fix: VMware Tanzu Platform provider - bug fixes, streaming, UI improvements (#8126)

Signed-off-by: Nick Kuhn <nick.kuhn@broadcom.com>
Signed-off-by: Douwe Osinga <douwe@squareup.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Douwe Osinga <douwe@squareup.com>

crates/goose/src/providers/declarative/tanzu.json

@@ -1,8 +1,8 @@
 {
   "name": "tanzu_ai",
   "engine": "openai",
-  "display_name": "Tanzu AI Services",
-  "description": "Enterprise-managed LLM access through VMware Tanzu Platform AI Services",
+  "display_name": "VMware Tanzu Platform",
+  "description": "Enterprise-managed LLM access through AI Services on VMware Tanzu Platform.",
   "api_key_env": "TANZU_AI_API_KEY",
   "base_url": "${TANZU_AI_ENDPOINT}/openai/v1/chat/completions",
   "env_vars": [
@@ -10,12 +10,20 @@
       "name": "TANZU_AI_ENDPOINT",
       "required": true,
       "secret": false,
-      "description": "Your Tanzu AI Services endpoint URL"
+      "description": "Your VMware Tanzu Platform AI Services endpoint URL"
+    },
+    {
+      "name": "TANZU_AI_STREAMING",
+      "required": false,
+      "secret": false,
+      "primary": true,
+      "default": "true",
+      "description": "Enable streaming responses (true/false)"
     }
   ],
   "dynamic_models": true,
   "models": [
     { "name": "openai/gpt-oss-120b", "context_limit": 131072 }
   ],
-  "supports_streaming": false
+  "supports_streaming": true
 }

crates/goose/src/providers/init.rs

@@ -191,7 +191,7 @@ mod tests {
         // Should be a Declarative (fixed) provider
         assert_eq!(*provider_type, ProviderType::Declarative);
 
-        assert_eq!(meta.display_name, "Tanzu AI Services");
+        assert_eq!(meta.display_name, "VMware Tanzu Platform");
         assert_eq!(meta.default_model, "openai/gpt-oss-120b");
 
         // First config key should be TANZU_AI_API_KEY (secret, required)

crates/goose/src/providers/openai.rs

@@ -153,7 +153,17 @@ impl OpenAiProvider {
         let global_config = crate::config::Config::global();
 
         let api_key: Option<String> = if config.requires_auth && !config.api_key_env.is_empty() {
-            global_config.get_secret(&config.api_key_env).ok()
+            Some(global_config.get_secret::<String>(&config.api_key_env).map_err(|e| {
+                use crate::config::ConfigError;
+                match e {
+                    ConfigError::NotFound(_) => anyhow::anyhow!(
+                        "Required API key {} is not set. Configure it via `goose configure` or set the {} environment variable.",
+                        config.api_key_env,
+                        config.api_key_env
+                    ),
+                    other => anyhow::anyhow!("Failed to read {}: {}", config.api_key_env, other),
+                }
+            })?)
         } else {
             None
         };

crates/goose/src/providers/provider_registry.rs

@@ -125,12 +125,14 @@ impl ProviderRegistry {
 
         if let Some(ref env_vars) = config.env_vars {
             for ev in env_vars {
+                // Default primary to `required` so required fields show prominently in the UI
+                let primary = ev.primary.unwrap_or(ev.required);
                 config_keys.push(super::base::ConfigKey::new(
                     &ev.name,
                     ev.required,
                     ev.secret,
                     ev.default.as_deref(),
-                    false,
+                    primary,
                 ));
             }
         }