fix(vscode): support Bedrock and Vertex credentials

[chrarnoldus]

What changed

Use provider-specific credential setup in the VS Code extension:

• Amazon Bedrock offers AWS access keys with secret, optional session token, and region, while retaining Bedrock API-key login.
• Google Vertex accepts multiline service-account JSON with project override and location.
• Structured credentials stay in Kilo's credential store and are passed to the provider SDK without being serialized to the webview or reinterpreted as generic API keys.

Why

The generic API-key dialog could not configure the credential shapes required by Bedrock and Vertex, leaving both setup flows unusable for their standard authentication methods.

Validation

The hooman has confirmed the new setup flow works in the VS Code extension.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
packages/kilo-vscode/webview-ui/src/components/settings/ProviderConnectDialog.tsx	453	Vertex service-account JSON (contains private_key) is no longer masked — -webkit-text-security dropped and field switched off type="password"

Files Reviewed (1 file, incremental)

• packages/kilo-vscode/webview-ui/src/components/settings/ProviderConnectDialog.tsx - 1 issue

Incremental review at HEAD 509bb87f. The only PR change since b8d5a81 removes the masked rendering of the Vertex credentials field (the remaining incremental-diff files are unrelated main-branch changes pulled in by a rebase). Previous findings on provider.ts (bearer token serialization) remain resolved. No memory leaks introduced — the change adds no subscriptions, timers, or processes.

Fix these issues in Kilo Cloud

Previous Review Summaries (2 snapshots, latest commit b8d5a81)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit b8d5a81)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files, incremental)

• packages/kilo-vscode/webview-ui/src/components/settings/ProviderConnectDialog.tsx - added multiline + -webkit-text-security masking for Vertex service-account JSON; resolves the previous single-line-input suggestion
• packages/opencode/src/provider/provider.ts - removed apiKey: awsBearerToken from serialized provider options; resolves the previous bearer-token exposure warning

Incremental review at HEAD b8d5a81. Verified the bearer token still reaches the Bedrock SDK: auth-store tokens flow via provider.key into the local SDK-options copy in resolveSDK (not serialized via toPublicInfo), and env-sourced AWS_BEARER_TOKEN_BEDROCK is handled natively by the AWS SDK. The kilo-ui TextField multiline prop renders a TextArea that receives the masking style. No memory leaks introduced (no new subscriptions, timers, or processes).

Previous review (commit 7bc71ef)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/provider/provider.ts	372	Bedrock bearer token (including env-sourced AWS_BEARER_TOKEN_BEDROCK) is copied into provider.options.apiKey, which is serialized to clients/webview via toPublicInfo — a new exposure channel; previously it only lived in process.env

SUGGESTION

File	Line	Issue
packages/kilo-vscode/webview-ui/src/components/settings/ProviderConnectDialog.tsx	455	Vertex service-account JSON is pasted into a single-line password input; consider the kilo-ui TextField multiline prop for usability

Files Reviewed (28 files)

• .changeset/cloud-provider-setup.md - user-facing changeset present, no issues
• packages/kilo-vscode/webview-ui/src/components/settings/ProviderConnectDialog.tsx - 1 issue
• packages/kilo-vscode/webview-ui/src/i18n/cloud-provider.ts - shared fallback dict, no issues
• packages/kilo-vscode/webview-ui/src/i18n/{en,ar,br,bs,da,de,es,fa,fr,it,ja,ko,nl,no,pl,ru,th,tr,uk,zh,zht}.ts - mechanical fallback spread, no issues
• packages/opencode/src/kilocode/provider/cloud-auth.ts - well-isolated Kilo-only module with validation, no issues
• packages/opencode/src/provider/provider.ts - 1 issue
• packages/opencode/test/kilocode/provider/cloud-auth.test.ts - tests real implementation without mocks, no issues

Verified: structured credentials stay out of the generic provider key via providerKey, the Vertex function marker is correctly dropped from serialization and hydrated in resolveSDK, auth metadata round-trips through cleanMetadata, and no memory/resource leaks were introduced (the removed process.env mutation is an improvement). Checked for stale findings against HEAD 7bc71ef.

Fix these issues in Kilo Cloud

---

_{Reviewed by kimi-k3 · Input: 59K · Output: 4.9K · Cached: 294.9K}

_{Review guidance: REVIEW.md from base branch main}

[chrarnoldus]