pi-provider-kimi-code 0.6.6 → 0.6.8

package/README.md

@@ -7,7 +7,7 @@
 
 Pi already has a basic `kimi-coding` provider. This extension is for the parts that start to matter once Kimi Code becomes part of your real Pi workflow: account login reuse, file uploads, tool schema compatibility, live model metadata, measured cache behavior, and API-tested parameter handling.
 
-> **Kimi K3 supported.** The provider combines Kimi's live `/v1/models` catalog with your membership level from `/usages`, exposing only eligible models and advertising the correct K3 context limit. It refreshes this metadata at startup and through `/kimi-settings`; OAuth login and token refresh also update the model catalog.
+> **Kimi K3 supported.** The provider reads Kimi's live `/v1/models` catalog as the source of truth for model availability and context limits. It refreshes the catalog at startup and through `/kimi-settings`; OAuth login and token refresh also update it.
 
 ## Why this exists
 
@@ -28,7 +28,7 @@ Kimi's API surface goes beyond the LLM itself. It includes file uploads, web sea
 - Kimi account login in Pi, plus `KIMI_API_KEY` for CI or pay-per-token use.
 - `kimi-code` credential reuse from `~/.kimi-code/credentials/kimi-code.json`, with read-only support for the legacy `~/.kimi` path.
 - Kimi Files API uploads for large inline images.
-- Live model metadata combined with membership-aware K3 and HighSpeed availability.
+- Live model metadata from Kimi's official catalog, including server-advertised model availability and context limits.
 - OpenAI-compatible mode by default, Anthropic-compatible mode on request.
 - K2.7 and K3 reasoning level mapping for Pi's reasoning controls.
 - Tool schema dedup to stay under Moonshot's 15 KB per-tool-schema limit.
@@ -108,15 +108,15 @@ KIMI_API_KEY=sk-... pi
 
 ## Models
 
-This provider publishes three Pi model IDs:
+The official catalog determines the models this provider publishes. The following IDs are the fallback set when catalog discovery is unavailable:
 
-| Pi model ID                             | Upstream model           | Access                                                 |
-| --------------------------------------- | ------------------------ | ------------------------------------------------------ |
-| `kimi-coding/kimi-for-coding`           | Kimi K2.7 Code           | All Kimi Code members                                  |
-| `kimi-coding/kimi-for-coding-highspeed` | Kimi K2.7 Code HighSpeed | Allegretto and above                                   |
-| `kimi-coding/k3`                        | Kimi K3                  | Moderato: 256K context; Allegretto and above: up to 1M |
+| Pi model ID                             | Default name             | Availability and context |
+| --------------------------------------- | ------------------------ | ------------------------ |
+| `kimi-coding/kimi-for-coding`           | Kimi K2.7 Code           | Official catalog         |
+| `kimi-coding/kimi-for-coding-highspeed` | Kimi K2.7 Code HighSpeed | Official catalog         |
+| `kimi-coding/k3`                        | Kimi K3                  | Official catalog         |
 
-Plans below Moderato cannot use K3. The provider reads the current membership level from `/usages` and combines it with `/models`: server catalog availability remains authoritative, while known plan limits can only hide unavailable selections or lower K3's advertised context window. Unknown or unavailable membership data falls back to the server catalog instead of guessing.
+Kimi's official catalog at `https://api.kimi.com/coding/v1/models` is authoritative for model availability and context windows. When discovery is unavailable, the extension uses the fallback models and defaults below.
 
 Select a model inside Pi:
 
@@ -126,7 +126,7 @@ Select a model inside Pi:
 /model kimi-coding/k3
 ```
 
-Kimi keeps Coding models behind aliases. Rather than hardcoding a stale model list, this extension asks Kimi for the current model info when you log in or refresh. If your account is on a newer rollout (e.g., Kimi K2.7) or internal test, Pi can pick up the latest model name and context size without waiting for a package release.
+Kimi keeps Coding models behind aliases. Rather than hardcoding a stale model list, this extension reads the official catalog at startup, when credentials change, and through `/kimi-settings`. If your account is on a newer rollout (e.g., Kimi K2.7) or internal test, Pi can pick up the latest model IDs, names, and context sizes without waiting for a package release.
 
 Fallback values:
 
@@ -135,7 +135,7 @@ Fallback values:
 - Input: text and image
 - Reasoning: enabled
 
-The provider maps Pi's reasoning levels to Kimi's top-level `thinking` parameter. K3 currently advertises only `max`; `max` and `xhigh` map to `max`, `high` and `medium` map to `high`, and `low` and `minimal` map to `low`. It sends `thinking.effort` only when `/models` advertises the mapped value. The mapping refreshes automatically on credential refresh. Opening `/kimi-settings` also re-discovers the latest model and membership metadata.
+The provider maps Pi's reasoning levels to Kimi's top-level `thinking` parameter. It sends `thinking.effort` only when the official catalog advertises the mapped value. The mapping refreshes automatically on credential refresh. Opening `/kimi-settings` also re-discovers the latest model metadata.
 
 Switching models or thinking effort invalidates Kimi's existing context cache. Start a new session when switching to avoid re-prefilling a long conversation and consuming extra quota.
 

package/index.ts

@@ -42,7 +42,6 @@ import { PROVIDER_ID, PROVIDER_VERSION, getBaseUrl, getKimiApiType } from "./src
 import {
   type KimiOAuthCredentials,
   type KimiOAuthExtras,
-  applyKimiMembershipLimitsToModel,
   buildKimiModelFromConfig,
   applyKimiOAuthExtrasToModel,
   KIMI_CODING_HIGHSPEED_MODEL_ID,
@@ -51,7 +50,7 @@ import {
   KIMI_MODEL_CATALOG_VERSION,
   discoverKimiModelMetadata,
   getKimiModelMetadata,
-  isKimiModelAvailableForMembership,
+  hasKimiModelMetadata,
   resolveKimiModelConfig,
 } from "./src/models.ts";
 import { getKimiApiKey, loginKimiCode, refreshKimiCodeToken } from "./src/oauth.ts";
@@ -71,7 +70,6 @@ interface KimiRuntimeState {
   cwd: string;
   config: KimiCodeConfig;
   modelExtras: KimiOAuthExtras;
-  membershipLevel: string | null;
   projectTrusted: boolean;
   overrides?: KimiCodeConfigPatch;
 }
@@ -167,10 +165,7 @@ async function openSettingsMenu(
   if (!modelsRefreshed && refreshedToken && refreshedToken !== modelDiscoveryToken) {
     modelsRefreshed = await refreshModelExtras(state);
   }
-  const refreshedMembershipLevel = usageSnapshot.membershipLevel ?? state.membershipLevel;
-  const membershipChanged = state.membershipLevel !== refreshedMembershipLevel;
-  state.membershipLevel = refreshedMembershipLevel;
-  if (modelsRefreshed || membershipChanged) registerKimiProvider(pi, state);
+  if (modelsRefreshed) registerKimiProvider(pi, state);
   const usage = usageSnapshot.summary;
 
   const projectTrusted = await isKimiProjectConfigApproved(ctx, ctx.cwd);
@@ -382,74 +377,48 @@ function saveScopeKimiCodeConfig(
 function filterAvailableKimiModels<T extends { id: string }>(
   models: T[],
   extras: KimiOAuthExtras,
-  membershipLevel: string | null,
 ): T[] {
   const available =
     extras.modelCatalogVersion === KIMI_MODEL_CATALOG_VERSION && extras.modelCatalog
       ? new Set(Object.keys(extras.modelCatalog))
       : null;
-  return models.filter(
-    (model) =>
-      (!available || available.has(model.id)) &&
-      isKimiModelAvailableForMembership(model.id, membershipLevel) !== false,
-  );
+  return models.filter((model) => !available || available.has(model.id));
 }
 
-function registerKimiProvider(pi: ExtensionAPI, state: KimiRuntimeState): void {
-  const standardModel = applyKimiMembershipLimitsToModel(
-    applyKimiOAuthExtrasToModel(
-      buildKimiModelFromConfig(state.config.model),
-      getKimiModelMetadata(state.modelExtras, KIMI_CODING_MODEL_ID),
-    ),
-    state.membershipLevel,
-  );
-  const highSpeedModel = applyKimiMembershipLimitsToModel(
-    applyKimiOAuthExtrasToModel(
-      buildKimiModelFromConfig(state.config.model, KIMI_CODING_HIGHSPEED_MODEL_ID),
-      getKimiModelMetadata(state.modelExtras, KIMI_CODING_HIGHSPEED_MODEL_ID),
-    ),
-    state.membershipLevel,
-  );
-  const k3Model = applyKimiMembershipLimitsToModel(
+function catalogModelIds(extras: KimiOAuthExtras): string[] {
+  if (extras.modelCatalogVersion === KIMI_MODEL_CATALOG_VERSION && extras.modelCatalog) {
+    return Object.keys(extras.modelCatalog);
+  }
+  return [KIMI_CODING_MODEL_ID, KIMI_CODING_HIGHSPEED_MODEL_ID, KIMI_K3_MODEL_ID];
+}
+
+function buildKimiCatalogModels(state: KimiRuntimeState) {
+  return catalogModelIds(state.modelExtras).map((modelId) =>
     applyKimiOAuthExtrasToModel(
-      buildKimiModelFromConfig(state.config.model, KIMI_K3_MODEL_ID),
-      getKimiModelMetadata(state.modelExtras, KIMI_K3_MODEL_ID),
+      buildKimiModelFromConfig(state.config.model, modelId),
+      getKimiModelMetadata(state.modelExtras, modelId),
+      state.config.model.reasoningMap,
     ),
-    state.membershipLevel,
   );
+}
 
+function registerKimiProvider(pi: ExtensionAPI, state: KimiRuntimeState): void {
   pi.registerProvider(PROVIDER_ID, {
     baseUrl: getBaseUrl(state.config.protocol),
     apiKey: "$KIMI_API_KEY",
     api: getKimiApiType(state.config.protocol),
     streamSimple: streamSimpleKimi,
 
-    models: filterAvailableKimiModels(
-      [standardModel, highSpeedModel, k3Model],
-      state.modelExtras,
-      state.membershipLevel,
-    ),
+    models: filterAvailableKimiModels(buildKimiCatalogModels(state), state.modelExtras),
 
     oauth: {
       name: "Kimi Code (OAuth)",
       login: async (callbacks) => {
         const credentials = await loginKimiCode(callbacks);
-        const usage = await fetchKimiUsageSnapshot({
-          timeoutMs: 2500,
-          token: credentials.access,
-          refreshOnUnauthorized: false,
-        });
-        state.membershipLevel = usage.membershipLevel;
         return credentials;
       },
       refreshToken: async (credentials) => {
         const refreshed = await refreshKimiCodeToken(credentials);
-        const usage = await fetchKimiUsageSnapshot({
-          timeoutMs: 2500,
-          token: refreshed.access,
-          refreshOnUnauthorized: false,
-        });
-        state.membershipLevel = usage.membershipLevel;
         return refreshed;
       },
       getApiKey: getKimiApiKey,
@@ -460,27 +429,53 @@ function registerKimiProvider(pi: ExtensionAPI, state: KimiRuntimeState): void {
       // request payload by streamSimpleKimi.
       modifyModels: (models, cred) => {
         const extras = cred as KimiOAuthCredentials;
-        state.modelExtras = extras;
+        // Retain previously discovered extras when this credential carries
+        // none (legacy format or failed discovery): applying empty metadata
+        // would strip thinking levels the startup discovery already found.
+        if (hasKimiModelMetadata(extras)) state.modelExtras = extras;
         reloadEffectiveKimiRuntimeConfig(state, state.cwd, state.projectTrusted);
         const available =
           extras.modelCatalogVersion === KIMI_MODEL_CATALOG_VERSION && extras.modelCatalog
             ? new Set(Object.keys(extras.modelCatalog))
             : null;
-        return models
-          .filter(
-            (model) =>
-              model.provider !== PROVIDER_ID ||
-              ((!available || available.has(model.id)) &&
-                isKimiModelAvailableForMembership(model.id, state.membershipLevel) !== false),
-          )
-          .map((model) =>
-            model.provider === PROVIDER_ID
-              ? applyKimiMembershipLimitsToModel(
-                  applyKimiOAuthExtrasToModel(model, getKimiModelMetadata(extras, model.id)),
-                  state.membershipLevel,
-                )
-              : model,
+        if (!available) {
+          return [
+            ...models.filter((model) => model.provider !== PROVIDER_ID),
+            ...models
+              .filter((model) => model.provider === PROVIDER_ID)
+              .map((model) => {
+                const metadata = getKimiModelMetadata(extras, model.id);
+                if (!hasKimiModelMetadata(metadata)) return model;
+                return applyKimiOAuthExtrasToModel(
+                  model,
+                  metadata,
+                  state.config.model.reasoningMap,
+                );
+              }),
+          ];
+        }
+        const catalogModels = catalogModelIds(extras).map((modelId) => {
+          const existing = models.find(
+            (model) => model.provider === PROVIDER_ID && model.id === modelId,
+          );
+          return applyKimiOAuthExtrasToModel(
+            existing ?? {
+              ...buildKimiModelFromConfig(state.config.model, modelId),
+              api: getKimiApiType(state.config.protocol),
+              provider: PROVIDER_ID,
+              baseUrl: getBaseUrl(state.config.protocol),
+            },
+            getKimiModelMetadata(extras, modelId),
+            state.config.model.reasoningMap,
           );
+        });
+        let insertedCatalog = false;
+        return models.flatMap((model) => {
+          if (model.provider !== PROVIDER_ID) return [model];
+          if (insertedCatalog) return [];
+          insertedCatalog = true;
+          return catalogModels;
+        });
       },
     },
   });
@@ -494,10 +489,9 @@ export function KimiCode(overrides?: KimiCodeConfigPatch): ExtensionFactory {
       overrides,
     );
     const discoveryToken = getKimiUsageToken();
-    const [initialDiscovery, usageSnapshot] = await Promise.all([
-      discoveryToken ? discoverKimiModelMetadata(discoveryToken, config.protocol) : {},
-      fetchKimiUsageSnapshot({ timeoutMs: 2500 }),
-    ]);
+    const initialDiscovery = discoveryToken
+      ? await discoverKimiModelMetadata(discoveryToken, config.protocol)
+      : {};
     let discovered = initialDiscovery;
     const refreshedToken = getKimiUsageToken();
     if (
@@ -511,7 +505,6 @@ export function KimiCode(overrides?: KimiCodeConfigPatch): ExtensionFactory {
       cwd,
       config,
       modelExtras: discovered,
-      membershipLevel: usageSnapshot.membershipLevel,
       projectTrusted: false,
       overrides,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-kimi-code",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "Use Kimi Code in Pi without losing the Kimi-specific bits",
   "keywords": [
     "ai-provider",
@@ -49,12 +49,16 @@
     "format:check": "oxfmt . --check",
     "pre-commit": "prek run"
   },
+  "dependencies": {
+    "proper-lockfile": "^4.1.2"
+  },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.79.10",
-    "@earendil-works/pi-coding-agent": "^0.79.10",
-    "@earendil-works/pi-tui": "^0.79.10",
+    "@earendil-works/pi-ai": "^0.80.9",
+    "@earendil-works/pi-coding-agent": "^0.80.9",
+    "@earendil-works/pi-tui": "^0.80.9",
     "@j178/prek": "^0.4.4",
     "@types/node": "^24.0.0",
+    "@types/proper-lockfile": "^4.1.4",
     "oxfmt": "^0.44.0",
     "oxlint": "^1.59.0",
     "typescript": "^5.9.0"

package/src/constants.ts

@@ -41,12 +41,12 @@ export function getDefaultBaseUrl(protocol: KimiWireProtocol): string {
 
 export const DEFAULT_BASE_URL = getDefaultBaseUrl(ENV_KIMI_CODE_PROTOCOL);
 
-export const PROVIDER_VERSION = "0.6.6";
+export const PROVIDER_VERSION = "0.6.8";
 
 // Upstream kimi-code CLI version — used in User-Agent and X-Msh-Version
 // headers to match the official client's identity. Update this when
 // syncing with https://github.com/MoonshotAI/kimi-code.
-export const KIMI_UPSTREAM_VERSION = "0.26.0";
+export const KIMI_UPSTREAM_VERSION = "0.28.0";
 export const KIMI_CODE_USER_AGENT = `kimi-code-cli/${KIMI_UPSTREAM_VERSION}`;
 export const KIMI_PLATFORM = "kimi_code_cli";
 

package/src/models.ts

@@ -1,8 +1,13 @@
 // Model identity: discovery against the server's /v1/models endpoint, plus the
 // extras-merging helpers used by both registration and the OAuth modifyModels hook.
 
-import type { Api, Model, OAuthCredentials } from "@earendil-works/pi-ai";
-import type { KimiInputModality, KimiResolvedModelConfig, ModelConfig } from "./config.ts";
+import type { Api, Model, OAuthCredentials, ThinkingLevelMap } from "@earendil-works/pi-ai";
+import type {
+  KimiInputModality,
+  KimiResolvedModelConfig,
+  ModelConfig,
+  ModelReasoningMap,
+} from "./config.ts";
 
 import { type KimiWireProtocol, getBaseUrl } from "./constants.ts";
 import { getKimiProviderHeaders } from "./device.ts";
@@ -50,62 +55,33 @@ function mergeInputModalities(
   return (["text", "image", "video"] as const).filter((modality) => next.has(modality));
 }
 
-// Pricing per million tokens in USD (CNY converted at ~7.25).
-// Source: https://platform.kimi.com/docs/pricing/chat-k27-code
-const COST_STANDARD = { input: 0.897, output: 3.724, cacheRead: 0.179, cacheWrite: 0.897 };
-const COST_HIGH_SPEED = { input: 1.793, output: 7.448, cacheRead: 0.359, cacheWrite: 1.793 };
+// Pricing per million tokens in USD.
+// Sources: https://www.kimi.com/resources/kimi-k2-7-code-pricing
+//          https://www.kimi.com/resources/kimi-k3-pricing
+const COST_STANDARD = { input: 0.95, output: 4, cacheRead: 0.19, cacheWrite: 0.95 };
+const COST_HIGH_SPEED = { input: 1.9, output: 8, cacheRead: 0.38, cacheWrite: 1.9 };
+const COST_K3 = { input: 3, output: 15, cacheRead: 0.3, cacheWrite: 3 };
 
 export const KIMI_CODING_MODEL_ID = "kimi-for-coding";
 export const KIMI_CODING_HIGHSPEED_MODEL_ID = "kimi-for-coding-highspeed";
 export const KIMI_K3_MODEL_ID = "k3";
 export const KIMI_MODEL_CATALOG_VERSION = 1;
 
-const KIMI_K3_MODERATO_CONTEXT_WINDOW = 262144;
-const KIMI_MEMBERSHIP_RANK: Readonly<Record<string, number>> = {
-  LEVEL_FREE: 0,
-  LEVEL_BASIC: 1,
-  LEVEL_STANDARD: 2,
-  LEVEL_INTERMEDIATE: 3,
-  LEVEL_ADVANCED: 4,
-  LEVEL_PREMIUM: 5,
-};
-const KIMI_MODERATO_RANK = KIMI_MEMBERSHIP_RANK.LEVEL_STANDARD;
-const KIMI_ALLEGRETTO_RANK = KIMI_MEMBERSHIP_RANK.LEVEL_INTERMEDIATE;
-
-export function isKimiModelAvailableForMembership(
+function resolveModelCost(
   modelId: string,
-  membershipLevel: string | null | undefined,
-): boolean | undefined {
-  if (!membershipLevel) return undefined;
-  const rank = KIMI_MEMBERSHIP_RANK[membershipLevel];
-  if (rank === undefined) return undefined;
-  if (modelId === KIMI_K3_MODEL_ID) return rank >= KIMI_MODERATO_RANK;
-  if (modelId === KIMI_CODING_HIGHSPEED_MODEL_ID) return rank >= KIMI_ALLEGRETTO_RANK;
-  return true;
-}
-
-export function applyKimiMembershipLimitsToModel(
-  model: Model<Api>,
-  membershipLevel: string | null | undefined,
-): Model<Api> {
-  const rank = membershipLevel ? KIMI_MEMBERSHIP_RANK[membershipLevel] : undefined;
-  if (model.id !== KIMI_K3_MODEL_ID || rank === undefined || rank >= KIMI_ALLEGRETTO_RANK) {
-    return model;
-  }
-  return {
-    ...model,
-    contextWindow: Math.min(model.contextWindow, KIMI_K3_MODERATO_CONTEXT_WINDOW),
-  };
-}
-
-function resolveModelCost(modelDisplay: string | undefined): {
+  modelDisplay?: string,
+): {
   input: number;
   output: number;
   cacheRead: number;
   cacheWrite: number;
 } {
-  if (modelDisplay && /high\s*speed/i.test(modelDisplay)) return COST_HIGH_SPEED;
-  return COST_STANDARD;
+  if (modelId === KIMI_K3_MODEL_ID) return COST_K3;
+  if (modelId === KIMI_CODING_MODEL_ID) return COST_STANDARD;
+  if (modelId === KIMI_CODING_HIGHSPEED_MODEL_ID || /high\s*speed/i.test(modelDisplay ?? "")) {
+    return COST_HIGH_SPEED;
+  }
+  return { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
 }
 
 export function buildKimiModelFromConfig(
@@ -118,13 +94,15 @@ export function buildKimiModelFromConfig(
       ? "Kimi K3"
       : isHighSpeed
         ? "Kimi for Coding High Speed"
-        : "Kimi for Coding";
+        : modelId === KIMI_CODING_MODEL_ID
+          ? "Kimi for Coding"
+          : modelId;
   return {
     id: modelId,
     name,
     reasoning: config.reasoning,
     input: [...config.input] as unknown as ("text" | "image" | "video")[],
-    cost: { ...(isHighSpeed ? COST_HIGH_SPEED : COST_STANDARD) },
+    cost: { ...resolveModelCost(modelId) },
     contextWindow: config.contextWindow,
     maxTokens: config.maxTokens,
   } as Model<Api>;
@@ -226,18 +204,29 @@ function getModelsUrl(protocol?: KimiWireProtocol): string {
   return buildModelsUrl(getBaseUrl(protocol));
 }
 
+export function isOfficialKimiModelsUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    return parsed.origin === "https://api.kimi.com" && parsed.pathname === "/coding/v1/models";
+  } catch {
+    return false;
+  }
+}
+
 export async function discoverKimiModelMetadata(
   accessToken: string,
   protocol?: KimiWireProtocol,
   options: DiscoverKimiModelMetadataOptions = {},
 ): Promise<KimiOAuthExtras> {
   if (!accessToken) return {};
+  const modelsUrl = getModelsUrl(protocol);
+  if (!isOfficialKimiModelsUrl(modelsUrl)) return {};
   const timeoutMs = options.timeoutMs ?? DEFAULT_DISCOVERY_TIMEOUT_MS;
   const controller = new AbortController();
   const timeout =
     timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs).unref() : undefined;
   try {
-    const response = await fetch(getModelsUrl(protocol), {
+    const response = await fetch(modelsUrl, {
       signal: controller.signal,
       headers: {
         ...getKimiProviderHeaders(),
@@ -248,16 +237,10 @@ export async function discoverKimiModelMetadata(
     if (!response.ok) return {};
     const json = (await response.json()) as { data?: unknown };
     const list = Array.isArray(json.data) ? (json.data as KimiServerModel[]) : [];
-    const supportedIds = new Set([
-      KIMI_CODING_MODEL_ID,
-      KIMI_CODING_HIGHSPEED_MODEL_ID,
-      KIMI_K3_MODEL_ID,
-    ]);
     const modelCatalog: Record<string, KimiModelMetadata> = {};
     for (const model of list) {
-      if (typeof model.id !== "string" || !supportedIds.has(model.id)) continue;
       const metadata = parseKimiModelMetadata(model);
-      if (metadata) modelCatalog[model.id] = metadata;
+      if (metadata) modelCatalog[metadata.wireModelId!] = metadata;
     }
     const preferred = modelCatalog[KIMI_CODING_MODEL_ID];
     if (!preferred) {
@@ -279,9 +262,49 @@ export function getKimiModelMetadata(extras: KimiOAuthExtras, modelId: string):
   return modelId === KIMI_CODING_MODEL_ID ? extras : {};
 }
 
+const KIMI_DISCOVERY_KEYS = [
+  "wireModelId",
+  "modelDisplay",
+  "contextLength",
+  "supportsReasoning",
+  "supportsImageIn",
+  "supportsVideoIn",
+  "supportsThinkingType",
+  "protocol",
+  "supportEfforts",
+  "defaultEffort",
+  "modelCatalog",
+] as const;
+
+// Credentials always carry access/refresh/expires, so discovery presence must
+// be checked on the metadata fields themselves. Empty means either a legacy
+// pre-discovery credential or a failed discovery during login/refresh.
+export function hasKimiModelMetadata(extras: KimiOAuthExtras): boolean {
+  return KIMI_DISCOVERY_KEYS.some((key) => extras[key] !== undefined);
+}
+
+export function buildKimiThinkingLevelMap(
+  reasoningMap: ModelReasoningMap,
+  extras: Pick<KimiModelMetadata, "supportEfforts" | "supportsThinkingType">,
+): ThinkingLevelMap | undefined {
+  if (!extras.supportEfforts?.length) return undefined;
+  const map = {
+    off: extras.supportsThinkingType === "only" ? null : "off",
+  } as ThinkingLevelMap & Record<string, string | null>;
+  for (const level of ["minimal", "low", "medium", "high", "xhigh", "max"] as const) {
+    const entry = reasoningMap[level];
+    map[level] =
+      entry?.enabled && entry.effort && extras.supportEfforts.includes(entry.effort)
+        ? entry.effort
+        : null;
+  }
+  return map;
+}
+
 export function applyKimiOAuthExtrasToModel(
   model: Model<Api>,
   extras: KimiModelMetadata,
+  reasoningMap?: ModelReasoningMap,
 ): Model<Api> {
   const next: Model<Api> & {
     wireModelId?: string;
@@ -295,7 +318,7 @@ export function applyKimiOAuthExtrasToModel(
       model.id === KIMI_K3_MODEL_ID && /^k3$/i.test(extras.modelDisplay)
         ? "Kimi K3"
         : extras.modelDisplay;
-    next.cost = resolveModelCost(extras.modelDisplay);
+    next.cost = resolveModelCost(model.id, extras.modelDisplay);
   }
   if (typeof extras.contextLength === "number" && extras.contextLength > 0) {
     next.contextWindow = extras.contextLength;
@@ -316,6 +339,13 @@ export function applyKimiOAuthExtrasToModel(
   }
   if (extras.protocol) next.wireProtocol = extras.protocol;
   if (extras.supportEfforts) next.supportEfforts = [...extras.supportEfforts];
+  else delete next.supportEfforts;
   if (extras.defaultEffort) next.defaultEffort = extras.defaultEffort;
+  else delete next.defaultEffort;
+  if (reasoningMap) {
+    const thinkingLevelMap = buildKimiThinkingLevelMap(reasoningMap, extras);
+    if (thinkingLevelMap) next.thinkingLevelMap = thinkingLevelMap;
+    else delete next.thinkingLevelMap;
+  }
   return next;
 }

package/src/oauth.ts

@@ -2,13 +2,158 @@
 // reuse, the login / refresh handlers wired into pi's OAuth interface, and
 // the stream-level auth refresh used by the streaming handler.
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import { dirname, join } from "node:path";
 
+import { lock as acquireFileLock } from "proper-lockfile";
+
 import type { OAuthCredentials, OAuthLoginCallbacks } from "@earendil-works/pi-ai";
-import type { OAuthCredential } from "@earendil-works/pi-coding-agent";
-import { AuthStorage } from "@earendil-works/pi-coding-agent";
+import * as piAgent from "@earendil-works/pi-coding-agent";
+
+// Structural mirrors of pi's stored credential shapes. The exported names
+// moved between pi versions (pi-coding-agent <=0.79 vs pi-ai >=0.80.8), so
+// these are defined locally to type-check against either surface.
+type StoredCredential = { type: string } & Record<string, unknown>;
+
+export interface StoredOAuthCredential {
+  type: "oauth";
+  access: string;
+  refresh: string;
+  expires: number;
+  [key: string]: unknown;
+}
+
+// pi renamed its auth storage surface in 0.80.8: the exported AuthStorage
+// class (sync get/set under a file lock) was replaced by readStoredCredential
+// for one-off reads, with no exported write path. Detect whichever the host
+// pi provides so the extension keeps loading on both sides of the rename.
+const piAgentRuntime = piAgent as unknown as {
+  getAgentDir(): string;
+  readStoredCredential?(providerId: string): StoredCredential | undefined;
+  AuthStorage?: {
+    create(): {
+      get(provider: string): StoredCredential | undefined;
+      set(provider: string, credential: StoredCredential): void;
+    };
+  };
+};
+
+export function readStoredOAuthCredential(providerId: string): StoredOAuthCredential | null {
+  const credential = piAgentRuntime.readStoredCredential
+    ? piAgentRuntime.readStoredCredential(providerId)
+    : piAgentRuntime.AuthStorage?.create().get(providerId);
+  return credential?.type === "oauth" ? (credential as StoredOAuthCredential) : null;
+}
+
+// Mutual exclusion with pi's own credential writes: use the same library
+// (proper-lockfile) on the same file pi's FileAuthStorageBackend locks, with
+// the same options. The shared implementation keeps the lock mtime fresh
+// while held, recovers stale locks from crashed processes, and retries for
+// ~40s so a live holder running a slow network refresh inside the lock is
+// waited out.
+async function acquireSharedFileLock(
+  path: string,
+  signal: AbortSignal | undefined,
+  options: { maxRetries: number; stale: number; minTimeout: number; maxTimeout: number },
+): Promise<() => Promise<void>> {
+  for (let attempt = 0; ; attempt++) {
+    signal?.throwIfAborted();
+    try {
+      return await acquireFileLock(path, {
+        realpath: false,
+        stale: options.stale,
+        // Retry via the outer abortable sleep below. proper-lockfile's own
+        // retry loop is not signal-aware and would otherwise ignore an abort
+        // for the full configured retry window.
+        retries: 0,
+      });
+    } catch (error) {
+      const code =
+        typeof error === "object" && error !== null && "code" in error
+          ? String((error as { code?: unknown }).code)
+          : undefined;
+      if (code !== "ELOCKED" || attempt >= options.maxRetries) throw error;
+      const baseDelay = Math.min(options.minTimeout * 2 ** attempt, options.maxTimeout);
+      await sleep(baseDelay * (1 + Math.random()), signal);
+    }
+  }
+}
+
+async function acquireAuthFileLock(
+  authPath: string,
+  signal?: AbortSignal,
+): Promise<() => Promise<void>> {
+  return acquireSharedFileLock(authPath, signal, {
+    maxRetries: 10,
+    stale: 30_000,
+    minTimeout: 100,
+    maxTimeout: 10_000,
+  });
+}
+
+async function acquireKimiCodeRefreshLock(signal?: AbortSignal): Promise<() => Promise<void>> {
+  if (process.platform === "win32" || process.env.KIMI_DISABLE_OAUTH_LOCK === "1") {
+    return async () => {};
+  }
+  const target = join(
+    process.env.KIMI_CODE_HOME || join(os.homedir(), ".kimi-code"),
+    "oauth",
+    "kimi-code",
+  );
+  mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+  writeFileSync(target, "", { encoding: "utf-8", flag: "a" });
+  return acquireSharedFileLock(target, signal, {
+    maxRetries: 120,
+    stale: 5_000,
+    minTimeout: 500,
+    maxTimeout: 1_000,
+  });
+}
+
+interface LockedOAuthCredential {
+  credential: StoredOAuthCredential | null;
+  store(credential: StoredOAuthCredential): void;
+  release(): Promise<void>;
+}
+
+async function lockStoredOAuthCredential(
+  providerId: string,
+  signal?: AbortSignal,
+): Promise<LockedOAuthCredential> {
+  // Hold the same lock Pi uses across the complete read-refresh-write
+  // transaction. Kimi rotates refresh tokens, so locking only the write lets
+  // concurrent Pi processes exchange the same token twice.
+  const authPath = join(piAgentRuntime.getAgentDir(), "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true, mode: 0o700 });
+  if (!existsSync(authPath)) {
+    writeFileSync(authPath, "{}", { encoding: "utf-8", mode: 0o600 });
+    chmodSync(authPath, 0o600);
+  }
+  const release = await acquireAuthFileLock(authPath, signal);
+  let data: Record<string, unknown> = {};
+  try {
+    const parsed = JSON.parse(readFileSync(authPath, "utf-8")) as unknown;
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+      data = parsed as Record<string, unknown>;
+    }
+  } catch {
+    // Missing or unreadable auth.json — treat it as an empty store.
+  }
+  const stored = data[providerId] as StoredCredential | undefined;
+  return {
+    credential: stored?.type === "oauth" ? (stored as unknown as StoredOAuthCredential) : null,
+    store(credential) {
+      data[providerId] = credential;
+      writeFileSync(authPath, JSON.stringify(data, null, 2), {
+        encoding: "utf-8",
+        mode: 0o600,
+      });
+      chmodSync(authPath, 0o600);
+    },
+    release,
+  };
+}
 
 import { CLIENT_ID, PROVIDER_ID, RETRYABLE_REFRESH_STATUSES, getOAuthHost } from "./constants.ts";
 import { getCommonHeaders } from "./device.ts";
@@ -258,14 +403,10 @@ function readKimiCliCredentials(): KimiCliCredentialsFile | null {
   return null;
 }
 
-function kimiCodeCredentialExists(): boolean {
-  return existsSync(getKimiCodeCredentialPath());
-}
-
 function writeKimiCodeCredentials(access: string, refresh: string, expiresMs: number): void {
   const path = getKimiCodeCredentialPath();
   const dir = dirname(path);
-  mkdirSync(dir, { recursive: true });
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
   const data: KimiCliCredentialsFile = {
     access_token: access,
     refresh_token: refresh,
@@ -274,7 +415,24 @@ function writeKimiCodeCredentials(access: string, refresh: string, expiresMs: nu
     token_type: "Bearer",
     expires_in: Math.max(0, Math.floor((expiresMs - Date.now()) / 1000)),
   };
-  writeFileSync(path, `${JSON.stringify(data, null, 2)}\n`, "utf-8");
+  writeFileSync(path, `${JSON.stringify(data, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+  chmodSync(path, 0o600);
+}
+
+interface LockedKimiCodeCredentials {
+  credential: KimiCliCredentialsFile | null;
+  store(access: string, refresh: string, expiresMs: number): void;
+  release(): Promise<void>;
+}
+
+async function lockKimiCodeCredentials(signal?: AbortSignal): Promise<LockedKimiCodeCredentials> {
+  const release = await acquireKimiCodeRefreshLock(signal);
+  const credential = readKimiCliCredentials();
+  return {
+    credential,
+    store: writeKimiCodeCredentials,
+    release,
+  };
 }
 
 async function tryReuseKimiCliCredentials(
@@ -395,26 +553,83 @@ export async function loginKimiCode(callbacks: OAuthLoginCallbacks): Promise<Kim
 export async function refreshKimiCodeToken(
   credentials: OAuthCredentials,
 ): Promise<KimiOAuthCredentials> {
-  const kimiCred = kimiCodeCredentialExists() ? readKimiCliCredentials() : null;
-  let token: Awaited<ReturnType<typeof refreshAccessToken>>;
+  const kimiLocked = await lockKimiCodeCredentials();
   try {
-    token = await refreshAccessToken(credentials.refresh);
-  } catch (error) {
-    if (kimiCred?.refresh_token && kimiCred.refresh_token !== credentials.refresh) {
-      token = await refreshAccessToken(kimiCred.refresh_token);
-    } else {
+    const initialKimiCred = kimiLocked.credential;
+    const initialKimiExpiresMs = (initialKimiCred?.expires_at ?? 0) * 1000;
+    const peerHasNewerValidAccess =
+      initialKimiCred?.access_token !== undefined &&
+      initialKimiCred.access_token !== credentials.access &&
+      Date.now() < initialKimiExpiresMs;
+    const activeRefreshToken = peerHasNewerValidAccess
+      ? initialKimiCred.refresh_token!
+      : credentials.refresh;
+    const activeAccessToken = peerHasNewerValidAccess
+      ? initialKimiCred.access_token!
+      : credentials.access;
+    if (peerHasNewerValidAccess && initialKimiCred.refresh_token !== credentials.refresh) {
+      const extras = await discoverKimiModelMetadata(activeAccessToken);
+      return {
+        access: activeAccessToken,
+        refresh: activeRefreshToken,
+        expires: initialKimiExpiresMs,
+        ...extras,
+      };
+    }
+    let token: Awaited<ReturnType<typeof refreshAccessToken>>;
+    try {
+      token = await refreshAccessToken(activeRefreshToken);
+    } catch (error) {
+      // Lock-disabled platforms (Windows / KIMI_DISABLE_OAUTH_LOCK=1) use
+      // storage re-read as the only coordinator. A peer may have rotated the
+      // shared sidecar while this process was exchanging the old refresh
+      // token; recover from that newer valid credential instead of surfacing
+      // the stale-token invalid_grant as a login failure.
+      await sleep(100);
+      const peerCredential = readKimiCliCredentials();
+      const peerAccess = peerCredential?.access_token;
+      const peerRefresh = peerCredential?.refresh_token;
+      const peerExpiresMs = (peerCredential?.expires_at ?? 0) * 1000;
+      if (
+        peerAccess !== undefined &&
+        peerRefresh !== undefined &&
+        peerAccess !== credentials.access &&
+        Date.now() < peerExpiresMs
+      ) {
+        const extras = await discoverKimiModelMetadata(peerAccess);
+        return {
+          access: peerAccess,
+          refresh: peerRefresh,
+          expires: peerExpiresMs,
+          ...extras,
+        };
+      }
       throw error;
     }
+    const expiresMs = Date.now() + token.expires_in * 1000;
+    const kimiCredentialAfterRefresh = readKimiCliCredentials();
+    const peerAccess = kimiCredentialAfterRefresh?.access_token;
+    const peerRefresh = kimiCredentialAfterRefresh?.refresh_token;
+    const peerExpiresMs = (kimiCredentialAfterRefresh?.expires_at ?? 0) * 1000;
+    const accessToken =
+      peerAccess !== undefined && peerAccess !== activeAccessToken && Date.now() < peerExpiresMs
+        ? peerAccess
+        : token.access_token;
+    const refreshToken = accessToken === peerAccess ? peerRefresh! : token.refresh_token;
+    const effectiveExpiresMs = accessToken === peerAccess ? peerExpiresMs : expiresMs;
+    if (accessToken !== peerAccess) {
+      kimiLocked.store(accessToken, refreshToken, effectiveExpiresMs);
+    }
+    const extras = await discoverKimiModelMetadata(accessToken);
+    return {
+      access: accessToken,
+      refresh: refreshToken,
+      expires: effectiveExpiresMs,
+      ...extras,
+    };
+  } finally {
+    await kimiLocked.release().catch(() => {});
   }
-  const expiresMs = Date.now() + token.expires_in * 1000;
-  writeKimiCodeCredentials(token.access_token, token.refresh_token, expiresMs);
-  const extras = await discoverKimiModelMetadata(token.access_token);
-  return {
-    access: token.access_token,
-    refresh: token.refresh_token,
-    expires: expiresMs,
-    ...extras,
-  };
 }
 
 // =============================================================================
@@ -424,8 +639,8 @@ export async function refreshKimiCodeToken(
 // `expires` is in the past. If the server rotates/revokes the access token
 // before that (common with short-lived session tokens), every request keeps
 // returning 401. The streaming handler invokes refreshKimiAuthToken on the
-// first auth error to force a refresh through AuthStorage (which persists the
-// new credentials under a file lock), and retry once.
+// first auth error to force a refresh and persist the new credentials, and
+// retry once.
 // =============================================================================
 
 export function getKimiApiKey(credentials: OAuthCredentials): string {
@@ -451,75 +666,90 @@ export async function refreshKimiAuthToken(
   currentKey: string,
   options: { signal?: AbortSignal } = {},
 ): Promise<string | null> {
+  let locked: LockedOAuthCredential | undefined;
+  let kimiLocked: LockedKimiCodeCredentials | undefined;
   try {
-    const kimiCred = readKimiCliCredentials();
-    const storage = AuthStorage.create();
-    const piCred = storage.get(PROVIDER_ID);
-    const piOAuth = piCred?.type === "oauth" ? piCred : null;
+    locked = await lockStoredOAuthCredential(PROVIDER_ID, options.signal);
+    const piOAuth = locked.credential;
 
     if (piOAuth) {
       if (piOAuth.access !== currentKey && Date.now() < piOAuth.expires) {
-        console.error("[kimi-coding] auth refresh: reusing newer on-disk token");
         return piOAuth.access;
       }
 
-      console.error("[kimi-coding] auth refresh: requesting new access token");
       let refreshed: Awaited<ReturnType<typeof refreshAccessToken>>;
+      kimiLocked = await lockKimiCodeCredentials(options.signal);
       try {
         refreshed = await refreshAccessToken(piOAuth.refresh, { signal: options.signal });
       } catch (error) {
+        const kimiCred = readKimiCliCredentials();
         if (!kimiCred?.refresh_token || kimiCred.refresh_token === piOAuth.refresh) throw error;
         const kimiExpiresMs = (kimiCred.expires_at ?? 0) * 1000;
         if (kimiCred.access_token !== currentKey && Date.now() < kimiExpiresMs) {
-          const recovered: OAuthCredential = {
+          const recovered: StoredOAuthCredential = {
             ...piOAuth,
             type: "oauth",
             access: kimiCred.access_token!,
             refresh: kimiCred.refresh_token,
             expires: kimiExpiresMs,
           };
-          storage.set(PROVIDER_ID, recovered);
-          console.error("[kimi-coding] auth refresh: recovered newer kimi-code token");
+          locked.store(recovered);
           return recovered.access;
         }
-        console.error("[kimi-coding] auth refresh: pi token rejected, trying kimi-code token");
         refreshed = await refreshAccessToken(kimiCred.refresh_token, { signal: options.signal });
       }
 
       const newExpiresMs = Date.now() + refreshed.expires_in * 1000;
-      const newCred: OAuthCredential = {
+      const kimiCredentialAfterRefresh = readKimiCliCredentials();
+      const peerAccess = kimiCredentialAfterRefresh?.access_token;
+      const peerExpiresMs = (kimiCredentialAfterRefresh?.expires_at ?? 0) * 1000;
+      const peerIsNewerValid =
+        peerAccess !== undefined && peerAccess !== currentKey && Date.now() < peerExpiresMs;
+      if (peerIsNewerValid) {
+        const peerCred: StoredOAuthCredential = {
+          ...piOAuth,
+          type: "oauth",
+          access: peerAccess,
+          refresh: kimiCredentialAfterRefresh!.refresh_token!,
+          expires: peerExpiresMs,
+        };
+        locked.store(peerCred);
+        return peerCred.access;
+      }
+      kimiLocked.store(refreshed.access_token, refreshed.refresh_token, newExpiresMs);
+      const newCred: StoredOAuthCredential = {
         ...piOAuth,
         type: "oauth",
         access: refreshed.access_token,
         refresh: refreshed.refresh_token,
         expires: newExpiresMs,
       };
-      storage.set(PROVIDER_ID, newCred);
-      writeKimiCodeCredentials(refreshed.access_token, refreshed.refresh_token, newExpiresMs);
-      console.error("[kimi-coding] auth refresh: new token persisted");
+      locked.store(newCred);
       return newCred.access;
     }
 
+    kimiLocked = await lockKimiCodeCredentials(options.signal);
+    const kimiCred = kimiLocked.credential;
     if (!kimiCred) {
-      console.error(
-        `[kimi-coding] auth refresh skipped: no OAuth credentials for ${PROVIDER_ID} on disk`,
-      );
       return null;
     }
 
     const kimiExpiresMs = (kimiCred.expires_at ?? 0) * 1000;
     if (kimiCred.access_token !== currentKey && Date.now() < kimiExpiresMs) {
-      console.error("[kimi-coding] auth refresh: reusing newer kimi-code token");
       return kimiCred.access_token!;
     }
 
-    console.error("[kimi-coding] auth refresh: requesting new access token via kimi-code");
     const refreshed = await refreshAccessToken(kimiCred.refresh_token!, {
       signal: options.signal,
     });
     const newExpiresMs = Date.now() + refreshed.expires_in * 1000;
-    writeKimiCodeCredentials(refreshed.access_token, refreshed.refresh_token, newExpiresMs);
-    console.error("[kimi-coding] auth refresh: new token persisted to kimi-code");
+    const kimiCredentialAfterRefresh = readKimiCliCredentials();
+    const peerAccess = kimiCredentialAfterRefresh?.access_token;
+    const peerExpiresMs = (kimiCredentialAfterRefresh?.expires_at ?? 0) * 1000;
+    if (peerAccess !== undefined && peerAccess !== currentKey && Date.now() < peerExpiresMs) {
+      return peerAccess;
+    }
+    kimiLocked.store(refreshed.access_token, refreshed.refresh_token, newExpiresMs);
     return refreshed.access_token;
   } catch (err) {
     if (options.signal?.aborted) return null;
@@ -529,5 +759,12 @@ export async function refreshKimiAuthToken(
       console.error("[kimi-coding] auth refresh failed:", err);
     }
     return null;
+  } finally {
+    if (kimiLocked) {
+      await kimiLocked.release().catch(() => {});
+    }
+    if (locked) {
+      await locked.release().catch(() => {});
+    }
   }
 }

package/src/stream.ts

@@ -12,11 +12,46 @@ import type {
   Model,
   SimpleStreamOptions,
 } from "@earendil-works/pi-ai";
-import {
-  createAssistantMessageEventStream,
-  streamSimpleAnthropic,
-  streamSimpleOpenAICompletions,
-} from "@earendil-works/pi-ai";
+import * as piAi from "@earendil-works/pi-ai";
+import { createAssistantMessageEventStream } from "@earendil-works/pi-ai";
+
+type KimiStreamSimple = (
+  model: Model<Api>,
+  context: Context,
+  options?: SimpleStreamOptions,
+) => AssistantMessageEventStream;
+
+// pi 0.80.8 unexported the global streamSimple* functions. Depending on how
+// this module is loaded, the pi-ai root now offers one of three shapes:
+//   - pi extension loader (jiti/Bun): root aliases to the compat entrypoint,
+//     which exposes lazy per-API factories (anthropicMessagesApi et al.)
+//   - pi <=0.79: root only has the legacy streamSimple* globals
+//   - plain Node with pi-ai >=0.80.8 (tests, SDK use): root has neither, but
+//     lazyApi + a dynamic subpath import reaches the same implementation
+// Detect whichever shape is present so the extension loads in all three.
+const piAiRuntime = piAi as unknown as {
+  anthropicMessagesApi?: () => { streamSimple: KimiStreamSimple };
+  openAICompletionsApi?: () => { streamSimple: KimiStreamSimple };
+  streamSimpleAnthropic?: KimiStreamSimple;
+  streamSimpleOpenAICompletions?: KimiStreamSimple;
+  lazyApi?: (load: () => Promise<object>) => { streamSimple: KimiStreamSimple };
+};
+
+// The ./api/* subpath exports only exist on pi-ai >=0.80.8, so a literal
+// specifier would fail type resolution against older pi-ai. Computed
+// specifiers keep the imports invisible to TypeScript; they are only ever
+// evaluated in plain-Node environments where the subpaths do resolve.
+const anthropicMessagesModule = "@earendil-works/pi-ai/api/anthropic-messages";
+const openAICompletionsModule = "@earendil-works/pi-ai/api/openai-completions";
+
+const streamSimpleAnthropic: KimiStreamSimple =
+  piAiRuntime.anthropicMessagesApi?.().streamSimple ??
+  piAiRuntime.streamSimpleAnthropic ??
+  piAiRuntime.lazyApi?.(() => import(anthropicMessagesModule)).streamSimple!;
+const streamSimpleOpenAICompletions: KimiStreamSimple =
+  piAiRuntime.openAICompletionsApi?.().streamSimple ??
+  piAiRuntime.streamSimpleOpenAICompletions ??
+  piAiRuntime.lazyApi?.(() => import(openAICompletionsModule)).streamSimple!;
 import {
   DEFAULT_KIMI_CODE_CONFIG,
   type KimiCodeConfig,
@@ -162,7 +197,16 @@ export function resolveKimiApiKey(apiKey: string | undefined): string {
   return apiKey || process.env.KIMI_API_KEY || "";
 }
 
-export function mergeKimiRequestHeaders(headers?: Record<string, string>): Record<string, string> {
+// SimpleStreamOptions.headers is Record<string, string> on pi <=0.79 and
+// ProviderHeaders (Record<string, string | null>, null = suppress the header
+// when pi-ai assembles the request) on >=0.80.8. Accept and preserve both
+// shapes; defined locally because ProviderHeaders is not exported on old pi.
+type HeaderMap = Record<string, string | null>;
+
+export function mergeKimiRequestHeaders(headers?: HeaderMap): HeaderMap {
+  // Caller values override our Kimi defaults. Nulls are retained rather than
+  // deleted so the suppression semantics reach pi-ai, which strips null
+  // entries (including its own defaults) when building the request.
   return { ...getKimiProviderHeaders(), ...headers };
 }
 
@@ -231,7 +275,9 @@ export function streamSimpleKimi(
     return {
       ...options,
       ...apiKeyOverride,
-      headers: mergeKimiRequestHeaders(options?.headers),
+      // Cast to whatever headers shape the installed pi-ai declares:
+      // Record<string, string> on pi <=0.79, ProviderHeaders on >=0.80.8.
+      headers: mergeKimiRequestHeaders(options?.headers) as SimpleStreamOptions["headers"],
       onPayload: async (payload, modelData) => {
         let nextPayload: unknown = payload;
 

package/src/tools/common.ts

@@ -1,9 +1,13 @@
-import { AuthStorage, type AgentToolResult } from "@earendil-works/pi-coding-agent";
+import type { AgentToolResult } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth } from "@earendil-works/pi-tui";
 
 import { PROVIDER_ID, getBaseUrl } from "../constants.ts";
 import { getKimiProviderHeaders } from "../device.ts";
-import { KIMI_LOGIN_REQUIRED_MESSAGE, refreshKimiAuthToken } from "../oauth.ts";
+import {
+  KIMI_LOGIN_REQUIRED_MESSAGE,
+  readStoredOAuthCredential,
+  refreshKimiAuthToken,
+} from "../oauth.ts";
 
 export const KIMI_TOOL_TIMEOUT_MS = 180_000;
 
@@ -19,9 +23,7 @@ export interface BuildKimiToolOptions {
 }
 
 function defaultGetAccessToken(): string | null {
-  const credential = AuthStorage.create().get(PROVIDER_ID);
-  if (!credential || credential.type !== "oauth") return null;
-  return credential.access;
+  return readStoredOAuthCredential(PROVIDER_ID)?.access ?? null;
 }
 
 export function buildKimiToolDeps(options: BuildKimiToolOptions = {}): KimiToolDeps {

package/src/usage.ts

@@ -1,17 +1,6 @@
-import { AuthStorage } from "@earendil-works/pi-coding-agent";
-
 import { PROVIDER_ID, getBaseUrl } from "./constants.ts";
 import { getKimiProviderHeaders } from "./device.ts";
-import { refreshKimiAuthToken } from "./oauth.ts";
-
-const MEMBERSHIP_LEVEL_NAMES: Record<string, string> = {
-  LEVEL_FREE: "Free",
-  LEVEL_BASIC: "Adagio",
-  LEVEL_STANDARD: "Moderato",
-  LEVEL_INTERMEDIATE: "Allegretto",
-  LEVEL_ADVANCED: "Allegro",
-  LEVEL_PREMIUM: "Vivace",
-};
+import { readStoredOAuthCredential, refreshKimiAuthToken } from "./oauth.ts";
 
 const RESET_TIME_KEYS = [
   "resetTime",
@@ -38,7 +27,6 @@ export interface UsageFormatOptions {
 
 export interface KimiUsageSnapshot {
   summary: string;
-  membershipLevel: string | null;
 }
 
 interface BoosterWalletInfo {
@@ -52,8 +40,8 @@ interface BoosterWalletInfo {
 const FIXED_POINT_CENTS = 1_000_000n;
 
 export function getKimiUsageToken(): string | null {
-  const credential = AuthStorage.create().get(PROVIDER_ID);
-  if (credential?.type === "oauth" && credential.access) return credential.access;
+  const credential = readStoredOAuthCredential(PROVIDER_ID);
+  if (credential?.access) return credential.access;
   const apiKey = process.env.KIMI_API_KEY?.trim();
   return apiKey || null;
 }
@@ -176,9 +164,6 @@ export function parseUsageSummary(payload: unknown, options: UsageFormatOptions
 
   const record = payload as Record<string, unknown>;
   const lines: string[] = [];
-  const membership = parseMembership(record);
-  if (membership) lines.push(membership, "");
-
   const summary = parseUsageRow(record.usage, "Current week");
   if (summary)
     lines.push(formatUsageRow({ ...summary, label: normalizeUsageLabel(summary.label) }, options));
@@ -237,24 +222,6 @@ function formatWindowLabel(value: unknown, fallbackLabel: string): string {
   return `Current ${minutes}m window`;
 }
 
-export function parseMembershipLevel(record: Record<string, unknown>): string | null {
-  const user = record.user;
-  if (typeof user !== "object" || user === null || Array.isArray(user)) return null;
-  const membership = (user as Record<string, unknown>).membership;
-  if (typeof membership !== "object" || membership === null || Array.isArray(membership)) {
-    return null;
-  }
-  const level = (membership as Record<string, unknown>).level;
-  return typeof level === "string" && level ? level : null;
-}
-
-export function parseMembership(record: Record<string, unknown>): string | null {
-  const level = parseMembershipLevel(record);
-  if (!level) return null;
-  const name = MEMBERSHIP_LEVEL_NAMES[level];
-  return name ? `Membership: ${name} (${level})` : `Membership: ${level}`;
-}
-
 export function formatUsageRow(row: UsageRow, options: UsageFormatOptions = {}): string {
   if (row.limit <= 0) return `${row.label}\n${row.used} used`;
   const used = Math.max(0, Math.min(row.used, row.limit));
@@ -358,10 +325,7 @@ export async function fetchKimiUsageSnapshot(
 ): Promise<KimiUsageSnapshot> {
   const token = options.token ?? getKimiUsageToken();
   if (!token) {
-    return {
-      summary: "Usage: missing credentials. Run /login kimi-coding.",
-      membershipLevel: null,
-    };
+    return { summary: "Usage: missing credentials. Run /login kimi-coding." };
   }
 
   const controller = new AbortController();
@@ -373,17 +337,13 @@ export async function fetchKimiUsageSnapshot(
       if (refreshed) response = await fetchKimiUsage(refreshed, controller.signal);
     }
     if (!response.ok) {
-      return { summary: `Usage: fetch failed (${response.status})`, membershipLevel: null };
+      return { summary: `Usage: fetch failed (${response.status})` };
     }
     const payload = (await response.json()) as unknown;
-    const membershipLevel =
-      typeof payload === "object" && payload !== null && !Array.isArray(payload)
-        ? parseMembershipLevel(payload as Record<string, unknown>)
-        : null;
-    return { summary: parseUsageSummary(payload), membershipLevel };
+    return { summary: parseUsageSummary(payload) };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    return { summary: `Usage: fetch failed (${message})`, membershipLevel: null };
+    return { summary: `Usage: fetch failed (${message})` };
   } finally {
     clearTimeout(timeout);
   }