@linxiraos/pi-ai 1.0.0

package/src/registry/oauth/kimi.ts

@@ -0,0 +1,297 @@
+/**
+ * Kimi Code OAuth flow (device authorization grant)
+ */
+
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { scheduler } from "node:timers/promises";
+import { $env, getAgentDir } from "@linxiraos/pi-utils";
+import packageJson from "../../../package.json" with { type: "json" };
+import * as AIError from "../../error";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+const DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+const DEVICE_ID_FILENAME = "kimi-device-id";
+const DEFAULT_POLL_INTERVAL_MS = 5000;
+const DEFAULT_DEVICE_FLOW_TTL_MS = 15 * 60 * 1000;
+const OAUTH_EXPIRY_SKEW_MS = 5 * 60 * 1000;
+
+interface DeviceAuthorizationResponse {
+	user_code?: string;
+	device_code?: string;
+	verification_uri?: string;
+	verification_uri_complete?: string;
+	expires_in?: number;
+	interval?: number;
+}
+
+interface TokenResponse {
+	access_token?: string;
+	refresh_token?: string;
+	expires_in?: number;
+	scope?: string;
+	token_type?: string;
+	error?: string;
+	error_description?: string;
+	interval?: number;
+}
+
+function resolveOAuthHost(): string {
+	return $env.KIMI_CODE_OAUTH_HOST || $env.KIMI_OAUTH_HOST || DEFAULT_OAUTH_HOST;
+}
+
+function formatDeviceModel(system: string, release: string, arch: string): string {
+	return [system, release, arch].filter(Boolean).join(" ").trim();
+}
+
+function getDeviceModel(): string {
+	const platform = os.platform();
+	const release = os.release();
+	const arch = os.arch();
+	if (platform === "darwin") return formatDeviceModel("macOS", release, arch);
+	if (platform === "win32") return formatDeviceModel("Windows", release, arch);
+	const label = platform === "linux" ? "Linux" : platform;
+	return formatDeviceModel(label, release, arch);
+}
+
+// Device id identifies this install to Kimi. Persistence is best-effort: a
+// missing/unwritable agent dir must never break header construction (and with
+// it every usage probe / request that spreads getKimiCommonHeaders()) — fall
+// back to a per-process ephemeral id instead.
+let getDeviceId = (): string => {
+	const deviceIdPath = path.join(getAgentDir(), DEVICE_ID_FILENAME);
+	try {
+		const existing = fs.readFileSync(deviceIdPath, "utf-8").trim();
+		if (existing) {
+			getDeviceId = () => existing;
+			return existing;
+		}
+	} catch {
+		// Unreadable device-id file: regenerate below.
+	}
+
+	const deviceId = crypto.randomUUID().replace(/-/g, "");
+	try {
+		fs.mkdirSync(path.dirname(deviceIdPath), { recursive: true });
+		fs.writeFileSync(deviceIdPath, `${deviceId}\n`, { mode: 0o600 });
+	} catch {
+		// Persist failure → ephemeral id for this process.
+	}
+	getDeviceId = () => deviceId;
+	return deviceId;
+};
+
+function sanitizeHeaderValue(value: string, fallback = ""): string {
+	const sanitized = value.replace(/[^\x20-\x7E]/g, "").trim();
+	return sanitized || fallback;
+}
+
+export let getKimiCommonHeaders = () => {
+	const headers = Object.freeze({
+		"User-Agent": `KimiCLI/${packageJson.version}`,
+		"X-Msh-Platform": "kimi_cli",
+		"X-Msh-Version": packageJson.version,
+		"X-Msh-Device-Name": sanitizeHeaderValue(os.hostname(), "unknown"),
+		"X-Msh-Device-Model": sanitizeHeaderValue(getDeviceModel(), "unknown"),
+		"X-Msh-Os-Version": sanitizeHeaderValue(os.version(), "unknown"),
+		"X-Msh-Device-Id": sanitizeHeaderValue(getDeviceId(), "unknown"),
+	});
+	getKimiCommonHeaders = () => headers;
+	return headers;
+};
+
+async function requestDeviceAuthorization(): Promise<{
+	userCode: string;
+	deviceCode: string;
+	verificationUri: string;
+	verificationUriComplete: string;
+	expiresInMs: number;
+	intervalMs: number;
+}> {
+	const response = await fetch(`${resolveOAuthHost()}/api/oauth/device_authorization`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			...getKimiCommonHeaders(),
+		},
+		body: new URLSearchParams({ client_id: CLIENT_ID }),
+	});
+
+	if (!response.ok) {
+		const text = await response.text();
+		throw new AIError.OAuthError(`Kimi device authorization failed: ${response.status} ${text}`, {
+			kind: "device-auth",
+			provider: "kimi",
+			status: response.status,
+		});
+	}
+
+	const payload = (await response.json()) as DeviceAuthorizationResponse;
+	const userCode = payload.user_code;
+	const deviceCode = payload.device_code;
+	const verificationUri = payload.verification_uri;
+	const verificationUriComplete = payload.verification_uri_complete;
+
+	if (!userCode || !deviceCode || !verificationUri) {
+		throw new AIError.OAuthError("Kimi device authorization response missing required fields", {
+			kind: "validation",
+			provider: "kimi",
+		});
+	}
+
+	const expiresInMs = typeof payload.expires_in === "number" ? payload.expires_in * 1000 : DEFAULT_DEVICE_FLOW_TTL_MS;
+	const intervalMs =
+		typeof payload.interval === "number" && payload.interval > 0 ? payload.interval * 1000 : DEFAULT_POLL_INTERVAL_MS;
+
+	return {
+		userCode,
+		deviceCode,
+		verificationUri,
+		verificationUriComplete: verificationUriComplete || verificationUri,
+		expiresInMs,
+		intervalMs,
+	};
+}
+
+function parseTokenPayload(payload: TokenResponse, refreshTokenFallback?: string): OAuthCredentials {
+	if (!payload.access_token || typeof payload.expires_in !== "number") {
+		throw new AIError.OAuthError("Kimi token response missing required fields", {
+			kind: "validation",
+			provider: "kimi",
+		});
+	}
+
+	const refresh = payload.refresh_token ?? refreshTokenFallback;
+	if (!refresh) {
+		throw new AIError.OAuthError("Kimi token response missing refresh token", {
+			kind: "validation",
+			provider: "kimi",
+		});
+	}
+
+	return {
+		access: payload.access_token,
+		refresh,
+		expires: Date.now() + payload.expires_in * 1000 - OAUTH_EXPIRY_SKEW_MS,
+	};
+}
+
+async function pollForToken(
+	deviceCode: string,
+	intervalMs: number,
+	expiresInMs: number,
+	signal?: AbortSignal,
+): Promise<OAuthCredentials> {
+	const deadline = Date.now() + expiresInMs;
+	let waitMs = Math.max(1000, intervalMs);
+
+	while (Date.now() < deadline) {
+		if (signal?.aborted) {
+			throw new AIError.LoginCancelledError();
+		}
+
+		const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				...getKimiCommonHeaders(),
+			},
+			body: new URLSearchParams({
+				client_id: CLIENT_ID,
+				device_code: deviceCode,
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			}),
+		});
+
+		const payload = (await response.json()) as TokenResponse;
+		if (response.ok && payload.access_token) {
+			return parseTokenPayload(payload);
+		}
+
+		const error = payload.error;
+		if (error === "authorization_pending") {
+			await scheduler.wait(waitMs, { signal });
+			continue;
+		}
+
+		if (error === "slow_down") {
+			waitMs += 5000;
+			const retryAfter = typeof payload.interval === "number" ? payload.interval * 1000 : undefined;
+			if (retryAfter && retryAfter > waitMs) waitMs = retryAfter;
+			await scheduler.wait(waitMs, { signal });
+			continue;
+		}
+
+		if (error === "expired_token") {
+			throw new AIError.OAuthError("Kimi device authorization expired", {
+				kind: "validation",
+				provider: "kimi",
+			});
+		}
+
+		if (error === "access_denied") {
+			throw new AIError.OAuthError("Kimi device authorization denied", {
+				kind: "validation",
+				provider: "kimi",
+			});
+		}
+
+		const description = payload.error_description ? `: ${payload.error_description}` : "";
+		throw new AIError.OAuthError(`Kimi device flow failed: ${error ?? response.status}${description}`, {
+			kind: "polling",
+			provider: "kimi",
+		});
+	}
+
+	throw new AIError.OAuthError("Kimi device flow timed out", {
+		kind: "timeout",
+		provider: "kimi",
+	});
+}
+
+/**
+ * Login with Kimi Code OAuth (device code flow).
+ */
+export async function loginKimi(options: OAuthController): Promise<OAuthCredentials> {
+	const device = await requestDeviceAuthorization();
+	options.onAuth?.({
+		url: device.verificationUriComplete,
+		instructions: `Enter code: ${device.userCode}`,
+	});
+
+	return pollForToken(device.deviceCode, device.intervalMs, device.expiresInMs, options.signal);
+}
+
+/**
+ * Refresh Kimi OAuth token.
+ */
+export async function refreshKimiToken(refreshToken: string): Promise<OAuthCredentials> {
+	const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			...getKimiCommonHeaders(),
+		},
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: CLIENT_ID,
+		}),
+	});
+
+	if (!response.ok) {
+		const payload = (await response.json().catch(() => undefined)) as TokenResponse | undefined;
+		const description = payload?.error_description ? `: ${payload.error_description}` : "";
+		throw new AIError.OAuthError(`Kimi token refresh failed: ${response.status}${description}`, {
+			kind: "token-refresh",
+			provider: "kimi",
+			status: response.status,
+		});
+	}
+
+	const payload = (await response.json()) as TokenResponse;
+	return parseTokenPayload(payload, refreshToken);
+}

package/src/registry/oauth/minimax-code.ts

@@ -0,0 +1,53 @@
+/**
+ * MiniMax Token Plan login flow.
+ *
+ * MiniMax Token Plan is a subscription service that provides access to
+ * MiniMax models (M2 and newer) through an OpenAI-compatible API.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to the matching regional MiniMax subscription page
+ * 2. User subscribes and copies their API key
+ * 3. User pastes the API key back into the CLI
+ *
+ * International: https://api.minimax.io/v1
+ * China: https://api.minimaxi.com/v1
+ */
+
+import { createApiKeyLogin } from "../api-key-login";
+
+const AUTH_URL_INTL = "https://platform.minimax.io/subscribe/token-plan";
+const AUTH_URL_CN = "https://platform.minimaxi.com/subscribe/token-plan";
+const API_BASE_URL_INTL = "https://api.minimax.io/v1";
+const API_BASE_URL_CN = "https://api.minimaxi.com/v1";
+const VALIDATION_MODEL = "MiniMax-M3";
+
+function createMiniMaxLogin(authUrl: string, baseUrl: string, provider: string) {
+	return createApiKeyLogin({
+		providerLabel: "MiniMax Token Plan",
+		authUrl,
+		instructions: "Subscribe to Token Plan and copy your API key",
+		promptMessage: "Paste your MiniMax Token Plan API key",
+		placeholder: "sk-...",
+		validation: {
+			kind: "chat-completions",
+			provider,
+			baseUrl,
+			model: VALIDATION_MODEL,
+		},
+	});
+}
+
+/**
+ * Login to MiniMax Token Plan (international).
+ *
+ * Opens browser to subscription page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export const loginMiniMaxCode = createMiniMaxLogin(AUTH_URL_INTL, API_BASE_URL_INTL, "MiniMax Token Plan");
+
+/**
+ * Login to MiniMax Token Plan (China).
+ *
+ * Same flow as international but uses China endpoint.
+ */
+export const loginMiniMaxCodeCn = createMiniMaxLogin(AUTH_URL_CN, API_BASE_URL_CN, "MiniMax Token Plan (China)");

package/src/registry/oauth/oauth.html

@@ -0,0 +1,317 @@
+<!doctype html>
+<html lang="en">
+	<head>
+		<meta charset="UTF-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
+		<title>zeta · authentication</title>
+		<style>
+			:root {
+				/* dark, slightly purple-tinted neutrals — never #000 */
+				--ink-0: oklch(0.135 0.018 295);
+				--ink-1: oklch(0.172 0.022 295);
+				--ink-2: oklch(0.21 0.024 295);
+				--ink-4: oklch(0.36 0.024 295);
+				--ink-5: oklch(0.5 0.022 290);
+				--ink-6: oklch(0.66 0.018 290);
+				--ink-7: oklch(0.82 0.014 285);
+				--ink-9: oklch(0.97 0.008 90);
+
+				/* brand: magenta lead, cyan reply */
+				--magenta: oklch(0.7 0.24 340);
+				--iris: oklch(0.62 0.21 295);
+				--cyan: oklch(0.81 0.14 200);
+
+				/* signal */
+				--success: oklch(0.78 0.16 150);
+				--error: oklch(0.66 0.22 25);
+
+				--bg: var(--ink-0);
+				--fg: var(--ink-9);
+				--fg-dim: var(--ink-7);
+				--fg-faint: var(--ink-5);
+				--rule: oklch(1 0 0 / 0.07);
+				--rule-strong: oklch(1 0 0 / 0.14);
+				--accent: var(--magenta);
+				--accent-2: var(--cyan);
+
+				color-scheme: dark;
+			}
+
+			* {
+				box-sizing: border-box;
+			}
+
+			body {
+				font-family: "Geist", ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+				background:
+					radial-gradient(ellipse 80vw 60vh at 18% -10%, oklch(0.7 0.24 340 / 0.13), transparent 60%),
+					radial-gradient(ellipse 70vw 70vh at 110% 30%, oklch(0.81 0.14 200 / 0.09), transparent 60%),
+					var(--bg);
+				color: var(--fg);
+				display: flex;
+				align-items: center;
+				justify-content: center;
+				min-height: 100vh;
+				margin: 0;
+				padding: 1.5rem;
+				-webkit-font-smoothing: antialiased;
+				text-rendering: optimizeLegibility;
+				overflow-x: clip;
+			}
+
+			/* ascii grid backdrop */
+			.grid-bg {
+				position: fixed;
+				inset: 0;
+				background-image:
+					linear-gradient(to right, oklch(1 0 0 / 0.025) 1px, transparent 1px),
+					linear-gradient(to bottom, oklch(1 0 0 / 0.025) 1px, transparent 1px);
+				background-size: 56px 56px;
+				background-position: -1px -1px;
+				mask-image: radial-gradient(ellipse at 50% 30%, #000 30%, transparent 75%);
+				pointer-events: none;
+				z-index: 0;
+			}
+
+			.container {
+				position: relative;
+				z-index: 1;
+				background: oklch(0.172 0.022 295 / 0.72);
+				backdrop-filter: blur(16px);
+				-webkit-backdrop-filter: blur(16px);
+				border: 1px solid var(--rule);
+				border-radius: 16px;
+				padding: 2.5rem 2.5rem 2rem;
+				width: 100%;
+				max-width: 420px;
+				text-align: center;
+				box-shadow:
+					0 24px 48px -12px oklch(0 0 0 / 0.55),
+					0 0 0 1px oklch(1 0 0 / 0.03) inset;
+				opacity: 0;
+				transform: translateY(10px);
+				animation: rise 0.6s cubic-bezier(0.16, 1, 0.3, 1) forwards;
+			}
+			@keyframes rise {
+				to {
+					opacity: 1;
+					transform: none;
+				}
+			}
+
+			/* brand header */
+			.brand {
+				display: flex;
+				align-items: center;
+				justify-content: center;
+				gap: 0.5rem;
+				margin-bottom: 2rem;
+			}
+			.brand svg {
+				width: 22px;
+				height: 22px;
+			}
+			.brand .wordmark {
+				font-size: 13px;
+				font-weight: 500;
+				letter-spacing: -0.01em;
+				color: var(--fg);
+			}
+
+			/* status mark */
+			.mark-wrap {
+				position: relative;
+				width: 72px;
+				height: 72px;
+				margin: 0 auto 1.5rem;
+				display: flex;
+				align-items: center;
+				justify-content: center;
+			}
+			.mark-wrap::before {
+				content: "";
+				position: absolute;
+				inset: 0;
+				border-radius: 50%;
+				background: oklch(1 0 0 / 0.05);
+				z-index: 0;
+			}
+			.mark {
+				width: 40px;
+				height: 40px;
+				z-index: 2;
+			}
+			.timer-svg {
+				position: absolute;
+				top: -2px;
+				left: -2px;
+				width: 76px;
+				height: 76px;
+				transform: rotate(-90deg);
+				z-index: 1;
+				pointer-events: none;
+			}
+			.timer-circle {
+				fill: none;
+				stroke-width: 2;
+				stroke-linecap: round;
+				stroke-dasharray: 226;
+				stroke-dashoffset: 0;
+			}
+			.countdown .timer-circle {
+				animation: countdown 3s linear forwards;
+			}
+			@keyframes countdown {
+				to {
+					stroke-dashoffset: 226;
+				}
+			}
+
+			h1 {
+				font-family: "Fraunces", "Iowan Old Style", Georgia, serif;
+				font-size: 1.6rem;
+				font-weight: 500;
+				letter-spacing: -0.022em;
+				line-height: 1.15;
+				margin: 0 0 0.75rem;
+				text-wrap: balance;
+			}
+			p {
+				color: var(--fg-dim);
+				line-height: 1.6;
+				margin: 0 0 1.75rem;
+				font-size: 0.95rem;
+			}
+
+			.btn {
+				display: inline-flex;
+				align-items: center;
+				gap: 0.5rem;
+				background: var(--fg);
+				color: var(--bg);
+				font-family: inherit;
+				font-weight: 500;
+				padding: 0.65rem 1.4rem;
+				border-radius: 8px;
+				text-decoration: none;
+				font-size: 0.9rem;
+				transition: opacity 0.2s, transform 0.2s;
+				cursor: pointer;
+				border: none;
+			}
+			.btn:hover {
+				opacity: 0.88;
+				transform: translateY(-1px);
+			}
+			.btn:active {
+				transform: translateY(0);
+			}
+
+			/* State: success */
+			.success .mark-wrap::before {
+				background: oklch(0.78 0.16 150 / 0.12);
+			}
+			.success .mark {
+				color: var(--success);
+			}
+			.success .timer-circle {
+				stroke: var(--success);
+			}
+			.success .icon-error {
+				display: none;
+			}
+
+			/* State: error */
+			.error .mark-wrap::before {
+				background: oklch(0.66 0.22 25 / 0.12);
+			}
+			.error .mark {
+				color: var(--error);
+			}
+			.error .timer-circle {
+				stroke: var(--error);
+			}
+			.error .icon-success,
+			.error .timer-svg {
+				display: none;
+			}
+
+			@media (prefers-reduced-motion: reduce) {
+				.container,
+				.countdown .timer-circle {
+					animation: none;
+				}
+				.container {
+					opacity: 1;
+					transform: none;
+				}
+			}
+		</style>
+	</head>
+	<body>
+		<span aria-hidden="true" class="grid-bg"></span>
+		<div id="app" class="container">
+			<div class="brand">
+				<svg viewBox="0 0 64 64" aria-hidden="true">
+					<defs>
+						<linearGradient id="pi-grad" x1="0" y1="0" x2="1" y2="1">
+							<stop offset="0" stop-color="oklch(0.7 0.24 340)" />
+							<stop offset=".5" stop-color="oklch(0.62 0.21 295)" />
+							<stop offset="1" stop-color="oklch(0.81 0.14 200)" />
+						</linearGradient>
+					</defs>
+					<text x="32" y="47" font-family="Helvetica, Arial, sans-serif" font-size="46" font-weight="700" fill="url(#pi-grad)" text-anchor="middle">ζ</text>
+				</svg>
+				<span class="wordmark">zeta</span>
+			</div>
+
+			<div class="mark-wrap">
+				<svg class="timer-svg" viewBox="0 0 76 76">
+					<circle class="timer-circle" cx="38" cy="38" r="36"></circle>
+				</svg>
+				<svg class="mark icon-success" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+					<path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7" />
+				</svg>
+				<svg class="mark icon-error" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+					<path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+				</svg>
+			</div>
+
+			<h1 id="title">Authentication</h1>
+			<p id="message"></p>
+			<button onclick="window.close()" class="btn">Close Window</button>
+		</div>
+
+		<script id="server-state" type="application/json">
+			__OAUTH_STATE__
+		</script>
+
+		<script>
+			let serverState;
+			try {
+				serverState = JSON.parse(document.getElementById("server-state").textContent);
+			} catch {
+				const params = new URLSearchParams(window.location.search);
+				serverState = {
+					ok: params.get("ok") === "1",
+					error: params.get("error") || "Authentication failed",
+				};
+			}
+
+			const app = document.getElementById("app");
+			const title = document.getElementById("title");
+			const message = document.getElementById("message");
+
+			if (serverState.ok) {
+				app.classList.add("success", "countdown");
+				title.textContent = "Authentication Successful";
+				message.innerHTML = "You have successfully logged in.<br>You can now close this tab.";
+				setTimeout(() => window.close(), 3000);
+			} else {
+				app.classList.add("error");
+				title.textContent = "Authentication Failed";
+				message.textContent = serverState.error || "An error occurred";
+			}
+		</script>
+	</body>
+</html>