@kenkaiiii/gg-core 5.90.0 → 5.91.1

package/NOTICE

@@ -0,0 +1,52 @@
+GG Coder
+Copyright (C) 2025-2026 KenKai
+
+This program is free software: you can redistribute it and/or modify it under
+the terms of the GNU Affero General Public License as published by the Free
+Software Foundation, version 3 only (AGPL-3.0-only). See LICENSE.
+
+This program is distributed in the hope that it will be useful, but WITHOUT
+ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+details.
+
+Releases before 4 November 2026 (up to and including v0.102.0 of the desktop
+app and 5.91.0 of the npm packages) were published under the MIT License, and
+copies already received under those terms keep them.
+
+--------------------------------------------------------------------------------
+Contributions under the MIT License
+
+The WSL-to-Windows-host audio playback in packages/ggcoder/src/core/radio.ts
+(isWsl and tryPlayOnWindowsHost) is derived from contributions by
+creativeprofit22 (pull requests #15 and #16, May 2026), made under these terms:
+
+  Copyright (c) 2026 creativeprofit22
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  SOFTWARE.
+
+--------------------------------------------------------------------------------
+Third-party components
+
+Bundled third-party code, fonts and media keep their own licenses, listed in:
+  gg-app/src/assets/fonts/THIRD-PARTY.md
+  packages/ggcoder/assets/motion/THIRD-PARTY.md
+  packages/gg-world/CREDITS.md
+and in the LICENSE / OFL.txt files beside each component. npm and Cargo
+dependencies are installed under their own licenses.

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@kenkaiiii/gg-core"><img src="https://img.shields.io/npm/v/@kenkaiiii/gg-core?style=for-the-badge" alt="npm version"></a>
-  <a href="../../LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg?style=for-the-badge" alt="MIT License"></a>
+  <a href="../../LICENSE"><img src="https://img.shields.io/badge/License-AGPL--3.0-blue.svg?style=for-the-badge" alt="AGPL-3.0 License"></a>
 </p>
 
 The shared foundation under GG Coder's app and CLI. It depends only on [`@kenkaiiii/gg-ai`](../gg-ai/README.md), never on React, Ink or the agent loop.
@@ -25,15 +25,15 @@ npm i @kenkaiiii/gg-core
 
 ## What's inside
 
-| Area | Main exports |
-|---|---|
-| Model registry | `getModel`, `getAllModels`, `getModelsForProvider`, `getDefaultModel`, `getContextWindow` |
-| Thinking levels | `getSupportedThinkingLevels`, `getMaxThinkingLevel`, `getDefaultThinkingLevel` |
-| Auth storage | `AuthStorage` (reads and writes `~/.gg/auth.json`, refreshes OAuth tokens) |
-| OAuth | Anthropic, OpenAI, Gemini, Kimi and xAI login flows |
-| Local models | `discoverLocalModels` (Ollama, LM Studio, llama.cpp, vLLM, custom endpoints) |
-| Paths | `getAppPaths` (every file under `~/.gg/`) |
-| Other | Logger, file lock, usage limits, Telegram, voice transcription, auto-update |
+| Area            | Main exports                                                                              |
+| --------------- | ----------------------------------------------------------------------------------------- |
+| Model registry  | `getModel`, `getAllModels`, `getModelsForProvider`, `getDefaultModel`, `getContextWindow` |
+| Thinking levels | `getSupportedThinkingLevels`, `getMaxThinkingLevel`, `getDefaultThinkingLevel`            |
+| Auth storage    | `AuthStorage` (reads and writes `~/.gg/auth.json`, refreshes OAuth tokens)                |
+| OAuth           | Anthropic, OpenAI, Gemini, Kimi and xAI login flows                                       |
+| Local models    | `discoverLocalModels` (Ollama, LM Studio, llama.cpp, vLLM, custom endpoints)              |
+| Paths           | `getAppPaths` (every file under `~/.gg/`)                                                 |
+| Other           | Logger, file lock, usage limits, Telegram, voice transcription, auto-update               |
 
 Two lighter subpath entries skip the rest of the package:
 
@@ -65,4 +65,4 @@ console.log(models.map((m) => m.id));
 
 ## License
 
-MIT
+AGPL-3.0-only. See [LICENSE](../../LICENSE).

package/dist/{chunk-QL5357JB.js → chunk-YXPGQIOD.js}

@@ -1177,9 +1177,13 @@ async function acquireLock(lockPath) {
           continue;
         }
       } catch {
-        await fs.unlink(lockPath).catch(() => {
-        });
-        continue;
+        const stat = await fs.stat(lockPath).catch(() => null);
+        if (!stat) continue;
+        if (Date.now() - stat.mtimeMs > STALE_TIMEOUT_MS) {
+          await fs.unlink(lockPath).catch(() => {
+          });
+          continue;
+        }
       }
       if (Date.now() - startTime > MAX_WAIT_MS) {
         await fs.unlink(lockPath).catch(() => {
@@ -1376,6 +1380,90 @@ function isHiddenProvider(provider) {
 
 // src/auth-storage.ts
 import { LOCAL_NO_API_KEY } from "@kenkaiiii/gg-ai";
+
+// src/minimax-region.ts
+var MINIMAX_GLOBAL_BASE_URL = "https://api.minimax.io/anthropic";
+var MINIMAX_CN_BASE_URL = "https://api.minimax.cn/anthropic";
+var REGION_HOSTS = [
+  { host: "https://api.minimax.io", baseUrl: MINIMAX_GLOBAL_BASE_URL },
+  { host: "https://api.minimax.cn", baseUrl: MINIMAX_CN_BASE_URL }
+];
+var KEY_KNOWN_CODES = /* @__PURE__ */ new Set([0, 2062]);
+var KEY_REJECTED_CODES = /* @__PURE__ */ new Set([1004, 2049]);
+async function probeRegion(host, apiKey, fetchImpl, timeoutMs) {
+  const url = apiKey.startsWith("sk-api-") ? `${host}/account/query_balance` : `${host}/v1/token_plan/remains`;
+  let sawRejection = false;
+  const authHeaders = [
+    { Authorization: `Bearer ${apiKey}` },
+    { "x-api-key": apiKey }
+  ];
+  for (const auth of authHeaders) {
+    let res;
+    try {
+      res = await fetchImpl(url, {
+        headers: { ...auth, "Content-Type": "application/json" },
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch {
+      return "inconclusive";
+    }
+    if (res.status === 401 || res.status === 403) {
+      sawRejection = true;
+      continue;
+    }
+    if (!res.ok) return "inconclusive";
+    let code;
+    try {
+      code = (await res.json()).base_resp?.status_code;
+    } catch {
+      return "inconclusive";
+    }
+    if (typeof code === "number" && KEY_KNOWN_CODES.has(code)) return "authorized";
+    if (typeof code === "number" && KEY_REJECTED_CODES.has(code)) {
+      sawRejection = true;
+      continue;
+    }
+    return "inconclusive";
+  }
+  return sawRejection ? "unauthorized" : "inconclusive";
+}
+async function detectMiniMaxBaseUrl(apiKey, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  const results = await Promise.all(
+    REGION_HOSTS.map((r) => probeRegion(r.host, apiKey, fetchImpl, timeoutMs))
+  );
+  const index = results.indexOf("authorized");
+  return index === -1 ? void 0 : REGION_HOSTS[index].baseUrl;
+}
+
+// src/xiaomi-region.ts
+var XIAOMI_TOKEN_PLAN_BASE_URLS = [
+  "https://token-plan-sgp.xiaomimimo.com/v1",
+  "https://token-plan-ams.xiaomimimo.com/v1",
+  "https://token-plan-cn.xiaomimimo.com/v1"
+];
+async function detectXiaomiTokenPlanBaseUrl(apiKey, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  const accepted = await Promise.all(
+    XIAOMI_TOKEN_PLAN_BASE_URLS.map(async (baseUrl) => {
+      try {
+        const res = await fetchImpl(`${baseUrl}/models`, {
+          headers: { Authorization: `Bearer ${apiKey}` },
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+        return res.ok;
+      } catch {
+        return false;
+      }
+    })
+  );
+  const index = accepted.indexOf(true);
+  return index === -1 ? void 0 : XIAOMI_TOKEN_PLAN_BASE_URLS[index];
+}
+
+// src/auth-storage.ts
 var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
 var XAI_OAUTH_KEY = "xai-oauth";
 var DUAL_AUTH_PROVIDERS = [
@@ -1425,6 +1513,15 @@ function activeBaseUrlEntry(data, provider) {
   }
   return data[provider];
 }
+var MINIMAX_REGION_RETRY_MS = 5 * 60 * 1e3;
+var miniMaxRegionProbes = /* @__PURE__ */ new Map();
+function cachedMiniMaxRegion(apiKey) {
+  const cached = miniMaxRegionProbes.get(apiKey);
+  if (cached && Date.now() - cached.at < MINIMAX_REGION_RETRY_MS) return cached.result;
+  const result = detectMiniMaxBaseUrl(apiKey).catch(() => void 0);
+  miniMaxRegionProbes.set(apiKey, { at: Date.now(), result });
+  return result;
+}
 function readStoredBaseUrlSync(authFile, provider) {
   try {
     const data = JSON.parse(readFileSync2(authFile, "utf-8"));
@@ -1471,8 +1568,12 @@ var AuthStorage = class {
   snapshotIno = 0;
   /** Per-provider lock to serialize concurrent refresh calls. */
   refreshLocks = /* @__PURE__ */ new Map();
-  constructor(filePath) {
+  detectMiniMaxRegion;
+  detectXiaomiCluster;
+  constructor(filePath, options) {
     this.filePath = filePath ?? getAppPaths().authFile;
+    this.detectMiniMaxRegion = options?.detectMiniMaxBaseUrl ?? cachedMiniMaxRegion;
+    this.detectXiaomiCluster = options?.detectXiaomiTokenPlanBaseUrl ?? detectXiaomiTokenPlanBaseUrl;
   }
   /** Path to the on-disk auth file. Useful for status output. */
   get path() {
@@ -1671,11 +1772,48 @@ var AuthStorage = class {
     await this.ensureFresh();
     return this.data[provider];
   }
+  /**
+   * A MiniMax key saved without an endpoint (every key, until its first use)
+   * gets the endpoint of the region that issued it, saved so the check runs
+   * once. Without this a Mainland China key went to the Global API, got a 401,
+   * and was deleted as invalid.
+   */
+  async withMiniMaxRegion(creds) {
+    const baseUrl = await this.detectMiniMaxRegion(creds.accessToken);
+    if (!baseUrl) return creds;
+    log("INFO", "auth", `MiniMax key belongs to ${baseUrl} \u2014 saved for future requests`);
+    await this.mutateLatest((latest) => {
+      const current = latest["minimax"];
+      if (current?.accessToken === creds.accessToken && !current.baseUrl) {
+        current.baseUrl = baseUrl;
+      }
+    });
+    return { ...creds, baseUrl };
+  }
   async setCredentials(provider, creds) {
     await this.mutateLatest((latest) => {
       latest[provider] = creds;
     });
   }
+  /**
+   * After a 401, move a regional key to the cluster that issued it instead of
+   * treating it as invalid. Only the Xiaomi Token Plan is regional: every key
+   * used to go to Singapore, so Europe and China keys were rejected and deleted.
+   * Returns the new base URL, or undefined when no other cluster accepts the key.
+   */
+  async relocateRegionalApiKey(storageKeys) {
+    const key = await this.pickStorageKey(storageKeys);
+    const creds = key === "xiaomi" ? this.data[key] : void 0;
+    if (!creds) return void 0;
+    const baseUrl = await this.detectXiaomiCluster(creds.accessToken);
+    if (!baseUrl || baseUrl === creds.baseUrl) return void 0;
+    await this.mutateLatest((latest) => {
+      const current = latest["xiaomi"];
+      if (current?.accessToken === creds.accessToken) current.baseUrl = baseUrl;
+    });
+    log("INFO", "auth", `Xiaomi Token Plan key belongs to ${baseUrl} \u2014 saved for future requests`);
+    return baseUrl;
+  }
   // Keeps local-endpoint keys: they're the user's own config, and a 401 there is often a busy gateway.
   async clearRejectedApiKey(storageKey) {
     if (storageKey.startsWith(LOCAL_AUTH_KEY_PREFIX)) return false;
@@ -1795,6 +1933,7 @@ var AuthStorage = class {
       throw new NotLoggedInError(provider);
     }
     if (STATIC_API_KEY_PROVIDERS.has(provider)) {
+      if (provider === "minimax" && !creds.baseUrl) return await this.withMiniMaxRegion(creds);
       return creds;
     }
     if (!opts?.forceRefresh && Date.now() < creds.expiresAt - refreshThresholdMs(creds)) {
@@ -2445,6 +2584,23 @@ var MODELS = [
     maxThinkingLevel: "max"
   },
   // ── MiniMax ────────────────────────────────────────────
+  {
+    // The only text model M Plan / Token Plan keys cover; MiniMax-M3 on those
+    // keys fails with "insufficient balance (1008)". Pay-as-you-go serves both.
+    // Always thinks (`thinking: disabled` 400s; omitted = on) with a real
+    // low→max effort ladder on output_config.effort, API default max.
+    id: "MiniMax-M3.1-Flash",
+    name: "MiniMax M3.1 Flash",
+    provider: "minimax",
+    contextWindow: 1e6,
+    maxOutputTokens: 131072,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: true,
+    maxVideoBytes: 50 * 1024 * 1024,
+    costTier: "low",
+    maxThinkingLevel: "max"
+  },
   {
     id: "MiniMax-M3",
     name: "MiniMax M3",
@@ -2651,11 +2807,44 @@ function clearRuntimeModels(predicate) {
     if (predicate(model)) runtimeModels.delete(id);
   }
 }
+var providerCatalogs = /* @__PURE__ */ new Map();
+function setProviderCatalog(provider, models) {
+  if (!models) {
+    providerCatalogs.delete(provider);
+    return [];
+  }
+  const installed = /* @__PURE__ */ new Map();
+  for (const model of models) {
+    if (model.provider !== provider) continue;
+    if (MODELS.some((m) => m.id === model.id && m.provider !== provider)) continue;
+    installed.set(model.id, model);
+  }
+  providerCatalogs.set(provider, installed);
+  return [...installed.values()];
+}
+function getProviderCatalog(provider) {
+  const catalog = providerCatalogs.get(provider);
+  return catalog ? [...catalog.values()] : void 0;
+}
 function getAllModels() {
-  return [...MODELS, ...runtimeModels.values()];
+  const synced = [...providerCatalogs.values()].flatMap((c) => [...c.values()]);
+  return [
+    ...MODELS.filter((m) => !providerCatalogs.has(m.provider)),
+    ...synced,
+    ...runtimeModels.values()
+  ];
 }
 function getModel(id) {
-  return MODELS.find((m) => m.id === id) ?? runtimeModels.get(id);
+  const fixed = MODELS.find((m) => m.id === id);
+  if (fixed && !providerCatalogs.has(fixed.provider)) return fixed;
+  return findSynced(id) ?? fixed ?? runtimeModels.get(id);
+}
+function findSynced(id) {
+  for (const catalog of providerCatalogs.values()) {
+    const hit = catalog.get(id);
+    if (hit) return hit;
+  }
+  return void 0;
 }
 function getModelsForProvider(provider) {
   return getAllModels().filter((m) => m.provider === provider);
@@ -2695,7 +2884,7 @@ var DEFAULT_MODEL_IDS = {
   gemini: "gemini-3.1-flash-lite",
   glm: "glm-5.3",
   moonshot: "kimi-k3",
-  minimax: "MiniMax-M3",
+  minimax: "MiniMax-M3.1-Flash",
   deepseek: "deepseek-v4-pro",
   huggingface: "moonshotai/Kimi-K2.7-Code",
   openrouter: "qwen/qwen3.8-max",
@@ -2791,6 +2980,11 @@ export {
   closeLogger,
   HIDDEN_PROVIDERS,
   isHiddenProvider,
+  MINIMAX_GLOBAL_BASE_URL,
+  MINIMAX_CN_BASE_URL,
+  detectMiniMaxBaseUrl,
+  XIAOMI_TOKEN_PLAN_BASE_URLS,
+  detectXiaomiTokenPlanBaseUrl,
   MOONSHOT_OAUTH_KEY,
   XAI_OAUTH_KEY,
   dualAuthProvider,
@@ -2807,6 +3001,8 @@ export {
   MODELS,
   registerRuntimeModels,
   clearRuntimeModels,
+  setProviderCatalog,
+  getProviderCatalog,
   getAllModels,
   getModel,
   getModelsForProvider,
@@ -2825,4 +3021,4 @@ export {
   getDefaultThinkingLevel,
   getSummaryModel
 };
-//# sourceMappingURL=chunk-QL5357JB.js.map
+//# sourceMappingURL=chunk-YXPGQIOD.js.map