ZacharyZhang-NY
021b82443d
Replace the xAI OAuth stack with the Kimi device authorization grant:
- kimi_oauth.rs wire layer (device_authorization + token poll + refresh
against kigi_env::oauth_host(); client_id per PRD; retryable statuses
429/5xx with backoff; expired_token restarts authorization)
- X-Msh-Device-{Name,Model,Id} headers; device_id minted uuid4-hex at
~/.kigi/device_id (0600)
- Storage: system keyring service `kigi`, entry `oauth/kimi-code`
(macOS/Windows native backends), atomic-file fallback under ~/.kigi;
official client's keyring/~/.kimi never touched
- Refresh manager: 60s tick, threshold max(300, expires_in*0.5),
401-tombstone keyed by rejected refresh token with 300s cooldown and
rotation auto-clear, cross-process lock with sibling-adoption
triple-check, sleep/wake forced refresh
- Deleted xAI machinery: enterprise OIDC (PKCE/JWKS/teams), devbox login,
external auth provider, JWT tier gating + subscription paywall stack,
X-XAI-Token-Auth marker headers, ZDR gates, /user enrichment
- kigi login / TUI /login both drive the device flow; login-host display
now derives from kigi_env::oauth_host()
- 264 auth unit/wiremock tests; live contract probe of
auth.kimi.com/api/oauth/device_authorization matches the wire shapes
Gates: check/clippy --all-targets clean, fmt, deny ok, kigi-shell lib
5131 tests green.
Kigi
Kigi (kigi) is an unofficial Kimi Code CLI community build — a
terminal-based AI coding agent based on the Apache-2.0 sources of
xai-org/grok-build, re-targeted at
the Kimi Code subscription API and the Moonshot open platform.
It runs as a full-screen TUI that understands your codebase, edits files, executes shell commands, and manages long-running tasks — interactively, headlessly for scripting/CI, or embedded in editors via the Agent Client Protocol (ACP).
Kigi is not affiliated with Moonshot AI or xAI. It coexists with the official
kimi CLI on the same machine: independent binary name, independent config
directory (~/.kigi), independent keyring credentials, and a KIGI_*
environment-variable namespace. Nothing the official client installs or
stores is touched.
Status
0.1.0 — milestone M0 (compilable skeleton) complete:
- 62 workspace crates renamed to the
kigi-*namespace; brand and env-var namespaces separated from upstream. - Telemetry, voice input, announcements, plugin marketplace, and relay/gateway remote services removed. Kigi is zero-telemetry: the only outbound connections are the inference/auth APIs you configure, GitHub Releases for updates, and MCP servers you add.
- Toolchain Rust 1.97.0;
cargo check/clippy --workspace --all-targetsclean;cargo deny check advisoriesgate in place.
Authentication and inference against Kimi Code (milestone M1), the compatibility surface (M2), and release distribution (M3) are in progress.
Building from source
rustup toolchain install 1.97.0
cargo build --profile release-dist -p kigi-bin
./target/release-dist/kigi --version
protoc is invoked through the vendored dotslash
launcher at bin/protoc; install dotslash (brew install dotslash or
cargo install dotslash) if it is not already on your PATH.
License
Apache-2.0. See LICENSE, NOTICE, and THIRD-PARTY-NOTICES. Code ported from openai/codex and sst/opencode is documented in crates/codegen/kigi-tools/THIRD_PARTY_NOTICES.md.