Function startServer

packages/server/src/start.ts:120–661

(opts: ServerStartOptions)

export { ServerLockedError };

export async function startServer(opts: ServerStartOptions): Promise<RunningServer> {
  const pinoLogger: ServerLogger =
    opts.logger ?? createServerLogger({ level: opts.logLevel ?? 'info' });

  const lockHandle = acquireLock({
    port: opts.port,
    host: opts.host,
    lockPath: opts.lockPath,
    // Record the host build identity so `kimi server status` can detect a
    // build-mismatched server.
    hostVersion: opts.coreProcessOptions?.identity?.version,
    entry: process.argv[1],
  });

  const app = Fastify({
    loggerInstance: pinoLogger,
    disableRequestLogging: false,
    genReqId: (req) => resolveRequestId(req.headers),
  });

  app.setValidatorCompiler(() => () => true);
  app.setSerializerCompiler(() => (data) => JSON.stringify(data));
  installErrorHandler(app);

  // Host / Origin checks (ROADMAP M4.3). Registered before any route so they
  // run ahead of every handler and ahead of the (future, M5.1) auth hook.
  // Host is evaluated before Origin; both are uniform across bindings (PLAN
  // D3) — even on loopback — so behavior does not depend on how the server is
  // reached. The default-allow set keeps `app.inject` (`Host: localhost:80`)
  // and real `fetch` to `127.0.0.1:<port>` working.
  const allowedHosts = [...parseAllowedHosts(process.env), ...(opts.allowedHosts ?? [])];
  const hostCheck = createHostCheck({
    boundHost: opts.host,
    extra: allowedHosts,
    disable: isHostCheckDisabled(process.env),
  });
  const originHook = createOriginHook({ allowedOrigins: parseCorsOrigins(process.env) });
  app.addHook('onRequest', hostCheck.onRequest);
  app.addHook('onRequest', originHook);

  const serverVersion = opts.coreProcessOptions?.identity?.version ?? getServerVersion();

  async function registerOpenApi(): Promise<void> {
    const { default: swagger } = await import('@fastify/swagger');
    await app.register(swagger, {
      openapi: {
        info: {
          title: 'Kimi Code Server API',
          description:
            'REST API for the Kimi Code local server. All JSON responses are wrapped in a uniform envelope `{ code, msg, data, request_id }`.',
          version: serverVersion,
        },
        tags: [
          { name: 'meta', description: 'Server metadata' },
          { name: 'auth', description: 'Auth readiness & login state' },
          { name: 'models', description: 'Configured model aliases' },
          { name: 'providers', description: 'Configured providers' },
          { name: 'sessions', description: 'Session lifecycle' },