@prestyj/cli 5.1.0 → 5.2.0

package/README.md

@@ -69,12 +69,12 @@ Switch mid-conversation with `/model`. Not locked to anyone.
 
 | Provider | Models | Auth |
 |---|---|---|
-| **Anthropic** | Claude Fable 5, Opus 4.8, Sonnet 4.6, Haiku 4.5 | OAuth |
+| **Anthropic** | Claude Opus 4.8, Sonnet 5, Haiku 4.5 | OAuth |
 | **OpenAI** | GPT-5.5, GPT-5.5 Pro, GPT-5.4, GPT-5.3 Codex | OAuth |
 | **Moonshot** | Kimi K2.6 | API key |
 | **Z.AI (GLM)** | GLM-5.1, GLM-4.7, GLM-4.7 Flash | API key |
 | **MiniMax** | MiniMax M3 (image + video) | API key |
-| **Xiaomi (MiMo)** | MiMo-V2.5-Pro, MiMo-V2.5 (image + video) | API key |
+| **Xiaomi (MiMo)** | MiMo-V2.5-Pro, MiMo-V2.5-Pro-UltraSpeed, MiMo-V2.5 (image + video) | API key |
 | **DeepSeek** | DeepSeek V4 Pro, V4 Flash | API key |
 | **OpenRouter** | Qwen3.6-Plus + multi-provider gateway | API key |
 

package/dist/app-sidecar.js

@@ -17,13 +17,15 @@ import os from "node:os";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { parseArgs } from "node:util";
+import { formatError } from "@prestyj/ai";
 import { runJsonMode } from "./modes/json-mode.js";
 import { AgentSession } from "./core/agent-session.js";
-import { buildNolanSystemPrompt } from "./core/nolan-prompt.js";
-import { buildNolanDigest } from "./core/nolan-context.js";
+import { buildNolanSystemPrompt, buildNolanAutopilotSystemPrompt } from "./core/nolan-prompt.js";
+import { buildNolanDigest, buildNolanAutopilotContext } from "./core/nolan-context.js";
+import { parseAutopilotVerdict } from "./core/autopilot-verdict.js";
 import { collectProjectContext } from "./system-prompt.js";
 import { AuthStorage } from "./core/auth-storage.js";
-import { MOONSHOT_OAUTH_KEY } from "@prestyj/core";
+import { MOONSHOT_OAUTH_KEY, XIAOMI_CREDITS_KEY } from "@prestyj/core";
 import { loginAnthropic } from "./core/oauth/anthropic.js";
 import { loginOpenAI } from "./core/oauth/openai.js";
 import { loginGemini } from "./core/oauth/gemini.js";
@@ -38,7 +40,7 @@ import { getNextThinkingLevel, getSupportedThinkingLevels, isThinkingLevelSuppor
 import { PROMPT_COMMANDS } from "./core/prompt-commands.js";
 import { loadCustomCommands } from "./core/custom-commands.js";
 import { discoverProjects, listRecentSessions } from "./core/project-discovery.js";
-import { loadTasksSync, saveTasksSync, getNextPendingTask, markTaskInProgress, } from "./core/task-store.js";
+import { loadTasksSync, saveTasksSync, pruneDoneTasksSync, getNextPendingTask, markTaskInProgress, } from "./core/task-store.js";
 import { initLogger, log } from "./core/logger.js";
 import { RADIO_STATIONS, getCurrentStation, playRadio, stopRadio } from "./core/radio.js";
 import { enrichProcessPath } from "./core/shell-path.js";
@@ -79,6 +81,7 @@ async function loadAppSettings() {
             // Preserve the per-project map verbatim (validated + written by the
             // model/thinking handlers below).
             projectModels: raw.projectModels && typeof raw.projectModels === "object" ? raw.projectModels : undefined,
+            autopilot: raw.autopilot && typeof raw.autopilot === "object" ? raw.autopilot : undefined,
         };
     }
     catch {
@@ -102,6 +105,19 @@ async function saveProjectModelPrefs(cwd, prefs) {
     s.projectModels = { ...(s.projectModels ?? {}), [key]: prefs };
     await saveAppSettings(s);
 }
+/** Read this project's persisted autopilot flag (default off). */
+async function loadAutopilot(cwd) {
+    const s = await loadAppSettings();
+    return s.autopilot?.[projectModelKey(cwd)] ?? false;
+}
+/** Persist this project's autopilot flag via read-modify-write so the rest of
+ *  the settings file (projectsRoot, model map, other projects) is preserved. */
+async function saveAutopilot(cwd, enabled) {
+    const s = await loadAppSettings();
+    const key = projectModelKey(cwd);
+    s.autopilot = { ...(s.autopilot ?? {}), [key]: enabled };
+    await saveAppSettings(s);
+}
 /**
  * Persist the active model selection to ~/.ezcoder/settings.json so it survives app
  * restarts. Mirrors the CLI's handleModelSelect persistence (App.tsx).
@@ -632,6 +648,31 @@ async function createSession(deps, opts) {
         for (const c of clients)
             c.res.write(frame);
     }
+    // Turn any thrown value into the same clear headline/message/guidance shape
+    // the TUI shows (see gg-ai's formatError) instead of a bare `err.message`, log
+    // the full detail, and broadcast it under `type` ("error" or "nolan_error").
+    // Without this the webview only ever saw a raw provider string like
+    // `400 {"code":"400",...}` with no "is this me or them / when does it reset"
+    // context that the CLI has always given.
+    function broadcastError(type, logLabel, err) {
+        const f = formatError(err);
+        log("ERROR", "app-sidecar", logLabel, {
+            headline: f.headline,
+            source: f.source,
+            ...(f.message ? { message: f.message } : {}),
+            ...(f.provider ? { provider: f.provider } : {}),
+            ...(f.statusCode != null ? { statusCode: String(f.statusCode) } : {}),
+            ...(f.requestId ? { requestId: f.requestId } : {}),
+        });
+        broadcast(type, {
+            headline: f.headline,
+            ...(f.message ? { message: f.message } : {}),
+            guidance: f.guidance,
+            ...(f.provider ? { provider: f.provider } : {}),
+            ...(f.statusCode != null ? { statusCode: f.statusCode } : {}),
+            ...(f.resetsAt != null ? { resetsAt: f.resetsAt } : {}),
+        });
+    }
     // The session file path to resume (passed by the daemon's POST /session);
     // empty/unset starts a fresh session.
     const resumeSessionPath = opts.sessionPath;
@@ -680,7 +721,7 @@ async function createSession(deps, opts) {
     let gitIsRepo = await isGitRepo(cwd).catch(() => false);
     function currentContextWindow() {
         const st = session.getState();
-        return getContextWindow(st.model, { provider: st.provider });
+        return getContextWindow(st.model, { provider: st.provider, accountId: st.accountId });
     }
     // Shared shape merged into /state + the SSE `ready` frame so the footer can
     // render context %, branch, and tasks immediately on connect.
@@ -731,9 +772,7 @@ async function createSession(deps, opts) {
     session.eventBus.on("turn_end", (d) => broadcast("turn_end", d));
     session.eventBus.on("agent_done", (d) => broadcast("agent_done", d));
     session.eventBus.on("error", (d) => {
-        const message = d.error instanceof Error ? d.error.message : String(d.error);
-        log("ERROR", "app-sidecar", "agent error", { message });
-        broadcast("error", { message });
+        broadcastError("error", "agent error", d.error);
     });
     session.eventBus.on("model_change", (d) => broadcast("model_change", d));
     session.eventBus.on("hook", (d) => broadcast("hook", d));
@@ -741,6 +780,24 @@ async function createSession(deps, opts) {
     session.eventBus.on("compaction_end", (d) => broadcast("compaction_end", d));
     let running = false;
     let titleGenerated = false;
+    // Autopilot (auto-review) toggle for THIS window's project. Loaded from
+    // ezcoder-app.json on boot; flipped via POST /autopilot. When on, POST /prompt runs
+    // runAutopilotCycle after the user's turn settles — Nolan auto-reviews the work
+    // and drives the review→prompt→review loop.
+    let autopilot = await loadAutopilot(cwd);
+    // True while an autopilot review is in flight (used to defer nolanAuto model
+    // switches, like nolanRunning does for chat Nolan, and to drive the spinner).
+    let autopilotReviewing = false;
+    // True for the WHOLE autopilot cycle (reviews + injected runs). The build
+    // `running` flag is false during the review windows between injected runs, so
+    // this is the extra guard that makes a user /prompt queue as steering instead
+    // of starting a run that would collide with an injected one on the same
+    // session (AgentSession.prompt has no concurrency guard).
+    let autopilotActive = false;
+    // Set by /cancel to break out of an in-flight autopilot cycle between steps.
+    let autopilotCancelled = false;
+    // Hard cap on review→prompt→review rounds per user turn (loop safety).
+    const MAX_AUTOPILOT_ROUNDS = 3;
     // ── Telegram serve (remote control via Telegram) ───────────
     // A single embedded serve session lives in this sidecar process. Only the main
     // window's home screen exposes the controls, so there's one bot per app.
@@ -803,14 +860,59 @@ async function createSession(deps, opts) {
         ken.eventBus.on("server_tool_call", (d) => broadcast("nolan_server_tool_call", d));
         ken.eventBus.on("turn_end", (d) => broadcast("nolan_turn_end", d));
         ken.eventBus.on("error", (d) => {
-            const message = d.error instanceof Error ? d.error.message : String(d.error);
-            log("ERROR", "app-sidecar", "ken error", { message });
-            broadcast("nolan_error", { message });
+            broadcastError("nolan_error", "ken error", d.error);
         });
         nolanSession = ken;
         log("INFO", "app-sidecar", "ken session ready", { provider: st.provider, model: st.model });
         return ken;
     }
+    // ── Autopilot Nolan (auto-reviewer) ──────────────────────────
+    // A THIRD read-only AgentSession, separate from chat Nolan. In autopilot mode
+    // Nolan silently reviews each finished EZ Coder turn and returns a verdict
+    // (PROMPT / ALL_CLEAR / HUMAN). Its bus is intentionally NOT bridged to the
+    // nolan_* chat bubbles — the review is silent; we read its final assistant text
+    // and parse it. Uses the lean autopilot system prompt + the same read-only
+    // tools. Created lazily on the first autopilot cycle.
+    let nolanAutoSession = null;
+    let nolanAutoAbort = new AbortController();
+    let pendingNolanAutoModel = null;
+    async function syncNolanAutoModel(provider, model) {
+        if (autopilotReviewing) {
+            pendingNolanAutoModel = { provider, model };
+            return;
+        }
+        if (!nolanAutoSession)
+            return;
+        const st = nolanAutoSession.getState();
+        if (st.provider === provider && st.model === model)
+            return;
+        await nolanAutoSession.switchModel(provider, model);
+        log("INFO", "app-sidecar", "ken autopilot session model synced", { provider, model });
+    }
+    async function ensureNolanAutoSession() {
+        if (nolanAutoSession)
+            return nolanAutoSession;
+        const st = session.getState();
+        const ken = new AgentSession({
+            provider: st.provider,
+            model: st.model,
+            cwd,
+            systemPrompt: buildNolanAutopilotSystemPrompt(),
+            allowedTools: NOLAN_ALLOWED_TOOLS,
+            allowedMcpServers: NOLAN_ALLOWED_MCP_SERVERS,
+            transient: true,
+            signal: nolanAutoAbort.signal,
+        });
+        await ken.initialize();
+        // Deliberately no bus bridge: the review is silent. Errors surface via the
+        // runAutopilotReview try/catch as autopilot_error frames.
+        nolanAutoSession = ken;
+        log("INFO", "app-sidecar", "ken autopilot session ready", {
+            provider: st.provider,
+            model: st.model,
+        });
+        return ken;
+    }
     // Resumed session: if it already has a conversation, generate its title now so
     // the title bar shows it immediately on load (not just after the next prompt).
     {
@@ -836,9 +938,7 @@ async function createSession(deps, opts) {
             await run();
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            broadcast("error", { message });
-            log("ERROR", "app-sidecar", "run failed", { message });
+            broadcastError("error", "run failed", err);
         }
         finally {
             running = false;
@@ -847,6 +947,14 @@ async function createSession(deps, opts) {
             gitBranch = await getGitBranch(cwd).catch(() => gitBranch);
             gitIsRepo = await isGitRepo(cwd).catch(() => gitIsRepo);
             broadcast("run_end", {});
+            // Autopilot's review loop is driven explicitly from POST /prompt (see
+            // runAutopilotCycle), NOT from this shared finally — that keeps the
+            // injected EZ Coder runs this cycle triggers from recursively re-entering
+            // the loop through the same bracket.
+            // The agent may have marked project tasks done during the run — prune the
+            // completed ones so they drop out of the Tasks modal automatically (users
+            // never have to delete finished tasks by hand).
+            broadcast("tasks_list", { tasks: pruneDoneTasksSync(cwd) });
             // Queue drains into the run as steering, so it's empty by run_end —
             // sync the webview indicator.
             broadcast("queued", { count: session.getQueuedCount() });
@@ -862,6 +970,79 @@ async function createSession(deps, opts) {
             }
         }
     }
+    // ── Autopilot orchestration ─────────────────────────────────
+    // One review = prompt the nolanAuto session with the review digest, read its
+    // final assistant text, parse a verdict. Returns null on failure (surfaced as
+    // an autopilot_error frame) so the cycle stops rather than looping blind.
+    async function runAutopilotReview() {
+        autopilotReviewing = true;
+        broadcast("autopilot_review_start", {});
+        try {
+            const ken = await ensureNolanAutoSession();
+            const projectContext = await collectProjectContext(cwd).catch(() => []);
+            const digest = buildNolanAutopilotContext({
+                projectContext,
+                cwd,
+                gitBranch,
+                messages: session.getMessages(),
+            });
+            await ken.prompt(digest);
+            return parseAutopilotVerdict(lastAssistantText(ken.getMessages()));
+        }
+        catch (err) {
+            broadcastError("autopilot_error", "autopilot review failed", err);
+            return null;
+        }
+        finally {
+            autopilotReviewing = false;
+            // Apply any model switch that landed mid-review.
+            const pending = pendingNolanAutoModel;
+            pendingNolanAutoModel = null;
+            if (pending)
+                await syncNolanAutoModel(pending.provider, pending.model);
+        }
+    }
+    // Drive the review→prompt→review loop for one finished user turn. Only ever
+    // called from POST /prompt after the user's own run resolves — never from the
+    // task runner, resume, /ken, or error paths, so there's no recursion and no
+    // guard tangle. Bounded by MAX_AUTOPILOT_ROUNDS and cancellable between steps.
+    async function runAutopilotCycle() {
+        if (!autopilot || autopilotCancelled)
+            return;
+        autopilotActive = true;
+        try {
+            // Lean context per user turn: wipe prior review history so each new turn
+            // starts cheap, while within this cycle the few review messages persist so
+            // Nolan remembers what he already asked EZ Coder to fix.
+            await nolanAutoSession?.newSession().catch(() => { });
+            for (let round = 1; round <= MAX_AUTOPILOT_ROUNDS; round++) {
+                if (autopilotCancelled)
+                    return;
+                const verdict = await runAutopilotReview();
+                if (!verdict || autopilotCancelled)
+                    return;
+                if (verdict.kind === "all_clear") {
+                    broadcast("autopilot_done", {});
+                    return;
+                }
+                if (verdict.kind === "human") {
+                    broadcast("autopilot_human", { reason: verdict.reason });
+                    return;
+                }
+                // prompt → show a compact Nolan-tinted marker (not the prompt body), then
+                // feed EZ Coder. Bracketed by runAgent so the run streams normally; the
+                // shared finally no longer re-triggers autopilot, so this can't recurse.
+                broadcast("autopilot_prompted", { round, body: verdict.body });
+                await runAgent(verdict.body, () => session.prompt(verdict.body));
+                if (autopilotCancelled)
+                    return;
+            }
+            broadcast("autopilot_capped", { rounds: MAX_AUTOPILOT_ROUNDS });
+        }
+        finally {
+            autopilotActive = false;
+        }
+    }
     // ── Task runner (project task list → sessions) ──────────────
     // Mirrors the CLI's task flow: each task runs in its OWN fresh session, with a
     // completion hint instructing the agent to mark the task done via the tasks
@@ -883,8 +1064,8 @@ async function createSession(deps, opts) {
             `tasks({ action: "done", id: "${shortId}" })`;
         await runAgent(task.title, () => session.prompt(task.prompt + completionHint));
         // The agent typically marks the task done via the tasks tool during the run;
-        // push the refreshed list so the webview's task modal reflects it.
-        broadcast("tasks_list", { tasks: loadTasksSync(cwd) });
+        // prune completed tasks and push the refreshed list so the modal drops them.
+        broadcast("tasks_list", { tasks: pruneDoneTasksSync(cwd) });
         return true;
     }
     async function runTasks(startId, all) {
@@ -921,6 +1102,9 @@ async function createSession(deps, opts) {
         };
     }
     async function authStatusPayload() {
+        // Native (Rust) writes to auth.json bypass this daemon's cache; re-read so
+        // the reported connection state matches what's actually on disk.
+        await auth.reload();
         const providers = await Promise.all(AUTH_PROVIDERS.map(async (p) => ({
             ...p,
             connected: await auth.hasProviderAuth(p.value),
@@ -979,6 +1163,7 @@ async function createSession(deps, opts) {
                 thinkingLevel: session.getThinkingLevel() ?? null,
                 supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                 supportsVideo: getModel(st.model)?.supportsVideo ?? false,
+                autopilot,
                 ...footerExtras(),
             });
             return;
@@ -1002,6 +1187,7 @@ async function createSession(deps, opts) {
                     thinkingLevel: session.getThinkingLevel() ?? null,
                     supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                     supportsVideo: getModel(st.model)?.supportsVideo ?? false,
+                    autopilot,
                     ...footerExtras(),
                 },
             })}\n\n`);
@@ -1325,10 +1511,13 @@ async function createSession(deps, opts) {
                     json(res, 400, { error: "empty prompt" });
                     return;
                 }
-                if (running) {
-                    // Queue prompts as mid-run steering (mirrors the CLI). Attachments are
-                    // persisted to .gg/uploads first so the queued media rides the same
-                    // native-block path as a non-queued attachment prompt when it drains.
+                if (running || autopilotActive) {
+                    // Queue prompts as mid-run steering (mirrors the CLI). Also queue while
+                    // an autopilot cycle is active but between injected runs (build idle,
+                    // Nolan reviewing) so the message never starts a run that collides with
+                    // an injected one on the same session. Attachments are persisted to
+                    // .gg/uploads first so the queued media rides the same native-block
+                    // path as a non-queued attachment prompt when it drains.
                     const prepared = attachments.length > 0 ? await prepareAttachments(cwd, attachments) : [];
                     const count = session.queueMessage(text, prepared);
                     broadcast("queued", { count });
@@ -1336,6 +1525,9 @@ async function createSession(deps, opts) {
                     return;
                 }
                 json(res, 202, { accepted: true });
+                // Fresh user turn: clear any cancel flag left from a prior cycle so this
+                // turn's autopilot review can run.
+                autopilotCancelled = false;
                 await runAgent(text, async () => {
                     if (attachments.length > 0) {
                         // Persist each attachment under .ezcoder/uploads so files are inspectable
@@ -1351,6 +1543,11 @@ async function createSession(deps, opts) {
                         await session.prompt(text);
                     }
                 });
+                // After the user's run settles, kick off Nolan's auto-review loop. This is
+                // the ONLY entry point into the cycle — it drives any follow-up EZ Coder
+                // runs itself, so the shared runAgent finally never recurses.
+                if (autopilot && !autopilotCancelled)
+                    await runAutopilotCycle();
             });
             return;
         }
@@ -1391,9 +1588,7 @@ async function createSession(deps, opts) {
                         await session.persistNolanTurn(text, reply);
                 }
                 catch (err) {
-                    const message = err instanceof Error ? err.message : String(err);
-                    log("ERROR", "app-sidecar", "ken run failed", { message });
-                    broadcast("nolan_error", { message });
+                    broadcastError("nolan_error", "ken run failed", err);
                 }
                 finally {
                     nolanRunning = false;
@@ -1415,6 +1610,24 @@ async function createSession(deps, opts) {
             json(res, 200, { cancelled: true });
             return;
         }
+        if (method === "POST" && url === "/autopilot") {
+            void readBody(req).then(async (raw) => {
+                let enabled;
+                try {
+                    enabled = Boolean(JSON.parse(raw).enabled);
+                }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                autopilot = enabled;
+                await saveAutopilot(cwd, enabled);
+                log("INFO", "app-sidecar", "autopilot toggled", { enabled: String(enabled) });
+                broadcast("autopilot", { autopilot: enabled });
+                json(res, 200, { autopilot: enabled });
+            });
+            return;
+        }
         if (method === "POST" && url === "/enhance") {
             void readBody(req).then(async (raw) => {
                 let text;
@@ -1444,7 +1657,7 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "GET" && url === "/tasks") {
-            json(res, 200, { tasks: loadTasksSync(cwd) });
+            json(res, 200, { tasks: pruneDoneTasksSync(cwd) });
             return;
         }
         // ── Radio (app-wide) ──────────────────────────────────────
@@ -1605,6 +1818,10 @@ async function createSession(deps, opts) {
         }
         if (method === "GET" && url === "/models") {
             void (async () => {
+                // The desktop app writes API keys natively (Rust → auth.json), bypassing
+                // this daemon's AuthStorage cache. Re-read from disk so a provider the
+                // user just logged in for (e.g. Xiaomi/MiMo) shows up in the list.
+                await auth.reload();
                 const loggedIn = [];
                 for (const p of ALL_PROVIDERS) {
                     if (await auth.hasProviderAuth(p))
@@ -1640,8 +1857,12 @@ async function createSession(deps, opts) {
                     json(res, 409, { error: "cannot switch model while running" });
                     return;
                 }
+                // Pick up any natively-written keys (desktop app) before resolving the
+                // new model's credentials, so switching to a just-added provider works.
+                await auth.reload();
                 await session.switchModel(target.provider, target.id);
                 await syncNolanModel(target.provider, target.id);
+                await syncNolanAutoModel(target.provider, target.id);
                 // Clamp the reasoning level to what the new model supports (mirrors the
                 // CLI): keep thinking on at the first supported tier if it was on but
                 // the prior level is unsupported here; leave it off if it was off.
@@ -1723,6 +1944,13 @@ async function createSession(deps, opts) {
             running = false;
             // Stop a run-all sweep so the next pending task isn't auto-started.
             taskRunAll = false;
+            // Stop any in-flight autopilot cycle: flag it so the loop bails between
+            // steps, and abort a review that's mid-prompt on the nolanAuto session.
+            autopilotCancelled = true;
+            nolanAutoAbort.abort();
+            nolanAutoAbort = new AbortController();
+            nolanAutoSession?.setSignal(nolanAutoAbort.signal);
+            autopilotReviewing = false;
             // Drop any queued steering and return it so the webview can restore it to
             // the composer.
             const drained = session.drainQueue();
@@ -1792,10 +2020,12 @@ async function createSession(deps, opts) {
             void readBody(req).then(async (raw) => {
                 let provider = "";
                 let key;
+                let variant;
                 try {
                     const body = JSON.parse(raw);
                     provider = body.provider ?? "";
                     key = (body.key ?? "").trim();
+                    variant = body.variant;
                 }
                 catch {
                     json(res, 400, { error: "invalid JSON body" });
@@ -1810,13 +2040,20 @@ async function createSession(deps, opts) {
                     json(res, 400, { error: "API key is required" });
                     return;
                 }
+                // Providers with multiple API-key variants (currently only Xiaomi: Token
+                // Plan vs. API Credits) store under the chosen variant's key/baseUrl,
+                // defaulting to the first variant. Single-variant providers fall back to
+                // the legacy provider-id storage key + flat apiKeyBaseUrl.
+                const chosenVariant = meta.apiKeyVariants?.find((v) => v.key === variant) ?? meta.apiKeyVariants?.[0];
+                const storageKey = chosenVariant?.key ?? provider;
+                const baseUrl = chosenVariant?.baseUrl ?? meta.apiKeyBaseUrl;
                 const creds = {
                     accessToken: key,
                     refreshToken: "",
                     expiresAt: Date.now() + 365 * 24 * 60 * 60 * 1000 * 100, // ~100y
-                    ...(meta.apiKeyBaseUrl ? { baseUrl: meta.apiKeyBaseUrl } : {}),
+                    ...(baseUrl ? { baseUrl } : {}),
                 };
-                await auth.setCredentials(provider, creds);
+                await auth.setCredentials(storageKey, creds);
                 broadcast("auth_done", { provider });
                 json(res, 200, { ok: true });
             });
@@ -1913,6 +2150,10 @@ async function createSession(deps, opts) {
                 // "disconnect" fully removes Kimi OAuth and the API key.
                 if (provider === "moonshot")
                     await auth.clearCredentials(MOONSHOT_OAUTH_KEY);
+                // Xiaomi's API Credits credential lives under a distinct key — clear it
+                // too so "disconnect" fully removes both the Token Plan and Credits keys.
+                if (provider === "xiaomi")
+                    await auth.clearCredentials(XIAOMI_CREDITS_KEY);
                 broadcast("auth_done", { provider });
                 json(res, 200, { ok: true });
             });
@@ -2196,7 +2437,9 @@ async function createSession(deps, opts) {
         for (const c of clients)
             c.res.end();
         nolanAbort.abort();
+        nolanAutoAbort.abort();
         await nolanSession?.dispose().catch(() => { });
+        await nolanAutoSession?.dispose().catch(() => { });
         await session.dispose().catch(() => { });
     }
     return {