[Windows] kimi.exe blocked by Smart App Control — please Authenticode-sign the CLI binaries

Summary

The Windows CLI binary kimi.exe (installed at %USERPROFILE%\.kimi-code\bin\kimi.exe) is not Authenticode-signed. On Windows 11 machines with Smart App Control turned on, the unsigned binary is blocked:

程序“kimi.exe”无法运行: 应用程序控制策略已阻止此文件。
(The program "kimi.exe" cannot run: This file has been blocked by application control policy.)

Environment

• OS: Windows 11 x64, Smart App Control state: On
• Binary: C:\Users\<user>\.kimi-code\bin\kimi.exe (~124 MB)
• Get-AuthenticodeSignature kimi.exe → Status: NotSigned (same for the bundled fd.exe and rg.exe)

Evidence

Windows Code Integrity operational log, Event ID 3033, recorded at every blocked launch:

Code Integrity determined that a process
(\Device\HarddiskVolume5\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
attempted to load \Device\HarddiskVolume5\Users\<user>\.kimi-code\bin\kimi.exe
that did not meet the Enterprise signing level requirements.

Impact

• After each CLI auto-update, the new binary has no Microsoft cloud reputation → blocked for hours or days.
• The block re-appears after every reboot (Smart App Control's trust state is not persisted across boots), even for a binary that previously ran fine.
• Smart App Control offers no per-app allowlist. The only user-side workaround is turning Smart App Control off entirely, which is irreversible without reinstalling Windows — not an acceptable ask for a developer tool.

Request

Please sign kimi.exe (and the bundled helper binaries fd.exe, rg.exe) with an Authenticode code-signing certificate (ideally EV) as part of the release pipeline. Signed binaries satisfy Smart App Control's publisher verification and would also eliminate SmartScreen reputation warnings on first run.

Related: #564 (sign native installer manifests and release provenance) — this issue is the same root cause affecting the CLI runtime binary itself.

Start by locating the release pipeline that produces the Windows CLI binaries, then inspect how kimi.exe, fd.exe, and rg.exe are packaged and published. Use Get-AuthenticodeSignature on release artifacts to verify the signing result; done means all three binaries are signed and no longer report NotSigned.