feat(providers/kimicode): add native Responses API support

.github/workflows/codeql.yml

@@ -40,7 +40,7 @@ jobs:
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -51,4 +51,4 @@ jobs:
         run: go build ./...
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4

config/config.example.yaml

@@ -144,9 +144,10 @@ models:
 #       headers:
 #         Authorization: "Bearer ${GITHUB_PAT}"
 #       description: GitHub tools
-#       allowed_tools: [] # allowlist of upstream tool names; empty = all
-#       disallowed_tools: [] # blocklist, applied after the allowlist
+#       allowed_tools: [] # allowlist of upstream tool names; empty = all (new upstream tools stay hidden when set)
+#       disallowed_tools: [] # tools to exclude, applied after the allowlist; edits apply without a reconnect
 #       user_paths: [] # restrict visibility to these user-path subtrees; empty = everyone
+#       disallowed_user_paths: [] # hide from these subtrees, even inside user_paths
 #       tool_timeout: 30s # per tools/call upper bound
 #     local-files: # stdio servers spawn a subprocess and are declarative-only:
 #       transport: stdio # the admin API and dashboard reject them by design
@@ -590,10 +591,14 @@ providers:
     type: jev
     api_key: "${JEV_API_KEY}"
     # base_url defaults to "https://api.typesafe.ai". TypeSafe's System One
-    # API is a decision API with no OpenAI-compatible surface: requests go to
-    # POST /p/jev/v1/systemone, or point the TypeSafe SDK at /p/jev. A
-    # self-hosted Kev server speaks the same API without authentication:
-    # set base_url (e.g. "http://localhost:8009") and omit api_key.
+    # API is a decision API with no OpenAI-compatible surface: configuring
+    # this provider (or openrouter, which serves Jev natively) enables
+    # POST /v1/systemone, which forwards requests natively (point the
+    # TypeSafe SDK at the gateway root). A self-hosted Kev
+    # server speaks the same API without authentication: set base_url
+    # (e.g. "http://localhost:8009") and omit api_key. Name it "kev" to see
+    # that name in logs and usage; no separate provider type is needed.
+    # Pinned versions such as "jev-1.13.0" route here without being listed.
     # Jev is priced per input token and is not in the upstream model catalog;
     # declare its pricing here to have the gateway cost System One requests.
     # models:

config/env.go

@@ -66,7 +66,7 @@ func applyPluginsLoadEnv(cfg *Config) {
 		return
 	}
 	load := make([]PluginFileConfig, 0, 4)
-	for _, item := range strings.Split(v, ",") {
+	for item := range strings.SplitSeq(v, ",") {
 		if entry := parsePluginLoadEntry(item); entry.File != "" {
 			load = append(load, entry)
 		}