Support Kimi Code CLI as a builder #1201

Summary

Add the Kimi Code CLI (kimi) as a supported builder harness, so .codev/config.json shell.builder: "kimi" / builderHarness: "kimi" produces a working builder. Scope is the builder MVI validated by spike task-Iptx; Kimi as an architect is explicitly out of scope (stage 2).

Spike findings (verdict: Feasible with Caveats, POC-validated end-to-end):
https://github.com/mohidmakhdoomi/codev/blob/builder/task-Iptx/codev/spikes/task-Iptx-kimi-code-cli-support.md
(reproducible probes: codev/spikes/task-Iptx-kimi-poc.sh on the same branch)

What breaks today

• detectHarnessFromCommand('kimi') is unrecognized → falls through to the Claude harness (Harden harness resolution: unrecognized override command defaults to claude harness (residual --resume crash-loop) #1062): the builder script appends --append-system-prompt and a positional prompt, both of which kimi rejects (exit 1) → shellper restart loop.
• The false Claude harness also exposes Claude session capabilities, so a stale Claude .jsonl can route --resume <claude-uuid> into kimi (the pre-Support codex as an architect #929 crash-loop class).

Validated approach (spike POC)

Seed-session bootstrap — solves role injection, initial-prompt delivery, and session identity in one pattern:

1. Seed: kimi -p "<role + task briefing, ack-and-wait wrapper>" --output-format stream-json in the worktree; capture the session id from the machine-readable session.resume_hint meta line.
2. Persist the id (.builder-kimi-session) and loop the TUI with kimi -S <id> --yolo — role/task context survives inner restarts.
3. Readiness barrier (required): script prints a __CODEV_KIMI_SEED_DONE__ <id> sentinel before exec'ing the TUI; Tower gates delivery on sentinel + grace, then sends a single-line BEGIN kick with store-verified delivery (poll the session's state.json; re-send Enter on timeout; retry once; loud warning after).

Scope (builder MVI)

• KIMI_HARNESS in harness.ts + detectHarnessFromCommand recognizing kimi
• Provider-owned builder launch shape (seed + -S loop) branched in spawn-worktree.ts
• Readiness barrier + store-verified BEGIN delivery (per spike addendum — required scope)
• buildResume for afx spawn --resume (explicit-ID from the Kimi session store, state.json.workDir exact match; null → fresh-with-role fallback) + verifyOwnership
• message-write.ts per-harness Enter-delay knob (Kimi: 80ms fails, 1s works — bisect and pin)
• codev doctor: kimi presence/version, truthful auth heuristic (no billed probe) + kimi login guidance
• Docs: arch.md harness section, .codev/config.json examples, skeleton mirror where framework files change
• Tests per the spike's test matrix (incl. the Support codex as an architect #929-class regression: kimi + stale Claude jsonl must never yield --resume <claude-uuid> or --append-system-prompt)

Out of scope

• Kimi as architect (needs async seedSession capability + async-buildable CrashLoopFallback per the spike addendum — stage 2, separate issue)
• ACP / kimi server adapter
• Write-guard parity (Kimi has no documented hook seam; must be documented as a caveat)

Caveats (carry into spec/plan)

• Role rides a user turn, not a system prompt (same tradeoff that deferred agy, Support agy (Antigravity CLI) as an architect #1063).
• Reliance on undocumented surfaces (session store layout, session_index.jsonl, session.resume_hint): pin kimi ≥ 0.27.0 and add a session-store smoke probe.
• Documented-Kimi-behavior claims cite only the command reference: https://www.kimi.com/code/docs/en/kimi-code-cli/reference/kimi-command.html

References

• Spike: task-Iptx (branch builder/task-Iptx on the fork above)
• Prior art: PR Support codex as an architect (PIR #929) #1059 (codex architect, PIR Support codex as an architect #929); issues Multi-architect conversation resume: disambiguate via per-architect session UUID #832, codev adopt / launchInstance: main architect hijacks an unrelated Claude Code session instead of spawning fresh #1145, Tower recovery: Claude architect crash-loops on stale --resume with no user escape #1149, afx: removed sibling architect resurrects after Tower recovery — reconciliation trusts persisted row without liveness check #1150, Harden harness resolution: unrecognized override command defaults to claude harness (residual --resume crash-loop) #1062, Builder worktree write-guard: prevent writes anchored at the main checkout root #1018