210cedb3bf
* feat(kimi-desktop): add Electron desktop client wrapping kimi-web
New apps/kimi-desktop — a thin Electron shell + process manager around
the existing web UI. It reuses kimi-code's shared daemon: it runs the
bundled SEA's `server run` (the same ensureDaemon reuse-or-spawn flow as
`kimi web`), reads ~/.kimi-code/server/lock for the real origin, and
loads the SEA-served kimi-web same-origin. The daemon is left running on
quit so the CLI / browser / TUI keep sharing it.
- main process: ensure-server (run SEA, read lock, confirm healthz),
sea-path (dev vs packaged), window + native menu + window-state +
loading/error screens
- packaging: electron-builder config; before-pack stages the
matching-platform SEA into <resources>/bin/<target>
- CI: desktop-build workflow builds unsigned mac/win/linux installers,
each runner building its own SEA
- workspace wiring: register in flake.nix, allow electron postinstall
(onlyBuiltDependencies), root dev:desktop + typecheck entries
v1 is unsigned, default icon, no auto-update.
* feat(kimi-desktop): sign + notarize macOS builds
Unsigned macOS builds are blocked by Gatekeeper ("app is damaged") once
transferred to another Mac. Add Developer ID signing + Apple notarization,
mirroring the TUI native build:
- build/entitlements.mac.plist: hardened-runtime entitlements (allow-jit,
disable-library-validation for koffi/clipboard, etc.) applied to the app
and — via entitlementsInherit — the nested SEA backend
- electron-builder.config.cjs (replaces .yml): hardenedRuntime + entitlements;
signing and notarization are env-driven (CSC_* + KIMI_DESKTOP_NOTARIZE +
APPLE_API_* ), so the same config builds unsigned locally or signed+notarized
- desktop-build CI: sign-macos input reuses the existing macos-keychain-setup
action + APPLE_* secrets, notarizes via the notary API key
- README: document signing, the Developer-ID requirement, and the
"don't rename the .app" gotcha
Verified locally that electron-builder signs both the app and the nested SEA
with hardened runtime + the entitlements, and the signed app still launches and
serves the web UI. Notarization itself needs a Developer ID cert (CI / a machine
that has one).
* feat(kimi-desktop): rename product to Kimi Code Desktop
productName / window title / menu label / error-screen text all use
"Kimi Code Desktop" so the bundle name matches its executable (a
mismatch from manual renaming is itself reported as "damaged").
* ci(kimi-desktop): build and attach desktop installers in the release pipeline
Make desktop-build.yml reusable (workflow_call) and invoke it from the
release workflow, mirroring the native-build pipeline, so each release
also attaches signed+notarized macOS, Windows and Linux desktop
installers to the GitHub Release.
* feat(kimi-desktop): brand the desktop as an internal testing build
- Add an inline 'internal testing build' tag next to the Kimi Code brand
in the sidebar header, shown only inside the desktop app.
- Use a hidden native title bar on macOS with the traffic lights folded
into the sidebar header, and pin the window title to the product name.
- Ship the Kimi app icon for macOS and Linux builds.
Desktop detection is runtime (a query hint from the Electron shell,
persisted in sessionStorage) so the branding appears even when the
window is served by an already-running shared daemon.
* docs(kimi-desktop): update v1 scope now that the app icon ships
* feat(kimi-desktop): add the Kimi app icon for Windows builds
* chore(nix): update pnpmDeps hash after lockfile refresh
* ci(kimi-desktop): build desktop on release but do not attach to GitHub Release
The desktop build is an internal-testing artifact (branded as such), so
keep it as a CI artifact for internal download instead of publishing it
to the public GitHub Release.
* chore(kimi-desktop): mark installers as internal pre-release builds
Rename the packaged artifacts to KCD-Internal-<version>-<arch>.<ext> and
bump the version to the 0.1.1-internal.0 pre-release, so a leaked or
forwarded installer file is not mistaken for an official public release.
* feat(kimi-desktop): strengthen the internal-build tag wording
Change the sidebar tag to 'Internal testing · do not distribute' /
'内部测试 · 禁止外传' so the no-distribution intent is explicit.
* feat(kimi-desktop): tweak internal-build tag to '仅供内部测试'
* fix(kimi-desktop): pass the server token to the web UI on launch
Read the daemon's persistent bearer token from <KIMI_CODE_HOME>/server.token
and carry it in the URL fragment (#token=), matching how 'kimi web' opens
the Web UI. Without this, a fresh launch (no saved credential) boots the
web UI without a token, hits 401, and falls into the manual token dialog
even though the desktop started the daemon itself.
Addresses review feedback on the desktop URL.
|
||
|---|---|---|
| .. | ||
| build | ||
| scripts | ||
| src/main | ||
| .gitignore | ||
| electron-builder.config.cjs | ||
| package.json | ||
| README.md | ||
| tsconfig.json | ||
| tsdown.config.ts | ||
Kimi Code Desktop
An Electron desktop client for Kimi Code (product name Kimi Code Desktop;
workspace package @moonshot-ai/kimi-desktop). It is a thin shell + process manager
around the existing web UI (apps/kimi-web): it does not reimplement any UI or
backend, it just opens a native window onto the local Kimi server.
How it works
The web UI cannot run on its own — it needs the Kimi Code server (REST + WS
under /api/v1). That server already ships as a self-contained single-file
executable (SEA) built from apps/kimi-code, with the web UI bundled inside it.
On launch the app:
- Runs the bundled SEA's
server run, which reuses a live shared daemon if one is already running, or starts one — exactly the sameensureDaemonflow the CLI (kimi web) uses. The daemon binds the well-known port (58627) and writes~/.kimi-code/server/lock, so the CLI, the browser and the TUI all share the same server. - Reads that lock file for the real port and loads the web UI from the daemon's
origin (e.g.
http://127.0.0.1:58627) — same-origin, no CORS, no preload.
On quit the daemon is left running; it self-exits ~60s after the last client disconnects, so closing the desktop app never tears down a server another client is still using.
Key files:
src/main/ensure-server.ts— run the SEA, read the lock, confirm/healthz.src/main/sea-path.ts— resolve the bundled SEA path (dev vs packaged).src/main/index.ts— window, native menu, window-state, loading/error screens.
Develop
The dev build loads the SEA from apps/kimi-code/dist-native/bin/<target>/, so
build the backend once for your platform first:
# one-time (rebuild when kimi-code / kimi-web change):
pnpm --filter @moonshot-ai/kimi-web run build
node apps/kimi-code/scripts/copy-web-assets.mjs
pnpm --filter @moonshot-ai/kimi-code run build:native:sea
# then run the desktop app (builds the main process, launches Electron):
pnpm -C apps/kimi-desktop run dev # or: pnpm dev:desktop (from repo root)
Checks:
pnpm -C apps/kimi-desktop run typecheck
Package
dist builds the main process and runs electron-builder for the current
platform. scripts/before-pack.cjs stages the matching-platform SEA into the
app's resources (<resources>/bin/<target>/).
# unsigned local build (for your own machine):
CSC_IDENTITY_AUTO_DISCOVERY=false pnpm -C apps/kimi-desktop run dist
# -> apps/kimi-desktop/dist-app/
Do not rename a built
.appbundle — renaming invalidates its code signature and macOS will report it as "damaged".
Cross-platform installers are produced in CI (.github/workflows/desktop-build.yml),
which builds the SEA on each platform runner and packages there. SEA injection
is per-platform (the blob is injected into the host Node binary), so each OS must
be built on its own runner.
macOS signing + notarization
An unsigned macOS build shows "app is damaged and can't be opened" once it
has been transferred to another Mac (Gatekeeper quarantine). To distribute it,
the app must be signed with a Developer ID Application certificate and
notarized by Apple. The config (electron-builder.config.cjs) applies the
hardened runtime + entitlements (build/entitlements.mac.plist) to the app and
the nested SEA, and signing/notarization are environment-driven:
KIMI_DESKTOP_NOTARIZE=true \
CSC_NAME="Developer ID Application: … (TEAMID)" \
APPLE_API_KEY=/path/AuthKey_XXX.p8 APPLE_API_KEY_ID=XXXX APPLE_API_ISSUER=…uuid… \
pnpm -C apps/kimi-desktop run dist
In CI, run the desktop-build workflow with sign-macos: true; it reuses the
same Apple secrets / keychain action as the TUI native build
(APPLE_CERTIFICATE_P12, APPLE_NOTARIZATION_KEY_*). The resulting .dmg opens
on any Mac without warnings.
An
Apple Developmentcertificate is not enough — it can sign for your own machine but cannot be notarized. You need aDeveloper ID Applicationcert.
v1 scope / not done yet
- Auto-update: not implemented (v2).
- Windows / Linux signing: unsigned in v1 (Windows shows a SmartScreen prompt). Only macOS is signed + notarized.
- App icon: builds ship the Kimi logo (sourced from the docs site art) on macOS, Windows, and Linux.
- First launch may need network: the SEA resolves its native sidecars (clipboard / koffi) the same way the installed CLI does.