Rebrand auth guidance strings: grok login/logout -> kigi login/logout

The headless not-signed-in message still pointed at `grok login` and
XAI_API_KEY; error copy across the shell (re-auth prompts, managed-config
rejection, mcp doctor, trace classifier) and kigi-bin did too. All now
reference `kigi login` / `kigi logout`, and the headless fallback points
at the Moonshot open-platform key (KIGI_MOONSHOT_API_KEY).

crates/codegen/kigi-shell/src/config/watcher.rs

@@ -112,7 +112,7 @@ pub enum ConfigChangeEvent {
 /// comparison) skips the update when nothing actually changed, so the
 /// redundant read is harmless. This avoids a class of bugs where an
 /// optimistic suppression window accidentally swallows writes from external
-/// processes (e.g. `grok login` in another terminal).
+/// processes (e.g. `kigi login` in another terminal).
 ///
 /// Adds two **non-recursive** watches per `cwd` argument:
 /// `<cwd>/` (catches `.mcp.json` and `.claude.json` at the project root) and

crates/codegen/kigi-shell/src/extensions/notification.rs

@@ -980,7 +980,7 @@ pub enum RetryState {
 /// again. Drives the actionable re-auth banner.
 ///
 /// `legacy_auth` is intentionally excluded: those failures carry their own
-/// detailed migration guidance (`grok logout` / `grok login`) in the
+/// detailed migration guidance (`kigi logout` / `kigi login`) in the
 /// message, so we surface that verbatim instead of the generic prompt.
 pub fn is_reauthable_failure(error_type: Option<&str>, message: &str) -> bool {
     if error_type == Some("legacy_auth") {

crates/codegen/kigi-shell/src/managed_config.rs

@@ -98,7 +98,7 @@ pub fn clear_orphan() {
 }
 
 /// Best-effort cross-process lock serializing apply/remove of the managed-config
-/// files (TUI tick vs `grok login` vs prefetch). `None` on contention — the
+/// files (TUI tick vs `kigi login` vs prefetch). `None` on contention — the
 /// caller skips and retries next cycle.
 fn try_lock_managed_config(home: &std::path::Path) -> Option<std::fs::File> {
     use fs2::FileExt;
@@ -645,7 +645,7 @@ pub enum ManagedConfigSync {
     Failed,
 }
 
-/// Post-login hook for `grok login` and the ACP/TUI authenticate flow: clear any
+/// Post-login hook for `kigi login` and the ACP/TUI authenticate flow: clear any
 /// orphaned files, then fetch the new principal's config immediately rather than
 /// waiting for the background tick. `authenticated` pins the just-logged-in
 /// principal (`None` = on-disk team). Latency-bounded by [`SyncBudget::Login`];

crates/codegen/kigi-shell/src/managed_config/response.rs

@@ -42,7 +42,7 @@ pub enum ManagedConfigError {
     )]
     DeploymentKeyRejected,
     #[error(
-        "Your team sign-in was rejected. It may have expired or lack access. Run `grok login` to sign in again."
+        "Your team sign-in was rejected. It may have expired or lack access. Run `kigi login` to sign in again."
     )]
     TeamAuthRejected,
     #[error("The server returned an unexpected error (HTTP {status}). Try again in a few minutes.")]

crates/codegen/kigi-shell/src/mcp_doctor.rs

@@ -284,7 +284,7 @@ async fn try_discover_managed_servers() -> (ConfigSourceStatus, Vec<DiscoveredSe
 
     let token = match auth_manager.get_valid_token().await {
         Ok(key) => key,
-        Err(_) => return managed_skipped("auth expired — run `grok login`"),
+        Err(_) => return managed_skipped("auth expired — run `kigi login`"),
     };
 
     let proxy_url = crate::agent::config::EndpointsConfig::from_effective_config().proxy_url();

crates/codegen/kigi-shell/src/sampling/error.rs

@@ -78,7 +78,7 @@ pub fn map_sampling_err_to_acp(err: SamplingError) -> acp::Error {
                     format!(
                         "{message}\n\nYou have an API key set (XAI_API_KEY). \
                          Your cached OAuth session is being used instead. \
-                         To use your API key, run `grok logout` or type /logout in the TUI."
+                         To use your API key, run `kigi logout` or type /logout in the TUI."
                     )
                 } else {
                     message
@@ -485,8 +485,8 @@ mod tests {
             let data = acp_err.data.unwrap();
             let msg = data.as_str().unwrap();
             assert!(
-                msg.contains("grok logout"),
-                "should suggest grok logout when API key is available: {msg}"
+                msg.contains("kigi logout"),
+                "should suggest kigi logout when API key is available: {msg}"
             );
             assert!(
                 msg.contains("/logout"),
@@ -509,7 +509,7 @@ mod tests {
             let data = acp_err.data.unwrap();
             let msg = data.as_str().unwrap();
             assert!(
-                !msg.contains("grok logout"),
+                !msg.contains("kigi logout"),
                 "should NOT suggest logout when no API key is available: {msg}"
             );
         });
@@ -529,7 +529,7 @@ mod tests {
             let data = acp_err.data.unwrap();
             let msg = data.as_str().unwrap();
             assert!(
-                !msg.contains("grok logout"),
+                !msg.contains("kigi logout"),
                 "should NOT suggest logout for non-subscription 403: {msg}"
             );
         });

crates/codegen/kigi-shell/src/trace_classifier/mod.rs

@@ -1052,7 +1052,7 @@ pub async fn resolve_api_key(explicit: Option<&str>, kigi_home: &Path) -> Result
         return Ok(key);
     }
     Err(anyhow!(
-        "no API key: pass --api-key, set XAI_API_KEY, or run `grok login` to populate \
+        "no API key: pass --api-key, set XAI_API_KEY, or run `kigi login` to populate \
          <grok-home>/auth.json. An expired OIDC token is auto-refreshed when a refresh_token \
          is present; if not, re-login is required."
     ))
@@ -1088,7 +1088,7 @@ async fn non_interactive_auth_key(kigi_home: &Path) -> Result<Option<String>> {
         }
         Err(AuthError::NotLoggedIn) => Ok(None),
         Err(e) => Err(anyhow!(
-            "auth.json refresh failed: {e}. Run `grok login` to re-authenticate, \
+            "auth.json refresh failed: {e}. Run `kigi login` to re-authenticate, \
              or pass --api-key / set $XAI_API_KEY to bypass auth.json."
         )),
     }
@@ -2134,7 +2134,7 @@ mod tests {
     }
 
     /// Write an `auth.json` whose only entry is at the production
-    /// OIDC scope (the same scope `grok login` writes today and
+    /// OIDC scope (the same scope `kigi login` writes today and
     /// `AuthManager` reads). `auth_mode: api_key` skips the refresh
     /// path entirely — useful for "plain key, no refresh wanted"
     /// fixtures.
@@ -2345,7 +2345,7 @@ mod tests {
         assert!(
             msg.contains("--api-key")
                 && msg.contains("XAI_API_KEY")
-                && msg.contains("grok login")
+                && msg.contains("kigi login")
                 && msg.contains("auth.json"),
             "error names all three sources: {msg}",
         );

crates/codegen/kigi-shell/src/util/kigi_auth_credentials.rs

@@ -68,7 +68,7 @@ impl KigiAuthCredentials {
         if self.deployment_key.is_some() {
             "Your KIGI_DEPLOYMENT_KEY is invalid or expired. Please contact a team admin."
         } else if self.user_token.is_some() {
-            "Your auth token is invalid or expired. Run `grok login` to re-authenticate."
+            "Your auth token is invalid or expired. Run `kigi login` to re-authenticate."
         } else {
             "Not authenticated."
         }