fix(agent-core-v2): support services.moonshot_search config for WebSearch

[7Sageer]

Related Issue

No prior issue — this came out of running the release-e2e suite against the experimental agent-core-v2 engine (KIMI_CODE_EXPERIMENTAL_FLAG=1), where the tool-skill-web-search scenario failed.

Problem

In v1, the WebSearch tool's backend has two sources, and the authoritative one is the [services.moonshot_search] config section (an api_key and/or an oauth ref) — it works without any OAuth login. The v2 rewrite only wired the OAuth-derived path: WebSearchProviderService resolves a provider solely from the managed managed:kimi-code provider's oauth ref (i.e. only after a successful Kimi login).

Consequence: any environment that configures web search purely through services.moonshot_search (api key, no login) gets no provider, the self-registering WebSearch tool stays hidden, and model tool calls return Tool "WebSearch" not found. This is exactly what the release-e2e home does, so the scenario failed under v2.

What changed

• New src/app/auth/configSection.ts — registers the services config section: the zod schema plus the snake_case↔camelCase TOML transforms (including nested oauth and custom_headers normalization, and preserving unknown top-level services verbatim), mirroring v1's ServicesConfigSchema. moonshot_fetch is included in the schema as a placeholder for the web domain but is not wired yet. It lives in the auth domain because that domain's login/logout flows provision/clear the section and its WebSearchProviderService consumes moonshot_search; it self-registers via registerConfigSection so the config domain never imports this domain.
• webSearchService.ts — injects IConfigService and resolves the provider as fromServicesConfig() ?? fromManagedOAuth(), keeping v1's precedence (explicit config wins over the OAuth-derived provider). The config path requires baseUrl, accepts an oauth ref (resolved via IOAuthService.resolveTokenProvider) and/or an apiKey (blank strings treated as absent), and attaches the host Kimi identity headers plus customHeaders.
• index.ts — exports the new module.
• Tests in test/app/auth/auth.test.ts covering config-only, oauth-ref resolution, config-over-OAuth precedence, blank apiKey, and TOML round-trip.

Verified: agent-core-v2 typecheck + lint:domain + full test suite (236 files / 3177 tests) green; staged diff audited for internal identifiers (clean).

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

[changeset-bot]

🦋 Changeset detected

Latest commit: c947a67

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@moonshot-ai/kimi-code	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@moonshot-ai/kimi-code@c947a67

npx https://pkg.pr.new/@moonshot-ai/kimi-code@c947a67

commit: c947a67