§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-tui/src/app/agent_view/cta.rs

@@ -52,7 +52,7 @@ impl AgentView {
         }
     }
 
-    /// Apply an `x.ai/follow_ups` notification, keyed by `response_id`
+    /// Apply an `kigi/follow_ups` notification, keyed by `response_id`
     /// (newest-response-wins).
     ///
     /// Monotonic accept-the-newer: a never-seen `response_id` is strictly newer
@@ -78,7 +78,7 @@ impl AgentView {
     }
 
     /// `apply_follow_ups` with the turn identity (`prompt_id`) the shell stamps
-    /// on each `x.ai/follow_ups` notification (the same `promptId` it stamps on
+    /// on each `kigi/follow_ups` notification (the same `promptId` it stamps on
     /// every `session/update`). The identity makes viewer-adoption dedup
     /// DETERMINISTIC:
     ///
@@ -86,7 +86,7 @@ impl AgentView {
     ///   `prompt_id` equals `session.current_prompt_id`) re-renders even when its
     ///   chips were cleared by turn adoption — so chips that were applied then
     ///   cleared reappear instead of being lost until reload.
-    /// - A buffer-replayed `x.ai/follow_ups` for a PRIOR turn's `response_id`
+    /// - A buffer-replayed `kigi/follow_ups` for a PRIOR turn's `response_id`
     ///   stays rejected by the seen-ring (its `prompt_id` is not the active one),
     ///   so stale chips are never revived on the new turn.
     ///
@@ -219,7 +219,7 @@ impl AgentView {
         true
     }
 
-    /// Buffer a stamped `x.ai/follow_ups` for a turn that is not yet current,
+    /// Buffer a stamped `kigi/follow_ups` for a turn that is not yet current,
     /// keyed by its `promptId`. A newer delivery for the same `promptId`
     /// overwrites the earlier one (keep the latest); the FIFO order list bounds
     /// the map to [`MAX_PENDING_FOLLOW_UPS`], evicting only the oldest entry.
@@ -249,7 +249,7 @@ impl AgentView {
         }
     }
 
-    /// Flush a buffered `x.ai/follow_ups` for `prompt_id` (a turn that has just
+    /// Flush a buffered `kigi/follow_ups` for `prompt_id` (a turn that has just
     /// become current). Renders the chips through [`apply_follow_ups_with_prompt`]
     /// — now that `current_prompt_id == prompt_id`, the stamped delivery is
     /// accepted as the active turn's. Returns whether chips were rendered. A
@@ -292,7 +292,7 @@ impl AgentView {
 
     /// Reload reset that PRESERVES the running turn's follow-ups for
     /// `keep_prompt_id` (the turn the load is about to adopt). On `SessionLoaded`
-    /// the running turn's `x.ai/follow_ups` arrive on the ext channel DURING
+    /// the running turn's `kigi/follow_ups` arrive on the ext channel DURING
     /// `loading_replay`; an unconditional reset would drop them before adoption
     /// could re-render them, so the chips would never appear unless the server
     /// resent them. The running turn's chips live in ONE of two places at reset

crates/codegen/kigi-tui/src/app/agent_view/interactions.rs

@@ -1107,7 +1107,7 @@ impl AgentView {
         self.submit_question_answers(skipped)
     }
     fn submit_question_answers(&mut self, skipped: bool) -> InputOutcome {
-        use kigi_tools::implementations::grok_build::ask_user_question::AskUserQuestionExtResponse;
+        use kigi_tools::implementations::kigi::ask_user_question::AskUserQuestionExtResponse;
         self.swap_question_freeform();
         let Some(mut qv) = self.question_view.take() else {
             return InputOutcome::Changed;
@@ -1594,7 +1594,7 @@ mod permission_scope_key_tests {
 #[cfg(test)]
 mod question_no_freeform_tests {
     //! Freeform ("Other") gating for `no_freeform` question modals — e.g.
-    //! the SuperGrok upsell. Regression tests for the bug where clicking
+    //! the subscription upsell. Regression tests for the bug where clicking
     //! under the last option of the upsell selected the (hidden) freeform
     //! row and let the user type into a modal that offers no free text.
     use super::super::test_fixtures::make_agent;
@@ -1605,7 +1605,7 @@ mod question_no_freeform_tests {
     use crossterm::event::{
         KeyCode, KeyEvent, KeyModifiers, MouseButton, MouseEvent, MouseEventKind,
     };
-    use kigi_tools::implementations::grok_build::ask_user_question::{Question, QuestionOption};
+    use kigi_tools::implementations::kigi::ask_user_question::{Question, QuestionOption};
     use ratatui::buffer::Buffer;
     use ratatui::layout::Rect;
     /// Fixed options, single-select — shaped like the free-usage upsell.

crates/codegen/kigi-tui/src/app/agent_view/mod.rs

@@ -200,7 +200,7 @@ impl McpInitProgress {
     /// Whether the progress indicator should be visible in the UI.
     ///
     /// - `total > 0` (real servers): always visible until
-    ///   `x.ai/mcp_initialized` clears the progress.
+    ///   `kigi/mcp_initialized` clears the progress.
     /// - `total == 0` (seed / 0-server): visible for at most
     ///   [`SEED_EXPIRE`] seconds, then auto-expires as
     ///   defense-in-depth against the shell failing to send
@@ -559,7 +559,7 @@ pub(crate) struct SessionReload {
     saw_todo_update: bool,
 }
 /// Follow-up suggestion chips for the latest assistant response
-/// (`x.ai/follow_ups`). Streaming-only: never persisted, does not survive a
+/// (`kigi/follow_ups`). Streaming-only: never persisted, does not survive a
 /// session reload. Keyed by the assistant `response_id` (the newest-wins key).
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) struct FollowUps {
@@ -799,7 +799,7 @@ pub struct AgentView {
     /// answering questions via `AskUserQuestion`). Reset when the turn ends.
     pub turn_paused_duration: std::time::Duration,
     /// IDs of interjections this client sent and already rendered locally
-    /// (optimistic echo). The shell broadcasts `x.ai/session/interjection` to
+    /// (optimistic echo). The shell broadcasts `kigi/session/interjection` to
     /// every attached pane; when our own broadcast echoes back carrying an id
     /// in this set, `handle_interjection` drops it (we already showed it) and
     /// removes the id. Other panes (which lack the id) render it. This is the
@@ -1133,7 +1133,7 @@ pub struct AgentView {
     /// (`When::DashboardOverlay`) are lit in the overlay and dimmed elsewhere.
     pub(crate) in_dashboard_overlay: bool,
     /// MCP server init progress. Set when the shell starts connecting
-    /// MCP servers, cleared when `x.ai/mcp_initialized` arrives.
+    /// MCP servers, cleared when `kigi/mcp_initialized` arrives.
     /// Shown in the turn status line while the agent is idle.
     pub(crate) mcp_init_progress: Option<McpInitProgress>,
     /// Last synced ACP command generation. When this differs from
@@ -1206,7 +1206,7 @@ pub struct AgentView {
     /// lands on a tick; borrowed during render so streaming redraws don't
     /// rescan/allocate the prompt every frame.
     pub(crate) timeline_hover_preview: Option<(usize, String)>,
-    /// Running agent definition for this session (`x.ai/session/info` `agentName`).
+    /// Running agent definition for this session (`kigi/session/info` `agentName`).
     pub session_agent_name: Option<String>,
     /// Map of child session IDs to subagent metadata. Populated on
     /// `SubagentSpawned` notifications, used for permission routing
@@ -1286,7 +1286,7 @@ pub struct AgentView {
     /// complete. Kind-only: the payload is re-derived from the widget on
     /// reissue so the freshly attached image chip travels with it.
     pub(crate) deferred_send: Option<AgentDeferredSend>,
-    /// Armed when an `x.ai/session/prompt_complete` broadcast arrives for the
+    /// Armed when an `kigi/session/prompt_complete` broadcast arrives for the
     /// turn THIS client drives while it is still awaiting that turn's
     /// `session/prompt` RPC response. The RPC normally lands milliseconds
     /// later and disarms this; if it never does (lost in leader response
@@ -1317,17 +1317,17 @@ pub struct AgentView {
     pub(crate) follow_without_jump_prompt_id: Option<String>,
     /// Ids of THIS client's server-queue rows that are still optimistic
     /// echoes — the `session/prompt` RPC is in flight and no
-    /// `x.ai/queue/changed` broadcast has confirmed the row yet. Inserted by
+    /// `kigi/queue/changed` broadcast has confirmed the row yet. Inserted by
     /// the echo push, drained when a broadcast lists the id (queued or
     /// running) or the RPC resolves without the row landing.
     pub(crate) optimistic_queue_ids: std::collections::HashSet<String>,
     /// A queue-row send-now the user fired while the row was still an
-    /// optimistic echo. Firing `x.ai/queue/interject` then would race the
+    /// optimistic echo. Firing `kigi/queue/interject` then would race the
     /// row's own in-flight `session/prompt` and silently no-op shell-side
     /// (a rapid double-Enter on a queued bash command could "disappear" — the
     /// interject overtook the row, the no-op dropped the send-now, and the
     /// armed cancel expectation hid the still-queued row).
-    /// Parked here and fired from the confirming `x.ai/queue/changed`
+    /// Parked here and fired from the confirming `kigi/queue/changed`
     /// broadcast with the row's authoritative version.
     pub(crate) send_now_awaiting_confirm: Option<String>,
     /// User blocks painted at send-now dispatch, keyed by prompt id; the
@@ -1337,7 +1337,7 @@ pub struct AgentView {
     pub(crate) send_now_painted_blocks:
         std::collections::HashMap<String, (crate::scrollback::EntryId, bool)>,
     /// Follow-up suggestion chips for the latest assistant response
-    /// (`x.ai/follow_ups`). `None` when no chips are shown. Set by
+    /// (`kigi/follow_ups`). `None` when no chips are shown. Set by
     /// [`AgentView::apply_follow_ups`]; cleared at each turn start.
     pub(crate) follow_ups: Option<FollowUps>,
     /// `promptId` (turn identity) of the currently-shown `follow_ups`, when the
@@ -1371,7 +1371,7 @@ pub struct AgentView {
     /// The ordering key for newest-wins: a fresh id takes the next value (the
     /// new high-water), so every previously-seen id is strictly lower.
     pub(crate) follow_up_next_gen: u64,
-    /// Stamped `x.ai/follow_ups` that arrived for a turn that is NOT yet the
+    /// Stamped `kigi/follow_ups` that arrived for a turn that is NOT yet the
     /// currently-adopted one, keyed by `promptId`. Ext notifications and
     /// `session/update` travel on separate channels, so a turn's follow_ups can
     /// land BEFORE the `session/update` that adopts it. Rather than drop such a
@@ -1891,7 +1891,7 @@ fn resolve_action(action_id: Option<ActionId>) -> Option<InputOutcome> {
 fn question_visible_h(
     scroll_region: Option<(u16, u16)>,
     prompt_height: u16,
-    question: &kigi_tools::implementations::grok_build::ask_user_question::Question,
+    question: &kigi_tools::implementations::kigi::ask_user_question::Question,
     content_w: usize,
     preview: Option<&str>,
     fullscreen: bool,
@@ -2625,7 +2625,7 @@ pub(super) mod test_fixtures {
         );
         assert_eq!(agent.follow_ups.as_ref().unwrap().suggestions, vec!["a"]);
     }
-    /// FIX 4 (b): after adopting a NEW turn, a buffer-replayed `x.ai/follow_ups`
+    /// FIX 4 (b): after adopting a NEW turn, a buffer-replayed `kigi/follow_ups`
     /// for a PRIOR turn's response_id must NOT revive stale chips — its
     /// `promptId` is not the active turn and it is already in the seen ring.
     #[test]
@@ -2646,7 +2646,7 @@ pub(super) mod test_fixtures {
         assert!(agent.apply_follow_ups_with_prompt("resp-2".into(), Some("p2"), vec!["b".into()]));
         assert_eq!(agent.follow_ups.as_ref().unwrap().response_id, "resp-2");
     }
-    /// FINDING B (stamped path): a LATE FIRST-TIME (never-seen) `x.ai/follow_ups`
+    /// FINDING B (stamped path): a LATE FIRST-TIME (never-seen) `kigi/follow_ups`
     /// for a PRIOR turn — arriving while a newer turn is active — must NOT
     /// render. Before the fix it slipped through the "strictly newer" branch
     /// (never recorded in `follow_up_seen`, so the seen-reject didn't catch it).
@@ -2702,7 +2702,7 @@ pub(super) mod test_fixtures {
     /// distinguished from the new turn's first follow_ups, so it follows the
     /// legacy newest-wins (renders). This path is not reachable for current
     /// shells (which always stamp `promptId`) or for buffer-replays (suppressed
-    /// upstream by the `_meta["x.ai/replayed"]` gate); it is pinned here so the
+    /// upstream by the `_meta["kigi/replayed"]` gate); it is pinned here so the
     /// stamped-path fix above is understood to be the deterministic guard.
     #[test]
     fn apply_follow_ups_none_prompt_first_time_follows_legacy_newest_wins() {
@@ -2714,7 +2714,7 @@ pub(super) mod test_fixtures {
         );
         assert_eq!(agent.follow_ups.as_ref().unwrap().response_id, "resp-x");
     }
-    /// FIX (buffer-before-adoption): a stamped `x.ai/follow_ups` for a turn that
+    /// FIX (buffer-before-adoption): a stamped `kigi/follow_ups` for a turn that
     /// is NOT yet current (its `session/update` adoption raced behind the ext
     /// channel) must be BUFFERED, not dropped — and then RENDER when that turn
     /// becomes current and is flushed.

crates/codegen/kigi-tui/src/app/agent_view/paste.rs

@@ -1180,10 +1180,10 @@ pub(super) mod paste_key_tests {
     /// Build a `QuestionViewState` already in `InputMode` focus.
     pub(in crate::app::agent_view) fn make_question_view_state_in_input_mode()
     -> crate::views::question_view::QuestionViewState {
-        let question = kigi_tools::implementations::grok_build::ask_user_question::Question {
+        let question = kigi_tools::implementations::kigi::ask_user_question::Question {
             question: "Pick one?".to_string(),
             options: vec![
-                kigi_tools::implementations::grok_build::ask_user_question::QuestionOption {
+                kigi_tools::implementations::kigi::ask_user_question::QuestionOption {
                     label: "A".to_string(),
                     description: "Option A".to_string(),
                     preview: None,

crates/codegen/kigi-tui/src/app/agent_view/prompt.rs

@@ -1412,7 +1412,7 @@ mod prompt_suggestion_key_tests {
     use crossterm::event::{KeyCode, KeyEvent, KeyModifiers};
 
     /// Idle agent with the gate open and a loaded suggestion — the state
-    /// right after a turn ends with `x.ai/suggestPrompt` resolved. Pins the
+    /// right after a turn ends with `kigi/suggestPrompt` resolved. Pins the
     /// settings cache so `resolve_enabled()` never reads the dev machine's
     /// config.toml (thread-local, so per-test).
     fn suggestion_agent(text: &str) -> AgentView {

crates/codegen/kigi-tui/src/app/agent_view/queue.rs

@@ -530,7 +530,7 @@ impl AgentView {
             Some(crate::views::queue_pane::QueueRowOrigin::Server)
         );
         if is_server {
-            // Server row: the agent promotes it to run next (`x.ai/queue/interject`); any kind may send now.
+            // Server row: the agent promotes it to run next (`kigi/queue/interject`); any kind may send now.
             if let Some(row) = row.as_ref()
                 && let Some(server_id) = row.server_id.clone()
             {
@@ -538,7 +538,7 @@ impl AgentView {
                 // flight, so an interject fired now would overtake the row
                 // shell-side and silently no-op (dropping the send-now and
                 // hiding the row behind the armed cancel expectation). Park
-                // the intent; the confirming `x.ai/queue/changed` broadcast
+                // the intent; the confirming `kigi/queue/changed` broadcast
                 // fires it with the row's authoritative version (see
                 // `resolve_send_now_awaiting_confirm`).
                 if self.optimistic_queue_ids.contains(&server_id) {
@@ -568,13 +568,13 @@ impl AgentView {
     }
 
     /// Reconcile this client's optimistic queue echoes against a raw
-    /// `x.ai/queue/changed` broadcast (pre-merge entries — the mirrored
+    /// `kigi/queue/changed` broadcast (pre-merge entries — the mirrored
     /// snapshot re-pins unconfirmed echoes, so it can't tell confirmation
     /// apart), and resolve a parked queue-row send-now
     /// ([`Self::send_now_awaiting_confirm`]).
     ///
     /// Returns `Some((id, version))` when the parked row is now confirmed as
-    /// QUEUED — the caller fires `x.ai/queue/interject` with that
+    /// QUEUED — the caller fires `kigi/queue/interject` with that
     /// authoritative version. A parked row confirmed as RUNNING clears the
     /// park with nothing to do (the natural drain won the race). A row in
     /// neither set stays parked (its RPC is still in flight).
@@ -715,7 +715,7 @@ impl AgentView {
         // Queue-specific actions (delete, edit, reorder). `x`/Delete = row delete.
         if let Some(event) = self.queue.handle_key(key, registry) {
             // Resolve the selected row's origin so edits route correctly:
-            // Server-origin rows go to the agent as `x.ai/queue/*`
+            // Server-origin rows go to the agent as `kigi/queue/*`
             // commands (the rebroadcast is the source of truth); Local rows
             // keep today's in-place mutation.
             let row = self.queue.row_ref(Self::queue_event_id(&event));
@@ -822,7 +822,7 @@ impl AgentView {
         }
     }
 
-    /// Reorder payload for `x.ai/queue/reorder`. Omit only running; include
+    /// Reorder payload for `kigi/queue/reorder`. Omit only running; include
     /// send-now in the list but do not swap past it (shell ranks missing ids last).
     fn server_queue_reordered(&self, selection_id: u64, up: bool) -> Option<Vec<String>> {
         let server_id = self.queue.row_ref(selection_id)?.server_id?;

crates/codegen/kigi-tui/src/app/agent_view/selection.rs

@@ -1325,7 +1325,7 @@ mod tests {
             crate::scrollback::text_selection::ResolvedSelectionBoundaries::default();
         for (entry_idx, text, hit_col, prefix, suffix, expected) in [
             (0, "foo rest", 0, "   ", "", "foo"),
-            (1, "rest https://x.ai", 5, "", "   ", "https://x.ai"),
+            (1, "rest https://kimi.com", 5, "", "   ", "https://kimi.com"),
         ] {
             let line = ResolvedSelectableLine {
                 entry_idx,

crates/codegen/kigi-tui/src/app/agent_view/session.rs

@@ -397,7 +397,7 @@ impl AgentView {
         self.session.start_turn(&mut self.scrollback);
     }
     /// Adopt the in-flight turn another client is driving, conveyed by the
-    /// `session/load` response meta (`x.ai/runningPromptId`): enter
+    /// `session/load` response meta (`kigi/runningPromptId`): enter
     /// TurnRunning and match subsequent live deltas. No user-prompt block is
     /// pushed — the turn's prompt and prior chunks arrived via the replay.
     pub(crate) fn adopt_running_prompt(&mut self, prompt_id: String) {

crates/codegen/kigi-tui/src/app/agent_view/shell_completion.rs

@@ -506,7 +506,7 @@ mod shell_suggestion_key_tests {
         let mut agent = bash_agent("ls | gr");
         agent.prompt.suggestions.dropdown.items = vec![
             item("grep", None),
-            file_item("ls | grokfile", "grokfile", 5..7),
+            file_item("ls | kigifile", "kigifile", 5..7),
         ];
 
         let outcome = agent.handle_prompt_key_for_test(&key(KeyCode::Tab));