
+        assert!(config.env_vars.is_none());
+        assert!(config.dynamic_models.is_none());
+    }
+
+    #[test]
+    fn test_expand_env_vars_replaces_placeholder() {
+        let _guard = env_lock::lock_env([("TEST_EXPAND_HOST", Some("https://example.com/api"))]);
+
+        let env_vars = vec![EnvVarConfig {
+            name: "TEST_EXPAND_HOST".to_string(),
+            required: true,
+            secret: false,
+            description: None,
+            default: None,
+        }];
+
+        let result = expand_env_vars("${TEST_EXPAND_HOST}/v1/chat/completions", &env_vars).unwrap();
+        assert_eq!(result, "https://example.com/api/v1/chat/completions");
+    }
+
+    #[test]
+    fn test_expand_env_vars_required_missing_errors() {
+        let _guard = env_lock::lock_env([("TEST_EXPAND_MISSING", None::<&str>)]);
+
+        let env_vars = vec![EnvVarConfig {
+            name: "TEST_EXPAND_MISSING".to_string(),
+            required: true,
+            secret: false,
+            description: None,
+            default: None,
+        }];
+
+        let result = expand_env_vars("${TEST_EXPAND_MISSING}/path", &env_vars);
+        assert!(result.is_err());
+        assert!(result
+            .unwrap_err()
+            .to_string()
+            .contains("TEST_EXPAND_MISSING"));
+    }
+
+    #[test]
+    fn test_expand_env_vars_uses_default_when_missing() {
+        let _guard = env_lock::lock_env([("TEST_EXPAND_DEFAULT", None::<&str>)]);
+
+        let env_vars = vec![EnvVarConfig {
+            name: "TEST_EXPAND_DEFAULT".to_string(),
+            required: false,
+            secret: false,
+            description: None,
+            default: Some("https://fallback.example.com".to_string()),
+        }];
+
+        let result =
+            expand_env_vars("${TEST_EXPAND_DEFAULT}/v1/chat/completions", &env_vars).unwrap();
+        assert_eq!(result, "https://fallback.example.com/v1/chat/completions");
+    }
+
+    #[test]
+    fn test_expand_env_vars_no_placeholders_passthrough() {
+        let env_vars = vec![EnvVarConfig {
+            name: "UNUSED_VAR".to_string(),
+            required: true,
+            secret: false,
+            description: None,
+            default: None,
+        }];
+
+        let result =
+            expand_env_vars("https://static.example.com/v1/chat/completions", &env_vars).unwrap();
+        assert_eq!(result, "https://static.example.com/v1/chat/completions");
+    }
+
+    #[test]
+    fn test_expand_env_vars_empty_slice_passthrough() {
+        let result = expand_env_vars("${WHATEVER}/path", &[]).unwrap();
+        assert_eq!(result, "${WHATEVER}/path");
+    }
+
+    #[test]
+    fn test_expand_env_vars_env_value_overrides_default() {
+        let _guard = env_lock::lock_env([("TEST_EXPAND_OVERRIDE", Some("https://from-env.com"))]);
+
+        let env_vars = vec![EnvVarConfig {
+            name: "TEST_EXPAND_OVERRIDE".to_string(),
+            required: false,
+            secret: false,
+            description: None,
+            default: Some("https://from-default.com".to_string()),
+        }];
+
+        let result = expand_env_vars("${TEST_EXPAND_OVERRIDE}/path", &env_vars).unwrap();
+        assert_eq!(result, "https://from-env.com/path");
+    }
+}

crates/goose/src/providers/anthropic.rs

@@ -97,7 +97,13 @@ impl AnthropicProvider {
             key: api_key,
         };
 
-        let mut api_client = ApiClient::new(config.base_url, auth)?
+        let resolved_url = if let Some(ref env_vars) = config.env_vars {
+            crate::config::declarative_providers::expand_env_vars(&config.base_url, env_vars)?
+        } else {
+            config.base_url.clone()
+        };
+
+        let mut api_client = ApiClient::new(resolved_url, auth)?
             .with_header("anthropic-version", ANTHROPIC_API_VERSION)?;
 
         if let Some(headers) = &config.headers {

crates/goose/src/providers/declarative/tanzu.json

@@ -0,0 +1,21 @@
+{
+  "name": "tanzu_ai",
+  "engine": "openai",
+  "display_name": "Tanzu AI Services",
+  "description": "Enterprise-managed LLM access through VMware Tanzu Platform AI Services",
+  "api_key_env": "TANZU_AI_API_KEY",
+  "base_url": "${TANZU_AI_ENDPOINT}/openai/v1/chat/completions",
+  "env_vars": [
+    {
+      "name": "TANZU_AI_ENDPOINT",
+      "required": true,
+      "secret": false,
+      "description": "Your Tanzu AI Services endpoint URL"
+    }
+  ],
+  "dynamic_models": true,
+  "models": [
+    { "name": "openai/gpt-oss-120b", "context_limit": 131072 }
+  ],
+  "supports_streaming": false
+}

crates/goose/src/providers/init.rs

@@ -22,7 +22,6 @@ use super::{
     provider_registry::ProviderRegistry,
     sagemaker_tgi::SageMakerTgiProvider,
     snowflake::SnowflakeProvider,
-    tanzu::TanzuAIServicesProvider,
     tetrate::TetrateProvider,
     venice::VeniceProvider,
     xai::XaiProvider,
@@ -62,7 +61,6 @@ async fn init_registry() -> RwLock<ProviderRegistry> {
         registry.register::<OpenRouterProvider>(true);
         registry.register::<SageMakerTgiProvider>(false);
         registry.register::<SnowflakeProvider>(false);
-        registry.register::<TanzuAIServicesProvider>(false);
         registry.register::<TetrateProvider>(true);
         registry.register::<VeniceProvider>(false);
         registry.register::<XaiProvider>(false);
@@ -296,6 +294,47 @@ mod tests {
         assert_eq!(result.context_limit, Some(expected_limit));
     }
 
+    #[tokio::test]
+    async fn test_tanzu_declarative_provider_registry_wiring() {
+        let providers_list = providers().await;
+        let tanzu = providers_list
+            .iter()
+            .find(|(m, _)| m.name == "tanzu_ai")
+            .expect("tanzu_ai provider should be registered");
+        let (meta, provider_type) = tanzu;
+
+        // Should be a Declarative (fixed) provider
+        assert_eq!(*provider_type, ProviderType::Declarative);
+
+        assert_eq!(meta.display_name, "Tanzu AI Services");
+        assert_eq!(meta.default_model, "openai/gpt-oss-120b");
+        assert!(
+            meta.allows_unlisted_models,
+            "dynamic_models should enable allows_unlisted_models"
+        );
+
+        // First config key should be TANZU_AI_API_KEY (secret, required)
+        let api_key = meta
+            .config_keys
+            .iter()
+            .find(|k| k.name == "TANZU_AI_API_KEY")
+            .expect("TANZU_AI_API_KEY config key should exist");
+        assert!(
+            api_key.required,
+            "API key should be required for fixed declarative provider"
+        );
+        assert!(api_key.secret, "API key should be secret");
+
+        // Should have TANZU_AI_ENDPOINT config key (not secret, required)
+        let endpoint = meta
+            .config_keys
+            .iter()
+            .find(|k| k.name == "TANZU_AI_ENDPOINT")
+            .expect("TANZU_AI_ENDPOINT config key should exist");
+        assert!(endpoint.required, "Endpoint should be required");
+        assert!(!endpoint.secret, "Endpoint should not be secret");
+    }
+
     #[tokio::test]
     async fn test_openai_compatible_providers_config_keys() {
         let providers_list = providers().await;

crates/goose/src/providers/mod.rs

@@ -32,7 +32,6 @@ pub mod provider_test;
 mod retry;
 pub mod sagemaker_tgi;
 pub mod snowflake;
-pub mod tanzu;
 pub mod testprovider;
 pub mod tetrate;
 pub mod toolshim;

crates/goose/src/providers/ollama.rs

@@ -99,18 +99,22 @@ impl OllamaProvider {
     ) -> Result<Self> {
         let timeout = Duration::from_secs(config.timeout_seconds.unwrap_or(OLLAMA_TIMEOUT));
 
-        let base =
-            if config.base_url.starts_with("http://") || config.base_url.starts_with("https://") {
-                config.base_url.clone()
-            } else {
-                format!("http://{}", config.base_url)
-            };
+        let resolved_url = if let Some(ref env_vars) = config.env_vars {
+            crate::config::declarative_providers::expand_env_vars(&config.base_url, env_vars)?
+        } else {
+            config.base_url.clone()
+        };
+
+        let base = if resolved_url.starts_with("http://") || resolved_url.starts_with("https://") {
+            resolved_url.clone()
+        } else {
+            format!("http://{}", resolved_url)
+        };
 
         let mut base_url = Url::parse(&base)
-            .map_err(|e| anyhow::anyhow!("Invalid base URL '{}': {}", config.base_url, e))?;
+            .map_err(|e| anyhow::anyhow!("Invalid base URL '{}': {}", resolved_url, e))?;
 
-        let explicit_default_port =
-            config.base_url.ends_with(":80") || config.base_url.ends_with(":443");
+        let explicit_default_port = resolved_url.ends_with(":80") || resolved_url.ends_with(":443");
         let is_https = base_url.scheme() == "https";
 
         if base_url.port().is_none() && !explicit_default_port && !is_https {

crates/goose/src/providers/openai.rs

@@ -155,8 +155,14 @@ impl OpenAiProvider {
             None
         };
 
-        let url = url::Url::parse(&config.base_url)
-            .map_err(|e| anyhow::anyhow!("Invalid base URL '{}': {}", config.base_url, e))?;
+        let resolved_url = if let Some(ref env_vars) = config.env_vars {
+            crate::config::declarative_providers::expand_env_vars(&config.base_url, env_vars)?
+        } else {
+            config.base_url.clone()
+        };
+
+        let url = url::Url::parse(&resolved_url)
+            .map_err(|e| anyhow::anyhow!("Invalid base URL '{}': {}", resolved_url, e))?;
 
         let host = if let Some(port) = url.port() {
             format!(