koto 1.5.1

koto 1.5.1

koto venice-login / koto minimax-login, with a key check (#41)

• Two new commands. koto venice-login writes creds/venice.key, and koto minimax-login writes creds/minimax.key. Both files are 0600 and live in the state dir, and the key never enters a guest.
• The key comes from --key-file F, --api-key-stdin, or a hidden terminal prompt. It is never taken from argv.
• Key check before storing. Each key is tested with one request that needs auth before it is written:
  • Venice: GET /api/v1/api_keys/rate_limits (Bearer)
  • MiniMax: GET /anthropic/v1/models (x-api-key)
  • A 2xx stores the key.
  • A 401/403 refuses it, exits 1, and leaves any existing key file untouched.
  • A network error, a 15s timeout or a 5xx stores the key with a warning.
• --no-verify skips the check. --status only reports whether a key is stored.
• Error messages show the status code or the transport error, never the key.
• The setup wizard's auth step now uses the same check for Venice and MiniMax. The daemon re-reads the key on every request, so no restart is needed.

Upgrade note

• Only koto and koto-tui are rebuilt.
• firecracker 1.17.0, vmlinux 6.1.186 and rootfs.img (fedora44) are the 1.5.0 release assets, reused byte-for-byte. Their SHA256SUMS lines and their artifacts.sha256 entries are the same as in 1.5.0. No new rootfs, no new kernel.

koto 1.5.1 for linux/x86_64.

component	version
koto	1.5.1
koto-tui	1.5.1
firecracker	1.17.0
vmlinux	6.1.186
rootfs.img	fedora44

Install: curl -fsSL https://kotovm.com/install.sh | sh -s -- --version 1.5.1,
or from a clone of this tag: make fetch && make install && make wizard.

SHA256SUMS is signed by A6E69ED6BC4779F3281721484CC1AFDE15B64EA3 (SHA256SUMS.asc); both routes
verify that signature, and the unpacked bytes against the artifacts.sha256
committed at this tag, before anything is installed.

🤖 Generated with Claude Code