[dhh]

Follow-up to #14040. The agents panel's add screen could only sign in to Claude Code, Codex and Grok. It now offers every subscription the panel tracks, plus a way to paste an API key for the providers that only take one.

Subscriptions

The add screen lists Claude Code, Codex, Grok, Cursor, Copilot, Kimi, Muse Code, Antigravity and Devin. Picking one runs that agent's own login, installing its CLI first if needed, and the panel follows along:

• Cursor, Kimi, Muse Code, Copilot are followed in the panel. The add command now passes the CLI's stderr through (Kimi writes its login text there), opens the sign-in page itself for CLIs that don't (Muse, and gh), and the panel finds a device code anywhere in a line (Kimi and gh print it mid-sentence).
• Copilot signs in through gh auth login --web, since gh's token is what both the Copilot CLI and the usage collector read; the Copilot CLI's own keyring login isn't visible to the collector.
• Antigravity and Devin need a real terminal (agy has no login command; devin auth login refuses without a TTY), so the add command opens a floating terminal and waits, up to 15 minutes, for the sign-in to land.
• These six sign in once, in their default home. A tile already signed in says so; picking it signs in again, except Antigravity, which has nothing to run again. Second accounts stay with Claude, Codex and Grok for now.
• --check stays fast and never starts a lazy CLI: every signed-in test reads the same file or keyring entry the collector reads.

API keys

Z.ai, MiniMax, Synthetic, Ollama Cloud, OpenRouter, DeepSeek, Fireworks, OpenCode and Kimchi take a pasted key, with a link to where each provider hands one out:

• The key goes to the add command on stdin, never on a command line, and is never printed or sent in a notification.
• It's saved as apiKey in ~/.config/omarchy/agents/<id>.json (Kimchi: its own config.json, as kimchi login writes it), merged with whatever else the file holds, written atomically at mode 0600.
• The collector then runs once with that provider's environment keys removed; a key the provider refuses is reported and the previous file put back.
• MiniMax, Synthetic, DeepSeek, Fireworks and OpenCode now read that file, right after their environment variables; OpenRouter reads its saved apiKey right after OPENROUTER_API_KEY instead of last; Z.ai and Ollama already did.

Layout

The picker is two labelled groups, Subscriptions and API keys, four across, and the keyboard walks it row by row.

Verification

• Every test/shell.d/agent*-test.sh plus the launcher tests pass (56 files) in Pacific/Honolulu and Pacific/Kiritimati, with ./test/cli and the i18n structural check.
• agent-account-test.sh covers --check for all 18 providers without starting a CLI, each new sign-in with stub CLIs (stderr passed through, the page opened for gh and Muse, the terminal wait finishing and being cancelled), and saving keys (fields kept, mode 0600, the key in no output or argument, a refused key restored). Each collector's test checks its saved key is used, in order.
• Each CLI's real login output was captured in a sandbox, without completing a sign-in.
• The add screen and the key step were checked in a running shell: all 18 tiles render with their marks, the signed-in state shows, and the key is masked as it's typed.

Not verified

No sign-in or key was completed against a real service, so the post-login files and the keyring entries are as each CLI's source writes them. The key pages for Synthetic and Kimchi point at their sites, as neither documents a key page.

🤖 Generated with Claude Code

Posted by Claude on behalf of DHH