playmaker-cli 0.11.0__tar.gz → 0.12.0__tar.gz

{playmaker_cli-0.11.0 → playmaker_cli-0.12.0}/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.0] - 2026-09-04
+
+### Added
+
+- **Kimi Code usage in `playmaker quotas`.** The table reads Kimi Code's
+  managed OAuth usage endpoint and shows its rolling 5-hour Session and weekly
+  buckets beside the other provider pools.
+
 ## [0.11.0] - 2026-09-04
 
 ### Added

{playmaker_cli-0.11.0 → playmaker_cli-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: playmaker-cli
-Version: 0.11.0
+Version: 0.12.0
 Summary: Playing-coach CLI for orchestrating Claude Code, Codex, Antigravity, Kimi Code and opencode sub-agents in parallel.
 Project-URL: Homepage, https://github.com/vladsafedev/playmaker
 Project-URL: Repository, https://github.com/vladsafedev/playmaker
@@ -446,6 +446,10 @@ whole Z.ai block. Routing a subtask is choosing which of them to spend.
   lane pointed at a local model spends nothing here. Shows *unsupported* rather
   than an error when no Z.ai credential exists. `MCP tools` is the monthly
   web-search/reader pool, not inference.
+- **Kimi Code** — managed usage API; OAuth token from
+  `~/.kimi-code/credentials/kimi-code-env-*.json` (`$KIMI_CODE_HOME` overrides
+  the root). Its 5-hour `Session` and weekly rows are separate percentage
+  buckets; no credential reads as *unsupported* rather than a failed probe.
 
 Reading these at *model* granularity is the point: they are the load-balancing
 input the coach skill uses to route each subtask.

{playmaker_cli-0.11.0 → playmaker_cli-0.12.0}/README.md

@@ -419,6 +419,10 @@ whole Z.ai block. Routing a subtask is choosing which of them to spend.
   lane pointed at a local model spends nothing here. Shows *unsupported* rather
   than an error when no Z.ai credential exists. `MCP tools` is the monthly
   web-search/reader pool, not inference.
+- **Kimi Code** — managed usage API; OAuth token from
+  `~/.kimi-code/credentials/kimi-code-env-*.json` (`$KIMI_CODE_HOME` overrides
+  the root). Its 5-hour `Session` and weekly rows are separate percentage
+  buckets; no credential reads as *unsupported* rather than a failed probe.
 
 Reading these at *model* granularity is the point: they are the load-balancing
 input the coach skill uses to route each subtask.

{playmaker_cli-0.11.0 → playmaker_cli-0.12.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "playmaker-cli"
-version = "0.11.0"
+version = "0.12.0"
 description = "Playing-coach CLI for orchestrating Claude Code, Codex, Antigravity, Kimi Code and opencode sub-agents in parallel."
 readme = "README.md"
 requires-python = ">=3.11"

{playmaker_cli-0.11.0 → playmaker_cli-0.12.0}/skills/playmaker-coach/references/quotas.md

@@ -24,6 +24,9 @@ several tiers with independent buckets, and the whole point of pulling quotas is
 - **Codex:** the main block is the primary Codex window; `Codex — Spark` is a separate block with
   its own `Session` / `Weekly` rows for the Spark model, the junior Codex lane — route Spark work
   off that block, not off the main one.
+- **Kimi Code:** `Session` is its rolling 5-hour bucket and `Weekly` is the subscription's weekly
+  percentage bucket. They are independent of Claude, Codex and the opencode-backed plans, so Kimi
+  is a useful alternate lane when either of those two rows still has headroom.
 - **opencode:** the quota belongs to the *plan behind the provider*, not to the CLI — it appears
   under that provider (e.g. a GLM coding plan's session and weekly credit windows) and reads
   unsupported without a credential. A dispatch pointed at a **local** model spends nothing and never

{playmaker_cli-0.11.0 → playmaker_cli-0.12.0}/src/playmaker/cli.py

@@ -1004,11 +1004,13 @@ def _render_provider(name: str, info: dict) -> None:
         "agy": "green",
         "gemini": "cyan",
         "zai": "yellow",
+        "kimi": "cyan",
         "ollama": "bright_cyan",
     }.get(name, "white")
     display = {
         "agy": "Antigravity (agy)",
         "zai": "Z.ai (GLM, via opencode)",
+        "kimi": "Kimi Code",
         "ollama": "Ollama (local, via opencode)",
     }.get(name, name.capitalize())
     title = f"[bold {label_color}]{display}[/bold {label_color}]"

{playmaker_cli-0.11.0 → playmaker_cli-0.12.0}/src/playmaker/quotas.py

@@ -9,6 +9,8 @@ All providers go through OAuth Bearer tokens; no WebKit, no PTY.
 - Gemini (retired locally): same creds -> cloudcode-pa.googleapis.com
 - Z.ai (GLM, dispatched via opencode): API key in opencode's auth.json ->
   api.z.ai/api/monitor/usage/quota/limit
+- Kimi Code: OAuth credential in ~/.kimi-code/credentials ->
+  api.kimi.ai/coding/v1/usages
 - Ollama (local, also via opencode): no quota to fetch — localhost:11434
   /api/tags is an availability probe reporting unmetered capacity
 """
@@ -22,7 +24,9 @@ import re
 import shutil
 import ssl
 import subprocess
+import tempfile
 import time
+import tomllib
 import urllib.error
 import urllib.parse
 import urllib.request
@@ -1161,6 +1165,303 @@ def zai_probe() -> dict:
     }
 
 
+# ---- Kimi Code --------------------------------------------------------------
+
+
+_KIMI_CODE_DEFAULT_BASE_URL = "https://api.kimi.ai/coding/v1"
+_KIMI_CODE_DEFAULT_OAUTH_HOST = "https://auth.kimi.ai"
+
+# Public installed-app client id from kimi-code 0.41.0's OAuth bundle. The
+# bundle refreshes at <oauth_host>/api/oauth/token with this form body.
+_KIMI_CODE_OAUTH_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098"
+
+
+def _kimi_code_home() -> Path:
+    configured = os.environ.get("KIMI_CODE_HOME")
+    return Path(configured).expanduser() if configured else Path("~/.kimi-code").expanduser()
+
+
+def _kimi_load_config(home: Path) -> dict:
+    try:
+        config = tomllib.loads((home / "config.toml").read_text(encoding="utf-8"))
+    except (OSError, tomllib.TOMLDecodeError):
+        return {}
+    return config if isinstance(config, dict) else {}
+
+
+def _kimi_provider_config(config: dict) -> dict:
+    providers = config.get("providers")
+    if not isinstance(providers, dict):
+        return {}
+    provider = providers.get("managed:kimi-code")
+    return provider if isinstance(provider, dict) else {}
+
+
+def _kimi_runtime_urls(config: dict) -> tuple[str, str]:
+    """Return the configured managed API and OAuth hosts, defaulting global."""
+    provider = _kimi_provider_config(config)
+    base_url = provider.get("base_url") or provider.get("baseUrl")
+    oauth = provider.get("oauth")
+    oauth = oauth if isinstance(oauth, dict) else {}
+    oauth_host = oauth.get("oauth_host") or oauth.get("oauthHost")
+    resolved_base_url = (
+        str(base_url).rstrip("/")
+        if isinstance(base_url, str) and base_url
+        else _KIMI_CODE_DEFAULT_BASE_URL
+    )
+    resolved_oauth_host = (
+        str(oauth_host).rstrip("/")
+        if isinstance(oauth_host, str) and oauth_host
+        else _KIMI_CODE_DEFAULT_OAUTH_HOST
+    )
+    return (
+        resolved_base_url,
+        resolved_oauth_host,
+    )
+
+
+def _kimi_credential_paths(home: Path, config: dict) -> list[Path]:
+    """Prefer this environment's configured OAuth file, then other CLI files."""
+    credentials_dir = home / "credentials"
+    provider = _kimi_provider_config(config)
+    oauth = provider.get("oauth")
+    oauth = oauth if isinstance(oauth, dict) else {}
+    oauth_key = oauth.get("key")
+    configured: list[Path] = []
+    if isinstance(oauth_key, str):
+        name = Path(oauth_key).name
+        if name.startswith("kimi-code-env-"):
+            configured.append(credentials_dir / f"{name}.json")
+
+    try:
+        discovered = sorted(
+            credentials_dir.glob("kimi-code-env-*.json"),
+            key=lambda path: path.stat().st_mtime,
+            reverse=True,
+        )
+    except OSError:
+        discovered = []
+    return configured + [path for path in discovered if path not in configured]
+
+
+def _kimi_load_credentials() -> tuple[dict, Path, dict] | None:
+    home = _kimi_code_home()
+    config = _kimi_load_config(home)
+    for path in _kimi_credential_paths(home, config):
+        try:
+            credentials = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            continue
+        if isinstance(credentials, dict) and isinstance(credentials.get("access_token"), str):
+            return credentials, path, config
+    return None
+
+
+def _kimi_save_credentials(path: Path, credentials: dict) -> None:
+    tmp_path: Path | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="w",
+            encoding="utf-8",
+            dir=path.parent,
+            prefix=f".{path.name}.",
+            suffix=".tmp",
+            delete=False,
+        ) as tmp:
+            tmp_path = Path(tmp.name)
+            tmp_path.chmod(0o600)
+            tmp.write(json.dumps(credentials, indent=2) + "\n")
+        tmp_path.replace(path)
+    finally:
+        if tmp_path is not None:
+            try:
+                tmp_path.unlink()
+            except FileNotFoundError:
+                pass
+
+
+def _kimi_refresh(credentials: dict, path: Path, oauth_host: str) -> dict:
+    """Refresh a Kimi CLI OAuth token and persist it to its existing file."""
+    refresh_token = credentials.get("refresh_token")
+    if not isinstance(refresh_token, str) or not refresh_token:
+        raise RuntimeError("no refresh_token in Kimi credential")
+    body = urllib.parse.urlencode(
+        {
+            "client_id": _KIMI_CODE_OAUTH_CLIENT_ID,
+            "grant_type": "refresh_token",
+            "refresh_token": refresh_token,
+        }
+    )
+    response = _http_json(
+        f"{oauth_host.rstrip('/')}/api/oauth/token",
+        method="POST",
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        body=body,
+    )
+    access_token = response.get("access_token")
+    expires_in = response.get("expires_in")
+    if not isinstance(access_token, str) or not access_token:
+        raise RuntimeError("Kimi token refresh response missing access_token")
+    if not isinstance(expires_in, (int, float)) or expires_in <= 0:
+        raise RuntimeError("Kimi token refresh response missing expires_in")
+
+    refreshed = dict(credentials)
+    refreshed["access_token"] = access_token
+    if isinstance(response.get("refresh_token"), str) and response["refresh_token"]:
+        refreshed["refresh_token"] = response["refresh_token"]
+    refreshed["expires_in"] = int(expires_in)
+    refreshed["expires_at"] = int(time.time()) + int(expires_in)
+    if isinstance(response.get("token_type"), str):
+        refreshed["token_type"] = response["token_type"]
+    if isinstance(response.get("scope"), str):
+        refreshed["scope"] = response["scope"]
+    _kimi_save_credentials(path, refreshed)
+    return refreshed
+
+
+def _humanize_kimi_tier(level: object) -> str | None:
+    if not isinstance(level, str) or not level:
+        return None
+    suffix = level.removeprefix("LEVEL_")
+    return suffix.replace("_", " ").title()
+
+
+def _kimi_window(
+    name: str, detail: dict, *, window_seconds: float, include_forecast: bool
+) -> dict | None:
+    limit = detail.get("limit")
+    remaining = detail.get("remaining")
+    used = detail.get("used")
+    if not isinstance(limit, (int, float, str)):
+        return None
+    try:
+        limit_value = float(limit)
+        if isinstance(remaining, (int, float, str)):
+            remaining_value = float(remaining)
+        elif isinstance(used, (int, float, str)):
+            # The live API omits `remaining` at 0%, while retaining `used`.
+            remaining_value = limit_value - float(used)
+        else:
+            return None
+    except ValueError:
+        return None
+    if limit_value <= 0:
+        return None
+
+    reset_at = detail.get("resetTime")
+    reset_iso = reset_at if isinstance(reset_at, str) else None
+    forecast: str | None = None
+    if include_forecast and reset_iso:
+        try:
+            reset_dt = datetime.fromisoformat(reset_iso.replace("Z", "+00:00"))
+            elapsed = max(0.0, window_seconds - (reset_dt.timestamp() - time.time()))
+            used_pct = max(0.0, min(100.0, 100 - (remaining_value / limit_value * 100)))
+            forecast = _forecast_label(used_pct, window_seconds, elapsed)
+        except ValueError:
+            pass
+    return {
+        "name": name,
+        "pct_left": max(0, min(100, int(round(remaining_value / limit_value * 100)))),
+        "reset_at_iso": reset_iso,
+        "reset_relative": _format_relative(reset_iso),
+        "forecast": forecast,
+        "reserve_pct": None,
+    }
+
+
+def kimi_probe() -> dict:
+    """Kimi Code OAuth usage, as reported by its managed `/usages` endpoint.
+
+    `usage` is the weekly percentage bucket. `limits[]` holds rolling windows;
+    the 300-minute detail is Kimi Code's session quota. The stored access token
+    is intentionally never refreshed by making a chat request: when it is
+    expired, this uses the CLI's documented OAuth refresh request instead.
+    """
+    loaded = _kimi_load_credentials()
+    if loaded is None:
+        return {
+            "status": "unsupported",
+            "reason": "no Kimi Code credential — run `kimi login --region global`",
+        }
+    credentials, credentials_path, config = loaded
+    access_token = credentials.get("access_token")
+    expires_at = credentials.get("expires_at")
+    base_url, oauth_host = _kimi_runtime_urls(config)
+    if not isinstance(access_token, str) or not access_token:
+        return {
+            "status": "unsupported",
+            "reason": "Kimi token expired — run any `kimi` command to refresh it",
+        }
+    if not isinstance(expires_at, (int, float)) or expires_at <= time.time():
+        if (
+            not isinstance(credentials.get("refresh_token"), str)
+            or not credentials["refresh_token"]
+        ):
+            return {
+                "status": "unsupported",
+                "reason": "Kimi token expired — run any `kimi` command to refresh it",
+            }
+        credentials = _kimi_refresh(credentials, credentials_path, oauth_host)
+        access_token = credentials["access_token"]
+
+    try:
+        response = _http_json(
+            f"{base_url.rstrip('/')}/usages",
+            headers={"Authorization": f"Bearer {access_token}"},
+        )
+    except RuntimeError as exc:
+        if "HTTP 401" not in str(exc) or not isinstance(credentials.get("refresh_token"), str):
+            raise
+        credentials = _kimi_refresh(credentials, credentials_path, oauth_host)
+        response = _http_json(
+            f"{base_url.rstrip('/')}/usages",
+            headers={"Authorization": f"Bearer {credentials['access_token']}"},
+        )
+
+    usage = response.get("usage")
+    limits = response.get("limits")
+    user = response.get("user")
+    if not isinstance(usage, dict) or not isinstance(limits, list) or not isinstance(user, dict):
+        return {
+            "status": "unsupported",
+            "reason": f"unrecognised quota payload: {str(response)[:200]}",
+        }
+    membership = user.get("membership")
+
+    session: dict | None = None
+    for limit in limits:
+        if not isinstance(limit, dict):
+            continue
+        window = limit.get("window")
+        detail = limit.get("detail")
+        if (
+            isinstance(window, dict)
+            and window.get("duration") == 300
+            and window.get("timeUnit") == "TIME_UNIT_MINUTE"
+            and isinstance(detail, dict)
+        ):
+            # Session windows churn too quickly for a useful pace forecast,
+            # matching the Claude and Z.ai rows in this table.
+            session = _kimi_window(
+                "Session", detail, window_seconds=5 * 3600, include_forecast=False
+            )
+            break
+    weekly = _kimi_window("Weekly", usage, window_seconds=7 * 86400, include_forecast=True)
+    if session is None or weekly is None:
+        return {
+            "status": "unsupported",
+            "reason": f"unrecognised quota payload: {str(response)[:200]}",
+        }
+
+    level = membership.get("level") if isinstance(membership, dict) else None
+    return {
+        "status": "ok",
+        "account_email": None,
+        "tier": _humanize_kimi_tier(level),
+        "windows": [session, weekly],
+    }
+
+
 # ---- Ollama (local, unmetered) ----------------------------------------------
 
 # Ollama's own API, not the OpenAI-compatible /v1 shim that opencode dispatches
@@ -1285,6 +1586,7 @@ PROBES = {
     "claude": claude_probe,
     "agy": antigravity_probe,
     "zai": zai_probe,
+    "kimi": kimi_probe,
     "ollama": ollama_probe,
 }
 

playmaker_cli-0.12.0/tests/test_quotas_kimi.py

@@ -0,0 +1,220 @@
+"""Kimi Code quota probe."""
+
+from __future__ import annotations
+
+import json
+import stat
+import sys
+import time
+import urllib.parse
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+import playmaker.quotas as quotas
+
+# Captured verbatim from https://api.kimi.ai/coding/v1/usages on a live
+# Moderato (LEVEL_BASIC) account, 2026-09-04. `usage` is the weekly percent
+# bucket; each `limits[]` entry is a rolling window, here five hours.
+_PAYLOAD = json.loads(
+    '{"user":{"userId":"d9gg8obmrb73tddocqb0","region":"REGION_OVERSEA","membership":{"level":"LEVEL_BASIC"},"businessId":""},"usage":{"limit":"100","used":"1","remaining":"99","resetTime":"2026-09-11T14:50:20.391966Z"},"limits":[{"window":{"duration":300,"timeUnit":"TIME_UNIT_MINUTE"},"detail":{"limit":"100","used":"3","remaining":"97","resetTime":"2026-09-04T19:50:20.391966Z"}}],"parallel":{"limit":"10"},"totalQuota":{},"authentication":{"method":"METHOD_ACCESS_TOKEN","scope":"FEATURE_CODING"},"subType":"TYPE_PURCHASE","domain":"DOMAIN_NEXUS","version":"GOODS_VERSION_V1"}'
+)
+
+
+@pytest.fixture
+def credential(monkeypatch, tmp_path) -> Path:
+    """Point the probe at the Kimi CLI's global managed-provider credential."""
+    home = tmp_path / "kimi-code"
+    monkeypatch.setenv("KIMI_CODE_HOME", str(home))
+    credentials = home / "credentials" / "kimi-code-env-deadbeef.json"
+    credentials.parent.mkdir(parents=True)
+    credentials.write_text(
+        json.dumps(
+            {
+                "access_token": "access-test",
+                "refresh_token": "refresh-test",
+                "expires_at": int(time.time()) + 900,
+                "expires_in": 900,
+                "token_type": "Bearer",
+                "scope": "kimi-code",
+            }
+        ),
+        encoding="utf-8",
+    )
+    credentials.chmod(0o600)
+    (home / "config.toml").write_text(
+        """[providers.\"managed:kimi-code\"]
+base_url = "https://api.kimi.ai/coding/v1"
+
+[providers.\"managed:kimi-code\".oauth]
+key = "oauth/kimi-code-env-deadbeef"
+oauth_host = "https://auth.kimi.ai"
+""",
+        encoding="utf-8",
+    )
+    return credentials
+
+
+def _respond(monkeypatch, payload: dict) -> dict:
+    seen: dict = {}
+
+    def fake(url, **kwargs):
+        seen["url"] = url
+        seen["headers"] = kwargs.get("headers") or {}
+        return payload
+
+    monkeypatch.setattr(quotas, "_http_json", fake)
+    return seen
+
+
+def test_usage_is_normalized_to_session_and_weekly(monkeypatch, credential) -> None:
+    _respond(monkeypatch, _PAYLOAD)
+
+    result = quotas.kimi_probe()
+
+    assert result["status"] == "ok"
+    assert result["tier"] == "Basic"
+    assert [(window["name"], window["pct_left"]) for window in result["windows"]] == [
+        ("Session", 97),
+        ("Weekly", 99),
+    ]
+
+
+def test_usage_endpoint_and_bearer_token_follow_the_managed_config(monkeypatch, credential) -> None:
+    seen = _respond(monkeypatch, _PAYLOAD)
+
+    quotas.kimi_probe()
+
+    assert seen["url"] == "https://api.kimi.ai/coding/v1/usages"
+    assert seen["headers"]["Authorization"] == "Bearer access-test"
+
+
+def test_session_keeps_its_reset_time_but_has_no_pace_forecast(monkeypatch, credential) -> None:
+    _respond(monkeypatch, _PAYLOAD)
+
+    session, weekly = quotas.kimi_probe()["windows"]
+
+    assert session["reset_at_iso"] == "2026-09-04T19:50:20.391966Z"
+    assert session["forecast"] is None
+    assert weekly["reset_at_iso"] == "2026-09-11T14:50:20.391966Z"
+
+
+def test_an_exhausted_window_without_remaining_still_renders(monkeypatch, credential) -> None:
+    payload = json.loads(json.dumps(_PAYLOAD))
+    detail = payload["limits"][0]["detail"]
+    detail["used"] = "100"
+    detail.pop("remaining")
+    _respond(monkeypatch, payload)
+
+    session = quotas.kimi_probe()["windows"][0]
+
+    assert session["pct_left"] == 0
+
+
+def test_expired_token_uses_the_cli_refresh_request_and_persists_it(
+    monkeypatch, credential
+) -> None:
+    expired = json.loads(credential.read_text(encoding="utf-8"))
+    expired["expires_at"] = int(time.time()) - 1
+    credential.write_text(json.dumps(expired), encoding="utf-8")
+    seen: list[tuple[str, dict]] = []
+
+    def fake(url, **kwargs):
+        seen.append((url, kwargs))
+        if url == "https://auth.kimi.ai/api/oauth/token":
+            return {
+                "access_token": "access-refreshed",
+                "refresh_token": "refresh-refreshed",
+                "expires_in": 900,
+                "token_type": "Bearer",
+                "scope": "kimi-code",
+            }
+        return _PAYLOAD
+
+    monkeypatch.setattr(quotas, "_http_json", fake)
+
+    result = quotas.kimi_probe()
+
+    assert result["status"] == "ok"
+    refresh_url, refresh_kwargs = seen[0]
+    assert refresh_url == "https://auth.kimi.ai/api/oauth/token"
+    assert refresh_kwargs["method"] == "POST"
+    assert refresh_kwargs["headers"]["Content-Type"] == "application/x-www-form-urlencoded"
+    assert urllib.parse.parse_qs(refresh_kwargs["body"]) == {
+        "client_id": ["17e5f671-d194-4dfb-9706-5516cb48c098"],
+        "grant_type": ["refresh_token"],
+        "refresh_token": ["refresh-test"],
+    }
+    saved = json.loads(credential.read_text(encoding="utf-8"))
+    assert saved["access_token"] == "access-refreshed"
+    assert saved["refresh_token"] == "refresh-refreshed"
+    assert stat.S_IMODE(credential.stat().st_mode) == 0o600
+    assert seen[1][1]["headers"]["Authorization"] == "Bearer access-refreshed"
+
+
+def test_credential_write_uses_a_mode_600_sibling_temp_file(monkeypatch, credential) -> None:
+    seen: dict = {}
+    original_replace = Path.replace
+
+    def record_replace(source: Path, target: Path) -> Path:
+        seen["source"] = source
+        seen["target"] = target
+        seen["mode_at_replace"] = stat.S_IMODE(source.stat().st_mode)
+        return original_replace(source, target)
+
+    monkeypatch.setattr(Path, "replace", record_replace)
+
+    quotas._kimi_save_credentials(credential, {"access_token": "saved"})
+
+    assert seen["source"].parent == credential.parent
+    assert seen["source"] != credential
+    assert seen["source"].name.startswith(f".{credential.name}.")
+    assert seen["target"] == credential
+    assert seen["mode_at_replace"] == 0o600
+    assert stat.S_IMODE(credential.stat().st_mode) == 0o600
+    assert json.loads(credential.read_text(encoding="utf-8")) == {"access_token": "saved"}
+
+
+def test_expired_token_without_a_refresh_token_is_unsupported(monkeypatch, credential) -> None:
+    expired = json.loads(credential.read_text(encoding="utf-8"))
+    expired.pop("refresh_token")
+    expired["expires_at"] = int(time.time()) - 1
+    credential.write_text(json.dumps(expired), encoding="utf-8")
+
+    result = quotas.kimi_probe()
+
+    assert result == {
+        "status": "unsupported",
+        "reason": "Kimi token expired — run any `kimi` command to refresh it",
+    }
+
+
+def test_no_credential_is_unsupported_not_an_error(monkeypatch, tmp_path) -> None:
+    monkeypatch.setenv("KIMI_CODE_HOME", str(tmp_path / "kimi-code"))
+
+    result = quotas.kimi_probe()
+
+    assert result["status"] == "unsupported"
+    assert "no Kimi Code credential" in result["reason"]
+
+
+def test_a_reshaped_payload_is_unsupported_rather_than_an_error(monkeypatch, credential) -> None:
+    _respond(monkeypatch, {"usage": {"limit": "100"}, "limits": []})
+
+    result = quotas.kimi_probe()
+
+    assert result["status"] == "unsupported"
+    assert "unrecognised" in result["reason"]
+
+
+def test_a_truthy_non_object_user_is_unsupported_not_an_error(monkeypatch, credential) -> None:
+    payload = json.loads(json.dumps(_PAYLOAD))
+    payload["user"] = "gap"
+    _respond(monkeypatch, payload)
+
+    result = quotas.kimi_probe()
+
+    assert result["status"] == "unsupported"
+    assert "unrecognised" in result["reason"]