feat(providers): protocol-based import criterion — add Kilo, Copilot, GitLab Duo, CF Gateway

Corrects the earlier import: the inclusion rule is PROTOCOL ("does it speak a standard
streaming API opencodex can proxy"), not "is it an agent like Cursor". Adds the 4
standard-wire providers that rule was wrongly dropping:
- kilo (openai-chat) — 443 models, single OpenAI-compatible endpoint
- cloudflare-ai-gateway (anthropic) — template URL (account/gateway)
- github-copilot, gitlab-duo (openai-chat) — multi-model gateways mapped to their
  universal OpenAI-compatible endpoint (audit caught that they span 3 protocols on one
  host; the anthropic-only mapping would have mis-routed their GPT/Gemini models).

Verified with a deterministic coverage check against jawcode's registry: all 39
standard-wire providers represented, 0 missing, 0 proprietary leaked in. The 6 excluded
are exactly the proprietary-protocol ones with no opencodex adapter: amazon-bedrock,
cursor, google-antigravity, google-gemini-cli, google-vertex, openai-codex.
Catalog: 26 -> 30. tsc clean. Plan + audit in devlog/61_provider-import/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: lidge-jun

devlog/61_provider-import/00_plan.md

@@ -0,0 +1,54 @@
+# Plan — fix provider import criterion + verify full jawcode coverage
+
+## Correction
+The earlier import used the WRONG exclusion criterion ("CLI-agent like cursor"). The correct rule is
+**protocol**: include any provider jawcode exposes on a standard streaming API opencodex already speaks
+(`openai-completions`→openai-chat, `anthropic-messages`→anthropic, `openai-responses`, `azure-openai-responses`,
+`google-generative-ai`); exclude only providers on a proprietary / non-HTTP-streaming protocol opencodex
+has no adapter for.
+
+## Classification (derived from jawcode models.json `api` field)
+- **Include (39, standard wire):** alibaba, anthropic, azure-openai, cerebras, **cloudflare-ai-gateway**,
+  deepseek, firepass, fireworks, **github-copilot**, **gitlab-duo**, google, groq, huggingface, **kilo**,
+  kimi-code, litellm, minimax(+cn/code), mistral, moonshot, nanogpt, nvidia, openai, opencode(+go/zen),
+  openrouter, qianfan, qwen-portal, synthetic, together, venice, vercel-ai-gateway, xai, xiaomi, zai, zenmux.
+- **Exclude (6, proprietary — no opencodex adapter):** amazon-bedrock (`bedrock-converse-stream`),
+  cursor (`cursor-agent`), google-antigravity + google-gemini-cli (`google-gemini-cli`),
+  google-vertex (`google-vertex`), openai-codex (`openai-codex-responses` — the codex backend itself).
+  (`ollama-cloud` is native `ollama-chat` in jawcode but opencodex routes it via the OpenAI `/v1` endpoint → already included.)
+
+## Gap (vs current opencodex coverage)
+Already present in opencodex (KEY_LOGIN catalog / OAUTH / init+GUI presets): all of the 39 EXCEPT four.
+**ADD these 4 standard-wire providers to `src/oauth/key-providers.ts`:**
+
+| id | opencodex adapter | baseUrl | notes |
+|----|-------------------|---------|-------|
+| `kilo` | openai-chat | `https://api.kilo.ai/api/gateway` | clean — all 443 models openai-completions |
+| `cloudflare-ai-gateway` | anthropic | `https://gateway.ai.cloudflare.com/v1/{account-id}/{gateway}/anthropic` | clean — all 37 anthropic-messages; URL is a template |
+| `github-copilot` | openai-chat | `https://api.githubcopilot.com` | **REVISED per audit** |
+| `gitlab-duo` | openai-chat | `https://cloud.gitlab.com/ai/v1/proxy/openai/v1` | **REVISED per audit** |
+
+groq/openrouter are already usable via the init+GUI presets, so they need no catalog entry.
+
+## Audit fix (A FAILED → corrected)
+The auditor proved `github-copilot` and `gitlab-duo` are NOT single-protocol — their models span
+anthropic-messages + openai-responses + openai-completions. Mapping them to one `anthropic` adapter
+would mis-route their GPT/Gemini models. **Fix:** map both to `openai-chat` against their universal
+**OpenAI-compatible endpoint** (copilot: all models share host `api.githubcopilot.com`; gitlab: the
+`/proxy/openai/v1` endpoint) — one wire that serves the whole lineup, no mis-routing.
+
+## Auth caveat (documented, not hidden)
+`github-copilot` and `gitlab-duo` are subscription gateways: they authenticate with a Bearer
+subscription token (not a plain provider API key), and copilot additionally expects a client
+`User-Agent` header. They're imported because the streaming IS a standard OpenAI-compatible API; the
+user supplies their token (and, for copilot, may add a `User-Agent` via custom provider `headers`).
+`cloudflare-ai-gateway` needs the account/gateway ids filled into the URL.
+
+## Verify (Check phase)
+A deterministic script maps EVERY jawcode provider → its api → expected include/exclude → and confirms
+it against opencodex's actual catalog+presets+oauth. Pass = every standard-wire provider represented,
+every proprietary one absent. Plus `tsc` clean.
+
+## Files
+- MODIFY `src/oauth/key-providers.ts` — add the 4 entries.
+- (docs) MODIFY `docs-site/.../guides/providers.md` — mention the gateways/proxies + auth caveat.

docs-site/src/content/docs/guides/providers.md

@@ -76,11 +76,25 @@ validates the key, and stores it. Notable entries:
 | Z.AI (GLM Coding) | `https://api.z.ai/api/coding/paas/v4` |
 | Qwen Portal | `https://portal.qwen.ai/v1` |
 | Xiaomi MiMo | `https://api.xiaomimimo.com/anthropic` |
+| Kilo | `https://api.kilo.ai/api/gateway` |
+| GitHub Copilot · GitLab Duo | `https://api.githubcopilot.com` · `https://cloud.gitlab.com/ai/v1/proxy/openai/v1` |
+| Cloudflare AI Gateway | `https://gateway.ai.cloudflare.com/v1/{account}/{gateway}/anthropic` |
 | …and more | opencode zen, Vercel AI Gateway, Venice, NanoGPT, Synthetic, Qianfan, Alibaba, Parallel, ZenMux, LiteLLM |
 
 Most use the `openai-chat` adapter with a bearer key; a few that expose only an Anthropic-compatible
 endpoint (e.g. **Xiaomi MiMo**) use the `anthropic` adapter (`x-api-key`).
 
+:::note[Gateways & subscription proxies]
+A provider is included whenever it speaks a standard streaming API opencodex can proxy
+(`openai-completions`, `anthropic-messages`, `openai-responses`, Azure, or Gemini) — **not** based on
+whether it's an "agent" product. Providers on a proprietary protocol with no opencodex adapter are
+excluded: Cursor, Gemini CLI / Antigravity, Vertex AI, Amazon Bedrock, and the Codex backend itself.
+**GitHub Copilot** and **GitLab Duo** are multi-model gateways mapped to their universal
+OpenAI-compatible endpoint; they authenticate with a Bearer **subscription token** (not a plain API
+key), and Copilot may need a `User-Agent` header set via the provider's `headers`. **Cloudflare AI
+Gateway** needs your account + gateway ids filled into the URL.
+:::
+
 ### Ollama Cloud
 
 Ollama Cloud is a hosted (not local) Ollama, OpenAI-compatible at `https://ollama.com/v1` with a key

src/oauth/key-providers.ts

@@ -75,6 +75,16 @@ export const KEY_LOGIN_PROVIDERS: Record<string, KeyLoginProvider> = {
   "vercel-ai-gateway": { label: "Vercel AI Gateway", baseUrl: "https://ai-gateway.vercel.sh/v1", adapter: "openai-chat", dashboardUrl: "https://vercel.com/dashboard" },
   // Xiaomi MiMo exposes an Anthropic-compatible endpoint → anthropic adapter (x-api-key).
   xiaomi: { label: "Xiaomi MiMo", baseUrl: "https://api.xiaomimimo.com/anthropic", adapter: "anthropic", dashboardUrl: "https://xiaomimimo.com", defaultModel: "mimo-v2.5-pro" },
+  // ── Gateways / multi-model proxies (standard wire; subscription-token auth) ──────────────
+  // kilo: single-protocol OpenAI-compatible gateway (443 models). Cloudflare AI Gateway: anthropic
+  // wire, URL is a template (fill in your account + gateway). github-copilot & gitlab-duo are
+  // multi-model gateways whose models span 3 protocols on ONE host — mapped to their universal
+  // OpenAI-compatible endpoint (one wire serves the whole lineup). Both need a Bearer subscription
+  // token (not a plain API key), and copilot may need a `User-Agent` header via custom provider config.
+  kilo: { label: "Kilo", baseUrl: "https://api.kilo.ai/api/gateway", adapter: "openai-chat", dashboardUrl: "https://kilo.ai" },
+  "cloudflare-ai-gateway": { label: "Cloudflare AI Gateway", baseUrl: "https://gateway.ai.cloudflare.com/v1/{account-id}/{gateway}/anthropic", adapter: "anthropic", dashboardUrl: "https://dash.cloudflare.com/?to=/:account/ai/ai-gateway" },
+  "github-copilot": { label: "GitHub Copilot", baseUrl: "https://api.githubcopilot.com", adapter: "openai-chat", dashboardUrl: "https://github.com/settings/copilot" },
+  "gitlab-duo": { label: "GitLab Duo", baseUrl: "https://cloud.gitlab.com/ai/v1/proxy/openai/v1", adapter: "openai-chat", dashboardUrl: "https://gitlab.com/-/user_settings/personal_access_tokens" },
 };
 
 /**