§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok' crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party license archives, README provenance, and the required 'Based on Grok Build Open Source' attribution, now sourced from version_attribution.txt). Wire-visible renames (both sides in this repo, changed in lockstep): - Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode). - Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* / _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps a read-side alias for the legacy '_x.ai/session/update' method so existing updates.jsonl histories load; writes emit only the new name (both directions test-pinned). - Agent types grok-build* → kigi* with a documented legacy-prefix alias at resolution time so persisted sessions keep resolving. - ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build implementation dirs renamed to kigi*. - x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes grokday/groknight → kigiday/kiginight (old persisted values fall back to the default theme), web_fetch allowlist xAI hosts → kimi.com + moonshot platforms, changelog CDN → this repo, grok-build changelog archives deleted. - BYOK default endpoint removed: [endpoints] api_base_url is now truly optional with NO default — consumers fail fast with the flag name when unset (no silent x.ai egress). Mock harnesses inject it explicitly. - System-prompt identity fixed: 'released by xAI' → 'an unofficial community CLI for Kimi' (template + regenerated encrypted form). Also repaired pre-existing grok-era test debt found by the sweep: the stale trace_classify default-model pin, the grok-pager UA label test, pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY test could previously reach the real api.moonshot.cn), and the outdated oauth fixture scope key. Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings); FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed; deny advisories ok.
2026-07-18 02:48:46 -04:00
parent 86e3724310
commit 6f31415ed6
1056 changed files with 8410 additions and 18307 deletions
@@ -1,9 +1,9 @@
 //! rmcp transport bridge over the ACP reverse channel.
 //!
-//! In-process SDK MCP servers (the official `grok-agent-sdk`'s `@tool` /
+//! In-process SDK MCP servers (the official `kigi-agent-sdk`'s `@tool` /
 //! `create_sdk_mcp_server`) run in the SDK-host process, not behind a socket. The
 //! agent reaches them by sending each MCP JSON-RPC message to the client as a
-//! reverse `x.ai/mcp/sdk_call` request and feeding the response back. This module
+//! reverse `kigi/mcp/sdk_call` request and feeding the response back. This module
 //! adapts that request/response channel into an rmcp transport so an in-process
 //! server reuses the same `RunningService` / tool-dispatch path as HTTP/stdio
 //! servers for tool calls.
@@ -28,7 +28,7 @@ use serde_json::Value;
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader, DuplexStream};

 /// Sends one MCP JSON-RPC message to an in-process server over the ACP reverse
-/// channel (`x.ai/mcp/sdk_call`) and returns its JSON-RPC response. The `Err` string is
+/// channel (`kigi/mcp/sdk_call`) and returns its JSON-RPC response. The `Err` string is
 /// surfaced as a JSON-RPC error to the waiting rmcp request (fail-closed: a missing
 /// tool server is a real error, unlike a hook gate).
 ///
@@ -65,7 +65,7 @@ const INTERNAL_ERROR_CODE: i64 = -32603;
 /// Build an rmcp transport that bridges to an in-process MCP server via `invoker`.
 ///
 /// Spawns a pump that forwards each client→server message as a reverse
-/// `x.ai/mcp/sdk_call` and writes the server→client response back. The pump exits when
+/// `kigi/mcp/sdk_call` and writes the server→client response back. The pump exits when
 /// rmcp drops its half of the duplex (service shutdown), so it never leaks.
 ///
 /// `invoke_timeout` is the resolved per-server tool timeout; it bounds every reverse
@@ -159,7 +159,7 @@ async fn read_requests(
            }
        };
        // An id-less message is a notification (no response). The SDK peer rejects reverse
-        // `x.ai/mcp/sdk_call`s without a JSON-RPC id, so id-less messages (e.g. rmcp's
+        // `kigi/mcp/sdk_call`s without a JSON-RPC id, so id-less messages (e.g. rmcp's
        // `notifications/initialized` on every handshake) are logged and discarded locally
        // rather than spawning a doomed round-trip. Safe only because the SDK `Server` is
        // lenient about never receiving `initialized` (a documented v1 limit).
@@ -77,7 +77,7 @@ impl McpCredentialStore {
    /// Save the credential store to the default path.
    pub fn save_default(&self) -> Result<()> {
        let path = Self::default_path().ok_or_else(|| {
-            McpCredentialError::Other("no user grok home (set $KIGI_SHARE_DIR or $HOME)".into())
+            McpCredentialError::Other("no user kigi home (set $KIGI_SHARE_DIR or $HOME)".into())
        })?;
        self.save_to(&path)
    }
@@ -99,7 +99,7 @@ impl McpCredentialStore {
        creds: rmcp::transport::auth::StoredCredentials,
    ) -> Result<()> {
        let path = Self::default_path().ok_or_else(|| {
-            McpCredentialError::Other("no user grok home (set $KIGI_SHARE_DIR or $HOME)".into())
+            McpCredentialError::Other("no user kigi home (set $KIGI_SHARE_DIR or $HOME)".into())
        })?;
        let lock_path = path.with_extension("lock");

@@ -417,7 +417,7 @@ mod tests {

    #[test]
    fn save_and_load_from_file() {
-        let dir = std::env::temp_dir().join("grok-mcp-credentials-test");
+        let dir = std::env::temp_dir().join("kigi-mcp-credentials-test");
        std::fs::create_dir_all(&dir).unwrap();
        let path = dir.join("test_creds.json");

@@ -22,7 +22,7 @@ use crate::rmcp::transport::auth::{AuthorizationManager, OAuthClientConfig};
 /// Client name advertised to MCP servers during Dynamic Client Registration
 /// (RFC 7591). Surfaces as the application name on third-party OAuth consent
 /// screens (e.g. Linear, GitHub), so keep this human-recognizable.
-const MCP_OAUTH_CLIENT_NAME: &str = "Grok";
+const MCP_OAUTH_CLIENT_NAME: &str = "Kigi";

 /// How often the interactive OAuth flow polls the credential store to detect
 /// a login completed in another window or process.
@@ -31,7 +31,7 @@ const CREDENTIAL_POLL_INTERVAL: std::time::Duration = std::time::Duration::from_
 // ---------------------------------------------------------------------------
 // Two-layer dedup: prevents duplicate browser tabs both within one process
 // (multiple async tasks / sessions) and across separate processes (leader
-// mode disabled, multiple `grok` invocations).
+// mode disabled, multiple `kigi` invocations).
 //
 // Layer 1 (cross-process): filesystem lock at $KIGI_SHARE_DIR/mcp_auth_{safe_name}.lock
 // Layer 2 (in-process):    watch channel so only one task runs the flow
@@ -310,10 +310,10 @@ impl InitProgress {
 }

 /// One in-process SDK MCP server registration: its tool-namespace name and the
-/// SDK-side id echoed back in `x.ai/mcp/sdk_call`. A named struct (rather than a
+/// SDK-side id echoed back in `kigi/mcp/sdk_call`. A named struct (rather than a
 /// `(String, String)` tuple) so callers can't transpose the two strings.
 ///
-/// `Deserialize`d straight from a `_meta["x.ai/mcp/servers"]` entry, so the
+/// `Deserialize`d straight from a `_meta["kigi/mcp/servers"]` entry, so the
 /// `serverId` wire field name is declared (and serde-checked) exactly once here.
 #[derive(Debug, Clone, serde::Deserialize)]
 pub struct AcpServerEntry {
@@ -322,7 +322,7 @@ pub struct AcpServerEntry {
    pub server_id: String,
 }

-/// The session's in-process SDK MCP servers (declared via `_meta["x.ai/mcp/servers"]`,
+/// The session's in-process SDK MCP servers (declared via `_meta["kigi/mcp/servers"]`,
 /// reached over the ACP reverse channel), bundled with the shared reverse-RPC invoker.
 /// Held as `McpState::acp_mcp: Option<_>` so the set is one atom — present together or
 /// absent, never "servers without an invoker" — and survives `update_configs` clears
@@ -332,7 +332,7 @@ struct AcpMcpRegistry {
    /// Registered servers (`name -> serverId`).
    servers: Vec<AcpServerEntry>,
    /// Shared reverse-RPC invoker all these servers' tools are called through (emits
-    /// `x.ai/mcp/sdk_call` over the ACP connection).
+    /// `kigi/mcp/sdk_call` over the ACP connection).
    invoker: Arc<dyn crate::acp_transport::AcpReverseInvoker>,
 }

@@ -381,7 +381,7 @@ pub struct McpState {
    /// task.  When `Some`, the state — and every [`McpClient`] reached
    /// through [`Self::all_clients`] / [`Self::get_client`] — forwards
    /// [`McpClientEvent`]s here for coalescing and fan-out as ACP
-    /// `x.ai/mcp/server_status` notifications.
+    /// `kigi/mcp/server_status` notifications.
    ///
    /// Intentionally `None` in subagent-pool / shared-pool snapshots
    /// ([`SharedMcpPool`]) where the **parent** session is the
@@ -441,7 +441,7 @@ impl McpState {
    /// [`McpClient::set_event_tx`] **before**
    /// `get_tool_registrations` (so `ensure_initialized`'s
    /// `Ready`/`HandshakeFailed` emit fires with `Some(tx)` and the
-    /// `GrokClientHandler` cloned during `try_handshake` reads
+    /// `KigiClientHandler` cloned during `try_handshake` reads
    /// through the same Arc).
    pub fn set_client_event_tx(
        &mut self,
@@ -1219,8 +1219,8 @@ pub struct McpTool {
 ///   so the LLM can invoke them during a conversation.
 /// - **App-visible only** (`["app"]`): not registered in `ToolBridge`, so the LLM
 ///   never sees them. These are UI-only actions (e.g. refresh buttons) surfaced to
-///   the frontend via `x.ai/mcp/tools_changed` notifications and callable via
-///   `x.ai/mcp/call`.
+///   the frontend via `kigi/mcp/tools_changed` notifications and callable via
+///   `kigi/mcp/call`.
 pub struct McpToolRegistration {
    pub name: String,
    pub description: String,
@@ -2201,7 +2201,7 @@ enum PendingTransport {
        auth_manager: Arc<tokio::sync::Mutex<rmcp::transport::auth::AuthorizationManager>>,
    },
    /// In-process SDK MCP server reached over the ACP reverse channel
-    /// (`x.ai/mcp/sdk_call`). Rebuildable from its `server_id` + invoker, so handshake
+    /// (`kigi/mcp/sdk_call`). Rebuildable from its `server_id` + invoker, so handshake
    /// failures restore like Http (unlike the consumed Stdio child).
    Acp {
        server_id: String,
@@ -2210,14 +2210,14 @@ enum PendingTransport {
 }

 /// A connected MCP service (rmcp's RunningService wrapped in Arc).
-/// Uses [`GrokClientHandler`] rather than rmcp's default `ClientInfo`
+/// Uses [`KigiClientHandler`] rather than rmcp's default `ClientInfo`
 /// handler: rmcp 2.1 parameterizes `RunningService` over the handler
 /// type, and `ClientInfo` is only a `ClientHandler` impl with no
 /// notification routing. The custom handler keeps the same protocol
 /// behavior (same `get_info`) while plumbing
 /// `tools/list_changed` / `resources/list_changed` notifications
 /// through to the session-actor dispatcher.
-pub type McpService = Arc<RunningService<RoleClient, GrokClientHandler>>;
+pub type McpService = Arc<RunningService<RoleClient, KigiClientHandler>>;

 /// MCP client connection state machine.
 ///
@@ -2290,13 +2290,13 @@ pub enum LivenessCheck {
 /// 1. [`crate::liveness::spawn_transport_liveness`] when an `is_healthy`
 ///    poll observes that the rmcp service loop has shut down its receiver
 ///    (`TransportClosed`).
-/// 2. [`GrokClientHandler`] when the server pushes a notification we
+/// 2. [`KigiClientHandler`] when the server pushes a notification we
 ///    care about — currently `notifications/tools/list_changed` and
 ///    `notifications/resources/list_changed`.
 /// 3. The session/managed-config layer when a server is added, removed,
 ///    or successfully (re-)initialized.
 ///
-/// Consumers fan these out to ACP `x.ai/mcp/server_status` after 50 ms
+/// Consumers fan these out to ACP `kigi/mcp/server_status` after 50 ms
 /// of tumbling-window coalescing keyed by `(server, kind)`; see the
 /// session-actor `StatusDispatcher`.
 #[derive(Debug, Clone)]
@@ -2527,7 +2527,7 @@ pub struct McpClient {
    ///
    /// The slot is `Some` after [`Self::set_event_tx`] is called and
    /// `None` otherwise. The `Arc<Mutex<...>>` is **shared with
-    /// [`GrokClientHandler`]** constructed by
+    /// [`KigiClientHandler`]** constructed by
    /// [`Self::make_client_handler`]: the handler holds a clone of
    /// the same Arc and reads through it on every notification.
    /// Snapshotting the slot at handshake time instead would mean any
@@ -2569,7 +2569,7 @@ pub struct McpClient {
 }

 /// Shared sender slot type — the same Arc lives on the [`McpClient`]
-/// and the [`GrokClientHandler`] it constructs during
+/// and the [`KigiClientHandler`] it constructs during
 /// [`McpClient::try_handshake`]. Mutating the slot via
 /// [`McpClient::set_event_tx`] is observed by the live rmcp service
 /// loop on the next notification, so there's no "snapshot at
@@ -3026,7 +3026,7 @@ impl McpClient {
    }

    /// Build a client for an in-process SDK MCP server reached over the ACP reverse
-    /// channel. `server_id` is the id the agent echoes back in `x.ai/mcp/sdk_call`; the
+    /// channel. `server_id` is the id the agent echoes back in `kigi/mcp/sdk_call`; the
    /// `invoker` performs the reverse request. Same downstream path as HTTP/stdio.
    pub fn new_acp(
        server_name: String,
@@ -3350,7 +3350,7 @@ impl McpClient {
    async fn try_handshake(
        &self,
        pending: PendingTransport,
-    ) -> Result<rmcp::service::RunningService<RoleClient, GrokClientHandler>, McpError> {
+    ) -> Result<rmcp::service::RunningService<RoleClient, KigiClientHandler>, McpError> {
        let timeout = std::time::Duration::from_secs(self.startup_timeout_sec);
        let name = &self.server_name;

@@ -3431,7 +3431,7 @@ impl McpClient {
                    })
            }
            PendingTransport::Acp { server_id, invoker } => {
-                // Per-reverse-call backstop on `x.ai/mcp/sdk_call`: the larger of the
+                // Per-reverse-call backstop on `kigi/mcp/sdk_call`: the larger of the
                // startup and tool timeouts, so it never undercuts the real outer bound
                // (the handshake `initialize` is bounded by the serve `timeout` below;
                // tool calls by `tool_timeout_for` in `try_call_tool`). The bridge
@@ -3468,7 +3468,7 @@ impl McpClient {
        ClientInfo::new(
            capabilities,
            Implementation::new(
-                format!("grok-shell-{server_name}"),
+                format!("kigi-shell-{server_name}"),
                kigi_version::VERSION.to_string(),
            ),
        )
@@ -3478,14 +3478,14 @@ impl McpClient {
        .with_protocol_version(rmcp::model::ProtocolVersion::V_2025_06_18)
    }

-    /// Build the [`GrokClientHandler`] that drives `client.serve(...)`.
+    /// Build the [`KigiClientHandler`] that drives `client.serve(...)`.
    ///
    /// The handler holds a **clone of `Arc<Mutex<Option<Sender>>>`**,
    /// not a snapshot — so any subsequent call to
    /// [`Self::set_event_tx`] is observed by the live rmcp service
    /// loop on its next notification.
-    fn make_client_handler(&self) -> GrokClientHandler {
-        GrokClientHandler {
+    fn make_client_handler(&self) -> KigiClientHandler {
+        KigiClientHandler {
            info: Self::make_client_info(&self.server_name),
            server_name: self.server_name.clone(),
            notify_tx: Arc::clone(&self.notify_tx),
@@ -3495,7 +3495,7 @@ impl McpClient {
    /// Wire a sender for [`McpClientEvent`]s emitted by this client.
    ///
    /// Mutates the shared slot synchronously. All previously-cloned
-    /// references (the [`GrokClientHandler`] handed to
+    /// references (the [`KigiClientHandler`] handed to
    /// `client.serve`, the [`crate::liveness::spawn_transport_liveness`]
    /// task) read through the same Arc, so this is observed
    /// session-wide on the next event.
@@ -4027,7 +4027,7 @@ fn ensure_figma_user_agent(headers: &mut reqwest::header::HeaderMap, server_name
    }
    headers.insert(
        reqwest::header::USER_AGENT,
-        reqwest::header::HeaderValue::from_static("grok-cli"),
+        reqwest::header::HeaderValue::from_static("kigi-cli"),
    );
 }

@@ -4297,7 +4297,7 @@ impl McpClient {
 /// Plumbs server-pushed notifications through an
 /// [`tokio::sync::mpsc::UnboundedSender<McpClientEvent>`] so the
 /// session-actor dispatcher can fan them out as ACP
-/// `x.ai/mcp/server_status` events.
+/// `kigi/mcp/server_status` events.
 ///
 /// ## RPIT, not `#[async_trait]`
 ///
@@ -4322,7 +4322,7 @@ impl McpClient {
 /// send fails silently; rmcp must not see an error from a
 /// notification handler or the service loop tears down.
 #[derive(Debug)]
-pub struct GrokClientHandler {
+pub struct KigiClientHandler {
    /// Static `ClientInfo` returned by [`Self::get_info`]; built once
    /// at handshake time and stored to avoid re-allocating per call.
    info: ClientInfo,
@@ -4337,7 +4337,7 @@ pub struct GrokClientHandler {
    notify_tx: SharedEventTx,
 }

-impl GrokClientHandler {
+impl KigiClientHandler {
    /// Best-effort event emit. Reads the shared `notify_tx` slot on
    /// every call (so the handler picks up any post-handshake wiring
    /// done by [`McpClient::set_event_tx`]). Drops the send error: if
@@ -4352,13 +4352,13 @@ impl GrokClientHandler {
    }
 }

-impl ClientHandler for GrokClientHandler {
+impl ClientHandler for KigiClientHandler {
    // NOTE: `async fn` here is sugar for the trait's
    // `-> impl Future<Output = ()> + Send + '_`. We INTENTIONALLY do
    // not use `#[async_trait]` — rmcp 2.1's `ClientHandler` declares
    // its notification methods as return-position `impl Future`, and
    // async_trait would produce a different (incompatible) signature.
-    // See the [`GrokClientHandler`] doc-comment for the full RPIT
+    // See the [`KigiClientHandler`] doc-comment for the full RPIT
    // contract.
    async fn on_tool_list_changed(&self, _context: NotificationContext<RoleClient>) {
        self.emit(McpClientEvent::ToolsChanged {
@@ -4510,19 +4510,19 @@ mod tests {
    }

    #[test]
-    fn ensure_figma_user_agent_sets_grok_cli_when_missing() {
+    fn ensure_figma_user_agent_sets_kigi_cli_when_missing() {
        let mut headers = reqwest::header::HeaderMap::new();
        ensure_figma_user_agent(&mut headers, "figma", "https://mcp.figma.com/mcp");
        assert_eq!(
            headers.get(reqwest::header::USER_AGENT).unwrap(),
-            "grok-cli"
+            "kigi-cli"
        );

        let mut host_only = reqwest::header::HeaderMap::new();
        ensure_figma_user_agent(&mut host_only, "other", "https://mcp.figma.com/mcp");
        assert_eq!(
            host_only.get(reqwest::header::USER_AGENT).unwrap(),
-            "grok-cli"
+            "kigi-cli"
        );
    }

@@ -6671,7 +6671,7 @@ mod tests {
                    }
                }
            });
-            let handler = GrokClientHandler {
+            let handler = KigiClientHandler {
                info: McpClient::make_client_info("dead"),
                server_name: "dead".to_string(),
                notify_tx: Arc::new(parking_lot::Mutex::new(None)),
@@ -7395,7 +7395,7 @@ mod tests {
        );
    }

-    // -- GrokClientHandler --------------------------------------
+    // -- KigiClientHandler --------------------------------------
    //
    // The handler's notification routing is the only behavior worth
    // unit-testing here; `get_info` is a literal `info.clone()` and
@@ -7409,7 +7409,7 @@ mod tests {
    #[tokio::test]
    async fn client_handler_routes_tools_changed() {
        let (tx, mut rx) = tokio::sync::mpsc::unbounded_channel::<McpClientEvent>();
-        let handler = GrokClientHandler {
+        let handler = KigiClientHandler {
            info: McpClient::make_client_info("test"),
            server_name: "test".to_string(),
            notify_tx: Arc::new(parking_lot::Mutex::new(Some(tx))),
@@ -7429,7 +7429,7 @@ mod tests {
    /// must not panic.
    #[tokio::test]
    async fn client_handler_no_dispatcher_is_silent() {
-        let handler = GrokClientHandler {
+        let handler = KigiClientHandler {
            info: McpClient::make_client_info("test"),
            server_name: "test".to_string(),
            notify_tx: Arc::new(parking_lot::Mutex::new(None)),
@@ -7444,7 +7444,7 @@ mod tests {
    #[tokio::test]
    async fn client_handler_get_info_round_trips() {
        let info = McpClient::make_client_info("test-srv");
-        let handler = GrokClientHandler {
+        let handler = KigiClientHandler {
            info: info.clone(),
            server_name: "test-srv".to_string(),
            notify_tx: Arc::new(parking_lot::Mutex::new(None)),
@@ -1,27 +1,27 @@
-//! Single source of truth for the `x.ai/mcp/*` ACP wire strings.
+//! Single source of truth for the `kigi/mcp/*` ACP wire strings.
 //!
 //! These method/`_meta` keys are part of the cross-language MCP-over-ACP
 //! protocol the SDK speaks (mirrors the SDK's `_mcp_wire.py` / `mcpWire.ts`).
 //! Reference these constants instead of re-typing the literals so the agent and
 //! SDK can't drift apart.

-/// Forward tool-invocation method (client -> agent): `x.ai/mcp/call`.
+/// Forward tool-invocation method (client -> agent): `kigi/mcp/call`.
 ///
 /// The pager/client asks the agent to invoke an MCP tool on a server the agent is
 /// connected to, outside the LLM loop. See `extensions::mcp::handle_call`.
-pub const MCP_CALL: &str = "x.ai/mcp/call";
+pub const MCP_CALL: &str = "kigi/mcp/call";

-/// Reverse zero-IPC tool-invocation method (agent -> client): `x.ai/mcp/sdk_call`.
+/// Reverse zero-IPC tool-invocation method (agent -> client): `kigi/mcp/sdk_call`.
 ///
 /// The agent invokes a tool that lives in the SDK's in-process MCP server by sending
 /// the MCP JSON-RPC message back to the client over the ACP reverse channel. Distinct
 /// from [`MCP_CALL`] so the two disjoint schemas don't share a method string for
 /// metrics/tracing. See the agent-side ACP invoker that handles this method.
-pub const MCP_SDK_CALL: &str = "x.ai/mcp/sdk_call";
+pub const MCP_SDK_CALL: &str = "kigi/mcp/sdk_call";

-/// `session/new` `_meta` key listing in-process SDK MCP servers: `x.ai/mcp/servers`.
-pub const MCP_SERVERS: &str = "x.ai/mcp/servers";
+/// `session/new` `_meta` key listing in-process SDK MCP servers: `kigi/mcp/servers`.
+pub const MCP_SERVERS: &str = "kigi/mcp/servers";

 /// `initialize` `_meta` capability flag advertising in-process SDK MCP support
-/// (enables the SDK's `transport="acp"`): `x.ai/mcp/sdk`.
-pub const MCP_SDK: &str = "x.ai/mcp/sdk";
+/// (enables the SDK's `transport="acp"`): `kigi/mcp/sdk`.
+pub const MCP_SDK: &str = "kigi/mcp/sdk";