jeo-code 0.7.26 → 0.7.28

package/src/auth/callback-server.ts

@@ -27,6 +27,19 @@ export interface OAuthCallbackFlowOptions {
 
 export type CallbackResult = { code: string; state: string };
 
+/** Thrown when the fixed callback port cannot be bound and the provider forbids a
+ *  port fallback (fixed redirect URI). Typed so callers (e.g. the OpenAI flow) can
+ *  detect the bind failure and fall back to the device-code flow instead of
+ *  string-matching the error message. */
+export class CallbackPortUnavailableError extends Error {
+  readonly port: number;
+  constructor(port: number) {
+    super(`OAuth callback port ${port} unavailable and this provider requires a fixed redirect URI.`);
+    this.name = "CallbackPortUnavailableError";
+    this.port = port;
+  }
+}
+
 // "jeo" wordmark — bold forged monospace lettering on a neon blue→violet→pink
 // gradient (the mascot's synthwave palette), generated via god-tibo-imagen and
 // matching jeo-pi's bold-wordmark typographic treatment. Embedded as a data URI
@@ -125,6 +138,7 @@ export abstract class OAuthCallbackFlow {
       Bun.serve({
         hostname: this.callbackHostname,
         port,
+        reusePort: false, // gjc parity: never share the port — a busy port must FAIL, not silently split traffic
         fetch: req => this.#handle(req, expectedState),
       });
     try {
@@ -134,9 +148,7 @@ export abstract class OAuthCallbackFlow {
       return { server, redirectUri };
     } catch {
       if (this.fixedRedirectUri) {
-        throw new Error(
-          `OAuth callback port ${this.preferredPort} unavailable and this provider requires a fixed redirect URI.`
-        );
+        throw new CallbackPortUnavailableError(this.preferredPort);
       }
       const server = serve(0);
       const redirectUri = `http://${this.callbackHostname}:${server.port}${this.callbackPath}`;
@@ -172,7 +184,7 @@ export abstract class OAuthCallbackFlow {
     });
 
     return new Response(renderHtml(ok, message), {
-      status: ok ? 200 : 400,
+      status: ok ? 200 : 500, // gjc parity: provider/CSRF failures are server-side errors (500), not 400
       headers: { "content-type": "text/html" },
     });
   }
@@ -206,7 +218,9 @@ export abstract class OAuthCallbackFlow {
               .then(input => {
                 const parsed = parseCallbackInput(input);
                 if (!parsed.code) return null;
-                if (expectedState && parsed.state !== expectedState) return null; // reject missing OR mismatched state
+                // gjc parity: a bare pasted code WITHOUT a state is accepted (the provider
+                // may strip it); only an explicitly MISMATCHED state is rejected.
+                if (expectedState && parsed.state && parsed.state !== expectedState) return null;
                 return { code: parsed.code, state: parsed.state ?? "" } as CallbackResult;
               })
               .catch(() => null),

package/src/auth/flows/AGENTS.md

@@ -9,12 +9,13 @@ Specific OAuth flow implementations for various providers.
 ## Key Files
 | File | Description |
 |------|-------------|
-| `anthropic.ts` | Brief description of purpose |
-| `antigravity.ts` | Brief description of purpose |
-| `google-project.ts` | Brief description of purpose |
-| `google.ts` | Brief description of purpose |
-| `index.ts` | Brief description of purpose |
-| `openai.ts` | Brief description of purpose |
+| `anthropic.ts` | Anthropic (claude.ai) PKCE OAuth |
+| `antigravity.ts` | Google Antigravity OAuth (desktop-app client, dedicated project discovery) |
+| `google-project.ts` | Cloud Code Assist project discovery/onboarding shared by gemini + antigravity |
+| `google.ts` | Google Gemini CLI OAuth (authorization-code) |
+| `index.ts` | OAUTH_FLOW_REGISTRY wiring flows to providers |
+| `kimi.ts` | Kimi Code (Moonshot subscription) device-authorization OAuth — no callback server |
+| `openai.ts` | OpenAI Codex PKCE OAuth + device-code fallback when port 1455 is busy |
 
 ## Subdirectories
 *(None)*

package/src/auth/flows/antigravity.ts

@@ -56,6 +56,9 @@ export function discoverAntigravityProjectId(
   return discoverGoogleProjectId(accessToken, {
     metadata: { ...ANTIGRAVITY_DISCOVERY_METADATA },
     extraHeaders: { "User-Agent": getAntigravityUserAgent() },
+    // gjc antigravity parity: a reported tier without a project ONBOARDS the
+    // default/legacy tier instead of throwing the workspace-project hint.
+    alwaysOnboard: true,
     onProgress: opts.onProgress,
   });
 }

package/src/auth/flows/google-project.ts

@@ -56,6 +56,11 @@ export interface DiscoverProjectOptions {
   /** Per-request deadline; a stalled discovery fetch must NEVER hang the turn
    *  forever (round-5 #2 — this path runs BEFORE the manager's guarded call). */
   requestTimeoutMs?: number;
+  /** Antigravity semantics (gjc google-antigravity discoverProject): when the account
+   *  reports a tier but names no project, ONBOARD the default/legacy tier instead of
+   *  demanding an explicit workspace project. The gemini-cli flow keeps the strict
+   *  workspace hint (default false). */
+  alwaysOnboard?: boolean;
 }
 
 const DISCOVERY_REQUEST_TIMEOUT_MS = 30_000;
@@ -147,12 +152,13 @@ export async function discoverGoogleProjectId(
   if (data.currentTier) {
     const existing = readProjectId(data.cloudaicompanionProject) ?? envProjectId;
     if (existing) return existing;
-    throw new Error(WORKSPACE_PROJECT_HINT);
+    if (!opts.alwaysOnboard) throw new Error(WORKSPACE_PROJECT_HINT);
+    // alwaysOnboard: fall through and provision the default/legacy tier (gjc antigravity parity).
   }
 
   // Not onboarded yet: provision the default tier (free tier needs no project).
   const tierId = defaultTierId(data.allowedTiers) || TIER_FREE;
-  if (tierId !== TIER_FREE && tierId !== TIER_LEGACY && !envProjectId) {
+  if (!opts.alwaysOnboard && tierId !== TIER_FREE && tierId !== TIER_LEGACY && !envProjectId) {
     throw new Error(WORKSPACE_PROJECT_HINT);
   }
 

package/src/auth/flows/google.ts

@@ -9,8 +9,22 @@
  */
 import { OAuthCallbackFlow } from "../callback-server";
 import { discoverGoogleProjectId } from "./google-project";
+import { getGeminiCliHeaders } from "../../ai/providers/gemini";
 import type { OAuthController, OAuthCredentials } from "../types";
 
+/** Login-time Cloud Code Assist project discovery for a gemini-cli token. Sends the
+ *  gemini-cli identity headers (User-Agent + Client-Metadata) on loadCodeAssist/
+ *  onboardUser, matching gjc's google-gemini-cli discovery requests. */
+export function discoverGeminiProjectId(
+  accessToken: string,
+  opts: { onProgress?: (message: string) => void } = {},
+): Promise<string> {
+  return discoverGoogleProjectId(accessToken, {
+    extraHeaders: getGeminiCliHeaders(),
+    onProgress: opts.onProgress,
+  });
+}
+
 const decode = (s: string) => atob(s);
 const CLIENT_ID = decode(
   [
@@ -101,7 +115,7 @@ class GoogleOAuthFlow extends OAuthCallbackFlow {
       // gjc parity: auto-discover (or provision) the Cloud Code Assist project so
       // Antigravity models work straight after login — best-effort, never fails login.
       try {
-        projectId = await discoverGoogleProjectId(data.access_token);
+        projectId = await discoverGeminiProjectId(data.access_token);
       } catch {
         projectId = undefined;
       }

package/src/auth/flows/index.ts

@@ -5,6 +5,7 @@ import { loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import { loginOpenAI, refreshOpenAIToken } from "./openai";
 import { loginGoogle, refreshGoogleToken } from "./google";
 import { loginAntigravity, refreshAntigravityToken } from "./antigravity";
+import { loginKimi, refreshKimiToken } from "./kimi";
 
 export interface OAuthFlow {
   readonly provider: OAuthProvider;
@@ -52,9 +53,18 @@ export const OAUTH_FLOW_REGISTRY: Record<OAuthProvider, OAuthFlow> = {
     verifiedEndToEnd: true,
     note: "Antigravity desktop-app OAuth client; serves antigravity/* models (Gemini 3, Claude, GPT-OSS via Cloud Code Assist). The Google Cloud projectId is discovered automatically at login.",
   },
+  kimi: {
+    provider: "kimi",
+    label: "Kimi Code (Moonshot subscription)",
+    login: loginKimi,
+    refresh: refreshKimiToken,
+    verifiedEndToEnd: true,
+    note: "Device-code OAuth (auth.kimi.com); the token is served via the Anthropic-compatible endpoint at api.kimi.com/coding. A KIMI_API_KEY, when set and no OAuth is stored, uses the OpenAI-compatible api.moonshot.ai/v1.",
+  },
 };
 
 export { loginAnthropic, refreshAnthropicToken } from "./anthropic";
 export { loginOpenAI, refreshOpenAIToken } from "./openai";
 export { loginGoogle, refreshGoogleToken } from "./google";
 export { loginAntigravity, refreshAntigravityToken, discoverAntigravityProjectId, antigravityClientSecret } from "./antigravity";
+export { loginKimi, refreshKimiToken, getKimiCommonHeaders } from "./kimi";

package/src/auth/flows/kimi.ts

@@ -0,0 +1,263 @@
+/**
+ * Kimi Code (Moonshot subscription) OAuth — device authorization grant.
+ * Faithful port of gjc's packages/ai/src/utils/oauth/kimi.ts.
+ *
+ * No callback server: the user opens `verification_uri_complete` (or enters the
+ * user code at `verification_uri`) and jeo polls the token endpoint until the
+ * grant is approved. The minted access token is used as `Authorization: Bearer`
+ * against the Anthropic-compatible endpoint at https://api.kimi.com/coding.
+ */
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import pkg from "../../../package.json";
+import { jeoEnv } from "../../util/env";
+import type { OAuthController, OAuthCredentials } from "../types";
+
+const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+const DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+const DEVICE_ID_FILENAME = "kimi-device-id";
+const DEFAULT_POLL_INTERVAL_MS = 5000;
+const DEFAULT_DEVICE_FLOW_TTL_MS = 15 * 60 * 1000;
+const OAUTH_EXPIRY_SKEW_MS = 5 * 60 * 1000;
+
+interface DeviceAuthorizationResponse {
+  user_code?: string;
+  device_code?: string;
+  verification_uri?: string;
+  verification_uri_complete?: string;
+  expires_in?: number;
+  interval?: number;
+}
+
+interface TokenResponse {
+  access_token?: string;
+  refresh_token?: string;
+  expires_in?: number;
+  error?: string;
+  error_description?: string;
+  interval?: number;
+}
+
+/** gjc parity: raw (non-JEO_) env overrides for the OAuth host. */
+function resolveOAuthHost(): string {
+  return process.env.KIMI_CODE_OAUTH_HOST || process.env.KIMI_OAUTH_HOST || DEFAULT_OAUTH_HOST;
+}
+
+function formatDeviceModel(system: string, release: string, arch: string): string {
+  return [system, release, arch].filter(Boolean).join(" ").trim();
+}
+
+function getDeviceModel(): string {
+  const platform = os.platform();
+  const release = os.release();
+  const arch = os.arch();
+  if (platform === "darwin") return formatDeviceModel("macOS", release, arch);
+  if (platform === "win32") return formatDeviceModel("Windows", release, arch);
+  const label = platform === "linux" ? "Linux" : platform;
+  return formatDeviceModel(label, release, arch);
+}
+
+// Cached per config-dir path so a JEO_CONFIG_DIR change (tests) is honored.
+const deviceIdCache = new Map<string, string>();
+
+/** Stable per-machine device id, persisted like gjc's `<agent-dir>/kimi-device-id`. */
+function getDeviceId(): string {
+  const dir = jeoEnv("CONFIG_DIR") || path.join(os.homedir(), ".jeo");
+  const deviceIdPath = path.join(dir, DEVICE_ID_FILENAME);
+  const cached = deviceIdCache.get(deviceIdPath);
+  if (cached) return cached;
+  try {
+    const trimmed = fs.readFileSync(deviceIdPath, "utf-8").trim();
+    if (trimmed) {
+      deviceIdCache.set(deviceIdPath, trimmed);
+      return trimmed;
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException)?.code !== "ENOENT") throw error;
+  }
+  const deviceId = crypto.randomUUID().replace(/-/g, "");
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(deviceIdPath, `${deviceId}\n`, { mode: 0o600 });
+  deviceIdCache.set(deviceIdPath, deviceId);
+  return deviceId;
+}
+
+/** X-Msh-* device headers sent on every Kimi OAuth AND API request (gjc parity). */
+export function getKimiCommonHeaders(): Record<string, string> {
+  return {
+    "User-Agent": `KimiCLI/${pkg.version}`,
+    "X-Msh-Platform": "kimi_cli",
+    "X-Msh-Version": pkg.version,
+    "X-Msh-Device-Name": os.hostname(),
+    "X-Msh-Device-Model": getDeviceModel(),
+    "X-Msh-Os-Version": os.version(),
+    "X-Msh-Device-Id": getDeviceId(),
+  };
+}
+
+/** Abortable sleep; injectable in pollForToken for tests. */
+function wait(ms: number, signal?: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(new Error("Login cancelled"));
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new Error("Login cancelled"));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+export async function requestDeviceAuthorization(): Promise<{
+  userCode: string;
+  deviceCode: string;
+  verificationUri: string;
+  verificationUriComplete: string;
+  expiresInMs: number;
+  intervalMs: number;
+}> {
+  const response = await fetch(`${resolveOAuthHost()}/api/oauth/device_authorization`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      ...getKimiCommonHeaders(),
+    },
+    body: new URLSearchParams({ client_id: CLIENT_ID }),
+  });
+
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Kimi device authorization failed: ${response.status} ${text}`);
+  }
+
+  const payload = (await response.json()) as DeviceAuthorizationResponse;
+  const { user_code: userCode, device_code: deviceCode, verification_uri: verificationUri } = payload;
+  if (!userCode || !deviceCode || !verificationUri) {
+    throw new Error("Kimi device authorization response missing required fields");
+  }
+
+  const expiresInMs = typeof payload.expires_in === "number" ? payload.expires_in * 1000 : DEFAULT_DEVICE_FLOW_TTL_MS;
+  const intervalMs =
+    typeof payload.interval === "number" && payload.interval > 0 ? payload.interval * 1000 : DEFAULT_POLL_INTERVAL_MS;
+
+  return {
+    userCode,
+    deviceCode,
+    verificationUri,
+    verificationUriComplete: payload.verification_uri_complete || verificationUri,
+    expiresInMs,
+    intervalMs,
+  };
+}
+
+function parseTokenPayload(payload: TokenResponse, refreshTokenFallback?: string): OAuthCredentials {
+  if (!payload.access_token || typeof payload.expires_in !== "number") {
+    throw new Error("Kimi token response missing required fields");
+  }
+  const refresh = payload.refresh_token ?? refreshTokenFallback;
+  if (!refresh) {
+    throw new Error("Kimi token response missing refresh token");
+  }
+  return {
+    access: payload.access_token,
+    refresh,
+    expires: Date.now() + payload.expires_in * 1000 - OAUTH_EXPIRY_SKEW_MS,
+  };
+}
+
+/** Poll the token endpoint until the device grant is approved (RFC 8628 semantics). */
+export async function pollForToken(
+  deviceCode: string,
+  intervalMs: number,
+  expiresInMs: number,
+  signal?: AbortSignal,
+  sleep: (ms: number, signal?: AbortSignal) => Promise<void> = wait,
+): Promise<OAuthCredentials> {
+  const deadline = Date.now() + expiresInMs;
+  let waitMs = Math.max(1000, intervalMs);
+
+  while (Date.now() < deadline) {
+    if (signal?.aborted) throw new Error("Login cancelled");
+
+    const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        ...getKimiCommonHeaders(),
+      },
+      body: new URLSearchParams({
+        client_id: CLIENT_ID,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      }),
+    });
+
+    const payload = (await response.json()) as TokenResponse;
+    if (response.ok && payload.access_token) {
+      return parseTokenPayload(payload);
+    }
+
+    const error = payload.error;
+    if (error === "authorization_pending") {
+      await sleep(waitMs, signal);
+      continue;
+    }
+    if (error === "slow_down") {
+      waitMs += 5000;
+      const retryAfter = typeof payload.interval === "number" ? payload.interval * 1000 : undefined;
+      if (retryAfter && retryAfter > waitMs) waitMs = retryAfter;
+      await sleep(waitMs, signal);
+      continue;
+    }
+    if (error === "expired_token") {
+      throw new Error("Kimi device authorization expired");
+    }
+    if (error === "access_denied") {
+      throw new Error("Kimi device authorization denied");
+    }
+    const description = payload.error_description ? `: ${payload.error_description}` : "";
+    throw new Error(`Kimi device flow failed: ${error ?? response.status}${description}`);
+  }
+
+  throw new Error("Kimi device flow timed out");
+}
+
+/** Login with Kimi Code OAuth (device code flow — no local callback server). */
+export async function loginKimi(ctrl: OAuthController): Promise<OAuthCredentials> {
+  const device = await requestDeviceAuthorization();
+  ctrl.onAuth?.({
+    url: device.verificationUriComplete,
+    instructions: `Enter code: ${device.userCode}`,
+  });
+  return pollForToken(device.deviceCode, device.intervalMs, device.expiresInMs, ctrl.signal);
+}
+
+/** Refresh a Kimi OAuth access token. */
+export async function refreshKimiToken(refreshToken: string): Promise<OAuthCredentials> {
+  const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      ...getKimiCommonHeaders(),
+    },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: CLIENT_ID,
+    }),
+  });
+
+  if (!response.ok) {
+    const payload = (await response.json().catch(() => undefined)) as TokenResponse | undefined;
+    const description = payload?.error_description ? `: ${payload.error_description}` : "";
+    throw new Error(`Kimi token refresh failed: ${response.status}${description}`);
+  }
+
+  const payload = (await response.json()) as TokenResponse;
+  return parseTokenPayload(payload, refreshToken);
+}

package/src/auth/flows/openai.ts

@@ -7,7 +7,7 @@
  * which expects a platform API key. Use this flow with a Codex-compatible
  * endpoint, or prefer an `OPENAI_API_KEY` for the bundled chat adapter.
  */
-import { OAuthCallbackFlow } from "../callback-server";
+import { CallbackPortUnavailableError, OAuthCallbackFlow } from "../callback-server";
 import { generatePKCE } from "../pkce";
 import type { OAuthController, OAuthCredentials } from "../types";
 
@@ -20,6 +20,15 @@ const SCOPE = "openid profile email offline_access";
 const TIMEOUT_MS = 15_000;
 const JWT_AUTH_CLAIM = "https://api.openai.com/auth";
 const JWT_PROFILE_CLAIM = "https://api.openai.com/profile";
+// Device-code (headless) fallback endpoints — gjc openai-codex.ts DEVICE_* parity.
+const DEVICE_USERCODE_URL = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+const DEVICE_TOKEN_URL = "https://auth.openai.com/api/accounts/deviceauth/token";
+const DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+const DEVICE_AUTH_URL = "https://auth.openai.com/codex/device";
+const DEVICE_POLL_INTERVAL_MS = 5_000;
+const DEVICE_POLL_SAFETY_MARGIN_MS = 3_000;
+/** Upper bound on device-code polling to avoid infinite loops on server errors. */
+const DEVICE_MAX_POLLS = 120;
 
 function decodeJwt<T = Record<string, unknown>>(token: string): T | null {
   try {
@@ -60,6 +69,11 @@ async function exchangeCodeForToken(code: string, verifier: string, redirectUri:
     throw new Error("OpenAI token response missing required fields");
   }
   const { accountId, email } = profileFromToken(data.access_token);
+  if (!accountId) {
+    // gjc parity (openai-codex.ts:139-141): a Codex token without a chatgpt_account_id
+    // claim is unusable for the request path — fail the login instead of storing it.
+    throw new Error("Failed to extract accountId from token");
+  }
   return {
     access: data.access_token,
     refresh: data.refresh_token,
@@ -93,7 +107,9 @@ class OpenAIOAuthFlow extends OAuthCallbackFlow {
       state,
       id_token_add_organizations: "true",
       codex_cli_simplified_flow: "true",
-      originator: "jeo",
+      // "codex_cli_rs" for self-consistency with jeo's request path (openai-responses.ts
+      // sends the same originator header) — deliberate divergence from gjc's "opencode" default.
+      originator: "codex_cli_rs",
     });
     return { url: `${AUTHORIZE_URL}?${params.toString()}`, instructions: "Complete login in your browser." };
   }
@@ -104,7 +120,91 @@ class OpenAIOAuthFlow extends OAuthCallbackFlow {
 }
 
 export async function loginOpenAI(ctrl: OAuthController): Promise<OAuthCredentials> {
-  return new OpenAIOAuthFlow(ctrl).login();
+  try {
+    return await new OpenAIOAuthFlow(ctrl).login();
+  } catch (err) {
+    // OpenAI requires the FIXED redirect http://localhost:1455/auth/callback, so a busy
+    // port cannot fall back to a random one. Fall back to the device-code flow instead
+    // (gjc loginOpenAICodexDevice parity) — no local callback server needed.
+    if (err instanceof CallbackPortUnavailableError) {
+      ctrl.onProgress?.(`Port ${CALLBACK_PORT} is busy — falling back to device-code login.`);
+      return loginOpenAIDevice(ctrl);
+    }
+    throw err;
+  }
+}
+
+/**
+ * Login using OpenAI's device-code (headless) flow — no local callback server.
+ * Port of gjc's loginOpenAICodexDevice (openai-codex.ts): request a user code,
+ * surface it via the controller, poll for the authorization code (403/404 =
+ * authorization pending), then run the standard token exchange against the
+ * fixed device redirect URI.
+ */
+export async function loginOpenAIDevice(ctrl: OAuthController): Promise<OAuthCredentials> {
+  ctrl.onProgress?.("Initiating device authorization…");
+
+  const initResponse = await fetch(DEVICE_USERCODE_URL, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ client_id: CLIENT_ID }),
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+  });
+  if (!initResponse.ok) {
+    throw new Error(`Device authorization initiation failed: ${initResponse.status}`);
+  }
+  const initData = (await initResponse.json()) as {
+    device_auth_id?: string;
+    user_code?: string;
+    interval?: string | number;
+  };
+  if (!initData.device_auth_id || !initData.user_code) {
+    throw new Error("Device authorization response missing required fields");
+  }
+
+  const userCode = initData.user_code;
+  const pollIntervalMs =
+    (typeof initData.interval === "number"
+      ? initData.interval
+      : parseInt(String(initData.interval ?? "5"), 10) || 5) *
+      1000 +
+    DEVICE_POLL_SAFETY_MARGIN_MS;
+
+  ctrl.onAuth?.({ url: DEVICE_AUTH_URL, instructions: `Enter code: ${userCode}` });
+  ctrl.onProgress?.(`Waiting for browser authorization (code: ${userCode})…`);
+
+  for (let poll = 0; poll < DEVICE_MAX_POLLS; poll++) {
+    await Bun.sleep(poll === 0 ? Math.min(pollIntervalMs, DEVICE_POLL_INTERVAL_MS) : pollIntervalMs);
+    if (ctrl.signal?.aborted) {
+      throw new Error("Device authorization cancelled");
+    }
+
+    const pollResponse = await fetch(DEVICE_TOKEN_URL, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ device_auth_id: initData.device_auth_id, user_code: userCode }),
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+
+    // 403/404 = authorization pending, keep polling (gjc wire parity).
+    if (pollResponse.status === 403 || pollResponse.status === 404) continue;
+    if (!pollResponse.ok) {
+      throw new Error(`Device token polling failed: ${pollResponse.status}`);
+    }
+
+    const pollData = (await pollResponse.json()) as {
+      authorization_code?: string;
+      code_verifier?: string;
+    };
+    if (!pollData.authorization_code || !pollData.code_verifier) {
+      throw new Error("Device token response missing authorization_code or code_verifier");
+    }
+
+    ctrl.onProgress?.("Exchanging authorization code for tokens…");
+    return exchangeCodeForToken(pollData.authorization_code, pollData.code_verifier, DEVICE_REDIRECT_URI);
+  }
+
+  throw new Error("Device authorization timed out — user did not complete login in time");
 }
 
 export async function refreshOpenAIToken(refreshToken: string): Promise<OAuthCredentials> {

package/src/auth/oauth.ts

@@ -44,6 +44,15 @@ export const OAUTH_FLOWS: Record<OAuthProvider, OauthFlowDef> = {
       "Use this for antigravity/* models; Gemini CLI OAuth can be imported separately but may not satisfy Antigravity backend permissions.",
     ],
   },
+  kimi: {
+    label: "Kimi Code (Moonshot subscription)",
+    authorizeUrl: "https://auth.kimi.com",
+    instructions: [
+      "Device-code OAuth: no callback server. A browser tab opens at auth.kimi.com with the",
+      "verification URL; confirm the displayed user code there and jeo polls until approval.",
+      "Note: the minted token targets api.kimi.com/coding (Anthropic Messages format), not api.moonshot.ai.",
+    ],
+  },
 };
 
 export async function openInBrowser(url: string): Promise<void> {

package/src/auth/refresh.ts

@@ -37,6 +37,11 @@ export interface RefreshResult {
   credential: Credential;
 }
 
+/** Refresh-ahead window: a token expiring within this many ms is treated as stale
+ *  and refreshed NOW, so it never dies mid-request. gjc parity: auth-storage.ts
+ *  OAUTH_REFRESH_SKEW_MS = 60_000. */
+export const OAUTH_REFRESH_SKEW_MS = 60_000;
+
 /**
  * Exchange the stored refresh token for a fresh access token via the provider's
  * real OAuth token endpoint, persist it, and return the updated credential.
@@ -56,7 +61,7 @@ export async function refreshOAuthToken(provider: AuthProvider): Promise<Refresh
       return { refreshed: false, reason, credential: await resolveCredential(provider) };
     }
 
-    if (stored.expires && stored.expires > Date.now()) {
+    if (stored.expires && stored.expires > Date.now() + OAUTH_REFRESH_SKEW_MS) {
       return {
         refreshed: true,
         reason: "already_refreshed",

package/src/auth/storage.ts

@@ -6,16 +6,16 @@ import { jeoEnv } from "../util/env";
 
 
 /** Providers with an interactive OAuth login + refresh flow. */
-export type OAuthProvider = "anthropic" | "openai" | "gemini" | "antigravity";
+export type OAuthProvider = "anthropic" | "openai" | "gemini" | "antigravity" | "kimi";
 /** Every provider jeo resolves a credential for: OAuth-capable ∪ API-key-only. */
-export type AuthProvider = OAuthProvider | "xai" | "kimi" | "groq" | "deepseek" | "mistral" | "openrouter" | "together" | "cerebras" | "fireworks" | "nvidia" | "alibaba-coding-plan" | "huggingface" | "nanogpt" | "qwen-portal" | "synthetic" | "venice" | "zenmux" | "qianfan" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "minimax-code" | "minimax-code-cn" | "zai" | "minimax" | "tencent";
+export type AuthProvider = OAuthProvider | "xai" | "groq" | "deepseek" | "mistral" | "openrouter" | "together" | "cerebras" | "fireworks" | "nvidia" | "alibaba-coding-plan" | "huggingface" | "nanogpt" | "qwen-portal" | "synthetic" | "venice" | "zenmux" | "qianfan" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "minimax-code" | "minimax-code-cn" | "zai" | "minimax" | "tencent";
 
 
-export const OAUTH_PROVIDERS: readonly OAuthProvider[] = ["anthropic", "openai", "gemini", "antigravity"];
+export const OAUTH_PROVIDERS: readonly OAuthProvider[] = ["anthropic", "openai", "gemini", "antigravity", "kimi"];
 /** API-key-only providers (no OAuth flow) — resolved from config.providers / `<NAME>_API_KEY`. */
-export const API_KEY_ONLY_PROVIDERS: readonly AuthProvider[] = ["xai", "kimi", "groq", "deepseek", "mistral", "openrouter", "together", "cerebras", "fireworks", "nvidia", "alibaba-coding-plan", "huggingface", "nanogpt", "qwen-portal", "synthetic", "venice", "zenmux", "qianfan", "xiaomi", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "xiaomi-token-plan-sgp", "minimax-code", "minimax-code-cn", "zai", "minimax", "tencent"];
+export const API_KEY_ONLY_PROVIDERS: readonly AuthProvider[] = ["xai", "groq", "deepseek", "mistral", "openrouter", "together", "cerebras", "fireworks", "nvidia", "alibaba-coding-plan", "huggingface", "nanogpt", "qwen-portal", "synthetic", "venice", "zenmux", "qianfan", "xiaomi", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "xiaomi-token-plan-sgp", "minimax-code", "minimax-code-cn", "zai", "minimax", "tencent"];
 
-/** Narrow an AuthProvider to the OAuth-capable subset (xai/kimi have no OAuth flow). */
+/** Narrow an AuthProvider to the OAuth-capable subset (xai has no OAuth flow). */
 export function isOAuthProvider(p: AuthProvider): p is OAuthProvider {
   return (OAUTH_PROVIDERS as readonly string[]).includes(p);
 }