jeo-code 0.7.27 → 0.7.28

package/src/auth/flows/kimi.ts

@@ -0,0 +1,263 @@
+/**
+ * Kimi Code (Moonshot subscription) OAuth — device authorization grant.
+ * Faithful port of gjc's packages/ai/src/utils/oauth/kimi.ts.
+ *
+ * No callback server: the user opens `verification_uri_complete` (or enters the
+ * user code at `verification_uri`) and jeo polls the token endpoint until the
+ * grant is approved. The minted access token is used as `Authorization: Bearer`
+ * against the Anthropic-compatible endpoint at https://api.kimi.com/coding.
+ */
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import pkg from "../../../package.json";
+import { jeoEnv } from "../../util/env";
+import type { OAuthController, OAuthCredentials } from "../types";
+
+const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+const DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+const DEVICE_ID_FILENAME = "kimi-device-id";
+const DEFAULT_POLL_INTERVAL_MS = 5000;
+const DEFAULT_DEVICE_FLOW_TTL_MS = 15 * 60 * 1000;
+const OAUTH_EXPIRY_SKEW_MS = 5 * 60 * 1000;
+
+interface DeviceAuthorizationResponse {
+  user_code?: string;
+  device_code?: string;
+  verification_uri?: string;
+  verification_uri_complete?: string;
+  expires_in?: number;
+  interval?: number;
+}
+
+interface TokenResponse {
+  access_token?: string;
+  refresh_token?: string;
+  expires_in?: number;
+  error?: string;
+  error_description?: string;
+  interval?: number;
+}
+
+/** gjc parity: raw (non-JEO_) env overrides for the OAuth host. */
+function resolveOAuthHost(): string {
+  return process.env.KIMI_CODE_OAUTH_HOST || process.env.KIMI_OAUTH_HOST || DEFAULT_OAUTH_HOST;
+}
+
+function formatDeviceModel(system: string, release: string, arch: string): string {
+  return [system, release, arch].filter(Boolean).join(" ").trim();
+}
+
+function getDeviceModel(): string {
+  const platform = os.platform();
+  const release = os.release();
+  const arch = os.arch();
+  if (platform === "darwin") return formatDeviceModel("macOS", release, arch);
+  if (platform === "win32") return formatDeviceModel("Windows", release, arch);
+  const label = platform === "linux" ? "Linux" : platform;
+  return formatDeviceModel(label, release, arch);
+}
+
+// Cached per config-dir path so a JEO_CONFIG_DIR change (tests) is honored.
+const deviceIdCache = new Map<string, string>();
+
+/** Stable per-machine device id, persisted like gjc's `<agent-dir>/kimi-device-id`. */
+function getDeviceId(): string {
+  const dir = jeoEnv("CONFIG_DIR") || path.join(os.homedir(), ".jeo");
+  const deviceIdPath = path.join(dir, DEVICE_ID_FILENAME);
+  const cached = deviceIdCache.get(deviceIdPath);
+  if (cached) return cached;
+  try {
+    const trimmed = fs.readFileSync(deviceIdPath, "utf-8").trim();
+    if (trimmed) {
+      deviceIdCache.set(deviceIdPath, trimmed);
+      return trimmed;
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException)?.code !== "ENOENT") throw error;
+  }
+  const deviceId = crypto.randomUUID().replace(/-/g, "");
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(deviceIdPath, `${deviceId}\n`, { mode: 0o600 });
+  deviceIdCache.set(deviceIdPath, deviceId);
+  return deviceId;
+}
+
+/** X-Msh-* device headers sent on every Kimi OAuth AND API request (gjc parity). */
+export function getKimiCommonHeaders(): Record<string, string> {
+  return {
+    "User-Agent": `KimiCLI/${pkg.version}`,
+    "X-Msh-Platform": "kimi_cli",
+    "X-Msh-Version": pkg.version,
+    "X-Msh-Device-Name": os.hostname(),
+    "X-Msh-Device-Model": getDeviceModel(),
+    "X-Msh-Os-Version": os.version(),
+    "X-Msh-Device-Id": getDeviceId(),
+  };
+}
+
+/** Abortable sleep; injectable in pollForToken for tests. */
+function wait(ms: number, signal?: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(new Error("Login cancelled"));
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new Error("Login cancelled"));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+export async function requestDeviceAuthorization(): Promise<{
+  userCode: string;
+  deviceCode: string;
+  verificationUri: string;
+  verificationUriComplete: string;
+  expiresInMs: number;
+  intervalMs: number;
+}> {
+  const response = await fetch(`${resolveOAuthHost()}/api/oauth/device_authorization`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      ...getKimiCommonHeaders(),
+    },
+    body: new URLSearchParams({ client_id: CLIENT_ID }),
+  });
+
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Kimi device authorization failed: ${response.status} ${text}`);
+  }
+
+  const payload = (await response.json()) as DeviceAuthorizationResponse;
+  const { user_code: userCode, device_code: deviceCode, verification_uri: verificationUri } = payload;
+  if (!userCode || !deviceCode || !verificationUri) {
+    throw new Error("Kimi device authorization response missing required fields");
+  }
+
+  const expiresInMs = typeof payload.expires_in === "number" ? payload.expires_in * 1000 : DEFAULT_DEVICE_FLOW_TTL_MS;
+  const intervalMs =
+    typeof payload.interval === "number" && payload.interval > 0 ? payload.interval * 1000 : DEFAULT_POLL_INTERVAL_MS;
+
+  return {
+    userCode,
+    deviceCode,
+    verificationUri,
+    verificationUriComplete: payload.verification_uri_complete || verificationUri,
+    expiresInMs,
+    intervalMs,
+  };
+}
+
+function parseTokenPayload(payload: TokenResponse, refreshTokenFallback?: string): OAuthCredentials {
+  if (!payload.access_token || typeof payload.expires_in !== "number") {
+    throw new Error("Kimi token response missing required fields");
+  }
+  const refresh = payload.refresh_token ?? refreshTokenFallback;
+  if (!refresh) {
+    throw new Error("Kimi token response missing refresh token");
+  }
+  return {
+    access: payload.access_token,
+    refresh,
+    expires: Date.now() + payload.expires_in * 1000 - OAUTH_EXPIRY_SKEW_MS,
+  };
+}
+
+/** Poll the token endpoint until the device grant is approved (RFC 8628 semantics). */
+export async function pollForToken(
+  deviceCode: string,
+  intervalMs: number,
+  expiresInMs: number,
+  signal?: AbortSignal,
+  sleep: (ms: number, signal?: AbortSignal) => Promise<void> = wait,
+): Promise<OAuthCredentials> {
+  const deadline = Date.now() + expiresInMs;
+  let waitMs = Math.max(1000, intervalMs);
+
+  while (Date.now() < deadline) {
+    if (signal?.aborted) throw new Error("Login cancelled");
+
+    const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        ...getKimiCommonHeaders(),
+      },
+      body: new URLSearchParams({
+        client_id: CLIENT_ID,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      }),
+    });
+
+    const payload = (await response.json()) as TokenResponse;
+    if (response.ok && payload.access_token) {
+      return parseTokenPayload(payload);
+    }
+
+    const error = payload.error;
+    if (error === "authorization_pending") {
+      await sleep(waitMs, signal);
+      continue;
+    }
+    if (error === "slow_down") {
+      waitMs += 5000;
+      const retryAfter = typeof payload.interval === "number" ? payload.interval * 1000 : undefined;
+      if (retryAfter && retryAfter > waitMs) waitMs = retryAfter;
+      await sleep(waitMs, signal);
+      continue;
+    }
+    if (error === "expired_token") {
+      throw new Error("Kimi device authorization expired");
+    }
+    if (error === "access_denied") {
+      throw new Error("Kimi device authorization denied");
+    }
+    const description = payload.error_description ? `: ${payload.error_description}` : "";
+    throw new Error(`Kimi device flow failed: ${error ?? response.status}${description}`);
+  }
+
+  throw new Error("Kimi device flow timed out");
+}
+
+/** Login with Kimi Code OAuth (device code flow — no local callback server). */
+export async function loginKimi(ctrl: OAuthController): Promise<OAuthCredentials> {
+  const device = await requestDeviceAuthorization();
+  ctrl.onAuth?.({
+    url: device.verificationUriComplete,
+    instructions: `Enter code: ${device.userCode}`,
+  });
+  return pollForToken(device.deviceCode, device.intervalMs, device.expiresInMs, ctrl.signal);
+}
+
+/** Refresh a Kimi OAuth access token. */
+export async function refreshKimiToken(refreshToken: string): Promise<OAuthCredentials> {
+  const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      ...getKimiCommonHeaders(),
+    },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: CLIENT_ID,
+    }),
+  });
+
+  if (!response.ok) {
+    const payload = (await response.json().catch(() => undefined)) as TokenResponse | undefined;
+    const description = payload?.error_description ? `: ${payload.error_description}` : "";
+    throw new Error(`Kimi token refresh failed: ${response.status}${description}`);
+  }
+
+  const payload = (await response.json()) as TokenResponse;
+  return parseTokenPayload(payload, refreshToken);
+}

package/src/auth/flows/openai.ts

@@ -7,7 +7,7 @@
  * which expects a platform API key. Use this flow with a Codex-compatible
  * endpoint, or prefer an `OPENAI_API_KEY` for the bundled chat adapter.
  */
-import { OAuthCallbackFlow } from "../callback-server";
+import { CallbackPortUnavailableError, OAuthCallbackFlow } from "../callback-server";
 import { generatePKCE } from "../pkce";
 import type { OAuthController, OAuthCredentials } from "../types";
 
@@ -20,6 +20,15 @@ const SCOPE = "openid profile email offline_access";
 const TIMEOUT_MS = 15_000;
 const JWT_AUTH_CLAIM = "https://api.openai.com/auth";
 const JWT_PROFILE_CLAIM = "https://api.openai.com/profile";
+// Device-code (headless) fallback endpoints — gjc openai-codex.ts DEVICE_* parity.
+const DEVICE_USERCODE_URL = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+const DEVICE_TOKEN_URL = "https://auth.openai.com/api/accounts/deviceauth/token";
+const DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+const DEVICE_AUTH_URL = "https://auth.openai.com/codex/device";
+const DEVICE_POLL_INTERVAL_MS = 5_000;
+const DEVICE_POLL_SAFETY_MARGIN_MS = 3_000;
+/** Upper bound on device-code polling to avoid infinite loops on server errors. */
+const DEVICE_MAX_POLLS = 120;
 
 function decodeJwt<T = Record<string, unknown>>(token: string): T | null {
   try {
@@ -60,6 +69,11 @@ async function exchangeCodeForToken(code: string, verifier: string, redirectUri:
     throw new Error("OpenAI token response missing required fields");
   }
   const { accountId, email } = profileFromToken(data.access_token);
+  if (!accountId) {
+    // gjc parity (openai-codex.ts:139-141): a Codex token without a chatgpt_account_id
+    // claim is unusable for the request path — fail the login instead of storing it.
+    throw new Error("Failed to extract accountId from token");
+  }
   return {
     access: data.access_token,
     refresh: data.refresh_token,
@@ -93,7 +107,9 @@ class OpenAIOAuthFlow extends OAuthCallbackFlow {
       state,
       id_token_add_organizations: "true",
       codex_cli_simplified_flow: "true",
-      originator: "jeo",
+      // "codex_cli_rs" for self-consistency with jeo's request path (openai-responses.ts
+      // sends the same originator header) — deliberate divergence from gjc's "opencode" default.
+      originator: "codex_cli_rs",
     });
     return { url: `${AUTHORIZE_URL}?${params.toString()}`, instructions: "Complete login in your browser." };
   }
@@ -104,7 +120,91 @@ class OpenAIOAuthFlow extends OAuthCallbackFlow {
 }
 
 export async function loginOpenAI(ctrl: OAuthController): Promise<OAuthCredentials> {
-  return new OpenAIOAuthFlow(ctrl).login();
+  try {
+    return await new OpenAIOAuthFlow(ctrl).login();
+  } catch (err) {
+    // OpenAI requires the FIXED redirect http://localhost:1455/auth/callback, so a busy
+    // port cannot fall back to a random one. Fall back to the device-code flow instead
+    // (gjc loginOpenAICodexDevice parity) — no local callback server needed.
+    if (err instanceof CallbackPortUnavailableError) {
+      ctrl.onProgress?.(`Port ${CALLBACK_PORT} is busy — falling back to device-code login.`);
+      return loginOpenAIDevice(ctrl);
+    }
+    throw err;
+  }
+}
+
+/**
+ * Login using OpenAI's device-code (headless) flow — no local callback server.
+ * Port of gjc's loginOpenAICodexDevice (openai-codex.ts): request a user code,
+ * surface it via the controller, poll for the authorization code (403/404 =
+ * authorization pending), then run the standard token exchange against the
+ * fixed device redirect URI.
+ */
+export async function loginOpenAIDevice(ctrl: OAuthController): Promise<OAuthCredentials> {
+  ctrl.onProgress?.("Initiating device authorization…");
+
+  const initResponse = await fetch(DEVICE_USERCODE_URL, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ client_id: CLIENT_ID }),
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+  });
+  if (!initResponse.ok) {
+    throw new Error(`Device authorization initiation failed: ${initResponse.status}`);
+  }
+  const initData = (await initResponse.json()) as {
+    device_auth_id?: string;
+    user_code?: string;
+    interval?: string | number;
+  };
+  if (!initData.device_auth_id || !initData.user_code) {
+    throw new Error("Device authorization response missing required fields");
+  }
+
+  const userCode = initData.user_code;
+  const pollIntervalMs =
+    (typeof initData.interval === "number"
+      ? initData.interval
+      : parseInt(String(initData.interval ?? "5"), 10) || 5) *
+      1000 +
+    DEVICE_POLL_SAFETY_MARGIN_MS;
+
+  ctrl.onAuth?.({ url: DEVICE_AUTH_URL, instructions: `Enter code: ${userCode}` });
+  ctrl.onProgress?.(`Waiting for browser authorization (code: ${userCode})…`);
+
+  for (let poll = 0; poll < DEVICE_MAX_POLLS; poll++) {
+    await Bun.sleep(poll === 0 ? Math.min(pollIntervalMs, DEVICE_POLL_INTERVAL_MS) : pollIntervalMs);
+    if (ctrl.signal?.aborted) {
+      throw new Error("Device authorization cancelled");
+    }
+
+    const pollResponse = await fetch(DEVICE_TOKEN_URL, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ device_auth_id: initData.device_auth_id, user_code: userCode }),
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+
+    // 403/404 = authorization pending, keep polling (gjc wire parity).
+    if (pollResponse.status === 403 || pollResponse.status === 404) continue;
+    if (!pollResponse.ok) {
+      throw new Error(`Device token polling failed: ${pollResponse.status}`);
+    }
+
+    const pollData = (await pollResponse.json()) as {
+      authorization_code?: string;
+      code_verifier?: string;
+    };
+    if (!pollData.authorization_code || !pollData.code_verifier) {
+      throw new Error("Device token response missing authorization_code or code_verifier");
+    }
+
+    ctrl.onProgress?.("Exchanging authorization code for tokens…");
+    return exchangeCodeForToken(pollData.authorization_code, pollData.code_verifier, DEVICE_REDIRECT_URI);
+  }
+
+  throw new Error("Device authorization timed out — user did not complete login in time");
 }
 
 export async function refreshOpenAIToken(refreshToken: string): Promise<OAuthCredentials> {

package/src/auth/oauth.ts

@@ -44,6 +44,15 @@ export const OAUTH_FLOWS: Record<OAuthProvider, OauthFlowDef> = {
       "Use this for antigravity/* models; Gemini CLI OAuth can be imported separately but may not satisfy Antigravity backend permissions.",
     ],
   },
+  kimi: {
+    label: "Kimi Code (Moonshot subscription)",
+    authorizeUrl: "https://auth.kimi.com",
+    instructions: [
+      "Device-code OAuth: no callback server. A browser tab opens at auth.kimi.com with the",
+      "verification URL; confirm the displayed user code there and jeo polls until approval.",
+      "Note: the minted token targets api.kimi.com/coding (Anthropic Messages format), not api.moonshot.ai.",
+    ],
+  },
 };
 
 export async function openInBrowser(url: string): Promise<void> {

package/src/auth/refresh.ts

@@ -37,6 +37,11 @@ export interface RefreshResult {
   credential: Credential;
 }
 
+/** Refresh-ahead window: a token expiring within this many ms is treated as stale
+ *  and refreshed NOW, so it never dies mid-request. gjc parity: auth-storage.ts
+ *  OAUTH_REFRESH_SKEW_MS = 60_000. */
+export const OAUTH_REFRESH_SKEW_MS = 60_000;
+
 /**
  * Exchange the stored refresh token for a fresh access token via the provider's
  * real OAuth token endpoint, persist it, and return the updated credential.
@@ -56,7 +61,7 @@ export async function refreshOAuthToken(provider: AuthProvider): Promise<Refresh
       return { refreshed: false, reason, credential: await resolveCredential(provider) };
     }
 
-    if (stored.expires && stored.expires > Date.now()) {
+    if (stored.expires && stored.expires > Date.now() + OAUTH_REFRESH_SKEW_MS) {
       return {
         refreshed: true,
         reason: "already_refreshed",

package/src/auth/storage.ts

@@ -6,16 +6,16 @@ import { jeoEnv } from "../util/env";
 
 
 /** Providers with an interactive OAuth login + refresh flow. */
-export type OAuthProvider = "anthropic" | "openai" | "gemini" | "antigravity";
+export type OAuthProvider = "anthropic" | "openai" | "gemini" | "antigravity" | "kimi";
 /** Every provider jeo resolves a credential for: OAuth-capable ∪ API-key-only. */
-export type AuthProvider = OAuthProvider | "xai" | "kimi" | "groq" | "deepseek" | "mistral" | "openrouter" | "together" | "cerebras" | "fireworks" | "nvidia" | "alibaba-coding-plan" | "huggingface" | "nanogpt" | "qwen-portal" | "synthetic" | "venice" | "zenmux" | "qianfan" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "minimax-code" | "minimax-code-cn" | "zai" | "minimax" | "tencent";
+export type AuthProvider = OAuthProvider | "xai" | "groq" | "deepseek" | "mistral" | "openrouter" | "together" | "cerebras" | "fireworks" | "nvidia" | "alibaba-coding-plan" | "huggingface" | "nanogpt" | "qwen-portal" | "synthetic" | "venice" | "zenmux" | "qianfan" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "minimax-code" | "minimax-code-cn" | "zai" | "minimax" | "tencent";
 
 
-export const OAUTH_PROVIDERS: readonly OAuthProvider[] = ["anthropic", "openai", "gemini", "antigravity"];
+export const OAUTH_PROVIDERS: readonly OAuthProvider[] = ["anthropic", "openai", "gemini", "antigravity", "kimi"];
 /** API-key-only providers (no OAuth flow) — resolved from config.providers / `<NAME>_API_KEY`. */
-export const API_KEY_ONLY_PROVIDERS: readonly AuthProvider[] = ["xai", "kimi", "groq", "deepseek", "mistral", "openrouter", "together", "cerebras", "fireworks", "nvidia", "alibaba-coding-plan", "huggingface", "nanogpt", "qwen-portal", "synthetic", "venice", "zenmux", "qianfan", "xiaomi", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "xiaomi-token-plan-sgp", "minimax-code", "minimax-code-cn", "zai", "minimax", "tencent"];
+export const API_KEY_ONLY_PROVIDERS: readonly AuthProvider[] = ["xai", "groq", "deepseek", "mistral", "openrouter", "together", "cerebras", "fireworks", "nvidia", "alibaba-coding-plan", "huggingface", "nanogpt", "qwen-portal", "synthetic", "venice", "zenmux", "qianfan", "xiaomi", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "xiaomi-token-plan-sgp", "minimax-code", "minimax-code-cn", "zai", "minimax", "tencent"];
 
-/** Narrow an AuthProvider to the OAuth-capable subset (xai/kimi have no OAuth flow). */
+/** Narrow an AuthProvider to the OAuth-capable subset (xai has no OAuth flow). */
 export function isOAuthProvider(p: AuthProvider): p is OAuthProvider {
   return (OAUTH_PROVIDERS as readonly string[]).includes(p);
 }

package/src/commands/launch.ts

@@ -1027,6 +1027,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           maxTokens: resolveMaxOutputTokens(activeModel, sessionThinking),
           reasoningEffort: sessionThinking ? thinkingToReasoningEffort(sessionThinking) : undefined,
           signal: ac.signal,
+          sessionKey: sessionId,
           steer: drainSteer,
           events: wrapEvents(withStepPersistence({ ...withToolDetailCapture(tui ? tui.events() : streamEvents), onBeforeDone }, persistTurnTail), opik),
         });
@@ -1046,6 +1047,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             maxTokens: resolveMaxOutputTokens(activeModel, sessionThinking),
             reasoningEffort: sessionThinking ? thinkingToReasoningEffort(sessionThinking) : undefined,
             signal: ac.signal,
+            sessionKey: sessionId,
             steer: drainSteer,
             events: wrapEvents(withToolDetailCapture(tui ? tui.events() : streamEvents), opik),
           });
@@ -2693,7 +2695,8 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // TTY only — the caller prints scriptable guidance otherwise.
   const pickApiKeyProvider = async (statuses: Awaited<ReturnType<typeof describeAllProviders>>): Promise<AuthProvider | undefined> => {
     const subs = new Set<string>(SUBSCRIPTION_PROVIDER_NAMES); // surfaced under OAuth/subscription login instead
-    const keyed = new Set<string>(API_KEY_ONLY_PROVIDERS);
+    // kimi is dual-credential (moonshot API key OR Kimi Code OAuth) — keep it key-settable.
+    const keyed = new Set<string>([...API_KEY_ONLY_PROVIDERS, "kimi"]);
     const list = apiKeyPicker(statuses.filter(s => keyed.has(s.name) && !subs.has(s.name)), true);
     let chosen: ProviderName | undefined;
     await runSelectPicker(
@@ -3693,7 +3696,8 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         // `/provider key [name] [key]` → store an API key for an API-key-only provider
         // (groq/deepseek/mistral/…). Interactive: pick the provider, then paste the key.
         if (name === "key") {
-          const keyed = new Set<string>(API_KEY_ONLY_PROVIDERS);
+          // kimi is dual-credential (moonshot API key OR Kimi Code OAuth) — keep it key-settable.
+          const keyed = new Set<string>([...API_KEY_ONLY_PROVIDERS, "kimi"]);
           let target = tokens.slice(1).map(t => t.toLowerCase()).find(t => keyed.has(t)) as AuthProvider | undefined;
           // A trailing token after the provider name is treated as the key itself.
           const inlineKey = target ? tokens.slice(1).filter(t => t.toLowerCase() !== target).pop() : undefined;

package/src/commands/team.ts

@@ -437,6 +437,9 @@ async function executeTaskWithAgent(ctx: RalphSubagentPromptContext & { cwd: str
     cwd: ctx.cwd,
     model,
     maxSteps,
+    // Per-run prompt-cache key: each worker replays its own growing history every
+    // step, so a stable per-run key gets provider cache hits (gjc sub-session parity).
+    sessionKey: crypto.randomUUID(),
     // Bounded delegation: ralph/team subagents keep an exact step contract; the
     // orchestrator owns retries, so the gjc step-extension flow is disabled here.
     budget: { maxExtensions: 0 },