@itssimplereally/opencode-kimicode-auth 0.1.0

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 opencode-kimicode-auth contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/README.md

@@ -0,0 +1,87 @@
+# OpenCode Kimi Code Auth
+
+OpenCode plugin for **Kimi Code OAuth** under the **Moonshot AI** provider.
+
+Authenticates via device-code OAuth (same flow as kimi-cli), manages multi-account rotation, and routes requests to the Kimi Code API.
+
+## Models
+
+| OpenCode model | Mode | Kimi API model |
+|---|---|---|
+| `moonshotai/kimicode-kimi-k2.5` | Thinking off | `kimi-for-coding` |
+| `moonshotai/kimicode-kimi-k2.5-thinking` | Thinking on | `kimi-for-coding` |
+
+Both models use 262k context and 32k output. Existing `moonshotai/*` API-key models are unaffected.
+
+## Install
+
+Add the plugin to `~/.config/opencode/opencode.json`:
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": [
+    "@itssimplereally/opencode-kimicode-auth@latest"
+  ]
+}
+```
+
+Then authenticate:
+
+```bash
+opencode auth login
+```
+
+In the picker, select **Moonshot AI** → **OAuth (Kimi Code / kimi-cli)**.
+
+A browser window opens for Kimi device authorization. After approval, the plugin stores your tokens locally. You can add multiple accounts for rotation.
+
+Verify:
+
+```bash
+opencode models moonshotai
+```
+
+## Troubleshooting
+
+- **Only seeing "Enter your API key"** — Ensure `"@itssimplereally/opencode-kimicode-auth@latest"` is in your plugin array, then re-run `opencode auth login`.
+- **Auth errors after working setup** — Your refresh token may have expired. Re-run `opencode auth login`.
+
+## For LLMs
+
+Copy this prompt into your coding agent to set up the plugin:
+
+```text
+Configure OpenCode on this machine to use Kimi Code OAuth via the published plugin.
+
+Goal:
+- Use Kimi Code OAuth in OpenCode for moonshotai/kimicode-* models.
+
+Rules:
+- Never print credential values.
+- Only modify config fields required for this setup.
+
+Steps:
+1. Validate tools:
+   - Run: opencode --version
+2. Update OpenCode config:
+   - File: ~/.config/opencode/opencode.json
+   - Ensure the plugin array includes: "@itssimplereally/opencode-kimicode-auth@latest"
+   - Preserve all other existing plugin entries.
+3. Verify OpenCode starts cleanly:
+   - Run: opencode auth list
+   - If plugin install/import errors occur, fix the plugin entry first.
+4. **Do not attempt interactive auth in this session.**
+   - Ask the human to run: opencode auth login
+   - Ask the human to choose provider "Moonshot AI" and method "OAuth (Kimi Code / kimi-cli)".
+   - Wait for the human to confirm they completed authorization.
+5. After human confirmation, verify:
+   - Run: opencode auth list
+   - Run: opencode models moonshotai
+   - Confirm output includes moonshotai/kimicode-kimi-k2.5 and moonshotai/kimicode-kimi-k2.5-thinking.
+6. Return a concise report of changes and verification results.
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { KimicodeCLIOAuthPlugin, MoonshotAIOAuthPlugin, createKimicodePlugin, } from "./src/plugin";
+export { authorizeKimi } from "./src/kimi/oauth";
+export type { KimiTokenExchangeResult } from "./src/kimi/oauth";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { KimicodeCLIOAuthPlugin, MoonshotAIOAuthPlugin, createKimicodePlugin, } from "./src/plugin";
+export { authorizeKimi } from "./src/kimi/oauth";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/src/constants.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Constants for Kimi Code OAuth flows and API integration.
+ */
+/**
+ * OAuth client ID for Kimi Code (from kimi-cli).
+ */
+export declare const KIMI_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+/**
+ * OAuth host for Kimi authentication.
+ * Env override: KIMI_CODE_OAUTH_HOST
+ */
+export declare const KIMI_OAUTH_HOST: string;
+/**
+ * Device authorization endpoint.
+ */
+export declare const KIMI_DEVICE_AUTH_ENDPOINT: string;
+/**
+ * Token endpoint (for both device code exchange and refresh).
+ */
+export declare const KIMI_TOKEN_ENDPOINT: string;
+/**
+ * Base URL for Kimi Code API.
+ * Env override: KIMI_CODE_BASE_URL
+ */
+export declare const KIMI_API_BASE_URL: string;
+/**
+ * Chat completions endpoint (OpenAI-compatible).
+ */
+export declare const KIMI_CHAT_COMPLETIONS_ENDPOINT: string;
+/**
+ * Models listing endpoint.
+ */
+export declare const KIMI_MODELS_ENDPOINT: string;
+/**
+ * Grant type for device code token exchange.
+ */
+export declare const KIMI_DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * Grant type for token refresh.
+ */
+export declare const KIMI_REFRESH_GRANT_TYPE = "refresh_token";
+/**
+ * Token refresh threshold in seconds (refresh when < 300s remaining).
+ */
+export declare const KIMI_REFRESH_THRESHOLD_SECONDS = 300;
+/**
+ * Background token refresh interval in seconds.
+ */
+export declare const KIMI_REFRESH_INTERVAL_SECONDS = 60;
+/**
+ * Provider identifier shared between the plugin loader and credential store.
+ */
+export declare const KIMI_PROVIDER_ID = "kimi";
+export declare function getKimiPluginVersion(): string;
+export declare function setKimiPluginVersion(version: string): void;
+export declare function getKimiUserAgent(): string;
+/**
+ * X-Msh-* device headers for Kimi API requests.
+ * These mimic the headers sent by the official kimi-cli.
+ */
+export declare function getKimiDeviceHeaders(deviceId: string): Record<string, string>;
+/**
+ * X-Msh-* headers for OAuth requests (device auth, token exchange, refresh).
+ * Matches kimi-cli's _common_headers() which sends these on every OAuth call.
+ * Uses a session-stable device ID generated at module load.
+ */
+export declare function getKimiOAuthHeaders(): Record<string, string>;
+export declare function setOAuthDeviceId(id: string): void;
+//# sourceMappingURL=constants.d.ts.map

package/dist/src/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH;;GAEG;AACH,eAAO,MAAM,cAAc,yCAAyC,CAAA;AAEpE;;;GAGG;AACH,eAAO,MAAM,eAAe,QAA8D,CAAA;AAE1F;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAsD,CAAA;AAE5F;;GAEG;AACH,eAAO,MAAM,mBAAmB,QAAuC,CAAA;AAEvE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,QAAqE,CAAA;AAEnG;;GAEG;AACH,eAAO,MAAM,8BAA8B,QAA0C,CAAA;AAErF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAgC,CAAA;AAEjE;;GAEG;AACH,eAAO,MAAM,2BAA2B,iDAAiD,CAAA;AAEzF;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAA;AAEtD;;GAEG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAA;AAEjD;;GAEG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,gBAAgB,SAAS,CAAA;AAWtC,wBAAgB,oBAAoB,IAAI,MAAM,CAA6B;AAE3E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAI1D;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS7E;AAsED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS5D;AAiBD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEjD"}

package/dist/src/constants.js

@@ -0,0 +1,207 @@
+/**
+ * Constants for Kimi Code OAuth flows and API integration.
+ */
+import { execSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { arch, hostname, platform, release, version as osVersion, } from "node:os";
+/**
+ * OAuth client ID for Kimi Code (from kimi-cli).
+ */
+export const KIMI_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+/**
+ * OAuth host for Kimi authentication.
+ * Env override: KIMI_CODE_OAUTH_HOST
+ */
+export const KIMI_OAUTH_HOST = process.env.KIMI_CODE_OAUTH_HOST || "https://auth.kimi.com";
+/**
+ * Device authorization endpoint.
+ */
+export const KIMI_DEVICE_AUTH_ENDPOINT = `${KIMI_OAUTH_HOST}/api/oauth/device_authorization`;
+/**
+ * Token endpoint (for both device code exchange and refresh).
+ */
+export const KIMI_TOKEN_ENDPOINT = `${KIMI_OAUTH_HOST}/api/oauth/token`;
+/**
+ * Base URL for Kimi Code API.
+ * Env override: KIMI_CODE_BASE_URL
+ */
+export const KIMI_API_BASE_URL = process.env.KIMI_CODE_BASE_URL || "https://api.kimi.com/coding/v1";
+/**
+ * Chat completions endpoint (OpenAI-compatible).
+ */
+export const KIMI_CHAT_COMPLETIONS_ENDPOINT = `${KIMI_API_BASE_URL}/chat/completions`;
+/**
+ * Models listing endpoint.
+ */
+export const KIMI_MODELS_ENDPOINT = `${KIMI_API_BASE_URL}/models`;
+/**
+ * Grant type for device code token exchange.
+ */
+export const KIMI_DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * Grant type for token refresh.
+ */
+export const KIMI_REFRESH_GRANT_TYPE = "refresh_token";
+/**
+ * Token refresh threshold in seconds (refresh when < 300s remaining).
+ */
+export const KIMI_REFRESH_THRESHOLD_SECONDS = 300;
+/**
+ * Background token refresh interval in seconds.
+ */
+export const KIMI_REFRESH_INTERVAL_SECONDS = 60;
+/**
+ * Provider identifier shared between the plugin loader and credential store.
+ */
+export const KIMI_PROVIDER_ID = "kimi";
+/**
+ * Emulated kimi-cli version for User-Agent and X-Msh-Version headers.
+ * This should track a recent kimi-cli release to avoid server-side
+ * version gating. Override with KIMI_CODE_CLI_VERSION env var.
+ */
+const KIMI_CLI_COMPAT_VERSION = "1.12.0";
+let kimiPluginVersion = process.env.KIMI_CODE_CLI_VERSION || KIMI_CLI_COMPAT_VERSION;
+let versionLocked = !!process.env.KIMI_CODE_CLI_VERSION;
+export function getKimiPluginVersion() { return kimiPluginVersion; }
+export function setKimiPluginVersion(version) {
+    if (versionLocked)
+        return;
+    kimiPluginVersion = version;
+    versionLocked = true;
+}
+export function getKimiUserAgent() {
+    // Kimi For Coding access is gated on known coding-agent user agents.
+    // Mimic kimi-cli by default, but allow an escape hatch.
+    return process.env.OPENCODE_KIMICODE_USER_AGENT || `KimiCLI/${getKimiPluginVersion()}`;
+}
+/**
+ * X-Msh-* device headers for Kimi API requests.
+ * These mimic the headers sent by the official kimi-cli.
+ */
+export function getKimiDeviceHeaders(deviceId) {
+    return {
+        "X-Msh-Platform": "kimi_cli",
+        "X-Msh-Version": getKimiPluginVersion(),
+        "X-Msh-Device-Name": asciiHeaderValue(getDeviceName()),
+        "X-Msh-Device-Model": asciiHeaderValue(getDeviceModel()),
+        "X-Msh-Os-Version": asciiHeaderValue(getOsVersion()),
+        "X-Msh-Device-Id": deviceId,
+    };
+}
+function getDeviceName() {
+    try {
+        return hostname();
+    }
+    catch {
+        return "unknown";
+    }
+}
+function getMacOsVersion() {
+    try {
+        return execSync("sw_vers -productVersion", { encoding: "utf8" }).trim();
+    }
+    catch {
+        // Fallback: derive from Darwin kernel version (e.g. 23.x → 14.x)
+        try {
+            return release();
+        }
+        catch {
+            return "";
+        }
+    }
+}
+function getWindowsRelease() {
+    try {
+        // os.release() returns e.g. "10.0.22621" on Windows
+        const rel = release();
+        const major = rel.split(".")[0];
+        // Windows 11 is still NT 10.0 but with build >= 22000
+        if (major === "10") {
+            const build = parseInt(rel.split(".")[2] ?? "0", 10);
+            if (build >= 22000)
+                return "11";
+        }
+        return major ?? rel;
+    }
+    catch {
+        return "";
+    }
+}
+function getDeviceModel() {
+    const sys = platform();
+    const a = arch();
+    if (sys === "darwin") {
+        const ver = getMacOsVersion();
+        if (ver && a)
+            return `macOS ${ver} ${a}`;
+        if (ver)
+            return `macOS ${ver}`;
+        return `macOS ${a}`.trim();
+    }
+    if (sys === "win32") {
+        const rel = getWindowsRelease();
+        if (rel && a)
+            return `Windows ${rel} ${a}`;
+        if (rel)
+            return `Windows ${rel}`;
+        return `Windows ${a}`.trim();
+    }
+    if (sys)
+        return `${sys} ${release()} ${a}`.trim();
+    return "Unknown";
+}
+function getOsVersion() {
+    try {
+        return osVersion();
+    }
+    catch {
+        try {
+            return release();
+        }
+        catch {
+            return "unknown";
+        }
+    }
+}
+/**
+ * X-Msh-* headers for OAuth requests (device auth, token exchange, refresh).
+ * Matches kimi-cli's _common_headers() which sends these on every OAuth call.
+ * Uses a session-stable device ID generated at module load.
+ */
+export function getKimiOAuthHeaders() {
+    return {
+        "X-Msh-Platform": "kimi_cli",
+        "X-Msh-Version": getKimiPluginVersion(),
+        "X-Msh-Device-Name": asciiHeaderValue(getDeviceName()),
+        "X-Msh-Device-Model": asciiHeaderValue(getDeviceModel()),
+        "X-Msh-Os-Version": asciiHeaderValue(getOsVersion()),
+        "X-Msh-Device-Id": getOrCreateOAuthDeviceId(),
+    };
+}
+/**
+ * Lazily-generated device ID for OAuth requests.
+ * In kimi-cli this is persisted to ~/.kimi/device_id; here we generate once
+ * per process and also allow the fingerprint module to override it later.
+ */
+let oauthDeviceId = null;
+function getOrCreateOAuthDeviceId() {
+    if (!oauthDeviceId) {
+        // Generate a 32-char lowercase hex string matching kimi-cli's uuid4().hex format
+        oauthDeviceId = randomBytes(16).toString("hex");
+    }
+    return oauthDeviceId;
+}
+export function setOAuthDeviceId(id) {
+    oauthDeviceId = id;
+}
+function asciiHeaderValue(value, fallback = "unknown") {
+    if (/^[\x00-\x7F]*$/.test(value))
+        return value;
+    const sanitized = value
+        .split("")
+        .filter((ch) => ch.charCodeAt(0) < 128)
+        .join("")
+        .trim();
+    return sanitized || fallback;
+}
+//# sourceMappingURL=constants.js.map

package/dist/src/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACL,IAAI,EACJ,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,OAAO,IAAI,SAAS,GACrB,MAAM,SAAS,CAAA;AAEhB;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,sCAAsC,CAAA;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,uBAAuB,CAAA;AAE1F;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,eAAe,iCAAiC,CAAA;AAE5F;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,eAAe,kBAAkB,CAAA;AAEvE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,gCAAgC,CAAA;AAEnG;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,iBAAiB,mBAAmB,CAAA;AAErF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,iBAAiB,SAAS,CAAA;AAEjE;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,8CAA8C,CAAA;AAEzF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAA;AAEtD;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAA;AAEjD;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAA;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,QAAQ,CAAA;AACxC,IAAI,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,uBAAuB,CAAA;AACpF,IAAI,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAA;AAEvD,MAAM,UAAU,oBAAoB,KAAa,OAAO,iBAAiB,CAAA,CAAC,CAAC;AAE3E,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,aAAa;QAAE,OAAM;IACzB,iBAAiB,GAAG,OAAO,CAAA;IAC3B,aAAa,GAAG,IAAI,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,qEAAqE;IACrE,wDAAwD;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,WAAW,oBAAoB,EAAE,EAAE,CAAA;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO;QACL,gBAAgB,EAAE,UAAU;QAC5B,eAAe,EAAE,oBAAoB,EAAE;QACvC,mBAAmB,EAAE,gBAAgB,CAAC,aAAa,EAAE,CAAC;QACtD,oBAAoB,EAAE,gBAAgB,CAAC,cAAc,EAAE,CAAC;QACxD,kBAAkB,EAAE,gBAAgB,CAAC,YAAY,EAAE,CAAC;QACpD,iBAAiB,EAAE,QAAQ;KAC5B,CAAA;AACH,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,IAAI,CAAC;YACH,OAAO,OAAO,EAAE,CAAA;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,oDAAoD;QACpD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;QACrB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/B,sDAAsD;QACtD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;YACpD,IAAI,KAAK,IAAI,KAAK;gBAAE,OAAO,IAAI,CAAA;QACjC,CAAC;QACD,OAAO,KAAK,IAAI,GAAG,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;IACtB,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;IAChB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;QAC7B,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,SAAS,GAAG,IAAI,CAAC,EAAE,CAAA;QACxC,IAAI,GAAG;YAAE,OAAO,SAAS,GAAG,EAAE,CAAA;QAC9B,OAAO,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,CAAA;IAC5B,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAA;QAC/B,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,WAAW,GAAG,IAAI,CAAC,EAAE,CAAA;QAC1C,IAAI,GAAG;YAAE,OAAO,WAAW,GAAG,EAAE,CAAA;QAChC,OAAO,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAA;IAC9B,CAAC;IACD,IAAI,GAAG;QAAE,OAAO,GAAG,GAAG,IAAI,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAA;IACjD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAA;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,OAAO,EAAE,CAAA;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,gBAAgB,EAAE,UAAU;QAC5B,eAAe,EAAE,oBAAoB,EAAE;QACvC,mBAAmB,EAAE,gBAAgB,CAAC,aAAa,EAAE,CAAC;QACtD,oBAAoB,EAAE,gBAAgB,CAAC,cAAc,EAAE,CAAC;QACxD,kBAAkB,EAAE,gBAAgB,CAAC,YAAY,EAAE,CAAC;QACpD,iBAAiB,EAAE,wBAAwB,EAAE;KAC9C,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,IAAI,aAAa,GAAkB,IAAI,CAAA;AAEvC,SAAS,wBAAwB;IAC/B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,iFAAiF;QACjF,aAAa,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,aAAa,GAAG,EAAE,CAAA;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,QAAQ,GAAG,SAAS;IAC3D,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9C,MAAM,SAAS,GAAG,KAAK;SACpB,KAAK,CAAC,EAAE,CAAC;SACT,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;SACtC,IAAI,CAAC,EAAE,CAAC;SACR,IAAI,EAAE,CAAA;IACT,OAAO,SAAS,IAAI,QAAQ,CAAA;AAC9B,CAAC"}

package/dist/src/kimi/oauth.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Kimi Device Authorization Grant (RFC 8628)
+ *
+ * Implements the device code flow used by kimi-cli:
+ * 1. Request device code from auth.kimi.com
+ * 2. User visits verification URL and enters code
+ * 3. Plugin polls token endpoint until user completes auth
+ */
+export interface DeviceAuthorizationResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    expires_in: number;
+    interval: number;
+}
+export interface KimiTokenExchangeResult {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    scope?: string;
+    token_type: string;
+}
+/**
+ * Request a device code from Kimi's OAuth server.
+ * Returns device_code, user_code, and verification_uri for the user.
+ */
+export declare function requestDeviceAuthorization(): Promise<DeviceAuthorizationResponse>;
+export type PollResult = {
+    status: "success";
+    tokens: KimiTokenExchangeResult;
+} | {
+    status: "pending";
+} | {
+    status: "slow_down";
+    interval: number;
+} | {
+    status: "expired";
+} | {
+    status: "error";
+    message: string;
+};
+/**
+ * Poll the token endpoint until the user completes authorization.
+ * Implements backoff on slow_down responses and respects expiration.
+ *
+ * @param deviceCode The device code from requestDeviceAuthorization
+ * @param intervalSeconds Initial polling interval in seconds
+ * @param expiresInSeconds Time until the device code expires
+ * @param signal Optional AbortSignal to cancel polling
+ */
+export declare function pollForToken(deviceCode: string, intervalSeconds: number, expiresInSeconds: number, signal?: AbortSignal): Promise<KimiTokenExchangeResult>;
+export interface KimiAuthorization {
+    verificationUri: string;
+    userCode: string;
+    poll: (signal?: AbortSignal) => Promise<KimiTokenExchangeResult>;
+}
+/**
+ * Start the Kimi device authorization flow.
+ * Returns the verification URL/code for the user, and a poll function
+ * to await completion.
+ */
+export declare function authorizeKimi(): Promise<KimiAuthorization>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/src/kimi/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/kimi/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,CAAA;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAMD;;;GAGG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAoBvF;AAMD,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACtD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AA8CxC;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,gBAAgB,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,uBAAuB,CAAC,CAiClC;AAMD,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAA;CACjE;AAED;;;;GAIG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAchE"}

package/dist/src/kimi/oauth.js

@@ -0,0 +1,130 @@
+/**
+ * Kimi Device Authorization Grant (RFC 8628)
+ *
+ * Implements the device code flow used by kimi-cli:
+ * 1. Request device code from auth.kimi.com
+ * 2. User visits verification URL and enters code
+ * 3. Plugin polls token endpoint until user completes auth
+ */
+import { KIMI_CLIENT_ID, KIMI_DEVICE_AUTH_ENDPOINT, KIMI_TOKEN_ENDPOINT, KIMI_DEVICE_CODE_GRANT_TYPE, getKimiOAuthHeaders, } from "../constants";
+// =============================================================================
+// Device Authorization
+// =============================================================================
+/**
+ * Request a device code from Kimi's OAuth server.
+ * Returns device_code, user_code, and verification_uri for the user.
+ */
+export async function requestDeviceAuthorization() {
+    const response = await fetch(KIMI_DEVICE_AUTH_ENDPOINT, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            ...getKimiOAuthHeaders(),
+        },
+        body: new URLSearchParams({
+            client_id: KIMI_CLIENT_ID,
+        }),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Device authorization failed (${response.status}): ${text}`);
+    }
+    return (await response.json());
+}
+/**
+ * Poll the token endpoint once for a device code exchange result.
+ */
+async function pollTokenEndpointOnce(deviceCode) {
+    const response = await fetch(KIMI_TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            ...getKimiOAuthHeaders(),
+        },
+        body: new URLSearchParams({
+            grant_type: KIMI_DEVICE_CODE_GRANT_TYPE,
+            client_id: KIMI_CLIENT_ID,
+            device_code: deviceCode,
+        }),
+    });
+    if (response.ok) {
+        const tokens = (await response.json());
+        return { status: "success", tokens };
+    }
+    const body = await response.text().catch(() => "");
+    let errorCode = "";
+    try {
+        const parsed = JSON.parse(body);
+        errorCode = parsed.error ?? "";
+    }
+    catch {
+        // not JSON
+    }
+    if (errorCode === "authorization_pending") {
+        return { status: "pending" };
+    }
+    if (errorCode === "slow_down") {
+        return { status: "slow_down", interval: 10 };
+    }
+    if (errorCode === "expired_token") {
+        return { status: "expired" };
+    }
+    return { status: "error", message: `Token exchange failed (${response.status}): ${body}` };
+}
+/**
+ * Poll the token endpoint until the user completes authorization.
+ * Implements backoff on slow_down responses and respects expiration.
+ *
+ * @param deviceCode The device code from requestDeviceAuthorization
+ * @param intervalSeconds Initial polling interval in seconds
+ * @param expiresInSeconds Time until the device code expires
+ * @param signal Optional AbortSignal to cancel polling
+ */
+export async function pollForToken(deviceCode, intervalSeconds, expiresInSeconds, signal) {
+    const deadline = Date.now() + expiresInSeconds * 1000;
+    let interval = intervalSeconds;
+    while (Date.now() < deadline) {
+        if (signal?.aborted) {
+            throw new Error("Device authorization cancelled");
+        }
+        await sleep(interval * 1000);
+        if (signal?.aborted) {
+            throw new Error("Device authorization cancelled");
+        }
+        const result = await pollTokenEndpointOnce(deviceCode);
+        switch (result.status) {
+            case "success":
+                return result.tokens;
+            case "pending":
+                continue;
+            case "slow_down":
+                interval = Math.max(interval + 5, result.interval);
+                continue;
+            case "expired":
+                throw new Error("Device code expired. Please restart the login flow.");
+            case "error":
+                throw new Error(result.message);
+        }
+    }
+    throw new Error("Device code expired (timeout). Please restart the login flow.");
+}
+/**
+ * Start the Kimi device authorization flow.
+ * Returns the verification URL/code for the user, and a poll function
+ * to await completion.
+ */
+export async function authorizeKimi() {
+    const deviceAuth = await requestDeviceAuthorization();
+    return {
+        verificationUri: deviceAuth.verification_uri_complete ?? deviceAuth.verification_uri,
+        userCode: deviceAuth.user_code,
+        poll: (signal) => pollForToken(deviceAuth.device_code, deviceAuth.interval, deviceAuth.expires_in, signal),
+    };
+}
+// =============================================================================
+// Helpers
+// =============================================================================
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=oauth.js.map

package/dist/src/kimi/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/kimi/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,cAAc,CAAA;AAuBrB,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,GAAG,mBAAmB,EAAE;SACzB;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,cAAc;SAC1B,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QAClD,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAC5D,CAAA;IACH,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgC,CAAA;AAC/D,CAAC;AAaD;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,GAAG,mBAAmB,EAAE;SACzB;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,2BAA2B;YACvC,SAAS,EAAE,cAAc;YACzB,WAAW,EAAE,UAAU;SACxB,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;QACjE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IACtC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAClD,IAAI,SAAS,GAAG,EAAE,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmD,CAAA;QACjF,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IAED,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC9B,CAAC;IACD,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC9C,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC9B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,EAAE,CAAA;AAC5F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,eAAuB,EACvB,gBAAwB,EACxB,MAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAA;IACrD,IAAI,QAAQ,GAAG,eAAe,CAAA;IAE9B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,CAAC;QAED,MAAM,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;QAE5B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAA;QAEtD,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,SAAS;gBACZ,OAAO,MAAM,CAAC,MAAM,CAAA;YACtB,KAAK,SAAS;gBACZ,SAAQ;YACV,KAAK,WAAW;gBACd,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;gBAClD,SAAQ;YACV,KAAK,SAAS;gBACZ,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;YACxE,KAAK,OAAO;gBACV,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;AAClF,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAA;IAErD,OAAO;QACL,eAAe,EAAE,UAAU,CAAC,yBAAyB,IAAI,UAAU,CAAC,gBAAgB;QACpF,QAAQ,EAAE,UAAU,CAAC,SAAS;QAC9B,IAAI,EAAE,CAAC,MAAoB,EAAE,EAAE,CAC7B,YAAY,CACV,UAAU,CAAC,WAAW,EACtB,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,UAAU,EACrB,MAAM,CACP;KACJ,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC"}