@nanogpt/private-mode 0.2.2 → 0.2.5

package/README.md

@@ -25,14 +25,14 @@ const client = new OpenAI({
 });
 
 const response = await client.chat.completions.create({
-  model: "private/kimi-k2-6",
+  model: "private/glm-5-2",
   messages: [{ role: "user", content: "Hello" }],
 });
 ```
 
 The local proxy verifies TEE attestation, encrypts request bodies with EHBP, sends ciphertext through NanoGPT, decrypts encrypted responses locally, and returns normal OpenAI JSON to the calling app.
 
-After a long idle period (five minutes by default), the proxy re-verifies attestation and creates a fresh encrypted transport before the next request. This makes laptop sleep/resume safe without requiring a proxy restart. Set `NANOGPT_PRIVATE_CLIENT_IDLE_RESET_MS` to a positive millisecond value to adjust the idle threshold.
+After a long idle period (five minutes by default), the proxy re-verifies attestation and creates a fresh encrypted transport before the next request. This makes laptop sleep/resume safe without requiring a proxy restart. Set `NANOGPT_PRIVATE_CLIENT_IDLE_RESET_MS` to a positive millisecond value to adjust the idle threshold, or `0` to disable idle resets.
 
 NanoGPT can see account identity, selected private model, selected TEE target metadata, timing, sizes, status, and usage metadata. NanoGPT cannot read the prompt or completion body for supported private models.
 
@@ -54,7 +54,7 @@ GET http://127.0.0.1:8787/v1/private-mode/attestation
 
 Supported private model IDs include:
 
-- `private/kimi-k2-6`
+- `private/kimi-k3`
 - `private/glm-5-1`
 - `private/glm-5-1-thinking`
 - `private/glm-5-2`

package/lib/requestTransforms.js

@@ -8,9 +8,25 @@ const ASSISTANT_REASONING_MESSAGE_FIELDS = [
 ];
 const MAX_TOKEN_ALIAS_FIELDS = [
   'max_completion_tokens',
+  'max_output_tokens',
   'maxCompletionTokens',
   'maxTokens',
 ];
+const KIMI_K3_STANDARD_DEFAULT_MAX_COMPLETION_TOKENS = 16_384;
+const KIMI_K3_DEFAULT_MAX_COMPLETION_TOKENS = 65_536;
+const KIMI_K3_MAX_COMPLETION_TOKENS = 1_048_576;
+const KIMI_K3_CONTEXT_WINDOW_TOKENS = 1_048_576;
+const KIMI_K3_CONTEXT_SAFETY_MARGIN_TOKENS = 10;
+const KIMI_K3_ESTIMATED_TEXT_BYTES_PER_TOKEN = 3;
+const KIMI_K3_HIGH_ENTROPY_TEXT_MIN_LENGTH = 2_048;
+const KIMI_K3_HIGH_ENTROPY_TOKENS_PER_BYTE = 0.75;
+const KIMI_K3_IMAGE_TOKENS = 85;
+const KIMI_K3_DOCUMENT_TOKENS = 85;
+const KIMI_K3_AUDIO_TOKENS = 32_768;
+const KIMI_K3_AUDIO_URL_TOKENS = 4_096;
+const KIMI_K3_VIDEO_TOKENS = 65_536;
+const KIMI_K3_REASONING_EFFORT_LEVELS = new Set(['low', 'high', 'max']);
+const KIMI_K3_TEXT_ENCODER = new TextEncoder();
 const PRIVATE_TINFOIL_CHAT_COMPLETION_BODY_FIELDS = new Set([
   'chat_template_kwargs',
   'frequency_penalty',
@@ -44,6 +60,149 @@ function isPlainObject(value) {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
 
+function estimateKimiK3TextTokens(value) {
+  if (typeof value !== 'string' || value.length === 0) return 0;
+  const utf8Bytes = KIMI_K3_TEXT_ENCODER.encode(value).byteLength;
+  const ordinaryEstimate = Math.ceil(utf8Bytes / KIMI_K3_ESTIMATED_TEXT_BYTES_PER_TOKEN);
+  if (value.length < KIMI_K3_HIGH_ENTROPY_TEXT_MIN_LENGTH) return ordinaryEstimate;
+
+  let ascii = 0;
+  let whitespace = 0;
+  const uniqueChars = new Set();
+  let currentRun = 0;
+  let longestRun = 0;
+  let previous = '';
+
+  for (const char of value) {
+    const code = char.charCodeAt(0);
+    if (code >= 32 && code <= 126) ascii += 1;
+    if (/\s/.test(char)) whitespace += 1;
+    uniqueChars.add(char);
+    if (char === previous) {
+      currentRun += 1;
+    } else {
+      previous = char;
+      currentRun = 1;
+    }
+    if (currentRun > longestRun) longestRun = currentRun;
+  }
+
+  const isHighEntropy =
+    ascii / value.length >= 0.98 &&
+    whitespace / value.length <= 0.02 &&
+    uniqueChars.size >= 32 &&
+    longestRun / value.length <= 0.02;
+  if (!isHighEntropy) return ordinaryEstimate;
+
+  return Math.max(
+    ordinaryEstimate,
+    Math.ceil(utf8Bytes * KIMI_K3_HIGH_ENTROPY_TOKENS_PER_BYTE),
+  );
+}
+
+function estimateKimiK3ContentTokens(content) {
+  if (typeof content === 'string') return estimateKimiK3TextTokens(content);
+  if (Array.isArray(content)) {
+    return content.reduce((total, part) => total + estimateKimiK3ContentTokens(part), 0);
+  }
+  if (!isPlainObject(content)) return 0;
+
+  const type = String(content.type || '').toLowerCase();
+  const nestedFile = isPlainObject(content.file) ? content.file : {};
+  const nestedSource = isPlainObject(content.source) ? content.source : {};
+  const nestedDocument = isPlainObject(content.document) ? content.document : {};
+  const mediaType = String(
+    content.media_type ||
+    content.mime_type ||
+    content.file_type ||
+    nestedFile.media_type ||
+    nestedFile.mime_type ||
+    nestedFile.file_type ||
+    nestedSource.media_type ||
+    nestedSource.mime_type ||
+    nestedDocument.media_type ||
+    nestedDocument.mime_type ||
+    '',
+  ).trim().toLowerCase();
+  const hasVideoMediaValue = [
+    content.url,
+    content.file_url,
+    content.file_data,
+    nestedFile.url,
+    nestedFile.file_url,
+    nestedFile.file_data,
+    nestedFile.data,
+    nestedSource.url,
+    nestedSource.data,
+    nestedDocument.url,
+    nestedDocument.file_url,
+  ].some((value) => {
+    if (isPlainObject(value)) value = value.url;
+    if (typeof value !== 'string') return false;
+    const normalized = value.trim().toLowerCase();
+    if (normalized.startsWith('data:video/')) return true;
+    let pathname = normalized.split(/[?#]/, 1)[0] || normalized;
+    try {
+      pathname = new URL(value).pathname.toLowerCase();
+    } catch {}
+    return /\.(?:mp4|mov|mkv|avi|m4v|mpeg|mpg|webm|ogv)$/.test(pathname);
+  });
+  if (type === 'audio_url' || (!type && content.audio_url)) return KIMI_K3_AUDIO_URL_TOKENS;
+  if (type === 'input_audio' || type === 'audio') return KIMI_K3_AUDIO_TOKENS;
+  if (
+    type === 'video' ||
+    type === 'video_url' ||
+    type === 'input_video' ||
+    mediaType.startsWith('video/') ||
+    hasVideoMediaValue ||
+    'video_url' in content ||
+    'input_video' in content
+  ) return KIMI_K3_VIDEO_TOKENS;
+  if (
+    type === 'image' ||
+    type === 'image_url' ||
+    type === 'input_image' ||
+    'image_url' in content
+  ) return KIMI_K3_IMAGE_TOKENS;
+  if (
+    type === 'document' ||
+    type === 'input_file' ||
+    type === 'input_document' ||
+    'file_url' in content
+  ) return KIMI_K3_DOCUMENT_TOKENS;
+
+  for (const key of ['text', 'content', 'message']) {
+    if (typeof content[key] === 'string') return estimateKimiK3TextTokens(content[key]);
+  }
+  return estimateKimiK3TextTokens(JSON.stringify(content));
+}
+
+function estimatePrivateModeKimiK3PromptTokens(body) {
+  let tokens = 3;
+  for (const message of Array.isArray(body.messages) ? body.messages : []) {
+    if (!isPlainObject(message)) continue;
+    tokens += 3;
+    tokens += estimateKimiK3TextTokens(message.role);
+    tokens += estimateKimiK3TextTokens(message.name);
+    tokens += estimateKimiK3ContentTokens(message.content);
+    tokens += estimateKimiK3ContentTokens(message.prompt);
+    tokens += estimateKimiK3TextTokens(message.reasoning_content);
+    if (Array.isArray(message.tools)) {
+      tokens += estimateKimiK3TextTokens(JSON.stringify(message.tools));
+    }
+    if (message.function_call !== undefined) {
+      tokens += estimateKimiK3TextTokens(JSON.stringify(message.function_call));
+    }
+    if (message.tool_calls !== undefined) {
+      tokens += estimateKimiK3TextTokens(JSON.stringify(message.tool_calls));
+    }
+  }
+  if (Array.isArray(body.tools)) {
+    tokens += estimateKimiK3TextTokens(JSON.stringify(body.tools));
+  }
+  return tokens;
+}
+
 function isThinkingEnabled(thinking) {
   if (typeof thinking === 'boolean') return thinking;
   if (!isPlainObject(thinking)) return undefined;
@@ -123,8 +282,32 @@ function stripPrivateModeReasoningBlocks(value) {
     .replace(/◁think▷/g, '<think>')
     .replace(/◁\/think▷/g, '</think>')
     .replace(/<think>[\s\S]*?<\/think>\s*/gi, '')
+    .replace(/<thinking>[\s\S]*?<\/thinking>\s*/gi, '')
     .replace(/<previous_reasoning>[\s\S]*?<\/previous_reasoning>\s*/gi, '')
-    .trimStart();
+    .replace(/<(?:think|thinking|previous_reasoning)>[\s\S]*$/i, '');
+}
+
+function extractPrivateModeReasoningBlocks(value) {
+  const textValues = typeof value === 'string'
+    ? [value]
+    : Array.isArray(value)
+      ? value.flatMap((part) => (
+          isPlainObject(part) && part.type === 'text' && typeof part.text === 'string'
+            ? [part.text]
+            : []
+        ))
+      : [];
+  const reasoningParts = textValues.flatMap((text) => {
+    const normalized = text
+      .replace(/◁think▷/g, '<think>')
+      .replace(/◁\/think▷/g, '</think>');
+    return Array.from(
+      normalized.matchAll(/<(think|thinking|previous_reasoning)>([\s\S]*?)<\/\1>/gi),
+      (match) => match[2],
+    );
+  });
+  const reasoning = reasoningParts.join('');
+  return reasoning.trim() ? reasoning : undefined;
 }
 
 function stripPrivateModeReasoningFromContent(value) {
@@ -163,6 +346,441 @@ function stripPrivateModeReasoningFromMessages(body) {
   });
 }
 
+function normalizePrivateModeReasoningPayload(value) {
+  if (typeof value === 'string') return value.trim() ? value : undefined;
+  if (Array.isArray(value)) {
+    const joined = value
+      .map(normalizePrivateModeReasoningPayload)
+      .filter(Boolean)
+      .join('');
+    return joined || undefined;
+  }
+  if (!isPlainObject(value)) return undefined;
+  return normalizePrivateModeReasoningPayload(
+    value.text ?? value.content ?? value.reasoning_content ?? value.reasoning ?? value.thinking,
+  );
+}
+
+function normalizePrivateModeKimiK3ReasoningFromMessages(body) {
+  if (!Array.isArray(body.messages)) return;
+
+  body.messages = body.messages.map((message) => {
+    if (!isPlainObject(message) || message.role !== 'assistant') return message;
+
+    const normalized = { ...message };
+    const reasoningContent =
+      normalizePrivateModeReasoningPayload(message.reasoning_content) ??
+      normalizePrivateModeReasoningPayload(message.reasoning) ??
+      normalizePrivateModeReasoningPayload(message.thinking) ??
+      normalizePrivateModeReasoningPayload(message.reasoning_details) ??
+      extractPrivateModeReasoningBlocks(message.content) ??
+      extractPrivateModeReasoningBlocks(message.prompt);
+    delete normalized.reasoning;
+    delete normalized.reasoning_details;
+    delete normalized.thinking;
+    if (reasoningContent) normalized.reasoning_content = reasoningContent;
+    else delete normalized.reasoning_content;
+    if ('content' in normalized) {
+      normalized.content = stripPrivateModeReasoningFromContent(normalized.content);
+    }
+    if ('prompt' in normalized) {
+      normalized.prompt = stripPrivateModeReasoningFromContent(normalized.prompt);
+    }
+    return normalized;
+  });
+}
+
+function normalizePrivateModeKimiK3DynamicToolMessages(body) {
+  if (!Array.isArray(body.messages)) return;
+
+  body.messages = body.messages.flatMap((message) => {
+    if (!isPlainObject(message) || message.role !== 'system' || !Array.isArray(message.tools)) {
+      return [message];
+    }
+
+    const { tools, ...messageWithoutTools } = message;
+    const hasContent =
+      messageWithoutTools.content !== undefined &&
+      messageWithoutTools.content !== null &&
+      !(typeof messageWithoutTools.content === 'string' && messageWithoutTools.content.trim() === '');
+    const normalizedMessages = hasContent ? [messageWithoutTools] : [];
+    if (tools.length > 0) normalizedMessages.push({ role: 'system', tools });
+    return normalizedMessages;
+  });
+}
+
+function isPrivateModeKimiK3Model(model) {
+  return [model.upstreamModel, model.billingModel, ...(model.aliases || [])]
+    .some((value) => {
+      const normalized = String(value).trim().toLowerCase();
+      return normalized === 'kimi-k3' || normalized === 'tee/kimi-k3';
+    });
+}
+
+function getPrivateModeFunctionToolName(tool) {
+  if (!isPlainObject(tool) || tool.type !== 'function' || !isPlainObject(tool.function)) {
+    return undefined;
+  }
+  const name = tool.function.name;
+  return typeof name === 'string' && name.trim() ? name.trim() : undefined;
+}
+
+function getPrivateModeNamedToolChoiceName(toolChoice) {
+  if (!isPlainObject(toolChoice)) return undefined;
+  if (toolChoice.type !== undefined && String(toolChoice.type).toLowerCase() !== 'function') {
+    return undefined;
+  }
+  const name = isPlainObject(toolChoice.function)
+    ? toolChoice.function.name
+    : toolChoice.name;
+  return typeof name === 'string' && name.trim() ? name.trim() : undefined;
+}
+
+function normalizePrivateModeKimiK3NamedToolChoice(body) {
+  const selectedToolName = getPrivateModeNamedToolChoiceName(body.tool_choice);
+  if (!selectedToolName) return;
+
+  const dynamicTools = Array.isArray(body.messages)
+    ? body.messages.flatMap((message) => (
+      isPlainObject(message) && message.role === 'system' && Array.isArray(message.tools)
+        ? message.tools
+        : []
+    ))
+    : [];
+  const selectedTool = [
+    ...(Array.isArray(body.tools) ? body.tools : []),
+    ...dynamicTools,
+  ].find((tool) => getPrivateModeFunctionToolName(tool) === selectedToolName);
+  if (!selectedTool) return;
+
+  body.tools = [selectedTool];
+  body.tool_choice = 'required';
+  if (dynamicTools.length === 0 || !Array.isArray(body.messages)) return;
+  body.messages = body.messages.flatMap((message) => {
+    if (!isPlainObject(message) || message.role !== 'system' || !Array.isArray(message.tools)) {
+      return [message];
+    }
+    const { tools: _tools, ...messageWithoutTools } = message;
+    const hasContent =
+      messageWithoutTools.content !== undefined &&
+      messageWithoutTools.content !== null &&
+      !(typeof messageWithoutTools.content === 'string' && messageWithoutTools.content.trim() === '');
+    return hasContent ? [messageWithoutTools] : [];
+  });
+}
+
+function getKimiK3ReasoningEffortCandidate(value) {
+  return isPlainObject(value) ? value.effort : value;
+}
+
+function isKimiK3ReasoningOptOutCandidate(value) {
+  if (value === false) return true;
+  if (typeof value === 'string') {
+    const normalized = value.trim().toLowerCase();
+    return normalized === 'none' || normalized === 'off';
+  }
+  if (!isPlainObject(value)) return false;
+  const effort = String(value.effort || '').trim().toLowerCase();
+  const type = String(value.type || '').trim().toLowerCase();
+  return value.enabled === false ||
+    effort === 'none' ||
+    effort === 'off' ||
+    type === 'disabled' ||
+    type === 'off';
+}
+
+function coercePrivateModeBooleanFlag(value) {
+  if (typeof value === 'boolean') return value;
+  if (typeof value !== 'string') return undefined;
+  const normalized = value.trim().toLowerCase();
+  if (['true', '1', 'yes', 'on'].includes(normalized)) return true;
+  if (['false', '0', 'no', 'off'].includes(normalized)) return false;
+  return undefined;
+}
+
+export function normalizePrivateModelReasoningControls(body, model) {
+  if (!isPrivateModeKimiK3Model(model)) return body;
+  const includeReasoning = coercePrivateModeBooleanFlag(body.include_reasoning);
+  if (includeReasoning === undefined) return body;
+  const reasoning = isPlainObject(body.reasoning) ? { ...body.reasoning } : {};
+  if (includeReasoning) reasoning.enabled = true;
+  else reasoning.exclude = true;
+  body.reasoning = reasoning;
+  return body;
+}
+
+export function shouldSuppressPrivateModelReasoning(body, model) {
+  if (!isPrivateModeKimiK3Model(model)) return false;
+  return body.reasoningOptOut === true ||
+    body.exposeReasoning === false ||
+    body.materializeReasoning === false ||
+    coercePrivateModeBooleanFlag(body.include_reasoning) === false ||
+    [body.enable_thinking, body.thinking, body.reasoning_effort, body.reasoning]
+      .some((value) => isKimiK3ReasoningOptOutCandidate(value) || (
+        isPlainObject(value) && value.exclude === true
+      ));
+}
+
+function resolvePrivateModeKimiK3ReasoningEffort(body) {
+  const candidates = [
+    body.reasoningOptOut === true ? false : undefined,
+    body.exposeReasoning === false ? false : undefined,
+    body.materializeReasoning === false ? false : undefined,
+    body.enable_thinking,
+    body.thinking,
+    body.reasoning_effort,
+    body.reasoning,
+  ];
+  if (candidates.some(isKimiK3ReasoningOptOutCandidate)) return 'low';
+
+  const explicitEffort = candidates
+    .map(getKimiK3ReasoningEffortCandidate)
+    .find((value) => typeof value === 'string' && KIMI_K3_REASONING_EFFORT_LEVELS.has(value.trim().toLowerCase()));
+  const normalizedEffort = typeof explicitEffort === 'string'
+    ? explicitEffort.trim().toLowerCase()
+    : undefined;
+  const excludesReasoning = candidates.some((value) => isPlainObject(value) && value.exclude === true);
+  return excludesReasoning ? normalizedEffort ?? 'low' : normalizedEffort ?? 'max';
+}
+
+function applyPrivateModeKimiK3RequestParams(body) {
+  const reasoningEffort = resolvePrivateModeKimiK3ReasoningEffort(body);
+  const requestedMaxTokens = typeof body.max_tokens === 'number' && Number.isFinite(body.max_tokens)
+    ? body.max_tokens
+    : undefined;
+  const normalizedMaxTokens = requestedMaxTokens === undefined
+    ? reasoningEffort === 'max'
+      ? KIMI_K3_DEFAULT_MAX_COMPLETION_TOKENS
+      : KIMI_K3_STANDARD_DEFAULT_MAX_COMPLETION_TOKENS
+    : requestedMaxTokens < 0
+      ? KIMI_K3_MAX_COMPLETION_TOKENS
+      : requestedMaxTokens;
+  normalizePrivateModeKimiK3NamedToolChoice(body);
+  const promptTokenEstimate = estimatePrivateModeKimiK3PromptTokens(body);
+  const remainingContext = Math.max(
+    1,
+    KIMI_K3_CONTEXT_WINDOW_TOKENS -
+      promptTokenEstimate -
+      KIMI_K3_CONTEXT_SAFETY_MARGIN_TOKENS,
+  );
+
+  delete body.temperature;
+  delete body.top_p;
+  delete body.n;
+  delete body.frequency_penalty;
+  delete body.presence_penalty;
+  delete body.logit_bias;
+  delete body.thinking;
+  delete body.enable_thinking;
+  delete body.reasoning;
+  body.reasoning_effort = reasoningEffort;
+  body.max_tokens = Math.min(
+    Math.max(1, Math.floor(normalizedMaxTokens)),
+    remainingContext,
+  );
+}
+
+export function createPrivateModeReasoningContentSuppressor() {
+  const openTags = ['<think>', '<thinking>', '<previous_reasoning>', '◁think▷'];
+  const closeTags = ['</think>', '</thinking>', '</previous_reasoning>', '◁/think▷'];
+  const allTags = [...openTags, ...closeTags];
+  const maxTagLength = Math.max(...allTags.map((tag) => tag.length));
+  let buffered = '';
+  let insideReasoning = false;
+
+  const findEarliestTag = (text, tags) => {
+    let earliest = null;
+    const normalizedText = text.toLowerCase();
+    for (const tag of tags) {
+      const index = normalizedText.indexOf(tag.toLowerCase());
+      if (index >= 0 && (!earliest || index < earliest.index)) earliest = { index, tag };
+    }
+    return earliest;
+  };
+  const findPartialTagIndex = (text, tags) => {
+    const start = Math.max(0, text.length - maxTagLength + 1);
+    for (let index = start; index < text.length; index += 1) {
+      const suffix = text.slice(index).toLowerCase();
+      if (tags.some((tag) => {
+        const normalizedTag = tag.toLowerCase();
+        return normalizedTag.startsWith(suffix) && normalizedTag !== suffix;
+      })) return index;
+    }
+    return -1;
+  };
+
+  return {
+    process(value) {
+      let input = buffered + String(value || '');
+      buffered = '';
+      let output = '';
+      while (input) {
+        const tags = insideReasoning ? closeTags : openTags;
+        const match = findEarliestTag(input, tags);
+        if (match) {
+          if (!insideReasoning) output += input.slice(0, match.index);
+          input = input.slice(match.index + match.tag.length);
+          insideReasoning = !insideReasoning;
+          continue;
+        }
+        const partialIndex = findPartialTagIndex(input, tags);
+        if (!insideReasoning) {
+          output += partialIndex >= 0 ? input.slice(0, partialIndex) : input;
+        }
+        if (partialIndex >= 0) buffered = input.slice(partialIndex);
+        return output;
+      }
+      return output;
+    },
+    flush() {
+      const output = insideReasoning ? '' : buffered;
+      buffered = '';
+      return output;
+    },
+  };
+}
+
+export function splitCompleteSseFrames(buffer) {
+  const parts = buffer.split(/\r?\n\r?\n/);
+  return {
+    frames: parts.slice(0, -1).map((frame) => frame.replace(/\r\n/g, '\n')),
+    remainder: parts.at(-1) || '',
+  };
+}
+
+const PRIVATE_MODE_SSE_CHUNK_METADATA_FIELDS = [
+  'id',
+  'object',
+  'created',
+  'model',
+  'system_fingerprint',
+  'service_tier',
+];
+
+export function capturePrivateModeSseChunkMetadata(metadata, payload) {
+  if (!isPlainObject(metadata) || !isPlainObject(payload)) return metadata;
+  for (const field of PRIVATE_MODE_SSE_CHUNK_METADATA_FIELDS) {
+    if (payload[field] !== undefined) metadata[field] = payload[field];
+  }
+  return metadata;
+}
+
+export function buildPrivateModeSseContentDelta(content, metadata = {}) {
+  return JSON.stringify({
+    ...metadata,
+    choices: [{ index: 0, delta: { content } }],
+  });
+}
+
+export function suppressPrivateModeReasoningFromResponsePayload(
+  payload,
+  stripContent = stripPrivateModeReasoningBlocks,
+) {
+  if (!isPlainObject(payload)) {
+    throw new TypeError('Private Mode response payload must be an object.');
+  }
+  const targets = [
+    payload,
+    ...(Array.isArray(payload.choices) ? payload.choices : []),
+  ];
+  for (const target of targets) {
+    if (!isPlainObject(target)) continue;
+    const nestedTargets = [target, target.message, target.delta].filter(isPlainObject);
+    for (const nested of nestedTargets) {
+      for (const field of ASSISTANT_REASONING_MESSAGE_FIELDS) delete nested[field];
+      delete nested.thinking;
+      for (const field of ['content', 'text', 'output_text']) {
+        if (typeof nested[field] === 'string') {
+          nested[field] = stripContent(nested[field]);
+        } else if (Array.isArray(nested[field])) {
+          nested[field] = nested[field].map((part) => (
+            isPlainObject(part) && part.type === 'text' && typeof part.text === 'string'
+              ? { ...part, text: stripContent(part.text) }
+              : part
+          ));
+        }
+      }
+    }
+  }
+  return payload;
+}
+
+export function suppressPrivateModeReasoningFromJsonText(value) {
+  const parsed = JSON.parse(String(value));
+  suppressPrivateModeReasoningFromResponsePayload(parsed);
+  return JSON.stringify(parsed);
+}
+
+export function suppressPrivateModeReasoningFromSseFrame(frame, contentSuppressor, chunkMetadata) {
+  const lines = frame.split('\n');
+  const dataLineIndexes = lines.flatMap((line, index) => line.startsWith('data:') ? [index] : []);
+  if (dataLineIndexes.length === 0) {
+    const isCommentOnlyFrame =
+      lines.some((line) => line.startsWith(':')) &&
+      lines.every((line) => line === '' || line.startsWith(':'));
+    if (isCommentOnlyFrame) return frame;
+
+    // A stream request can still receive an ordinary JSON (or otherwise
+    // non-SSE) body. Reasoning opt-outs are a privacy boundary, so never pass
+    // a frame through unless its data payload can be parsed and sanitized.
+    return '';
+  }
+
+  const payload = dataLineIndexes
+    .map((index) => lines[index].slice('data:'.length).trim())
+    .join('\n')
+    .trim();
+  if (!payload) return frame;
+
+  const replaceDataPayload = (replacement) => lines
+    .flatMap((line, index) => {
+      if (index === dataLineIndexes[0]) return [`data: ${replacement}`];
+      return dataLineIndexes.includes(index) ? [] : [line];
+    })
+    .join('\n');
+
+  if (payload === '[DONE]') {
+    const flushedContent = contentSuppressor.flush();
+    if (!flushedContent) return frame;
+    const finalDelta = buildPrivateModeSseContentDelta(flushedContent, chunkMetadata);
+    return `data: ${finalDelta}\n\n${replaceDataPayload('[DONE]')}`;
+  }
+
+  try {
+    const parsed = JSON.parse(payload);
+    capturePrivateModeSseChunkMetadata(chunkMetadata, parsed);
+    suppressPrivateModeReasoningFromResponsePayload(
+      parsed,
+      (content) => contentSuppressor.process(content),
+    );
+    const terminalChoice = Array.isArray(parsed.choices) && parsed.choices.find(
+      (choice) => choice && choice.finish_reason !== undefined && choice.finish_reason !== null,
+    );
+    if (!terminalChoice) return replaceDataPayload(JSON.stringify(parsed));
+
+    const flushedContent = contentSuppressor.flush();
+    if (!flushedContent) return replaceDataPayload(JSON.stringify(parsed));
+
+    let visibleContent = '';
+    if (isPlainObject(terminalChoice.delta) && typeof terminalChoice.delta.content === 'string') {
+      visibleContent = terminalChoice.delta.content;
+      terminalChoice.delta.content = '';
+    } else if (typeof terminalChoice.text === 'string') {
+      visibleContent = terminalChoice.text;
+      terminalChoice.text = '';
+    }
+    const finalDelta = buildPrivateModeSseContentDelta(
+      `${visibleContent}${flushedContent}`,
+      chunkMetadata,
+    );
+    return `data: ${finalDelta}\n\n${replaceDataPayload(JSON.stringify(parsed))}`;
+  } catch {
+    // Reasoning opt-outs are a privacy boundary. Never pass an unparseable
+    // upstream data frame through because it may contain unsanitized reasoning.
+    return '';
+  }
+}
+
 function buildJsonSchemaPromptSuffix(responseFormat) {
   if (!isPlainObject(responseFormat?.json_schema)) return null;
   const schemaWrapper = responseFormat.json_schema;
@@ -240,12 +858,20 @@ function normalizeStreamOptions(body) {
 }
 
 export function applyPrivateModelRequestMutations(body, model) {
-  stripPrivateModeReasoningFromMessages(body);
+  if (isPrivateModeKimiK3Model(model)) {
+    normalizePrivateModelReasoningControls(body, model);
+    normalizePrivateModeKimiK3ReasoningFromMessages(body);
+    normalizePrivateModeKimiK3DynamicToolMessages(body);
+  } else {
+    stripPrivateModeReasoningFromMessages(body);
+  }
   normalizeMaxTokenAliases(body);
-
   body.model = model.upstreamModel;
   normalizeStreamOptions(body);
   applyTinfoilCompatibilityMutations(body, model);
+  if (isPrivateModeKimiK3Model(model)) {
+    applyPrivateModeKimiK3RequestParams(body);
+  }
 
   if (model.thinkingMode === 'gemma') {
     body.chat_template_kwargs = {
@@ -254,7 +880,7 @@ export function applyPrivateModelRequestMutations(body, model) {
     };
     delete body.thinking;
     delete body.reasoning_effort;
-  } else if (model.thinkingMode === 'kimi-k2.6' || model.thinkingMode === 'glm-5.2') {
+  } else if (model.thinkingMode === 'glm-5.2') {
     const thinkingEnabled = shouldEnableThinking(body, model);
     body.chat_template_kwargs = {
       ...mergeChatTemplateKwargs(body),

package/lib/secureClientLifecycle.js

@@ -1,13 +1,15 @@
 const DEFAULT_SECURE_CLIENT_IDLE_RESET_MS = 5 * 60 * 1000;
+const EHBP_RESPONSE_NONCE_HEADER = 'ehbp-response-nonce';
 
 function readSecureClientIdleResetMs() {
-  const parsed = Number(process.env.NANOGPT_PRIVATE_CLIENT_IDLE_RESET_MS || '');
-  if (Number.isFinite(parsed) && parsed > 0) return Math.floor(parsed);
+  const configured = process.env.NANOGPT_PRIVATE_CLIENT_IDLE_RESET_MS?.trim();
+  const parsed = configured ? Number(configured) : Number.NaN;
+  if (Number.isFinite(parsed) && parsed >= 0) return Math.floor(parsed);
   return DEFAULT_SECURE_CLIENT_IDLE_RESET_MS;
 }
 
 export function createSecureState(apiBase, options = {}) {
-  const idleResetMs = Number.isFinite(options.idleResetMs) && options.idleResetMs > 0
+  const idleResetMs = Number.isFinite(options.idleResetMs) && options.idleResetMs >= 0
     ? Math.floor(options.idleResetMs)
     : readSecureClientIdleResetMs();
   const loadTinfoil = options.loadTinfoil || (() => import('tinfoil'));
@@ -24,8 +26,10 @@ export function createSecureState(apiBase, options = {}) {
     const idleMs = clientState ? nowMs - clientState.lastUsedAtMs : 0;
     if (
       clientState?.userCacheSecret === userCacheSecret
-      && idleMs >= 0
-      && idleMs < idleResetMs
+      && (
+        idleResetMs === 0
+        || (idleMs >= 0 && idleMs < idleResetMs)
+      )
     ) {
       clientState.lastUsedAtMs = nowMs;
       return clientState.promise;
@@ -74,6 +78,11 @@ export function createSecureState(apiBase, options = {}) {
 
   return {
     getClient,
+    markClientUsed(client) {
+      if (!clientState || clientState.client !== client) return false;
+      clientState.lastUsedAtMs = now();
+      return true;
+    },
     invalidateClient(client) {
       if (!clientState) return false;
       if (client && clientState.client !== client) return false;
@@ -94,6 +103,10 @@ export function createSecureState(apiBase, options = {}) {
 
 export async function isMissingEncryptedBodyHeaderResponse(response) {
   if (response?.status !== 400) return false;
+  // Only NanoGPT's plaintext pre-dispatch rejection is safe to retry. An EHBP
+  // nonce means the response came back through the encrypted provider path, so
+  // the original request may already have been processed.
+  if (response.headers.has(EHBP_RESPONSE_NONCE_HEADER)) return false;
   try {
     const data = await response.clone().json();
     return data?.error?.code === 'missing_encrypted_body_header';
@@ -104,6 +117,7 @@ export async function isMissingEncryptedBodyHeaderResponse(response) {
 
 export async function fetchWithSecureClientRecovery({
   fetchWithClient,
+  onResponseClient,
   secureState,
   shouldInvalidateError = () => true,
   userCacheSecret,
@@ -118,6 +132,7 @@ export async function fetchWithSecureClientRecovery({
         secureState.invalidateClient(client);
         continue;
       }
+      onResponseClient?.(client);
       return response;
     }
   } catch (error) {

package/lib/server.js

@@ -6,7 +6,15 @@ import {
   buildPrivateModeOriginPolicy,
   getCorsHeadersForRequest,
 } from './originPolicy.js';
-import { applyPrivateModelRequestMutations } from './requestTransforms.js';
+import {
+  applyPrivateModelRequestMutations,
+  buildPrivateModeSseContentDelta,
+  createPrivateModeReasoningContentSuppressor,
+  shouldSuppressPrivateModelReasoning,
+  splitCompleteSseFrames,
+  suppressPrivateModeReasoningFromSseFrame,
+  suppressPrivateModeReasoningFromJsonText,
+} from './requestTransforms.js';
 import {
   normalizePrivateModeUpstreamErrorMessage,
   readErrorMessage,
@@ -68,6 +76,7 @@ function openAIModelList() {
       object: 'model',
       created: model.created,
       owned_by: model.ownedBy,
+      ...(model.maxOutputTokens ? { max_output_tokens: model.maxOutputTokens } : {}),
     })),
   };
 }
@@ -264,6 +273,7 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
     return;
   }
 
+  const suppressReasoning = shouldSuppressPrivateModelReasoning(body, model);
   applyPrivateModelRequestMutations(body, model);
   const privateStreamRequested = body.stream === true;
 
@@ -281,6 +291,7 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
   }
 
   let response;
+  let responseClient;
   const upstreamAbortController = new AbortController();
   let responseComplete = false;
   res.on('close', () => {
@@ -307,6 +318,9 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
         body: privateRequestBody,
         signal: upstreamAbortController.signal,
       }),
+      onResponseClient: (client) => {
+        responseClient = client;
+      },
     });
   } catch (error) {
     responseComplete = true;
@@ -342,12 +356,19 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
         code: 'private_mode_upstream_failed',
       },
     }, errorHeaders);
+    secureState.markClientUsed(responseClient);
     return;
   }
 
   if (privateStreamRequested && response.body) {
     res.writeHead(response.status, headers);
     const reader = response.body.getReader();
+    const decoder = suppressReasoning ? new TextDecoder() : null;
+    const contentSuppressor = suppressReasoning
+      ? createPrivateModeReasoningContentSuppressor()
+      : null;
+    const sseChunkMetadata = {};
+    let sseBuffer = '';
     let streamFailed = false;
     try {
       while (true) {
@@ -358,7 +379,28 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
           upstreamAbortController.abort();
           return;
         }
-        if (value) res.write(Buffer.from(value));
+        if (!value) continue;
+        if (!suppressReasoning || !decoder || !contentSuppressor) {
+          res.write(Buffer.from(value));
+          continue;
+        }
+        sseBuffer += decoder.decode(value, { stream: true });
+        const { frames, remainder } = splitCompleteSseFrames(sseBuffer);
+        sseBuffer = remainder;
+        for (const frame of frames) {
+          res.write(`${suppressPrivateModeReasoningFromSseFrame(frame, contentSuppressor, sseChunkMetadata)}\n\n`);
+        }
+      }
+      if (suppressReasoning && decoder && contentSuppressor) {
+        sseBuffer += decoder.decode();
+        if (sseBuffer) {
+          res.write(`${suppressPrivateModeReasoningFromSseFrame(sseBuffer, contentSuppressor, sseChunkMetadata)}\n\n`);
+        }
+        const flushedContent = contentSuppressor.flush();
+        if (flushedContent) {
+          const finalDelta = buildPrivateModeSseContentDelta(flushedContent, sseChunkMetadata);
+          res.write(`data: ${finalDelta}\n\n`);
+        }
       }
     } catch (error) {
       streamFailed = true;
@@ -369,12 +411,32 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
       return;
     } finally {
       responseComplete = true;
+      if (!streamFailed) secureState.markClientUsed(responseClient);
       if (!streamFailed && !res.writableEnded && !res.destroyed) res.end();
     }
     return;
   }
 
-  const responseBody = Buffer.from(await response.arrayBuffer());
+  let responseBody = Buffer.from(await response.arrayBuffer());
+  if (suppressReasoning) {
+    try {
+      responseBody = Buffer.from(
+        suppressPrivateModeReasoningFromJsonText(responseBody.toString('utf8')),
+      );
+    } catch {
+      secureState.markClientUsed(responseClient);
+      responseComplete = true;
+      jsonResponse(res, 502, {
+        error: {
+          message: 'Private Mode upstream returned an invalid response.',
+          type: 'api_error',
+          code: 'private_mode_invalid_response',
+        },
+      }, corsHeaders);
+      return;
+    }
+  }
+  secureState.markClientUsed(responseClient);
   headers['content-length'] = String(responseBody.length);
   responseComplete = true;
   res.writeHead(response.status, headers);

package/lib/serverErrorNormalization.js

@@ -1,8 +1,12 @@
 // Keep user-facing upstream error classification in sync with
-// lib/privateMode/tinfoilBrowserClient.ts. Never expose decrypted upstream
-// response bodies or exception text to local proxy clients.
+// lib/privateMode/tinfoilBrowserClient.ts. Only surface sanitized client-error
+// messages from responses that completed the verified Private Mode transport.
 const MISSING_EHBP_RESPONSE_NONCE_PATTERN = /missing\s+ehbp-response-nonce\s+header/i;
+const EHBP_RESPONSE_NONCE_HEADER = 'ehbp-response-nonce';
 const PRIVATE_MODE_REFUND_NOTICE = 'Any reserved balance will be released or refunded.';
+const MAX_UPSTREAM_ERROR_BODY_BYTES = 16 * 1024;
+const MAX_UPSTREAM_ERROR_MESSAGE_CHARS = 1_000;
+const HIDDEN_PROVIDER_NAME_PATTERN = /\b(?:openrouter|spoke\s*ai|aihubmix|ollama|mimas|comet|azure|digital\s*ocean|axionic|whale\s*ai|langfork)\b/gi;
 
 export function privateModeProviderFailureMessage(status) {
   if (status === 429) {
@@ -19,12 +23,109 @@ export function normalizePrivateModeUpstreamErrorMessage(message, fallback) {
   return privateModeProviderFailureMessage();
 }
 
-export async function readErrorMessage(response, fallback) {
-  void fallback;
+function sanitizeUpstreamErrorMessage(value) {
+  if (typeof value !== 'string') return null;
+  const normalized = value
+    .replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .replace(HIDDEN_PROVIDER_NAME_PATTERN, 'upstream service')
+    .trim();
+  if (!normalized) return null;
+  const characters = Array.from(normalized);
+  if (characters.length <= MAX_UPSTREAM_ERROR_MESSAGE_CHARS) return normalized;
+  return `${characters.slice(0, MAX_UPSTREAM_ERROR_MESSAGE_CHARS - 1).join('').trimEnd()}…`;
+}
+
+async function discardResponseBody(response) {
   try {
     await response?.body?.cancel();
   } catch {
-    // The body may already be locked or closed. Its contents remain discarded.
+    // The body may already be locked or closed.
+  }
+}
+
+async function readLimitedResponseText(response) {
+  const contentLength = Number(response?.headers?.get?.('content-length') || '');
+  if (Number.isFinite(contentLength) && contentLength > MAX_UPSTREAM_ERROR_BODY_BYTES) {
+    await discardResponseBody(response);
+    return null;
+  }
+
+  const reader = response?.body?.getReader?.();
+  if (!reader) return null;
+  const decoder = new TextDecoder();
+  let bytesRead = 0;
+  let text = '';
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytesRead += value?.byteLength || 0;
+      if (bytesRead > MAX_UPSTREAM_ERROR_BODY_BYTES) {
+        await reader.cancel().catch(() => undefined);
+        return null;
+      }
+      if (value) text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+    return text;
+  } catch {
+    await reader.cancel().catch(() => undefined);
+    return null;
+  } finally {
+    reader.releaseLock();
   }
-  return privateModeProviderFailureMessage(response?.status);
+}
+
+function extractStructuredErrorMessage(data) {
+  if (!data || typeof data !== 'object' || Array.isArray(data)) return null;
+  const nestedError = data.error && typeof data.error === 'object' && !Array.isArray(data.error)
+    ? data.error
+    : null;
+  const candidates = [
+    nestedError?.message,
+    typeof data.error === 'string' ? data.error : null,
+    data.message,
+    data.detail,
+  ];
+  for (const candidate of candidates) {
+    const sanitized = sanitizeUpstreamErrorMessage(candidate);
+    if (sanitized) return sanitized;
+  }
+  return null;
+}
+
+export async function readErrorMessage(response, fallback) {
+  void fallback;
+  const status = Number(response?.status);
+  const contentType = String(response?.headers?.get?.('content-type') || '').toLowerCase();
+  const mediaType = contentType.split(';', 1)[0]?.trim() || '';
+  const isJsonMediaType = mediaType === 'application/json' || mediaType.endsWith('+json');
+  const mayExposeClientError = (
+    response?.headers?.get?.('x-nanogpt-private-mode') === 'tinfoil'
+    && response?.headers?.has?.(EHBP_RESPONSE_NONCE_HEADER)
+    && (status === 400 || status === 422)
+    && (isJsonMediaType || mediaType === 'text/plain')
+  );
+
+  if (!mayExposeClientError) {
+    await discardResponseBody(response);
+    return privateModeProviderFailureMessage(status);
+  }
+
+  const body = await readLimitedResponseText(response);
+  let message = null;
+  if (body !== null && isJsonMediaType) {
+    try {
+      message = extractStructuredErrorMessage(JSON.parse(body));
+    } catch {
+      message = null;
+    }
+  } else if (body !== null) {
+    message = sanitizeUpstreamErrorMessage(body);
+  }
+
+  return message
+    ? `Private Mode request was rejected: ${message} — ${PRIVATE_MODE_REFUND_NOTICE}`
+    : privateModeProviderFailureMessage(status);
 }

package/models/private-tee.json

@@ -1,14 +1,14 @@
 [
   {
-    "id": "private/kimi-k2-6",
-    "name": "Kimi K2.6 Private",
-    "upstreamModel": "kimi-k2-6",
-    "billingModel": "TEE/kimi-k2-6",
-    "teeTargetModel": "kimi-k2-6",
-    "thinkingMode": "kimi-k2.6",
-    "created": 1764547200,
+    "id": "private/kimi-k3",
+    "name": "Kimi K3 Private",
+    "upstreamModel": "kimi-k3",
+    "billingModel": "TEE/kimi-k3",
+    "teeTargetModel": "kimi-k3",
+    "maxOutputTokens": 1048576,
+    "created": 1786147200,
     "ownedBy": "nanogpt-private-mode",
-    "aliases": ["private/kimi-k2.6", "TEE/kimi-k2-6", "TEE/kimi-k2.6"]
+    "aliases": ["TEE/kimi-k3"]
   },
   {
     "id": "private/gpt-oss-120b",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanogpt/private-mode",
-  "version": "0.2.2",
+  "version": "0.2.5",
   "description": "OpenAI-compatible localhost proxy for NanoGPT Private Mode.",
   "type": "module",
   "publishConfig": {
@@ -23,6 +23,9 @@
     "models",
     "README.md"
   ],
+  "scripts": {
+    "start": "node ./bin/nanogpt-private-mode.js"
+  },
   "dependencies": {
     "ai": "6.0.220",
     "tinfoil": "1.1.12"
@@ -30,8 +33,5 @@
   "engines": {
     "node": ">=22"
   },
-  "license": "MIT",
-  "scripts": {
-    "start": "node ./bin/nanogpt-private-mode.js"
-  }
-}
+  "license": "MIT"
+}