fix: preserve provider auth metadata

frontend/src/utils/__tests__/providerKeyAuth.spec.ts

@@ -39,4 +39,14 @@ describe('providerKeyAuth', () => {
     expect(shouldShowOAuthRefreshControl(input)).toBe(true)
     expect(getProviderMaskedSecretLabel(input, 'codex')).toBe('[OAuth Token]')
   })
+
+  it('renders OAuth-managed authorization header credentials as OAuth Header', () => {
+    const input = {
+      auth_type: 'oauth',
+      oauth_managed: true,
+      oauth_header_auth: true,
+    }
+
+    expect(getProviderMaskedSecretLabel(input, 'codex')).toBe('[OAuth Header]')
+  })
 })

frontend/src/utils/providerKeyAuth.ts

@@ -4,6 +4,7 @@ export interface ProviderKeyAuthCarrier {
   credential_kind?: string | null
   runtime_auth_kind?: string | null
   oauth_managed?: boolean | null
+  oauth_header_auth?: boolean | null
   oauth_temporary?: boolean | null
   can_refresh_oauth?: boolean | null
   can_export_oauth?: boolean | null
@@ -121,6 +122,7 @@ export function getProviderMaskedSecretLabel(
   providerType?: string | null,
 ): string {
   if (isGrokSessionCredential(input, providerType)) return '[Session Cookie]'
+  if (isOAuthManagedCredential(input) && input.oauth_header_auth === true) return '[OAuth Header]'
   if (isOAuthManagedCredential(input)) return '[OAuth Token]'
   if (isServiceAccountCredential(input)) return '[Service Account]'
   if (getProviderRuntimeAuthKind(input) === 'mixed') return '[Key]'