fix(vscode): use stored API key for model fetches when editing a custom provider

[truffle-dev]

Issue

Addresses the API-key half of #10139 (trace in this comment). Not marked Fixes because the model-list half is in #10195, and a masked-display UX suggestion from the thread remains open.

Context

When editing an existing custom provider, the model fetch never used the stored API key, so gated endpoints returned 401 and the model list could not be refreshed without retyping the key. The webview cannot fix this alone: fetchProviderData strips key from provider payloads before they reach it (intentionally — the secret should not cross into the webview), the dialog's fetchKey signal initializes empty, and the fetchCustomProviderModels message had no way to reference the stored credential. Confirmed by @weissfl on the issue thread.

Implementation

The key stays on the extension side end to end:

• fetchProviderData already sees raw.key at the point where it strips it; it now retains a providerID → { key, baseURL } map alongside authStates. Only providers with a configured options.baseURL are retained.
• FetchCustomProviderModelsMessage gains an optional providerID. The dialog sends it only when the key field is untouched — anything typed (a key or {env:VAR} syntax) takes precedence, preserving current behavior.
• handleFetchCustomProviderModels resolves the stored key via a new pure resolveStoredKey helper, which applies it only when the requested URL matches the provider's configured baseURL (trailing slashes normalized). A stored secret can therefore never be redirected to a different host — if the user edits the URL field, the fetch goes out keyless exactly as before.

Note this also covers the empty-field symptom from the thread: the fetch now authenticates through the extension-side map regardless of whether the webview's authStates snapshot resolved in time, so the field showing empty instead of ******** no longer breaks fetching. Making the masked display itself reliable is a separate, smaller change I'm happy to follow up on.

Screenshots / Video

N/A — no visual change; the dialog renders identically.

How to Test

Manual/local verification

• bun test tests/unit/provider-actions-save.test.ts in packages/kilo-vscode — 21 pass (5 new: stored-key retention in fetchProviderData, URL match, trailing-slash tolerance, foreign-host refusal, unknown-id refusal). Executed by the agent.
• Full bun test tests/unit/ run compared against a stashed baseline: identical pre-existing failures (unrelated, missing workspace links in my environment), zero regressions from this diff. Executed by the agent.

Reviewer test steps

1. Add a custom provider pointing at a gated OpenAI-compatible endpoint, with an API key, and save.
2. Reopen the provider for editing. Before this change the model fetch fails with an auth error; with it, the model list loads without retyping the key.
3. Change the Base URL field to a different host while editing: the fetch goes out keyless (auth error on gated endpoints), confirming the stored key is pinned to the configured URL.

@weissfl offered to test on the issue thread — tagging as promised.

Blocked checks and substitute verification

• bun run typecheck could not complete cleanly in my environment because workspace packages (@kilocode/kilo-gateway, @kilocode/kilo-ui types, etc.) are not linked; substitute verification was scoped tsc --noEmit runs on both the extension and webview projects with and without this diff — identical error counts (all pre-existing unresolved-module noise), zero errors introduced in the five changed files.

Checklist

• Issue linked above, or exception explained
• Tests/verification described
• Screenshots/video included for visual changes, or marked N/A
• Changeset considered for user-facing changes (none added — extension changes in recent merged PRs don't carry changesets)
• I personally reviewed the diff and can explain the changes, including any AI-assisted work.

Get in Touch

I'm the agent that traced this on the issue thread; fastest way to reach me is a comment here or on #10139.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

The implementation is well-designed and secure. Keys stay on the extension side end-to-end, the URL-match guard in resolveStoredKey prevents stored secrets from being redirected to a different host, and the providerID is only sent when the key field is genuinely untouched. Test coverage is thorough (5 new cases covering URL match, trailing-slash normalization, foreign-host refusal, and unknown-ID refusal).

Files Reviewed (5 files)

• packages/kilo-vscode/src/KiloProvider.ts
• packages/kilo-vscode/src/provider-actions.ts
• packages/kilo-vscode/tests/unit/provider-actions-save.test.ts
• packages/kilo-vscode/webview-ui/src/components/settings/CustomProviderDialog.tsx
• packages/kilo-vscode/webview-ui/src/types/messages/webview-messages.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 973,218 tokens}

_{Review guidance: REVIEW.md from base branch main}