mirror of
https://github.com/MoonshotAI/kimi-code.git
synced 2026-07-09 17:29:12 +00:00
210cedb3bf
* feat(kimi-desktop): add Electron desktop client wrapping kimi-web
New apps/kimi-desktop — a thin Electron shell + process manager around
the existing web UI. It reuses kimi-code's shared daemon: it runs the
bundled SEA's `server run` (the same ensureDaemon reuse-or-spawn flow as
`kimi web`), reads ~/.kimi-code/server/lock for the real origin, and
loads the SEA-served kimi-web same-origin. The daemon is left running on
quit so the CLI / browser / TUI keep sharing it.
- main process: ensure-server (run SEA, read lock, confirm healthz),
sea-path (dev vs packaged), window + native menu + window-state +
loading/error screens
- packaging: electron-builder config; before-pack stages the
matching-platform SEA into <resources>/bin/<target>
- CI: desktop-build workflow builds unsigned mac/win/linux installers,
each runner building its own SEA
- workspace wiring: register in flake.nix, allow electron postinstall
(onlyBuiltDependencies), root dev:desktop + typecheck entries
v1 is unsigned, default icon, no auto-update.
* feat(kimi-desktop): sign + notarize macOS builds
Unsigned macOS builds are blocked by Gatekeeper ("app is damaged") once
transferred to another Mac. Add Developer ID signing + Apple notarization,
mirroring the TUI native build:
- build/entitlements.mac.plist: hardened-runtime entitlements (allow-jit,
disable-library-validation for koffi/clipboard, etc.) applied to the app
and — via entitlementsInherit — the nested SEA backend
- electron-builder.config.cjs (replaces .yml): hardenedRuntime + entitlements;
signing and notarization are env-driven (CSC_* + KIMI_DESKTOP_NOTARIZE +
APPLE_API_* ), so the same config builds unsigned locally or signed+notarized
- desktop-build CI: sign-macos input reuses the existing macos-keychain-setup
action + APPLE_* secrets, notarizes via the notary API key
- README: document signing, the Developer-ID requirement, and the
"don't rename the .app" gotcha
Verified locally that electron-builder signs both the app and the nested SEA
with hardened runtime + the entitlements, and the signed app still launches and
serves the web UI. Notarization itself needs a Developer ID cert (CI / a machine
that has one).
* feat(kimi-desktop): rename product to Kimi Code Desktop
productName / window title / menu label / error-screen text all use
"Kimi Code Desktop" so the bundle name matches its executable (a
mismatch from manual renaming is itself reported as "damaged").
* ci(kimi-desktop): build and attach desktop installers in the release pipeline
Make desktop-build.yml reusable (workflow_call) and invoke it from the
release workflow, mirroring the native-build pipeline, so each release
also attaches signed+notarized macOS, Windows and Linux desktop
installers to the GitHub Release.
* feat(kimi-desktop): brand the desktop as an internal testing build
- Add an inline 'internal testing build' tag next to the Kimi Code brand
in the sidebar header, shown only inside the desktop app.
- Use a hidden native title bar on macOS with the traffic lights folded
into the sidebar header, and pin the window title to the product name.
- Ship the Kimi app icon for macOS and Linux builds.
Desktop detection is runtime (a query hint from the Electron shell,
persisted in sessionStorage) so the branding appears even when the
window is served by an already-running shared daemon.
* docs(kimi-desktop): update v1 scope now that the app icon ships
* feat(kimi-desktop): add the Kimi app icon for Windows builds
* chore(nix): update pnpmDeps hash after lockfile refresh
* ci(kimi-desktop): build desktop on release but do not attach to GitHub Release
The desktop build is an internal-testing artifact (branded as such), so
keep it as a CI artifact for internal download instead of publishing it
to the public GitHub Release.
* chore(kimi-desktop): mark installers as internal pre-release builds
Rename the packaged artifacts to KCD-Internal-<version>-<arch>.<ext> and
bump the version to the 0.1.1-internal.0 pre-release, so a leaked or
forwarded installer file is not mistaken for an official public release.
* feat(kimi-desktop): strengthen the internal-build tag wording
Change the sidebar tag to 'Internal testing · do not distribute' /
'内部测试 · 禁止外传' so the no-distribution intent is explicit.
* feat(kimi-desktop): tweak internal-build tag to '仅供内部测试'
* fix(kimi-desktop): pass the server token to the web UI on launch
Read the daemon's persistent bearer token from <KIMI_CODE_HOME>/server.token
and carry it in the URL fragment (#token=), matching how 'kimi web' opens
the Web UI. Without this, a fresh launch (no saved credential) boots the
web UI without a token, hits 401, and falls into the manual token dialog
even though the desktop started the daemon itself.
Addresses review feedback on the desktop URL.
67 lines
1.9 KiB
JavaScript
67 lines
1.9 KiB
JavaScript
'use strict';
|
|
|
|
// electron-builder configuration.
|
|
//
|
|
// Signing / notarization are environment-driven so the same config produces
|
|
// either an unsigned local build or a fully signed + notarized distributable:
|
|
//
|
|
// unsigned (default / local):
|
|
// CSC_IDENTITY_AUTO_DISCOVERY=false -> no signing, no notarization
|
|
//
|
|
// signed + notarized (CI, with a Developer ID cert in the keychain):
|
|
// KIMI_DESKTOP_NOTARIZE=true
|
|
// APPLE_API_KEY=<path to .p8> APPLE_API_KEY_ID=<id> APPLE_API_ISSUER=<id>
|
|
//
|
|
// The entitlements (hardened runtime) are applied to the app AND every nested
|
|
// Mach-O — including the bundled Kimi SEA backend — via entitlementsInherit, so
|
|
// the whole bundle passes notarization. Mirrors the TUI's native entitlements.
|
|
|
|
const notarize = process.env.KIMI_DESKTOP_NOTARIZE === 'true';
|
|
|
|
module.exports = {
|
|
appId: 'ai.moonshot.kimi.desktop',
|
|
productName: 'Kimi Code Desktop',
|
|
copyright: 'Copyright © Moonshot AI',
|
|
|
|
directories: {
|
|
output: 'dist-app',
|
|
},
|
|
|
|
// No native node modules in the Electron app itself; the backend is the
|
|
// prebuilt SEA staged by before-pack.cjs.
|
|
npmRebuild: false,
|
|
asar: true,
|
|
|
|
files: ['out/**', 'package.json'],
|
|
|
|
beforePack: './scripts/before-pack.cjs',
|
|
extraResources: [{ from: 'resources-stage/bin', to: 'bin' }],
|
|
|
|
mac: {
|
|
category: 'public.app-category.developer-tools',
|
|
hardenedRuntime: true,
|
|
gatekeeperAssess: false,
|
|
entitlements: 'build/entitlements.mac.plist',
|
|
entitlementsInherit: 'build/entitlements.mac.plist',
|
|
target: ['dmg', 'zip'],
|
|
artifactName: 'KCD-Internal-${version}-${arch}.${ext}',
|
|
notarize,
|
|
},
|
|
|
|
win: {
|
|
target: ['nsis'],
|
|
artifactName: 'KCD-Internal-${version}-${arch}.${ext}',
|
|
},
|
|
|
|
nsis: {
|
|
oneClick: false,
|
|
perMachine: false,
|
|
allowToChangeInstallationDirectory: true,
|
|
},
|
|
|
|
linux: {
|
|
category: 'Development',
|
|
target: ['AppImage', 'deb'],
|
|
artifactName: 'KCD-Internal-${version}-${arch}.${ext}',
|
|
},
|
|
};
|