fix: correct managed OAuth credential name lookup for gateway MCP clients (#543)

* fix: correct managed OAuth credential name lookup for gateway MCP clients

The managed OAuth credential is created with the suffix '-oauth' (e.g.
'my-gateway-oauth') but was being looked up with '-agent-oauth' in
schema-mapper.ts and displayed with '-agent-oauth' in AddGatewayScreen.

This mismatch caused the credential lookup to fail silently, resulting
in an empty provider_name in the generated @requires_access_token
decorator. The agent runtime then crashed with:
  ParamValidationError: Invalid length for parameter
  resourceCredentialProviderName, value: 0, valid min length: 1

* refactor: extract computeManagedOAuthCredentialName to shared utility

Replace inline credential name construction with a shared function in
credential-utils.ts. All three consumers (GatewayPrimitive, schema-mapper,
AddGatewayScreen) now use the same function, preventing future naming drift.

Add regression test for the shared function.

Author: aidandaly24

src/cli/operations/agent/generate/__tests__/schema-mapper.test.ts

@@ -1,3 +1,4 @@
+import { computeManagedOAuthCredentialName } from '../../../../primitives/credential-utils.js';
 import type { GenerateConfig } from '../../../../tui/screens/generate/types.js';
 import {
   mapGenerateConfigToAgent,
@@ -190,3 +191,13 @@ describe('mapGenerateConfigToRenderConfig', () => {
     expect(result.memoryProviders[0]!.strategies).toEqual(['SEMANTIC', 'USER_PREFERENCE', 'SUMMARIZATION']);
   });
 });
+
+describe('gateway credential provider name mapping', () => {
+  it('computeManagedOAuthCredentialName produces the correct suffix', () => {
+    // Regression test: the managed credential name must use '-oauth' suffix.
+    // GatewayPrimitive creates it, schema-mapper looks it up, AddGatewayScreen displays it.
+    // All three now use computeManagedOAuthCredentialName to stay in sync.
+    expect(computeManagedOAuthCredentialName('my-gateway')).toBe('my-gateway-oauth');
+    expect(computeManagedOAuthCredentialName('test')).toBe('test-oauth');
+  });
+});

src/cli/operations/agent/generate/schema-mapper.ts

@@ -11,7 +11,10 @@ import type {
 } from '../../../../schema';
 import { DEFAULT_STRATEGY_NAMESPACES } from '../../../../schema';
 import { GatewayPrimitive } from '../../../primitives/GatewayPrimitive';
-import { computeDefaultCredentialEnvVarName } from '../../../primitives/credential-utils';
+import {
+  computeDefaultCredentialEnvVarName,
+  computeManagedOAuthCredentialName,
+} from '../../../primitives/credential-utils';
 import type {
   AgentRenderConfig,
   GatewayProviderRenderConfig,
@@ -199,7 +202,7 @@ async function mapGatewaysToGatewayProviders(): Promise<GatewayProviderRenderCon
 
       if (gateway.authorizerType === 'CUSTOM_JWT' && gateway.authorizerConfiguration?.customJwtAuthorizer) {
         const jwtConfig = gateway.authorizerConfiguration.customJwtAuthorizer;
-        const credName = `${gateway.name}-agent-oauth`;
+        const credName = computeManagedOAuthCredentialName(gateway.name);
         const credential = project.credentials.find(c => c.name === credName);
 
         if (credential) {

src/cli/primitives/GatewayPrimitive.ts

@@ -8,7 +8,7 @@ import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/
 import type { AddGatewayConfig } from '../tui/screens/mcp/types';
 import { BasePrimitive } from './BasePrimitive';
 import { SOURCE_CODE_NOTE } from './constants';
-import { computeDefaultCredentialEnvVarName } from './credential-utils';
+import { computeDefaultCredentialEnvVarName, computeManagedOAuthCredentialName } from './credential-utils';
 import type { AddResult, AddScreenComponent, RemovableResource } from './types';
 import type { Command } from '@commander-js/extra-typings';
 
@@ -379,7 +379,7 @@ export class GatewayPrimitive extends BasePrimitive<AddGatewayOptions, Removable
     gatewayName: string,
     jwtConfig: NonNullable<AddGatewayConfig['jwtConfig']>
   ): Promise<void> {
-    const credentialName = `${gatewayName}-oauth`;
+    const credentialName = computeManagedOAuthCredentialName(gatewayName);
     const project = await this.readProjectSpec();
 
     // Skip if credential already exists

src/cli/primitives/credential-utils.ts

@@ -6,3 +6,12 @@
 export function computeDefaultCredentialEnvVarName(credentialName: string): string {
   return `AGENTCORE_CREDENTIAL_${credentialName.replace(/-/g, '_').toUpperCase()}`;
 }
+
+/**
+ * Compute the managed OAuth credential name for a gateway.
+ * Used when creating the credential (GatewayPrimitive) and when
+ * looking it up for code generation (schema-mapper).
+ */
+export function computeManagedOAuthCredentialName(gatewayName: string): string {
+  return `${gatewayName}-oauth`;
+}

src/cli/tui/screens/mcp/AddGatewayScreen.tsx

@@ -1,5 +1,6 @@
 import type { GatewayAuthorizerType } from '../../../../schema';
 import { GatewayNameSchema } from '../../../../schema';
+import { computeManagedOAuthCredentialName } from '../../../primitives/credential-utils';
 import {
   ConfirmReview,
   Panel,
@@ -272,7 +273,7 @@ export function AddGatewayScreen({ onComplete, onExit, existingGateways, unassig
                       ? [{ label: 'Allowed Scopes', value: wizard.config.jwtConfig.allowedScopes.join(', ') }]
                       : []),
                     ...(wizard.config.jwtConfig.agentClientId
-                      ? [{ label: 'Agent Credential', value: `${wizard.config.name}-agent-oauth` }]
+                      ? [{ label: 'Agent Credential', value: computeManagedOAuthCredentialName(wizard.config.name) }]
                       : []),
                   ]
                 : []),