Fix auth discovery and refresh parity

Author: lemon07r

AGENTS.md

@@ -43,14 +43,14 @@ Data flow on a chat request:
 1. opencode asks the `@ai-sdk/openai-compatible` provider for a language model.
 2. Before instantiating it, opencode calls our `auth.loader`. We return `{ apiKey, fetch }`.
 3. The SDK uses our `fetch` for every HTTP call (models, chat, whatever).
-4. Our `fetch` calls `ensureFresh()` → maybe refreshes → sets Authorization + the seven `X-Msh-*` headers → on 401 refreshes once and retries.
+4. Our `fetch` calls `ensureFresh()` → maybe refreshes → lazily discovers `/coding/v1/models` when needed → sets Authorization + the seven `X-Msh-*` headers → on 401 refreshes once and retries.
 5. Separately, opencode runs the `chat.params` hook and writes `thinking`, `reasoning_effort`, `prompt_cache_key` into `output.options`. opencode wraps those as `{ [providerID]: options }` and the openai-compatible SDK forwards them as top-level body fields. That is why those keys must use **exactly** the wire names (`prompt_cache_key`, `reasoning_effort`, `thinking`).
 
 ### Contracts to keep intact
 
 These are the invariants that, if broken, silently degrade K2.6 → K2.5 or produce fingerprint-based throttling. Do not "clean them up" without reading the linked upstream.
 
-1. **`X-Msh-Version` and `User-Agent` must track `kimi-cli`.** Bumping involves exactly one line in `src/constants.ts`. See upstream `research/kimi-cli/src/kimi_cli/constant.py`. The UA prefix is `KimiCLI/` (not `KimiCodeCLI/`) — Moonshot's `kimi-for-coding` backend 403s with `access_terminated_error: only available for Coding Agents such as Kimi CLI, Claude Code, Roo Code…` on any other prefix. Likewise, `X-Msh-Device-Model` is `"{system} {release} {machine}"` (e.g. `Linux 7.0.0 x86_64`) — NOT just `{arch}` — and `X-Msh-Os-Version` is the kernel build string from `os.version()`, NOT `"{type} {release}"`. Tested live against `api.kimi.com/coding/v1` on 2026-04-17 — any of those three fields off-spec → 403.
+1. **`X-Msh-Version` and `User-Agent` must track `kimi-cli`.** Bumping involves exactly one line in `src/constants.ts`. See upstream `research/kimi-cli/src/kimi_cli/constant.py`. The UA prefix is `KimiCLI/` (not `KimiCodeCLI/`) — Moonshot's `kimi-for-coding` backend 403s with `access_terminated_error: only available for Coding Agents such as Kimi CLI, Claude Code, Roo Code…` on any other prefix. Likewise, `X-Msh-Device-Model` must mirror kimi-cli's `_device_model()` shape, including the Darwin/Windows special cases (`macOS <version> <arch>`, `Windows 10/11 <arch>`, Linux `"{system} {release} {machine}"`) — NOT just `{arch}` — and `X-Msh-Os-Version` is the kernel build string from `os.version()`, NOT `"{type} {release}"`. Tested live against `api.kimi.com/coding/v1` on 2026-04-17 — any of those three fields off-spec → 403.
 2. **`X-Msh-Device-Id` must be stable across runs.** Never regenerate a fresh UUID at import time. `getDeviceId()` reads/writes `~/.kimi/device_id`; that path is shared with `kimi-cli` on purpose.
 3. **`Authorization` header is owned by `loader.fetch`.** Anything else (opencode core, the SDK, future hooks) must be overridden. Our `loader` deletes both `authorization` and `Authorization` before setting its own.
 4. **Effort ↔ fields mapping** (kimi-cli `llm.py` / `kosong/chat_provider/kimi.py`):
@@ -66,8 +66,8 @@ These are the invariants that, if broken, silently degrade K2.6 → K2.5 or prod
    `auto` is the "let the server decide dynamically" variant — neither field is sent, matching kimi-cli's "nothing passed" default. When no effort is set at all, the plugin still emits `thinking: {type: "enabled"}` because the model is a reasoner. Gate the hook on `input.model.providerID` — NOT `input.provider.info.id`. The `@opencode-ai/plugin` `ProviderContext` type claims `.info.id` exists, but the runtime shape opencode passes (see `research/opencode/packages/opencode/src/session/llm.ts::stream`, ~line 168, `provider: item`) is the flat `ProviderConfig` (`.id`). `input.model.providerID` is what every first-party plugin uses (cloudflare.ts, codex.ts, github-copilot/copilot.ts) and it avoids the runtime crash "undefined is not an object (evaluating 'input.provider.info.id')". Tested live 2026-04-17.
 
 5. **`prompt_cache_key` only for `kimi-for-coding`.** Never attach it to unrelated models. The check is `input.model.id === MODEL_ID` in `chat.params`.
-6. **Wire model id comes from `/coding/v1/models`, not from user config.** The opencode-side model id is a stable alias (`MODEL_ID = "kimi-for-coding"`); the plugin calls `GET /coding/v1/models` at login and on every token refresh (mirroring kimi-cli's `refresh_managed_models` in `research/kimi-cli/src/kimi_cli/auth/platforms.py`), caches the first returned `{id, context_length, display_name}` in `auth.json` as `model_id`/`context_length`/`model_display`, and rewrites the JSON body `model` field inside `loader.fetch` whenever the cached id differs from `MODEL_ID` (the K2.5 case — server may return `k2p5` instead). K2.6 accounts see `id: "kimi-for-coding"` and the rewrite is a no-op. Do not strip the `kimi-` prefix; send whatever the server returned. Discovery failures are non-fatal (stale cached id still works; 401 retry flushes broken tokens).
-7. **Auth store is opencode's, not kimi-cli's.** We use `client.auth.get/set` against the `kimi-for-coding-oauth` provider id. Do not read/write `~/.kimi/credentials/kimi-code.json`; that's kimi-cli's file and sharing it across independent apps causes token-race bugs.
+6. **Wire model id comes from `/coding/v1/models`, not from user config.** The opencode-side model id is a stable alias (`MODEL_ID = "kimi-for-coding"`); the plugin calls `GET /coding/v1/models` at login and on every token refresh (mirroring kimi-cli's `refresh_managed_models` in `research/kimi-cli/src/kimi_cli/auth/platforms.py`), caches the first returned `{id, context_length, display_name}` in loader memory, and rewrites the JSON body `model` field inside `loader.fetch` whenever the discovered id differs from `MODEL_ID` (the K2.5 case — server may return `k2p5` instead). A new loader instance re-discovers on first use if needed. K2.6 accounts see `id: "kimi-for-coding"` and the rewrite is a no-op. Do not strip the `kimi-` prefix; send whatever the server returned. Discovery failures are non-fatal (warm cached id still works; 401 retry flushes broken tokens).
+7. **Auth store is opencode's, not kimi-cli's.** We use opencode's auth store for tokens under the `kimi-for-coding-oauth` provider id. Do not read/write `~/.kimi/credentials/kimi-code.json`; that's kimi-cli's file and sharing it across independent apps causes token-race bugs. Also note that opencode's SDK auth schema only persists the standard oauth fields, so model discovery metadata cannot be stored there durably.
 8. **Provider id must not collide with any id in the [models.dev](https://models.dev) catalog.** models.dev publishes `kimi-for-coding` (static `KIMI_API_KEY` → `@ai-sdk/anthropic` → K2.5). If we registered under that same id, `opencode auth login kimi-for-coding` would surface two methods under one entry and users picking the API-key one would silently land on K2.5. We deliberately use `kimi-for-coding-oauth` instead; `MODEL_ID` on the wire stays `kimi-for-coding` (rule 6).
 9. **`src/index.ts` must have exactly one export — the default plugin function.** opencode's plugin loader (`research/opencode/packages/opencode/src/plugin/index.ts` → `getLegacyPlugins`) iterates every export of the plugin module and throws `Plugin export is not a function` if any named export is not callable. The failure mode is silent in the CLI (the provider just doesn't appear in `opencode auth login`); the error only surfaces in `~/.local/share/opencode/log/*.log`. Keep constants in `src/constants.ts` and import them in `src/index.ts` rather than re-exporting. `test/exports.test.ts` guards this.
 
@@ -103,7 +103,7 @@ bun test                                           # offline unit tests
 
 Online (requires a real Kimi-for-coding account):
 
-1. `cd ~/.opencode && bun add /path/to/this/repo`
+1. Install the local checkout via opencode's plugin flow (`opencode plugin /path/to/this/repo --global`) or point the `plugin` array in your opencode config at the repo root, as shown in `README.md`.
 2. Paste the provider block from `README.md` into your opencode config.
 3. `opencode auth login kimi-for-coding-oauth` — confirm a token lands in opencode's `auth.json` with `type: "oauth"`, a JWT `access`, and `expires` ~15 min in the future.
 4. Start opencode, select `kimi-for-coding-oauth/kimi-for-coding`, and ask the model to self-identify. It should claim to be K2.6 / `kimi-for-coding`.

README.md

@@ -99,7 +99,7 @@ Two identifiers are load-bearing:
 opencode auth login -p kimi-for-coding-oauth
 ```
 
-The plugin returns a verification URL and user code. After browser approval it polls the device-auth endpoint, queries `/coding/v1/models` to discover the current model id and context length for your account, prints a config snippet with that context length filled in, and stores the token plus discovered model metadata in opencode's auth store. Model discovery runs again on every token refresh. Access tokens refresh automatically, and the loader retries once after a `401`.
+The plugin returns a verification URL and user code. After browser approval it polls the device-auth endpoint, queries `/coding/v1/models` to discover the current model id and context length for your account, prints a config snippet with that context length filled in, and stores the token in opencode's auth store. Model discovery runs again on every token refresh, and a fresh loader instance will re-query `/coding/v1/models` on first use if it needs the current wire model id. Access tokens refresh automatically, and the loader retries once after a `401`.
 
 ### Use
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-kimi-full",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "OpenCode plugin that adds first-class support for Kimi K2.6 (kimi-for-coding) via the official Kimi OAuth device flow, matching the upstream kimi-cli 1:1.",
   "license": "MIT",
   "repository": {
@@ -38,6 +38,9 @@
   "peerDependencies": {
     "@opencode-ai/plugin": ">=1.4.6"
   },
+  "engines": {
+    "opencode": ">=1.4.6"
+  },
   "devDependencies": {
     "@opencode-ai/plugin": "^1.4.7",
     "typescript": "^5.6.0",

src/headers.ts

@@ -2,6 +2,7 @@ import os from "node:os"
 import fs from "node:fs"
 import path from "node:path"
 import crypto from "node:crypto"
+import childProcess from "node:child_process"
 import { KIMI_CLI_VERSION, USER_AGENT } from "./constants.ts"
 
 // kimi-cli persists its device id at `~/.kimi/device_id` as a plain UUIDv4
@@ -27,10 +28,67 @@ export function getDeviceId(): string {
 }
 
 // Non-ASCII characters in HTTP headers will be rejected by Node's undici
-// fetch (`TypeError: Invalid character in header content`). kimi-cli does the
-// same sanitization in oauth._ascii_header_value.
-function ascii(value: string): string {
-  return value.replace(/[^\x20-\x7e]/g, "?")
+// fetch (`TypeError: Invalid character in header content`). kimi-cli strips
+// non-ASCII bytes in oauth._ascii_header_value; we do the same while also
+// dropping control characters to stay within Node's header rules.
+export function asciiHeaderValue(value: string, fallback = "unknown"): string {
+  const sanitized = value.replace(/[^\x20-\x7e]/g, "").trim()
+  return sanitized || fallback
+}
+
+let cachedMacVersion: string | undefined
+
+function macProductVersion(): string | undefined {
+  if (process.platform !== "darwin") return undefined
+  if (cachedMacVersion !== undefined) return cachedMacVersion || undefined
+  try {
+    cachedMacVersion = childProcess.execFileSync("sw_vers", ["-productVersion"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim()
+  } catch {
+    cachedMacVersion = ""
+  }
+  return cachedMacVersion || undefined
+}
+
+/**
+ * Mirrors kimi-cli's `_device_model()` logic in research/kimi-cli/src/
+ * kimi_cli/auth/oauth.py, including the Darwin/Windows special cases.
+ */
+export function kimiDeviceModel(input?: {
+  system?: string
+  release?: string
+  machine?: string
+  macVersion?: string
+}) {
+  const system = input?.system ?? os.type()
+  const release = input?.release ?? os.release()
+  const machine = input?.machine ?? os.machine?.() ?? os.arch()
+
+  if (system === "Darwin") {
+    const version = input?.macVersion ?? macProductVersion() ?? release
+    if (version && machine) return `macOS ${version} ${machine}`
+    if (version) return `macOS ${version}`
+    return `macOS ${machine}`.trim()
+  }
+
+  if (system === "Windows_NT") {
+    const parts = release.split(".")
+    const build = Number(parts[2] ?? "")
+    const label = parts[0] === "10" ? (Number.isFinite(build) && build >= 22000 ? "11" : "10") : release
+    if (label && machine) return `Windows ${label} ${machine}`
+    if (label) return `Windows ${label}`
+    return `Windows ${machine}`.trim()
+  }
+
+  if (system) {
+    if (release && machine) return `${system} ${release} ${machine}`
+    if (release) return `${system} ${release}`
+    return `${system} ${machine}`.trim()
+  }
+
+  return "Unknown"
 }
 
 /**
@@ -46,14 +104,13 @@ function ascii(value: string): string {
  *   - platform.version() → os.version()  (kernel build string on Linux)
  */
 export function kimiHeaders(): Record<string, string> {
-  const machine = os.machine?.() || os.arch()
   return {
     "User-Agent": USER_AGENT,
     "X-Msh-Platform": "kimi_cli",
     "X-Msh-Version": KIMI_CLI_VERSION,
-    "X-Msh-Device-Name": ascii(os.hostname() || "unknown"),
-    "X-Msh-Device-Model": ascii(`${os.type()} ${os.release()} ${machine}`),
+    "X-Msh-Device-Name": asciiHeaderValue(os.hostname() || "unknown"),
+    "X-Msh-Device-Model": asciiHeaderValue(kimiDeviceModel()),
     "X-Msh-Device-Id": getDeviceId(),
-    "X-Msh-Os-Version": ascii(os.version?.() || `${os.type()} ${os.release()}`),
+    "X-Msh-Os-Version": asciiHeaderValue(os.version?.() || `${os.type()} ${os.release()}`),
   }
 }