Maciejdziuba · August 8, 2026 04:55
diff --git a/README.md b/README.md
diff --git a/CHEATSHEET.md b/CHEATSHEET.md
diff --git a/codex.toml b/codex.toml
 # Append to ~/.codex/config.toml, then run: codex --profile kimi
 [model_providers.kimi]
 name = "Kimi (subscription)"
 base_url = "https://api.kimi.com/coding/v1"
 env_key = "KIMI_API_KEY"
 wire_api = "chat"

 [profiles.kimi]
 model_provider = "kimi"
 model = "k3"
diff --git a/install.sh b/install.sh
 #!/usr/bin/env bash
 # One-line installer for kimi-on:
 #   curl -fsSL https://gist.githubusercontent.com/Maciejdziuba/038c0c822d2c799cffcfdec805975e66/raw/install.sh | bash
 set -euo pipefail

 RAW="https://gist.githubusercontent.com/Maciejdziuba/038c0c822d2c799cffcfdec805975e66/raw/kimi-on.sh"
 PROXY_RAW="https://gist.githubusercontent.com/Maciejdziuba/038c0c822d2c799cffcfdec805975e66/raw/kimi-oauth-proxy.mjs"
 DEST_DIR="${KIMI_ON_BIN:-$HOME/.local/bin}"

 mkdir -p "$DEST_DIR"
 curl -fsSL "$RAW" -o "$DEST_DIR/kimi-on"
 chmod +x "$DEST_DIR/kimi-on"
 curl -fsSL "$PROXY_RAW" -o "$DEST_DIR/kimi-oauth-proxy.mjs"

 echo "Installed kimi-on to $DEST_DIR/kimi-on (+ OAuth proxy)"

 case ":$PATH:" in
  *":$DEST_DIR:"*) ;;
  *)
    echo ""
    echo "NOTE: $DEST_DIR is not on your PATH. Add this to your shell profile:"
    echo "  export PATH=\"$DEST_DIR:\$PATH\""
    ;;
 esac

 echo ""
 echo "Next steps:"
 echo "  1. kimi-on setup          # paste your key from kimi.com/code/console"
 echo "  2. kimi-on claude         # Claude Code running on your Kimi subscription"
diff --git a/kimi-k3-harness-setup.md b/kimi-k3-harness-setup.md
diff --git a/kimi-oauth-proxy.mjs b/kimi-oauth-proxy.mjs
 #!/usr/bin/env node
 // kimi-oauth-proxy — run any harness on your Kimi subscription with NO API key.
 //
 // Reuses the OAuth session created by `kimi login` (Kimi Code CLI):
 //   ~/.kimi-code/credentials/kimi-code.json   access + refresh token
 //   ~/.kimi-code/device_id                    device identity header
 //
 // Serves http://127.0.0.1:8790 and forwards any /v1/* route to Kimi's
 // subscription gateway with a fresh OAuth bearer:
 //   /v1/chat/completions  OpenAI format  (Codex, OpenCode, Cline, Aider)
 //   /v1/messages          Anthropic format (Claude Code)
 //
 // Zero dependencies. Node 18+.
 import {
  chmodSync, closeSync, existsSync, fsyncSync, mkdirSync,
  openSync, readFileSync, renameSync, unlinkSync, writeFileSync,
 } from "node:fs";
 import http from "node:http";
 import os from "node:os";
 import path from "node:path";

 const VERSION = "1.0.0";
 // Public OAuth client id of the Kimi Code CLI (same one codex-router uses).
 const KIMI_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
 const KIMI_CODE_HOME = process.env.KIMI_CODE_HOME || path.join(os.homedir(), ".kimi-code");
 const API_BASE = (process.env.KIMI_CODING_BASE || "https://api.kimi.com/coding/v1").replace(/\/+$/, "");
 const OAUTH_HOST = (process.env.KIMI_OAUTH_HOST || "https://auth.kimi.com").replace(/\/+$/, "");
 const LISTEN_HOST = "127.0.0.1";
 const LISTEN_PORT = Number(process.env.KIMI_OAUTH_PROXY_PORT || 8790);
 const QUIET = process.env.KIMI_OAUTH_PROXY_QUIET === "1";

 const CREDENTIALS_PATH = path.join(KIMI_CODE_HOME, "credentials", "kimi-code.json");
 const DEVICE_ID_PATH = path.join(KIMI_CODE_HOME, "device_id");

 const HOP_BY_HOP = new Set([
  "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
  "te", "trailer", "transfer-encoding", "upgrade", "host", "content-length",
 ]);

 let refreshInFlight;

 function log(message) {
  if (!QUIET) console.error(`[kimi-oauth-proxy] ${message}`);
 }

 function asciiHeader(value, fallback = "unknown") {
  const cleaned = String(value).replace(/[^ -~]/g, "").trim();
  return cleaned || fallback;
 }

 function readDeviceId() {
  const value = readFileSync(DEVICE_ID_PATH, "utf8").trim();
  if (!value) throw new Error("Kimi device id missing; run `kimi login` first.");
  return value;
 }

 // Same identity header shape the Kimi Code CLI ecosystem sends; the gateway
 // expects a device identity alongside the bearer.
 function identityHeaders() {
  return {
    "User-Agent": `kimi-oauth-proxy/${VERSION}`,
    "X-Msh-Platform": "codex",
    "X-Msh-Version": VERSION,
    "X-Msh-Device-Name": asciiHeader(os.hostname()),
    "X-Msh-Device-Model": asciiHeader(`${os.type()} ${os.release()} ${os.arch()}`),
    "X-Msh-Os-Version": asciiHeader(os.release()),
    "X-Msh-Device-Id": asciiHeader(readDeviceId()),
  };
 }

 function readToken() {
  if (!existsSync(CREDENTIALS_PATH)) {
    throw new Error("Kimi OAuth credentials not found; run `kimi login` first.");
  }
  const value = JSON.parse(readFileSync(CREDENTIALS_PATH, "utf8"));
  if (!value?.access_token || !value?.refresh_token) {
    throw new Error("Kimi OAuth credentials incomplete; run `kimi login` again.");
  }
  return {
    access_token: value.access_token,
    refresh_token: value.refresh_token,
    expires_at: Number(value.expires_at) || 0,
    expires_in: Number(value.expires_in) || 0,
    scope: value.scope || "kimi-code",
    token_type: value.token_type || "Bearer",
  };
 }

 function shouldRefresh(token) {
  const threshold = Math.max(300, token.expires_in > 0 ? token.expires_in * 0.5 : 0);
  return Math.floor(Date.now() / 1000) >= token.expires_at - threshold;
 }

 function atomicSaveToken(token) {
  const dir = path.dirname(CREDENTIALS_PATH);
  mkdirSync(dir, { recursive: true, mode: 0o700 });
  const tmp = `${CREDENTIALS_PATH}.tmp.${process.pid}`;
  const fd = openSync(tmp, "w", 0o600);
  try {
    writeFileSync(fd, `${JSON.stringify(token, null, 2)}\n`, "utf8");
    fsyncSync(fd);
  } finally {
    closeSync(fd);
  }
  try {
    chmodSync(tmp, 0o600);
    renameSync(tmp, CREDENTIALS_PATH);
    chmodSync(CREDENTIALS_PATH, 0o600);
  } catch (error) {
    try { unlinkSync(tmp); } catch {}
    throw error;
  }
 }

 const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

 async function requestRefresh(refreshTokenValue) {
  const retryable = new Set([429, 500, 502, 503, 504]);
  let lastError;
  for (let attempt = 0; attempt < 3; attempt += 1) {
    try {
      const response = await fetch(`${OAUTH_HOST}/api/oauth/token`, {
        method: "POST",
        headers: {
          ...identityHeaders(),
          Accept: "application/json",
          "Content-Type": "application/x-www-form-urlencoded",
        },
        body: new URLSearchParams({
          client_id: KIMI_CLIENT_ID,
          grant_type: "refresh_token",
          refresh_token: refreshTokenValue,
        }),
        signal: AbortSignal.timeout(30_000),
      });
      const payload = await response.json().catch(() => ({}));
      if (response.ok) {
        const expiresIn = Number(payload.expires_in);
        if (!payload.access_token || !payload.refresh_token || !(expiresIn > 0)) {
          throw new Error("OAuth refresh returned an incomplete response.");
        }
        return {
          access_token: payload.access_token,
          refresh_token: payload.refresh_token,
          expires_at: Math.floor(Date.now() / 1000) + expiresIn,
          expires_in: expiresIn,
          scope: payload.scope || "kimi-code",
          token_type: payload.token_type || "Bearer",
        };
      }
      if (response.status === 401 || response.status === 403 || payload.error === "invalid_grant") {
        const error = new Error("OAuth refresh rejected; run `kimi login` again.");
        error.code = "oauth_unauthorized";
        throw error;
      }
      if (!retryable.has(response.status)) {
        throw new Error(`OAuth refresh failed with HTTP ${response.status}.`);
      }
      lastError = new Error(`Temporary OAuth error: HTTP ${response.status}.`);
    } catch (error) {
      if (error?.code === "oauth_unauthorized") throw error;
      lastError = error instanceof Error ? error : new Error(String(error));
    }
    if (attempt < 2) await wait(2 ** attempt * 1000);
  }
  throw lastError || new Error("OAuth refresh failed.");
 }

 // Single-flight refresh: concurrent requests share one refresh; the token
 // file is re-read after acquiring the slot in case another process refreshed.
 async function ensureFreshToken({ force = false } = {}) {
  if (refreshInFlight) return refreshInFlight;
  refreshInFlight = (async () => {
    const current = readToken();
    if (!force && !shouldRefresh(current)) return current.access_token;
    const refreshed = await requestRefresh(current.refresh_token);
    atomicSaveToken(refreshed);
    log("OAuth token refreshed");
    return refreshed.access_token;
  })().finally(() => { refreshInFlight = undefined; });
  return refreshInFlight;
 }

 // Kimi routes non-thinking traffic to older models; keep thinking on and map
 // OpenAI-style effort levels onto Kimi's low/high/max. Chat Completions only —
 // Anthropic-format bodies pass through untouched.
 function normalizeChatBody(buffer, contentType) {
  if (!buffer.length || !String(contentType || "").includes("application/json")) return buffer;
  let payload;
  try { payload = JSON.parse(buffer.toString("utf8")); } catch { return buffer; }
  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return buffer;
  payload.thinking = { type: "enabled" };
  const effort = {
    minimal: "low", low: "low", medium: "high",
    high: "high", xhigh: "max", max: "max", ultra: "max",
  }[payload.reasoning_effort];
  if (effort) payload.reasoning_effort = effort;
  else delete payload.reasoning_effort;
  return Buffer.from(JSON.stringify(payload), "utf8");
 }

 function upstreamHeaders(requestHeaders, body) {
  const headers = {};
  for (const [name, value] of Object.entries(requestHeaders)) {
    const lower = name.toLowerCase();
    if (HOP_BY_HOP.has(lower) || lower === "authorization") continue;
    if (lower.startsWith("x-msh-") || lower.startsWith("x-codex-")) continue;
    if (lower.startsWith("x-openai-") || lower === "chatgpt-account-id") continue;
    if (lower === "x-api-key" || lower === "originator") continue;
    if (lower === "user-agent" || lower === "accept-encoding") continue;
    if (value !== undefined) headers[name] = Array.isArray(value) ? value.join(", ") : value;
  }
  Object.assign(headers, identityHeaders());
  headers["Accept-Encoding"] = "identity";
  if (body.length) headers["Content-Length"] = String(body.length);
  return headers;
 }

 function readBody(request) {
  return new Promise((resolve, reject) => {
    const chunks = [];
    request.on("data", (chunk) => chunks.push(chunk));
    request.on("end", () => resolve(Buffer.concat(chunks)));
    request.on("error", reject);
  });
 }

 function writeJson(response, status, value) {
  const body = JSON.stringify(value);
  response.writeHead(status, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
  response.end(body);
 }

 async function pipeResponse(upstream, response) {
  const headers = {};
  upstream.headers.forEach((value, name) => {
    if (!HOP_BY_HOP.has(name.toLowerCase())) headers[name] = value;
  });
  response.writeHead(upstream.status, headers);
  if (!upstream.body) { response.end(); return; }
  for await (const chunk of upstream.body) {
    if (!response.write(chunk)) {
      await new Promise((resolve) => response.once("drain", resolve));
    }
  }
  response.end();
 }

 function tokenHealth() {
  try {
    const token = readToken();
    return {
      credential_present: true,
      scope: token.scope,
      expires_in_seconds: Math.max(0, token.expires_at - Math.floor(Date.now() / 1000)),
    };
  } catch (error) {
    return { credential_present: false, error: String(error?.message || error) };
  }
 }

 async function requestUpstream(request, target, body, token, signal) {
  return fetch(target, {
    method: request.method,
    headers: { ...upstreamHeaders(request.headers, body), Authorization: `Bearer ${token}` },
    body: body.length ? body : undefined,
    signal,
  });
 }

 async function handle(request, response) {
  const startedAt = Date.now();
  const url = new URL(request.url || "/", `http://${request.headers.host || LISTEN_HOST}`);

  if (request.method === "GET" && url.pathname === "/health") {
    writeJson(response, 200, { ok: true, version: VERSION, ...tokenHealth() });
    return;
  }
  if (!url.pathname.startsWith("/v1/") || !["GET", "POST"].includes(request.method)) {
    writeJson(response, 404, { error: { type: "route_not_found", message: "Only /v1/* is proxied." } });
    return;
  }

  const controller = new AbortController();
  request.once("aborted", () => controller.abort());
  response.once("close", () => { if (!response.writableEnded) controller.abort(); });

  let body = await readBody(request);
  const route = url.pathname.slice("/v1".length);
  if (route === "/chat/completions") {
    body = normalizeChatBody(body, request.headers["content-type"]);
  }
  const target = `${API_BASE}${route}${url.search}`;

  let token = await ensureFreshToken();
  let upstream = await requestUpstream(request, target, body, token, controller.signal);
  if (upstream.status === 401) {
    await upstream.arrayBuffer();
    token = await ensureFreshToken({ force: true });
    upstream = await requestUpstream(request, target, body, token, controller.signal);
  }
  await pipeResponse(upstream, response);
  log(`${request.method} ${route} -> ${upstream.status} ${Date.now() - startedAt}ms`);
 }

 const server = http.createServer((request, response) => {
  handle(request, response).catch((error) => {
    log(`request failed: ${error?.message || error}`);
    if (!response.headersSent) {
      writeJson(response, 502, {
        error: { type: "kimi_oauth_proxy_error", message: String(error?.message || error) },
      });
    } else if (!response.writableEnded) {
      response.destroy(error instanceof Error ? error : undefined);
    }
  });
 });

 server.listen(LISTEN_PORT, LISTEN_HOST, () => {
  log(`listening on http://${LISTEN_HOST}:${LISTEN_PORT} -> ${API_BASE}`);
 });

 for (const signal of ["SIGINT", "SIGTERM"]) {
  process.on(signal, () => server.close(() => process.exit(0)));
 }
diff --git a/kimi-on.sh b/kimi-on.sh
 #!/usr/bin/env bash
 # kimi-on — run any coding harness on your flat-fee Kimi subscription.
 #
 # One Kimi Code API key speaks two protocols:
 #   Anthropic-compatible : https://api.kimi.com/coding/
 #   OpenAI-compatible    : https://api.kimi.com/coding/v1
 #
 # Known tools get a tailored launch; any other command is run with BOTH
 # protocol env vars injected, so it works with anything that accepts a
 # custom Anthropic or OpenAI endpoint.
 set -euo pipefail

 CONF="${KIMI_EVERYWHERE_ENV:-$HOME/.kimi-everywhere/env}"
 ANTHROPIC_EP="https://api.kimi.com/coding/"
 OPENAI_EP="https://api.kimi.com/coding/v1"
 DEFAULT_MODEL="${KIMI_MODEL:-k3}"

 usage() {
  cat <<'EOF'
 kimi-on — power any coding harness with one Kimi subscription

 Usage:
  kimi-on setup                store your Kimi Code API key (one time)
  kimi-on claude [args...]     Claude Code on Kimi (Anthropic endpoint)
  kimi-on claude --init        also skip Anthropic onboarding (first run)
  kimi-on claude-app on|off    Claude Code DESKTOP APP on Kimi (persistent settings)
  kimi-on codex [args...]      Codex CLI on Kimi (adds a 'kimi' profile)
  kimi-on codex-app on|off     Codex DESKTOP APP on Kimi (macOS, launchctl env)
  kimi-on opencode [args...]   OpenCode on Kimi (project opencode.json)
  kimi-on aider [args...]      Aider on Kimi (OpenAI-compatible)
  kimi-on env anthropic        print export lines for Anthropic-style tools
  kimi-on env openai           print export lines for OpenAI-style tools
  kimi-on <any-command>        run any tool with both protocols injected

 OAuth mode (no API key — reuses your `kimi login` session):
  kimi-on oauth start          run the local OAuth proxy (127.0.0.1:8790)
  kimi-on oauth stop|status    manage / inspect the proxy
  kimi-on claude --oauth       Claude Code through the OAuth proxy

 Model selection (default k3):
  KIMI_MODEL=kimi-for-coding kimi-on claude     # K2.7 Code
  KIMI_MODEL="k3[1m]" kimi-on claude            # 1M context (Allegretto+)
 EOF
 }

 load_key() {
  # shellcheck disable=SC1090
  [ -f "$CONF" ] && . "$CONF"
  if [ -z "${KIMI_API_KEY:-}" ]; then
    echo "No Kimi Code API key found." >&2
    echo "Create one at https://www.kimi.com/code/console (requires a Kimi subscription)." >&2
    printf 'Paste your Kimi Code API key: ' >&2
    read -r -s KIMI_API_KEY
    echo >&2
    [ -n "$KIMI_API_KEY" ] || { echo "No key entered, aborting." >&2; exit 1; }
    mkdir -p "$(dirname "$CONF")"
    printf 'KIMI_API_KEY=%s\n' "$KIMI_API_KEY" > "$CONF"
    chmod 600 "$CONF"
    echo "Saved to $CONF" >&2
  fi
  export KIMI_API_KEY
 }

 # Claude Code reads a bracketed [1m] suffix; context limit must match the model.
 context_for_model() {
  case "$1" in
    *"[1m]"*) echo 1048576 ;;
    *)        echo 262144 ;;
  esac
 }

 claude_init() {
  # Official Moonshot onboarding-skip: marks onboarding complete so Claude
  # Code doesn't force an Anthropic login before honoring ANTHROPIC_BASE_URL.
  node --eval "
 const fs = require('fs'); const os = require('os'); const path = require('path');
 const p = path.join(os.homedir(), '.claude.json');
 const cur = fs.existsSync(p) ? JSON.parse(fs.readFileSync(p, 'utf-8')) : {};
 fs.writeFileSync(p, JSON.stringify({ ...cur, hasCompletedOnboarding: true }, null, 2), 'utf-8');
 console.log('Claude Code onboarding marked complete.');
 "
 }

 # ── OAuth proxy (no API key; reuses the `kimi login` session) ──────────────
 PROXY_PORT="${KIMI_OAUTH_PROXY_PORT:-8790}"
 PROXY_URL="http://127.0.0.1:$PROXY_PORT"
 PROXY_RAW_URL="https://gist.githubusercontent.com/Maciejdziuba/038c0c822d2c799cffcfdec805975e66/raw/kimi-oauth-proxy.mjs"

 proxy_paths() {
  PROXY_DIR="$(dirname "$CONF")"
  PROXY_PID_FILE="$PROXY_DIR/oauth-proxy.pid"
  PROXY_LOG="$PROXY_DIR/oauth-proxy.log"
 }

 # The proxy script ships next to kimi-on in the gist; self-download if absent.
 proxy_script() {
  proxy_paths
  local here script
  here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
  for script in "$here/kimi-oauth-proxy.mjs" "$PROXY_DIR/kimi-oauth-proxy.mjs"; do
    [ -f "$script" ] && { echo "$script"; return; }
  done
  mkdir -p "$PROXY_DIR"
  curl -fsSL "$PROXY_RAW_URL" -o "$PROXY_DIR/kimi-oauth-proxy.mjs"
  echo "$PROXY_DIR/kimi-oauth-proxy.mjs"
 }

 proxy_healthy() {
  curl -s -m 2 "$PROXY_URL/health" 2>/dev/null | grep -q '"ok":true'
 }

 oauth_creds_check() {
  local kimi_home="${KIMI_CODE_HOME:-$HOME/.kimi-code}"
  if [ ! -f "$kimi_home/credentials/kimi-code.json" ]; then
    echo "No Kimi OAuth session found ($kimi_home/credentials/kimi-code.json)." >&2
    echo "Install the Kimi Code CLI and run: kimi login" >&2
    exit 1
  fi
 }

 oauth_start() {
  command -v node >/dev/null 2>&1 || { echo "node is required for OAuth mode." >&2; exit 1; }
  oauth_creds_check
  proxy_paths
  if proxy_healthy; then echo "OAuth proxy already running at $PROXY_URL"; return; fi
  local script
  script="$(proxy_script)"
  mkdir -p "$PROXY_DIR"
  nohup node "$script" >> "$PROXY_LOG" 2>&1 &
  echo $! > "$PROXY_PID_FILE"
  local tries=0
  until proxy_healthy; do
    tries=$((tries + 1))
    [ "$tries" -gt 20 ] && { echo "Proxy failed to start; see $PROXY_LOG" >&2; exit 1; }
    sleep 0.3
  done
  echo "OAuth proxy running at $PROXY_URL (log: $PROXY_LOG)"
 }

 oauth_stop() {
  proxy_paths
  if [ -f "$PROXY_PID_FILE" ]; then
    kill "$(cat "$PROXY_PID_FILE")" 2>/dev/null || true
    rm -f "$PROXY_PID_FILE"
    echo "OAuth proxy stopped."
  else
    echo "No proxy pid file; nothing to stop."
  fi
 }

 oauth_status() {
  if proxy_healthy; then
    curl -s -m 2 "$PROXY_URL/health"
    echo
  else
    echo "OAuth proxy is not running. Start it with: kimi-on oauth start"
  fi
 }

 # Claude Code pointed at the local proxy; auth is injected by the proxy, the
 # dummy token only satisfies Claude Code's "some auth must be set" check.
 run_claude_oauth() {
  local model="$DEFAULT_MODEL" ctx
  ctx="$(context_for_model "$model")"
  proxy_healthy || oauth_start
  ANTHROPIC_BASE_URL="$PROXY_URL" \
  ANTHROPIC_AUTH_TOKEN="kimi-oauth-proxy" \
  ANTHROPIC_MODEL="$model" \
  ANTHROPIC_DEFAULT_OPUS_MODEL="$model" \
  ANTHROPIC_DEFAULT_SONNET_MODEL="$model" \
  ANTHROPIC_DEFAULT_HAIKU_MODEL="$model" \
  CLAUDE_CODE_SUBAGENT_MODEL="$model" \
  CLAUDE_CODE_EFFORT_LEVEL="${KIMI_EFFORT:-high}" \
  CLAUDE_CODE_AUTO_COMPACT_WINDOW="$ctx" \
  CLAUDE_CODE_MAX_CONTEXT_TOKENS="$ctx" \
  claude "$@"
 }

 run_claude() {
  local model="$DEFAULT_MODEL" ctx
  ctx="$(context_for_model "$model")"
  ANTHROPIC_BASE_URL="$ANTHROPIC_EP" \
  ANTHROPIC_API_KEY="$KIMI_API_KEY" \
  ANTHROPIC_MODEL="$model" \
  ANTHROPIC_DEFAULT_OPUS_MODEL="$model" \
  ANTHROPIC_DEFAULT_SONNET_MODEL="$model" \
  ANTHROPIC_DEFAULT_HAIKU_MODEL="$model" \
  CLAUDE_CODE_SUBAGENT_MODEL="$model" \
  CLAUDE_CODE_EFFORT_LEVEL="${KIMI_EFFORT:-high}" \
  CLAUDE_CODE_AUTO_COMPACT_WINDOW="$ctx" \
  CLAUDE_CODE_MAX_CONTEXT_TOKENS="$ctx" \
  claude "$@"
 }

 # Env keys claude-app on writes into ~/.claude/settings.json (env object).
 # Kept as one list so `off` deletes exactly what `on` added.
 CLAUDE_APP_ENV_KEYS="ANTHROPIC_BASE_URL ANTHROPIC_API_KEY ANTHROPIC_MODEL ANTHROPIC_DEFAULT_OPUS_MODEL ANTHROPIC_DEFAULT_SONNET_MODEL ANTHROPIC_DEFAULT_HAIKU_MODEL CLAUDE_CODE_SUBAGENT_MODEL CLAUDE_CODE_EFFORT_LEVEL CLAUDE_CODE_AUTO_COMPACT_WINDOW CLAUDE_CODE_MAX_CONTEXT_TOKENS"

 # GUI apps don't inherit shell env, so the desktop app route writes a
 # persistent env block into ~/.claude/settings.json instead. Values are
 # passed to node via env vars — never embedded in the script text.
 claude_app_on() {
  load_key
  local settings="$HOME/.claude/settings.json"
  local backup="$(dirname "$CONF")/claude-settings.backup.json"
  local model="$DEFAULT_MODEL" ctx
  ctx="$(context_for_model "$model")"
  mkdir -p "$HOME/.claude"
  # One-time safety net; never overwrite an existing backup.
  if [ -f "$settings" ] && [ ! -f "$backup" ]; then
    mkdir -p "$(dirname "$backup")"
    cp "$settings" "$backup"
    echo "Backed up existing settings to $backup"
  fi
  KIMI_SETTINGS_PATH="$settings" \
  KIMI_EP="$ANTHROPIC_EP" \
  KIMI_KEY="$KIMI_API_KEY" \
  KIMI_MDL="$model" \
  KIMI_EFFORT_LVL="${KIMI_EFFORT:-high}" \
  KIMI_CTX="$ctx" \
  node --eval '
 const fs = require("fs");
 const p = process.env.KIMI_SETTINGS_PATH;
 let cur = {};
 if (fs.existsSync(p)) {
  const raw = fs.readFileSync(p, "utf-8").trim();
  if (raw) cur = JSON.parse(raw); // throws on malformed JSON -> non-zero, no write
 }
 const m = process.env.KIMI_MDL, ctx = process.env.KIMI_CTX;
 const env = { ...(cur.env || {}) };
 env.ANTHROPIC_BASE_URL = process.env.KIMI_EP;
 env.ANTHROPIC_API_KEY = process.env.KIMI_KEY;
 env.ANTHROPIC_MODEL = m;
 env.ANTHROPIC_DEFAULT_OPUS_MODEL = m;
 env.ANTHROPIC_DEFAULT_SONNET_MODEL = m;
 env.ANTHROPIC_DEFAULT_HAIKU_MODEL = m;
 env.CLAUDE_CODE_SUBAGENT_MODEL = m;
 env.CLAUDE_CODE_EFFORT_LEVEL = process.env.KIMI_EFFORT_LVL;
 env.CLAUDE_CODE_AUTO_COMPACT_WINDOW = ctx;
 env.CLAUDE_CODE_MAX_CONTEXT_TOKENS = ctx;
 cur.env = env;
 fs.writeFileSync(p, JSON.stringify(cur, null, 2) + "\n", "utf-8");
 '
  KIMI_SETTINGS_PATH="$HOME/.claude.json" \
  node --eval '
 const fs = require("fs");
 const p = process.env.KIMI_SETTINGS_PATH;
 let cur = {};
 if (fs.existsSync(p)) {
  const raw = fs.readFileSync(p, "utf-8").trim();
  if (raw) cur = JSON.parse(raw);
 }
 cur.hasCompletedOnboarding = true;
 fs.writeFileSync(p, JSON.stringify(cur, null, 2) + "\n", "utf-8");
 '
  cat <<EOF
 Claude Code desktop app: ON (model $model, context $ctx)
  wrote env block in $settings
  set hasCompletedOnboarding in $HOME/.claude.json
 This affects EVERY Claude Code session (app, CLI, IDE) until you run:
  kimi-on claude-app off
 Restart the Claude Code app fully to apply.
 EOF
 }

 claude_app_off() {
  local settings="$HOME/.claude/settings.json"
  local backup="$(dirname "$CONF")/claude-settings.backup.json"
  if [ ! -f "$settings" ]; then
    echo "No $settings found — nothing to remove."
    return
  fi
  KIMI_SETTINGS_PATH="$settings" KIMI_KEYS="$CLAUDE_APP_ENV_KEYS" \
  node --eval '
 const fs = require("fs");
 const p = process.env.KIMI_SETTINGS_PATH;
 const raw = fs.readFileSync(p, "utf-8").trim();
 const cur = raw ? JSON.parse(raw) : {}; // throws on malformed JSON -> non-zero, no write
 const env = { ...(cur.env || {}) };
 for (const k of process.env.KIMI_KEYS.split(" ")) delete env[k];
 cur.env = env;
 fs.writeFileSync(p, JSON.stringify(cur, null, 2) + "\n", "utf-8");
 '
  cat <<EOF
 Claude Code desktop app: OFF
  removed the kimi-on env keys from $settings (your other env keys kept)
  one-time backup kept at $backup (manual restore if ever needed)
 Restart the Claude Code app fully to apply.
 EOF
 }

 ensure_codex_profile() {
  local conf="$HOME/.codex/config.toml"
  mkdir -p "$HOME/.codex"
  touch "$conf"
  if ! grep -q 'model_providers.kimi' "$conf"; then
    cat >> "$conf" <<EOF

 # --- added by kimi-on (kimi-everywhere) ---
 [model_providers.kimi]
 name = "Kimi (subscription)"
 base_url = "$OPENAI_EP"
 env_key = "KIMI_API_KEY"
 wire_api = "chat"

 [profiles.kimi]
 model_provider = "kimi"
 model = "k3"
 # --- end kimi-on ---
 EOF
    echo "Added 'kimi' provider + profile to $conf" >&2
  fi
 }

 # The Codex desktop app shares ~/.codex/config.toml with the CLI, but as a
 # GUI app it can't see shell env vars — launchctl setenv puts KIMI_API_KEY
 # into the user session so the app's env_key lookup resolves (until logout).
 codex_app_on() {
  load_key
  ensure_codex_profile
  if [ "$(uname)" = "Darwin" ]; then
    launchctl setenv KIMI_API_KEY "$KIMI_API_KEY"
    echo "Set KIMI_API_KEY for GUI apps via launchctl (clears at logout)."
  else
    echo "Note: the Codex desktop app path is macOS-only for now."
    echo "The CLI (kimi-on codex) is unaffected."
  fi
  cat <<'EOF'
 Codex desktop app: ON
 Next steps:
  1. Fully quit the Codex app (Cmd+Q, not just close the window).
  2. Reopen it.
  3. Open the model picker / settings and select the custom "kimi"
     provider/profile if offered (it may appear as a "Custom" entry).
 Notes:
  - launchctl setenv clears at logout — rerun `kimi-on codex-app on` after a reboot.
  - This is the simple key-based route. For a native model picker + Kimi
    OAuth instead, see https://github.com/duolahypercho/codex-router
 EOF
 }

 codex_app_off() {
  if [ "$(uname)" = "Darwin" ]; then
    launchctl unsetenv KIMI_API_KEY
    echo "Removed KIMI_API_KEY from the GUI session (launchctl unsetenv)."
  fi
  cat <<'EOF'
 Codex desktop app: OFF
 The 'kimi' provider + profile block stays in ~/.codex/config.toml — harmless,
 the CLI still uses it. To remove it manually, delete the lines between
  # --- added by kimi-on (kimi-everywhere) ---
  # --- end kimi-on ---
 Restart the Codex app to apply.
 EOF
 }

 ensure_opencode_config() {
  [ -f opencode.json ] && return
  cat > opencode.json <<EOF
 {
  "\$schema": "https://opencode.ai/config.json",
  "provider": {
    "kimi": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Kimi (subscription)",
      "options": {
        "baseURL": "$OPENAI_EP",
        "apiKey": "{env:KIMI_API_KEY}"
      },
      "models": {
        "k3": { "name": "Kimi K3" },
        "kimi-for-coding": { "name": "Kimi K2.7 Code" }
      }
    }
  },
  "model": "kimi/k3"
 }
 EOF
  echo "Wrote project opencode.json (Kimi provider, model kimi/k3)" >&2
 }

 print_env() {
  case "${1:-}" in
    anthropic)
      echo "export ANTHROPIC_BASE_URL=$ANTHROPIC_EP"
      echo "export ANTHROPIC_API_KEY=$KIMI_API_KEY"
      echo "export ANTHROPIC_MODEL=$DEFAULT_MODEL"
      ;;
    openai)
      echo "export OPENAI_BASE_URL=$OPENAI_EP"
      echo "export OPENAI_API_BASE=$OPENAI_EP"
      echo "export OPENAI_API_KEY=$KIMI_API_KEY"
      ;;
    *)
      echo "Usage: kimi-on env anthropic|openai" >&2
      exit 1
      ;;
  esac
 }

 cmd="${1:-}"
 [ -n "$cmd" ] || { usage; exit 0; }
 shift || true

 case "$cmd" in
  -h|--help|help) usage ;;
  setup) load_key; echo "Key ready. Try: kimi-on claude" ;;
  claude)
    if [ "${1:-}" = "--oauth" ]; then
      shift
      run_claude_oauth "$@"
      exit 0
    fi
    load_key
    if [ "${1:-}" = "--init" ]; then shift; claude_init; fi
    run_claude "$@"
    ;;
  oauth)
    case "${1:-}" in
      start)  oauth_start ;;
      stop)   oauth_stop ;;
      status) oauth_status ;;
      *)      echo "Usage: kimi-on oauth start|stop|status" >&2; exit 1 ;;
    esac
    ;;
  claude-app)
    case "${1:-}" in
      on)  claude_app_on ;;
      off) claude_app_off ;;
      *)   echo "Usage: kimi-on claude-app on|off" >&2; exit 1 ;;
    esac
    ;;
  codex)
    load_key
    ensure_codex_profile
    codex --profile kimi "$@"
    ;;
  codex-app)
    case "${1:-}" in
      on)  codex_app_on ;;
      off) codex_app_off ;;
      *)   echo "Usage: kimi-on codex-app on|off" >&2; exit 1 ;;
    esac
    ;;
  opencode)
    load_key
    ensure_opencode_config
    opencode "$@"
    ;;
  aider)
    load_key
    OPENAI_API_BASE="$OPENAI_EP" OPENAI_API_KEY="$KIMI_API_KEY" \
      aider --model "openai/$DEFAULT_MODEL" "$@"
    ;;
  env)
    load_key
    print_env "${1:-}"
    ;;
  *)
    # Universal fallback: inject both protocols and run the command as-is.
    load_key
    command -v "$cmd" >/dev/null 2>&1 || { echo "Unknown command: $cmd" >&2; usage; exit 1; }
    ANTHROPIC_BASE_URL="$ANTHROPIC_EP" \
    ANTHROPIC_API_KEY="$KIMI_API_KEY" \
    ANTHROPIC_MODEL="$DEFAULT_MODEL" \
    OPENAI_BASE_URL="$OPENAI_EP" \
    OPENAI_API_BASE="$OPENAI_EP" \
    OPENAI_API_KEY="$KIMI_API_KEY" \
    "$cmd" "$@"
    ;;
 esac
diff --git a/kimi-router-SKILL.md b/kimi-router-SKILL.md
diff --git a/opencode.json b/opencode.json
 {
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "kimi": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Kimi (subscription)",
      "options": {
        "baseURL": "https://api.kimi.com/coding/v1",
        "apiKey": "{env:KIMI_API_KEY}"
      },
      "models": {
        "k3": { "name": "Kimi K3" },
        "kimi-for-coding": { "name": "Kimi K2.7 Code" }
      }
    }
  },
  "model": "kimi/k3"
 }
Protocol	Endpoint	Works with
Anthropic-compatible	`https://api.kimi.com/coding/`	Claude Code + anything expecting `ANTHROPIC_BASE_URL`
OpenAI-compatible	`https://api.kimi.com/coding/v1`	Codex CLI, OpenCode, Cline, Roo Code, Aider + anything expecting an OpenAI base URL
What	Value
Anthropic-compatible base URL	`https://api.kimi.com/coding/`
OpenAI-compatible base URL	`https://api.kimi.com/coding/v1`
API key	Create in the Kimi Code Console (subscription required)
Plan	Models	Context
Andante	`kimi-for-coding`	256K
Moderato ($19/mo)	`k3`, `kimi-for-coding`	256K
Allegretto+ ($39/mo+)	`k3`, `kimi-for-coding`, `kimi-for-coding-highspeed`	1M for K3, 256K for K2.7 Code
Field	Value
Base URL	`https://api.kimi.com/coding/v1`
API Key	your Kimi Code key
Model ID	`k3` (or `kimi-for-coding`)
Route	Speaks	For
`http://127.0.0.1:8790/v1/chat/completions`	OpenAI format	Codex, OpenCode, Cline, Aider
`http://127.0.0.1:8790/v1/messages`	Anthropic format	Claude Code
	# Append to ~/.codex/config.toml, then run: codex --profile kimi
	[model_providers.kimi]
	name = "Kimi (subscription)"
	base_url = "https://api.kimi.com/coding/v1"
	env_key = "KIMI_API_KEY"
	wire_api = "chat"

	[profiles.kimi]
	model_provider = "kimi"
	model = "k3"
	#!/usr/bin/env bash
	# One-line installer for kimi-on:
	# curl -fsSL https://gist.githubusercontent.com/Maciejdziuba/038c0c822d2c799cffcfdec805975e66/raw/install.sh \| bash
	set -euo pipefail

	RAW="https://gist.githubusercontent.com/Maciejdziuba/038c0c822d2c799cffcfdec805975e66/raw/kimi-on.sh"
	PROXY_RAW="https://gist.githubusercontent.com/Maciejdziuba/038c0c822d2c799cffcfdec805975e66/raw/kimi-oauth-proxy.mjs"
	DEST_DIR="${KIMI_ON_BIN:-$HOME/.local/bin}"

	mkdir -p "$DEST_DIR"
	curl -fsSL "$RAW" -o "$DEST_DIR/kimi-on"
	chmod +x "$DEST_DIR/kimi-on"
	curl -fsSL "$PROXY_RAW" -o "$DEST_DIR/kimi-oauth-proxy.mjs"

	echo "Installed kimi-on to $DEST_DIR/kimi-on (+ OAuth proxy)"

	case ":$PATH:" in
	":$DEST_DIR:") ;;
	*)
	echo ""
	echo "NOTE: $DEST_DIR is not on your PATH. Add this to your shell profile:"
	echo " export PATH=\"$DEST_DIR:\$PATH\""
	;;
	esac

	echo ""
	echo "Next steps:"
	echo " 1. kimi-on setup # paste your key from kimi.com/code/console"
	echo " 2. kimi-on claude # Claude Code running on your Kimi subscription"
Fact	Value
Key source	https://www.kimi.com/code/console (separate from platform keys)
Base URL	`https://api.kimi.com/coding/` (Anthropic-compatible; also serves the `kimi-coding` providers in Hermes/Pi)
Model IDs	`k3` (256K), `k3[1m]` (1M, Claude Code env vars only — everywhere else use `k3`), `kimi-for-coding` (K2.7 Code, 256K), `kimi-for-coding-highspeed`
Plan gating	Starter/legacy-Andante/Moderato tiers: `k3` at 256K only. Explorer/Expert/Master (and legacy Allegretto+): `k3` at 1M + highspeed
Thinking effort	K3 supports `low`/`high`/`max`; Claude Code `CLAUDE_CODE_EFFORT_LEVEL=high` recommended; disabling thinking silently routes to K2.6
Fact	Value
Credential	An OAuth session created by `kimi login` (official Kimi Code CLI, `kimi-code`) — device-code flow: the CLI prints a URL + code, the user confirms in a browser. No key material passes through you.
Session owner	The Kimi Code CLI stores and refreshes the session itself (`~/.kimi-code/`). Never read, print, or copy its credential files — bridges reuse the session, they don't extract it.
Bridge for Codex	`duolahypercho/codex-router` — purpose-built router that puts `kimi-oauth/k3` in the Codex model picker (App + CLI) next to native GPT models, preserving the ChatGPT login. Ships an agent runbook (`AGENTS.md`) and a non-interactive installer: `./install.sh --auto --providers kimi-oauth --migrate-known`. Listens on 127.0.0.1 ports 4100–4103.
Bridge (alternative)	`lidge-jun/opencodex` (npm `@bitkyc08/opencodex`, proxy on `localhost:10100`) — universal provider proxy for Codex and Claude Code with Kimi OAuth support. Its `ocx init` setup is interactive, so under this runbook use it only if codex-router fails and configure `~/.opencodex/config.json` directly per its docs.
Plan gating	Same subscription tiers as Route S (§1.3 tier heuristic applies).
Fact	Value
Key source	https://platform.kimi.ai/console/api-keys
Model ID	`kimi-k3`
OpenAI-compatible endpoint	`https://api.moonshot.ai/v1`
Anthropic-compatible endpoint	`https://api.moonshot.ai/anthropic`
China endpoints	`https://api.moonshot.cn/v1`, `https://api.moonshot.cn/anthropic`
Thinking effort	`reasoning_effort` supports only `max`