mixdog 1.1.0 → 1.1.1

package/src/runtime/agent/orchestrator/providers/mimo-oauth-profile.mjs

@@ -0,0 +1,218 @@
+// MiMo wire profile: the opt-in hooks the shared Chat Completions sender reads
+// from `config.chatProfile`, plus the model roster helpers and gateway error
+// shaping. Nothing here applies to any other provider.
+import { markProviderRecoveryExhausted } from './retry-classifier.mjs';
+import { scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import { PROVIDER_MAX_BEFORE_WARN_MS, STALL_ABORT_S, STALL_TICK_MS } from '../stall-policy.mjs';
+import { PACKAGE_VERSION } from '../../../web-search/lib/package-version.mjs';
+import { DEFAULT_MODEL } from './mimo-oauth-tokens.mjs';
+
+const MIMO_EFFORT_LEVELS = Object.freeze(['minimal', 'low', 'medium', 'high']);
+const MIMO_DEFAULT_TEMPERATURE = 1.0;
+const MIMO_DEFAULT_MAX_OUTPUT_TOKENS = 128_000;
+// Slow reasoning can stay silent for minutes: wait for the first byte as long
+// as the agent stall watchdog allows, and tolerate long gaps between events.
+export const MIMO_FIRST_BYTE_TIMEOUT_MS = Math.min(300_000, PROVIDER_MAX_BEFORE_WARN_MS);
+export const MIMO_SEMANTIC_IDLE_TIMEOUT_MS = Math.min(480_000, Math.max(10_000, STALL_ABORT_S * 1000 - STALL_TICK_MS));
+
+// Local roster used when /models fails or comes back empty.
+const SEED_CONTEXT = 1_048_576;
+const SEED_OUTPUT = 131_072;
+export const SEED_MODELS = Object.freeze(
+  [
+    ['mimo-v2.6-pro', 'MiMo-V2.6-Pro', SEED_CONTEXT],
+    ['mimo-v2.6-flash', 'MiMo-V2.6-Flash', SEED_CONTEXT],
+    ['mimo-v2.6-pro-ultraspeed', 'MiMo-V2.6-Pro-Ultraspeed', SEED_CONTEXT],
+    ['mimo-v2.5-pro', 'MiMo-V2.5-Pro', SEED_CONTEXT],
+    ['mimo-v2.5', 'MiMo-V2.5', SEED_CONTEXT],
+    ['mimo-v2-pro', 'MiMo-V2-Pro', SEED_CONTEXT],
+    ['mimo-v2-omni', 'MiMo-V2-Omni', 262_144],
+  ].map(([id, display_name, context_window]) =>
+    Object.freeze({ id, display_name, context_window, max_output_tokens: SEED_OUTPUT })
+  )
+);
+
+export function seedModelItems() {
+  return SEED_MODELS.map((item) => ({ ...item }));
+}
+
+// Speech/transcription ids cannot serve a text chat turn.
+export function isChatModelId(id) {
+  const text = String(id || '').toLowerCase();
+  return Boolean(text) && !text.includes('-tts') && !text.includes('-asr');
+}
+
+// Prefer the flagship only when this credential actually serves it; otherwise
+// the first chat model the roster lists, and the seed default for an empty one.
+export function chooseDefaultModel(ids) {
+  const chat = (ids || []).filter(isChatModelId);
+  if (chat.includes(DEFAULT_MODEL)) return DEFAULT_MODEL;
+  return chat[0] || DEFAULT_MODEL;
+}
+
+// Exact seed id, else the longest seed whose id is a lineage prefix of the
+// model (dated or suffixed variants of a seeded model).
+function seedRow(model) {
+  const id = String(model || '').toLowerCase();
+  let seed = SEED_MODELS.find((item) => item.id === id) || null;
+  if (!seed) {
+    for (const item of SEED_MODELS) {
+      if (id.startsWith(`${item.id}-`) && (!seed || item.id.length > seed.id.length)) seed = item;
+    }
+  }
+  if (!seed) return null;
+  return {
+    id: String(model),
+    contextWindow: seed.context_window,
+    outputTokens: seed.max_output_tokens,
+    reasoning: true,
+    vision: true,
+    inputModalities: ['text', 'image'],
+  };
+}
+
+// Fill the gaps a /models row leaves (names, limits, effort levels).
+export function decorateModelRows(rows, items) {
+  const display = new Map();
+  for (const item of items || []) {
+    if (typeof item?.id === 'string' && typeof item.display_name === 'string' && item.display_name.trim()) {
+      display.set(item.id, item.display_name.trim());
+    }
+  }
+  return rows.map((row) => {
+    const seed = seedRow(row.id);
+    return {
+      ...row,
+      name: display.get(row.id) || row.name,
+      contextWindow: row.contextWindow || seed?.contextWindow || 0,
+      outputTokens: row.outputTokens || seed?.outputTokens || null,
+      ...(seed && row.reasoning === undefined ? { reasoning: seed.reasoning } : {}),
+      ...(seed && row.vision === undefined ? { vision: seed.vision } : {}),
+      ...(seed && row.inputModalities === undefined ? { inputModalities: seed.inputModalities } : {}),
+      reasoningLevels: [...MIMO_EFFORT_LEVELS],
+      reasoningContentField: 'reasoning_content',
+    };
+  });
+}
+
+// Mixdog effort → MiMo `reasoning_effort`; the ladder's top edges fold to high.
+function mimoEffort(value) {
+  const effort = String(value ?? '')
+    .trim()
+    .toLowerCase();
+  if (MIMO_EFFORT_LEVELS.includes(effort)) return effort;
+  return ['xhigh', 'max', 'ultra'].includes(effort) ? 'high' : null;
+}
+
+function thinkingDisabled(thinking, effort) {
+  const mode = String(thinking?.type ?? thinking ?? '')
+    .trim()
+    .toLowerCase();
+  return thinking === false || mode === 'disabled' || mode === 'off' || mode === 'none' || effort === 'none';
+}
+
+function namedToolChoice(choice) {
+  if (!choice || typeof choice !== 'object') return null;
+  const name = choice.function?.name || choice.name;
+  return typeof name === 'string' && name ? name : null;
+}
+
+function applyMimoParams(params, { opts = {}, config = {}, modelInfo = null } = {}) {
+  const temperature = Number(opts.temperature);
+  params.temperature = Number.isFinite(temperature) && temperature >= 0 ? temperature : MIMO_DEFAULT_TEMPERATURE;
+
+  for (const [key, wire] of [
+    ['topP', 'top_p'],
+    ['topK', 'top_k'],
+  ]) {
+    const value = Number(opts[key] ?? config?.[key]);
+    if ((opts[key] ?? config?.[key]) != null && Number.isFinite(value) && value >= 0) params[wire] = value;
+  }
+
+  const limit = Number(modelInfo?.outputTokens);
+  const requested = params.max_tokens || MIMO_DEFAULT_MAX_OUTPUT_TOKENS;
+  params.max_tokens = Number.isFinite(limit) && limit > 0 ? Math.min(requested, limit) : requested;
+
+  const thinking = opts.thinking ?? config?.thinking;
+  const rawEffort = opts.effort ?? config?.reasoningEffort;
+  const effort = String(rawEffort ?? '')
+    .trim()
+    .toLowerCase();
+  if (thinkingDisabled(thinking, effort)) {
+    params.thinking = { type: 'disabled' };
+  } else if (thinking !== undefined || effort) {
+    params.thinking = { type: 'enabled' };
+    const level = mimoEffort(effort);
+    if (level) params.reasoning_effort = level;
+  }
+
+  if (params.tools?.length) {
+    if (opts.toolChoice === 'required') params.tool_choice = 'required';
+    else {
+      const name = namedToolChoice(opts.toolChoice);
+      if (name) params.tool_choice = { type: 'function', function: { name } };
+    }
+  }
+  return params;
+}
+
+// Session affinity and client identity, sent per request.
+export function mimoRequestHeaders(opts = {}) {
+  const headers = { 'User-Agent': `mimocode/${PACKAGE_VERSION}` };
+  if (opts.ephemeral === true) return headers;
+  const sessionId = String(opts.sessionId || opts.session?.id || '').trim();
+  if (sessionId) headers['x-session-affinity'] = sessionId;
+  const parentId = String(opts.parentSessionId || opts.session?.parentSessionId || '').trim();
+  if (sessionId && parentId) headers['x-parent-session-id'] = parentId;
+  return headers;
+}
+
+const FRIENDLY_GATEWAY_CODES = Object.freeze({
+  421: 'Request blocked by content moderation',
+  441: 'Request blocked by risk control',
+});
+
+// The gateway body is `{ error: { code, message, param } }`; the SDK exposes it
+// as err.error (already unwrapped) or leaves it wrapped for stream events.
+function gatewayError(err) {
+  const body = err?.error;
+  if (!body || typeof body !== 'object') return null;
+  return body.error && typeof body.error === 'object' ? body.error : body;
+}
+
+// Readable failure text: the friendly label for known block codes, otherwise
+// the gateway message, followed by `param` when it carries the real reason.
+export function mimoErrorDetail(err, secrets = []) {
+  const gw = gatewayError(err);
+  let text = '';
+  if (gw) {
+    const base = FRIENDLY_GATEWAY_CODES[String(gw.code)] || (typeof gw.message === 'string' ? gw.message : '');
+    if (base) text = typeof gw.param === 'string' && gw.param && gw.param !== base ? `${base}: ${gw.param}` : base;
+  }
+  return scrubOAuthSecrets(text || String(err?.message || err || ''), secrets).trim();
+}
+
+// Keep gateway detail on the error; a quota refusal can never succeed on replay.
+function refineMimoError(err) {
+  if (!err || typeof err !== 'object') return err;
+  const gw = gatewayError(err);
+  if (!gw) return err;
+  const detail = mimoErrorDetail(err);
+  if (detail && detail !== err.message) err.message = detail;
+  if (gw.code !== undefined && gw.code !== null) err.mimoGatewayCode = String(gw.code);
+  if (typeof gw.param === 'string' && gw.param) err.mimoGatewayParam = gw.param;
+  if (String(gw.code || gw.type || '').toLowerCase() === 'insufficient_quota') {
+    err.code = 'insufficient_quota';
+    markProviderRecoveryExhausted(err, { owner: 'mimo-oauth' });
+  }
+  return err;
+}
+
+export const MIMO_CHAT_PROFILE = Object.freeze({
+  replaysReasoningContent: true,
+  firstByteTimeoutMs: MIMO_FIRST_BYTE_TIMEOUT_MS,
+  semanticIdleTimeoutMs: MIMO_SEMANTIC_IDLE_TIMEOUT_MS,
+  resolveModelInfo: (provider, model) => provider.getCachedModelInfo(model) || seedRow(model),
+  applyParams: applyMimoParams,
+  refineError: refineMimoError,
+});

package/src/runtime/agent/orchestrator/providers/mimo-oauth-tokens.mjs

@@ -0,0 +1,239 @@
+// MiMo subscription credentials: a long-lived API key minted by the MiMo
+// platform authorize flow. There is no refresh grant — a 401 means the user
+// has to sign in again. Stored in Mixdog's own token file (mimo-oauth.json).
+import { randomBytes } from 'node:crypto';
+import { readFileSync, existsSync, mkdirSync, unlinkSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { getPluginData } from '../config.mjs';
+import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
+import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
+import { accountIdentityFields, fileMtimeMs, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+
+const DEFAULT_PLATFORM_ORIGIN = 'https://platform.xiaomimimo.com';
+const DEFAULT_BASE_URL = 'https://api.xiaomimimo.com/v1';
+export const DEFAULT_MODEL = 'mimo-v2.6-pro';
+export const SOURCE_HEADER = Object.freeze({ 'X-Mimo-Source': 'mimocode-cli' });
+export const LOGIN_TIMEOUT_MS = 5 * 60_000;
+const TOKEN_PLAN_KEY_PREFIX = 'tp-';
+// Probe order for a Token Plan key that arrives without a gateway URL.
+export const TOKEN_PLAN_BASE_URLS = Object.freeze(
+  ['sgp', 'ams', 'cn'].map((region) => `https://token-plan-${region}.xiaomimimo.com/v1`)
+);
+const TOKEN_PLAN_PROBE_TIMEOUT_MS = 15_000;
+const TOKEN_PLAN_PROBE_MODEL = 'mimo-v2.5';
+// The only hosts an API key may be sent to: the default gateway and the Token
+// Plan regional gateways. Derived from the constants above so they cannot drift.
+const MIMO_API_HOSTS = new Set([DEFAULT_BASE_URL, ...TOKEN_PLAN_BASE_URLS].map((url) => new URL(url).hostname));
+const MAX_BASE_URL_LENGTH = 2048;
+const SAFE_BASE_PATH = /^(?:\/[A-Za-z0-9._~-]+)*\/?$/;
+
+/**
+ * A gateway URL from the authorization payload, validated against the Xiaomi
+ * MiMo API host allowlist: HTTPS, no credentials, default port, no query or
+ * fragment. Returns it without a trailing slash; throws otherwise.
+ */
+export function normalizeMimoBaseUrl(value) {
+  const reject = () =>
+    new Error('[mimo-oauth] authorization payload carried a gateway URL outside the Xiaomi MiMo API hosts');
+  if (typeof value !== 'string' || value.length > MAX_BASE_URL_LENGTH) throw reject();
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw reject();
+  }
+  if (
+    url.protocol !== 'https:' ||
+    !MIMO_API_HOSTS.has(url.hostname) ||
+    url.username ||
+    url.password ||
+    url.port ||
+    url.search ||
+    url.hash ||
+    !SAFE_BASE_PATH.test(url.pathname)
+  ) {
+    throw reject();
+  }
+  return `${url.origin}${url.pathname.replace(/\/+$/, '')}`;
+}
+
+// Read per call so MIMO_PLATFORM_URL can point every login URL at another host.
+function platformOrigin() {
+  const override = String(process.env.MIMO_PLATFORM_URL || '')
+    .trim()
+    .replace(/\/+$/, '');
+  return override || DEFAULT_PLATFORM_ORIGIN;
+}
+export const authorizeEndpoint = () => `${platformOrigin()}/authorize`;
+export const manualRedirectUri = () => `${platformOrigin()}/authorize/code/callback`;
+export const resultUrl = () => `${platformOrigin()}/authorize/callback`;
+
+function dataDir() {
+  const dir = getPluginData();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+export function getOwnTokenPath() {
+  const bound = boundProviderAuthPath('mimo-oauth');
+  if (bound) return resolve(bound);
+  const explicit = process.env.MIMO_OAUTH_CREDENTIALS_PATH;
+  if (explicit) return resolve(explicit);
+  return join(dataDir(), 'mimo-oauth.json');
+}
+
+// Key name shown on the MiMo platform. Generated once, then reused so repeated
+// sign-ins replace one key instead of piling up new ones.
+export function getKeyName() {
+  const path = join(dataDir(), 'mimo-oauth-key-name.json');
+  try {
+    const saved = JSON.parse(readFileSync(path, 'utf-8'));
+    if (typeof saved?.keyName === 'string' && saved.keyName) return saved.keyName;
+  } catch {
+    /* generate below */
+  }
+  const keyName = `mimo-code-cli-key-${randomBytes(4).toString('hex')}`;
+  writeJsonAtomicSync(path, { keyName }, { lock: true, mode: 0o600 });
+  return keyName;
+}
+
+export function loadTokens() {
+  const path = getOwnTokenPath();
+  if (!existsSync(path)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(path, 'utf-8'));
+    if (!raw?.apiKey) return null;
+    return {
+      apiKey: String(raw.apiKey),
+      uid: raw.uid ? String(raw.uid) : '',
+      baseUrl: raw.baseUrl || DEFAULT_BASE_URL,
+      source: 'own',
+      mtimeMs: fileMtimeMs(path),
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function saveTokens({ apiKey, uid, baseUrl }) {
+  const tokens = { apiKey, uid: uid ? String(uid) : '', baseUrl: baseUrl || DEFAULT_BASE_URL };
+  writeJsonAtomicSync(getOwnTokenPath(), tokens, { lock: true, fsyncDir: true, mode: 0o600, secret: true });
+  return tokens;
+}
+
+// Find the regional gateway that accepts a Token Plan key. Each endpoint gets
+// its own fresh timeout so one slow region cannot starve the next; a 401 or a
+// failure of any kind moves on (only caller cancellation stops); the last error
+// is reported when every region fails.
+export async function probeTokenPlanBaseUrl(apiKey, { fetchImpl = fetch, signal = null } = {}) {
+  let lastError = null;
+  let allRejected = true;
+  for (const baseUrl of TOKEN_PLAN_BASE_URLS) {
+    signal?.throwIfAborted();
+    const timeout = AbortSignal.timeout(TOKEN_PLAN_PROBE_TIMEOUT_MS);
+    try {
+      const res = await fetchImpl(`${baseUrl}/chat/completions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}`, ...SOURCE_HEADER },
+        body: JSON.stringify({
+          model: TOKEN_PLAN_PROBE_MODEL,
+          max_tokens: 1,
+          messages: [{ role: 'user', content: 'ping' }],
+        }),
+        redirect: 'error',
+        signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
+      });
+      if (res.ok) return baseUrl;
+      const detail = scrubOAuthSecrets(await res.text().catch(() => ''), [apiKey])
+        .trim()
+        .slice(0, 300);
+      lastError = Object.assign(
+        new Error(`[mimo-oauth] Token Plan check failed (${res.status})${detail ? `: ${detail}` : ''}`),
+        { status: res.status, httpStatus: res.status, detail }
+      );
+      if (res.status !== 401) allRejected = false;
+    } catch (err) {
+      if (signal?.aborted) throw err;
+      allRejected = false;
+      lastError = err instanceof Error ? err : new Error(String(err));
+    }
+  }
+  if (lastError && allRejected) throw mimoReauthError(lastError.detail);
+  throw lastError || new Error('[mimo-oauth] Token Plan check failed');
+}
+
+// A rejected key needs a fresh sign-in; shared by the probe and the send path.
+export function mimoReauthError(detail = '') {
+  return Object.assign(
+    new Error(
+      `[mimo-oauth] API key rejected (401) — open /providers in mixdog to sign in again${detail ? `: ${detail}` : ''}`
+    ),
+    { httpStatus: 401, status: 401, reauthRequired: true }
+  );
+}
+
+// A Token Plan key whose gateway URL is unknown is resolved once and persisted.
+export async function ensureTokenPlanBaseUrl(tokens, options = {}) {
+  const needsProbe =
+    tokens.apiKey.startsWith(TOKEN_PLAN_KEY_PREFIX) && (!tokens.baseUrl || tokens.baseUrl === DEFAULT_BASE_URL);
+  if (!needsProbe) return tokens;
+  const { persist = true, ...probeOptions } = options;
+  const baseUrl = await probeTokenPlanBaseUrl(tokens.apiKey, probeOptions);
+  // The probe awaited the network; only write back if the stored credential is
+  // still the one that was probed (a newer sign-in must not be overwritten).
+  const current = persist ? loadTokens() : null;
+  if (current && current.apiKey === tokens.apiKey && current.uid === (tokens.uid || '')) {
+    saveTokens({ apiKey: tokens.apiKey, uid: tokens.uid, baseUrl });
+  }
+  return { ...tokens, baseUrl };
+}
+
+export function hasMimoOAuthCredentials() {
+  try {
+    return Boolean(loadTokens()?.apiKey);
+  } catch {
+    return false;
+  }
+}
+
+export function describeMimoOAuthCredentials() {
+  try {
+    const tokens = loadTokens();
+    if (!tokens) {
+      return {
+        authenticated: false,
+        usable: false,
+        refreshable: false,
+        reauthRequired: false,
+        status: 'Not Set',
+        detail: 'Mixdog token store',
+      };
+    }
+    return {
+      authenticated: true,
+      usable: true,
+      refreshable: false,
+      reauthRequired: false,
+      status: 'Valid',
+      detail: 'Mixdog token store; API key',
+      expiresAt: 0,
+      ...accountIdentityFields({ id: tokens.uid }),
+    };
+  } catch (err) {
+    return {
+      authenticated: false,
+      usable: false,
+      refreshable: false,
+      reauthRequired: false,
+      status: 'Error',
+      detail: String(err?.message || err).slice(0, 200),
+    };
+  }
+}
+
+export function forgetMimoOAuthCredentials() {
+  const path = getOwnTokenPath();
+  if (!existsSync(path)) return { removed: false };
+  unlinkSync(path);
+  return { removed: true };
+}

package/src/runtime/agent/orchestrator/providers/mimo-oauth.mjs

@@ -0,0 +1,233 @@
+/**
+ * Xiaomi MiMo subscription provider.
+ *
+ * Credentials are a platform-issued API key (mimo-oauth-tokens.mjs). Requests
+ * go through an inner OpenAI-compatible Chat Completions client pointed at the
+ * stored base URL. The key never expires and has no refresh grant: a 401 means
+ * the user must sign in again.
+ */
+import { noteErrorUsage } from './lib/note-error-usage.mjs';
+import { fileMtimeMs, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import { OpenAICompatProvider, preloadOpenAICompatRuntime } from './openai-compat.mjs';
+import { fetchCompatModelItems, listCompatModels } from './openai-compat-models.mjs';
+import {
+  SOURCE_HEADER,
+  ensureTokenPlanBaseUrl,
+  getOwnTokenPath,
+  loadTokens,
+  mimoReauthError,
+} from './mimo-oauth-tokens.mjs';
+import {
+  MIMO_CHAT_PROFILE,
+  chooseDefaultModel,
+  decorateModelRows,
+  isChatModelId,
+  mimoErrorDetail,
+  mimoRequestHeaders,
+  seedModelItems,
+} from './mimo-oauth-profile.mjs';
+
+const isUnauthorized = (err) => Number(err?.httpStatus || err?.status) === 401;
+
+// Strip the key from an error (message plus any echoed gateway body).
+function scrubErrorSecrets(err, apiKey) {
+  if (!err || typeof err !== 'object' || !apiKey) return err;
+  const seen = new Set();
+  const walk = (obj, depth) => {
+    if (!obj || typeof obj !== 'object' || seen.has(obj) || depth > 4) return;
+    seen.add(obj);
+    for (const k of Object.keys(obj)) {
+      const v = obj[k];
+      if (typeof v === 'string') {
+        if (v.includes(apiKey)) obj[k] = scrubOAuthSecrets(v, [apiKey]);
+      } else walk(v, depth + 1);
+    }
+  };
+  if (typeof err.message === 'string') err.message = scrubOAuthSecrets(err.message, [apiKey]);
+  walk(err.error, 0);
+  walk(err.body, 0);
+  return err;
+}
+
+// Redact where the transport first surfaces errors (request open and stream
+// iteration), so the shared retry reporter never logs the key.
+function redactClientErrors(client, apiKey) {
+  const completions = client?.chat?.completions;
+  if (!completions || !apiKey || completions.create?.mimoRedacting === apiKey) return;
+  const create = completions.create.bind(completions);
+  const wrapped = async (...args) => {
+    try {
+      const stream = await create(...args);
+      if (stream && typeof stream[Symbol.asyncIterator] === 'function') {
+        const iterate = stream[Symbol.asyncIterator].bind(stream);
+        stream[Symbol.asyncIterator] = () => {
+          const it = iterate();
+          return {
+            next: async (...a) => {
+              try {
+                return await it.next(...a);
+              } catch (err) {
+                throw scrubErrorSecrets(err, apiKey);
+              }
+            },
+            return: (...a) => it.return?.(...a),
+          };
+        };
+      }
+      return stream;
+    } catch (err) {
+      throw scrubErrorSecrets(err, apiKey);
+    }
+  };
+  wrapped.mimoRedacting = apiKey;
+  completions.create = wrapped;
+}
+
+export {
+  hasMimoOAuthCredentials,
+  describeMimoOAuthCredentials,
+  forgetMimoOAuthCredentials,
+} from './mimo-oauth-tokens.mjs';
+export { beginOAuthLogin, loginOAuth } from './mimo-oauth-login.mjs';
+
+export class MimoOAuthProvider {
+  // No document block on this wire: a PDF is lowered to text before the request is built.
+  nativePdf = false;
+  // OpenAI-compatible usage: prompt_tokens includes cached. See registry.mjs.
+  static inputExcludesCache = false;
+  name = 'mimo-oauth';
+  config;
+  tokens = null;
+  _inner = null;
+  _innerKey = null;
+  _rosterItems = [];
+  _defaultModelKey = null;
+  _defaultModel = null;
+
+  constructor(config) {
+    this.config = config || {};
+    this.tokens = loadTokens();
+    try {
+      preloadOpenAICompatRuntime();
+    } catch {
+      /* authoritative send surfaces load failures */
+    }
+  }
+
+  ensureAuth() {
+    // Re-read when the token file changed (sign-in from another process).
+    const mtime = fileMtimeMs(getOwnTokenPath());
+    if (!mtime) {
+      // File gone (signed out / forgotten): drop every cached credential.
+      this.tokens = null;
+      this._inner = null;
+      this._innerKey = null;
+    }
+    if (!this.tokens || mtime > (this.tokens.mtimeMs || 0)) this.tokens = loadTokens() || this.tokens;
+    if (!this.tokens?.apiKey) {
+      throw new Error('[mimo-oauth] credentials not found — open /providers in mixdog to sign in first');
+    }
+    return this.tokens;
+  }
+
+  _ensureInner() {
+    const { apiKey, baseUrl } = this.ensureAuth();
+    const key = `${baseUrl}:${apiKey}`;
+    if (this._inner && this._innerKey === key) return this._inner;
+    const inner = new OpenAICompatProvider('mimo-oauth', {
+      ...this.config,
+      apiKey,
+      baseURL: baseUrl,
+      chatProfile: MIMO_CHAT_PROFILE,
+      // Explicit nulls keep OPENAI_ORG_ID / OPENAI_PROJECT_ID out of the requests.
+      clientOptions: { organization: null, project: null },
+      extraHeaders: { ...SOURCE_HEADER, Accept: 'application/json' },
+    });
+    inner._fetchModelItems = (args) => this._fetchRoster(inner, args);
+    redactClientErrors(inner.client, apiKey);
+    this._inner = inner;
+    this._innerKey = key;
+    return inner;
+  }
+
+  // Chat models from /models; a failed or empty listing falls back to the local
+  // seed roster. Only a rejected key is surfaced.
+  async _fetchRoster(inner, args) {
+    let items = [];
+    try {
+      items = (await fetchCompatModelItems(inner, args)).filter((item) => isChatModelId(item?.id));
+    } catch (err) {
+      if (isUnauthorized(err)) throw err;
+    }
+    if (!items.length) items = seedModelItems();
+    this._rosterItems = items;
+    return items;
+  }
+
+  // Shared send/list error shaping, also applied to credential setup failures.
+  // A rejected key needs a fresh sign-in; the gateway's own detail stays attached.
+  _shapeError(err, apiKey) {
+    noteErrorUsage(err);
+    if (isUnauthorized(err) && !err?.reauthRequired) return mimoReauthError(mimoErrorDetail(err, [apiKey]));
+    return err;
+  }
+
+  async _readyInner(signal = null) {
+    this.tokens = await ensureTokenPlanBaseUrl(this.ensureAuth(), { fetchImpl: this.config.fetchImpl, signal });
+    return this._ensureInner();
+  }
+
+  // Configured model wins; otherwise pick from this credential's own roster.
+  async _pickDefaultModel(inner) {
+    if (this._defaultModel && this._defaultModelKey === this._innerKey) return this._defaultModel;
+    await this._listRows(inner);
+    this._defaultModel = chooseDefaultModel(this._enrichedIds(inner));
+    this._defaultModelKey = this._innerKey;
+    return this._defaultModel;
+  }
+
+  _enrichedIds(inner) {
+    return (inner._enrichedModels || []).map((row) => row.id);
+  }
+
+  async _listRows(inner) {
+    const rows = decorateModelRows(await listCompatModels(inner, { throwOnError: true }), this._rosterItems);
+    inner._enrichedModels = rows;
+    return rows;
+  }
+
+  async send(messages, model, tools, sendOpts) {
+    let inner;
+    try {
+      inner = await this._readyInner(sendOpts?.signal || null);
+    } catch (err) {
+      throw this._shapeError(err, this.tokens?.apiKey);
+    }
+    const apiKey = this.tokens.apiKey;
+    // This wire is Chat Completions only; a caller cannot move it to Responses.
+    const { compatWireApi: _wire, responsesTransport: _transport, ...rest } = sendOpts || {};
+    const opts = { ...rest, requestHeaders: { ...mimoRequestHeaders(rest), ...rest.requestHeaders } };
+    try {
+      const useModel = model || (await this._pickDefaultModel(inner));
+      // _doSend directly: the compat wrapper's 401 handler reloads a static
+      // config key, which does not apply to this credential.
+      return await inner._doSend(messages, useModel, tools, opts);
+    } catch (err) {
+      throw this._shapeError(err, apiKey);
+    }
+  }
+
+  async listModels() {
+    let inner;
+    try {
+      inner = await this._readyInner();
+      return await this._listRows(inner);
+    } catch (err) {
+      throw this._shapeError(err, this.tokens?.apiKey);
+    }
+  }
+
+  async isAvailable() {
+    return loadTokens() !== null;
+  }
+}