feat(xiaomi-mimo): merge MiMo Desktop support into xiaomi-mimo as dual auth

Adds the Desktop-exclusive Preview models and the Xiaomi account-session
route to the existing xiaomi-mimo provider instead of a separate
xiaomi-desktop provider, so the dashboard shows one MiMo entry rather than
three overlapping ones.

Dual auth, same pattern as kimi — API key (sk-) covers the cloud API,
Desktop/OAuth adds the account session used by the Preview models:

- registry: category oauth, authModes [oauth, apikey], oauth block, the two
  mimo-x-*-preview models, and the invite signupUrl
- executor: routes Preview models to the account-service route with a Cookie
  session, everything else keeps the sourceFormat-matched transport
- oauth: custom ECDH encrypted-callback flow (X25519 -> SHA256 -> AES-256-GCM)
  with a loopback callback proxy, plus one-click import of the local Desktop
  auth.json
- usage: weekly quota from the account session

Fixes found while merging:

- the OAuth browser flow was dead: poll-status cleared the session before the
  client could POST /exchange, so every exchange returned 400
- a Claude-format client was sent to /v1/chat/completions instead of the
  declared /anthropic/v1/messages transport, because buildUrl ignored
  runtimeTransport
- stopXiaomiMimoProxy leaked every pending session (each holding an X25519
  private key) for the process lifetime
- the OAuth exchange did not persist the Desktop passToken, so the Preview
  models could never work after a browser sign-in

Removes dead code: the local engine token minting (mimoEngine, never called
on the request path), the model-catalog and usage routes, engineToken/
engineUrl plumbing, and an unread top-level usage block.

Adds tests/unit/xiaomi-mimo-{executor,oauth-session,oauth-proxy}.test.js —
the provider previously had none.

tests/unit/xiaomi-mimo-executor.test.js

@@ -0,0 +1,80 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { XiaomiMimoExecutor, __test__ } from "../../open-sse/executors/xiaomi-mimo.js";
+import { getExecutor } from "../../open-sse/executors/index.js";
+
+const { bareModel, COOKIE_KEY } = __test__;
+
+const OPENAI_T = { runtimeTransport: { format: "openai", baseUrl: "https://api.xiaomimimo.com/v1/chat/completions" } };
+const CLAUDE_T = { runtimeTransport: { format: "claude", baseUrl: "https://api.xiaomimimo.com/anthropic/v1/messages" } };
+
+describe("xiaomi-mimo executor", () => {
+  let ex;
+  beforeEach(() => {
+    ex = new XiaomiMimoExecutor();
+  });
+
+  it("is registered for xiaomi-mimo", () => {
+    expect(getExecutor("xiaomi-mimo")).toBeInstanceOf(XiaomiMimoExecutor);
+  });
+
+  it("routes Preview models to the account-service route regardless of transport", () => {
+    const expected = "https://mimo-server-cn.xiaomimimo.com/api/route/chat/completions";
+    expect(ex.buildUrl("mimo-x-pro-preview", true, 0, OPENAI_T)).toBe(expected);
+    expect(ex.buildUrl("mimo-x-pro-preview", true, 0, CLAUDE_T)).toBe(expected);
+    // body.model arrives as `xiaomi/<id>` via upstreamModelId
+    expect(ex.buildUrl("xiaomi/mimo-x-flash-preview", true, 0, OPENAI_T)).toBe(expected);
+  });
+
+  it("keeps the sourceFormat-matched endpoint for cloud models", () => {
+    // Regression: a Claude client must reach /anthropic/v1/messages, not /v1/chat/completions.
+    expect(ex.buildUrl("mimo-v2.5-pro", true, 0, CLAUDE_T)).toBe(CLAUDE_T.runtimeTransport.baseUrl);
+    expect(ex.buildUrl("mimo-v2.5-pro", true, 0, OPENAI_T)).toBe(OPENAI_T.runtimeTransport.baseUrl);
+  });
+
+  it("authenticates Preview calls with the account cookie", () => {
+    const headers = ex.buildHeaders({ [COOKIE_KEY]: "serviceToken=abc", accessToken: "sk-x" }, true, "u", "mimo-x-pro-preview");
+    expect(headers.Cookie).toBe("serviceToken=abc");
+    expect(headers.Authorization).toBeUndefined();
+  });
+
+  it("authenticates cloud calls with the bearer key", () => {
+    const headers = ex.buildHeaders({ accessToken: "sk-x" }, true, "u", "mimo-v2.5-pro");
+    expect(headers.Authorization).toBe("Bearer sk-x");
+    expect(headers.Cookie).toBeUndefined();
+  });
+
+  it("fails fast when a Preview call has no account session", async () => {
+    await expect(
+      ex.execute({ model: "mimo-x-pro-preview", body: {}, stream: true, credentials: {}, log: null }),
+    ).rejects.toThrow(/account session unavailable/);
+  });
+
+  it("flattens content-part arrays to plain strings", () => {
+    const out = ex.transformRequest(
+      "mimo-x-pro-preview",
+      { messages: [{ role: "user", content: [{ type: "text", text: "a" }, { type: "text", text: "b" }] }] },
+      true,
+      {},
+    );
+    expect(out.messages[0].content).toBe("ab");
+  });
+
+  it("applies Preview defaults without overriding explicit values", () => {
+    const body = { messages: [{ role: "user", content: "hi" }], temperature: 0.2 };
+    const out = ex.transformRequest("mimo-x-pro-preview", body, true, {});
+    expect(out.temperature).toBe(0.2);       // caller's value kept
+    expect(out.top_p).toBe(0.95);            // default filled in
+    expect(out.max_tokens).toBe(4096);
+  });
+
+  it("leaves cloud bodies free of Preview defaults", () => {
+    const out = ex.transformRequest("mimo-v2.5-pro", { messages: [{ role: "user", content: "hi" }] }, true, {});
+    expect(out.thinking).toBeUndefined();
+    expect(out.max_tokens).toBeUndefined();
+  });
+
+  it("strips a provider/model prefix when testing preview ids", () => {
+    expect(bareModel("xiaomi/mimo-x-pro-preview")).toBe("mimo-x-pro-preview");
+    expect(bareModel("mimo-x-pro-preview")).toBe("mimo-x-pro-preview");
+  });
+});

tests/unit/xiaomi-mimo-oauth-proxy.test.js

@@ -0,0 +1,54 @@
+/**
+ * Regression: the xiaomi-mimo OAuth session store must not retain sessions
+ * once the callback listener is down.
+ *
+ * Each /authorize registers a session holding an X25519 private key, keyed by a
+ * fresh state. Unlike trae/windsurf/zed (singleton session) this is a Map, so
+ * without an explicit clear every login attempt would leak a private key for
+ * the whole process lifetime.
+ */
+import { describe, it, expect } from "vitest";
+import {
+  registerXiaomiMimoSession,
+  getXiaomiMimoSessionStatus,
+  clearXiaomiMimoSession,
+  stopXiaomiMimoProxy,
+} from "../../src/lib/oauth/utils/server.js";
+
+const KEY = Buffer.from("x25519-private-key-material");
+
+describe("xiaomi-mimo OAuth session store", () => {
+  it("drops pending sessions when the proxy stops", () => {
+    registerXiaomiMimoSession({ state: "s1", privateKeyDer: KEY });
+    expect(getXiaomiMimoSessionStatus("s1")).not.toBeNull();
+
+    stopXiaomiMimoProxy();
+
+    expect(getXiaomiMimoSessionStatus("s1")).toBeNull();
+  });
+
+  it("drops every session, not just the last one", () => {
+    registerXiaomiMimoSession({ state: "a", privateKeyDer: KEY });
+    registerXiaomiMimoSession({ state: "b", privateKeyDer: KEY });
+    registerXiaomiMimoSession({ state: "c", privateKeyDer: KEY });
+
+    stopXiaomiMimoProxy();
+
+    for (const s of ["a", "b", "c"]) {
+      expect(getXiaomiMimoSessionStatus(s)).toBeNull();
+    }
+  });
+
+  it("ignores registrations with a missing state or key", () => {
+    expect(registerXiaomiMimoSession({ state: "", privateKeyDer: KEY })).toBe(false);
+    expect(registerXiaomiMimoSession({ state: "s", privateKeyDer: null })).toBe(false);
+  });
+
+  it("never exposes the private key to callers", () => {
+    registerXiaomiMimoSession({ state: "s1", privateKeyDer: KEY });
+    const view = getXiaomiMimoSessionStatus("s1");
+    expect(view).toEqual({ status: "pending", result: null, error: null });
+    expect(JSON.stringify(view)).not.toContain("privateKeyDer");
+    clearXiaomiMimoSession("s1");
+  });
+});

tests/unit/xiaomi-mimo-oauth-session.test.js

@@ -0,0 +1,152 @@
+/**
+ * Regression: the poll-status/exchange session lifecycle for xiaomi-mimo.
+ *
+ * The original PR cleared the session inside poll-status, so the client's
+ * following POST /exchange always saw a missing session and returned 400 —
+ * the whole browser-OAuth fallback was dead. These tests pin the contract:
+ *   - a finished session survives /poll-status until /exchange consumes it
+ *   - a failed session is cleaned up by /poll-status itself
+ */
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("next/server", () => ({
+  NextResponse: {
+    json: (body, init) => ({
+      status: init?.status || 200,
+      body,
+      json: async () => body,
+    }),
+  },
+}));
+
+vi.mock("@/lib/oauth/providers", () => ({
+  getProvider: vi.fn(),
+  generateAuthData: vi.fn(),
+  exchangeTokens: vi.fn(),
+  requestDeviceCode: vi.fn(),
+  pollForToken: vi.fn(),
+}));
+
+vi.mock("@/models", () => ({
+  createProviderConnection: vi.fn(async (d) => ({ id: "conn-1", ...d })),
+}));
+
+vi.mock("open-sse/shared/mimoAccount.js", () => ({
+  readDesktopPassToken: vi.fn(async () => ({ passToken: "pt-abc", userId: "u1", cUserId: "c1" })),
+}));
+
+vi.mock("@/lib/oauth/utils/ideDetect", () => ({ detectIdeInstalled: vi.fn() }));
+
+// Session store backing the mocked OAuth server helpers, so the test can assert
+// on real lifecycle transitions rather than on call counts alone.
+const sessions = new Map();
+const stopped = { count: 0 };
+
+vi.mock("@/lib/oauth/utils/server", () => {
+  const notUsed = () => { throw new Error("unexpected helper"); };
+  const noop = () => {};
+  return {
+    startCodexProxy: notUsed, stopCodexProxy: noop, registerCodexSession: noop,
+    getCodexSessionStatus: () => null, clearCodexSession: noop,
+    startXaiProxy: notUsed, stopXaiProxy: noop, registerXaiSession: noop,
+    getXaiSessionStatus: () => null, clearXaiSession: noop,
+    startTraeProxy: notUsed, stopTraeProxy: noop, registerTraeSession: noop,
+    getTraeSessionStatus: () => null, clearTraeSession: noop,
+    startWindsurfProxy: notUsed, stopWindsurfProxy: noop, registerWindsurfSession: noop,
+    getWindsurfSessionStatus: () => null, clearWindsurfSession: noop,
+    startZedProxy: notUsed, stopZedProxy: noop, registerZedSession: noop,
+    getZedSessionStatus: () => null, clearZedSession: noop,
+    startXiaomiMimoProxy: notUsed,
+    stopXiaomiMimoProxy: () => { stopped.count += 1; },
+    registerXiaomiMimoSession: () => {},
+    getXiaomiMimoSessionStatus: (state) => {
+      const s = sessions.get(state);
+      return s ? { status: s.status, result: s.result || null, error: s.error || null } : null;
+    },
+    clearXiaomiMimoSession: (state) => { sessions.delete(state); },
+  };
+});
+
+const { GET, POST } = await import("../../src/app/api/oauth/[provider]/[action]/route.js");
+
+const get = (action, state) =>
+  GET(new Request(`http://localhost/api/oauth/xiaomi-mimo/${action}?state=${state}`), {
+    params: Promise.resolve({ provider: "xiaomi-mimo", action }),
+  });
+
+const exchange = (state) =>
+  POST(
+    new Request("http://localhost/api/oauth/xiaomi-mimo/exchange", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ state }),
+    }),
+    { params: Promise.resolve({ provider: "xiaomi-mimo", action: "exchange" }) },
+  );
+
+describe("xiaomi-mimo OAuth session lifecycle", () => {
+  beforeEach(() => {
+    sessions.clear();
+    stopped.count = 0;
+  });
+
+  it("keeps a finished session alive so /exchange can consume it", async () => {
+    sessions.set("st1", { status: "done", result: { uid: "u1", accessToken: "sk-x", baseUrl: "https://api.xiaomimimo.com/v1" } });
+
+    const poll = await get("poll-status", "st1");
+    expect(poll.status).toBe(200);
+    expect(await poll.json()).toMatchObject({ status: "done" });
+
+    // The bug: this used to be gone, making /exchange always 400.
+    expect(sessions.has("st1")).toBe(true);
+
+    const res = await exchange("st1");
+    expect(res.status).toBe(200);
+    expect((await res.json()).success).toBe(true);
+  });
+
+  it("clears the session once /exchange consumed it", async () => {
+    sessions.set("st1", { status: "done", result: { uid: "u1", accessToken: "sk-x" } });
+    await exchange("st1");
+    expect(sessions.has("st1")).toBe(false);
+  });
+
+  it("cleans up a failed session in poll-status and stops the proxy", async () => {
+    sessions.set("st2", { status: "error", error: "Could not decrypt with any pending session key" });
+
+    const poll = await get("poll-status", "st2");
+    expect(await poll.json()).toMatchObject({ status: "error" });
+
+    expect(sessions.has("st2")).toBe(false);
+    expect(stopped.count).toBe(1);
+  });
+
+  it("persists the Desktop passToken onto the connection (Preview models need it)", async () => {
+    const { createProviderConnection } = await import("@/models");
+    sessions.set("st3", { status: "done", result: { uid: "u1", accessToken: "sk-x" } });
+
+    await exchange("st3");
+
+    const arg = createProviderConnection.mock.calls.at(-1)[0];
+    expect(arg.provider).toBe("xiaomi-mimo");
+    expect(arg.providerSpecificData.mimoPassToken).toBe("pt-abc");
+    expect(arg.providerSpecificData.mimoUserId).toBe("u1");
+  });
+
+  it("still reports unknown for an unregistered state", async () => {
+    const poll = await get("poll-status", "nope");
+    expect(await poll.json()).toEqual({ status: "unknown" });
+  });
+
+  it("rejects /exchange without a state", async () => {
+    const res = await POST(
+      new Request("http://localhost/api/oauth/xiaomi-mimo/exchange", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({}),
+      }),
+      { params: Promise.resolve({ provider: "xiaomi-mimo", action: "exchange" }) },
+    );
+    expect(res.status).toBe(400);
+  });
+});