pi-provider-kimi-code 0.6.5 → 0.6.7

package/README.md

@@ -7,7 +7,7 @@
 
 Pi already has a basic `kimi-coding` provider. This extension is for the parts that start to matter once Kimi Code becomes part of your real Pi workflow: account login reuse, file uploads, tool schema compatibility, live model metadata, measured cache behavior, and API-tested parameter handling.
 
-> **Kimi K2.7 supported.** The provider automatically discovers the current model from Kimi's `/v1/models` endpoint at login, refresh, and `/kimi-settings` time, so new rollouts (including K2.7) are picked up immediately without a package update.
+> **Kimi K3 supported.** The provider combines Kimi's live `/v1/models` catalog with your membership level from `/usages`, exposing only eligible models and advertising the correct K3 context limit. It refreshes this metadata at startup and through `/kimi-settings`; OAuth login and token refresh also update the model catalog.
 
 ## Why this exists
 
@@ -19,20 +19,20 @@ Kimi's API surface goes beyond the LLM itself. It includes file uploads, web sea
 - **Send files the Kimi way.** Large inline images go through Kimi's Files API and become `ms://` references instead of huge base64 payloads.
 - **Know what the cache is doing.** Kimi caches by content prefix. This repo measures that behavior instead of pretending `prompt_cache_key` controls it.
 - **Keep Pi's tools working.** Moonshot's API rejects tool schemas over 15 KB — a limit that Pi's extension ecosystem regularly hits ([#16](https://github.com/Leechael/pi-provider-kimi-code/issues/16), [#21](https://github.com/Leechael/pi-provider-kimi-code/issues/21)). This extension automatically deduplicates schemas with `$ref`/`$defs` before sending, so subagents and other extensions don't break.
-- **Tested against the live API.** Thinking config, parameter constraints, protocol compatibility, and streaming behavior are all verified against Kimi's Coding endpoint — not assumed from docs. When the API rejects something (wrong `temperature`, unsupported `tool_choice`), the provider strips it before you see a 400.
+- **Tested against the live API.** Thinking config, parameter constraints, protocol compatibility, and streaming behavior are all verified against Kimi's Coding endpoint — not assumed from docs. When the API rejects something (wrong `temperature`, unsupported `tool_choice`), the provider normalizes the request before you see a 400.
 - **Turn on Kimi-native tools when you want them.** `moonshot_search`, `moonshot_fetch`, and `kimi_datasource` are opt-in, configurable per user or per project.
 - **Embed in your own build.** `KimiCode()` factory lets you ship Kimi Code support inside a custom Pi agent with programmatic config overrides — no file-based extension path needed.
 
 ## What this package adds
 
 - Kimi account login in Pi, plus `KIMI_API_KEY` for CI or pay-per-token use.
-- `kimi-code` credential reuse from `~/.kimi/credentials/kimi-code.json`.
+- `kimi-code` credential reuse from `~/.kimi-code/credentials/kimi-code.json`, with read-only support for the legacy `~/.kimi` path.
 - Kimi Files API uploads for large inline images.
-- Live model metadata from Kimi at login, refresh, and `/kimi-settings` time.
+- Live model metadata combined with membership-aware K3 and HighSpeed availability.
 - OpenAI-compatible mode by default, Anthropic-compatible mode on request.
-- Kimi K2.7 reasoning level mapping for Pi's reasoning controls.
+- K2.7 and K3 reasoning level mapping for Pi's reasoning controls.
 - Tool schema dedup to stay under Moonshot's 15 KB per-tool-schema limit.
-- K2.7 parameter guard: strips `temperature`, `top_p`, and `tool_choice` values that the API rejects.
+- K2.7 parameter guard: removes rejected `temperature` and `top_p` values and rewrites unsupported `tool_choice` values to `auto`.
 - Stream cleanup for Kimi's thinking-only placeholder text.
 - Optional `moonshot_search`, `moonshot_fetch`, and unified datasource `kimi_datasource` tools via `/kimi-settings`.
 - Programmatic `KimiCode()` factory for embedding in custom Pi builds.
@@ -84,15 +84,21 @@ Inside Pi, run:
 /login kimi-coding
 ```
 
-A browser tab opens, you sign into your Kimi account, and Pi stores the credential at `~/.pi/agent/auth.json`. Tokens refresh automatically.
+A browser tab opens, you sign into your Kimi account, and Pi stores the credential at `~/.pi/agent/auth.json`. Tokens refresh automatically. The extension also syncs refreshed credentials to the current `kimi-code` credential file:
 
-If you already use `kimi-code`, this extension can reuse its credential file:
+```text
+~/.kimi-code/credentials/kimi-code.json
+```
+
+If you already use `kimi-code`, the extension can reuse that session. Set `KIMI_CODE_HOME` if its home directory lives somewhere else.
+
+The legacy credential path is also supported:
 
 ```text
 ~/.kimi/credentials/kimi-code.json
 ```
 
-The file is read-only from this extension's side. Set `KIMI_SHARE_DIR` if your `kimi-code` share directory lives somewhere else.
+Legacy credentials are read-only. Set `KIMI_SHARE_DIR` to override the legacy `~/.kimi` directory.
 
 For CI or pay-per-token use, set `KIMI_API_KEY` instead:
 
@@ -100,20 +106,24 @@ For CI or pay-per-token use, set `KIMI_API_KEY` instead:
 KIMI_API_KEY=sk-... pi
 ```
 
-## Model
+## Models
 
-This provider publishes two Pi model IDs:
+This provider publishes three Pi model IDs:
 
-```text
-kimi-coding/kimi-for-coding
-kimi-coding/kimi-for-coding-highspeed
-```
+| Pi model ID                             | Upstream model           | Access                                                 |
+| --------------------------------------- | ------------------------ | ------------------------------------------------------ |
+| `kimi-coding/kimi-for-coding`           | Kimi K2.7 Code           | All Kimi Code members                                  |
+| `kimi-coding/kimi-for-coding-highspeed` | Kimi K2.7 Code HighSpeed | Allegretto and above                                   |
+| `kimi-coding/k3`                        | Kimi K3                  | Moderato: 256K context; Allegretto and above: up to 1M |
 
-Select standard or highspeed mode inside Pi:
+Plans below Moderato cannot use K3. The provider reads the current membership level from `/usages` and combines it with `/models`: server catalog availability remains authoritative, while known plan limits can only hide unavailable selections or lower K3's advertised context window. Unknown or unavailable membership data falls back to the server catalog instead of guessing.
+
+Select a model inside Pi:
 
 ```text
 /model kimi-coding/kimi-for-coding
 /model kimi-coding/kimi-for-coding-highspeed
+/model kimi-coding/k3
 ```
 
 Kimi keeps Coding models behind aliases. Rather than hardcoding a stale model list, this extension asks Kimi for the current model info when you log in or refresh. If your account is on a newer rollout (e.g., Kimi K2.7) or internal test, Pi can pick up the latest model name and context size without waiting for a package release.
@@ -125,7 +135,9 @@ Fallback values:
 - Input: text and image
 - Reasoning: enabled
 
-The provider maps Pi's reasoning levels to Kimi's top-level `thinking` parameter. It sends `thinking.effort` only when `/models` advertises supported effort values. The mapping refreshes automatically on credential refresh. Opening `/kimi-settings` also re-discovers the latest model metadata.
+The provider maps Pi's reasoning levels to Kimi's top-level `thinking` parameter. K3 currently advertises only `max`; `max` and `xhigh` map to `max`, `high` and `medium` map to `high`, and `low` and `minimal` map to `low`. It sends `thinking.effort` only when `/models` advertises the mapped value. The mapping refreshes automatically on credential refresh. Opening `/kimi-settings` also re-discovers the latest model and membership metadata.
+
+Switching models or thinking effort invalidates Kimi's existing context cache. Start a new session when switching to avoid re-prefilling a long conversation and consuming extra quota.
 
 ## Optional tools
 
@@ -143,8 +155,8 @@ Configurable settings include protocol mode, upload threshold, and per-tool enab
 
 Config files are JSON:
 
-- Home: `~/.pi/pi-provider-kimi-code.json`
-- Project override: `<cwd>/.pi/pi-provider-kimi-code.json`
+- Home: `~/.pi/providers/kimi-coding/config.json`
+- Project override: `<cwd>/.pi/providers/kimi-coding/config.json`
 
 Project config overrides home config with a deep merge. Missing files or missing keys mean all tools stay off.
 
@@ -296,7 +308,7 @@ In OpenAI mode this extension maps the `developer` role to `system` (Kimi's Codi
 
 ## Credits
 
-Based on the login implementation from Kimi Code by Moonshot AI. Built as a Pi extension by [@badlogic](https://github.com/badlogic).
+Based on the login implementation from Kimi Code by Moonshot AI. Pi was originally created by [@badlogic](https://github.com/badlogic).
 
 ## License
 

package/index.ts

@@ -42,12 +42,16 @@ import { PROVIDER_ID, PROVIDER_VERSION, getBaseUrl, getKimiApiType } from "./src
 import {
   type KimiOAuthCredentials,
   type KimiOAuthExtras,
+  applyKimiMembershipLimitsToModel,
   buildKimiModelFromConfig,
   applyKimiOAuthExtrasToModel,
   KIMI_CODING_HIGHSPEED_MODEL_ID,
   KIMI_CODING_MODEL_ID,
+  KIMI_K3_MODEL_ID,
+  KIMI_MODEL_CATALOG_VERSION,
   discoverKimiModelMetadata,
   getKimiModelMetadata,
+  isKimiModelAvailableForMembership,
   resolveKimiModelConfig,
 } from "./src/models.ts";
 import { getKimiApiKey, loginKimiCode, refreshKimiCodeToken } from "./src/oauth.ts";
@@ -60,13 +64,14 @@ import {
   parseByteSizeInput,
 } from "./src/settings-ui.ts";
 import { setStoreResolvedKimiConfig, streamSimpleKimi } from "./src/stream.ts";
-import { fetchKimiUsageSummary, getKimiUsageToken } from "./src/usage.ts";
+import { fetchKimiUsageSnapshot, getKimiUsageToken } from "./src/usage.ts";
 import { buildMoonshotFetchTool, buildMoonshotSearchTool } from "./src/tools/moonshot.ts";
 import { buildKimiDatasourceTool } from "./src/tools/datasource.ts";
 interface KimiRuntimeState {
   cwd: string;
   config: KimiCodeConfig;
   modelExtras: KimiOAuthExtras;
+  membershipLevel: string | null;
   projectTrusted: boolean;
   overrides?: KimiCodeConfigPatch;
 }
@@ -152,11 +157,21 @@ async function openSettingsMenu(
   ctx: ExtensionCommandContext,
   state: KimiRuntimeState,
 ): Promise<void> {
-  const [usage, modelsRefreshed] = await Promise.all([
-    fetchKimiUsageSummary(),
+  const modelDiscoveryToken = getKimiUsageToken();
+  const [usageSnapshot, initialModelsRefreshed] = await Promise.all([
+    fetchKimiUsageSnapshot(),
     refreshModelExtras(state),
   ]);
-  if (modelsRefreshed) registerKimiProvider(pi, state);
+  let modelsRefreshed = initialModelsRefreshed;
+  const refreshedToken = getKimiUsageToken();
+  if (!modelsRefreshed && refreshedToken && refreshedToken !== modelDiscoveryToken) {
+    modelsRefreshed = await refreshModelExtras(state);
+  }
+  const refreshedMembershipLevel = usageSnapshot.membershipLevel ?? state.membershipLevel;
+  const membershipChanged = state.membershipLevel !== refreshedMembershipLevel;
+  state.membershipLevel = refreshedMembershipLevel;
+  if (modelsRefreshed || membershipChanged) registerKimiProvider(pi, state);
+  const usage = usageSnapshot.summary;
 
   const projectTrusted = await isKimiProjectConfigApproved(ctx, ctx.cwd);
   const homeDraft = loadHomeKimiCodeConfig(os.homedir());
@@ -367,19 +382,40 @@ function saveScopeKimiCodeConfig(
 function filterAvailableKimiModels<T extends { id: string }>(
   models: T[],
   extras: KimiOAuthExtras,
+  membershipLevel: string | null,
 ): T[] {
-  const available = extras.modelCatalog ? new Set(Object.keys(extras.modelCatalog)) : null;
-  return available ? models.filter((model) => available.has(model.id)) : models;
+  const available =
+    extras.modelCatalogVersion === KIMI_MODEL_CATALOG_VERSION && extras.modelCatalog
+      ? new Set(Object.keys(extras.modelCatalog))
+      : null;
+  return models.filter(
+    (model) =>
+      (!available || available.has(model.id)) &&
+      isKimiModelAvailableForMembership(model.id, membershipLevel) !== false,
+  );
 }
 
 function registerKimiProvider(pi: ExtensionAPI, state: KimiRuntimeState): void {
-  const standardModel = applyKimiOAuthExtrasToModel(
-    buildKimiModelFromConfig(state.config.model),
-    getKimiModelMetadata(state.modelExtras, KIMI_CODING_MODEL_ID),
+  const standardModel = applyKimiMembershipLimitsToModel(
+    applyKimiOAuthExtrasToModel(
+      buildKimiModelFromConfig(state.config.model),
+      getKimiModelMetadata(state.modelExtras, KIMI_CODING_MODEL_ID),
+    ),
+    state.membershipLevel,
   );
-  const highSpeedModel = applyKimiOAuthExtrasToModel(
-    buildKimiModelFromConfig(state.config.model, KIMI_CODING_HIGHSPEED_MODEL_ID),
-    getKimiModelMetadata(state.modelExtras, KIMI_CODING_HIGHSPEED_MODEL_ID),
+  const highSpeedModel = applyKimiMembershipLimitsToModel(
+    applyKimiOAuthExtrasToModel(
+      buildKimiModelFromConfig(state.config.model, KIMI_CODING_HIGHSPEED_MODEL_ID),
+      getKimiModelMetadata(state.modelExtras, KIMI_CODING_HIGHSPEED_MODEL_ID),
+    ),
+    state.membershipLevel,
+  );
+  const k3Model = applyKimiMembershipLimitsToModel(
+    applyKimiOAuthExtrasToModel(
+      buildKimiModelFromConfig(state.config.model, KIMI_K3_MODEL_ID),
+      getKimiModelMetadata(state.modelExtras, KIMI_K3_MODEL_ID),
+    ),
+    state.membershipLevel,
   );
 
   pi.registerProvider(PROVIDER_ID, {
@@ -388,12 +424,34 @@ function registerKimiProvider(pi: ExtensionAPI, state: KimiRuntimeState): void {
     api: getKimiApiType(state.config.protocol),
     streamSimple: streamSimpleKimi,
 
-    models: filterAvailableKimiModels([standardModel, highSpeedModel], state.modelExtras),
+    models: filterAvailableKimiModels(
+      [standardModel, highSpeedModel, k3Model],
+      state.modelExtras,
+      state.membershipLevel,
+    ),
 
     oauth: {
       name: "Kimi Code (OAuth)",
-      login: loginKimiCode,
-      refreshToken: refreshKimiCodeToken,
+      login: async (callbacks) => {
+        const credentials = await loginKimiCode(callbacks);
+        const usage = await fetchKimiUsageSnapshot({
+          timeoutMs: 2500,
+          token: credentials.access,
+          refreshOnUnauthorized: false,
+        });
+        state.membershipLevel = usage.membershipLevel;
+        return credentials;
+      },
+      refreshToken: async (credentials) => {
+        const refreshed = await refreshKimiCodeToken(credentials);
+        const usage = await fetchKimiUsageSnapshot({
+          timeoutMs: 2500,
+          token: refreshed.access,
+          refreshOnUnauthorized: false,
+        });
+        state.membershipLevel = usage.membershipLevel;
+        return refreshed;
+      },
       getApiKey: getKimiApiKey,
       // Reflect server-side model identity on the registered model after login
       // / refresh. We never rewrite the model id (pi-side `/model` selections
@@ -404,14 +462,23 @@ function registerKimiProvider(pi: ExtensionAPI, state: KimiRuntimeState): void {
         const extras = cred as KimiOAuthCredentials;
         state.modelExtras = extras;
         reloadEffectiveKimiRuntimeConfig(state, state.cwd, state.projectTrusted);
-        const available = extras.modelCatalog ? new Set(Object.keys(extras.modelCatalog)) : null;
+        const available =
+          extras.modelCatalogVersion === KIMI_MODEL_CATALOG_VERSION && extras.modelCatalog
+            ? new Set(Object.keys(extras.modelCatalog))
+            : null;
         return models
           .filter(
-            (model) => model.provider !== PROVIDER_ID || !available || available.has(model.id),
+            (model) =>
+              model.provider !== PROVIDER_ID ||
+              ((!available || available.has(model.id)) &&
+                isKimiModelAvailableForMembership(model.id, state.membershipLevel) !== false),
           )
           .map((model) =>
             model.provider === PROVIDER_ID
-              ? applyKimiOAuthExtrasToModel(model, getKimiModelMetadata(extras, model.id))
+              ? applyKimiMembershipLimitsToModel(
+                  applyKimiOAuthExtrasToModel(model, getKimiModelMetadata(extras, model.id)),
+                  state.membershipLevel,
+                )
               : model,
           );
       },
@@ -427,13 +494,24 @@ export function KimiCode(overrides?: KimiCodeConfigPatch): ExtensionFactory {
       overrides,
     );
     const discoveryToken = getKimiUsageToken();
-    const discovered = discoveryToken
-      ? await discoverKimiModelMetadata(discoveryToken, config.protocol)
-      : {};
+    const [initialDiscovery, usageSnapshot] = await Promise.all([
+      discoveryToken ? discoverKimiModelMetadata(discoveryToken, config.protocol) : {},
+      fetchKimiUsageSnapshot({ timeoutMs: 2500 }),
+    ]);
+    let discovered = initialDiscovery;
+    const refreshedToken = getKimiUsageToken();
+    if (
+      Object.keys(discovered).length === 0 &&
+      refreshedToken &&
+      refreshedToken !== discoveryToken
+    ) {
+      discovered = await discoverKimiModelMetadata(refreshedToken, config.protocol);
+    }
     const state: KimiRuntimeState = {
       cwd,
       config,
       modelExtras: discovered,
+      membershipLevel: usageSnapshot.membershipLevel,
       projectTrusted: false,
       overrides,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-kimi-code",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "Use Kimi Code in Pi without losing the Kimi-specific bits",
   "keywords": [
     "ai-provider",
@@ -49,12 +49,16 @@
     "format:check": "oxfmt . --check",
     "pre-commit": "prek run"
   },
+  "dependencies": {
+    "proper-lockfile": "^4.1.2"
+  },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.79.10",
-    "@earendil-works/pi-coding-agent": "^0.79.10",
-    "@earendil-works/pi-tui": "^0.79.10",
+    "@earendil-works/pi-ai": "^0.80.9",
+    "@earendil-works/pi-coding-agent": "^0.80.9",
+    "@earendil-works/pi-tui": "^0.80.9",
     "@j178/prek": "^0.4.4",
     "@types/node": "^24.0.0",
+    "@types/proper-lockfile": "^4.1.4",
     "oxfmt": "^0.44.0",
     "oxlint": "^1.59.0",
     "typescript": "^5.9.0"

package/src/config.ts

@@ -121,9 +121,10 @@ export const DEFAULT_KIMI_CODE_CONFIG: KimiCodeConfig = {
       off: { effort: null, enabled: false },
       minimal: { effort: "low", enabled: true },
       low: { effort: "low", enabled: true },
-      medium: { effort: "medium", enabled: true },
+      medium: { effort: "high", enabled: true },
       high: { effort: "high", enabled: true },
-      xhigh: { effort: "high", enabled: true },
+      xhigh: { effort: "max", enabled: true },
+      max: { effort: "max", enabled: true },
     },
     thinkingKeep: "all",
     generation: {},

package/src/constants.ts

@@ -41,12 +41,12 @@ export function getDefaultBaseUrl(protocol: KimiWireProtocol): string {
 
 export const DEFAULT_BASE_URL = getDefaultBaseUrl(ENV_KIMI_CODE_PROTOCOL);
 
-export const PROVIDER_VERSION = "0.6.5";
+export const PROVIDER_VERSION = "0.6.7";
 
 // Upstream kimi-code CLI version — used in User-Agent and X-Msh-Version
 // headers to match the official client's identity. Update this when
-// syncing with https://github.com/anthropics/kimi-code.
-export const KIMI_UPSTREAM_VERSION = "0.23.4";
+// syncing with https://github.com/MoonshotAI/kimi-code.
+export const KIMI_UPSTREAM_VERSION = "0.26.0";
 export const KIMI_CODE_USER_AGENT = `kimi-code-cli/${KIMI_UPSTREAM_VERSION}`;
 export const KIMI_PLATFORM = "kimi_code_cli";
 

package/src/models.ts

@@ -22,6 +22,7 @@ export interface KimiModelMetadata {
 
 export interface KimiOAuthExtras extends KimiModelMetadata {
   modelCatalog?: Record<string, KimiModelMetadata>;
+  modelCatalogVersion?: number;
 }
 
 export type KimiOAuthCredentials = OAuthCredentials & KimiOAuthExtras;
@@ -56,6 +57,46 @@ const COST_HIGH_SPEED = { input: 1.793, output: 7.448, cacheRead: 0.359, cacheWr
 
 export const KIMI_CODING_MODEL_ID = "kimi-for-coding";
 export const KIMI_CODING_HIGHSPEED_MODEL_ID = "kimi-for-coding-highspeed";
+export const KIMI_K3_MODEL_ID = "k3";
+export const KIMI_MODEL_CATALOG_VERSION = 1;
+
+const KIMI_K3_MODERATO_CONTEXT_WINDOW = 262144;
+const KIMI_MEMBERSHIP_RANK: Readonly<Record<string, number>> = {
+  LEVEL_FREE: 0,
+  LEVEL_BASIC: 1,
+  LEVEL_STANDARD: 2,
+  LEVEL_INTERMEDIATE: 3,
+  LEVEL_ADVANCED: 4,
+  LEVEL_PREMIUM: 5,
+};
+const KIMI_MODERATO_RANK = KIMI_MEMBERSHIP_RANK.LEVEL_STANDARD;
+const KIMI_ALLEGRETTO_RANK = KIMI_MEMBERSHIP_RANK.LEVEL_INTERMEDIATE;
+
+export function isKimiModelAvailableForMembership(
+  modelId: string,
+  membershipLevel: string | null | undefined,
+): boolean | undefined {
+  if (!membershipLevel) return undefined;
+  const rank = KIMI_MEMBERSHIP_RANK[membershipLevel];
+  if (rank === undefined) return undefined;
+  if (modelId === KIMI_K3_MODEL_ID) return rank >= KIMI_MODERATO_RANK;
+  if (modelId === KIMI_CODING_HIGHSPEED_MODEL_ID) return rank >= KIMI_ALLEGRETTO_RANK;
+  return true;
+}
+
+export function applyKimiMembershipLimitsToModel(
+  model: Model<Api>,
+  membershipLevel: string | null | undefined,
+): Model<Api> {
+  const rank = membershipLevel ? KIMI_MEMBERSHIP_RANK[membershipLevel] : undefined;
+  if (model.id !== KIMI_K3_MODEL_ID || rank === undefined || rank >= KIMI_ALLEGRETTO_RANK) {
+    return model;
+  }
+  return {
+    ...model,
+    contextWindow: Math.min(model.contextWindow, KIMI_K3_MODERATO_CONTEXT_WINDOW),
+  };
+}
 
 function resolveModelCost(modelDisplay: string | undefined): {
   input: number;
@@ -72,9 +113,15 @@ export function buildKimiModelFromConfig(
   modelId = KIMI_CODING_MODEL_ID,
 ): Model<Api> {
   const isHighSpeed = modelId === KIMI_CODING_HIGHSPEED_MODEL_ID;
+  const name =
+    modelId === KIMI_K3_MODEL_ID
+      ? "Kimi K3"
+      : isHighSpeed
+        ? "Kimi for Coding High Speed"
+        : "Kimi for Coding";
   return {
     id: modelId,
-    name: isHighSpeed ? "Kimi for Coding High Speed" : "Kimi for Coding",
+    name,
     reasoning: config.reasoning,
     input: [...config.input] as unknown as ("text" | "image" | "video")[],
     cost: { ...(isHighSpeed ? COST_HIGH_SPEED : COST_STANDARD) },
@@ -201,7 +248,11 @@ export async function discoverKimiModelMetadata(
     if (!response.ok) return {};
     const json = (await response.json()) as { data?: unknown };
     const list = Array.isArray(json.data) ? (json.data as KimiServerModel[]) : [];
-    const supportedIds = new Set([KIMI_CODING_MODEL_ID, KIMI_CODING_HIGHSPEED_MODEL_ID]);
+    const supportedIds = new Set([
+      KIMI_CODING_MODEL_ID,
+      KIMI_CODING_HIGHSPEED_MODEL_ID,
+      KIMI_K3_MODEL_ID,
+    ]);
     const modelCatalog: Record<string, KimiModelMetadata> = {};
     for (const model of list) {
       if (typeof model.id !== "string" || !supportedIds.has(model.id)) continue;
@@ -210,9 +261,11 @@ export async function discoverKimiModelMetadata(
     }
     const preferred = modelCatalog[KIMI_CODING_MODEL_ID];
     if (!preferred) {
-      return Object.keys(modelCatalog).length > 0 ? { modelCatalog } : {};
+      return Object.keys(modelCatalog).length > 0
+        ? { modelCatalog, modelCatalogVersion: KIMI_MODEL_CATALOG_VERSION }
+        : {};
     }
-    return { ...preferred, modelCatalog };
+    return { ...preferred, modelCatalog, modelCatalogVersion: KIMI_MODEL_CATALOG_VERSION };
   } catch {
     return {};
   } finally {
@@ -238,7 +291,10 @@ export function applyKimiOAuthExtrasToModel(
     defaultEffort?: string;
   } = { ...model };
   if (typeof extras.modelDisplay === "string" && extras.modelDisplay) {
-    next.name = extras.modelDisplay;
+    next.name =
+      model.id === KIMI_K3_MODEL_ID && /^k3$/i.test(extras.modelDisplay)
+        ? "Kimi K3"
+        : extras.modelDisplay;
     next.cost = resolveModelCost(extras.modelDisplay);
   }
   if (typeof extras.contextLength === "number" && extras.contextLength > 0) {

package/src/oauth.ts

@@ -2,13 +2,94 @@
 // reuse, the login / refresh handlers wired into pi's OAuth interface, and
 // the stream-level auth refresh used by the streaming handler.
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import { dirname, join } from "node:path";
 
+import { lock as acquireFileLock } from "proper-lockfile";
+
 import type { OAuthCredentials, OAuthLoginCallbacks } from "@earendil-works/pi-ai";
-import type { OAuthCredential } from "@earendil-works/pi-coding-agent";
-import { AuthStorage } from "@earendil-works/pi-coding-agent";
+import * as piAgent from "@earendil-works/pi-coding-agent";
+
+// Structural mirrors of pi's stored credential shapes. The exported names
+// moved between pi versions (pi-coding-agent <=0.79 vs pi-ai >=0.80.8), so
+// these are defined locally to type-check against either surface.
+type StoredCredential = { type: string } & Record<string, unknown>;
+
+export interface StoredOAuthCredential {
+  type: "oauth";
+  access: string;
+  refresh: string;
+  expires: number;
+  [key: string]: unknown;
+}
+
+// pi renamed its auth storage surface in 0.80.8: the exported AuthStorage
+// class (sync get/set under a file lock) was replaced by readStoredCredential
+// for one-off reads, with no exported write path. Detect whichever the host
+// pi provides so the extension keeps loading on both sides of the rename.
+const piAgentRuntime = piAgent as unknown as {
+  getAgentDir(): string;
+  readStoredCredential?(providerId: string): StoredCredential | undefined;
+  AuthStorage?: {
+    create(): {
+      get(provider: string): StoredCredential | undefined;
+      set(provider: string, credential: StoredCredential): void;
+    };
+  };
+};
+
+export function readStoredOAuthCredential(providerId: string): StoredOAuthCredential | null {
+  const credential = piAgentRuntime.readStoredCredential
+    ? piAgentRuntime.readStoredCredential(providerId)
+    : piAgentRuntime.AuthStorage?.create().get(providerId);
+  return credential?.type === "oauth" ? (credential as StoredOAuthCredential) : null;
+}
+
+// Mutual exclusion with pi's own credential writes: use the same library
+// (proper-lockfile) on the same file pi's FileAuthStorageBackend locks, with
+// the same options. The shared implementation keeps the lock mtime fresh
+// while held, recovers stale locks from crashed processes, and retries for
+// ~40s so a live holder running a slow network refresh inside the lock is
+// waited out.
+async function acquireAuthFileLock(authPath: string): Promise<() => Promise<void>> {
+  return acquireFileLock(authPath, {
+    realpath: false,
+    stale: 30_000,
+    retries: { retries: 10, factor: 2, minTimeout: 100, maxTimeout: 10_000, randomize: true },
+  });
+}
+
+async function writeStoredCredential(
+  providerId: string,
+  credential: StoredOAuthCredential,
+): Promise<void> {
+  const AuthStorage = piAgentRuntime.AuthStorage;
+  if (AuthStorage) {
+    AuthStorage.create().set(providerId, credential);
+    return;
+  }
+  // pi >=0.80.8: no exported write path, so do a locked read-modify-write of
+  // auth.json in pi's on-disk format (indent 2). The read happens inside the
+  // lock so concurrent updates from other processes are never clobbered, and
+  // the explicit chmod covers pre-existing files (writeFileSync's mode only
+  // applies on creation).
+  const authPath = join(piAgentRuntime.getAgentDir(), "auth.json");
+  const release = await acquireAuthFileLock(authPath);
+  try {
+    let data: Record<string, unknown> = {};
+    try {
+      data = JSON.parse(readFileSync(authPath, "utf-8"));
+    } catch {
+      // Missing or unreadable auth.json — start from an empty store.
+    }
+    data[providerId] = credential;
+    writeFileSync(authPath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 0o600 });
+    chmodSync(authPath, 0o600);
+  } finally {
+    await release();
+  }
+}
 
 import { CLIENT_ID, PROVIDER_ID, RETRYABLE_REFRESH_STATUSES, getOAuthHost } from "./constants.ts";
 import { getCommonHeaders } from "./device.ts";
@@ -120,6 +201,7 @@ export async function requestDeviceToken(
 
 interface RefreshAccessTokenOptions {
   maxRetries?: number;
+  signal?: AbortSignal;
   sleep?: (ms: number) => Promise<void>;
 }
 
@@ -133,8 +215,20 @@ export class KimiLoginRequiredError extends Error {
   }
 }
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  if (!signal) return new Promise((resolve) => setTimeout(resolve, ms));
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      clearTimeout(timeout);
+      reject(signal.reason);
+    };
+    const timeout = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
 }
 
 export async function refreshAccessToken(
@@ -142,11 +236,12 @@ export async function refreshAccessToken(
   options: RefreshAccessTokenOptions = {},
 ): Promise<TokenResponse> {
   const maxRetries = options.maxRetries ?? 3;
-  const wait = options.sleep ?? sleep;
+  const wait = options.sleep ?? ((ms: number) => sleep(ms, options.signal));
   let lastError: unknown;
 
   for (let attempt = 0; attempt < maxRetries; attempt++) {
     try {
+      options.signal?.throwIfAborted();
       const response = await fetch(`${getOAuthHost()}/api/oauth/token`, {
         method: "POST",
         headers: {
@@ -158,6 +253,7 @@ export async function refreshAccessToken(
           grant_type: "refresh_token",
           refresh_token: refreshToken,
         }),
+        signal: options.signal,
       });
 
       if (!response.ok) {
@@ -185,6 +281,7 @@ export async function refreshAccessToken(
 
       return data;
     } catch (error) {
+      if (options.signal?.aborted) throw options.signal.reason;
       lastError = error;
       const message = error instanceof Error ? error.message : String(error);
       if (error instanceof KimiLoginRequiredError) throw error;
@@ -408,8 +505,8 @@ export async function refreshKimiCodeToken(
 // `expires` is in the past. If the server rotates/revokes the access token
 // before that (common with short-lived session tokens), every request keeps
 // returning 401. The streaming handler invokes refreshKimiAuthToken on the
-// first auth error to force a refresh through AuthStorage (which persists the
-// new credentials under a file lock), and retry once.
+// first auth error to force a refresh and persist the new credentials, and
+// retry once.
 // =============================================================================
 
 export function getKimiApiKey(credentials: OAuthCredentials): string {
@@ -418,6 +515,11 @@ export function getKimiApiKey(credentials: OAuthCredentials): string {
 
 export function isKimiAuthErrorMessage(message: unknown): boolean {
   const text = String(message ?? "").toLowerCase();
+  const isMembershipPermissionError =
+    text.includes("current subscription does not have access to k3") ||
+    text.includes("current plan supports only kimi-k3 up to 256k context") ||
+    text.includes("current subscription does not have access to kimi-for-coding-highspeed");
+  if (isMembershipPermissionError) return false;
   return (
     /\b401\b/.test(text) ||
     text.includes("unauthorized") ||
@@ -426,12 +528,13 @@ export function isKimiAuthErrorMessage(message: unknown): boolean {
   );
 }
 
-export async function refreshKimiAuthToken(currentKey: string): Promise<string | null> {
+export async function refreshKimiAuthToken(
+  currentKey: string,
+  options: { signal?: AbortSignal } = {},
+): Promise<string | null> {
   try {
     const kimiCred = readKimiCliCredentials();
-    const storage = AuthStorage.create();
-    const piCred = storage.get(PROVIDER_ID);
-    const piOAuth = piCred?.type === "oauth" ? piCred : null;
+    const piOAuth = readStoredOAuthCredential(PROVIDER_ID);
 
     if (piOAuth) {
       if (piOAuth.access !== currentKey && Date.now() < piOAuth.expires) {
@@ -442,35 +545,35 @@ export async function refreshKimiAuthToken(currentKey: string): Promise<string |
       console.error("[kimi-coding] auth refresh: requesting new access token");
       let refreshed: Awaited<ReturnType<typeof refreshAccessToken>>;
       try {
-        refreshed = await refreshAccessToken(piOAuth.refresh);
+        refreshed = await refreshAccessToken(piOAuth.refresh, { signal: options.signal });
       } catch (error) {
         if (!kimiCred?.refresh_token || kimiCred.refresh_token === piOAuth.refresh) throw error;
         const kimiExpiresMs = (kimiCred.expires_at ?? 0) * 1000;
         if (kimiCred.access_token !== currentKey && Date.now() < kimiExpiresMs) {
-          const recovered: OAuthCredential = {
+          const recovered: StoredOAuthCredential = {
             ...piOAuth,
             type: "oauth",
             access: kimiCred.access_token!,
             refresh: kimiCred.refresh_token,
             expires: kimiExpiresMs,
           };
-          storage.set(PROVIDER_ID, recovered);
+          await writeStoredCredential(PROVIDER_ID, recovered);
           console.error("[kimi-coding] auth refresh: recovered newer kimi-code token");
           return recovered.access;
         }
         console.error("[kimi-coding] auth refresh: pi token rejected, trying kimi-code token");
-        refreshed = await refreshAccessToken(kimiCred.refresh_token);
+        refreshed = await refreshAccessToken(kimiCred.refresh_token, { signal: options.signal });
       }
 
       const newExpiresMs = Date.now() + refreshed.expires_in * 1000;
-      const newCred: OAuthCredential = {
+      const newCred: StoredOAuthCredential = {
         ...piOAuth,
         type: "oauth",
         access: refreshed.access_token,
         refresh: refreshed.refresh_token,
         expires: newExpiresMs,
       };
-      storage.set(PROVIDER_ID, newCred);
+      await writeStoredCredential(PROVIDER_ID, newCred);
       writeKimiCodeCredentials(refreshed.access_token, refreshed.refresh_token, newExpiresMs);
       console.error("[kimi-coding] auth refresh: new token persisted");
       return newCred.access;
@@ -490,12 +593,15 @@ export async function refreshKimiAuthToken(currentKey: string): Promise<string |
     }
 
     console.error("[kimi-coding] auth refresh: requesting new access token via kimi-code");
-    const refreshed = await refreshAccessToken(kimiCred.refresh_token!);
+    const refreshed = await refreshAccessToken(kimiCred.refresh_token!, {
+      signal: options.signal,
+    });
     const newExpiresMs = Date.now() + refreshed.expires_in * 1000;
     writeKimiCodeCredentials(refreshed.access_token, refreshed.refresh_token, newExpiresMs);
     console.error("[kimi-coding] auth refresh: new token persisted to kimi-code");
     return refreshed.access_token;
   } catch (err) {
+    if (options.signal?.aborted) return null;
     if (err instanceof KimiLoginRequiredError) {
       console.error(`[kimi-coding] ${KIMI_LOGIN_REQUIRED_MESSAGE}`);
     } else {

package/src/payload.ts

@@ -488,6 +488,28 @@ export async function applyKimiPayloadMutations(
     }
   }
 
+  // Preserved-thinking Kimi endpoints require every replayed assistant turn to
+  // carry reasoning_content, including turns whose reasoning delta was empty.
+  // pi-ai drops empty thinking blocks while building Chat Completions history,
+  // so restore the explicit empty field after the final thinking mode is known.
+  if (
+    ctx.api === "openai-completions" &&
+    isRecord(payload.thinking) &&
+    payload.thinking.type !== "disabled" &&
+    payload.thinking.keep === "all" &&
+    Array.isArray(payload.messages)
+  ) {
+    for (const message of payload.messages) {
+      if (
+        isRecord(message) &&
+        message.role === "assistant" &&
+        message.reasoning_content === undefined
+      ) {
+        message.reasoning_content = "";
+      }
+    }
+  }
+
   // 8. K2.7 Code API constraints: the server rejects non-default values for
   //    temperature (must be 1.0) and top_p (must be 0.95), and tool_choice
   //    "required" / function-specific when thinking is enabled (always-on).

package/src/stream.ts

@@ -12,11 +12,46 @@ import type {
   Model,
   SimpleStreamOptions,
 } from "@earendil-works/pi-ai";
-import {
-  createAssistantMessageEventStream,
-  streamSimpleAnthropic,
-  streamSimpleOpenAICompletions,
-} from "@earendil-works/pi-ai";
+import * as piAi from "@earendil-works/pi-ai";
+import { createAssistantMessageEventStream } from "@earendil-works/pi-ai";
+
+type KimiStreamSimple = (
+  model: Model<Api>,
+  context: Context,
+  options?: SimpleStreamOptions,
+) => AssistantMessageEventStream;
+
+// pi 0.80.8 unexported the global streamSimple* functions. Depending on how
+// this module is loaded, the pi-ai root now offers one of three shapes:
+//   - pi extension loader (jiti/Bun): root aliases to the compat entrypoint,
+//     which exposes lazy per-API factories (anthropicMessagesApi et al.)
+//   - pi <=0.79: root only has the legacy streamSimple* globals
+//   - plain Node with pi-ai >=0.80.8 (tests, SDK use): root has neither, but
+//     lazyApi + a dynamic subpath import reaches the same implementation
+// Detect whichever shape is present so the extension loads in all three.
+const piAiRuntime = piAi as unknown as {
+  anthropicMessagesApi?: () => { streamSimple: KimiStreamSimple };
+  openAICompletionsApi?: () => { streamSimple: KimiStreamSimple };
+  streamSimpleAnthropic?: KimiStreamSimple;
+  streamSimpleOpenAICompletions?: KimiStreamSimple;
+  lazyApi?: (load: () => Promise<object>) => { streamSimple: KimiStreamSimple };
+};
+
+// The ./api/* subpath exports only exist on pi-ai >=0.80.8, so a literal
+// specifier would fail type resolution against older pi-ai. Computed
+// specifiers keep the imports invisible to TypeScript; they are only ever
+// evaluated in plain-Node environments where the subpaths do resolve.
+const anthropicMessagesModule = "@earendil-works/pi-ai/api/anthropic-messages";
+const openAICompletionsModule = "@earendil-works/pi-ai/api/openai-completions";
+
+const streamSimpleAnthropic: KimiStreamSimple =
+  piAiRuntime.anthropicMessagesApi?.().streamSimple ??
+  piAiRuntime.streamSimpleAnthropic ??
+  piAiRuntime.lazyApi?.(() => import(anthropicMessagesModule)).streamSimple!;
+const streamSimpleOpenAICompletions: KimiStreamSimple =
+  piAiRuntime.openAICompletionsApi?.().streamSimple ??
+  piAiRuntime.streamSimpleOpenAICompletions ??
+  piAiRuntime.lazyApi?.(() => import(openAICompletionsModule)).streamSimple!;
 import {
   DEFAULT_KIMI_CODE_CONFIG,
   type KimiCodeConfig,
@@ -162,7 +197,16 @@ export function resolveKimiApiKey(apiKey: string | undefined): string {
   return apiKey || process.env.KIMI_API_KEY || "";
 }
 
-export function mergeKimiRequestHeaders(headers?: Record<string, string>): Record<string, string> {
+// SimpleStreamOptions.headers is Record<string, string> on pi <=0.79 and
+// ProviderHeaders (Record<string, string | null>, null = suppress the header
+// when pi-ai assembles the request) on >=0.80.8. Accept and preserve both
+// shapes; defined locally because ProviderHeaders is not exported on old pi.
+type HeaderMap = Record<string, string | null>;
+
+export function mergeKimiRequestHeaders(headers?: HeaderMap): HeaderMap {
+  // Caller values override our Kimi defaults. Nulls are retained rather than
+  // deleted so the suppression semantics reach pi-ai, which strips null
+  // entries (including its own defaults) when building the request.
   return { ...getKimiProviderHeaders(), ...headers };
 }
 
@@ -231,7 +275,9 @@ export function streamSimpleKimi(
     return {
       ...options,
       ...apiKeyOverride,
-      headers: mergeKimiRequestHeaders(options?.headers),
+      // Cast to whatever headers shape the installed pi-ai declares:
+      // Record<string, string> on pi <=0.79, ProviderHeaders on >=0.80.8.
+      headers: mergeKimiRequestHeaders(options?.headers) as SimpleStreamOptions["headers"],
       onPayload: async (payload, modelData) => {
         let nextPayload: unknown = payload;
 

package/src/tools/common.ts

@@ -1,9 +1,13 @@
-import { AuthStorage, type AgentToolResult } from "@earendil-works/pi-coding-agent";
+import type { AgentToolResult } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth } from "@earendil-works/pi-tui";
 
 import { PROVIDER_ID, getBaseUrl } from "../constants.ts";
 import { getKimiProviderHeaders } from "../device.ts";
-import { KIMI_LOGIN_REQUIRED_MESSAGE, refreshKimiAuthToken } from "../oauth.ts";
+import {
+  KIMI_LOGIN_REQUIRED_MESSAGE,
+  readStoredOAuthCredential,
+  refreshKimiAuthToken,
+} from "../oauth.ts";
 
 export const KIMI_TOOL_TIMEOUT_MS = 180_000;
 
@@ -19,9 +23,7 @@ export interface BuildKimiToolOptions {
 }
 
 function defaultGetAccessToken(): string | null {
-  const credential = AuthStorage.create().get(PROVIDER_ID);
-  if (!credential || credential.type !== "oauth") return null;
-  return credential.access;
+  return readStoredOAuthCredential(PROVIDER_ID)?.access ?? null;
 }
 
 export function buildKimiToolDeps(options: BuildKimiToolOptions = {}): KimiToolDeps {

package/src/usage.ts

@@ -1,8 +1,6 @@
-import { AuthStorage } from "@earendil-works/pi-coding-agent";
-
 import { PROVIDER_ID, getBaseUrl } from "./constants.ts";
 import { getKimiProviderHeaders } from "./device.ts";
-import { refreshKimiAuthToken } from "./oauth.ts";
+import { readStoredOAuthCredential, refreshKimiAuthToken } from "./oauth.ts";
 
 const MEMBERSHIP_LEVEL_NAMES: Record<string, string> = {
   LEVEL_FREE: "Free",
@@ -36,6 +34,11 @@ export interface UsageFormatOptions {
   timeZone?: string;
 }
 
+export interface KimiUsageSnapshot {
+  summary: string;
+  membershipLevel: string | null;
+}
+
 interface BoosterWalletInfo {
   balanceCents: bigint;
   monthlyChargeLimitEnabled: boolean;
@@ -47,8 +50,8 @@ interface BoosterWalletInfo {
 const FIXED_POINT_CENTS = 1_000_000n;
 
 export function getKimiUsageToken(): string | null {
-  const credential = AuthStorage.create().get(PROVIDER_ID);
-  if (credential?.type === "oauth" && credential.access) return credential.access;
+  const credential = readStoredOAuthCredential(PROVIDER_ID);
+  if (credential?.access) return credential.access;
   const apiKey = process.env.KIMI_API_KEY?.trim();
   return apiKey || null;
 }
@@ -232,7 +235,7 @@ function formatWindowLabel(value: unknown, fallbackLabel: string): string {
   return `Current ${minutes}m window`;
 }
 
-export function parseMembership(record: Record<string, unknown>): string | null {
+export function parseMembershipLevel(record: Record<string, unknown>): string | null {
   const user = record.user;
   if (typeof user !== "object" || user === null || Array.isArray(user)) return null;
   const membership = (user as Record<string, unknown>).membership;
@@ -240,7 +243,12 @@ export function parseMembership(record: Record<string, unknown>): string | null
     return null;
   }
   const level = (membership as Record<string, unknown>).level;
-  if (typeof level !== "string" || !level) return null;
+  return typeof level === "string" && level ? level : null;
+}
+
+export function parseMembership(record: Record<string, unknown>): string | null {
+  const level = parseMembershipLevel(record);
+  if (!level) return null;
   const name = MEMBERSHIP_LEVEL_NAMES[level];
   return name ? `Membership: ${name} (${level})` : `Membership: ${level}`;
 }
@@ -343,24 +351,42 @@ function fetchKimiUsage(token: string, signal: AbortSignal): Promise<Response> {
   });
 }
 
-export async function fetchKimiUsageSummary(): Promise<string> {
-  const token = getKimiUsageToken();
-  if (!token) return "Usage: missing credentials. Run /login kimi-coding.";
+export async function fetchKimiUsageSnapshot(
+  options: { timeoutMs?: number; token?: string; refreshOnUnauthorized?: boolean } = {},
+): Promise<KimiUsageSnapshot> {
+  const token = options.token ?? getKimiUsageToken();
+  if (!token) {
+    return {
+      summary: "Usage: missing credentials. Run /login kimi-coding.",
+      membershipLevel: null,
+    };
+  }
 
   const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 15_000);
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 15_000);
   try {
     let response = await fetchKimiUsage(token, controller.signal);
-    if (response.status === 401) {
-      const refreshed = await refreshKimiAuthToken(token);
+    if (response.status === 401 && options.refreshOnUnauthorized !== false) {
+      const refreshed = await refreshKimiAuthToken(token, { signal: controller.signal });
       if (refreshed) response = await fetchKimiUsage(refreshed, controller.signal);
     }
-    if (!response.ok) return `Usage: fetch failed (${response.status})`;
-    return parseUsageSummary(await response.json());
+    if (!response.ok) {
+      return { summary: `Usage: fetch failed (${response.status})`, membershipLevel: null };
+    }
+    const payload = (await response.json()) as unknown;
+    const membershipLevel =
+      typeof payload === "object" && payload !== null && !Array.isArray(payload)
+        ? parseMembershipLevel(payload as Record<string, unknown>)
+        : null;
+    return { summary: parseUsageSummary(payload), membershipLevel };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    return `Usage: fetch failed (${message})`;
+    return { summary: `Usage: fetch failed (${message})`, membershipLevel: null };
   } finally {
     clearTimeout(timeout);
   }
 }
+
+export async function fetchKimiUsageSummary(): Promise<string> {
+  return (await fetchKimiUsageSnapshot()).summary;
+}