feat: kimi agent (Moonshot Kimi Code CLI)

[lroolle]

Description

Add kimi (@moonshot-ai/kimi-code, bin kimi) as the 5th agent. Launch it like claude/codex/gemini/grok: container is the sandbox, --yolo auto-approve.

Type

• New feature

Details

• oauth default: mount ~/.kimi-code, device-code kimi login (no browser needed in-container).
• api-key mode: kimi reads NO credential from the shell env; the only shell channel is the KIMI_MODEL_* family. Map KIMI_CODE_API_KEY -> KIMI_MODEL_{NAME=k3,API_KEY,PROVIDER_TYPE=kimi,BASE_URL=https://api.kimi.com/coding/v1}; override via DEVA_KIMI_MODEL / DEVA_KIMI_BASE_URL. Key is synthesized in-memory, never written to config.toml -> no ~/.kimi-code mount, nothing on disk.
• Pin KIMI_CODE_VERSION through versions.env, Makefile, Dockerfile(+rust), version scripts, TOOL_REGISTRY, ci/nightly/release workflows, install scripts.

Related Files

agents/kimi.sh, agents/shared_auth.sh, deva.sh, versions.env, Makefile, Dockerfile, Dockerfile.rust, scripts/, .github/workflows/, docs/*

Test Plan

• scripts/test-kimi-auth.sh: KIMI_MODEL_* wiring, redaction, no-mount in api-key mode, overrides, missing-key error
• release-utils registry + version-upgrade + install-tooling tests stay green
• deva.sh kimi works in oauth and api-key modes (dry-run + real key)