first pass of merging in warp (doesn't build)

crates/galaxy_cli/src/secret.rs

@@ -1,4 +1,5 @@
-use std::{fmt, path::PathBuf};
+use std::fmt;
+use std::path::PathBuf;
 
 use clap::{Args, Subcommand, ValueEnum};
 
@@ -9,7 +10,8 @@ use crate::scope::ObjectScope;
 pub enum SecretCommand {
     /// Create a new secret.
     ///
-    /// Use `oz secret create anthropic api-key <NAME>` to create a Claude/Anthropic auth secret.
+    /// Use `oz secret create claude api-key <NAME>` to create a Claude/Anthropic auth secret,
+    /// or `oz secret create codex api-key <NAME>` to create a Codex/OpenAI auth secret.
     Create(CreateSecretArgs),
     /// Delete a secret.
     Delete(DeleteSecretArgs),
@@ -22,6 +24,17 @@ pub enum SecretCommand {
     List(ListSecretsArgs),
 }
 
+impl SecretCommand {
+    pub(crate) fn as_str_for_tracing(&self) -> &'static str {
+        match self {
+            SecretCommand::Create(_) => "secret create",
+            SecretCommand::Delete(_) => "secret delete",
+            SecretCommand::Update(_) => "secret update",
+            SecretCommand::List(_) => "secret list",
+        }
+    }
+}
+
 #[derive(Debug, Clone, Args)]
 #[command(args_conflicts_with_subcommands = true)]
 pub struct CreateSecretArgs {
@@ -51,7 +64,10 @@ pub struct CreateSecretArgs {
 #[derive(Debug, Clone, Subcommand)]
 pub enum CreateProvider {
     /// Create a Claude/Anthropic auth secret.
+    #[command(name = "claude")]
     Anthropic(AnthropicCreateArgs),
+    /// Create a Codex/OpenAI auth secret.
+    Codex(CodexCreateArgs),
 }
 
 #[derive(Debug, Clone, Args)]
@@ -113,6 +129,37 @@ pub struct BedrockApiKeyArgs {
     pub region: Option<String>,
 }
 
+#[derive(Debug, Clone, Args)]
+pub struct CodexCreateArgs {
+    #[command(subcommand)]
+    pub method: CodexMethod,
+}
+
+/// Codex credential type.
+#[derive(Debug, Clone, Subcommand)]
+pub enum CodexMethod {
+    /// Direct OpenAI API key.
+    #[command(name = "api-key")]
+    ApiKey(OpenAiApiKeyArgs),
+}
+
+/// Arguments for creating an OpenAI API key secret used by the Codex harness.
+#[derive(Debug, Clone, Args)]
+pub struct OpenAiApiKeyArgs {
+    #[clap(flatten)]
+    pub common: CommonSecretCreateArgs,
+
+    #[clap(flatten)]
+    pub value: ValueArgs,
+
+    /// Optional base URL for the OpenAI API (e.g. a regional endpoint like
+    /// `https://us.api.openai.com/v1`). When omitted in interactive mode the
+    /// CLI prompts for it; pressing Enter at the prompt skips it. When omitted
+    /// in non-interactive mode the harness uses the provider's default endpoint.
+    #[arg(long = "base-url")]
+    pub base_url: Option<String>,
+}
+
 /// Arguments for creating an Anthropic Bedrock access key secret.
 #[derive(Debug, Clone, Args)]
 pub struct BedrockAccessKeyArgs {
@@ -190,6 +237,9 @@ pub enum SecretType {
     // Not exposed via the CLI `--type` flag; constructed internally for provider subcommands.
     #[value(skip)]
     AnthropicBedrockApiKey,
+    // Not exposed via the CLI `--type` flag; constructed internally for provider subcommands.
+    #[value(skip)]
+    OpenaiApiKey,
 }
 
 impl fmt::Display for SecretType {
@@ -198,6 +248,7 @@ impl fmt::Display for SecretType {
             SecretType::RawValue => write!(f, "raw-value"),
             SecretType::AnthropicApiKey => write!(f, "anthropic-api-key"),
             SecretType::AnthropicBedrockApiKey => write!(f, "anthropic-bedrock-api-key"),
+            SecretType::OpenaiApiKey => write!(f, "openai-api-key"),
         }
     }
 }