Login picker: offer all three platforms like the official CLI

The unauthenticated welcome screen previously offered only 'Login with
Kimi Code'. It now lists every interactive platform the shell
advertises, matching the official kimi-cli picker:

  Kimi Code (OAuth)
  Moonshot Open Platform (API key · moonshot.cn)
  Moonshot Open Platform (API key · moonshot.ai)
  Quit

- Shell: new ACP auth methods moonshot-cn / moonshot-ai (advertised
  after kimi-code; the BYOK first-position invariant holds).
  authenticate(moonshot-*) reloads keys from env>config, fails with an
  actionable message when none is configured, validates the key against
  GET {base}/models (401 → 'invalid API key' naming the console), then
  swaps the fresh config in, triggers the model sync, and reports
  auth_mode api_key so the pager treats it like other API-key logins.
  Never session-based; keys never logged.
- Config: save_platform_api_key persists [platforms.<id>].api_key via an
  atomic mode-preserving write under the config lock; refuses OAuth
  platforms, blank keys, and unparseable files.
- TUI: the Pending welcome renders the picker rows from the advertised
  methods (arrows/Enter/mouse; 'l' keeps selecting the OAuth row).
  Choosing a Moonshot row opens a masked paste box ('Paste your Moonshot
  API key (from platform.moonshot.cn)'); Esc returns to the picker,
  Enter persists the key and authenticates in one sequential effect;
  failures return to the picker with the error line, success lands on
  the normal welcome. Startup eager-auth is unchanged: a key already in
  the environment authenticates exactly as before, and single-method
  shells keep the historical auto-device-flow.

Gates: workspace check/clippy 0/0; shell 4870 + tui 6620 lib tests
green; headless probe advertises [kimi-code, moonshot-cn, moonshot-ai]
for a fresh user and xai.api_key-first with a key configured.

crates/codegen/kigi-tui/src/acp/mod.rs

@@ -909,6 +909,57 @@ mod tests {
         assert_eq!(mode, AuthStartMode::Pending);
     }
 
+    /// CROSS-CRATE: the moonshot picker methods must not change startup.
+    ///
+    /// - Fresh user: `kimi-code` is still `auth_methods.first()` → login
+    ///   screen; the interactive fallback still resolves to `kimi-code`.
+    /// - Configured moonshot key (BYOK shape, the headless
+    ///   `KIGI_MOONSHOT_CN_API_KEY`-only e2e): eager auth selects
+    ///   `xai.api_key` via `default_auth_method_id` — NEVER a moonshot
+    ///   method. The moonshot ids exist for the interactive picker only.
+    #[test]
+    fn moonshot_methods_are_never_selected_for_eager_auth() {
+        use kigi_shell::agent::auth_method::{
+            AuthMethodsBuildInputs, KIMI_CODE_METHOD_ID, MOONSHOT_AI_METHOD_ID,
+            MOONSHOT_CN_METHOD_ID, XAI_API_KEY_METHOD_ID, build_auth_methods,
+        };
+
+        let fresh = build_auth_methods(AuthMethodsBuildInputs {
+            has_external_api_key: false,
+            has_cached_token: false,
+            login_label: None,
+        });
+        let (needs, _, method_id, _) = startup_auth_metadata(&fresh.methods);
+        assert!(needs, "fresh user must still hit the login screen");
+        assert_eq!(method_id.unwrap().0.as_ref(), KIMI_CODE_METHOD_ID);
+        let (_, fallback_id, _) = find_interactive_login_method(&fresh.methods);
+        assert_eq!(
+            fallback_id.unwrap().0.as_ref(),
+            KIMI_CODE_METHOD_ID,
+            "the interactive fallback must stay the OAuth device login"
+        );
+
+        let byok = build_auth_methods(AuthMethodsBuildInputs {
+            has_external_api_key: true,
+            has_cached_token: false,
+            login_label: None,
+        });
+        let (needs, _, _, _) = startup_auth_metadata(&byok.methods);
+        assert!(
+            !needs,
+            "a configured key must keep skipping the login screen"
+        );
+        let selected =
+            select_eager_auth_method(&byok.methods, byok.default_auth_method_id.as_ref())
+                .expect("eager method must resolve");
+        assert_eq!(selected.0.as_ref(), XAI_API_KEY_METHOD_ID);
+        assert!(
+            selected.0.as_ref() != MOONSHOT_CN_METHOD_ID
+                && selected.0.as_ref() != MOONSHOT_AI_METHOD_ID,
+            "eager auth must never pick a moonshot picker method"
+        );
+    }
+
     /// Inverse direction: when `xai.api_key` is NOT in the list, the pager
     /// MUST show the login screen. We assert this with `xai.api_key` present
     /// LATER in the list (the shape of a past regression) and confirm the

crates/codegen/kigi-tui/src/app/actions.rs

@@ -569,6 +569,15 @@ pub enum Action {
     CancelLogin,
     /// User submitted a manually-pasted auth token (loopback mode).
     SubmitAuthCode(String),
+    /// User selected a Moonshot row on the welcome login picker: switch the
+    /// welcome screen into API-key entry for that platform.
+    BeginPlatformKeyEntry(crate::app::app_view::PlatformLogin),
+    /// Esc from the API-key entry box: return to the login picker.
+    CancelPlatformKeyEntry,
+    /// User submitted a pasted Moonshot API key: persist it to
+    /// `[platforms.<id>]` in config.toml, then authenticate with the
+    /// platform's method id. The key must never be logged.
+    SubmitPlatformApiKey(String),
     /// Copy the auth URL to the clipboard during authentication.
     CopyAuthUrl,
     /// Show the raw auth URL with mouse capture disabled for manual copy.
@@ -1611,6 +1620,14 @@ pub enum Effect {
     PollAuthUrl { request_seq: u64 },
     /// Submit a manually-pasted auth code (ext request).
     SubmitAuthCode { request_seq: u64, code: String },
+    /// Persist a Moonshot API key to `[platforms.<id>]` in config.toml, then
+    /// send AuthenticateRequest with the platform's method id. SECURITY: the
+    /// key must never appear in logs or errors.
+    PersistPlatformApiKeyAndAuthenticate {
+        request_seq: u64,
+        target: crate::app::app_view::PlatformLogin,
+        key: String,
+    },
     /// Fetch MCP server list from the shell (kigi/mcp/list).
     FetchMcpsList {
         agent_id: AgentId,

crates/codegen/kigi-tui/src/app/app_view.rs

@@ -260,6 +260,117 @@ pub enum AuthMode {
     Loopback,
     /// RFC 8628 device flow: device code + copyable URL, no paste box.
     Device,
+    /// Open-platform API-key entry: paste box for a Moonshot key selected
+    /// from the welcome login picker. Esc returns to the picker (no quit).
+    ApiKeyEntry(PlatformLogin),
+}
+/// Open-platform API-key login target, selected from the welcome picker.
+/// Mirrors the shell's `moonshot-cn` / `moonshot-ai` interactive auth
+/// methods ([`kigi_shell::agent::auth_method`]).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PlatformLogin {
+    MoonshotCn,
+    MoonshotAi,
+}
+impl PlatformLogin {
+    /// The picker target behind an advertised ACP method id; `None` for every
+    /// non-moonshot method.
+    pub fn from_method_id(id: &acp::AuthMethodId) -> Option<Self> {
+        match id.0.as_ref() {
+            kigi_shell::agent::auth_method::MOONSHOT_CN_METHOD_ID => Some(Self::MoonshotCn),
+            kigi_shell::agent::auth_method::MOONSHOT_AI_METHOD_ID => Some(Self::MoonshotAi),
+            _ => None,
+        }
+    }
+    /// The registry platform whose `[platforms.<id>]` table stores the key.
+    pub fn platform_id(self) -> kigi_shell::models::PlatformId {
+        match self {
+            Self::MoonshotCn => kigi_shell::models::PlatformId::MoonshotCn,
+            Self::MoonshotAi => kigi_shell::models::PlatformId::MoonshotAi,
+        }
+    }
+    /// The ACP auth method id to `authenticate` with after persisting the key.
+    pub fn method_id(self) -> acp::AuthMethodId {
+        acp::AuthMethodId::new(self.platform_id().as_str())
+    }
+    /// Console host shown in the paste-box copy.
+    pub fn console_host(self) -> &'static str {
+        match self {
+            Self::MoonshotCn => "platform.moonshot.cn",
+            Self::MoonshotAi => "platform.moonshot.ai",
+        }
+    }
+}
+/// One row of the unauthenticated welcome menu (the login picker).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PendingMenuItem {
+    /// Interactive OAuth login (the existing `kimi-code` device flow).
+    Login {
+        label: String,
+    },
+    /// Open-platform API-key entry.
+    ApiKey {
+        target: PlatformLogin,
+        label: String,
+    },
+    Quit,
+}
+impl PendingMenuItem {
+    /// Shortcut-column text for this row (`l` on the OAuth row for
+    /// muscle-memory compat, `q` on Quit).
+    pub fn shortcut(&self, index: usize) -> &'static str {
+        match self {
+            Self::Login { .. } if index == 0 => "l",
+            Self::Quit => "q",
+            _ => "",
+        }
+    }
+    pub fn label(&self) -> &str {
+        match self {
+            Self::Login { label } | Self::ApiKey { label, .. } => label,
+            Self::Quit => "Quit",
+        }
+    }
+}
+/// Build the welcome login-picker rows from the shell-advertised methods:
+/// every INTERACTIVE method — the OAuth device login plus the Moonshot
+/// API-key logins — followed by Quit. `xai.api_key` and `cached_token` are
+/// non-interactive (eager-auth only) and never listed. When the shell
+/// advertises no interactive method at all (fail-closed `preferred_method`
+/// pins, old agents), fall back to the historical single Login row so the
+/// screen keeps its shape and `Action::Login` surfaces the proper error.
+pub fn pending_menu_items(
+    auth_methods: &[acp::AuthMethod],
+    login_label: Option<&str>,
+) -> Vec<PendingMenuItem> {
+    use kigi_shell::agent::auth_method::AuthMethodKind;
+    let mut items: Vec<PendingMenuItem> = Vec::new();
+    for method in auth_methods {
+        if let Some(target) = PlatformLogin::from_method_id(method.id()) {
+            items.push(PendingMenuItem::ApiKey {
+                target,
+                label: method.name().to_string(),
+            });
+        } else if AuthMethodKind::from_id(method.id()).needs_interactive_login() {
+            items.push(PendingMenuItem::Login {
+                label: format!("{} (OAuth)", method.name()),
+            });
+        }
+    }
+    if items.is_empty() {
+        items.push(PendingMenuItem::Login {
+            label: format!("Login with {}", login_label.unwrap_or("kimi.com")),
+        });
+    }
+    items.push(PendingMenuItem::Quit);
+    items
+}
+/// True when the login picker offers a real choice (more than one login row
+/// besides Quit). Startup then lands on the picker instead of auto-starting
+/// the OAuth device flow; single-choice shells keep the historical
+/// auto-trigger.
+pub fn login_picker_has_choice(auth_methods: &[acp::AuthMethod]) -> bool {
+    pending_menu_items(auth_methods, None).len() > 2
 }
 /// Folder-trust state for the welcome screen.
 ///
@@ -1517,6 +1628,7 @@ impl AppView {
                     trust_state: &self.trust_state,
                     cwd: &self.cwd,
                     mid_session_login: self.auth_return_view.is_some(),
+                    auth_methods: &self.auth_methods,
                     auth_code_input: &mut self.auth_code_input,
                     prompt: &mut self.welcome_prompt,
                     prompt_focused: &mut self.welcome_prompt_focused,
@@ -2049,6 +2161,9 @@ struct WelcomeInputCtx<'a> {
     /// that was started from inside a session. Esc / `q` then cancel the
     /// login and return to the session rather than quitting the app.
     mid_session_login: bool,
+    /// Shell-advertised auth methods — drives the login-picker rows shown in
+    /// the `AuthState::Pending` welcome menu.
+    auth_methods: &'a [acp::AuthMethod],
     auth_code_input: &'a mut String,
     prompt: &'a mut PromptWidget,
     prompt_focused: &'a mut bool,
@@ -2515,8 +2630,17 @@ fn handle_welcome_input(ev: &Event, ctx: &mut WelcomeInputCtx<'_>) -> InputOutco
                     }
                     return InputOutcome::Action(Action::QuitConfirmed);
                 }
-                if key!('l').matches(key) || key!(Enter).matches(key) {
-                    return InputOutcome::Action(Action::Login);
+                let items = pending_menu_items(ctx.auth_methods, None);
+                if let Some(outcome) = handle_menu_nav(key, ctx.menu_index, items.len()) {
+                    return outcome;
+                }
+                // 'l' keeps its muscle-memory meaning: the first (OAuth) row.
+                if key!('l').matches(key) {
+                    return dispatch_pending_menu_action(&items, 0);
+                }
+                if key!(Enter).matches(key) {
+                    let index = ctx.menu_index.filter(|i| *i < items.len()).unwrap_or(0);
+                    return dispatch_pending_menu_action(&items, index);
                 }
             }
             AuthState::Authenticating { .. } if *ctx.show_raw_url => {
@@ -2525,6 +2649,37 @@ fn handle_welcome_input(ev: &Event, ctx: &mut WelcomeInputCtx<'_>) -> InputOutco
                 }
                 return InputOutcome::Unchanged;
             }
+            AuthState::Authenticating {
+                mode: AuthMode::ApiKeyEntry(_),
+                ..
+            } => {
+                // Esc cancels BACK TO THE PICKER (unlike the OAuth flows,
+                // where Esc quits): the user chose this row a keystroke ago.
+                if key!(Esc).matches(key) {
+                    return InputOutcome::Action(Action::CancelPlatformKeyEntry);
+                }
+                if key!('q', CONTROL).matches(key) || key!('c', CONTROL).matches(key) {
+                    if ctx.mid_session_login {
+                        return InputOutcome::Action(Action::CancelLogin);
+                    }
+                    return InputOutcome::Action(Action::QuitConfirmed);
+                }
+                if key!(Enter).matches(key) {
+                    let trimmed = ctx.auth_code_input.trim().to_string();
+                    if !trimmed.is_empty() {
+                        return InputOutcome::Action(Action::SubmitPlatformApiKey(trimmed));
+                    }
+                    return InputOutcome::Unchanged;
+                }
+                if key!(Backspace).matches(key) {
+                    ctx.auth_code_input.pop();
+                    return InputOutcome::Changed;
+                }
+                if let crossterm::event::KeyCode::Char(c) = key.code {
+                    ctx.auth_code_input.push(c);
+                    return InputOutcome::Changed;
+                }
+            }
             AuthState::Authenticating {
                 mode: AuthMode::Loopback,
                 ..
@@ -2573,7 +2728,7 @@ fn handle_welcome_input(ev: &Event, ctx: &mut WelcomeInputCtx<'_>) -> InputOutco
                 return InputOutcome::ActionThenForward(Action::NewSession);
             }
             AuthState::Authenticating {
-                mode: AuthMode::Loopback,
+                mode: AuthMode::Loopback | AuthMode::ApiKeyEntry(_),
                 ..
             } => {
                 let cleaned: String = text.chars().filter(|c| *c != '\n' && *c != '\r').collect();
@@ -2597,7 +2752,8 @@ fn handle_welcome_input(ev: &Event, ctx: &mut WelcomeInputCtx<'_>) -> InputOutco
                         && mouse.row < rect.y + rect.height
                     {
                         if matches!(ctx.auth_state, AuthState::Pending { .. }) {
-                            return dispatch_pending_menu_action(i);
+                            let items = pending_menu_items(ctx.auth_methods, None);
+                            return dispatch_pending_menu_action(&items, i);
                         }
                         if ctx.has_claude_import
                             && i == 0
@@ -2715,13 +2871,16 @@ fn handle_menu_nav(
         _ => None,
     }
 }
-/// Dispatch an action for a welcome menu item when not yet authenticated.
-/// Menu layout: 0 = Login, 1 = Quit.
-fn dispatch_pending_menu_action(index: usize) -> InputOutcome {
-    match index {
-        0 => InputOutcome::Action(Action::Login),
-        1 => InputOutcome::Action(Action::Quit),
-        _ => InputOutcome::Unchanged,
+/// Dispatch an action for a welcome login-picker row (not yet authenticated).
+/// Rows come from [`pending_menu_items`]: interactive methods + Quit.
+fn dispatch_pending_menu_action(items: &[PendingMenuItem], index: usize) -> InputOutcome {
+    match items.get(index) {
+        Some(PendingMenuItem::Login { .. }) => InputOutcome::Action(Action::Login),
+        Some(PendingMenuItem::ApiKey { target, .. }) => {
+            InputOutcome::Action(Action::BeginPlatformKeyEntry(*target))
+        }
+        Some(PendingMenuItem::Quit) => InputOutcome::Action(Action::Quit),
+        None => InputOutcome::Unchanged,
     }
 }
 /// Dispatch an action for a welcome menu item by index.
@@ -3073,6 +3232,7 @@ impl AppView {
                             cwd: &self.cwd,
                             auth_state: &self.auth_state,
                             trust_state: &self.trust_state,
+                            auth_methods: &self.auth_methods,
                             login_label: self.login_label.as_deref(),
                             auth_code_input: &self.auth_code_input,
                             clipboard_copied: self.auth_clipboard_copied,
@@ -6841,6 +7001,133 @@ pub(crate) mod tests {
         let outcome = app.handle_input(&key_event(KeyCode::Char('n'), KeyModifiers::NONE));
         assert!(matches!(outcome, InputOutcome::Unchanged));
     }
+    /// The shell's fresh-user auth methods (kimi-code + both moonshot
+    /// platforms) map to picker rows: OAuth first, then the two API-key rows,
+    /// then Quit.
+    fn fresh_user_auth_methods() -> Vec<acp::AuthMethod> {
+        kigi_shell::agent::auth_method::build_auth_methods(
+            kigi_shell::agent::auth_method::AuthMethodsBuildInputs {
+                has_external_api_key: false,
+                has_cached_token: false,
+                login_label: None,
+            },
+        )
+        .methods
+    }
+    #[test]
+    fn pending_menu_items_lists_interactive_methods_plus_quit() {
+        let items = pending_menu_items(&fresh_user_auth_methods(), None);
+        assert_eq!(items.len(), 4, "3 login rows + Quit, got {items:?}");
+        assert!(
+            matches!(&items[0], PendingMenuItem::Login { label } if label == "Kimi Code (OAuth)"),
+            "row 0 must be the OAuth login, got {:?}",
+            items[0]
+        );
+        assert_eq!(
+            items[1],
+            PendingMenuItem::ApiKey {
+                target: PlatformLogin::MoonshotCn,
+                label: "Moonshot Open Platform (API key \u{b7} moonshot.cn)".into(),
+            }
+        );
+        assert_eq!(
+            items[2],
+            PendingMenuItem::ApiKey {
+                target: PlatformLogin::MoonshotAi,
+                label: "Moonshot Open Platform (API key \u{b7} moonshot.ai)".into(),
+            }
+        );
+        assert_eq!(items[3], PendingMenuItem::Quit);
+        // The non-interactive methods must never appear as rows.
+        let byok = kigi_shell::agent::auth_method::build_auth_methods(
+            kigi_shell::agent::auth_method::AuthMethodsBuildInputs {
+                has_external_api_key: true,
+                has_cached_token: true,
+                login_label: None,
+            },
+        );
+        assert_eq!(
+            pending_menu_items(&byok.methods, None).len(),
+            4,
+            "xai.api_key / cached_token must not add rows"
+        );
+    }
+    /// Startup lands on the picker only when there is a real choice: the
+    /// three-method shell has one, an old kimi-code-only shell (or an empty
+    /// list) does not — those keep the auto-triggered device flow.
+    #[test]
+    fn login_picker_has_choice_only_with_multiple_login_rows() {
+        assert!(login_picker_has_choice(&fresh_user_auth_methods()));
+        let kimi_only = vec![kigi_shell::agent::auth_method::kimi_code_auth_method(None)];
+        assert!(!login_picker_has_choice(&kimi_only));
+        assert!(!login_picker_has_choice(&[]));
+    }
+    /// With all three methods advertised, arrows+Enter select a Moonshot row
+    /// and 'l' keeps selecting the first (OAuth) row.
+    #[test]
+    fn welcome_pending_arrows_select_moonshot_row() {
+        let mut app = test_app();
+        app.auth_methods = fresh_user_auth_methods();
+        app.auth_state = AuthState::Pending { error: None };
+        app.welcome_prompt_focused = false;
+        // Down → row 0 (OAuth), Down → row 1 (moonshot-cn).
+        app.handle_input(&key_event(KeyCode::Down, KeyModifiers::NONE));
+        app.handle_input(&key_event(KeyCode::Down, KeyModifiers::NONE));
+        let outcome = app.handle_input(&key_event(KeyCode::Enter, KeyModifiers::NONE));
+        assert!(
+            matches!(
+                outcome,
+                InputOutcome::Action(Action::BeginPlatformKeyEntry(PlatformLogin::MoonshotCn))
+            ),
+            "Enter on row 1 must open moonshot-cn key entry, got {outcome:?}"
+        );
+        // 'l' is muscle-memory for the first (OAuth) row regardless of the
+        // arrow selection.
+        let outcome = app.handle_input(&key_event(KeyCode::Char('l'), KeyModifiers::NONE));
+        assert!(matches!(outcome, InputOutcome::Action(Action::Login)));
+    }
+    #[test]
+    fn welcome_api_key_entry_esc_returns_to_picker() {
+        let mut app = test_app();
+        app.auth_state = AuthState::Authenticating {
+            request_seq: 1,
+            handle: None,
+            auth_url: None,
+            mode: AuthMode::ApiKeyEntry(PlatformLogin::MoonshotCn),
+        };
+        let outcome = app.handle_input(&key_event(KeyCode::Esc, KeyModifiers::NONE));
+        assert!(
+            matches!(
+                outcome,
+                InputOutcome::Action(Action::CancelPlatformKeyEntry)
+            ),
+            "Esc must cancel back to the picker, got {outcome:?}"
+        );
+    }
+    #[test]
+    fn welcome_api_key_entry_enter_submits_typed_key() {
+        let mut app = test_app();
+        app.auth_state = AuthState::Authenticating {
+            request_seq: 1,
+            handle: None,
+            auth_url: None,
+            mode: AuthMode::ApiKeyEntry(PlatformLogin::MoonshotAi),
+        };
+        // Empty input: Enter is a no-op.
+        let outcome = app.handle_input(&key_event(KeyCode::Enter, KeyModifiers::NONE));
+        assert!(matches!(outcome, InputOutcome::Unchanged));
+        for c in "sk-42".chars() {
+            app.handle_input(&key_event(KeyCode::Char(c), KeyModifiers::NONE));
+        }
+        assert_eq!(app.auth_code_input, "sk-42");
+        let outcome = app.handle_input(&key_event(KeyCode::Enter, KeyModifiers::NONE));
+        match outcome {
+            InputOutcome::Action(Action::SubmitPlatformApiKey(key)) => {
+                assert_eq!(key, "sk-42");
+            }
+            other => panic!("expected SubmitPlatformApiKey, got {other:?}"),
+        }
+    }
     #[test]
     fn welcome_done_n_starts_session() {
         let mut app = test_app();

crates/codegen/kigi-tui/src/app/dispatch/auth.rs

@@ -7,7 +7,7 @@ use super::session::lifecycle::{clear_startup_actions, drain_startup_actions};
 use crate::app::actions::{Action, Effect};
 use crate::app::agent::AgentId;
 use crate::app::agent_view::AgentView;
-use crate::app::app_view::{ActiveView, AppView, AuthMode, AuthState};
+use crate::app::app_view::{ActiveView, AppView, AuthMode, AuthState, PlatformLogin};
 use crate::scrollback::block::RenderBlock;
 use crate::scrollback::blocks::SessionEvent;
 
@@ -252,6 +252,74 @@ pub(super) fn dispatch_submit_auth_code(app: &mut AppView, code: String) -> Vec<
     vec![Effect::SubmitAuthCode { request_seq, code }]
 }
 
+/// A Moonshot row was selected on the welcome login picker: switch the
+/// welcome screen into the API-key paste box for that platform.
+pub(super) fn dispatch_begin_platform_key_entry(
+    app: &mut AppView,
+    target: PlatformLogin,
+) -> Vec<Effect> {
+    let request_seq = app.next_auth_request_seq;
+    app.next_auth_request_seq += 1;
+    app.auth_code_input.clear();
+    app.auth_state = AuthState::Authenticating {
+        request_seq,
+        handle: None,
+        auth_url: None,
+        mode: AuthMode::ApiKeyEntry(target),
+    };
+    vec![]
+}
+
+/// Esc in the API-key paste box: back to the login picker (no error line).
+/// Bumps the request seq so any stale in-flight auth result is dropped by
+/// the `AuthComplete`/`AuthFailed` guards.
+pub(super) fn dispatch_cancel_platform_key_entry(app: &mut AppView) -> Vec<Effect> {
+    if !matches!(
+        app.auth_state,
+        AuthState::Authenticating {
+            mode: AuthMode::ApiKeyEntry(_),
+            ..
+        }
+    ) {
+        return vec![];
+    }
+    app.next_auth_request_seq += 1;
+    app.auth_code_input.clear();
+    app.auth_state = AuthState::Pending { error: None };
+    vec![]
+}
+
+/// Enter with a non-empty key in the API-key paste box: persist the key to
+/// `[platforms.<id>]` in config.toml, then authenticate with the platform's
+/// method id (one sequential background task — see the effect handler).
+/// The screen shows the connecting state while the key is validated; a
+/// failure lands back on the picker with the error line (`AuthFailed`).
+pub(super) fn dispatch_submit_platform_api_key(app: &mut AppView, key: String) -> Vec<Effect> {
+    let (request_seq, target) = match &app.auth_state {
+        AuthState::Authenticating {
+            request_seq,
+            mode: AuthMode::ApiKeyEntry(target),
+            ..
+        } => (*request_seq, *target),
+        _ => return vec![],
+    };
+    let key = key.trim().to_string();
+    if key.is_empty() {
+        return vec![];
+    }
+    app.auth_state = AuthState::Authenticating {
+        request_seq,
+        handle: None,
+        auth_url: None,
+        mode: AuthMode::Pending,
+    };
+    vec![Effect::PersistPlatformApiKeyAndAuthenticate {
+        request_seq,
+        target,
+        key,
+    }]
+}
+
 // TaskResult handlers.
 
 pub(super) fn handle_auth_complete(

crates/codegen/kigi-tui/src/app/dispatch/router.rs

@@ -1,6 +1,7 @@
 //! Top-level action router: maps actions and action results to handlers.
 use super::auth::{
-    dispatch_cancel_login, dispatch_login, dispatch_logout, dispatch_submit_auth_code,
+    dispatch_begin_platform_key_entry, dispatch_cancel_login, dispatch_cancel_platform_key_entry,
+    dispatch_login, dispatch_logout, dispatch_submit_auth_code, dispatch_submit_platform_api_key,
     dispatch_switch_account,
 };
 use super::ctx::{
@@ -880,6 +881,9 @@ pub(crate) fn dispatch(action: Action, app: &mut AppView) -> Vec<Effect> {
         Action::Login => dispatch_login(app),
         Action::CancelLogin => dispatch_cancel_login(app),
         Action::SubmitAuthCode(code) => dispatch_submit_auth_code(app, code),
+        Action::BeginPlatformKeyEntry(target) => dispatch_begin_platform_key_entry(app, target),
+        Action::CancelPlatformKeyEntry => dispatch_cancel_platform_key_entry(app),
+        Action::SubmitPlatformApiKey(key) => dispatch_submit_platform_api_key(app, key),
         Action::CopyAuthUrl => {
             if let AuthState::Authenticating {
                 auth_url: Some(url),

crates/codegen/kigi-tui/src/app/dispatch/tests/auth.rs

@@ -100,6 +100,120 @@ fn auth_complete_with_deferred_load_also_fetches_status() {
     assert!(app.deferred_startup.session.is_none());
 }
 
+/// The Moonshot API-key entry flow: picking a row opens the paste box,
+/// submitting a key dispatches ONE effect that persists the key and then
+/// authenticates with the platform's method id, and the visual flips to the
+/// connecting state under the same request seq.
+#[test]
+fn submit_platform_api_key_dispatches_persist_then_authenticate() {
+    use crate::app::app_view::PlatformLogin;
+
+    let mut app = test_app();
+    app.auth_state = AuthState::Pending { error: None };
+
+    let effects = dispatch(
+        Action::BeginPlatformKeyEntry(PlatformLogin::MoonshotCn),
+        &mut app,
+    );
+    assert!(effects.is_empty(), "entering key entry is UI-only");
+    let seq = match &app.auth_state {
+        AuthState::Authenticating {
+            request_seq,
+            mode: AuthMode::ApiKeyEntry(PlatformLogin::MoonshotCn),
+            ..
+        } => *request_seq,
+        other => panic!("expected ApiKeyEntry(MoonshotCn), got {other:?}"),
+    };
+
+    let effects = dispatch(Action::SubmitPlatformApiKey("sk-test-key".into()), &mut app);
+    match effects.as_slice() {
+        [
+            Effect::PersistPlatformApiKeyAndAuthenticate {
+                request_seq,
+                target,
+                key,
+            },
+        ] => {
+            assert_eq!(*request_seq, seq);
+            assert_eq!(*target, PlatformLogin::MoonshotCn);
+            assert_eq!(key, "sk-test-key");
+            assert_eq!(
+                target.method_id().0.as_ref(),
+                "moonshot-cn",
+                "authenticate must use the shell's moonshot-cn method id"
+            );
+        }
+        other => panic!("expected exactly the persist+authenticate effect, got {other:?}"),
+    }
+    // Same seq, connecting visual: this attempt's AuthComplete/AuthFailed
+    // still matches.
+    assert!(matches!(
+        app.auth_state,
+        AuthState::Authenticating {
+            request_seq,
+            mode: AuthMode::Pending,
+            ..
+        } if request_seq == seq
+    ));
+
+    // Failed validation lands back on the picker with the error line.
+    dispatch(
+        Action::TaskComplete(TaskResult::AuthFailed {
+            request_seq: seq,
+            error: "Invalid API key for moonshot-cn".into(),
+        }),
+        &mut app,
+    );
+    assert!(matches!(
+        &app.auth_state,
+        AuthState::Pending { error: Some(e) } if e == "Invalid API key for moonshot-cn"
+    ));
+}
+
+/// Esc in the paste box returns to the picker (no error), clears the typed
+/// key, and invalidates the seq so stale auth results are dropped.
+#[test]
+fn cancel_platform_key_entry_returns_to_picker() {
+    use crate::app::app_view::PlatformLogin;
+
+    let mut app = test_app();
+    app.auth_state = AuthState::Pending { error: None };
+    dispatch(
+        Action::BeginPlatformKeyEntry(PlatformLogin::MoonshotAi),
+        &mut app,
+    );
+    app.auth_code_input = "sk-half-typed".into();
+    let seq_before = app.next_auth_request_seq;
+
+    let effects = dispatch(Action::CancelPlatformKeyEntry, &mut app);
+    assert!(effects.is_empty());
+    assert!(matches!(app.auth_state, AuthState::Pending { error: None }));
+    assert!(app.auth_code_input.is_empty(), "typed key must be cleared");
+    assert!(app.next_auth_request_seq > seq_before);
+}
+
+/// A submitted empty/whitespace key is a no-op (stays in the paste box).
+#[test]
+fn submit_platform_api_key_ignores_blank_key() {
+    use crate::app::app_view::PlatformLogin;
+
+    let mut app = test_app();
+    app.auth_state = AuthState::Pending { error: None };
+    dispatch(
+        Action::BeginPlatformKeyEntry(PlatformLogin::MoonshotCn),
+        &mut app,
+    );
+    let effects = dispatch(Action::SubmitPlatformApiKey("   ".into()), &mut app);
+    assert!(effects.is_empty());
+    assert!(matches!(
+        app.auth_state,
+        AuthState::Authenticating {
+            mode: AuthMode::ApiKeyEntry(PlatformLogin::MoonshotCn),
+            ..
+        }
+    ));
+}
+
 /// `/login` from the welcome screen (startup / logged-out) must NOT
 /// stash a return view — the normal login-then-load flow is preserved.
 #[test]

crates/codegen/kigi-tui/src/app/effects/mod.rs

@@ -1895,6 +1895,35 @@ pub(crate) fn execute(
                     }
                 });
         }
+        Effect::PersistPlatformApiKeyAndAuthenticate { request_seq, target, key } => {
+            let tx = acp_tx.clone();
+            let abort_handle = tasks
+                .spawn(async move {
+                    // Persist first so the shell's authenticate handler
+                    // (which re-reads config + env) finds the key. The
+                    // writer's errors never contain the key.
+                    if let Err(e) = kigi_shell::agent::config::save_platform_api_key(
+                            target.platform_id(),
+                            &key,
+                        )
+                        .await
+                    {
+                        let error = format!("Couldn't save API key: {e}");
+                        ulog::error(
+                            "platform api key persist failed",
+                            None,
+                            Some(serde_json::json!({ "error" : & error })),
+                        );
+                        return TaskResult::AuthFailed {
+                            request_seq,
+                            error,
+                        };
+                    }
+                    send_authenticate(&tx, request_seq, target.method_id(), false, false)
+                        .await
+                });
+            meta.auth_abort_handle = Some((request_seq, abort_handle));
+        }
         Effect::SubmitAuthCode { request_seq, code } => {
             let tx = acp_tx.clone();
             tasks

crates/codegen/kigi-tui/src/app/event_loop.rs

@@ -683,6 +683,13 @@ pub(crate) async fn run(
                 error: Some("No login method available".to_string()),
             };
             vec![]
+        } else if super::app_view::login_picker_has_choice(&app.auth_methods) {
+            // Multiple interactive login choices (OAuth + Moonshot API-key
+            // rows): land on the login picker instead of auto-starting the
+            // device flow, so the user can choose a platform. Single-choice
+            // shells keep the historical auto-trigger below.
+            app.auth_state = super::app_view::AuthState::Pending { error: None };
+            vec![]
         } else {
             dispatch::dispatch(Action::Login, &mut app)
         }

crates/codegen/kigi-tui/src/views/welcome/mod.rs

@@ -12,7 +12,11 @@ use ratatui::style::{Modifier, Style};
 use ratatui::text::{Line, Span};
 use ratatui::widgets::{Block, Borders, Padding, Paragraph, Widget, Wrap};
 
-use crate::app::app_view::{AuthMode, AuthState, SessionPickerEntry, TrustState};
+use agent_client_protocol as acp;
+
+use crate::app::app_view::{
+    AuthMode, AuthState, PendingMenuItem, SessionPickerEntry, TrustState, pending_menu_items,
+};
 use crate::startup::StartupWarning;
 use crate::theme::Theme;
 use crate::views::prompt_widget::{PromptFlag, PromptInfo, PromptWidget};
@@ -524,6 +528,9 @@ pub struct WelcomeRenderParams<'a> {
     /// Folder-trust state. When `Pending` (auth done, access granted), the
     /// welcome screen renders the trust question instead of the normal prompt.
     pub trust_state: &'a TrustState,
+    /// Shell-advertised auth methods — the login picker lists the interactive
+    /// ones (see [`pending_menu_items`]).
+    pub auth_methods: &'a [acp::AuthMethod],
     pub login_label: Option<&'a str>,
     pub auth_code_input: &'a str,
     pub clipboard_copied: bool,
@@ -602,9 +609,14 @@ pub fn render_welcome(
 
     let mut result = match params.auth_state {
         AuthState::Pending { error } => {
-            let label = params.login_label.unwrap_or("kimi.com");
-            let login_text = format!("Login with {}", label);
-            let menu = [("l", login_text.as_str()), ("q", "Quit")];
+            // Login picker: one row per interactive method + Quit.
+            let items: Vec<PendingMenuItem> =
+                pending_menu_items(params.auth_methods, params.login_label);
+            let menu: Vec<(&str, &str)> = items
+                .iter()
+                .enumerate()
+                .map(|(i, item)| (item.shortcut(i), item.label()))
+                .collect();
             let msg = error.as_deref().map(|e| (e, theme.accent_error));
             let info = PromptInfo {
                 model_name: params.model_name,
@@ -1278,7 +1290,13 @@ fn render_welcome_authenticating(
             ])
             .flex(Flex::Center)
             .areas(prompt_area);
-            render_auth_input_box(prompt_centered, buf, theme, auth_code_input);
+            render_auth_input_box(
+                prompt_centered,
+                buf,
+                theme,
+                auth_code_input,
+                "Paste your token here...",
+            );
 
             // Hints
             let mut hint_spans = vec![
@@ -1297,6 +1315,78 @@ fn render_welcome_authenticating(
             (click_rect, fallback_rect)
         }
 
+        AuthMode::ApiKeyEntry(target) => {
+            // Moonshot API-key paste box: instruction + input + hints. No
+            // auth-URL machinery — the key comes from the platform console.
+            let h_pad: u16 = content_area.width / 6;
+            let inner_width = content_area.width.saturating_sub(h_pad * 2).max(1);
+            let instruction = format!(
+                "Paste your Moonshot API key (from {})",
+                target.console_host()
+            );
+            let msg_height = (instruction.len() as u16).div_ceil(inner_width);
+            let [_, logo_area, _, msg_area, _, prompt_area, _, hint_area, _] = Layout::vertical([
+                Constraint::Length(top_pad),
+                Constraint::Length(logo_line_count),
+                Constraint::Length(1),          // gap
+                Constraint::Length(msg_height), // instruction
+                Constraint::Min(1),             // gap
+                Constraint::Length(5),          // prompt box
+                Constraint::Length(1),          // gap
+                Constraint::Length(1),          // hints
+                Constraint::Min(0),
+            ])
+            .areas(content_area);
+
+            render_logo(logo_area, buf, theme, content_area.height);
+
+            let msg = Line::from(Span::styled(
+                instruction,
+                Style::default().fg(theme.gray_bright),
+            ))
+            .alignment(Alignment::Center);
+            Paragraph::new(msg)
+                .wrap(Wrap { trim: false })
+                .block(Block::default().padding(Padding::horizontal(h_pad)))
+                .render(msg_area, buf);
+
+            let [_, prompt_centered, _] = Layout::horizontal([
+                Constraint::Min(0),
+                Constraint::Length(content_area.width),
+                Constraint::Min(0),
+            ])
+            .flex(Flex::Center)
+            .areas(prompt_area);
+            render_auth_input_box(
+                prompt_centered,
+                buf,
+                theme,
+                auth_code_input,
+                "Paste your API key here...",
+            );
+
+            let hints = Line::from(vec![
+                Span::styled(
+                    "enter",
+                    Style::default()
+                        .fg(theme.accent_user)
+                        .add_modifier(Modifier::BOLD),
+                ),
+                Span::styled("  submit    ", Style::default().fg(theme.gray)),
+                Span::styled(
+                    "esc",
+                    Style::default()
+                        .fg(theme.accent_user)
+                        .add_modifier(Modifier::BOLD),
+                ),
+                Span::styled("  back", Style::default().fg(theme.gray)),
+            ])
+            .alignment(Alignment::Center);
+            Paragraph::new(hints).render(hint_area, buf);
+
+            (None, None)
+        }
+
         AuthMode::Command => render_browser_status_arm(
             content_area,
             buf,
@@ -2008,7 +2098,13 @@ pub(crate) fn render_session_picker(
 }
 
 /// Render the auth token input box (loopback mode).
-fn render_auth_input_box(area: Rect, buf: &mut Buffer, theme: &Theme, input: &str) {
+fn render_auth_input_box(
+    area: Rect,
+    buf: &mut Buffer,
+    theme: &Theme,
+    input: &str,
+    placeholder: &str,
+) {
     let prompt_block = Block::default()
         .borders(Borders::ALL)
         .border_style(Style::default().fg(theme.accent_user))
@@ -2022,7 +2118,11 @@ fn render_auth_input_box(area: Rect, buf: &mut Buffer, theme: &Theme, input: &st
     prompt_block.render(area, buf);
 
     if inner.height > 0 && inner.width > 2 {
-        let display = mask_auth_token_for_display(input);
+        let display = if input.is_empty() {
+            placeholder.to_string()
+        } else {
+            mask_auth_token_for_display(input)
+        };
 
         let style = if input.is_empty() {
             Style::default().fg(theme.gray_dim)
@@ -2151,6 +2251,7 @@ mod tests {
             prompt_focus: WelcomePromptFocus::Unfocused,
             auth_state,
             trust_state,
+            auth_methods: &[],
             login_label: None,
             auth_code_input: "",
             clipboard_copied: false,
@@ -2191,6 +2292,93 @@ mod tests {
         buffer_text(&buf)
     }
 
+    /// The unauthenticated welcome menu lists one row per interactive login
+    /// method — the OAuth device login plus BOTH Moonshot open platforms —
+    /// and Quit, when the shell advertises all three.
+    #[test]
+    fn pending_menu_lists_three_login_rows_plus_quit() {
+        use kigi_shell::agent::auth_method::{AuthMethodsBuildInputs, build_auth_methods};
+        let built = build_auth_methods(AuthMethodsBuildInputs {
+            has_external_api_key: false,
+            has_cached_token: false,
+            login_label: None,
+        });
+        let auth = AuthState::Pending { error: None };
+        let trust = TrustState::Done;
+        let mut params = render_params(&auth, &trust, None);
+        params.auth_methods = &built.methods;
+        let text = render_done_text(&params);
+        assert!(text.contains("Kimi Code (OAuth)"), "{text}");
+        assert!(
+            text.contains("Moonshot Open Platform (API key \u{b7} moonshot.cn)"),
+            "{text}"
+        );
+        assert!(
+            text.contains("Moonshot Open Platform (API key \u{b7} moonshot.ai)"),
+            "{text}"
+        );
+        assert!(text.contains("Quit"), "{text}");
+        // Shortcut hints for muscle memory: `l` (first row) and `q` (Quit).
+        assert!(text.contains('l'), "{text}");
+        assert!(text.contains('q'), "{text}");
+    }
+
+    /// An old/limited shell that advertises only `kimi-code` keeps the
+    /// two-row shape (single login row + Quit) — and never a Moonshot row.
+    #[test]
+    fn pending_menu_without_moonshot_methods_keeps_two_rows() {
+        let methods = vec![kigi_shell::agent::auth_method::kimi_code_auth_method(None)];
+        let auth = AuthState::Pending { error: None };
+        let trust = TrustState::Done;
+        let mut params = render_params(&auth, &trust, None);
+        params.auth_methods = &methods;
+        let text = render_done_text(&params);
+        assert!(text.contains("Kimi Code (OAuth)"), "{text}");
+        assert!(!text.contains("Moonshot"), "{text}");
+    }
+
+    /// The Moonshot API-key entry arm renders the platform copy, the paste
+    /// box, and the esc-back hint — and no OAuth-URL affordances.
+    #[test]
+    fn api_key_entry_arm_shows_platform_copy_and_paste_box() {
+        let area = Rect::new(0, 0, 80, 40);
+        let mut buf = Buffer::empty(area);
+        let theme = Theme::current();
+
+        let (copy_rect, fallback_rect) = render_welcome_authenticating(
+            area,
+            &mut buf,
+            &theme,
+            logo_line_count(area.height),
+            None, // auth_url — none in key-entry mode
+            AuthMode::ApiKeyEntry(crate::app::app_view::PlatformLogin::MoonshotCn),
+            "",    // auth_code_input
+            false, // clipboard_copied
+            false, // show_raw_url
+        );
+
+        let text = buffer_text(&buf);
+        // The instruction may soft-wrap; assert its two halves (each stays an
+        // intact word run on one row).
+        assert!(
+            text.contains("Paste your Moonshot API key"),
+            "key-entry arm must show the platform instruction, got:\n{text}"
+        );
+        assert!(
+            text.contains("platform.moonshot.cn"),
+            "key-entry arm must name the platform console, got:\n{text}"
+        );
+        assert!(
+            text.contains("Paste your API key here..."),
+            "key-entry arm must render the paste box placeholder, got:\n{text}"
+        );
+        assert!(
+            text.contains("esc") && text.contains("back"),
+            "key-entry arm must hint esc-back, got:\n{text}"
+        );
+        assert!(copy_rect.is_none() && fallback_rect.is_none());
+    }
+
     #[test]
     fn foreign_resume_tip_names_each_tool_and_age() {
         use kigi_workspace::foreign_sessions::ForeignSessionTool;