playmaker-cli 0.11.0__tar.gz → 0.12.1__tar.gz

{playmaker_cli-0.11.0 → playmaker_cli-0.12.1}/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.1] - 2026-09-08
+
+### Fixed
+
+- **The bundled coach skill never named the `kimi` lane.** 0.11.0 made Kimi
+  Code a first-class agent and `references/lanes.md` listed it, but `SKILL.md`
+  — the file the coach reads first, and the description Claude Code matches a
+  request against — still said the workers were Claude, Codex, Antigravity and
+  opencode; the routing cheat-sheet sent write-heavy work that can leave
+  Claude to `codex / agy / opencode` only, and the tier table had no senior
+  seat for K3. A coach following the skill to the letter would never route a
+  WP to the one subscription nobody else on the machine draws from. The
+  description, the lane list, the per-agent-traps pointer, the cheat-sheet
+  and the tier table now name `kimi`; CONTRIBUTING's lane and handler lists
+  too. As with 0.5.1, this release exists because the skill ships inside the
+  wheel — doc fixes are not live until published.
+
+## [0.12.0] - 2026-09-04
+
+### Added
+
+- **Kimi Code usage in `playmaker quotas`.** The table reads Kimi Code's
+  managed OAuth usage endpoint and shows its rolling 5-hour Session and weekly
+  buckets beside the other provider pools.
+
 ## [0.11.0] - 2026-09-04
 
 ### Added

{playmaker_cli-0.11.0 → playmaker_cli-0.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: playmaker-cli
-Version: 0.11.0
+Version: 0.12.1
 Summary: Playing-coach CLI for orchestrating Claude Code, Codex, Antigravity, Kimi Code and opencode sub-agents in parallel.
 Project-URL: Homepage, https://github.com/vladsafedev/playmaker
 Project-URL: Repository, https://github.com/vladsafedev/playmaker
@@ -446,6 +446,10 @@ whole Z.ai block. Routing a subtask is choosing which of them to spend.
   lane pointed at a local model spends nothing here. Shows *unsupported* rather
   than an error when no Z.ai credential exists. `MCP tools` is the monthly
   web-search/reader pool, not inference.
+- **Kimi Code** — managed usage API; OAuth token from
+  `~/.kimi-code/credentials/kimi-code-env-*.json` (`$KIMI_CODE_HOME` overrides
+  the root). Its 5-hour `Session` and weekly rows are separate percentage
+  buckets; no credential reads as *unsupported* rather than a failed probe.
 
 Reading these at *model* granularity is the point: they are the load-balancing
 input the coach skill uses to route each subtask.

{playmaker_cli-0.11.0 → playmaker_cli-0.12.1}/README.md

@@ -419,6 +419,10 @@ whole Z.ai block. Routing a subtask is choosing which of them to spend.
   lane pointed at a local model spends nothing here. Shows *unsupported* rather
   than an error when no Z.ai credential exists. `MCP tools` is the monthly
   web-search/reader pool, not inference.
+- **Kimi Code** — managed usage API; OAuth token from
+  `~/.kimi-code/credentials/kimi-code-env-*.json` (`$KIMI_CODE_HOME` overrides
+  the root). Its 5-hour `Session` and weekly rows are separate percentage
+  buckets; no credential reads as *unsupported* rather than a failed probe.
 
 Reading these at *model* granularity is the point: they are the load-balancing
 input the coach skill uses to route each subtask.

{playmaker_cli-0.11.0 → playmaker_cli-0.12.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "playmaker-cli"
-version = "0.11.0"
+version = "0.12.1"
 description = "Playing-coach CLI for orchestrating Claude Code, Codex, Antigravity, Kimi Code and opencode sub-agents in parallel."
 readme = "README.md"
 requires-python = ">=3.11"

{playmaker_cli-0.11.0 → playmaker_cli-0.12.1}/skills/playmaker-coach/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: playmaker-coach
-description: Team-lead mode for coding work. Decompose the task into work packages, dispatch them to Claude/Codex/Antigravity(agy)/opencode workers through the `playmaker` CLI, then run an automatic multi-agent review board over every diff before it lands, and drive the fix cycles. Use for ANY request that will change code in more than one place, needs an independent review pass, or has two or more parts that can run at once — "implement", "add", "fix", "refactor", "wire up", "сделай", "почини", "добавь", "реализуй", "собери". NOT for answering a question, reading or explaining code, a single-line edit, or a git/ops command.
+description: Team-lead mode for coding work. Decompose the task into work packages, dispatch them to Claude/Codex/Antigravity(agy)/opencode/Kimi Code(kimi) workers through the `playmaker` CLI, then run an automatic multi-agent review board over every diff before it lands, and drive the fix cycles. Use for ANY request that will change code in more than one place, needs an independent review pass, or has two or more parts that can run at once — "implement", "add", "fix", "refactor", "wire up", "сделай", "почини", "добавь", "реализуй", "собери". NOT for answering a question, reading or explaining code, a single-line edit, or a git/ops command.
 ---
 
 # playmaker-coach — you are the tech lead, not the typist
 
-`playmaker` dispatches sub-tasks to Codex / Antigravity (`agy`) / opencode / a sibling Claude,
-tracks them, and returns their threads. This skill is the judgment on top: what to split,
-who gets which slice, how to size it so verifying is cheap, and **how the review board runs**.
+`playmaker` dispatches sub-tasks to Codex / Antigravity (`agy`) / opencode / Kimi Code (`kimi`) / a
+sibling Claude, tracks them, and returns their threads. This skill is the judgment on top: what to
+split, who gets which slice, how to size it so verifying is cheap, and **how the review board runs**.
 
 **The coach produces plans, prompts, verdicts and integration — not feature diffs.** Your context
 window is the most expensive resource on the table. Every file you read yourself and every line you
@@ -118,7 +118,7 @@ playmaker dispatch <agent> --model <name> --batch "$B" --cwd "$(pwd)" --prompt "
 Detached by default — that is the point; never `--sync` a whole fan-out. Always pass `--cwd`,
 `--batch` (one summary ping for the batch), and `--model` unless the profile says otherwise.
 Prompt shape: `references/prompt-templates.md`. Per-agent traps (agy scratch dir, opencode relative
-paths, codex model roster): `references/agent-gotchas.md`.
+paths, codex model roster, kimi's K2.7 default and exit codes): `references/agent-gotchas.md`.
 
 Parallel WPs that touch the same files go in **git worktrees**, one per WP, or they will collide.
 

{playmaker_cli-0.11.0 → playmaker_cli-0.12.1}/skills/playmaker-coach/references/lanes.md

@@ -44,7 +44,8 @@ against the live roster, failing the dispatch on a stale name.
 | writes files, coach integrates the result directly | in-session sub-agent | write-capable, returns into context |
 | is an independent stream to monitor separately | `dispatch claude --model sonnet` | tracked, detached, spares the top bucket |
 | is heavy reasoning only the coach can do | coach | top tier, serial |
-| is write-heavy and can leave Claude | codex / agy / opencode | their own quotas |
+| is write-heavy and can leave Claude | codex / agy / opencode / kimi | their own quotas |
+| needs senior judgment on a pool nobody else on the machine draws from | `dispatch kimi -m kimi-code/k3-256k` | K3 on its own subscription; slow, so detached only |
 | needs a second strong reviewer without touching the Anthropic bucket | `dispatch agy --model <gemini-pro-high>` | near-senior judgment on an uncontended pool |
 | is bulk work with every subscription low | `dispatch opencode --model <plan>/<model>` | a separate plan, untouched by the others |
 | is mechanical and privacy-sensitive, or all quotas spent | `dispatch opencode --model <local>/<model>` | runs on this machine, costs wall-clock only |
@@ -52,7 +53,7 @@ against the live roster, failing the dispatch on a stale name.
 ## Tier-matching
 
 - **Architectural / spec judgment / cross-module integration** → top tier (coach, top-tier Codex,
-  Gemini-Pro-high on agy for review and advice rather than implementation).
+  K3 on `kimi`, Gemini-Pro-high on agy for review and advice rather than implementation).
 - **Pattern-following implementation, scoped CRUD, mechanical refactor, test scaffolding, writing
   inside an existing convention** → mid tier (Claude Sonnet, Gemini-Pro-low, mid-tier Codex;
   agy's Claude models only when the roster shows a current version). Most delegated implementation lives here.

{playmaker_cli-0.11.0 → playmaker_cli-0.12.1}/skills/playmaker-coach/references/quotas.md

@@ -24,6 +24,9 @@ several tiers with independent buckets, and the whole point of pulling quotas is
 - **Codex:** the main block is the primary Codex window; `Codex — Spark` is a separate block with
   its own `Session` / `Weekly` rows for the Spark model, the junior Codex lane — route Spark work
   off that block, not off the main one.
+- **Kimi Code:** `Session` is its rolling 5-hour bucket and `Weekly` is the subscription's weekly
+  percentage bucket. They are independent of Claude, Codex and the opencode-backed plans, so Kimi
+  is a useful alternate lane when either of those two rows still has headroom.
 - **opencode:** the quota belongs to the *plan behind the provider*, not to the CLI — it appears
   under that provider (e.g. a GLM coding plan's session and weekly credit windows) and reads
   unsupported without a credential. A dispatch pointed at a **local** model spends nothing and never

{playmaker_cli-0.11.0 → playmaker_cli-0.12.1}/src/playmaker/cli.py

@@ -1004,11 +1004,13 @@ def _render_provider(name: str, info: dict) -> None:
         "agy": "green",
         "gemini": "cyan",
         "zai": "yellow",
+        "kimi": "cyan",
         "ollama": "bright_cyan",
     }.get(name, "white")
     display = {
         "agy": "Antigravity (agy)",
         "zai": "Z.ai (GLM, via opencode)",
+        "kimi": "Kimi Code",
         "ollama": "Ollama (local, via opencode)",
     }.get(name, name.capitalize())
     title = f"[bold {label_color}]{display}[/bold {label_color}]"

{playmaker_cli-0.11.0 → playmaker_cli-0.12.1}/src/playmaker/quotas.py

@@ -9,6 +9,8 @@ All providers go through OAuth Bearer tokens; no WebKit, no PTY.
 - Gemini (retired locally): same creds -> cloudcode-pa.googleapis.com
 - Z.ai (GLM, dispatched via opencode): API key in opencode's auth.json ->
   api.z.ai/api/monitor/usage/quota/limit
+- Kimi Code: OAuth credential in ~/.kimi-code/credentials ->
+  api.kimi.ai/coding/v1/usages
 - Ollama (local, also via opencode): no quota to fetch — localhost:11434
   /api/tags is an availability probe reporting unmetered capacity
 """
@@ -22,7 +24,9 @@ import re
 import shutil
 import ssl
 import subprocess
+import tempfile
 import time
+import tomllib
 import urllib.error
 import urllib.parse
 import urllib.request
@@ -1161,6 +1165,303 @@ def zai_probe() -> dict:
     }
 
 
+# ---- Kimi Code --------------------------------------------------------------
+
+
+_KIMI_CODE_DEFAULT_BASE_URL = "https://api.kimi.ai/coding/v1"
+_KIMI_CODE_DEFAULT_OAUTH_HOST = "https://auth.kimi.ai"
+
+# Public installed-app client id from kimi-code 0.41.0's OAuth bundle. The
+# bundle refreshes at <oauth_host>/api/oauth/token with this form body.
+_KIMI_CODE_OAUTH_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098"
+
+
+def _kimi_code_home() -> Path:
+    configured = os.environ.get("KIMI_CODE_HOME")
+    return Path(configured).expanduser() if configured else Path("~/.kimi-code").expanduser()
+
+
+def _kimi_load_config(home: Path) -> dict:
+    try:
+        config = tomllib.loads((home / "config.toml").read_text(encoding="utf-8"))
+    except (OSError, tomllib.TOMLDecodeError):
+        return {}
+    return config if isinstance(config, dict) else {}
+
+
+def _kimi_provider_config(config: dict) -> dict:
+    providers = config.get("providers")
+    if not isinstance(providers, dict):
+        return {}
+    provider = providers.get("managed:kimi-code")
+    return provider if isinstance(provider, dict) else {}
+
+
+def _kimi_runtime_urls(config: dict) -> tuple[str, str]:
+    """Return the configured managed API and OAuth hosts, defaulting global."""
+    provider = _kimi_provider_config(config)
+    base_url = provider.get("base_url") or provider.get("baseUrl")
+    oauth = provider.get("oauth")
+    oauth = oauth if isinstance(oauth, dict) else {}
+    oauth_host = oauth.get("oauth_host") or oauth.get("oauthHost")
+    resolved_base_url = (
+        str(base_url).rstrip("/")
+        if isinstance(base_url, str) and base_url
+        else _KIMI_CODE_DEFAULT_BASE_URL
+    )
+    resolved_oauth_host = (
+        str(oauth_host).rstrip("/")
+        if isinstance(oauth_host, str) and oauth_host
+        else _KIMI_CODE_DEFAULT_OAUTH_HOST
+    )
+    return (
+        resolved_base_url,
+        resolved_oauth_host,
+    )
+
+
+def _kimi_credential_paths(home: Path, config: dict) -> list[Path]:
+    """Prefer this environment's configured OAuth file, then other CLI files."""
+    credentials_dir = home / "credentials"
+    provider = _kimi_provider_config(config)
+    oauth = provider.get("oauth")
+    oauth = oauth if isinstance(oauth, dict) else {}
+    oauth_key = oauth.get("key")
+    configured: list[Path] = []
+    if isinstance(oauth_key, str):
+        name = Path(oauth_key).name
+        if name.startswith("kimi-code-env-"):
+            configured.append(credentials_dir / f"{name}.json")
+
+    try:
+        discovered = sorted(
+            credentials_dir.glob("kimi-code-env-*.json"),
+            key=lambda path: path.stat().st_mtime,
+            reverse=True,
+        )
+    except OSError:
+        discovered = []
+    return configured + [path for path in discovered if path not in configured]
+
+
+def _kimi_load_credentials() -> tuple[dict, Path, dict] | None:
+    home = _kimi_code_home()
+    config = _kimi_load_config(home)
+    for path in _kimi_credential_paths(home, config):
+        try:
+            credentials = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            continue
+        if isinstance(credentials, dict) and isinstance(credentials.get("access_token"), str):
+            return credentials, path, config
+    return None
+
+
+def _kimi_save_credentials(path: Path, credentials: dict) -> None:
+    tmp_path: Path | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="w",
+            encoding="utf-8",
+            dir=path.parent,
+            prefix=f".{path.name}.",
+            suffix=".tmp",
+            delete=False,
+        ) as tmp:
+            tmp_path = Path(tmp.name)
+            tmp_path.chmod(0o600)
+            tmp.write(json.dumps(credentials, indent=2) + "\n")
+        tmp_path.replace(path)
+    finally:
+        if tmp_path is not None:
+            try:
+                tmp_path.unlink()
+            except FileNotFoundError:
+                pass
+
+
+def _kimi_refresh(credentials: dict, path: Path, oauth_host: str) -> dict:
+    """Refresh a Kimi CLI OAuth token and persist it to its existing file."""
+    refresh_token = credentials.get("refresh_token")
+    if not isinstance(refresh_token, str) or not refresh_token:
+        raise RuntimeError("no refresh_token in Kimi credential")
+    body = urllib.parse.urlencode(
+        {
+            "client_id": _KIMI_CODE_OAUTH_CLIENT_ID,
+            "grant_type": "refresh_token",
+            "refresh_token": refresh_token,
+        }
+    )
+    response = _http_json(
+        f"{oauth_host.rstrip('/')}/api/oauth/token",
+        method="POST",
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        body=body,
+    )
+    access_token = response.get("access_token")
+    expires_in = response.get("expires_in")
+    if not isinstance(access_token, str) or not access_token:
+        raise RuntimeError("Kimi token refresh response missing access_token")
+    if not isinstance(expires_in, (int, float)) or expires_in <= 0:
+        raise RuntimeError("Kimi token refresh response missing expires_in")
+
+    refreshed = dict(credentials)
+    refreshed["access_token"] = access_token
+    if isinstance(response.get("refresh_token"), str) and response["refresh_token"]:
+        refreshed["refresh_token"] = response["refresh_token"]
+    refreshed["expires_in"] = int(expires_in)
+    refreshed["expires_at"] = int(time.time()) + int(expires_in)
+    if isinstance(response.get("token_type"), str):
+        refreshed["token_type"] = response["token_type"]
+    if isinstance(response.get("scope"), str):
+        refreshed["scope"] = response["scope"]
+    _kimi_save_credentials(path, refreshed)
+    return refreshed
+
+
+def _humanize_kimi_tier(level: object) -> str | None:
+    if not isinstance(level, str) or not level:
+        return None
+    suffix = level.removeprefix("LEVEL_")
+    return suffix.replace("_", " ").title()
+
+
+def _kimi_window(
+    name: str, detail: dict, *, window_seconds: float, include_forecast: bool
+) -> dict | None:
+    limit = detail.get("limit")
+    remaining = detail.get("remaining")
+    used = detail.get("used")
+    if not isinstance(limit, (int, float, str)):
+        return None
+    try:
+        limit_value = float(limit)
+        if isinstance(remaining, (int, float, str)):
+            remaining_value = float(remaining)
+        elif isinstance(used, (int, float, str)):
+            # The live API omits `remaining` at 0%, while retaining `used`.
+            remaining_value = limit_value - float(used)
+        else:
+            return None
+    except ValueError:
+        return None
+    if limit_value <= 0:
+        return None
+
+    reset_at = detail.get("resetTime")
+    reset_iso = reset_at if isinstance(reset_at, str) else None
+    forecast: str | None = None
+    if include_forecast and reset_iso:
+        try:
+            reset_dt = datetime.fromisoformat(reset_iso.replace("Z", "+00:00"))
+            elapsed = max(0.0, window_seconds - (reset_dt.timestamp() - time.time()))
+            used_pct = max(0.0, min(100.0, 100 - (remaining_value / limit_value * 100)))
+            forecast = _forecast_label(used_pct, window_seconds, elapsed)
+        except ValueError:
+            pass
+    return {
+        "name": name,
+        "pct_left": max(0, min(100, int(round(remaining_value / limit_value * 100)))),
+        "reset_at_iso": reset_iso,
+        "reset_relative": _format_relative(reset_iso),
+        "forecast": forecast,
+        "reserve_pct": None,
+    }
+
+
+def kimi_probe() -> dict:
+    """Kimi Code OAuth usage, as reported by its managed `/usages` endpoint.
+
+    `usage` is the weekly percentage bucket. `limits[]` holds rolling windows;
+    the 300-minute detail is Kimi Code's session quota. The stored access token
+    is intentionally never refreshed by making a chat request: when it is
+    expired, this uses the CLI's documented OAuth refresh request instead.
+    """
+    loaded = _kimi_load_credentials()
+    if loaded is None:
+        return {
+            "status": "unsupported",
+            "reason": "no Kimi Code credential — run `kimi login --region global`",
+        }
+    credentials, credentials_path, config = loaded
+    access_token = credentials.get("access_token")
+    expires_at = credentials.get("expires_at")
+    base_url, oauth_host = _kimi_runtime_urls(config)
+    if not isinstance(access_token, str) or not access_token:
+        return {
+            "status": "unsupported",
+            "reason": "Kimi token expired — run any `kimi` command to refresh it",
+        }
+    if not isinstance(expires_at, (int, float)) or expires_at <= time.time():
+        if (
+            not isinstance(credentials.get("refresh_token"), str)
+            or not credentials["refresh_token"]
+        ):
+            return {
+                "status": "unsupported",
+                "reason": "Kimi token expired — run any `kimi` command to refresh it",
+            }
+        credentials = _kimi_refresh(credentials, credentials_path, oauth_host)
+        access_token = credentials["access_token"]
+
+    try:
+        response = _http_json(
+            f"{base_url.rstrip('/')}/usages",
+            headers={"Authorization": f"Bearer {access_token}"},
+        )
+    except RuntimeError as exc:
+        if "HTTP 401" not in str(exc) or not isinstance(credentials.get("refresh_token"), str):
+            raise
+        credentials = _kimi_refresh(credentials, credentials_path, oauth_host)
+        response = _http_json(
+            f"{base_url.rstrip('/')}/usages",
+            headers={"Authorization": f"Bearer {credentials['access_token']}"},
+        )
+
+    usage = response.get("usage")
+    limits = response.get("limits")
+    user = response.get("user")
+    if not isinstance(usage, dict) or not isinstance(limits, list) or not isinstance(user, dict):
+        return {
+            "status": "unsupported",
+            "reason": f"unrecognised quota payload: {str(response)[:200]}",
+        }
+    membership = user.get("membership")
+
+    session: dict | None = None
+    for limit in limits:
+        if not isinstance(limit, dict):
+            continue
+        window = limit.get("window")
+        detail = limit.get("detail")
+        if (
+            isinstance(window, dict)
+            and window.get("duration") == 300
+            and window.get("timeUnit") == "TIME_UNIT_MINUTE"
+            and isinstance(detail, dict)
+        ):
+            # Session windows churn too quickly for a useful pace forecast,
+            # matching the Claude and Z.ai rows in this table.
+            session = _kimi_window(
+                "Session", detail, window_seconds=5 * 3600, include_forecast=False
+            )
+            break
+    weekly = _kimi_window("Weekly", usage, window_seconds=7 * 86400, include_forecast=True)
+    if session is None or weekly is None:
+        return {
+            "status": "unsupported",
+            "reason": f"unrecognised quota payload: {str(response)[:200]}",
+        }
+
+    level = membership.get("level") if isinstance(membership, dict) else None
+    return {
+        "status": "ok",
+        "account_email": None,
+        "tier": _humanize_kimi_tier(level),
+        "windows": [session, weekly],
+    }
+
+
 # ---- Ollama (local, unmetered) ----------------------------------------------
 
 # Ollama's own API, not the OpenAI-compatible /v1 shim that opencode dispatches
@@ -1285,6 +1586,7 @@ PROBES = {
     "claude": claude_probe,
     "agy": antigravity_probe,
     "zai": zai_probe,
+    "kimi": kimi_probe,
     "ollama": ollama_probe,
 }
 

playmaker_cli-0.12.1/tests/test_quotas_kimi.py

@@ -0,0 +1,220 @@
+"""Kimi Code quota probe."""
+
+from __future__ import annotations
+
+import json
+import stat
+import sys
+import time
+import urllib.parse
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+import playmaker.quotas as quotas
+
+# Captured verbatim from https://api.kimi.ai/coding/v1/usages on a live
+# Moderato (LEVEL_BASIC) account, 2026-09-04. `usage` is the weekly percent
+# bucket; each `limits[]` entry is a rolling window, here five hours.
+_PAYLOAD = json.loads(
+    '{"user":{"userId":"d9gg8obmrb73tddocqb0","region":"REGION_OVERSEA","membership":{"level":"LEVEL_BASIC"},"businessId":""},"usage":{"limit":"100","used":"1","remaining":"99","resetTime":"2026-09-11T14:50:20.391966Z"},"limits":[{"window":{"duration":300,"timeUnit":"TIME_UNIT_MINUTE"},"detail":{"limit":"100","used":"3","remaining":"97","resetTime":"2026-09-04T19:50:20.391966Z"}}],"parallel":{"limit":"10"},"totalQuota":{},"authentication":{"method":"METHOD_ACCESS_TOKEN","scope":"FEATURE_CODING"},"subType":"TYPE_PURCHASE","domain":"DOMAIN_NEXUS","version":"GOODS_VERSION_V1"}'
+)
+
+
+@pytest.fixture
+def credential(monkeypatch, tmp_path) -> Path:
+    """Point the probe at the Kimi CLI's global managed-provider credential."""
+    home = tmp_path / "kimi-code"
+    monkeypatch.setenv("KIMI_CODE_HOME", str(home))
+    credentials = home / "credentials" / "kimi-code-env-deadbeef.json"
+    credentials.parent.mkdir(parents=True)
+    credentials.write_text(
+        json.dumps(
+            {
+                "access_token": "access-test",
+                "refresh_token": "refresh-test",
+                "expires_at": int(time.time()) + 900,
+                "expires_in": 900,
+                "token_type": "Bearer",
+                "scope": "kimi-code",
+            }
+        ),
+        encoding="utf-8",
+    )
+    credentials.chmod(0o600)
+    (home / "config.toml").write_text(
+        """[providers.\"managed:kimi-code\"]
+base_url = "https://api.kimi.ai/coding/v1"
+
+[providers.\"managed:kimi-code\".oauth]
+key = "oauth/kimi-code-env-deadbeef"
+oauth_host = "https://auth.kimi.ai"
+""",
+        encoding="utf-8",
+    )
+    return credentials
+
+
+def _respond(monkeypatch, payload: dict) -> dict:
+    seen: dict = {}
+
+    def fake(url, **kwargs):
+        seen["url"] = url
+        seen["headers"] = kwargs.get("headers") or {}
+        return payload
+
+    monkeypatch.setattr(quotas, "_http_json", fake)
+    return seen
+
+
+def test_usage_is_normalized_to_session_and_weekly(monkeypatch, credential) -> None:
+    _respond(monkeypatch, _PAYLOAD)
+
+    result = quotas.kimi_probe()
+
+    assert result["status"] == "ok"
+    assert result["tier"] == "Basic"
+    assert [(window["name"], window["pct_left"]) for window in result["windows"]] == [
+        ("Session", 97),
+        ("Weekly", 99),
+    ]
+
+
+def test_usage_endpoint_and_bearer_token_follow_the_managed_config(monkeypatch, credential) -> None:
+    seen = _respond(monkeypatch, _PAYLOAD)
+
+    quotas.kimi_probe()
+
+    assert seen["url"] == "https://api.kimi.ai/coding/v1/usages"
+    assert seen["headers"]["Authorization"] == "Bearer access-test"
+
+
+def test_session_keeps_its_reset_time_but_has_no_pace_forecast(monkeypatch, credential) -> None:
+    _respond(monkeypatch, _PAYLOAD)
+
+    session, weekly = quotas.kimi_probe()["windows"]
+
+    assert session["reset_at_iso"] == "2026-09-04T19:50:20.391966Z"
+    assert session["forecast"] is None
+    assert weekly["reset_at_iso"] == "2026-09-11T14:50:20.391966Z"
+
+
+def test_an_exhausted_window_without_remaining_still_renders(monkeypatch, credential) -> None:
+    payload = json.loads(json.dumps(_PAYLOAD))
+    detail = payload["limits"][0]["detail"]
+    detail["used"] = "100"
+    detail.pop("remaining")
+    _respond(monkeypatch, payload)
+
+    session = quotas.kimi_probe()["windows"][0]
+
+    assert session["pct_left"] == 0
+
+
+def test_expired_token_uses_the_cli_refresh_request_and_persists_it(
+    monkeypatch, credential
+) -> None:
+    expired = json.loads(credential.read_text(encoding="utf-8"))
+    expired["expires_at"] = int(time.time()) - 1
+    credential.write_text(json.dumps(expired), encoding="utf-8")
+    seen: list[tuple[str, dict]] = []
+
+    def fake(url, **kwargs):
+        seen.append((url, kwargs))
+        if url == "https://auth.kimi.ai/api/oauth/token":
+            return {
+                "access_token": "access-refreshed",
+                "refresh_token": "refresh-refreshed",
+                "expires_in": 900,
+                "token_type": "Bearer",
+                "scope": "kimi-code",
+            }
+        return _PAYLOAD
+
+    monkeypatch.setattr(quotas, "_http_json", fake)
+
+    result = quotas.kimi_probe()
+
+    assert result["status"] == "ok"
+    refresh_url, refresh_kwargs = seen[0]
+    assert refresh_url == "https://auth.kimi.ai/api/oauth/token"
+    assert refresh_kwargs["method"] == "POST"
+    assert refresh_kwargs["headers"]["Content-Type"] == "application/x-www-form-urlencoded"
+    assert urllib.parse.parse_qs(refresh_kwargs["body"]) == {
+        "client_id": ["17e5f671-d194-4dfb-9706-5516cb48c098"],
+        "grant_type": ["refresh_token"],
+        "refresh_token": ["refresh-test"],
+    }
+    saved = json.loads(credential.read_text(encoding="utf-8"))
+    assert saved["access_token"] == "access-refreshed"
+    assert saved["refresh_token"] == "refresh-refreshed"
+    assert stat.S_IMODE(credential.stat().st_mode) == 0o600
+    assert seen[1][1]["headers"]["Authorization"] == "Bearer access-refreshed"
+
+
+def test_credential_write_uses_a_mode_600_sibling_temp_file(monkeypatch, credential) -> None:
+    seen: dict = {}
+    original_replace = Path.replace
+
+    def record_replace(source: Path, target: Path) -> Path:
+        seen["source"] = source
+        seen["target"] = target
+        seen["mode_at_replace"] = stat.S_IMODE(source.stat().st_mode)
+        return original_replace(source, target)
+
+    monkeypatch.setattr(Path, "replace", record_replace)
+
+    quotas._kimi_save_credentials(credential, {"access_token": "saved"})
+
+    assert seen["source"].parent == credential.parent
+    assert seen["source"] != credential
+    assert seen["source"].name.startswith(f".{credential.name}.")
+    assert seen["target"] == credential
+    assert seen["mode_at_replace"] == 0o600
+    assert stat.S_IMODE(credential.stat().st_mode) == 0o600
+    assert json.loads(credential.read_text(encoding="utf-8")) == {"access_token": "saved"}
+
+
+def test_expired_token_without_a_refresh_token_is_unsupported(monkeypatch, credential) -> None:
+    expired = json.loads(credential.read_text(encoding="utf-8"))
+    expired.pop("refresh_token")
+    expired["expires_at"] = int(time.time()) - 1
+    credential.write_text(json.dumps(expired), encoding="utf-8")
+
+    result = quotas.kimi_probe()
+
+    assert result == {
+        "status": "unsupported",
+        "reason": "Kimi token expired — run any `kimi` command to refresh it",
+    }
+
+
+def test_no_credential_is_unsupported_not_an_error(monkeypatch, tmp_path) -> None:
+    monkeypatch.setenv("KIMI_CODE_HOME", str(tmp_path / "kimi-code"))
+
+    result = quotas.kimi_probe()
+
+    assert result["status"] == "unsupported"
+    assert "no Kimi Code credential" in result["reason"]
+
+
+def test_a_reshaped_payload_is_unsupported_rather_than_an_error(monkeypatch, credential) -> None:
+    _respond(monkeypatch, {"usage": {"limit": "100"}, "limits": []})
+
+    result = quotas.kimi_probe()
+
+    assert result["status"] == "unsupported"
+    assert "unrecognised" in result["reason"]
+
+
+def test_a_truthy_non_object_user_is_unsupported_not_an_error(monkeypatch, credential) -> None:
+    payload = json.loads(json.dumps(_PAYLOAD))
+    payload["user"] = "gap"
+    _respond(monkeypatch, payload)
+
+    result = quotas.kimi_probe()
+
+    assert result["status"] == "unsupported"
+    assert "unrecognised" in result["reason"]