fix: prefer profile auth in provider summaries

src/agents/models-config.providers.auth-provenance.test.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { describe, expect, it } from "vitest";
 import { captureEnv } from "../test-utils/env.js";
 import { MINIMAX_OAUTH_MARKER, NON_ENV_SECRETREF_MARKER } from "./model-auth-markers.js";
+import { createProviderAuthResolver } from "./models-config.providers.secrets.js";
 import { resolveImplicitProvidersForTest } from "./models-config.e2e-harness.js";
 
 describe("models-config provider auth provenance", () => {
@@ -106,4 +107,32 @@ describe("models-config provider auth provenance", () => {
     const providers = await resolveImplicitProvidersForTest({ agentDir, env: {} });
     expect(providers?.["minimax-portal"]?.apiKey).toBe(MINIMAX_OAUTH_MARKER);
   });
+
+  it("prefers profile auth over env auth in provider summaries to match runtime resolution", async () => {
+    const auth = createProviderAuthResolver(
+      {
+        OPENAI_API_KEY: "env-openai-key",
+      } as NodeJS.ProcessEnv,
+      {
+        version: 1,
+        profiles: {
+          "openai:default": {
+            type: "api_key",
+            provider: "openai",
+            keyRef: { source: "env", provider: "default", id: "OPENAI_PROFILE_KEY" },
+          },
+        },
+      },
+    );
+
+    expect(
+      auth("openai"),
+    ).toEqual({
+      apiKey: "OPENAI_PROFILE_KEY",
+      discoveryApiKey: undefined,
+      mode: "api_key",
+      source: "profile",
+      profileId: "openai:default",
+    });
+  });
 });

src/agents/models-config.providers.secrets.ts

@@ -324,16 +324,6 @@ export function createProviderAuthResolver(
   authStore: ReturnType<typeof ensureAuthProfileStore>,
 ): ProviderAuthResolver {
   return (provider: string, options?: { oauthMarker?: string }) => {
-    const envVar = resolveEnvApiKeyVarName(provider, env);
-    if (envVar) {
-      return {
-        apiKey: envVar,
-        discoveryApiKey: toDiscoveryApiKey(env[envVar]),
-        mode: "api_key" as const,
-        source: "env" as const,
-      };
-    }
-
     const ids = listProfilesForProvider(authStore, provider);
     let oauthCandidate:
       | {
@@ -375,6 +365,16 @@ export function createProviderAuthResolver(
       return oauthCandidate;
     }
 
+    const envVar = resolveEnvApiKeyVarName(provider, env);
+    if (envVar) {
+      return {
+        apiKey: envVar,
+        discoveryApiKey: toDiscoveryApiKey(env[envVar]),
+        mode: "api_key" as const,
+        source: "env" as const,
+      };
+    }
+
     return {
       apiKey: undefined,
       discoveryApiKey: undefined,