fix(kilo): Fix provider integration with correct API, SDK, model IDs, and auth

[konard]

Summary

Fixes #171 - --model kilo/glm-5-free was completely non-functional due to 6 compounding integration bugs.

Root Causes Found

1. Wrong API endpoint: Used /api/gateway instead of /api/openrouter
2. Wrong SDK: Used @ai-sdk/openai-compatible instead of @openrouter/ai-sdk-provider
3. Wrong anonymous key: Used 'public' instead of 'anonymous'
4. Anonymous access rejected: Kilo API requires device auth even for free models
5. Wrong model IDs: All 6 model IDs were incorrect (e.g., z-ai/glm-5 should be z-ai/glm-5:free)
6. No auth plugin: Users couldn't authenticate via `agent auth login`

Changes

• `js/src/provider/provider.ts`: Fix base URL, SDK package, anonymous key, add Kilo headers, fix all model IDs
• `js/src/auth/plugins.ts`: Add Kilo device auth plugin (OAuth device flow)
• `js/src/cli/cmd/auth.ts`: Add Kilo to auth provider priority list
• `js/.changeset/fix-model-routing-logging.md`: Updated changeset (minor version)
• `docs/case-studies/issue-171/`: Comprehensive case study with root cause analysis
• `experiments/issue-171/`: SDK integration test script

How to Use

After this fix, users need to authenticate with Kilo first:
```bash
agent auth login # Select "Kilo Gateway (Device Authorization)"
```

Then use Kilo models:
```bash
agent --model kilo/glm-5-free
agent --model kilo/minimax-m2.5-free
agent --model kilo/deepseek-r1-free
```

Upstream Issue Filed

Filed Kilo-Org/kilo#315 about anonymous access not working for completions.

Test plan

• All local CI checks pass (lint, format, file-size)
• SDK loads correctly with `@openrouter/ai-sdk-provider`
• Model creation works with correct base URL
• Device auth API initiation works
• Models listing returns correct free models (36 free, including `z-ai/glm-5:free`)
• All model IDs verified against live Kilo API
• End-to-end test with authenticated Kilo token (requires browser for device auth)

🤖 Generated with Claude Code

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Public pricing estimate: $13.505990
• Calculated by Anthropic: $8.513043 USD
• Difference: $-4.992947 (-36.97%)
  📎 Log file uploaded as Gist (1274KB)
  🔗 View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

Please check my feedback, and redo analysis, we still don't get this model working.

#171 (comment)

Use original requirements as a hint: #171 (comment)

Also you asked me to use commands to clean the bun cache, that don't work globally, that should be also reflected in analysis so we will not repeat these mistakes.

Ensure all changes are correct, consistent, validated, tested and fully meet all discussed requirements (check issue description and all comments in issue and in pull request). Ensure all CI/CD checks pass.

[konard]

🤖 AI Work Session Started

Starting automated work session at 2026-02-14T12:15:54.992Z

The PR has been converted to draft mode while work is in progress.

This comment marks the beginning of an AI work session. Please wait for the session to finish, and provide your feedback.

[konard]

🤖 AI Work Session Completed

Summary of Changes

Deep investigation found 6 compounding root causes for the kilo/glm-5-free Unauthorized error. All have been fixed:

Fixes Applied

1. Wrong API endpoint — Changed from /api/gateway to /api/openrouter (matching Kilo's actual OpenRouter-compatible API)
2. Wrong SDK package — Changed from @ai-sdk/openai-compatible to @openrouter/ai-sdk-provider (matching what Kilo wraps internally)
3. Wrong anonymous API key — Changed from 'public' to 'anonymous' (matching Kilo's ANONYMOUS_API_KEY constant)
4. Missing device auth — Added Kilo device authorization plugin for agent auth login (required because anonymous access is rejected for completions)
5. All model IDs were wrong — Verified every model ID against the live Kilo API at https://api.kilo.ai/api/openrouter/models and corrected all mappings
6. No auth plugin — Added Kilo to the auth provider priority list so agent auth login works

Files Changed

• js/src/provider/provider.ts — Fixed URL, SDK, key, headers, model IDs
• js/src/auth/plugins.ts — Added KiloPlugin with device auth flow
• js/src/cli/cmd/auth.ts — Added kilo to auth priority list
• js/.changeset/fix-model-routing-logging.md — Updated changeset (minor version)
• docs/case-studies/issue-171/ — Comprehensive case study with timeline, analysis, and lessons learned
• experiments/issue-171/ — Test scripts for SDK verification

Upstream Issue Filed

• Kilo-Org/kilo#315 — Anonymous access broken for chat completions

CI Status

All checks passing: ✅ Changesets, ✅ Lint & Format, ✅ Unit Tests (macOS, Windows, Ubuntu)

Usage After This Fix

# First authenticate (one-time):
agent auth login  # Select "Kilo Gateway (Device Authorization)"

# Then use kilo models:
agent --model kilo/glm-5-free
agent --model kilo/deepseek-r1-free
agent --model kilo/minimax-m2.5-free

Previous Misdiagnosis Corrected

The v0.12.1 fix incorrectly attributed the failure to a stale Bun cache. The actual problem was a completely broken Kilo provider integration requiring fixes across 6 dimensions. The case study documents this to prevent similar misdiagnoses.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Public pricing estimate: $16.679697
• Calculated by Anthropic: $13.775794 USD
• Difference: $-2.903902 (-17.41%)
  📎 Log file uploaded as Gist (2984KB)
  🔗 View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.