feat(kimi): merge OAuth into dual-auth provider, add K3/K2.7 models

Gộp kimi-coding vào kimi (oauth+apikey), parity CLIProxyAPI device flow/headers/refresh.
Thêm K3 + K2.7 Code (+ Kimi Code ids), pricing/caps vision, cập nhật baseline.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/lib/oauth/constants/oauth.js

@@ -89,12 +89,18 @@ export const CURSOR_CONFIG = {
   },
 };
 
-// Kimi Coding OAuth Configuration (Device Code Flow)
-// clientId uses env override — dynamic, not stored in registry
-export const KIMI_CODING_CONFIG = {
-  ...PROVIDER_OAUTH["kimi-coding"],
-  clientId: process.env.KIMI_CODING_OAUTH_CLIENT_ID || REGISTRY_PROVIDERS["kimi-coding"]?.clientId,
+// Kimi Code OAuth (Device Code Flow) — merged into provider id `kimi` (dual auth)
+// clientId: registry first, env override for forks
+export const KIMI_CONFIG = {
+  ...PROVIDER_OAUTH["kimi"],
+  clientId:
+    process.env.KIMI_CODING_OAUTH_CLIENT_ID ||
+    process.env.KIMI_OAUTH_CLIENT_ID ||
+    REGISTRY_PROVIDERS["kimi"]?.clientId ||
+    PROVIDER_OAUTH["kimi"]?.clientId,
 };
+// Back-compat alias for any remaining KIMI_CODING_CONFIG imports
+export const KIMI_CODING_CONFIG = KIMI_CONFIG;
 
 // KiloCode OAuth Configuration (Custom Device Auth Flow)
 export const KILOCODE_CONFIG = { ...PROVIDER_OAUTH["kilocode"] };
@@ -134,7 +140,8 @@ export const PROVIDERS = {
   GITHUB: "github",
   KIRO: "kiro",
   CURSOR: "cursor",
-  KIMI_CODING: "kimi-coding",
+  KIMI: "kimi",
+  KIMI_CODING: "kimi",
   KILOCODE: "kilocode",
   CLINE: "cline",
   CLINEPASS: "clinepass",

src/lib/oauth/providers.js

@@ -20,7 +20,7 @@ import {
   KIRO_CONFIG,
   assertValidAwsRegion,
   CURSOR_CONFIG,
-  KIMI_CODING_CONFIG,
+  KIMI_CONFIG,
   KILOCODE_CONFIG,
   CLINE_CONFIG,
   CLINEPASS_CONFIG,
@@ -1081,13 +1081,22 @@ const PROVIDERS = {
     }),
   },
 
-  "kimi-coding": {
-    config: KIMI_CODING_CONFIG,
+  // Kimi Code device flow (CLIProxyAPI internal/auth/kimi). Id is `kimi`;
+  // `kimi-coding` remains an alias key so old UI/API routes still resolve.
+  kimi: {
+    config: KIMI_CONFIG,
     flowType: "device_code",
     requestDeviceCode: async (config) => {
+      const { buildKimiHeaders } = await import("open-sse/config/appConstants.js");
+      const deviceId = crypto.randomUUID();
+      const headers = {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+        ...buildKimiHeaders(deviceId),
+      };
       const response = await fetch(config.deviceCodeUrl, {
         method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+        headers,
         body: new URLSearchParams({ client_id: config.clientId }),
       });
       if (!response.ok) {
@@ -1095,21 +1104,30 @@ const PROVIDERS = {
         throw new Error(`Device code request failed: ${error}`);
       }
       const data = await response.json();
+      const authorizeDeviceUrl = config.authorizeDeviceUrl || "https://www.kimi.com/code/authorize_device";
       return {
         device_code: data.device_code,
         user_code: data.user_code,
-        verification_uri: data.verification_uri || "https://www.kimi.com/code/authorize_device",
+        verification_uri: data.verification_uri || authorizeDeviceUrl,
         verification_uri_complete:
           data.verification_uri_complete ||
-          `https://www.kimi.com/code/authorize_device?user_code=${data.user_code}`,
+          `${authorizeDeviceUrl}?user_code=${data.user_code}`,
         expires_in: data.expires_in,
         interval: data.interval || 5,
+        _kimiDeviceId: deviceId,
       };
     },
-    pollToken: async (config, deviceCode) => {
+    pollToken: async (config, deviceCode, _codeVerifier, extraData) => {
+      const { buildKimiHeaders } = await import("open-sse/config/appConstants.js");
+      const deviceId = extraData?._kimiDeviceId;
+      const headers = {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+        ...buildKimiHeaders(deviceId),
+      };
       const response = await fetch(config.tokenUrl, {
         method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+        headers,
         body: new URLSearchParams({
           grant_type: "urn:ietf:params:oauth:grant-type:device_code",
           client_id: config.clientId,
@@ -1119,19 +1137,26 @@ const PROVIDERS = {
       let data;
       try {
         data = await response.json();
-      } catch (e) {
-        const text = await response.text();
-        data = { error: "invalid_response", error_description: text };
+      } catch {
+        data = { error: "invalid_response", error_description: "non-json token response" };
       }
-      return { ok: response.ok, data };
+      // CLIProxyAPI: Kimi returns 200 for pending states with error field
+      if (data.error === "authorization_pending" || data.error === "slow_down") {
+        return { ok: true, data };
+      }
+      if (data.access_token && deviceId) data._kimiDeviceId = deviceId;
+      return { ok: response.ok || !!data.access_token || !!data.error, data };
     },
     mapTokens: (tokens) => ({
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token,
       expiresIn: tokens.expires_in,
+      providerSpecificData: {
+        authMethod: "device_code",
+        ...(tokens._kimiDeviceId ? { deviceId: tokens._kimiDeviceId } : {}),
+      },
     }),
   },
-
   kilocode: {
     config: KILOCODE_CONFIG,
     flowType: "device_code",
@@ -1520,7 +1545,9 @@ const PROVIDERS = {
  * Get provider handler
  */
 export function getProvider(name) {
-  const provider = PROVIDERS[name];
+  // Legacy kimi-coding → kimi (dual-auth merge)
+  const key = name === "kimi-coding" ? "kimi" : name;
+  const provider = PROVIDERS[key];
   if (!provider) {
     throw new Error(`Unknown provider: ${name}`);
   }