feat: add OpenRouter OAuth login

Author: danielkov

README.md

@@ -103,19 +103,41 @@ local record; if remote revocation is unavailable, credentials are retained. Use
 Kit refreshes expiring credentials proactively and retries one rejected credential
 with a synchronized forced refresh.
 
-To use OpenRouter, set `OPENROUTER_API_KEY`, select the provider, and pass an
-OpenRouter model identifier:
+To use OpenRouter, sign in to the shared credential store or supply an API key,
+then select the provider and pass an OpenRouter model identifier:
 
 ```sh
-OPENROUTER_API_KEY=sk-or-v1-... cargo run -- prompt \
+cargo run -- auth login openrouter --credential-store keychain
+cargo run -- auth status openrouter --credential-store keychain
+cargo run -- prompt --credential-store keychain \
   --provider openrouter --model anthropic/claude-sonnet-4 \
   --root /path/to/project "Reply with a short project summary"
+cargo run -- auth logout openrouter --credential-store keychain
 ```
 
+Runtime and OpenRouter auth status resolve keys in this order: a non-empty global
+`--openrouter-api-key`, a non-empty `OPENROUTER_API_KEY`, then the stored
+`openrouter/default` credential. An empty flag is rejected; an empty environment value
+is treated as absent. The flag is available to `serve`, `acp`, `prompt`, `tui`, and `auth`, but its value is
+present in Kit's initial process argv and can be exposed by shell history or process
+inspection. Prefer the environment or stored credentials. Kit never rewrites its own
+process environment and never adds the key to child argv. It overrides
+`OPENROUTER_API_KEY` only in the TUI's Kit `serve` child and built-in or configured
+`acp.kit` children. Kit removes its resolved OpenRouter key from external ACP child
+environments rather than exposing the credential to arbitrary configured agents.
+
+`kit auth status openrouter` reports whether the active source is the flag,
+environment, or stored credentials without printing the key. Logout removes only the
+stored record and cannot revoke an OpenRouter key automatically. If the flag or
+`OPENROUTER_API_KEY` remains set, logout warns that it is still active; the
+environment value is retained.
+
 Kit uses the selected `--model` or configured `model`; `OPENROUTER_MODEL` does not
 override it. The adapter also honors its optional `OPENROUTER_BASE_URL`,
 `OPENROUTER_APP_NAME`, `OPENROUTER_SITE_URL`, `OPENROUTER_MAX_COMPLETION_TOKENS`,
-`OPENROUTER_TEMPERATURE`, and `OPENROUTER_REASONING_EFFORT` settings.
+`OPENROUTER_TEMPERATURE`, and `OPENROUTER_REASONING_EFFORT` settings. Stored OAuth
+credentials are restricted to OpenRouter's canonical API endpoint; custom base URLs
+require an explicit flag or environment key.
 
 Kit also reads the OpenRouter model catalog's
 `context_length` for the selected model, enabling the normal context gauge and
@@ -212,7 +234,9 @@ explicit `[acp.kit]` overrides that executable/base argv. In both cases Kit then
 appends root, provider, model, the resolved reasoning effort, persistent session, resume, MCP, credential, and inherited
 depth flags, and the profile remains eligible for isolated Kit transcript fork
 fallback. Other profiles remain literal generic ACP argv. Configured child
-processes inherit Kit's environment unchanged in this release.
+processes inherit Kit's environment except for resolved OpenRouter credentials:
+`acp.kit` receives the key as a child-only `OPENROUTER_API_KEY` override, while
+generic ACP profiles have `OPENROUTER_API_KEY` removed.
 Missing config files are ignored; unreadable or invalid files and unknown selected
 harness references produce an error rather than being silently discarded.
 
@@ -446,7 +470,7 @@ refusal, protocol errors, and other uncertain stops retire the child instead. Pe
 headless child are conservatively cancelled so they cannot hang. Nested built-in
 children use `kit acp` and never start A2A listeners.
 
-OpenAI, Speakeasy, and MCP use one shared credential backend, selected with
+OpenAI, OpenRouter, Speakeasy, and MCP use one shared credential backend, selected with
 `--credential-store` or `credential_store`. The default `memory` backend is
 process-local, so credentials disappear at exit and are not available to the
 TUI server process or nested Kit children. Use persistent storage when those

src/acp_child.rs

@@ -226,6 +226,7 @@ impl AcpHarnesses {
                 .ok_or_else(|| format!("unknown ACP harness {reference:?}"))?;
             let mut command = Command::new(&profile.command);
             command.args(&profile.args);
+            command.env_remove("OPENROUTER_API_KEY");
             command
         };
         // Every trusted profile is spawned directly (never through a shell)
@@ -282,6 +283,9 @@ impl AcpHarnesses {
             command.arg("--credential-dir").arg(path);
         }
         config.telemetry.append_cli_args(&mut command);
+        if let Some(api_key) = &config.openrouter_api_key {
+            command.env("OPENROUTER_API_KEY", api_key.as_str());
+        }
         Ok(command)
     }
 }
@@ -307,6 +311,7 @@ pub(crate) fn serve_command(
     model: &str,
     provider: crate::ProviderKind,
     reasoning_effort: Option<crate::ReasoningEffort>,
+    openrouter_api_key: Option<&crate::provider::OpenRouterApiKey>,
     session_id: &str,
     resume: bool,
 ) -> std::io::Result<Command> {
@@ -326,6 +331,9 @@ pub(crate) fn serve_command(
     if resume {
         command.arg("--resume");
     }
+    if let Some(api_key) = openrouter_api_key {
+        command.env("OPENROUTER_API_KEY", api_key.as_str());
+    }
     Ok(command)
 }
 
@@ -335,6 +343,7 @@ pub(crate) struct ChildConfig {
     pub model: String,
     pub provider: crate::ProviderKind,
     pub reasoning_effort: Option<crate::ReasoningEffort>,
+    pub openrouter_api_key: Option<crate::provider::OpenRouterApiKey>,
     pub mcp_config: Option<PathBuf>,
     pub credential_storage: CredentialStorage,
     pub telemetry: crate::telemetry::Settings,
@@ -1047,6 +1056,7 @@ mod tests {
             "test-model",
             crate::ProviderKind::OpenRouter,
             Some(crate::ReasoningEffort::Medium),
+            Some(&crate::provider::OpenRouterApiKey::new("tui-secret")),
             "session",
             true,
         )
@@ -1060,6 +1070,48 @@ mod tests {
             args.windows(2)
                 .any(|pair| pair == ["--reasoning-effort", "medium"])
         );
+        assert!(args.iter().all(|arg| arg != "tui-secret"));
+        assert!(command.as_std().get_envs().any(|(name, value)| {
+            name == "OPENROUTER_API_KEY" && value == Some(std::ffi::OsStr::new("tui-secret"))
+        }));
+    }
+
+    #[test]
+    fn openrouter_key_is_removed_from_external_acp_profiles() {
+        let root = tempfile::tempdir().unwrap();
+        let harnesses = AcpHarnesses::new(BTreeMap::from([(
+            "external".into(),
+            AcpHarnessProfile {
+                command: "external-agent".into(),
+                args: Vec::new(),
+                permissions: AcpPermissionPolicy::Deny,
+            },
+        )]))
+        .unwrap();
+        for openrouter_api_key in [
+            Some(crate::provider::OpenRouterApiKey::new("external-secret")),
+            None,
+        ] {
+            let config = ChildConfig {
+                root: root.path().into(),
+                model: "model".into(),
+                provider: crate::ProviderKind::OpenRouter,
+                reasoning_effort: None,
+                openrouter_api_key,
+                mcp_config: None,
+                credential_storage: Default::default(),
+                telemetry: Default::default(),
+                harnesses: harnesses.clone(),
+                default_harness: "acp.external".into(),
+            };
+            let command = harnesses.spawn("acp.external", &config, None, 1).unwrap();
+            assert!(
+                command
+                    .as_std()
+                    .get_envs()
+                    .any(|(name, value)| { name == "OPENROUTER_API_KEY" && value.is_none() })
+            );
+        }
     }
 
     #[test]
@@ -1235,6 +1287,7 @@ mod tests {
             model: "unused".into(),
             provider: Default::default(),
             reasoning_effort: None,
+            openrouter_api_key: None,
             mcp_config: None,
             credential_storage: Default::default(),
             telemetry: Default::default(),
@@ -1285,6 +1338,7 @@ mod tests {
             model: "unused".into(),
             provider: Default::default(),
             reasoning_effort: None,
+            openrouter_api_key: None,
             mcp_config: None,
             credential_storage: Default::default(),
             telemetry: Default::default(),
@@ -1334,6 +1388,7 @@ mod tests {
             model: "unused".into(),
             provider: Default::default(),
             reasoning_effort: None,
+            openrouter_api_key: None,
             mcp_config: None,
             credential_storage: Default::default(),
             telemetry: Default::default(),
@@ -1370,6 +1425,7 @@ mod tests {
             model: "test-model".into(),
             provider: crate::ProviderKind::OpenRouter,
             reasoning_effort: Some(crate::ReasoningEffort::High),
+            openrouter_api_key: Some(crate::provider::OpenRouterApiKey::new("child-secret")),
             mcp_config: None,
             credential_storage: CredentialStorage::Filesystem(root.path().join("credentials")),
             telemetry: crate::telemetry::Settings::try_new(
@@ -1439,6 +1495,10 @@ mod tests {
                 .any(|pair| { pair == ["--otel-message-content-max-bytes", "4096"] })
         );
         assert_eq!(command.as_std().get_current_dir(), Some(root.path()));
+        assert!(args.iter().all(|arg| arg != "child-secret"));
+        assert!(command.as_std().get_envs().any(|(name, value)| {
+            name == "OPENROUTER_API_KEY" && value == Some(std::ffi::OsStr::new("child-secret"))
+        }));
     }
 
     #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
@@ -1458,6 +1518,7 @@ mod tests {
             model: "unused".into(),
             provider: Default::default(),
             reasoning_effort: None,
+            openrouter_api_key: None,
             mcp_config: None,
             credential_storage: Default::default(),
             telemetry: Default::default(),
@@ -1516,6 +1577,7 @@ mod tests {
             model: "unused".into(),
             provider: Default::default(),
             reasoning_effort: None,
+            openrouter_api_key: None,
             mcp_config: None,
             credential_storage: Default::default(),
             telemetry: Default::default(),