Merge upstream changes (v7.2.111) with local modifications

- Recover Home OAuth credentials after 401 without breaking fork scheduling
- Add Kimi K3 256K model metadata and token-version fingerprints

Author: caidaoli

internal/home/client.go

@@ -1327,7 +1327,7 @@ func isAmbiguousIssuedRPopAuthError(err error) bool {
 	return !errors.As(err, &redisErr)
 }
 
-func (c *Client) GetRefreshAuth(ctx context.Context, authIndex string) ([]byte, error) {
+func (c *Client) GetRefreshAuth(ctx context.Context, authIndex string, lastRefreshedAt time.Time, accessTokenSHA256 string) ([]byte, error) {
 	cmd, errClient := c.commandClient()
 	if errClient != nil {
 		return nil, errClient
@@ -1340,6 +1340,10 @@ func (c *Client) GetRefreshAuth(ctx context.Context, authIndex string) ([]byte,
 		Type:      "refresh",
 		AuthIndex: authIndex,
 	}
+	if !lastRefreshedAt.IsZero() {
+		req.LastRefreshedAt = lastRefreshedAt.UTC().Format(time.RFC3339Nano)
+	}
+	req.ObservedAccessTokenSHA256 = strings.TrimSpace(accessTokenSHA256)
 	keyBytes, err := json.Marshal(&req)
 	if err != nil {
 		return nil, err

internal/home/requests.go

@@ -18,8 +18,10 @@ type modelsRequest struct {
 }
 
 type refreshRequest struct {
-	Type      string `json:"type"`
-	AuthIndex string `json:"auth_index"`
+	Type                      string `json:"type"`
+	AuthIndex                 string `json:"auth_index"`
+	LastRefreshedAt           string `json:"last_refreshed_at,omitempty"`
+	ObservedAccessTokenSHA256 string `json:"access_token_sha256,omitempty"`
 }
 
 type InFlightFrameKind string

internal/redisqueue/plugin.go

@@ -90,6 +90,7 @@ func (p *usageQueuePlugin) HandleUsage(ctx context.Context, record coreusage.Rec
 		TTFTMs:          record.TTFT.Milliseconds(),
 		Source:          record.Source,
 		AuthIndex:       record.AuthIndex,
+		AccessTokenHash: record.AccessTokenSHA256,
 		ClientIP:        clientRequestMetadata.ClientIP,
 		XForwardedFor:   clientRequestMetadata.XForwardedFor,
 		UserAgent:       clientRequestMetadata.UserAgent,
@@ -145,6 +146,7 @@ type requestDetail struct {
 	TTFTMs          int64       `json:"ttft_ms"`
 	Source          string      `json:"source"`
 	AuthIndex       string      `json:"auth_index"`
+	AccessTokenHash string      `json:"access_token_sha256,omitempty"`
 	ClientIP        string      `json:"client_ip"`
 	XForwardedFor   string      `json:"x_forwarded_for"`
 	UserAgent       string      `json:"user_agent"`

internal/registry/models/models.json

@@ -2410,6 +2410,25 @@
       "type": "kimi",
       "display_name": "Kimi K3",
       "description": "Kimi K3 - Moonshot AI's next-generation flagship model (~2.8T MoE) with multimodal input",
+      "context_length": 1048576,
+      "max_completion_tokens": 65536,
+      "thinking": {
+        "zero_allowed": false,
+        "levels": [
+          "low",
+          "high",
+          "max"
+        ]
+      }
+    },
+    {
+      "id": "kimi-k3-256k",
+      "object": "model",
+      "created": 1785110400,
+      "owned_by": "moonshot",
+      "type": "kimi",
+      "display_name": "Kimi K3 256K",
+      "description": "Kimi K3 256K - 256K context version of Kimi K3 delivering the same results within 256K context at reduced quota consumption; supports image input only (no video)",
       "context_length": 262144,
       "max_completion_tokens": 65536,
       "thinking": {

internal/runtime/executor/helps/home_refresh.go

@@ -2,10 +2,14 @@ package helps
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/router-for-me/CLIProxyAPI/v7/internal/config"
 	"github.com/router-for-me/CLIProxyAPI/v7/internal/home"
@@ -43,7 +47,7 @@ type homeErrorDetail struct {
 
 type homeRefreshClient interface {
 	HeartbeatOK() bool
-	GetRefreshAuth(ctx context.Context, authIndex string) ([]byte, error)
+	GetRefreshAuth(ctx context.Context, authIndex string, lastRefreshedAt time.Time, accessTokenSHA256 string) ([]byte, error)
 }
 
 var currentHomeRefreshClient = func() homeRefreshClient {
@@ -77,8 +81,11 @@ func RefreshAuthViaHome(ctx context.Context, cfg *config.Config, auth *cliproxya
 		return nil, true, homeStatusErr{code: http.StatusBadGateway, msg: "home refresh: auth_index is empty"}
 	}
 
-	raw, err := client.GetRefreshAuth(ctx, authIndex)
+	raw, err := client.GetRefreshAuth(ctx, authIndex, auth.LastRefreshedAt, authAccessTokenSHA256(auth))
 	if err != nil {
+		if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+			return nil, true, err
+		}
 		return nil, true, homeStatusErr{code: http.StatusBadGateway, msg: err.Error()}
 	}
 
@@ -107,6 +114,43 @@ func RefreshAuthViaHome(ctx context.Context, cfg *config.Config, auth *cliproxya
 	return updated, true, nil
 }
 
+func authAccessTokenSHA256(auth *cliproxyauth.Auth) string {
+	accessToken := authAccessTokenForFingerprint(auth)
+	if accessToken == "" {
+		return ""
+	}
+	digest := sha256.Sum256([]byte(accessToken))
+	return hex.EncodeToString(digest[:])
+}
+
+func authAccessTokenForFingerprint(auth *cliproxyauth.Auth) string {
+	if auth == nil || auth.Metadata == nil {
+		return ""
+	}
+	for _, key := range []string{"access_token", "accessToken"} {
+		if value, ok := auth.Metadata[key].(string); ok && strings.TrimSpace(value) != "" {
+			return strings.TrimSpace(value)
+		}
+	}
+	for _, key := range []string{"token", "Token"} {
+		switch token := auth.Metadata[key].(type) {
+		case map[string]any:
+			for _, tokenKey := range []string{"access_token", "accessToken"} {
+				if value, ok := token[tokenKey].(string); ok && strings.TrimSpace(value) != "" {
+					return strings.TrimSpace(value)
+				}
+			}
+		case map[string]string:
+			for _, tokenKey := range []string{"access_token", "accessToken"} {
+				if value := strings.TrimSpace(token[tokenKey]); value != "" {
+					return value
+				}
+			}
+		}
+	}
+	return ""
+}
+
 func parseHomeRefreshAuth(raw []byte) (*cliproxyauth.Auth, string, error) {
 	var rawObject map[string]json.RawMessage
 	if errUnmarshal := json.Unmarshal(raw, &rawObject); errUnmarshal != nil {
@@ -132,6 +176,8 @@ func statusFromHomeErrorCode(code string) int {
 		return http.StatusUnauthorized
 	case "model_not_found":
 		return http.StatusNotFound
+	case "refresh_temporarily_unavailable", "home_unavailable":
+		return http.StatusServiceUnavailable
 	default:
 		return http.StatusBadGateway
 	}

internal/runtime/executor/helps/home_refresh_test.go

@@ -3,9 +3,11 @@ package helps
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"sync/atomic"
 	"testing"
+	"time"
 
 	"github.com/router-for-me/CLIProxyAPI/v7/internal/config"
 	cliproxyauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth"
@@ -18,22 +20,60 @@ func TestStatusFromHomeErrorCodeMapsAuthenticationErrorToUnauthorized(t *testing
 	if got := statusFromHomeErrorCode("unauthorized"); got != http.StatusUnauthorized {
 		t.Fatalf("statusFromHomeErrorCode(unauthorized) = %d, want %d", got, http.StatusUnauthorized)
 	}
+	if got := statusFromHomeErrorCode("refresh_temporarily_unavailable"); got != http.StatusServiceUnavailable {
+		t.Fatalf("statusFromHomeErrorCode(refresh_temporarily_unavailable) = %d, want %d", got, http.StatusServiceUnavailable)
+	}
 }
 
 type fakeHomeRefreshClient struct {
-	calls     atomic.Int32
-	authIndex string
-	raw       []byte
+	calls           atomic.Int32
+	authIndex       string
+	lastRefreshedAt time.Time
+	accessTokenHash string
+	raw             []byte
+	err             error
 }
 
 func (c *fakeHomeRefreshClient) HeartbeatOK() bool {
 	return true
 }
 
-func (c *fakeHomeRefreshClient) GetRefreshAuth(_ context.Context, authIndex string) ([]byte, error) {
+func (c *fakeHomeRefreshClient) GetRefreshAuth(_ context.Context, authIndex string, lastRefreshedAt time.Time, accessTokenHash string) ([]byte, error) {
 	c.calls.Add(1)
 	c.authIndex = authIndex
-	return c.raw, nil
+	c.lastRefreshedAt = lastRefreshedAt
+	c.accessTokenHash = accessTokenHash
+	return c.raw, c.err
+}
+
+func TestRefreshAuthViaHomePreservesContextErrors(t *testing.T) {
+	client := &fakeHomeRefreshClient{err: context.DeadlineExceeded}
+	oldCurrentHomeRefreshClient := currentHomeRefreshClient
+	currentHomeRefreshClient = func() homeRefreshClient { return client }
+	t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient })
+
+	cfg := &config.Config{Home: config.HomeConfig{Enabled: true}}
+	auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "codex"}
+	_, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth)
+	if !handled || !errors.Is(errRefresh, context.DeadlineExceeded) {
+		t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want true/context.DeadlineExceeded", handled, errRefresh)
+	}
+}
+
+func TestAuthAccessTokenSHA256SupportsKnownMetadataShapes(t *testing.T) {
+	want := authAccessTokenSHA256(&cliproxyauth.Auth{Metadata: map[string]any{"access_token": "same-token"}})
+	cases := map[string]*cliproxyauth.Auth{
+		"camel case":        {Metadata: map[string]any{"accessToken": "same-token"}},
+		"nested any map":    {Metadata: map[string]any{"token": map[string]any{"access_token": "same-token"}}},
+		"nested string map": {Metadata: map[string]any{"Token": map[string]string{"accessToken": "same-token"}}},
+	}
+	for name, auth := range cases {
+		t.Run(name, func(t *testing.T) {
+			if got := authAccessTokenSHA256(auth); got == "" || got != want {
+				t.Fatalf("token hash = %q, want %q", got, want)
+			}
+		})
+	}
 }
 
 func TestRefreshAuthViaHomeAcceptsAuthEnvelope(t *testing.T) {
@@ -64,11 +104,14 @@ func TestRefreshAuthViaHomeAcceptsAuthEnvelope(t *testing.T) {
 	})
 
 	cfg := &config.Config{Home: config.HomeConfig{Enabled: true}}
+	observedRefreshAt := time.Now().UTC()
 	auth := &cliproxyauth.Auth{
-		ID:       "home-auth-1",
-		Provider: "antigravity",
-		Index:    "home-index-1",
+		ID:              "home-auth-1",
+		Provider:        "antigravity",
+		Index:           "home-index-1",
+		LastRefreshedAt: observedRefreshAt,
 		Metadata: map[string]any{
+			"access_token":  "old-access-token",
 			"refresh_token": "refresh-token",
 		},
 	}
@@ -86,6 +129,12 @@ func TestRefreshAuthViaHomeAcceptsAuthEnvelope(t *testing.T) {
 	if client.authIndex != "home-index-1" {
 		t.Fatalf("home refresh auth_index = %q, want home-index-1", client.authIndex)
 	}
+	if !client.lastRefreshedAt.Equal(observedRefreshAt) {
+		t.Fatalf("home refresh last_refreshed_at = %v, want %v", client.lastRefreshedAt, observedRefreshAt)
+	}
+	if client.accessTokenHash != authAccessTokenSHA256(auth) {
+		t.Fatalf("home refresh access token hash = %q, want %q", client.accessTokenHash, authAccessTokenSHA256(auth))
+	}
 	if updated == nil {
 		t.Fatal("updated auth = nil")
 	}

internal/runtime/executor/helps/usage_helpers.go

@@ -23,25 +23,26 @@ import (
 )
 
 type UsageReporter struct {
-	provider     string
-	executorType string
-	model        string
-	alias        string
-	authID       string
-	authIndex    string
-	authType     string
-	apiKey       string
-	source       string
-	reasoning    string
-	serviceTier  string
-	stream       *bool
-	generate     bool
-	requestedAt  time.Time
-	ttftMu       sync.RWMutex
-	ttft         time.Duration
-	ttftStart    time.Time
-	ttftSet      bool
-	once         sync.Once
+	provider        string
+	executorType    string
+	model           string
+	alias           string
+	authID          string
+	authIndex       string
+	accessTokenHash string
+	authType        string
+	apiKey          string
+	source          string
+	reasoning       string
+	serviceTier     string
+	stream          *bool
+	generate        bool
+	requestedAt     time.Time
+	ttftMu          sync.RWMutex
+	ttft            time.Duration
+	ttftStart       time.Time
+	ttftSet         bool
+	once            sync.Once
 }
 
 type usageExecutor interface {
@@ -82,6 +83,7 @@ func NewUsageReporter(ctx context.Context, provider, model string, auth *cliprox
 	if auth != nil {
 		reporter.authID = auth.ID
 		reporter.authIndex = auth.EnsureIndex()
+		reporter.accessTokenHash = authAccessTokenSHA256(auth)
 	}
 	return reporter
 }
@@ -269,6 +271,7 @@ func (r *UsageReporter) buildRecordForModel(model string, detail usage.Detail, f
 		APIKey:              r.apiKey,
 		AuthID:              r.authID,
 		AuthIndex:           r.authIndex,
+		AccessTokenSHA256:   r.accessTokenHash,
 		AuthType:            r.authType,
 		ReasoningEffort:     r.reasoning,
 		ServiceTier:         r.serviceTier,

sdk/cliproxy/auth/conductor_execution.go

@@ -639,7 +639,7 @@ func (m *Manager) executeStreamMixedOnce(ctx context.Context, providers []string
 			models = models[:1]
 			pooled = false
 		}
-		streamResult, errStream := m.executeStreamWithModelPool(execCtx, executor, auth, provider, execReq, execOpts, routeModel, streamExecutionModel, models, pooled, aliasResult, routing, !homeMode, selection != nil)
+		streamResult, errStream := m.executeStreamWithModelPool(execCtx, executor, auth, provider, execReq, execOpts, routeModel, streamExecutionModel, models, pooled, aliasResult, routing, true, selection != nil)
 		if errStream != nil {
 			if selection != nil {
 				releaseAttempt()