@oh-my-pi/pi-ai 16.2.0 → 16.2.2

package/src/registry/oauth/github-copilot.ts

@@ -12,6 +12,7 @@ import {
 	normalizeGitHubCopilotEnterpriseDomain,
 	OPENCODE_HEADERS,
 } from "@oh-my-pi/pi-catalog/wire/github-copilot";
+import * as AIError from "../../error";
 import type { FetchImpl } from "../../types";
 import type { OAuthCredentials } from "./types";
 
@@ -63,7 +64,7 @@ async function fetchJson(url: string, init: RequestInit, fetchImpl: FetchImpl):
 	const response = await fetchImpl(url, init);
 	if (!response.ok) {
 		const text = await response.text();
-		throw new Error(`${response.status} ${response.statusText}: ${text}`);
+		throw new AIError.ProviderHttpError(`${response.status} ${response.statusText}: ${text}`, response.status);
 	}
 	return response.json();
 }
@@ -88,7 +89,7 @@ async function startDeviceFlow(domain: string, fetchImpl: FetchImpl): Promise<De
 	);
 
 	if (!data || typeof data !== "object") {
-		throw new Error("Invalid device code response");
+		throw new AIError.OAuthError("Invalid device code response", { kind: "validation", provider: "github-copilot" });
 	}
 
 	const deviceCode = (data as Record<string, unknown>).device_code;
@@ -104,7 +105,10 @@ async function startDeviceFlow(domain: string, fetchImpl: FetchImpl): Promise<De
 		typeof interval !== "number" ||
 		typeof expiresIn !== "number"
 	) {
-		throw new Error("Invalid device code response fields");
+		throw new AIError.OAuthError("Invalid device code response fields", {
+			kind: "validation",
+			provider: "github-copilot",
+		});
 	}
 
 	return {
@@ -134,7 +138,7 @@ async function pollForGitHubAccessToken(
 
 	while (Date.now() < deadline) {
 		if (signal?.aborted) {
-			throw new Error("Login cancelled");
+			throw new AIError.LoginCancelledError();
 		}
 
 		const remainingMs = deadline - Date.now();
@@ -142,7 +146,7 @@ async function pollForGitHubAccessToken(
 		try {
 			await scheduler.wait(waitMs, { signal });
 		} catch {
-			throw new Error("Login cancelled");
+			throw new AIError.LoginCancelledError();
 		}
 
 		const raw = await fetchJson(
@@ -184,17 +188,21 @@ async function pollForGitHubAccessToken(
 			}
 
 			const descriptionSuffix = description ? `: ${description}` : "";
-			throw new Error(`Device flow failed: ${error}${descriptionSuffix}`);
+			throw new AIError.OAuthError(`Device flow failed: ${error}${descriptionSuffix}`, {
+				kind: "polling",
+				provider: "github-copilot",
+			});
 		}
 	}
 
 	if (slowDownResponses > 0) {
-		throw new Error(
+		throw new AIError.OAuthError(
 			"Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.",
+			{ kind: "timeout", provider: "github-copilot" },
 		);
 	}
 
-	throw new Error("Device flow timed out");
+	throw new AIError.OAuthError("Device flow timed out", { kind: "timeout", provider: "github-copilot" });
 }
 
 /** Far-future expiry (10 years). GitHub OAuth tokens are long-lived; no JWT exchange needed. */
@@ -314,13 +322,16 @@ export async function loginGitHubCopilot(options: GitHubCopilotLoginOptions): Pr
 	});
 
 	if (options.signal?.aborted) {
-		throw new Error("Login cancelled");
+		throw new AIError.LoginCancelledError();
 	}
 
 	const trimmed = input.trim();
 	const normalizedDomain = normalizeDomain(input);
 	if (trimmed && !normalizedDomain) {
-		throw new Error("Invalid GitHub Enterprise URL/domain");
+		throw new AIError.OAuthError("Invalid GitHub Enterprise URL/domain", {
+			kind: "validation",
+			provider: "github-copilot",
+		});
 	}
 	const enterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(normalizedDomain ?? undefined);
 	const domain =

package/src/registry/oauth/gitlab-duo-workflow.ts

@@ -1,3 +1,4 @@
+import * as AIError from "../../error";
 import type { FetchImpl } from "../../types";
 import { OAuthCallbackFlow } from "./callback-server";
 import { generatePKCE } from "./pkce";
@@ -20,7 +21,10 @@ function mapTokenResponse(payload: {
 	created_at?: number;
 }): OAuthCredentials {
 	if (!payload.access_token || !payload.refresh_token || typeof payload.expires_in !== "number") {
-		throw new Error("GitLab Duo Workflow OAuth token response missing required fields");
+		throw new AIError.OAuthError("GitLab Duo Workflow OAuth token response missing required fields", {
+			kind: "validation",
+			provider: "gitlab-duo-workflow",
+		});
 	}
 
 	const createdAtMs =
@@ -82,8 +86,9 @@ class GitLabDuoWorkflowOAuthFlow extends OAuthCallbackFlow {
 		});
 
 		if (!response.ok) {
-			throw new Error(
+			throw new AIError.OAuthError(
 				`GitLab Duo Workflow OAuth token exchange failed: ${response.status} ${await response.text()}`,
+				{ kind: "token-exchange", provider: "gitlab-duo-workflow", status: response.status },
 			);
 		}
 
@@ -120,7 +125,14 @@ export async function refreshGitLabDuoWorkflowToken(
 	});
 
 	if (!response.ok) {
-		throw new Error(`GitLab Duo Workflow OAuth refresh failed: ${response.status} ${await response.text()}`);
+		throw new AIError.OAuthError(
+			`GitLab Duo Workflow OAuth refresh failed: ${response.status} ${await response.text()}`,
+			{
+				kind: "token-refresh",
+				provider: "gitlab-duo-workflow",
+				status: response.status,
+			},
+		);
 	}
 
 	return mapTokenResponse(

package/src/registry/oauth/gitlab-duo.ts

@@ -1,3 +1,4 @@
+import * as AIError from "../../error";
 import { clearGitLabDuoDirectAccessCache } from "../../providers/gitlab-duo";
 import type { FetchImpl } from "../../types";
 import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
@@ -59,15 +60,24 @@ function resolveCallbackOptions(): OAuthCallbackFlowOptions {
 	try {
 		parsed = new URL(raw);
 	} catch {
-		throw new Error(`Invalid GITLAB_REDIRECT_URI: ${raw}`);
+		throw new AIError.OAuthError(`Invalid GITLAB_REDIRECT_URI: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo",
+		});
 	}
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-		throw new Error(`GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw}`);
+		throw new AIError.OAuthError(`GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo",
+		});
 	}
 
 	const isLoopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
 	if (isLoopback && parsed.protocol !== "http:") {
-		throw new Error(`GITLAB_REDIRECT_URI loopback callbacks must use http://, got: ${raw}`);
+		throw new AIError.OAuthError(`GITLAB_REDIRECT_URI loopback callbacks must use http://, got: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo",
+		});
 	}
 
 	const port = parsed.port ? Number.parseInt(parsed.port, 10) : parsed.protocol === "https:" ? 443 : 80;
@@ -87,7 +97,10 @@ function mapTokenResponse(payload: {
 	created_at?: number;
 }): OAuthCredentials {
 	if (!payload.access_token || !payload.refresh_token || typeof payload.expires_in !== "number") {
-		throw new Error("GitLab OAuth token response missing required fields");
+		throw new AIError.OAuthError("GitLab OAuth token response missing required fields", {
+			kind: "validation",
+			provider: "gitlab-duo",
+		});
 	}
 
 	const createdAtMs =
@@ -148,7 +161,14 @@ class GitLabDuoOAuthFlow extends OAuthCallbackFlow {
 		});
 
 		if (!response.ok) {
-			throw new Error(`GitLab OAuth token exchange failed: ${response.status} ${await response.text()}`);
+			throw new AIError.OAuthError(
+				`GitLab OAuth token exchange failed: ${response.status} ${await response.text()}`,
+				{
+					kind: "token-exchange",
+					provider: "gitlab-duo",
+					status: response.status,
+				},
+			);
 		}
 
 		clearGitLabDuoDirectAccessCache();
@@ -183,7 +203,11 @@ export async function refreshGitLabDuoToken(credentials: OAuthCredentials): Prom
 	});
 
 	if (!response.ok) {
-		throw new Error(`GitLab OAuth refresh failed: ${response.status} ${await response.text()}`);
+		throw new AIError.OAuthError(`GitLab OAuth refresh failed: ${response.status} ${await response.text()}`, {
+			kind: "token-refresh",
+			provider: "gitlab-duo",
+			status: response.status,
+		});
 	}
 
 	clearGitLabDuoDirectAccessCache();

package/src/registry/oauth/google-antigravity.ts

@@ -3,6 +3,7 @@
  * Uses different OAuth credentials than google-gemini-cli for access to additional models.
  */
 import { getAntigravityUserAgent } from "@oh-my-pi/pi-catalog/wire/gemini-headers";
+import * as AIError from "../../error";
 import { runGoogleOAuthLogin } from "./google-oauth-shared";
 import type { OAuthController, OAuthCredentials } from "./types";
 
@@ -89,7 +90,10 @@ async function onboardProjectWithRetries(
 
 		if (!onboardResponse.ok) {
 			const errorText = await onboardResponse.text();
-			throw new Error(`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`);
+			throw new AIError.OAuthError(
+				`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`,
+				{ kind: "provisioning", status: onboardResponse.status },
+			);
 		}
 
 		const operation = (await onboardResponse.json()) as LongRunningOperationResponse;
@@ -103,8 +107,9 @@ async function onboardProjectWithRetries(
 		}
 	}
 
-	throw new Error(
+	throw new AIError.OAuthError(
 		`onboardUser did not return a provisioned project id after ${PROJECT_ONBOARD_MAX_ATTEMPTS} attempts`,
+		{ kind: "provisioning" },
 	);
 }
 
@@ -128,7 +133,10 @@ async function discoverProject(accessToken: string, onProgress?: (message: strin
 
 		if (!loadResponse.ok) {
 			const errorText = await loadResponse.text();
-			throw new Error(`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`);
+			throw new AIError.OAuthError(
+				`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`,
+				{ kind: "discovery", status: loadResponse.status },
+			);
 		}
 
 		const loadPayload = (await loadResponse.json()) as LoadCodeAssistPayload;
@@ -146,8 +154,9 @@ async function discoverProject(accessToken: string, onProgress?: (message: strin
 		const provisionedProject = await onboardProjectWithRetries(endpoint, headers, onboardBody, onProgress);
 		return provisionedProject;
 	} catch (error) {
-		throw new Error(
+		throw new AIError.OAuthError(
 			`Could not discover or provision an Antigravity project. ${error instanceof Error ? error.message : String(error)}`,
+			{ kind: "discovery", cause: error },
 		);
 	}
 }
@@ -182,7 +191,7 @@ export async function refreshAntigravityToken(refreshToken: string, projectId: s
 
 	if (!response.ok) {
 		const error = await response.text();
-		throw new Error(`Antigravity token refresh failed: ${error}`);
+		throw new AIError.OAuthError(`Antigravity token refresh failed: ${error}`, { kind: "token-refresh" });
 	}
 
 	const data = (await response.json()) as {

package/src/registry/oauth/google-gemini-cli.ts

@@ -5,6 +5,7 @@
 
 import { getGeminiCliHeaders } from "@oh-my-pi/pi-catalog/wire/gemini-headers";
 import { $env } from "@oh-my-pi/pi-utils";
+import * as AIError from "../../error";
 import { runGoogleOAuthLogin } from "./google-oauth-shared";
 import type { OAuthController, OAuthCredentials } from "./types";
 
@@ -80,7 +81,11 @@ async function pollOperation(
 		});
 
 		if (!response.ok) {
-			throw new Error(`Failed to poll operation: ${response.status} ${response.statusText}`);
+			throw new AIError.OAuthError(`Failed to poll operation: ${response.status} ${response.statusText}`, {
+				kind: "polling",
+				provider: "google-gemini-cli",
+				status: response.status,
+			});
 		}
 
 		const data = (await response.json()) as LongRunningOperationResponse;
@@ -130,7 +135,10 @@ async function discoverProject(accessToken: string, onProgress?: (message: strin
 			data = { currentTier: { id: TIER_STANDARD } };
 		} else {
 			const errorText = await loadResponse.text();
-			throw new Error(`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`);
+			throw new AIError.OAuthError(
+				`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`,
+				{ kind: "discovery", provider: "google-gemini-cli", status: loadResponse.status },
+			);
 		}
 	} else {
 		data = (await loadResponse.json()) as LoadCodeAssistPayload;
@@ -143,9 +151,10 @@ async function discoverProject(accessToken: string, onProgress?: (message: strin
 		if (envProjectId) {
 			return envProjectId;
 		}
-		throw new Error(
+		throw new AIError.OAuthError(
 			"This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. " +
 				"See https://goo.gle/gemini-cli-auth-docs#workspace-gca",
+			{ kind: "configuration", provider: "google-gemini-cli" },
 		);
 	}
 
@@ -153,9 +162,10 @@ async function discoverProject(accessToken: string, onProgress?: (message: strin
 	const tierId = tier?.id ?? TIER_FREE;
 
 	if (tierId !== TIER_FREE && !envProjectId) {
-		throw new Error(
+		throw new AIError.OAuthError(
 			"This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. " +
 				"See https://goo.gle/gemini-cli-auth-docs#workspace-gca",
+			{ kind: "configuration", provider: "google-gemini-cli" },
 		);
 	}
 
@@ -183,7 +193,10 @@ async function discoverProject(accessToken: string, onProgress?: (message: strin
 
 	if (!onboardResponse.ok) {
 		const errorText = await onboardResponse.text();
-		throw new Error(`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`);
+		throw new AIError.OAuthError(
+			`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`,
+			{ kind: "provisioning", provider: "google-gemini-cli", status: onboardResponse.status },
+		);
 	}
 
 	let lroData = (await onboardResponse.json()) as LongRunningOperationResponse;
@@ -201,10 +214,11 @@ async function discoverProject(accessToken: string, onProgress?: (message: strin
 		return envProjectId;
 	}
 
-	throw new Error(
+	throw new AIError.OAuthError(
 		"Could not discover or provision a Google Cloud project. " +
 			"Try setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. " +
 			"See https://goo.gle/gemini-cli-auth-docs#workspace-gca",
+		{ kind: "validation", provider: "google-gemini-cli" },
 	);
 }
 
@@ -238,7 +252,10 @@ export async function refreshGoogleCloudToken(refreshToken: string, projectId: s
 
 	if (!response.ok) {
 		const error = await response.text();
-		throw new Error(`Google Cloud token refresh failed: ${error}`);
+		throw new AIError.OAuthError(`Google Cloud token refresh failed: ${error}`, {
+			kind: "token-refresh",
+			provider: "google-gemini-cli",
+		});
 	}
 
 	const data = (await response.json()) as {

package/src/registry/oauth/google-oauth-shared.ts

@@ -4,6 +4,7 @@
  * Both providers use the same authorization-code flow shape; only the client
  * credentials, scopes, endpoint constants, and project-discovery logic differ.
  */
+import * as AIError from "../../error";
 import { extractGoogleValidationUrl, formatGoogleValidationRequiredMessage } from "../../utils/google-validation";
 import { OAuthCallbackFlow } from "./callback-server";
 import type { OAuthController, OAuthCredentials } from "./types";
@@ -79,7 +80,7 @@ export class GoogleOAuthFlow extends OAuthCallbackFlow {
 
 		if (!tokenResponse.ok) {
 			const error = await tokenResponse.text();
-			throw new Error(`Token exchange failed: ${error}`);
+			throw new AIError.OAuthError(`Token exchange failed: ${error}`, { kind: "token-exchange" });
 		}
 
 		const tokenData = (await tokenResponse.json()) as {
@@ -89,7 +90,7 @@ export class GoogleOAuthFlow extends OAuthCallbackFlow {
 		};
 
 		if (!tokenData.refresh_token) {
-			throw new Error("No refresh token received. Please try again.");
+			throw new AIError.OAuthError("No refresh token received. Please try again.", { kind: "validation" });
 		}
 
 		this.ctrl.onProgress?.("Getting user info...");
@@ -100,7 +101,9 @@ export class GoogleOAuthFlow extends OAuthCallbackFlow {
 		} catch (err) {
 			const validationUrl = extractGoogleValidationUrl(err instanceof Error ? err.message : String(err));
 			if (!validationUrl) throw err;
-			throw new Error(formatGoogleValidationRequiredMessage(validationUrl, "sign in again", email));
+			throw new AIError.OAuthError(formatGoogleValidationRequiredMessage(validationUrl, "sign in again", email), {
+				kind: "validation",
+			});
 		}
 
 		return {

package/src/registry/oauth/index.ts

@@ -2,6 +2,7 @@
 // High-level API
 // ============================================================================
 
+import * as AIError from "../../error";
 import { getProviderDefinition, PROVIDER_REGISTRY } from "../registry";
 import type {
 	OAuthCredentials,
@@ -46,14 +47,14 @@ async function abortableDeviceFlowSleep(ms: number, signal: AbortSignal | undefi
 		return;
 	}
 	if (signal.aborted) {
-		throw new Error(DEVICE_FLOW_CANCEL_MESSAGE);
+		throw new AIError.LoginCancelledError(DEVICE_FLOW_CANCEL_MESSAGE);
 	}
 
 	const { promise, resolve, reject } = Promise.withResolvers<void>();
 	let timer: Timer | undefined;
 	const onAbort = () => {
 		if (timer) clearTimeout(timer);
-		reject(new Error(DEVICE_FLOW_CANCEL_MESSAGE));
+		reject(new AIError.LoginCancelledError(DEVICE_FLOW_CANCEL_MESSAGE));
 	};
 	timer = setTimeout(() => {
 		signal.removeEventListener("abort", onAbort);
@@ -77,14 +78,14 @@ export async function pollOAuthDeviceCodeFlow<T>(options: OAuthDeviceCodeFlowOpt
 
 	while (Date.now() < deadline) {
 		if (options.signal?.aborted) {
-			throw new Error(DEVICE_FLOW_CANCEL_MESSAGE);
+			throw new AIError.LoginCancelledError(DEVICE_FLOW_CANCEL_MESSAGE);
 		}
 		const result = await options.poll();
 		if (result.status === "complete") {
 			return result.value;
 		}
 		if (result.status === "failed") {
-			throw new Error(result.message);
+			throw new AIError.OAuthError(result.message, { kind: "polling" });
 		}
 		if (result.status === "slow_down") {
 			slowDownResponses += 1;
@@ -98,7 +99,10 @@ export async function pollOAuthDeviceCodeFlow<T>(options: OAuthDeviceCodeFlowOpt
 		await abortableDeviceFlowSleep(Math.min(intervalMs, remainingMs), options.signal);
 	}
 
-	throw new Error(slowDownResponses > 0 ? DEVICE_FLOW_SLOW_DOWN_TIMEOUT_MESSAGE : DEVICE_FLOW_TIMEOUT_MESSAGE);
+	throw new AIError.OAuthError(
+		slowDownResponses > 0 ? DEVICE_FLOW_SLOW_DOWN_TIMEOUT_MESSAGE : DEVICE_FLOW_TIMEOUT_MESSAGE,
+		{ kind: "timeout" },
+	);
 }
 
 const builtInOAuthProviders: OAuthProviderInfo[] = PROVIDER_REGISTRY.filter(
@@ -146,11 +150,17 @@ export async function refreshOAuthToken(
 	credentials: OAuthCredentials,
 ): Promise<OAuthCredentials> {
 	if (!credentials) {
-		throw new Error(`No OAuth credentials found for ${provider}`);
+		throw new AIError.OAuthError(`No OAuth credentials found for ${provider}`, {
+			kind: "validation",
+			provider,
+		});
 	}
 	const def = getProviderDefinition(provider);
 	if (!def?.login) {
-		throw new Error(`Unknown OAuth provider: ${provider}`);
+		throw new AIError.OAuthError(`Unknown OAuth provider: ${provider}`, {
+			kind: "validation",
+			provider,
+		});
 	}
 	// Providers without a real refresher (static bearer tokens / API keys that
 	// don't expire) return the credentials unchanged.
@@ -219,8 +229,9 @@ export async function getOAuthApiKey(
 				return { newCredentials: fallbackCredentials, apiKey: fallbackCredentials.access };
 			}
 		}
-		throw new Error(
+		throw new AIError.OAuthError(
 			`OAuth credential for ${provider} is expired and must be refreshed via AuthStorage before getOAuthApiKey is called`,
+			{ kind: "validation", provider },
 		);
 	}
 	// For providers that need request-time credential metadata, return JSON.

package/src/registry/oauth/kimi.ts

@@ -9,6 +9,7 @@ import * as path from "node:path";
 import { scheduler } from "node:timers/promises";
 import { $env, getAgentDir, isEnoent } from "@oh-my-pi/pi-utils";
 import packageJson from "../../../package.json" with { type: "json" };
+import * as AIError from "../../error";
 import type { OAuthController, OAuthCredentials } from "./types";
 
 const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
@@ -113,7 +114,11 @@ async function requestDeviceAuthorization(): Promise<{
 
 	if (!response.ok) {
 		const text = await response.text();
-		throw new Error(`Kimi device authorization failed: ${response.status} ${text}`);
+		throw new AIError.OAuthError(`Kimi device authorization failed: ${response.status} ${text}`, {
+			kind: "device-auth",
+			provider: "kimi",
+			status: response.status,
+		});
 	}
 
 	const payload = (await response.json()) as DeviceAuthorizationResponse;
@@ -123,7 +128,10 @@ async function requestDeviceAuthorization(): Promise<{
 	const verificationUriComplete = payload.verification_uri_complete;
 
 	if (!userCode || !deviceCode || !verificationUri) {
-		throw new Error("Kimi device authorization response missing required fields");
+		throw new AIError.OAuthError("Kimi device authorization response missing required fields", {
+			kind: "validation",
+			provider: "kimi",
+		});
 	}
 
 	const expiresInMs = typeof payload.expires_in === "number" ? payload.expires_in * 1000 : DEFAULT_DEVICE_FLOW_TTL_MS;
@@ -142,12 +150,18 @@ async function requestDeviceAuthorization(): Promise<{
 
 function parseTokenPayload(payload: TokenResponse, refreshTokenFallback?: string): OAuthCredentials {
 	if (!payload.access_token || typeof payload.expires_in !== "number") {
-		throw new Error("Kimi token response missing required fields");
+		throw new AIError.OAuthError("Kimi token response missing required fields", {
+			kind: "validation",
+			provider: "kimi",
+		});
 	}
 
 	const refresh = payload.refresh_token ?? refreshTokenFallback;
 	if (!refresh) {
-		throw new Error("Kimi token response missing refresh token");
+		throw new AIError.OAuthError("Kimi token response missing refresh token", {
+			kind: "validation",
+			provider: "kimi",
+		});
 	}
 
 	return {
@@ -168,7 +182,7 @@ async function pollForToken(
 
 	while (Date.now() < deadline) {
 		if (signal?.aborted) {
-			throw new Error("Login cancelled");
+			throw new AIError.LoginCancelledError();
 		}
 
 		const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
@@ -204,18 +218,30 @@ async function pollForToken(
 		}
 
 		if (error === "expired_token") {
-			throw new Error("Kimi device authorization expired");
+			throw new AIError.OAuthError("Kimi device authorization expired", {
+				kind: "validation",
+				provider: "kimi",
+			});
 		}
 
 		if (error === "access_denied") {
-			throw new Error("Kimi device authorization denied");
+			throw new AIError.OAuthError("Kimi device authorization denied", {
+				kind: "validation",
+				provider: "kimi",
+			});
 		}
 
 		const description = payload.error_description ? `: ${payload.error_description}` : "";
-		throw new Error(`Kimi device flow failed: ${error ?? response.status}${description}`);
+		throw new AIError.OAuthError(`Kimi device flow failed: ${error ?? response.status}${description}`, {
+			kind: "polling",
+			provider: "kimi",
+		});
 	}
 
-	throw new Error("Kimi device flow timed out");
+	throw new AIError.OAuthError("Kimi device flow timed out", {
+		kind: "timeout",
+		provider: "kimi",
+	});
 }
 
 /**
@@ -251,7 +277,11 @@ export async function refreshKimiToken(refreshToken: string): Promise<OAuthCrede
 	if (!response.ok) {
 		const payload = (await response.json().catch(() => undefined)) as TokenResponse | undefined;
 		const description = payload?.error_description ? `: ${payload.error_description}` : "";
-		throw new Error(`Kimi token refresh failed: ${response.status}${description}`);
+		throw new AIError.OAuthError(`Kimi token refresh failed: ${response.status}${description}`, {
+			kind: "token-refresh",
+			provider: "kimi",
+			status: response.status,
+		});
 	}
 
 	const payload = (await response.json()) as TokenResponse;