first pass of merging in warp (doesn't build)

crates/managed_secrets/src/secret_value.rs

@@ -26,6 +26,13 @@ pub enum ManagedSecretValue {
         aws_bearer_token_bedrock: String,
         aws_region: String,
     },
+    OpenaiApiKey {
+        api_key: String,
+        /// Optional base URL for the OpenAI API (e.g. regional endpoints).
+        /// When absent, the harness uses the provider's default endpoint.
+        #[serde(skip_serializing_if = "Option::is_none")]
+        base_url: Option<String>,
+    },
 }
 
 impl ManagedSecretValue {
@@ -63,6 +70,14 @@ impl ManagedSecretValue {
         }
     }
 
+    /// Construct an OpenAI API key secret value with an optional base URL.
+    pub fn openai_api_key(api_key: impl Into<String>, base_url: Option<String>) -> Self {
+        Self::OpenaiApiKey {
+            api_key: api_key.into(),
+            base_url,
+        }
+    }
+
     pub fn secret_type(&self) -> ManagedSecretType {
         match self {
             ManagedSecretValue::RawValue { .. } => ManagedSecretType::RawValue,
@@ -73,6 +88,7 @@ impl ManagedSecretValue {
             ManagedSecretValue::AnthropicBedrockApiKey { .. } => {
                 ManagedSecretType::AnthropicBedrockApiKey
             }
+            ManagedSecretValue::OpenaiApiKey { .. } => ManagedSecretType::OpenaiApiKey,
         }
     }
 }
@@ -92,6 +108,9 @@ impl fmt::Debug for ManagedSecretValue {
             ManagedSecretValue::AnthropicBedrockApiKey { .. } => f
                 .debug_struct("ManagedSecret::AnthropicBedrockApiKey")
                 .finish_non_exhaustive(),
+            ManagedSecretValue::OpenaiApiKey { .. } => f
+                .debug_struct("ManagedSecret::OpenaiApiKey")
+                .finish_non_exhaustive(),
         }
     }
 }