Document new kimi-agent service: kimi-code CLI wrapped as a LiteLLM model, backed by user's Kimi subscription

Kimi-Agent.md

@@ -0,0 +1,72 @@
+## Kimi Code CLI Agent
+
+Autonomous coding agent, invokable as a model through LiteLLM/Open WebUI, powered by the user's own Kimi/Moonshot subscription (not the Moonshot pay-per-token API).
+
+### Pipeline
+
+```
+Open WebUI  ->  LiteLLM (model: kimi-agent)  ->  kimi-agent container (HTTP wrapper)
+            ->  kimi-code CLI  ->  Moonshot cloud (user's Kimi subscription, via `kimi login`)
+```
+
+### Location
+
+`~/agap_git/openai/kimi-agent/` — built as part of the `openai` compose project (alongside `litellm`, `open-webui`).
+
+| File | Purpose |
+|------|---------|
+| `Dockerfile` | `node:22-slim` + `npm install -g @moonshot-ai/kimi-code` |
+| `server.js` | Minimal OpenAI-compatible wrapper (`/v1/models`, `/v1/chat/completions`) — no external deps, built-in `http`/`child_process` only. Spawns `kimi -p "<prompt>" --output-format text` per request. |
+
+### Docker Compose
+
+```yaml
+kimi-agent:
+  build: ./kimi-agent
+  container_name: kimi-agent
+  volumes:
+    - /home/alvis/kimi-workspace:/workspace
+    - kimi-agent-home:/root/.kimi-code
+  restart: unless-stopped
+```
+
+- **Mount scope is deliberately narrow**: only `~/kimi-workspace` is mounted as `/workspace`, not the full home directory. The agent runs prompts via `-p` with no interactive approval gate (see below), so it must never see `~/.ssh`, `~/.claude`, `~/bin/bw`, etc.
+- `kimi-agent-home` is a named volume persisting `/root/.kimi-code` (the OAuth session from `kimi login`) across container restarts/rebuilds.
+- No ports are published — only reachable from other containers on the `openai_default` network (i.e. `litellm`), not from the host or LAN.
+
+### LiteLLM registration
+
+In `litellm-config.yaml`:
+
+```yaml
+- model_name: kimi-agent
+  litellm_params:
+    model: openai/kimi-agent
+    api_base: http://kimi-agent:8000/v1
+    api_key: dummy
+```
+
+Shows up automatically in Open WebUI since `OPENAI_API_BASE_URL` there already points at `http://host.docker.internal:4000/v1` (LiteLLM).
+
+### Auth (one-time, manual)
+
+```bash
+docker exec -it kimi-agent kimi login
+```
+
+Prints a `https://www.kimi.com/code/authorize_device?user_code=...` URL — open it and authorize with the Kimi subscription account. Session persists in the `kimi-agent-home` volume. Check status any time with:
+
+```bash
+docker exec kimi-agent kimi doctor
+```
+
+### Key CLI gotcha
+
+`-p` (non-interactive single-prompt mode) **cannot be combined with `--yolo` or `--auto`** — and doesn't need to be. In `-p` mode there's no TTY to prompt for approval, so tool calls (file read/write, shell) execute automatically already. `server.js` calls plain `kimi -p "<prompt>" --output-format text`.
+
+### Rebuild / restart
+
+```bash
+cd ~/agap_git/openai
+docker compose up -d --build kimi-agent
+```