feat(kimi): support multiple web-auth accounts with custom labels

Sources/CodexBar/Providers/Kimi/KimiProviderImplementation.swift

@@ -33,10 +33,40 @@ struct KimiProviderImplementation: ProviderImplementation {
 
     @MainActor
     func sourceMode(context: ProviderSourceModeContext) -> ProviderSourceMode {
+        // Token accounts are cookie-based; while any saved account exists, route
+        // refreshes through the web pipeline so each card shows that account's
+        // web quota instead of a shared API/CLI quota. This derives the mode at
+        // fetch time and never persists an override, so removing the final
+        // account automatically falls back to the user's configured source.
+        if !context.settings.tokenAccounts(for: context.provider).isEmpty {
+            return ProviderSourceMode.web
+        }
         switch context.settings.kimiUsageDataSource {
-        case .api: .api
-        case .web: .web
-        case .auto, .cli, .oauth: .auto
+        case .api:
+            return ProviderSourceMode.api
+        case .web:
+            return ProviderSourceMode.web
+        case .auto, .cli, .oauth:
+            return ProviderSourceMode.auto
+        }
+    }
+
+    @MainActor
+    func tokenAccountsVisibility(context: ProviderSettingsContext, support: TokenAccountSupport) -> Bool {
+        guard support.requiresManualCookieSource else { return true }
+        // Kimi has no dedicated login runner, so the multi-account editor must
+        // stay visible even before the first account exists. Otherwise users
+        // cannot discover how to add web-auth accounts.
+        return true
+    }
+
+    @MainActor
+    func applyTokenAccountCookieSource(settings: SettingsStore) {
+        // Cookie source must be manual so the per-account cookie header is used.
+        // The usage source itself is derived from active token accounts in
+        // `sourceMode` and is not persisted here, preserving the user's setting.
+        if settings.kimiCookieSource != .manual {
+            settings.kimiCookieSource = .manual
         }
     }
 

Sources/CodexBarCore/Providers/Kimi/KimiProviderDescriptor.swift

@@ -19,6 +19,20 @@ public enum KimiProviderDescriptor {
             guard let token else { return nil }
             return ProviderTokenResolution(token: token, source: .environment)
         },
+        tokenAccountSupport: TokenAccountSupport(
+            title: "Kimi accounts",
+            subtitle: "Store multiple Kimi kimi-auth tokens (web login). Each account is fetched with its own cookie.",
+            placeholder: "Paste kimi-auth token\u{2026}",
+            injection: .cookieHeader,
+            requiresManualCookieSource: true,
+            cookieName: "kimi-auth",
+            environmentOverride: { token in
+                [KimiSettingsReader.authTokenEnvironmentKey: token]
+            },
+            environmentScrubber: { environment, _ in
+                environment.removeValue(forKey: KimiSettingsReader.authTokenEnvironmentKey)
+                environment.removeValue(forKey: "KIMI_MANUAL_COOKIE")
+            }),
         authDetector: { environment, _ in
             var modes: [String] = []
             if KimiSettingsReader.apiKey(environment: environment) != nil {
@@ -29,7 +43,11 @@ public enum KimiProviderDescriptor {
             }
             return modes
         },
-        missingCredentialMessage: { _ in KimiAPIError.missingToken.errorDescription })
+        missingCredentialMessage: { _ in KimiAPIError.missingToken.errorDescription },
+        selectedAccountSourceModeResolver: { base, account, _ in
+            guard account != nil else { return base }
+            return .web
+        })
 
     static func makeDescriptor() -> ProviderDescriptor {
         ProviderDescriptor(

Sources/CodexBarCore/Providers/Kimi/KimiSettingsReader.swift

@@ -1,6 +1,7 @@
 import Foundation
 
 public enum KimiSettingsReader {
+    public static let authTokenEnvironmentKey = "KIMI_AUTH_TOKEN"
     public static let apiKeyEnvironmentKeys = ["KIMI_CODE_API_KEY"]
     public static let codeAPIBaseURLEnvironmentKey = "KIMI_CODE_BASE_URL"
     public static let codeHomeEnvironmentKey = "KIMI_CODE_HOME"
@@ -9,7 +10,7 @@ public enum KimiSettingsReader {
     private static let codePlatform = "kimi_code_cli"
 
     public static func authToken(environment: [String: String] = ProcessInfo.processInfo.environment) -> String? {
-        let raw = environment["KIMI_AUTH_TOKEN"] ?? environment["kimi_auth_token"]
+        let raw = environment[self.authTokenEnvironmentKey] ?? environment["kimi_auth_token"]
         return self.cleaned(raw)
     }
 

Tests/CodexBarTests/KimiTokenAccountSourceRoutingTests.swift

@@ -0,0 +1,69 @@
+import CodexBarCore
+import Foundation
+import Testing
+@testable import CodexBar
+
+@Suite(.serialized)
+@MainActor
+struct KimiTokenAccountSourceRoutingTests {
+    @Test(arguments: [
+        ProviderSourceMode.auto,
+        ProviderSourceMode.api,
+        ProviderSourceMode.web,
+    ])
+    func `active token accounts route Kimi refreshes through web without persisting source`(
+        configuredSource: ProviderSourceMode) throws
+    {
+        let settings = testSettingsStore(suiteName: "KimiTokenAccountSourceRoutingTests-\(configuredSource.rawValue)")
+        settings.kimiUsageDataSource = configuredSource
+
+        let implementation = KimiProviderImplementation()
+
+        // No accounts: source mode follows the user's configured source.
+        let noAccountMode = implementation.sourceMode(context: ProviderSourceModeContext(
+            provider: .kimi,
+            settings: settings))
+        #expect(noAccountMode == configuredSource)
+
+        // Add an account: source mode derives .web at fetch time.
+        settings.addTokenAccount(
+            provider: .kimi,
+            label: "kimi-user",
+            token: "kimi-auth-test-token")
+        let storedAccount = try #require(settings.tokenAccounts(for: .kimi).first)
+        let withAccountMode = implementation.sourceMode(context: ProviderSourceModeContext(
+            provider: .kimi,
+            settings: settings))
+        #expect(withAccountMode == .web)
+
+        // The persisted setting must NOT have been overwritten.
+        #expect(settings.kimiUsageDataSource == configuredSource)
+
+        // Remove the final account: falls back to the user's configured source.
+        settings.removeTokenAccount(provider: .kimi, accountID: storedAccount.id)
+        let afterRemovalMode = implementation.sourceMode(context: ProviderSourceModeContext(
+            provider: .kimi,
+            settings: settings))
+        #expect(afterRemovalMode == configuredSource)
+        #expect(settings.kimiUsageDataSource == configuredSource)
+    }
+
+    @Test
+    func `adding account forces manual cookie source but preserves usage source`() throws {
+        let settings = testSettingsStore(suiteName: "KimiTokenAccountSourceRoutingTests-cookie")
+        settings.kimiUsageDataSource = .api
+        settings.kimiCookieSource = .auto
+
+        let implementation = KimiProviderImplementation()
+        settings.addTokenAccount(
+            provider: .kimi,
+            label: "kimi-user",
+            token: "kimi-auth-test-token")
+        implementation.applyTokenAccountCookieSource(settings: settings)
+
+        // Cookie source becomes manual (required to use per-account cookie header).
+        #expect(settings.kimiCookieSource == .manual)
+        // Usage source is untouched — routing is derived, not persisted.
+        #expect(settings.kimiUsageDataSource == .api)
+    }
+}