fix(credential-pool): resolve kimi-coding base URL from API key prefix

[victorGPT]

What does this PR do?

_seed_from_env() resolves provider-specific base URLs when seeding the credential pool from environment variables. It already handles the zai provider via _resolve_zai_base_url(), but kimi-coding was missing the equivalent _resolve_kimi_base_url() call. This caused sk-kimi- prefixed API keys (issued by platform.kimi.ai subscriptions) to always route to api.moonshot.ai/v1 instead of the correct api.kimi.com/coding/v1, resulting in persistent HTTP 400 errors.

Additionally, pasted API keys can pick up invisible terminal escape sequences (e.g. ESC[B, ESC+TAB) that get persisted into the credential pool, breaking the startswith("sk-kimi-") prefix detection. This PR strips such sequences before persisting tokens.

Related Issue

No existing issue — discovered during debugging of Kimi subscription key routing failures.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• agent/credential_pool.py: Added _resolve_kimi_base_url import from hermes_cli.auth
• agent/credential_pool.py: Added kimi-coding branch in _seed_from_env() alongside existing zai handling (line ~1090)
• agent/credential_pool.py: Strip terminal escape sequences from env var tokens before use (line ~1081)

How to Test

1. Set KIMI_API_KEY to a sk-kimi- prefixed key
2. Run hermes with kimi-coding provider and kimi-k2.5 model
3. Verify the endpoint resolves to https://api.kimi.com/coding/v1 (not api.moonshot.ai/v1)
4. Check ~/.hermes/auth.json credential pool entry has the correct base_url

Bonus (escape sequence test):

1. Set KIMI_API_KEY to a value with leading escape chars: export KIMI_API_KEY=$'\x1b[Bsk-kimi-testkey'
2. Run hermes — verify the key is cleaned and routes correctly

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15 (Darwin 25.5.0)

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

[teknium1]

Thanks for the contribution, @victorGPT! This fix was already merged to main by an earlier PR before yours was opened.

Automated hermes-sweeper review found:

• The kimi-coding branch in _seed_from_env() calling _resolve_kimi_base_url is already present at agent/credential_pool.py lines 1325–1326.
• The fix was landed in commit 4d1b98807 ("fix(credential_pool): use _resolve_kimi_base_url when seeding kimi-coding pool", by @SeeYangZhi, fixing kimi-coding credential pool seeds wrong base_url for sk-kimi- keys, causing 401 on first request #5561) and shipped in release v2026.4.13.
• _resolve_kimi_base_url is imported at line 28 of the same file, as your PR also proposes.

The escape-sequence stripping of env var tokens (the bonus item) is not yet on main. If you believe that is a meaningful standalone bug, feel free to open a new focused issue or PR for just that piece.