Improve China Kimi/GLM routes: Coding Plan 5h, Kimi Monthly, clearer labels#2351
Improve China Kimi/GLM routes: Coding Plan 5h, Kimi Monthly, clearer labels#2351Leehow wants to merge 4 commits into
Conversation
Rename provider labels and settings copy so China routes map to the correct product (moonshot.cn / bigmodel.cn), and allow packaging without the widget when full Xcode is unavailable.
… keys. Enrich Code CLI/API usage with GetSubscriptionStats via kimi-desktop kimi-auth, format absolute reset times as dates only, and accept common BigModel API key env aliases with a required key field in settings.
Discover ~/.coding-relay/glm-api-key, parse plan level, map TOKENS_LIMIT 5h to the main bar, and park MCP TIME_LIMIT as an extra lane so Coding Plan is not misread as multi-window monthly quota.
Expand provider docs in English so China Coding Plan keys, local key files, and Kimi Desktop membership enrichment are discoverable for contributors.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Pass the manual Kimi cookie into API enrichment
For an Auto/API user with a configured Kimi Code API key and a manually pasted kimi-auth cookie, this successful API strategy never supplies context.settings or context.env to the enrichment call. The new helper therefore only sees ProcessInfo environment, Desktop, or browser cookies, while the configured manual cookie is only read by KimiCookieHeader.resolveCookieOverride(context:); the API result is accepted and Monthly is omitted instead of being enriched. Pass the resolved manual token/context into fetchCodeAPIUsage so this advertised authentication path works.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for relative in self.localAPIKeyRelativePaths { | ||
| let url = homeDirectory.appendingPathComponent(relative) | ||
| guard FileManager.default.isReadableFile(atPath: url.path), | ||
| let raw = try? String(contentsOf: url, encoding: .utf8), | ||
| let token = self.cleaned(raw.split(separator: "\n").first.map(String.init)) | ||
| else { continue } | ||
| return token |
There was a problem hiding this comment.
When a user has the newly supported ~/.coding-relay/glm-api-key (or either other BigModel path) but has not explicitly changed the region, this returns that key while the provider still defaults to ZaiAPIRegion.global, so the next refresh sends a BigModel credential as a Bearer token to https://api.z.ai. The settings copy explicitly says these keys are not interchangeable; infer/select the China endpoint for these files or require the China region before returning them to avoid leaking the credential to the wrong service.
Useful? React with 👍 / 👎.
| #if os(macOS) | ||
| if let token = try? KimiCookieImporter.importSession().authToken { | ||
| return token |
There was a problem hiding this comment.
This browser import now runs after every successful Code API/CLI refresh whenever no process-level token or Desktop token is found, even when the provider's cookie source is set to Off or the user selected API source. Since the helper has no fetch context, it bypasses the guard used by KimiWebFetchStrategy and can trigger browser/Keychain access despite the user's opt-out; thread the cookie-source setting into enrichment and skip Desktop/browser discovery when it is off.
Useful? React with 👍 / 👎.
| // Chrome/Electron may hold a write lock; copy to a temp file first. | ||
| let tempURL = FileManager.default.temporaryDirectory | ||
| .appendingPathComponent("codexbar-kimi-desktop-cookies-\(UUID().uuidString).db") | ||
| do { | ||
| try FileManager.default.copyItem(at: dbURL, to: tempURL) |
There was a problem hiding this comment.
When Kimi Desktop has its Chromium Cookies database open in WAL mode, recent cookie writes live in Cookies-wal rather than the main Cookies file. Copying only the main database and opening the isolated copy can therefore return a stale token or no kimi-auth row, so Desktop-only users miss the new monthly enrichment. Use SQLite's backup API or copy the WAL/SHM sidecars consistently before opening the temporary database.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
rating: 🧂 unranked krab
|
Codex review: needs real behavior proof before merge. Reviewed July 20, 2026, 12:19 AM ET / 04:19 UTC. Summary Reproducibility: no. live high-confidence reproduction was run in this read-only review, but the failures are source-reproducible: a discovered BigModel file key lacks a region guard, and Kimi enrichment lacks the cookie-source policy input. Review metrics: 2 noteworthy metrics.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Proof guidance:
Risk before merge
Maintainer options:
Next step before merge
Security Review findings
Review detailsBest possible solution: Preserve the useful provider labeling and quota work, but gate BigModel local-file discovery on the China region or atomically infer that region, thread the Kimi cookie-source policy through enrichment, use a WAL-consistent SQLite snapshot, add focused tests, and provide redacted live CLI/provider evidence after the fixes. Do we have a high-confidence way to reproduce the issue? No live high-confidence reproduction was run in this read-only review, but the failures are source-reproducible: a discovered BigModel file key lacks a region guard, and Kimi enrichment lacks the cookie-source policy input. Is this the best way to solve the issue? No. The overall direction is useful, but automatic credential/session discovery must preserve endpoint routing and explicit cookie-source consent before it is a maintainable solution. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against f8636cb37eb0. Label changesLabel changes:
Label justifications:
Evidence reviewedSecurity concerns:
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
1 participant
Summary
Helps users (especially China-region accounts) map the right product endpoints and see the quotas that actually matter:
api.moonshot.cn) is not confused with Kimi Code subscription (api.kimi.com).kimi-authsession. Best-effort enrichment via env/manual cookie, Kimi Desktop Cookies DB, then browser import.~/.coding-relay/glm-api-key, env aliases), parselevel, show 5-hourTOKENS_LIMITas primary, keep MCPTIME_LIMITas an extra lane (not mislabeled as monthly coding quota).CODEXBAR_SKIP_WIDGET=1when full Xcode is unavailable;@Entry→ manualEnvironmentKeyfor Command Line Tools builds.Motivation
China users often hold:
api.kimi.comapi.moonshot.cnopen.bigmodel.cnCodexBar already had the right APIs for several of these, but discovery, labeling, and window mapping made it easy to miss Monthly (Kimi) or to think GLM was broken when the key lived only in a local relay file.
Test plan
codexbar usage --provider kimiwith Kimi Code CLI + signed-in Kimi Desktop → primary/secondary + Monthly (+ Code 7-day when present)codexbar usage --provider zaiwith~/.coding-relay/glm-api-key+region=bigmodel-cn→ primary 5-hour, MCP in extras, planmax/levelCODEXBAR_SKIP_WIDGET=1used in CLT-only environments)Notes for reviewers