pi-provider-kimi-code 0.6.3 → 0.6.6

package/src/models.ts

@@ -5,9 +5,9 @@ import type { Api, Model, OAuthCredentials } from "@earendil-works/pi-ai";
 import type { KimiInputModality, KimiResolvedModelConfig, ModelConfig } from "./config.ts";
 
 import { type KimiWireProtocol, getBaseUrl } from "./constants.ts";
-import { getCommonHeaders } from "./device.ts";
+import { getKimiProviderHeaders } from "./device.ts";
 
-export interface KimiOAuthExtras {
+export interface KimiModelMetadata {
   wireModelId?: string;
   modelDisplay?: string;
   contextLength?: number;
@@ -15,6 +15,14 @@ export interface KimiOAuthExtras {
   supportsImageIn?: boolean;
   supportsVideoIn?: boolean;
   supportsThinkingType?: "only" | "no" | "both";
+  protocol?: KimiWireProtocol;
+  supportEfforts?: string[];
+  defaultEffort?: string;
+}
+
+export interface KimiOAuthExtras extends KimiModelMetadata {
+  modelCatalog?: Record<string, KimiModelMetadata>;
+  modelCatalogVersion?: number;
 }
 
 export type KimiOAuthCredentials = OAuthCredentials & KimiOAuthExtras;
@@ -47,6 +55,49 @@ function mergeInputModalities(
 const COST_STANDARD = { input: 0.897, output: 3.724, cacheRead: 0.179, cacheWrite: 0.897 };
 const COST_HIGH_SPEED = { input: 1.793, output: 7.448, cacheRead: 0.359, cacheWrite: 1.793 };
 
+export const KIMI_CODING_MODEL_ID = "kimi-for-coding";
+export const KIMI_CODING_HIGHSPEED_MODEL_ID = "kimi-for-coding-highspeed";
+export const KIMI_K3_MODEL_ID = "k3";
+export const KIMI_MODEL_CATALOG_VERSION = 1;
+
+const KIMI_K3_MODERATO_CONTEXT_WINDOW = 262144;
+const KIMI_MEMBERSHIP_RANK: Readonly<Record<string, number>> = {
+  LEVEL_FREE: 0,
+  LEVEL_BASIC: 1,
+  LEVEL_STANDARD: 2,
+  LEVEL_INTERMEDIATE: 3,
+  LEVEL_ADVANCED: 4,
+  LEVEL_PREMIUM: 5,
+};
+const KIMI_MODERATO_RANK = KIMI_MEMBERSHIP_RANK.LEVEL_STANDARD;
+const KIMI_ALLEGRETTO_RANK = KIMI_MEMBERSHIP_RANK.LEVEL_INTERMEDIATE;
+
+export function isKimiModelAvailableForMembership(
+  modelId: string,
+  membershipLevel: string | null | undefined,
+): boolean | undefined {
+  if (!membershipLevel) return undefined;
+  const rank = KIMI_MEMBERSHIP_RANK[membershipLevel];
+  if (rank === undefined) return undefined;
+  if (modelId === KIMI_K3_MODEL_ID) return rank >= KIMI_MODERATO_RANK;
+  if (modelId === KIMI_CODING_HIGHSPEED_MODEL_ID) return rank >= KIMI_ALLEGRETTO_RANK;
+  return true;
+}
+
+export function applyKimiMembershipLimitsToModel(
+  model: Model<Api>,
+  membershipLevel: string | null | undefined,
+): Model<Api> {
+  const rank = membershipLevel ? KIMI_MEMBERSHIP_RANK[membershipLevel] : undefined;
+  if (model.id !== KIMI_K3_MODEL_ID || rank === undefined || rank >= KIMI_ALLEGRETTO_RANK) {
+    return model;
+  }
+  return {
+    ...model,
+    contextWindow: Math.min(model.contextWindow, KIMI_K3_MODERATO_CONTEXT_WINDOW),
+  };
+}
+
 function resolveModelCost(modelDisplay: string | undefined): {
   input: number;
   output: number;
@@ -57,13 +108,23 @@ function resolveModelCost(modelDisplay: string | undefined): {
   return COST_STANDARD;
 }
 
-export function buildKimiModelFromConfig(config: ModelConfig): Model<Api> {
+export function buildKimiModelFromConfig(
+  config: ModelConfig,
+  modelId = KIMI_CODING_MODEL_ID,
+): Model<Api> {
+  const isHighSpeed = modelId === KIMI_CODING_HIGHSPEED_MODEL_ID;
+  const name =
+    modelId === KIMI_K3_MODEL_ID
+      ? "Kimi K3"
+      : isHighSpeed
+        ? "Kimi for Coding High Speed"
+        : "Kimi for Coding";
   return {
-    id: "kimi-for-coding",
-    name: "Kimi for Coding",
+    id: modelId,
+    name,
     reasoning: config.reasoning,
     input: [...config.input] as unknown as ("text" | "image" | "video")[],
-    cost: { ...COST_STANDARD },
+    cost: { ...(isHighSpeed ? COST_HIGH_SPEED : COST_STANDARD) },
     contextWindow: config.contextWindow,
     maxTokens: config.maxTokens,
   } as Model<Api>;
@@ -86,6 +147,8 @@ export function resolveKimiModelConfig(
   if (typeof extras.supportsImageIn === "boolean" || typeof extras.supportsVideoIn === "boolean") {
     resolved.input = mergeInputModalities(resolved.input, extras);
   }
+  if (extras.supportEfforts) resolved.supportEfforts = [...extras.supportEfforts];
+  if (extras.defaultEffort) resolved.defaultEffort = extras.defaultEffort;
   return resolved;
 }
 
@@ -97,6 +160,8 @@ interface KimiServerModel {
   supports_image_in?: unknown;
   supports_video_in?: unknown;
   supports_thinking_type?: unknown;
+  protocol?: unknown;
+  think_efforts?: unknown;
 }
 
 function parseSupportsThinkingType(value: unknown): "only" | "no" | "both" | undefined {
@@ -104,6 +169,54 @@ function parseSupportsThinkingType(value: unknown): "only" | "no" | "both" | und
   return undefined;
 }
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function parseThinkEfforts(value: unknown): {
+  supportEfforts?: string[];
+  defaultEffort?: string;
+} {
+  if (!isRecord(value) || value.support !== true) return {};
+  const validEfforts = Array.isArray(value.valid_efforts)
+    ? value.valid_efforts.filter(
+        (effort): effort is string => typeof effort === "string" && !!effort,
+      )
+    : [];
+  return {
+    ...(validEfforts.length > 0 ? { supportEfforts: validEfforts } : {}),
+    ...(typeof value.default_effort === "string" && value.default_effort
+      ? { defaultEffort: value.default_effort }
+      : {}),
+  };
+}
+
+function parseKimiModelMetadata(model: KimiServerModel): KimiModelMetadata | undefined {
+  if (typeof model.id !== "string" || !model.id) return undefined;
+  const metadata: KimiModelMetadata = { wireModelId: model.id };
+  if (typeof model.display_name === "string") metadata.modelDisplay = model.display_name;
+  if (typeof model.context_length === "number" && model.context_length > 0) {
+    metadata.contextLength = model.context_length;
+  }
+  const thinkingType = parseSupportsThinkingType(model.supports_thinking_type);
+  if (thinkingType) {
+    metadata.supportsThinkingType = thinkingType;
+  } else if (typeof model.supports_reasoning === "boolean") {
+    metadata.supportsReasoning = model.supports_reasoning;
+  }
+  if (typeof model.supports_image_in === "boolean") {
+    metadata.supportsImageIn = model.supports_image_in;
+  }
+  if (typeof model.supports_video_in === "boolean") {
+    metadata.supportsVideoIn = model.supports_video_in;
+  }
+  if (model.protocol === "openai" || model.protocol === "anthropic") {
+    metadata.protocol = model.protocol;
+  }
+  Object.assign(metadata, parseThinkEfforts(model.think_efforts));
+  return metadata;
+}
+
 export function buildModelsUrl(baseUrl: string): string {
   const base = baseUrl.replace(/\/+$/, "");
   return base.endsWith("/v1") ? `${base}/models` : `${base}/v1/models`;
@@ -127,7 +240,7 @@ export async function discoverKimiModelMetadata(
     const response = await fetch(getModelsUrl(protocol), {
       signal: controller.signal,
       headers: {
-        ...getCommonHeaders(),
+        ...getKimiProviderHeaders(),
         Authorization: `Bearer ${accessToken}`,
         Accept: "application/json",
       },
@@ -135,26 +248,24 @@ export async function discoverKimiModelMetadata(
     if (!response.ok) return {};
     const json = (await response.json()) as { data?: unknown };
     const list = Array.isArray(json.data) ? (json.data as KimiServerModel[]) : [];
-    const preferred = list.find((m) => typeof m.id === "string" && m.id === "kimi-for-coding");
-    if (!preferred || typeof preferred.id !== "string") return {};
-    const extras: KimiOAuthExtras = { wireModelId: preferred.id };
-    if (typeof preferred.display_name === "string") extras.modelDisplay = preferred.display_name;
-    if (typeof preferred.context_length === "number" && preferred.context_length > 0) {
-      extras.contextLength = preferred.context_length;
-    }
-    const thinkingType = parseSupportsThinkingType(preferred.supports_thinking_type);
-    if (thinkingType) {
-      extras.supportsThinkingType = thinkingType;
-    } else if (typeof preferred.supports_reasoning === "boolean") {
-      extras.supportsReasoning = preferred.supports_reasoning;
+    const supportedIds = new Set([
+      KIMI_CODING_MODEL_ID,
+      KIMI_CODING_HIGHSPEED_MODEL_ID,
+      KIMI_K3_MODEL_ID,
+    ]);
+    const modelCatalog: Record<string, KimiModelMetadata> = {};
+    for (const model of list) {
+      if (typeof model.id !== "string" || !supportedIds.has(model.id)) continue;
+      const metadata = parseKimiModelMetadata(model);
+      if (metadata) modelCatalog[model.id] = metadata;
     }
-    if (typeof preferred.supports_image_in === "boolean") {
-      extras.supportsImageIn = preferred.supports_image_in;
+    const preferred = modelCatalog[KIMI_CODING_MODEL_ID];
+    if (!preferred) {
+      return Object.keys(modelCatalog).length > 0
+        ? { modelCatalog, modelCatalogVersion: KIMI_MODEL_CATALOG_VERSION }
+        : {};
     }
-    if (typeof preferred.supports_video_in === "boolean") {
-      extras.supportsVideoIn = preferred.supports_video_in;
-    }
-    return extras;
+    return { ...preferred, modelCatalog, modelCatalogVersion: KIMI_MODEL_CATALOG_VERSION };
   } catch {
     return {};
   } finally {
@@ -162,14 +273,28 @@ export async function discoverKimiModelMetadata(
   }
 }
 
+export function getKimiModelMetadata(extras: KimiOAuthExtras, modelId: string): KimiModelMetadata {
+  const discovered = extras.modelCatalog?.[modelId];
+  if (discovered) return discovered;
+  return modelId === KIMI_CODING_MODEL_ID ? extras : {};
+}
+
 export function applyKimiOAuthExtrasToModel(
   model: Model<Api>,
-  extras: KimiOAuthExtras,
+  extras: KimiModelMetadata,
 ): Model<Api> {
-  const next: Model<Api> & { wireModelId?: string; supportsThinkingType?: "only" | "no" | "both" } =
-    { ...model };
+  const next: Model<Api> & {
+    wireModelId?: string;
+    supportsThinkingType?: "only" | "no" | "both";
+    wireProtocol?: KimiWireProtocol;
+    supportEfforts?: string[];
+    defaultEffort?: string;
+  } = { ...model };
   if (typeof extras.modelDisplay === "string" && extras.modelDisplay) {
-    next.name = extras.modelDisplay;
+    next.name =
+      model.id === KIMI_K3_MODEL_ID && /^k3$/i.test(extras.modelDisplay)
+        ? "Kimi K3"
+        : extras.modelDisplay;
     next.cost = resolveModelCost(extras.modelDisplay);
   }
   if (typeof extras.contextLength === "number" && extras.contextLength > 0) {
@@ -189,5 +314,8 @@ export function applyKimiOAuthExtrasToModel(
     const input = mergeInputModalities(next.input as KimiInputModality[], extras);
     (next as unknown as { input: string[] }).input = input;
   }
+  if (extras.protocol) next.wireProtocol = extras.protocol;
+  if (extras.supportEfforts) next.supportEfforts = [...extras.supportEfforts];
+  if (extras.defaultEffort) next.defaultEffort = extras.defaultEffort;
   return next;
 }

package/src/oauth.ts

@@ -2,9 +2,9 @@
 // reuse, the login / refresh handlers wired into pi's OAuth interface, and
 // the stream-level auth refresh used by the streaming handler.
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 import type { OAuthCredentials, OAuthLoginCallbacks } from "@earendil-works/pi-ai";
 import type { OAuthCredential } from "@earendil-works/pi-coding-agent";
@@ -120,11 +120,34 @@ export async function requestDeviceToken(
 
 interface RefreshAccessTokenOptions {
   maxRetries?: number;
+  signal?: AbortSignal;
   sleep?: (ms: number) => Promise<void>;
 }
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+export const KIMI_LOGIN_REQUIRED_MESSAGE =
+  "Kimi Code authorization is no longer valid. Sign in again with /login kimi-coding.";
+
+export class KimiLoginRequiredError extends Error {
+  constructor() {
+    super(KIMI_LOGIN_REQUIRED_MESSAGE);
+    this.name = "KimiLoginRequiredError";
+  }
+}
+
+function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  if (!signal) return new Promise((resolve) => setTimeout(resolve, ms));
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      clearTimeout(timeout);
+      reject(signal.reason);
+    };
+    const timeout = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
 }
 
 export async function refreshAccessToken(
@@ -132,11 +155,12 @@ export async function refreshAccessToken(
   options: RefreshAccessTokenOptions = {},
 ): Promise<TokenResponse> {
   const maxRetries = options.maxRetries ?? 3;
-  const wait = options.sleep ?? sleep;
+  const wait = options.sleep ?? ((ms: number) => sleep(ms, options.signal));
   let lastError: unknown;
 
   for (let attempt = 0; attempt < maxRetries; attempt++) {
     try {
+      options.signal?.throwIfAborted();
       const response = await fetch(`${getOAuthHost()}/api/oauth/token`, {
         method: "POST",
         headers: {
@@ -148,12 +172,20 @@ export async function refreshAccessToken(
           grant_type: "refresh_token",
           refresh_token: refreshToken,
         }),
+        signal: options.signal,
       });
 
       if (!response.ok) {
         const text = await response.text().catch(() => "");
-        if (response.status === 401 || response.status === 403) {
-          throw new Error(`Token refresh unauthorized: ${text}`);
+        let errorCode = "";
+        try {
+          const body = JSON.parse(text) as { error?: unknown };
+          if (typeof body.error === "string") errorCode = body.error;
+        } catch {
+          // Non-JSON OAuth errors are classified by status below.
+        }
+        if (response.status === 401 || response.status === 403 || errorCode === "invalid_grant") {
+          throw new KimiLoginRequiredError();
         }
         if (RETRYABLE_REFRESH_STATUSES.has(response.status)) {
           throw new Error(`Token refresh retryable: ${response.status} ${text}`);
@@ -168,9 +200,10 @@ export async function refreshAccessToken(
 
       return data;
     } catch (error) {
+      if (options.signal?.aborted) throw options.signal.reason;
       lastError = error;
       const message = error instanceof Error ? error.message : String(error);
-      if (message.startsWith("Token refresh unauthorized:")) throw error;
+      if (error instanceof KimiLoginRequiredError) throw error;
       if (message.startsWith("Token refresh failed:")) throw error;
       if (attempt < maxRetries - 1) {
         await wait(2 ** attempt * 1000);
@@ -196,15 +229,19 @@ interface KimiCliCredentialsFile {
   access_token?: string;
   refresh_token?: string;
   expires_at?: number; // Unix seconds (upstream convention)
+  scope?: string;
+  token_type?: string;
+  expires_in?: number;
 }
 
-function getKimiCredentialPaths(): string[] {
+function getKimiCodeCredentialPath(): string {
   const kimiCodeHome = process.env.KIMI_CODE_HOME || join(os.homedir(), ".kimi-code");
+  return join(kimiCodeHome, "credentials", "kimi-code.json");
+}
+
+function getKimiCredentialPaths(): string[] {
   const shareDir = process.env.KIMI_SHARE_DIR || join(os.homedir(), ".kimi");
-  return [
-    join(kimiCodeHome, "credentials", "kimi-code.json"),
-    join(shareDir, "credentials", "kimi-code.json"),
-  ];
+  return [getKimiCodeCredentialPath(), join(shareDir, "credentials", "kimi-code.json")];
 }
 
 function readKimiCliCredentials(): KimiCliCredentialsFile | null {
@@ -221,6 +258,25 @@ function readKimiCliCredentials(): KimiCliCredentialsFile | null {
   return null;
 }
 
+function kimiCodeCredentialExists(): boolean {
+  return existsSync(getKimiCodeCredentialPath());
+}
+
+function writeKimiCodeCredentials(access: string, refresh: string, expiresMs: number): void {
+  const path = getKimiCodeCredentialPath();
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true });
+  const data: KimiCliCredentialsFile = {
+    access_token: access,
+    refresh_token: refresh,
+    expires_at: Math.floor(expiresMs / 1000),
+    scope: "",
+    token_type: "Bearer",
+    expires_in: Math.max(0, Math.floor((expiresMs - Date.now()) / 1000)),
+  };
+  writeFileSync(path, `${JSON.stringify(data, null, 2)}\n`, "utf-8");
+}
+
 async function tryReuseKimiCliCredentials(
   callbacks: OAuthLoginCallbacks,
 ): Promise<KimiOAuthCredentials | null> {
@@ -247,11 +303,13 @@ async function tryReuseKimiCliCredentials(
   callbacks.onProgress?.("Kimi access token expired, refreshing.");
   try {
     const token = await refreshAccessToken(data.refresh_token!);
+    const expiresMs = Date.now() + token.expires_in * 1000;
+    writeKimiCodeCredentials(token.access_token, token.refresh_token, expiresMs);
     const extras = await discoverKimiModelMetadata(token.access_token);
     return {
       access: token.access_token,
       refresh: token.refresh_token,
-      expires: Date.now() + token.expires_in * 1000,
+      expires: expiresMs,
       ...extras,
     };
   } catch {
@@ -319,11 +377,13 @@ export async function loginKimiCode(callbacks: OAuthLoginCallbacks): Promise<Kim
     }
 
     if (token) {
+      const expiresMs = Date.now() + token.expires_in * 1000;
+      writeKimiCodeCredentials(token.access_token, token.refresh_token, expiresMs);
       const extras = await discoverKimiModelMetadata(token.access_token);
       return {
         access: token.access_token,
         refresh: token.refresh_token,
-        expires: Date.now() + token.expires_in * 1000,
+        expires: expiresMs,
         ...extras,
       };
     }
@@ -335,12 +395,24 @@ export async function loginKimiCode(callbacks: OAuthLoginCallbacks): Promise<Kim
 export async function refreshKimiCodeToken(
   credentials: OAuthCredentials,
 ): Promise<KimiOAuthCredentials> {
-  const token = await refreshAccessToken(credentials.refresh);
+  const kimiCred = kimiCodeCredentialExists() ? readKimiCliCredentials() : null;
+  let token: Awaited<ReturnType<typeof refreshAccessToken>>;
+  try {
+    token = await refreshAccessToken(credentials.refresh);
+  } catch (error) {
+    if (kimiCred?.refresh_token && kimiCred.refresh_token !== credentials.refresh) {
+      token = await refreshAccessToken(kimiCred.refresh_token);
+    } else {
+      throw error;
+    }
+  }
+  const expiresMs = Date.now() + token.expires_in * 1000;
+  writeKimiCodeCredentials(token.access_token, token.refresh_token, expiresMs);
   const extras = await discoverKimiModelMetadata(token.access_token);
   return {
     access: token.access_token,
     refresh: token.refresh_token,
-    expires: Date.now() + token.expires_in * 1000,
+    expires: expiresMs,
     ...extras,
   };
 }
@@ -356,8 +428,17 @@ export async function refreshKimiCodeToken(
 // new credentials under a file lock), and retry once.
 // =============================================================================
 
+export function getKimiApiKey(credentials: OAuthCredentials): string {
+  return credentials.access;
+}
+
 export function isKimiAuthErrorMessage(message: unknown): boolean {
   const text = String(message ?? "").toLowerCase();
+  const isMembershipPermissionError =
+    text.includes("current subscription does not have access to k3") ||
+    text.includes("current plan supports only kimi-k3 up to 256k context") ||
+    text.includes("current subscription does not have access to kimi-for-coding-highspeed");
+  if (isMembershipPermissionError) return false;
   return (
     /\b401\b/.test(text) ||
     text.includes("unauthorized") ||
@@ -366,39 +447,87 @@ export function isKimiAuthErrorMessage(message: unknown): boolean {
   );
 }
 
-export async function refreshKimiAuthToken(currentKey: string): Promise<string | null> {
+export async function refreshKimiAuthToken(
+  currentKey: string,
+  options: { signal?: AbortSignal } = {},
+): Promise<string | null> {
   try {
+    const kimiCred = readKimiCliCredentials();
     const storage = AuthStorage.create();
-    const cred = storage.get(PROVIDER_ID);
-    if (!cred || cred.type !== "oauth") {
+    const piCred = storage.get(PROVIDER_ID);
+    const piOAuth = piCred?.type === "oauth" ? piCred : null;
+
+    if (piOAuth) {
+      if (piOAuth.access !== currentKey && Date.now() < piOAuth.expires) {
+        console.error("[kimi-coding] auth refresh: reusing newer on-disk token");
+        return piOAuth.access;
+      }
+
+      console.error("[kimi-coding] auth refresh: requesting new access token");
+      let refreshed: Awaited<ReturnType<typeof refreshAccessToken>>;
+      try {
+        refreshed = await refreshAccessToken(piOAuth.refresh, { signal: options.signal });
+      } catch (error) {
+        if (!kimiCred?.refresh_token || kimiCred.refresh_token === piOAuth.refresh) throw error;
+        const kimiExpiresMs = (kimiCred.expires_at ?? 0) * 1000;
+        if (kimiCred.access_token !== currentKey && Date.now() < kimiExpiresMs) {
+          const recovered: OAuthCredential = {
+            ...piOAuth,
+            type: "oauth",
+            access: kimiCred.access_token!,
+            refresh: kimiCred.refresh_token,
+            expires: kimiExpiresMs,
+          };
+          storage.set(PROVIDER_ID, recovered);
+          console.error("[kimi-coding] auth refresh: recovered newer kimi-code token");
+          return recovered.access;
+        }
+        console.error("[kimi-coding] auth refresh: pi token rejected, trying kimi-code token");
+        refreshed = await refreshAccessToken(kimiCred.refresh_token, { signal: options.signal });
+      }
+
+      const newExpiresMs = Date.now() + refreshed.expires_in * 1000;
+      const newCred: OAuthCredential = {
+        ...piOAuth,
+        type: "oauth",
+        access: refreshed.access_token,
+        refresh: refreshed.refresh_token,
+        expires: newExpiresMs,
+      };
+      storage.set(PROVIDER_ID, newCred);
+      writeKimiCodeCredentials(refreshed.access_token, refreshed.refresh_token, newExpiresMs);
+      console.error("[kimi-coding] auth refresh: new token persisted");
+      return newCred.access;
+    }
+
+    if (!kimiCred) {
       console.error(
         `[kimi-coding] auth refresh skipped: no OAuth credentials for ${PROVIDER_ID} on disk`,
       );
       return null;
     }
 
-    // If disk already has a different valid token (e.g., another process or a
-    // previous retry refreshed it while the caller's in-memory cache went
-    // stale), reuse it without hitting the OAuth endpoint.
-    if (cred.access !== currentKey && Date.now() < cred.expires) {
-      console.error("[kimi-coding] auth refresh: reusing newer on-disk token");
-      return cred.access;
+    const kimiExpiresMs = (kimiCred.expires_at ?? 0) * 1000;
+    if (kimiCred.access_token !== currentKey && Date.now() < kimiExpiresMs) {
+      console.error("[kimi-coding] auth refresh: reusing newer kimi-code token");
+      return kimiCred.access_token!;
     }
 
-    console.error("[kimi-coding] auth refresh: requesting new access token");
-    const refreshed = await refreshAccessToken(cred.refresh);
-    const newCred: OAuthCredential = {
-      ...cred,
-      type: "oauth",
-      access: refreshed.access_token,
-      refresh: refreshed.refresh_token,
-      expires: Date.now() + refreshed.expires_in * 1000,
-    };
-    storage.set(PROVIDER_ID, newCred);
-    console.error("[kimi-coding] auth refresh: new token persisted");
-    return newCred.access;
+    console.error("[kimi-coding] auth refresh: requesting new access token via kimi-code");
+    const refreshed = await refreshAccessToken(kimiCred.refresh_token!, {
+      signal: options.signal,
+    });
+    const newExpiresMs = Date.now() + refreshed.expires_in * 1000;
+    writeKimiCodeCredentials(refreshed.access_token, refreshed.refresh_token, newExpiresMs);
+    console.error("[kimi-coding] auth refresh: new token persisted to kimi-code");
+    return refreshed.access_token;
   } catch (err) {
-    console.error("[kimi-coding] auth refresh failed:", err);
+    if (options.signal?.aborted) return null;
+    if (err instanceof KimiLoginRequiredError) {
+      console.error(`[kimi-coding] ${KIMI_LOGIN_REQUIRED_MESSAGE}`);
+    } else {
+      console.error("[kimi-coding] auth refresh failed:", err);
+    }
     return null;
   }
 }