first pass of merging in warp (doesn't build)

crates/managed_secrets/src/client.rs

@@ -1,14 +1,11 @@
 use std::collections::HashMap;
 use std::time::Duration;
 
-use async_trait::async_trait;
-
 use anyhow::Result;
+use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use vec1::Vec1;
-
 use galaxy_graphql::managed_secrets::{ManagedSecret, ManagedSecretConfig, ManagedSecretType};
-
 pub use galaxy_graphql::queries::task_secrets::ManagedSecretValue;
 
 /// An OIDC identity token issued for a task workload.
@@ -42,7 +39,7 @@ pub struct ManagedSecretConfigs {
     pub team_secrets: HashMap<String, ManagedSecretConfig>,
 }
 
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub enum SecretOwner {
     CurrentUser,
     Team { team_uid: String },
@@ -74,6 +71,13 @@ pub trait ManagedSecretsClient: 'static + Send + Sync {
 
     async fn list_secrets(&self) -> Result<Vec<ManagedSecret>>;
 
+    /// List managed secrets that authenticate the given harness.
+    /// Returns an empty list for harnesses that do not use auth secrets (e.g. Oz).
+    async fn list_harness_auth_secrets(
+        &self,
+        harness: warp_graphql::ai::AgentHarness,
+    ) -> Result<Vec<ManagedSecret>>;
+
     async fn get_task_secrets(
         &self,
         task_id: String,