pi-provider-kimi-code 0.6.11 → 0.6.13

package/README.md

@@ -3,7 +3,9 @@
 [![npm](https://img.shields.io/npm/v/pi-provider-kimi-code)](https://www.npmjs.com/package/pi-provider-kimi-code)
 [![license](https://img.shields.io/npm/l/pi-provider-kimi-code)](./LICENSE)
 
-> **Kimi Code extension for Pi — use K3, K2.7 Code, and HighSpeed models with your Kimi Code Plan.** This extension brings the full Kimi Code surface into Pi: shared OAuth login state with the official `kimi-code` CLI, Kimi Files API uploads, and Kimi-native tools such as `moonshot_search`, `moonshot_fetch`, and `kimi_datasource`. (Pi v0.82.0+ ships a built-in `kimi-coding` provider for the LLM layer; this extension covers everything around it.)
+> **Kimi Code extension for Pi — use K3, K2.8 Code, and HighSpeed models with your Kimi Code Plan.**
+>
+> Why you need it: Pi v0.82.0+ ships a built-in `kimi-coding` provider for model discovery, reasoning controls, and OAuth login, but it does not provide this extension's Kimi Code integrations. Without this extension, Pi and the official `kimi-code` CLI log in separately (a login in one does not authenticate the other), large inline images blow up requests or fail because nothing uploads them through Kimi's Files API, Moonshot's server-side tools (`moonshot_search`, `moonshot_fetch`, `kimi_datasource`) are unavailable, Pi's tool schemas regularly exceed Moonshot's 15 KB per-tool limit and get rejected, and accounts on the wrong side of the mainland-cn / global split (kimi.com vs kimi.ai) fail with 401 because the built-in provider has no region switching. This extension closes those gaps — see [Why this exists](#why-this-exists) below for details.
 
 ## Why this exists
 
@@ -12,7 +14,8 @@ Use the built-in provider if you only want to chat with Kimi models. Install thi
 - **Share a session with the official `kimi-code` CLI.** Reuse an existing `kimi-code` login, or sync Pi's OAuth login back to `kimi-code` so both CLIs stay authenticated.
 - **Send files the Kimi way.** Large inline images go through Kimi's Files API and become `ms://` references instead of huge base64 payloads.
 - **Use Kimi-native tools.** `moonshot_search`, `moonshot_fetch`, and `kimi_datasource` are opt-in tools that call Moonshot's server-side services.
-- **Keep Pi's tools working.** Moonshot's API rejects tool schemas over 15 KB — a limit that Pi's extension ecosystem regularly hits ([#16](https://github.com/Leechael/pi-provider-kimi-code/issues/16), [#21](https://github.com/Leechael/pi-provider-kimi-code/issues/21)). This extension automatically deduplicates schemas with `$ref`/`$defs` before sending, so subagents and other extensions don't break.
+- **Meet Kimi's official schema requirements.** Moonshot's API rejects tool schemas over 15 KB — a limit that Pi's extension ecosystem regularly hits ([#16](https://github.com/Leechael/pi-provider-kimi-code/issues/16), [#21](https://github.com/Leechael/pi-provider-kimi-code/issues/21)). This extension adapts Pi's tool schemas to Kimi's requirements by automatically deduplicating them with `$ref`/`$defs` before sending, so subagents and other extensions don't break.
+- **Switch regions.** Kimi runs two managed sides (`mainland-cn` on kimi.com, `global` on kimi.ai). The extension carries the region selection through API endpoints, OAuth, and `/login`, so a kimi.ai account no longer dies with a 401 against the default `.com` endpoints.
 - **Embed in your own build.** The `KimiCode()` factory lets you ship Kimi Code support inside a custom Pi agent with programmatic config overrides — no file-based extension path needed.
 
 ## What this package adds
@@ -72,12 +75,25 @@ Pi's built-in `kimi-coding` provider already supports OAuth login via `/login`.
 - **Syncs refreshed tokens back to `kimi-code`.** Pi stores credentials at `~/.pi/agent/auth.json`; this extension keeps the official CLI's credential file (`~/.kimi-code/credentials/kimi-code.json`) up to date so both stay authenticated.
 - **Reuses existing `kimi-code` sessions.** If you already use the official CLI, the extension reads its session directly. Set `KIMI_CODE_HOME` if its home directory lives somewhere else.
 - **Supports the legacy `~/.kimi` path.** Read-only. Set `KIMI_SHARE_DIR` to override it.
+- **Follows your region.** Managed endpoints follow the selected region (`mainland-cn` default, `global` for kimi.ai accounts) for API, OAuth, and `/login`. See [Region selection](#region-selection).
 - **`KIMI_API_KEY` fallback.** For CI or key-based access:
 
 ```bash
 KIMI_API_KEY=sk-... pi
 ```
 
+### Region selection
+
+Kimi runs two managed sides: `api.kimi.com` / `auth.kimi.com` (mainland China, default) and `api.kimi.ai` / `auth.kimi.ai` (global). If your account lives on the kimi.ai side, a global OAuth session or API key against the default `.com` endpoints fails with 401.
+
+Precedence, lowest to highest:
+
+1. Built-in default (`mainland-cn`)
+2. `KIMI_CODE_REGION` env var (`mainland-cn` or `global`)
+3. `region` in merged home/project `config.json` (`"mainland-cn"` / `"global"` / `null` = auto; project overrides home); the **Region** row in `/kimi-settings` edits this config
+
+`KIMI_CODE_BASE_URL` / `KIMI_CODE_OAUTH_HOST` overrides always win, and unknown values fall back to `mainland-cn`. `/login kimi-coding` follows the selected region end to end. See [docs/ENV.md](docs/ENV.md) for details.
+
 ## Models (legacy provider registration)
 
 > **New users:** Use Pi's built-in `kimi-coding` provider for model discovery, reasoning controls, and OAuth login. This extension keeps its own model registration only for backward compatibility with existing sessions.
@@ -90,9 +106,9 @@ When this extension does register models, the official catalog determines what i
 | `kimi-coding/kimi-for-coding-highspeed` | Kimi for Coding High Speed | Official catalog |
 | `kimi-coding/k3`                        | Kimi K3                    | Official catalog |
 
-Kimi's official catalog at `https://api.kimi.com/coding/v1/models` is authoritative for model availability and context windows. When discovery is unavailable, the extension uses the fallback models and defaults below.
+Kimi's official catalog at `https://api.kimi.com/coding/v1/models` is authoritative for model availability and context windows. Since the K2.8 Preview rollout (2026-09-11), the `kimi-for-coding` ID is upgraded in place — same model ID, new engine, no config change needed. K2.8 advertises up to 1M tokens of context across all membership tiers; the catalog reports the exact window for your account.
 
-Fallback values:
+When discovery is unavailable, the extension uses the fallback models and defaults below (conservative pre-discovery values):
 
 - Context window: `256k` tokens
 - Max output: `32k` tokens
@@ -113,7 +129,7 @@ Inside Pi, run:
 /kimi-settings
 ```
 
-That command shows your signed-in account (via Kimi's `/me` endpoint), the current server-side model name (e.g. "K2.7 Code High Speed"), your Kimi quota and Extra Usage balance, and lets you edit the home or project config. Changes apply to the active session tool set.
+That command shows your signed-in account (via Kimi's `/me` endpoint), the current server-side model name (e.g. "K2.8 Code High Speed"), your Kimi quota and Extra Usage balance, the effective region, and lets you edit the home or project config. Changes apply to the active session tool set.
 
 Configurable settings include protocol mode, upload threshold, and per-tool enable/collapse.
 
@@ -137,6 +153,7 @@ Project config overrides home config with a deep merge. Missing files or missing
 ```json
 {
   "protocol": "openai",
+  "region": "global",
   "uploads": { "thresholdBytes": 1048576 },
   "tools": {
     "moonshot_search": { "enabled": true, "default_collapsed": true },
@@ -183,7 +200,8 @@ If you already use another search or fetch tool, pick one path for a session. Ov
 Most users do not need environment variables. Two are worth knowing:
 
 - `KIMI_API_KEY` — static API key for CI or key-based access.
-- `KIMI_CODE_PROTOCOL` — `openai` by default; set to `anthropic` for Anthropic-compatible requests.
+- `KIMI_CODE_PROTOCOL` — `openai` by default; set to `anthropic` for Anthropic-compatible requests, or `responses` for the OpenAI Responses API.
+- `KIMI_CODE_REGION` — `mainland-cn` (default) or `global`; selects the managed API/OAuth endpoints for kimi.com vs kimi.ai accounts.
 
 Tools, protocol, and upload threshold are all configurable through `/kimi-settings` or JSON config files.
 
@@ -219,7 +237,7 @@ The login flow always prints a verification URL. Copy it into a browser manually
 
 ### "Access denied" or subscription errors after a successful login
 
-Your Moonshot account needs an active Kimi Code Plan. If the same account works in `kimi-code`, re-run `/login kimi-coding` to refresh credentials.
+Your Moonshot account needs an active Kimi Code Plan. If the same account works in `kimi-code`, re-run `/login kimi-coding` to refresh credentials. A 401 right after login can also mean a region mismatch — accounts registered on the kimi.ai side must run with `KIMI_CODE_REGION=global` (or the matching `region` config / `/kimi-settings` row).
 
 ### Tools do not show up or return errors
 
@@ -227,7 +245,7 @@ Run `/kimi-settings` and check whether the tool is enabled in the home or projec
 
 ### Large images fail with a payload error
 
-This extension uploads images over `KIMI_CODE_UPLOAD_THRESHOLD_BYTES` (default 1 MB) to Kimi's Files API and references them as `ms://`. Set `KIMI_CODE_DEBUG=1` to see upload decisions in the provider logs.
+This extension uploads images over `KIMI_CODE_UPLOAD_THRESHOLD_BYTES` (default 1 MB) to Kimi's Files API and references them as `ms://`. Independently of that, a per-request inline media budget (~20 MB of base64 on the wire) drops oversized inline images and videos from the payload and leaves a media-kind-specific placeholder, such as `[image omitted: dropped to fit the request media budget]` or `[video omitted: dropped to fit the request media budget]`, so the model knows content was removed. Set `KIMI_CODE_DEBUG=1` to see upload and budget decisions in the provider logs.
 
 ### Prompt cache never seems to hit
 

package/index.ts

@@ -43,10 +43,14 @@ import {
 } from "./src/config.ts";
 import {
   KIMI_GLOBAL_FALLBACK_SOURCE_ID,
+  KIMI_WIRE_PROTOCOLS,
   PROVIDER_ID,
   PROVIDER_VERSION,
+  type KimiRegion,
+  applyKimiRegionEnvBridge,
   getBaseUrl,
   getKimiApiType,
+  setKimiRegionOverride,
 } from "./src/constants.ts";
 import {
   type KimiOAuthCredentials,
@@ -73,6 +77,7 @@ import {
   type KimiConfigScope,
   buildSettingsTheme,
   formatByteSize,
+  formatRegionValue,
   formatScopeDescription,
   parseByteSizeInput,
 } from "./src/settings-ui.ts";
@@ -138,6 +143,12 @@ function reloadEffectiveKimiRuntimeConfig(
   state.cwd = cwd;
   state.config = config;
   state.projectTrusted = projectTrusted;
+  // Push the effective region (project/home JSON wins over the env capture;
+  // env KIMI_CODE_REGION already sits in the merged config via the env layer)
+  // and re-bridge pi core's OAuth host so /login follows settings changes
+  // without a restart.
+  setKimiRegionOverride(config.region);
+  applyKimiRegionEnvBridge();
   setStoreResolvedKimiConfig({
     model: resolveKimiModelConfig(
       config.model,
@@ -236,6 +247,7 @@ async function openSettingsMenu(
         list.updateValue(toolName, formatToolMenuValue(toolName));
       }
       list.updateValue("protocol", drafts[scope].protocol);
+      list.updateValue("region", formatRegionValue(drafts[scope].region));
       list.updateValue("uploadThreshold", formatByteSize(drafts[scope].uploads.thresholdBytes));
     };
 
@@ -268,6 +280,12 @@ async function openSettingsMenu(
         save();
         return;
       }
+      if (id === "region") {
+        drafts[scope].region = newValue === "auto" ? null : (newValue as KimiRegion);
+        list.updateValue(id, newValue);
+        save();
+        return;
+      }
       if (id === "uploadThreshold") {
         const bytes = parseByteSizeInput(newValue);
         if (bytes === undefined || bytes <= 0) {
@@ -340,7 +358,14 @@ async function openSettingsMenu(
       label: "Protocol",
       description: "API protocol for Kimi requests",
       currentValue: drafts[scope].protocol,
-      values: ["openai", "anthropic"],
+      values: ["openai", "anthropic", "responses"],
+    });
+    items.push({
+      id: "region",
+      label: "Region",
+      description: "Managed deployment region (auto follows KIMI_CODE_REGION / default)",
+      currentValue: formatRegionValue(drafts[scope].region),
+      values: ["auto", "mainland-cn", "global"],
     });
     items.push({
       id: "uploadThreshold",
@@ -462,8 +487,8 @@ const MODULE_UNAVAILABLE_CODES = new Set([
 // model was resolved, so a session created before a protocol switch still
 // carries the other id and would keep crashing. streamSimpleKimi routes on the
 // model's wireProtocol / the resolved runtime config and never on model.api, so
-// both ids dispatch identically.
-const KIMI_FALLBACK_APIS = [getKimiApiType("openai"), getKimiApiType("anthropic")];
+// all three ids dispatch identically.
+const KIMI_FALLBACK_APIS = KIMI_WIRE_PROTOCOLS.map((protocol) => getKimiApiType(protocol));
 
 type PiAiApiRegistry = {
   registerApiProvider: (
@@ -653,6 +678,9 @@ function startModelDiscovery(pi: ExtensionAPI, state: KimiRuntimeState): void {
 
 export function KimiCode(overrides?: KimiCodeConfigPatch): ExtensionFactory {
   return async (pi: ExtensionAPI) => {
+    // Region handling (setKimiRegionOverride + the OAuth host bridge) happens
+    // in reloadEffectiveKimiRuntimeConfig, which runs just below and on every
+    // /kimi-settings save.
     const cwd = process.cwd();
     const config = loadKimiCodeConfig(
       { cwd, home: os.homedir(), includeProject: false },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-provider-kimi-code",
-  "version": "0.6.11",
-  "description": "Kimi Code models (K3, K2.7, HighSpeed) in Pi: OAuth shared login with kimi-code CLI, file uploads, and Kimi-native tools",
+  "version": "0.6.13",
+  "description": "Kimi Code models (K3, K2.8, HighSpeed) in Pi: OAuth shared login with kimi-code CLI, file uploads, and Kimi-native tools",
   "keywords": [
     "ai-provider",
     "coding-agent",
@@ -15,6 +15,7 @@
     "kimi-k2.5",
     "kimi-k2.6",
     "kimi-k2.7",
+    "kimi-k2.8",
     "kimi-k3",
     "llm",
     "llm-provider",
@@ -57,14 +58,14 @@
     "proper-lockfile": "^4.1.2"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.83.0",
-    "@earendil-works/pi-coding-agent": "^0.83.0",
-    "@earendil-works/pi-tui": "^0.83.0",
-    "@j178/prek": "^0.4.4",
+    "@earendil-works/pi-ai": "^0.99.2",
+    "@earendil-works/pi-coding-agent": "^0.99.2",
+    "@earendil-works/pi-tui": "^0.99.2",
+    "@j178/prek": "^0.5.2",
     "@types/node": "^24.0.0",
     "@types/proper-lockfile": "^4.1.4",
-    "oxfmt": "^0.44.0",
-    "oxlint": "^1.59.0",
+    "oxfmt": "^0.67.0",
+    "oxlint": "^1.82.0",
     "typescript": "^5.9.0"
   },
   "peerDependencies": {

package/src/config.ts

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
-import { PROVIDER_ID } from "./constants.ts";
+import { PROVIDER_ID, type KimiRegion, type KimiWireProtocol } from "./constants.ts";
 
 export const KIMI_TOOL_NAMES = ["moonshot_search", "moonshot_fetch", "kimi_datasource"] as const;
 
@@ -46,7 +46,14 @@ export interface KimiCodeConfig {
   model: ModelConfig;
   tools: Record<KimiToolName, { enabled: boolean; default_collapsed: boolean }>;
   uploads: { thresholdBytes: number };
-  protocol: "openai" | "anthropic";
+  protocol: KimiWireProtocol;
+  /**
+   * Managed region for the default endpoints. `null` means "not specified
+   * here" — the module-load `KIMI_CODE_REGION` env capture (or the
+   * mainland-cn default) then decides. An explicit value from project/home
+   * config wins over the env capture once pushed via setKimiRegionOverride.
+   */
+  region: KimiRegion | null;
 }
 
 export type KimiCodeConfigPatch = Partial<{
@@ -62,6 +69,7 @@ export type KimiCodeConfigPatch = Partial<{
   tools: Partial<Record<KimiToolName, Partial<{ enabled: unknown; default_collapsed: unknown }>>>;
   uploads: Partial<{ thresholdBytes: unknown }>;
   protocol: unknown;
+  region: unknown;
 }>;
 
 export interface KimiCodeConfigSources {
@@ -81,6 +89,7 @@ export interface KimiCodeConfigSources {
   tools: Record<KimiToolName, { enabled: KimiConfigSource; default_collapsed: KimiConfigSource }>;
   uploads: { thresholdBytes: KimiConfigSource };
   protocol: KimiConfigSource;
+  region: KimiConfigSource;
 }
 
 export interface LoadKimiCodeConfigOptions {
@@ -132,6 +141,7 @@ export const DEFAULT_KIMI_CODE_CONFIG: KimiCodeConfig = {
   tools: makeDefaultTools(),
   uploads: { thresholdBytes: 1048576 },
   protocol: "openai",
+  region: null,
 };
 
 let runtimeOverride: KimiCodeConfigPatch = {};
@@ -257,6 +267,12 @@ function envConfigPatch(env: NodeJS.ProcessEnv): KimiCodeConfigPatch {
   const protocol = env.KIMI_CODE_PROTOCOL?.trim();
   if (protocol) patch.protocol = protocol;
 
+  // KIMI_CODE_REGION intentionally does NOT enter the merged config: the env
+  // acts as a fallback below the config.json layers (documented precedence:
+  // explicit config > env > built-in default), and an invalid value must not
+  // crash startup via strict validation — currentKimiRegion() falls back to
+  // the module-load capture instead.
+
   const capabilities = env.KIMI_MODEL_CAPABILITIES;
   if (capabilities) {
     const caps = new Set(
@@ -315,8 +331,26 @@ function requireProtocol(
   configPath: string,
   pointer: string,
 ): KimiCodeConfig["protocol"] {
-  if (raw === "openai" || raw === "anthropic") return raw;
-  return fail(configPath, pointer, `expected "openai" | "anthropic", got ${JSON.stringify(raw)}`);
+  if (raw === "openai" || raw === "anthropic" || raw === "responses") return raw;
+  return fail(
+    configPath,
+    pointer,
+    `expected "openai" | "anthropic" | "responses", got ${JSON.stringify(raw)}`,
+  );
+}
+
+function requireRegionOrNull(
+  raw: unknown,
+  configPath: string,
+  pointer: string,
+): KimiCodeConfig["region"] {
+  if (raw === null) return null;
+  if (raw === "mainland-cn" || raw === "global") return raw;
+  return fail(
+    configPath,
+    pointer,
+    `expected "mainland-cn" | "global" | null, got ${JSON.stringify(raw)}`,
+  );
 }
 
 function requireInputArray(raw: unknown, configPath: string, pointer: string): KimiInputModality[] {
@@ -434,6 +468,7 @@ export function validateKimiCodeConfig(
       ),
     },
     protocol: requireProtocol(config.protocol, configPath, "/protocol"),
+    region: requireRegionOrNull(config.region, configPath, "/region"),
   };
 }
 
@@ -483,6 +518,7 @@ function buildSources(
     tools,
     uploads: { thresholdBytes: sourceForPath(layers, ["uploads", "thresholdBytes"]) },
     protocol: sourceForPath(layers, ["protocol"]),
+    region: sourceForPath(layers, ["region"]),
   };
 }
 

package/src/constants.ts

@@ -7,41 +7,133 @@ import os from "node:os";
 import { join } from "node:path";
 
 export const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
-export const DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
 
-export type KimiWireProtocol = "openai" | "anthropic";
+// Region profiles mirror upstream kimi-code's packages/oauth region.ts: a
+// region is a bundle of the managed API base origin and the OAuth host. The
+// region only picks the DEFAULT endpoints — explicit env overrides
+// (KIMI_CODE_BASE_URL / KIMI_CODE_OAUTH_HOST) always win. Global users with
+// kimi.ai credentials otherwise hit 401s against the hardcoded .com defaults
+// (issue #77).
+export type KimiRegion = "mainland-cn" | "global";
+
+export const KIMI_REGION_PROFILES: Record<KimiRegion, { apiBase: string; oauthHost: string }> = {
+  "mainland-cn": { apiBase: "https://api.kimi.com", oauthHost: "https://auth.kimi.com" },
+  global: { apiBase: "https://api.kimi.ai", oauthHost: "https://auth.kimi.ai" },
+};
+
+export function parseKimiRegion(value: string | undefined): KimiRegion {
+  if (value === "global" || value === "mainland-cn") return value;
+  return "mainland-cn";
+}
+
+export const ENV_KIMI_CODE_REGION: KimiRegion = parseKimiRegion(process.env.KIMI_CODE_REGION);
+
+// Effective region pushed from the plugin config (project/home JSON via
+// /kimi-settings), taking precedence over the module-load env capture so a
+// settings change applies without a restart. `null` means "config did not
+// specify" and falls back to ENV_KIMI_CODE_REGION.
+let resolvedRegionOverride: KimiRegion | null = null;
+
+export function setKimiRegionOverride(region: KimiRegion | null): void {
+  resolvedRegionOverride = region;
+}
+
+export function currentKimiRegion(): KimiRegion {
+  return resolvedRegionOverride ?? ENV_KIMI_CODE_REGION;
+}
+
+// Tracks a KIMI_CODE_OAUTH_HOST value injected by the bridge so a re-apply
+// (e.g. region switched back to mainland in /kimi-settings) can retract it
+// without clobbering a value the user configured in the meantime.
+let regionBridgeOwnedValue: string | undefined;
+
+// Bridge the selected region into pi core's built-in Kimi OAuth: pi-ai reads
+// KIMI_CODE_OAUTH_HOST at call time, so filling it makes /login follow the
+// configured region even when the login runs through pi's own kimi-coding
+// auth path instead of this extension's. Only fills the variable when the
+// region is non-default and the user has not configured an explicit override.
+export function applyKimiRegionEnvBridge(
+  env: NodeJS.ProcessEnv = process.env,
+  region: KimiRegion = currentKimiRegion(),
+): boolean {
+  if (regionBridgeOwnedValue !== undefined && env.KIMI_CODE_OAUTH_HOST === regionBridgeOwnedValue) {
+    delete env.KIMI_CODE_OAUTH_HOST;
+  }
+  regionBridgeOwnedValue = undefined;
+  // pi core's OAuth reads only KIMI_CODE_OAUTH_HOST; mirror the documented
+  // KIMI_OAUTH_HOST alias into it so the alias keeps working on the built-in
+  // login path. The alias stays the source of truth.
+  if (!env.KIMI_CODE_OAUTH_HOST && env.KIMI_OAUTH_HOST?.trim()) {
+    env.KIMI_CODE_OAUTH_HOST = env.KIMI_OAUTH_HOST.trim();
+    regionBridgeOwnedValue = env.KIMI_CODE_OAUTH_HOST;
+  }
+  if (region === "mainland-cn") return false;
+  if (env.KIMI_CODE_OAUTH_HOST || env.KIMI_OAUTH_HOST) return false;
+  env.KIMI_CODE_OAUTH_HOST = KIMI_REGION_PROFILES[region].oauthHost;
+  regionBridgeOwnedValue = env.KIMI_CODE_OAUTH_HOST;
+  return true;
+}
+
+/** Normalize any managed base URL to its `/v1` form. Single implementation
+ * shared by the tool endpoints (src/tools/common.ts), the usage/account URLs
+ * (src/usage.ts), and the credential probe (src/oauth.ts). */
+export function normalizeKimiBaseV1(baseUrl: string): string {
+  const base = baseUrl.replace(/\/+$/, "");
+  return base.endsWith("/v1") ? base : `${base}/v1`;
+}
+
+export const DEFAULT_OAUTH_HOST = KIMI_REGION_PROFILES[ENV_KIMI_CODE_REGION].oauthHost;
+
+export const KIMI_WIRE_PROTOCOLS = ["openai", "anthropic", "responses"] as const;
+export type KimiWireProtocol = (typeof KIMI_WIRE_PROTOCOLS)[number];
+export type KimiApiProtocol = "openai-completions" | "anthropic-messages" | "openai-responses";
+export type KimiApiType =
+  | "kimi-openai-completions"
+  | "kimi-anthropic-messages"
+  | "kimi-openai-responses";
+
+// KIMI_CODE_PROTOCOL supports openai (default), anthropic, and responses.
+// Unknown values fall back to openai, matching the previous two-protocol parser.
+export function parseKimiWireProtocol(value: string | undefined): KimiWireProtocol {
+  if (value === "anthropic" || value === "responses") return value;
+  return "openai";
+}
 
-// KIMI_CODE_PROTOCOL supports two values: "openai" (default) and "anthropic".
-export const ENV_KIMI_CODE_PROTOCOL: KimiWireProtocol =
-  process.env.KIMI_CODE_PROTOCOL === "anthropic" ? "anthropic" : "openai";
+export const ENV_KIMI_CODE_PROTOCOL: KimiWireProtocol = parseKimiWireProtocol(
+  process.env.KIMI_CODE_PROTOCOL,
+);
 
 export const IS_OPENAI_PROTOCOL = ENV_KIMI_CODE_PROTOCOL === "openai";
 
-export function getApiProtocol(
-  protocol: KimiWireProtocol,
-): "openai-completions" | "anthropic-messages" {
-  return protocol === "openai" ? "openai-completions" : "anthropic-messages";
+export function getApiProtocol(protocol: KimiWireProtocol): KimiApiProtocol {
+  if (protocol === "anthropic") return "anthropic-messages";
+  if (protocol === "responses") return "openai-responses";
+  return "openai-completions";
 }
 
 export const PROTOCOL = getApiProtocol(ENV_KIMI_CODE_PROTOCOL);
 
-export function getKimiApiType(
-  protocol: KimiWireProtocol,
-): "kimi-openai-completions" | "kimi-anthropic-messages" {
-  return protocol === "openai" ? "kimi-openai-completions" : "kimi-anthropic-messages";
+export function getKimiApiType(protocol: KimiWireProtocol): KimiApiType {
+  if (protocol === "anthropic") return "kimi-anthropic-messages";
+  if (protocol === "responses") return "kimi-openai-responses";
+  return "kimi-openai-completions";
 }
 
 // Use a custom api identifier so this provider never conflicts with the
-// built-in "anthropic-messages" or "openai-completions" stream handlers.
+// built-in anthropic-messages / openai-completions / openai-responses handlers.
 export const KIMI_API_TYPE = getKimiApiType(ENV_KIMI_CODE_PROTOCOL);
 
-export function getDefaultBaseUrl(protocol: KimiWireProtocol): string {
-  return protocol === "openai" ? "https://api.kimi.com/coding/v1" : "https://api.kimi.com/coding";
+export function getDefaultBaseUrl(
+  protocol: KimiWireProtocol,
+  region: KimiRegion = currentKimiRegion(),
+): string {
+  const apiBase = KIMI_REGION_PROFILES[region].apiBase;
+  return protocol === "anthropic" ? `${apiBase}/coding` : `${apiBase}/coding/v1`;
 }
 
 export const DEFAULT_BASE_URL = getDefaultBaseUrl(ENV_KIMI_CODE_PROTOCOL);
 
-export const PROVIDER_VERSION = "0.6.11";
+export const PROVIDER_VERSION = "0.6.13";
 
 export const KIMI_CODE_USER_AGENT = `pi-provider-kimi-code/${PROVIDER_VERSION}`;
 export const KIMI_PLATFORM = "pi";
@@ -64,9 +156,9 @@ export const PROVIDER_ID = "kimi-coding";
 export const KIMI_GLOBAL_FALLBACK_SOURCE_ID = "pi-provider-kimi-code-global-fallback";
 
 export function getOAuthHost(): string {
-  const value =
-    process.env.KIMI_CODE_OAUTH_HOST || process.env.KIMI_OAUTH_HOST || DEFAULT_OAUTH_HOST;
-  return value.trim() || DEFAULT_OAUTH_HOST;
+  const value = process.env.KIMI_CODE_OAUTH_HOST || process.env.KIMI_OAUTH_HOST;
+  if (value?.trim()) return value.trim();
+  return KIMI_REGION_PROFILES[currentKimiRegion()].oauthHost;
 }
 
 export function getBaseUrl(protocol: KimiWireProtocol = ENV_KIMI_CODE_PROTOCOL): string {

package/src/models.ts

@@ -99,6 +99,15 @@ function resolveModelCost(
 // per-request cap still wins (options.maxTokens ?? model.maxTokens). Reconcile
 // wherever contextWindow is authored so the two stay in lockstep.
 //
+// Wire note (upstream kimi-code #4091): the OpenAI wires now omit the
+// completion cap entirely unless one is explicitly configured —
+// applyKimiPayloadMutations drops the pi-ai-seeded cap when the model cap is
+// window-tracked, keeping it only for Anthropic /messages (which requires
+// max_tokens, where the window-clamped value matches upstream's
+// kimiUnsetCompletionTokens). The window-tracked maxTokens therefore feeds
+// pi-ai internals (thinking-budget math) and the Anthropic wire, not the
+// OpenAI payloads.
+//
 // "Explicitly configured" means any value other than the built-in default:
 // ensureKimiCodeConfig materializes the full default config (including
 // maxTokens) into the home config file, so config-source tracking cannot
@@ -186,6 +195,14 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// Server /v1/models uses "response"; kimi-code maps that to openai_responses.
+// Accept the server value plus the user-facing and internal aliases.
+function parseKimiCatalogProtocol(value: unknown): KimiWireProtocol | undefined {
+  if (value === "openai" || value === "anthropic" || value === "responses") return value;
+  if (value === "response" || value === "openai_responses") return "responses";
+  return undefined;
+}
+
 function parseThinkEfforts(value: unknown): {
   supportEfforts?: string[];
   defaultEffort?: string;
@@ -223,9 +240,8 @@ function parseKimiModelMetadata(model: KimiServerModel): KimiModelMetadata | und
   if (typeof model.supports_video_in === "boolean") {
     metadata.supportsVideoIn = model.supports_video_in;
   }
-  if (model.protocol === "openai" || model.protocol === "anthropic") {
-    metadata.protocol = model.protocol;
-  }
+  const protocol = parseKimiCatalogProtocol(model.protocol);
+  if (protocol) metadata.protocol = protocol;
   Object.assign(metadata, parseThinkEfforts(model.think_efforts));
   return metadata;
 }
@@ -239,10 +255,15 @@ function getModelsUrl(protocol?: KimiWireProtocol): string {
   return buildModelsUrl(getBaseUrl(protocol));
 }
 
+// Both official managed deployments serve /coding/v1/models; global (kimi.ai)
+// users get model discovery too, not just mainland (.com).
 export function isOfficialKimiModelsUrl(url: string): boolean {
   try {
     const parsed = new URL(url);
-    return parsed.origin === "https://api.kimi.com" && parsed.pathname === "/coding/v1/models";
+    return (
+      (parsed.origin === "https://api.kimi.com" || parsed.origin === "https://api.kimi.ai") &&
+      parsed.pathname === "/coding/v1/models"
+    );
   } catch {
     return false;
   }

package/src/oauth.ts

@@ -155,7 +155,14 @@ async function lockStoredOAuthCredential(
   };
 }
 
-import { CLIENT_ID, PROVIDER_ID, RETRYABLE_REFRESH_STATUSES, getOAuthHost } from "./constants.ts";
+import {
+  CLIENT_ID,
+  PROVIDER_ID,
+  RETRYABLE_REFRESH_STATUSES,
+  getBaseUrl,
+  getOAuthHost,
+  normalizeKimiBaseV1,
+} from "./constants.ts";
 import { getCommonHeaders } from "./device.ts";
 import { type KimiOAuthCredentials, discoverKimiModelMetadata } from "./models.ts";
 
@@ -435,6 +442,25 @@ async function lockKimiCodeCredentials(signal?: AbortSignal): Promise<LockedKimi
   };
 }
 
+// Tokens are region-bound, but the kimi-code CLI credential file does not
+// record which OAuth host minted them — so a fresh credential reused across
+// regions (a mainland CLI login while KIMI_CODE_REGION=global, or vice versa)
+// would 401 every request. Probe the current region's managed API before
+// reuse. Only an explicit 401 disproves usability: network failures must not
+// force an unnecessary re-login. Exported for tests.
+export async function isKimiCredentialRegionValid(accessToken: string): Promise<boolean> {
+  const meUrl = `${normalizeKimiBaseV1(getBaseUrl())}/me`;
+  try {
+    const response = await fetch(meUrl, {
+      headers: { ...getCommonHeaders(), Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(5_000),
+    });
+    return response.status !== 401;
+  } catch {
+    return true;
+  }
+}
+
 async function tryReuseKimiCliCredentials(
   callbacks: OAuthLoginCallbacks,
 ): Promise<KimiOAuthCredentials | null> {
@@ -449,6 +475,12 @@ async function tryReuseKimiCliCredentials(
   callbacks.onProgress?.("Found existing Kimi credentials, reusing them.");
 
   if (stillFresh) {
+    if (!(await isKimiCredentialRegionValid(data.access_token!))) {
+      callbacks.onProgress?.(
+        "Existing Kimi credentials are not valid for the configured region, starting a fresh login.",
+      );
+      return null;
+    }
     const extras = await discoverKimiModelMetadata(data.access_token!);
     return {
       access: data.access_token!,
@@ -461,6 +493,15 @@ async function tryReuseKimiCliCredentials(
   callbacks.onProgress?.("Kimi access token expired, refreshing.");
   try {
     const token = await refreshAccessToken(data.refresh_token!);
+    // Probe before persisting: a token that fails the region check must not
+    // be written into the shared CLI credential file, or a later CLI-side
+    // reuse (or the next /login) would pick up a token that 401s.
+    if (!(await isKimiCredentialRegionValid(token.access_token))) {
+      callbacks.onProgress?.(
+        "Refreshed Kimi credentials are not valid for the configured region, starting a fresh login.",
+      );
+      return null;
+    }
     const expiresMs = Date.now() + token.expires_in * 1000;
     writeKimiCodeCredentials(token.access_token, token.refresh_token, expiresMs);
     const extras = await discoverKimiModelMetadata(token.access_token);