fix(kimi-web): migrate to www.kimi.com Connect-RPC API (kimi.moonshot.cn retired)

[janeza2]

Summary

kimi-web is completely broken: the legacy kimi.moonshot.cn consumer chat domain was retired and now 307-redirects every non-CN visitor to https://www.kimi.com/, which speaks a completely different API. This PR repoints the provider at the international domain and reimplements the executor against the new wire format.

The earlier issue #5813 sketched the migration; this PR is the working implementation, validated end-to-end against a live Plus-tier overseas session.

New wire format (verified live)

Aspect	Old (kimi.moonshot.cn)	New (www.kimi.com)
Endpoint	POST /api/chat	POST /apiv2/kimi.gateway.chat.v1.ChatService/Chat
Protocol	REST JSON	Connect-RPC (application/connect+json)
Auth	cookie kimi_token	JWT in Authorization: Bearer … + Cookie: kimi-auth=<jwt>
Body	plain JSON	Connect streaming envelope — 5-byte header (flags + big-endian length) wrapping JSON. Without the envelope the upstream returns invalid_argument for every request.
Response	OpenAI-style SSE	Connect-framed stream of JSON events keyed by op + mask

Response event schema

op=set,     mask=block.text             → first answer chunk
op=append,  mask=block.text.content     → answer delta
op=set,     mask=block.think            → first reasoning chunk
op=append,  mask=block.think.content    → reasoning delta
op=set,     mask=block.stage / multiStage → stage transitions (suppressed)
{heartbeat:{}}                           → keep-alive (suppressed)
op=set,     message.role=assistant + status=MESSAGE_STATUS_COMPLETED → end of stream

The executor translates block.think.content deltas to OpenAI reasoning_content and block.text.content deltas to OpenAI content (SSE for streaming, buffered JSON for non-streaming).

Auth handling

Users paste the full Cookie header from www.kimi.com. The executor's extractKimiJwt accepts:

• bare JWT
• kimi-auth=<jwt> inside a full Cookie header
• Cookie: or Authorization: Bearer prefixed forms

Only kimi-auth is replayed back to the upstream — analytics cookies (_ga, _gcl_au, __cf_bm, HM*, …) are dropped.

Headers — what is and isn't required

Tested against a live session by stripping headers one at a time:

Header	Required?
Authorization: Bearer <jwt>	✅ yes
Cookie: kimi-auth=<jwt>	✅ yes
connect-protocol-version: 1	✅ yes
Content-Type: application/connect+json	✅ yes (any other value → UnsupportedMediaType)
Connect framing on body	✅ yes (without it → invalid_argument)
x-msh-platform / x-msh-version	❌ not required
x-msh-device-id / x-msh-session-id / x-traffic-id	❌ not required
x-msh-shield-data	❌ not required (not the anti-bot gate it might look like)
x-language / r-timezone	❌ not required

The 4 "test matrix" runs (full headers / no bx-ua / no x-msh-* at all / minimal set) all produced the same Connect-framed event stream with model output (1+1=2).

Commits

1. validator — new specialty validateKimiWebProvider probing GET /api/user; registered in the dispatcher so kimi-web no longer falls through to the generic OpenAI-compatible probe that hit the retired .cn host.
2. executor + registry + metadata + docs — rewrites KimiWebExecutor for Connect-RPC; updates baseUrl, website/authHint, i18n strings (en, zh-CN, ru), tokenExtractionConfig, provider reference. Other locales were already in __MISSING__ fallback state and pick up the English source via the existing pipeline.
3. tests — pins the executor URL (asserts www.kimi.com and explicitly !moonshot.cn), the missing-JWT 400 short-circuit, and the extractKimiJwt parser across all accepted input forms. Updates the existing web-cookie-sweep tests to feed a kimi-auth credential and assert the international URL.

Test plan

• npm run typecheck:core — passes (only pre-existing unrelated appConfig.ts errors)
• ReadLints — clean on all changed files (the two pre-existing node:test / duckduckgo-web type errors in web-cookie-providers-new.test.ts / webSessionCredentials.ts exist on upstream/main already)
• Manual end-to-end against live www.kimi.com — chat completion returns the correct Connect-framed stream with reasoning + answer (1+1=2)
• Manual matrix sweep of x-msh-* headers — confirmed not required
• CI test-unit — needs upstream CI to run (local checkout lacks the cross-env / tsx runtime used by npm run test:unit)

Notes for reviewers

• The model catalog is updated to { kimi-default, kimi-k2.6, kimi-128k }. The scenario value is pinned to SCENARIO_K2D5 (the only one the SPA sends today); if Kimi ships a new scenario we'll need to revisit.
• The Connect frame parser is hand-rolled (5 bytes header + length-prefixed JSON). It is small enough that pulling in a Connect-RPC client dependency is not worth it.
• The kimi-auth JWT is now treated as a long-lived bearer token. Expiry handling relies on the existing web-cookie refresh path — if the SPA rotates the JWT on the next login, the user re-pastes a fresh Cookie header (same UX as qwen-web).
• Closes feat(providers): Add support for international domain (www.kimi.com) — currently CN-only #5813.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[diegosouzapw]

Thanks @janeza2! Best PR of this review round — the Connect-RPC decoder is defensive (sign-extension, partial frames, 8MiB cap) and superbly tested. We resolved the release-branch conflicts, regenerated PROVIDER_REFERENCE, and added a one-line extractKimiJwt re-export the tests needed (kept you as author). Merged into release/v3.8.43. 🙌