feat(provider): add MiMo Free no-auth provider

Bootstrap → JWT → chat flow with auto-retry. Inject the MiMoCode
system marker required to pass the upstream 403 anti-abuse gate,
derive JWT expiry from the exp claim, and use a stable per-machine
fingerprint as the bootstrap client.

Co-authored-by: Cursor <cursoragent@cursor.com>

open-sse/config/providerModels.js

@@ -211,6 +211,14 @@ export const PROVIDER_MODELS = {
     // { id: "minimax-m2.5-free", name: "MiniMax M2.5", targetFormat: "claude" },
     // { id: "trinity-large-preview-free", name: "Trinity Large Preview" },
   ],
+  mmf: [  // MiMo Free
+    { id: "mimo-auto", name: "MiMo Auto" },
+    { id: "mimo-v2.5-pro", name: "MiMo V2.5 Pro" },
+    { id: "mimo-v2.5", name: "MiMo V2.5" },
+    { id: "mimo-v2-pro", name: "MiMo V2 Pro" },
+    { id: "mimo-v2-omni", name: "MiMo V2 Omni" },
+    { id: "mimo-v2-flash", name: "MiMo V2 Flash" },
+  ],
 
   cl: [  // Cline
     { id: "anthropic/claude-opus-4.7", name: "Claude Opus 4.7" },
@@ -897,6 +905,7 @@ const OAUTH_ALIASES = {
   cline: "cl",
   opencode: "oc",
   qoder: "qd",
+  "mimo-free": "mmf",
   vertex: "vertex",
   "vertex-partner": "vertex-partner",
 };

open-sse/config/providers.js

@@ -410,6 +410,8 @@ export const PROVIDERS = {
     baseUrl: "https://api.xiaomimimo.com/v1/chat/completions",
     format: "openai"
   },
+  "mimo-free": { baseUrl: "https://api.xiaomimimo.com/api/free-ai/openai/chat", format: "openai", noAuth: true },
+  mmf: { baseUrl: "https://api.xiaomimimo.com/api/free-ai/openai/chat", format: "openai", noAuth: true },
   "xiaomi-tokenplan": {
     baseUrl: "https://token-plan-sgp.xiaomimimo.com/v1/chat/completions",
     format: "openai"

open-sse/executors/index.js

@@ -16,6 +16,7 @@ import { PerplexityWebExecutor } from "./perplexity-web.js";
 import { OllamaLocalExecutor } from "./ollama-local.js";
 import { CommandCodeExecutor } from "./commandcode.js";
 import { XiaomiTokenplanExecutor } from "./xiaomi-tokenplan.js";
+import { MimoFreeExecutor } from "./mimo-free.js";
 import { DefaultExecutor } from "./default.js";
 
 const executors = {
@@ -39,6 +40,8 @@ const executors = {
   "ollama-local": new OllamaLocalExecutor(),
   commandcode: new CommandCodeExecutor(),
   "xiaomi-tokenplan": new XiaomiTokenplanExecutor(),
+  "mimo-free": new MimoFreeExecutor(),
+  mmf: new MimoFreeExecutor(), // Alias for mimo-free
 };
 
 const defaultCache = new Map();
@@ -73,3 +76,4 @@ export { PerplexityWebExecutor } from "./perplexity-web.js";
 export { OllamaLocalExecutor } from "./ollama-local.js";
 export { CommandCodeExecutor } from "./commandcode.js";
 export { XiaomiTokenplanExecutor } from "./xiaomi-tokenplan.js";
+export { MimoFreeExecutor } from "./mimo-free.js";

open-sse/executors/mimo-free.js

@@ -0,0 +1,156 @@
+import { BaseExecutor } from "./base.js";
+import { PROVIDERS } from "../config/providers.js";
+import { proxyAwareFetch } from "../utils/proxyFetch.js";
+import { createHash } from "crypto";
+import os from "os";
+
+const BOOTSTRAP_URL = "https://api.xiaomimimo.com/api/free-ai/bootstrap";
+const CHAT_URL = "https://api.xiaomimimo.com/api/free-ai/openai/chat";
+const SESSION_AFFINITY_PREFIX = "ses_";
+const SESSION_ID_LENGTH = 24;
+const JWT_FALLBACK_TTL_SEC = 3000;
+const JWT_EXPIRY_BUFFER_MS = 300000;
+const SESSION_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789";
+
+// Anti-abuse gate marker: the free chat endpoint returns 403 "Illegal access"
+// unless a system message contains this exact MiMoCode signature substring.
+export const MIMO_SYSTEM_MARKER =
+  "You are MiMoCode, an interactive CLI tool that helps users with software engineering tasks.";
+
+// In-memory JWT cache (per-process, survives across requests but not restarts)
+let cachedJwt = null;
+let jwtExpiresAt = 0;
+
+// Device fingerprint reused as the bootstrap "client" — stable per machine
+function generateFingerprint() {
+  let username = "unknown-user";
+  try {
+    username = os.userInfo().username;
+  } catch {
+    // ignore
+  }
+  const cpu = (os.cpus()[0]?.model || "unknown-cpu").trim();
+  const seed = `${os.hostname()}|${os.platform()}|${os.arch()}|${cpu}|${username}`;
+  return createHash("sha256").update(seed).digest("hex");
+}
+
+function generateSessionId() {
+  let id = SESSION_AFFINITY_PREFIX;
+  for (let i = 0; i < SESSION_ID_LENGTH; i++) {
+    id += SESSION_CHARS[Math.floor(Math.random() * SESSION_CHARS.length)];
+  }
+  return id;
+}
+
+// Derive expiry from the JWT exp claim; fall back to a fixed TTL when unparseable
+function parseJwtExp(jwt) {
+  try {
+    const payload = JSON.parse(Buffer.from(jwt.split(".")[1], "base64").toString());
+    if (payload.exp) return payload.exp * 1000;
+  } catch {
+    // ignore
+  }
+  return Date.now() + JWT_FALLBACK_TTL_SEC * 1000;
+}
+
+// Ensure the body carries the anti-abuse marker in a system message (idempotent)
+function injectSystemMarker(body) {
+  const messages = body?.messages;
+  if (!Array.isArray(messages)) return body;
+  const hasMarker = messages.some(
+    (m) => m?.role === "system" && typeof m.content === "string" && m.content.includes(MIMO_SYSTEM_MARKER)
+  );
+  if (hasMarker) return body;
+  return { ...body, messages: [{ role: "system", content: MIMO_SYSTEM_MARKER }, ...messages] };
+}
+
+function resetJwtCache() {
+  cachedJwt = null;
+  jwtExpiresAt = 0;
+}
+
+async function bootstrapJwt(proxyOptions = null) {
+  if (cachedJwt && Date.now() < jwtExpiresAt - JWT_EXPIRY_BUFFER_MS) {
+    return cachedJwt;
+  }
+
+  const response = await proxyAwareFetch(BOOTSTRAP_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ client: generateFingerprint() }),
+  }, proxyOptions);
+
+  if (!response.ok) {
+    throw new Error(`MiMo bootstrap failed: ${response.status}`);
+  }
+
+  const data = await response.json();
+  if (!data.jwt) {
+    throw new Error("MiMo bootstrap returned no JWT");
+  }
+
+  cachedJwt = data.jwt;
+  jwtExpiresAt = parseJwtExp(data.jwt);
+  return cachedJwt;
+}
+
+export class MimoFreeExecutor extends BaseExecutor {
+  constructor() {
+    super("mimo-free", PROVIDERS["mimo-free"]);
+    this.sessionId = generateSessionId();
+  }
+
+  buildUrl() {
+    return CHAT_URL;
+  }
+
+  buildHeaders(credentials, stream = true) {
+    return {
+      "Content-Type": "application/json",
+      "X-Mimo-Source": "mimocode-cli-free",
+      "x-session-affinity": this.sessionId,
+      "Accept": stream ? "text/event-stream" : "application/json",
+    };
+  }
+
+  transformRequest(model, body) {
+    return injectSystemMarker(body);
+  }
+
+  async execute({ model, body, stream, credentials, signal, log, proxyOptions = null }) {
+    let jwt;
+    try {
+      jwt = await bootstrapJwt(proxyOptions);
+    } catch (error) {
+      log?.error?.("AUTH", `MiMo bootstrap failed: ${error.message}`);
+      throw error;
+    }
+
+    const url = this.buildUrl();
+    const transformedBody = this.transformRequest(model, body);
+    const headers = { ...this.buildHeaders(credentials, stream), "Authorization": `Bearer ${jwt}` };
+    const bodyStr = JSON.stringify(transformedBody);
+    log?.debug?.("FETCH", `MIMO-FREE → ${url} | body=${bodyStr.length}B`);
+
+    const response = await proxyAwareFetch(url, { method: "POST", headers, body: bodyStr, signal }, proxyOptions);
+
+    // On auth failure, invalidate cache and retry once with a fresh JWT
+    if (response.status === 401 || response.status === 403) {
+      log?.debug?.("AUTH", `MiMo auth failed (${response.status}), re-bootstrapping...`);
+      resetJwtCache();
+      jwt = await bootstrapJwt(proxyOptions);
+      headers["Authorization"] = `Bearer ${jwt}`;
+      const retryResponse = await proxyAwareFetch(url, { method: "POST", headers, body: bodyStr, signal }, proxyOptions);
+      return { response: retryResponse, url, headers, transformedBody };
+    }
+
+    return { response, url, headers, transformedBody };
+  }
+}
+
+export const __test__ = {
+  generateFingerprint, generateSessionId, bootstrapJwt, resetJwtCache, parseJwtExp,
+  injectSystemMarker, MIMO_SYSTEM_MARKER, BOOTSTRAP_URL, CHAT_URL, SESSION_AFFINITY_PREFIX,
+};
+
+export default MimoFreeExecutor;

src/app/api/providers/suggested-models/filters.js

@@ -17,4 +17,10 @@ export const FILTERS = {
     models
       .filter((m) => m.id?.endsWith("-free") || KNOWN_FREE_OPENCODE_MODELS.includes(m.id))
       .map((m) => ({ id: m.id, name: m.id })),
+
+  // models.dev returns a large catalog; keep only mimo models
+  "mimo-free": (models) =>
+    (Array.isArray(models) ? models : [])
+      .filter((m) => m.id?.startsWith("mimo") || m.name?.toLowerCase().includes("mimo"))
+      .map((m) => ({ id: m.id, name: m.name || m.id })),
 };

src/shared/constants/providers.js

@@ -12,6 +12,7 @@ export const FREE_PROVIDERS = {
   qoder: { id: "qoder", alias: "qd", name: "Qoder", icon: "water_drop", color: "#EC4899", deprecated: true, deprecationNotice: RISK_NOTICE, website: "https://qoder.com", notice: { signupUrl: "https://qoder.com" } },
   // iflow: { id: "iflow", alias: "if", name: "iFlow AI", icon: "water_drop", color: "#6366F1", website: "https://iflow.cn", notice: { signupUrl: "https://iflow.cn" } },
   opencode: { id: "opencode", alias: "oc", name: "OpenCode Free", icon: "terminal", color: "#E87040", textIcon: "OC", noAuth: true, passthroughModels: true, modelsFetcher: { url: "https://opencode.ai/zen/v1/models", type: "opencode-free" } },
+  "mimo-free": { id: "mimo-free", alias: "mmf", name: "MiMo Code Free", icon: "smart_toy", color: "#FF6900", textIcon: "MF", noAuth: true, passthroughModels: true, modelsFetcher: { url: "https://models.dev/api.json", type: "mimo-free" } },
 };
 
 // Free Tier Providers (has free access but may require account/API key)

tests/unit/mimo-free.test.js

@@ -0,0 +1,251 @@
+/**
+ * Unit tests for the MiMo Free no-auth provider.
+ *
+ * Covers the parts that would silently break the bootstrap → JWT → chat flow:
+ *   - fingerprint / session id primitives (format + determinism)
+ *   - JWT bootstrap (caching, exp parsing, error paths)
+ *   - system marker injection (the 403 anti-abuse gate)
+ *   - executor wiring (headers, transformRequest, registration)
+ *   - provider/model config registration
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+// Mock proxyAwareFetch so bootstrapJwt never hits the network.
+const fetchMock = vi.fn();
+vi.mock("../../open-sse/utils/proxyFetch.js", () => ({
+  proxyAwareFetch: (...args) => fetchMock(...args),
+}));
+
+import { MimoFreeExecutor, __test__ } from "../../open-sse/executors/mimo-free.js";
+import { getExecutor } from "../../open-sse/executors/index.js";
+import { PROVIDERS } from "../../open-sse/config/providers.js";
+import { PROVIDER_MODELS, PROVIDER_ID_TO_ALIAS } from "../../open-sse/config/providerModels.js";
+import { FREE_PROVIDERS } from "../../src/shared/constants/providers.js";
+
+const {
+  generateFingerprint, generateSessionId, bootstrapJwt, resetJwtCache, parseJwtExp,
+  injectSystemMarker, MIMO_SYSTEM_MARKER, SESSION_AFFINITY_PREFIX, BOOTSTRAP_URL, CHAT_URL,
+} = __test__;
+
+function jsonResponse(data, { ok = true, status = 200 } = {}) {
+  return { ok, status, json: async () => data };
+}
+
+// Build a fake JWT with the given exp (seconds) in the payload.
+function makeJwt(expSec) {
+  const header = Buffer.from(JSON.stringify({ alg: "HS256" })).toString("base64url");
+  const payload = Buffer.from(JSON.stringify({ exp: expSec })).toString("base64url");
+  return `${header}.${payload}.sig`;
+}
+
+beforeEach(() => {
+  fetchMock.mockReset();
+  resetJwtCache();
+});
+
+describe("generateSessionId", () => {
+  it("uses the ses_ prefix and a 24-char random suffix", () => {
+    const id = generateSessionId();
+    expect(id.startsWith(SESSION_AFFINITY_PREFIX)).toBe(true);
+    expect(id.length).toBe(SESSION_AFFINITY_PREFIX.length + 24);
+  });
+
+  it("only emits lowercase alphanumeric characters in the suffix", () => {
+    expect(generateSessionId().slice(SESSION_AFFINITY_PREFIX.length)).toMatch(/^[a-z0-9]{24}$/);
+  });
+
+  it("produces a fresh id on each call", () => {
+    expect(generateSessionId()).not.toBe(generateSessionId());
+  });
+});
+
+describe("generateFingerprint", () => {
+  it("returns a 64-char hex sha256 digest", () => {
+    expect(generateFingerprint()).toMatch(/^[a-f0-9]{64}$/);
+  });
+
+  it("is stable per machine (deterministic across calls)", () => {
+    expect(generateFingerprint()).toBe(generateFingerprint());
+  });
+});
+
+describe("parseJwtExp", () => {
+  it("derives the expiry from the JWT exp claim (ms)", () => {
+    const expSec = Math.floor(Date.now() / 1000) + 3600;
+    expect(parseJwtExp(makeJwt(expSec))).toBe(expSec * 1000);
+  });
+
+  it("falls back to a future timestamp when the JWT is unparseable", () => {
+    const before = Date.now();
+    const result = parseJwtExp("not-a-jwt");
+    expect(result).toBeGreaterThan(before);
+  });
+});
+
+describe("injectSystemMarker", () => {
+  it("prepends a system message with the marker when none is present", () => {
+    const out = injectSystemMarker({ messages: [{ role: "user", content: "hi" }] });
+    expect(out.messages[0].role).toBe("system");
+    expect(out.messages[0].content).toContain(MIMO_SYSTEM_MARKER);
+  });
+
+  it("preserves the original user message after injection", () => {
+    const out = injectSystemMarker({ messages: [{ role: "user", content: "write a haiku" }] });
+    expect(out.messages.find((m) => m.role === "user").content).toBe("write a haiku");
+  });
+
+  it("keeps a caller-provided system prompt alongside the marker", () => {
+    const out = injectSystemMarker({
+      messages: [
+        { role: "system", content: "You are a pirate." },
+        { role: "user", content: "hi" },
+      ],
+    });
+    const sys = out.messages.filter((m) => m.role === "system").map((m) => m.content).join("\n");
+    expect(sys).toContain(MIMO_SYSTEM_MARKER);
+    expect(sys).toContain("You are a pirate.");
+  });
+
+  it("does not duplicate the marker when already present", () => {
+    const out = injectSystemMarker({
+      messages: [
+        { role: "system", content: `${MIMO_SYSTEM_MARKER}\nExtra.` },
+        { role: "user", content: "hi" },
+      ],
+    });
+    const count = out.messages.filter(
+      (m) => m.role === "system" && m.content.includes(MIMO_SYSTEM_MARKER)
+    ).length;
+    expect(count).toBe(1);
+  });
+
+  it("leaves a body without a messages array untouched", () => {
+    const body = { prompt: "legacy" };
+    expect(injectSystemMarker(body)).toBe(body);
+  });
+});
+
+describe("bootstrapJwt", () => {
+  it("returns the jwt from the bootstrap response", async () => {
+    fetchMock.mockResolvedValueOnce(jsonResponse({ jwt: makeJwt(Math.floor(Date.now() / 1000) + 3600) }));
+    const jwt = await bootstrapJwt();
+    expect(jwt).toMatch(/\./);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0][0]).toBe(BOOTSTRAP_URL);
+  });
+
+  it("sends the machine fingerprint as the bootstrap client", async () => {
+    fetchMock.mockResolvedValueOnce(jsonResponse({ jwt: makeJwt(Math.floor(Date.now() / 1000) + 3600) }));
+    await bootstrapJwt();
+    const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+    expect(body.client).toBe(generateFingerprint());
+  });
+
+  it("caches the jwt and does not re-fetch while still valid", async () => {
+    fetchMock.mockResolvedValueOnce(jsonResponse({ jwt: makeJwt(Math.floor(Date.now() / 1000) + 3600) }));
+    const first = await bootstrapJwt();
+    const second = await bootstrapJwt();
+    expect(first).toBe(second);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("re-fetches once the cached jwt is within the expiry buffer", async () => {
+    // exp 100s out < 300s buffer → treated as near-expiry.
+    fetchMock.mockResolvedValueOnce(jsonResponse({ jwt: makeJwt(Math.floor(Date.now() / 1000) + 100) }));
+    await bootstrapJwt();
+    const fresh = makeJwt(Math.floor(Date.now() / 1000) + 3600);
+    fetchMock.mockResolvedValueOnce(jsonResponse({ jwt: fresh }));
+    expect(await bootstrapJwt()).toBe(fresh);
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it("throws when the bootstrap response is not ok", async () => {
+    fetchMock.mockResolvedValueOnce(jsonResponse({}, { ok: false, status: 403 }));
+    await expect(bootstrapJwt()).rejects.toThrow(/bootstrap failed: 403/);
+  });
+
+  it("throws when the bootstrap response has no jwt", async () => {
+    fetchMock.mockResolvedValueOnce(jsonResponse({ expiresIn: 3600 }));
+    await expect(bootstrapJwt()).rejects.toThrow(/no JWT/);
+  });
+});
+
+describe("MimoFreeExecutor", () => {
+  const exec = new MimoFreeExecutor();
+
+  it("buildUrl returns the free-ai chat endpoint", () => {
+    expect(exec.buildUrl()).toBe(CHAT_URL);
+  });
+
+  it("buildHeaders includes the MiMo source and session affinity", () => {
+    const h = exec.buildHeaders({}, true);
+    expect(h["X-Mimo-Source"]).toBe("mimocode-cli-free");
+    expect(h["x-session-affinity"]).toMatch(/^ses_/);
+    expect(h["Accept"]).toBe("text/event-stream");
+  });
+
+  it("transformRequest injects the system marker", () => {
+    const out = exec.transformRequest("mimo-auto", { messages: [{ role: "user", content: "hi" }] });
+    expect(out.messages[0].content).toContain(MIMO_SYSTEM_MARKER);
+  });
+
+  it("execute injects the marker and sends a Bearer JWT to the chat endpoint", async () => {
+    fetchMock.mockResolvedValueOnce(jsonResponse({ jwt: makeJwt(Math.floor(Date.now() / 1000) + 3600) }));
+    fetchMock.mockResolvedValueOnce({ ok: true, status: 200 });
+    const { url, headers, transformedBody } = await exec.execute({
+      model: "mimo-auto",
+      body: { model: "mimo-auto", stream: true, messages: [{ role: "user", content: "hi" }] },
+      stream: true,
+      credentials: {},
+    });
+    expect(url).toBe(CHAT_URL);
+    expect(headers["Authorization"]).toMatch(/^Bearer /);
+    expect(transformedBody.messages[0].content).toContain(MIMO_SYSTEM_MARKER);
+    // first call = bootstrap, second = chat with auth header
+    const chatHeaders = fetchMock.mock.calls[1][1].headers;
+    expect(chatHeaders["Authorization"]).toMatch(/^Bearer /);
+  });
+
+  it("re-bootstraps and retries once on a 403 from the chat endpoint", async () => {
+    fetchMock.mockResolvedValueOnce(jsonResponse({ jwt: makeJwt(Math.floor(Date.now() / 1000) + 3600) }));
+    fetchMock.mockResolvedValueOnce({ ok: false, status: 403 });
+    fetchMock.mockResolvedValueOnce(jsonResponse({ jwt: makeJwt(Math.floor(Date.now() / 1000) + 3600) }));
+    fetchMock.mockResolvedValueOnce({ ok: true, status: 200 });
+    const { response } = await exec.execute({
+      model: "mimo-auto",
+      body: { messages: [{ role: "user", content: "hi" }] },
+      stream: true,
+      credentials: {},
+    });
+    expect(response.status).toBe(200);
+    // bootstrap, chat(403), re-bootstrap, chat(200)
+    expect(fetchMock).toHaveBeenCalledTimes(4);
+  });
+});
+
+describe("MiMo Free provider registration", () => {
+  it("registers a specialized executor for mimo-free and the mmf alias", () => {
+    expect(getExecutor("mimo-free")).toBeInstanceOf(MimoFreeExecutor);
+    expect(getExecutor("mmf")).toBeInstanceOf(MimoFreeExecutor);
+  });
+
+  it("registers mimo-free as a no-auth provider in open-sse config", () => {
+    expect(PROVIDERS["mimo-free"]?.noAuth).toBe(true);
+    expect(PROVIDERS.mmf?.noAuth).toBe(true);
+  });
+
+  it("exposes the mmf model catalog", () => {
+    expect(Array.isArray(PROVIDER_MODELS.mmf)).toBe(true);
+    expect(PROVIDER_MODELS.mmf.some((m) => m.id === "mimo-auto")).toBe(true);
+  });
+
+  it("maps the mimo-free alias to mmf", () => {
+    expect(PROVIDER_ID_TO_ALIAS["mimo-free"]).toBe("mmf");
+  });
+
+  it("lists mimo-free in the dashboard FREE_PROVIDERS catalog", () => {
+    expect(FREE_PROVIDERS["mimo-free"]?.alias).toBe("mmf");
+    expect(FREE_PROVIDERS["mimo-free"]?.noAuth).toBe(true);
+  });
+});