@prestyj/core 5.8.0 → 5.10.0

package/dist/index.cjs

@@ -31,19 +31,30 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   AuthStorage: () => AuthStorage,
+  DEFAULT_LOCAL_ENDPOINTS: () => DEFAULT_LOCAL_ENDPOINTS,
   DEFAULT_MAX_VIDEO_BYTES: () => DEFAULT_MAX_VIDEO_BYTES,
+  FALLBACK_CONTEXT_WINDOW: () => FALLBACK_CONTEXT_WINDOW,
+  LOCAL_API_KEY_PLACEHOLDER: () => LOCAL_API_KEY_PLACEHOLDER,
+  LOCAL_AUTH_KEY_PREFIX: () => LOCAL_AUTH_KEY_PREFIX,
   MODELS: () => MODELS,
   MOONSHOT_OAUTH_KEY: () => MOONSHOT_OAUTH_KEY,
   NotLoggedInError: () => NotLoggedInError,
   SubscriptionUsageError: () => SubscriptionUsageError,
   TelegramBot: () => TelegramBot,
   XIAOMI_CREDITS_KEY: () => XIAOMI_CREDITS_KEY,
+  clearLocalDiscoveryCache: () => clearLocalDiscoveryCache,
+  clearRuntimeModels: () => clearRuntimeModels,
   closeLogger: () => closeLogger,
   createAutoUpdater: () => createAutoUpdater,
   decodeOggOpus: () => decodeOggOpus,
+  discoverLocalModels: () => discoverLocalModels,
   downmixToMono: () => downmixToMono,
+  endpointRoot: () => endpointRoot,
   fetchSubscriptionUsage: () => fetchSubscriptionUsage,
+  findProbedModel: () => findProbedModel,
+  formatLocalModelId: () => formatLocalModelId,
   generatePKCE: () => generatePKCE,
+  getAllModels: () => getAllModels,
   getAppPaths: () => getAppPaths,
   getAuthStorageKey: () => getAuthStorageKey,
   getAuthStorageKeys: () => getAuthStorageKeys,
@@ -51,6 +62,7 @@ __export(index_exports, {
   getClaudeCodeVersion: () => getClaudeCodeVersion,
   getContextWindow: () => getContextWindow,
   getDefaultModel: () => getDefaultModel,
+  getDefaultThinkingLevel: () => getDefaultThinkingLevel,
   getFastModel: () => getFastModel,
   getMaxThinkingLevel: () => getMaxThinkingLevel,
   getModel: () => getModel,
@@ -62,33 +74,43 @@ __export(index_exports, {
   getToolResultCharLimit: () => getToolResultCharLimit,
   getVideoByteLimit: () => getVideoByteLimit,
   isKimiCodingEndpoint: () => isKimiCodingEndpoint,
+  isLocalModelId: () => isLocalModelId,
   isLoggerOpen: () => isLoggerOpen,
   isModelLoaded: () => isModelLoaded,
   isThinkingLevelSupported: () => isThinkingLevelSupported,
   kimiCodeBaseUrl: () => kimiCodeBaseUrl,
   kimiCodingHeaders: () => kimiCodingHeaders,
+  localAuthStorageKey: () => localAuthStorageKey,
   log: () => log,
   loginAnthropic: () => loginAnthropic,
   loginGemini: () => loginGemini,
   loginKimi: () => loginKimi,
   loginOpenAI: () => loginOpenAI,
   openLog: () => openLog,
+  parseLocalModelId: () => parseLocalModelId,
+  probeEndpoint: () => probeEndpoint,
+  readStoredBaseUrlSync: () => readStoredBaseUrlSync,
   refreshAnthropicToken: () => refreshAnthropicToken,
   refreshGeminiToken: () => refreshGeminiToken,
   refreshKimiToken: () => refreshKimiToken,
   refreshOpenAIToken: () => refreshOpenAIToken,
   registerLogCleanup: () => registerLogCleanup,
+  registerRuntimeModels: () => registerRuntimeModels,
   resample: () => resample,
   setProgressCallback: () => setProgressCallback,
+  toModelInfo: () => toModelInfo,
   transcribeVoice: () => transcribeVoice,
   usesOpenAICodexTransport: () => usesOpenAICodexTransport,
   withFileLock: () => withFileLock
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/auth-storage.ts
-var import_promises4 = __toESM(require("fs/promises"), 1);
-var import_node_crypto6 = __toESM(require("crypto"), 1);
+// src/oauth/kimi.ts
+var import_node_child_process = require("child_process");
+var import_node_crypto = require("crypto");
+var import_node_fs = require("fs");
+var import_node_os2 = require("os");
+var import_node_path2 = __toESM(require("path"), 1);
 
 // src/paths.ts
 var import_node_path = __toESM(require("path"), 1);
@@ -115,8 +137,226 @@ function getAppPaths() {
   };
 }
 
+// src/oauth/kimi.ts
+var CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
+var KIMI_PLATFORM = "kimi_code_cli";
+var DEFAULT_KIMI_VERSION = "1.0.11";
+var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
+function oauthHost() {
+  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
+  return host.replace(/\/+$/, "");
+}
+function kimiCodeBaseUrl() {
+  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
+}
+function kimiVersion() {
+  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
+  return asciiHeader(v, DEFAULT_KIMI_VERSION);
+}
+function asciiHeader(value, fallback = "unknown") {
+  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
+  return cleaned.length > 0 ? cleaned : fallback;
+}
+function macOsProductVersion() {
+  try {
+    const version = (0, import_node_child_process.execFileSync)("/usr/bin/sw_vers", ["-productVersion"], {
+      encoding: "utf-8",
+      timeout: 1e3
+    }).trim();
+    return version.length > 0 ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function deviceModel() {
+  const os2 = (0, import_node_os2.type)();
+  const version = (0, import_node_os2.release)();
+  const osArch = (0, import_node_os2.arch)();
+  if (os2 === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
+  if (os2 === "Windows_NT") return `Windows ${version} ${osArch}`;
+  return `${os2} ${version} ${osArch}`.trim();
+}
+function deviceId() {
+  const idPath = import_node_path2.default.join(getAppPaths().agentDir, "kimi_device_id");
+  if ((0, import_node_fs.existsSync)(idPath)) {
+    try {
+      const text = (0, import_node_fs.readFileSync)(idPath, "utf-8").trim();
+      if (text.length > 0) return text;
+    } catch {
+    }
+  }
+  const id = (0, import_node_crypto.randomUUID)();
+  try {
+    (0, import_node_fs.mkdirSync)(getAppPaths().agentDir, { recursive: true, mode: 448 });
+    (0, import_node_fs.writeFileSync)(idPath, id, { encoding: "utf-8", mode: 384 });
+  } catch {
+  }
+  return id;
+}
+function deviceHeaders() {
+  return {
+    "X-Msh-Platform": KIMI_PLATFORM,
+    "X-Msh-Version": kimiVersion(),
+    "X-Msh-Device-Name": asciiHeader((0, import_node_os2.hostname)()),
+    "X-Msh-Device-Model": asciiHeader(deviceModel()),
+    "X-Msh-Os-Version": asciiHeader((0, import_node_os2.release)()),
+    "X-Msh-Device-Id": deviceId()
+  };
+}
+function kimiCodingHeaders() {
+  return {
+    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
+    ...deviceHeaders()
+  };
+}
+function isKimiCodingEndpoint(baseUrl) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
+  const normalized = baseUrl.replace(/\/+$/, "");
+  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
+}
+async function postForm(endpoint, params) {
+  const response = await fetch(`${oauthHost()}${endpoint}`, {
+    method: "POST",
+    headers: {
+      ...deviceHeaders(),
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams(params).toString()
+  });
+  let data = {};
+  try {
+    const parsed = await response.json();
+    if (parsed && typeof parsed === "object") data = parsed;
+  } catch {
+  }
+  return { status: response.status, data };
+}
+function errorDetail(data) {
+  const desc = data.error_description ?? data.message ?? data.error;
+  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
+}
+function credsFromTokenResponse(data, opts) {
+  const accessToken = data.access_token;
+  const responseRefreshToken = data.refresh_token;
+  const expiresIn = Number(data.expires_in);
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("Kimi OAuth response missing access_token.");
+  }
+  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
+  if (refreshToken.length === 0) {
+    throw new Error("Kimi OAuth response missing refresh_token.");
+  }
+  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("Kimi OAuth response missing or invalid expires_in.");
+  }
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: Date.now() + expiresIn * 1e3,
+    expiresIn,
+    baseUrl: kimiCodeBaseUrl()
+  };
+}
+async function requestDeviceAuthorization() {
+  const { status, data } = await postForm("/api/oauth/device_authorization", {
+    client_id: CLIENT_ID
+  });
+  if (status !== 200) {
+    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
+  }
+  const userCode = data.user_code;
+  const deviceCode = data.device_code;
+  const verificationUriComplete = data.verification_uri_complete;
+  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
+    throw new Error("Kimi device authorization response missing user_code/device_code.");
+  }
+  return {
+    userCode,
+    deviceCode,
+    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
+    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
+    interval: Number(data.interval ?? 5) || 5
+  };
+}
+async function pollDeviceToken(deviceCode) {
+  const { status, data } = await postForm("/api/oauth/token", {
+    client_id: CLIENT_ID,
+    device_code: deviceCode,
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return { kind: "success", creds: credsFromTokenResponse(data) };
+  }
+  if (status >= 500) {
+    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
+  switch (errorCode) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    case "access_denied":
+      return { kind: "denied" };
+    default:
+      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+async function loginKimi(callbacks) {
+  const auth = await requestDeviceAuthorization();
+  callbacks.onStatus(
+    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
+  );
+  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
+  callbacks.onStatus("Waiting for you to authorize in the browser...");
+  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
+  let interval = Math.max(auth.interval, 1);
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    const result = await pollDeviceToken(auth.deviceCode);
+    if (result.kind === "success") return result.creds;
+    if (result.kind === "denied") {
+      throw new Error("Kimi authorization was denied.");
+    }
+    if (result.kind === "expired") {
+      throw new Error("Kimi device code expired. Please run login again.");
+    }
+    if (result.kind === "slow_down") {
+      interval += 5;
+    }
+  }
+  throw new Error("Kimi login timed out. Please run login again.");
+}
+async function refreshKimiToken(refreshToken) {
+  const { status, data } = await postForm("/api/oauth/token", {
+    client_id: CLIENT_ID,
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "";
+  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
+}
+
+// src/auth-storage.ts
+var import_promises4 = __toESM(require("fs/promises"), 1);
+var import_node_fs3 = require("fs");
+var import_node_crypto6 = __toESM(require("crypto"), 1);
+
 // src/oauth/anthropic.ts
-var import_node_crypto2 = __toESM(require("crypto"), 1);
+var import_node_crypto3 = __toESM(require("crypto"), 1);
 
 // src/oauth/pkce.ts
 function base64urlEncode(bytes) {
@@ -138,49 +378,66 @@ async function generatePKCE() {
 
 // src/claude-code-version.ts
 var import_promises = __toESM(require("fs/promises"), 1);
-var import_node_path3 = __toESM(require("path"), 1);
+var import_node_path4 = __toESM(require("path"), 1);
 
 // src/logger.ts
-var import_node_fs = __toESM(require("fs"), 1);
-var import_node_path2 = __toESM(require("path"), 1);
-var import_node_crypto = require("crypto");
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_node_path3 = __toESM(require("path"), 1);
+var import_node_crypto2 = require("crypto");
 var import_ai = require("@prestyj/ai");
 var MAX_BYTES = 10 * 1024 * 1024;
 var fd = null;
+var bytesWritten = 0;
+var capped = false;
 var sessionId = "";
 var appName = "app";
 var cleanups = [];
 var exactSecrets = [];
 function rotateIfNeeded(filePath) {
   try {
-    const st = import_node_fs.default.statSync(filePath);
+    const st = import_node_fs2.default.statSync(filePath);
     if (st.size < MAX_BYTES) return;
     const rotated = `${filePath}.1`;
     try {
-      import_node_fs.default.unlinkSync(rotated);
+      import_node_fs2.default.unlinkSync(rotated);
     } catch {
     }
-    import_node_fs.default.renameSync(filePath, rotated);
+    import_node_fs2.default.renameSync(filePath, rotated);
   } catch {
   }
 }
 function openLog(filePath, name) {
-  if (fd !== null) return false;
+  if (fd !== null || capped) return false;
   appName = name;
   exactSecrets = (0, import_ai.environmentSecrets)(process.env);
   try {
-    import_node_fs.default.mkdirSync(import_node_path2.default.dirname(filePath), { recursive: true, mode: 448 });
+    import_node_fs2.default.mkdirSync(import_node_path3.default.dirname(filePath), { recursive: true, mode: 448 });
   } catch {
   }
   rotateIfNeeded(filePath);
   try {
-    fd = import_node_fs.default.openSync(filePath, "a");
+    fd = import_node_fs2.default.openSync(filePath, "a");
   } catch {
+    fd = null;
+    bytesWritten = 0;
     return false;
   }
-  sessionId = (0, import_node_crypto.randomBytes)(4).toString("hex");
   try {
-    import_node_fs.default.writeSync(fd, "\n");
+    bytesWritten = import_node_fs2.default.fstatSync(fd).size;
+  } catch {
+    try {
+      import_node_fs2.default.closeSync(fd);
+    } catch {
+    }
+    fd = null;
+    bytesWritten = 0;
+    return false;
+  }
+  sessionId = (0, import_node_crypto2.randomBytes)(4).toString("hex");
+  try {
+    if (bytesWritten < MAX_BYTES) {
+      bytesWritten += import_node_fs2.default.writeSync(fd, "\n");
+    }
   } catch {
   }
   return true;
@@ -206,8 +463,23 @@ function log(level, category, message, data) {
     if (pairs) line += ` ${pairs}`;
   }
   line += "\n";
+  const lineBytes = Buffer.byteLength(line);
+  if (bytesWritten + lineBytes > MAX_BYTES) {
+    const capLine = `[${ts}] [sid=${sessionId}] [WARN] [logger] Log cap reached; file logging disabled until restart
+`;
+    try {
+      if (bytesWritten + Buffer.byteLength(capLine) <= MAX_BYTES) {
+        bytesWritten += import_node_fs2.default.writeSync(fd, capLine);
+      }
+      import_node_fs2.default.closeSync(fd);
+    } catch {
+    }
+    fd = null;
+    capped = true;
+    return;
+  }
   try {
-    import_node_fs.default.writeSync(fd, line);
+    bytesWritten += import_node_fs2.default.writeSync(fd, line);
   } catch {
   }
 }
@@ -215,13 +487,16 @@ function registerLogCleanup(fn) {
   cleanups.push(fn);
 }
 function closeLogger(opts) {
-  if (fd === null) return;
-  if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
-  try {
-    import_node_fs.default.closeSync(fd);
-  } catch {
+  if (fd !== null) {
+    if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
+    try {
+      if (fd !== null) import_node_fs2.default.closeSync(fd);
+    } catch {
+    }
   }
   fd = null;
+  bytesWritten = 0;
+  capped = false;
   exactSecrets = [];
   for (const unsub of cleanups) unsub();
   cleanups = [];
@@ -235,7 +510,7 @@ var FALLBACK_VERSION = "2.1.88";
 var memoryCache = null;
 var inflight = null;
 function cachePath() {
-  return import_node_path3.default.join(getAppPaths().agentDir, "claude-code-version.json");
+  return import_node_path4.default.join(getAppPaths().agentDir, "claude-code-version.json");
 }
 async function readDiskCache() {
   try {
@@ -317,7 +592,7 @@ async function getClaudeCliUserAgent() {
 }
 
 // src/oauth/anthropic.ts
-var CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+var CLIENT_ID2 = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
 var TOKEN_URLS = [
   "https://platform.claude.com/v1/oauth/token",
@@ -361,10 +636,10 @@ function toCredentials(data) {
 }
 async function loginAnthropic(callbacks) {
   const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto2.default.randomBytes(16).toString("hex");
+  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
   const params = new URLSearchParams({
     code: "true",
-    client_id: CLIENT_ID,
+    client_id: CLIENT_ID2,
     response_type: "code",
     redirect_uri: REDIRECT_URI,
     scope: SCOPES,
@@ -385,7 +660,7 @@ async function exchangeAnthropicCode(code, state, verifier) {
   const data = await postTokenRequest(
     {
       grant_type: "authorization_code",
-      client_id: CLIENT_ID,
+      client_id: CLIENT_ID2,
       code,
       state,
       redirect_uri: REDIRECT_URI,
@@ -399,7 +674,7 @@ async function refreshAnthropicToken(refreshToken) {
   const data = await postTokenRequest(
     {
       grant_type: "refresh_token",
-      client_id: CLIENT_ID,
+      client_id: CLIENT_ID2,
       refresh_token: refreshToken
     },
     "token refresh"
@@ -409,8 +684,8 @@ async function refreshAnthropicToken(refreshToken) {
 
 // src/oauth/openai.ts
 var import_node_http = __toESM(require("http"), 1);
-var import_node_crypto3 = __toESM(require("crypto"), 1);
-var CLIENT_ID2 = "app_EMoamEEZ73f0CkXaXp7hrann";
+var import_node_crypto4 = __toESM(require("crypto"), 1);
+var CLIENT_ID3 = "app_EMoamEEZ73f0CkXaXp7hrann";
 var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
 var TOKEN_URL = "https://auth.openai.com/oauth/token";
 var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
@@ -418,10 +693,10 @@ var SCOPE = "openid profile email offline_access api.connectors.read api.connect
 var JWT_CLAIM_PATH = "https://api.openai.com/auth";
 async function loginOpenAI(callbacks) {
   const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
+  const state = import_node_crypto4.default.randomBytes(16).toString("hex");
   const url = new URL(AUTHORIZE_URL2);
   url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID2);
+  url.searchParams.set("client_id", CLIENT_ID3);
   url.searchParams.set("redirect_uri", REDIRECT_URI2);
   url.searchParams.set("scope", SCOPE);
   url.searchParams.set("code_challenge", challenge);
@@ -542,7 +817,7 @@ async function exchangeOpenAICode(code, verifier) {
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "authorization_code",
-      client_id: CLIENT_ID2,
+      client_id: CLIENT_ID3,
       code,
       redirect_uri: REDIRECT_URI2,
       code_verifier: verifier
@@ -566,7 +841,7 @@ async function refreshOpenAIToken(refreshToken) {
     body: new URLSearchParams({
       grant_type: "refresh_token",
       refresh_token: refreshToken,
-      client_id: CLIENT_ID2
+      client_id: CLIENT_ID3
     })
   });
   if (!response.ok) {
@@ -588,7 +863,7 @@ async function refreshOpenAIToken(refreshToken) {
 
 // src/oauth/gemini.ts
 var import_node_http2 = __toESM(require("http"), 1);
-var import_node_crypto4 = __toESM(require("crypto"), 1);
+var import_node_crypto5 = __toESM(require("crypto"), 1);
 var CLIENT_ID_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_ID";
 var CLIENT_SECRET_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_SECRET";
 var DEFAULT_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
@@ -622,7 +897,7 @@ var CodeAssistHttpError = class extends Error {
 async function loginGemini(callbacks) {
   const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
   const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto4.default.randomBytes(32).toString("hex");
+  const state = import_node_crypto5.default.randomBytes(32).toString("hex");
   const redirectUri = await getLoopbackRedirectUri();
   const url = new URL(AUTHORIZE_URL3);
   url.searchParams.set("response_type", "code");
@@ -883,287 +1158,70 @@ function throwProjectError(response) {
 async function codeAssistPost(accessToken, method, body) {
   let lastError;
   for (let attempt = 0; attempt <= CODE_ASSIST_POST_RETRIES; attempt++) {
-    try {
-      return await codeAssistRequest(getCodeAssistMethodUrl(method), accessToken, method, {
-        method: "POST",
-        body: JSON.stringify(body)
-      });
-    } catch (err) {
-      if (!(err instanceof CodeAssistHttpError) || attempt === CODE_ASSIST_POST_RETRIES || !shouldRetryCodeAssistStatus(err.status)) {
-        throw err;
-      }
-      lastError = err;
-    }
-    await new Promise((resolve) => setTimeout(resolve, CODE_ASSIST_POST_RETRY_DELAY_MS));
-  }
-  throw lastError ?? new Error(`Gemini Code Assist ${method} failed.`);
-}
-async function codeAssistGet(accessToken, operationName) {
-  return codeAssistRequest(getCodeAssistOperationUrl(operationName), accessToken, "operation", {
-    method: "GET"
-  });
-}
-async function codeAssistRequest(url, accessToken, label, init) {
-  const response = await fetch(url, {
-    ...init,
-    headers: codeAssistHeaders(accessToken)
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new CodeAssistHttpError(label, response.status, text);
-  }
-  return await response.json();
-}
-function getCodeAssistBaseUrl() {
-  const endpoint = process.env.CODE_ASSIST_ENDPOINT ?? CODE_ASSIST_BASE_URL;
-  const version = process.env.CODE_ASSIST_API_VERSION || CODE_ASSIST_API_VERSION;
-  return `${endpoint}/${version}`;
-}
-function getCodeAssistMethodUrl(method) {
-  return `${getCodeAssistBaseUrl()}:${method}`;
-}
-function getCodeAssistOperationUrl(operationName) {
-  return `${getCodeAssistBaseUrl()}/${operationName}`;
-}
-function shouldRetryCodeAssistStatus(status) {
-  return status === 429 || status === 499 || status >= 500 && status <= 599;
-}
-function isVpcScAffectedError(error) {
-  try {
-    const parsed = JSON.parse(error.body);
-    if (!parsed || typeof parsed !== "object" || !("error" in parsed)) return false;
-    const details = parsed.error?.details;
-    return Array.isArray(details) ? details.some(
-      (detail) => detail != null && typeof detail === "object" && "reason" in detail && detail.reason === VPC_SC_REASON
-    ) : false;
-  } catch {
-    return false;
-  }
-}
-function codeAssistHeaders(accessToken) {
-  return {
-    Authorization: `Bearer ${accessToken}`,
-    "Content-Type": "application/json",
-    "User-Agent": "google-gemini-cli",
-    "X-Goog-Api-Client": "gemini-cli/0.0.0"
-  };
-}
-
-// src/oauth/kimi.ts
-var import_node_child_process = require("child_process");
-var import_node_crypto5 = require("crypto");
-var import_node_fs2 = require("fs");
-var import_node_os2 = require("os");
-var import_node_path4 = __toESM(require("path"), 1);
-var CLIENT_ID3 = "17e5f671-d194-4dfb-9706-5516cb48c098";
-var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
-var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
-var KIMI_PLATFORM = "kimi_code_cli";
-var DEFAULT_KIMI_VERSION = "1.0.11";
-var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
-function oauthHost() {
-  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
-  return host.replace(/\/+$/, "");
-}
-function kimiCodeBaseUrl() {
-  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
-}
-function kimiVersion() {
-  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
-  return asciiHeader(v, DEFAULT_KIMI_VERSION);
-}
-function asciiHeader(value, fallback = "unknown") {
-  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : fallback;
-}
-function macOsProductVersion() {
-  try {
-    const version = (0, import_node_child_process.execFileSync)("/usr/bin/sw_vers", ["-productVersion"], {
-      encoding: "utf-8",
-      timeout: 1e3
-    }).trim();
-    return version.length > 0 ? version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function deviceModel() {
-  const os2 = (0, import_node_os2.type)();
-  const version = (0, import_node_os2.release)();
-  const osArch = (0, import_node_os2.arch)();
-  if (os2 === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
-  if (os2 === "Windows_NT") return `Windows ${version} ${osArch}`;
-  return `${os2} ${version} ${osArch}`.trim();
-}
-function deviceId() {
-  const idPath = import_node_path4.default.join(getAppPaths().agentDir, "kimi_device_id");
-  if ((0, import_node_fs2.existsSync)(idPath)) {
-    try {
-      const text = (0, import_node_fs2.readFileSync)(idPath, "utf-8").trim();
-      if (text.length > 0) return text;
-    } catch {
-    }
-  }
-  const id = (0, import_node_crypto5.randomUUID)();
-  try {
-    (0, import_node_fs2.mkdirSync)(getAppPaths().agentDir, { recursive: true, mode: 448 });
-    (0, import_node_fs2.writeFileSync)(idPath, id, { encoding: "utf-8", mode: 384 });
-  } catch {
-  }
-  return id;
-}
-function deviceHeaders() {
-  return {
-    "X-Msh-Platform": KIMI_PLATFORM,
-    "X-Msh-Version": kimiVersion(),
-    "X-Msh-Device-Name": asciiHeader((0, import_node_os2.hostname)()),
-    "X-Msh-Device-Model": asciiHeader(deviceModel()),
-    "X-Msh-Os-Version": asciiHeader((0, import_node_os2.release)()),
-    "X-Msh-Device-Id": deviceId()
-  };
-}
-function kimiCodingHeaders() {
-  return {
-    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
-    ...deviceHeaders()
-  };
-}
-function isKimiCodingEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
-}
-async function postForm(endpoint, params) {
-  const response = await fetch(`${oauthHost()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      ...deviceHeaders(),
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(params).toString()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function credsFromTokenResponse(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  const expiresIn = Number(data.expires_in);
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Kimi OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error("Kimi OAuth response missing refresh_token.");
-  }
-  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-    throw new Error("Kimi OAuth response missing or invalid expires_in.");
-  }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    baseUrl: kimiCodeBaseUrl()
-  };
-}
-async function requestDeviceAuthorization() {
-  const { status, data } = await postForm("/api/oauth/device_authorization", {
-    client_id: CLIENT_ID3
-  });
-  if (status !== 200) {
-    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Kimi device authorization response missing user_code/device_code.");
-  }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5
-  };
-}
-async function pollDeviceToken(deviceCode) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID3,
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
+    try {
+      return await codeAssistRequest(getCodeAssistMethodUrl(method), accessToken, method, {
+        method: "POST",
+        body: JSON.stringify(body)
+      });
+    } catch (err) {
+      if (!(err instanceof CodeAssistHttpError) || attempt === CODE_ASSIST_POST_RETRIES || !shouldRetryCodeAssistStatus(err.status)) {
+        throw err;
+      }
+      lastError = err;
+    }
+    await new Promise((resolve) => setTimeout(resolve, CODE_ASSIST_POST_RETRY_DELAY_MS));
   }
+  throw lastError ?? new Error(`Gemini Code Assist ${method} failed.`);
 }
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
+async function codeAssistGet(accessToken, operationName) {
+  return codeAssistRequest(getCodeAssistOperationUrl(operationName), accessToken, "operation", {
+    method: "GET"
   });
 }
-async function loginKimi(callbacks) {
-  const auth = await requestDeviceAuthorization();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    await sleep(interval * 1e3);
-    const result = await pollDeviceToken(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Kimi authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Kimi device code expired. Please run login again.");
-    }
-    if (result.kind === "slow_down") {
-      interval += 5;
-    }
+async function codeAssistRequest(url, accessToken, label, init) {
+  const response = await fetch(url, {
+    ...init,
+    headers: codeAssistHeaders(accessToken)
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new CodeAssistHttpError(label, response.status, text);
   }
-  throw new Error("Kimi login timed out. Please run login again.");
+  return await response.json();
 }
-async function refreshKimiToken(refreshToken) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID3,
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
+function getCodeAssistBaseUrl() {
+  const endpoint = process.env.CODE_ASSIST_ENDPOINT ?? CODE_ASSIST_BASE_URL;
+  const version = process.env.CODE_ASSIST_API_VERSION || CODE_ASSIST_API_VERSION;
+  return `${endpoint}/${version}`;
+}
+function getCodeAssistMethodUrl(method) {
+  return `${getCodeAssistBaseUrl()}:${method}`;
+}
+function getCodeAssistOperationUrl(operationName) {
+  return `${getCodeAssistBaseUrl()}/${operationName}`;
+}
+function shouldRetryCodeAssistStatus(status) {
+  return status === 429 || status === 499 || status >= 500 && status <= 599;
+}
+function isVpcScAffectedError(error) {
+  try {
+    const parsed = JSON.parse(error.body);
+    if (!parsed || typeof parsed !== "object" || !("error" in parsed)) return false;
+    const details = parsed.error?.details;
+    return Array.isArray(details) ? details.some(
+      (detail) => detail != null && typeof detail === "object" && "reason" in detail && detail.reason === VPC_SC_REASON
+    ) : false;
+  } catch {
+    return false;
   }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
+}
+function codeAssistHeaders(accessToken) {
+  return {
+    Authorization: `Bearer ${accessToken}`,
+    "Content-Type": "application/json",
+    "User-Agent": "google-gemini-cli",
+    "X-Goog-Api-Client": "gemini-cli/0.0.0"
+  };
 }
 
 // src/file-lock.ts
@@ -1231,7 +1289,34 @@ function isAlive(pid) {
 // src/auth-storage.ts
 var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
 var XIAOMI_CREDITS_KEY = "xiaomi-credits";
-var REFRESH_SKEW_MS = 6e4;
+var LOCAL_AUTH_KEY_PREFIX = "local:";
+var LOCAL_CREDENTIAL_LIFETIME_MS = 100 * 365 * 24 * 60 * 60 * 1e3;
+function activeBaseUrlEntry(data, provider) {
+  if (provider === "moonshot") {
+    const oauth = data[MOONSHOT_OAUTH_KEY];
+    if (oauth) {
+      const exhaustedUntil = oauth.usageExhaustedUntil ?? 0;
+      if (Date.now() < exhaustedUntil && data["moonshot"]) return data["moonshot"];
+      return oauth;
+    }
+    return data["moonshot"];
+  }
+  return data[provider];
+}
+function readStoredBaseUrlSync(authFile, provider) {
+  try {
+    const data = JSON.parse((0, import_node_fs3.readFileSync)(authFile, "utf-8"));
+    return activeBaseUrlEntry(data, provider)?.baseUrl;
+  } catch {
+    return void 0;
+  }
+}
+var MIN_REFRESH_THRESHOLD_MS = 3e5;
+var REFRESH_THRESHOLD_RATIO = 0.5;
+function refreshThresholdMs(creds) {
+  const lifetimeMs = (creds.expiresIn ?? 0) * 1e3;
+  return Math.max(MIN_REFRESH_THRESHOLD_MS, lifetimeMs * REFRESH_THRESHOLD_RATIO);
+}
 var USAGE_EXHAUSTED_DEFAULT_MS = 15 * 60 * 1e3;
 var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
   "glm",
@@ -1241,7 +1326,9 @@ var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
   "deepseek",
   "openrouter",
   "sakana",
-  "xai"
+  "xai",
+  // Local endpoints: a fixed (usually placeholder) key, never refreshable.
+  "local"
 ]);
 var AuthStorage = class {
   data = {};
@@ -1290,8 +1377,33 @@ var AuthStorage = class {
     if (provider === "xiaomi") {
       return Boolean(this.data["xiaomi"] || this.data[XIAOMI_CREDITS_KEY]);
     }
+    if (provider === "local") {
+      return Object.keys(this.data).some((key) => key.startsWith(LOCAL_AUTH_KEY_PREFIX));
+    }
     return Boolean(this.data[provider]);
   }
+  /** Endpoint ids that currently have a `local:<id>` credential stored. */
+  async listLocalEndpointIds() {
+    await this.ensureLoaded();
+    return Object.keys(this.data).filter((key) => key.startsWith(LOCAL_AUTH_KEY_PREFIX)).map((key) => key.slice(LOCAL_AUTH_KEY_PREFIX.length));
+  }
+  /**
+   * Write (or refresh) the credential for one local endpoint. The `baseUrl` is
+   * what `effectiveBaseUrl` later picks up, and `accessToken` is the endpoint's
+   * key — a placeholder for the servers that ignore it.
+   */
+  async setLocalEndpoint(endpointId, baseUrl, apiKey) {
+    await this.setCredentials(`${LOCAL_AUTH_KEY_PREFIX}${endpointId}`, {
+      accessToken: apiKey && apiKey.length > 0 ? apiKey : "local",
+      refreshToken: "",
+      expiresAt: Date.now() + LOCAL_CREDENTIAL_LIFETIME_MS,
+      baseUrl
+    });
+  }
+  /** Remove one local endpoint's credential. No-op when it isn't stored. */
+  async removeLocalEndpoint(endpointId) {
+    await this.clearCredentials(`${LOCAL_AUTH_KEY_PREFIX}${endpointId}`);
+  }
   /**
    * True if the active credential for `provider` is a static API key with no
    * refresh mechanism. For `moonshot` this is only true when the Kimi OAuth
@@ -1306,6 +1418,16 @@ var AuthStorage = class {
     }
     return STATIC_API_KEY_PROVIDERS.has(provider);
   }
+  /**
+   * The base URL on the credential that is active right now, if any.
+   * Synchronous — call only after load()/resolveCredentials() populated the
+   * snapshot. For `moonshot` this is the Kimi For Coding URL whenever the
+   * OAuth entry is the one resolveCredentials would serve (i.e. not currently
+   * usage-exhausted with an API key configured).
+   */
+  getStoredBaseUrl(provider) {
+    return activeBaseUrlEntry(this.data, provider)?.baseUrl;
+  }
   async load() {
     await withFileLock(this.filePath, async () => {
       try {
@@ -1337,27 +1459,46 @@ var AuthStorage = class {
   /**
    * Force a re-read from disk, discarding the in-memory cache. Needed when
    * another process mutates the auth file out-of-band — e.g. the desktop app
-   * writes API keys natively (Rust → ~/.ezcoder/auth.json) without going through
-   * this instance, so a long-lived daemon's cache would otherwise stay stale and
-   * never see a newly added provider key.
+   * writes API keys natively without going through this instance.
    */
   async reload() {
     this.loaded = false;
     await this.load();
   }
+  /**
+   * Apply one provider-scoped mutation to the latest on-disk snapshot.
+   * AuthStorage instances live in every app session/process, so writing this
+   * instance's cached snapshot can erase credentials another instance just
+   * added. The file lock only serializes writers; the re-read prevents stale
+   * full-file overwrites.
+   */
+  async mutateLatest(mutator) {
+    await this.ensureLoaded();
+    await withFileLock(this.filePath, async () => {
+      const latest = await readAuthData(this.filePath);
+      mutator(latest);
+      await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
+      this.data = latest;
+    });
+  }
+  async reloadLatest() {
+    await withFileLock(this.filePath, async () => {
+      this.data = await readAuthData(this.filePath);
+    });
+  }
   async getCredentials(provider) {
     await this.ensureLoaded();
     return this.data[provider];
   }
   async setCredentials(provider, creds) {
-    await this.ensureLoaded();
-    this.data[provider] = creds;
-    await this.save();
+    await this.mutateLatest((latest) => {
+      latest[provider] = creds;
+    });
   }
   async clearCredentials(provider) {
-    await this.ensureLoaded();
-    delete this.data[provider];
-    await this.save();
+    await this.mutateLatest((latest) => {
+      delete latest[provider];
+    });
   }
   /**
    * Mark the credential stored under `storageKey` as usage-exhausted until
@@ -1371,12 +1512,15 @@ var AuthStorage = class {
    * nothing is stored under `storageKey`.
    */
   async markUsageExhausted(storageKey, resetsAt) {
-    await this.ensureLoaded();
-    const creds = this.data[storageKey];
-    if (!creds) return;
     const until = resetsAt !== void 0 && resetsAt * 1e3 > Date.now() ? resetsAt * 1e3 : Date.now() + USAGE_EXHAUSTED_DEFAULT_MS;
-    creds.usageExhaustedUntil = until;
-    await this.save();
+    let marked = false;
+    await this.mutateLatest((latest) => {
+      const creds = latest[storageKey];
+      if (!creds) return;
+      creds.usageExhaustedUntil = until;
+      marked = true;
+    });
+    if (!marked) return;
     log(
       "WARN",
       "auth",
@@ -1384,8 +1528,11 @@ var AuthStorage = class {
     );
   }
   async clearAll() {
-    this.data = {};
-    await this.save();
+    await this.ensureLoaded();
+    await withFileLock(this.filePath, async () => {
+      this.data = {};
+      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+    });
   }
   /**
    * Returns valid credentials, auto-refreshing if expired.
@@ -1395,6 +1542,10 @@ var AuthStorage = class {
    */
   async resolveCredentials(provider, opts) {
     await this.ensureLoaded();
+    const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : provider === "moonshot" ? [MOONSHOT_OAUTH_KEY, "moonshot"] : [provider];
+    if (!directStorageKeys.some((key) => Boolean(this.data[key]))) {
+      await this.reloadLatest();
+    }
     if (opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider)) {
       for (const key of opts.storageKeys) {
         const creds2 = this.data[key];
@@ -1435,47 +1586,50 @@ var AuthStorage = class {
     if (STATIC_API_KEY_PROVIDERS.has(provider)) {
       return creds;
     }
-    if (!opts?.forceRefresh && Date.now() < creds.expiresAt - REFRESH_SKEW_MS) {
+    if (!opts?.forceRefresh && Date.now() < creds.expiresAt - refreshThresholdMs(creds)) {
       return creds;
     }
     const existing = this.refreshLocks.get(provider);
     if (existing) return existing;
     const refreshPromise = withFileLock(this.filePath, async () => {
-      try {
-        const content = await import_promises4.default.readFile(this.filePath, "utf-8");
-        const freshData = JSON.parse(content);
-        const freshCreds = freshData[provider];
-        if (freshCreds && !opts?.forceRefresh && Date.now() < freshCreds.expiresAt - REFRESH_SKEW_MS) {
-          this.data[provider] = freshCreds;
-          return freshCreds;
-        }
-      } catch {
+      const latest = await readAuthData(this.filePath);
+      const latestCreds = latest[provider];
+      if (!latestCreds) {
+        this.data = latest;
+        throw new NotLoggedInError(provider);
+      }
+      const credentialWasReplaced = latestCreds.accessToken !== creds.accessToken || latestCreds.refreshToken !== creds.refreshToken || latestCreds.expiresAt !== creds.expiresAt;
+      if (credentialWasReplaced || !opts?.forceRefresh && Date.now() < latestCreds.expiresAt - refreshThresholdMs(latestCreds)) {
+        this.data = latest;
+        return latestCreds;
       }
       const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : refreshOpenAIToken;
       let refreshed;
       try {
-        refreshed = await refreshFn(creds.refreshToken);
+        refreshed = await refreshFn(latestCreds.refreshToken);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh/i.test(msg) || /unauthorized/i.test(msg);
         if (isAuthFailure) {
-          delete this.data[provider];
-          await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+          delete latest[provider];
+          this.data = latest;
+          await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
           throw new NotLoggedInError(provider);
         }
         throw err;
       }
-      if (!refreshed.accountId && creds.accountId) {
-        refreshed.accountId = creds.accountId;
+      if (!refreshed.accountId && latestCreds.accountId) {
+        refreshed.accountId = latestCreds.accountId;
       }
-      if (!refreshed.projectId && creds.projectId) {
-        refreshed.projectId = creds.projectId;
+      if (!refreshed.projectId && latestCreds.projectId) {
+        refreshed.projectId = latestCreds.projectId;
       }
-      if (!refreshed.baseUrl && creds.baseUrl) {
-        refreshed.baseUrl = creds.baseUrl;
+      if (!refreshed.baseUrl && latestCreds.baseUrl) {
+        refreshed.baseUrl = latestCreds.baseUrl;
       }
-      this.data[provider] = refreshed;
-      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+      latest[provider] = refreshed;
+      this.data = latest;
+      await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
       return refreshed;
     });
     this.refreshLocks.set(provider, refreshPromise);
@@ -1493,12 +1647,16 @@ var AuthStorage = class {
     const creds = await this.resolveCredentials(provider);
     return creds.accessToken;
   }
-  async save() {
-    await withFileLock(this.filePath, async () => {
-      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
-    });
-  }
 };
+async function readAuthData(filePath) {
+  try {
+    const content = await import_promises4.default.readFile(filePath, "utf-8");
+    return JSON.parse(content);
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  }
+}
 async function atomicWriteFile(filePath, content) {
   const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${import_node_crypto6.default.randomUUID().slice(0, 8)}.tmp`;
   try {
@@ -1553,8 +1711,12 @@ var MODELS = [
   //   maxThinkingLevel: "max",
   // },
   {
-    id: "claude-opus-4-8",
-    name: "Claude Opus 4.8",
+    // Released 2026-07-24 — "For complex agentic coding and enterprise work".
+    // Near-Fable capability at half the price ($5/$25 vs $10/$50). Adaptive
+    // thinking with the full effort ladder (low→max, xhigh included); dateless
+    // ID is the canonical pinned snapshot (post-4.6 naming scheme).
+    id: "claude-opus-5",
+    name: "Claude Opus 5",
     provider: "anthropic",
     contextWindow: 1e6,
     maxOutputTokens: 128e3,
@@ -1591,7 +1753,8 @@ var MODELS = [
   // ── OpenAI (Codex) ─────────────────────────────────────
   // GPT-5.6 family — three agentic coding tiers launched July 2026. The public
   // Responses API advertises a 1.05M context window; OpenAI's Codex product
-  // catalog advertises 372K on the ChatGPT OAuth route. All three take
+  // catalog advertises 272K on the ChatGPT OAuth route (corrected from the
+  // initially advertised 372K — openai/codex PR #33972, Jul 18 2026 hotfix). All three take
   // text+image input, freeform apply_patch, text+image web search, and parallel
   // tool calls.
   {
@@ -1603,7 +1766,7 @@ var MODELS = [
     name: "GPT-5.6 Sol",
     provider: "openai",
     contextWindow: 105e4,
-    codexContextWindow: 372e3,
+    codexContextWindow: 272e3,
     maxOutputTokens: 128e3,
     supportsThinking: true,
     supportsImages: true,
@@ -1618,7 +1781,7 @@ var MODELS = [
     name: "GPT-5.6 Terra",
     provider: "openai",
     contextWindow: 105e4,
-    codexContextWindow: 372e3,
+    codexContextWindow: 272e3,
     maxOutputTokens: 128e3,
     supportsThinking: true,
     supportsImages: true,
@@ -1633,7 +1796,7 @@ var MODELS = [
     name: "GPT-5.6 Luna",
     provider: "openai",
     contextWindow: 105e4,
-    codexContextWindow: 372e3,
+    codexContextWindow: 272e3,
     maxOutputTokens: 128e3,
     supportsThinking: true,
     supportsImages: true,
@@ -1752,8 +1915,9 @@ var MODELS = [
   },
   // ── Moonshot (Kimi) ────────────────────────────────────
   // K3 is Kimi's 2.8T-parameter flagship for long-horizon coding, knowledge
-  // work, and deep reasoning. It always reasons at the `max` effort; the public
-  // API uses `reasoning_effort`, while Kimi Code OAuth keeps its managed wire shape.
+  // work, and deep reasoning. Its effort ladder is server-declared as
+  // low/high/max on both the public API (default max) and the Kimi For Coding
+  // OAuth endpoint (default high); thinking can also be fully disabled.
   {
     id: "kimi-k3",
     name: "Kimi K3",
@@ -1938,14 +2102,30 @@ var MODELS = [
     maxThinkingLevel: "high"
   }
 ];
+var runtimeModels = /* @__PURE__ */ new Map();
+function registerRuntimeModels(models) {
+  for (const model of models) runtimeModels.set(model.id, model);
+}
+function clearRuntimeModels(predicate) {
+  if (!predicate) {
+    runtimeModels.clear();
+    return;
+  }
+  for (const [id, model] of runtimeModels) {
+    if (predicate(model)) runtimeModels.delete(id);
+  }
+}
+function getAllModels() {
+  return [...MODELS, ...runtimeModels.values()];
+}
 function getModel(id) {
-  return MODELS.find((m) => m.id === id);
+  return MODELS.find((m) => m.id === id) ?? runtimeModels.get(id);
 }
 function getModelsForProvider(provider) {
-  return MODELS.filter((m) => m.provider === provider);
+  return getAllModels().filter((m) => m.provider === provider);
 }
 function getAuthStorageKeys(provider, modelId) {
-  const model = MODELS.find((m) => m.id === modelId && m.provider === provider);
+  const model = getAllModels().find((m) => m.id === modelId && m.provider === provider);
   return model?.authStorageKeys ?? [provider];
 }
 function getAuthStorageKey(provider, modelId) {
@@ -1968,8 +2148,23 @@ function getDefaultModel(provider) {
   if (provider === "openrouter") return MODELS.find((m) => m.id === "qwen/qwen3.6-plus");
   if (provider === "sakana") return MODELS.find((m) => m.id === "fugu");
   if (provider === "xai") return MODELS.find((m) => m.id === "grok-4.5");
+  if (provider === "local") {
+    return getModelsForProvider("local")[0] ?? PLACEHOLDER_LOCAL_MODEL;
+  }
   return MODELS.find((m) => m.id === "claude-sonnet-5");
 }
+var PLACEHOLDER_LOCAL_MODEL = {
+  id: "local/none/none",
+  name: "No local model discovered",
+  provider: "local",
+  contextWindow: 8192,
+  maxOutputTokens: 2048,
+  supportsThinking: false,
+  supportsImages: false,
+  supportsVideo: false,
+  costTier: "low",
+  maxThinkingLevel: "high"
+};
 function usesOpenAICodexTransport(options) {
   return options?.provider === "openai" && Boolean(options.accountId);
 }
@@ -1987,6 +2182,11 @@ function getContextWindow(modelId, options) {
 function getMaxThinkingLevel(modelId) {
   return getModel(modelId)?.maxThinkingLevel ?? "high";
 }
+function getDefaultThinkingLevel(modelId, options) {
+  const model = getModel(modelId);
+  if (model?.id === "kimi-k3" && isKimiCodingEndpoint(options?.baseUrl)) return "high";
+  return model?.maxThinkingLevel ?? "high";
+}
 function getSummaryModel(provider, currentModelId) {
   if (provider === "anthropic") {
     return MODELS.find((m) => m.id === "claude-sonnet-5");
@@ -2014,7 +2214,7 @@ var OPENAI_GPT_56_THINKING_LEVELS = [
 ];
 var SAKANA_THINKING_LEVELS = ["high", "xhigh"];
 var XAI_THINKING_LEVELS = ["low", "medium", "high"];
-var ANTHROPIC_OPUS_48_47_THINKING_LEVELS = [
+var ANTHROPIC_XHIGH_THINKING_LEVELS = [
   "low",
   "medium",
   "high",
@@ -2027,6 +2227,8 @@ var ANTHROPIC_ADAPTIVE_THINKING_LEVELS = [
   "high",
   "max"
 ];
+var MOONSHOT_K3_THINKING_LEVELS = ["low", "high", "max"];
+var LOCAL_THINKING_LEVELS = ["low", "medium", "high", "max"];
 function isOpenAIGptModel(provider, model) {
   return provider === "openai" && model.startsWith("gpt-");
 }
@@ -2036,16 +2238,25 @@ function isSakanaModel(provider) {
 function isXaiModel(provider) {
   return provider === "xai";
 }
-function isAnthropicOpus48Or47Model(provider, model) {
-  return provider === "anthropic" && /opus-4-8|opus-4-7/.test(model);
+function isMoonshotK3Model(provider, model) {
+  return provider === "moonshot" && model === "kimi-k3";
+}
+function isAnthropicXhighModel(provider, model) {
+  return provider === "anthropic" && /opus-5|opus-4-8|opus-4-7/.test(model);
 }
 function isAnthropicAdaptiveModel(provider, model) {
-  return provider === "anthropic" && /opus-4-8|opus-4-7|opus-4-6|sonnet-5|fable-5|mythos-5/.test(model);
+  return provider === "anthropic" && /opus-5|opus-4-8|opus-4-7|opus-4-6|sonnet-5|fable-5|mythos-5/.test(model);
 }
 function getSupportedThinkingLevels(provider, model) {
+  if (provider === "local") {
+    const info = getModel(model);
+    if (!info?.supportsThinking) return [];
+    const maxIndex2 = LOCAL_THINKING_LEVELS.indexOf(info.maxThinkingLevel);
+    return maxIndex2 === -1 ? LOCAL_THINKING_LEVELS.slice(0, 3) : LOCAL_THINKING_LEVELS.slice(0, maxIndex2 + 1);
+  }
   const maxLevel = getMaxThinkingLevel(model);
   if (isAnthropicAdaptiveModel(provider, model)) {
-    const levels2 = isAnthropicOpus48Or47Model(provider, model) ? ANTHROPIC_OPUS_48_47_THINKING_LEVELS : ANTHROPIC_ADAPTIVE_THINKING_LEVELS;
+    const levels2 = isAnthropicXhighModel(provider, model) ? ANTHROPIC_XHIGH_THINKING_LEVELS : ANTHROPIC_ADAPTIVE_THINKING_LEVELS;
     const maxIndex2 = levels2.indexOf(maxLevel);
     if (maxIndex2 === -1) return ["low", "medium", "high"];
     return levels2.slice(0, maxIndex2 + 1);
@@ -2060,6 +2271,7 @@ function getSupportedThinkingLevels(provider, model) {
     if (maxIndex2 === -1) return XAI_THINKING_LEVELS;
     return XAI_THINKING_LEVELS.slice(0, maxIndex2 + 1);
   }
+  if (isMoonshotK3Model(provider, model)) return MOONSHOT_K3_THINKING_LEVELS;
   if (!isOpenAIGptModel(provider, model)) return [maxLevel];
   const levels = model.startsWith("gpt-5.6-") ? OPENAI_GPT_56_THINKING_LEVELS : OPENAI_GPT_THINKING_LEVELS;
   const maxIndex = levels.indexOf(maxLevel);
@@ -2071,7 +2283,11 @@ function isThinkingLevelSupported(provider, model, level) {
 }
 function getNextThinkingLevel(provider, model, current) {
   const supportedLevels = getSupportedThinkingLevels(provider, model);
-  const shouldCycleLevels = isOpenAIGptModel(provider, model) || isAnthropicAdaptiveModel(provider, model) || isSakanaModel(provider) || isXaiModel(provider);
+  const shouldCycleLevels = isOpenAIGptModel(provider, model) || isAnthropicAdaptiveModel(provider, model) || isSakanaModel(provider) || isXaiModel(provider) || isMoonshotK3Model(provider, model) || // Local servers take a real effort level, not just on/off: Ollama accepts
+  // low/medium/high on `reasoning_effort` (verified against 0.32) and the
+  // other OpenAI-compatible servers use the same three. A model that can't
+  // reason at all already has no supported levels, so it never gets here.
+  provider === "local";
   if (!shouldCycleLevels) {
     return current ? void 0 : supportedLevels[0];
   }
@@ -2081,11 +2297,259 @@ function getNextThinkingLevel(provider, model, current) {
   return supportedLevels[index + 1];
 }
 
+// src/local-models.ts
+var DEFAULT_LOCAL_ENDPOINTS = [
+  { id: "ollama", label: "Ollama", baseUrl: "http://127.0.0.1:11434/v1", kind: "ollama" },
+  { id: "lmstudio", label: "LM Studio", baseUrl: "http://127.0.0.1:1234/v1", kind: "lmstudio" },
+  { id: "llamacpp", label: "llama.cpp", baseUrl: "http://127.0.0.1:8080/v1", kind: "llamacpp" },
+  { id: "vllm", label: "vLLM", baseUrl: "http://127.0.0.1:8000/v1", kind: "vllm" }
+];
+var FALLBACK_CONTEXT_WINDOW = 8192;
+var LOCAL_API_KEY_PLACEHOLDER = "local";
+var DEFAULT_PROBE_TIMEOUT_MS = 1200;
+var ENRICH_CONCURRENCY = 6;
+var CACHE_TTL_MS2 = 3e4;
+var NON_CHAT_ID_PATTERN = /(?:^|[-_/])(?:embed|embedding|rerank|reranker|bge|nomic-embed)/i;
+var LOCAL_ID_PREFIX = "local/";
+function formatLocalModelId(endpointId, rawId) {
+  return `${LOCAL_ID_PREFIX}${endpointId}/${rawId}`;
+}
+function parseLocalModelId(id) {
+  if (!id.startsWith(LOCAL_ID_PREFIX)) return void 0;
+  const rest = id.slice(LOCAL_ID_PREFIX.length);
+  const slash = rest.indexOf("/");
+  if (slash <= 0 || slash === rest.length - 1) return void 0;
+  return { endpointId: rest.slice(0, slash), rawId: rest.slice(slash + 1) };
+}
+function isLocalModelId(id) {
+  return parseLocalModelId(id) !== void 0;
+}
+function localAuthStorageKey(endpointId) {
+  return `local:${endpointId}`;
+}
+function endpointRoot(baseUrl) {
+  return baseUrl.replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+function authHeaders(endpoint) {
+  return {
+    Authorization: `Bearer ${endpoint.apiKey ?? LOCAL_API_KEY_PLACEHOLDER}`,
+    Accept: "application/json"
+  };
+}
+async function fetchJson(url, endpoint, options) {
+  try {
+    const res = await fetchJsonOrThrow(url, endpoint, options);
+    return res;
+  } catch {
+    return void 0;
+  }
+}
+async function fetchJsonOrThrow(url, endpoint, { timeoutMs, signal, method = "GET", body }) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const onAbort = () => controller.abort();
+  signal?.addEventListener("abort", onAbort, { once: true });
+  try {
+    const res = await fetch(url, {
+      method,
+      signal: controller.signal,
+      headers: body ? { ...authHeaders(endpoint), "Content-Type": "application/json" } : authHeaders(endpoint),
+      ...body ? { body: JSON.stringify(body) } : {}
+    });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    return await res.json();
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+  }
+}
+function unreachableReason(endpoint, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (/abort/i.test(message)) return `No response from ${endpoint.baseUrl} (timed out)`;
+  if (/HTTP 401|HTTP 403/.test(message)) {
+    return `${endpoint.baseUrl} rejected the API key (HTTP ${message.includes("401") ? 401 : 403})`;
+  }
+  if (/HTTP \d+/.test(message)) return `${endpoint.baseUrl} returned ${message}`;
+  return `Not running at ${endpoint.baseUrl}`;
+}
+async function probeEndpoint(endpoint, { timeoutMs = DEFAULT_PROBE_TIMEOUT_MS, signal } = {}) {
+  const listUrl = `${endpoint.baseUrl.replace(/\/+$/, "")}/models`;
+  let list;
+  try {
+    list = await fetchJsonOrThrow(listUrl, endpoint, { timeoutMs, signal });
+  } catch (err) {
+    return { endpoint, reachable: false, reason: unreachableReason(endpoint, err), models: [] };
+  }
+  const entries = (list.data ?? []).filter(
+    (entry) => typeof entry.id === "string" && entry.id.length > 0 && !NON_CHAT_ID_PATTERN.test(entry.id)
+  );
+  const models = await enrich(endpoint, entries, { timeoutMs, signal });
+  log("INFO", "local-models", `Probed ${endpoint.label}`, {
+    baseUrl: endpoint.baseUrl,
+    models: String(models.length)
+  });
+  return { endpoint, reachable: true, models };
+}
+async function enrich(endpoint, entries, options) {
+  if (endpoint.kind === "lmstudio") return enrichLmStudio(endpoint, entries, options);
+  if (endpoint.kind === "ollama") return enrichOllama(endpoint, entries, options);
+  if (endpoint.kind === "llamacpp") return enrichLlamaCpp(endpoint, entries, options);
+  return entries.map((entry) => genericModel(endpoint, entry));
+}
+function genericModel(endpoint, entry) {
+  const declared = typeof entry.max_model_len === "number" ? entry.max_model_len : void 0;
+  return {
+    rawId: entry.id,
+    endpointId: endpoint.id,
+    contextWindow: declared ?? FALLBACK_CONTEXT_WINDOW,
+    contextWindowKnown: declared !== void 0,
+    supportsTools: true,
+    supportsImages: false,
+    supportsThinking: false
+  };
+}
+async function enrichOllama(endpoint, entries, options) {
+  const showUrl = `${endpointRoot(endpoint.baseUrl)}/api/show`;
+  const enriched = await mapLimited(entries, ENRICH_CONCURRENCY, async (entry) => {
+    const show = await fetchJson(showUrl, endpoint, {
+      ...options,
+      method: "POST",
+      body: { model: entry.id }
+    });
+    if (!show) return genericModel(endpoint, entry);
+    const caps = show.capabilities ?? [];
+    if (caps.includes("embedding") && !caps.includes("completion")) return void 0;
+    const ctx = ollamaContextLength(show.model_info);
+    return {
+      rawId: entry.id,
+      endpointId: endpoint.id,
+      contextWindow: ctx ?? FALLBACK_CONTEXT_WINDOW,
+      contextWindowKnown: ctx !== void 0,
+      // Ollama reports capabilities honestly, so trust it here rather than
+      // using the optimistic generic default.
+      supportsTools: caps.includes("tools"),
+      supportsImages: caps.includes("vision"),
+      supportsThinking: caps.includes("thinking")
+    };
+  });
+  return enriched.filter((model) => model !== void 0);
+}
+function ollamaContextLength(info) {
+  if (!info) return void 0;
+  for (const [key, value] of Object.entries(info)) {
+    if (key.endsWith(".context_length") && typeof value === "number" && value > 0) return value;
+  }
+  return void 0;
+}
+async function enrichLmStudio(endpoint, entries, options) {
+  const detail = await fetchJson(
+    `${endpointRoot(endpoint.baseUrl)}/api/v0/models`,
+    endpoint,
+    options
+  );
+  if (!detail?.data) return entries.map((entry) => genericModel(endpoint, entry));
+  const byId = new Map(detail.data.filter((m) => m.id).map((m) => [m.id, m]));
+  const models = [];
+  for (const entry of entries) {
+    const info = byId.get(entry.id);
+    if (info && info.type !== "llm" && info.type !== "vlm") continue;
+    const ctx = info?.max_context_length;
+    models.push({
+      rawId: entry.id,
+      endpointId: endpoint.id,
+      contextWindow: typeof ctx === "number" && ctx > 0 ? ctx : FALLBACK_CONTEXT_WINDOW,
+      contextWindowKnown: typeof ctx === "number" && ctx > 0,
+      // LM Studio doesn't report tool support; it gates per-model at request time.
+      supportsTools: true,
+      supportsImages: info?.type === "vlm",
+      supportsThinking: false,
+      loaded: info?.state === "loaded"
+    });
+  }
+  return models;
+}
+async function enrichLlamaCpp(endpoint, entries, options) {
+  const props = await fetchJson(
+    `${endpointRoot(endpoint.baseUrl)}/props`,
+    endpoint,
+    options
+  );
+  const nCtx = props?.default_generation_settings?.n_ctx;
+  const known = typeof nCtx === "number" && nCtx > 0;
+  return entries.map((entry) => ({
+    ...genericModel(endpoint, entry),
+    contextWindow: known ? nCtx : FALLBACK_CONTEXT_WINDOW,
+    contextWindowKnown: known
+  }));
+}
+async function mapLimited(items, limit, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (next < items.length) {
+      const index = next++;
+      results[index] = await fn(items[index]);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+function maxThinkingLevelFor(endpoint) {
+  return endpoint.kind === "ollama" ? "max" : "high";
+}
+function toModelInfo(model, endpoint) {
+  return {
+    id: formatLocalModelId(model.endpointId, model.rawId),
+    name: `${model.rawId} (${endpoint.label})`,
+    provider: "local",
+    contextWindow: model.contextWindow,
+    // Leave real headroom for the prompt on small local windows.
+    maxOutputTokens: Math.max(512, Math.min(4096, Math.floor(model.contextWindow / 4))),
+    supportsThinking: model.supportsThinking,
+    supportsImages: model.supportsImages,
+    supportsVideo: false,
+    costTier: "low",
+    maxThinkingLevel: maxThinkingLevelFor(endpoint),
+    authStorageKeys: [localAuthStorageKey(model.endpointId)]
+  };
+}
+var cache;
+function cacheKey(endpoints) {
+  return endpoints.map((e) => `${e.id}@${e.baseUrl}`).join("|");
+}
+async function discoverLocalModels(endpoints = DEFAULT_LOCAL_ENDPOINTS, options = {}) {
+  const key = cacheKey(endpoints);
+  if (!options.force && cache && cache.key === key && Date.now() - cache.at < CACHE_TTL_MS2) {
+    return cache.result;
+  }
+  const probes = await Promise.all(endpoints.map((endpoint) => probeEndpoint(endpoint, options)));
+  const models = probes.flatMap(
+    (probe) => probe.models.map((model) => toModelInfo(model, probe.endpoint))
+  );
+  const result = { probes, models };
+  cache = { key, at: Date.now(), result };
+  return result;
+}
+function clearLocalDiscoveryCache() {
+  cache = void 0;
+}
+function findProbedModel(probes, modelId) {
+  const parsed = parseLocalModelId(modelId);
+  if (!parsed) return void 0;
+  for (const probe of probes) {
+    if (probe.endpoint.id !== parsed.endpointId) continue;
+    const model = probe.models.find((m) => m.rawId === parsed.rawId);
+    if (model) return { model, endpoint: probe.endpoint };
+  }
+  return void 0;
+}
+
 // src/provider-usage.ts
 var SubscriptionUsageError = class extends Error {
-  constructor(message, status) {
+  constructor(message, status, retryAfterMs2) {
     super(message);
     this.status = status;
+    this.retryAfterMs = retryAfterMs2;
     this.name = "SubscriptionUsageError";
   }
 };
@@ -2135,12 +2599,20 @@ function normalizedCodexWindow(window, fallbackKind, now) {
     resetsAt: codexResetAt(window, now)
   };
 }
-async function readUsageResponse(response) {
+function retryAfterMs(response, now) {
+  const value = response.headers.get("retry-after")?.trim();
+  if (!value) return void 0;
+  if (/^\d+(?:\.\d+)?$/.test(value)) return Math.ceil(Number(value) * 1e3);
+  const retryAt = Date.parse(value);
+  return Number.isFinite(retryAt) ? Math.max(0, retryAt - now) : void 0;
+}
+async function readUsageResponse(response, now) {
   const text = await response.text();
   if (!response.ok) {
     throw new SubscriptionUsageError(
       `Subscription usage request failed with HTTP ${response.status}`,
-      response.status
+      response.status,
+      retryAfterMs(response, now)
     );
   }
   try {
@@ -2161,7 +2633,7 @@ async function fetchAnthropicUsage(credentials, fetchFn, signal, now) {
       "User-Agent": "ezcoder"
     }
   });
-  const data = await readUsageResponse(response);
+  const data = await readUsageResponse(response, now());
   const windows = [];
   const currentPercent = clampPercent(data.five_hour?.utilization);
   if (currentPercent !== void 0) {
@@ -2197,7 +2669,7 @@ async function fetchCodexUsage(credentials, fetchFn, signal, now) {
   };
   if (credentials.accountId) headers["ChatGPT-Account-Id"] = credentials.accountId;
   const response = await fetchFn(CODEX_USAGE_URL, { method: "GET", signal, headers });
-  const data = await readUsageResponse(response);
+  const data = await readUsageResponse(response, now());
   const windows = [
     normalizedCodexWindow(data.rate_limit?.primary_window, "current", now()),
     normalizedCodexWindow(data.rate_limit?.secondary_window, "weekly", now())
@@ -2213,12 +2685,97 @@ async function fetchCodexUsage(credentials, fetchFn, signal, now) {
     fetchedAt: now()
   };
 }
+function kimiNumber(value) {
+  if (typeof value === "string" && value.trim()) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  }
+  return finiteNumber(value);
+}
+function kimiUsagePercent(detail) {
+  const used = kimiNumber(detail?.used);
+  const limit = kimiNumber(detail?.limit);
+  if (used === void 0 || limit === void 0 || limit <= 0) return void 0;
+  return Math.min(100, Math.max(0, used / limit * 100));
+}
+function kimiWindowMinutes(window) {
+  const duration = kimiNumber(window?.duration);
+  if (duration === void 0 || duration <= 0) return void 0;
+  switch (window?.timeUnit) {
+    case "TIME_UNIT_SECOND":
+      return duration / 60;
+    case "TIME_UNIT_MINUTE":
+      return duration;
+    case "TIME_UNIT_HOUR":
+      return duration * 60;
+    case "TIME_UNIT_DAY":
+      return duration * 24 * 60;
+    default:
+      return void 0;
+  }
+}
+async function fetchKimiUsage(credentials, fetchFn, signal, now) {
+  const response = await fetchFn(`${kimiCodeBaseUrl()}/usages`, {
+    method: "GET",
+    signal,
+    headers: {
+      Authorization: "Bearer " + credentials.accessToken,
+      Accept: "application/json",
+      // The managed coding endpoint gates on the kimi-code-cli client identity,
+      // same as model requests.
+      ...kimiCodingHeaders()
+    }
+  });
+  const data = await readUsageResponse(response, now());
+  const windows = [];
+  const weeklyPercent = kimiUsagePercent(data.usage);
+  if (weeklyPercent !== void 0) {
+    windows.push({
+      kind: "weekly",
+      label: "Weekly",
+      usedPercent: weeklyPercent,
+      resetsAt: isoTimestamp(data.usage?.resetTime)
+    });
+  }
+  for (const limit of data.limits ?? []) {
+    const minutes = kimiWindowMinutes(limit?.window);
+    const percent = kimiUsagePercent(limit?.detail);
+    if (minutes === void 0 || percent === void 0) continue;
+    if (minutes >= 6 * 24 * 60) {
+      if (!windows.some((window) => window.kind === "weekly")) {
+        windows.push({
+          kind: "weekly",
+          label: "Weekly",
+          usedPercent: percent,
+          resetsAt: isoTimestamp(limit?.detail?.resetTime)
+        });
+      }
+      continue;
+    }
+    windows.push({
+      kind: "current",
+      label: `${Math.max(1, Math.round(minutes / 60))}-hour`,
+      usedPercent: percent,
+      resetsAt: isoTimestamp(limit?.detail?.resetTime)
+    });
+  }
+  windows.sort((left, right) => {
+    if (left.kind === right.kind) return 0;
+    return left.kind === "current" ? -1 : 1;
+  });
+  return {
+    provider: "moonshot",
+    displayName: "Kimi",
+    windows,
+    fetchedAt: now()
+  };
+}
 async function fetchSubscriptionUsage(provider, credentials, options = {}) {
   const fetchFn = options.fetchFn ?? fetch;
   const now = options.now ?? Date.now;
   const signal = AbortSignal.timeout(options.timeoutMs ?? 8e3);
   try {
-    return provider === "anthropic" ? await fetchAnthropicUsage(credentials, fetchFn, signal, now) : await fetchCodexUsage(credentials, fetchFn, signal, now);
+    return provider === "anthropic" ? await fetchAnthropicUsage(credentials, fetchFn, signal, now) : provider === "openai" ? await fetchCodexUsage(credentials, fetchFn, signal, now) : await fetchKimiUsage(credentials, fetchFn, signal, now);
   } catch (error) {
     if (error instanceof SubscriptionUsageError) throw error;
     const message = error instanceof Error ? error.message : String(error);
@@ -2535,7 +3092,7 @@ async function transcribeVoice(fileUrl) {
 
 // src/auto-update.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs3 = __toESM(require("fs"), 1);
+var import_node_fs4 = __toESM(require("fs"), 1);
 var import_node_path5 = __toESM(require("path"), 1);
 var CHECK_INTERVAL_MS = 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS2 = 1e4;
@@ -2569,7 +3126,7 @@ function createAutoUpdater(config) {
   }
   function readState() {
     try {
-      const raw = import_node_fs3.default.readFileSync(stateFilePath(), "utf-8");
+      const raw = import_node_fs4.default.readFileSync(stateFilePath(), "utf-8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -2578,8 +3135,8 @@ function createAutoUpdater(config) {
   function writeState(state) {
     try {
       const filePath = stateFilePath();
-      import_node_fs3.default.mkdirSync(import_node_path5.default.dirname(filePath), { recursive: true, mode: 448 });
-      import_node_fs3.default.writeFileSync(filePath, JSON.stringify(state));
+      import_node_fs4.default.mkdirSync(import_node_path5.default.dirname(filePath), { recursive: true, mode: 448 });
+      import_node_fs4.default.writeFileSync(filePath, JSON.stringify(state));
     } catch {
     }
   }
@@ -2704,19 +3261,30 @@ function createAutoUpdater(config) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthStorage,
+  DEFAULT_LOCAL_ENDPOINTS,
   DEFAULT_MAX_VIDEO_BYTES,
+  FALLBACK_CONTEXT_WINDOW,
+  LOCAL_API_KEY_PLACEHOLDER,
+  LOCAL_AUTH_KEY_PREFIX,
   MODELS,
   MOONSHOT_OAUTH_KEY,
   NotLoggedInError,
   SubscriptionUsageError,
   TelegramBot,
   XIAOMI_CREDITS_KEY,
+  clearLocalDiscoveryCache,
+  clearRuntimeModels,
   closeLogger,
   createAutoUpdater,
   decodeOggOpus,
+  discoverLocalModels,
   downmixToMono,
+  endpointRoot,
   fetchSubscriptionUsage,
+  findProbedModel,
+  formatLocalModelId,
   generatePKCE,
+  getAllModels,
   getAppPaths,
   getAuthStorageKey,
   getAuthStorageKeys,
@@ -2724,6 +3292,7 @@ function createAutoUpdater(config) {
   getClaudeCodeVersion,
   getContextWindow,
   getDefaultModel,
+  getDefaultThinkingLevel,
   getFastModel,
   getMaxThinkingLevel,
   getModel,
@@ -2735,24 +3304,31 @@ function createAutoUpdater(config) {
   getToolResultCharLimit,
   getVideoByteLimit,
   isKimiCodingEndpoint,
+  isLocalModelId,
   isLoggerOpen,
   isModelLoaded,
   isThinkingLevelSupported,
   kimiCodeBaseUrl,
   kimiCodingHeaders,
+  localAuthStorageKey,
   log,
   loginAnthropic,
   loginGemini,
   loginKimi,
   loginOpenAI,
   openLog,
+  parseLocalModelId,
+  probeEndpoint,
+  readStoredBaseUrlSync,
   refreshAnthropicToken,
   refreshGeminiToken,
   refreshKimiToken,
   refreshOpenAIToken,
   registerLogCleanup,
+  registerRuntimeModels,
   resample,
   setProgressCallback,
+  toModelInfo,
   transcribeVoice,
   usesOpenAICodexTransport,
   withFileLock