feat(kimi): sync Code, Web, and Moonshot providers

[backryun]

Summary

• align Kimi Code with the current CLI contract, including K3 discovery, OAuth/API-key authentication under one provider card, protocol-aware routing, thinking metadata, token refresh, and usage handling
• update Kimi Web to the current access-token and Connect-RPC request/stream contract, with a curated k3/k2d6 catalog and no remote model import path
• add Moonshot-specific model metadata and request normalization for Kimi K3, K2.7 Code, and K2.6 while retaining hidden legacy provider aliases for compatibility

Why

The existing Kimi integrations represented authentication modes as separate visible providers and relied on stale cookie, model-discovery, and generic OpenAI-compatible assumptions. Those assumptions no longer matched the current Kimi Code CLI, Kimi Web client, or Moonshot API contracts.

Impact

• users see one Kimi Code CLI provider and can choose OAuth or Kimi Code API Key when adding a connection
• Kimi Code routes each discovered model through its declared OpenAI or Anthropic protocol and preserves its supported thinking policy
• Kimi Web exposes only the intentionally supported curated models and no longer presents model import/sync behavior
• Moonshot requests apply model-specific reasoning, sampling, tool-choice, replay, and usage normalization

Validation

• npm run lint
• npm run typecheck:core
• npm run check:cycles
• 23 changed Node test files: 342 tests passed
• dashboard provider Vitest: 2 tests passed
• provider consistency and build-scope checks passed
• Webpack production build completed and generated all 635 pages (OMNIROUTE_USE_TURBOPACK=0 npm run build)
• git diff --check

Local build note

The default Turbopack invocation cannot follow this Windows worktree's junctioned node_modules directory because it points outside the worktree filesystem root. The supported Webpack fallback completed successfully; the remaining non-fatal standalone asset-copy warning is caused by the same junction resolving source and destination to the same directory.

CI Follow-up (2026-07-17)

• Fast Quality Gates initially exceeded the structural/cognitive complexity ratchets at 2063 / 893.
• Kimi/Moonshot request normalization, runtime metadata, discovery, and managed-import paths were decomposed into focused helpers without changing their routing behavior; the final counts are 2056 / 890.
• Fixed the dashboard onboarding regression by explicitly typing the new hiddenFromDashboard property access. The frozen dashboard error baseline was not widened.
• Targeted Kimi/Moonshot validation, ESLint, core typecheck, complexity checks, and the post-amend GitHub Actions run all passed: 13 passed, 2 intentionally skipped, 0 failed.

Rebase Follow-up (2026-07-17)

• Rebased the implementation commit onto release/v3.8.49 at 873e3da62.
• Resolved the translator conflict by retaining the updated connection-level cache-control policy and Responses tool-schema normalization together with Kimi/Moonshot authentic reasoning preservation and Moonshot video_url handling.
• Revalidated full ESLint, core typecheck, complexity ratchets, and all 342 tests across the 23 changed Node test files. The translate-path golden's parsed expected/actual JSON remains structurally identical.

Root Refresh (2026-07-17, 93e217e76)

• Rebased the Kimi implementation onto the latest release/v3.8.49 root at 93e217e76375d1e250708ea0d0ce85618d346a89.
• Upstream provider additions raised the aggregate structural-complexity count by one. The existing NVIDIA and Kimi paired-provider branches were consolidated into a static same-file alias map, preserving lookup behavior while restoring the ratchet to 2056 / 2056.
• Full ESLint, core typecheck, and all 342 tests across the 23 changed Node test files passed. No golden or complexity baseline was changed.
• The final rebase range-diff maps the amended implementation commit one-to-one with no further patch changes.

Root Refresh (2026-07-18, ed4944e77)

• Rebased the Kimi implementation commit onto the latest release/v3.8.49 root at ed4944e771d3e5dba944534414cf470c85598f22.
• Range-diff reports the implementation patch unchanged; git diff --check and core typecheck passed.
• Complexity is 2058 structural / 890 cognitive, exactly matching a clean checkout of this root; the two structural violations above the 2056 baseline are inherited from upstream.
• No golden file or quality baseline was changed.

Recovery Audit (2026-07-18, e6f81d827)

• Rebased the Kimi implementation onto the current release/v3.8.49 root at e6f81d827e5d92f13fd4ac157f82dd1e6bc7bd1a.
• Reduced branch-owned gate growth without changing behavior: NVIDIA/Kimi credential aliases now share one two-entry provider-pair table; the provider-route test verifies Kimi authentication and the essential normalized model result while the dedicated discovery suite owns detailed capability mapping; stale extraction-phase comments were removed.
• Frozen files are now below their limits: ProviderDetailPageClient.tsx 785 / 786, auth.ts 2460 / 2461, and provider-models-route.test.ts 1739 / 1752. All 342 tests across the changed Node test files, core typecheck, file-size, and strict docs-count gates pass.
• No PR golden or quality baseline was changed. Remaining red checks are inherited from the current root: the mutation gate is missing tests/unit/microsoft-designer-web-6672.test.ts from Stryker tap.testFiles; the new freetheai alias collides with the test fixture prefix fta, the translate-path golden does not yet contain freetheai, and structural complexity is 2058 against the committed 2056 baseline. Cognitive complexity is 890 / 890.

[gemini-code-assist]

Code Review

This pull request refactors the Kimi and Moonshot provider integrations, migrating Kimi Web to use curated static models and access tokens from localStorage, introducing a dedicated MoonshotExecutor for native Moonshot API compatibility, and updating Kimi Coding to support both OpenAI and Claude protocols with CLI identity headers. It also updates the dashboard UI to support curated-only model catalogs and Kimi Code CLI authentication methods. The review feedback identifies two important issues: a performance concern where synchronous execFileSync calls during token refresh block the Node.js event loop (suggesting global caching of the device model), and a potential API compatibility bug in kimi-web.ts where explicit null values for tools or functions could trigger unexpected 400 errors.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[diegosouzapw]

Thanks for the thorough Kimi/Moonshot sync — this is a well-scoped, well-tested rewrite (resolvePublicCred used correctly for the public client id, errors routed through the existing makeExecutorErrorResult/sanitizeErrorMessage pattern, no any introduced, lint clean, and the 42+94 tests I ran locally across the core touched files all pass). The two currently-red CI checks (Fast Quality Gates complexity ratchet, and the translate-path golden) both trace to the same cause: your branch's merge-base predates a same-day release-tip commit (a5714f3) that bumped the complexity baseline 2056->2058 and regenerated the golden for an unrelated freetheai/#6772 alias landing. A rebase onto the current release/v3.8.49 tip plus an UPDATE_GOLDEN=1 regen should turn both green without touching your own logic — we'll drive that rebase and merge once it's confirmed net-zero on complexity.

[backryun]

Thanks for the thorough Kimi/Moonshot sync — this is a well-scoped, well-tested rewrite (resolvePublicCred used correctly for the public client id, errors routed through the existing makeExecutorErrorResult/sanitizeErrorMessage pattern, no any introduced, lint clean, and the 42+94 tests I ran locally across the core touched files all pass). The two currently-red CI checks (Fast Quality Gates complexity ratchet, and the translate-path golden) both trace to the same cause: your branch's merge-base predates a same-day release-tip commit (a5714f3) that bumped the complexity baseline 2056->2058 and regenerated the golden for an unrelated freetheai/#6772 alias landing. A rebase onto the current release/v3.8.49 tip plus an UPDATE_GOLDEN=1 regen should turn both green without touching your own logic — we'll drive that rebase and merge once it's confirmed net-zero on complexity.

I've just addressed the issue you requested. Is it ready for merging now?

[diegosouzapw]

Merged into release/v3.8.49 — thank you for the contribution, @backryun! 🎉 Validated in today's full-suite merge-train (33 PRs, 19k+ tests green) before landing.