fix(vscode): make the gear sign-in actually log in

[wbxl2000]

Related Issue

No issue — the problem is explained in the next section.

Problem

The gear (Action) menu's Sign in item in the VS Code webview was a dead button. When not logged in, ActionMenu.handleAuthAction only closed the menu and triggered a refresh — it never called bridge.login(). The full LoginScreen only appears when zero models are configured, so for users with a working config.toml setup the click had no visible effect at all.

The menu deliberately reflects only the managed Kimi account OAuth session — statically provisioned api_key providers in config.toml don't count, because Sign out must remain a meaningful action that maps to deleting the OAuth session, mirroring the CLI's /login and /logout. An earlier revision of this PR counted configured api keys as signed in; that made Sign out a no-op for those users, so it was reverted.

What changed

• webview-ui/src/components/ActionMenu.tsx: the gear Sign in item now actually calls bridge.login() (device-code flow opens the browser automatically) with the existing loading state, and surfaces failures via a toast. Sign out keeps calling bridge.logout(); because the menu state tracks the OAuth session only, both actions now visibly toggle the menu state.
• No changes to login detection (updateLoginContext stays OAuth-based) or to the login-screen gating (unchanged: the screen only shows when no models are configured).

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works. (Covered by the existing bridge/handler test suite; the change is webview event wiring verified by typecheck and the full extension test suite.)
• Ran gen-changesets skill, or this PR needs no changeset. (No changeset: vscode-extension-only change, nothing enters the CLI bundle.)
• Ran gen-docs skill, or this PR needs no doc update. (Internal behavior fix, no user-facing docs affected.)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 38de981

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@moonshot-ai/kimi-code@38de981

npx https://pkg.pr.new/@moonshot-ai/kimi-code@38de981

commit: 38de981

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b6e046a215

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Don't treat unrelated provider keys as managed login

When a config has a static API key for one provider but the default/first model still uses managed:kimi-code without an OAuth token, this returns true just because some provider has apiKey. useAppInit then calls requiresManagedProviderLogin(..., loginStatus.loggedIn), which short-circuits on loggedIn and skips the login screen, leaving the UI ready even though the active managed model has no token and prompts will fail; the check needs to be tied to the active provider (or keep managed OAuth status separate from other provider credentials).

Useful? React with 👍 / 👎.