@dreb/ai 2.43.0 → 2.43.2

package/dist/utils/oauth/kimi-coding.js

@@ -1,55 +1,69 @@
 /**
  * Kimi For Coding OAuth flow (device code)
  *
- * Authenticates against Moonshot's Kimi API (auth.kimi.com) with scope "kimi-code".
+ * Authenticates against Moonshot's Kimi API (auth.kimi.com) using the current Kimi Code device identity.
  * Uses the device authorization grant flow to obtain access/refresh tokens,
  * then discovers the user's model entitlement via the /models endpoint.
  */
 import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 // ============================================================================
 // Constants
 // ============================================================================
-const KIMI_CLI_VERSION = "1.35.0";
-const USER_AGENT = `KimiCLI/${KIMI_CLI_VERSION}`;
+function readDrebVersion() {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(new URL("../../../package.json", import.meta.url), "utf-8"));
+        if (typeof pkg.version === "string" && pkg.version.length > 0)
+            return pkg.version;
+    }
+    catch {
+        // Fall back for unusual bundlers that omit package.json.
+    }
+    return "unknown";
+}
+const DREB_VERSION = readDrebVersion();
+const USER_AGENT = `dreb/${DREB_VERSION}`;
 const OAUTH_HOST = "https://auth.kimi.com";
 const OAUTH_DEVICE_AUTH_URL = `${OAUTH_HOST}/api/oauth/device_authorization`;
 const OAUTH_TOKEN_URL = `${OAUTH_HOST}/api/oauth/token`;
 const OAUTH_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
-const OAUTH_SCOPE = "kimi-code";
 const OAUTH_DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 const OAUTH_REFRESH_GRANT = "refresh_token";
 const API_BASE_URL = "https://api.kimi.com/coding/v1";
-const DEVICE_ID_PATH = path.join(os.homedir(), ".kimi", "device_id");
+const KIMI_CODE_HOME = path.join(os.homedir(), ".kimi-code");
+const DEVICE_ID_PATH = path.join(KIMI_CODE_HOME, "device_id");
 const MAX_REFRESH_RETRIES = 3;
+const MAX_DEVICE_FLOW_MS = 15 * 60 * 1000;
 // ============================================================================
 // Device ID
 // ============================================================================
-function generateDeviceId() {
-    // UUID v4 without dashes (hex only, 32 chars)
-    return "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx".replace(/x/g, () => Math.floor(Math.random() * 16).toString(16));
-}
+let sessionDeviceId;
 function getDeviceId() {
+    if (sessionDeviceId)
+        return sessionDeviceId;
     try {
         if (fs.existsSync(DEVICE_ID_PATH)) {
             const id = fs.readFileSync(DEVICE_ID_PATH, "utf-8").trim();
-            if (/^[0-9a-f]{32}$/i.test(id)) {
+            if (id.length > 0) {
+                sessionDeviceId = id;
                 return id;
             }
         }
     }
     catch {
-        // Fall through to generate
+        // Fall through to generate.
     }
-    const id = generateDeviceId();
+    const id = randomUUID();
+    sessionDeviceId = id;
     try {
-        fs.mkdirSync(path.dirname(DEVICE_ID_PATH), { recursive: true });
-        fs.writeFileSync(DEVICE_ID_PATH, id, "utf-8");
+        fs.mkdirSync(KIMI_CODE_HOME, { recursive: true, mode: 0o700 });
+        fs.writeFileSync(DEVICE_ID_PATH, id, { encoding: "utf-8", mode: 0o600 });
     }
     catch {
-        // If we can't persist, just use the generated ID for this session
+        // If we can't persist, just use the generated ID for this session.
     }
     return id;
 }
@@ -59,19 +73,36 @@ function getDeviceId() {
 /**
  * Strip non-ASCII characters from a string for use in HTTP header values.
  */
-function asciiHeaderValue(value) {
-    return value.replace(/[^\x20-\x7E]/g, "");
+function asciiHeaderValue(value, fallback = "unknown") {
+    const cleaned = value.replace(/[^\x20-\x7E]/g, "").trim();
+    return cleaned.length > 0 ? cleaned : fallback;
+}
+function customKimiHeaders() {
+    const raw = process.env.KIMI_CODE_CUSTOM_HEADERS?.trim();
+    if (!raw)
+        return {};
+    const headers = {};
+    for (const line of raw.split("\n")) {
+        const colon = line.indexOf(":");
+        if (colon < 0)
+            continue;
+        const name = line.slice(0, colon).trim();
+        if (!name)
+            continue;
+        headers[name] = line.slice(colon + 1).trim();
+    }
+    return headers;
 }
 /**
  * Determine the device model string, mirroring kimi-cli logic.
  */
 function kimiDeviceModel() {
     const platform = os.platform();
-    const machine = os.machine?.() || process.arch;
+    const machine = os.arch();
     if (platform === "darwin") {
         let version;
         try {
-            version = execFileSync("sw_vers", ["-productVersion"], { encoding: "utf-8", timeout: 3000 }).trim();
+            version = execFileSync("/usr/bin/sw_vers", ["-productVersion"], { encoding: "utf-8", timeout: 3000 }).trim();
         }
         catch {
             version = os.release();
@@ -79,31 +110,111 @@ function kimiDeviceModel() {
         return `macOS ${version} ${machine}`;
     }
     if (platform === "win32") {
-        const release = os.release();
-        const buildNumber = Number.parseInt(release.split(".").pop() || "0", 10);
-        const label = buildNumber >= 22000 ? "11" : "10";
-        return `Windows ${label} ${machine}`;
+        return `Windows ${os.release()} ${machine}`;
     }
     // Linux and other
-    return `${os.type()} ${os.release()} ${machine}`;
+    return `${os.type()} ${os.release()} ${machine}`.trim();
 }
 /**
  * Build the standard set of headers required on every Kimi API request.
  */
 export function buildKimiHeaders() {
     return {
+        ...customKimiHeaders(),
         "User-Agent": USER_AGENT,
-        "X-Msh-Platform": "kimi_cli",
-        "X-Msh-Version": KIMI_CLI_VERSION,
+        "X-Msh-Platform": "kimi_code_cli",
+        "X-Msh-Version": DREB_VERSION,
         "X-Msh-Device-Name": asciiHeaderValue(os.hostname()),
         "X-Msh-Device-Model": asciiHeaderValue(kimiDeviceModel()),
         "X-Msh-Device-Id": getDeviceId(),
-        "X-Msh-Os-Version": asciiHeaderValue(os.version?.() || `${os.type()} ${os.release()}`),
+        "X-Msh-Os-Version": asciiHeaderValue(os.release()),
     };
 }
+function parseTokenSuccess(response) {
+    if (typeof response.access_token !== "string" ||
+        response.access_token.length === 0 ||
+        typeof response.refresh_token !== "string" ||
+        response.refresh_token.length === 0 ||
+        typeof response.expires_in !== "number" ||
+        !Number.isFinite(response.expires_in) ||
+        response.expires_in <= 0) {
+        throw new Error("Invalid token response fields");
+    }
+    return response;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseStringArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const out = value.filter((v) => typeof v === "string" && v.length > 0);
+    return out.length > 0 ? out : undefined;
+}
+function parseSupportsThinkingType(value) {
+    return value === "only" || value === "no" || value === "both" ? value : undefined;
+}
+function parseModelProtocol(value) {
+    return value === "anthropic" ? "anthropic" : undefined;
+}
+function parseThinkEfforts(value) {
+    if (!isRecord(value) || value.support !== true)
+        return undefined;
+    return {
+        support: true,
+        valid_efforts: parseStringArray(value.valid_efforts),
+        default_effort: typeof value.default_effort === "string" && value.default_effort.length > 0 ? value.default_effort : undefined,
+    };
+}
+function toKimiModelInfo(item) {
+    if (!isRecord(item) || typeof item.id !== "string" || item.id.length === 0) {
+        return undefined;
+    }
+    const contextLength = Number(item.context_length);
+    if (!Number.isInteger(contextLength) || contextLength <= 0) {
+        throw new Error(`Kimi Code model "${item.id}" must include a positive context_length.`);
+    }
+    const displayName = item.display_name;
+    const normalizedDisplayName = typeof displayName === "string" && displayName.length > 0 ? displayName : undefined;
+    const optionalBoolean = (value) => (typeof value === "boolean" ? value : undefined);
+    const parsed = {
+        id: item.id,
+        context_length: contextLength,
+        display_name: normalizedDisplayName,
+    };
+    const supportsReasoning = optionalBoolean(item.supports_reasoning);
+    if (supportsReasoning !== undefined)
+        parsed.supports_reasoning = supportsReasoning;
+    const supportsImageIn = optionalBoolean(item.supports_image_in);
+    if (supportsImageIn !== undefined)
+        parsed.supports_image_in = supportsImageIn;
+    const supportsVideoIn = optionalBoolean(item.supports_video_in);
+    if (supportsVideoIn !== undefined)
+        parsed.supports_video_in = supportsVideoIn;
+    if (Object.hasOwn(item, "supports_tool_use")) {
+        const supportsToolUse = optionalBoolean(item.supports_tool_use);
+        if (supportsToolUse !== undefined)
+            parsed.supports_tool_use = supportsToolUse;
+    }
+    const supportsThinkingType = parseSupportsThinkingType(item.supports_thinking_type);
+    if (supportsThinkingType !== undefined)
+        parsed.supports_thinking_type = supportsThinkingType;
+    const protocol = parseModelProtocol(item.protocol);
+    if (protocol !== undefined)
+        parsed.protocol = protocol;
+    const thinkEfforts = parseThinkEfforts(item.think_efforts);
+    if (thinkEfforts !== undefined)
+        parsed.think_efforts = thinkEfforts;
+    return parsed;
+}
 // ============================================================================
 // Network helpers
 // ============================================================================
+const REQUEST_TIMEOUT_MS = 30_000;
+function requestSignal(signal) {
+    const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
 async function fetchJson(url, init) {
     const response = await fetch(url, init);
     if (!response.ok) {
@@ -135,11 +246,12 @@ function abortableSleep(ms, signal) {
  * List available models from the Kimi API.
  * Returns the model info array from the response's `data` field.
  */
-export async function listModels(accessToken) {
+export async function listModels(accessToken, signal) {
     const raw = await fetchJson(`${API_BASE_URL}/models`, {
+        signal: requestSignal(signal),
         headers: {
-            Authorization: `Bearer ${accessToken}`,
             ...buildKimiHeaders(),
+            Authorization: `Bearer ${accessToken}`,
         },
     });
     if (!raw || typeof raw !== "object") {
@@ -149,22 +261,20 @@ export async function listModels(accessToken) {
     if (!Array.isArray(data)) {
         throw new Error("Invalid models response: expected data array");
     }
-    return data;
+    return data.map((item) => toKimiModelInfo(item)).filter((item) => item !== undefined);
 }
 // ============================================================================
 // Device flow
 // ============================================================================
-async function startDeviceFlow() {
+async function startDeviceFlow(signal) {
     const data = await fetchJson(OAUTH_DEVICE_AUTH_URL, {
         method: "POST",
+        signal: requestSignal(signal),
         headers: {
-            "Content-Type": "application/x-www-form-urlencoded",
             ...buildKimiHeaders(),
+            "Content-Type": "application/x-www-form-urlencoded",
         },
-        body: new URLSearchParams({
-            client_id: OAUTH_CLIENT_ID,
-            scope: OAUTH_SCOPE,
-        }),
+        body: new URLSearchParams({ client_id: OAUTH_CLIENT_ID }),
     });
     if (!data || typeof data !== "object") {
         throw new Error("Invalid device code response");
@@ -172,20 +282,30 @@ async function startDeviceFlow() {
     const d = data;
     const device_code = d.device_code;
     const user_code = d.user_code;
-    const verification_uri = d.verification_uri;
+    const verification_uri_complete = typeof d.verification_uri_complete === "string" && d.verification_uri_complete.length > 0
+        ? d.verification_uri_complete
+        : typeof d.verification_uri === "string" && d.verification_uri.length > 0
+            ? `${d.verification_uri}${d.verification_uri.includes("?") ? "&" : "?"}user_code=${encodeURIComponent(user_code)}`
+            : undefined;
     const interval = d.interval;
     const expires_in = d.expires_in;
     if (typeof device_code !== "string" ||
         typeof user_code !== "string" ||
-        typeof verification_uri !== "string" ||
+        typeof verification_uri_complete !== "string" ||
         typeof interval !== "number" ||
         typeof expires_in !== "number") {
         throw new Error("Invalid device code response fields");
     }
-    return { device_code, user_code, verification_uri, interval, expires_in };
+    return { device_code, user_code, verification_uri_complete, interval, expires_in };
 }
-async function pollForAccessToken(deviceCode, intervalSeconds, expiresIn, signal) {
-    const deadline = Date.now() + expiresIn * 1000;
+class DeviceCodeExpiredError extends Error {
+    constructor() {
+        super("Device code expired");
+        this.name = "DeviceCodeExpiredError";
+    }
+}
+async function pollForAccessToken(deviceCode, intervalSeconds, expiresIn, signal, overallDeadline = Date.now() + MAX_DEVICE_FLOW_MS) {
+    const deadline = Math.min(Date.now() + expiresIn * 1000, overallDeadline);
     let intervalMs = Math.max(1000, Math.floor(intervalSeconds * 1000));
     while (Date.now() < deadline) {
         if (signal?.aborted) {
@@ -196,9 +316,10 @@ async function pollForAccessToken(deviceCode, intervalSeconds, expiresIn, signal
         await abortableSleep(waitMs, signal);
         const tokenResponse = await fetch(OAUTH_TOKEN_URL, {
             method: "POST",
+            signal: requestSignal(signal),
             headers: {
-                "Content-Type": "application/x-www-form-urlencoded",
                 ...buildKimiHeaders(),
+                "Content-Type": "application/x-www-form-urlencoded",
             },
             body: new URLSearchParams({
                 client_id: OAUTH_CLIENT_ID,
@@ -211,7 +332,7 @@ async function pollForAccessToken(deviceCode, intervalSeconds, expiresIn, signal
         const resp = (await tokenResponse.json());
         // Success: has access_token
         if (typeof resp.access_token === "string") {
-            return resp;
+            return parseTokenSuccess(resp);
         }
         // Error response (RFC 8628 §3.5)
         if (typeof resp.error === "string") {
@@ -229,7 +350,7 @@ async function pollForAccessToken(deviceCode, intervalSeconds, expiresIn, signal
                 continue;
             }
             if (error === "expired_token") {
-                throw new Error("Device code expired. Please try logging in again.");
+                throw new DeviceCodeExpiredError();
             }
             const descriptionSuffix = description ? `: ${description}` : "";
             throw new Error(`Device flow failed: ${error}${descriptionSuffix}`);
@@ -255,7 +376,7 @@ class RetriableError extends Error {
  * recognizable substrings in the message.
  */
 function isNetworkError(error) {
-    if (error instanceof TypeError)
+    if (error instanceof TypeError || error.name === "TimeoutError")
         return true;
     const msg = error.message.toLowerCase();
     return ["fetch failed", "econnrefused", "etimedout", "enotfound", "econnreset", "socket hang up"].some((s) => msg.includes(s));
@@ -269,9 +390,10 @@ async function refreshWithRetry(refreshToken, signal) {
         try {
             const response = await fetch(OAUTH_TOKEN_URL, {
                 method: "POST",
+                signal: requestSignal(signal),
                 headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
                     ...buildKimiHeaders(),
+                    "Content-Type": "application/x-www-form-urlencoded",
                 },
                 body: new URLSearchParams({
                     client_id: OAUTH_CLIENT_ID,
@@ -288,12 +410,13 @@ async function refreshWithRetry(refreshToken, signal) {
                 throw new Error(`Token refresh failed: ${response.status} ${response.statusText}: ${text}`);
             }
             const raw = await response.json();
-            if (!raw || typeof raw !== "object" || typeof raw.access_token !== "string") {
+            if (!raw || typeof raw !== "object")
                 throw new Error("Invalid token refresh response");
-            }
-            return raw;
+            return parseTokenSuccess(raw);
         }
         catch (error) {
+            if (signal?.aborted)
+                throw new Error("Refresh cancelled");
             lastError = error instanceof Error ? error : new Error(String(error));
             // Wrap network errors (TypeError from fetch, or common network failure indicators) as retriable
             if (!(lastError instanceof RetriableError) && isNetworkError(lastError)) {
@@ -314,22 +437,34 @@ async function refreshWithRetry(refreshToken, signal) {
 // Login flow
 // ============================================================================
 export async function loginKimiCoding(options) {
-    const device = await startDeviceFlow();
-    // Kimi's device page expects user_code as a query parameter
-    const authUrl = new URL(device.verification_uri);
-    authUrl.searchParams.set("user_code", device.user_code);
-    options.onAuth({
-        url: authUrl.toString(),
-        instructions: `Enter code: ${device.user_code}`,
-    });
-    const tokenResp = await pollForAccessToken(device.device_code, device.interval, device.expires_in, options.signal);
-    // Discover model entitlement
+    const overallDeadline = Date.now() + MAX_DEVICE_FLOW_MS;
+    let tokenResp;
+    while (true) {
+        const device = await startDeviceFlow(options.signal);
+        options.onAuth({
+            url: device.verification_uri_complete,
+            instructions: `Enter code: ${device.user_code}`,
+        });
+        try {
+            tokenResp = await pollForAccessToken(device.device_code, device.interval, device.expires_in, options.signal, overallDeadline);
+            break;
+        }
+        catch (error) {
+            if (error instanceof DeviceCodeExpiredError && Date.now() < overallDeadline)
+                continue;
+            throw error;
+        }
+    }
+    // Discover model entitlement. Undefined means discovery failed; an empty
+    // array is a successful, authoritative response.
     options.onProgress?.("Discovering available models...");
-    let models = [];
+    let models;
     try {
-        models = await listModels(tokenResp.access_token);
+        models = await listModels(tokenResp.access_token, options.signal);
     }
     catch {
+        if (options.signal?.aborted)
+            throw new Error("Login cancelled");
         // Proceed without model enrichment if the models endpoint fails
     }
     const credentials = {
@@ -337,11 +472,14 @@ export async function loginKimiCoding(options) {
         access: tokenResp.access_token,
         expires: Date.now() + tokenResp.expires_in * 1000,
     };
-    if (models.length > 0) {
+    if (models) {
+        credentials.models = models;
         const primary = models[0];
-        credentials.modelId = primary.id;
-        credentials.contextLength = primary.context_length;
-        credentials.modelDisplay = primary.display_name;
+        if (primary) {
+            credentials.modelId = primary.id;
+            credentials.contextLength = primary.context_length;
+            credentials.modelDisplay = primary.display_name;
+        }
     }
     return credentials;
 }
@@ -350,27 +488,33 @@ export async function loginKimiCoding(options) {
 // ============================================================================
 export async function refreshKimiCodingToken(credentials, signal) {
     const tokenResp = await refreshWithRetry(credentials.refresh, signal);
-    // Re-discover model entitlement
-    let models = [];
+    // Re-discover model entitlement. Undefined means discovery failed; an empty
+    // array is a successful, authoritative response.
+    let models;
     try {
-        models = await listModels(tokenResp.access_token);
+        models = await listModels(tokenResp.access_token, signal);
     }
     catch {
+        if (signal?.aborted)
+            throw new Error("Refresh cancelled");
         // Proceed without model enrichment if the models endpoint fails
     }
+    const oldCreds = credentials;
     const fresh = {
         refresh: tokenResp.refresh_token ?? credentials.refresh,
         access: tokenResp.access_token,
         expires: Date.now() + tokenResp.expires_in * 1000,
-        modelId: credentials.modelId,
-        contextLength: credentials.contextLength,
-        modelDisplay: credentials.modelDisplay,
+        models: oldCreds.models,
+        modelId: oldCreds.modelId,
+        contextLength: oldCreds.contextLength,
+        modelDisplay: oldCreds.modelDisplay,
     };
-    if (models.length > 0) {
+    if (models) {
+        fresh.models = models;
         const primary = models[0];
-        fresh.modelId = primary.id;
-        fresh.contextLength = primary.context_length;
-        fresh.modelDisplay = primary.display_name;
+        fresh.modelId = primary?.id;
+        fresh.contextLength = primary?.context_length;
+        fresh.modelDisplay = primary?.display_name;
     }
     return fresh;
 }
@@ -396,24 +540,138 @@ export const kimiCodingOAuthProvider = {
     modifyModels(models, credentials) {
         const creds = credentials;
         const headers = buildKimiHeaders();
-        return models.map((m) => {
-            if (m.provider !== "kimi-coding-oauth")
-                return m;
+        const staticModels = models.filter((m) => m.provider === "kimi-coding-oauth");
+        if (staticModels.length === 0) {
+            return models;
+        }
+        const injectHeaders = (m) => ({
+            ...m,
+            headers: { ...(m.headers || {}), ...headers },
+        });
+        const staticById = new Map(staticModels.map((m) => [m.id, m]));
+        const fallbackTemplate = staticById.get("kimi-for-coding") ?? staticModels[0];
+        // No discovery (or failed discovery): keep the static fallback list intact.
+        // Legacy credentials describe one discovered model, so enrich or append only
+        // that model rather than collapsing every static entry to the same ID.
+        const discovered = creds.models;
+        if (!discovered) {
+            const fallbackModels = models.map((m) => {
+                if (m.provider !== "kimi-coding-oauth")
+                    return m;
+                const updated = {
+                    ...m,
+                    // The OAuth coding endpoint accepts OpenAI-style image_url data URLs;
+                    // keep this capability even if static metadata is stale.
+                    input: Array.from(new Set([...m.input, "image"])),
+                };
+                if (creds.modelId === m.id && creds.contextLength) {
+                    updated.contextWindow = creds.contextLength;
+                }
+                if (creds.modelId === m.id && creds.modelDisplay) {
+                    updated.name = creds.modelDisplay;
+                }
+                return injectHeaders(updated);
+            });
+            if (creds.modelId && !staticById.has(creds.modelId)) {
+                fallbackModels.push(injectHeaders({
+                    ...fallbackTemplate,
+                    id: creds.modelId,
+                    name: creds.modelDisplay || creds.modelId,
+                    contextWindow: creds.contextLength || fallbackTemplate.contextWindow,
+                }));
+            }
+            return fallbackModels;
+        }
+        const discoveredInput = (base, info) => {
+            if (info.supports_image_in === true)
+                return Array.from(new Set([...base.input, "image"]));
+            if (info.supports_image_in === false)
+                return base.input.filter((input) => input !== "image");
+            return base.input;
+        };
+        const discoveredCompat = (base, info) => {
+            const valid = info.think_efforts?.support ? info.think_efforts.valid_efforts : undefined;
+            if (!valid || valid.length === 0)
+                return base.compat;
+            const efforts = new Set(valid);
+            const declaredDefault = info.think_efforts?.default_effort;
+            const validDefault = declaredDefault && efforts.has(declaredDefault) ? declaredDefault : undefined;
+            const choose = (...preferences) => preferences.find((effort) => efforts.has(effort)) ?? validDefault ?? valid[0];
+            return {
+                ...base.compat,
+                reasoningEffortMap: {
+                    minimal: choose("minimal", "low", "medium", "high", "max"),
+                    low: choose("low", "minimal", "medium", "high", "max"),
+                    medium: choose("medium", "high", "low", "max"),
+                    high: choose("high", "medium", "max", "low"),
+                    xhigh: choose("max", "xhigh", "high", "medium", "low"),
+                },
+            };
+        };
+        // Apply discovered metadata to a static model, preserving its static shape.
+        const applyDiscovery = (staticModel, info) => {
             const updated = {
-                ...m,
-                // The OAuth coding endpoint accepts OpenAI-style image_url data URLs for
-                // kimi-for-coding; keep this capability even if static metadata is stale.
-                input: Array.from(new Set([...m.input, "image"])),
-                headers: { ...headers, ...(m.headers || {}) },
+                ...staticModel,
+                id: info.id,
+                name: info.display_name || info.id,
+                contextWindow: info.context_length || staticModel.contextWindow,
+                input: discoveredInput(staticModel, info),
+                compat: discoveredCompat(staticModel, info),
             };
-            if (creds.modelId) {
-                updated.id = creds.modelId;
+            if (info.supports_thinking_type === "only" || info.supports_thinking_type === "both") {
+                updated.reasoning = true;
             }
-            if (creds.contextLength) {
-                updated.contextWindow = creds.contextLength;
+            else if (info.supports_thinking_type === "no") {
+                updated.reasoning = false;
             }
-            return updated;
-        });
+            else if (typeof info.supports_reasoning === "boolean") {
+                updated.reasoning = info.supports_reasoning;
+            }
+            return injectHeaders(updated);
+        };
+        // Safely template a future/discovered model ID using the static fallback.
+        const templateDiscovery = (info) => {
+            const templated = {
+                ...fallbackTemplate,
+                id: info.id,
+                name: info.display_name || info.id,
+                contextWindow: info.context_length || fallbackTemplate.contextWindow,
+                reasoning: info.supports_thinking_type === undefined
+                    ? (info.supports_reasoning ?? false)
+                    : info.supports_thinking_type !== "no",
+                input: info.supports_image_in === true ? ["text", "image"] : ["text"],
+                compat: discoveredCompat(fallbackTemplate, info),
+            };
+            return injectHeaders(templated);
+        };
+        // The official client treats only the explicit "anthropic" protocol as a
+        // separate wire format; absent and future values use the default Kimi route.
+        const supportedDiscovered = discovered.filter((info) => info.supports_tool_use !== false && info.protocol !== "anthropic");
+        const result = [];
+        const seen = new Set();
+        // 1. Walk the original model list to preserve order, replacing discovered
+        //    static models and dropping undiscovered entries. A successful response
+        //    is authoritative for the subscription's current entitlements.
+        for (const m of models) {
+            if (m.provider !== "kimi-coding-oauth") {
+                result.push(m);
+                continue;
+            }
+            const info = staticById.has(m.id) ? supportedDiscovered.find((d) => d.id === m.id) : undefined;
+            if (info) {
+                result.push(applyDiscovery(m, info));
+                seen.add(info.id);
+            }
+        }
+        // 2. Discovered models with IDs not present in the static list are templated
+        //    from the fallback so future model IDs are safely usable.
+        for (const info of supportedDiscovered) {
+            if (!seen.has(info.id)) {
+                result.push(templateDiscovery(info));
+                seen.add(info.id);
+            }
+        }
+        return result;
     },
 };
 //# sourceMappingURL=kimi-coding.js.map