feat(xiaomi-mimo): merge MiMo Desktop support into xiaomi-mimo as dual auth

Adds the Desktop-exclusive Preview models and the Xiaomi account-session route to the existing xiaomi-mimo provider instead of a separate xiaomi-desktop provider, so the dashboard shows one MiMo entry rather than three overlapping ones. Dual auth, same pattern as kimi — API key (sk-) covers the cloud API, Desktop/OAuth adds the account session used by the Preview models: - registry: category oauth, authModes [oauth, apikey], oauth block, the two mimo-x-*-preview models, and the invite signupUrl - executor: routes Preview models to the account-service route with a Cookie session, everything else keeps the sourceFormat-matched transport - oauth: custom ECDH encrypted-callback flow (X25519 -> SHA256 -> AES-256-GCM) with a loopback callback proxy, plus one-click import of the local Desktop auth.json - usage: weekly quota from the account session Fixes found while merging: - the OAuth browser flow was dead: poll-status cleared the session before the client could POST /exchange, so every exchange returned 400 - a Claude-format client was sent to /v1/chat/completions instead of the declared /anthropic/v1/messages transport, because buildUrl ignored runtimeTransport - stopXiaomiMimoProxy leaked every pending session (each holding an X25519 private key) for the process lifetime - the OAuth exchange did not persist the Desktop passToken, so the Preview models could never work after a browser sign-in Removes dead code: the local engine token minting (mimoEngine, never called on the request path), the model-catalog and usage routes, engineToken/ engineUrl plumbing, and an unread top-level usage block. Adds tests/unit/xiaomi-mimo-{executor,oauth-session,oauth-proxy}.test.js — the provider previously had none.
2026-09-10 23:41:40 +07:00
parent 83af3f1853
commit 73cb89143c
21 changed files with 1828 additions and 4 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -90,3 +90,14 @@ graphify-out/*
 # Kiro local workspace state
 .kiro/
 9router-*
 # Local sensitive / temp files
 .engine-token.txt
 .tmp-prov.json
 .tmp-providers.json
 .oauth-session.json
 .dev-server.log
 .dev-server-err.log
 .start-dev.ps1
 start-dev-silent.cjs
 debug.log
--- a/open-sse/executors/index.js
+++ b/open-sse/executors/index.js
@@ -17,6 +17,7 @@ import { PerplexityWebExecutor } from "./perplexity-web.js";
 import { OllamaLocalExecutor } from "./ollama-local.js";
 import { CommandCodeExecutor } from "./commandcode.js";
 import { XiaomiTokenplanExecutor } from "./xiaomi-tokenplan.js";
 import { XiaomiMimoExecutor } from "./xiaomi-mimo.js";
 import { MimoFreeExecutor } from "./mimo-free.js";
 import { CodeBuddyExecutor } from "./codebuddy-cn.js";
 import { CodeBuddyIntlExecutor } from "./codebuddy-intl.js";
@@ -50,6 +51,7 @@ const executors = {
  "ollama-local": new OllamaLocalExecutor(),
  commandcode: new CommandCodeExecutor(),
  "xiaomi-tokenplan": new XiaomiTokenplanExecutor(),
  "xiaomi-mimo": new XiaomiMimoExecutor(),
  "mimo-free": new MimoFreeExecutor(),
  mmf: new MimoFreeExecutor(), // Alias for mimo-free
  "codebuddy-cn": new CodeBuddyExecutor(),
@@ -93,6 +95,7 @@ export { PerplexityWebExecutor } from "./perplexity-web.js";
 export { OllamaLocalExecutor } from "./ollama-local.js";
 export { CommandCodeExecutor } from "./commandcode.js";
 export { XiaomiTokenplanExecutor } from "./xiaomi-tokenplan.js";
 export { XiaomiMimoExecutor } from "./xiaomi-mimo.js";
 export { MimoFreeExecutor } from "./mimo-free.js";
 export { CodeBuddyExecutor } from "./codebuddy-cn.js";
 export { CodeBuddyIntlExecutor } from "./codebuddy-intl.js";
--- a/open-sse/executors/xiaomi-mimo.js
+++ b/open-sse/executors/xiaomi-mimo.js
@@ -0,0 +1,99 @@
 import { DefaultExecutor } from "./default.js";
 import { getMimoAccountCookie, invalidateMimoAccountCookieCache, MIMO_API_BASE, MIMO_API_UA } from "../shared/mimoAccount.js";
 // Desktop-exclusive Preview models. These are served by the account service's
 // /api/route proxy, authorized by the Xiaomi account session (NOT the sk- key).
 // See shared/mimoAccount.js for the session handshake.
 const PREVIEW_MODELS = new Set(["mimo-x-pro-preview", "mimo-x-flash-preview"]);
 // Session cookie resolved in execute() (async) and read back by buildHeaders()
 // (sync — BaseExecutor.execute does not await it). Carried on the per-request
 // credentials object, same as runtimeTransport.
 const COOKIE_KEY = "__mimoAccountCookie";
 // Upstream calls may hand us either the bare id or a `provider/model` ref.
 function bareModel(model) {
  const s = String(model || "");
  const i = s.indexOf("/");
  return i >= 0 ? s.slice(i + 1) : s;
 }
 export class XiaomiMimoExecutor extends DefaultExecutor {
  constructor() {
    super("xiaomi-mimo");
  }
  static isPreviewModel(model) {
    return PREVIEW_MODELS.has(bareModel(model));
  }
  buildUrl(model, stream, urlIndex = 0, credentials = null) {
    // Preview models live on the account-service route, which is not one of the
    // declared transports — resolve it before the default runtimeTransport path.
    if (XiaomiMimoExecutor.isPreviewModel(model)) {
      return `${MIMO_API_BASE}/api/route/chat/completions`;
    }
    // Cloud API models keep default handling, so a Claude-format client reaches
    // the /anthropic/v1/messages transport.
    return super.buildUrl(model, stream, urlIndex, credentials);
  }
  buildHeaders(credentials, stream = true, url, model) {
    if (XiaomiMimoExecutor.isPreviewModel(model) && credentials?.[COOKIE_KEY]) {
      // Preview models authenticate with the account-session cookie, not the key.
      return {
        "Content-Type": "application/json",
        Accept: stream ? "text/event-stream" : "application/json",
        "User-Agent": MIMO_API_UA,
        Cookie: credentials[COOKIE_KEY],
      };
    }
    return super.buildHeaders(credentials, stream, url, model);
  }
  transformRequest(model, body, stream, credentials) {
    // super runs stripUnsupportedParams, which flattens Preview content-part
    // arrays (see the xiaomi-mimo rule in translator/concerns/paramSupport.js).
    const out = super.transformRequest(model, body, stream, credentials);
    // Preview models: thinking/params get defaults only — never override what the
    // caller set explicitly. (body.model is already `xiaomi/<id>` via upstreamModelId.)
    if (XiaomiMimoExecutor.isPreviewModel(model)) {
      if (out.thinking == null) out.thinking = { type: "enabled" };
      if (out.temperature == null) out.temperature = 1.0;
      if (out.top_p == null) out.top_p = 0.95;
      if (!out.max_tokens) out.max_tokens = 4096;
    }
    return out;
  }
  async execute(args) {
    const { model, credentials, proxyOptions = null } = args;
    if (!XiaomiMimoExecutor.isPreviewModel(model)) return super.execute(args);
    const cookie = await getMimoAccountCookie(credentials?.providerSpecificData, proxyOptions);
    if (!cookie) {
      throw new Error(
        "Xiaomi MiMo account session unavailable. Sign in to MiMo Desktop once so its passToken is present, then retry.",
      );
    }
    credentials[COOKIE_KEY] = cookie;
    const result = await super.execute(args);
    // A cached session can expire early — drop it and retry once with a fresh one.
    if (result.response.status === 401) {
      invalidateMimoAccountCookieCache();
      const fresh = await getMimoAccountCookie(credentials?.providerSpecificData, proxyOptions).catch(() => null);
      if (fresh) {
        credentials[COOKIE_KEY] = fresh;
        return super.execute(args);
      }
    }
    return result;
  }
 }
 export const __test__ = { PREVIEW_MODELS, bareModel, COOKIE_KEY };
 export default XiaomiMimoExecutor;
--- a/open-sse/providers/registry/xiaomi-mimo.js
+++ b/open-sse/providers/registry/xiaomi-mimo.js
@@ -1,11 +1,19 @@
 import { CLAUDE_API_HEADERS } from "../shared.js";
 // Dual auth (same pattern as kimi):
 //   - API key (sk-...)      → cloud API on api.xiaomimimo.com
 //   - Desktop account/OAuth → same cloud host, plus the Desktop-exclusive Preview
 //     models served by the account-service route on mimo-server-cn.xiaomimimo.com
 //     (authorized by a Xiaomi account session cookie, not the key).
 // Endpoint is picked per model in the executor, same as opencode-go's /responses split.
 export default {
  id: "xiaomi-mimo",
  priority: 290,
  alias: "xiaomi-mimo",
  aliases: [
    "mimo",
    "mimo-desktop",
    "xmd",
  ],
  uiAlias: "mimo",
  display: {
@@ -16,9 +24,12 @@ export default {
    website: "https://xiaomimimo.com",
    notice: {
      apiKeyUrl: "https://platform.xiaomimimo.com/console/api-keys",
      signupUrl: "https://mimo.xiaomimimo.com/desktop/invite/",
    },
  },
-  category: "apikey",
+  category: "oauth",
  authModes: ["oauth", "apikey"],
  hasOAuth: true,
  serviceKinds: ["llm", "tts"],
  transport: {
    baseUrl: "https://api.xiaomimimo.com/v1/chat/completions",
@@ -39,6 +50,11 @@ export default {
    },
  ],
  models: [
    // Desktop-exclusive — served by the account-service route, which only accepts
    // OpenAI format, so supportedFormats pins them to the openai transport.
    { id: "mimo-x-pro-preview", name: "MiMo-X-Pro-Preview", upstreamModelId: "xiaomi/mimo-x-pro-preview", supportedFormats: ["openai"] },
    { id: "mimo-x-flash-preview", name: "MiMo-X-Flash-Preview", upstreamModelId: "xiaomi/mimo-x-flash-preview", supportedFormats: ["openai"] },
    // Cloud API models (api.xiaomimimo.com/v1)
    { id: "mimo-v2.5-pro", name: "MiMo V2.5 Pro" },
    { id: "mimo-v2.5", name: "MiMo V2.5" },
    { id: "mimo-v2-omni", name: "MiMo V2 Omni" },
@@ -51,4 +67,18 @@ export default {
    authHeader: "bearer",
    format: "xiaomi-mimo-tts",
  },
  features: {
    usage: true,
    usageApikey: true,
  },
  // Custom OAuth — non-standard ECDH encrypted-callback flow.
  // Handled by the Xiaomi MiMo OAuth service, not the generic PKCE pipeline.
  oauth: {
    custom: true,
    authorizeUrl: "https://platform.xiaomimimo.com/authorize",
    // The callback carries ?u=<ECDH-encrypted payload> instead of ?code=.
    // Decryption yields { uid, sk, url }.
    callbackParam: "u",
    kn: "mimocode",
  },
 };
--- a/open-sse/services/usage.js
+++ b/open-sse/services/usage.js
@@ -17,6 +17,7 @@ import { getDeepseekUsage } from "./usage/deepseek.js";
 import { getOpenCodeGoUsage } from "./usage/opencode-go.js";
 import { getGroqUsage } from "./usage/groq.js";
 import { getZedUsage } from "./usage/zed.js";
 import { getXiaomiMimoUsage } from "./usage/xiaomi-mimo.js";
 import { resolveQoderCredentials } from "./qoderModels.js";
 import { getGlmUsage } from "./usage/glm.js";
 import {
@@ -60,6 +61,7 @@ const USAGE_HANDLERS = {
  deepseek: (c) => getDeepseekUsage(c.apiKey, c.proxyOptions),
  groq: (c) => getGroqUsage(c.apiKey, c.proxyOptions),
  zed: (c) => getZedUsage(c.accessToken, c.providerSpecificData, c.proxyOptions),
  "xiaomi-mimo": (c) => getXiaomiMimoUsage(c.accessToken, c.providerSpecificData, c.proxyOptions),
 };
 export async function getUsageForProvider(connection, proxyOptions = null, options = {}) {
--- a/open-sse/services/usage/xiaomi-mimo.js
+++ b/open-sse/services/usage/xiaomi-mimo.js
@@ -0,0 +1,125 @@
 /**
 * Xiaomi MiMo usage — weekly quota from the Xiaomi account session.
 *
 * Primary path: GET {mimo-server}/api/user/usage authorized by the account-session
 * cookie (see shared/mimoAccount.js). Response: { code: 0, data: { percent (remaining
 * %), resetDate, resetAt } }.
 *
 * Fallback: the sk- API key cannot read the quota, so when no account session is
 * available we surface a graceful message instead of failing.
 */
 import { proxyAwareFetch } from "../../utils/proxyFetch.js";
 import { getMimoAccountUsage } from "../../shared/mimoAccount.js";
 const USAGE_URL = "https://aistudio.xiaomimimo.com/open-apis/v1/user/usage";
 /**
 * @param {string|null|undefined} accessToken - sk- API key
 * @param {object|null} providerSpecificData - may contain mimoPassToken, uid, etc.
 * @param {object|null} proxyOptions
 */
 export async function getXiaomiMimoUsage(accessToken = null, providerSpecificData = null, proxyOptions = null) {
  // Preferred path: the weekly quota comes from the account service session
  // (mimo-server /api/user/usage), which the sk- key cannot reach. The session is
  // derived from MiMo Desktop's persisted passToken via the SSO/sts handshake.
  const account = await getMimoAccountUsage(providerSpecificData, proxyOptions);
  if (typeof account.percent === "number" && Number.isFinite(account.percent)) {
    const remaining = Math.max(0, Math.min(100, Math.round(account.percent)));
    const used = 100 - remaining;
    let resetAt = null;
    if (typeof account.resetAt === "number" && account.resetAt > 0) {
      resetAt = new Date(account.resetAt * 1000).toISOString();
    } else if (typeof account.resetDate === "string") {
      const parsed = new Date(`${account.resetDate}T00:00:00Z`);
      if (!Number.isNaN(parsed.getTime())) resetAt = parsed.toISOString();
    }
    return {
      plan: "Xiaomi MiMo Desktop",
      quotas: {
        Weekly: { used, total: 100, remainingPercentage: remaining, resetAt, unlimited: false },
      },
    };
  }
  // Fallback: no account session available (Desktop never logged in, or its cookie
  // store is locked). The sk- key cannot read the quota, so surface a clear message.
  const key = accessToken || providerSpecificData?.apiKey;
  if (!key || typeof key !== "string" || !key.trim()) {
    return { message: "Xiaomi MiMo Desktop not connected. Add credentials to view usage." };
  }
  try {
    const response = await proxyAwareFetch(
      USAGE_URL,
      {
        method: "GET",
        headers: {
          Authorization: `Bearer ${key.trim()}`,
          "X-Mimo-Source": "mimocode-cli",
          Accept: "application/json",
        },
        signal: AbortSignal.timeout(10000),
      },
      proxyOptions,
    );
    if (response.status === 401) {
      return {
        plan: "Xiaomi MiMo Desktop",
        message: "Weekly quota requires Xiaomi account session. API key alone is insufficient.",
      };
    }
    if (!response.ok) {
      return {
        plan: "Xiaomi MiMo Desktop",
        message: `Usage API error (${response.status})`,
      };
    }
    const data = await response.json().catch(() => null);
    if (!data || data.code !== 0 || !data.data) {
      return {
        plan: "Xiaomi MiMo Desktop",
        message: "Usage endpoint returned unexpected response.",
      };
    }
    const { percent, resetDate } = data.data;
    if (typeof percent !== "number" || !Number.isFinite(percent)) {
      return {
        plan: "Xiaomi MiMo Desktop",
        message: "Usage data missing percent field.",
      };
    }
    // percent = remaining percentage (e.g. 94 means 94% remaining)
    const remaining = Math.max(0, Math.min(100, Math.round(percent)));
    const used = 100 - remaining;
    // Parse resetDate — expected format "2026-09-16"
    let resetAt = null;
    if (resetDate && typeof resetDate === "string") {
      const parsed = new Date(`${resetDate}T00:00:00Z`);
      if (!Number.isNaN(parsed.getTime())) {
        resetAt = parsed.toISOString();
      }
    }
    return {
      plan: "Xiaomi MiMo Desktop",
      quotas: {
        Weekly: {
          used,
          total: 100,
          remainingPercentage: remaining,
          resetAt,
          unlimited: false,
        },
      },
    };
  } catch (error) {
    return { message: `Xiaomi MiMo Desktop usage error: ${error.message}` };
  }
 }
--- a/open-sse/shared/mimoAccount.js
+++ b/open-sse/shared/mimoAccount.js
@@ -0,0 +1,264 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import crypto from "node:crypto";
 import { proxyAwareFetch } from "../utils/proxyFetch.js";
 /**
 * Xiaomi MiMo account-session helpers (used for weekly quota).
 *
 * The weekly quota endpoint lives on the account service domain and is authorized
 * by an account session cookie, NOT the sk- API key. Acquiring that cookie mirrors
 * MiMo Desktop: a passToken (persisted in Desktop's cookie store) is exchanged via
 * the passportapi SSO, then authorized for the `mimopc` service, and finally stamped
 * by the mimo-server /api/sts callback into a `serviceToken` cookie.
 *
 * Flow (verified against MiMo Desktop traffic):
 *   1. GET  {api}/api/user/xiaomi/me           -> 302 to account SSO (sid=mimopc)
 *   2. GET  account /pass/serviceLogin?sid=passportapi&_json=true   -> nonce/ssecurity
 *   3. GET  {location}&clientSign=...          -> account-level serviceToken
 *   4. GET  account /pass/serviceLogin?sid=mimopc&callback=<sts>&_json=true
 *   5. GET  {api}/api/sts?...&ticket...        -> Set-Cookie: serviceToken (mimopc scope)
 */
 const API_BASE = "https://mimo-server-cn.xiaomimimo.com";
 const ACCOUNT_HOST = "account.xiaomi.com";
 const API_UA =
  "miNative PC/Normal Windows_NT/10.0.19045 SDKV/1.0.0 DEVT/PC DEVS/Windows APP/miaccount_desktop APPV/0.1.0";
 const SSO_UA = "MiClaw/1.0";
 const COOKIE_TTL_MS = 30 * 60 * 1000;
 // Per-account session caches (keyed by passToken hash) so multiple Xiaomi
 // accounts / connections can rotate without clobbering each other.
 const _cache = new Map(); // key -> { cookie, at }
 const _inflight = new Map(); // key -> Promise<cookie|null>
 function desktopCookiePath() {
  const home = os.homedir();
  if (process.platform === "win32") {
    return path.join(home, "AppData", "Roaming", "Xiaomi MiMo", "Partitions", "xiaomi-account", "Network", "Cookies");
  }
  if (process.platform === "darwin") {
    return path.join(home, "Library", "Application Support", "Xiaomi MiMo", "Partitions", "xiaomi-account", "Network", "Cookies");
  }
  return path.join(home, ".config", "Xiaomi MiMo", "Partitions", "xiaomi-account", "Network", "Cookies");
 }
 /**
 * Read the persisted Xiaomi account cookies from MiMo Desktop's Electron profile.
 * The Chromium cookie DB is held with an exclusive lock while Desktop runs, so we
 * copy it first and bail (return null) if that fails.
 * @returns {Promise<Record<string,string>|null>}
 */
 async function readDesktopAccountCookies() {
  const src = desktopCookiePath();
  if (!fs.existsSync(src)) return null;
  const tmp = path.join(os.tmpdir(), `9r-mimo-cookies-${process.pid}-${crypto.randomBytes(4).toString("hex")}.db`);
  try {
    fs.copyFileSync(src, tmp);
  } catch {
    return null; // locked by a running Desktop
  }
  try {
    const { DatabaseSync } = await import("node:sqlite");
    const db = new DatabaseSync(tmp, { readOnly: true });
    const rows = db.prepare("SELECT name, value FROM cookies WHERE host_key = ?").all("." + ACCOUNT_HOST);
    db.close();
    const jar = Object.fromEntries(rows.map((r) => [r.name, r.value]));
    return jar.passToken ? jar : null;
  } catch {
    return null;
  } finally {
    try {
      fs.unlinkSync(tmp);
    } catch {
      /* ignore */
    }
  }
 }
 /**
 * Read just the passToken + identity cookies from Desktop's profile.
 * Exported so the connect flow can persist a per-account passToken into the
 * connection's providerSpecificData — this is what enables multi-account rotation.
 * @returns {Promise<{passToken:string, userId:string|null, cUserId:string|null}|null>}
 */
 export async function readDesktopPassToken() {
  try {
    const jar = await readDesktopAccountCookies();
    if (!jar?.passToken) return null;
    return { passToken: jar.passToken, userId: jar.userId || null, cUserId: jar.cUserId || null };
  } catch {
    return null;
  }
 }
 function signatureClientSign(nonce, ssecurity) {
  const input = `nonce=${nonce}` + (ssecurity && ssecurity.trim() ? `&${ssecurity}` : "");
  return encodeURIComponent(crypto.createHash("sha1").update(input).digest("base64"));
 }
 function absorbSetCookie(jar, res) {
  for (const c of res.headers.getSetCookie?.() || []) {
    const m = /^([^=]+)=([^;]*)/.exec(c.trim());
    if (m && m[2]) jar[m[1]] = m[2];
  }
 }
 function cookieHeader(jar) {
  return Object.entries(jar)
    .filter(([, v]) => v)
    .map(([k, v]) => `${k}=${v}`)
    .join("; ");
 }
 /**
 * Exchange a passToken for a mimo-server service session cookie.
 * @returns {Promise<string|null>} Cookie header value, or null on failure.
 */
 async function acquireServiceCookie(passJar, proxyOptions) {
  const jar = { ...passJar };
  const ck = () => cookieHeader(jar);
  // 1. Unauthenticated API call -> 302 carrying the sts callback (sid=mimopc)
  const r1 = await proxyAwareFetch(
    `${API_BASE}/api/user/xiaomi/me`,
    { redirect: "manual", headers: { "User-Agent": API_UA, Cookie: ck() } },
    proxyOptions,
  );
  const redirect = r1.headers.get("location");
  if (!redirect) return null;
  const stsCallback = new URL(redirect).searchParams.get("callback");
  if (!stsCallback) return null;
  // 2. passportapi SSO phase 1 -> nonce + ssecurity
  const sso1 = await proxyAwareFetch(
    `https://${ACCOUNT_HOST}/pass/serviceLogin?sid=passportapi&_json=true`,
    { headers: { Cookie: ck(), "User-Agent": SSO_UA, Accept: "application/json" } },
    proxyOptions,
  );
  const j1 = JSON.parse((await sso1.text()).replace(/^&&&START&&&/, ""));
  const nonce = j1.nonce || (j1.location ? new URL(j1.location).searchParams.get("nonce") : null);
  if (!nonce || !j1.location) return null;
  // 3. passportapi SSO phase 2 -> account-level serviceToken
  const sso2 = await proxyAwareFetch(
    `${j1.location}&clientSign=${signatureClientSign(nonce, j1.ssecurity)}`,
    { redirect: "manual", headers: { Cookie: ck(), "User-Agent": SSO_UA } },
    proxyOptions,
  );
  absorbSetCookie(jar, sso2);
  // 4. mimopc SSO -> sts callback carrying a ticket
  const sso3 = await proxyAwareFetch(
    `https://${ACCOUNT_HOST}/pass/serviceLogin?sid=mimopc&callback=${encodeURIComponent(stsCallback)}&_json=true`,
    { headers: { Cookie: ck(), "User-Agent": SSO_UA, Accept: "application/json" } },
    proxyOptions,
  );
  const j3 = JSON.parse((await sso3.text()).replace(/^&&&START&&&/, ""));
  absorbSetCookie(jar, sso3);
  if (!j3?.location || !/\/api\/sts/.test(j3.location)) return null;
  // 5. sts callback -> Set-Cookie: serviceToken (mimopc scope)
  const sts = await proxyAwareFetch(
    j3.location,
    { redirect: "manual", headers: { "User-Agent": API_UA, Cookie: ck() } },
    proxyOptions,
  );
  absorbSetCookie(jar, sts);
  const needed = ["serviceToken", "mimopc_ph", "mimopc_slh", "userId"];
  if (!jar.serviceToken) return null;
  const out = {};
  for (const k of needed) if (jar[k]) out[k] = jar[k];
  return cookieHeader(out);
 }
 /**
 * Get (and cache) the mimo-server account cookie.
 * @param {object|null} providerSpecificData - may carry `mimoPassToken` override
 */
 async function getServiceCookie(providerSpecificData, proxyOptions) {
  const passJar = providerSpecificData?.mimoPassToken
    ? { passToken: providerSpecificData.mimoPassToken, userId: providerSpecificData.mimoUserId, cUserId: providerSpecificData.mimoCUserId }
    : await readDesktopAccountCookies();
  if (!passJar) return { cookie: null, reason: "no-pass-token" };
  // One cached session per passToken — accounts/connections rotate independently.
  const key = crypto.createHash("sha256").update(passJar.passToken).digest("hex");
  const cached = _cache.get(key);
  if (cached && Date.now() - cached.at < COOKIE_TTL_MS) {
    return { cookie: cached.cookie };
  }
  // De-dupe concurrent handshakes for the same account: a burst of requests must
  // not each run the full 5-step SSO chain.
  const inflight = _inflight.get(key);
  if (inflight) {
    const cookie = await inflight;
    return cookie ? { cookie } : { cookie: null, reason: "sso-failed" };
  }
  const promise = (async () => {
    try {
      return await acquireServiceCookie(passJar, proxyOptions);
    } catch {
      return null; // network/parse failure — callers degrade, never throw
    } finally {
      _inflight.delete(key);
    }
  })();
  _inflight.set(key, promise);
  const cookie = await promise;
  if (!cookie) return { cookie: null, reason: "sso-failed" };
  _cache.set(key, { cookie, at: Date.now() });
  return { cookie };
 }
 /** Drop cached sessions so the next call re-runs the handshake (e.g. after a 401). */
 export function invalidateMimoAccountCookieCache() {
  _cache.clear();
 }
 /** mimo-server account API base + the User-Agent its backend expects. */
 export const MIMO_API_BASE = API_BASE;
 export const MIMO_API_UA = API_UA;
 /**
 * Resolve the mimo-server account-session cookie, for upstream /api/route/* calls.
 * @returns {Promise<string|null>} Cookie header value, or null when unavailable.
 */
 export async function getMimoAccountCookie(providerSpecificData = null, proxyOptions = null) {
  try {
    const { cookie } = await getServiceCookie(providerSpecificData, proxyOptions);
    return cookie;
  } catch {
    return null;
  }
 }
 /**
 * Fetch the weekly quota from the account service.
 * @returns {Promise<{percent?:number, resetDate?:string, resetAt?:number, error?:string}>}
 */
 export async function getMimoAccountUsage(providerSpecificData = null, proxyOptions = null) {
  const { cookie, reason } = await getServiceCookie(providerSpecificData, proxyOptions);
  if (!cookie) {
    return { error: reason === "no-pass-token" ? "no-session" : "session-failed" };
  }
  try {
    const res = await proxyAwareFetch(
      `${API_BASE}/api/user/usage`,
      { headers: { "User-Agent": API_UA, Cookie: cookie, Accept: "application/json" }, signal: AbortSignal.timeout(10000) },
      proxyOptions,
    );
    if (!res.ok) return { error: `http-${res.status}` };
    const data = await res.json().catch(() => null);
    if (!data || data.code !== 0 || !data.data) return { error: "bad-response" };
    return { percent: data.data.percent, resetDate: data.data.resetDate, resetAt: data.data.resetAt };
  } catch (e) {
    return { error: e.message };
  }
 }
--- a/open-sse/translator/concerns/paramSupport.js
+++ b/open-sse/translator/concerns/paramSupport.js
@@ -14,6 +14,9 @@ const STRIP_RULES = [
  { provider: "github", match: (m) => /claude/i.test(m) && !/claude.*(opus|sonnet).*4\.6/i.test(m), drop: ["thinking", "reasoning_effort"] },
  // Cloudflare Workers AI: content must be plain string, rejects OpenAI content-part array (#1926)
  { provider: "cloudflare-ai", flattenContent: true },
  // MiMo Desktop Preview models (account-service route): content must be plain string,
  // rejects OpenAI content-part array. Cloud models keep their parts (mimo-v2-omni is multi-modal).
  { provider: "xiaomi-mimo", match: /preview/i, flattenContent: true },
  { provider: "volcengine-ark", match: /glm-5/i, clampToModelMaxOutput: true },
  // VolcEngine Ark caps the Kimi family at max_tokens <= 32768, but the model's
  // advertised ceiling is far higher (Kimi-K2.7-Code resolves to maxOutput 262144),
--- a/src/app/(dashboard)/dashboard/providers/[id]/page.js
+++ b/src/app/(dashboard)/dashboard/providers/[id]/page.js
@@ -5,7 +5,7 @@ import { useParams, useRouter } from "next/navigation";
 import Link from "next/link";
 import Image from "next/image";
 import { getProviderIconSrc, markProviderIconMissing } from "@/shared/utils/providerIcon";
-import { Card, Button, Badge, Input, Modal, CardSkeleton, OAuthModal, KiroOAuthWrapper, CursorAuthModal, IFlowCookieModal, GitLabAuthModal, Toggle, Select, EditConnectionModal, NoAuthProxyCard, ConfirmModal } from "@/shared/components";
+import { Card, Button, Badge, Input, Modal, CardSkeleton, OAuthModal, KiroOAuthWrapper, CursorAuthModal, XiaomiMimoAuthModal, IFlowCookieModal, GitLabAuthModal, Toggle, Select, EditConnectionModal, NoAuthProxyCard, ConfirmModal } from "@/shared/components";
 import { OAUTH_PROVIDERS, APIKEY_PROVIDERS, FREE_PROVIDERS, FREE_TIER_PROVIDERS, WEB_COOKIE_PROVIDERS, getProviderAlias, isOpenAICompatibleProvider, isAnthropicCompatibleProvider, AI_PROVIDERS } from "@/shared/constants/providers";
 import { getModelsByProviderId, getModelKind } from "@/shared/constants/models";
 import { getThinkingLevels } from "open-sse/providers/thinkingLevels.js";
@@ -45,6 +45,7 @@ export default function ProviderDetailPage() {
  const [providerNode, setProviderNode] = useState(null);
  const [proxyPools, setProxyPools] = useState([]);
  const [showOAuthModal, setShowOAuthModal] = useState(false);
  const [showXiaomiMimoModal, setShowXiaomiMimoModal] = useState(false);
  const [showIFlowCookieModal, setShowIFlowCookieModal] = useState(false);
  const [showAddApiKeyModal, setShowAddApiKeyModal] = useState(false);
  const [addConnectionError, setAddConnectionError] = useState("");
@@ -98,6 +99,11 @@ export default function ProviderDetailPage() {
        return;
      }
    }
    // Xiaomi Desktop: auto-import local credentials first, OAuth as fallback
    if (providerId === "xiaomi-mimo") {
      setShowXiaomiMimoModal(true);
      return;
    }
    if (isOAuth) {
      openOAuthConnection();
      return;
@@ -1796,6 +1802,13 @@ export default function ProviderDetailPage() {
          onClose={() => setShowOAuthModal(false)}
        />
      )}
      {/* Xiaomi Desktop: auto-import local credentials modal */}
      <XiaomiMimoAuthModal
        isOpen={showXiaomiMimoModal}
        onSuccess={handleOAuthSuccess}
        onClose={() => setShowXiaomiMimoModal(false)}
      />
      {providerId === "iflow" && (
        <IFlowCookieModal
          isOpen={showIFlowCookieModal}
--- a/src/app/api/oauth/[provider]/[action]/route.js
+++ b/src/app/api/oauth/[provider]/[action]/route.js
@@ -1,3 +1,4 @@
 import crypto from "crypto";
 import { NextResponse } from "next/server";
 import {
  getProvider,
@@ -7,6 +8,7 @@ import {
  pollForToken
 } from "@/lib/oauth/providers";
 import { createProviderConnection } from "@/models";
 import { readDesktopPassToken } from "open-sse/shared/mimoAccount.js";
 import {
  startCodexProxy,
  stopCodexProxy,
@@ -33,6 +35,11 @@ import {
  registerZedSession,
  getZedSessionStatus,
  clearZedSession,
  startXiaomiMimoProxy,
  stopXiaomiMimoProxy,
  registerXiaomiMimoSession,
  getXiaomiMimoSessionStatus,
  clearXiaomiMimoSession,
 } from "@/lib/oauth/utils/server";
 import { detectIdeInstalled } from "@/lib/oauth/utils/ideDetect";
 import { ZED_HOSTED_CONFIG } from "@/lib/oauth/constants/oauth";
@@ -89,6 +96,32 @@ export async function GET(request, { params }) {
    const { searchParams } = new URL(request.url);
    if (action === "authorize") {
      // Xiaomi Desktop: custom ECDH flow — generate keypair, start proxy, return authorize URL
      if (provider === "xiaomi-mimo") {
        const { generateKeyPair, buildAuthorizeUrl, getKeyName } = await import("@/lib/oauth/providers/xiaomi-mimo");
        const { publicKey, privateKeyDer } = generateKeyPair();
        const state = searchParams.get("state") || crypto.randomUUID();
        // Start the callback proxy (or reuse if already running)
        const proxyResult = await startXiaomiMimoProxy();
        if (!proxyResult.success) {
          return NextResponse.json({ error: `Failed to start callback server: ${proxyResult.reason}` }, { status: 500 });
        }
        // Register the session with the private key for decryption
        registerXiaomiMimoSession({ state, privateKeyDer });
        const redirectUri = proxyResult.callbackUrl;
        const authorizeUrl = buildAuthorizeUrl(publicKey, redirectUri, getKeyName());
        return NextResponse.json({
          state,
          authorizeUrl,
          redirectUri,
          port: proxyResult.port,
        });
      }
      const redirectUri = searchParams.get("redirect_uri") || "http://localhost:8080/callback";
      // Collect provider-specific meta params (e.g. gitlab passes baseUrl, clientId, clientSecret)
      const reservedParams = new Set(["redirect_uri"]);
@@ -120,6 +153,10 @@ export async function GET(request, { params }) {
        const result = await startZedProxy(searchParams.get("native_app_port") || ZED_HOSTED_CONFIG.defaultNativeAppPort);
        return NextResponse.json(result);
      }
      if (provider === "xiaomi-mimo") {
        const result = await startXiaomiMimoProxy();
        return NextResponse.json(result);
      }
      if (!["codex", "xai"].includes(provider)) {
        return NextResponse.json({ error: "Proxy only supported for codex/xai/trae/windsurf/zed" }, { status: 400 });
      }
@@ -153,10 +190,21 @@ export async function GET(request, { params }) {
      else if (provider === "zed") session = getZedSessionStatus(state);
      else if (provider === "xai") session = getXaiSessionStatus(state);
      else if (provider === "codex") session = getCodexSessionStatus(state);
-      else return NextResponse.json({ error: "Poll only supported for codex/xai/trae/windsurf/zed" }, { status: 400 });
+      else if (provider === "xiaomi-mimo") session = getXiaomiMimoSessionStatus(state);
      else return NextResponse.json({ error: "Poll only supported for codex/xai/trae/windsurf/zed/xiaomi-mimo" }, { status: 400 });
      if (!session) return NextResponse.json({ status: "unknown" });
      if (session.status === "done" || session.status === "error") {
        const payload = { ...session };
        if (provider === "xiaomi-mimo") {
          // Unlike the others this does not auto-exchange server-side, so a
          // finished session must survive until the client POSTs /exchange —
          // that call clears it. A failed one is cleared here instead.
          if (session.status === "error") {
            clearXiaomiMimoSession(state);
            stopXiaomiMimoProxy();
          }
          return NextResponse.json(payload);
        }
        if (provider === "trae") clearTraeSession(state);
        else if (provider === "windsurf") clearWindsurfSession(state);
        else if (provider === "zed") clearZedSession(state);
@@ -173,7 +221,8 @@ export async function GET(request, { params }) {
      else if (provider === "zed") stopZedProxy();
      else if (provider === "xai") stopXaiProxy();
      else if (provider === "codex") stopCodexProxy();
-      else return NextResponse.json({ error: "Proxy only supported for codex/xai/trae/windsurf/zed" }, { status: 400 });
+      else if (provider === "xiaomi-mimo") stopXiaomiMimoProxy();
      else return NextResponse.json({ error: "Proxy only supported for codex/xai/trae/windsurf/zed/xiaomi-mimo" }, { status: 400 });
      return NextResponse.json({ success: true });
    }
@@ -268,6 +317,68 @@ export async function POST(request, { params }) {
    if (action === "exchange") {
      const { code, redirectUri, codeVerifier, state, meta } = body;
      // Xiaomi MiMo: no token exchange needed — the callback already decrypted the sk.
      // Just read the session result and create the connection.
      if (provider === "xiaomi-mimo") {
        if (!state) {
          return NextResponse.json({ error: "Missing state" }, { status: 400 });
        }
        const session = getXiaomiMimoSessionStatus(state);
        if (!session || session.status !== "done" || !session.result) {
          return NextResponse.json(
            { error: session?.error || "OAuth session not completed. Please restart the login flow." },
            { status: 400 },
          );
        }
        const { uid, accessToken, baseUrl } = session.result;
        // Desktop-exclusive Preview models authenticate with the account-session
        // passToken, which only lives in MiMo Desktop's cookie store — attach it
        // to the connection so those models work right after OAuth.
        let passToken = null;
        try {
          passToken = await readDesktopPassToken();
        } catch {
          // Desktop not installed / cookie DB locked — preview models stay unavailable.
        }
        try {
          const connection = await createProviderConnection({
            provider: "xiaomi-mimo",
            authType: "oauth",
            accessToken,
            refreshToken: null,
            expiresAt: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString(),
            email: uid ? `${uid}@xiaomi` : null,
            displayName: uid ? `Xiaomi ${uid}` : "Xiaomi MiMo",
            providerSpecificData: {
              uid: uid || null,
              baseUrl: baseUrl || "https://api.xiaomimimo.com/v1",
              authMethod: "oauth",
              mimoPassToken: passToken?.passToken || null,
              mimoUserId: passToken?.userId || null,
              mimoCUserId: passToken?.cUserId || null,
            },
            testStatus: "active",
          });
          clearXiaomiMimoSession(state);
          stopXiaomiMimoProxy();
          return NextResponse.json({
            success: true,
            connection: {
              id: connection.id,
              provider: connection.provider,
              email: connection.email,
              displayName: connection.displayName,
            },
          });
        } catch (err) {
          clearXiaomiMimoSession(state);
          stopXiaomiMimoProxy();
          return NextResponse.json({ error: err.message }, { status: 500 });
        }
      }
      // Trae/Windsurf: code is either a raw callback URL or a pasted token.
      // exchangeTokens() handles both paths; no PKCE, skip codex JWT extraction.
      if (provider === "trae" || provider === "windsurf") {
--- a/src/app/api/oauth/xiaomi-mimo/api-key/route.js
+++ b/src/app/api/oauth/xiaomi-mimo/api-key/route.js
@@ -0,0 +1,136 @@
 import { NextResponse } from "next/server";
 import { createProviderConnection } from "@/models";
 /**
 * POST /api/oauth/xiaomi-mimo/api-key
 * Import a Xiaomi MiMo API key manually (or from auto-import).
 * The key is validated against the models endpoint, then stored.
 *
 * Body: { apiKey, uid?, baseUrl? }
 */
 export async function POST(request) {
  try {
    const { apiKey, uid, baseUrl, mimoPassToken, mimoUserId, mimoCUserId } = await request.json();
    if (!apiKey || typeof apiKey !== "string" || !apiKey.trim()) {
      return NextResponse.json(
        { error: "API key is required" },
        { status: 400 },
      );
    }
    const key = apiKey.trim();
    if (!key.startsWith("sk-")) {
      return NextResponse.json(
        { error: "Invalid key format — expected sk- prefix" },
        { status: 400 },
      );
    }
    const effectiveBaseUrl = (baseUrl || "https://api.xiaomimimo.com/v1").replace(/\/+$/, "");
    // Validate the key against the models endpoint
    let validated = false;
    let modelCount = 0;
    try {
      const resp = await fetch(`${effectiveBaseUrl}/models`, {
        method: "GET",
        headers: {
          Authorization: `Bearer ${key}`,
          "X-Mimo-Source": "mimocode-cli",
        },
        signal: AbortSignal.timeout(10000),
      });
      if (resp.ok) {
        const data = await resp.json();
        modelCount = Array.isArray(data?.data) ? data.data.length : 0;
        validated = true;
      }
    } catch {
      // Network error — still allow import (key may be valid but network blocked)
    }
    if (!validated) {
      // Soft-fail: store the key but mark as untested
      console.log("[xiaomi-mimo] key validation failed, storing as untested");
    }
    // Dedup: if a connection with the same uid or same key already exists, update it
    const { getProviderConnections, updateProviderConnection } = await import("@/models");
    const existing = (await getProviderConnections()).find(
      (c) => c.provider === "xiaomi-mimo" && (
        (uid && c.email === `${uid}@xiaomi`) ||
        c.accessToken === key
      ),
    );
    if (existing) {
      const updated = await updateProviderConnection(existing.id, {
        accessToken: key,
        providerSpecificData: {
          ...existing.providerSpecificData,
          uid: uid || existing.providerSpecificData?.uid || null,
          baseUrl: effectiveBaseUrl,
          // Per-account session credential — enables multi-account rotation.
          mimoPassToken: mimoPassToken || existing.providerSpecificData?.mimoPassToken || null,
          mimoUserId: mimoUserId || existing.providerSpecificData?.mimoUserId || null,
          mimoCUserId: mimoCUserId || existing.providerSpecificData?.mimoCUserId || null,
          modelCount,
        },
        testStatus: validated ? "active" : existing.testStatus,
      });
      return NextResponse.json({
        success: true,
        validated,
        modelCount,
        updated: true,
        connection: {
          id: existing.id,
          provider: existing.provider,
          email: existing.email,
          displayName: existing.displayName,
        },
      });
    }
    const connection = await createProviderConnection({
      provider: "xiaomi-mimo",
      authType: "api_key",
      accessToken: key,
      refreshToken: null,
      // API keys don't expire on a fixed schedule; use a long horizon
      expiresAt: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString(),
      email: uid ? `${uid}@xiaomi` : null,
      displayName: uid ? `Xiaomi ${uid}` : "Xiaomi MiMo",
      providerSpecificData: {
        uid: uid || null,
        baseUrl: effectiveBaseUrl,
        authMethod: "api_key",
        provider: "API Key",
        modelCount,
        // Per-account session credential — enables multi-account rotation.
        mimoPassToken: mimoPassToken || null,
        mimoUserId: mimoUserId || null,
        mimoCUserId: mimoCUserId || null,
      },
      testStatus: validated ? "active" : "untested",
    });
    return NextResponse.json({
      success: true,
      validated,
      modelCount,
      connection: {
        id: connection.id,
        provider: connection.provider,
        email: connection.email,
        displayName: connection.displayName,
      },
    });
  } catch (error) {
    console.log("Xiaomi MiMo API key import error:", error);
    return NextResponse.json(
      { error: "API key import failed" },
      { status: 500 },
    );
  }
 }
--- a/src/app/api/oauth/xiaomi-mimo/auto-import/route.js
+++ b/src/app/api/oauth/xiaomi-mimo/auto-import/route.js
@@ -0,0 +1,140 @@
 import { NextResponse } from "next/server";
 import { readFile, access, constants } from "fs/promises";
 import { homedir } from "os";
 import { join } from "path";
 import { readDesktopPassToken } from "open-sse/shared/mimoAccount.js";
 /**
 * GET /api/oauth/xiaomi-mimo/auto-import
 * Auto-detect Xiaomi MiMo credentials from local auth.json.
 *
 * Sources (in priority order):
 *   1. ~/.local/share/mimocode/auth.json  → xiaomi field
 *   2. %APPDATA%/Xiaomi MiMo/...          → (future: Desktop keychain)
 *
 * auth.json shape:
 * {
 *   "xiaomi": {
 *     "type": "api",
 *     "key": "sk-xxxx",
 *     "metadata": { "uid": "...", "base_url": "https://api.xiaomimimo.com/v1" }
 *   }
 * }
 */
 function getCandidatePaths() {
  const home = homedir();
  const paths = [];
  // MiMoCode / MiMo Desktop shared data dir (cross-platform XDG)
  paths.push(join(home, ".local", "share", "mimocode", "auth.json"));
  // Windows: also check USERPROFILE-based XDG
  if (process.platform === "win32") {
    const appData = process.env.APPDATA || join(home, "AppData", "Roaming");
    // Desktop's own storage (may have separate credentials in the future)
    paths.push(join(appData, "Xiaomi MiMo", "auth.json"));
  }
  // macOS
  if (process.platform === "darwin") {
    paths.push(
      join(home, "Library", "Application Support", "mimocode", "auth.json"),
    );
  }
  return paths;
 }
 /**
 * GET /api/oauth/xiaomi-mimo/auto-import
 */
 export async function GET() {
  try {
    const candidates = getCandidatePaths();
    let authPath = null;
    for (const candidate of candidates) {
      try {
        await access(candidate, constants.R_OK);
        authPath = candidate;
        break;
      } catch {
        // Try next candidate
      }
    }
    if (!authPath) {
      return NextResponse.json({
        found: false,
        error: `Xiaomi MiMo Desktop auth file not found. Checked:\n${candidates.join("\n")}\n\nMake sure Xiaomi MiMo Desktop is installed and you are signed in.`,
      });
    }
    const raw = await readFile(authPath, "utf-8");
    let auth;
    try {
      auth = JSON.parse(raw);
    } catch {
      return NextResponse.json({
        found: false,
        error: "auth.json is not valid JSON. Please sign in to Xiaomi MiMo Desktop again.",
      });
    }
    const xiaomi = auth?.xiaomi;
    if (!xiaomi || !xiaomi.key) {
      return NextResponse.json({
        found: false,
        error: "No Xiaomi credentials found in auth.json. Please sign in to Xiaomi MiMo Desktop.",
      });
    }
    // Validate key format
    const key = String(xiaomi.key).trim();
    if (!key.startsWith("sk-")) {
      return NextResponse.json({
        found: false,
        error: "Xiaomi key does not appear to be a valid API key (expected sk- prefix).",
      });
    }
    const metadata = xiaomi.metadata || {};
    const uid = metadata.uid || null;
    const baseUrl = metadata.base_url || "https://api.xiaomimimo.com/v1";
    // Account-session passToken from Desktop's cookie store. Persisting it per
    // connection is what lets multiple Xiaomi accounts rotate independently.
    // (null while Desktop is running — its cookie DB is exclusively locked.)
    let mimoPassToken = null;
    let mimoUserId = null;
    let mimoCUserId = null;
    try {
      const pt = await readDesktopPassToken();
      if (pt) {
        mimoPassToken = pt.passToken;
        mimoUserId = pt.userId;
        mimoCUserId = pt.cUserId;
      }
    } catch (e) {
      console.log("[xiaomi-mimo] passToken read failed (non-fatal):", e.message);
    }
    return NextResponse.json({
      found: true,
      apiKey: key,
      uid,
      baseUrl,
      source: authPath,
      mimoPassToken,
      mimoUserId,
      mimoCUserId,
    });
  } catch (error) {
    console.log("Xiaomi MiMo auto-import error:", error);
    return NextResponse.json(
      { found: false, error: error.message },
      { status: 500 },
    );
  }
 }
--- a/src/lib/db/driver.js
+++ b/src/lib/db/driver.js
@@ -19,6 +19,10 @@ async function tryBunSqlite() {
 async function tryBetterSqlite() {
  // Skip on Bun — better-sqlite3 native bindings unsupported
  if (process.versions.bun) return null;
  // Skip on Node >= 24: the native addon SIGSEGVs on load there, which is a
  // process-level crash the try/catch below cannot recover from. node:sqlite covers it.
  const [nodeMajor] = process.versions.node.split(".").map(Number);
  if (nodeMajor >= 24) return null;
  try {
    const { createBetterSqliteAdapter } = await import("./adapters/betterSqliteAdapter.js");
    return createBetterSqliteAdapter(DATA_FILE);
--- a/src/lib/oauth/constants/oauth.js
+++ b/src/lib/oauth/constants/oauth.js
@@ -130,6 +130,21 @@ export const GROK_CLI_CONFIG = { ...PROVIDER_OAUTH["grok-cli"] };
 //   3) Redirect → ${cb}?refreshToken=...&loginHost=...&isRedirect=true
 //   4) POST ExchangeToken {ClientID, RefreshToken, ClientSecret:"-"} → {Result.AccessToken, ExpiresAt}
 //   5) POST GetUserInfo (x-cloudide-token) → email/name
 // Xiaomi MiMo Desktop OAuth — custom ECDH encrypted-callback flow (NOT standard OAuth2).
 //   1) Client generates X25519 keypair
 //   2) Browser opens ${platformUrl}/authorize?pk=<pubkey>&redirect_uri=http://localhost:<port>/&kn=mimocode&key_name=...
 //   3) Redirect → http://localhost:<port>/?u=<base64 encrypted payload>
 //   4) Decrypt: ECDH(shared) → SHA256 → AES-256-GCM
 //      Layout: [12-byte nonce][32-byte ephemeral pubkey][ciphertext][16-byte GCM tag]
 //   5) Result JSON: { uid, sk, url }
 export const XIAOMI_MIMO_CONFIG = {
  platformUrl: process.env.MIMO_PLATFORM_URL || "https://platform.xiaomimimo.com",
  defaultBaseUrl: "https://api.xiaomimimo.com/v1",
  kn: "mimocode",
  callbackPath: "/",
  timeoutMs: 300000, // 5 minutes
 };
 export const TRAE_CONFIG = {
  clientId: "ono9krqynydwx5",
  clientSecret: "-",
--- a/src/lib/oauth/providers/xiaomi-mimo.js
+++ b/src/lib/oauth/providers/xiaomi-mimo.js
@@ -0,0 +1,123 @@
 import crypto from "crypto";
 import { XIAOMI_MIMO_CONFIG } from "../constants/oauth.js";
 // ───────────────────────────────────────────────────────────────────────────
 // Xiaomi MiMo OAuth helpers
 // Custom ECDH + AES-256-GCM encrypted-callback flow (NOT standard OAuth2).
 // ───────────────────────────────────────────────────────────────────────────
 /**
 * Generate an X25519 keypair for the OAuth handshake.
 * @returns {{ publicKey: string, privateKeyDer: Buffer }}
 *   publicKey     — base64 SPKI (for the `pk` URL param)
 *   privateKeyDer — PKCS8 DER Buffer (for ECDH later)
 */
 export function generateKeyPair() {
  const { publicKey, privateKey } = crypto.generateKeyPairSync("x25519");
  const publicKeyDer = publicKey.export({ format: "der", type: "spki" });
  // SPKI for X25519 is 44 bytes; the raw 32-byte key is the last 32 bytes.
  // But the platform expects the full base64 SPKI — pass as-is.
  const publicKeyB64 = publicKeyDer.toString("base64");
  const privateKeyDer = privateKey.export({ format: "der", type: "pkcs8" });
  return { publicKey: publicKeyB64, privateKeyDer };
 }
 /**
 * Decrypt the `u` query parameter from the Xiaomi OAuth callback.
 *
 * Wire format (base64-decoded):
 *   bytes 0..11   — 12-byte AES-GCM nonce
 *   bytes 12..43  — 32-byte ephemeral public key (raw X25519)
 *   bytes 44..n-16 — ciphertext
 *   last 16 bytes  — GCM auth tag
 *
 * Key derivation: SHA256(ECDH(clientPrivateKey, ephemeralPublicKey))
 *
 * @param {Buffer} privateKeyDer — PKCS8 DER private key from generateKeyPair()
 * @param {string} encryptedB64  — the `u` query param value (base64)
 * @returns {{ uid: string, sk: string, url?: string }}
 */
 export function decryptCallback(privateKeyDer, encryptedB64) {
  const raw = Buffer.from(encryptedB64, "base64");
  if (raw.length < 12 + 32 + 16 + 1) {
    throw new Error(`Encrypted payload too short: ${raw.length} bytes`);
  }
  const nonce = raw.subarray(0, 12);
  const ephemeralPubRaw = raw.subarray(12, 44);
  const ciphertextAndTag = raw.subarray(44);
  const tag = ciphertextAndTag.subarray(ciphertextAndTag.length - 16);
  const ciphertext = ciphertextAndTag.subarray(0, ciphertextAndTag.length - 16);
  // Reconstruct the ephemeral public key as SPKI DER for Node crypto.
  // X25519 SPKI prefix: 302a300506032b656e032100
  const ephemeralPub = crypto.createPublicKey({
    key: Buffer.concat([
      Buffer.from("302a300506032b656e032100", "hex"),
      ephemeralPubRaw,
    ]),
    format: "der",
    type: "spki",
  });
  const privateKey = crypto.createPrivateKey({
    key: privateKeyDer,
    format: "der",
    type: "pkcs8",
  });
  const sharedSecret = crypto.diffieHellman({ privateKey, publicKey: ephemeralPub });
  const derivedKey = crypto.createHash("sha256").update(sharedSecret).digest();
  const decipher = crypto.createDecipheriv("aes-256-gcm", derivedKey, nonce);
  decipher.setAuthTag(tag);
  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
  const parsed = JSON.parse(decrypted.toString("utf-8"));
  if (!parsed || typeof parsed !== "object") {
    throw new Error("Decrypted payload is not a valid object");
  }
  return {
    uid: parsed.uid || null,
    sk: parsed.sk || null,
    url: parsed.url || XIAOMI_MIMO_CONFIG.defaultBaseUrl,
  };
 }
 /**
 * Build the browser authorization URL.
 * @param {string} publicKey — base64 SPKI from generateKeyPair()
 * @param {string} redirectUri — e.g. http://localhost:12345/
 * @param {string} [keyName] — optional stable key name
 * @returns {string}
 */
 export function buildAuthorizeUrl(publicKey, redirectUri, keyName) {
  const params = new URLSearchParams({
    pk: publicKey,
    redirect_uri: redirectUri,
    kn: XIAOMI_MIMO_CONFIG.kn,
  });
  if (keyName) params.set("key_name", keyName);
  return `${XIAOMI_MIMO_CONFIG.platformUrl}/authorize?${params.toString()}`;
 }
 /**
 * Get or create a stable key name for this installation.
 * Stored in the 9Router data dir so re-auth reuses the same name.
 */
 export function getKeyName() {
  // Use a deterministic name based on machine — avoids needing filesystem writes
  // in the OAuth provider layer. The platform treats key_name as a label only.
  const machineId = crypto
    .createHash("sha256")
    .update(`${process.platform}-${process.env.COMPUTERNAME || process.env.HOSTNAME || "unknown"}`)
    .digest("hex")
    .slice(0, 8);
  return `9router-xmd-${machineId}`;
 }
--- a/src/lib/oauth/utils/server.js
+++ b/src/lib/oauth/utils/server.js
@@ -755,3 +755,185 @@ export function stopZedProxy() {
  zedProxyPort = null;
 }
 // ───────────────────────────────────────────────────────────────────────────
 // Xiaomi MiMo Desktop OAuth callback proxy
 // Receives the ECDH-encrypted `u` param, decrypts it, stores the session.
 // ───────────────────────────────────────────────────────────────────────────
 let xiaomiMimoProxyServer = null;
 let xiaomiMimoProxyPort = null;
 let xiaomiMimoProxyTimeout = null;
 const xiaomiMimoSessions = new Map();
 export function registerXiaomiMimoSession({ state, privateKeyDer }) {
  if (!state || !privateKeyDer) return false;
  xiaomiMimoSessions.set(state, {
    privateKeyDer,
    status: "pending",
    createdAt: Date.now(),
  });
  return true;
 }
 export function getXiaomiMimoSessionStatus(state) {
  const s = xiaomiMimoSessions.get(state);
  if (!s) return null;
  // Don't leak the private key to the client
  return { status: s.status, result: s.result || null, error: s.error || null };
 }
 export function clearXiaomiMimoSession(state) {
  xiaomiMimoSessions.delete(state);
 }
 function renderXiaomiMimoResultPage(success, message) {
  const color = success ? "#22c55e" : "#ef4444";
  const icon = success ? "&#10003;" : "&#10007;";
  const title = success ? "Authentication Successful" : "Authentication Failed";
  return `<!DOCTYPE html>
 <html>
 <head><meta charset="utf-8"><title>${title}</title>
 <style>
  body { font-family: system-ui; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #f5f5f5; }
  .container { text-align: center; padding: 2rem; background: white; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
  .icon { color: ${color}; font-size: 3rem; }
  h1 { margin: 1rem 0; font-size: 1.25rem; }
  p { color: #666; font-size: 0.875rem; }
 </style>
 </head>
 <body>
  <div class="container">
    <div class="icon">${icon}</div>
    <h1>${title}</h1>
    <p>${message || (success ? "You can close this tab and return to 9Router." : "Please try again.")}</p>
    ${success ? "<script>setTimeout(() => window.close(), 3000);</script>" : ""}
  </div>
 </body>
 </html>`;
 }
 /**
 * Start the Xiaomi Desktop OAuth callback proxy.
 * @returns {Promise<{success: boolean, port?: number, callbackUrl?: string, reason?: string}>}
 */
 export function startXiaomiMimoProxy() {
  return new Promise((resolve) => {
    if (xiaomiMimoProxyServer) {
      resolve({
        success: true,
        port: xiaomiMimoProxyPort,
        callbackUrl: `http://127.0.0.1:${xiaomiMimoProxyPort}/`,
      });
      return;
    }
    const server = http.createServer(async (req, res) => {
      // Origin guard
      if (!isLoopbackOrigin(req.headers.origin)) {
        res.writeHead(403);
        res.end("Forbidden");
        return;
      }
      const url = new URL(req.url, "http://127.0.0.1");
      const u = url.searchParams.get("u");
      if (!u) {
        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
        res.end(renderXiaomiMimoResultPage(false, "Missing encrypted payload (u parameter)."));
        return;
      }
      // Try each pending session's private key — the callback URL carries no
      // state param, so we attempt decryption with every pending key.
      const pendingSessions = [...xiaomiMimoSessions.entries()]
        .filter(([, s]) => s.status === "pending");
      if (pendingSessions.length === 0) {
        res.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
        res.end(renderXiaomiMimoResultPage(false, "No active OAuth session. Please restart the login flow."));
        return;
      }
      try {
        const { decryptCallback } = await import("../providers/xiaomi-mimo.js");
        let result = null;
        let matchedState = null;
        for (const [state, session] of pendingSessions) {
          try {
            result = decryptCallback(session.privateKeyDer, u);
            matchedState = state;
            break;
          } catch {
            // Wrong key for this session — try next
          }
        }
        if (!result || !matchedState) {
          throw new Error("Could not decrypt with any pending session key");
        }
        if (!result.sk) {
          throw new Error("Decrypted payload missing sk (API key)");
        }
        // Store result only in the matched session
        const session = xiaomiMimoSessions.get(matchedState);
        if (session) {
          session.status = "done";
          session.result = {
            uid: result.uid,
            accessToken: result.sk,
            baseUrl: result.url || "https://api.xiaomimimo.com/v1",
          };
        }
        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
        res.end(renderXiaomiMimoResultPage(true, "Xiaomi account linked. You can close this tab."));
        console.log("[xiaomi-mimo oauth] callback decrypted, uid:", result.uid);
      } catch (err) {
        console.error("[xiaomi-mimo oauth] decrypt failed:", err.message);
        for (const [, session] of pendingSessions) {
          session.status = "error";
          session.error = err.message;
        }
        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
        res.end(renderXiaomiMimoResultPage(false, `Decryption failed: ${err.message}`));
      }
    });
    server.on("error", (err) => {
      console.log("[xiaomi-mimo oauth] listen error:", err.message);
      resolve({ success: false, reason: err.message });
    });
    server.listen(0, "127.0.0.1", () => {
      xiaomiMimoProxyServer = server;
      xiaomiMimoProxyPort = server.address().port;
      xiaomiMimoProxyTimeout = setTimeout(() => {
        console.log("[xiaomi-mimo oauth] timeout, stopping");
        stopXiaomiMimoProxy();
      }, 300000);
      console.log(`[xiaomi-mimo oauth] listening on port ${xiaomiMimoProxyPort}`);
      resolve({
        success: true,
        port: xiaomiMimoProxyPort,
        callbackUrl: `http://127.0.0.1:${xiaomiMimoProxyPort}/`,
      });
    });
  });
 }
 export function stopXiaomiMimoProxy() {
  console.log(`[xiaomi-mimo oauth] stopping (port ${xiaomiMimoProxyPort || "-"})`);
  if (xiaomiMimoProxyTimeout) { clearTimeout(xiaomiMimoProxyTimeout); xiaomiMimoProxyTimeout = null; }
  if (xiaomiMimoProxyServer) { xiaomiMimoProxyServer.close(); xiaomiMimoProxyServer = null; }
  xiaomiMimoProxyPort = null;
  // No callback can arrive once the listener is down, so drop every pending
  // session — each holds an X25519 private key and they would otherwise
  // accumulate for the process lifetime (one per /authorize call).
  xiaomiMimoSessions.clear();
 }
--- a/src/shared/components/XiaomiMimoAuthModal.js
+++ b/src/shared/components/XiaomiMimoAuthModal.js
@@ -0,0 +1,276 @@
 "use client";
 import { useState, useEffect } from "react";
 import PropTypes from "prop-types";
 import { Modal, Button } from "@/shared/components";
 /**
 * Xiaomi MiMo Auth Modal
 *
 * Auto-imports credentials from the local Xiaomi MiMo Desktop auth.json (~/.local/share/mimocode/auth.json).
 * If auto-import fails, offers a one-click browser OAuth fallback.
 * Reached only via the "Connect with OAuth" button — the API-key path uses the
 * standard Add API Key modal, since Xiaomi MiMo supports both auth modes.
 */
 export default function XiaomiMimoAuthModal({ isOpen, onSuccess, onClose }) {
  const [phase, setPhase] = useState("detecting"); // detecting | found | not-found | importing | error
  const [detectResult, setDetectResult] = useState(null);
  const [error, setError] = useState(null);
  const [oauthUrl, setOauthUrl] = useState(null);
  const [oauthState, setOauthState] = useState(null);
  // Auto-detect local credentials when modal opens
  useEffect(() => {
    if (!isOpen) return;
    let cancelled = false;
    (async () => {
      setPhase("detecting");
      setError(null);
      setDetectResult(null);
      setOauthUrl(null);
      try {
        const res = await fetch("/api/oauth/xiaomi-mimo/auto-import");
        const data = await res.json();
        if (cancelled) return;
        if (data.found && data.apiKey) {
          setDetectResult(data);
          setPhase("found");
        } else {
          setPhase("not-found");
          setError(data.error || "Xiaomi MiMo Desktop credentials not found on this machine.");
        }
      } catch {
        if (!cancelled) {
          setPhase("not-found");
          setError("Failed to read local Xiaomi MiMo Desktop credentials.");
        }
      }
    })();
    return () => { cancelled = true; };
  }, [isOpen]);
  // Import the auto-detected key
  const handleImport = async () => {
    if (!detectResult?.apiKey) return;
    setPhase("importing");
    setError(null);
    try {
      const res = await fetch("/api/oauth/xiaomi-mimo/api-key", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
          apiKey: detectResult.apiKey,
          uid: detectResult.uid,
          baseUrl: detectResult.baseUrl,
          mimoPassToken: detectResult.mimoPassToken || null,
          mimoUserId: detectResult.mimoUserId || null,
          mimoCUserId: detectResult.mimoCUserId || null,
        }),
      });
      const data = await res.json();
      if (!res.ok || !data.success) {
        throw new Error(data.error || "Import failed");
      }
      onSuccess?.(data.connection);
      onClose();
    } catch (err) {
      setPhase("found");
      setError(err.message);
    }
  };
  // Start browser OAuth fallback
  const handleStartOAuth = async () => {
    setError(null);
    try {
      const state = crypto.randomUUID();
      const res = await fetch(`/api/oauth/xiaomi-mimo/authorize?state=${state}`);
      const data = await res.json();
      if (data.authorizeUrl) {
        setOauthUrl(data.authorizeUrl);
        setOauthState(data.state);
        window.open(data.authorizeUrl, "_blank", "width=600,height=700");
      } else {
        throw new Error(data.error || "Failed to start OAuth");
      }
    } catch (err) {
      setError(err.message);
    }
  };
  // Poll OAuth result
  const handlePollOAuth = async () => {
    if (!oauthState) return;
    setError(null);
    try {
      const res = await fetch(`/api/oauth/xiaomi-mimo/poll-status?state=${oauthState}`);
      const data = await res.json();
      if (data.status === "done" && data.result) {
        // Exchange to create the connection
        const exRes = await fetch("/api/oauth/xiaomi-mimo/exchange", {
          method: "POST",
          headers: { "Content-Type": "application/json" },
          body: JSON.stringify({ state: oauthState }),
        });
        const exData = await exRes.json();
        if (exData.success) {
          onSuccess?.(exData.connection);
          onClose();
        } else {
          throw new Error(exData.error || "Exchange failed");
        }
      } else if (data.status === "error") {
        throw new Error(data.error || "OAuth failed");
      } else {
        setError("Authorization not completed yet. Finish in the browser, then click Check Again.");
      }
    } catch (err) {
      setError(err.message);
    }
  };
  return (
    <Modal isOpen={isOpen} title="Connect Xiaomi MiMo" onClose={onClose}>
      <div className="flex flex-col gap-4">
        {/* Detecting */}
        {phase === "detecting" && (
          <div className="text-center py-6">
            <div className="size-16 mx-auto mb-4 rounded-full bg-primary/10 flex items-center justify-center">
              <span className="material-symbols-outlined text-3xl text-primary animate-spin">
                progress_activity
              </span>
            </div>
            <h3 className="text-lg font-semibold mb-2">Reading local credentials...</h3>
            <p className="text-sm text-text-muted">
              Checking ~/.local/share/mimocode/auth.json
            </p>
          </div>
        )}
        {/* Found — one-click import */}
        {phase === "found" && detectResult && (
          <>
            <div className="bg-green-50 dark:bg-green-900/20 p-3 rounded-lg border border-green-200 dark:border-green-800">
              <div className="flex gap-2">
                <span className="material-symbols-outlined text-green-600 dark:text-green-400">check_circle</span>
                <div className="text-sm text-green-800 dark:text-green-200">
                  <p className="font-medium">Xiaomi MiMo Desktop credentials found!</p>
                  <p className="mt-1 opacity-80">
                    UID: {detectResult.uid || "—"} · Source: {detectResult.source?.split(/[\\/]/).pop()}
                  </p>
                </div>
              </div>
            </div>
            {error && (
              <div className="bg-red-50 dark:bg-red-900/20 p-3 rounded-lg border border-red-200 dark:border-red-800">
                <p className="text-sm text-red-600 dark:text-red-400">{error}</p>
              </div>
            )}
            <div className="flex gap-2">
              <Button onClick={handleImport} fullWidth>
                Connect with Local Credentials
              </Button>
              <Button onClick={onClose} variant="ghost" fullWidth>
                Cancel
              </Button>
            </div>
          </>
        )}
        {/* Importing */}
        {phase === "importing" && (
          <div className="text-center py-6">
            <div className="size-16 mx-auto mb-4 rounded-full bg-primary/10 flex items-center justify-center">
              <span className="material-symbols-outlined text-3xl text-primary animate-spin">
                progress_activity
              </span>
            </div>
            <h3 className="text-lg font-semibold mb-2">Connecting...</h3>
          </div>
        )}
        {/* Not found — offer OAuth fallback */}
        {phase === "not-found" && (
          <>
            <div className="bg-amber-50 dark:bg-amber-900/20 p-3 rounded-lg border border-amber-200 dark:border-amber-800">
              <div className="flex gap-2 items-start">
                <span className="material-symbols-outlined text-amber-600 dark:text-amber-400">info</span>
                <div className="text-sm text-amber-800 dark:text-amber-200">
                  <p className="font-medium">Local credentials not found</p>
                  <p className="mt-1 opacity-80">{error}</p>
                  <p className="mt-2 opacity-80">
                    Make sure Xiaomi MiMo Desktop is installed and you are signed in, then retry.
                    Or sign in via browser below.
                  </p>
                </div>
              </div>
            </div>
            {!oauthUrl ? (
              <div className="flex gap-2">
                <Button
                  onClick={() => {
                    setPhase("detecting");
                    // Re-trigger detect
                    fetch("/api/oauth/xiaomi-mimo/auto-import")
                      .then((r) => r.json())
                      .then((data) => {
                        if (data.found && data.apiKey) {
                          setDetectResult(data);
                          setPhase("found");
                        } else {
                          setPhase("not-found");
                          setError(data.error || "Still not found.");
                        }
                      })
                      .catch(() => setPhase("not-found"));
                  }}
                  variant="outline"
                  fullWidth
                >
                  Retry Local Detect
                </Button>
                <Button onClick={handleStartOAuth} fullWidth>
                  Sign in via Browser
                </Button>
              </div>
            ) : (
              <div className="flex flex-col gap-2">
                <div className="bg-blue-50 dark:bg-blue-900/20 p-3 rounded-lg border border-blue-200 dark:border-blue-800">
                  <p className="text-sm text-blue-800 dark:text-blue-200">
                    Browser opened. Complete the Xiaomi sign-in, then click{" "}
                    <strong>Check Again</strong>.
                  </p>
                </div>
                <div className="flex gap-2">
                  <Button onClick={handlePollOAuth} fullWidth>
                    Check Again
                  </Button>
                  <Button onClick={onClose} variant="ghost" fullWidth>
                    Cancel
                  </Button>
                </div>
              </div>
            )}
          </>
        )}
      </div>
    </Modal>
  );
 }
 XiaomiMimoAuthModal.propTypes = {
  isOpen: PropTypes.bool.isRequired,
  onSuccess: PropTypes.func,
  onClose: PropTypes.func.isRequired,
 };
--- a/src/shared/components/index.js
+++ b/src/shared/components/index.js
@@ -28,6 +28,7 @@ export { default as KiroAuthModal } from "./KiroAuthModal";
 export { default as KiroOAuthWrapper } from "./KiroOAuthWrapper";
 export { default as KiroSocialOAuthModal } from "./KiroSocialOAuthModal";
 export { default as CursorAuthModal } from "./CursorAuthModal";
 export { default as XiaomiMimoAuthModal } from "./XiaomiMimoAuthModal";
 export { default as IFlowCookieModal } from "./IFlowCookieModal";
 export { default as GitLabAuthModal } from "./GitLabAuthModal";
 export { default as EditConnectionModal } from "./EditConnectionModal";
--- a/tests/unit/xiaomi-mimo-executor.test.js
+++ b/tests/unit/xiaomi-mimo-executor.test.js
@@ -0,0 +1,80 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { XiaomiMimoExecutor, __test__ } from "../../open-sse/executors/xiaomi-mimo.js";
 import { getExecutor } from "../../open-sse/executors/index.js";
 const { bareModel, COOKIE_KEY } = __test__;
 const OPENAI_T = { runtimeTransport: { format: "openai", baseUrl: "https://api.xiaomimimo.com/v1/chat/completions" } };
 const CLAUDE_T = { runtimeTransport: { format: "claude", baseUrl: "https://api.xiaomimimo.com/anthropic/v1/messages" } };
 describe("xiaomi-mimo executor", () => {
  let ex;
  beforeEach(() => {
    ex = new XiaomiMimoExecutor();
  });
  it("is registered for xiaomi-mimo", () => {
    expect(getExecutor("xiaomi-mimo")).toBeInstanceOf(XiaomiMimoExecutor);
  });
  it("routes Preview models to the account-service route regardless of transport", () => {
    const expected = "https://mimo-server-cn.xiaomimimo.com/api/route/chat/completions";
    expect(ex.buildUrl("mimo-x-pro-preview", true, 0, OPENAI_T)).toBe(expected);
    expect(ex.buildUrl("mimo-x-pro-preview", true, 0, CLAUDE_T)).toBe(expected);
    // body.model arrives as `xiaomi/<id>` via upstreamModelId
    expect(ex.buildUrl("xiaomi/mimo-x-flash-preview", true, 0, OPENAI_T)).toBe(expected);
  });
  it("keeps the sourceFormat-matched endpoint for cloud models", () => {
    // Regression: a Claude client must reach /anthropic/v1/messages, not /v1/chat/completions.
    expect(ex.buildUrl("mimo-v2.5-pro", true, 0, CLAUDE_T)).toBe(CLAUDE_T.runtimeTransport.baseUrl);
    expect(ex.buildUrl("mimo-v2.5-pro", true, 0, OPENAI_T)).toBe(OPENAI_T.runtimeTransport.baseUrl);
  });
  it("authenticates Preview calls with the account cookie", () => {
    const headers = ex.buildHeaders({ [COOKIE_KEY]: "serviceToken=abc", accessToken: "sk-x" }, true, "u", "mimo-x-pro-preview");
    expect(headers.Cookie).toBe("serviceToken=abc");
    expect(headers.Authorization).toBeUndefined();
  });
  it("authenticates cloud calls with the bearer key", () => {
    const headers = ex.buildHeaders({ accessToken: "sk-x" }, true, "u", "mimo-v2.5-pro");
    expect(headers.Authorization).toBe("Bearer sk-x");
    expect(headers.Cookie).toBeUndefined();
  });
  it("fails fast when a Preview call has no account session", async () => {
    await expect(
      ex.execute({ model: "mimo-x-pro-preview", body: {}, stream: true, credentials: {}, log: null }),
    ).rejects.toThrow(/account session unavailable/);
  });
  it("flattens content-part arrays to plain strings", () => {
    const out = ex.transformRequest(
      "mimo-x-pro-preview",
      { messages: [{ role: "user", content: [{ type: "text", text: "a" }, { type: "text", text: "b" }] }] },
      true,
      {},
    );
    expect(out.messages[0].content).toBe("ab");
  });
  it("applies Preview defaults without overriding explicit values", () => {
    const body = { messages: [{ role: "user", content: "hi" }], temperature: 0.2 };
    const out = ex.transformRequest("mimo-x-pro-preview", body, true, {});
    expect(out.temperature).toBe(0.2);       // caller's value kept
    expect(out.top_p).toBe(0.95);            // default filled in
    expect(out.max_tokens).toBe(4096);
  });
  it("leaves cloud bodies free of Preview defaults", () => {
    const out = ex.transformRequest("mimo-v2.5-pro", { messages: [{ role: "user", content: "hi" }] }, true, {});
    expect(out.thinking).toBeUndefined();
    expect(out.max_tokens).toBeUndefined();
  });
  it("strips a provider/model prefix when testing preview ids", () => {
    expect(bareModel("xiaomi/mimo-x-pro-preview")).toBe("mimo-x-pro-preview");
    expect(bareModel("mimo-x-pro-preview")).toBe("mimo-x-pro-preview");
  });
 });
--- a/tests/unit/xiaomi-mimo-oauth-proxy.test.js
+++ b/tests/unit/xiaomi-mimo-oauth-proxy.test.js
@@ -0,0 +1,54 @@
 /**
 * Regression: the xiaomi-mimo OAuth session store must not retain sessions
 * once the callback listener is down.
 *
 * Each /authorize registers a session holding an X25519 private key, keyed by a
 * fresh state. Unlike trae/windsurf/zed (singleton session) this is a Map, so
 * without an explicit clear every login attempt would leak a private key for
 * the whole process lifetime.
 */
 import { describe, it, expect } from "vitest";
 import {
  registerXiaomiMimoSession,
  getXiaomiMimoSessionStatus,
  clearXiaomiMimoSession,
  stopXiaomiMimoProxy,
 } from "../../src/lib/oauth/utils/server.js";
 const KEY = Buffer.from("x25519-private-key-material");
 describe("xiaomi-mimo OAuth session store", () => {
  it("drops pending sessions when the proxy stops", () => {
    registerXiaomiMimoSession({ state: "s1", privateKeyDer: KEY });
    expect(getXiaomiMimoSessionStatus("s1")).not.toBeNull();
    stopXiaomiMimoProxy();
    expect(getXiaomiMimoSessionStatus("s1")).toBeNull();
  });
  it("drops every session, not just the last one", () => {
    registerXiaomiMimoSession({ state: "a", privateKeyDer: KEY });
    registerXiaomiMimoSession({ state: "b", privateKeyDer: KEY });
    registerXiaomiMimoSession({ state: "c", privateKeyDer: KEY });
    stopXiaomiMimoProxy();
    for (const s of ["a", "b", "c"]) {
      expect(getXiaomiMimoSessionStatus(s)).toBeNull();
    }
  });
  it("ignores registrations with a missing state or key", () => {
    expect(registerXiaomiMimoSession({ state: "", privateKeyDer: KEY })).toBe(false);
    expect(registerXiaomiMimoSession({ state: "s", privateKeyDer: null })).toBe(false);
  });
  it("never exposes the private key to callers", () => {
    registerXiaomiMimoSession({ state: "s1", privateKeyDer: KEY });
    const view = getXiaomiMimoSessionStatus("s1");
    expect(view).toEqual({ status: "pending", result: null, error: null });
    expect(JSON.stringify(view)).not.toContain("privateKeyDer");
    clearXiaomiMimoSession("s1");
  });
 });
--- a/tests/unit/xiaomi-mimo-oauth-session.test.js
+++ b/tests/unit/xiaomi-mimo-oauth-session.test.js
@@ -0,0 +1,152 @@
 /**
 * Regression: the poll-status/exchange session lifecycle for xiaomi-mimo.
 *
 * The original PR cleared the session inside poll-status, so the client's
 * following POST /exchange always saw a missing session and returned 400 —
 * the whole browser-OAuth fallback was dead. These tests pin the contract:
 *   - a finished session survives /poll-status until /exchange consumes it
 *   - a failed session is cleaned up by /poll-status itself
 */
 import { describe, it, expect, vi, beforeEach } from "vitest";
 vi.mock("next/server", () => ({
  NextResponse: {
    json: (body, init) => ({
      status: init?.status || 200,
      body,
      json: async () => body,
    }),
  },
 }));
 vi.mock("@/lib/oauth/providers", () => ({
  getProvider: vi.fn(),
  generateAuthData: vi.fn(),
  exchangeTokens: vi.fn(),
  requestDeviceCode: vi.fn(),
  pollForToken: vi.fn(),
 }));
 vi.mock("@/models", () => ({
  createProviderConnection: vi.fn(async (d) => ({ id: "conn-1", ...d })),
 }));
 vi.mock("open-sse/shared/mimoAccount.js", () => ({
  readDesktopPassToken: vi.fn(async () => ({ passToken: "pt-abc", userId: "u1", cUserId: "c1" })),
 }));
 vi.mock("@/lib/oauth/utils/ideDetect", () => ({ detectIdeInstalled: vi.fn() }));
 // Session store backing the mocked OAuth server helpers, so the test can assert
 // on real lifecycle transitions rather than on call counts alone.
 const sessions = new Map();
 const stopped = { count: 0 };
 vi.mock("@/lib/oauth/utils/server", () => {
  const notUsed = () => { throw new Error("unexpected helper"); };
  const noop = () => {};
  return {
    startCodexProxy: notUsed, stopCodexProxy: noop, registerCodexSession: noop,
    getCodexSessionStatus: () => null, clearCodexSession: noop,
    startXaiProxy: notUsed, stopXaiProxy: noop, registerXaiSession: noop,
    getXaiSessionStatus: () => null, clearXaiSession: noop,
    startTraeProxy: notUsed, stopTraeProxy: noop, registerTraeSession: noop,
    getTraeSessionStatus: () => null, clearTraeSession: noop,
    startWindsurfProxy: notUsed, stopWindsurfProxy: noop, registerWindsurfSession: noop,
    getWindsurfSessionStatus: () => null, clearWindsurfSession: noop,
    startZedProxy: notUsed, stopZedProxy: noop, registerZedSession: noop,
    getZedSessionStatus: () => null, clearZedSession: noop,
    startXiaomiMimoProxy: notUsed,
    stopXiaomiMimoProxy: () => { stopped.count += 1; },
    registerXiaomiMimoSession: () => {},
    getXiaomiMimoSessionStatus: (state) => {
      const s = sessions.get(state);
      return s ? { status: s.status, result: s.result || null, error: s.error || null } : null;
    },
    clearXiaomiMimoSession: (state) => { sessions.delete(state); },
  };
 });
 const { GET, POST } = await import("../../src/app/api/oauth/[provider]/[action]/route.js");
 const get = (action, state) =>
  GET(new Request(`http://localhost/api/oauth/xiaomi-mimo/${action}?state=${state}`), {
    params: Promise.resolve({ provider: "xiaomi-mimo", action }),
  });
 const exchange = (state) =>
  POST(
    new Request("http://localhost/api/oauth/xiaomi-mimo/exchange", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ state }),
    }),
    { params: Promise.resolve({ provider: "xiaomi-mimo", action: "exchange" }) },
  );
 describe("xiaomi-mimo OAuth session lifecycle", () => {
  beforeEach(() => {
    sessions.clear();
    stopped.count = 0;
  });
  it("keeps a finished session alive so /exchange can consume it", async () => {
    sessions.set("st1", { status: "done", result: { uid: "u1", accessToken: "sk-x", baseUrl: "https://api.xiaomimimo.com/v1" } });
    const poll = await get("poll-status", "st1");
    expect(poll.status).toBe(200);
    expect(await poll.json()).toMatchObject({ status: "done" });
    // The bug: this used to be gone, making /exchange always 400.
    expect(sessions.has("st1")).toBe(true);
    const res = await exchange("st1");
    expect(res.status).toBe(200);
    expect((await res.json()).success).toBe(true);
  });
  it("clears the session once /exchange consumed it", async () => {
    sessions.set("st1", { status: "done", result: { uid: "u1", accessToken: "sk-x" } });
    await exchange("st1");
    expect(sessions.has("st1")).toBe(false);
  });
  it("cleans up a failed session in poll-status and stops the proxy", async () => {
    sessions.set("st2", { status: "error", error: "Could not decrypt with any pending session key" });
    const poll = await get("poll-status", "st2");
    expect(await poll.json()).toMatchObject({ status: "error" });
    expect(sessions.has("st2")).toBe(false);
    expect(stopped.count).toBe(1);
  });
  it("persists the Desktop passToken onto the connection (Preview models need it)", async () => {
    const { createProviderConnection } = await import("@/models");
    sessions.set("st3", { status: "done", result: { uid: "u1", accessToken: "sk-x" } });
    await exchange("st3");
    const arg = createProviderConnection.mock.calls.at(-1)[0];
    expect(arg.provider).toBe("xiaomi-mimo");
    expect(arg.providerSpecificData.mimoPassToken).toBe("pt-abc");
    expect(arg.providerSpecificData.mimoUserId).toBe("u1");
  });
  it("still reports unknown for an unregistered state", async () => {
    const poll = await get("poll-status", "nope");
    expect(await poll.json()).toEqual({ status: "unknown" });
  });
  it("rejects /exchange without a state", async () => {
    const res = await POST(
      new Request("http://localhost/api/oauth/xiaomi-mimo/exchange", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({}),
      }),
      { params: Promise.resolve({ provider: "xiaomi-mimo", action: "exchange" }) },
    );
    expect(res.status).toBe(400);
  });
 });