DWI Kimi Code

Important

This is an unofficial community wrapper. It is not affiliated with, endorsed by, or supported by Moonshot AI.

A small native macOS shell around kimi web. The DWI Kimi Code name is intended to distinguish this community app from official Moonshot AI software. It launches the locally installed Kimi Code CLI on an available loopback port, reads the tokenized URL from the server's own startup banner, loads it in WKWebView, and stops the server when the app quits. The token is never embedded in or written to the app bundle.

Requirements

• macOS 13 or later to run the app.
• Xcode 26 or later to build it. The supplied Icon Composer .icon document requires the newer actool, even though the resulting app targets macOS 13.
• Kimi Code CLI installed at ~/.kimi-code/bin/kimi.
• An authenticated CLI session. Run kimi login before opening the wrapper.

There are no third-party source dependencies.

Download

Download DWI-Kimi-Code-macOS-universal.zip from the latest release, unzip it, and move DWI Kimi Code.app to your Applications folder.

Release builds are ad-hoc signed rather than notarized. Read the Gatekeeper instructions before opening a downloaded copy.

Build

git clone https://github.com/thienhoc/dwi-kimi-code.git
cd dwi-kimi-code
./build.sh
open "dist/DWI Kimi Code.app"

./build.sh compiles a universal Apple Silicon + Intel executable, compiles the icon with actool, assembles the bundle, and applies an ad-hoc signature. The result is dist/DWI Kimi Code.app.

The build deliberately gives actool absolute paths and keeps its --output-partial-info-plist outside the --compile directory. The raw Kimi Code.icon document is not copied into the app: Assets.car and Kimi Code.icns are the runtime resources.

Install

Build and copy the app into your user Applications folder:

./build.sh --install
open "$HOME/Applications/DWI Kimi Code.app"

No administrator access is required.

Choose the working directory

The server starts in your home directory by default. Override it with either:

open -n "dist/DWI Kimi Code.app" --args \
  --working-directory "$HOME/Developer/my-project"

or:

KIMI_CODE_WORKING_DIRECTORY="$HOME/Developer/my-project" \
  "dist/DWI Kimi Code.app/Contents/MacOS/KimiCode"

--working-directory takes precedence over KIMI_CODE_WORKING_DIRECTORY. Relative paths are resolved from the process's current directory. open -n can launch another app instance; each instance asks macOS for its own available loopback port.

Gatekeeper and the ad-hoc signature

Release archives from this repository are ad-hoc signed, not Developer ID signed or notarized. macOS may block a downloaded copy because it cannot establish the developer's identity.

After verifying that the download came from the repository you trust, try one of Apple's normal approval paths:

1. In Finder, Control-click the app, choose Open, then confirm Open.
2. If macOS still blocks it, open System Settings → Privacy & Security and choose Open Anyway for DWI Kimi Code.

For a command-line fallback, remove only this app's downloaded-file quarantine attribute, then open it:

xattr -dr com.apple.quarantine "$HOME/Applications/DWI Kimi Code.app"
open "$HOME/Applications/DWI Kimi Code.app"

Only bypass quarantine for an app whose source and archive you trust. Removing this warning for normal users requires signing with an Apple Developer Developer ID Application certificate and notarizing the release with Apple. An ad-hoc signature alone cannot provide that trust chain.

Release workflow

.github/workflows/release.yml builds and validates the universal app on GitHub's macos-26 runner, then uploads DWI-Kimi-Code-macOS-universal.zip as a workflow artifact. A tag matching v* also creates a GitHub Release containing that ZIP.

The workflow checks for Xcode 26 or later before invoking actool. If GitHub changes the runner image or removes compatible Icon Composer tooling, the job stops early with an explicit toolchain message instead of publishing a bundle with a broken icon.

Security and privacy notes

• The Kimi server binds to its default loopback host; the wrapper never passes a remote --host.
• The bearer-token URL is consumed directly from the child process's banner. It is not committed, bundled, or persisted by this wrapper.
• External links open in the default browser. The WKWebView only accepts navigation to 127.0.0.1 or localhost.
• NSAllowsLocalNetworking remains enabled so WebKit can load the local HTTP server.
• Quitting the app terminates the server process it launched.

License

MIT