@kenkaiiii/gg-core 5.20.4 → 5.21.0

package/dist/index.cjs

@@ -51,6 +51,7 @@ __export(index_exports, {
   getClaudeCodeVersion: () => getClaudeCodeVersion,
   getContextWindow: () => getContextWindow,
   getDefaultModel: () => getDefaultModel,
+  getDefaultThinkingLevel: () => getDefaultThinkingLevel,
   getFastModel: () => getFastModel,
   getMaxThinkingLevel: () => getMaxThinkingLevel,
   getModel: () => getModel,
@@ -73,6 +74,7 @@ __export(index_exports, {
   loginKimi: () => loginKimi,
   loginOpenAI: () => loginOpenAI,
   openLog: () => openLog,
+  readStoredBaseUrlSync: () => readStoredBaseUrlSync,
   refreshAnthropicToken: () => refreshAnthropicToken,
   refreshGeminiToken: () => refreshGeminiToken,
   refreshKimiToken: () => refreshKimiToken,
@@ -86,9 +88,12 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/auth-storage.ts
-var import_promises4 = __toESM(require("fs/promises"), 1);
-var import_node_crypto6 = __toESM(require("crypto"), 1);
+// src/oauth/kimi.ts
+var import_node_child_process = require("child_process");
+var import_node_crypto = require("crypto");
+var import_node_fs = require("fs");
+var import_node_os2 = require("os");
+var import_node_path2 = __toESM(require("path"), 1);
 
 // src/paths.ts
 var import_node_path = __toESM(require("path"), 1);
@@ -115,8 +120,225 @@ function getAppPaths() {
   };
 }
 
+// src/oauth/kimi.ts
+var CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
+var KIMI_PLATFORM = "kimi_code_cli";
+var DEFAULT_KIMI_VERSION = "1.0.11";
+var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
+function oauthHost() {
+  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
+  return host.replace(/\/+$/, "");
+}
+function kimiCodeBaseUrl() {
+  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
+}
+function kimiVersion() {
+  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
+  return asciiHeader(v, DEFAULT_KIMI_VERSION);
+}
+function asciiHeader(value, fallback = "unknown") {
+  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
+  return cleaned.length > 0 ? cleaned : fallback;
+}
+function macOsProductVersion() {
+  try {
+    const version = (0, import_node_child_process.execFileSync)("/usr/bin/sw_vers", ["-productVersion"], {
+      encoding: "utf-8",
+      timeout: 1e3
+    }).trim();
+    return version.length > 0 ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function deviceModel() {
+  const os2 = (0, import_node_os2.type)();
+  const version = (0, import_node_os2.release)();
+  const osArch = (0, import_node_os2.arch)();
+  if (os2 === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
+  if (os2 === "Windows_NT") return `Windows ${version} ${osArch}`;
+  return `${os2} ${version} ${osArch}`.trim();
+}
+function deviceId() {
+  const idPath = import_node_path2.default.join(getAppPaths().agentDir, "kimi_device_id");
+  if ((0, import_node_fs.existsSync)(idPath)) {
+    try {
+      const text = (0, import_node_fs.readFileSync)(idPath, "utf-8").trim();
+      if (text.length > 0) return text;
+    } catch {
+    }
+  }
+  const id = (0, import_node_crypto.randomUUID)();
+  try {
+    (0, import_node_fs.mkdirSync)(getAppPaths().agentDir, { recursive: true, mode: 448 });
+    (0, import_node_fs.writeFileSync)(idPath, id, { encoding: "utf-8", mode: 384 });
+  } catch {
+  }
+  return id;
+}
+function deviceHeaders() {
+  return {
+    "X-Msh-Platform": KIMI_PLATFORM,
+    "X-Msh-Version": kimiVersion(),
+    "X-Msh-Device-Name": asciiHeader((0, import_node_os2.hostname)()),
+    "X-Msh-Device-Model": asciiHeader(deviceModel()),
+    "X-Msh-Os-Version": asciiHeader((0, import_node_os2.release)()),
+    "X-Msh-Device-Id": deviceId()
+  };
+}
+function kimiCodingHeaders() {
+  return {
+    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
+    ...deviceHeaders()
+  };
+}
+function isKimiCodingEndpoint(baseUrl) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
+  const normalized = baseUrl.replace(/\/+$/, "");
+  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
+}
+async function postForm(endpoint, params) {
+  const response = await fetch(`${oauthHost()}${endpoint}`, {
+    method: "POST",
+    headers: {
+      ...deviceHeaders(),
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams(params).toString()
+  });
+  let data = {};
+  try {
+    const parsed = await response.json();
+    if (parsed && typeof parsed === "object") data = parsed;
+  } catch {
+  }
+  return { status: response.status, data };
+}
+function errorDetail(data) {
+  const desc = data.error_description ?? data.message ?? data.error;
+  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
+}
+function credsFromTokenResponse(data, opts) {
+  const accessToken = data.access_token;
+  const responseRefreshToken = data.refresh_token;
+  const expiresIn = Number(data.expires_in);
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("Kimi OAuth response missing access_token.");
+  }
+  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
+  if (refreshToken.length === 0) {
+    throw new Error("Kimi OAuth response missing refresh_token.");
+  }
+  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("Kimi OAuth response missing or invalid expires_in.");
+  }
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: Date.now() + expiresIn * 1e3,
+    baseUrl: kimiCodeBaseUrl()
+  };
+}
+async function requestDeviceAuthorization() {
+  const { status, data } = await postForm("/api/oauth/device_authorization", {
+    client_id: CLIENT_ID
+  });
+  if (status !== 200) {
+    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
+  }
+  const userCode = data.user_code;
+  const deviceCode = data.device_code;
+  const verificationUriComplete = data.verification_uri_complete;
+  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
+    throw new Error("Kimi device authorization response missing user_code/device_code.");
+  }
+  return {
+    userCode,
+    deviceCode,
+    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
+    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
+    interval: Number(data.interval ?? 5) || 5
+  };
+}
+async function pollDeviceToken(deviceCode) {
+  const { status, data } = await postForm("/api/oauth/token", {
+    client_id: CLIENT_ID,
+    device_code: deviceCode,
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return { kind: "success", creds: credsFromTokenResponse(data) };
+  }
+  if (status >= 500) {
+    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
+  switch (errorCode) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    case "access_denied":
+      return { kind: "denied" };
+    default:
+      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+async function loginKimi(callbacks) {
+  const auth = await requestDeviceAuthorization();
+  callbacks.onStatus(
+    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
+  );
+  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
+  callbacks.onStatus("Waiting for you to authorize in the browser...");
+  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
+  let interval = Math.max(auth.interval, 1);
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    const result = await pollDeviceToken(auth.deviceCode);
+    if (result.kind === "success") return result.creds;
+    if (result.kind === "denied") {
+      throw new Error("Kimi authorization was denied.");
+    }
+    if (result.kind === "expired") {
+      throw new Error("Kimi device code expired. Please run login again.");
+    }
+    if (result.kind === "slow_down") {
+      interval += 5;
+    }
+  }
+  throw new Error("Kimi login timed out. Please run login again.");
+}
+async function refreshKimiToken(refreshToken) {
+  const { status, data } = await postForm("/api/oauth/token", {
+    client_id: CLIENT_ID,
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "";
+  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
+}
+
+// src/auth-storage.ts
+var import_promises4 = __toESM(require("fs/promises"), 1);
+var import_node_fs3 = require("fs");
+var import_node_crypto6 = __toESM(require("crypto"), 1);
+
 // src/oauth/anthropic.ts
-var import_node_crypto2 = __toESM(require("crypto"), 1);
+var import_node_crypto3 = __toESM(require("crypto"), 1);
 
 // src/oauth/pkce.ts
 function base64urlEncode(bytes) {
@@ -138,12 +360,12 @@ async function generatePKCE() {
 
 // src/claude-code-version.ts
 var import_promises = __toESM(require("fs/promises"), 1);
-var import_node_path3 = __toESM(require("path"), 1);
+var import_node_path4 = __toESM(require("path"), 1);
 
 // src/logger.ts
-var import_node_fs = __toESM(require("fs"), 1);
-var import_node_path2 = __toESM(require("path"), 1);
-var import_node_crypto = require("crypto");
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_node_path3 = __toESM(require("path"), 1);
+var import_node_crypto2 = require("crypto");
 var import_gg_ai = require("@kenkaiiii/gg-ai");
 var MAX_BYTES = 10 * 1024 * 1024;
 var fd = null;
@@ -155,14 +377,14 @@ var cleanups = [];
 var exactSecrets = [];
 function rotateIfNeeded(filePath) {
   try {
-    const st = import_node_fs.default.statSync(filePath);
+    const st = import_node_fs2.default.statSync(filePath);
     if (st.size < MAX_BYTES) return;
     const rotated = `${filePath}.1`;
     try {
-      import_node_fs.default.unlinkSync(rotated);
+      import_node_fs2.default.unlinkSync(rotated);
     } catch {
     }
-    import_node_fs.default.renameSync(filePath, rotated);
+    import_node_fs2.default.renameSync(filePath, rotated);
   } catch {
   }
 }
@@ -171,32 +393,32 @@ function openLog(filePath, name) {
   appName = name;
   exactSecrets = (0, import_gg_ai.environmentSecrets)(process.env);
   try {
-    import_node_fs.default.mkdirSync(import_node_path2.default.dirname(filePath), { recursive: true, mode: 448 });
+    import_node_fs2.default.mkdirSync(import_node_path3.default.dirname(filePath), { recursive: true, mode: 448 });
   } catch {
   }
   rotateIfNeeded(filePath);
   try {
-    fd = import_node_fs.default.openSync(filePath, "a");
+    fd = import_node_fs2.default.openSync(filePath, "a");
   } catch {
     fd = null;
     bytesWritten = 0;
     return false;
   }
   try {
-    bytesWritten = import_node_fs.default.fstatSync(fd).size;
+    bytesWritten = import_node_fs2.default.fstatSync(fd).size;
   } catch {
     try {
-      import_node_fs.default.closeSync(fd);
+      import_node_fs2.default.closeSync(fd);
     } catch {
     }
     fd = null;
     bytesWritten = 0;
     return false;
   }
-  sessionId = (0, import_node_crypto.randomBytes)(4).toString("hex");
+  sessionId = (0, import_node_crypto2.randomBytes)(4).toString("hex");
   try {
     if (bytesWritten < MAX_BYTES) {
-      bytesWritten += import_node_fs.default.writeSync(fd, "\n");
+      bytesWritten += import_node_fs2.default.writeSync(fd, "\n");
     }
   } catch {
   }
@@ -229,9 +451,9 @@ function log(level, category, message, data) {
 `;
     try {
       if (bytesWritten + Buffer.byteLength(capLine) <= MAX_BYTES) {
-        bytesWritten += import_node_fs.default.writeSync(fd, capLine);
+        bytesWritten += import_node_fs2.default.writeSync(fd, capLine);
       }
-      import_node_fs.default.closeSync(fd);
+      import_node_fs2.default.closeSync(fd);
     } catch {
     }
     fd = null;
@@ -239,7 +461,7 @@ function log(level, category, message, data) {
     return;
   }
   try {
-    bytesWritten += import_node_fs.default.writeSync(fd, line);
+    bytesWritten += import_node_fs2.default.writeSync(fd, line);
   } catch {
   }
 }
@@ -250,7 +472,7 @@ function closeLogger(opts) {
   if (fd !== null) {
     if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
     try {
-      if (fd !== null) import_node_fs.default.closeSync(fd);
+      if (fd !== null) import_node_fs2.default.closeSync(fd);
     } catch {
     }
   }
@@ -270,7 +492,7 @@ var FALLBACK_VERSION = "2.1.88";
 var memoryCache = null;
 var inflight = null;
 function cachePath() {
-  return import_node_path3.default.join(getAppPaths().agentDir, "claude-code-version.json");
+  return import_node_path4.default.join(getAppPaths().agentDir, "claude-code-version.json");
 }
 async function readDiskCache() {
   try {
@@ -352,7 +574,7 @@ async function getClaudeCliUserAgent() {
 }
 
 // src/oauth/anthropic.ts
-var CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+var CLIENT_ID2 = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
 var TOKEN_URLS = [
   "https://platform.claude.com/v1/oauth/token",
@@ -396,10 +618,10 @@ function toCredentials(data) {
 }
 async function loginAnthropic(callbacks) {
   const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto2.default.randomBytes(16).toString("hex");
+  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
   const params = new URLSearchParams({
     code: "true",
-    client_id: CLIENT_ID,
+    client_id: CLIENT_ID2,
     response_type: "code",
     redirect_uri: REDIRECT_URI,
     scope: SCOPES,
@@ -420,7 +642,7 @@ async function exchangeAnthropicCode(code, state, verifier) {
   const data = await postTokenRequest(
     {
       grant_type: "authorization_code",
-      client_id: CLIENT_ID,
+      client_id: CLIENT_ID2,
       code,
       state,
       redirect_uri: REDIRECT_URI,
@@ -434,7 +656,7 @@ async function refreshAnthropicToken(refreshToken) {
   const data = await postTokenRequest(
     {
       grant_type: "refresh_token",
-      client_id: CLIENT_ID,
+      client_id: CLIENT_ID2,
       refresh_token: refreshToken
     },
     "token refresh"
@@ -444,8 +666,8 @@ async function refreshAnthropicToken(refreshToken) {
 
 // src/oauth/openai.ts
 var import_node_http = __toESM(require("http"), 1);
-var import_node_crypto3 = __toESM(require("crypto"), 1);
-var CLIENT_ID2 = "app_EMoamEEZ73f0CkXaXp7hrann";
+var import_node_crypto4 = __toESM(require("crypto"), 1);
+var CLIENT_ID3 = "app_EMoamEEZ73f0CkXaXp7hrann";
 var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
 var TOKEN_URL = "https://auth.openai.com/oauth/token";
 var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
@@ -453,10 +675,10 @@ var SCOPE = "openid profile email offline_access api.connectors.read api.connect
 var JWT_CLAIM_PATH = "https://api.openai.com/auth";
 async function loginOpenAI(callbacks) {
   const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
+  const state = import_node_crypto4.default.randomBytes(16).toString("hex");
   const url = new URL(AUTHORIZE_URL2);
   url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID2);
+  url.searchParams.set("client_id", CLIENT_ID3);
   url.searchParams.set("redirect_uri", REDIRECT_URI2);
   url.searchParams.set("scope", SCOPE);
   url.searchParams.set("code_challenge", challenge);
@@ -577,7 +799,7 @@ async function exchangeOpenAICode(code, verifier) {
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "authorization_code",
-      client_id: CLIENT_ID2,
+      client_id: CLIENT_ID3,
       code,
       redirect_uri: REDIRECT_URI2,
       code_verifier: verifier
@@ -601,7 +823,7 @@ async function refreshOpenAIToken(refreshToken) {
     body: new URLSearchParams({
       grant_type: "refresh_token",
       refresh_token: refreshToken,
-      client_id: CLIENT_ID2
+      client_id: CLIENT_ID3
     })
   });
   if (!response.ok) {
@@ -623,7 +845,7 @@ async function refreshOpenAIToken(refreshToken) {
 
 // src/oauth/gemini.ts
 var import_node_http2 = __toESM(require("http"), 1);
-var import_node_crypto4 = __toESM(require("crypto"), 1);
+var import_node_crypto5 = __toESM(require("crypto"), 1);
 var CLIENT_ID_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_ID";
 var CLIENT_SECRET_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_SECRET";
 var DEFAULT_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
@@ -657,7 +879,7 @@ var CodeAssistHttpError = class extends Error {
 async function loginGemini(callbacks) {
   const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
   const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto4.default.randomBytes(32).toString("hex");
+  const state = import_node_crypto5.default.randomBytes(32).toString("hex");
   const redirectUri = await getLoopbackRedirectUri();
   const url = new URL(AUTHORIZE_URL3);
   url.searchParams.set("response_type", "code");
@@ -984,223 +1206,6 @@ function codeAssistHeaders(accessToken) {
   };
 }
 
-// src/oauth/kimi.ts
-var import_node_child_process = require("child_process");
-var import_node_crypto5 = require("crypto");
-var import_node_fs2 = require("fs");
-var import_node_os2 = require("os");
-var import_node_path4 = __toESM(require("path"), 1);
-var CLIENT_ID3 = "17e5f671-d194-4dfb-9706-5516cb48c098";
-var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
-var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
-var KIMI_PLATFORM = "kimi_code_cli";
-var DEFAULT_KIMI_VERSION = "1.0.11";
-var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
-function oauthHost() {
-  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
-  return host.replace(/\/+$/, "");
-}
-function kimiCodeBaseUrl() {
-  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
-}
-function kimiVersion() {
-  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
-  return asciiHeader(v, DEFAULT_KIMI_VERSION);
-}
-function asciiHeader(value, fallback = "unknown") {
-  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : fallback;
-}
-function macOsProductVersion() {
-  try {
-    const version = (0, import_node_child_process.execFileSync)("/usr/bin/sw_vers", ["-productVersion"], {
-      encoding: "utf-8",
-      timeout: 1e3
-    }).trim();
-    return version.length > 0 ? version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function deviceModel() {
-  const os2 = (0, import_node_os2.type)();
-  const version = (0, import_node_os2.release)();
-  const osArch = (0, import_node_os2.arch)();
-  if (os2 === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
-  if (os2 === "Windows_NT") return `Windows ${version} ${osArch}`;
-  return `${os2} ${version} ${osArch}`.trim();
-}
-function deviceId() {
-  const idPath = import_node_path4.default.join(getAppPaths().agentDir, "kimi_device_id");
-  if ((0, import_node_fs2.existsSync)(idPath)) {
-    try {
-      const text = (0, import_node_fs2.readFileSync)(idPath, "utf-8").trim();
-      if (text.length > 0) return text;
-    } catch {
-    }
-  }
-  const id = (0, import_node_crypto5.randomUUID)();
-  try {
-    (0, import_node_fs2.mkdirSync)(getAppPaths().agentDir, { recursive: true, mode: 448 });
-    (0, import_node_fs2.writeFileSync)(idPath, id, { encoding: "utf-8", mode: 384 });
-  } catch {
-  }
-  return id;
-}
-function deviceHeaders() {
-  return {
-    "X-Msh-Platform": KIMI_PLATFORM,
-    "X-Msh-Version": kimiVersion(),
-    "X-Msh-Device-Name": asciiHeader((0, import_node_os2.hostname)()),
-    "X-Msh-Device-Model": asciiHeader(deviceModel()),
-    "X-Msh-Os-Version": asciiHeader((0, import_node_os2.release)()),
-    "X-Msh-Device-Id": deviceId()
-  };
-}
-function kimiCodingHeaders() {
-  return {
-    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
-    ...deviceHeaders()
-  };
-}
-function isKimiCodingEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
-}
-async function postForm(endpoint, params) {
-  const response = await fetch(`${oauthHost()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      ...deviceHeaders(),
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(params).toString()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function credsFromTokenResponse(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  const expiresIn = Number(data.expires_in);
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Kimi OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error("Kimi OAuth response missing refresh_token.");
-  }
-  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-    throw new Error("Kimi OAuth response missing or invalid expires_in.");
-  }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    baseUrl: kimiCodeBaseUrl()
-  };
-}
-async function requestDeviceAuthorization() {
-  const { status, data } = await postForm("/api/oauth/device_authorization", {
-    client_id: CLIENT_ID3
-  });
-  if (status !== 200) {
-    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Kimi device authorization response missing user_code/device_code.");
-  }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5
-  };
-}
-async function pollDeviceToken(deviceCode) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID3,
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
-  }
-}
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-async function loginKimi(callbacks) {
-  const auth = await requestDeviceAuthorization();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    await sleep(interval * 1e3);
-    const result = await pollDeviceToken(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Kimi authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Kimi device code expired. Please run login again.");
-    }
-    if (result.kind === "slow_down") {
-      interval += 5;
-    }
-  }
-  throw new Error("Kimi login timed out. Please run login again.");
-}
-async function refreshKimiToken(refreshToken) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID3,
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
-}
-
 // src/file-lock.ts
 var import_promises2 = __toESM(require("fs/promises"), 1);
 var import_promises3 = require("timers/promises");
@@ -1266,6 +1271,26 @@ function isAlive(pid) {
 // src/auth-storage.ts
 var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
 var XIAOMI_CREDITS_KEY = "xiaomi-credits";
+function activeBaseUrlEntry(data, provider) {
+  if (provider === "moonshot") {
+    const oauth = data[MOONSHOT_OAUTH_KEY];
+    if (oauth) {
+      const exhaustedUntil = oauth.usageExhaustedUntil ?? 0;
+      if (Date.now() < exhaustedUntil && data["moonshot"]) return data["moonshot"];
+      return oauth;
+    }
+    return data["moonshot"];
+  }
+  return data[provider];
+}
+function readStoredBaseUrlSync(authFile, provider) {
+  try {
+    const data = JSON.parse((0, import_node_fs3.readFileSync)(authFile, "utf-8"));
+    return activeBaseUrlEntry(data, provider)?.baseUrl;
+  } catch {
+    return void 0;
+  }
+}
 var REFRESH_SKEW_MS = 6e4;
 var USAGE_EXHAUSTED_DEFAULT_MS = 15 * 60 * 1e3;
 var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
@@ -1341,6 +1366,16 @@ var AuthStorage = class {
     }
     return STATIC_API_KEY_PROVIDERS.has(provider);
   }
+  /**
+   * The base URL on the credential that is active right now, if any.
+   * Synchronous — call only after load()/resolveCredentials() populated the
+   * snapshot. For `moonshot` this is the Kimi For Coding URL whenever the
+   * OAuth entry is the one resolveCredentials would serve (i.e. not currently
+   * usage-exhausted with an API key configured).
+   */
+  getStoredBaseUrl(provider) {
+    return activeBaseUrlEntry(this.data, provider)?.baseUrl;
+  }
   async load() {
     await withFileLock(this.filePath, async () => {
       try {
@@ -1369,19 +1404,40 @@ var AuthStorage = class {
   async ensureLoaded() {
     if (!this.loaded) await this.load();
   }
+  /**
+   * Apply one provider-scoped mutation to the latest on-disk snapshot.
+   * AuthStorage instances live in every app session/process, so writing this
+   * instance's cached snapshot can erase credentials another instance just
+   * added. The file lock only serializes writers; the re-read prevents stale
+   * full-file overwrites.
+   */
+  async mutateLatest(mutator) {
+    await this.ensureLoaded();
+    await withFileLock(this.filePath, async () => {
+      const latest = await readAuthData(this.filePath);
+      mutator(latest);
+      await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
+      this.data = latest;
+    });
+  }
+  async reloadLatest() {
+    await withFileLock(this.filePath, async () => {
+      this.data = await readAuthData(this.filePath);
+    });
+  }
   async getCredentials(provider) {
     await this.ensureLoaded();
     return this.data[provider];
   }
   async setCredentials(provider, creds) {
-    await this.ensureLoaded();
-    this.data[provider] = creds;
-    await this.save();
+    await this.mutateLatest((latest) => {
+      latest[provider] = creds;
+    });
   }
   async clearCredentials(provider) {
-    await this.ensureLoaded();
-    delete this.data[provider];
-    await this.save();
+    await this.mutateLatest((latest) => {
+      delete latest[provider];
+    });
   }
   /**
    * Mark the credential stored under `storageKey` as usage-exhausted until
@@ -1395,12 +1451,15 @@ var AuthStorage = class {
    * nothing is stored under `storageKey`.
    */
   async markUsageExhausted(storageKey, resetsAt) {
-    await this.ensureLoaded();
-    const creds = this.data[storageKey];
-    if (!creds) return;
     const until = resetsAt !== void 0 && resetsAt * 1e3 > Date.now() ? resetsAt * 1e3 : Date.now() + USAGE_EXHAUSTED_DEFAULT_MS;
-    creds.usageExhaustedUntil = until;
-    await this.save();
+    let marked = false;
+    await this.mutateLatest((latest) => {
+      const creds = latest[storageKey];
+      if (!creds) return;
+      creds.usageExhaustedUntil = until;
+      marked = true;
+    });
+    if (!marked) return;
     log(
       "WARN",
       "auth",
@@ -1408,8 +1467,11 @@ var AuthStorage = class {
     );
   }
   async clearAll() {
-    this.data = {};
-    await this.save();
+    await this.ensureLoaded();
+    await withFileLock(this.filePath, async () => {
+      this.data = {};
+      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+    });
   }
   /**
    * Returns valid credentials, auto-refreshing if expired.
@@ -1419,6 +1481,10 @@ var AuthStorage = class {
    */
   async resolveCredentials(provider, opts) {
     await this.ensureLoaded();
+    const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : provider === "moonshot" ? [MOONSHOT_OAUTH_KEY, "moonshot"] : [provider];
+    if (!directStorageKeys.some((key) => Boolean(this.data[key]))) {
+      await this.reloadLatest();
+    }
     if (opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider)) {
       for (const key of opts.storageKeys) {
         const creds2 = this.data[key];
@@ -1465,41 +1531,44 @@ var AuthStorage = class {
     const existing = this.refreshLocks.get(provider);
     if (existing) return existing;
     const refreshPromise = withFileLock(this.filePath, async () => {
-      try {
-        const content = await import_promises4.default.readFile(this.filePath, "utf-8");
-        const freshData = JSON.parse(content);
-        const freshCreds = freshData[provider];
-        if (freshCreds && !opts?.forceRefresh && Date.now() < freshCreds.expiresAt - REFRESH_SKEW_MS) {
-          this.data[provider] = freshCreds;
-          return freshCreds;
-        }
-      } catch {
+      const latest = await readAuthData(this.filePath);
+      const latestCreds = latest[provider];
+      if (!latestCreds) {
+        this.data = latest;
+        throw new NotLoggedInError(provider);
+      }
+      const credentialWasReplaced = latestCreds.accessToken !== creds.accessToken || latestCreds.refreshToken !== creds.refreshToken || latestCreds.expiresAt !== creds.expiresAt;
+      if (credentialWasReplaced || !opts?.forceRefresh && Date.now() < latestCreds.expiresAt - REFRESH_SKEW_MS) {
+        this.data = latest;
+        return latestCreds;
       }
       const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : refreshOpenAIToken;
       let refreshed;
       try {
-        refreshed = await refreshFn(creds.refreshToken);
+        refreshed = await refreshFn(latestCreds.refreshToken);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh/i.test(msg) || /unauthorized/i.test(msg);
         if (isAuthFailure) {
-          delete this.data[provider];
-          await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+          delete latest[provider];
+          this.data = latest;
+          await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
           throw new NotLoggedInError(provider);
         }
         throw err;
       }
-      if (!refreshed.accountId && creds.accountId) {
-        refreshed.accountId = creds.accountId;
+      if (!refreshed.accountId && latestCreds.accountId) {
+        refreshed.accountId = latestCreds.accountId;
       }
-      if (!refreshed.projectId && creds.projectId) {
-        refreshed.projectId = creds.projectId;
+      if (!refreshed.projectId && latestCreds.projectId) {
+        refreshed.projectId = latestCreds.projectId;
       }
-      if (!refreshed.baseUrl && creds.baseUrl) {
-        refreshed.baseUrl = creds.baseUrl;
+      if (!refreshed.baseUrl && latestCreds.baseUrl) {
+        refreshed.baseUrl = latestCreds.baseUrl;
       }
-      this.data[provider] = refreshed;
-      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+      latest[provider] = refreshed;
+      this.data = latest;
+      await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
       return refreshed;
     });
     this.refreshLocks.set(provider, refreshPromise);
@@ -1517,12 +1586,16 @@ var AuthStorage = class {
     const creds = await this.resolveCredentials(provider);
     return creds.accessToken;
   }
-  async save() {
-    await withFileLock(this.filePath, async () => {
-      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
-    });
-  }
 };
+async function readAuthData(filePath) {
+  try {
+    const content = await import_promises4.default.readFile(filePath, "utf-8");
+    return JSON.parse(content);
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  }
+}
 async function atomicWriteFile(filePath, content) {
   const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${import_node_crypto6.default.randomUUID().slice(0, 8)}.tmp`;
   try {
@@ -1777,8 +1850,9 @@ var MODELS = [
   },
   // ── Moonshot (Kimi) ────────────────────────────────────
   // K3 is Kimi's 2.8T-parameter flagship for long-horizon coding, knowledge
-  // work, and deep reasoning. It always reasons at the `max` effort; the public
-  // API uses `reasoning_effort`, while Kimi Code OAuth keeps its managed wire shape.
+  // work, and deep reasoning. Its effort ladder is server-declared as
+  // low/high/max on both the public API (default max) and the Kimi For Coding
+  // OAuth endpoint (default high); thinking can also be fully disabled.
   {
     id: "kimi-k3",
     name: "Kimi K3",
@@ -2012,6 +2086,11 @@ function getContextWindow(modelId, options) {
 function getMaxThinkingLevel(modelId) {
   return getModel(modelId)?.maxThinkingLevel ?? "high";
 }
+function getDefaultThinkingLevel(modelId, options) {
+  const model = getModel(modelId);
+  if (model?.id === "kimi-k3" && isKimiCodingEndpoint(options?.baseUrl)) return "high";
+  return model?.maxThinkingLevel ?? "high";
+}
 function getSummaryModel(provider, currentModelId) {
   if (provider === "anthropic") {
     return MODELS.find((m) => m.id === "claude-sonnet-5");
@@ -2052,6 +2131,7 @@ var ANTHROPIC_ADAPTIVE_THINKING_LEVELS = [
   "high",
   "max"
 ];
+var MOONSHOT_K3_THINKING_LEVELS = ["low", "high", "max"];
 function isOpenAIGptModel(provider, model) {
   return provider === "openai" && model.startsWith("gpt-");
 }
@@ -2061,6 +2141,9 @@ function isSakanaModel(provider) {
 function isXaiModel(provider) {
   return provider === "xai";
 }
+function isMoonshotK3Model(provider, model) {
+  return provider === "moonshot" && model === "kimi-k3";
+}
 function isAnthropicOpus48Or47Model(provider, model) {
   return provider === "anthropic" && /opus-4-8|opus-4-7/.test(model);
 }
@@ -2085,6 +2168,7 @@ function getSupportedThinkingLevels(provider, model) {
     if (maxIndex2 === -1) return XAI_THINKING_LEVELS;
     return XAI_THINKING_LEVELS.slice(0, maxIndex2 + 1);
   }
+  if (isMoonshotK3Model(provider, model)) return MOONSHOT_K3_THINKING_LEVELS;
   if (!isOpenAIGptModel(provider, model)) return [maxLevel];
   const levels = model.startsWith("gpt-5.6-") ? OPENAI_GPT_56_THINKING_LEVELS : OPENAI_GPT_THINKING_LEVELS;
   const maxIndex = levels.indexOf(maxLevel);
@@ -2096,7 +2180,7 @@ function isThinkingLevelSupported(provider, model, level) {
 }
 function getNextThinkingLevel(provider, model, current) {
   const supportedLevels = getSupportedThinkingLevels(provider, model);
-  const shouldCycleLevels = isOpenAIGptModel(provider, model) || isAnthropicAdaptiveModel(provider, model) || isSakanaModel(provider) || isXaiModel(provider);
+  const shouldCycleLevels = isOpenAIGptModel(provider, model) || isAnthropicAdaptiveModel(provider, model) || isSakanaModel(provider) || isXaiModel(provider) || isMoonshotK3Model(provider, model);
   if (!shouldCycleLevels) {
     return current ? void 0 : supportedLevels[0];
   }
@@ -2560,7 +2644,7 @@ async function transcribeVoice(fileUrl) {
 
 // src/auto-update.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs3 = __toESM(require("fs"), 1);
+var import_node_fs4 = __toESM(require("fs"), 1);
 var import_node_path5 = __toESM(require("path"), 1);
 var CHECK_INTERVAL_MS = 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS2 = 1e4;
@@ -2594,7 +2678,7 @@ function createAutoUpdater(config) {
   }
   function readState() {
     try {
-      const raw = import_node_fs3.default.readFileSync(stateFilePath(), "utf-8");
+      const raw = import_node_fs4.default.readFileSync(stateFilePath(), "utf-8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -2603,8 +2687,8 @@ function createAutoUpdater(config) {
   function writeState(state) {
     try {
       const filePath = stateFilePath();
-      import_node_fs3.default.mkdirSync(import_node_path5.default.dirname(filePath), { recursive: true, mode: 448 });
-      import_node_fs3.default.writeFileSync(filePath, JSON.stringify(state));
+      import_node_fs4.default.mkdirSync(import_node_path5.default.dirname(filePath), { recursive: true, mode: 448 });
+      import_node_fs4.default.writeFileSync(filePath, JSON.stringify(state));
     } catch {
     }
   }
@@ -2749,6 +2833,7 @@ function createAutoUpdater(config) {
   getClaudeCodeVersion,
   getContextWindow,
   getDefaultModel,
+  getDefaultThinkingLevel,
   getFastModel,
   getMaxThinkingLevel,
   getModel,
@@ -2771,6 +2856,7 @@ function createAutoUpdater(config) {
   loginKimi,
   loginOpenAI,
   openLog,
+  readStoredBaseUrlSync,
   refreshAnthropicToken,
   refreshGeminiToken,
   refreshKimiToken,