F3: Kimi inference pipeline + full grok cloud-surface excision
Sampler / inference (PRD F3):
- kimi_compat.rs: single adaptation point for the Kimi chat/completions
dialect (thinking-field mapping, model_id stripping, empty-content
tool-call message fix, stream_options.include_usage), with kimi-cli
source citations
- Rate-limit handling reworked for Kimi/Moonshot semantics; UA kigi/{version}
- /models replaces the xAI models-v2 endpoint everywhere; idle model
refresh carries X-Msh-* device headers only (X-XAI-Token-Auth and
x-grok-client-mode/CLIENT_MODE_HEADER machinery deleted)
Cloud-surface excision (PRD §5, zero-egress):
- remote/ conversations lane, cli-chat-proxy-types crate, prod/ dir,
share command, credit bar: deleted (single local session lane;
paginate() replaces merge_and_paginate)
- Subscription/tier gate stack deleted end-to-end: AppView
gate/tier/team/ZDR fields, app/subscription.rs watch loop,
dispatch/billing.rs paywall + SuperGrok upsell, free-usage-exhausted
chain, tier-restricted commands, GateInfo, RemoteSettings gate fields,
SettingsUpdateNotification gate fields
- /privacy + coding-data-sharing setting deleted (backed by a dead xAI
RPC; Kigi is zero-egress — nothing to share or retain remotely)
Auth UX correctness (user-reported):
- Device-flow fixtures now mirror the live Kimi payload shape
(https://www.kimi.com/code/authorize_device?user_code=..., verified
against auth.kimi.com); the fabricated auth.kimi.com/device?code=...
URLs are gone
- open_browser_detached is a no-op under cfg(test): unit tests drove
wiremock fixture URLs into the real browser (root cause of the
"garbage mock link" ABCD-1234 tabs)
- Welcome/pager-minimal rebrand: Grok Build -> Kigi, grok.com ->
kimi.com, "Sign in to Grok" -> "Sign in to Kimi"
This commit is contained in:
@@ -29,12 +29,14 @@ pub(crate) fn ascii_header_value(value: &str) -> String {
|
||||
}
|
||||
}
|
||||
|
||||
/// The three device-identity headers sent on every OAuth call.
|
||||
/// The three device-identity headers sent on every OAuth call and, via
|
||||
/// `agent::config::inject_url_derived_headers`, on every first-party
|
||||
/// inference request (mirroring kimi-cli src/kimi_cli/llm.py:317-323).
|
||||
///
|
||||
/// Errors when the persistent device id cannot be created (e.g. read-only
|
||||
/// `~/.kigi`): the OAuth endpoints require `X-Msh-Device-Id`, so login cannot
|
||||
/// proceed without it.
|
||||
pub(crate) fn device_headers() -> anyhow::Result<[(&'static str, String); 3]> {
|
||||
/// proceed without it. Inference callers treat the error as skip-with-warning.
|
||||
pub fn device_headers() -> anyhow::Result<[(&'static str, String); 3]> {
|
||||
Ok([
|
||||
("X-Msh-Device-Name", ascii_header_value(&device_name())),
|
||||
("X-Msh-Device-Model", ascii_header_value(device_model())),
|
||||
|
||||
@@ -150,6 +150,11 @@ async fn complete_device_code_login(
|
||||
/// caller can decide how to notify the user (eprintln on CLI, nothing on TUI
|
||||
/// where the URL is already rendered in the widget).
|
||||
async fn open_browser_detached(url: &str) -> bool {
|
||||
// Unit tests drive the full login flow against mock servers — their
|
||||
// fixture URLs must never reach a real browser.
|
||||
if cfg!(test) {
|
||||
return false;
|
||||
}
|
||||
let url = url.to_owned();
|
||||
match tokio::task::spawn_blocking(move || webbrowser::open(&url)).await {
|
||||
Ok(Ok(())) => true,
|
||||
@@ -171,13 +176,16 @@ mod tests {
|
||||
use wiremock::matchers::{body_string_contains, method, path};
|
||||
use wiremock::{Mock, MockServer, ResponseTemplate};
|
||||
|
||||
/// Fixture mirroring the live `device_authorization` payload (verified
|
||||
/// against auth.kimi.com): verification URLs are passed through verbatim
|
||||
/// by the login flow, so they use the real shape.
|
||||
fn device_auth_json(code: &str) -> serde_json::Value {
|
||||
serde_json::json!({
|
||||
"user_code": "ABCD-1234",
|
||||
"user_code": "WXYZ-6789",
|
||||
"device_code": code,
|
||||
"verification_uri": "https://auth.kimi.com/device",
|
||||
"verification_uri_complete": "https://auth.kimi.com/device?code=ABCD-1234",
|
||||
"expires_in": 600,
|
||||
"verification_uri": "https://www.kimi.com/code/authorize_device",
|
||||
"verification_uri_complete": "https://www.kimi.com/code/authorize_device?user_code=WXYZ-6789",
|
||||
"expires_in": 1800,
|
||||
"interval": 0, // floored to 1s by the poll loop
|
||||
})
|
||||
}
|
||||
|
||||
@@ -359,11 +359,11 @@ mod tests {
|
||||
"client_id={KIMI_CODE_CLIENT_ID}"
|
||||
)))
|
||||
.respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
|
||||
"user_code": "ABCD-1234",
|
||||
"user_code": "WXYZ-6789",
|
||||
"device_code": "dev-code-1",
|
||||
"verification_uri": "https://auth.kimi.com/device",
|
||||
"verification_uri_complete": "https://auth.kimi.com/device?code=ABCD-1234",
|
||||
"expires_in": 600,
|
||||
"verification_uri": "https://www.kimi.com/code/authorize_device",
|
||||
"verification_uri_complete": "https://www.kimi.com/code/authorize_device?user_code=WXYZ-6789",
|
||||
"expires_in": 1800,
|
||||
"interval": 7,
|
||||
})))
|
||||
.expect(1)
|
||||
@@ -371,13 +371,13 @@ mod tests {
|
||||
.await;
|
||||
|
||||
let auth = request_device_authorization(&server.uri()).await.unwrap();
|
||||
assert_eq!(auth.user_code, "ABCD-1234");
|
||||
assert_eq!(auth.user_code, "WXYZ-6789");
|
||||
assert_eq!(auth.device_code, "dev-code-1");
|
||||
assert_eq!(auth.interval, 7);
|
||||
assert_eq!(auth.expires_in, Some(600));
|
||||
assert_eq!(auth.expires_in, Some(1800));
|
||||
assert_eq!(
|
||||
auth.verification_uri_complete,
|
||||
"https://auth.kimi.com/device?code=ABCD-1234"
|
||||
"https://www.kimi.com/code/authorize_device?user_code=WXYZ-6789"
|
||||
);
|
||||
}
|
||||
|
||||
@@ -392,7 +392,7 @@ mod tests {
|
||||
.respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
|
||||
"user_code": "AAAA",
|
||||
"device_code": "d",
|
||||
"verification_uri_complete": "https://auth.kimi.com/device?code=AAAA",
|
||||
"verification_uri_complete": "https://www.kimi.com/code/authorize_device?user_code=AAAA",
|
||||
"interval": 5,
|
||||
})))
|
||||
.expect(1)
|
||||
@@ -409,7 +409,7 @@ mod tests {
|
||||
.respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
|
||||
"user_code": "AAAA",
|
||||
"device_code": "d",
|
||||
"verification_uri_complete": "https://auth.kimi.com/device?code=AAAA",
|
||||
"verification_uri_complete": "https://www.kimi.com/code/authorize_device?user_code=AAAA",
|
||||
})))
|
||||
.mount(&server)
|
||||
.await;
|
||||
|
||||
@@ -1,17 +1,5 @@
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
||||
/// Access-gate copy resolved from remote settings (message + optional CTA).
|
||||
/// Auth no longer produces gates (tier gating was an xAI concept); the pager
|
||||
/// still renders one when remote settings carry a gate message.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct GateInfo {
|
||||
pub message: String,
|
||||
#[serde(default)]
|
||||
pub url: Option<String>,
|
||||
#[serde(default)]
|
||||
pub label: Option<String>,
|
||||
}
|
||||
|
||||
/// Typed auth metadata passed from the shell to the pager via ACP.
|
||||
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
|
||||
pub struct AuthMeta {
|
||||
|
||||
@@ -20,9 +20,10 @@ pub use flow::{
|
||||
run_auth_flow_with_stderr_bridge, run_cli_login, run_cli_logout, try_ensure_fresh_auth,
|
||||
};
|
||||
mod meta;
|
||||
pub use device::device_headers;
|
||||
pub use error::{AuthError, RefreshTokenError, RefreshTokenFailedReason};
|
||||
pub use manager::{AuthManager, shared_api_key_provider};
|
||||
pub use meta::{AuthMeta, GateInfo};
|
||||
pub use meta::AuthMeta;
|
||||
pub use model::{AuthMode, KimiAuth, lookup_auth};
|
||||
pub(crate) use model::{TOKEN_TTL, is_expired, token_suffix};
|
||||
pub use storage::{
|
||||
|
||||
Reference in New Issue
Block a user