cookbook-bridge 0.1.11 → 0.1.12

package/README.md

@@ -2,6 +2,12 @@
 
 ## Changelog
 
+**0.1.12** (2026-09-02)
+- Kimi Code is the fourth agent: `connect` finds `kimi`, mints a "Kimi" token and writes `~/.kimi-code/mcp.json` (owner-only, other servers kept). Runs use `kimi -p ... --output-format stream-json`; the board gets live text and the work log, resume by session id, and a duration-only receipt (kimi reports no token counts).
+- A headless kimi run approves every tool and has no `--allowedTools` flag, so the Bridge turns the config's `--allowedTools` into a per-run agent file (`--agent-file`, a 0600 temp file) whose tools allowlist is exactly that list. `doctor` fails a Kimi agent that has no `--allowedTools`.
+- Billing protection also hides `KIMI_API_KEY`, `MOONSHOT_API_KEY` and `KIMI_MODEL_API_KEY`.
+- `doctor` gained Kimi rows: version, login (config.toml providers or OAuth credentials), the MCP file, and the two flags a headless run needs.
+
 **0.1.11** (2026-09-02)
 - The Bridge has a home: `~/.cookbook/config.json` (file 0600, folder 0700) for every command. `bridge.state.json`, `local.json` and `bridge.log` sit next to it. Before, the config lived next to `bridge.mjs`, so every `npx cookbook-bridge@latest` landed in a fresh cache folder and lost it. A config found next to `bridge.mjs` is copied to the home once (the old file stays) and the move is announced in one line. `--config <path>` and `COOKBOOK_CONFIG` still win.
 - `connect` runs the Bridge right after the approval (pass `--no-run` to stop at "connected"). With no agent CLI found it prints the doctor instead.
@@ -25,7 +31,7 @@
 - Set `COOKBOOK_NO_BROWSER=1` to stop `login`/`connect` from opening a browser (the URL is still printed).
 
 
-Runs your **own AI agents** (Claude Code, Codex, Gemini) on **your own subscriptions**,
+Runs your **own AI agents** (Claude Code, Codex, Gemini, Kimi Code) on **your own subscriptions**,
 against your Cookbook workspaces — so tasks on the board get done by your agents
 automatically, on your machine, with **no API credits**.
 
@@ -45,7 +51,7 @@ Trust model: your Cookbook's `/security` page.
 
 ```bash
 npx cookbook-bridge@latest connect   # ONE approval connects the Bridge AND every installed
-                                     # agent CLI (claude, codex, agy, openclaw), each with its
+                                     # agent CLI (claude, codex, agy, kimi, openclaw), each with its
                                      # own attributed token, then RUNS the Bridge. Leave it open.
 ```
 
@@ -89,7 +95,7 @@ attribution label, "Claude · via you"), then configures each CLI via its own `m
 **Account → Tokens** page.
 
 Requires **Node 18+** (built-in `fetch`, no npm install) and at least one agent CLI
-installed and logged in (`claude`, `agy` — the Antigravity CLI for Gemini — or the Codex app). Each agent must also be
+installed and logged in (`claude`, `agy` — the Antigravity CLI for Gemini — `kimi`, or the Codex app). Each agent must also be
 connected to Cookbook over MCP — that's how it completes tasks. Run `doctor`; it tells
 you exactly which parts are ready and how to fix the rest.
 
@@ -143,6 +149,8 @@ local files are behind.
     "command": ["claude", "-p", "{prompt}", "--allowedTools", "mcp__cookbook__*", "--output-format", "json"] },
   { "name": "Gemini", "match": ["gemini"], "enabled": true,
     "command": ["agy", "-p", "{prompt}", "--sandbox", "--print-timeout", "3600s"] },
+  { "name": "Kimi", "match": ["kimi"], "enabled": true,
+    "command": ["kimi", "-p", "{prompt}", "--allowedTools", "mcp__cookbook__*", "--output-format", "stream-json"] },
   { "name": "Codex", "match": ["codex", "chatgpt"], "enabled": false, "runner": "app-server",
     "command": ["/Applications/Codex.app/Contents/Resources/codex"] }
 ]
@@ -158,6 +166,13 @@ local files are behind.
   usual cause — `doctor` checks it.
 - **Codex (ChatGPT)** runs through `codex app-server` (its headless `exec` can't call
   MCP tools); see `_setup` in `config.example.json` for the 3-step enable.
+- **Kimi Code** runs `kimi -p` with `--output-format stream-json` (live text, work log,
+  session resume; no token counts, so the receipt is duration only). Its headless mode
+  approves every tool and has no `--allowedTools` flag, so the Bridge turns that value
+  into a per-run agent file (`--agent-file`) whose `tools:` allowlist is exactly the
+  list. Keep it on the command; `doctor` fails a Kimi agent without it. `connect`
+  writes `~/.kimi-code/mcp.json` (kimi has no `mcp add`). Kimi does not stream its
+  thinking, so a long think looks like silence to `livenessTimeoutSeconds`.
 - `"default"`: which agent takes tasks assigned to **any**.
 
 ## What rides into (and out of) every run
@@ -180,9 +195,11 @@ you opt an agent in, and only tasks explicitly posted as goals are ever eligible
 
 ## Safety rails (on by default)
 
-- **Billing protection**: vendor API keys (`ANTHROPIC_API_KEY` etc.) are hidden from
-  agent processes, so a task can never silently bill your API account instead of your
-  subscription. Opt out with `"allowApiKeyBilling": true`.
+- **Billing protection**: vendor API keys (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`,
+  `GEMINI_API_KEY`, `GOOGLE_API_KEY`, `KIMI_API_KEY`, `MOONSHOT_API_KEY`,
+  `KIMI_MODEL_API_KEY`) are hidden from agent processes, so a task can never silently
+  bill your API account instead of your subscription. Opt out with
+  `"allowApiKeyBilling": true`.
 - **Vulnerable-version gate**: gemini-cli below 0.39.1 (the CVSS-10.0 RCE fix) is refused; agy below 1.1.1 (headless MCP) is refused.
 - **Who can use your agents**: `"acceptFrom": "anyone"` (default) or a list of member
   names (e.g. `["dp", "pierre"]`); per-agent overrides supported. Plus the per-person

package/bridge.mjs

@@ -33,7 +33,7 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
-import { callsFromStreamLine, foldCallEvent, wireCalls } from "./live.mjs";
+import { callsFromStreamLine, foldCallEvent, wireCalls, shortTool, argFor } from "./live.mjs";
 import { planFromStreamLine, notePlan, planLine } from "./plan.mjs";
 
 // Node version guard: below 18 there is no global fetch and none of this runs. One
@@ -59,6 +59,7 @@ import { resolveAgentForTask } from "./chef.mjs";
 import { locateConfig, cli, updateLine, configHome } from "./update.mjs";
 let listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings, agentsQuery;
 let agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION, withCookbookMcp, isClaudeCommand, withApprovalRelay, materializeMcpConfig;
+let isKimiCommand, kimiFromLine, kimiResultEnvelope, kimiCommand, kimiLoginState, kimiMcpState, checkKimiVersion;
 let extractUsage, displayText;
 let volunteeringEnabled, volunteerCandidates, decisionPrompt, parseDecision, MAX_DECISIONS_PER_POLL, mergeVolunteerSettings, effectiveCapabilities;
 let buildPrompt, buildThreadFollowUpPrompt;
@@ -75,7 +76,8 @@ async function loadRuntime() {
   ({ connectAgentsProgrammatic, detectClis } = await import("./device.mjs"));
   ({ listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings, fetchHands, claimHandsCall, reportHandsResult, agentsQuery } = await import("./cookbook.mjs"));
   ({ serveCalls, describeCall, hostingMode, which: whichExec, argvForSpawn, redact: redactText, resolveCmdShim, killTree } = await import("./hands.mjs"));
-  ({ agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION, withCookbookMcp, isClaudeCommand, withApprovalRelay, materializeMcpConfig } = await import("./harden.mjs"));
+  ({ agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION, withCookbookMcp, isClaudeCommand, withApprovalRelay, materializeMcpConfig,
+    isKimiCommand, kimiFromLine, kimiResultEnvelope, kimiCommand, kimiLoginState, kimiMcpState, checkKimiVersion } = await import("./harden.mjs"));
   ({ extractUsage, displayText } = await import("./usage.mjs"));
   ({ volunteeringEnabled, volunteerCandidates, decisionPrompt, parseDecision, MAX_DECISIONS_PER_POLL, mergeVolunteerSettings, effectiveCapabilities } = await import("./volunteer.mjs"));
   ({ buildPrompt, buildThreadFollowUpPrompt } = await import("./prompt.mjs"));
@@ -123,6 +125,7 @@ function ensureAgentPath() {
   if (home) {
     dirs.push(path.join(home, ".claude/local")); // claude CLI local install
     dirs.push(path.join(home, ".bun/bin"), path.join(home, ".local/bin"));
+    dirs.push(path.join(process.env.KIMI_CODE_HOME || path.join(home, ".kimi-code"), "bin")); // kimi's install-script binary
     try {
       const base = path.join(home, ".nvm/versions/node");
       const vers = fs.readdirSync(base).sort();
@@ -405,20 +408,30 @@ export function shouldKill({ streaming, startedAt, lastActivityAt, now, liveness
 export function withModel(command, model) {
   if (!Array.isArray(command) || !model) return command;
   const base = String(command[0] ?? "").split(/[\\/]/).pop().toLowerCase();
-  if (base !== "claude") return command;
+  // Kimi: `-m <alias>` (an alias from ~/.kimi-code/config.toml). Same replace rule.
+  const kimi = base === "kimi" || base === "kimi.exe";
+  if (base !== "claude" && !kimi) return command;
+  const flags = kimi ? ["-m", "--model"] : ["--model"];
   const out = [];
   for (let i = 0; i < command.length; i++) {
-    if (command[i] === "--model") { i++; continue; }
+    if (flags.includes(command[i])) { i++; continue; }
     if (String(command[i]).startsWith("--model=")) continue;
     out.push(command[i]);
   }
-  out.push("--model", model);
+  out.push(kimi ? "-m" : "--model", model);
   return out;
 }
 
 export function resumeCommand(command, sessionId) {
   if (!Array.isArray(command) || !sessionId) return { command, resumed: false };
   const base = String(command[0] ?? "").split(/[\\/]/).pop().toLowerCase();
+  if (base === "kimi" || base === "kimi.exe") {
+    // Kimi resumes with `-S <id>` (the id its session.resume_hint line carried).
+    // kimiCommand drops the --allowedTools jail on a resume: the session keeps
+    // the agent file it was created with, and kimi refuses --agent-file here.
+    if (command.some((a) => a === "-S" || a === "--session" || a === "-r" || a === "--resume")) return { command, resumed: true };
+    return { command: [command[0], "-S", sessionId, ...command.slice(1)], resumed: true };
+  }
   if (base !== "claude") return { command, resumed: false };
   if (command.includes("--resume")) return { command, resumed: true };
   return { command: [command[0], "--resume", sessionId, ...command.slice(1)], resumed: true };
@@ -438,7 +451,14 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
     // The bearer token leaves argv here: an inline --mcp-config JSON becomes a 0600
     // temp file (harden.mjs materializeMcpConfig), removed when the run ends.
     const mat = materializeMcpConfig ? materializeMcpConfig(command) : { command, cleanup: () => {} };
-    const [cmd, ...rawArgs] = mat.command;
+    // KIMI JAIL: `--allowedTools X` becomes a per-run agent file (0600) whose tools
+    // allowlist is X, because kimi's headless mode approves every tool and has no
+    // such flag (harden.mjs kimiCommand). Dropped on a resume, where the session
+    // already carries it. Identity for every other CLI.
+    const jail = kimiCommand ? kimiCommand(mat.command) : { command: mat.command, cleanup: () => {} };
+    const kimi = isKimiCommand ? isKimiCommand(jail.command) : false;
+    const cleanupRun = () => { jail.cleanup(); mat.cleanup(); };
+    const [cmd, ...rawArgs] = jail.command;
     // PROMPT DELIVERY. claude reads the prompt from stdin when `-p` has no
     // positional prompt (synthesis.mjs relies on the same). That keeps workspace
     // text out of argv: no argument-length ceiling, and on Windows no cmd.exe
@@ -459,7 +479,7 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
       // or refuse with the fix (hands.mjs resolveCmdShim).
       const script = resolveCmdShim ? resolveCmdShim(bare) : null;
       if (!script) {
-        mat.cleanup();
+        cleanupRun();
         reject(new Error(`refusing to pass a prompt through the ${path.basename(bare)} shell shim on Windows (cmd.exe quoting is not safe for workspace text). Point this agent's command at the CLI's .js entry or its real executable instead.`));
         return;
       }
@@ -476,7 +496,7 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
         ...(agent.cwd ? { cwd: agent.cwd } : {}),
       });
     } catch (e) {
-      mat.cleanup();
+      cleanupRun();
       reject(new Error(`could not launch \`${cmd}\`: ${e.message}`));
       return;
     }
@@ -499,13 +519,19 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
     let partialText = "";
     // Live CALLS (show the work): tool_use/tool_result folded into a capped list.
     let calls = [];
+    // Kimi: the last assistant text is the run's answer (no result line exists);
+    // it becomes a claude-shaped envelope on close (harden.mjs kimiResultEnvelope).
+    let kimiText = "";
+    let kimiTurns = 0;
     const liveText = () => {
       const full = partialText ? `${turnsText}${turnsText ? "\n\n" : ""}${partialText}` : turnsText;
       return full.length > LIVE_TEXT_CAP ? "…" + full.slice(-LIVE_TEXT_CAP) : full;
     };
     const emit = () => {
       const text = liveText();
-      if (!onProgress || (acc.input_tokens === 0 && acc.output_tokens === 0 && !text)) return;
+      // A tick with only calls (a run that reads before it speaks; every kimi run,
+      // whose stream carries no token counts) is still worth showing.
+      if (!onProgress || (acc.input_tokens === 0 && acc.output_tokens === 0 && !text && !calls.length)) return;
       lastEmit = Date.now();
       // session_ref rides every tick once known: the server-visible resume handle that
       // lets a Composer-thread follow-up continue THIS conversation (0064), surviving
@@ -541,6 +567,24 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
         // text throttle (still ≥300ms apart so a burst of reads is one tick).
         let touched = false;
         for (const ev of callsFromStreamLine(line)) { calls = foldCallEvent(calls, ev); touched = true; }
+        if (kimi) {
+          // Kimi's lines are keyed by `role` (claude's by `type`), so the claude
+          // parsers above ignore them and this is the only reader.
+          const kev = kimiFromLine(line);
+          if (kev) {
+            if (kev.sessionId && !sessionId) sessionId = kev.sessionId;
+            if (kev.text) {
+              turnsText += (turnsText ? "\n\n" : "") + kev.text;
+              kimiText = kev.text;
+              kimiTurns++;
+            }
+            for (const c of kev.calls) {
+              calls = foldCallEvent(calls, c.kind === "call" ? { kind: "call", id: c.id, name: shortTool(c.name), arg: argFor(c.input) } : c);
+              touched = true;
+            }
+            if (kev.retry) log(`  ↳ ${agent.name}: kimi is retrying its API (${kev.retry.attempt}/${kev.retry.max}): ${kev.retry.error}`);
+          }
+        }
         // The CLI also says where the member's plan stands (claude: rate_limit_event).
         // Remembered per vendor; the next heartbeat carries it (bridge/plan.mjs).
         const plan = planFromStreamLine(line);
@@ -577,15 +621,18 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
 
     child.on("error", (e) => {
       clearInterval(watchdog);
-      mat.cleanup();
+      cleanupRun();
       reject(new Error(`could not launch \`${cmd}\` (is it installed + on PATH?): ${e.message}`));
     });
     child.on("close", (code) => {
       clearInterval(watchdog);
-      mat.cleanup();
+      cleanupRun();
       // In streaming mode, hand back the final result line (json-mode-identical); fall
       // back to the raw buffer if the run died before emitting one.
-      resolve({ code, out: streaming ? (resultLine || lineBuf || out) : out, err, sessionId });
+      const kimiOut = kimi && streaming
+        ? kimiResultEnvelope({ text: kimiText, sessionId, durationMs: Date.now() - startedAt, code, err, numTurns: kimiTurns })
+        : null;
+      resolve({ code, out: kimiOut ?? (streaming ? (resultLine || lineBuf || out) : out), err, sessionId });
     });
   });
 }
@@ -694,6 +741,11 @@ function failureHint(result) {
   const tail = tailSrc.split("\n").slice(-2).join(" ").slice(0, 240);
   if (infra.includes("not logged in") || infra.includes("please log in"))
     return "the agent CLI isn't logged in → run `claude auth login`";
+  // Kimi's own error strings (stderr: "error: failed to run prompt: provider.connection_error: …").
+  if (infra.includes("provider.connection_error") || infra.includes("connection error"))
+    return "the agent CLI can't reach its API (a network or DNS block on the vendor's hosts) → check the connection, then try `kimi -p hi` by hand";
+  if (infra.includes("no provider") || infra.includes("default_model") || infra.includes("no model configured"))
+    return "kimi has no provider configured → run `kimi login`";
   if (infra.includes("no mcp") || infra.includes("requires authentication"))
     return `the agent can't reach the Cookbook MCP → run \`${cli("doctor")}\``;
   if (infra.includes("not allowed") || infra.includes("allowedtools"))
@@ -947,7 +999,8 @@ function detectAgentsForStatus(cfg) {
   const rows = cfg.agents.map((a) => {
     const cmd = Array.isArray(a.command) ? a.command[0] : null;
     const binary = resolveBin(cmd);
-    return { name: a.name, vendor: vendorOf ? vendorOf(a) : "other", binary, found: !!binary, enabled: true, runner: a.runner ?? "cli", configured: true };
+    const vendor = isKimiCommand && isKimiCommand(a.command) ? "kimi" : (vendorOf ? vendorOf(a) : "other");
+    return { name: a.name, vendor, binary, found: !!binary, enabled: true, runner: a.runner ?? "cli", configured: true };
   });
   try {
     for (const cli of detectClis ? detectClis() : []) {
@@ -2550,6 +2603,30 @@ async function doctorReport(args) {
         }
       }
 
+      // Kimi Code: version (no gate), login (config.toml providers / credentials),
+      // the user-level mcp.json the Bridge writes, and the two flags a headless
+      // run needs (the jail and the stream).
+      if (isKimiCommand && isKimiCommand(cmd)) {
+        const { version } = await checkKimiVersion([bin]);
+        if (version) ok(`${agent.name}: kimi ${version}`);
+        else warn(`${agent.name}: couldn't read kimi version`, "run `kimi --version` by hand");
+        const login = kimiLoginState();
+        if (login.loggedIn) ok(`${agent.name}: logged in (${login.providers.length ? `provider ${login.providers.join(", ")}` : `${login.credentials} OAuth credential(s)`})`);
+        else bad(`${agent.name}: no Kimi login found (no provider with a key in ${login.configPath}, nothing under credentials/)`, "run `kimi login` (device code), or `/login` inside `kimi`");
+        const mcp = kimiMcpState({ cookbookUrl: cfg.cookbookUrl });
+        if (mcp.server && mcp.matches && mcp.hasAuth) ok(`${agent.name}: Cookbook MCP configured (${mcp.file})`);
+        else if (mcp.server) warn(`${agent.name}: MCP server 'cookbook' in ${mcp.file} points at ${mcp.url || "(no url)"}${mcp.hasAuth ? "" : " with no Authorization header"}`, `expected ${cfg.cookbookUrl}/api/mcp with a bearer token; re-run \`${cli("connect")}\``);
+        else bad(`${agent.name}: no 'cookbook' server in ${mcp.file}`, `run \`${cli("connect")}\` (kimi has no \`mcp add\`; the Bridge writes this file)`);
+        const cmdArgs = agent.command || [];
+        if (!cmdArgs.includes("--allowedTools")) {
+          bad(`${agent.name}: no --allowedTools in the command; kimi's headless mode auto-approves EVERY tool (Bash included) and has no flag of its own`,
+            `add "--allowedTools", "mcp__cookbook__*" to this agent's command (the Bridge turns it into a per-run agent file)`);
+        } else if (cmdArgs.includes("-S") || cmdArgs.includes("--session") || cmdArgs.includes("-c")) {
+          warn(`${agent.name}: the command resumes a session by hand, so --allowedTools is ignored on that run (kimi binds the agent at session creation)`);
+        }
+        if (!cmdArgs.includes("stream-json")) warn(`${agent.name}: no --output-format stream-json; the board gets no live progress and no work log from this agent`, `add "--output-format", "stream-json" to this agent's command`);
+      }
+
       if (isClaudeCommand && isClaudeCommand(agent.command)) {
         if (agent.token) ok(`${agent.name}: runs carry their own Cookbook connection (per-agent token) — identity is this Bridge's member`);
         else warn(`${agent.name}: no per-agent token — runs use the claude CLI's OWN Cookbook login, which may be a different account and inherits stale claude.ai connectors`,

package/config.example.json

@@ -8,7 +8,7 @@
   "livenessTimeoutSeconds": 300,
   "_concurrency": "How many task runs may be in flight at once. Runs launch in parallel up to this cap; the atomic pre-claim keeps every task single-runner.",
   "maxConcurrentRuns": 3,
-  "_billing": "Agents run on the CLI subscriptions you already pay for. The Bridge hides ANTHROPIC_API_KEY / OPENAI_API_KEY / GEMINI_API_KEY / GOOGLE_API_KEY from agent processes so a task can never silently bill your API account instead. Set allowApiKeyBilling to true ONLY if you explicitly want API-key billing.",
+  "_billing": "Agents run on the CLI subscriptions you already pay for. The Bridge hides ANTHROPIC_API_KEY / OPENAI_API_KEY / GEMINI_API_KEY / GOOGLE_API_KEY / KIMI_API_KEY / MOONSHOT_API_KEY / KIMI_MODEL_API_KEY from agent processes so a task can never silently bill your API account instead. Set allowApiKeyBilling to true ONLY if you explicitly want API-key billing.",
   "allowApiKeyBilling": false,
   "_volunteering": "STIGMERGY (off by default): an agent with volunteer:true watches tasks posted as open GOALS (to:'goal' on the board) and may claim ones matching its capabilities — decided by one cheap call to the agent's own CLI, gated by your delegation policy (ask parks it in your approvals inbox), claimed atomically, capped per poll. Flip volunteering:false to kill it globally without touching agents.",
   "volunteering": true,
@@ -57,6 +57,25 @@
       "_allowedTools": "The prefix matches HOW your Claude is connected to Cookbook: a CLI-added server (claude mcp add ... cookbook ...) exposes mcp__cookbook__*; the claude.ai/desktop CONNECTOR exposes mcp__claude_ai_Cookbook__*. If tasks run but never complete, this mismatch is the usual cause; `npx cookbook-bridge@latest doctor` (tarball: `node bridge/bridge.mjs doctor`) checks it.",
       "_output": "json output lets the Bridge report what each task cost (tokens/$) back to the board — text works too, you just lose the usage report"
     },
+    {
+      "name": "Kimi",
+      "match": [
+        "kimi",
+        "moonshot"
+      ],
+      "enabled": true,
+      "command": [
+        "kimi",
+        "-p",
+        "{prompt}",
+        "--allowedTools",
+        "mcp__cookbook__*",
+        "--output-format",
+        "stream-json"
+      ],
+      "_setup": "Kimi Code CLI (install: curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash, or npm i -g @moonshot-ai/kimi-code; needs 0.39+). Auth: `kimi login` (device code) or /login inside `kimi`; providers live in ~/.kimi-code/config.toml. MCP: `npx cookbook-bridge@latest connect` (tarball: `node bridge/bridge.mjs connect`) writes ~/.kimi-code/mcp.json owner-only (kimi has no `mcp add`). Headless `-p` refuses --yolo/--auto and ALWAYS runs with every tool auto-approved, so --allowedTools is required here: kimi has no such flag, the Bridge turns it into a per-run agent file (--agent-file) whose tools allowlist is exactly this list. Without it, a task's text could run Bash on this machine.",
+      "_usage": "kimi's stream-json carries no token counts; the board shows wall-clock duration for its runs. Thinking is not streamed either, so a long think looks like silence: keep livenessTimeoutSeconds generous on a Kimi-heavy board."
+    },
     {
       "name": "Codex",
       "match": [

package/device.mjs

@@ -12,7 +12,7 @@
  *
  * `connect-agents` runs the same flow but asks for one attributed token per agent
  * CLI found on this machine, then configures each CLI (Claude, Gemini/agy, Codex,
- * OpenClaw). The pieces are exported separately so Bridge Local (local.mjs) can run
+ * OpenClaw, Kimi). The pieces are exported separately so Bridge Local (local.mjs) can run
  * the identical flow behind a button: beginDeviceFlow → waitForDeviceToken →
  * saveLoginConfig → configureClis.
  *
@@ -31,6 +31,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { listWorkspaces } from "./cookbook.mjs";
 import { which, argvForSpawn } from "./hands.mjs";
+import { kimiHome } from "./harden.mjs";
 import { locateConfig, writeConfigFile, cli, updateLine, checkForUpdate } from "./update.mjs";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
@@ -157,6 +158,7 @@ function exampleAgentVendor(a) {
   if (base === "claude") return "claude";
   if (base === "agy" || base === "gemini") return "gemini";
   if (base === "codex") return "codex";
+  if (base === "kimi" || base === "kimi.exe") return "kimi";
   return "other";
 }
 
@@ -184,7 +186,7 @@ export function seedConfigFromExample(example, found, { log = () => {} } = {}) {
     if (a.runner === "app-server" && hit?.path) a.command = [hit.path];
   }
   cfg.agents = kept;
-  const preferred = ["claude", "codex", "gemini", "openclaw"];
+  const preferred = ["claude", "codex", "gemini", "kimi", "openclaw"];
   const enabled = kept.filter((a) => a.enabled !== false);
   const dflt = preferred.map((v) => enabled.find((a) => exampleAgentVendor(a) === v)).find(Boolean) ?? enabled[0] ?? kept[0] ?? null;
   if (dflt) cfg.default = dflt.name; else delete cfg.default;
@@ -230,6 +232,36 @@ export function findCodexBinary() {
   return which("codex");
 }
 
+/** Kimi's install script puts the binary at $KIMI_CODE_HOME/bin/kimi (~/.kimi-code/bin),
+ *  which a GUI-launched Bridge's PATH does not have; an npm install lands on PATH. */
+export function findKimiBinary({ home = os.homedir(), env = process.env } = {}) {
+  const onPath = which("kimi");
+  if (onPath) return onPath;
+  const c = path.join(kimiHome({ home, env }), "bin", process.platform === "win32" ? "kimi.exe" : "kimi");
+  try { fs.accessSync(c, fs.constants.X_OK); return c; } catch { return null; }
+}
+
+/**
+ * Kimi Code has no `mcp add`; merge-write its user-level mcp.json (docs: mcpServers.<name>
+ * with `url` + `headers` for HTTP). Other servers are kept; the cookbook entry keeps
+ * harmless tuning (timeouts, tool lists) and gets exactly one way in: this bearer.
+ * The file carries a token, so it is owner-only like config.json.
+ */
+export function kimiConfigure(url, token, { home = os.homedir(), env = process.env } = {}) {
+  const cfgPath = path.join(kimiHome({ home, env }), "mcp.json");
+  let current = {};
+  try { current = JSON.parse(fs.readFileSync(cfgPath, "utf8")) ?? {}; } catch { /* fresh file */ }
+  if (typeof current !== "object" || Array.isArray(current)) current = {};
+  const servers = current.mcpServers && typeof current.mcpServers === "object" && !Array.isArray(current.mcpServers) ? current.mcpServers : {};
+  const prev = servers.cookbook && typeof servers.cookbook === "object" ? servers.cookbook : {};
+  const { headers: _h, bearerTokenEnvVar: _b, transport: _t, url: _u, serverUrl: _s, command: _c, args: _a, env: _e, cwd: _w, enabled: _en, ...rest } = prev;
+  current.mcpServers = { ...servers, cookbook: { ...rest, url, headers: { Authorization: `Bearer ${token}` } } };
+  fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
+  fs.writeFileSync(cfgPath, JSON.stringify(current, null, 2) + "\n", { mode: 0o600 });
+  try { fs.chmodSync(cfgPath, 0o600); } catch { /* best-effort on platforms without chmod */ }
+  return cfgPath;
+}
+
 /** agy (Antigravity) has no `mcp add`; merge-write its documented config file. */
 function agyConfigure(url, token) {
   const cfgPath = path.join(process.env.HOME || os.homedir(), ".gemini", "config", "mcp_config.json");
@@ -312,6 +344,8 @@ export function detectClis() {
   if (agy) out.push({ agent: "Gemini", vendor: "gemini", path: agy, kind: "file" });
   const codex = findCodexBinary();
   if (codex) out.push({ agent: "Codex", vendor: "codex", path: codex, kind: "codex" });
+  const kimi = findKimiBinary();
+  if (kimi) out.push({ agent: "Kimi", vendor: "kimi", path: kimi, kind: "kimi" });
   const openclaw = which("openclaw");
   if (openclaw) out.push({ agent: "OpenClaw", vendor: "openclaw", path: openclaw, kind: "openclaw" });
   return out;
@@ -355,6 +389,9 @@ export function configureClis(found, { baseUrl, agentTokens, cfgPath }) {
       } else if (cli.kind === "openclaw") {
         const wrote = openclawConfigure(mcpUrl, token);
         results.push({ agent: cli.agent, ok: true, detail: `connected (${wrote}, streamable-http)` });
+      } else if (cli.kind === "kimi") {
+        const wrote = kimiConfigure(mcpUrl, token);
+        results.push({ agent: cli.agent, ok: true, detail: `connected (${wrote})` });
       }
     } catch (e) {
       results.push({ agent: cli.agent, ok: false, detail: String(e?.message || e).slice(0, 200) });
@@ -542,14 +579,14 @@ function probeAgent(cmd) {
 /**
  * connect-agents — one command, one human approval, every installed agent CLI
  * connected to Cookbook with CORRECT ATTRIBUTION. Detects Claude, Gemini (agy),
- * Codex (ChatGPT app) and OpenClaw; mints one named token per agent in the same
+ * Codex (ChatGPT app), Kimi and OpenClaw; mints one named token per agent in the same
  * approval as the Bridge token; configures each via its official path.
  */
 export async function connectAgents(argv, { willRun = false } = {}) {
   const cfgPath = configPath(argv);
   const found = detectClis();
   if (found.length === 0) {
-    console.log("\nNo agent CLIs found (looked for: claude, agy, codex/ChatGPT.app, openclaw).");
+    console.log("\nNo agent CLIs found (looked for: claude, agy, codex/ChatGPT.app, kimi, openclaw).");
     console.log(`Install one, then re-run: ${cli("connect")}\n`);
     return { ok: false, reason: "no-agents", cfgPath };
   }

package/hands.mjs

@@ -28,6 +28,7 @@
  */
 import fs from "node:fs";
 import os from "node:os";
+import { kimiLoginState } from "./harden.mjs";
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 
@@ -138,6 +139,7 @@ export const SETUP_FILES = Object.freeze([
   ".codex-bridge/config.toml",                     // the Bridge's own Codex home
   ".gemini/config/mcp_config.json",                // agy's MCP config (agy has no `mcp add`)
   ".gemini/antigravity-cli/settings.json",
+  ".kimi-code/mcp.json",                           // kimi's MCP servers (kimi has no `mcp add`)
   ".openclaw/openclaw.json",
   ".cookbook/config.json",                          // Bridge config (projected: tokens stripped)
   ".cookbook/bridge.state.json",                    // attempt counters (projected)
@@ -173,6 +175,8 @@ const NEVER_READ = Object.freeze([
   /(^|\/)\.codex\/auth\.json$/i,
   /(^|\/)\.codex-bridge\/auth\.json$/i,
   /(^|\/)\.gemini\/oauth_creds\.json$/i,
+  /(^|\/)\.kimi-code\/credentials(\/|$)/i,          // kimi OAuth credentials (dir + files)
+  /(^|\/)\.kimi-code\/config\.toml$/i,             // kimi keeps provider API keys HERE, not in env
   /(^|\/)\.openclaw\/(auth|credentials)[^/]*$/i,
   /(^|\/)\.ssh(\/|$)/i,
   /(^|\/)\.gnupg(\/|$)/i,
@@ -812,6 +816,7 @@ const VERBS = {
         claude: marker(".claude/.credentials.json"),
         codex: marker(".codex/auth.json"),
         gemini: marker(".gemini/oauth_creds.json"),
+        kimi: kimiLoginState({ home }).loggedIn,
         openclaw: marker(".openclaw"),
       },
       setup_files_present: SETUP_FILES.filter((rel) => marker(rel)),

package/harden.mjs

@@ -19,6 +19,12 @@
  * 3. AGY VERSION GATE — Antigravity CLI (gemini's successor) below 1.1.1 cannot call
  *    MCP tools in headless -p mode: the run LOOKS fine but complete_task never lands,
  *    burning every attempt. Confirmed-old versions are refused with a clear message.
+ *
+ * 4. KIMI CODE CONTRACT (0.1.12): the fourth vendor's CLI shape lives at the bottom
+ *    of this file: stream parsing, the per-run tool jail (kimi has no --allowedTools),
+ *    login and MCP state. Kept here rather than in a new module so the shipped file
+ *    lists (BRIDGE_RUNTIME_FILES, next.config tracing, package.json files) stay as
+ *    they are.
  */
 import fs from "node:fs";
 import os from "node:os";
@@ -26,7 +32,15 @@ import path from "node:path";
 import { spawn } from "node:child_process";
 
 /** Env vars that flip the official CLIs from subscription auth to API-key billing. */
-export const API_BILLING_KEYS = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY"];
+export const API_BILLING_KEYS = [
+  "ANTHROPIC_API_KEY", "OPENAI_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY",
+  // Kimi Code reads provider keys from config.toml, not the shell, EXCEPT the
+  // env-defined model (KIMI_MODEL_NAME + KIMI_MODEL_API_KEY), which would put a
+  // Bridge run on an API key. KIMI_API_KEY / MOONSHOT_API_KEY are the names the
+  // docs and the Moonshot SDKs use; hidden too, so a future CLI that reads them
+  // cannot flip billing either.
+  "KIMI_API_KEY", "MOONSHOT_API_KEY", "KIMI_MODEL_API_KEY",
+];
 
 /**
  * The environment agent processes get. By default: the parent env MINUS vendor billing
@@ -225,3 +239,228 @@ export function withCookbookMcp(command, { token, cookbookUrl } = {}) {
   });
   return { command: [command[0], "--strict-mcp-config", "--mcp-config", cfg, ...command.slice(1)], injected: true, reason: null };
 }
+
+// ─────────────────────────────────────────────────────────────────────────────
+// KIMI CODE (the fourth vendor, 0.1.12): the CLI contract, pinned empirically
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// Read off `kimi --help` (0.39.1), the prompt-mode emitter in the binary, and the
+// docs at moonshotai.github.io/kimi-code (2026-09-02):
+//
+//  - Headless: `kimi -p "<prompt>" --output-format stream-json`. `-p` takes the
+//    prompt as an argument (there is no stdin mode). `-p` REFUSES --yolo, --auto
+//    and --plan: prompt mode always runs in "auto" permission (every tool call is
+//    approved; static deny rules still apply). There is no --allowedTools flag.
+//    The jail is an agent file: `--agent-file <md>` whose frontmatter `tools:` is
+//    an allowlist (`mcp__cookbook__*` globs work). kimiCommand() below writes one
+//    per run from the command's `--allowedTools` value, so config.json keeps the
+//    same shape as the Claude entry and localizeCommand keeps working.
+//  - stream-json: one JSON object per stdout line, keyed by `role`:
+//      {"role":"meta","type":"system.version","version":"0.39.1"}
+//      {"role":"assistant","content":"..."}                       a finished turn's text
+//      {"role":"assistant","tool_calls":[{"type":"function","id":"...",
+//         "function":{"name":"Read","arguments":"{\"path\":\"...\"}"}}]}
+//      {"role":"tool","tool_call_id":"...","content":"..."}         the tool's output
+//      {"role":"meta","type":"turn.step.retrying","failed_attempt":1,"next_attempt":2,
+//         "max_attempts":10,"delay_ms":557.5,"error_name":"APIConnectionError",
+//         "error_message":"Connection error."}
+//      {"role":"meta","type":"session.resume_hint","session_id":"session_<uuid>",
+//         "command":"kimi -r session_<uuid>","content":"To resume this session: ..."}
+//    Thinking is never written to stdout; tool progress and notices go to stderr.
+//    No usage line exists, so the receipt is duration-only.
+//  - Resume: `-S <id>` (hidden alias `-r`), legal with `-p`, illegal with
+//    `--agent-file` (a resumed session keeps the agent it was created with).
+//  - Model: `-m <alias>`; aliases come from ~/.kimi-code/config.toml.
+//  - MCP: ~/.kimi-code/mcp.json ($KIMI_CODE_HOME/mcp.json): mcpServers.<name> with
+//    `url` (+ `headers`) for HTTP. A project-level .kimi-code/mcp.json exists but
+//    sits behind the workspace-trust prompt, so the Bridge writes the user file.
+//    Tools are named mcp__<server>__<tool>.
+//  - Login: [providers.<name>] in config.toml (api_key, or an oauth table written
+//    by `kimi login`); OAuth credentials under ~/.kimi-code/credentials/.
+
+/** Kimi's data root: $KIMI_CODE_HOME, else ~/.kimi-code. */
+export function kimiHome({ home = process.env.HOME || os.homedir(), env = process.env } = {}) {
+  return env.KIMI_CODE_HOME || path.join(home, ".kimi-code");
+}
+
+/** True when this command (argv array or bare string) runs the kimi CLI. */
+export function isKimiCommand(command) {
+  const first = Array.isArray(command) ? command[0] : command;
+  const base = String(first ?? "").split(/[\\/]/).pop().toLowerCase();
+  return base === "kimi" || base === "kimi.exe";
+}
+
+/** Probe `kimi --version` (e.g. "0.39.1"). No gate: nothing is refused, doctor prints it. */
+export async function checkKimiVersion(argv, timeoutMs = 10_000) {
+  return { version: await probeVersion(argv, timeoutMs) };
+}
+
+/** Kimi built-in tool names the live work log should read as verbs (live.mjs
+ *  already knows Read/Write/Edit/Bash/Grep/Glob/WebSearch by their lowercase). */
+const KIMI_TOOL_VERBS = { fetchurl: "fetch", readmediafile: "read", todolist: "todo", agent: "agent", agentswarm: "agent", skill: "skill" };
+
+/**
+ * One stream-json line → what the Bridge shows. Null for non-kimi lines (a claude
+ * line has `type`, never a top-level `role`). Pure.
+ *   { role, text, calls: [{kind:'call', id, name, input} | {kind:'result', id, err}],
+ *     sessionId, retry: {attempt, max, error} | null }
+ */
+export function kimiFromLine(line) {
+  let j;
+  try { j = JSON.parse(line); } catch { return null; }
+  if (!j || typeof j !== "object" || typeof j.role !== "string") return null;
+  const ev = { role: j.role, text: null, calls: [], sessionId: null, retry: null };
+  if (j.role === "assistant") {
+    if (typeof j.content === "string" && j.content.trim()) ev.text = j.content;
+    for (const tc of Array.isArray(j.tool_calls) ? j.tool_calls : []) {
+      const raw = String(tc?.function?.name ?? tc?.name ?? "").trim();
+      if (!raw) continue;
+      let input = tc?.function?.arguments ?? tc?.arguments;
+      if (typeof input === "string") { try { input = JSON.parse(input); } catch { /* partial or plain text: keep the string */ } }
+      const name = raw.startsWith("mcp__") ? raw : (KIMI_TOOL_VERBS[raw.toLowerCase()] ?? raw);
+      ev.calls.push({ kind: "call", id: String(tc?.id ?? ""), name, input });
+    }
+  } else if (j.role === "tool") {
+    ev.calls.push({ kind: "result", id: String(j.tool_call_id ?? ""), err: kimiToolFailed(j.content) });
+  } else if (j.role === "meta") {
+    if (j.type === "session.resume_hint" && typeof j.session_id === "string" && j.session_id) ev.sessionId = j.session_id;
+    if (j.type === "turn.step.retrying") {
+      ev.retry = {
+        attempt: Number(j.failed_attempt) || 0,
+        max: Number(j.max_attempts) || 0,
+        error: `${j.error_name ?? "error"}${j.error_message ? `: ${j.error_message}` : ""}`,
+      };
+    }
+  }
+  return ev;
+}
+
+/** Best-effort: a tool result that reads as a failure (kimi has no is_error flag). */
+function kimiToolFailed(content) {
+  const text = typeof content === "string" ? content : (content == null ? "" : JSON.stringify(content));
+  return /^\s*(error\b|tool error|permission denied|denied\b|command failed|failed to)/i.test(text);
+}
+
+/**
+ * The claude-shaped result envelope for a finished kimi run, so displayText,
+ * resultError, failureHint and extractUsage need no kimi branch. Pure.
+ */
+export function kimiResultEnvelope({ text = "", sessionId = null, durationMs = 0, code = 0, err = "", numTurns = 0 } = {}) {
+  const failed = typeof code === "number" && code !== 0;
+  const tail = String(err ?? "").trim().split("\n").filter(Boolean).slice(-2).join(" ").slice(0, 300);
+  return JSON.stringify({
+    type: "result",
+    subtype: failed ? "error_during_execution" : "success",
+    is_error: failed,
+    result: String(text ?? ""),
+    duration_ms: Math.max(0, Math.round(Number(durationMs) || 0)),
+    num_turns: numTurns,
+    ...(sessionId ? { session_id: sessionId } : {}),
+    ...(failed ? { errors: [tail || `kimi exited ${code}`] } : {}),
+    runner: "kimi",
+  });
+}
+
+/** Claude tool names that appear in Bridge configs → the kimi name of the same tool. */
+export const KIMI_TOOL_ALIASES = Object.freeze({ WebFetch: "FetchURL", TodoWrite: "TodoList", Task: "Agent" });
+
+/** "Bash,Read,mcp__cookbook__*" → ["Bash", "Read", "mcp__cookbook__*"], kimi names, deduped. */
+export function kimiTools(spec) {
+  const out = [];
+  for (const raw of String(spec ?? "").split(",")) {
+    const t = raw.trim();
+    // Tool names are plain tokens; anything else is not a tool and never reaches YAML.
+    if (!t || !/^[A-Za-z0-9_*.:-]+$/.test(t)) continue;
+    const name = KIMI_TOOL_ALIASES[t] ?? t;
+    if (!out.includes(name)) out.push(name);
+  }
+  return out;
+}
+
+/** The agent file that jails one run: same system prompt, only these tools.
+ *  An empty list means NO tools (kimi: `tools: []`), which is what a summary wants. */
+export function kimiAgentFile(spec) {
+  const tools = kimiTools(spec);
+  const list = tools.length ? "\n" + tools.map((t) => `  - ${t}`).join("\n") : " []";
+  return [
+    "---",
+    "name: cookbook-bridge",
+    "description: A Cookbook Bridge run. Only the tools this task was given.",
+    `tools:${list}`,
+    "---",
+    "${base_prompt}",
+    "",
+  ].join("\n");
+}
+
+/**
+ * Turn a Bridge-shaped kimi command into what the CLI accepts: `--allowedTools X`
+ * (which kimi does not have) becomes `--agent-file <0600 temp file>` carrying X as
+ * the tools allowlist. On a resume (-S/-r/-c) the flag is simply dropped: kimi
+ * refuses --agent-file there and the session already carries the jail it was
+ * created with. Identity for non-kimi commands and commands without the flag.
+ * Returns { command, file, cleanup, tools }. IO; tested.
+ */
+export function kimiCommand(command, { dir = os.tmpdir() } = {}) {
+  const noop = { command, file: null, cleanup: () => {}, tools: null };
+  if (!Array.isArray(command) || !isKimiCommand(command)) return noop;
+  const i = command.indexOf("--allowedTools");
+  if (i < 0) return noop;
+  const spec = i + 1 < command.length ? String(command[i + 1]) : "";
+  const rest = command.filter((_, k) => k !== i && k !== i + 1);
+  const resuming = rest.some((a) => ["-S", "--session", "-r", "--resume", "-c", "-C", "--continue"].includes(String(a)));
+  if (resuming || rest.includes("--agent-file") || rest.includes("--agent")) return { ...noop, command: rest };
+  const privDir = fs.mkdtempSync(path.join(dir, "cookbook-bridge-kimi-"));
+  try { fs.chmodSync(privDir, 0o700); } catch { /* best effort on platforms without modes */ }
+  const file = path.join(privDir, "agent.md");
+  fs.writeFileSync(file, kimiAgentFile(spec), { mode: 0o600 });
+  try { fs.chmodSync(file, 0o600); } catch { /* best effort */ }
+  liveMcpDirs.add(privDir);
+  installMcpExitHook();
+  const cleanup = () => {
+    liveMcpDirs.delete(privDir);
+    try { fs.rmSync(privDir, { recursive: true, force: true }); } catch { /* best effort */ }
+  };
+  return { command: [rest[0], "--agent-file", file, ...rest.slice(1)], file, cleanup, tools: kimiTools(spec) };
+}
+
+/**
+ * Is kimi logged in? Reads what `kimi login` / `/login` write: a [providers.<name>]
+ * section in config.toml with an api_key (or a [providers.<name>.env] key, or an
+ * oauth sub-table), or an OAuth credential file under credentials/. Never throws.
+ */
+export function kimiLoginState({ home = process.env.HOME || os.homedir(), env = process.env } = {}) {
+  const root = kimiHome({ home, env });
+  const configPath = path.join(root, "config.toml");
+  let toml = "";
+  try { toml = fs.readFileSync(configPath, "utf8"); } catch { /* not installed or never run */ }
+  const providers = new Set();
+  let section = null; // "providers.<name>" or "providers.<name>.env" / ".oauth"
+  for (const raw of toml.split(/\r?\n/)) {
+    const line = raw.trim();
+    const head = line.match(/^\[+\s*([^\]]+?)\s*\]+$/);
+    if (head) {
+      const name = head[1].replace(/"/g, "");
+      section = name.startsWith("providers.") ? name : null;
+      if (section && /^providers\.[^.]+\.oauth$/.test(section)) providers.add(section.split(".")[1]);
+      continue;
+    }
+    if (!section) continue;
+    if (/^(api_key|KIMI_API_KEY|MOONSHOT_API_KEY|ANTHROPIC_API_KEY|OPENAI_API_KEY|GOOGLE_API_KEY)\s*=\s*"[^"]+"/.test(line)) providers.add(section.split(".")[1]);
+  }
+  let credentials = 0;
+  try { credentials = fs.readdirSync(path.join(root, "credentials")).filter((f) => f.endsWith(".json")).length; } catch { /* none */ }
+  return { root, configPath, loggedIn: providers.size > 0 || credentials > 0, providers: [...providers], credentials };
+}
+
+/** The Cookbook entry in kimi's user-level mcp.json, judged against this Bridge's URL. */
+export function kimiMcpState({ home = process.env.HOME || os.homedir(), env = process.env, cookbookUrl = null } = {}) {
+  const file = path.join(kimiHome({ home, env }), "mcp.json");
+  let json = null;
+  try { json = JSON.parse(fs.readFileSync(file, "utf8")); } catch { /* absent or unparseable */ }
+  const srv = json && typeof json === "object" && json.mcpServers && typeof json.mcpServers === "object" ? json.mcpServers.cookbook ?? null : null;
+  const url = srv && typeof srv === "object" ? (srv.url ?? srv.serverUrl ?? null) : null;
+  const want = cookbookUrl ? `${String(cookbookUrl).replace(/\/$/, "")}/api/mcp` : null;
+  const hasAuth = !!(srv && typeof srv === "object" && ((srv.headers && srv.headers.Authorization) || srv.bearerTokenEnvVar));
+  return { file, exists: json !== null, server: srv, url, matches: !!url && (!want || url === want), hasAuth };
+}

package/local.mjs

@@ -52,7 +52,7 @@ export function modeForTools(allowedTools) {
  *  vendors' own state). Relative to home. */
 const DENIED_UNDER_HOME = [
   "Library", ".ssh", ".gnupg", ".aws", ".config", ".claude", ".codex", ".codex-bridge",
-  ".gemini", ".openclaw", ".cursor", ".npm", ".nvm", ".Trash",
+  ".gemini", ".kimi-code", ".openclaw", ".cursor", ".npm", ".nvm", ".Trash",
 ];
 
 /**
@@ -100,6 +100,7 @@ export function vendorOf(agent) {
   if (base === "claude") return "claude";
   if (base === "codex" || /ChatGPT\.app|Codex\.app/.test(cmd) || agent.runner === "app-server") return "codex";
   if (base === "agy" || base === "gemini") return "gemini";
+  if (base === "kimi") return "kimi";
   if (base === "openclaw") return "openclaw";
   return "other";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cookbook-bridge",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Run your own Claude, Codex and Gemini subscriptions against your Cookbook workspaces. One approval connects every agent CLI on your machine, with a receipt for every run.",
   "type": "module",
   "bin": {
@@ -40,7 +40,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node --test test/local.test.mjs test/review.test.mjs test/home.test.mjs"
+    "test": "node --test test/local.test.mjs test/review.test.mjs test/home.test.mjs test/kimi.test.mjs"
   },
   "keywords": [
     "cookbook",