fix(cli-precheck): probe ~/.kimi/credentials/kimi-code.json for moonshot auth (#109)

The native Kimi Code build (code.kimi.com — the one #98/#99 taught
detection about) never writes ~/.kimi/auth.json. It stores its OAuth
tokens in ~/.kimi/credentials/kimi-code.json, so the cred gate reported
auth_missing for a user who had just logged in successfully, and the
voice was blocked before it ever spawned.

Additive: the existing auth.json + opencode candidates are unchanged,
so the kimi-via-opencode transport is unaffected. The same candidate
list backs getMostRecentCredMtime, so this also restores auto-heal
after a re-login for kimi (a sticky auth_invalid had no mtime to
compare against before).

Reproduced locally: a logged-in kimi install has
~/.kimi/credentials/kimi-code.json (OAuth access_token + refresh_token)
and no ~/.kimi/auth.json at all.

Reported by @Ikkimel in the #107 thread.

Co-authored-by: chorus-codes <280607145+chorus-codes@users.noreply.github.com>

Author: chorus-codes

src/lib/cli-precheck.ts

@@ -88,6 +88,13 @@ const CRED_PATHS: Record<CliLineage, () => string[]> = {
   opencode: () => CRED_PATHS_OPENCODE(),
   moonshot: () => [
     path.join(os.homedir(), '.kimi', 'auth.json'),
+    // The native Kimi Code build (code.kimi.com — the one #98/#99 taught
+    // detection about) does NOT write ~/.kimi/auth.json. Its OAuth tokens
+    // land in ~/.kimi/credentials/kimi-code.json, so a freshly logged-in
+    // user was still gated as auth_missing on the auth.json probe alone.
+    // This path also feeds getMostRecentCredMtime, so it restores the
+    // auto-heal-after-relogin signal for kimi. (#107 follow-up.)
+    path.join(os.homedir(), '.kimi', 'credentials', 'kimi-code.json'),
     // The kimi shim delegates to `opencode --model opencode-go/kimi-k2.6`
     // when the requested model carries the opencode-go/ prefix, so a
     // moonshot voice routed via opencode is actually authed by opencode's

tests/cli-precheck.test.ts

@@ -282,6 +282,20 @@ describe('precheckLineage', () => {
       expect(result.ok).toBe(true);
     });
 
+    it('passes for a native Kimi Code login (~/.kimi/credentials/kimi-code.json)', async () => {
+      // The code.kimi.com build never writes ~/.kimi/auth.json — probing
+      // that path alone gated a logged-in user as auth_missing (#107 thread).
+      writeFakeCred('.kimi/credentials/kimi-code.json');
+      const result = await precheckLineage('moonshot');
+      expect(result.ok).toBe(true);
+    });
+
+    it('still blocks moonshot when no kimi or opencode credential exists', async () => {
+      const result = await precheckLineage('moonshot');
+      expect(result.ok).toBe(false);
+      if (!result.ok) expect(result.reason).toBe('auth_missing');
+    });
+
     it('per-lineage CTA mentions the right login command', async () => {
       const cases: Array<{ lineage: 'anthropic' | 'openai' | 'google' | 'opencode' | 'moonshot'; needle: RegExp }> = [
         { lineage: 'anthropic', needle: /claude login/i },