feat(auth): add Kimi Code OAuth login

docs/oauth-subscriptions.md

@@ -37,7 +37,7 @@ before. Tokens are stored 0600 (or the OS keyring with
 Running `/provider` opens a **"How do you want to connect?"** chooser:
 
 ```text
-❯ Sign in with OAuth                 One-click browser login (OpenRouter, xAI, ChatGPT, Hugging Face)
+❯ Sign in with OAuth                 No API key to copy — browser login (OpenRouter, xAI, ChatGPT, Hugging Face) or device code (xAI, Kimi Code, Hugging Face)
   Paste an API key / browse providers  Any of 20+ providers, local, or a proxy
 ```
 
@@ -46,23 +46,28 @@ Pick **Sign in with OAuth** → the list of providers that do real OAuth → cho
 ```text
 ❯ OpenRouter      browser sign-in · creates a key
   xAI (Grok)      browser or device code
+  Kimi Code       device code (managed coding endpoint)
   ChatGPT         browser (Codex backend, ChatGPT Plus/Pro)
   Hugging Face    browser or device code
 ```
 
 - **OpenRouter / xAI / ChatGPT / Hugging Face** are real OAuth: your browser
-  opens to approve → done (no key to paste). OpenRouter mints a key; xAI /
-  ChatGPT / Hugging Face store a refreshable bearer. Hugging Face requires a
-  one-time OAuth-app registration (no secret needed for "public" apps); the
-  preset pre-fills scopes, endpoints, and the OIDC issuer. The same chooser
-  appears in first-run onboarding. (xAI uses an opt-in preset — set
-  `ZERO_OAUTH_ALLOW_PRESETS=1` or your own `ZERO_OAUTH_XAI_*`; see below.)
-- **Device code (headless / SSH):** for a provider that supports it (xAI,
-  Hugging Face), press **d** on the list to get a code to enter on another
-  device instead of opening a browser. On an SSH session or headless Linux box
-  (no `DISPLAY`) device code is used automatically; set `ZERO_OAUTH_DEVICE=1`
-  to force it anywhere. The CLI equivalent is
-  `zero auth login <name> --device`.
+   opens to approve → done (no key to paste). OpenRouter mints a key; xAI /
+   ChatGPT / Hugging Face store a refreshable bearer. Hugging Face requires a
+   one-time OAuth-app registration (no secret needed for "public" apps); the
+   preset pre-fills scopes, endpoints, and the OIDC issuer. Kimi Code is also
+   real OAuth but has no browser flow at all — see the device-code bullet
+   below. The same chooser appears in first-run onboarding. (xAI and Kimi Code
+   use an opt-in preset — set `ZERO_OAUTH_ALLOW_PRESETS=1` or your own
+   `ZERO_OAUTH_XAI_*` / `ZERO_OAUTH_KIMI_CODE_*`; see below.)
+- **Device code (headless / SSH):** for a provider that supports it (xAI, Kimi
+   Code, Hugging Face), press **d** on the list to get a code to enter on
+   another device instead of opening a browser. On an SSH session or headless
+   Linux box (no `DISPLAY`) device code is used automatically; set
+   `ZERO_OAUTH_DEVICE=1` to force it anywhere. The CLI equivalent is
+   `zero auth login <name> --device`. (Kimi Code is **device-code only** — it
+   has no loopback/browser flow, so `zero auth kimi` always uses the device
+   path and pressing plain Enter on it in the wizard does too.)
 - **ChatGPT / Claude are intentionally not in this list for the proxy path** —
   use the dedicated `chatgpt-proxy` / `custom-anthropic-compatible` preset
   (see §2) for subscription-via-proxy. ChatGPT *is* a first-class OAuth
@@ -83,9 +88,37 @@ Pick **Sign in with OAuth** → the list of providers that do real OAuth → cho
   (browser, or `--device` for headless) works one-click; the token is used directly
   on `api.x.ai/v1`. Without the opt-in, set `ZERO_OAUTH_XAI_CLIENT_ID` (and
   endpoints, or an issuer) yourself via `ZERO_OAUTH_XAI_*`. Either way the preset is
-  fully overridable by `ZERO_OAUTH_XAI_*` (env wins), and it requires a
-  SuperGrok / X Premium+ subscription; the client_id is an undocumented public
-  Grok-CLI client that may change without notice.
+   fully overridable by `ZERO_OAUTH_XAI_*` (env wins), and it requires a
+   SuperGrok / X Premium+ subscription; the client_id is an undocumented public
+   Grok-CLI client that may change without notice.
+- **Kimi Code — built-in preset, device-code only** — `zero auth kimi` (or
+   `zero auth login kimi-code --device`) runs the RFC 8628 device-code flow
+   against `https://auth.kimi.com`. You approve on another device and enter the
+   code; the returned access token is stored and used **directly** as a bearer
+   on Kimi's managed coding endpoint `https://api.kimi.com/coding/v1` (an
+   OpenAI-compatible chat-completions endpoint) — no ID-token claim extraction
+   is needed. Kimi has **no browser/loopback flow**, so the device code is the
+   only path (it is used automatically, and `--device` is accepted but
+   redundant). The catalog/provider ID is `kimi-code`, not `kimi` — the
+   `moonshot` provider already uses `kimi` as an alias for its separate,
+   API-key-based endpoint, so `zero auth kimi` is CLI sugar that forwards to
+   `kimi-code` rather than reusing that name. Like xAI, the preset ships the
+   public kimi-cli client identity (`17e5f671-d194-4dfb-9706-5516cb48c098`).
+   Unlike the raw `ZERO_OAUTH_XAI_*`-only path, no `ZERO_OAUTH_ALLOW_PRESETS=1`
+   is needed for Kimi: both `zero auth kimi` and `zero auth login kimi-code`
+   run through the `auth login` engine, which enables presets unconditionally.
+   Any field is still overridable with
+   `ZERO_OAUTH_KIMI_CODE_*`. Kimi's backend also requires a handful of
+   vendor-identity `X-Msh-*` headers across all applicable OAuth and API calls
+   (device authorization, polling, code exchange, refresh, and managed
+   runtime/completions requests). These are reverse-engineered from kimi-cli,
+   not from public documentation — verify against a real login before relying
+   on this.
+   This is distinct from the `moonshot` catalog entry, which is the API-key path at
+   `https://api.moonshot.ai/v1` (set `MOONSHOT_API_KEY`). To override the managed
+   endpoint, set `baseURL` on the provider profile; to override the OAuth host,
+   set `ZERO_OAUTH_KIMI_CODE_ISSUER_URL`/`ZERO_OAUTH_KIMI_CODE_DEVICE_URL`/`ZERO_OAUTH_KIMI_CODE_TOKEN_URL`
+   (the provider resolves as `kimi-code`, so the env prefix is `KIMI_CODE`).
 - **ChatGPT (Codex) — opt-in preset** — `zero auth chatgpt` opens a browser, you
   approve with your ChatGPT Plus/Pro/Business/Enterprise account, and the bearer is
   stored. The bearer routes to `https://chatgpt.com/backend-api/codex/responses`

internal/cli/auth.go

@@ -78,6 +78,18 @@ func runAuth(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 		return runAuthOpenRouter(args[1:], stdout, stderr, deps)
 	case "chatgpt":
 		return runAuthChatGPT(args[1:], stdout, stderr, deps)
+	case "kimi":
+		// Kimi Code is a standard device-code OAuth preset (no bespoke client
+		// like ChatGPT's Codex flow), so it reuses the generic `auth login`
+		// engine — which already opts into presets and resolves the baked-in
+		// kimi-code client_id/endpoints. `zero auth kimi` is sugar for
+		// `zero auth login kimi-code`, forwarding whatever flags the caller
+		// passed after "kimi" (--device, --scope, --help) through the real
+		// parser instead of discarding them: `zero auth kimi --help` must show
+		// help, not silently start a real device authorization, and an unknown
+		// flag or extra positional must be rejected the same way `zero auth
+		// login` rejects one.
+		return runAuthLogin(append([]string{"kimi-code"}, args[1:]...), stdout, stderr, deps)
 	default:
 		return writeExecUsageError(stderr, fmt.Sprintf("unknown auth subcommand %q", args[0]))
 	}
@@ -591,12 +603,15 @@ Commands:
   refresh <provider> [--watch]                    Force a token refresh (--watch keeps it fresh)
   openrouter                                      Log in to OpenRouter in the browser; mints an API key
   chatgpt                                         Log in to ChatGPT in the browser (Codex backend, ChatGPT Plus/Pro)
+  kimi                                            Log in to Kimi Code via device code (managed coding endpoint)
 
 A provider is any OAuth 2.0 / OIDC server. "openrouter" ('zero auth openrouter')
-works out of the box. "xai" ('zero auth login xai') uses a built-in preset that is
-off by default — enable it with ZERO_OAUTH_ALLOW_PRESETS=1, or set the
-ZERO_OAUTH_XAI_* vars yourself. "chatgpt" ('zero auth login chatgpt' or
-'zero auth chatgpt') uses a fixed-port loopback flow against the Codex backend.
+and "kimi-code" ('zero auth login kimi-code' or 'zero auth kimi') work out of the
+box. "xai" ('zero auth login xai') uses a built-in preset that is off by
+default — enable it with ZERO_OAUTH_ALLOW_PRESETS=1, or set the
+ZERO_OAUTH_XAI_* vars yourself. "chatgpt" ('zero auth
+login chatgpt' or 'zero auth chatgpt') uses a fixed-port loopback flow against
+the Codex backend.
 Any preset field is overridable via the env vars below. For a custom provider named <name>, set:
   ZERO_OAUTH_<NAME>_CLIENT_ID       (required)
   ZERO_OAUTH_<NAME>_CLIENT_SECRET   (optional)

internal/config/resolver.go

@@ -1088,11 +1088,12 @@ func applyCatalogDescriptor(profile *ProviderProfile, descriptor providercatalog
 			merged[key] = value
 		}
 		profile.CustomHeaders = merged
-	} else if strings.EqualFold(strings.TrimSpace(descriptor.ID), "aimlapi") && !canonicalCatalogEndpoint {
-		// AIMLAPI attribution is owned by the catalog endpoint. A profile can retain
-		// those generated headers after its base URL is edited; strip their names
-		// before sending requests to an arbitrary staging/proxy host while preserving
-		// unrelated headers explicitly supplied by the user.
+	} else if len(descriptor.CustomHeaders) > 0 && !canonicalCatalogEndpoint {
+		// Catalog-owned headers (AIMLAPI attribution, Kimi's X-Msh-* device
+		// identity, etc.) are only valid against the catalog endpoint. A profile
+		// can retain those generated headers after its base URL is edited; strip
+		// their names before sending requests to an arbitrary staging/proxy host
+		// while preserving unrelated headers explicitly supplied by the user.
 		for profileKey := range profile.CustomHeaders {
 			for catalogKey := range descriptor.CustomHeaders {
 				if strings.EqualFold(profileKey, catalogKey) {

internal/config/resolver_test.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -1561,6 +1562,49 @@ func TestApplyCatalogDescriptorStripsAimlapiAttributionFromRetargetedProfile(t *
 	}
 }
 
+// setKimiUserConfigRoot redirects os.UserConfigDir() to a throwaway temp dir
+// before the kimi-code descriptor's RuntimeHeaders (kimiidentity.Headers) run,
+// so this test never creates or touches the real kimi-device-id file.
+func setKimiUserConfigRoot(t *testing.T) {
+	t.Helper()
+	root := t.TempDir()
+	switch runtime.GOOS {
+	case "windows":
+		t.Setenv("APPDATA", root)
+	case "darwin":
+		t.Setenv("HOME", root)
+	default:
+		t.Setenv("XDG_CONFIG_HOME", root)
+	}
+}
+
+func TestApplyCatalogDescriptorStripsKimiIdentityFromRetargetedProfile(t *testing.T) {
+	setKimiUserConfigRoot(t)
+	descriptor, err := providercatalog.Require("kimi-code")
+	if err != nil {
+		t.Fatal(err)
+	}
+	profile := ProviderProfile{
+		BaseURL: "https://proxy.example.test/v1",
+		CustomHeaders: map[string]string{
+			"x-msh-platform":  "kimi_code_cli",
+			"X-Msh-Device-Id": "persisted-device-id",
+			"X-Environment":   "staging",
+		},
+	}
+
+	applyCatalogDescriptor(&profile, descriptor, true)
+
+	for key := range profile.CustomHeaders {
+		if strings.HasPrefix(strings.ToLower(key), "x-msh-") {
+			t.Fatalf("kimi identity headers survived retargeting: %#v", profile.CustomHeaders)
+		}
+	}
+	if profile.CustomHeaders["X-Environment"] != "staging" {
+		t.Fatalf("user header was removed: %#v", profile.CustomHeaders)
+	}
+}
+
 func TestResolveProviderProfileParseThinkTagsFalseAlias(t *testing.T) {
 	path := writeConfig(t, `{
 		"activeProvider": "custom",