feat(kimi): add Moonshot Kimi Code CLI as a launchable agent - #486
Conversation
|
Claude encountered an error after 1s —— View job I'll analyze this and get back to you. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 743567d51e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| ./scripts/test-image-precedence.sh |
There was a problem hiding this comment.
This step unconditionally executes ./scripts/test-image-precedence.sh, but that file is absent from the reviewed commit (confirmed with both rg --files and git ls-tree -r). Consequently, every CI smoke job reaches this step and fails with “No such file or directory”; add the script to the commit or remove the step.
Useful? React with 👍 / 👎.
| local model="${DEVA_KIMI_MODEL:-k3}" | ||
| local base_url="${DEVA_KIMI_BASE_URL:-https://api.kimi.com/coding/v1}" |
There was a problem hiding this comment.
When an API-key Kimi container already exists, changing DEVA_KIMI_MODEL or DEVA_KIMI_BASE_URL does not take effect: these values are only added to the creation-time docker run environment, while the persistent attach path reuses the same container name and its docker exec does not pass them again. Because the name/shape calculation does not include either override, the documented switch from the coding endpoint to a direct Moonshot provider can silently continue using the old model and URL; hash these values into the persistent container identity or pass them on attach.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
Adds Moonshot’s Kimi Code CLI as a first-class, launchable deva.sh kimi agent (matching the existing claude/codex/gemini/grok integration style), including its unique API-key-via-KIMI_MODEL_* auth wiring, and also lands a fix for traced launches by serializing cctrace CA installation inside the container.
Changes:
- Introduce the new
kimiagent with OAuth (mounted~/.kimi-code) and API-key mode (in-memoryKIMI_MODEL_*provider synthesis; no~/.kimi-codemount), plus--tracewrapping via cctrace. - Wire
KIMI_CODE_VERSIONthrough version pinning, build/release tooling, and CI, and add targeted smoke/tests for the new agent/auth behavior. - Fix
--tracereliability by locking CA trust-store installation and ensuring traced runs use distinct container identities.
Reviewed changes
Copilot reviewed 36 out of 36 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| versions.env | Updates shared tool/version pins; adds KIMI_CODE_VERSION. |
| tests/version-upgrade.sh | Extends version-upgrade test fixtures for Kimi and adds a pins round-trip guard. |
| tests/test_release_utils.sh | Updates tool-registry expectations to include kimi-code. |
| scripts/version-upgrade.sh | Adds Kimi to upgrade flow, env overrides, and build args. |
| scripts/version-pins.sh | Adds KIMI_CODE_VERSION to the pinned var list. |
| scripts/update-version-pins.sh | Adds KIMI_CODE_VERSION to emit/refresh logic. |
| scripts/test-kimi-auth.sh | New smoke test for kimi auth wiring (oauth + api-key + trace) in dry-run mode. |
| scripts/test-install-agent-tooling.sh | Extends install-tooling stubs to include kimi. |
| scripts/resolve-tool-versions.sh | Adds kimi_code_version resolution for workflow outputs/labels. |
| scripts/release-utils.sh | Registers kimi-code in the release tool registry. |
| scripts/install-agent-tooling.sh | Installs @moonshot-ai/kimi-code and verifies its --version. |
| README.md | Updates marketing/overview text and examples to include Kimi. |
| Makefile | Plumbs KIMI_CODE_VERSION through build args and status output. |
| llms.txt | Updates project synopsis/usage to include Kimi. |
| install.sh | Installs the new agents/kimi.sh module. |
| docs/troubleshooting.md | Updates auth-home troubleshooting text to include .kimi-code. |
| docs/quick-start.md | Adds Kimi to quick-start and API-key usage examples. |
| docs/philosophy.md | Updates narrative docs to include Kimi among supported agents. |
| docs/index.md | Updates docs index copy to include Kimi. |
| docs/how-it-works.md | Extends config-home layout docs and examples for Kimi. |
| docs/authentication.md | Documents Kimi’s OAuth mount and API-key-to-KIMI_MODEL_* mapping. |
| docs/advanced-usage.md | Notes Kimi tracing behavior alongside other traced agents. |
| Dockerfile.rust | Adds Kimi version label/arg to rust image metadata. |
| Dockerfile | Adds Kimi version label/arg to main image metadata and installs it via tooling stage. |
| docker-entrypoint.sh | Serializes cctrace CA installation with flock and avoids set -e subshell traps. |
| deva.sh | Adds Kimi agent integration: mounts, config-home handling, env filtering, version labels, and trace container identity changes. |
| DEV-LOGS.md | Adds dev-log entries describing the trace fix and Kimi agent integration. |
| CHANGELOG.md | Documents the added Kimi agent and the trace fix in Unreleased. |
| agents/shared_auth.sh | Adds shared --trace flag filtering and enables kimi auth parsing. |
| agents/kimi.sh | New agent module implementing Kimi command, trace wrapping, and auth wiring. |
| agents/grok.sh | Refactors --trace flag parsing to the shared helper. |
| agents/codex.sh | Refactors --trace flag parsing to the shared helper. |
| .github/workflows/release.yml | Adds Kimi pin outputs and passes KIMI_CODE_VERSION into builds. |
| .github/workflows/nightly-images.yml | Adds Kimi pin outputs and passes KIMI_CODE_VERSION into builds. |
| .github/workflows/ci.yml | Passes KIMI_CODE_VERSION into CI builds and adds kimi smoke/auth tests. |
| .deva.example | Updates example config comments to include Kimi in the hybrid layout. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| CODEX_VERSION=0.145.0 | ||
| GEMINI_CLI_VERSION=0.51.0 | ||
| GROK_CLI_VERSION=0.2.106 | ||
| KIMI_CODE_VERSION=0.28.1 |
| ARG GROK_CLI_VERSION=0.2.93 | ||
| ARG KIMI_CODE_VERSION=0.28.0 | ||
| ARG CCX_VERSION=v0.7.0 |
| ARG CLAUDE_CODE_VERSION=2.1.143 | ||
| ARG CODEX_VERSION=0.131.0 | ||
| ARG GEMINI_CLI_VERSION=0.42.0 | ||
| ARG GROK_CLI_VERSION=0.2.93 | ||
| ARG KIMI_CODE_VERSION=0.28.0 |
First of two commits on this branch (kimi, then cloak). This commit is kimi plus the maintenance that rode with it. - kimi (#455): `deva.sh kimi`, oauth default + api-key. kimi reads no API key from the shell except the KIMI_MODEL_* family, so api-key mode synthesizes an in-memory provider from KIMI_CODE_API_KEY and nothing lands on disk. Pin, docs, CI/nightly/release wiring, tests. - refactor(trace): extract shared filter_trace_flag from the codex/grok inline --trace detection into agents/shared_auth.sh. - fix(#414): serialize the cctrace CA install under flock and exit 0 explicitly so set -e stops killing traced launches in baked images. - chore(pins): refresh CLI pins (claude 2.1.217, codex 0.145, gemini 0.51, grok 0.2.106, cctrace 0.19, ccx 0.11, playwright 1.61, go 1.26.5). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Claude encountered an error after 1s —— View job I'll analyze this and get back to you. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 36 out of 36 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
versions.env:16
- KIMI_CODE_VERSION is pinned to 0.28.1 here, but the rest of the PR consistently references 0.28.0 (e.g., Dockerfile/Dockerfile.rust ARG defaults and CHANGELOG/DEV-LOGS text). This mismatch will make local builds and docs disagree about which kimi version is actually being shipped.
Fifth agent:
deva.sh kimilaunches @moonshot-ai/kimi-code like claude/codex/gemini/grok.The auth model broke the premise the other agents share. kimi reads NO API key
from the shell --
KIMI_API_KEYdoes nothing, credentials come only from~/.kimi-code/config.toml. Its one shell channel is the
KIMI_MODEL_*family,which synthesizes an in-memory provider. So api-key mode maps
KIMI_CODE_API_KEYontoKIMI_MODEL_{NAME,API_KEY,PROVIDER_TYPE,BASE_URL}(default k3, https://api.kimi.com/coding/v1; override via DEVA_KIMI_MODEL /
DEVA_KIMI_BASE_URL). The key is synthesized in memory and never written to
config.toml, so api-key mode mounts no ~/.kimi-code and nothing lands on disk.
Simpler than grok: kimi's npm bin is a plain symlink, no self-update
trampoline, so no binary pinning and no update-guard tmpfs.
KIMI_CODE_VERSION wired through versions.env, Makefile, Dockerfile(+rust),
version-pins/upgrade/update scripts, and the ci/nightly/release workflows.
Also rides here (bundled before the branch split, flagging rather than
rewriting history): the #414 fix serializing the cctrace CA install under
flock, including the follow-on where the subshell ended on a failed
[ "$VERBOSE" = "true" ] && echoand set -e killed every non-verbose tracedlaunch.
Test plan
redaction, naming, no-mount, overrides, missing-key error
Closes #455