ZacharyZhang-NY
021b82443d
Replace the xAI OAuth stack with the Kimi device authorization grant:
- kimi_oauth.rs wire layer (device_authorization + token poll + refresh
against kigi_env::oauth_host(); client_id per PRD; retryable statuses
429/5xx with backoff; expired_token restarts authorization)
- X-Msh-Device-{Name,Model,Id} headers; device_id minted uuid4-hex at
~/.kigi/device_id (0600)
- Storage: system keyring service `kigi`, entry `oauth/kimi-code`
(macOS/Windows native backends), atomic-file fallback under ~/.kigi;
official client's keyring/~/.kimi never touched
- Refresh manager: 60s tick, threshold max(300, expires_in*0.5),
401-tombstone keyed by rejected refresh token with 300s cooldown and
rotation auto-clear, cross-process lock with sibling-adoption
triple-check, sleep/wake forced refresh
- Deleted xAI machinery: enterprise OIDC (PKCE/JWKS/teams), devbox login,
external auth provider, JWT tier gating + subscription paywall stack,
X-XAI-Token-Auth marker headers, ZDR gates, /user enrichment
- kigi login / TUI /login both drive the device flow; login-host display
now derives from kigi_env::oauth_host()
- 264 auth unit/wiremock tests; live contract probe of
auth.kimi.com/api/oauth/device_authorization matches the wire shapes
Gates: check/clippy --all-targets clean, fmt, deny ok, kigi-shell lib
5131 tests green.
398 lines
15 KiB
TOML
398 lines
15 KiB
TOML
# Hand-maintained workspace root (PRD §8.1: the upstream monorepo generator is
|
|
# not part of this repository, so this file is a source file here).
|
|
# Keep members sorted; dependency versions live here, per-crate manifests
|
|
# reference them with `workspace = true`.
|
|
|
|
[workspace]
|
|
resolver = "2"
|
|
members = [
|
|
"crates/build/kigi-proto-build",
|
|
"crates/codegen/ptyctl",
|
|
"crates/codegen/ptyctl-cli",
|
|
"crates/codegen/kigi-acp-lib",
|
|
"crates/codegen/kigi-agent-lifecycle",
|
|
"crates/codegen/kigi-chat-state",
|
|
"crates/codegen/kigi-codebase-graph",
|
|
"crates/codegen/kigi-crash-handler",
|
|
"crates/codegen/kigi-fast-worktree",
|
|
"crates/codegen/kigi-file-utils",
|
|
"crates/codegen/kigi-fsnotify",
|
|
"crates/codegen/kigi-gix-status",
|
|
"crates/codegen/kigi-agent",
|
|
"crates/codegen/kigi-auth",
|
|
"crates/codegen/kigi-config",
|
|
"crates/codegen/kigi-config-types",
|
|
"crates/codegen/kigi-env",
|
|
"crates/codegen/kigi-hooks",
|
|
"crates/codegen/kigi-http",
|
|
"crates/codegen/kigi-markdown",
|
|
"crates/codegen/kigi-markdown-core",
|
|
"crates/codegen/kigi-mcp",
|
|
"crates/codegen/kigi-memory",
|
|
"crates/codegen/kigi-mermaid",
|
|
"crates/codegen/kigi-models",
|
|
"crates/codegen/kigi-tui",
|
|
"crates/codegen/kigi-bin",
|
|
"crates/codegen/kigi-pager-minimal",
|
|
"crates/codegen/kigi-pager-pty-harness",
|
|
"crates/codegen/kigi-pager-render",
|
|
"crates/codegen/kigi-paths",
|
|
"crates/codegen/kigi-sampler",
|
|
"crates/codegen/kigi-sampling-types",
|
|
"crates/codegen/kigi-sandbox",
|
|
"crates/codegen/kigi-secrets",
|
|
"crates/codegen/kigi-shared",
|
|
"crates/codegen/kigi-shell",
|
|
"crates/codegen/kigi-shell-base",
|
|
"crates/codegen/kigi-shell-session-support",
|
|
"crates/codegen/kigi-subagent-resolution",
|
|
"crates/codegen/kigi-test-support",
|
|
"crates/codegen/kigi-tools",
|
|
"crates/codegen/kigi-tools-api",
|
|
"crates/codegen/kigi-update",
|
|
"crates/codegen/kigi-version",
|
|
"crates/codegen/kigi-workspace",
|
|
"crates/codegen/kigi-workspace-client",
|
|
"crates/codegen/kigi-workspace-types",
|
|
"crates/codegen/kigi-hooks-plugins-types",
|
|
"crates/codegen/kigi-hunk-tracker",
|
|
"crates/codegen/kigi-log",
|
|
"crates/codegen/kigi-prompt-queue",
|
|
"crates/codegen/kigi-ratatui-inline",
|
|
"crates/codegen/kigi-ratatui-textarea",
|
|
"crates/codegen/kigi-sqlite-journal",
|
|
"crates/codegen/kigi-system-power",
|
|
"crates/codegen/kigi-token-estimation",
|
|
"crates/codegen/kigi-tracing-macros",
|
|
"crates/codegen/kigi-tty-utils",
|
|
"crates/common/kigi-computer-hub-core",
|
|
"crates/common/kigi-computer-hub-mcp-adapter",
|
|
"crates/common/kigi-computer-hub-sdk",
|
|
"crates/common/kigi-compaction",
|
|
"crates/common/kigi-interjection-core",
|
|
"crates/common/kigi-test-utils",
|
|
"crates/common/kigi-tool-protocol",
|
|
"crates/common/kigi-tool-runtime",
|
|
"crates/common/kigi-tool-types",
|
|
"crates/common/kigi-tracing",
|
|
"prod/mc/cli-chat-proxy-types",
|
|
"third_party/dagre_rust",
|
|
"third_party/graphlib_rust",
|
|
"third_party/mermaid-to-svg",
|
|
"third_party/ordered_hashmap",
|
|
]
|
|
|
|
[workspace.package]
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
license = "Apache-2.0"
|
|
|
|
[workspace.dependencies]
|
|
agent-client-protocol = { version = "0.10.4", features = ["unstable"] }
|
|
alacritty_terminal = "0.26.0"
|
|
ansi-to-tui = "7.0.0"
|
|
ansi-width = "0.1"
|
|
anstyle = "1.0"
|
|
anstyle-lossy = "1.1.4"
|
|
anstyle-parse = "0.2"
|
|
anstyle-syntect = "1.0.4"
|
|
anyhow = { version = "1", features = ["backtrace"] }
|
|
arboard = "3.6"
|
|
arc-swap = "1.7"
|
|
assert_matches = "1.5.0"
|
|
async-compression = { version = "0.4.17", default-features = false, features = ["gzip", "zstd", "tokio"] }
|
|
async-lsp = { version = "0.2.3", features = ["tokio", "tracing"] }
|
|
async-openai = { version = "0.33.0", features = ["responses"] }
|
|
async-stream = "0.3"
|
|
async-trait = "0.1"
|
|
axum = { version = "0.8", features = ["macros", "ws"] }
|
|
backon = { version = "1.6" }
|
|
backtrace = "0.3"
|
|
base64 = "0.22"
|
|
blake3 = "1"
|
|
bytes = { version = "1", features = ["serde"] }
|
|
camino = "1.1.10"
|
|
chrono = "0.4"
|
|
clap = { version = "4", features = ["derive", "env"] }
|
|
clap_complete = { version = "4" }
|
|
colored_json = "5"
|
|
core-foundation = "0.10"
|
|
crc32fast = "1.4"
|
|
criterion = "0.6"
|
|
crossbeam = "0.8"
|
|
crossterm = "0.28"
|
|
cryptify = "3.2"
|
|
dashmap = "6"
|
|
derive_more = { version = "2", features = ["add", "add_assign", "debug", "deref", "deref_mut", "display", "from", "from_str", "into", "into_iterator", "try_into"] }
|
|
dirs = "5.0"
|
|
documented = "0.9"
|
|
dunce = "1"
|
|
educe = "0.6.0"
|
|
enum_delegate = "0.2"
|
|
env_logger = "0.11"
|
|
eventsource-stream = "0.2"
|
|
fastrace = { version = "0.7" }
|
|
fastrace-opentelemetry = { version = "0.18" }
|
|
fastrace-reqwest = { version = "0.2" }
|
|
fastrace-tonic = { version = "0.1" }
|
|
fastrand = "2"
|
|
filetime = "0.2.25"
|
|
flate2 = { version = "1", default-features = false, features = ["zlib-rs"] }
|
|
fontdb = "0.23"
|
|
fs2 = "0.4"
|
|
futures = "0.3"
|
|
futures-util = "0.3"
|
|
fuzzy-matcher = "0.3.7"
|
|
gethostname = "1"
|
|
git2 = { version = "0.21", default-features = false, features = ["vendored-libgit2"] }
|
|
gix = { version = "0.83", default-features = false, features = ["sha1"] }
|
|
glob = "0.3"
|
|
globset = "0.4"
|
|
htmd = "0.5.4"
|
|
html-escape = "0.2"
|
|
http = "1"
|
|
http-body-util = "0.1"
|
|
humantime-serde = "1"
|
|
ignore = "0.4"
|
|
image = { version = "0.25.9", default-features = false }
|
|
indexmap = { version = "2", features = ["serde"] }
|
|
indicatif = "0.18"
|
|
infer = "0.19.0"
|
|
insta = "1"
|
|
itertools = "0.14"
|
|
jsonschema = "0.30.0"
|
|
libc = "0.2"
|
|
linkify = "0.10"
|
|
lipsum = "0.9"
|
|
log = { version = "0.4", features = ["kv", "kv_unstable"] }
|
|
md5 = "0.8"
|
|
mermaid-to-svg = { path = "third_party/mermaid-to-svg" }
|
|
minijinja = "2.9"
|
|
mockito = "1"
|
|
moka = "0.12"
|
|
nix = { version = "0.30", features = ["poll", "process", "signal", "sched", "term", "mount", "fs", "ioctl", "mman", "reboot", "user"] }
|
|
notify = "8"
|
|
notify-debouncer-mini = "0.6"
|
|
nucleo = { git = "https://github.com/helix-editor/nucleo.git", rev = "5b74652" }
|
|
num_cpus = "1"
|
|
oauth2 = "5"
|
|
obfstr = "0.4"
|
|
once_cell = "1"
|
|
opentelemetry = "0.32"
|
|
opentelemetry-http = { version = "0.32", features = ["reqwest-blocking"] }
|
|
opentelemetry-otlp = { version = "0.32", features = ["grpc-tonic", "reqwest-blocking-client", "tls-roots"] }
|
|
opentelemetry-proto = { version = "0.32", features = ["gen-tonic"] }
|
|
opentelemetry_sdk = { version = "0.32.1", features = ["spec_unstable_metrics_views"] }
|
|
parking_lot = "0.12.4"
|
|
pbjson-build = "0.9"
|
|
pdf_oxide = { version = "0.3.43", features = ["rendering"] }
|
|
petgraph = { version = "0.6.5", default-features = false, features = ["serde-1", "stable_graph"] }
|
|
portable-pty = "0.9"
|
|
pprof = "0.15"
|
|
pretty_assertions = "1"
|
|
prometheus = { version = "0.14", features = ["process"] }
|
|
prost = "0.14"
|
|
prost-build = "0.14"
|
|
pulldown-cmark = "0.13"
|
|
quick-xml = "0.41"
|
|
rand = "0.9"
|
|
ratatui = { version = "0.29" }
|
|
ratatui-core = "0.1"
|
|
rayon = "1"
|
|
reflink-copy = "0.1"
|
|
regex = "1"
|
|
reqwest = { version = "0.12", features = ["rustls-tls", "stream", "json", "multipart", "http2", "blocking", "socks"], default-features = false }
|
|
reqwest-middleware = { version = "0.4.1", features = ["json", "multipart"] }
|
|
resvg = { version = "0.47", default-features = false, features = ["text"] }
|
|
ring = "0.17"
|
|
rsa = "0.9"
|
|
runfiles = "0.1"
|
|
rustc-hash = "2"
|
|
schemars = "1"
|
|
scraper = "0.23"
|
|
semver = "1"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_path_to_error = "0.1"
|
|
serde_yaml = "0.9"
|
|
serial_test = "3"
|
|
sha2 = { version = "0.10", features = ["force-soft"] }
|
|
shlex = "1"
|
|
signal-hook = "0.3"
|
|
similar = "2.7"
|
|
siphasher = "1"
|
|
smallvec = "1"
|
|
strip-ansi-escapes = "0.2.1"
|
|
strum = { version = "0.27", features = ["derive"] }
|
|
supports-color = "3.0"
|
|
syntect = "5.3"
|
|
tar = "0.4"
|
|
tempfile = "3"
|
|
terminput = "0.3"
|
|
termwiz = { version = "0.23", default-features = false }
|
|
textwrap = "0.16"
|
|
thiserror = "2"
|
|
tikv-jemalloc-ctl = "0.6"
|
|
tikv-jemalloc-sys = "0.6"
|
|
tikv-jemallocator = { version = "0.6", features = ["profiling", "unprefixed_malloc_on_supported_platforms"] }
|
|
time = "0.3"
|
|
tiny-skia = "0.12"
|
|
tokio = { version = "1", features = ["full"] }
|
|
tokio-retry = "0.3"
|
|
tokio-stream = "0.1"
|
|
tokio-tungstenite = "0.27"
|
|
tokio-util = { version = "0.7", features = ["rt"] }
|
|
toml = "0.9"
|
|
toml_edit = "0.22"
|
|
tonic = { version = "0.14", features = ["tls-aws-lc", "gzip", "deflate", "zstd"] }
|
|
tonic-prost = "0.14"
|
|
tonic-prost-build = "0.14"
|
|
tower = "0.5"
|
|
tower-http = "0.6"
|
|
tracing = "0.1"
|
|
tracing-opentelemetry = "0.33"
|
|
tracing-subscriber = { version = "0.3.23", default-features = false, features = ["env-filter", "smallvec", "tracing-log", "std", "ansi"] }
|
|
tui-scrollbar = "0.2"
|
|
two-face = { version = "0.4", default-features = false, features = ["syntect-fancy"] }
|
|
unicode-segmentation = "1.12.0"
|
|
unicode-width = "0.2"
|
|
url = "2"
|
|
urlencoding = "2"
|
|
uuid = { version = "1", features = ["serde", "v4", "v5"] }
|
|
vte = "0.15.0"
|
|
wait-timeout = "0.2"
|
|
walkdir = "2"
|
|
webbrowser = { version = "1.0.4" }
|
|
which = "8"
|
|
keyring = { version = "3", default-features = false }
|
|
windows = { version = "0.61", features = ["Win32_Security", "Win32_Security_Authorization", "Win32_Foundation", "Win32_System_Threading", "Win32_System_JobObjects", "Win32_System_Console", "Win32_System_Pipes"] }
|
|
wiremock = "0.6"
|
|
wl-clipboard-rs = "0.9"
|
|
kigi-acp-lib = { path = "crates/codegen/kigi-acp-lib" }
|
|
kigi-agent-lifecycle = { path = "crates/codegen/kigi-agent-lifecycle" }
|
|
kigi-computer-hub-core = { path = "crates/common/kigi-computer-hub-core" }
|
|
kigi-computer-hub-sdk = { path = "crates/common/kigi-computer-hub-sdk" }
|
|
kigi-gix-status = { path = "crates/codegen/kigi-gix-status" }
|
|
kigi-agent = { path = "crates/codegen/kigi-agent" }
|
|
kigi-auth = { path = "crates/codegen/kigi-auth" }
|
|
kigi-config = { path = "crates/codegen/kigi-config" }
|
|
kigi-config-types = { path = "crates/codegen/kigi-config-types" }
|
|
kigi-env = { path = "crates/codegen/kigi-env" }
|
|
kigi-http = { path = "crates/codegen/kigi-http" }
|
|
kigi-markdown = { path = "crates/codegen/kigi-markdown" }
|
|
kigi-markdown-core = { path = "crates/codegen/kigi-markdown-core" }
|
|
kigi-mcp = { path = "crates/codegen/kigi-mcp" }
|
|
kigi-memory = { path = "crates/codegen/kigi-memory" }
|
|
kigi-mermaid = { path = "crates/codegen/kigi-mermaid" }
|
|
kigi-models = { path = "crates/codegen/kigi-models" }
|
|
kigi-sampler = { path = "crates/codegen/kigi-sampler" }
|
|
kigi-secrets = { path = "crates/codegen/kigi-secrets" }
|
|
kigi-shared = { path = "crates/codegen/kigi-shared" }
|
|
kigi-shell = { path = "crates/codegen/kigi-shell" }
|
|
kigi-shell-base = { path = "crates/codegen/kigi-shell-base" }
|
|
kigi-shell-session-support = { path = "crates/codegen/kigi-shell-session-support" }
|
|
kigi-log = { path = "crates/codegen/kigi-log" }
|
|
kigi-test-support = { path = "crates/codegen/kigi-test-support" }
|
|
kigi-tools = { path = "crates/codegen/kigi-tools" }
|
|
kigi-tools-api = { path = "crates/codegen/kigi-tools-api" }
|
|
kigi-version = { path = "crates/codegen/kigi-version" }
|
|
kigi-workspace = { path = "crates/codegen/kigi-workspace" }
|
|
kigi-workspace-types = { path = "crates/codegen/kigi-workspace-types" }
|
|
kigi-hooks-plugins-types = { path = "crates/codegen/kigi-hooks-plugins-types" }
|
|
kigi-interjection-core = { path = "crates/common/kigi-interjection-core" }
|
|
kigi-prompt-queue = { path = "crates/codegen/kigi-prompt-queue" }
|
|
kigi-proto-build = { path = "crates/build/kigi-proto-build" }
|
|
kigi-ratatui-inline = { path = "crates/codegen/kigi-ratatui-inline" }
|
|
kigi-ratatui-textarea = { path = "crates/codegen/kigi-ratatui-textarea" }
|
|
kigi-sqlite-journal = { path = "crates/codegen/kigi-sqlite-journal" }
|
|
kigi-system-power = { path = "crates/codegen/kigi-system-power" }
|
|
kigi-test-utils = { path = "crates/common/kigi-test-utils" }
|
|
kigi-token-estimation = { path = "crates/codegen/kigi-token-estimation" }
|
|
kigi-tool-protocol = { path = "crates/common/kigi-tool-protocol" }
|
|
kigi-tool-runtime = { path = "crates/common/kigi-tool-runtime" }
|
|
kigi-tool-types = { path = "crates/common/kigi-tool-types" }
|
|
kigi-tracing = { path = "crates/common/kigi-tracing" }
|
|
kigi-tty-utils = { path = "crates/codegen/kigi-tty-utils" }
|
|
zbus = { version = "5" }
|
|
zstd = "0.13"
|
|
|
|
[profile.release]
|
|
incremental = true
|
|
panic = "abort"
|
|
|
|
# Hardened release profile for shipping to end users (alpha + stable).
|
|
# Use `cargo build --profile release-dist` for distribution builds.
|
|
# Not used by default `--release` to avoid slowing down local dev builds (~2.2x).
|
|
#
|
|
# Hardening: thin LTO for cross-crate optimization with reasonable link times,
|
|
# codegen-units=1 maximizes optimization (whole-program analysis, no CGU boundaries).
|
|
# debug=1 emits line-tables DWARF; strip=false keeps symbols so CI can extract
|
|
# .debug sidecars (Linux) or .dSYM bundles (macOS) before stripping post-build.
|
|
# Linker flags (RELRO, NX stack) are set per-target in .cargo/config.toml.
|
|
[profile.release-dist]
|
|
inherits = "release"
|
|
lto = "thin"
|
|
codegen-units = 1
|
|
strip = false
|
|
debug = 1
|
|
split-debuginfo = "off"
|
|
|
|
# Production profile for latency-sensitive x-product services (VF, home-mixer).
|
|
# Thin LTO gives ~90% of full LTO benefit at significantly faster link time.
|
|
# Keeps symbols + line tables for prod debuggability (perf, flamegraph, stack traces).
|
|
[profile.x-prod]
|
|
inherits = "release"
|
|
lto = "thin"
|
|
strip = false
|
|
codegen-units = 1
|
|
debug = "line-tables-only"
|
|
panic = "unwind"
|
|
|
|
# Desktop release profile. Functionally identical to release-dist — kept as a
|
|
# named alias so the desktop workflow can reference it without coupling to the
|
|
# CLI pipeline's profile name. Alpha and stable share a single release-dist
|
|
# profile so that stable promotion can pointer-swap the alpha binary without
|
|
# rebuilding.
|
|
[profile.release-dist-jemalloc]
|
|
inherits = "release-dist"
|
|
# All settings now match the parent — this is an intentional alias.
|
|
|
|
|
|
[profile.dev]
|
|
panic = "abort"
|
|
split-debuginfo = "unpacked"
|
|
codegen-units = 128
|
|
debug = "line-tables-only"
|
|
opt-level = 0
|
|
lto = false
|
|
incremental = true
|
|
|
|
[profile.bench]
|
|
debug = true
|
|
|
|
[workspace.lints.clippy]
|
|
# prost 0.14 renders proto doc-comment bullet lists in a way that trips this
|
|
# lint on generated code. Kept in sync with bazel/lint/linters.bzl.
|
|
doc_lazy_continuation = "allow"
|
|
doc_overindented_list_items = "allow"
|
|
needless_lifetimes = "allow"
|
|
single_range_in_vec_init = "allow"
|
|
too_many_arguments = "allow"
|
|
|
|
# Allow uninlined_format_args lint to prevent main from breaking after merges
|
|
# When older branches (created before this lint was added to CI) get merged,
|
|
# they pass their own CI because their CI config doesn't include this lint check.
|
|
# However, once merged to main, the code violates main's lint rules, causing:
|
|
# 1. Main's CI to fail
|
|
# 2. All new branches based off main to fail CI
|
|
# 3. Developers having to fix lint violations from other people's merged code
|
|
# Without a merge-queue that runs main's CI checks on the PR branch,
|
|
# these violations slip through and break the build for everyone.
|
|
# TODO: -> "deny" once/if merge queue enabled
|
|
uninlined_format_args = "allow"
|
|
|
|
# The `fastrace::trace(properties = { … })` proc-macro expands `"{param}"`
|
|
# into `format!("{}", param)`, which clippy flags as useless_format.
|
|
# Suppressed until the upstream crate fixes its codegen (fixed in 0.7.16+).
|
|
useless_format = "allow"
|