@prestyj/core 5.8.0 → 5.9.0

package/dist/index.cjs

@@ -51,6 +51,7 @@ __export(index_exports, {
   getClaudeCodeVersion: () => getClaudeCodeVersion,
   getContextWindow: () => getContextWindow,
   getDefaultModel: () => getDefaultModel,
+  getDefaultThinkingLevel: () => getDefaultThinkingLevel,
   getFastModel: () => getFastModel,
   getMaxThinkingLevel: () => getMaxThinkingLevel,
   getModel: () => getModel,
@@ -73,6 +74,7 @@ __export(index_exports, {
   loginKimi: () => loginKimi,
   loginOpenAI: () => loginOpenAI,
   openLog: () => openLog,
+  readStoredBaseUrlSync: () => readStoredBaseUrlSync,
   refreshAnthropicToken: () => refreshAnthropicToken,
   refreshGeminiToken: () => refreshGeminiToken,
   refreshKimiToken: () => refreshKimiToken,
@@ -86,9 +88,12 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/auth-storage.ts
-var import_promises4 = __toESM(require("fs/promises"), 1);
-var import_node_crypto6 = __toESM(require("crypto"), 1);
+// src/oauth/kimi.ts
+var import_node_child_process = require("child_process");
+var import_node_crypto = require("crypto");
+var import_node_fs = require("fs");
+var import_node_os2 = require("os");
+var import_node_path2 = __toESM(require("path"), 1);
 
 // src/paths.ts
 var import_node_path = __toESM(require("path"), 1);
@@ -115,8 +120,225 @@ function getAppPaths() {
   };
 }
 
+// src/oauth/kimi.ts
+var CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
+var KIMI_PLATFORM = "kimi_code_cli";
+var DEFAULT_KIMI_VERSION = "1.0.11";
+var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
+function oauthHost() {
+  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
+  return host.replace(/\/+$/, "");
+}
+function kimiCodeBaseUrl() {
+  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
+}
+function kimiVersion() {
+  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
+  return asciiHeader(v, DEFAULT_KIMI_VERSION);
+}
+function asciiHeader(value, fallback = "unknown") {
+  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
+  return cleaned.length > 0 ? cleaned : fallback;
+}
+function macOsProductVersion() {
+  try {
+    const version = (0, import_node_child_process.execFileSync)("/usr/bin/sw_vers", ["-productVersion"], {
+      encoding: "utf-8",
+      timeout: 1e3
+    }).trim();
+    return version.length > 0 ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function deviceModel() {
+  const os2 = (0, import_node_os2.type)();
+  const version = (0, import_node_os2.release)();
+  const osArch = (0, import_node_os2.arch)();
+  if (os2 === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
+  if (os2 === "Windows_NT") return `Windows ${version} ${osArch}`;
+  return `${os2} ${version} ${osArch}`.trim();
+}
+function deviceId() {
+  const idPath = import_node_path2.default.join(getAppPaths().agentDir, "kimi_device_id");
+  if ((0, import_node_fs.existsSync)(idPath)) {
+    try {
+      const text = (0, import_node_fs.readFileSync)(idPath, "utf-8").trim();
+      if (text.length > 0) return text;
+    } catch {
+    }
+  }
+  const id = (0, import_node_crypto.randomUUID)();
+  try {
+    (0, import_node_fs.mkdirSync)(getAppPaths().agentDir, { recursive: true, mode: 448 });
+    (0, import_node_fs.writeFileSync)(idPath, id, { encoding: "utf-8", mode: 384 });
+  } catch {
+  }
+  return id;
+}
+function deviceHeaders() {
+  return {
+    "X-Msh-Platform": KIMI_PLATFORM,
+    "X-Msh-Version": kimiVersion(),
+    "X-Msh-Device-Name": asciiHeader((0, import_node_os2.hostname)()),
+    "X-Msh-Device-Model": asciiHeader(deviceModel()),
+    "X-Msh-Os-Version": asciiHeader((0, import_node_os2.release)()),
+    "X-Msh-Device-Id": deviceId()
+  };
+}
+function kimiCodingHeaders() {
+  return {
+    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
+    ...deviceHeaders()
+  };
+}
+function isKimiCodingEndpoint(baseUrl) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
+  const normalized = baseUrl.replace(/\/+$/, "");
+  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
+}
+async function postForm(endpoint, params) {
+  const response = await fetch(`${oauthHost()}${endpoint}`, {
+    method: "POST",
+    headers: {
+      ...deviceHeaders(),
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams(params).toString()
+  });
+  let data = {};
+  try {
+    const parsed = await response.json();
+    if (parsed && typeof parsed === "object") data = parsed;
+  } catch {
+  }
+  return { status: response.status, data };
+}
+function errorDetail(data) {
+  const desc = data.error_description ?? data.message ?? data.error;
+  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
+}
+function credsFromTokenResponse(data, opts) {
+  const accessToken = data.access_token;
+  const responseRefreshToken = data.refresh_token;
+  const expiresIn = Number(data.expires_in);
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("Kimi OAuth response missing access_token.");
+  }
+  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
+  if (refreshToken.length === 0) {
+    throw new Error("Kimi OAuth response missing refresh_token.");
+  }
+  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("Kimi OAuth response missing or invalid expires_in.");
+  }
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: Date.now() + expiresIn * 1e3,
+    baseUrl: kimiCodeBaseUrl()
+  };
+}
+async function requestDeviceAuthorization() {
+  const { status, data } = await postForm("/api/oauth/device_authorization", {
+    client_id: CLIENT_ID
+  });
+  if (status !== 200) {
+    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
+  }
+  const userCode = data.user_code;
+  const deviceCode = data.device_code;
+  const verificationUriComplete = data.verification_uri_complete;
+  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
+    throw new Error("Kimi device authorization response missing user_code/device_code.");
+  }
+  return {
+    userCode,
+    deviceCode,
+    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
+    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
+    interval: Number(data.interval ?? 5) || 5
+  };
+}
+async function pollDeviceToken(deviceCode) {
+  const { status, data } = await postForm("/api/oauth/token", {
+    client_id: CLIENT_ID,
+    device_code: deviceCode,
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return { kind: "success", creds: credsFromTokenResponse(data) };
+  }
+  if (status >= 500) {
+    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
+  switch (errorCode) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    case "access_denied":
+      return { kind: "denied" };
+    default:
+      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+async function loginKimi(callbacks) {
+  const auth = await requestDeviceAuthorization();
+  callbacks.onStatus(
+    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
+  );
+  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
+  callbacks.onStatus("Waiting for you to authorize in the browser...");
+  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
+  let interval = Math.max(auth.interval, 1);
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    const result = await pollDeviceToken(auth.deviceCode);
+    if (result.kind === "success") return result.creds;
+    if (result.kind === "denied") {
+      throw new Error("Kimi authorization was denied.");
+    }
+    if (result.kind === "expired") {
+      throw new Error("Kimi device code expired. Please run login again.");
+    }
+    if (result.kind === "slow_down") {
+      interval += 5;
+    }
+  }
+  throw new Error("Kimi login timed out. Please run login again.");
+}
+async function refreshKimiToken(refreshToken) {
+  const { status, data } = await postForm("/api/oauth/token", {
+    client_id: CLIENT_ID,
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "";
+  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
+}
+
+// src/auth-storage.ts
+var import_promises4 = __toESM(require("fs/promises"), 1);
+var import_node_fs3 = require("fs");
+var import_node_crypto6 = __toESM(require("crypto"), 1);
+
 // src/oauth/anthropic.ts
-var import_node_crypto2 = __toESM(require("crypto"), 1);
+var import_node_crypto3 = __toESM(require("crypto"), 1);
 
 // src/oauth/pkce.ts
 function base64urlEncode(bytes) {
@@ -138,49 +360,66 @@ async function generatePKCE() {
 
 // src/claude-code-version.ts
 var import_promises = __toESM(require("fs/promises"), 1);
-var import_node_path3 = __toESM(require("path"), 1);
+var import_node_path4 = __toESM(require("path"), 1);
 
 // src/logger.ts
-var import_node_fs = __toESM(require("fs"), 1);
-var import_node_path2 = __toESM(require("path"), 1);
-var import_node_crypto = require("crypto");
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_node_path3 = __toESM(require("path"), 1);
+var import_node_crypto2 = require("crypto");
 var import_ai = require("@prestyj/ai");
 var MAX_BYTES = 10 * 1024 * 1024;
 var fd = null;
+var bytesWritten = 0;
+var capped = false;
 var sessionId = "";
 var appName = "app";
 var cleanups = [];
 var exactSecrets = [];
 function rotateIfNeeded(filePath) {
   try {
-    const st = import_node_fs.default.statSync(filePath);
+    const st = import_node_fs2.default.statSync(filePath);
     if (st.size < MAX_BYTES) return;
     const rotated = `${filePath}.1`;
     try {
-      import_node_fs.default.unlinkSync(rotated);
+      import_node_fs2.default.unlinkSync(rotated);
     } catch {
     }
-    import_node_fs.default.renameSync(filePath, rotated);
+    import_node_fs2.default.renameSync(filePath, rotated);
   } catch {
   }
 }
 function openLog(filePath, name) {
-  if (fd !== null) return false;
+  if (fd !== null || capped) return false;
   appName = name;
   exactSecrets = (0, import_ai.environmentSecrets)(process.env);
   try {
-    import_node_fs.default.mkdirSync(import_node_path2.default.dirname(filePath), { recursive: true, mode: 448 });
+    import_node_fs2.default.mkdirSync(import_node_path3.default.dirname(filePath), { recursive: true, mode: 448 });
   } catch {
   }
   rotateIfNeeded(filePath);
   try {
-    fd = import_node_fs.default.openSync(filePath, "a");
+    fd = import_node_fs2.default.openSync(filePath, "a");
   } catch {
+    fd = null;
+    bytesWritten = 0;
     return false;
   }
-  sessionId = (0, import_node_crypto.randomBytes)(4).toString("hex");
   try {
-    import_node_fs.default.writeSync(fd, "\n");
+    bytesWritten = import_node_fs2.default.fstatSync(fd).size;
+  } catch {
+    try {
+      import_node_fs2.default.closeSync(fd);
+    } catch {
+    }
+    fd = null;
+    bytesWritten = 0;
+    return false;
+  }
+  sessionId = (0, import_node_crypto2.randomBytes)(4).toString("hex");
+  try {
+    if (bytesWritten < MAX_BYTES) {
+      bytesWritten += import_node_fs2.default.writeSync(fd, "\n");
+    }
   } catch {
   }
   return true;
@@ -206,8 +445,23 @@ function log(level, category, message, data) {
     if (pairs) line += ` ${pairs}`;
   }
   line += "\n";
+  const lineBytes = Buffer.byteLength(line);
+  if (bytesWritten + lineBytes > MAX_BYTES) {
+    const capLine = `[${ts}] [sid=${sessionId}] [WARN] [logger] Log cap reached; file logging disabled until restart
+`;
+    try {
+      if (bytesWritten + Buffer.byteLength(capLine) <= MAX_BYTES) {
+        bytesWritten += import_node_fs2.default.writeSync(fd, capLine);
+      }
+      import_node_fs2.default.closeSync(fd);
+    } catch {
+    }
+    fd = null;
+    capped = true;
+    return;
+  }
   try {
-    import_node_fs.default.writeSync(fd, line);
+    bytesWritten += import_node_fs2.default.writeSync(fd, line);
   } catch {
   }
 }
@@ -215,13 +469,16 @@ function registerLogCleanup(fn) {
   cleanups.push(fn);
 }
 function closeLogger(opts) {
-  if (fd === null) return;
-  if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
-  try {
-    import_node_fs.default.closeSync(fd);
-  } catch {
+  if (fd !== null) {
+    if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
+    try {
+      if (fd !== null) import_node_fs2.default.closeSync(fd);
+    } catch {
+    }
   }
   fd = null;
+  bytesWritten = 0;
+  capped = false;
   exactSecrets = [];
   for (const unsub of cleanups) unsub();
   cleanups = [];
@@ -235,7 +492,7 @@ var FALLBACK_VERSION = "2.1.88";
 var memoryCache = null;
 var inflight = null;
 function cachePath() {
-  return import_node_path3.default.join(getAppPaths().agentDir, "claude-code-version.json");
+  return import_node_path4.default.join(getAppPaths().agentDir, "claude-code-version.json");
 }
 async function readDiskCache() {
   try {
@@ -317,7 +574,7 @@ async function getClaudeCliUserAgent() {
 }
 
 // src/oauth/anthropic.ts
-var CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+var CLIENT_ID2 = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
 var TOKEN_URLS = [
   "https://platform.claude.com/v1/oauth/token",
@@ -361,10 +618,10 @@ function toCredentials(data) {
 }
 async function loginAnthropic(callbacks) {
   const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto2.default.randomBytes(16).toString("hex");
+  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
   const params = new URLSearchParams({
     code: "true",
-    client_id: CLIENT_ID,
+    client_id: CLIENT_ID2,
     response_type: "code",
     redirect_uri: REDIRECT_URI,
     scope: SCOPES,
@@ -385,7 +642,7 @@ async function exchangeAnthropicCode(code, state, verifier) {
   const data = await postTokenRequest(
     {
       grant_type: "authorization_code",
-      client_id: CLIENT_ID,
+      client_id: CLIENT_ID2,
       code,
       state,
       redirect_uri: REDIRECT_URI,
@@ -399,7 +656,7 @@ async function refreshAnthropicToken(refreshToken) {
   const data = await postTokenRequest(
     {
       grant_type: "refresh_token",
-      client_id: CLIENT_ID,
+      client_id: CLIENT_ID2,
       refresh_token: refreshToken
     },
     "token refresh"
@@ -409,8 +666,8 @@ async function refreshAnthropicToken(refreshToken) {
 
 // src/oauth/openai.ts
 var import_node_http = __toESM(require("http"), 1);
-var import_node_crypto3 = __toESM(require("crypto"), 1);
-var CLIENT_ID2 = "app_EMoamEEZ73f0CkXaXp7hrann";
+var import_node_crypto4 = __toESM(require("crypto"), 1);
+var CLIENT_ID3 = "app_EMoamEEZ73f0CkXaXp7hrann";
 var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
 var TOKEN_URL = "https://auth.openai.com/oauth/token";
 var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
@@ -418,10 +675,10 @@ var SCOPE = "openid profile email offline_access api.connectors.read api.connect
 var JWT_CLAIM_PATH = "https://api.openai.com/auth";
 async function loginOpenAI(callbacks) {
   const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
+  const state = import_node_crypto4.default.randomBytes(16).toString("hex");
   const url = new URL(AUTHORIZE_URL2);
   url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID2);
+  url.searchParams.set("client_id", CLIENT_ID3);
   url.searchParams.set("redirect_uri", REDIRECT_URI2);
   url.searchParams.set("scope", SCOPE);
   url.searchParams.set("code_challenge", challenge);
@@ -542,7 +799,7 @@ async function exchangeOpenAICode(code, verifier) {
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "authorization_code",
-      client_id: CLIENT_ID2,
+      client_id: CLIENT_ID3,
       code,
       redirect_uri: REDIRECT_URI2,
       code_verifier: verifier
@@ -566,7 +823,7 @@ async function refreshOpenAIToken(refreshToken) {
     body: new URLSearchParams({
       grant_type: "refresh_token",
       refresh_token: refreshToken,
-      client_id: CLIENT_ID2
+      client_id: CLIENT_ID3
     })
   });
   if (!response.ok) {
@@ -588,7 +845,7 @@ async function refreshOpenAIToken(refreshToken) {
 
 // src/oauth/gemini.ts
 var import_node_http2 = __toESM(require("http"), 1);
-var import_node_crypto4 = __toESM(require("crypto"), 1);
+var import_node_crypto5 = __toESM(require("crypto"), 1);
 var CLIENT_ID_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_ID";
 var CLIENT_SECRET_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_SECRET";
 var DEFAULT_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
@@ -622,7 +879,7 @@ var CodeAssistHttpError = class extends Error {
 async function loginGemini(callbacks) {
   const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
   const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto4.default.randomBytes(32).toString("hex");
+  const state = import_node_crypto5.default.randomBytes(32).toString("hex");
   const redirectUri = await getLoopbackRedirectUri();
   const url = new URL(AUTHORIZE_URL3);
   url.searchParams.set("response_type", "code");
@@ -863,307 +1120,90 @@ async function loadCodeAssist(accessToken, envProject, metadata) {
   }
 }
 function getValidationRequiredTier(response) {
-  return response.ineligibleTiers?.find(
-    (tier) => tier.reasonCode === VALIDATION_REQUIRED_REASON && typeof tier.validationUrl === "string"
-  );
-}
-function getOnboardTier(response) {
-  const defaultTier = response.allowedTiers?.find((tier) => tier.isDefault);
-  return defaultTier ?? { id: USER_TIER_LEGACY, name: "" };
-}
-function throwProjectError(response) {
-  const reasons = response.ineligibleTiers?.map((tier) => tier.reasonMessage ?? tier.tierName).filter((reason) => Boolean(reason));
-  if (reasons && reasons.length > 0) {
-    throw new Error(`Gemini Code Assist setup failed: ${reasons.join(", ")}`);
-  }
-  throw new Error(
-    "Gemini requires a Google Cloud project for this account. Set GOOGLE_CLOUD_PROJECT and try again."
-  );
-}
-async function codeAssistPost(accessToken, method, body) {
-  let lastError;
-  for (let attempt = 0; attempt <= CODE_ASSIST_POST_RETRIES; attempt++) {
-    try {
-      return await codeAssistRequest(getCodeAssistMethodUrl(method), accessToken, method, {
-        method: "POST",
-        body: JSON.stringify(body)
-      });
-    } catch (err) {
-      if (!(err instanceof CodeAssistHttpError) || attempt === CODE_ASSIST_POST_RETRIES || !shouldRetryCodeAssistStatus(err.status)) {
-        throw err;
-      }
-      lastError = err;
-    }
-    await new Promise((resolve) => setTimeout(resolve, CODE_ASSIST_POST_RETRY_DELAY_MS));
-  }
-  throw lastError ?? new Error(`Gemini Code Assist ${method} failed.`);
-}
-async function codeAssistGet(accessToken, operationName) {
-  return codeAssistRequest(getCodeAssistOperationUrl(operationName), accessToken, "operation", {
-    method: "GET"
-  });
-}
-async function codeAssistRequest(url, accessToken, label, init) {
-  const response = await fetch(url, {
-    ...init,
-    headers: codeAssistHeaders(accessToken)
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new CodeAssistHttpError(label, response.status, text);
-  }
-  return await response.json();
-}
-function getCodeAssistBaseUrl() {
-  const endpoint = process.env.CODE_ASSIST_ENDPOINT ?? CODE_ASSIST_BASE_URL;
-  const version = process.env.CODE_ASSIST_API_VERSION || CODE_ASSIST_API_VERSION;
-  return `${endpoint}/${version}`;
-}
-function getCodeAssistMethodUrl(method) {
-  return `${getCodeAssistBaseUrl()}:${method}`;
-}
-function getCodeAssistOperationUrl(operationName) {
-  return `${getCodeAssistBaseUrl()}/${operationName}`;
-}
-function shouldRetryCodeAssistStatus(status) {
-  return status === 429 || status === 499 || status >= 500 && status <= 599;
-}
-function isVpcScAffectedError(error) {
-  try {
-    const parsed = JSON.parse(error.body);
-    if (!parsed || typeof parsed !== "object" || !("error" in parsed)) return false;
-    const details = parsed.error?.details;
-    return Array.isArray(details) ? details.some(
-      (detail) => detail != null && typeof detail === "object" && "reason" in detail && detail.reason === VPC_SC_REASON
-    ) : false;
-  } catch {
-    return false;
-  }
-}
-function codeAssistHeaders(accessToken) {
-  return {
-    Authorization: `Bearer ${accessToken}`,
-    "Content-Type": "application/json",
-    "User-Agent": "google-gemini-cli",
-    "X-Goog-Api-Client": "gemini-cli/0.0.0"
-  };
-}
-
-// src/oauth/kimi.ts
-var import_node_child_process = require("child_process");
-var import_node_crypto5 = require("crypto");
-var import_node_fs2 = require("fs");
-var import_node_os2 = require("os");
-var import_node_path4 = __toESM(require("path"), 1);
-var CLIENT_ID3 = "17e5f671-d194-4dfb-9706-5516cb48c098";
-var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
-var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
-var KIMI_PLATFORM = "kimi_code_cli";
-var DEFAULT_KIMI_VERSION = "1.0.11";
-var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
-function oauthHost() {
-  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
-  return host.replace(/\/+$/, "");
-}
-function kimiCodeBaseUrl() {
-  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
-}
-function kimiVersion() {
-  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
-  return asciiHeader(v, DEFAULT_KIMI_VERSION);
-}
-function asciiHeader(value, fallback = "unknown") {
-  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : fallback;
-}
-function macOsProductVersion() {
-  try {
-    const version = (0, import_node_child_process.execFileSync)("/usr/bin/sw_vers", ["-productVersion"], {
-      encoding: "utf-8",
-      timeout: 1e3
-    }).trim();
-    return version.length > 0 ? version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function deviceModel() {
-  const os2 = (0, import_node_os2.type)();
-  const version = (0, import_node_os2.release)();
-  const osArch = (0, import_node_os2.arch)();
-  if (os2 === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
-  if (os2 === "Windows_NT") return `Windows ${version} ${osArch}`;
-  return `${os2} ${version} ${osArch}`.trim();
-}
-function deviceId() {
-  const idPath = import_node_path4.default.join(getAppPaths().agentDir, "kimi_device_id");
-  if ((0, import_node_fs2.existsSync)(idPath)) {
-    try {
-      const text = (0, import_node_fs2.readFileSync)(idPath, "utf-8").trim();
-      if (text.length > 0) return text;
-    } catch {
-    }
-  }
-  const id = (0, import_node_crypto5.randomUUID)();
-  try {
-    (0, import_node_fs2.mkdirSync)(getAppPaths().agentDir, { recursive: true, mode: 448 });
-    (0, import_node_fs2.writeFileSync)(idPath, id, { encoding: "utf-8", mode: 384 });
-  } catch {
-  }
-  return id;
-}
-function deviceHeaders() {
-  return {
-    "X-Msh-Platform": KIMI_PLATFORM,
-    "X-Msh-Version": kimiVersion(),
-    "X-Msh-Device-Name": asciiHeader((0, import_node_os2.hostname)()),
-    "X-Msh-Device-Model": asciiHeader(deviceModel()),
-    "X-Msh-Os-Version": asciiHeader((0, import_node_os2.release)()),
-    "X-Msh-Device-Id": deviceId()
-  };
-}
-function kimiCodingHeaders() {
-  return {
-    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
-    ...deviceHeaders()
-  };
-}
-function isKimiCodingEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
-}
-async function postForm(endpoint, params) {
-  const response = await fetch(`${oauthHost()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      ...deviceHeaders(),
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(params).toString()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
+  return response.ineligibleTiers?.find(
+    (tier) => tier.reasonCode === VALIDATION_REQUIRED_REASON && typeof tier.validationUrl === "string"
+  );
 }
-function errorDetail(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
+function getOnboardTier(response) {
+  const defaultTier = response.allowedTiers?.find((tier) => tier.isDefault);
+  return defaultTier ?? { id: USER_TIER_LEGACY, name: "" };
 }
-function credsFromTokenResponse(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  const expiresIn = Number(data.expires_in);
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Kimi OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error("Kimi OAuth response missing refresh_token.");
+function throwProjectError(response) {
+  const reasons = response.ineligibleTiers?.map((tier) => tier.reasonMessage ?? tier.tierName).filter((reason) => Boolean(reason));
+  if (reasons && reasons.length > 0) {
+    throw new Error(`Gemini Code Assist setup failed: ${reasons.join(", ")}`);
   }
-  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-    throw new Error("Kimi OAuth response missing or invalid expires_in.");
+  throw new Error(
+    "Gemini requires a Google Cloud project for this account. Set GOOGLE_CLOUD_PROJECT and try again."
+  );
+}
+async function codeAssistPost(accessToken, method, body) {
+  let lastError;
+  for (let attempt = 0; attempt <= CODE_ASSIST_POST_RETRIES; attempt++) {
+    try {
+      return await codeAssistRequest(getCodeAssistMethodUrl(method), accessToken, method, {
+        method: "POST",
+        body: JSON.stringify(body)
+      });
+    } catch (err) {
+      if (!(err instanceof CodeAssistHttpError) || attempt === CODE_ASSIST_POST_RETRIES || !shouldRetryCodeAssistStatus(err.status)) {
+        throw err;
+      }
+      lastError = err;
+    }
+    await new Promise((resolve) => setTimeout(resolve, CODE_ASSIST_POST_RETRY_DELAY_MS));
   }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    baseUrl: kimiCodeBaseUrl()
-  };
+  throw lastError ?? new Error(`Gemini Code Assist ${method} failed.`);
 }
-async function requestDeviceAuthorization() {
-  const { status, data } = await postForm("/api/oauth/device_authorization", {
-    client_id: CLIENT_ID3
+async function codeAssistGet(accessToken, operationName) {
+  return codeAssistRequest(getCodeAssistOperationUrl(operationName), accessToken, "operation", {
+    method: "GET"
   });
-  if (status !== 200) {
-    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Kimi device authorization response missing user_code/device_code.");
-  }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5
-  };
 }
-async function pollDeviceToken(deviceCode) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID3,
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+async function codeAssistRequest(url, accessToken, label, init) {
+  const response = await fetch(url, {
+    ...init,
+    headers: codeAssistHeaders(accessToken)
   });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
+  if (!response.ok) {
+    const text = await response.text();
+    throw new CodeAssistHttpError(label, response.status, text);
   }
+  return await response.json();
 }
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
+function getCodeAssistBaseUrl() {
+  const endpoint = process.env.CODE_ASSIST_ENDPOINT ?? CODE_ASSIST_BASE_URL;
+  const version = process.env.CODE_ASSIST_API_VERSION || CODE_ASSIST_API_VERSION;
+  return `${endpoint}/${version}`;
 }
-async function loginKimi(callbacks) {
-  const auth = await requestDeviceAuthorization();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    await sleep(interval * 1e3);
-    const result = await pollDeviceToken(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Kimi authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Kimi device code expired. Please run login again.");
-    }
-    if (result.kind === "slow_down") {
-      interval += 5;
-    }
-  }
-  throw new Error("Kimi login timed out. Please run login again.");
+function getCodeAssistMethodUrl(method) {
+  return `${getCodeAssistBaseUrl()}:${method}`;
 }
-async function refreshKimiToken(refreshToken) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID3,
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
+function getCodeAssistOperationUrl(operationName) {
+  return `${getCodeAssistBaseUrl()}/${operationName}`;
+}
+function shouldRetryCodeAssistStatus(status) {
+  return status === 429 || status === 499 || status >= 500 && status <= 599;
+}
+function isVpcScAffectedError(error) {
+  try {
+    const parsed = JSON.parse(error.body);
+    if (!parsed || typeof parsed !== "object" || !("error" in parsed)) return false;
+    const details = parsed.error?.details;
+    return Array.isArray(details) ? details.some(
+      (detail) => detail != null && typeof detail === "object" && "reason" in detail && detail.reason === VPC_SC_REASON
+    ) : false;
+  } catch {
+    return false;
   }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
+}
+function codeAssistHeaders(accessToken) {
+  return {
+    Authorization: `Bearer ${accessToken}`,
+    "Content-Type": "application/json",
+    "User-Agent": "google-gemini-cli",
+    "X-Goog-Api-Client": "gemini-cli/0.0.0"
+  };
 }
 
 // src/file-lock.ts
@@ -1231,6 +1271,26 @@ function isAlive(pid) {
 // src/auth-storage.ts
 var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
 var XIAOMI_CREDITS_KEY = "xiaomi-credits";
+function activeBaseUrlEntry(data, provider) {
+  if (provider === "moonshot") {
+    const oauth = data[MOONSHOT_OAUTH_KEY];
+    if (oauth) {
+      const exhaustedUntil = oauth.usageExhaustedUntil ?? 0;
+      if (Date.now() < exhaustedUntil && data["moonshot"]) return data["moonshot"];
+      return oauth;
+    }
+    return data["moonshot"];
+  }
+  return data[provider];
+}
+function readStoredBaseUrlSync(authFile, provider) {
+  try {
+    const data = JSON.parse((0, import_node_fs3.readFileSync)(authFile, "utf-8"));
+    return activeBaseUrlEntry(data, provider)?.baseUrl;
+  } catch {
+    return void 0;
+  }
+}
 var REFRESH_SKEW_MS = 6e4;
 var USAGE_EXHAUSTED_DEFAULT_MS = 15 * 60 * 1e3;
 var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
@@ -1306,6 +1366,16 @@ var AuthStorage = class {
     }
     return STATIC_API_KEY_PROVIDERS.has(provider);
   }
+  /**
+   * The base URL on the credential that is active right now, if any.
+   * Synchronous — call only after load()/resolveCredentials() populated the
+   * snapshot. For `moonshot` this is the Kimi For Coding URL whenever the
+   * OAuth entry is the one resolveCredentials would serve (i.e. not currently
+   * usage-exhausted with an API key configured).
+   */
+  getStoredBaseUrl(provider) {
+    return activeBaseUrlEntry(this.data, provider)?.baseUrl;
+  }
   async load() {
     await withFileLock(this.filePath, async () => {
       try {
@@ -1337,27 +1407,46 @@ var AuthStorage = class {
   /**
    * Force a re-read from disk, discarding the in-memory cache. Needed when
    * another process mutates the auth file out-of-band — e.g. the desktop app
-   * writes API keys natively (Rust → ~/.ezcoder/auth.json) without going through
-   * this instance, so a long-lived daemon's cache would otherwise stay stale and
-   * never see a newly added provider key.
+   * writes API keys natively without going through this instance.
    */
   async reload() {
     this.loaded = false;
     await this.load();
   }
+  /**
+   * Apply one provider-scoped mutation to the latest on-disk snapshot.
+   * AuthStorage instances live in every app session/process, so writing this
+   * instance's cached snapshot can erase credentials another instance just
+   * added. The file lock only serializes writers; the re-read prevents stale
+   * full-file overwrites.
+   */
+  async mutateLatest(mutator) {
+    await this.ensureLoaded();
+    await withFileLock(this.filePath, async () => {
+      const latest = await readAuthData(this.filePath);
+      mutator(latest);
+      await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
+      this.data = latest;
+    });
+  }
+  async reloadLatest() {
+    await withFileLock(this.filePath, async () => {
+      this.data = await readAuthData(this.filePath);
+    });
+  }
   async getCredentials(provider) {
     await this.ensureLoaded();
     return this.data[provider];
   }
   async setCredentials(provider, creds) {
-    await this.ensureLoaded();
-    this.data[provider] = creds;
-    await this.save();
+    await this.mutateLatest((latest) => {
+      latest[provider] = creds;
+    });
   }
   async clearCredentials(provider) {
-    await this.ensureLoaded();
-    delete this.data[provider];
-    await this.save();
+    await this.mutateLatest((latest) => {
+      delete latest[provider];
+    });
   }
   /**
    * Mark the credential stored under `storageKey` as usage-exhausted until
@@ -1371,12 +1460,15 @@ var AuthStorage = class {
    * nothing is stored under `storageKey`.
    */
   async markUsageExhausted(storageKey, resetsAt) {
-    await this.ensureLoaded();
-    const creds = this.data[storageKey];
-    if (!creds) return;
     const until = resetsAt !== void 0 && resetsAt * 1e3 > Date.now() ? resetsAt * 1e3 : Date.now() + USAGE_EXHAUSTED_DEFAULT_MS;
-    creds.usageExhaustedUntil = until;
-    await this.save();
+    let marked = false;
+    await this.mutateLatest((latest) => {
+      const creds = latest[storageKey];
+      if (!creds) return;
+      creds.usageExhaustedUntil = until;
+      marked = true;
+    });
+    if (!marked) return;
     log(
       "WARN",
       "auth",
@@ -1384,8 +1476,11 @@ var AuthStorage = class {
     );
   }
   async clearAll() {
-    this.data = {};
-    await this.save();
+    await this.ensureLoaded();
+    await withFileLock(this.filePath, async () => {
+      this.data = {};
+      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+    });
   }
   /**
    * Returns valid credentials, auto-refreshing if expired.
@@ -1395,6 +1490,10 @@ var AuthStorage = class {
    */
   async resolveCredentials(provider, opts) {
     await this.ensureLoaded();
+    const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : provider === "moonshot" ? [MOONSHOT_OAUTH_KEY, "moonshot"] : [provider];
+    if (!directStorageKeys.some((key) => Boolean(this.data[key]))) {
+      await this.reloadLatest();
+    }
     if (opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider)) {
       for (const key of opts.storageKeys) {
         const creds2 = this.data[key];
@@ -1441,41 +1540,44 @@ var AuthStorage = class {
     const existing = this.refreshLocks.get(provider);
     if (existing) return existing;
     const refreshPromise = withFileLock(this.filePath, async () => {
-      try {
-        const content = await import_promises4.default.readFile(this.filePath, "utf-8");
-        const freshData = JSON.parse(content);
-        const freshCreds = freshData[provider];
-        if (freshCreds && !opts?.forceRefresh && Date.now() < freshCreds.expiresAt - REFRESH_SKEW_MS) {
-          this.data[provider] = freshCreds;
-          return freshCreds;
-        }
-      } catch {
+      const latest = await readAuthData(this.filePath);
+      const latestCreds = latest[provider];
+      if (!latestCreds) {
+        this.data = latest;
+        throw new NotLoggedInError(provider);
+      }
+      const credentialWasReplaced = latestCreds.accessToken !== creds.accessToken || latestCreds.refreshToken !== creds.refreshToken || latestCreds.expiresAt !== creds.expiresAt;
+      if (credentialWasReplaced || !opts?.forceRefresh && Date.now() < latestCreds.expiresAt - REFRESH_SKEW_MS) {
+        this.data = latest;
+        return latestCreds;
       }
       const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : refreshOpenAIToken;
       let refreshed;
       try {
-        refreshed = await refreshFn(creds.refreshToken);
+        refreshed = await refreshFn(latestCreds.refreshToken);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh/i.test(msg) || /unauthorized/i.test(msg);
         if (isAuthFailure) {
-          delete this.data[provider];
-          await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+          delete latest[provider];
+          this.data = latest;
+          await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
           throw new NotLoggedInError(provider);
         }
         throw err;
       }
-      if (!refreshed.accountId && creds.accountId) {
-        refreshed.accountId = creds.accountId;
+      if (!refreshed.accountId && latestCreds.accountId) {
+        refreshed.accountId = latestCreds.accountId;
       }
-      if (!refreshed.projectId && creds.projectId) {
-        refreshed.projectId = creds.projectId;
+      if (!refreshed.projectId && latestCreds.projectId) {
+        refreshed.projectId = latestCreds.projectId;
       }
-      if (!refreshed.baseUrl && creds.baseUrl) {
-        refreshed.baseUrl = creds.baseUrl;
+      if (!refreshed.baseUrl && latestCreds.baseUrl) {
+        refreshed.baseUrl = latestCreds.baseUrl;
       }
-      this.data[provider] = refreshed;
-      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+      latest[provider] = refreshed;
+      this.data = latest;
+      await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
       return refreshed;
     });
     this.refreshLocks.set(provider, refreshPromise);
@@ -1493,12 +1595,16 @@ var AuthStorage = class {
     const creds = await this.resolveCredentials(provider);
     return creds.accessToken;
   }
-  async save() {
-    await withFileLock(this.filePath, async () => {
-      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
-    });
-  }
 };
+async function readAuthData(filePath) {
+  try {
+    const content = await import_promises4.default.readFile(filePath, "utf-8");
+    return JSON.parse(content);
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  }
+}
 async function atomicWriteFile(filePath, content) {
   const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${import_node_crypto6.default.randomUUID().slice(0, 8)}.tmp`;
   try {
@@ -1591,7 +1697,8 @@ var MODELS = [
   // ── OpenAI (Codex) ─────────────────────────────────────
   // GPT-5.6 family — three agentic coding tiers launched July 2026. The public
   // Responses API advertises a 1.05M context window; OpenAI's Codex product
-  // catalog advertises 372K on the ChatGPT OAuth route. All three take
+  // catalog advertises 272K on the ChatGPT OAuth route (corrected from the
+  // initially advertised 372K — openai/codex PR #33972, Jul 18 2026 hotfix). All three take
   // text+image input, freeform apply_patch, text+image web search, and parallel
   // tool calls.
   {
@@ -1603,7 +1710,7 @@ var MODELS = [
     name: "GPT-5.6 Sol",
     provider: "openai",
     contextWindow: 105e4,
-    codexContextWindow: 372e3,
+    codexContextWindow: 272e3,
     maxOutputTokens: 128e3,
     supportsThinking: true,
     supportsImages: true,
@@ -1618,7 +1725,7 @@ var MODELS = [
     name: "GPT-5.6 Terra",
     provider: "openai",
     contextWindow: 105e4,
-    codexContextWindow: 372e3,
+    codexContextWindow: 272e3,
     maxOutputTokens: 128e3,
     supportsThinking: true,
     supportsImages: true,
@@ -1633,7 +1740,7 @@ var MODELS = [
     name: "GPT-5.6 Luna",
     provider: "openai",
     contextWindow: 105e4,
-    codexContextWindow: 372e3,
+    codexContextWindow: 272e3,
     maxOutputTokens: 128e3,
     supportsThinking: true,
     supportsImages: true,
@@ -1752,8 +1859,9 @@ var MODELS = [
   },
   // ── Moonshot (Kimi) ────────────────────────────────────
   // K3 is Kimi's 2.8T-parameter flagship for long-horizon coding, knowledge
-  // work, and deep reasoning. It always reasons at the `max` effort; the public
-  // API uses `reasoning_effort`, while Kimi Code OAuth keeps its managed wire shape.
+  // work, and deep reasoning. Its effort ladder is server-declared as
+  // low/high/max on both the public API (default max) and the Kimi For Coding
+  // OAuth endpoint (default high); thinking can also be fully disabled.
   {
     id: "kimi-k3",
     name: "Kimi K3",
@@ -1987,6 +2095,11 @@ function getContextWindow(modelId, options) {
 function getMaxThinkingLevel(modelId) {
   return getModel(modelId)?.maxThinkingLevel ?? "high";
 }
+function getDefaultThinkingLevel(modelId, options) {
+  const model = getModel(modelId);
+  if (model?.id === "kimi-k3" && isKimiCodingEndpoint(options?.baseUrl)) return "high";
+  return model?.maxThinkingLevel ?? "high";
+}
 function getSummaryModel(provider, currentModelId) {
   if (provider === "anthropic") {
     return MODELS.find((m) => m.id === "claude-sonnet-5");
@@ -2027,6 +2140,7 @@ var ANTHROPIC_ADAPTIVE_THINKING_LEVELS = [
   "high",
   "max"
 ];
+var MOONSHOT_K3_THINKING_LEVELS = ["low", "high", "max"];
 function isOpenAIGptModel(provider, model) {
   return provider === "openai" && model.startsWith("gpt-");
 }
@@ -2036,6 +2150,9 @@ function isSakanaModel(provider) {
 function isXaiModel(provider) {
   return provider === "xai";
 }
+function isMoonshotK3Model(provider, model) {
+  return provider === "moonshot" && model === "kimi-k3";
+}
 function isAnthropicOpus48Or47Model(provider, model) {
   return provider === "anthropic" && /opus-4-8|opus-4-7/.test(model);
 }
@@ -2060,6 +2177,7 @@ function getSupportedThinkingLevels(provider, model) {
     if (maxIndex2 === -1) return XAI_THINKING_LEVELS;
     return XAI_THINKING_LEVELS.slice(0, maxIndex2 + 1);
   }
+  if (isMoonshotK3Model(provider, model)) return MOONSHOT_K3_THINKING_LEVELS;
   if (!isOpenAIGptModel(provider, model)) return [maxLevel];
   const levels = model.startsWith("gpt-5.6-") ? OPENAI_GPT_56_THINKING_LEVELS : OPENAI_GPT_THINKING_LEVELS;
   const maxIndex = levels.indexOf(maxLevel);
@@ -2071,7 +2189,7 @@ function isThinkingLevelSupported(provider, model, level) {
 }
 function getNextThinkingLevel(provider, model, current) {
   const supportedLevels = getSupportedThinkingLevels(provider, model);
-  const shouldCycleLevels = isOpenAIGptModel(provider, model) || isAnthropicAdaptiveModel(provider, model) || isSakanaModel(provider) || isXaiModel(provider);
+  const shouldCycleLevels = isOpenAIGptModel(provider, model) || isAnthropicAdaptiveModel(provider, model) || isSakanaModel(provider) || isXaiModel(provider) || isMoonshotK3Model(provider, model);
   if (!shouldCycleLevels) {
     return current ? void 0 : supportedLevels[0];
   }
@@ -2083,9 +2201,10 @@ function getNextThinkingLevel(provider, model, current) {
 
 // src/provider-usage.ts
 var SubscriptionUsageError = class extends Error {
-  constructor(message, status) {
+  constructor(message, status, retryAfterMs2) {
     super(message);
     this.status = status;
+    this.retryAfterMs = retryAfterMs2;
     this.name = "SubscriptionUsageError";
   }
 };
@@ -2135,12 +2254,20 @@ function normalizedCodexWindow(window, fallbackKind, now) {
     resetsAt: codexResetAt(window, now)
   };
 }
-async function readUsageResponse(response) {
+function retryAfterMs(response, now) {
+  const value = response.headers.get("retry-after")?.trim();
+  if (!value) return void 0;
+  if (/^\d+(?:\.\d+)?$/.test(value)) return Math.ceil(Number(value) * 1e3);
+  const retryAt = Date.parse(value);
+  return Number.isFinite(retryAt) ? Math.max(0, retryAt - now) : void 0;
+}
+async function readUsageResponse(response, now) {
   const text = await response.text();
   if (!response.ok) {
     throw new SubscriptionUsageError(
       `Subscription usage request failed with HTTP ${response.status}`,
-      response.status
+      response.status,
+      retryAfterMs(response, now)
     );
   }
   try {
@@ -2161,7 +2288,7 @@ async function fetchAnthropicUsage(credentials, fetchFn, signal, now) {
       "User-Agent": "ezcoder"
     }
   });
-  const data = await readUsageResponse(response);
+  const data = await readUsageResponse(response, now());
   const windows = [];
   const currentPercent = clampPercent(data.five_hour?.utilization);
   if (currentPercent !== void 0) {
@@ -2197,7 +2324,7 @@ async function fetchCodexUsage(credentials, fetchFn, signal, now) {
   };
   if (credentials.accountId) headers["ChatGPT-Account-Id"] = credentials.accountId;
   const response = await fetchFn(CODEX_USAGE_URL, { method: "GET", signal, headers });
-  const data = await readUsageResponse(response);
+  const data = await readUsageResponse(response, now());
   const windows = [
     normalizedCodexWindow(data.rate_limit?.primary_window, "current", now()),
     normalizedCodexWindow(data.rate_limit?.secondary_window, "weekly", now())
@@ -2213,12 +2340,97 @@ async function fetchCodexUsage(credentials, fetchFn, signal, now) {
     fetchedAt: now()
   };
 }
+function kimiNumber(value) {
+  if (typeof value === "string" && value.trim()) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  }
+  return finiteNumber(value);
+}
+function kimiUsagePercent(detail) {
+  const used = kimiNumber(detail?.used);
+  const limit = kimiNumber(detail?.limit);
+  if (used === void 0 || limit === void 0 || limit <= 0) return void 0;
+  return Math.min(100, Math.max(0, used / limit * 100));
+}
+function kimiWindowMinutes(window) {
+  const duration = kimiNumber(window?.duration);
+  if (duration === void 0 || duration <= 0) return void 0;
+  switch (window?.timeUnit) {
+    case "TIME_UNIT_SECOND":
+      return duration / 60;
+    case "TIME_UNIT_MINUTE":
+      return duration;
+    case "TIME_UNIT_HOUR":
+      return duration * 60;
+    case "TIME_UNIT_DAY":
+      return duration * 24 * 60;
+    default:
+      return void 0;
+  }
+}
+async function fetchKimiUsage(credentials, fetchFn, signal, now) {
+  const response = await fetchFn(`${kimiCodeBaseUrl()}/usages`, {
+    method: "GET",
+    signal,
+    headers: {
+      Authorization: "Bearer " + credentials.accessToken,
+      Accept: "application/json",
+      // The managed coding endpoint gates on the kimi-code-cli client identity,
+      // same as model requests.
+      ...kimiCodingHeaders()
+    }
+  });
+  const data = await readUsageResponse(response, now());
+  const windows = [];
+  const weeklyPercent = kimiUsagePercent(data.usage);
+  if (weeklyPercent !== void 0) {
+    windows.push({
+      kind: "weekly",
+      label: "Weekly",
+      usedPercent: weeklyPercent,
+      resetsAt: isoTimestamp(data.usage?.resetTime)
+    });
+  }
+  for (const limit of data.limits ?? []) {
+    const minutes = kimiWindowMinutes(limit?.window);
+    const percent = kimiUsagePercent(limit?.detail);
+    if (minutes === void 0 || percent === void 0) continue;
+    if (minutes >= 6 * 24 * 60) {
+      if (!windows.some((window) => window.kind === "weekly")) {
+        windows.push({
+          kind: "weekly",
+          label: "Weekly",
+          usedPercent: percent,
+          resetsAt: isoTimestamp(limit?.detail?.resetTime)
+        });
+      }
+      continue;
+    }
+    windows.push({
+      kind: "current",
+      label: `${Math.max(1, Math.round(minutes / 60))}-hour`,
+      usedPercent: percent,
+      resetsAt: isoTimestamp(limit?.detail?.resetTime)
+    });
+  }
+  windows.sort((left, right) => {
+    if (left.kind === right.kind) return 0;
+    return left.kind === "current" ? -1 : 1;
+  });
+  return {
+    provider: "moonshot",
+    displayName: "Kimi",
+    windows,
+    fetchedAt: now()
+  };
+}
 async function fetchSubscriptionUsage(provider, credentials, options = {}) {
   const fetchFn = options.fetchFn ?? fetch;
   const now = options.now ?? Date.now;
   const signal = AbortSignal.timeout(options.timeoutMs ?? 8e3);
   try {
-    return provider === "anthropic" ? await fetchAnthropicUsage(credentials, fetchFn, signal, now) : await fetchCodexUsage(credentials, fetchFn, signal, now);
+    return provider === "anthropic" ? await fetchAnthropicUsage(credentials, fetchFn, signal, now) : provider === "openai" ? await fetchCodexUsage(credentials, fetchFn, signal, now) : await fetchKimiUsage(credentials, fetchFn, signal, now);
   } catch (error) {
     if (error instanceof SubscriptionUsageError) throw error;
     const message = error instanceof Error ? error.message : String(error);
@@ -2535,7 +2747,7 @@ async function transcribeVoice(fileUrl) {
 
 // src/auto-update.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs3 = __toESM(require("fs"), 1);
+var import_node_fs4 = __toESM(require("fs"), 1);
 var import_node_path5 = __toESM(require("path"), 1);
 var CHECK_INTERVAL_MS = 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS2 = 1e4;
@@ -2569,7 +2781,7 @@ function createAutoUpdater(config) {
   }
   function readState() {
     try {
-      const raw = import_node_fs3.default.readFileSync(stateFilePath(), "utf-8");
+      const raw = import_node_fs4.default.readFileSync(stateFilePath(), "utf-8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -2578,8 +2790,8 @@ function createAutoUpdater(config) {
   function writeState(state) {
     try {
       const filePath = stateFilePath();
-      import_node_fs3.default.mkdirSync(import_node_path5.default.dirname(filePath), { recursive: true, mode: 448 });
-      import_node_fs3.default.writeFileSync(filePath, JSON.stringify(state));
+      import_node_fs4.default.mkdirSync(import_node_path5.default.dirname(filePath), { recursive: true, mode: 448 });
+      import_node_fs4.default.writeFileSync(filePath, JSON.stringify(state));
     } catch {
     }
   }
@@ -2724,6 +2936,7 @@ function createAutoUpdater(config) {
   getClaudeCodeVersion,
   getContextWindow,
   getDefaultModel,
+  getDefaultThinkingLevel,
   getFastModel,
   getMaxThinkingLevel,
   getModel,
@@ -2746,6 +2959,7 @@ function createAutoUpdater(config) {
   loginKimi,
   loginOpenAI,
   openLog,
+  readStoredBaseUrlSync,
   refreshAnthropicToken,
   refreshGeminiToken,
   refreshKimiToken,