Kimi Desktop

English | 简体中文

Wraps the kimi web command from Kimi Code CLI into a desktop application.

Prerequisites

Install Kimi Code CLI globally:

pnpm add -g @moonshot-ai/kimi-code
# or
npm i -g @moonshot-ai/kimi-code

Development

pnpm install
pnpm start

Build

pnpm dist

Build artifacts are written to dist/.

Custom Features

The following enhancements are injected via src/preload.js:

• Title bar: System title bar is hidden; window control button background tracks the page theme automatically.
• Window dragging: A draggable region is injected at the top of the window so you can move it without a title bar.
• Persistence: Uses a persist:kimi session partition so language, theme, and onboarding choices survive across restarts.
• Custom font: A "Font" setting row is injected into Settings → Appearance, below "Font size". Enter a font-family value to override the UI font; leave empty to use the default.

Configuration

Variable	Default	Description
KIMI_BIN	kimi	Path to the kimi executable
KIMI_PORT	58628	Local auth proxy port; point the Cloudflare Tunnel origin to http://localhost:58628
KIMI_INTERNAL_PORT	KIMI_PORT + 1	Internal Kimi Web port

Remote access security

The Cloudflare Tunnel token is kept out of browser storage and passed to cloudflared through the TUNNEL_TOKEN environment variable. Copied remote URLs do not contain the Kimi bearer token, so a remote browser must enter the Kimi token on first use.

Treat the Kimi token like a workstation password. Rotate it after accidental exposure:

kimi web rotate-token

For an optional second authentication layer, create a Cloudflare Access self-hosted application for the Tunnel hostname and add an Allow policy whose Include rule lists the permitted email addresses. Cloudflare currently requires payment information when enrolling in the Zero Trust Free plan, even when usage stays within the free allowance. See the Chinese documentation for the detailed dashboard steps.

If you do not want to provide payment information, the app also provides a local username/password auth proxy. Configure the Cloudflare Tunnel origin as http://localhost:58628, then enter a local account and a password of at least 12 characters in the Remote Access panel. Remote users must pass this login before entering the Kimi Token. The local session lasts 12 hours and is temporarily blocked after five failed attempts.