fix(auth): resolve kimi-coding-cn pool base_url for sk-kimi- keys

[theone139344]

Summary

• When credential pool entries use provider kimi-coding-cn with sk-kimi- keys, resolve the correct Coding API base_url so requests do not hit the wrong host.

Test plan

• Pool entry with kimi-coding-cn + sk-kimi-… resolves api.kimi.com/coding (or configured CN endpoint)
• Existing kimi-coding path unchanged

[alt-glitch]

This was generated by AI during triage.

Related to #5908 and #18694: this patch fixes the distinct environment-pool _env_payload path in agent/credential_pool.py; #18694 normalizes persisted entries when they are loaded.

[teknium1]

Thanks for identifying the environment-pool/runtime mismatch. The implementation matches the existing runtime routing rule: current main only resolves kimi-coding in agent/credential_pool.py:2617, while hermes_cli/auth.py:6954 already resolves both Kimi provider IDs.

Problems

• The PR has no regression coverage for the changed pool path. tests/hermes_cli/test_api_key_providers.py:916 tests _resolve_kimi_base_url() in isolation, but it does not cover _seed_from_env("kimi-coding-cn", ...), where this defect occurs.

Suggested changes

• Add a focused test that seeds KIMI_CN_API_KEY=sk-kimi-... through _seed_from_env and asserts the created entry uses KIMI_CODE_BASE_URL; retain a legacy-key assertion for the CN default endpoint.

Automated hermes-sweeper review.

[teknium1]

Please add a regression test for this pool-specific branch: seed KIMI_CN_API_KEY=sk-kimi-... via _seed_from_env("kimi-coding-cn", entries) and assert the entry uses KIMI_CODE_BASE_URL. Existing helper tests do not exercise pool seeding.

[GottZ]

This was generated by AI during triage.

Summary

Seven PRs address or reference the Kimi endpoint-routing complex: #5566, #5669, and #7554 target initial environment-pool seeding; #18694 targets stale persisted entries; #69409 extends environment-pool seeding to kimi-coding-cn; and #10525/#10534 cover related CN runtime resolution. The evidence shows that persisted-pool normalization and CN environment-pool seeding are distinct remaining paths, while the original kimi-coding seeding fix is already represented on main by commit 4d1b988.

Related pull requests

• fix(credential_pool): use _resolve_kimi_base_url when seeding kimi-coding pool #5566 [closed] best fix — (+5/-1) — n/a: Adds _resolve_kimi_base_url() to kimi-coding environment-pool seeding, directly matching kimi-coding credential pool seeds wrong base_url for sk-kimi- keys, causing 401 on first request #5561's wrong-first-endpoint cause; it remains the recorded best-fix/reference for kimi-coding credential pool seeds wrong base_url for sk-kimi- keys, causing 401 on first request #5561, although it was closed after a contributor identified its functional change as identical to fix(auth): kimi-coding pool base_url seeding + PKCE endpoint fallback #5669.
• fix(auth): kimi-coding pool base_url seeding + PKCE endpoint fallback #5669 [closed] fixes — (+32/-14) — n/a: Applies the same kimi-coding seeding correction as fix(credential_pool): use _resolve_kimi_base_url when seeding kimi-coding pool #5566 but bundles an unrelated Anthropic PKCE endpoint fallback; it is closed after triage declined this combined approach.
• fix(credential-pool): resolve kimi-coding base URL from API key prefix #7554 [closed] fixes — (+5/-0) — n/a: Repeats the kimi-coding seeding resolver change and additionally strips terminal escape sequences from tokens; it was closed because a contributor documented the routing fix on main at commit 4d1b988, while directing the unique stripping change to a focused follow-up.
• fix(kimi): unify kimi-coding-cn provider flow #10525 [closed] related — (+16/-5) — n/a: Proposes CN-provider runtime resolution, model-flow routing, credential-pool fallback, and a label update rather than fixing stale or environment-seeded pool URLs directly; it is closed and superseded by fix(kimi): include kimi-coding-cn in Kimi base URL resolution #10534, which salvaged only the base-URL and label portions after contributor-documented implementation problems in the other parts.
• fix(kimi): include kimi-coding-cn in Kimi base URL resolution #10534 [merged] related — (+3/-3) — n/a: Extends runtime Kimi base-URL resolution to kimi-coding-cn and updates the display label, but does not address the environment-pool branch changed by fix(auth): resolve kimi-coding-cn pool base_url for sk-kimi- keys #69409 or persisted entries targeted by fix(auth): re-resolve Kimi pool base URLs #18694; as a merged salvage of fix(kimi): unify kimi-coding-cn provider flow #10525, it remains the runtime reference implementation.
• fix(auth): re-resolve Kimi pool base URLs #18694 best fix — (+87/-2) — n/a: Normalizes persisted Kimi pool entries on read and adds stale-Moonshot and environment-override tests, directly targeting kimi-coding credential pool base_url not re-resolved from key prefix on load #5908 and remaining its recorded best fix. The contributor keep_open review requires revision because the diff overwrites intentional custom pool URLs, predates current profile/global fallback semantics, and lacks pool-to-runtime and custom-URL preservation coverage.
• fix(auth): resolve kimi-coding-cn pool base_url for sk-kimi- keys #69409 related — (+5/-1) — n/a: Extends the existing _env_payload condition from kimi-coding to both Kimi provider IDs, directly fixing the distinct kimi-coding-cn environment-pool path while leaving persisted-entry loading to fix(auth): re-resolve Kimi pool base URLs #18694. The contributor keep_open review finds the implementation aligned with runtime routing but requires focused _seed_from_env regression coverage for both sk-kimi and legacy CN keys.

Duplicates

#5566 and the kimi-coding portion of #5669 are functionally identical; #7554 repeats that same routing change while adding separate token-sanitization logic. #18694 and #69409 are complementary, not duplicates: they cover persisted-entry loading and environment-pool seeding respectively; #10534 is the merged runtime-resolution subset of #10525.

Suggested consolidation

Keep #69409 open with a salvage path: add the contributor-requested _seed_from_env("kimi-coding-cn", ...) regression tests for both KIMI_CODE_BASE_URL selection and legacy CN-default preservation. Keep #18694 open separately as the recorded best fix for #5908, but require it to preserve non-default stored URLs, integrate with current profile/global fallback semantics, and add pool-to-runtime coverage; leave #5566, #5669, #7554, and #10525 closed, with #10534 retained as the merged CN runtime reference.

Cross-PR triage: Reviewed 7 pull requests and 2 issues in this complex. Diffs were read for 5 of 7 PRs (rest unavailable); Assessment working set: 12 kB of PR diffs, 15 kB of issue/PR text, 5 kB of discussion (11 comments), 10 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.

[theone139344]

Rebased onto latest origin/main (3f832978d) after local re-verify 2026-08-09.

Why still needed: _seed_from_env still only special-cases kimi-coding on main; kimi-coding-cn pool entries stay on api.moonshot.cn/v1, so sk-kimi- keys get 401 and fallback looks like “all models dead”.

Local acceptance (live chat):

• kimi-coding-cn / k3 + kimi-for-coding → HTTP 200 via https://api.kimi.com/coding (anthropic_messages)
• Diff scope: only agent/credential_pool.py (+4/-1)

Please re-run CI.