@prestyj/core 5.8.0 → 5.9.0

package/dist/{chunk-GMAX7TES.js → chunk-JXPW4JKV.js}

@@ -2,8 +2,226 @@ import {
   getAppPaths
 } from "./chunk-WCIV25KV.js";
 
+// src/oauth/kimi.ts
+import { execFileSync } from "child_process";
+import { randomUUID } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { arch, hostname, release, type } from "os";
+import path from "path";
+var CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
+var KIMI_PLATFORM = "kimi_code_cli";
+var DEFAULT_KIMI_VERSION = "1.0.11";
+var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
+function oauthHost() {
+  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
+  return host.replace(/\/+$/, "");
+}
+function kimiCodeBaseUrl() {
+  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
+}
+function kimiVersion() {
+  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
+  return asciiHeader(v, DEFAULT_KIMI_VERSION);
+}
+function asciiHeader(value, fallback = "unknown") {
+  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
+  return cleaned.length > 0 ? cleaned : fallback;
+}
+function macOsProductVersion() {
+  try {
+    const version = execFileSync("/usr/bin/sw_vers", ["-productVersion"], {
+      encoding: "utf-8",
+      timeout: 1e3
+    }).trim();
+    return version.length > 0 ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function deviceModel() {
+  const os = type();
+  const version = release();
+  const osArch = arch();
+  if (os === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
+  if (os === "Windows_NT") return `Windows ${version} ${osArch}`;
+  return `${os} ${version} ${osArch}`.trim();
+}
+function deviceId() {
+  const idPath = path.join(getAppPaths().agentDir, "kimi_device_id");
+  if (existsSync(idPath)) {
+    try {
+      const text = readFileSync(idPath, "utf-8").trim();
+      if (text.length > 0) return text;
+    } catch {
+    }
+  }
+  const id = randomUUID();
+  try {
+    mkdirSync(getAppPaths().agentDir, { recursive: true, mode: 448 });
+    writeFileSync(idPath, id, { encoding: "utf-8", mode: 384 });
+  } catch {
+  }
+  return id;
+}
+function deviceHeaders() {
+  return {
+    "X-Msh-Platform": KIMI_PLATFORM,
+    "X-Msh-Version": kimiVersion(),
+    "X-Msh-Device-Name": asciiHeader(hostname()),
+    "X-Msh-Device-Model": asciiHeader(deviceModel()),
+    "X-Msh-Os-Version": asciiHeader(release()),
+    "X-Msh-Device-Id": deviceId()
+  };
+}
+function kimiCodingHeaders() {
+  return {
+    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
+    ...deviceHeaders()
+  };
+}
+function isKimiCodingEndpoint(baseUrl) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
+  const normalized = baseUrl.replace(/\/+$/, "");
+  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
+}
+async function postForm(endpoint, params) {
+  const response = await fetch(`${oauthHost()}${endpoint}`, {
+    method: "POST",
+    headers: {
+      ...deviceHeaders(),
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams(params).toString()
+  });
+  let data = {};
+  try {
+    const parsed = await response.json();
+    if (parsed && typeof parsed === "object") data = parsed;
+  } catch {
+  }
+  return { status: response.status, data };
+}
+function errorDetail(data) {
+  const desc = data.error_description ?? data.message ?? data.error;
+  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
+}
+function credsFromTokenResponse(data, opts) {
+  const accessToken = data.access_token;
+  const responseRefreshToken = data.refresh_token;
+  const expiresIn = Number(data.expires_in);
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("Kimi OAuth response missing access_token.");
+  }
+  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
+  if (refreshToken.length === 0) {
+    throw new Error("Kimi OAuth response missing refresh_token.");
+  }
+  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("Kimi OAuth response missing or invalid expires_in.");
+  }
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: Date.now() + expiresIn * 1e3,
+    baseUrl: kimiCodeBaseUrl()
+  };
+}
+async function requestDeviceAuthorization() {
+  const { status, data } = await postForm("/api/oauth/device_authorization", {
+    client_id: CLIENT_ID
+  });
+  if (status !== 200) {
+    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
+  }
+  const userCode = data.user_code;
+  const deviceCode = data.device_code;
+  const verificationUriComplete = data.verification_uri_complete;
+  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
+    throw new Error("Kimi device authorization response missing user_code/device_code.");
+  }
+  return {
+    userCode,
+    deviceCode,
+    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
+    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
+    interval: Number(data.interval ?? 5) || 5
+  };
+}
+async function pollDeviceToken(deviceCode) {
+  const { status, data } = await postForm("/api/oauth/token", {
+    client_id: CLIENT_ID,
+    device_code: deviceCode,
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return { kind: "success", creds: credsFromTokenResponse(data) };
+  }
+  if (status >= 500) {
+    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
+  switch (errorCode) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    case "access_denied":
+      return { kind: "denied" };
+    default:
+      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+async function loginKimi(callbacks) {
+  const auth = await requestDeviceAuthorization();
+  callbacks.onStatus(
+    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
+  );
+  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
+  callbacks.onStatus("Waiting for you to authorize in the browser...");
+  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
+  let interval = Math.max(auth.interval, 1);
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    const result = await pollDeviceToken(auth.deviceCode);
+    if (result.kind === "success") return result.creds;
+    if (result.kind === "denied") {
+      throw new Error("Kimi authorization was denied.");
+    }
+    if (result.kind === "expired") {
+      throw new Error("Kimi device code expired. Please run login again.");
+    }
+    if (result.kind === "slow_down") {
+      interval += 5;
+    }
+  }
+  throw new Error("Kimi login timed out. Please run login again.");
+}
+async function refreshKimiToken(refreshToken) {
+  const { status, data } = await postForm("/api/oauth/token", {
+    client_id: CLIENT_ID,
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "";
+  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
+}
+
 // src/auth-storage.ts
 import fs4 from "fs/promises";
+import { readFileSync as readFileSync2 } from "fs";
 import crypto5 from "crypto";
 
 // src/oauth/anthropic.ts
@@ -29,15 +247,17 @@ async function generatePKCE() {
 
 // src/claude-code-version.ts
 import fs2 from "fs/promises";
-import path2 from "path";
+import path3 from "path";
 
 // src/logger.ts
 import fs from "fs";
-import path from "path";
+import path2 from "path";
 import { randomBytes } from "crypto";
 import { environmentSecrets, redactText, redactValue } from "@prestyj/ai";
 var MAX_BYTES = 10 * 1024 * 1024;
 var fd = null;
+var bytesWritten = 0;
+var capped = false;
 var sessionId = "";
 var appName = "app";
 var cleanups = [];
@@ -56,22 +276,37 @@ function rotateIfNeeded(filePath) {
   }
 }
 function openLog(filePath, name) {
-  if (fd !== null) return false;
+  if (fd !== null || capped) return false;
   appName = name;
   exactSecrets = environmentSecrets(process.env);
   try {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 448 });
+    fs.mkdirSync(path2.dirname(filePath), { recursive: true, mode: 448 });
   } catch {
   }
   rotateIfNeeded(filePath);
   try {
     fd = fs.openSync(filePath, "a");
   } catch {
+    fd = null;
+    bytesWritten = 0;
+    return false;
+  }
+  try {
+    bytesWritten = fs.fstatSync(fd).size;
+  } catch {
+    try {
+      fs.closeSync(fd);
+    } catch {
+    }
+    fd = null;
+    bytesWritten = 0;
     return false;
   }
   sessionId = randomBytes(4).toString("hex");
   try {
-    fs.writeSync(fd, "\n");
+    if (bytesWritten < MAX_BYTES) {
+      bytesWritten += fs.writeSync(fd, "\n");
+    }
   } catch {
   }
   return true;
@@ -97,8 +332,23 @@ function log(level, category, message, data) {
     if (pairs) line += ` ${pairs}`;
   }
   line += "\n";
+  const lineBytes = Buffer.byteLength(line);
+  if (bytesWritten + lineBytes > MAX_BYTES) {
+    const capLine = `[${ts}] [sid=${sessionId}] [WARN] [logger] Log cap reached; file logging disabled until restart
+`;
+    try {
+      if (bytesWritten + Buffer.byteLength(capLine) <= MAX_BYTES) {
+        bytesWritten += fs.writeSync(fd, capLine);
+      }
+      fs.closeSync(fd);
+    } catch {
+    }
+    fd = null;
+    capped = true;
+    return;
+  }
   try {
-    fs.writeSync(fd, line);
+    bytesWritten += fs.writeSync(fd, line);
   } catch {
   }
 }
@@ -106,13 +356,16 @@ function registerLogCleanup(fn) {
   cleanups.push(fn);
 }
 function closeLogger(opts) {
-  if (fd === null) return;
-  if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
-  try {
-    fs.closeSync(fd);
-  } catch {
+  if (fd !== null) {
+    if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
+    try {
+      if (fd !== null) fs.closeSync(fd);
+    } catch {
+    }
   }
   fd = null;
+  bytesWritten = 0;
+  capped = false;
   exactSecrets = [];
   for (const unsub of cleanups) unsub();
   cleanups = [];
@@ -126,7 +379,7 @@ var FALLBACK_VERSION = "2.1.88";
 var memoryCache = null;
 var inflight = null;
 function cachePath() {
-  return path2.join(getAppPaths().agentDir, "claude-code-version.json");
+  return path3.join(getAppPaths().agentDir, "claude-code-version.json");
 }
 async function readDiskCache() {
   try {
@@ -208,7 +461,7 @@ async function getClaudeCliUserAgent() {
 }
 
 // src/oauth/anthropic.ts
-var CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+var CLIENT_ID2 = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
 var TOKEN_URLS = [
   "https://platform.claude.com/v1/oauth/token",
@@ -255,7 +508,7 @@ async function loginAnthropic(callbacks) {
   const state = crypto2.randomBytes(16).toString("hex");
   const params = new URLSearchParams({
     code: "true",
-    client_id: CLIENT_ID,
+    client_id: CLIENT_ID2,
     response_type: "code",
     redirect_uri: REDIRECT_URI,
     scope: SCOPES,
@@ -276,7 +529,7 @@ async function exchangeAnthropicCode(code, state, verifier) {
   const data = await postTokenRequest(
     {
       grant_type: "authorization_code",
-      client_id: CLIENT_ID,
+      client_id: CLIENT_ID2,
       code,
       state,
       redirect_uri: REDIRECT_URI,
@@ -290,7 +543,7 @@ async function refreshAnthropicToken(refreshToken) {
   const data = await postTokenRequest(
     {
       grant_type: "refresh_token",
-      client_id: CLIENT_ID,
+      client_id: CLIENT_ID2,
       refresh_token: refreshToken
     },
     "token refresh"
@@ -301,7 +554,7 @@ async function refreshAnthropicToken(refreshToken) {
 // src/oauth/openai.ts
 import http from "http";
 import crypto3 from "crypto";
-var CLIENT_ID2 = "app_EMoamEEZ73f0CkXaXp7hrann";
+var CLIENT_ID3 = "app_EMoamEEZ73f0CkXaXp7hrann";
 var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
 var TOKEN_URL = "https://auth.openai.com/oauth/token";
 var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
@@ -312,7 +565,7 @@ async function loginOpenAI(callbacks) {
   const state = crypto3.randomBytes(16).toString("hex");
   const url = new URL(AUTHORIZE_URL2);
   url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID2);
+  url.searchParams.set("client_id", CLIENT_ID3);
   url.searchParams.set("redirect_uri", REDIRECT_URI2);
   url.searchParams.set("scope", SCOPE);
   url.searchParams.set("code_challenge", challenge);
@@ -433,7 +686,7 @@ async function exchangeOpenAICode(code, verifier) {
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "authorization_code",
-      client_id: CLIENT_ID2,
+      client_id: CLIENT_ID3,
       code,
       redirect_uri: REDIRECT_URI2,
       code_verifier: verifier
@@ -457,7 +710,7 @@ async function refreshOpenAIToken(refreshToken) {
     body: new URLSearchParams({
       grant_type: "refresh_token",
       refresh_token: refreshToken,
-      client_id: CLIENT_ID2
+      client_id: CLIENT_ID3
     })
   });
   if (!response.ok) {
@@ -840,223 +1093,6 @@ function codeAssistHeaders(accessToken) {
   };
 }
 
-// src/oauth/kimi.ts
-import { execFileSync } from "child_process";
-import { randomUUID } from "crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { arch, hostname, release, type } from "os";
-import path3 from "path";
-var CLIENT_ID3 = "17e5f671-d194-4dfb-9706-5516cb48c098";
-var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
-var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
-var KIMI_PLATFORM = "kimi_code_cli";
-var DEFAULT_KIMI_VERSION = "1.0.11";
-var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
-function oauthHost() {
-  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
-  return host.replace(/\/+$/, "");
-}
-function kimiCodeBaseUrl() {
-  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
-}
-function kimiVersion() {
-  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
-  return asciiHeader(v, DEFAULT_KIMI_VERSION);
-}
-function asciiHeader(value, fallback = "unknown") {
-  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : fallback;
-}
-function macOsProductVersion() {
-  try {
-    const version = execFileSync("/usr/bin/sw_vers", ["-productVersion"], {
-      encoding: "utf-8",
-      timeout: 1e3
-    }).trim();
-    return version.length > 0 ? version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function deviceModel() {
-  const os = type();
-  const version = release();
-  const osArch = arch();
-  if (os === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
-  if (os === "Windows_NT") return `Windows ${version} ${osArch}`;
-  return `${os} ${version} ${osArch}`.trim();
-}
-function deviceId() {
-  const idPath = path3.join(getAppPaths().agentDir, "kimi_device_id");
-  if (existsSync(idPath)) {
-    try {
-      const text = readFileSync(idPath, "utf-8").trim();
-      if (text.length > 0) return text;
-    } catch {
-    }
-  }
-  const id = randomUUID();
-  try {
-    mkdirSync(getAppPaths().agentDir, { recursive: true, mode: 448 });
-    writeFileSync(idPath, id, { encoding: "utf-8", mode: 384 });
-  } catch {
-  }
-  return id;
-}
-function deviceHeaders() {
-  return {
-    "X-Msh-Platform": KIMI_PLATFORM,
-    "X-Msh-Version": kimiVersion(),
-    "X-Msh-Device-Name": asciiHeader(hostname()),
-    "X-Msh-Device-Model": asciiHeader(deviceModel()),
-    "X-Msh-Os-Version": asciiHeader(release()),
-    "X-Msh-Device-Id": deviceId()
-  };
-}
-function kimiCodingHeaders() {
-  return {
-    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
-    ...deviceHeaders()
-  };
-}
-function isKimiCodingEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
-}
-async function postForm(endpoint, params) {
-  const response = await fetch(`${oauthHost()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      ...deviceHeaders(),
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(params).toString()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function credsFromTokenResponse(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  const expiresIn = Number(data.expires_in);
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Kimi OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error("Kimi OAuth response missing refresh_token.");
-  }
-  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-    throw new Error("Kimi OAuth response missing or invalid expires_in.");
-  }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    baseUrl: kimiCodeBaseUrl()
-  };
-}
-async function requestDeviceAuthorization() {
-  const { status, data } = await postForm("/api/oauth/device_authorization", {
-    client_id: CLIENT_ID3
-  });
-  if (status !== 200) {
-    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Kimi device authorization response missing user_code/device_code.");
-  }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5
-  };
-}
-async function pollDeviceToken(deviceCode) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID3,
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
-  }
-}
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-async function loginKimi(callbacks) {
-  const auth = await requestDeviceAuthorization();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    await sleep(interval * 1e3);
-    const result = await pollDeviceToken(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Kimi authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Kimi device code expired. Please run login again.");
-    }
-    if (result.kind === "slow_down") {
-      interval += 5;
-    }
-  }
-  throw new Error("Kimi login timed out. Please run login again.");
-}
-async function refreshKimiToken(refreshToken) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID3,
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
-}
-
 // src/file-lock.ts
 import fs3 from "fs/promises";
 import { setTimeout as setTimeout2 } from "timers/promises";
@@ -1122,6 +1158,26 @@ function isAlive(pid) {
 // src/auth-storage.ts
 var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
 var XIAOMI_CREDITS_KEY = "xiaomi-credits";
+function activeBaseUrlEntry(data, provider) {
+  if (provider === "moonshot") {
+    const oauth = data[MOONSHOT_OAUTH_KEY];
+    if (oauth) {
+      const exhaustedUntil = oauth.usageExhaustedUntil ?? 0;
+      if (Date.now() < exhaustedUntil && data["moonshot"]) return data["moonshot"];
+      return oauth;
+    }
+    return data["moonshot"];
+  }
+  return data[provider];
+}
+function readStoredBaseUrlSync(authFile, provider) {
+  try {
+    const data = JSON.parse(readFileSync2(authFile, "utf-8"));
+    return activeBaseUrlEntry(data, provider)?.baseUrl;
+  } catch {
+    return void 0;
+  }
+}
 var REFRESH_SKEW_MS = 6e4;
 var USAGE_EXHAUSTED_DEFAULT_MS = 15 * 60 * 1e3;
 var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
@@ -1197,6 +1253,16 @@ var AuthStorage = class {
     }
     return STATIC_API_KEY_PROVIDERS.has(provider);
   }
+  /**
+   * The base URL on the credential that is active right now, if any.
+   * Synchronous — call only after load()/resolveCredentials() populated the
+   * snapshot. For `moonshot` this is the Kimi For Coding URL whenever the
+   * OAuth entry is the one resolveCredentials would serve (i.e. not currently
+   * usage-exhausted with an API key configured).
+   */
+  getStoredBaseUrl(provider) {
+    return activeBaseUrlEntry(this.data, provider)?.baseUrl;
+  }
   async load() {
     await withFileLock(this.filePath, async () => {
       try {
@@ -1228,27 +1294,46 @@ var AuthStorage = class {
   /**
    * Force a re-read from disk, discarding the in-memory cache. Needed when
    * another process mutates the auth file out-of-band — e.g. the desktop app
-   * writes API keys natively (Rust → ~/.ezcoder/auth.json) without going through
-   * this instance, so a long-lived daemon's cache would otherwise stay stale and
-   * never see a newly added provider key.
+   * writes API keys natively without going through this instance.
    */
   async reload() {
     this.loaded = false;
     await this.load();
   }
+  /**
+   * Apply one provider-scoped mutation to the latest on-disk snapshot.
+   * AuthStorage instances live in every app session/process, so writing this
+   * instance's cached snapshot can erase credentials another instance just
+   * added. The file lock only serializes writers; the re-read prevents stale
+   * full-file overwrites.
+   */
+  async mutateLatest(mutator) {
+    await this.ensureLoaded();
+    await withFileLock(this.filePath, async () => {
+      const latest = await readAuthData(this.filePath);
+      mutator(latest);
+      await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
+      this.data = latest;
+    });
+  }
+  async reloadLatest() {
+    await withFileLock(this.filePath, async () => {
+      this.data = await readAuthData(this.filePath);
+    });
+  }
   async getCredentials(provider) {
     await this.ensureLoaded();
     return this.data[provider];
   }
   async setCredentials(provider, creds) {
-    await this.ensureLoaded();
-    this.data[provider] = creds;
-    await this.save();
+    await this.mutateLatest((latest) => {
+      latest[provider] = creds;
+    });
   }
   async clearCredentials(provider) {
-    await this.ensureLoaded();
-    delete this.data[provider];
-    await this.save();
+    await this.mutateLatest((latest) => {
+      delete latest[provider];
+    });
   }
   /**
    * Mark the credential stored under `storageKey` as usage-exhausted until
@@ -1262,12 +1347,15 @@ var AuthStorage = class {
    * nothing is stored under `storageKey`.
    */
   async markUsageExhausted(storageKey, resetsAt) {
-    await this.ensureLoaded();
-    const creds = this.data[storageKey];
-    if (!creds) return;
     const until = resetsAt !== void 0 && resetsAt * 1e3 > Date.now() ? resetsAt * 1e3 : Date.now() + USAGE_EXHAUSTED_DEFAULT_MS;
-    creds.usageExhaustedUntil = until;
-    await this.save();
+    let marked = false;
+    await this.mutateLatest((latest) => {
+      const creds = latest[storageKey];
+      if (!creds) return;
+      creds.usageExhaustedUntil = until;
+      marked = true;
+    });
+    if (!marked) return;
     log(
       "WARN",
       "auth",
@@ -1275,8 +1363,11 @@ var AuthStorage = class {
     );
   }
   async clearAll() {
-    this.data = {};
-    await this.save();
+    await this.ensureLoaded();
+    await withFileLock(this.filePath, async () => {
+      this.data = {};
+      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+    });
   }
   /**
    * Returns valid credentials, auto-refreshing if expired.
@@ -1286,6 +1377,10 @@ var AuthStorage = class {
    */
   async resolveCredentials(provider, opts) {
     await this.ensureLoaded();
+    const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : provider === "moonshot" ? [MOONSHOT_OAUTH_KEY, "moonshot"] : [provider];
+    if (!directStorageKeys.some((key) => Boolean(this.data[key]))) {
+      await this.reloadLatest();
+    }
     if (opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider)) {
       for (const key of opts.storageKeys) {
         const creds2 = this.data[key];
@@ -1332,41 +1427,44 @@ var AuthStorage = class {
     const existing = this.refreshLocks.get(provider);
     if (existing) return existing;
     const refreshPromise = withFileLock(this.filePath, async () => {
-      try {
-        const content = await fs4.readFile(this.filePath, "utf-8");
-        const freshData = JSON.parse(content);
-        const freshCreds = freshData[provider];
-        if (freshCreds && !opts?.forceRefresh && Date.now() < freshCreds.expiresAt - REFRESH_SKEW_MS) {
-          this.data[provider] = freshCreds;
-          return freshCreds;
-        }
-      } catch {
+      const latest = await readAuthData(this.filePath);
+      const latestCreds = latest[provider];
+      if (!latestCreds) {
+        this.data = latest;
+        throw new NotLoggedInError(provider);
+      }
+      const credentialWasReplaced = latestCreds.accessToken !== creds.accessToken || latestCreds.refreshToken !== creds.refreshToken || latestCreds.expiresAt !== creds.expiresAt;
+      if (credentialWasReplaced || !opts?.forceRefresh && Date.now() < latestCreds.expiresAt - REFRESH_SKEW_MS) {
+        this.data = latest;
+        return latestCreds;
       }
       const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : refreshOpenAIToken;
       let refreshed;
       try {
-        refreshed = await refreshFn(creds.refreshToken);
+        refreshed = await refreshFn(latestCreds.refreshToken);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh/i.test(msg) || /unauthorized/i.test(msg);
         if (isAuthFailure) {
-          delete this.data[provider];
-          await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+          delete latest[provider];
+          this.data = latest;
+          await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
           throw new NotLoggedInError(provider);
         }
         throw err;
       }
-      if (!refreshed.accountId && creds.accountId) {
-        refreshed.accountId = creds.accountId;
+      if (!refreshed.accountId && latestCreds.accountId) {
+        refreshed.accountId = latestCreds.accountId;
       }
-      if (!refreshed.projectId && creds.projectId) {
-        refreshed.projectId = creds.projectId;
+      if (!refreshed.projectId && latestCreds.projectId) {
+        refreshed.projectId = latestCreds.projectId;
       }
-      if (!refreshed.baseUrl && creds.baseUrl) {
-        refreshed.baseUrl = creds.baseUrl;
+      if (!refreshed.baseUrl && latestCreds.baseUrl) {
+        refreshed.baseUrl = latestCreds.baseUrl;
       }
-      this.data[provider] = refreshed;
-      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+      latest[provider] = refreshed;
+      this.data = latest;
+      await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
       return refreshed;
     });
     this.refreshLocks.set(provider, refreshPromise);
@@ -1384,12 +1482,16 @@ var AuthStorage = class {
     const creds = await this.resolveCredentials(provider);
     return creds.accessToken;
   }
-  async save() {
-    await withFileLock(this.filePath, async () => {
-      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
-    });
-  }
 };
+async function readAuthData(filePath) {
+  try {
+    const content = await fs4.readFile(filePath, "utf-8");
+    return JSON.parse(content);
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  }
+}
 async function atomicWriteFile(filePath, content) {
   const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${crypto5.randomUUID().slice(0, 8)}.tmp`;
   try {
@@ -1482,7 +1584,8 @@ var MODELS = [
   // ── OpenAI (Codex) ─────────────────────────────────────
   // GPT-5.6 family — three agentic coding tiers launched July 2026. The public
   // Responses API advertises a 1.05M context window; OpenAI's Codex product
-  // catalog advertises 372K on the ChatGPT OAuth route. All three take
+  // catalog advertises 272K on the ChatGPT OAuth route (corrected from the
+  // initially advertised 372K — openai/codex PR #33972, Jul 18 2026 hotfix). All three take
   // text+image input, freeform apply_patch, text+image web search, and parallel
   // tool calls.
   {
@@ -1494,7 +1597,7 @@ var MODELS = [
     name: "GPT-5.6 Sol",
     provider: "openai",
     contextWindow: 105e4,
-    codexContextWindow: 372e3,
+    codexContextWindow: 272e3,
     maxOutputTokens: 128e3,
     supportsThinking: true,
     supportsImages: true,
@@ -1509,7 +1612,7 @@ var MODELS = [
     name: "GPT-5.6 Terra",
     provider: "openai",
     contextWindow: 105e4,
-    codexContextWindow: 372e3,
+    codexContextWindow: 272e3,
     maxOutputTokens: 128e3,
     supportsThinking: true,
     supportsImages: true,
@@ -1524,7 +1627,7 @@ var MODELS = [
     name: "GPT-5.6 Luna",
     provider: "openai",
     contextWindow: 105e4,
-    codexContextWindow: 372e3,
+    codexContextWindow: 272e3,
     maxOutputTokens: 128e3,
     supportsThinking: true,
     supportsImages: true,
@@ -1643,8 +1746,9 @@ var MODELS = [
   },
   // ── Moonshot (Kimi) ────────────────────────────────────
   // K3 is Kimi's 2.8T-parameter flagship for long-horizon coding, knowledge
-  // work, and deep reasoning. It always reasons at the `max` effort; the public
-  // API uses `reasoning_effort`, while Kimi Code OAuth keeps its managed wire shape.
+  // work, and deep reasoning. Its effort ladder is server-declared as
+  // low/high/max on both the public API (default max) and the Kimi For Coding
+  // OAuth endpoint (default high); thinking can also be fully disabled.
   {
     id: "kimi-k3",
     name: "Kimi K3",
@@ -1878,6 +1982,11 @@ function getContextWindow(modelId, options) {
 function getMaxThinkingLevel(modelId) {
   return getModel(modelId)?.maxThinkingLevel ?? "high";
 }
+function getDefaultThinkingLevel(modelId, options) {
+  const model = getModel(modelId);
+  if (model?.id === "kimi-k3" && isKimiCodingEndpoint(options?.baseUrl)) return "high";
+  return model?.maxThinkingLevel ?? "high";
+}
 function getSummaryModel(provider, currentModelId) {
   if (provider === "anthropic") {
     return MODELS.find((m) => m.id === "claude-sonnet-5");
@@ -1894,6 +2003,11 @@ function getFastModel(provider, currentModelId) {
 }
 
 export {
+  kimiCodeBaseUrl,
+  kimiCodingHeaders,
+  isKimiCodingEndpoint,
+  loginKimi,
+  refreshKimiToken,
   generatePKCE,
   openLog,
   getSessionId,
@@ -1909,14 +2023,10 @@ export {
   refreshOpenAIToken,
   loginGemini,
   refreshGeminiToken,
-  kimiCodeBaseUrl,
-  kimiCodingHeaders,
-  isKimiCodingEndpoint,
-  loginKimi,
-  refreshKimiToken,
   withFileLock,
   MOONSHOT_OAUTH_KEY,
   XIAOMI_CREDITS_KEY,
+  readStoredBaseUrlSync,
   AuthStorage,
   NotLoggedInError,
   MODELS,
@@ -1931,7 +2041,8 @@ export {
   getToolResultCharLimit,
   getContextWindow,
   getMaxThinkingLevel,
+  getDefaultThinkingLevel,
   getSummaryModel,
   getFastModel
 };
-//# sourceMappingURL=chunk-GMAX7TES.js.map
+//# sourceMappingURL=chunk-JXPW4JKV.js.map