Headless startup crashes when the $HOME watcher emits EPERM under a sandbox

Summary

A non-interactive Kimi run inside a macOS sandbox can terminate during startup before the model is called because a chokidar FSWatcher emits EPERM for $HOME and the error is not handled.

This is distinct from authentication and from ACP transport health: an ACP initialize/session handshake succeeds, while the headless process dies when the watcher is created.

Reproduction shape

1. Run Kimi under a macOS Seatbelt profile that allows the workspace and a disposable KIMI_CODE_HOME, but denies reads of the user's real home directory.
2. Start a headless prompt (kimi -p "say ok" --output-format stream-json).
3. During startup, chokidar attempts to watch $HOME and emits an error like:

Error: EPERM: operation not permitted, watch '/Users/<user>'
Emitted 'error' event on FSWatcher instance
node:events: throw er

The process exits before any model response.

Version evidence

We reproduced the same startup death on 0.34.0, 0.38.0, and 0.39.0. Five independent headless purposes (title, install analysis, repair, serve, and subagent work) all fail at the same startup point on 0.38.0 and 0.39.0. Running outside the sandbox reaches the event parser normally, so this is not a stream-json parsing regression.

The separate OAuth refresh-lock problem is already avoidable with KIMI_DISABLE_OAUTH_LOCK=1; it does not fix this watcher failure.

Requested behavior

Please make watcher errors non-fatal: attach an error listener and either degrade the affected watch root, retry with a narrower root, or continue without that watcher. A denied ambient home directory should not crash a headless run whose explicit workspace and state root are valid.

This would let sandboxed hosts re-enable Kimi headless capabilities after a real-machine regression matrix passes.

Start at headless startup where the chokidar FSWatcher is created and follow the $HOME watch path. Reproduce with the macOS Seatbelt profile and a valid workspace and KIMI_CODE_HOME, then verify that a denied $HOME watch no longer terminates the process and that the headless prompt reaches the event parser.