opencode-auth-load-balancer 0.4.1 → 0.5.0

package/README.md

@@ -1,6 +1,6 @@
 # opencode-auth-load-balancer
 
-Load-balance [opencode](https://opencode.ai) across **multiple Claude (Anthropic) and Codex (OpenAI/ChatGPT) OAuth accounts** so you never have to stop and re-login when one account runs out of quota.
+Load-balance [opencode](https://opencode.ai) across **multiple Claude (Anthropic) and Codex (OpenAI/ChatGPT) OAuth accounts and Kimi Code subscriptions** so you never have to stop and re-login when one account runs out of quota.
 
 Selection is **not** round-robin. It is weighted primarily by **weekly** usage, with a continuous "drain the soonest-resetting account first" rule, per-conversation **session affinity** (to preserve prompt caching), and a proactive switch **before** an account hits 100%.
 
@@ -8,7 +8,7 @@ Selection is **not** round-robin. It is weighted primarily by **weekly** usage,
 
 ## Features
 
-- **Account pool** — register many Claude / Codex OAuth accounts; the plugin manages and rotates them.
+- **Account pool** — register many Claude / Codex / Kimi Code accounts (Kimi also by API key); the plugin manages and rotates them.
 - **Weekly-usage-weighted scheduling** — `urgency = weeklyRemaining / daysUntilWeeklyReset`. A sooner reset (e.g. 3 days) outranks a later one (7 days) at equal headroom; perishable quota is drained progressively, never crammed into the final hour.
 - **Automatic rotation** — on `429`/auth errors an account is cooled down and the next-best is tried; `retry-after` is honored.
 - **Model-tier fallback ladder (Fable, Opus, …)** — Claude Max accounts have *separate* weekly caps per premium model tier. When one is exhausted (a 429 whose `representative-claim` names a tier window, e.g. `seven_day_fable` / `seven_day_opus`), the balancer records a **per-tier** cooldown instead of cooling the whole account down (which used to cascade every account into a false "cooldown" and block *every* model on it). Requests for that tier then **steer to an account with tier headroom** — keeping the model you asked for — and only when the *whole pool* is tier-limited does the request descend **one rung down the fallback ladder**: the next model family in `fable → opus → sonnet → haiku` (order configurable via `OPENCODE_AUTH_LB_ANTHROPIC_FAMILY_ORDER`), picking the **highest-versioned model your provider config actually has** (a capped `claude-fable-5` prefers `claude-opus-4-9` over `claude-opus-4-8`). If that tier is capped too, it descends again (`fable → opus → sonnet`), each step toasted, preferably on the session's pinned account (keeping its prompt cache). Pin a fixed target or disable entirely via `OPENCODE_AUTH_LB_ANTHROPIC_OPUS_FALLBACK_MODEL`.
@@ -24,7 +24,7 @@ Selection is **not** round-robin. It is weighted primarily by **weekly** usage,
 ## Requirements
 
 - [Bun](https://bun.com) ≥ 1.3
-- opencode (TUI), with the Anthropic and/or OpenAI providers available
+- opencode (TUI), with the Anthropic, OpenAI, and/or Kimi For Coding providers available
 
 ---
 
@@ -80,7 +80,7 @@ Run opencode's auth flow once **per account**:
 
 1. `opencode auth login`
 2. Choose **"Claude Pro/Max (add account to load balancer)"** (or **"ChatGPT/Codex …"**).
-3. Open the URL, authorize, and paste the resulting code/URL back.
+3. Open the URL, authorize, and paste the result back. For Codex, the browser lands on a `localhost:1455` page that does not load — paste either its whole address-bar URL or just the `code` value from it; both work.
 4. Repeat for every account you want in the pool.
 
 Each login **appends** to the pool (it does not overwrite opencode's single auth slot). If you already logged in with the upstream `opencode-anthropic-auth` plugin, that credential is imported automatically on first run.
@@ -100,6 +100,19 @@ A third file, `auth-load-balancer-cc-version.json`, caches the discovered Claude
 
 > **OpenAI/Codex note:** the OpenAI path assumes opencode is configured to use the **Responses API** (the standard ChatGPT/Codex setup); `/responses` requests are routed to the Codex backend.
 
+### Kimi Code
+
+A Kimi Code subscription joins the pool either through an **OAuth sign-in** (device code) or as a **static API key**. The plugin hooks both deployments in opencode's model catalog, each with its own pool: **Kimi For Coding (kimi.com)** (`kimi-code-plan-cn`, `api.kimi.com/coding/v1`, sign-in at `auth.kimi.com`) and **Kimi For Coding (kimi.ai)** (`kimi-code-plan-global`, `api.kimi.ai/coding/v1`, sign-in at `auth.kimi.ai`).
+
+1. `opencode auth login` → **Kimi For Coding (kimi.com)** (or **(kimi.ai)**), then either:
+   - **"Kimi Code (…) (add account to load balancer)"** — the sign-in: opencode shows a URL, you approve the sign-in there (the code is already in it), and the login completes on its own. Tokens refresh automatically.
+   - **"Kimi Code (…) API key (add account to load balancer)"** — create a key in the console the login links to ([kimi.com](https://www.kimi.com/code/console) / [kimi.ai](https://www.kimi.ai/code/console)) and paste it at the prompt; the CLI labels it "authorization code", but paste the key.
+2. Repeat for every subscription.
+
+Every login is checked against the account behind it (`GET /me`), so one subscription stays one pool row: a second key or a sign-in of the same account replaces that row instead of double-counting its quota. A sign-in is stored in opencode as an `oauth` credential and a key as a plain `api` one; whichever opencode already stores for the provider is imported on first start. Usage (5h + weekly) comes from `/usages` alone — Kimi's inference responses carry no quota headers — polled at most every 5 minutes while requests flow. A revoked key (`401`) or refresh token (`invalid_grant`) switches the row to `re-login` instead of being retried, and the TUI's re-login uses the kind of login the row was added with.
+
+The sign-in identifies itself to Kimi's OAuth host the way Kimi's own clients do, with `X-Msh-*` headers: platform `opencode_auth_load_balancer`, this machine's host name and OS, and a device id hashed from the host name and home directory.
+
 ---
 
 ## See which account is in use
@@ -270,7 +283,7 @@ opencode loads plugins once at startup, so the loop is:
 
 ```
 src/
-  index.ts              # plugin entry: 3 exports (Anthropic, OpenAI, Status-tool)
+  index.ts              # plugin entry: 5 exports (Anthropic, OpenAI, Kimi Code ×2, Status-tool)
   fetch.ts              # load-balanced fetch — the per-request choke point
   refresh.ts            # singleflight OAuth refresh, invalid_grant handling
   accounts.ts           # append / bootstrap accounts into the pool
@@ -288,6 +301,7 @@ src/
   providers/            # ProviderAdapter contract + headers
     anthropic/          #   Claude OAuth + Claude Code request transforms + usage
     openai/             #   ChatGPT/Codex OAuth + Responses transforms + usage
+    kimi/               #   Kimi Code device-code OAuth + API-key login + /usages (kimi.com + kimi.ai)
   cli/status.ts         # `bun run status`
   __tests__/            # all tests
 tui/
@@ -321,6 +335,7 @@ The account pool and durable pending references are separate JSON files (opencod
 
 - **Bottom status bar** ([`tui/auth-load-balancer-tui.ts`](tui/auth-load-balancer-tui.ts) + [`.view.tsx`](tui/auth-load-balancer-tui.view.tsx) + [`.logic.ts`](tui/auth-load-balancer-tui.logic.ts) + [`auth-load-balancer-scoring.ts`](tui/auth-load-balancer-scoring.ts)) is a SolidJS TUI artifact compiled by opencode (its JSX deps — `solid-js` + `@opentui/*` — are installed as devDependencies, so the `.tsx` view **is** typechecked via `tsconfig.tui.json` and linted, though not render-tested here since that needs a live opencode TUI; its scorer is a byte-identical copy of the unit-tested [`src/scheduler/score-core.ts`](src/scheduler/score-core.ts), enforced by a sync test). It is written against opencode `>=1.18.26` internals (the `app_bottom` slot + the `subagent-footer` usage computation, verified against source); confirm it renders in your opencode build. The toast/tool/CLI cover the account info regardless.
 - **OpenAI/Codex** assumes the Responses API; chat-completions → responses conversion is out of scope.
+- **Kimi Code** sign-ins must be approved within 15 minutes, or the login fails and has to be started again. A key imported from opencode's store at startup is keyed by the key itself — the import makes no network call to learn its account — so log that subscription in again before adding it a second way, or it can count twice.
 - **Plugin reloads require restart**: opencode loads server plugins once at process startup. After installing a new build, restart the running opencode process once; durable turns are restored on that next start and are never sent while opencode is closed.
 - **Cross-process refresh**: per-process singleflight protects token rotation within one opencode instance. Running two opencode instances at once could still race the single-use refresh token.
 - **TUI pool writes**: the TUI sidebar's Rename / Delete actions write the pool file atomically (temp + rename) but WITHOUT the cross-process file lock the server uses around its own read-modify-write — so a server usage / cooldown / session / `tokenGen` update committed between the TUI's `readFileSync` and `renameSync` can be silently overwritten. Impact is bounded: the next request re-records usage from response headers, so the window is one cycle of staleness on the affected account; correctness recovers on its own.

package/dist/accounts.d.ts

@@ -1,11 +1,14 @@
 import { type PoolAccount, type TokenSet } from './types';
-/** The credential getter opencode passes to an auth loader. */
-export type OpencodeAuthGetter = () => Promise<{
+/** A credential from opencode's auth store (`oauth` token pair or `api` key). */
+interface OpencodeAuth {
     type: string;
     access?: string;
     refresh?: string;
     expires?: number;
-}>;
+    key?: string;
+}
+/** The credential getter opencode passes to an auth loader. */
+export type OpencodeAuthGetter = () => Promise<OpencodeAuth>;
 /**
  * Append a freshly-authorized account to the pool, deduped by refresh token
  * or provider account id. Re-authorizing the same account refreshes its
@@ -13,8 +16,11 @@ export type OpencodeAuthGetter = () => Promise<{
  */
 export declare function addAccount(providerID: string, tokens: TokenSet, label?: string): Promise<PoolAccount>;
 /**
- * Seed the pool from opencode's existing single-slot OAuth credential (e.g. left by
- * the single-account anthropic-auth plugin) so the user keeps working without
- * re-login. No-op once the pool already has an account for this provider.
+ * Seed the pool from opencode's existing single-slot credential (e.g. an OAuth
+ * login left by the single-account anthropic-auth plugin, or a Kimi Code API
+ * key saved before this plugin was installed) so the user keeps working
+ * without re-login. No-op once the pool already has an account for this
+ * provider.
  */
-export declare function bootstrapFromOpencodeAuth(providerID: string, getAuth: OpencodeAuthGetter): Promise<void>;
+export declare function bootstrapFromOpencodeAuth(providerID: string, getAuth: OpencodeAuthGetter, tokensFromApiKey?: (key: string) => TokenSet): Promise<void>;
+export {};

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 import type { Plugin } from '@opencode-ai/plugin';
 export declare const AnthropicLoadBalancerPlugin: Plugin;
 export declare const OpenAILoadBalancerPlugin: Plugin;
+export declare const KimiCodeLoadBalancerPlugin: Plugin;
+export declare const KimiCodeGlobalLoadBalancerPlugin: Plugin;
 /**
  * A standalone plugin that registers the `auth_lb_status` tool — an on-demand
  * dashboard (in-use account per provider, each account's weekly/5h usage,

package/dist/index.js

@@ -12856,21 +12856,28 @@ async function addAccount(providerID, tokens, label) {
     return account;
   });
 }
-async function bootstrapFromOpencodeAuth(providerID, getAuth) {
+function importableTokens(auth, tokensFromApiKey) {
+  if (auth.type === "api")
+    return tokensFromApiKey && auth.key ? tokensFromApiKey(auth.key) : null;
+  if (auth.type !== "oauth" || !auth.access || !auth.refresh)
+    return null;
+  return {
+    access: auth.access,
+    refresh: auth.refresh,
+    expires: auth.expires ?? 0
+  };
+}
+async function bootstrapFromOpencodeAuth(providerID, getAuth, tokensFromApiKey) {
   const auth = await getAuth().catch(() => null);
-  if (!auth || auth.type !== "oauth" || !auth.access || !auth.refresh)
+  const tokens = auth && importableTokens(auth, tokensFromApiKey);
+  if (!tokens)
     return;
-  const { access, refresh, expires } = auth;
   if ((await readPool()).accounts.some((a) => a.providerID === providerID))
     return;
   await mutatePool((pool) => {
     if (pool.accounts.some((a) => a.providerID === providerID))
       return;
-    pool.accounts.push(makeAccount(providerID, `${providerID}-1`, {
-      access,
-      refresh,
-      expires: expires ?? 0
-    }));
+    pool.accounts.push(makeAccount(providerID, `${providerID}-1`, tokens));
   });
 }
 
@@ -13616,6 +13623,14 @@ function parseCallbackInput(input, options = {}) {
     return { code, state };
   return null;
 }
+var BARE_CODE_RE = /^[\w.~-]+$/;
+function parseCodeInput(input) {
+  const callback = parseCallbackInput(input);
+  if (callback)
+    return callback;
+  const bare = input.trim();
+  return BARE_CODE_RE.test(bare) ? { code: bare, state: null } : null;
+}
 
 // src/providers/pkce.ts
 function base64UrlEncode(bytes) {
@@ -14175,8 +14190,259 @@ var anthropicAdapter = {
   recoverClientVersion: recoverClaudeCodeVersion
 };
 
+// src/providers/kimi/constants.ts
+var KIMI_CODE = {
+  id: "kimi-code-plan-cn",
+  baseUrl: "https://api.kimi.com/coding/v1",
+  oauthHost: "https://auth.kimi.com",
+  consoleUrl: "https://www.kimi.com/code/console"
+};
+var KIMI_CODE_GLOBAL = {
+  id: "kimi-code-plan-global",
+  baseUrl: "https://api.kimi.ai/coding/v1",
+  oauthHost: "https://auth.kimi.ai",
+  consoleUrl: "https://www.kimi.ai/code/console"
+};
+var KIMI_OAUTH_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+var KIMI_DEVICE_PLATFORM = "opencode_auth_load_balancer";
+var KIMI_DEVICE_VERSION = "1";
+var DEVICE_LOGIN_TIMEOUT_MS = 15 * 60 * 1000;
+var STATIC_KEY_EXPIRES = Number.MAX_SAFE_INTEGER;
+
+// src/providers/kimi/key.ts
+import { createHash as createHash3 } from "node:crypto";
+
+// src/providers/kimi/profile.ts
+async function fetchProfile(baseUrl, bearer) {
+  const me = await fetchJson(`${baseUrl}/me`, { authorization: `Bearer ${bearer}`, accept: "application/json" }, USAGE_HTTP_TIMEOUT_MS);
+  if (!isPlainObject2(me))
+    return null;
+  return typeof me.user_id === "string" && me.user_id !== "" ? { userId: me.user_id } : {};
+}
+
+// src/providers/kimi/key.ts
+function tokensFromApiKey(key) {
+  const fingerprint = createHash3("sha256").update(key).digest("hex");
+  return {
+    access: key,
+    refresh: "",
+    expires: STATIC_KEY_EXPIRES,
+    accountId: `key:${fingerprint.slice(0, 16)}`
+  };
+}
+async function exchange2(deployment, input) {
+  const key = input.trim();
+  if (!/^\S+$/.test(key))
+    return null;
+  const profile = await fetchProfile(deployment.baseUrl, key);
+  if (!profile)
+    return null;
+  const tokens = tokensFromApiKey(key);
+  return profile.userId ? { ...tokens, accountId: profile.userId } : tokens;
+}
+
+// src/providers/kimi/oauth.ts
+import { createHash as createHash4 } from "node:crypto";
+import { arch, homedir as homedir2, hostname as hostname4, release, type } from "node:os";
+function ascii(value) {
+  return value.replaceAll(/[^\x20-\x7E]/g, "").trim() || "unknown";
+}
+function deviceHeaders() {
+  const os = type();
+  const name = os === "Darwin" ? "macOS" : os === "Windows_NT" ? "Windows" : os;
+  const id = createHash4("sha256").update(`${hostname4()}
+${homedir2()}`);
+  return {
+    "X-Msh-Platform": KIMI_DEVICE_PLATFORM,
+    "X-Msh-Version": KIMI_DEVICE_VERSION,
+    "X-Msh-Device-Name": ascii(hostname4()),
+    "X-Msh-Device-Model": ascii(`${name} ${release()} ${arch()}`),
+    "X-Msh-Os-Version": ascii(release()),
+    "X-Msh-Device-Id": id.digest("hex").slice(0, 32)
+  };
+}
+function postForm(deployment, path, params) {
+  return fetch(`${deployment.oauthHost}${path}`, {
+    method: "POST",
+    headers: {
+      ...deviceHeaders(),
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    },
+    body: new URLSearchParams({ client_id: KIMI_OAUTH_CLIENT_ID, ...params }),
+    signal: AbortSignal.timeout(OAUTH_HTTP_TIMEOUT_MS)
+  });
+}
+function text(json, key) {
+  const value = json[key];
+  return typeof value === "string" && value !== "" ? value : null;
+}
+var REAL_CLOCK = { now: () => Date.now(), sleep };
+async function authorizeDevice(deployment, now) {
+  const res = await postForm(deployment, "/api/oauth/device_authorization", {});
+  const json = await res.json().catch(() => null);
+  const body = isPlainObject2(json) ? json : {};
+  const deviceCode = text(body, "device_code");
+  const userCode = text(body, "user_code");
+  const url = text(body, "verification_uri_complete");
+  if (!res.ok || !deviceCode || !userCode || !url)
+    throw new Error(`Kimi Code device authorization failed (HTTP ${res.status})`);
+  const expiresInMs = Number(body.expires_in) * 1000;
+  return {
+    deviceCode,
+    userCode,
+    url,
+    intervalMs: Math.max(Number(body.interval) || 5, 1) * 1000,
+    deadline: now + (expiresInMs > 0 ? Math.min(expiresInMs, DEVICE_LOGIN_TIMEOUT_MS) : DEVICE_LOGIN_TIMEOUT_MS)
+  };
+}
+async function pollDevice(deployment, device, clock) {
+  let intervalMs = device.intervalMs;
+  for (;; ) {
+    const res = await postForm(deployment, "/api/oauth/token", {
+      device_code: device.deviceCode,
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+    });
+    if (res.ok) {
+      const json = await readTokenResponse(res);
+      return json ? toTokenSet(json, "") : null;
+    }
+    const json = await res.json().catch(() => null);
+    const error = isPlainObject2(json) ? json.error : undefined;
+    if (error === "slow_down")
+      intervalMs += 5000;
+    else if (error !== "authorization_pending")
+      return null;
+    if (clock.now() + intervalMs >= device.deadline)
+      return null;
+    await clock.sleep(intervalMs);
+  }
+}
+async function startDeviceLogin(deployment, clock = REAL_CLOCK) {
+  const device = await authorizeDevice(deployment, clock.now());
+  return {
+    url: device.url,
+    instructions: `Approve the sign-in in your browser (code ${device.userCode}).`,
+    complete: async () => {
+      const tokens = await pollDevice(deployment, device, clock);
+      if (!tokens)
+        return null;
+      const profile = await fetchProfile(deployment.baseUrl, tokens.access);
+      return profile?.userId ? { ...tokens, accountId: profile.userId } : tokens;
+    }
+  };
+}
+async function refreshOAuth(deployment, refreshToken) {
+  if (!refreshToken)
+    throw new Error("invalid_grant: a Kimi Code API key cannot be refreshed");
+  const res = await postForm(deployment, "/api/oauth/token", {
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  if (res.status === 403) {
+    await res.body?.cancel().catch(ignore);
+    throw new Error("invalid_grant: Kimi Code rejected the refresh token (HTTP 403)");
+  }
+  return toTokenSet(await readRefreshResponse(res), refreshToken);
+}
+
+// src/providers/kimi/usage.ts
+var FIVE_HOURS_MS = 5 * 60 * 60 * 1000;
+var UNIT_MS = new Map([
+  ["TIME_UNIT_SECOND", 1000],
+  ["TIME_UNIT_MINUTE", 60000],
+  ["TIME_UNIT_HOUR", 3600000],
+  ["TIME_UNIT_DAY", 86400000]
+]);
+function toNumber(value) {
+  const n = typeof value === "string" && value.trim() !== "" ? Number(value) : value;
+  return typeof n === "number" && Number.isFinite(n) ? n : null;
+}
+function resetAt(value) {
+  if (typeof value !== "string")
+    return 0;
+  const ms = Date.parse(value);
+  return Number.isFinite(ms) && ms > 0 && !isImplausiblyFarFuture(ms) ? ms : 0;
+}
+function ratioWindow(raw) {
+  if (!isPlainObject2(raw))
+    return null;
+  const ratio = toNumber(raw.used_ratio);
+  if (ratio === null)
+    return null;
+  return { utilization: clamp01(ratio), resetAt: resetAt(raw.reset_time) };
+}
+function counterWindow(raw) {
+  if (!isPlainObject2(raw))
+    return null;
+  const limit = toNumber(raw.limit);
+  if (limit === null || limit <= 0)
+    return null;
+  const remaining = toNumber(raw.remaining);
+  const used = toNumber(raw.used) ?? (remaining === null ? 0 : limit - remaining);
+  return { utilization: clamp01(used / limit), resetAt: resetAt(raw.resetTime) };
+}
+function fiveHourCounters(limits) {
+  if (!Array.isArray(limits))
+    return null;
+  for (const entry of limits) {
+    if (!isPlainObject2(entry) || !isPlainObject2(entry.window))
+      continue;
+    const unitMs = UNIT_MS.get(String(entry.window.timeUnit));
+    const duration = toNumber(entry.window.duration);
+    if (unitMs !== undefined && duration !== null && duration * unitMs === FIVE_HOURS_MS)
+      return counterWindow(entry.detail);
+  }
+  return null;
+}
+function parseUsages(json, now) {
+  if (!isPlainObject2(json))
+    return null;
+  const ratios = isPlainObject2(json.usages) ? json.usages : {};
+  const hourly = ratioWindow(ratios.limit_5h) ?? fiveHourCounters(json.limits);
+  const weekly = ratioWindow(ratios.limit_7d) ?? counterWindow(json.usage);
+  return hourly || weekly ? { hourly, weekly, capturedAt: now } : null;
+}
+function getUsages(baseUrl, key) {
+  return fetchJson(`${baseUrl}/usages`, { authorization: `Bearer ${key}`, accept: "application/json" }, USAGE_HTTP_TIMEOUT_MS);
+}
+function usageFetcher(baseUrl) {
+  return async (account, now) => parseUsages(await getUsages(baseUrl, account.access), now);
+}
+
+// src/providers/kimi/adapter.ts
+function applyAuth(headers, account) {
+  headers.delete("x-api-key");
+  headers.set("authorization", `Bearer ${account.access}`);
+}
+function createKimiAdapter(deployment) {
+  return {
+    id: deployment.id,
+    startDeviceLogin: () => startDeviceLogin(deployment),
+    refresh: (refreshToken) => refreshOAuth(deployment, refreshToken),
+    authorize: async () => ({
+      url: deployment.consoleUrl,
+      verifier: "",
+      state: "",
+      redirectUri: "",
+      instructions: "Paste your Kimi Code API key here:"
+    }),
+    exchange: (input) => exchange2(deployment, input),
+    tokensFromApiKey,
+    applyAuth,
+    transformUrl: (input) => input,
+    transformBody: (body) => body,
+    transformResponse: (response) => response,
+    parseUsageHeaders: () => null,
+    fetchUsage: usageFetcher(deployment.baseUrl),
+    classifyError: classifyHttpStatus
+  };
+}
+var kimiCodeAdapter = createKimiAdapter(KIMI_CODE);
+var kimiCodeGlobalAdapter = createKimiAdapter(KIMI_CODE_GLOBAL);
+
 // src/providers/openai/constants.ts
-import { arch, platform, release } from "node:os";
+import { arch as arch2, platform, release as release2 } from "node:os";
 var PROVIDER_ID2 = "openai";
 var CLIENT_ID2 = "app_EMoamEEZ73f0CkXaXp7hrann";
 var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
@@ -14188,7 +14454,7 @@ var USAGE_URL2 = "https://chatgpt.com/backend-api/wham/usage";
 var USAGE_USER_AGENT = "codex-cli";
 var ORIGINATOR = "opencode";
 var OPENAI_BETA = "responses=experimental";
-var USER_AGENT = `opencode/0.2.0 (${platform()} ${release()}; ${arch()})`;
+var USER_AGENT = `opencode/0.2.0 (${platform()} ${release2()}; ${arch2()})`;
 var SESSION_ID = crypto.randomUUID();
 
 // src/providers/openai/jwt.ts
@@ -14270,11 +14536,11 @@ async function authorize2() {
     verifier: pkce.verifier
   };
 }
-async function exchange2(input, verifier, redirectUri, expectedState) {
-  const callback = parseCallbackInput(input);
+async function exchange3(input, verifier, redirectUri, expectedState) {
+  const callback = parseCodeInput(input);
   if (!callback)
     return null;
-  if (expectedState && callback.state !== expectedState)
+  if (expectedState && callback.state !== null && callback.state !== expectedState)
     return null;
   const body = new URLSearchParams({
     grant_type: "authorization_code",
@@ -14299,7 +14565,7 @@ async function refresh2(refreshToken) {
 }
 
 // src/providers/openai/transform.ts
-function applyAuth(headers, account) {
+function applyAuth2(headers, account) {
   headers.delete("x-api-key");
   headers.set("authorization", `Bearer ${account.access}`);
   const accountId = resolveAccountId(account);
@@ -14418,9 +14684,9 @@ async function fetchUsage2(account, now) {
 var openaiAdapter = {
   id: PROVIDER_ID2,
   authorize: authorize2,
-  exchange: exchange2,
+  exchange: exchange3,
   refresh: refresh2,
-  applyAuth,
+  applyAuth: applyAuth2,
   transformUrl: rewriteUrl2,
   transformBody: rewriteRequestBody2,
   transformResponse(response) {
@@ -14434,7 +14700,9 @@ var openaiAdapter = {
 // src/providers/registry.ts
 var ADAPTERS = [
   anthropicAdapter,
-  openaiAdapter
+  openaiAdapter,
+  kimiCodeAdapter,
+  kimiCodeGlobalAdapter
 ];
 function adapterFor(adapters, providerID) {
   for (const adapter of adapters)
@@ -14559,7 +14827,7 @@ async function applyCooldown(accountId, fallbackMs, kind) {
     }
   }));
 }
-async function recordRotation(adapter, accountId, res, fallbackMs, now, kind) {
+async function recordRotation(adapter, accountId, res, fallbackMs, now, kind, revokedKey) {
   const partial = adapter.parseUsageHeaders(res.headers);
   const until = cooldownUntilFrom(res, fallbackMs, now);
   await bestEffort("rotation", () => mutatePool((pool) => {
@@ -14572,6 +14840,8 @@ async function recordRotation(adapter, accountId, res, fallbackMs, now, kind) {
       account.cooldownUntil = until;
       account.cooldownKind = kind;
     }
+    if (revokedKey !== undefined && account.access === revokedKey)
+      account.disabledReason = `invalid API key: re-login required (${adapter.id}:${account.label})`;
   }));
 }
 async function recordModelCooldown(accountId, tier, until, partial, now) {
@@ -14782,7 +15052,7 @@ function createLoadBalancedFetch(adapter, hooks = {}, models = [], pending) {
             }
           }
           const ms = cls === "auth" ? AUTH_COOLDOWN_MS : ACCOUNT_COOLDOWN_MS;
-          await recordRotation(adapter, account.id, res, ms, Date.now(), cls === "auth" ? "auth" : "quota");
+          await recordRotation(adapter, account.id, res, ms, Date.now(), cls === "auth" ? "auth" : "quota", res.status === 401 && adapter.tokensFromApiKey && !account.refresh ? account.access : undefined);
           if (cls === "account") {
             waitableCooldownIds ??= new Set;
             waitableCooldownIds.add(account.id);
@@ -14840,7 +15110,9 @@ function createLoadBalancedFetch(adapter, hooks = {}, models = [], pending) {
 // src/status.ts
 var PROVIDER_NAMES = {
   anthropic: "Claude",
-  openai: "Codex"
+  openai: "Codex",
+  "kimi-code-plan-cn": "Kimi",
+  "kimi-code-plan-global": "Kimi (kimi.ai)"
 };
 function compareAscii(a, b) {
   return a < b ? -1 : a > b ? 1 : 0;
@@ -15109,7 +15381,7 @@ function acquirePendingLease(key, options = DEFAULT_PENDING_LEASE) {
 }
 
 // src/pending/store.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { readFile as readFile4 } from "node:fs/promises";
 var PENDING_WRITE_LOCK = {
   staleMs: 30000,
@@ -15132,7 +15404,7 @@ class PendingReadError extends Error {
   }
 }
 function pendingKey(ref) {
-  return createHash3("sha256").update(JSON.stringify([
+  return createHash5("sha256").update(JSON.stringify([
     ref.workspace,
     ref.providerID,
     ref.sessionID,
@@ -15582,7 +15854,9 @@ async function primeInUse(providerID, now) {
 // src/index.ts
 var PROVIDER_LABELS = {
   anthropic: "Claude Pro/Max",
-  openai: "ChatGPT/Codex"
+  openai: "ChatGPT/Codex",
+  "kimi-code-plan-cn": "Kimi Code (kimi.com)",
+  "kimi-code-plan-global": "Kimi Code (kimi.ai)"
 };
 function zeroOutCost(provider) {
   for (const model of Object.values(provider.models)) {
@@ -15595,10 +15869,21 @@ function zeroOutCost(provider) {
 }
 function buildAuthHook(adapter, client, pending) {
   const label = PROVIDER_LABELS[adapter.id] ?? adapter.id;
+  const startDeviceLogin = adapter.startDeviceLogin;
+  const register = async (tokens) => {
+    await addAccount(adapter.id, tokens);
+    await refreshUsageInBackground(adapter, Date.now()).catch(ignore);
+  };
+  const oauthSuccess = (tokens) => ({
+    type: "success",
+    refresh: tokens.refresh,
+    access: tokens.access,
+    expires: tokens.expires
+  });
   return {
     provider: adapter.id,
     async loader(getAuth, provider) {
-      await bootstrapFromOpencodeAuth(adapter.id, getAuth);
+      await bootstrapFromOpencodeAuth(adapter.id, getAuth, adapter.tokensFromApiKey);
       zeroOutCost(provider);
       await adapter.prime?.(Date.now()).catch(ignore);
       refreshUsageInBackground(adapter, Date.now()).then(() => primeInUse(adapter.id, Date.now())).catch(ignore);
@@ -15615,27 +15900,44 @@ function buildAuthHook(adapter, client, pending) {
       };
     },
     methods: [
+      ...startDeviceLogin ? [
+        {
+          label: `${label} (add account to load balancer)`,
+          type: "oauth",
+          authorize: async () => {
+            const login = await startDeviceLogin();
+            return {
+              url: login.url,
+              instructions: login.instructions,
+              method: "auto",
+              callback: async () => {
+                const tokens = await login.complete();
+                if (!tokens)
+                  return { type: "failed" };
+                await register(tokens);
+                return oauthSuccess(tokens);
+              }
+            };
+          }
+        }
+      ] : [],
       {
-        label: `${label} (add account to load balancer)`,
+        label: `${adapter.tokensFromApiKey ? `${label} API key` : label} (add account to load balancer)`,
         type: "oauth",
         authorize: async () => {
           const result = await adapter.authorize();
           return {
             url: result.url,
-            instructions: "Paste the authorization code here:",
+            instructions: result.instructions ?? "Paste the authorization code here:",
             method: "code",
             callback: async (code) => {
               const tokens = await adapter.exchange(code, result.verifier, result.redirectUri, result.state);
               if (!tokens)
                 return { type: "failed" };
-              await addAccount(adapter.id, tokens);
-              await refreshUsageInBackground(adapter, Date.now()).catch(ignore);
-              return {
-                type: "success",
-                refresh: tokens.refresh,
-                access: tokens.access,
-                expires: tokens.expires
-              };
+              await register(tokens);
+              if (adapter.tokensFromApiKey)
+                return { type: "success", key: tokens.access };
+              return oauthSuccess(tokens);
             }
           };
         }
@@ -15679,6 +15981,8 @@ function createProviderPlugin(adapter) {
 }
 var AnthropicLoadBalancerPlugin = createProviderPlugin(anthropicAdapter);
 var OpenAILoadBalancerPlugin = createProviderPlugin(openaiAdapter);
+var KimiCodeLoadBalancerPlugin = createProviderPlugin(kimiCodeAdapter);
+var KimiCodeGlobalLoadBalancerPlugin = createProviderPlugin(kimiCodeGlobalAdapter);
 var lbResult = (output) => ({ title: "Auth Load Balancer", output });
 var AuthLoadBalancerStatusPlugin = async (input) => ({
   tool: {
@@ -15753,5 +16057,7 @@ ${pending}` : status);
 export {
   AnthropicLoadBalancerPlugin,
   AuthLoadBalancerStatusPlugin,
+  KimiCodeGlobalLoadBalancerPlugin,
+  KimiCodeLoadBalancerPlugin,
   OpenAILoadBalancerPlugin
 };

package/dist/providers/kimi/adapter.d.ts

@@ -0,0 +1,13 @@
+import { type ProviderAdapter } from '../types';
+import { type KimiDeployment } from './constants';
+/**
+ * Kimi Code adapter for one deployment. A subscription joins the pool either
+ * through a device-code OAuth login (`startDeviceLogin`, refreshed by
+ * `refresh`) or as a pasted API key (`authorize`/`exchange` +
+ * `tokensFromApiKey`). opencode already shapes the requests as
+ * OpenAI-compatible chat completions, so they pass through untouched, and
+ * inference responses carry no quota headers: usage comes from `/usages`.
+ */
+export declare function createKimiAdapter(deployment: KimiDeployment): ProviderAdapter;
+export declare const kimiCodeAdapter: ProviderAdapter;
+export declare const kimiCodeGlobalAdapter: ProviderAdapter;

package/dist/providers/kimi/constants.d.ts

@@ -0,0 +1,36 @@
+export { OAUTH_HTTP_TIMEOUT_MS, USAGE_HTTP_TIMEOUT_MS } from '../http-timeouts';
+/**
+ * One Kimi Code deployment. kimi.com and kimi.ai are separate hosts with
+ * separate accounts, and opencode's models.dev catalog lists each as its own
+ * provider — so each gets its own adapter, and its own pool.
+ */
+export interface KimiDeployment {
+    /** opencode provider id (models.dev). */
+    readonly id: string;
+    /** OpenAI-compatible API base (the catalog's `api`); `/usages` and `/me` live here too. */
+    readonly baseUrl: string;
+    /** OAuth host for the device-code login and token refresh. */
+    readonly oauthHost: string;
+    /** Console page where a subscriber creates the API key the key login asks for. */
+    readonly consoleUrl: string;
+}
+export declare const KIMI_CODE: KimiDeployment;
+export declare const KIMI_CODE_GLOBAL: KimiDeployment;
+/** Kimi Code's public OAuth client, shared by both deployments (no secret). */
+export declare const KIMI_OAUTH_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+/**
+ * `X-Msh-Platform` / `X-Msh-Version` sent to the OAuth host. Kimi's SDK asks
+ * every host to name itself rather than borrow its CLI's `kimi_code_cli`, so
+ * this names the plugin; the version is this integration's, bumped when its
+ * handling of the login protocol changes.
+ */
+export declare const KIMI_DEVICE_PLATFORM = "opencode_auth_load_balancer";
+export declare const KIMI_DEVICE_VERSION = "1";
+/** Local wall-clock budget for one device-code login (Kimi's own clients use 15 min). */
+export declare const DEVICE_LOGIN_TIMEOUT_MS: number;
+/**
+ * `expires` stamped on a static-key row: a key does not expire client-side,
+ * so `needsRefresh` must never fire. Finite, so the pool store's
+ * `Number.isFinite(expires)` normalization keeps it.
+ */
+export declare const STATIC_KEY_EXPIRES: number;

package/dist/providers/kimi/key.d.ts

@@ -0,0 +1,18 @@
+import type { TokenSet } from '../../types';
+import { type KimiDeployment } from './constants';
+/**
+ * Map a Kimi Code API key onto the pool's token shape: the key is the bearer,
+ * with no refresh token and an expiry that never comes due. `accountId` is a
+ * fingerprint of the key — `addAccount` dedups on it — which a login upgrades
+ * to the Kimi account id; this bare form serves the startup import, where no
+ * network call can run.
+ */
+export declare function tokensFromApiKey(key: string): TokenSet;
+/**
+ * The pasted key, checked against `GET /me` before it can join the pool: a
+ * typo, a Moonshot open-platform key, or a stray URL fails the login instead
+ * of adding a row that only ever 401s. The row is keyed by the Kimi account
+ * behind the key, so a second key — or an OAuth login — for the same
+ * subscription replaces its row instead of double-counting one quota.
+ */
+export declare function exchange(deployment: KimiDeployment, input: string): Promise<TokenSet | null>;

package/dist/providers/kimi/oauth.d.ts

@@ -0,0 +1,22 @@
+import type { TokenSet } from '../../types';
+import type { DeviceLogin } from '../types';
+import { type KimiDeployment } from './constants';
+/** The poll loop's clock — a seam so tests need not wait out real intervals. */
+export interface PollClock {
+    readonly now: () => number;
+    readonly sleep: (ms: number) => Promise<void>;
+}
+/**
+ * Start a device-code login: the URL (user code embedded) to approve in a
+ * browser, and `complete` — the wait for that approval. The approved login is
+ * keyed by the Kimi account behind it (`GET /me`), like a key login, so one
+ * subscription stays one pool row however it signs in.
+ */
+export declare function startDeviceLogin(deployment: KimiDeployment, clock?: PollClock): Promise<DeviceLogin>;
+/**
+ * Refresh a Kimi Code OAuth row. Kimi answers a revoked grant with 400
+ * `invalid_grant`, 401 or 403, and each means re-login: 400/401 already carry
+ * the status refresh.ts parks rows on, so only 403 is spelled out as
+ * `invalid_grant`. A key row has no refresh token to spend at all.
+ */
+export declare function refreshOAuth(deployment: KimiDeployment, refreshToken: string): Promise<TokenSet>;

package/dist/providers/kimi/profile.d.ts

@@ -0,0 +1,10 @@
+/** What `GET /me` says about the account behind a bearer. */
+export interface KimiProfile {
+    /** Kimi's account id: one per subscription, whichever key or login reaches it. */
+    readonly userId?: string;
+}
+/**
+ * `GET {baseUrl}/me` with an API key or an OAuth access token. Null when the
+ * bearer is refused or the call fails, so it doubles as the key check.
+ */
+export declare function fetchProfile(baseUrl: string, bearer: string): Promise<KimiProfile | null>;

package/dist/providers/kimi/usage.d.ts

@@ -0,0 +1,12 @@
+import type { PoolAccount, UsageSnapshot } from '../../types';
+/**
+ * Parse `GET /usages` into the pool's snapshot, one window at a time: the
+ * ratio shape (`usages.limit_5h` / `limit_7d`) first, the counter shape as
+ * that window's fallback. Null when neither window parses, so a foreign or
+ * broken body keeps the last-known snapshot instead of reading as 0% used.
+ */
+export declare function parseUsages(json: unknown, now: number): UsageSnapshot | null;
+/** `GET {baseUrl}/usages` — free, spends no quota. Null on any failure. */
+export declare function getUsages(baseUrl: string, key: string): Promise<unknown>;
+/** The adapter's `fetchUsage` for one deployment. */
+export declare function usageFetcher(baseUrl: string): (account: PoolAccount, now: number) => Promise<UsageSnapshot | null>;

package/dist/providers/oauth-callback.d.ts

@@ -98,3 +98,17 @@ export declare function parseCallbackInput(input: string, options?: {
     code: string;
     state: string;
 } | null;
+/**
+ * `parseCallbackInput`, plus the authorization code on its own — what a user
+ * naturally copies out of the callback's `?code=…` when the login prompt asks
+ * for "the authorization code". A bare code carries no `state`, so it comes
+ * back as `state: null` and the caller skips its CSRF comparison for it. PKCE
+ * keeps that safe: a code only redeems together with the `code_verifier`
+ * generated for THIS login attempt, so a code minted for any other attempt is
+ * useless here. A pasted callback still returns its `state` for the caller to
+ * enforce.
+ */
+export declare function parseCodeInput(input: string): {
+    code: string;
+    state: string | null;
+} | null;

package/dist/providers/openai/oauth.d.ts

@@ -3,9 +3,12 @@ import type { AuthorizeRequest } from '../types';
 /** Begin the ChatGPT PKCE authorization flow. */
 export declare function authorize(): Promise<AuthorizeRequest>;
 /**
- * Exchange a pasted callback URL (or `code#state`) for tokens. Returns null on
- * failure. The redirect lands on http://localhost:1455/auth/callback — the user
- * copies that URL from the browser address bar and pastes it here.
+ * Exchange the pasted login result for tokens. Returns null on failure. The
+ * redirect lands on http://localhost:1455/auth/callback, a page that never
+ * loads — so the user pastes either that whole URL from the address bar (or
+ * its `code=…&state=…` query) or just the authorization code itself, which is
+ * what the login prompt asks for. A pasted `state` must match this attempt's;
+ * a bare code has none to compare (see `parseCodeInput`).
  */
 export declare function exchange(input: string, verifier: string, redirectUri: string, expectedState?: string): Promise<TokenSet | null>;
 /** Refresh an access token. Throws on failure; message includes the HTTP status. */

package/dist/providers/types.d.ts

@@ -28,6 +28,17 @@ export interface AuthorizeRequest {
     verifier: string;
     state: string;
     redirectUri: string;
+    /** Login prompt text; absent = the OAuth default ("Paste the authorization code here:"). */
+    instructions?: string;
+}
+/** A device-code login (RFC 8628) in flight: where to approve it, and the wait for approval. */
+export interface DeviceLogin {
+    /** Verification URL to open (the user code rides in it). */
+    url: string;
+    /** Prompt shown with the URL, e.g. the user code to confirm. */
+    instructions: string;
+    /** Resolve with the approved tokens, or null when denied, expired, or failed. */
+    complete(): Promise<TokenSet | null>;
 }
 /**
  * A request-body rewrite that downgrades the requested model to a cheaper
@@ -79,6 +90,24 @@ export interface ProviderAdapter {
     exchange(input: string, verifier: string, redirectUri: string, state: string): Promise<TokenSet | null>;
     /** Refresh an access token. Throws on failure (callers handle invalid_grant). */
     refresh(refreshToken: string): Promise<TokenSet>;
+    /**
+     * Start a device-code login, for providers whose OAuth has no redirect to
+     * paste back (Kimi Code). Registered as an `auto` login method ahead of the
+     * paste flow; absent on Claude/Codex.
+     */
+    startDeviceLogin?(): Promise<DeviceLogin>;
+    /**
+     * Present on providers that also take a static API key (Kimi Code): maps a
+     * key onto the pool's TokenSet. A key has no refresh token behind it, so
+     * its presence switches three credential paths:
+     *  - the paste login (`authorize`/`exchange`) collects a key, and its
+     *    callback hands opencode `{ key }`, stored as a plain `api` credential;
+     *  - the auth loader also imports opencode's `api` credential, which
+     *    OAuth-only providers ignore;
+     *  - a 401 parks a key row (one without a refresh token) for a re-login
+     *    instead of cooling it down — no refresh can repair a revoked key.
+     */
+    tokensFromApiKey?(key: string): TokenSet;
     /** Set auth + provider headers on an outgoing request for the chosen account. */
     applyAuth(headers: Headers, account: PoolAccount): void;
     /** Optionally rewrite the request URL (e.g. add ?beta=true, swap base URL). */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "opencode-auth-load-balancer",
-  "version": "0.4.1",
-  "description": "Load-balance opencode requests across multiple Anthropic (Claude) and OpenAI (Codex) OAuth accounts, weighted primarily by weekly usage with drain-before-reset scheduling.",
+  "version": "0.5.0",
+  "description": "Load-balance opencode requests across multiple Anthropic (Claude) and OpenAI (Codex) OAuth accounts and Kimi Code subscriptions, weighted primarily by weekly usage with drain-before-reset scheduling.",
   "type": "module",
   "license": "MIT",
   "author": "owjs3901",
@@ -62,6 +62,8 @@
     "claude",
     "openai",
     "codex",
+    "kimi",
+    "kimi-code",
     "oauth",
     "load-balancer"
   ],

package/tui/auth-load-balancer-tui.logic.ts

@@ -62,6 +62,8 @@ export interface PoolAccount {
   /** LEGACY pre-tier-map field (folded into `modelCooldownsUntil.opus` for display until the server migrates the file). */
   opusCooldownUntil?: number
   disabledReason?: string | null
+  /** Empty on a static API-key row (Kimi Code), which re-logs in with a new key. */
+  refresh?: string
 }
 /** Loosely-typed view of the on-disk pool JSON (one shape for reads AND read-modify-writes). */
 export interface PoolShape {
@@ -276,16 +278,24 @@ export function clearReloginTargetInPool(path: string = POOL_FILE): void {
  * opencode aggregates auth methods from every plugin registered for a provider,
  * so this plugin's position is not stable. Prefer its pooled-login label, then
  * fall back to the provider's first OAuth method when no such label is present.
+ * A provider can offer both an account login and an API-key login (Kimi
+ * Code), so `apiKey` picks the kind that matches how the row was added.
  */
 export function pickAuthMethodIndex(
   methods: readonly { type?: string; label?: string }[] | undefined,
+  apiKey = false,
 ): number | null {
-  const pooled = methods?.findIndex(
+  const pooled = (method: { type?: string; label?: string }): boolean =>
+    method.type === 'oauth' &&
+    (method.label?.toLowerCase().includes('load balancer') ?? false)
+  const sameKind = methods?.findIndex(
     (method) =>
-      method.type === 'oauth' &&
-      method.label?.toLowerCase().includes('load balancer'),
+      pooled(method) &&
+      (method.label?.toLowerCase().includes('api key') ?? false) === apiKey,
   )
-  if (pooled !== undefined && pooled >= 0) return pooled
+  if (sameKind !== undefined && sameKind >= 0) return sameKind
+  const anyPooled = methods?.findIndex(pooled)
+  if (anyPooled !== undefined && anyPooled >= 0) return anyPooled
   const oauth = methods?.findIndex((method) => method.type === 'oauth')
   return oauth !== undefined && oauth >= 0 ? oauth : null
 }

package/tui/auth-load-balancer-tui.view.tsx

@@ -57,6 +57,8 @@ import {
 const PROVIDER_NAMES: Record<string, string> = {
   anthropic: 'Claude',
   openai: 'Codex',
+  'kimi-code-plan-cn': 'Kimi',
+  'kimi-code-plan-global': 'Kimi (kimi.ai)',
 }
 /** Shared fallback lookup used by both the bottom bar and sidebar group labels. */
 function providerLabel(id: string): string {
@@ -200,6 +202,8 @@ interface Row extends WindowDisplay {
   rank: number | null
   state: string
   manuallyDisabled: boolean
+  /** A static API-key row: re-login asks for a new key, not an OAuth sign-in. */
+  apiKey: boolean
 }
 interface Group {
   provider: string
@@ -264,6 +268,7 @@ function SidebarPanel(props: {
           // tier annotation forever until the server heals the file.
           state: stateOf(sa, tierResets(a, now), now),
           manuallyDisabled: a.disabledReason === MANUAL_DISABLED_REASON,
+          apiKey: a.refresh === '',
         }
       })
       return { provider: providerLabel(providerID), rows }
@@ -306,12 +311,13 @@ function SidebarPanel(props: {
     id: string,
     label: string,
     providerID: string,
+    apiKey: boolean,
   ): Promise<void> {
     try {
       const methods = (await props.api.client.provider.auth()).data?.[
         providerID
       ]
-      const method = pickAuthMethodIndex(methods)
+      const method = pickAuthMethodIndex(methods, apiKey)
       if (method === null) {
         props.api.ui.toast({
           variant: 'error',
@@ -372,6 +378,15 @@ function SidebarPanel(props: {
       }
 
       if (auth.method === 'auto') {
+        // A device-code login (Kimi Code) completes in the browser: show where
+        // to approve it for as long as the callback waits.
+        dialog().replace(() =>
+          props.api.ui.DialogAlert({
+            title: `Re-login "${label}"`,
+            message: `${auth.instructions}\n\n${auth.url}`,
+            onConfirm: () => dialog().clear(),
+          }),
+        )
         await completeRelogin()
         return
       }
@@ -423,6 +438,7 @@ function SidebarPanel(props: {
     label: string,
     providerID: string,
     manuallyDisabled: boolean,
+    apiKey: boolean,
   ): void {
     const items: { title: string; run: () => void }[] = [
       { title: 'Rename', run: () => openRename(id, label) },
@@ -440,7 +456,7 @@ function SidebarPanel(props: {
       {
         title: 'Re-login — re-authorize with the provider',
         run: () => {
-          void openRelogin(id, label, providerID)
+          void openRelogin(id, label, providerID, apiKey)
         },
       },
       { title: 'Delete — remove from pool', run: () => openDelete(id, label) },
@@ -503,7 +519,13 @@ function SidebarPanel(props: {
                 {(r) => (
                   <box
                     onMouseUp={() =>
-                      openMenu(r.id, r.label, r.providerID, r.manuallyDisabled)
+                      openMenu(
+                        r.id,
+                        r.label,
+                        r.providerID,
+                        r.manuallyDisabled,
+                        r.apiKey,
+                      )
                     }
                   >
                     <text