feat(auth): add Kimi Code OAuth login

[euxaristia]

Summary

Adds a first-class Kimi Code OAuth login to Zero, listed directly below ChatGPT in the OAuth options.

Kimi is modeled on the generic device-code preset path (like xAI), not the bespoke ChatGPT/Codex path — because Kimi's returned access token works directly as a Bearer on its managed coding endpoint, so no claim extraction is needed.

Changes

• internal/providercatalog/catalog.go — new kimi catalog entry, OpenAI-compatible at https://api.kimi.com/coding/v1, flagged OAuth + OAuthDeviceFlow, RequiresAuth with no API-key env var. Placed immediately after the ChatGPT entry so it appears below ChatGPT in the OAuth provider list.
• internal/oauth/presets.go — kimi device-code preset (auth.kimi.com endpoints, public kimi-code client_id); overridable via ZERO_OAUTH_KIMI_*.
• internal/cli/auth.go — adds zero auth kimi sugar routing to the generic device-code login; lists kimi below chatgpt in the help text.
• internal/tui/provider_wizard.go — mentions Kimi in the OAuth method subtitle and includes it in the OAuth provider list.
• docs/oauth-subscriptions.md — documents the Kimi Code OAuth path.
• Tests: presets_test.go, catalog_test.go, oauth_test.go updated.

Safety / ToS note

The preset ships the public kimi-code client_id and Moonshot's auth.kimi.com endpoints copied from the open-source kimi-code CLI. It does nothing a user couldn't already do manually (standard RFC 8628 device-code flow, no client spoofing). Off by default; enable with ZERO_OAUTH_ALLOW_PRESETS=1 or explicit env overrides.

Verification

• go fmt, go vet, golangci-lint (unused,ineffassign,staticcheck), and govulncheck pass (no issues in modified files).
• go test ./internal/oauth/... ./internal/providercatalog/... ./internal/cli/... pass.

🤖 Generated with Zero

Summary by CodeRabbit

• New Features

  • Added Kimi Code as a supported provider, using its OpenAI-compatible coding service.
  • Added Kimi OAuth authentication with device-code sign-in.
  • Added zero auth kimi as a shortcut for starting authentication.
  • Included Kimi in provider selection and one-click OAuth options.

• Documentation

  • Expanded OAuth setup guidance for Kimi Code, including configuration, endpoints, presets, and environment variable overrides.

[coderabbitai]

Warning

Review limit reached

@euxaristia, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 54 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d962fbb3-2e5f-43b1-b0a4-b4f9d15a14c8

📥 Commits

Reviewing files that changed from the base of the PR and between 2a296f5 and 94cafb7.

📒 Files selected for processing (8)

• docs/oauth-subscriptions.md
• internal/cli/auth.go
• internal/oauth/presets.go
• internal/oauth/presets_test.go
• internal/providercatalog/catalog.go
• internal/providercatalog/catalog_test.go
• internal/providercatalog/oauth_test.go
• internal/tui/provider_wizard.go

Walkthrough

Kimi Code is added as an OpenAI-compatible device-code OAuth provider, with a built-in preset, CLI authentication shorthand, catalog coverage, wizard text, tests, and setup documentation.

Changes

Kimi OAuth integration

Layer / File(s)	Summary
Provider catalog registration and classification internal/providercatalog/catalog.go, internal/providercatalog/*_test.go	Adds Kimi Code with its managed coding endpoint and updates catalog ordering and OAuth classification tests.
OAuth preset and CLI authentication internal/oauth/presets.go, internal/oauth/presets_test.go, internal/cli/auth.go	Adds Kimi’s device-code preset, validates its resolved configuration, and supports zero auth kimi with updated help text.
Wizard and OAuth setup guidance internal/tui/provider_wizard.go, docs/oauth-subscriptions.md	Lists Kimi in the OAuth wizard and documents its device-code flow, endpoints, token usage, and environment overrides.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CLI as zero auth kimi
  participant Login as runAuthLogin
  participant Preset as Kimi OAuth preset
  participant OAuth as Kimi OAuth endpoints
  participant API as Kimi managed coding endpoint
  CLI->>Login: invoke Kimi login
  Login->>Preset: resolve device-flow configuration
  Login->>OAuth: request device code and token
  OAuth-->>Login: return access token
  Login->>API: use bearer token on coding endpoint

Loading

Suggested reviewers: vasanthdev2004, anandh8x

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding Kimi Code OAuth login.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/kimi-oauth-login

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Zero automated PR review

Verdict: No blockers found

Blockers

• None found.

Validation

• [pass] Diff hygiene: git diff --check
• [pass] Tests: go test ./...
• [pass] Build: go run ./cmd/zero-release build
• [pass] Smoke build: go run ./cmd/zero-release smoke

Scope

Head: 94cafb7f5407
Changed files (8): docs/oauth-subscriptions.md, internal/cli/auth.go, internal/oauth/presets.go, internal/oauth/presets_test.go, internal/providercatalog/catalog.go, internal/providercatalog/catalog_test.go, internal/providercatalog/oauth_test.go, internal/tui/provider_wizard.go

This deterministic review checks validation status and basic diff hygiene. A human reviewer still owns product judgment and design quality.

[euxaristia]

Superseded by Gitlawb#708 (wrong target repo).