feat(kimi-code): support two OAuth login endpoints

.changeset/oauth-region-split.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": minor
+---
+
+Support two OAuth login methods — kimi.ai and kimi.com.

.changeset/sdk-auth-login-region.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code-sdk": patch
+---
+
+Add an optional region parameter to the auth login API for selecting the OAuth login endpoint (.com or .ai deployment).

apps/kimi-code/src/cli/sub/acp-native.ts

@@ -25,7 +25,7 @@ import { getVersion } from '#/cli/version';
 import { KIMI_CODE_HOME_ENV } from '#/constant/app';
 import { getDataDir } from '#/utils/paths';
 
-import { runLoginFlow } from './login-flow';
+import { parseRegionFlag, runLoginFlow } from './login-flow';
 
 export function registerNativeAcpCommand(parent: Command): void {
   parent
@@ -36,9 +36,12 @@ export function registerNativeAcpCommand(parent: Command): void {
       'Run the device-code login flow then exit (entry point for ACP terminal-auth).',
       false,
     )
-    .action(async (opts: { login?: boolean }) => {
+    .option('--region <region>', 'Login region used together with --login: "mainland-cn" (kimi.com) or "global" (kimi.ai).')
+    .action(async (opts: { login?: boolean; region?: string }) => {
       if (opts.login === true) {
-        await runLoginFlow();
+        await runLoginFlow({
+          region: opts.region === undefined ? undefined : parseRegionFlag(opts.region),
+        });
         return;
       }
       // Forward `KIMI_CODE_HOME` (if set) into `authMethods[0].env` so the

apps/kimi-code/src/cli/sub/acp.ts

@@ -35,7 +35,7 @@ import { buildSkillSlashCommands } from '#/tui/commands/skills';
 
 import { isLegacyEnabled } from '../experimental-v2';
 import { registerNativeAcpCommand } from './acp-native';
-import { runLoginFlow } from './login-flow';
+import { parseRegionFlag, runLoginFlow } from './login-flow';
 
 export function registerAcpCommand(parent: Command): void {
   if (!isLegacyEnabled()) {
@@ -51,9 +51,12 @@ export function registerAcpCommand(parent: Command): void {
       'Run the device-code login flow then exit (entry point for ACP terminal-auth).',
       false,
     )
-    .action(async (opts: { login?: boolean }) => {
+    .option('--region <region>', 'Login region used together with --login: "mainland-cn" (kimi.com) or "global" (kimi.ai).')
+    .action(async (opts: { login?: boolean; region?: string }) => {
       if (opts.login === true) {
-        await runLoginFlow();
+        await runLoginFlow({
+          region: opts.region === undefined ? undefined : parseRegionFlag(opts.region),
+        });
         return;
       }
       const identity = createKimiCodeHostIdentity();

apps/kimi-code/src/cli/sub/login-flow.ts

@@ -6,11 +6,27 @@
  */
 
 import { createKimiHarness } from '@moonshot-ai/kimi-code-sdk';
+import type { KimiRegion } from '@moonshot-ai/kimi-code-oauth';
 
 import { createKimiCodeHostIdentity } from '#/cli/version';
 import { openUrl } from '#/utils/open-url';
+import { persistedKimiOAuthRef, regionForBareLogin } from '#/utils/region';
 
-export async function runLoginFlow(): Promise<never> {
+/** Parse a `--region` CLI flag; exits with an actionable message on bad input. */
+export function parseRegionFlag(value: string): KimiRegion {
+  if (value !== 'mainland-cn' && value !== 'global') {
+    process.stderr.write(`Invalid --region "${value}" (expected "mainland-cn" or "global").\n`);
+    process.exit(1);
+  }
+  return value;
+}
+
+export async function runLoginFlow(options: { region?: KimiRegion } = {}): Promise<never> {
+  // No flag: a fresh install follows the resolved region (env/marker/
+  // default); an existing login keeps its own environment (see
+  // regionForBareLogin — the default slot re-pins mainland-cn, a scoped slot
+  // keeps its configured hosts).
+  const region = options.region ?? regionForBareLogin(persistedKimiOAuthRef());
   const identity = createKimiCodeHostIdentity();
   const harness = createKimiHarness({
     identity,
@@ -23,6 +39,7 @@ export async function runLoginFlow(): Promise<never> {
   try {
     const result = await harness.auth.login(undefined, {
       signal: controller.signal,
+      region,
       onDeviceCode: (data) => {
         const url = data.verificationUriComplete || data.verificationUri;
         // Print the manual fallback before attempting to open the user's

apps/kimi-code/src/cli/sub/login.ts

@@ -8,13 +8,19 @@
 
 import type { Command } from 'commander';
 
-import { runLoginFlow } from './login-flow';
+import { parseRegionFlag, runLoginFlow } from './login-flow';
 
 export function registerLoginCommand(parent: Command): void {
   parent
     .command('login')
     .description('Authenticate with Kimi Code CLI via the device-code flow.')
-    .action(async () => {
-      await runLoginFlow();
+    .option(
+      '--region <region>',
+      'Login region: "mainland-cn" (kimi.com) or "global" (kimi.ai).',
+    )
+    .action(async (opts: { region?: string }) => {
+      await runLoginFlow({
+        region: opts.region === undefined ? undefined : parseRegionFlag(opts.region),
+      });
     });
 }

apps/kimi-code/src/cli/telemetry.ts

@@ -17,6 +17,7 @@ import {
 } from '@moonshot-ai/kimi-telemetry';
 
 import { CLI_USER_AGENT_PRODUCT, WEB_UI_MODE } from '#/constant/app';
+import { currentKimiProfile } from '#/utils/region';
 
 import { createKimiCodeHostIdentity } from './version';
 
@@ -57,6 +58,7 @@ export function initializeCliTelemetry(options: InitializeCliTelemetryOptions):
     uiMode: options.uiMode,
     model: options.model ?? options.config.defaultModel,
     sessionId: options.sessionId,
+    endpoint: () => currentKimiProfile().telemetryEndpoint,
     getAccessToken: async () =>
       (await options.harness.auth.getCachedAccessToken(KIMI_CODE_PROVIDER_NAME)) ?? null,
   });
@@ -105,6 +107,7 @@ export function initializeServerTelemetry(
     version: options.version,
     uiMode: WEB_UI_MODE,
     model: config.defaultModel,
+    endpoint: () => currentKimiProfile().telemetryEndpoint,
     getAccessToken: async () => (await auth.getCachedAccessToken(KIMI_CODE_PROVIDER_NAME)) ?? null,
   });
 

apps/kimi-code/src/cli/update/cdn.ts

@@ -1,7 +1,7 @@
 import { valid } from 'semver';
 import { z } from 'zod';
 
-import { KIMI_CODE_CDN_LATEST_JSON_URL, KIMI_CODE_CDN_LATEST_URL } from '#/constant/app';
+import { kimiCodeCdnLatestJsonUrl, kimiCodeCdnLatestUrl } from '#/constant/app';
 
 import type { UpdateManifest } from './types';
 
@@ -58,7 +58,7 @@ async function fetchWithTimeout(fetchImpl: typeof fetch, input: string): Promise
 export async function fetchLatestVersionFromCdn(
   fetchImpl: typeof fetch = fetch,
 ): Promise<string> {
-  const response = await fetchWithTimeout(fetchImpl, KIMI_CODE_CDN_LATEST_URL);
+  const response = await fetchWithTimeout(fetchImpl, kimiCodeCdnLatestUrl());
   if (!response.ok) {
     throw new Error(`CDN /latest returned HTTP ${response.status}`);
   }
@@ -70,7 +70,7 @@ export async function fetchLatestVersionFromCdn(
 }
 
 async function fetchUpdateManifestFromCdn(fetchImpl: typeof fetch): Promise<UpdateManifest> {
-  const response = await fetchWithTimeout(fetchImpl, KIMI_CODE_CDN_LATEST_JSON_URL);
+  const response = await fetchWithTimeout(fetchImpl, kimiCodeCdnLatestJsonUrl());
   if (!response.ok) {
     throw new Error(`CDN /latest.json returned HTTP ${response.status}`);
   }

apps/kimi-code/src/cli/update/native-manifest.ts

@@ -10,7 +10,7 @@
 import { valid } from 'semver';
 import { z } from 'zod';
 
-import { KIMI_CODE_CDN_BINARIES_BASE } from '#/constant/app';
+import { kimiCodeCdnBinariesBase } from '#/constant/app';
 
 const MANIFEST_FETCH_TIMEOUT_MS = 10_000;
 
@@ -33,11 +33,11 @@ export type NativeReleaseManifest = z.infer<typeof NativeReleaseManifestSchema>;
 export type NativePlatformEntry = z.infer<typeof PlatformEntrySchema>;
 
 export function nativeManifestUrl(version: string): string {
-  return `${KIMI_CODE_CDN_BINARIES_BASE}/${version}/manifest.json`;
+  return `${kimiCodeCdnBinariesBase()}/${version}/manifest.json`;
 }
 
 export function nativeBinaryUrl(version: string, filename: string): string {
-  return `${KIMI_CODE_CDN_BINARIES_BASE}/${version}/${filename}`;
+  return `${kimiCodeCdnBinariesBase()}/${version}/${filename}`;
 }
 
 /**

apps/kimi-code/src/cli/update/preflight.ts

@@ -4,9 +4,9 @@ import { log, type Logger } from '@moonshot-ai/kimi-code-sdk';
 import type { TelemetryProperties } from '@moonshot-ai/kimi-telemetry';
 
 import {
-  KIMI_CODE_OFFICIAL_INSTALL_URL,
-  NATIVE_INSTALL_COMMAND_UNIX,
-  NATIVE_INSTALL_COMMAND_WIN,
+  kimiCodeOfficialInstallUrl,
+  nativeInstallCommandUnix,
+  nativeInstallCommandWin,
 } from '#/constant/app';
 import { loadTuiConfig } from '#/tui/config';
 import { resolveCommandPath } from '#/utils/process/resolve-command';
@@ -82,7 +82,7 @@ export function installCommandFor(
     case 'homebrew':
       return 'brew upgrade kimi-code';
     case 'native':
-      return platform === 'win32' ? NATIVE_INSTALL_COMMAND_WIN : NATIVE_INSTALL_COMMAND_UNIX;
+      return platform === 'win32' ? nativeInstallCommandWin() : nativeInstallCommandUnix();
     case 'unsupported':
       return `npm install -g ${NPM_PACKAGE_NAME}@${version}`;
   }
@@ -184,9 +184,13 @@ function resolveInstallSpawn(
   return { resolvedCmd, args, shell: platform === 'win32' };
 }
 
-const THIRD_PARTY_SOURCE_NOTE =
-  '\nNote: Third-party sources may lag behind the official release.\n' +
-  `For the latest updates, use the official installer: ${KIMI_CODE_OFFICIAL_INSTALL_URL}\n`;
+// Built per call: the official-installer URL follows the current region.
+function thirdPartySourceNote(): string {
+  return (
+    '\nNote: Third-party sources may lag behind the official release.\n' +
+    `For the latest updates, use the official installer: ${kimiCodeOfficialInstallUrl()}\n`
+  );
+}
 
 export function renderManualUpdateMessage(
   currentVersion: string,
@@ -217,7 +221,7 @@ export function renderManualUpdateMessage(
     `(${currentVersion} -> ${target.version}).\n` +
     `Detected install source: ${sourceDesc}\n` +
     `To update manually, run: ${installCommand}\n` +
-    (source === 'homebrew' ? THIRD_PARTY_SOURCE_NOTE : '')
+    (source === 'homebrew' ? thirdPartySourceNote() : '')
   );
 }
 

apps/kimi-code/src/constant/app.ts

@@ -1,4 +1,7 @@
 import { ErrorCodes } from '@moonshot-ai/kimi-code-sdk';
+import { kimiCdnContentUrl } from '@moonshot-ai/kimi-code-oauth';
+
+import { currentKimiProfile } from '#/utils/region';
 
 export const PRODUCT_NAME = 'Kimi Code';
 export const CLI_COMMAND_NAME = 'kimi';
@@ -74,7 +77,9 @@ export const OAUTH_LOGIN_REQUIRED_CODE = ErrorCodes.AUTH_LOGIN_REQUIRED;
 export const FEEDBACK_ISSUE_URL = 'https://github.com/MoonshotAI/kimi-code/issues';
 // Sign-up / sign-in page offered to signed-out users so they can create an
 // account and submit feedback through the authenticated channel next time.
-export const KIMI_CODE_SIGNUP_URL = 'https://www.kimi.com/code';
+export function kimiCodeSignupUrl(): string {
+  return `${currentKimiProfile().siteBase}/code`;
+}
 
 // Sent in the feedback `version` field so the backend can distinguish this
 // TypeScript client from clients that send a bare version.
@@ -84,34 +89,59 @@ export const FEEDBACK_VERSION_PREFIX = 'kimi-code-';
 export const FEEDBACK_TELEMETRY_EVENT = 'feedback_submitted';
 
 // CDN source of truth: all version checks and native install scripts pull from here.
-export const KIMI_CODE_CDN_BASE = 'https://code.kimi.com/kimi-code';
-export const KIMI_CODE_CDN_LATEST_URL = `${KIMI_CODE_CDN_BASE}/latest`;
+// The off-session endpoints derive from the current region profile so a
+// global login points at the .ai deployment; they are resolved per call so
+// a region switch (login/logout + refreshKimiRegion) takes effect immediately.
+export function kimiCodeCdnBase(): string {
+  return currentKimiProfile().cdnBase;
+}
+export function kimiCodeCdnLatestUrl(): string {
+  return `${kimiCodeCdnBase()}/latest`;
+}
 // Rollout manifest consumed by update checks; the plain-text `/latest` above
 // stays unchanged forever — already-shipped clients hard-fail on non-semver
 // bodies, and the CDN install scripts read it for fresh installs.
-export const KIMI_CODE_CDN_LATEST_JSON_URL = `${KIMI_CODE_CDN_BASE}/latest.json`;
+export function kimiCodeCdnLatestJsonUrl(): string {
+  return `${kimiCodeCdnBase()}/latest.json`;
+}
 // Per-release native artifacts: `/binaries/<version>/manifest.json` +
 // `/binaries/<version>/kimi-code-<target>[.exe]` — the bare platform binary
 // (same layout install.ps1 consumes).
-export const KIMI_CODE_CDN_BINARIES_BASE = `${KIMI_CODE_CDN_BASE}/binaries`;
-export const KIMI_CODE_TIPS_BANNER_URL = 'https://cdn.kimi.com/kimi-code-tips/tips.json';
-// The marketplace catalog location constants live in the shared
-// agent-core-v2 plugin domain (kap-server consumes them from there).
-// Deep-path import: this module is evaluated on every CLI invocation, so it
-// must not pull in the engine root.
-export {
-  KIMI_CODE_PLUGIN_MARKETPLACE_URL,
-  KIMI_CODE_PLUGIN_MARKETPLACE_URL_ENV,
-} from '@moonshot-ai/agent-core-v2/app/plugin/marketplace';
+export function kimiCodeCdnBinariesBase(): string {
+  return `${kimiCodeCdnBase()}/binaries`;
+}
+// The tips banner rides the content CDN, which both regions currently share.
+export function kimiCodeTipsBannerUrl(): string {
+  return kimiCdnContentUrl('kimi-code-tips/tips.json');
+}
+// The marketplace env override name lives in the shared agent-core-v2 plugin
+// domain (kap-server consumes it from there). Deep-path import: this module is
+// evaluated on every CLI invocation, so it must not pull in the engine root.
+export { KIMI_CODE_PLUGIN_MARKETPLACE_URL_ENV } from '@moonshot-ai/agent-core-v2/app/plugin/marketplace';
+// The CLI-side default catalog derives from the current region profile; the
+// env override above takes priority at the call site.
+export function kimiCodePluginMarketplaceUrl(): string {
+  return `${kimiCodeCdnBase()}/plugins/marketplace.json`;
+}
 // Official plugins whose usage bills against the user's plan quota. Installing
 // one of these shows a quota note after the install result.
 export const QUOTA_CONSUMING_PLUGIN_IDS: readonly string[] = ['kimi-datasource'];
-export const KIMI_CODE_INSTALL_SH_URL = `${KIMI_CODE_CDN_BASE}/install.sh`;
-export const KIMI_CODE_INSTALL_PS1_URL = `${KIMI_CODE_CDN_BASE}/install.ps1`;
+export function kimiCodeInstallShUrl(): string {
+  return `${kimiCodeCdnBase()}/install.sh`;
+}
+export function kimiCodeInstallPs1Url(): string {
+  return `${kimiCodeCdnBase()}/install.ps1`;
+}
 // Official download page, referenced by prompt copy that steers users away
 // from third-party install sources.
-export const KIMI_CODE_OFFICIAL_INSTALL_URL = 'https://www.kimi.com/code';
+export function kimiCodeOfficialInstallUrl(): string {
+  return `${currentKimiProfile().siteBase}/code`;
+}
 
 // Native install commands, split by platform. Use these for prompt copy and spawn calls only; do not assemble the strings elsewhere.
-export const NATIVE_INSTALL_COMMAND_UNIX = `curl -fsSL ${KIMI_CODE_INSTALL_SH_URL} | bash`;
-export const NATIVE_INSTALL_COMMAND_WIN = `irm ${KIMI_CODE_INSTALL_PS1_URL} | iex`;
+export function nativeInstallCommandUnix(): string {
+  return `curl -fsSL ${kimiCodeInstallShUrl()} | bash`;
+}
+export function nativeInstallCommandWin(): string {
+  return `irm ${kimiCodeInstallPs1Url()} | iex`;
+}

apps/kimi-code/src/tui/banner/banner-provider.ts

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 
 import { eq, gte, lt, valid } from 'semver';
 
-import { KIMI_CODE_TIPS_BANNER_URL } from '#/constant/app';
+import { kimiCodeTipsBannerUrl } from '#/constant/app';
 import type { BannerDisplay, BannerState } from '#/tui/types';
 
 import type { BannerDisplayState } from './state';
@@ -315,7 +315,7 @@ export function selectDisplayableBanner({
 export class BannerProvider {
   constructor(
     private readonly clientVersion: string,
-    private readonly url: string = KIMI_CODE_TIPS_BANNER_URL,
+    private readonly url: string = kimiCodeTipsBannerUrl(),
   ) {}
 
   async load(