@bitkyc08/opencodex 2.7.21 → 2.7.23

package/src/oauth/store.ts

@@ -15,8 +15,8 @@
  *   same human on every re-login. Cursor login extracts JWT `sub` as accountId so multiauth
  *   can append distinct accounts.
  */
-import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, chmodSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, closeSync, copyFileSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret } from "../config";
 import type { OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
@@ -26,12 +26,21 @@ type AuthStore = Record<string, ProviderAccountSet>;
 /** Providers whose account set is pinned to a single slot (see module doc). */
 const SINGLE_SLOT_PROVIDERS = new Set(["chatgpt"]);
 
-function authPath(): string {
+export function getAuthStorePath(): string {
   return join(getConfigDir(), "auth.json");
 }
+export function getAuthStoreLockPath(): string { return join(getConfigDir(), "auth.store.lock"); }
+export function getAuthRefreshIntentLockPath(provider: string, accountId: string): string {
+  const safeProvider = provider.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const accountHash = createHash("sha256").update(accountId).digest("hex").slice(0, 24);
+  return join(getConfigDir(), `auth.refresh.${safeProvider}.${accountHash}.lock`);
+}
+export function credentialGeneration(cred: OAuthCredentials): string {
+  return createHash("sha256").update(JSON.stringify([cred.refresh, cred.access, cred.expires])).digest("hex");
+}
 
 function loadAuthStoreInternal(): { store: AuthStore; hadLegacy: boolean } {
-  const path = authPath();
+  const path = getAuthStorePath();
   hardenConfigDir();
   hardenExistingSecret(path);
   if (!existsSync(path)) return { store: {}, hadLegacy: false };
@@ -55,8 +64,24 @@ function persist(store: AuthStore): void {
     try { chmodSync(dir, 0o700); } catch { /* best-effort on existing dir */ }
   }
   hardenConfigDir();
-  atomicWriteFile(authPath(), JSON.stringify(store, null, 2) + "\n");
+  atomicWriteFile(getAuthStorePath(), JSON.stringify(store, null, 2) + "\n");
+}
+
+export class OAuthFileLockError extends Error { readonly code = "OAUTH_FILE_LOCK_UNAVAILABLE"; constructor(message: string, options?: { cause?: unknown }) { super(message, options); this.name = "OAuthFileLockError"; } }
+interface LockSnapshot { bytes: string; dev: number; ino: number; mtimeMs: number; size: number }
+export interface OAuthFileLockOptions { path: string; waitTimeoutMs?: number; staleAfterMs?: number; pollMinMs?: number; pollMaxMs?: number; sleep?: (ms: number) => Promise<void>; now?: () => number; random?: () => number; beforeStaleUnlink?: () => void; beforeReleaseUnlink?: () => void; beforeFailedCreateUnlink?: () => void; writeMetadata?: (fd: number, bytes: string) => void }
+export interface OAuthFileLockGuard { readonly ownerId: string; release(): void }
+function errorCode(error: unknown): string | undefined { return error && typeof error === "object" && "code" in error ? String((error as { code?: unknown }).code) : undefined; }
+function snapshot(path: string): LockSnapshot { const bytes = readFileSync(path, "utf8"); const s = statSync(path); return { bytes, dev:s.dev, ino:s.ino, mtimeMs:s.mtimeMs, size:s.size }; }
+function sameSnapshot(a: LockSnapshot,b: LockSnapshot): boolean { return a.bytes===b.bytes&&a.dev===b.dev&&a.ino===b.ino&&a.mtimeMs===b.mtimeMs&&a.size===b.size; }
+function sameFd(a: LockSnapshot,b: ReturnType<typeof fstatSync>): boolean { return a.dev===b.dev&&a.ino===b.ino&&a.mtimeMs===b.mtimeMs&&a.size===b.size; }
+export function createOAuthFileLock(options: OAuthFileLockOptions): { acquire(): Promise<OAuthFileLockGuard> } {
+ const wait=options.waitTimeoutMs??5000, stale=options.staleAfterMs??120000, min=options.pollMinMs??25,max=options.pollMaxMs??100,sleep=options.sleep??(ms=>Bun.sleep(ms)),now=options.now??Date.now,random=options.random??Math.random,write=options.writeMetadata??((fd,b)=>writeFileSync(fd,b,"utf8"));
+ if(wait<0||stale<=0||min<0||max<min) throw new OAuthFileLockError("Invalid OAuth file-lock timing options");
+ return { async acquire() { hardenConfigDir(); if(!existsSync(getConfigDir())) mkdirSync(getConfigDir(),{recursive:true,mode:0o700}); const ownerId=randomUUID(),started=now(); for(;;){ let fd:number|undefined; try { fd=openSync(options.path,"wx",0o600); const bytes=`${JSON.stringify({version:1,ownerId,pid:process.pid,createdAt:now()})}\n`; write(fd,bytes); const fs=fstatSync(fd); closeSync(fd); fd=undefined; const owned=snapshot(options.path); if(owned.bytes!==bytes||!sameFd(owned,fs)) throw new OAuthFileLockError("OAuth lock changed during creation"); let released=false; return {ownerId,release(){if(released)return;released=true;try{const a=snapshot(options.path);if(!sameSnapshot(owned,a))return;options.beforeReleaseUnlink?.();const b=snapshot(options.path);if(sameSnapshot(owned,b))unlinkSync(options.path);}catch(e){if(errorCode(e)!=="ENOENT")console.warn(`[oauth] lock release failed: ${e instanceof Error?e.message:String(e)}`);}}}; } catch(e) { if(fd!==undefined){let fs;try{fs=fstatSync(fd);}catch{}try{closeSync(fd);}catch{}if(fs)try{const a=snapshot(options.path);if(sameFd(a,fs)){options.beforeFailedCreateUnlink?.();const b=snapshot(options.path);if(sameSnapshot(a,b)&&sameFd(b,fs))unlinkSync(options.path);}}catch{}} if(errorCode(e)!=="EEXIST")throw e instanceof OAuthFileLockError?e:new OAuthFileLockError("Could not create OAuth file lock",{cause:e}); }
+ try{const a=snapshot(options.path);let created=a.mtimeMs;try{const p=JSON.parse(a.bytes);if(typeof p.createdAt==="number")created=Math.max(created,p.createdAt);}catch{}if(now()-created>stale){options.beforeStaleUnlink?.();const b=snapshot(options.path);if(sameSnapshot(a,b))unlinkSync(options.path);continue;}}catch(e){if(errorCode(e)==="ENOENT")continue;throw new OAuthFileLockError("Could not inspect OAuth file lock",{cause:e});} const elapsed=now()-started;if(elapsed>=wait)throw new OAuthFileLockError(`Timed out after ${wait}ms waiting for OAuth file lock`);await sleep(Math.min(wait-elapsed,min+Math.floor(random()*(max-min+1)))); } } };
 }
+export function createOAuthRefreshIntentLock(provider:string,accountId:string,overrides:Partial<OAuthFileLockOptions>={}) { return createOAuthFileLock({path:getAuthRefreshIntentLockPath(provider,accountId),staleAfterMs:120000,...overrides}); }
 
 /**
  * One-time downgrade safety net: the first time we persist the NEW shape over a file that
@@ -65,7 +90,7 @@ function persist(store: AuthStore): void {
  * store, destroying refresh tokens; the backup makes that recoverable.
  */
 function backupLegacyOnce(): void {
-  const path = authPath();
+  const path = getAuthStorePath();
   const backup = `${path}.pre-multiauth`;
   if (!existsSync(path) || existsSync(backup)) return;
   try {
@@ -155,23 +180,15 @@ function normalizeAuthStore(raw: unknown): { store: AuthStore; hadLegacy: boolea
  * a guardian refresh persisting a non-active account cannot roll back a concurrent
  * active-account switch (lost update). Cross-process races are accepted (single proxy).
  */
-let writeQueue: Promise<unknown> = Promise.resolve();
-function enqueueWrite<T>(fn: () => T): T {
-  // Synchronous mutations: chain onto the queue for ordering, but run eagerly since all
-  // current callers are sync. The queue exists so future async mutators serialize too.
-  const result = fn();
-  writeQueue = writeQueue.then(() => result);
-  return result;
-}
-
-function mutateStore<T>(fn: (store: AuthStore) => T): T {
-  return enqueueWrite(() => {
+let mutationTail: Promise<void> = Promise.resolve();
+function serializeMutation<T>(work:()=>Promise<T>):Promise<T>{const result=mutationTail.then(work,work);mutationTail=result.then(()=>undefined,()=>undefined);return result;}
+export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
     const { store, hadLegacy } = loadAuthStoreInternal();
     if (hadLegacy) backupLegacyOnce();
-    const result = fn(store);
+    const result = await fn(store);
     persist(store);
     return result;
-  });
+  }finally{guard.release();}});
 }
 
 /** The ACTIVE account's credential for a provider (what requests should use). */
@@ -187,10 +204,10 @@ export function getCredential(provider: string): OAuthCredentials | null {
  * (rotating refresh tokens would fabricate duplicates) and single-slot providers replace the
  * active slot / whole set instead.
  */
-export function saveCredential(provider: string, cred: OAuthCredentials): void {
+export async function saveCredential(provider: string, cred: OAuthCredentials): Promise<void> {
   const safe = normalizeCredential(cred);
   if (!safe) return;
-  mutateStore(store => {
+  await mutateStore(store => {
     const set = store[provider];
     const identity = safe.accountId ?? safe.email;
     if (!set || SINGLE_SLOT_PROVIDERS.has(provider)) {
@@ -225,8 +242,8 @@ export function saveCredential(provider: string, cred: OAuthCredentials): void {
 }
 
 /** Remove the ACTIVE account; remaining accounts promote the first one. */
-export function removeCredential(provider: string): void {
-  mutateStore(store => {
+export async function removeCredential(provider: string): Promise<void> {
+  await mutateStore(store => {
     const set = store[provider];
     if (!set) return;
     set.accounts = set.accounts.filter(a => a.id !== set.activeAccountId);
@@ -255,10 +272,10 @@ export function getAccountCredential(provider: string, accountId: string): OAuth
 }
 
 /** Persist a refreshed credential for a SPECIFIC account without touching activeAccountId. */
-export function saveAccountCredential(provider: string, accountId: string, cred: OAuthCredentials): void {
+export async function saveAccountCredential(provider: string, accountId: string, cred: OAuthCredentials): Promise<void> {
   const safe = normalizeCredential(cred);
   if (!safe) return;
-  mutateStore(store => {
+  await mutateStore(store => {
     const account = store[provider]?.accounts.find(a => a.id === accountId);
     if (!account) return;
     account.credential = safe;
@@ -266,8 +283,8 @@ export function saveAccountCredential(provider: string, accountId: string, cred:
   });
 }
 
-export function setActiveAccount(provider: string, accountId: string): boolean {
-  return mutateStore(store => {
+export async function setActiveAccount(provider: string, accountId: string): Promise<boolean> {
+  return await mutateStore(store => {
     const set = store[provider];
     if (!set || !set.accounts.some(a => a.id === accountId)) return false;
     set.activeAccountId = accountId;
@@ -276,8 +293,8 @@ export function setActiveAccount(provider: string, accountId: string): boolean {
 }
 
 /** Remove one account by id; active removal promotes the first remaining account. */
-export function removeAccount(provider: string, accountId: string): boolean {
-  return mutateStore(store => {
+export async function removeAccount(provider: string, accountId: string): Promise<boolean> {
+  return await mutateStore(store => {
     const set = store[provider];
     if (!set) return false;
     const before = set.accounts.length;
@@ -292,11 +309,14 @@ export function removeAccount(provider: string, accountId: string): boolean {
   });
 }
 
-export function markAccountNeedsReauth(provider: string, accountId: string, needsReauth: boolean): void {
-  mutateStore(store => {
+export async function markAccountNeedsReauth(provider: string, accountId: string, needsReauth: boolean): Promise<void> {
+  await mutateStore(store => {
     const account = store[provider]?.accounts.find(a => a.id === accountId);
     if (!account) return;
     if (needsReauth) account.needsReauth = true;
     else delete account.needsReauth;
   });
 }
+
+export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};account.credential=safe;delete account.needsReauth;return{superseded:false};});}
+export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string):Promise<boolean>{return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||credentialGeneration(account.credential)!==generation)return false;account.needsReauth=true;return true;});}

package/src/oauth/xai.ts

@@ -12,6 +12,9 @@ const XAI_OAUTH_CALLBACK_PATH = "/callback";
 const XAI_OAUTH_REFRESH_SKEW_MS = 2 * 60 * 1000;
 const TOKEN_REQUEST_TIMEOUT_MS = 30_000;
 
+export const XAI_LOCAL_CLI_DETACH_WARNING =
+  "[oauth:xai] Grok CLI credential was stale; refreshed into OpenCodex ownership. Grok CLI may require login again.";
+
 interface XaiDiscovery {
   authorizationEndpoint: string;
   tokenEndpoint: string;
@@ -22,7 +25,7 @@ interface XaiDiscoveryPayload {
   token_endpoint?: unknown;
 }
 
-interface XaiTokenPayload {
+export interface XaiTokenPayload {
   access_token?: unknown;
   refresh_token?: unknown;
   expires_in?: unknown;
@@ -89,12 +92,18 @@ function getTokenIdentity(accessToken: string, idToken: string | undefined): { a
   return { accountId, email };
 }
 
-async function postXaiToken(
+export class XaiTokenRequestError extends Error { constructor(public readonly status?:number,public readonly oauthError?:string,message="xAI token request failed",options?:{cause?:unknown}){super(message,options);this.name="XaiTokenRequestError";} }
+export interface XaiTokenRetryDeps { sleep?:(ms:number)=>Promise<void>; random?:()=>number }
+function isAbortError(error:unknown):boolean{return error instanceof DOMException&&error.name==="AbortError";}
+function retryDelay(attempt:number,retryAfter:string|null,random:()=>number):number{const base=attempt===1?100:250,j=Math.round(base*(.75+random()*.5)),seconds=retryAfter!==null&&/^\d+$/.test(retryAfter)?Number(retryAfter):0;return Math.min(2000,Math.max(j,seconds*1000));}
+async function readTokenError(response:Response):Promise<XaiTokenRequestError>{let oauthError:string|undefined,detail="";try{const body=await response.json() as {error?:unknown;error_description?:unknown};if(typeof body.error==="string")oauthError=body.error;if(typeof body.error_description==="string")detail=body.error_description;}catch{}const suffix=detail?`: ${detail}`:oauthError?`: ${oauthError}`:"";return new XaiTokenRequestError(response.status,oauthError,`xAI token request failed: ${response.status}${suffix}`);}
+export async function postXaiToken(
   tokenEndpoint: string,
   body: Record<string, string>,
-  signal?: AbortSignal,
+  signal?: AbortSignal, deps:XaiTokenRetryDeps={},
 ): Promise<XaiTokenPayload> {
-  const response = await fetch(tokenEndpoint, {
+ const sleep=deps.sleep??(ms=>Bun.sleep(ms)),random=deps.random??Math.random;let last:unknown;
+ for(let attempt=1;attempt<=3;attempt++){let response:Response;try{response=await fetch(tokenEndpoint, {
     method: "POST",
     headers: {
       Accept: "application/json",
@@ -102,11 +111,7 @@ async function postXaiToken(
     },
     body: new URLSearchParams(body).toString(),
     signal: requestSignal(signal),
-  });
-  if (!response.ok) {
-    throw new Error(`xAI token request failed: ${response.status} ${await response.text()}`);
-  }
-  return (await response.json()) as XaiTokenPayload;
+  });}catch(error){if(isAbortError(error)&&signal?.aborted)throw error;last=error;if(attempt===3)throw new XaiTokenRequestError(undefined,undefined,"xAI token request failed: network error",{cause:error});await sleep(retryDelay(attempt,null,random));continue;}if(response.ok)return await response.json() as XaiTokenPayload;const error=await readTokenError(response);last=error;if(!(response.status===429||response.status>=500)||attempt===3)throw error;await sleep(retryDelay(attempt,response.headers.get("retry-after"),random));}throw last;
 }
 
 function credentialsFromTokenPayload(payload: XaiTokenPayload, refreshFallback = ""): OAuthCredentials {
@@ -200,7 +205,9 @@ export async function loginXai(
       ctrl.onProgress?.("Found Grok CLI token, importing automatically");
       if (local.expires >= Date.now() + 60_000) return local;
       try {
-        return { ...(await refreshXaiToken(local.refresh, ctrl.signal)), source: "local-cli" };
+        const fresh = await refreshXaiToken(local.refresh, ctrl.signal);
+        ctrl.onProgress?.(XAI_LOCAL_CLI_DETACH_WARNING);
+        return { ...fresh, source: "oauth" };
       } catch (error) {
         if (importLocal === "only") {
           throw new Error(

package/src/providers/quota.ts

@@ -17,8 +17,6 @@ export interface ProviderQuotaWindow {
 }
 
 export interface ProviderQuota {
-  fiveHourPercent?: number;
-  fiveHourResetAt?: number;
   weeklyPercent?: number;
   weeklyResetAt?: number;
   monthlyPercent?: number;
@@ -58,8 +56,7 @@ function cacheKey(config: OcxConfig): string {
 
 function hasQuotaRows(quota: ProviderQuota | null | undefined): quota is ProviderQuota {
   if (!quota) return false;
-  return typeof quota.fiveHourPercent === "number"
-    || typeof quota.weeklyPercent === "number"
+  return typeof quota.weeklyPercent === "number"
     || typeof quota.monthlyPercent === "number"
     || !!quota.customWindows?.some(window => typeof window.percent === "number");
 }
@@ -188,11 +185,10 @@ async function fetchAnthropicQuota(provider: string): Promise<ProviderQuotaRepor
   const opus = parseClaudeBucket(body.seven_day_opus);
   const sonnet = parseClaudeBucket(body.seven_day_sonnet);
   const customWindows: ProviderQuotaWindow[] = [];
+  if (fiveHour?.percent !== undefined) customWindows.push({ label: "5h", percent: fiveHour.percent, ...(fiveHour.resetAt !== undefined ? { resetAt: fiveHour.resetAt } : {}) });
   if (opus?.percent !== undefined) customWindows.push({ label: "Opus", percent: opus.percent, ...(opus.resetAt !== undefined ? { resetAt: opus.resetAt } : {}) });
   if (sonnet?.percent !== undefined) customWindows.push({ label: "Sonnet", percent: sonnet.percent, ...(sonnet.resetAt !== undefined ? { resetAt: sonnet.resetAt } : {}) });
   const quota: ProviderQuota = {
-    ...(fiveHour?.percent !== undefined ? { fiveHourPercent: fiveHour.percent } : {}),
-    ...(fiveHour?.resetAt !== undefined ? { fiveHourResetAt: fiveHour.resetAt } : {}),
     ...(sevenDay?.percent !== undefined ? { weeklyPercent: sevenDay.percent } : {}),
     ...(sevenDay?.resetAt !== undefined ? { weeklyResetAt: sevenDay.resetAt } : {}),
     ...(customWindows.length > 0 ? { customWindows } : {}),

package/src/providers/registry.ts

@@ -146,16 +146,33 @@ const DEEPSEEK_THINKING_REASONING_MAP: Record<string, string> = {
   xhigh: "max",
   max: "max",
 };
-// 260710 Kimi model aliases and context windows: Tier-2 evidence in
-// devlog/_plan/260710_provider_hardening/002_research_cn.md.
-const KIMI_API_MODELS = ["kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6", "kimi-k2.5"];
-const KIMI_CODING_MODELS = [...KIMI_API_MODELS, "kimi-for-coding"];
+// 260717 Kimi K3: the subscription endpoint uses one upstream id (`k3`) for both
+// entitlement tiers. Bare `k3` advertises the Moderato 256K ceiling; the local `[1m]`
+// alias advertises Allegretto's 1M ceiling and is stripped before the upstream request.
+// The separately billed Moonshot API uses `kimi-k3`.
+// Evidence: https://www.kimi.com/code/docs/en/kimi-code/models.html
+//           https://www.kimi.com/code/docs/en/kimi-code/error-reference.html
+const KIMI_K3_STANDARD_CONTEXT_WINDOW = 262_144;
+const KIMI_K3_1M_CONTEXT_WINDOW = 1_048_576;
+const KIMI_CODING_K3_MODELS = ["k3", "k3[1m]"];
+const KIMI_LEGACY_API_MODELS = ["kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6", "kimi-k2.5"];
+const KIMI_API_MODELS = ["kimi-k3", ...KIMI_LEGACY_API_MODELS];
+const KIMI_CODING_MODELS = [...KIMI_CODING_K3_MODELS, ...KIMI_LEGACY_API_MODELS, "kimi-for-coding"];
 const KIMI_THINKING_MODELS = KIMI_CODING_MODELS;
+const KIMI_CODING_NO_REASONING_MODELS = KIMI_CODING_MODELS.filter(id => !KIMI_CODING_K3_MODELS.includes(id));
+const KIMI_API_NO_REASONING_MODELS = KIMI_API_MODELS.filter(id => id !== "kimi-k3");
+const KIMI_CODING_REASONING_EFFORTS = Object.fromEntries(
+  KIMI_CODING_MODELS.map(id => [id, KIMI_CODING_K3_MODELS.includes(id) ? ["max"] : []]),
+);
+const KIMI_API_REASONING_EFFORTS = Object.fromEntries(
+  KIMI_API_MODELS.map(id => [id, id === "kimi-k3" ? ["max"] : []]),
+);
 const KIMI_LOCKED_PARAMETER_MODELS = KIMI_CODING_MODELS;
 const KIMI_AUTO_TOOL_CHOICE_ONLY_MODELS = ["kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-for-coding"];
 const KIMI_API_MODEL_CONTEXT_WINDOWS: Record<string, number> = Object.fromEntries(
-  KIMI_API_MODELS.map(id => [id, 262_144]),
+  KIMI_API_MODELS.map(id => [id, id === "kimi-k3" ? KIMI_K3_1M_CONTEXT_WINDOW : 262_144]),
 );
+const KIMI_API_MODEL_INPUT_MODALITIES = { "kimi-k3": ["text", "image"] };
 
 // 260715 NVIDIA NIM kimi family (issue #126): documented served ids on integrate
 // chat/completions per docs.api.nvidia.com/nim/reference/llm-apis; live /v1/models
@@ -168,7 +185,10 @@ const NVIDIA_NIM_KIMI_MODELS = [
   "moonshotai/kimi-k2-instruct", "moonshotai/kimi-k2-instruct-0905",
 ];
 const KIMI_CODING_MODEL_CONTEXT_WINDOWS: Record<string, number> = Object.fromEntries(
-  KIMI_CODING_MODELS.map(id => [id, 262_144]),
+  KIMI_CODING_MODELS.map(id => [id, id === "k3[1m]" ? KIMI_K3_1M_CONTEXT_WINDOW : KIMI_K3_STANDARD_CONTEXT_WINDOW]),
+);
+const KIMI_CODING_MODEL_INPUT_MODALITIES = Object.fromEntries(
+  KIMI_CODING_K3_MODELS.map(id => [id, ["text", "image"]]),
 );
 const NEURALWATT_REASONING_HISTORY_MODELS = [
   "glm-5.2", "glm-5.2-short",
@@ -306,6 +326,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     adapter: "openai-chat",
     baseUrl: "https://api.kimi.com/coding/v1",
     authKind: "oauth",
+    modelSuffixBracketStrip: true,
     featured: true,
     oauthId: "kimi",
     jawcodeBundle: "moonshot",
@@ -313,9 +334,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     models: KIMI_CODING_MODELS,
     defaultModel: "kimi-k2.7-code",
     modelContextWindows: KIMI_CODING_MODEL_CONTEXT_WINDOWS,
-    // Kimi thinking is controlled by Kimi's `thinking` extension, not OpenAI `reasoning_effort`.
-    noReasoningModels: KIMI_THINKING_MODELS,
-    modelReasoningEfforts: Object.fromEntries(KIMI_THINKING_MODELS.map(id => [id, []])),
+    modelInputModalities: KIMI_CODING_MODEL_INPUT_MODALITIES,
+    // K3 accepts reasoning_effort=max; older Kimi models use Kimi's private thinking control.
+    noReasoningModels: KIMI_CODING_NO_REASONING_MODELS,
+    modelReasoningEfforts: KIMI_CODING_REASONING_EFFORTS,
     noTemperatureModels: KIMI_LOCKED_PARAMETER_MODELS,
     noTopPModels: KIMI_LOCKED_PARAMETER_MODELS,
     noPenaltyModels: KIMI_LOCKED_PARAMETER_MODELS,
@@ -502,8 +524,9 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     dashboardUrl: "https://platform.moonshot.ai/console/api-keys", defaultModel: "kimi-k2.7-code", jawcodeBundle: "moonshot",
     models: KIMI_API_MODELS,
     modelContextWindows: KIMI_API_MODEL_CONTEXT_WINDOWS,
-    noReasoningModels: KIMI_API_MODELS,
-    modelReasoningEfforts: Object.fromEntries(KIMI_API_MODELS.map(id => [id, []])),
+    modelInputModalities: KIMI_API_MODEL_INPUT_MODALITIES,
+    noReasoningModels: KIMI_API_NO_REASONING_MODELS,
+    modelReasoningEfforts: KIMI_API_REASONING_EFFORTS,
     noTemperatureModels: KIMI_API_MODELS,
     noTopPModels: KIMI_API_MODELS,
     noPenaltyModels: KIMI_API_MODELS,
@@ -599,10 +622,12 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   {
     id: "kimi-code", label: "Kimi (coding)", baseUrl: "https://api.kimi.com/coding/v1", adapter: "openai-chat", authKind: "key",
     dashboardUrl: "https://platform.moonshot.cn/console/api-keys", defaultModel: "kimi-k2.7-code",
+    modelSuffixBracketStrip: true,
     models: KIMI_CODING_MODELS,
     modelContextWindows: KIMI_CODING_MODEL_CONTEXT_WINDOWS,
-    noReasoningModels: KIMI_THINKING_MODELS,
-    modelReasoningEfforts: Object.fromEntries(KIMI_THINKING_MODELS.map(id => [id, []])),
+    modelInputModalities: KIMI_CODING_MODEL_INPUT_MODALITIES,
+    noReasoningModels: KIMI_CODING_NO_REASONING_MODELS,
+    modelReasoningEfforts: KIMI_CODING_REASONING_EFFORTS,
     noTemperatureModels: KIMI_LOCKED_PARAMETER_MODELS,
     noTopPModels: KIMI_LOCKED_PARAMETER_MODELS,
     noPenaltyModels: KIMI_LOCKED_PARAMETER_MODELS,

package/src/providers/xai-transport.ts

@@ -1,48 +1,79 @@
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import type { OcxProviderConfig } from "../types";
 
-/**
- * xAI account OAuth and xAI API keys share a bearer shape but not a billing
- * transport. OAuth represents the Grok CLI subscription entitlement, while a
- * key represents the API team. Keep the saved provider preset compatible with
- * the dashboard's "Use an API key instead" switch and resolve the transport at
- * request time.
- */
 export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 
-/** Minimum-compatible official Grok CLI wire version verified with the proxy. */
-export const XAI_GROK_CLIENT_VERSION = "0.2.93";
+export const XAI_GROK_COMPATIBILITY = {
+  version: "0.2.93",
+  userAgent: "opencodex-grok/0.2.93",
+  headers: {
+    clientIdentifier: "x-grok-client-identifier",
+    clientVersion: "x-grok-client-version",
+    tokenAuth: "x-xai-token-auth",
+    authenticateResponse: "x-authenticateresponse",
+    conversationId: "x-grok-conv-id",
+    requestId: "x-grok-req-id",
+    sessionId: "x-grok-session-id",
+    userAgent: "User-Agent",
+  },
+} as const;
 
-const XAI_GROK_CLI_HEADERS: Readonly<Record<string, string>> = {
-  "x-grok-client-identifier": "opencodex",
-  "x-grok-client-version": XAI_GROK_CLIENT_VERSION,
-  "x-xai-token-auth": "xai-grok-cli",
+export const XAI_GROK_CLIENT_VERSION = XAI_GROK_COMPATIBILITY.version;
+export const XAI_CONV_ID_HEADER = XAI_GROK_COMPATIBILITY.headers.conversationId;
+
+export type OcxProviderTransport = OcxProviderConfig & {
+  /** Request executor used only at runtime; never persisted. */
+  fetch?: typeof globalThis.fetch;
 };
 
-/**
- * Sticky-routing hint for xAI's automatic prefix cache. xAI routes requests
- * carrying the same `x-grok-conv-id` to the same server, which is where the
- * prompt cache lives (docs.x.ai prompt-caching best-practices; verified
- * 2026-07-13, devlog/_plan/260713_grok_caching). Codex clients send a stable
- * per-conversation `prompt_cache_key`; hash it so the raw session id never
- * leaves the proxy.
- */
-export const XAI_CONV_ID_HEADER = "x-grok-conv-id";
+const XAI_GROK_CLI_HEADERS: Readonly<Record<string, string>> = {
+  [XAI_GROK_COMPATIBILITY.headers.clientIdentifier]: "opencodex",
+  [XAI_GROK_COMPATIBILITY.headers.clientVersion]: XAI_GROK_CLIENT_VERSION,
+  [XAI_GROK_COMPATIBILITY.headers.tokenAuth]: "xai-grok-cli",
+  [XAI_GROK_COMPATIBILITY.headers.authenticateResponse]: "authenticate-response",
+};
 
-function hasHeaderCaseInsensitive(headers: Record<string, string> | undefined, name: string): boolean {
-  if (!headers) return false;
+function hasHeaderCaseInsensitive(
+  headers: Record<string, string> | undefined,
+  name: string,
+): boolean {
   const target = name.toLowerCase();
-  return Object.keys(headers).some(key => key.toLowerCase() === target);
+  return Object.keys(headers ?? {}).some(key => key.toLowerCase() === target);
+}
+
+function withoutUserOverridden(
+  defaults: Readonly<Record<string, string>>,
+  userHeaders: Record<string, string> | undefined,
+): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(defaults).filter(([name]) => !hasHeaderCaseInsensitive(userHeaders, name)),
+  );
 }
 
-/** Drop default entries the user already overrides under any header-name casing. */
-function withoutUserOverridden(defaults: Readonly<Record<string, string>>, userHeaders: Record<string, string> | undefined): Record<string, string> {
-  if (!userHeaders) return { ...defaults };
-  const out: Record<string, string> = {};
-  for (const [key, value] of Object.entries(defaults)) {
-    if (!hasHeaderCaseInsensitive(userHeaders, key)) out[key] = value;
+function withGeneratedRequestId(
+  init: RequestInit | undefined,
+  configuredRequestId: string | undefined,
+  stableHeaders: Readonly<Record<string, string>>,
+): RequestInit {
+  const headers = new Headers(init?.headers);
+  for (const [name, value] of Object.entries(stableHeaders)) {
+    if (!headers.has(name)) headers.set(name, value);
   }
-  return out;
+  if (!headers.has(XAI_GROK_COMPATIBILITY.headers.requestId)) {
+    headers.set(
+      XAI_GROK_COMPATIBILITY.headers.requestId,
+      configuredRequestId ?? randomUUID(),
+    );
+  }
+  return { ...init, headers };
+}
+
+function findHeaderCaseInsensitive(
+  headers: Record<string, string> | undefined,
+  name: string,
+): string | undefined {
+  const target = name.toLowerCase();
+  return Object.entries(headers ?? {}).find(([key]) => key.toLowerCase() === target)?.[1];
 }
 
 export function deriveXaiConvId(promptCacheKey: string): string {
@@ -50,40 +81,56 @@ export function deriveXaiConvId(promptCacheKey: string): string {
 }
 
 /**
- * Resolve the effective xAI transport without mutating persisted config.
- * User-provided headers are preserved and may advance the compatibility
- * version without waiting for an opencodex release.
- *
- * `promptCacheKey` (the client's stable conversation key) additionally pins
- * cache-affinity routing via `x-grok-conv-id` in BOTH auth modes. Blank or
- * whitespace-only keys are ignored so unrelated requests can never collapse
- * onto one shared conv id, and any user-configured header (any case) wins.
+ * Resolve xAI's runtime transport without mutating persisted config. Conversation/session
+ * affinity is stable for this resolved transport; request identity is generated per fetch.
+ * Agent, deployment, model-override, turn, mode, and user identity headers are intentionally
+ * omitted because opencodex has no truthful values for the official fields.
  */
 export function resolveProviderTransport(
   providerName: string,
-  provider: OcxProviderConfig,
+  provider: OcxProviderTransport,
   promptCacheKey?: string,
-): OcxProviderConfig {
+): OcxProviderTransport {
   if (providerName !== "xai") return provider;
+
   const cacheKey = promptCacheKey?.trim();
-  const convIdHeaders: Record<string, string> =
-    cacheKey && !hasHeaderCaseInsensitive(provider.headers, XAI_CONV_ID_HEADER)
-      ? { [XAI_CONV_ID_HEADER]: deriveXaiConvId(cacheKey) }
-      : {};
-  if (provider.authMode !== "oauth") {
-    if (Object.keys(convIdHeaders).length === 0) return provider;
-    return {
-      ...provider,
-      headers: { ...convIdHeaders, ...(provider.headers ?? {}) },
-    };
-  }
+  const affinity = cacheKey ? deriveXaiConvId(cacheKey) : undefined;
+  const stableDefaults: Record<string, string> = {
+    [XAI_GROK_COMPATIBILITY.headers.userAgent]: XAI_GROK_COMPATIBILITY.userAgent,
+    ...(affinity
+      ? {
+          [XAI_GROK_COMPATIBILITY.headers.conversationId]: affinity,
+          [XAI_GROK_COMPATIBILITY.headers.sessionId]: affinity,
+        }
+      : {}),
+    ...(provider.authMode === "oauth" ? XAI_GROK_CLI_HEADERS : {}),
+  };
+  const stableHeaders = {
+    ...withoutUserOverridden(stableDefaults, provider.headers),
+    ...(provider.headers ?? {}),
+  };
+  // Keep API-key provider metadata compatible with key-pool rotation; session/UA defaults
+  // remain transport-scoped and are applied by the wrapper immediately below.
+  const headers = provider.authMode === "oauth"
+    ? stableHeaders
+    : {
+        ...(affinity && !hasHeaderCaseInsensitive(provider.headers, XAI_GROK_COMPATIBILITY.headers.conversationId)
+          ? { [XAI_GROK_COMPATIBILITY.headers.conversationId]: affinity }
+          : {}),
+        ...(provider.headers ?? {}),
+      };
+  const configuredRequestId = findHeaderCaseInsensitive(
+    provider.headers,
+    XAI_GROK_COMPATIBILITY.headers.requestId,
+  );
+  const baseFetch = provider.fetch ?? globalThis.fetch;
+  const attemptFetch = ((input, init) =>
+    baseFetch(input, withGeneratedRequestId(init, configuredRequestId, stableHeaders))) as typeof globalThis.fetch;
+
   return {
     ...provider,
-    baseUrl: XAI_GROK_CLI_BASE_URL,
-    headers: {
-      ...withoutUserOverridden(XAI_GROK_CLI_HEADERS, provider.headers),
-      ...convIdHeaders,
-      ...(provider.headers ?? {}),
-    },
+    ...(provider.authMode === "oauth" ? { baseUrl: XAI_GROK_CLI_BASE_URL } : {}),
+    headers,
+    fetch: attemptFetch,
   };
 }