fix(oauth): normalize device timing fields

.changeset/oauth-device-timing-fields.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Handle invalid OAuth device authorization timing fields safely.

packages/oauth/src/oauth.ts

@@ -53,6 +53,13 @@ function tokenFromResponse(payload: Record<string, unknown>): TokenInfo {
   };
 }
 
+function positiveNumber(value: unknown): number | undefined {
+  if (typeof value !== 'number' && typeof value !== 'string') return undefined;
+  if (typeof value === 'string' && value.trim().length === 0) return undefined;
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? n : undefined;
+}
+
 /** HTTP client default timeout for OAuth requests. */
 const DEFAULT_HTTP_TIMEOUT_MS = 30_000;
 
@@ -152,8 +159,8 @@ export async function requestDeviceAuthorization(
     deviceCode,
     verificationUri: typeof data['verification_uri'] === 'string' ? data['verification_uri'] : '',
     verificationUriComplete,
-    expiresIn: data['expires_in'] !== undefined ? Number(data['expires_in']) : null,
-    interval: Number(data['interval'] ?? 5),
+    expiresIn: positiveNumber(data['expires_in']) ?? null,
+    interval: positiveNumber(data['interval']) ?? 5,
   };
 }
 

packages/oauth/test/oauth.test.ts

@@ -264,6 +264,22 @@ describe('requestDeviceAuthorization', () => {
     expect(auth.interval).toBe(5);
   });
 
+  it('normalizes invalid timing fields from device authorization responses', async () => {
+    server.enqueue('/api/oauth/device_authorization', {
+      status: 200,
+      body: {
+        user_code: 'U',
+        device_code: 'D',
+        verification_uri_complete: 'https://x/y',
+        expires_in: true,
+        interval: 'soon',
+      },
+    });
+    const auth = await requestAuth();
+    expect(auth.expiresIn).toBeNull();
+    expect(auth.interval).toBe(5);
+  });
+
   it('throws OAuthError on non-200 response', async () => {
     server.enqueue('/api/oauth/device_authorization', {
       status: 500,