feat(xiaomi-mimo): server-assisted desktop login, five account clusters, v2.6 models

Reproduce the MiMo Desktop login surface server-side so headless/Docker
deployments can link a Xiaomi account without the Desktop client. The
account session (passToken) is captured during the proxied login and
stored per connection.

- Five account clusters (cn/sgp/ams/ru/in): per-region mimo-server host
  and SSO sid, unknown region falls back to sgp
- mimo-v2.6-pro/flash/pro-ultraspeed dual-route models: account-service
  route when desktop credentials exist, cloud API (sk- key) otherwise;
  drops obsolete mimo-x-*-preview ids
- Desktop ServiceTokenManager 2-phase handshake (single serviceLogin with
  target sid, raw 64-bit nonce preserved), per-region session cache
- reasoning_effort bridged to output_config.effort; i18n runtime now
  observes characterData mutations so React text rewrites get translated
- Security hardening on the login proxy: session travels only in the
  httpOnly cookie (never in the URL), proxy branch requires dashboard
  auth, authorization/proxy-authorization never forwarded upstream, and
  upstream Set-Cookie is not replayed onto the app origin

open-sse/providers/registry/xiaomi-mimo.js

@@ -2,9 +2,9 @@ import { CLAUDE_API_HEADERS } from "../shared.js";
 
 // Dual auth (same pattern as kimi):
 //   - API key (sk-...)      → cloud API on api.xiaomimimo.com
-//   - Desktop account/OAuth → same cloud host, plus the Desktop-exclusive Preview
-//     models served by the account-service route on mimo-server-cn.xiaomimimo.com
-//     (authorized by a Xiaomi account session cookie, not the key).
+//   - Desktop account/OAuth → same cloud host, plus the dual-route v2.6 models
+//     served by the account-service route (mimo-server-<cluster>.xiaomimimo.com),
+//     authorized by a Xiaomi account session cookie, not the key.
 // Endpoint is picked per model in the executor, same as opencode-go's /responses split.
 export default {
   id: "xiaomi-mimo",
@@ -30,6 +30,16 @@ export default {
   category: "oauth",
   authModes: ["oauth", "apikey"],
   hasOAuth: true,
+  // Keys are cluster-specific. MiMo Desktop declares five regions
+  // (CN/SGP/AMS/RU/IN) — host + sid follow mimo-server-<code> / mimo<code>.
+  regions: [
+    { id: "cn", label: "China (中国大陆)" },
+    { id: "sgp", label: "Singapore (新加坡)" },
+    { id: "ams", label: "Europe · Amsterdam (欧洲)" },
+    { id: "ru", label: "Russia (俄罗斯)" },
+    { id: "in", label: "India (印度)" },
+  ],
+  defaultRegion: "sgp",
   serviceKinds: ["llm", "tts"],
   transport: {
     baseUrl: "https://api.xiaomimimo.com/v1/chat/completions",
@@ -50,10 +60,10 @@ export default {
     },
   ],
   models: [
-    // Desktop-exclusive — served by the account-service route, which only accepts
-    // OpenAI format, so supportedFormats pins them to the openai transport.
-    { id: "mimo-x-pro-preview", name: "MiMo-X-Pro-Preview", upstreamModelId: "xiaomi/mimo-x-pro-preview", supportedFormats: ["openai"] },
-    { id: "mimo-x-flash-preview", name: "MiMo-X-Flash-Preview", upstreamModelId: "xiaomi/mimo-x-flash-preview", supportedFormats: ["openai"] },
+    // Cloud API & Desktop dual-route models (prefers the desktop account quota when available)
+    { id: "mimo-v2.6-pro", name: "MiMo V2.6 Pro", upstreamModelId: "xiaomi/mimo-v2.6-pro", supportedFormats: ["openai"] },
+    { id: "mimo-v2.6-flash", name: "MiMo V2.6 Flash", upstreamModelId: "xiaomi/mimo-v2.6-flash", supportedFormats: ["openai"] },
+    { id: "mimo-v2.6-pro-ultraspeed", name: "MiMo V2.6 Pro UltraSpeed", upstreamModelId: "xiaomi/mimo-v2.6-pro-ultraspeed", supportedFormats: ["openai"] },
     // Cloud API models (api.xiaomimimo.com/v1)
     { id: "mimo-v2.5-pro", name: "MiMo V2.5 Pro" },
     { id: "mimo-v2.5", name: "MiMo V2.5" },

open-sse/providers/thinkingLevels.js

@@ -41,6 +41,7 @@ const PATTERN_THINKING = [
   { provider: "codex", pattern: "*gpt-5.6-terra*", levels: [...CODEX_GPT_5_6_LEVELS, "ultra"] },
   { provider: "codex", pattern: "*gpt-5.6-luna*", levels: CODEX_GPT_5_6_LEVELS },
   { pattern: "*codex*", levels: ["low", "medium", "high", "xhigh"] }, // codex cannot disable thinking
+  { pattern: "*mimo*v2.6*", levels: ["none", "low", "medium", "high", "xhigh"] },
   // DeepSeek v4.* (Alibaba MaaS, probed live): effort low|medium|high|xhigh|max
   // all 200 via output_config.effort; "none" is a 400 on the anthropic route
   // (disable thinking instead). none kept for the picker = disable.