pi-provider-kimi-code 0.6.2 → 0.6.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-kimi-code",
-  "version": "0.6.2",
+  "version": "0.6.5",
   "description": "Use Kimi Code in Pi without losing the Kimi-specific bits",
   "keywords": [
     "ai-provider",
@@ -50,9 +50,9 @@
     "pre-commit": "prek run"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.78.0",
-    "@earendil-works/pi-coding-agent": "^0.78.0",
-    "@earendil-works/pi-tui": "^0.78.1",
+    "@earendil-works/pi-ai": "^0.79.10",
+    "@earendil-works/pi-coding-agent": "^0.79.10",
+    "@earendil-works/pi-tui": "^0.79.10",
     "@j178/prek": "^0.4.4",
     "@types/node": "^24.0.0",
     "oxfmt": "^0.44.0",

package/src/config.ts

@@ -9,6 +9,8 @@ export type KimiToolName = (typeof KIMI_TOOL_NAMES)[number];
 
 export type KimiConfigSource = "runtime" | "env" | "project" | "home" | "default";
 
+export const PI_CONFIG_DIR_NAME = ".pi";
+
 export type KimiInputModality = "text" | "image" | "video";
 
 export interface ModelReasoningEntry {
@@ -36,6 +38,8 @@ export interface ModelConfig {
 
 export interface KimiResolvedModelConfig extends ModelConfig {
   supportsThinkingType?: "only" | "no" | "both";
+  supportEfforts?: string[];
+  defaultEffort?: string;
 }
 
 export interface KimiCodeConfig {
@@ -83,6 +87,7 @@ export interface LoadKimiCodeConfigOptions {
   cwd: string;
   home: string;
   env?: NodeJS.ProcessEnv;
+  includeProject?: boolean;
 }
 
 export class ConfigError extends Error {
@@ -147,11 +152,11 @@ export function getRuntimeKimiCodeConfigOverride(): KimiCodeConfigPatch {
 }
 
 export function getGlobalKimiCodeConfigPath(home: string): string {
-  return join(home, ".pi", "providers", PROVIDER_ID, "config.json");
+  return join(home, PI_CONFIG_DIR_NAME, "providers", PROVIDER_ID, "config.json");
 }
 
 export function getProjectKimiCodeConfigPath(cwd: string): string {
-  return join(cwd, ".pi", "providers", PROVIDER_ID, "config.json");
+  return join(cwd, PI_CONFIG_DIR_NAME, "providers", PROVIDER_ID, "config.json");
 }
 
 export function kimiCodeConfigPath(home: string): string {
@@ -483,15 +488,23 @@ function buildSources(
 function loadLayers(
   options: LoadKimiCodeConfigOptions,
 ): Array<{ source: KimiConfigSource; config: Record<string, unknown> }> {
-  return [
+  const layers: Array<{ source: KimiConfigSource; config: Record<string, unknown> }> = [
     { source: "home", config: readConfigFile(getGlobalKimiCodeConfigPath(options.home)) },
-    { source: "project", config: readConfigFile(getProjectKimiCodeConfigPath(options.cwd)) },
+  ];
+  if (options.includeProject !== false) {
+    layers.push({
+      source: "project",
+      config: readConfigFile(getProjectKimiCodeConfigPath(options.cwd)),
+    });
+  }
+  layers.push(
     {
       source: "env",
       config: envConfigPatch(options.env ?? process.env) as Record<string, unknown>,
     },
     { source: "runtime", config: runtimeOverride as Record<string, unknown> },
-  ];
+  );
+  return layers;
 }
 
 export function loadKimiCodeConfig(

package/src/constants.ts

@@ -41,12 +41,12 @@ export function getDefaultBaseUrl(protocol: KimiWireProtocol): string {
 
 export const DEFAULT_BASE_URL = getDefaultBaseUrl(ENV_KIMI_CODE_PROTOCOL);
 
-export const PROVIDER_VERSION = "0.6.2";
+export const PROVIDER_VERSION = "0.6.5";
 
 // Upstream kimi-code CLI version — used in User-Agent and X-Msh-Version
 // headers to match the official client's identity. Update this when
 // syncing with https://github.com/anthropics/kimi-code.
-export const KIMI_UPSTREAM_VERSION = "0.18.0";
+export const KIMI_UPSTREAM_VERSION = "0.23.4";
 export const KIMI_CODE_USER_AGENT = `kimi-code-cli/${KIMI_UPSTREAM_VERSION}`;
 export const KIMI_PLATFORM = "kimi_code_cli";
 

package/src/device.ts

@@ -152,6 +152,22 @@ function getStableDeviceId(): string {
   return DEVICE_ID;
 }
 
+export function parseKimiCodeCustomHeaders(
+  env: NodeJS.ProcessEnv = process.env,
+): Record<string, string> {
+  const raw = env.KIMI_CODE_CUSTOM_HEADERS?.trim();
+  if (!raw) return {};
+  const headers: Record<string, string> = {};
+  for (const line of raw.split("\n")) {
+    const colon = line.indexOf(":");
+    if (colon < 0) continue;
+    const name = line.slice(0, colon).trim();
+    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) continue;
+    headers[name] = asciiHeaderValue(line.slice(colon + 1));
+  }
+  return headers;
+}
+
 export function getCommonHeaders(): Record<string, string> {
   const headers = {
     "User-Agent": KIMI_CODE_USER_AGENT,
@@ -166,3 +182,28 @@ export function getCommonHeaders(): Record<string, string> {
     Object.entries(headers).map(([key, value]) => [key, asciiHeaderValue(value)]),
   ) as Record<string, string>;
 }
+
+const RESERVED_PROVIDER_HEADERS = new Set([
+  "accept",
+  "anthropic-version",
+  "authorization",
+  "content-type",
+  "user-agent",
+  "x-api-key",
+]);
+
+function isReservedProviderHeader(name: string): boolean {
+  const normalized = name.toLowerCase();
+  return RESERVED_PROVIDER_HEADERS.has(normalized) || normalized.startsWith("x-msh-");
+}
+
+export function getKimiProviderHeaders(
+  env: NodeJS.ProcessEnv = process.env,
+): Record<string, string> {
+  const customHeaders = Object.fromEntries(
+    Object.entries(parseKimiCodeCustomHeaders(env)).filter(
+      ([name]) => !isReservedProviderHeader(name),
+    ),
+  );
+  return { ...customHeaders, ...getCommonHeaders() };
+}

package/src/models.ts

@@ -5,9 +5,9 @@ import type { Api, Model, OAuthCredentials } from "@earendil-works/pi-ai";
 import type { KimiInputModality, KimiResolvedModelConfig, ModelConfig } from "./config.ts";
 
 import { type KimiWireProtocol, getBaseUrl } from "./constants.ts";
-import { getCommonHeaders } from "./device.ts";
+import { getKimiProviderHeaders } from "./device.ts";
 
-export interface KimiOAuthExtras {
+export interface KimiModelMetadata {
   wireModelId?: string;
   modelDisplay?: string;
   contextLength?: number;
@@ -15,6 +15,13 @@ export interface KimiOAuthExtras {
   supportsImageIn?: boolean;
   supportsVideoIn?: boolean;
   supportsThinkingType?: "only" | "no" | "both";
+  protocol?: KimiWireProtocol;
+  supportEfforts?: string[];
+  defaultEffort?: string;
+}
+
+export interface KimiOAuthExtras extends KimiModelMetadata {
+  modelCatalog?: Record<string, KimiModelMetadata>;
 }
 
 export type KimiOAuthCredentials = OAuthCredentials & KimiOAuthExtras;
@@ -47,6 +54,9 @@ function mergeInputModalities(
 const COST_STANDARD = { input: 0.897, output: 3.724, cacheRead: 0.179, cacheWrite: 0.897 };
 const COST_HIGH_SPEED = { input: 1.793, output: 7.448, cacheRead: 0.359, cacheWrite: 1.793 };
 
+export const KIMI_CODING_MODEL_ID = "kimi-for-coding";
+export const KIMI_CODING_HIGHSPEED_MODEL_ID = "kimi-for-coding-highspeed";
+
 function resolveModelCost(modelDisplay: string | undefined): {
   input: number;
   output: number;
@@ -57,13 +67,17 @@ function resolveModelCost(modelDisplay: string | undefined): {
   return COST_STANDARD;
 }
 
-export function buildKimiModelFromConfig(config: ModelConfig): Model<Api> {
+export function buildKimiModelFromConfig(
+  config: ModelConfig,
+  modelId = KIMI_CODING_MODEL_ID,
+): Model<Api> {
+  const isHighSpeed = modelId === KIMI_CODING_HIGHSPEED_MODEL_ID;
   return {
-    id: "kimi-for-coding",
-    name: "Kimi for Coding",
+    id: modelId,
+    name: isHighSpeed ? "Kimi for Coding High Speed" : "Kimi for Coding",
     reasoning: config.reasoning,
     input: [...config.input] as unknown as ("text" | "image" | "video")[],
-    cost: { ...COST_STANDARD },
+    cost: { ...(isHighSpeed ? COST_HIGH_SPEED : COST_STANDARD) },
     contextWindow: config.contextWindow,
     maxTokens: config.maxTokens,
   } as Model<Api>;
@@ -86,6 +100,8 @@ export function resolveKimiModelConfig(
   if (typeof extras.supportsImageIn === "boolean" || typeof extras.supportsVideoIn === "boolean") {
     resolved.input = mergeInputModalities(resolved.input, extras);
   }
+  if (extras.supportEfforts) resolved.supportEfforts = [...extras.supportEfforts];
+  if (extras.defaultEffort) resolved.defaultEffort = extras.defaultEffort;
   return resolved;
 }
 
@@ -97,6 +113,8 @@ interface KimiServerModel {
   supports_image_in?: unknown;
   supports_video_in?: unknown;
   supports_thinking_type?: unknown;
+  protocol?: unknown;
+  think_efforts?: unknown;
 }
 
 function parseSupportsThinkingType(value: unknown): "only" | "no" | "both" | undefined {
@@ -104,6 +122,54 @@ function parseSupportsThinkingType(value: unknown): "only" | "no" | "both" | und
   return undefined;
 }
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function parseThinkEfforts(value: unknown): {
+  supportEfforts?: string[];
+  defaultEffort?: string;
+} {
+  if (!isRecord(value) || value.support !== true) return {};
+  const validEfforts = Array.isArray(value.valid_efforts)
+    ? value.valid_efforts.filter(
+        (effort): effort is string => typeof effort === "string" && !!effort,
+      )
+    : [];
+  return {
+    ...(validEfforts.length > 0 ? { supportEfforts: validEfforts } : {}),
+    ...(typeof value.default_effort === "string" && value.default_effort
+      ? { defaultEffort: value.default_effort }
+      : {}),
+  };
+}
+
+function parseKimiModelMetadata(model: KimiServerModel): KimiModelMetadata | undefined {
+  if (typeof model.id !== "string" || !model.id) return undefined;
+  const metadata: KimiModelMetadata = { wireModelId: model.id };
+  if (typeof model.display_name === "string") metadata.modelDisplay = model.display_name;
+  if (typeof model.context_length === "number" && model.context_length > 0) {
+    metadata.contextLength = model.context_length;
+  }
+  const thinkingType = parseSupportsThinkingType(model.supports_thinking_type);
+  if (thinkingType) {
+    metadata.supportsThinkingType = thinkingType;
+  } else if (typeof model.supports_reasoning === "boolean") {
+    metadata.supportsReasoning = model.supports_reasoning;
+  }
+  if (typeof model.supports_image_in === "boolean") {
+    metadata.supportsImageIn = model.supports_image_in;
+  }
+  if (typeof model.supports_video_in === "boolean") {
+    metadata.supportsVideoIn = model.supports_video_in;
+  }
+  if (model.protocol === "openai" || model.protocol === "anthropic") {
+    metadata.protocol = model.protocol;
+  }
+  Object.assign(metadata, parseThinkEfforts(model.think_efforts));
+  return metadata;
+}
+
 export function buildModelsUrl(baseUrl: string): string {
   const base = baseUrl.replace(/\/+$/, "");
   return base.endsWith("/v1") ? `${base}/models` : `${base}/v1/models`;
@@ -127,7 +193,7 @@ export async function discoverKimiModelMetadata(
     const response = await fetch(getModelsUrl(protocol), {
       signal: controller.signal,
       headers: {
-        ...getCommonHeaders(),
+        ...getKimiProviderHeaders(),
         Authorization: `Bearer ${accessToken}`,
         Accept: "application/json",
       },
@@ -135,26 +201,18 @@ export async function discoverKimiModelMetadata(
     if (!response.ok) return {};
     const json = (await response.json()) as { data?: unknown };
     const list = Array.isArray(json.data) ? (json.data as KimiServerModel[]) : [];
-    const preferred = list.find((m) => typeof m.id === "string" && m.id === "kimi-for-coding");
-    if (!preferred || typeof preferred.id !== "string") return {};
-    const extras: KimiOAuthExtras = { wireModelId: preferred.id };
-    if (typeof preferred.display_name === "string") extras.modelDisplay = preferred.display_name;
-    if (typeof preferred.context_length === "number" && preferred.context_length > 0) {
-      extras.contextLength = preferred.context_length;
-    }
-    const thinkingType = parseSupportsThinkingType(preferred.supports_thinking_type);
-    if (thinkingType) {
-      extras.supportsThinkingType = thinkingType;
-    } else if (typeof preferred.supports_reasoning === "boolean") {
-      extras.supportsReasoning = preferred.supports_reasoning;
-    }
-    if (typeof preferred.supports_image_in === "boolean") {
-      extras.supportsImageIn = preferred.supports_image_in;
+    const supportedIds = new Set([KIMI_CODING_MODEL_ID, KIMI_CODING_HIGHSPEED_MODEL_ID]);
+    const modelCatalog: Record<string, KimiModelMetadata> = {};
+    for (const model of list) {
+      if (typeof model.id !== "string" || !supportedIds.has(model.id)) continue;
+      const metadata = parseKimiModelMetadata(model);
+      if (metadata) modelCatalog[model.id] = metadata;
     }
-    if (typeof preferred.supports_video_in === "boolean") {
-      extras.supportsVideoIn = preferred.supports_video_in;
+    const preferred = modelCatalog[KIMI_CODING_MODEL_ID];
+    if (!preferred) {
+      return Object.keys(modelCatalog).length > 0 ? { modelCatalog } : {};
     }
-    return extras;
+    return { ...preferred, modelCatalog };
   } catch {
     return {};
   } finally {
@@ -162,12 +220,23 @@ export async function discoverKimiModelMetadata(
   }
 }
 
+export function getKimiModelMetadata(extras: KimiOAuthExtras, modelId: string): KimiModelMetadata {
+  const discovered = extras.modelCatalog?.[modelId];
+  if (discovered) return discovered;
+  return modelId === KIMI_CODING_MODEL_ID ? extras : {};
+}
+
 export function applyKimiOAuthExtrasToModel(
   model: Model<Api>,
-  extras: KimiOAuthExtras,
+  extras: KimiModelMetadata,
 ): Model<Api> {
-  const next: Model<Api> & { wireModelId?: string; supportsThinkingType?: "only" | "no" | "both" } =
-    { ...model };
+  const next: Model<Api> & {
+    wireModelId?: string;
+    supportsThinkingType?: "only" | "no" | "both";
+    wireProtocol?: KimiWireProtocol;
+    supportEfforts?: string[];
+    defaultEffort?: string;
+  } = { ...model };
   if (typeof extras.modelDisplay === "string" && extras.modelDisplay) {
     next.name = extras.modelDisplay;
     next.cost = resolveModelCost(extras.modelDisplay);
@@ -189,5 +258,8 @@ export function applyKimiOAuthExtrasToModel(
     const input = mergeInputModalities(next.input as KimiInputModality[], extras);
     (next as unknown as { input: string[] }).input = input;
   }
+  if (extras.protocol) next.wireProtocol = extras.protocol;
+  if (extras.supportEfforts) next.supportEfforts = [...extras.supportEfforts];
+  if (extras.defaultEffort) next.defaultEffort = extras.defaultEffort;
   return next;
 }

package/src/oauth.ts

@@ -2,9 +2,9 @@
 // reuse, the login / refresh handlers wired into pi's OAuth interface, and
 // the stream-level auth refresh used by the streaming handler.
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 import type { OAuthCredentials, OAuthLoginCallbacks } from "@earendil-works/pi-ai";
 import type { OAuthCredential } from "@earendil-works/pi-coding-agent";
@@ -123,6 +123,16 @@ interface RefreshAccessTokenOptions {
   sleep?: (ms: number) => Promise<void>;
 }
 
+export const KIMI_LOGIN_REQUIRED_MESSAGE =
+  "Kimi Code authorization is no longer valid. Sign in again with /login kimi-coding.";
+
+export class KimiLoginRequiredError extends Error {
+  constructor() {
+    super(KIMI_LOGIN_REQUIRED_MESSAGE);
+    this.name = "KimiLoginRequiredError";
+  }
+}
+
 function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -152,8 +162,15 @@ export async function refreshAccessToken(
 
       if (!response.ok) {
         const text = await response.text().catch(() => "");
-        if (response.status === 401 || response.status === 403) {
-          throw new Error(`Token refresh unauthorized: ${text}`);
+        let errorCode = "";
+        try {
+          const body = JSON.parse(text) as { error?: unknown };
+          if (typeof body.error === "string") errorCode = body.error;
+        } catch {
+          // Non-JSON OAuth errors are classified by status below.
+        }
+        if (response.status === 401 || response.status === 403 || errorCode === "invalid_grant") {
+          throw new KimiLoginRequiredError();
         }
         if (RETRYABLE_REFRESH_STATUSES.has(response.status)) {
           throw new Error(`Token refresh retryable: ${response.status} ${text}`);
@@ -170,7 +187,7 @@ export async function refreshAccessToken(
     } catch (error) {
       lastError = error;
       const message = error instanceof Error ? error.message : String(error);
-      if (message.startsWith("Token refresh unauthorized:")) throw error;
+      if (error instanceof KimiLoginRequiredError) throw error;
       if (message.startsWith("Token refresh failed:")) throw error;
       if (attempt < maxRetries - 1) {
         await wait(2 ** attempt * 1000);
@@ -196,15 +213,19 @@ interface KimiCliCredentialsFile {
   access_token?: string;
   refresh_token?: string;
   expires_at?: number; // Unix seconds (upstream convention)
+  scope?: string;
+  token_type?: string;
+  expires_in?: number;
 }
 
-function getKimiCredentialPaths(): string[] {
+function getKimiCodeCredentialPath(): string {
   const kimiCodeHome = process.env.KIMI_CODE_HOME || join(os.homedir(), ".kimi-code");
+  return join(kimiCodeHome, "credentials", "kimi-code.json");
+}
+
+function getKimiCredentialPaths(): string[] {
   const shareDir = process.env.KIMI_SHARE_DIR || join(os.homedir(), ".kimi");
-  return [
-    join(kimiCodeHome, "credentials", "kimi-code.json"),
-    join(shareDir, "credentials", "kimi-code.json"),
-  ];
+  return [getKimiCodeCredentialPath(), join(shareDir, "credentials", "kimi-code.json")];
 }
 
 function readKimiCliCredentials(): KimiCliCredentialsFile | null {
@@ -221,6 +242,25 @@ function readKimiCliCredentials(): KimiCliCredentialsFile | null {
   return null;
 }
 
+function kimiCodeCredentialExists(): boolean {
+  return existsSync(getKimiCodeCredentialPath());
+}
+
+function writeKimiCodeCredentials(access: string, refresh: string, expiresMs: number): void {
+  const path = getKimiCodeCredentialPath();
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true });
+  const data: KimiCliCredentialsFile = {
+    access_token: access,
+    refresh_token: refresh,
+    expires_at: Math.floor(expiresMs / 1000),
+    scope: "",
+    token_type: "Bearer",
+    expires_in: Math.max(0, Math.floor((expiresMs - Date.now()) / 1000)),
+  };
+  writeFileSync(path, `${JSON.stringify(data, null, 2)}\n`, "utf-8");
+}
+
 async function tryReuseKimiCliCredentials(
   callbacks: OAuthLoginCallbacks,
 ): Promise<KimiOAuthCredentials | null> {
@@ -247,11 +287,13 @@ async function tryReuseKimiCliCredentials(
   callbacks.onProgress?.("Kimi access token expired, refreshing.");
   try {
     const token = await refreshAccessToken(data.refresh_token!);
+    const expiresMs = Date.now() + token.expires_in * 1000;
+    writeKimiCodeCredentials(token.access_token, token.refresh_token, expiresMs);
     const extras = await discoverKimiModelMetadata(token.access_token);
     return {
       access: token.access_token,
       refresh: token.refresh_token,
-      expires: Date.now() + token.expires_in * 1000,
+      expires: expiresMs,
       ...extras,
     };
   } catch {
@@ -319,11 +361,13 @@ export async function loginKimiCode(callbacks: OAuthLoginCallbacks): Promise<Kim
     }
 
     if (token) {
+      const expiresMs = Date.now() + token.expires_in * 1000;
+      writeKimiCodeCredentials(token.access_token, token.refresh_token, expiresMs);
       const extras = await discoverKimiModelMetadata(token.access_token);
       return {
         access: token.access_token,
         refresh: token.refresh_token,
-        expires: Date.now() + token.expires_in * 1000,
+        expires: expiresMs,
         ...extras,
       };
     }
@@ -335,12 +379,24 @@ export async function loginKimiCode(callbacks: OAuthLoginCallbacks): Promise<Kim
 export async function refreshKimiCodeToken(
   credentials: OAuthCredentials,
 ): Promise<KimiOAuthCredentials> {
-  const token = await refreshAccessToken(credentials.refresh);
+  const kimiCred = kimiCodeCredentialExists() ? readKimiCliCredentials() : null;
+  let token: Awaited<ReturnType<typeof refreshAccessToken>>;
+  try {
+    token = await refreshAccessToken(credentials.refresh);
+  } catch (error) {
+    if (kimiCred?.refresh_token && kimiCred.refresh_token !== credentials.refresh) {
+      token = await refreshAccessToken(kimiCred.refresh_token);
+    } else {
+      throw error;
+    }
+  }
+  const expiresMs = Date.now() + token.expires_in * 1000;
+  writeKimiCodeCredentials(token.access_token, token.refresh_token, expiresMs);
   const extras = await discoverKimiModelMetadata(token.access_token);
   return {
     access: token.access_token,
     refresh: token.refresh_token,
-    expires: Date.now() + token.expires_in * 1000,
+    expires: expiresMs,
     ...extras,
   };
 }
@@ -356,6 +412,10 @@ export async function refreshKimiCodeToken(
 // new credentials under a file lock), and retry once.
 // =============================================================================
 
+export function getKimiApiKey(credentials: OAuthCredentials): string {
+  return credentials.access;
+}
+
 export function isKimiAuthErrorMessage(message: unknown): boolean {
   const text = String(message ?? "").toLowerCase();
   return (
@@ -368,37 +428,79 @@ export function isKimiAuthErrorMessage(message: unknown): boolean {
 
 export async function refreshKimiAuthToken(currentKey: string): Promise<string | null> {
   try {
+    const kimiCred = readKimiCliCredentials();
     const storage = AuthStorage.create();
-    const cred = storage.get(PROVIDER_ID);
-    if (!cred || cred.type !== "oauth") {
+    const piCred = storage.get(PROVIDER_ID);
+    const piOAuth = piCred?.type === "oauth" ? piCred : null;
+
+    if (piOAuth) {
+      if (piOAuth.access !== currentKey && Date.now() < piOAuth.expires) {
+        console.error("[kimi-coding] auth refresh: reusing newer on-disk token");
+        return piOAuth.access;
+      }
+
+      console.error("[kimi-coding] auth refresh: requesting new access token");
+      let refreshed: Awaited<ReturnType<typeof refreshAccessToken>>;
+      try {
+        refreshed = await refreshAccessToken(piOAuth.refresh);
+      } catch (error) {
+        if (!kimiCred?.refresh_token || kimiCred.refresh_token === piOAuth.refresh) throw error;
+        const kimiExpiresMs = (kimiCred.expires_at ?? 0) * 1000;
+        if (kimiCred.access_token !== currentKey && Date.now() < kimiExpiresMs) {
+          const recovered: OAuthCredential = {
+            ...piOAuth,
+            type: "oauth",
+            access: kimiCred.access_token!,
+            refresh: kimiCred.refresh_token,
+            expires: kimiExpiresMs,
+          };
+          storage.set(PROVIDER_ID, recovered);
+          console.error("[kimi-coding] auth refresh: recovered newer kimi-code token");
+          return recovered.access;
+        }
+        console.error("[kimi-coding] auth refresh: pi token rejected, trying kimi-code token");
+        refreshed = await refreshAccessToken(kimiCred.refresh_token);
+      }
+
+      const newExpiresMs = Date.now() + refreshed.expires_in * 1000;
+      const newCred: OAuthCredential = {
+        ...piOAuth,
+        type: "oauth",
+        access: refreshed.access_token,
+        refresh: refreshed.refresh_token,
+        expires: newExpiresMs,
+      };
+      storage.set(PROVIDER_ID, newCred);
+      writeKimiCodeCredentials(refreshed.access_token, refreshed.refresh_token, newExpiresMs);
+      console.error("[kimi-coding] auth refresh: new token persisted");
+      return newCred.access;
+    }
+
+    if (!kimiCred) {
       console.error(
         `[kimi-coding] auth refresh skipped: no OAuth credentials for ${PROVIDER_ID} on disk`,
       );
       return null;
     }
 
-    // If disk already has a different valid token (e.g., another process or a
-    // previous retry refreshed it while the caller's in-memory cache went
-    // stale), reuse it without hitting the OAuth endpoint.
-    if (cred.access !== currentKey && Date.now() < cred.expires) {
-      console.error("[kimi-coding] auth refresh: reusing newer on-disk token");
-      return cred.access;
+    const kimiExpiresMs = (kimiCred.expires_at ?? 0) * 1000;
+    if (kimiCred.access_token !== currentKey && Date.now() < kimiExpiresMs) {
+      console.error("[kimi-coding] auth refresh: reusing newer kimi-code token");
+      return kimiCred.access_token!;
     }
 
-    console.error("[kimi-coding] auth refresh: requesting new access token");
-    const refreshed = await refreshAccessToken(cred.refresh);
-    const newCred: OAuthCredential = {
-      ...cred,
-      type: "oauth",
-      access: refreshed.access_token,
-      refresh: refreshed.refresh_token,
-      expires: Date.now() + refreshed.expires_in * 1000,
-    };
-    storage.set(PROVIDER_ID, newCred);
-    console.error("[kimi-coding] auth refresh: new token persisted");
-    return newCred.access;
+    console.error("[kimi-coding] auth refresh: requesting new access token via kimi-code");
+    const refreshed = await refreshAccessToken(kimiCred.refresh_token!);
+    const newExpiresMs = Date.now() + refreshed.expires_in * 1000;
+    writeKimiCodeCredentials(refreshed.access_token, refreshed.refresh_token, newExpiresMs);
+    console.error("[kimi-coding] auth refresh: new token persisted to kimi-code");
+    return refreshed.access_token;
   } catch (err) {
-    console.error("[kimi-coding] auth refresh failed:", err);
+    if (err instanceof KimiLoginRequiredError) {
+      console.error(`[kimi-coding] ${KIMI_LOGIN_REQUIRED_MESSAGE}`);
+    } else {
+      console.error("[kimi-coding] auth refresh failed:", err);
+    }
     return null;
   }
 }