[0.64.0] Honor Kimi manual cookie policy

[Finesssee]

Ports upstream v0.64.0 Kimi cookie-source behavior (dc2e01ea9). Manual and Off sources now remain authoritative when the configured token is empty or invalid, so they no longer fall through to Kimi Desktop or browser credential discovery. Explicit valid manual tokens continue to win.

This PR targets the temporary Kimi integration base containing prerequisite PRs #586 and #587. It does not merge those prerequisites into main.

Validation:

• cargo test --manifest-path rust/Cargo.toml providers::kimi::web::tests --lib (9 passed)
• cargo clippy --manifest-path rust/Cargo.toml --lib --tests -- -D warnings
• cargo fmt --all
• git diff --check

[coderabbitai]

Warning

Review limit reached

Next included review available in 12 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 29cb65d5-13b3-4324-a3b2-61dd05d7f352

📥 Commits

Reviewing files that changed from the base of the PR and between b585d48 and 7ca9714.

📒 Files selected for processing (8)

• rust/src/providers/chutes/mod.rs
• rust/src/providers/kimi/code_api.rs
• rust/src/providers/kimi/mod.rs
• rust/src/providers/kimi/web.rs
• rust/src/providers/minimax/coding_plan_html.rs
• rust/src/providers/perplexity/mod.rs
• rust/src/settings.rs
• rust/src/settings/tests.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Finesssee]

Thermo-nuclear code-quality review

Verdict: PASS — no actionable maintainability findings.

The change tightens the existing Kimi cookie policy into an explicit allowlist and keeps the provider-specific default in the settings accessor that already owns provider defaults. Tests cover automatic, manual, off, case-insensitive, and authoritative-manual behavior. The diff adds no new abstraction layer, scattered branching, meaningful duplication, or file-size threshold crossing.

[Finesssee]

Thermo source closeout: PASS at 7ca9714cd3fa6b535f9ecec542eca638d125ad75, independently reviewed against its original Kimi integration base.

Valid manual credentials are selected alone. When those credentials are absent or invalid, automatic desktop/browser discovery is gated on auto or browser; manual and off cannot silently switch credential sources. The Kimi-specific default is scoped to the existing settings accessor. No blocking structural finding remains in this diff.

This PR now targets main; its exact commit is included with the corrected #587 prerequisite and #599 in integration PR #610. Final landing requires #610's complete Windows gate against current main; the earlier per-branch checks are not being used as proof of the combined revision.