jeopi-ai 16.2.13

package/src/registry/oauth/google-oauth-shared.ts

@@ -0,0 +1,125 @@
+/**
+ * Shared OAuth flow for Google-style providers (Gemini CLI, Antigravity).
+ *
+ * Both providers use the same authorization-code flow shape; only the client
+ * credentials, scopes, endpoint constants, and project-discovery logic differ.
+ */
+import * as AIError from "../../error";
+import { extractGoogleValidationUrl, formatGoogleValidationRequiredMessage } from "../../utils/google-validation";
+import { OAuthCallbackFlow } from "./callback-server";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+export interface GoogleOAuthFlowConfig {
+	clientId: string;
+	clientSecret: string;
+	authUrl: string;
+	tokenUrl: string;
+	scopes: string[];
+	callbackPort: number;
+	callbackPath: string;
+	discoverProject: (accessToken: string, onProgress?: (message: string) => void) => Promise<string>;
+}
+
+async function getUserEmail(accessToken: string): Promise<string | undefined> {
+	try {
+		const response = await fetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", {
+			headers: { Authorization: `Bearer ${accessToken}` },
+		});
+
+		if (response.ok) {
+			const data = (await response.json()) as { email?: string };
+			return data.email;
+		}
+	} catch {
+		// Ignore errors, email is optional
+	}
+	return undefined;
+}
+
+export class GoogleOAuthFlow extends OAuthCallbackFlow {
+	private readonly config: GoogleOAuthFlowConfig;
+
+	constructor(ctrl: OAuthController, config: GoogleOAuthFlowConfig) {
+		super(ctrl, {
+			preferredPort: config.callbackPort,
+			callbackPath: config.callbackPath,
+			callbackHostname: "127.0.0.1",
+		});
+		this.config = config;
+	}
+
+	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		const authParams = new URLSearchParams({
+			client_id: this.config.clientId,
+			response_type: "code",
+			redirect_uri: redirectUri,
+			scope: this.config.scopes.join(" "),
+			state,
+			access_type: "offline",
+			prompt: "consent",
+		});
+
+		const url = `${this.config.authUrl}?${authParams.toString()}`;
+		return { url, instructions: "Complete the sign-in in your browser." };
+	}
+
+	async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
+		this.ctrl.onProgress?.("Exchanging authorization code for tokens...");
+
+		const tokenResponse = await fetch(this.config.tokenUrl, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: this.config.clientId,
+				client_secret: this.config.clientSecret,
+				code,
+				grant_type: "authorization_code",
+				redirect_uri: redirectUri,
+			}),
+		});
+
+		if (!tokenResponse.ok) {
+			const error = await tokenResponse.text();
+			throw new AIError.OAuthError(`Token exchange failed: ${error}`, { kind: "token-exchange" });
+		}
+
+		const tokenData = (await tokenResponse.json()) as {
+			access_token: string;
+			refresh_token: string;
+			expires_in: number;
+		};
+
+		if (!tokenData.refresh_token) {
+			throw new AIError.OAuthError("No refresh token received. Please try again.", { kind: "validation" });
+		}
+
+		this.ctrl.onProgress?.("Getting user info...");
+		const email = await getUserEmail(tokenData.access_token);
+		let projectId: string;
+		try {
+			projectId = await this.config.discoverProject(tokenData.access_token, this.ctrl.onProgress);
+		} catch (err) {
+			const validationUrl = extractGoogleValidationUrl(err instanceof Error ? err.message : String(err));
+			if (!validationUrl) throw err;
+			throw new AIError.OAuthError(formatGoogleValidationRequiredMessage(validationUrl, "sign in again", email), {
+				kind: "validation",
+			});
+		}
+
+		return {
+			refresh: tokenData.refresh_token,
+			access: tokenData.access_token,
+			expires: Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000,
+			projectId,
+			email,
+		};
+	}
+}
+
+export async function runGoogleOAuthLogin(
+	ctrl: OAuthController,
+	config: GoogleOAuthFlowConfig,
+): Promise<OAuthCredentials> {
+	const flow = new GoogleOAuthFlow(ctrl, config);
+	return flow.login();
+}

package/src/registry/oauth/index.ts

@@ -0,0 +1,269 @@
+// ============================================================================
+// High-level API
+// ============================================================================
+
+import * as AIError from "../../error";
+import { getProviderDefinition, PROVIDER_REGISTRY } from "../registry";
+import type {
+	OAuthCredentials,
+	OAuthProvider,
+	OAuthProviderId,
+	OAuthProviderInfo,
+	OAuthProviderInterface,
+} from "./types";
+
+export type * from "./types";
+
+const DEVICE_FLOW_CANCEL_MESSAGE = "Login cancelled";
+const DEVICE_FLOW_TIMEOUT_MESSAGE = "Device flow timed out";
+const DEVICE_FLOW_SLOW_DOWN_TIMEOUT_MESSAGE =
+	"Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.";
+const MINIMUM_DEVICE_FLOW_INTERVAL_MS = 1000;
+const DEFAULT_DEVICE_FLOW_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_INTERVAL_INCREMENT_MS = 5000;
+
+/** Result returned by one OAuth device-code polling attempt. */
+export type OAuthDeviceCodePollResult<T> =
+	| { status: "complete"; value: T }
+	| { status: "pending" }
+	| { status: "slow_down" }
+	| { status: "failed"; message: string };
+
+/** Options for polling an RFC 8628-style OAuth device-code flow. */
+export interface OAuthDeviceCodeFlowOptions<T> {
+	/** Poll the provider once and classify the response. */
+	poll(): OAuthDeviceCodePollResult<T> | Promise<OAuthDeviceCodePollResult<T>>;
+	/** Provider-requested polling cadence; defaults to RFC 8628's five seconds. */
+	intervalSeconds?: number;
+	/** Provider-issued expiry window for the device code. */
+	expiresInSeconds?: number;
+	/** Cancels the flow with the legacy "Login cancelled" error. */
+	signal?: AbortSignal;
+}
+
+async function abortableDeviceFlowSleep(ms: number, signal: AbortSignal | undefined): Promise<void> {
+	if (!signal) {
+		await Bun.sleep(ms);
+		return;
+	}
+	if (signal.aborted) {
+		throw new AIError.LoginCancelledError(DEVICE_FLOW_CANCEL_MESSAGE);
+	}
+
+	const { promise, resolve, reject } = Promise.withResolvers<void>();
+	let timer: Timer | undefined;
+	const onAbort = () => {
+		if (timer) clearTimeout(timer);
+		reject(new AIError.LoginCancelledError(DEVICE_FLOW_CANCEL_MESSAGE));
+	};
+	timer = setTimeout(() => {
+		signal.removeEventListener("abort", onAbort);
+		resolve();
+	}, ms);
+	signal.addEventListener("abort", onAbort, { once: true });
+	await promise;
+}
+
+/** Poll an OAuth device-code flow until completion, provider failure, timeout, or cancellation. */
+export async function pollOAuthDeviceCodeFlow<T>(options: OAuthDeviceCodeFlowOptions<T>): Promise<T> {
+	const deadline =
+		typeof options.expiresInSeconds === "number"
+			? Date.now() + options.expiresInSeconds * 1000
+			: Number.POSITIVE_INFINITY;
+	let intervalMs = Math.max(
+		MINIMUM_DEVICE_FLOW_INTERVAL_MS,
+		Math.floor((options.intervalSeconds ?? DEFAULT_DEVICE_FLOW_INTERVAL_SECONDS) * 1000),
+	);
+	let slowDownResponses = 0;
+
+	while (Date.now() < deadline) {
+		if (options.signal?.aborted) {
+			throw new AIError.LoginCancelledError(DEVICE_FLOW_CANCEL_MESSAGE);
+		}
+		const result = await options.poll();
+		if (result.status === "complete") {
+			return result.value;
+		}
+		if (result.status === "failed") {
+			throw new AIError.OAuthError(result.message, { kind: "polling" });
+		}
+		if (result.status === "slow_down") {
+			slowDownResponses += 1;
+			intervalMs = Math.max(MINIMUM_DEVICE_FLOW_INTERVAL_MS, intervalMs + SLOW_DOWN_INTERVAL_INCREMENT_MS);
+		}
+
+		const remainingMs = deadline - Date.now();
+		if (remainingMs <= 0) {
+			break;
+		}
+		await abortableDeviceFlowSleep(Math.min(intervalMs, remainingMs), options.signal);
+	}
+
+	throw new AIError.OAuthError(
+		slowDownResponses > 0 ? DEVICE_FLOW_SLOW_DOWN_TIMEOUT_MESSAGE : DEVICE_FLOW_TIMEOUT_MESSAGE,
+		{ kind: "timeout" },
+	);
+}
+
+const builtInOAuthProviders: OAuthProviderInfo[] = PROVIDER_REGISTRY.filter(
+	provider => provider.login && provider.showInLoginList !== false,
+).map(provider => ({
+	id: provider.id,
+	name: provider.name,
+	available: provider.available ?? true,
+	storeCredentialsAs: provider.storeCredentialsAs,
+}));
+
+const customOAuthProviders = new Map<string, OAuthProviderInterface>();
+
+/**
+ * Register a custom OAuth provider.
+ */
+export function registerOAuthProvider(provider: OAuthProviderInterface): void {
+	customOAuthProviders.set(provider.id, provider);
+}
+
+/**
+ * Get a custom OAuth provider by ID.
+ */
+export function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined {
+	return customOAuthProviders.get(id);
+}
+
+/**
+ * Remove all custom OAuth providers registered by a source.
+ */
+export function unregisterOAuthProviders(sourceId: string): void {
+	for (const [id, provider] of customOAuthProviders.entries()) {
+		if (provider.sourceId === sourceId) {
+			customOAuthProviders.delete(id);
+		}
+	}
+}
+
+/**
+ * Refresh token for any OAuth provider.
+ * Saves the new credentials and returns the new access token.
+ */
+export async function refreshOAuthToken(
+	provider: OAuthProvider,
+	credentials: OAuthCredentials,
+): Promise<OAuthCredentials> {
+	if (!credentials) {
+		throw new AIError.OAuthError(`No OAuth credentials found for ${provider}`, {
+			kind: "validation",
+			provider,
+		});
+	}
+	const def = getProviderDefinition(provider);
+	if (!def?.login) {
+		throw new AIError.OAuthError(`Unknown OAuth provider: ${provider}`, {
+			kind: "validation",
+			provider,
+		});
+	}
+	// Providers without a real refresher (static bearer tokens / API keys that
+	// don't expire) return the credentials unchanged.
+	return def.refreshToken ? def.refreshToken(credentials) : credentials;
+}
+function getPerplexityJwtExpiryMs(token: string): number | undefined {
+	const parts = token.split(".");
+	if (parts.length !== 3) return undefined;
+	const payload = parts[1];
+	if (!payload) return undefined;
+	try {
+		const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as { exp?: unknown };
+		if (typeof decoded.exp !== "number" || !Number.isFinite(decoded.exp)) return undefined;
+		return decoded.exp * 1000 - 5 * 60_000;
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Build API-key bytes for a provider from an already-fresh OAuth credential.
+ *
+ * Refresh is owned by AuthStorage. This helper deliberately refuses expired
+ * credentials so it cannot POST broker redaction sentinels to upstream token
+ * endpoints as a side channel.
+ *
+ * For providers that need credential metadata at request time, returns
+ * JSON-encoded credentials plus expiry metadata for diagnostics/edge guards.
+ * @returns API key string, or null if no credentials
+ * @throws Error if the credential is expired and must be refreshed upstream
+ */
+export async function getOAuthApiKey(
+	provider: OAuthProvider,
+	credentials: Record<string, OAuthCredentials>,
+): Promise<{ newCredentials: OAuthCredentials; apiKey: string } | null> {
+	let creds = credentials[provider];
+	if (!creds) {
+		return null;
+	}
+
+	if (provider === "perplexity") {
+		// Perplexity JWTs usually omit `exp` (server-side sessions). Trust the JWT
+		// claim when present; otherwise treat the credential as non-expiring rather
+		// than honoring a stale stored `expires` (older logins wrote loginTime+1h).
+		const NEVER_EXPIRES = 8.64e15;
+		const normalizedExpires =
+			creds.expires > 0 && creds.expires < 10_000_000_000 ? creds.expires * 1000 : creds.expires;
+		const jwtExpiry = getPerplexityJwtExpiryMs(creds.access);
+		const expires = jwtExpiry ?? Math.max(normalizedExpires, NEVER_EXPIRES);
+		if (expires !== creds.expires) {
+			creds = { ...creds, expires };
+		}
+	}
+	// Refresh is the sole responsibility of `AuthStorage` (which calls
+	// `refreshOAuthToken` directly with broker-aware single-flighting). If we
+	// reach here with an expired credential, the outer pipeline failed to
+	// refresh before this call OR the refresh slot is the broker sentinel —
+	// either way, posting the credential to a provider endpoint would only
+	// trigger a `__remote__`-against-real-provider failure that gets classified
+	// as `invalid_grant` and disables the row. Refuse loudly instead.
+	if (Date.now() >= creds.expires) {
+		if (provider === "perplexity") {
+			const jwtExpiry = getPerplexityJwtExpiryMs(creds.access);
+			if (jwtExpiry && Date.now() < jwtExpiry) {
+				const fallbackCredentials = { ...creds, expires: jwtExpiry };
+				return { newCredentials: fallbackCredentials, apiKey: fallbackCredentials.access };
+			}
+		}
+		throw new AIError.OAuthError(
+			`OAuth credential for ${provider} is expired and must be refreshed via AuthStorage before getOAuthApiKey is called`,
+			{ kind: "validation", provider },
+		);
+	}
+	// For providers that need request-time credential metadata, return JSON.
+	const needsStructuredApiKey =
+		provider === "github-copilot" ||
+		provider === "google-gemini-cli" ||
+		provider === "google-antigravity" ||
+		provider === "alibaba-coding-plan";
+	const apiKey = needsStructuredApiKey
+		? JSON.stringify({
+				apiEndpoint: creds.apiEndpoint,
+				token: creds.access,
+				enterpriseUrl: creds.enterpriseUrl,
+				projectId: creds.projectId,
+				refreshToken: creds.refresh,
+				expiresAt: creds.expires,
+				email: creds.email,
+				accountId: creds.accountId,
+			})
+		: creds.access;
+	return { newCredentials: creds, apiKey };
+}
+
+/**
+ * Get list of OAuth providers.
+ */
+export function getOAuthProviders(): OAuthProviderInfo[] {
+	const customProviders = Array.from(customOAuthProviders.values(), provider => ({
+		id: provider.id,
+		name: provider.name,
+		available: true,
+		storeCredentialsAs: provider.storeCredentialsAs,
+	}));
+	return [...builtInOAuthProviders, ...customProviders];
+}

package/src/registry/oauth/kimi.ts

@@ -0,0 +1,289 @@
+/**
+ * Kimi Code OAuth flow (device authorization grant)
+ */
+
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { scheduler } from "node:timers/promises";
+import { $env, getAgentDir, isEnoent } from "jeopi-utils";
+import packageJson from "../../../package.json" with { type: "json" };
+import * as AIError from "../../error";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+const DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+const DEVICE_ID_FILENAME = "kimi-device-id";
+const DEFAULT_POLL_INTERVAL_MS = 5000;
+const DEFAULT_DEVICE_FLOW_TTL_MS = 15 * 60 * 1000;
+const OAUTH_EXPIRY_SKEW_MS = 5 * 60 * 1000;
+
+interface DeviceAuthorizationResponse {
+	user_code?: string;
+	device_code?: string;
+	verification_uri?: string;
+	verification_uri_complete?: string;
+	expires_in?: number;
+	interval?: number;
+}
+
+interface TokenResponse {
+	access_token?: string;
+	refresh_token?: string;
+	expires_in?: number;
+	scope?: string;
+	token_type?: string;
+	error?: string;
+	error_description?: string;
+	interval?: number;
+}
+
+function resolveOAuthHost(): string {
+	return $env.KIMI_CODE_OAUTH_HOST || $env.KIMI_OAUTH_HOST || DEFAULT_OAUTH_HOST;
+}
+
+function formatDeviceModel(system: string, release: string, arch: string): string {
+	return [system, release, arch].filter(Boolean).join(" ").trim();
+}
+
+function getDeviceModel(): string {
+	const platform = os.platform();
+	const release = os.release();
+	const arch = os.arch();
+	if (platform === "darwin") return formatDeviceModel("macOS", release, arch);
+	if (platform === "win32") return formatDeviceModel("Windows", release, arch);
+	const label = platform === "linux" ? "Linux" : platform;
+	return formatDeviceModel(label, release, arch);
+}
+
+let getDeviceId = (): string => {
+	const deviceIdPath = path.join(getAgentDir(), DEVICE_ID_FILENAME);
+	try {
+		const existing = fs.readFileSync(deviceIdPath, "utf-8");
+		const trimmed = existing.trim();
+		if (trimmed) {
+			getDeviceId = () => trimmed;
+			return trimmed;
+		}
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+
+	const deviceId = crypto.randomUUID().replace(/-/g, "");
+	fs.writeFileSync(deviceIdPath, `${deviceId}\n`, { mode: 0o600 });
+	getDeviceId = () => deviceId;
+	return deviceId;
+};
+
+function sanitizeHeaderValue(value: string, fallback = ""): string {
+	const sanitized = value.replace(/[^\x20-\x7E]/g, "").trim();
+	return sanitized || fallback;
+}
+
+export let getKimiCommonHeaders = () => {
+	const headers = Object.freeze({
+		"User-Agent": `KimiCLI/${packageJson.version}`,
+		"X-Msh-Platform": "kimi_cli",
+		"X-Msh-Version": packageJson.version,
+		"X-Msh-Device-Name": sanitizeHeaderValue(os.hostname(), "unknown"),
+		"X-Msh-Device-Model": sanitizeHeaderValue(getDeviceModel(), "unknown"),
+		"X-Msh-Os-Version": sanitizeHeaderValue(os.version(), "unknown"),
+		"X-Msh-Device-Id": sanitizeHeaderValue(getDeviceId(), "unknown"),
+	});
+	getKimiCommonHeaders = () => headers;
+	return headers;
+};
+
+async function requestDeviceAuthorization(): Promise<{
+	userCode: string;
+	deviceCode: string;
+	verificationUri: string;
+	verificationUriComplete: string;
+	expiresInMs: number;
+	intervalMs: number;
+}> {
+	const response = await fetch(`${resolveOAuthHost()}/api/oauth/device_authorization`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			...getKimiCommonHeaders(),
+		},
+		body: new URLSearchParams({ client_id: CLIENT_ID }),
+	});
+
+	if (!response.ok) {
+		const text = await response.text();
+		throw new AIError.OAuthError(`Kimi device authorization failed: ${response.status} ${text}`, {
+			kind: "device-auth",
+			provider: "kimi",
+			status: response.status,
+		});
+	}
+
+	const payload = (await response.json()) as DeviceAuthorizationResponse;
+	const userCode = payload.user_code;
+	const deviceCode = payload.device_code;
+	const verificationUri = payload.verification_uri;
+	const verificationUriComplete = payload.verification_uri_complete;
+
+	if (!userCode || !deviceCode || !verificationUri) {
+		throw new AIError.OAuthError("Kimi device authorization response missing required fields", {
+			kind: "validation",
+			provider: "kimi",
+		});
+	}
+
+	const expiresInMs = typeof payload.expires_in === "number" ? payload.expires_in * 1000 : DEFAULT_DEVICE_FLOW_TTL_MS;
+	const intervalMs =
+		typeof payload.interval === "number" && payload.interval > 0 ? payload.interval * 1000 : DEFAULT_POLL_INTERVAL_MS;
+
+	return {
+		userCode,
+		deviceCode,
+		verificationUri,
+		verificationUriComplete: verificationUriComplete || verificationUri,
+		expiresInMs,
+		intervalMs,
+	};
+}
+
+function parseTokenPayload(payload: TokenResponse, refreshTokenFallback?: string): OAuthCredentials {
+	if (!payload.access_token || typeof payload.expires_in !== "number") {
+		throw new AIError.OAuthError("Kimi token response missing required fields", {
+			kind: "validation",
+			provider: "kimi",
+		});
+	}
+
+	const refresh = payload.refresh_token ?? refreshTokenFallback;
+	if (!refresh) {
+		throw new AIError.OAuthError("Kimi token response missing refresh token", {
+			kind: "validation",
+			provider: "kimi",
+		});
+	}
+
+	return {
+		access: payload.access_token,
+		refresh,
+		expires: Date.now() + payload.expires_in * 1000 - OAUTH_EXPIRY_SKEW_MS,
+	};
+}
+
+async function pollForToken(
+	deviceCode: string,
+	intervalMs: number,
+	expiresInMs: number,
+	signal?: AbortSignal,
+): Promise<OAuthCredentials> {
+	const deadline = Date.now() + expiresInMs;
+	let waitMs = Math.max(1000, intervalMs);
+
+	while (Date.now() < deadline) {
+		if (signal?.aborted) {
+			throw new AIError.LoginCancelledError();
+		}
+
+		const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				...getKimiCommonHeaders(),
+			},
+			body: new URLSearchParams({
+				client_id: CLIENT_ID,
+				device_code: deviceCode,
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			}),
+		});
+
+		const payload = (await response.json()) as TokenResponse;
+		if (response.ok && payload.access_token) {
+			return parseTokenPayload(payload);
+		}
+
+		const error = payload.error;
+		if (error === "authorization_pending") {
+			await scheduler.wait(waitMs, { signal });
+			continue;
+		}
+
+		if (error === "slow_down") {
+			waitMs += 5000;
+			const retryAfter = typeof payload.interval === "number" ? payload.interval * 1000 : undefined;
+			if (retryAfter && retryAfter > waitMs) waitMs = retryAfter;
+			await scheduler.wait(waitMs, { signal });
+			continue;
+		}
+
+		if (error === "expired_token") {
+			throw new AIError.OAuthError("Kimi device authorization expired", {
+				kind: "validation",
+				provider: "kimi",
+			});
+		}
+
+		if (error === "access_denied") {
+			throw new AIError.OAuthError("Kimi device authorization denied", {
+				kind: "validation",
+				provider: "kimi",
+			});
+		}
+
+		const description = payload.error_description ? `: ${payload.error_description}` : "";
+		throw new AIError.OAuthError(`Kimi device flow failed: ${error ?? response.status}${description}`, {
+			kind: "polling",
+			provider: "kimi",
+		});
+	}
+
+	throw new AIError.OAuthError("Kimi device flow timed out", {
+		kind: "timeout",
+		provider: "kimi",
+	});
+}
+
+/**
+ * Login with Kimi Code OAuth (device code flow).
+ */
+export async function loginKimi(options: OAuthController): Promise<OAuthCredentials> {
+	const device = await requestDeviceAuthorization();
+	options.onAuth?.({
+		url: device.verificationUriComplete,
+		instructions: `Enter code: ${device.userCode}`,
+	});
+
+	return pollForToken(device.deviceCode, device.intervalMs, device.expiresInMs, options.signal);
+}
+
+/**
+ * Refresh Kimi OAuth token.
+ */
+export async function refreshKimiToken(refreshToken: string): Promise<OAuthCredentials> {
+	const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			...getKimiCommonHeaders(),
+		},
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: CLIENT_ID,
+		}),
+	});
+
+	if (!response.ok) {
+		const payload = (await response.json().catch(() => undefined)) as TokenResponse | undefined;
+		const description = payload?.error_description ? `: ${payload.error_description}` : "";
+		throw new AIError.OAuthError(`Kimi token refresh failed: ${response.status}${description}`, {
+			kind: "token-refresh",
+			provider: "kimi",
+			status: response.status,
+		});
+	}
+
+	const payload = (await response.json()) as TokenResponse;
+	return parseTokenPayload(payload, refreshToken);
+}