feat(web): introduce Kimi web app and daemon gateway

.agents/skills/gen-changesets/SKILL.md

@@ -14,17 +14,18 @@ All other `@moonshot-ai/*` packages are treated as internal packages, including
 ## Core Rules
 
 1. **Inspect the actual changes first.** Use `git status` / `git diff --name-only` to identify which packages were actually changed.
-2. **List packages that were actually changed.** Source code, build config, package metadata, and other changes that affect a package's output or behavior need a changeset entry for that package.
-3. **Do not list unchanged internal packages.** For example, if `packages/node-sdk` was not changed, do not list `@moonshot-ai/kimi-code-sdk` just because another internal package changed. The SDK follows the same rule as other internal packages: list it only when it was actually changed.
-4. **Internal package source changes that enter the CLI bundle must manually list the CLI.** `@moonshot-ai/kimi-code` inline-bundles `@moonshot-ai/*` source, but those internal packages are devDependencies from the CLI's perspective, so changesets will not automatically propagate bumps. If a change enters the CLI output, also list `@moonshot-ai/kimi-code`.
+2. **List packages that changesets can release.** If a changed package is ignored in `.changeset/config.json`, do not put that ignored package in frontmatter together with a non-ignored package; changesets rejects mixed ignored/non-ignored frontmatter.
+3. **Map ignored internal changes to the affected released package.** If an ignored internal package changes CLI output or behavior, list `@moonshot-ai/kimi-code` and describe the actual user-visible or release-artifact change in the changelog text.
+4. **Internal package source changes that enter the CLI bundle must manually list the CLI.** `@moonshot-ai/kimi-code` inline-bundles `@moonshot-ai/*` source, but those internal packages are devDependencies from the CLI's perspective, so changesets will not automatically propagate bumps. If a change enters the CLI output, list `@moonshot-ai/kimi-code`.
+   - **Web app (`@moonshot-ai/kimi-web`) changes always enter the CLI bundle.** `@moonshot-ai/kimi-web` is ignored by changesets (see `.changeset/config.json`) and cannot be mixed with `@moonshot-ai/kimi-code` in one changeset frontmatter. Describe the web change in the changelog text, but list `@moonshot-ai/kimi-code` so the CLI release carries the bundled `dist-web` output.
 5. **Docs-only and tests-only changes usually do not need a changeset.** README, internal docs, and `test/` changes that do not enter package output do not trigger a CLI bump.
 6. `@moonshot-ai/vis` / `vis-server` / `vis-web` are ignored by changesets and should not be handled.
 
 ## Workflow
 
-1. List the packages that were actually changed.
+1. List the changed packages and check whether each one is ignored by `.changeset/config.json`.
 2. Choose a bump level for each package.
-3. If an internal package change enters the CLI bundle, add `@moonshot-ai/kimi-code`.
+3. If an ignored internal package change enters the CLI bundle, put `@moonshot-ai/kimi-code` in frontmatter instead of mixing the ignored package into the same changeset.
 4. Create a short kebab-case file under `.changeset/`.
 5. Split unrelated changes into separate changesets; keep one logical change in one file.
 
@@ -69,7 +70,6 @@ An internal package fixes a bug visible to CLI users:
 
 ```markdown
 ---
-"@moonshot-ai/agent-core": patch
 "@moonshot-ai/kimi-code": patch
 ---
 
@@ -80,7 +80,6 @@ An internal package has an internal-only change, but it enters the CLI bundle:
 
 ```markdown
 ---
-"@moonshot-ai/agent-core": patch
 "@moonshot-ai/kimi-code": patch
 ---
 
@@ -97,10 +96,46 @@ Only SDK source changed, and the CLI does not use it:
 Clarify session status typing for internal SDK callers.
 ```
 
+## Web app changes
+
+`@moonshot-ai/kimi-web` is ignored by changesets and must **never** appear in a changeset frontmatter. Because the web app is bundled into the CLI release artifact, any web change that ships must list `@moonshot-ai/kimi-code` instead and describe the actual web-facing change in the text.
+
+- If a PR contains both web UI changes and server API changes, split them into separate changesets so each entry has a focused description.
+- Do not enumerate every micro-tweak; keep it to one sentence that captures what the web user gets.
+
+Web-only fix:
+
+```markdown
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix the web chat not scrolling to the bottom after sending a message.
+```
+
+Web UI plus server APIs in the same PR (split into two changesets):
+
+```markdown
+---
+"@moonshot-ai/kimi-code": minor
+---
+
+Add the server-hosted web UI, including chat layout and session list behaviors.
+```
+
+```markdown
+---
+"@moonshot-ai/kimi-code": minor
+---
+
+Add the server REST and WebSocket APIs that power the web UI.
+```
+
 ## Red Flags
 
 - You are about to write `major` without asking the user.
 - Internal package source enters the CLI bundle, but `@moonshot-ai/kimi-code` is missing.
+- A changeset frontmatter mixes ignored internal packages with non-ignored packages.
 - `packages/node-sdk` was not changed, but `@moonshot-ai/kimi-code-sdk` was listed for "internal package sync".
 - The changelog entry is in Chinese.
 - The wording claims more than the diff actually did.

.changeset/README.md

@@ -15,14 +15,22 @@ Current publishable packages:
 
 All other workspace packages are private internal packages, are not published to npm, and are excluded via `ignore` in `.changeset/config.json`:
 
+- `@moonshot-ai/acp-adapter`
 - `@moonshot-ai/agent-core`
+- `@moonshot-ai/kaos`
 - `@moonshot-ai/kimi-code-oauth`
 - `@moonshot-ai/kimi-telemetry`
-- `@moonshot-ai/kaos`
+- `@moonshot-ai/kimi-web`
 - `@moonshot-ai/kosong`
+- `@moonshot-ai/migration-legacy`
+- `@moonshot-ai/protocol`
+- `@moonshot-ai/server`
+- `@moonshot-ai/server-e2e`
 - `@moonshot-ai/vis`
 - `@moonshot-ai/vis-server`
 - `@moonshot-ai/vis-web`
+- `daemon`
+- `kimi-migration-legacy`
 
 Version impact from internal dependencies must be judged manually. The published artifacts for CLI and SDK bundle internal workspace packages into the artifact itself; runtime `dependencies` of published packages must not include any `@moonshot-ai/*` internal workspace packages.
 

.changeset/config.json

@@ -7,9 +7,22 @@
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
   "ignore": [
+    "@moonshot-ai/acp-adapter",
+    "@moonshot-ai/agent-core",
+    "@moonshot-ai/kaos",
+    "@moonshot-ai/kimi-code-oauth",
+    "@moonshot-ai/kimi-telemetry",
+    "@moonshot-ai/kimi-web",
+    "@moonshot-ai/kosong",
+    "@moonshot-ai/migration-legacy",
+    "@moonshot-ai/protocol",
+    "@moonshot-ai/server",
+    "@moonshot-ai/server-e2e",
     "@moonshot-ai/vis",
     "@moonshot-ai/vis-server",
-    "@moonshot-ai/vis-web"
+    "@moonshot-ai/vis-web",
+    "daemon",
+    "kimi-migration-legacy"
   ],
   "snapshot": {
     "useCalculatedVersion": true,

.changeset/sdk-api-refactor.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code-sdk": patch
+---
+
+Add host-side config helpers `loadRuntimeConfigSafe` and `resolveConfigPath` for inspecting config without spinning up a full KimiCore.

.changeset/server-web-release.md

@@ -0,0 +1,10 @@
+---
+"@moonshot-ai/kimi-code": minor
+---
+
+Add the server-hosted web UI and the CLI commands that power it:
+
+- `kimi server` to start, stop, and manage the local server.
+- `kimi web` to open the server-hosted web UI in a browser.
+- Server REST and WebSocket APIs for the web client.
+- Web chat layout, session list, auto-scroll, and related behaviors.

.github/workflows/_native-build.yml

@@ -85,6 +85,13 @@ jobs:
           node apps/kimi-code/scripts/update-catalog.mjs --out "$CATALOG_FILE"
           echo "KIMI_CODE_BUILT_IN_CATALOG_FILE=$CATALOG_FILE" >> "$GITHUB_ENV"
 
+      - name: Build Kimi web assets
+        # The SEA blob step embeds apps/kimi-code/dist-web; build the web app
+        # and stage its assets before producing the native executable.
+        run: |
+          pnpm --filter @moonshot-ai/kimi-web run build
+          node apps/kimi-code/scripts/copy-web-assets.mjs
+
       - name: Build native executable (release profile, macOS signed)
         if: runner.os == 'macOS' && inputs.sign-macos
         run: pnpm --filter @moonshot-ai/kimi-code run build:native:release

.github/workflows/ci.yml

@@ -82,3 +82,9 @@ jobs:
             echo "Typechecking ${config}"
             pnpm dlx --package @typescript/native-preview@beta tsgo -p "${config}" --noEmit
           done
+      - name: Typecheck kimi-web (vue-tsc)
+        run: pnpm --filter @moonshot-ai/kimi-web run typecheck
+      - name: Typecheck vis-server
+        run: pnpm --filter @moonshot-ai/vis-server run typecheck
+      - name: Typecheck vis-web
+        run: pnpm --filter @moonshot-ai/vis-web run typecheck

.github/workflows/pkg-pr-new.yml

@@ -36,6 +36,9 @@ jobs:
       - name: Build package dependencies
         run: pnpm run build:packages
 
+      - name: Build Kimi web assets
+        run: pnpm --filter @moonshot-ai/kimi-web run build
+
       - name: Generate Kimi Code built-in catalog
         shell: bash
         run: |

.gitignore

@@ -1,5 +1,6 @@
 node_modules/
 dist/
+dist-web/
 dist-single/
 dist-native/
 .tmp-api-extractor/
@@ -14,3 +15,12 @@ coverage/
 plugins/cdn/
 superpowers
 .worktrees/
+
+Dockerfile
+!packages/daemon-e2e/Dockerfile
+docker-compose.yml
+.dockerignore
+
+docs/superpowers/
+reports/
+.superpowers/

AGENTS.md

@@ -15,13 +15,16 @@ This is a TypeScript monorepo built for agent-assisted development. Keep the roo
 ## Project Map
 
 - `apps/kimi-code`: the CLI / TUI application. It consumes core capabilities through `@moonshot-ai/kimi-code-sdk` and must not depend directly on `@moonshot-ai/agent-core`. When writing or modifying its terminal UI, use the `write-tui` skill (`.agents/skills/write-tui/SKILL.md`).
+- `apps/kimi-web`: the browser web UI, a peer to the TUI. Vue 3 + Vite + vue-i18n; talks to the server over REST + WebSocket under `/api/v1`. It must not depend on `@moonshot-ai/agent-core` (wire types are re-implemented locally). See `apps/kimi-web/AGENTS.md`.
 - `apps/vis`, `apps/vis/server`, `apps/vis/web`: visual debugging tools for sessions and replays.
-- `packages/agent-core`: the unified agent engine, including Agent, Session, profile, skills, tools, plan, permission, background, records, and other core capabilities.
+- `packages/agent-core`: the unified agent engine, including Agent, Session, profile, skills, tools, plan, permission, background, records, the in-process DI service layer (`src/services/`), and other core capabilities.
 - `packages/node-sdk`: the public TypeScript SDK and harness.
 - `packages/kosong`: the LLM / provider abstraction layer.
 - `packages/kaos`: the execution environment and file/process abstractions.
 - `packages/oauth`: Kimi OAuth and managed auth utilities.
 - `packages/telemetry`: shared client-side telemetry infrastructure.
+- `packages/server`: the Kimi Code server. Hosts `agent-core` sessions and exposes them over REST + WebSocket (`/api/v1`); bootstrapped from `src/start.ts` and consumed by `apps/kimi-code`. See `packages/server/AGENTS.md`.
+- `packages/server-e2e`: live e2e tests and scenarios against a running server (`KIMI_SERVER_URL`, default `http://127.0.0.1:58627`). See `packages/server-e2e/AGENTS.md`.
 
 ## Environment Requirements
 
@@ -32,9 +35,11 @@ This is a TypeScript monorepo built for agent-assisted development. Keep the roo
 ## Monorepo Workspace Maintenance
 
 - `pnpm-workspace.yaml` is the source of truth for workspace membership, but `flake.nix` also contains **hardcoded** `workspacePaths` and `workspaceNames` lists.
-- **Whenever you add or remove a workspace package, you MUST update both `pnpm-workspace.yaml` and `flake.nix`.**
+- **Whenever you add or remove a workspace package, you MUST update both `pnpm-workspace.yaml` and `flake.nix` — for every package, including leaf / test / e2e packages that nothing depends on.**
+  - `pnpm-workspace.yaml` uses globs (`packages/*`, `apps/*`), so most packages land there automatically; `flake.nix` is fully manual and is where omissions happen.
   - Missing a path in `flake.nix`'s `workspacePaths` will silently drop files from the Nix build's `src` fileset.
   - Missing a name in `flake.nix`'s `workspaceNames` will break `pnpmConfigHook` because dependencies for that workspace will not be fetched.
+- The automated "Check flake.nix workspace sync" (`scripts/check-nix-workspace.mjs`) only validates the transitive dependency **closure of `@moonshot-ai/kimi-code`**. A leaf package outside that closure (e.g. an e2e package nobody imports) slips through even when it is missing from `flake.nix`. A green check is therefore NOT proof that `flake.nix` is fully in sync — keep it updated by hand on every add/remove, do not rely on the check to catch omissions.
 
 ## General Coding Rules
 

apps/kimi-code/package.json

@@ -27,13 +27,16 @@
   },
   "files": [
     "dist",
+    "dist-web",
     "scripts/postinstall.mjs",
     "scripts/postinstall",
     "README.md"
   ],
   "type": "module",
   "imports": {
     "#/tui/theme": "./src/tui/theme/index.ts",
+    "#/cli/sub/server": "./src/cli/sub/server/index.ts",
+    "#/cli/sub/server/*": "./src/cli/sub/server/*.ts",
     "#/*": [
       "./src/*.ts",
       "./src/*/index.ts",
@@ -45,8 +48,8 @@
     "provenance": true
   },
   "scripts": {
+    "build": "pnpm -C ../kimi-web run build && tsdown && node scripts/copy-web-assets.mjs",
     "prebuild": "node scripts/build-vis-asset.mjs",
-    "build": "tsdown",
     "catalog:update": "node scripts/update-catalog.mjs --out dist/built-in-catalog.json",
     "smoke": "node scripts/smoke.mjs",
     "build:native:js": "node scripts/native/01-bundle.mjs",
@@ -58,6 +61,8 @@
     "test:native:smoke": "node scripts/native/smoke.mjs",
     "dev": "node scripts/dev.mjs",
     "dev:cli-only": "tsx --import ../../build/register-raw-text-loader.mjs ./src/main.ts",
+    "dev:server": "tsx --tsconfig ./tsconfig.dev.json --import ../../build/register-raw-text-loader.mjs ./src/main.ts server run --foreground",
+    "dev:server:restart": "node scripts/dev-server-restart.mjs",
     "dev:plugin-marketplace": "node scripts/dev-plugin-marketplace-server.mjs",
     "build:plugin-marketplace": "node scripts/build-plugin-marketplace-cdn.mjs",
     "dev:prod": "node dist/main.mjs",
@@ -70,15 +75,26 @@
   },
   "optionalDependencies": {
     "@mariozechner/clipboard": "^0.3.2",
-    "koffi": "^2.16.0"
+    "chalk": "^5.4.1",
+    "cli-highlight": "^2.1.11",
+    "commander": "^13.1.0",
+    "koffi": "^2.16.0",
+    "node-pty": "^1.1.0",
+    "pathe": "^2.0.3",
+    "pino-pretty": "^13.0.0",
+    "semver": "^7.7.4",
+    "smol-toml": "^1.6.1",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@earendil-works/pi-tui": "^0.74.0",
     "@moonshot-ai/acp-adapter": "workspace:^",
     "@moonshot-ai/kimi-code-oauth": "workspace:^",
     "@moonshot-ai/kimi-code-sdk": "workspace:^",
     "@moonshot-ai/kimi-telemetry": "workspace:^",
+    "@moonshot-ai/kimi-web": "workspace:^",
     "@moonshot-ai/migration-legacy": "workspace:^",
+    "@moonshot-ai/server": "workspace:^",
     "@moonshot-ai/vis-server": "workspace:^",
     "@moonshot-ai/vis-web": "workspace:*",
     "@types/semver": "^7.7.0",

apps/kimi-code/scripts/copy-web-assets.mjs

@@ -0,0 +1,27 @@
+import { cp, rm, stat } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const appRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const repoRoot = resolve(appRoot, '../..');
+const source = resolve(repoRoot, 'apps/kimi-web/dist');
+const target = resolve(appRoot, 'dist-web');
+
+async function assertBuiltWeb() {
+  try {
+    const info = await stat(resolve(source, 'index.html'));
+    if (!info.isFile()) {
+      throw new Error('index.html is not a file');
+    }
+  } catch {
+    throw new Error(
+      `Kimi web build output was not found at ${source}. Run \`pnpm --filter @moonshot-ai/kimi-web run build\` first.`,
+    );
+  }
+}
+
+await assertBuiltWeb();
+await rm(target, { recursive: true, force: true });
+await cp(source, target, { recursive: true });
+
+console.log(`Copied Kimi web assets to ${target}`);