Skip to content

feat(engines): add kimi (Kimi Code) - #286

Merged
ralyodio merged 1 commit into
mainfrom
worktree-engine-kimi
Aug 4, 2026
Merged

feat(engines): add kimi (Kimi Code)#286
ralyodio merged 1 commit into
mainfrom
worktree-engine-kimi

Conversation

@ralyodio

@ralyodio ralyodio commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Adds kimi to moshcode's engines, so moshcode install kimi, /agents kimi, /start kimi, headless ai(), and the skill fan-out all work.

Aliases: kimi-cli, kimi-code, moonshot.

Verified against the binary, not the docs

The kimi-cli reference documents the deprecated Python kimi-cli. The maintained product is Kimi Code, and it differs in ways that would have shipped broken:

kimi-cli docs Kimi Code 0.32.0 (actual)
install code.kimi.com/install.sh that wrapper is a deprecation prompt; use code.kimi.com/kimi-code/install.sh
upgrade uv tool upgrade kimi-cli kimi upgrade
headless --quiet -p -p (no --quiet)
MCP kimi mcp add … subcommand removed
skills dir ~/.kimi/skills ~/.kimi-code/skills

The install.sh the docs name now prompts and, on Enter or a 30s timeout, silently redirects to the kimi-code installer. moshcode install can't drive an installer that blocks on a human, so it calls the real one directly.

Details

  • agents: --yolo (auto-approves tool calls, agent may still ask). No agentsView — Kimi Code has no agent list to land on, so /agents kimi is the autonomous session. (--auto also suppresses questions; that's a step past what /agents means for the other engines.)
  • mcp: skipped with a reason. Kimi Code runs MCP servers but has no scriptable mcp add — they live in ~/.kimi-code/mcp.json or the in-session /mcp-config picker, and moshcode drives engines' CLIs rather than writing their config files.

Two supporting changes

  • Engines gain binDirs, which tools already had. Kimi's installer writes to ~/.kimi-code/bin and only appends it to your shell rc, so PATH alone reports it missing in the session that just installed it.
  • /mcp list now reads "no mcp add command" rather than "no MCP support". The column reports what moshcode can drive; "no MCP support" would be a false claim about kimi and send the reader hunting for an engine they already have.

Testing

Full suite green (1242 tests, 0 fail). End-to-end against a real Kimi Code 0.32.0 install: moshcode engines shows it installed, and moshcode start kimi --version passes through and prints 0.32.0.

🤖 Generated with Claude Code

`moshcode install kimi`, `/agents kimi`, `/start kimi`, headless `ai()`, and
the skill fan-out. Aliases: kimi-cli, kimi-code, moonshot.

Verified against the real binary (Kimi Code 0.32.0) rather than the kimi-cli
reference docs, which describe the deprecated Python CLI and differ in ways
that matter:

- install: the kimi-code installer directly. The code.kimi.com/install.sh
  wrapper those docs name now installs the deprecated kimi-cli, and it prompts
  — Enter or a 30s timeout redirects to kimi-code anyway. `moshcode install`
  cannot drive an installer that blocks on a human.
- agents: `--yolo` (auto-approve tool calls). No agentsView — Kimi Code has no
  agent list to land on, so /agents kimi is the autonomous session.
- upgrade: `kimi upgrade`, its own native updater.
- ai(): `-p <prompt>`. There is no `--quiet`/`--final-message-only` here.
- skills: clones into $KIMI_CODE_HOME/skills (default ~/.kimi-code/skills).
- mcp: skipped with a reason. Kimi Code runs MCP servers but dropped the
  `mcp add` subcommand — they live in ~/.kimi-code/mcp.json or the in-session
  /mcp-config picker, and moshcode drives engines' CLIs, not their config.

Two supporting changes:

- engines gain `binDirs`, as tools already have. Kimi's installer writes to
  ~/.kimi-code/bin and only appends it to your shell rc, so PATH alone reports
  it missing in the session that just installed it.
- the /mcp list column now reads "no mcp add command" instead of "no MCP
  support". It reports what moshcode can drive; "no MCP support" would be a
  false claim about kimi and send the reader looking for another engine.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

88 finding(s)

HIGH/CRITICAL: 50 | MEDIUM: 38

Severity Rule Location
HIGH manifest-typosquat apps/pwa/package.json:19
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH secret-generic-credential apps/pwa/test/apikey-bearer-scheme.test.mjs:30
HIGH secret-generic-credential apps/pwa/test/apikey-mask.test.mjs:38
HIGH secret-generic-credential apps/pwa/test/apikey-reveal.test.mjs:35
HIGH secret-generic-credential apps/pwa/test/approvals-context.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/approvals-credits.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/approvals-notify.test.mjs:26
HIGH secret-generic-credential apps/pwa/test/approvals-resolve-race.test.mjs:20
HIGH secret-generic-credential apps/pwa/test/auth-form-email.test.mjs:29
HIGH secret-generic-credential apps/pwa/test/auth-form-email.test.mjs:33
HIGH secret-generic-credential apps/pwa/test/auth-page-error.test.mjs:36
HIGH secret-generic-credential apps/pwa/test/cli-device-token.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/cli-pages-balance.test.mjs:32
HIGH secret-generic-credential apps/pwa/test/cli-token.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/credits-pack.test.mjs:51
HIGH secret-generic-credential apps/pwa/test/credits-webhook-event-match.test.mjs:35
HIGH secret-generic-credential apps/pwa/test/credits-webhook.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/csrf-input-escaping.test.mjs:31
HIGH secret-generic-credential apps/pwa/test/csrf-input-escaping.test.mjs:101
HIGH secret-generic-credential apps/pwa/test/logout-csrf.test.mjs:29
HIGH secret-generic-credential apps/pwa/test/moshpit-api-key.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-bulk-claim.test.mjs:23
HIGH secret-generic-credential apps/pwa/test/moshpit-claim-full-name.test.mjs:29
HIGH secret-generic-credential apps/pwa/test/moshpit-crawlable.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-ending-page.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-pins.test.mjs:22
HIGH secret-generic-credential apps/pwa/test/moshpit-pit-page.test.mjs:33
HIGH secret-generic-credential apps/pwa/test/moshpit-records-page.test.mjs:23
HIGH secret-generic-credential apps/pwa/test/moshpit-records.test.mjs:23
HIGH secret-generic-credential apps/pwa/test/moshpit-registry.test.mjs:20
HIGH secret-generic-credential apps/pwa/test/moshpit-related-endings.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-sales.test.mjs:16
HIGH secret-generic-credential apps/pwa/test/moshpit-search.test.mjs:74
HIGH secret-generic-credential apps/pwa/test/moshpit-terms.test.mjs:19
HIGH secret-generic-credential apps/pwa/test/moshpit-tlds-pagination.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/passkey-register-duplicate.test.mjs:38
HIGH secret-generic-credential apps/pwa/test/require-auth-next.test.mjs:31
HIGH secret-generic-credential apps/pwa/test/require-auth-next.test.mjs:35
HIGH secret-generic-credential apps/pwa/test/sessions-output-seq.test.mjs:30
HIGH secret-generic-credential apps/pwa/test/sessions-paste.test.mjs:24
HIGH secret-generic-credential apps/pwa/test/sessions-stream-replay.test.mjs:34
HIGH secret-generic-credential apps/pwa/test/sessions.test.mjs:24
HIGH secret-generic-credential apps/pwa/test/signature.test.mjs:6
HIGH secret-generic-credential test/auth.test.mjs:13
HIGH secret-generic-credential test/auth.test.mjs:63
HIGH secret-generic-credential test/console-cookie-malformed.test.mjs:15
HIGH secret-generic-credential test/console.test.mjs:12
HIGH secret-generic-credential test/mirror.test.mjs:37
HIGH secret-generic-credential test/mirror.test.mjs:77

…and 38 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio marked this pull request as ready for review August 4, 2026 13:14
@ralyodio
ralyodio merged commit 4f0026a into main Aug 4, 2026
4 checks passed
@ralyodio
ralyodio deleted the worktree-engine-kimi branch August 4, 2026 13:14
ralyodio added a commit that referenced this pull request Aug 4, 2026
`/install qwen` and `/install deepseek` now resolve, alongside the kimi
entry added in #286.

qwen is a Gemini CLI fork, so it reuses gemini's `--approval-mode=yolo`
for agent mode — `--yolo`/`-y` names the same mode, and passing both is a
hard error, so only one form is wired.

deepseek has no first-party CLI; `@serjm/deepseek-code` is the live
community one. The two names that get suggested alongside it are dead
ends: `deepseek-tui` is now a stub whose own description says it was
renamed to `codewhale`, and `deepseek-cli` has not shipped since January
2025. Its package installs `dsc` and `deepseek-code`; we launch the long
name, because `dsc` collides with Microsoft's Desired State
Configuration binary and the short name would silently start the wrong
program on a machine that has both.

The agents/start test loop now writes its stub under the engine's *bin*
rather than its key. Those were the same string for every engine until
now; deepseek is the first where they differ, and a stub named after the
key would leave nothing on PATH to find.

MCP and skills fan-out stay opt-in per engine, so both new engines report
"no support" there until their native `mcp add` surfaces are wired.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@ralyodio ralyodio mentioned this pull request Aug 4, 2026
ralyodio added a commit that referenced this pull request Aug 4, 2026
Three more coding engines you can install and drive: Kimi Code, Qwen
Code, and DeepSeek Code (#286, #287). `moshcode install kimi | qwen |
deepseek` now resolve, each with reviewed autonomous-mode flags behind
`agents` and a headless mode behind moshscript's ai().

Two of those entries route around a bad name. kimi installs the
kimi-code script directly, because the older code.kimi.com wrapper now
installs the deprecated Python kimi-cli and blocks on a prompt for 30
seconds. deepseek launches `deepseek-code` rather than the `dsc` alias
its package also installs, because `dsc` is Microsoft's Desired State
Configuration binary on a machine that has both.

`template list` grew a --json form for automation (#284).

Also fixes a DoH config that dropped its default guards when only one of
them was overridden (#285).

Minor, not patch: three new engines and a new output format.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant