feat(kimi): support multiple web-auth accounts with custom labels

Sources/CodexBar/Providers/Kimi/KimiProviderImplementation.swift

@@ -40,6 +40,27 @@ struct KimiProviderImplementation: ProviderImplementation {
         }
     }
 
+    @MainActor
+    func tokenAccountsVisibility(context: ProviderSettingsContext, support: TokenAccountSupport) -> Bool {
+        guard support.requiresManualCookieSource else { return true }
+        // Kimi has no dedicated login runner, so the multi-account editor must
+        // stay visible even before the first account exists. Otherwise users
+        // cannot discover how to add web-auth accounts.
+        return true
+    }
+
+    @MainActor
+    func applyTokenAccountCookieSource(settings: SettingsStore) {
+        if settings.kimiCookieSource != .manual {
+            settings.kimiCookieSource = .manual
+        }
+        // Token accounts are cookie-based; an API-only usage source would bypass
+        // the per-account cookie, so fall back to the web pipeline.
+        if settings.kimiUsageDataSource == .api {
+            settings.kimiUsageDataSource = .web
+        }
+    }
+
     @MainActor
     func settingsPickers(context: ProviderSettingsContext) -> [ProviderSettingsPickerDescriptor] {
         let usageBinding = Binding(

Sources/CodexBarCore/Providers/Kimi/KimiProviderDescriptor.swift

@@ -19,6 +19,20 @@ public enum KimiProviderDescriptor {
             guard let token else { return nil }
             return ProviderTokenResolution(token: token, source: .environment)
         },
+        tokenAccountSupport: TokenAccountSupport(
+            title: "Kimi accounts",
+            subtitle: "Store multiple Kimi kimi-auth tokens (web login). Each account is fetched with its own cookie.",
+            placeholder: "Paste kimi-auth token\u{2026}",
+            injection: .cookieHeader,
+            requiresManualCookieSource: true,
+            cookieName: "kimi-auth",
+            environmentOverride: { token in
+                [KimiSettingsReader.authTokenEnvironmentKey: token]
+            },
+            environmentScrubber: { environment, _ in
+                environment.removeValue(forKey: KimiSettingsReader.authTokenEnvironmentKey)
+                environment.removeValue(forKey: "KIMI_MANUAL_COOKIE")
+            }),
         authDetector: { environment, _ in
             var modes: [String] = []
             if KimiSettingsReader.apiKey(environment: environment) != nil {
@@ -29,7 +43,11 @@ public enum KimiProviderDescriptor {
             }
             return modes
         },
-        missingCredentialMessage: { _ in KimiAPIError.missingToken.errorDescription })
+        missingCredentialMessage: { _ in KimiAPIError.missingToken.errorDescription },
+        selectedAccountSourceModeResolver: { base, account, _ in
+            guard account != nil else { return base }
+            return .web
+        })
 
     static func makeDescriptor() -> ProviderDescriptor {
         ProviderDescriptor(

Sources/CodexBarCore/Providers/Kimi/KimiSettingsReader.swift

@@ -1,6 +1,7 @@
 import Foundation
 
 public enum KimiSettingsReader {
+    public static let authTokenEnvironmentKey = "KIMI_AUTH_TOKEN"
     public static let apiKeyEnvironmentKeys = ["KIMI_CODE_API_KEY"]
     public static let codeAPIBaseURLEnvironmentKey = "KIMI_CODE_BASE_URL"
     public static let codeHomeEnvironmentKey = "KIMI_CODE_HOME"
@@ -9,7 +10,7 @@ public enum KimiSettingsReader {
     private static let codePlatform = "kimi_code_cli"
 
     public static func authToken(environment: [String: String] = ProcessInfo.processInfo.environment) -> String? {
-        let raw = environment["KIMI_AUTH_TOKEN"] ?? environment["kimi_auth_token"]
+        let raw = environment[self.authTokenEnvironmentKey] ?? environment["kimi_auth_token"]
         return self.cleaned(raw)
     }