Use current Kimi Desktop session and recheck it before each request

[Finesssee]

Summary

Ports upstream steipete#4416 / steipete#3536 (985e603c3, 6acc6b2da): Kimi China uses only the current Kimi Desktop session and rechecks it before every request.

• Current session only (China): reads the exact https://www.kimi.com / access_token record from %APPDATA%\kimi-desktop\Local Storage\leveldb through a new strict single-key LevelDB reader (read_current_value_strict). Missing CURRENT, links/junctions, oversized or malformed files, torn logs, or a directory that changes mid-read all fail closed, so an older record is never recovered.
• Token checks: bare token, at most 16 KiB, JWT with non-none alg, typ=access, future exp, aud containing kimi.com, past nbf if present (signature not verified, same as upstream).
• No historical-cookie fallback for China. International keeps its existing Desktop cookie path.
• Recheck before each request (web fetch and Code API/CLI monthly enrichment): request must target the China web host over https:443 with matching Bearer and kimi-auth headers, and the session must still hold the same token. A failed check sticks for all copies of the credential. A changed session is a non-auth error, so the chain stops instead of trying other tokens; Code API enrichment keeps the quota result.
• Tokens are redacted in Debug output and never logged.

Windows adaptation: upstream's POSIX realpath/O_NOFOLLOW walk is replaced by link/junction rejection on each profile directory plus FILE_FLAG_OPEN_REPARSE_POINT. The macOS build flag and SweetCookieKit pairing are not applicable.

Commands run

• cargo test --manifest-path rust/Cargo.toml --no-fail-fast: 4642 passed, 1 failed (token_activity::codex_activity_leaves_the_shared_cost_coverage_alone, a pre-existing time-zone test bug on main fixed by Fix time-zone flake in token activity test #890), 1 ignored
• cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml: 729 passed
• cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings: clean
• cargo fmt --all: no changes

Summary by CodeRabbit

• New Features
  • Kimi China can use the current Kimi Desktop session for web access and membership details.
• Bug Fixes
  • Desktop sessions are rechecked before requests. Signed-out, expired, or replaced sessions are not used, and older stored tokens are not substituted.
  • Browser cookie import is disabled when Cookie Source is Off.
  • Subscription enrichment can try another credential when authentication is required, while preserving existing quota details if enrichment fails.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: nesszer/Win-CodexBar/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2bc2803a-2976-4327-838d-76d223c61ed5

📥 Commits

Reviewing files that changed from the base of the PR and between c0e763f and e02caf8.

📒 Files selected for processing: 1

• CHANGELOG.md

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 0 remain after this review.

📝 Walkthrough

Kimi China web authentication and subscription enrichment now use the current Kimi Desktop session. The change adds strict LevelDB reads, validates the access token, and rechecks Desktop credentials before requests are sent.

Changes: Kimi Desktop Session Authentication

Layer / File(s)	Summary
Strict LevelDB current-value reads rust/src/browser/leveldb/mod.rs, rust/src/browser/leveldb/tests.rs	Adds a bounded read for the newest value of one key. Incomplete or inconsistent reads return an error instead of skipping unreadable data. Tests cover values, deletions, corrupt data, truncated logs, and a missing CURRENT file.
Desktop session discovery and token validation rust/src/providers/kimi/desktop_session.rs, rust/src/providers/kimi/desktop_token.rs	China reads the exact Kimi origin’s access_token from Desktop Local Storage and validates it as an access JWT. International continues to use Desktop cookie discovery. Tests cover token validation, storage selection, and discovery failures.
Credential validation at request dispatch rust/src/providers/kimi/credential.rs, rust/src/providers/kimi/desktop_session.rs, rust/src/providers/kimi/mod.rs	Desktop credentials are checked against the request and current session before dispatch. A failed check invalidates cloned credentials. Request construction is separated from sending.
Web authentication and subscription enrichment rust/src/providers/kimi/web.rs, rust/src/providers/kimi/code_api.rs, CHANGELOG.md	Manual and automatic web authentication carry credentials through usage requests and subscription enrichment. A changed Desktop session stops fallback. The changelog describes the Windows Kimi China session behavior.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~60 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant KimiWeb
  participant KimiWebCredential
  participant DesktopSession
  participant KimiAPI
  KimiWeb->>KimiWebCredential: validate the built request
  KimiWebCredential->>DesktopSession: reread the current session
  DesktopSession-->>KimiWebCredential: current token or no valid session
  KimiWebCredential-->>KimiWeb: dispatch result
  KimiWeb->>KimiAPI: send request after validation succeeds

Loading

Suggested reviewers: yozu

Merge Risk: ⚪ Minimal · up to e02ca

The change rechecks the current Desktop token before sending Desktop-authenticated web requests, while documented browser and local-storage alternatives remain available when no Desktop token is found. No actionable merge-blocking issue is established.

Pre-merge checks: 8

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Provider Data Stays Siloed		PASS. The pull request changes Kimi provider code and a generic LevelDB reader. Kimi subscription and plan enrichment stays within the existing Kimi Code/web flow and uses the Kimi credential. The new…
Secrets Handled Safely		No changed production path logs or persists credential values. KimiWebCredential implements Debug with token set to [REDACTED], and WebTokenCandidate uses that implementation. New tracing ca…
No Unapproved Dependencies		The pull request changes no Cargo.toml or package.json file. It adds no npm or yarn lockfile and does not change a pnpm packageManager version. No dependency addition is present, so maintainer approva…
Ui Changes Include Windows Proof		The reviewed diff changes only CHANGELOG.md and Rust browser/Kimi provider code and tests. It does not change files under apps/desktop-tauri/src, rust/src/tray, the float bar, settings, or window chro…
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title is a short imperative summary that accurately describes the main change: using the current Kimi Desktop session and rechecking it before each request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}