fix(provider): 隐藏 Windsurf refresh token 刷新入口

frontend/src/utils/__tests__/providerKeyAuth.spec.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 
 import {
+  canRefreshOAuthCredential,
   getProviderMaskedSecretLabel,
   shouldShowOAuthRefreshControl,
 } from '@/utils/providerKeyAuth'
@@ -17,14 +18,25 @@ describe('providerKeyAuth', () => {
     expect(shouldShowOAuthRefreshControl(key, 'grok')).toBe(false)
   })
 
-  it('keeps standard OAuth providers on OAuth token semantics', () => {
-    const key = {
+  it('hides oauth refresh control when backend marks a provider as non-refreshable', () => {
+    const input = {
       auth_type: 'oauth',
       oauth_managed: true,
       can_refresh_oauth: false,
     }
 
-    expect(getProviderMaskedSecretLabel(key, 'codex')).toBe('[OAuth Token]')
-    expect(shouldShowOAuthRefreshControl(key, 'codex')).toBe(true)
+    expect(canRefreshOAuthCredential(input)).toBe(false)
+    expect(shouldShowOAuthRefreshControl(input)).toBe(false)
+  })
+
+  it('keeps legacy oauth refresh control visible when backend capability is absent', () => {
+    const input = {
+      auth_type: 'oauth',
+      oauth_managed: true,
+    }
+
+    expect(canRefreshOAuthCredential(input)).toBe(true)
+    expect(shouldShowOAuthRefreshControl(input)).toBe(true)
+    expect(getProviderMaskedSecretLabel(input, 'codex')).toBe('[OAuth Token]')
   })
 })

frontend/src/utils/__tests__/providerKeyStatus.spec.ts

@@ -251,4 +251,20 @@ describe('providerKeyStatus', () => {
     })
     expect(getOAuthStatusTitle(input, 0)).toBe('Refresh Token 未添加，无法自动刷新')
   })
+
+  it('does not treat non-refreshable provider sessions as missing refresh token', () => {
+    const input = {
+      auth_type: 'oauth',
+      oauth_managed: true,
+      can_refresh_oauth: false,
+    }
+
+    expect(getOAuthStatusDisplayWithFallback(input, 0)).toEqual({
+      text: '有效期未知',
+      isExpired: false,
+      isExpiringSoon: false,
+      isInvalid: false,
+    })
+    expect(getOAuthStatusTitle(input, 0)).toBe('Token 有效期未知')
+  })
 })

frontend/src/utils/providerKeyAuth.ts

@@ -92,7 +92,7 @@ export function shouldShowOAuthRefreshControl(
   providerType?: string | null,
 ): boolean {
   if (isGrokSessionCredential(input, providerType)) return false
-  return isOAuthManagedCredential(input)
+  return canRefreshOAuthCredential(input)
 }
 
 export function canExportOAuthCredential(input: ProviderKeyAuthCarrier): boolean {

frontend/src/utils/providerKeyStatus.ts

@@ -202,7 +202,7 @@ function mergeOAuthStatusDisplay(
 }
 
 function isOAuthCredentialWithoutRefreshToken(input: ProviderKeyStatusCarrier): boolean {
-  return isOAuthManagedCredential(input) && !canRefreshOAuthCredential(input)
+  return isOAuthManagedCredential(input) && input.oauth_temporary === true
 }
 
 function getMissingRefreshTokenStatus(): OAuthStatusInfo {