@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Providers can read their API key from a named environment variable (`api_key_env` in `config.toml` or the provider API).
@@ -12,17 +12,12 @@
  * refresh is automatic.
  */
 
-import {
-  applyCustomRegistryProvider,
-  CustomRegistryApiError,
-  fetchCustomRegistry,
-  type CustomRegistrySource,
-  type ManagedKimiConfigShape,
-} from '@moonshot-ai/kimi-code-oauth';
 import {
   applyCatalogProvider,
   catalogProviderModels,
   CatalogFetchError,
+  RegistryImportError,
+  type ImportCustomRegistryResult,
   createKimiHarness,
   DEFAULT_CATALOG_URL,
   resolveCatalogImport,
@@ -75,75 +70,51 @@ export async function handleProviderAdd(
   opts: AddOptions,
 ): Promise<void> {
   const apiKey = resolveApiKey(opts.apiKey, deps.env);
-  if (apiKey === undefined) {
-    deps.stderr.write(
-      'Missing API key. Pass --api-key <key> or set KIMI_REGISTRY_API_KEY.\n',
-    );
-    deps.exit(1);
-  }
 
   const trimmedUrl = url.trim();
   if (trimmedUrl.length === 0) {
     deps.stderr.write('Registry URL is required.\n');
     deps.exit(1);
   }
 
-  const source: CustomRegistrySource = {
-    kind: 'apiJson',
-    url: trimmedUrl,
-    apiKey,
-  };
-
   const harness = deps.getHarness();
   await harness.ensureConfigFile();
 
-  let entries: Awaited<ReturnType<typeof fetchCustomRegistry>>;
+  let result: ImportCustomRegistryResult;
   try {
-    entries = await fetchCustomRegistry(source, { userAgent: createKimiCodeUserAgent() });
+    result = await harness.importCustomRegistry({
+      url: trimmedUrl,
+      apiKey,
+      setDefaultWhenUnset: false,
+    });
   } catch (error) {
-    const suffix = error instanceof CustomRegistryApiError ? ` (HTTP ${String(error.status)})` : '';
+    if (!(error instanceof RegistryImportError) || error.phase === 'apply') throw error;
+    if (error.phase === 'empty') {
+      deps.stderr.write(`Registry at ${trimmedUrl} contained no usable providers.\n`);
+      deps.exit(1);
+    }
+    const suffix = error.status === undefined ? '' : ` (HTTP ${String(error.status)})`;
     deps.stderr.write(`Failed to fetch registry${suffix}: ${errorMessage(error)}\n`);
+    if (apiKey === undefined && (error.status === 401 || error.status === 403)) {
+      deps.stderr.write(
+        'This registry requires authentication — pass --api-key <key> or set KIMI_REGISTRY_API_KEY.\n',
+      );
+    }
     deps.exit(1);
   }
 
-  const entryList = Object.values(entries);
-  if (entryList.length === 0) {
-    deps.stderr.write(`Registry at ${trimmedUrl} contained no usable providers.\n`);
-    deps.exit(1);
-  }
-
-  // `harness.removeProvider` reloads the config from disk on each call (see
-  // `core-impl.ts removeKimiProvider`), so calling it inside the apply loop
-  // would discard providers we already applied in memory but have not yet
-  // persisted. Drop every stale id up front in a single batch instead, then
-  // apply against the resulting fresh config.
-  let config = await harness.getConfig();
-  const staleIds = entryList
-    .filter((entry) => config.providers[entry.id] !== undefined)
-    .map((entry) => entry.id);
-  for (const id of staleIds) {
-    config = await harness.removeProvider(id);
-  }
-
-  const addedProviderIds: string[] = [];
-  let modelCount = 0;
-  for (const entry of entryList) {
-    applyCustomRegistryProvider(asManaged(config), entry, source);
-    addedProviderIds.push(entry.id);
-    modelCount += Object.keys(entry.models).length;
-  }
-
-  await harness.setConfig({
-    providers: config.providers,
-    models: config.models,
-  });
-
+  const count = result.providers.length;
   deps.stdout.write(
-    `Imported ${String(addedProviderIds.length)} provider${addedProviderIds.length === 1 ? '' : 's'} ` +
-      `(${String(modelCount)} model${modelCount === 1 ? '' : 's'}) from ${trimmedUrl}:\n`,
+    `Imported ${String(count)} provider${count === 1 ? '' : 's'} ` +
+      `(${String(result.modelsImported)} model${result.modelsImported === 1 ? '' : 's'}) from ${trimmedUrl}:\n`,
   );
-  for (const id of addedProviderIds) {
-    deps.stdout.write(`  - ${id}\n`);
+  for (const provider of result.providers) {
+    deps.stdout.write(`  - ${provider.id}\n`);
+  }
+  for (const [id, envName] of Object.entries(result.credentialEnv)) {
+    deps.stdout.write(
+      `provider "${id}" declares credential env var "${envName}" — set api_key_env in config.toml to use it\n`,
+    );
   }
 }
 
@@ -474,7 +445,10 @@ export function registerProviderCommand(parent: Command, deps?: Partial<Provider
   provider
     .command('add <url>')
     .description('Import every provider listed in a custom registry (api.json).')
-    .option('--api-key <key>', 'Registry API key. Falls back to KIMI_REGISTRY_API_KEY.')
+    .option(
+      '--api-key <key>',
+      'Registry API key. Falls back to KIMI_REGISTRY_API_KEY; omit both for public registries.',
+    )
     .action(async (url: string, options: { apiKey?: string }) => {
       const resolved = resolveDeps(deps);
       await runAction(resolved, () => handleProviderAdd(resolved, url, { apiKey: options.apiKey }));
@@ -582,10 +556,6 @@ function resolveApiKey(flag: string | undefined, env: NodeJS.ProcessEnv): string
   return undefined;
 }
 
-function asManaged(config: KimiConfig): ManagedKimiConfigShape {
-  return config as unknown as ManagedKimiConfigShape;
-}
-
 function providerSourceLabel(provider: KimiConfig['providers'][string]): string {
   const source = provider.source;
   if (source !== undefined) {
 
@@ -184,7 +184,7 @@ async function handleOpenPlatformLogin(
       selection.thinking !== 'off' && selection.thinking !== 'on'
         ? selection.thinking
         : undefined,
-    apiKey,
+    credential: { apiKey },
   });
 
   await host.harness.setConfig({
 
@@ -1,13 +1,9 @@
-import {
-  applyCustomRegistryEntries,
-  fetchCustomRegistry,
-  type CustomRegistrySource,
-  type ManagedKimiConfigShape,
-} from '@moonshot-ai/kimi-code-oauth';
 import {
   applyCatalogProvider,
   catalogProviderModels,
   CatalogFetchError,
+  RegistryImportError,
+  type ImportCustomRegistryResult,
   DEFAULT_CATALOG_URL,
   resolveCatalogImport,
   SECONDARY_DERIVED_MODEL_ALIAS,
@@ -22,6 +18,7 @@ import { ChoicePickerComponent } from '../components/dialogs/choice-picker';
 import {
   CustomRegistryImportDialogComponent,
   type CustomRegistryImportResult,
+  type CustomRegistryImportValue,
 } from '../components/dialogs/custom-registry-import';
 import {
   ProviderManagerComponent,
@@ -342,49 +339,49 @@ async function handleCustomRegistryAddViaDialog(host: SlashCommandHost): Promise
   const value = await promptCustomRegistryImport(host);
   if (value === undefined) return false;
 
-  const source: CustomRegistrySource = {
-    kind: 'apiJson',
-    url: value.url,
-    apiKey: value.apiKey,
-  };
-
-  let entries: Awaited<ReturnType<typeof fetchCustomRegistry>>;
+  let result: ImportCustomRegistryResult;
   try {
-    entries = await fetchCustomRegistry(source, { userAgent: createKimiCodeUserAgent() });
+    result = await host.harness.importCustomRegistry({
+      url: value.url,
+      apiKey: value.apiKey,
+      setDefaultWhenUnset: false,
+    });
   } catch (error) {
-    host.showError(`Failed to import registry: ${formatErrorMessage(error)}`);
+    if (error instanceof RegistryImportError && error.phase === 'empty') {
+      host.showStatus('Registry contained no providers.');
+      return false;
+    }
+    const phase =
+      error instanceof RegistryImportError && error.phase === 'fetch' ? 'import' : 'apply';
+    host.showError(`Failed to ${phase} registry: ${formatErrorMessage(error)}`);
+    if (
+      value.apiKey === undefined &&
+      error instanceof RegistryImportError &&
+      (error.status === 401 || error.status === 403)
+    ) {
+      host.showStatus('This registry requires authentication — paste its Bearer token.', 'warning');
+    }
     return false;
   }
-
-  const addedProviderIds = Object.values(entries).map((entry) => entry.id);
   try {
-    const config = await host.harness.getConfig();
-    applyCustomRegistryEntries(
-      config as unknown as ManagedKimiConfigShape,
-      entries,
-      source,
-    );
-    await host.harness.setConfig({
-      providers: config.providers,
-      models: config.models,
-    });
     await host.authFlow.refreshConfigAfterLogin();
   } catch (error) {
     host.showError(`Failed to apply registry: ${formatErrorMessage(error)}`);
     return false;
   }
-
+  const addedProviderIds = result.providers.map((provider) => provider.id);
   const count = addedProviderIds.length;
-  if (count === 0) {
-    host.showStatus('Registry contained no providers.');
-    return false;
-  }
   host.showStatus(
     count === 1
       ? 'Imported 1 provider from registry.'
       : `Imported ${String(count)} providers from registry.`,
     'success',
   );
+  for (const [id, envName] of Object.entries(result.credentialEnv)) {
+    host.showStatus(
+      `provider "${id}" declares credential env var "${envName}" — set api_key_env in config.toml to use it`,
+    );
+  }
 
   // Offer the model selector so the user can pick a default, just like the
   // catalog (known-provider) flow. Copy without the v1-synthesized
@@ -419,7 +416,7 @@ async function handleCustomRegistryAddViaDialog(host: SlashCommandHost): Promise
 
 function promptCustomRegistryImport(
   host: SlashCommandHost,
-): Promise<{ readonly url: string; readonly apiKey: string } | undefined> {
+): Promise<CustomRegistryImportValue | undefined> {
   return new Promise((resolve) => {
     const dialog = new CustomRegistryImportDialogComponent(
       (result: CustomRegistryImportResult) => {
 
@@ -1,12 +1,13 @@
 /**
  * CustomRegistryImportDialog — blue rounded box that collects a custom
- * registry URL and a Bearer token before importing the registry's
+ * registry URL and an optional Bearer token before importing the registry's
  * provider entries.
  *
  * Geometry mirrors `ApiKeyInputDialogComponent` so the chrome stays
  * consistent with the API-key login flow. Two fields, switched with
  * Tab / Shift-Tab / Up / Down; Enter advances to the next field (and submits
- * on the last field), Esc cancels. Both fields are required.
+ * on the last field), Esc cancels. Only the URL is required — public
+ * registries take an empty token.
  */
 
 import {
@@ -23,17 +24,16 @@ import { currentTheme } from '#/tui/theme';
 
 export interface CustomRegistryImportValue {
   readonly url: string;
-  readonly apiKey: string;
+  readonly apiKey?: string;
 }
 
 export type CustomRegistryImportResult =
   | { readonly kind: 'ok'; readonly value: CustomRegistryImportValue }
   | { readonly kind: 'cancel' };
 
 const TITLE = 'Import custom provider registry';
-const SUBTITLE_DEFAULT = 'Paste an api.json URL and its Bearer token.';
+const SUBTITLE_DEFAULT = 'Paste an api.json URL; the Bearer token is optional.';
 const SUBTITLE_URL_EMPTY = 'Registry URL cannot be empty.';
-const SUBTITLE_TOKEN_EMPTY = 'Bearer token cannot be empty.';
 const FOOTER_NOT_LAST = 'Tab / ↑↓ to switch  ·  Enter for next field  ·  Esc to cancel';
 const FOOTER_LAST = 'Tab / ↑↓ to switch  ·  Enter to submit  ·  Esc to cancel';
 
@@ -72,7 +72,7 @@ export class CustomRegistryImportDialogComponent extends Container implements Fo
   private readonly onDone: (result: CustomRegistryImportResult) => void;
   private activeField: FieldId = 'url';
   private done = false;
-  private hint: 'none' | 'url-empty' | 'token-empty' = 'none';
+  private hint: 'none' | 'url-empty' = 'none';
 
   constructor(
     onDone: (result: CustomRegistryImportResult) => void,
@@ -144,20 +144,15 @@ export class CustomRegistryImportDialogComponent extends Container implements Fo
 
     const border = (s: string): string => currentTheme.fg('primary', s);
     const titleStyled = currentTheme.boldFg('textStrong', TITLE);
-    const subtitleText =
-      this.hint === 'url-empty'
-        ? SUBTITLE_URL_EMPTY
-        : this.hint === 'token-empty'
-          ? SUBTITLE_TOKEN_EMPTY
-          : SUBTITLE_DEFAULT;
+    const subtitleText = this.hint === 'url-empty' ? SUBTITLE_URL_EMPTY : SUBTITLE_DEFAULT;
     const subtitleStyled = currentTheme.fg('textDim', subtitleText);
     const footerStyled = currentTheme.fg(
       'textDim',
       this.activeField === 'url' ? FOOTER_NOT_LAST : FOOTER_LAST,
     );
 
     const urlLabelText = 'Registry URL';
-    const tokenLabelText = 'Bearer token';
+    const tokenLabelText = 'Bearer token (optional)';
     const urlLabelStyled =
       this.activeField === 'url'
         ? currentTheme.boldFg('accent', urlLabelText)
@@ -233,14 +228,12 @@ export class CustomRegistryImportDialogComponent extends Container implements Fo
       this.activeField = 'url';
       return;
     }
-    if (tokenValue.length === 0) {
-      this.hint = 'token-empty';
-      this.activeField = 'token';
-      return;
-    }
 
     this.done = true;
-    this.onDone({ kind: 'ok', value: { url: urlValue, apiKey: tokenValue } });
+    this.onDone({
+      kind: 'ok',
+      value: { url: urlValue, apiKey: tokenValue.length > 0 ? tokenValue : undefined },
+    });
   }
 
   private cancel(): void {
-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"@moonshot-ai/kimi-code": patch
 +---
++
 +Providers can read their API key from a named environment variable (`api_key_env` in `config.toml` or the provider API).