@kodax-ai/kodax 0.7.97-alpha.9 → 0.7.97-beta.2

package/README.md

@@ -36,6 +36,35 @@
 
 ---
 
+## Current development after alpha.10
+
+The unified Host cutover shipped in the `v0.7.97-alpha.12` tag retires
+`runtimeExitSettlement` and `settleKodaXRuntimeExit()`. Version-labelled
+paragraphs below describe their historical releases; use the [current SDK
+migration guide](docs/SDK_MIGRATION.md) for supported interfaces and
+[provider contracts](docs/LLM_INTEGRATION.md) for credential/account-preserving
+upgrades. Existing SDK/config/API_KEY entries remain.
+
+Agent / Coding / experimental Script work modes ship with Coding as the
+default. Select them with `--work-mode`, `/work-mode`, or Product Client
+Session `workMode`; this is independent of permissions and model choice.
+SDK/Host paths now share the corresponding settings, question outcomes,
+saved original tool reads, structured task reports and estimated-token
+progress. See the [SDK alignment and migration checklist](docs/SDK_MIGRATION.md#2026-10-29-未发布改动对齐)
+and [English integration guide](public_docs/sdk/embedder-guide.md#post-alpha10-sdk-alignment).
+These source additions shipped in the `v0.7.97-alpha.11` tag; the
+`v0.7.97-alpha.12` tag ships the unified shared-Host cutover, the
+FEATURE_302 provider/OAuth credential parity stack, and the 2026-11-01
+full-chain audit's Windows recovery, credential and permission fixes;
+the `v0.7.97-beta.1` tag completes the Space-facing Host execution and
+Session seams with Main default Skills, Quick Ask Session promotion and
+atomic core-config publication; the `v0.7.97-beta.2` tag hardens Script
+execution reliability with typed program data, native tool-name wire
+fidelity, on-demand output contracts and shared Host recovery/Workflow
+finalization fixes.
+Issue 371's historical first-read latency and Script model-efficiency
+acceptance remain open.
+
 ## Install in 30 seconds
 
 ```bash
@@ -294,10 +323,12 @@ name, not an API key value. Put the custom provider's actual API key in the
 `MY_LLM_API_KEY` environment variable, then close the current terminal and open
 a new one before running `kodax`.
 
+For native OpenAI Responses, add `"api": "responses"` to the custom provider. Omitted `api` keeps Chat Completions. Responses uses client-managed history and preserves ordered output; see [configuration and scope](public_docs/configuration/custom-providers.md#native-responses-api).
+
 `userAgentMode` defaults to `"compat"`, which sends `KodaX` instead of the official SDK User-Agent. Switch it to `"sdk"` only when your gateway expects the upstream SDK header.
 For custom reasoning models, `reasoning: { efforts, default }` is the preferred v0.7.57 shape; use `"reasoning": "none"` for models without thinking capability. SDK hosts should render effort pickers from `reasoningProfile.supportedEfforts` / `defaultEffort` rather than assuming a fixed five-option ladder.
 
-An undeclared OpenAI-compatible reasoning profile means capability is unknown. Omitted effort uses `auto`: the declared default wins, otherwise KodaX tries `max` and lowers only after explicit parameter/value rejection. `none` attempts to disable reasoning, then tries the lowest available thinking effort if disabling is rejected. SDK hosts receive `onReasoningResolved` with the requested effort, sent effort, fallback reasons, and `verified: false`; request acceptance does not prove that the model honored the strength. See [reasoning negotiation](docs/DD.md#23-custom-openai-compatible-reasoning) for cache and replay contracts.
+For the default Chat Completions API, an undeclared OpenAI-compatible reasoning profile means capability is unknown. Omitted effort uses `auto`: the declared default wins, otherwise KodaX tries `max` and lowers only after explicit parameter/value rejection. `none` attempts to disable reasoning, then tries the lowest available thinking effort if disabling is rejected. SDK hosts receive `onReasoningResolved` with the requested effort, sent effort, fallback reasons, and `verified: false`; request acceptance does not prove that the model honored the strength. See [reasoning negotiation](docs/DD.md#23-custom-openai-compatible-reasoning) for cache and replay contracts.
 
 #### OpenAI-compatible reasoning providers
 
@@ -443,12 +474,13 @@ try {
 
 `connectKodaXClient` attaches without starting or replacing a Host. The Node
 connector does not provide browser HTTP/WebSocket transport. The retained
-`/runtime` inline/daemon APIs are for explicit low-level Host integration;
+`/runtime` APIs connect trusted integrations to the same shared Host;
 Worker-hosted embedded Runtime is removed. The following structured-failure
 reference is scoped to that low-level API, not fields promised by Product Client.
 
 Both product entries accept optional `onStartupProgress` with the shared
-`ClientStartupProgress` type. Launcher `ready` means the Client is usable;
+`ClientStartupProgress` type, including `initializing` with actual Host phases
+for new Hosts. Phase observation adds no extra probes or waits. Launcher `ready` means the Client is usable;
 Session loading and UI rendering have separate boundaries. See the
 [startup progress example](public_docs/sdk/embedder-guide.md#show-local-startup-progress).
 
@@ -484,8 +516,10 @@ See [Structured Runtime failures](public_docs/sdk/embedder-guide.md#structured-c
 for the field contract, taxonomy, migration guidance, and security boundary.
 
 The product CLI uses the shared Host; `--runtime-mode`, `KODAX_RUNTIME_MODE`
-and the `runtimeMode` config key are removed. Explicit low-level inline
-embedding retains private ownership, while daemon clients detach independently.
+and the `runtimeMode` config key are removed. The unreleased Host-only SDK
+cutover also retires public embedded construction and inline owner switching.
+Use `/client` for product execution; daemon clients detach independently.
+See [migration and downgrade limits](docs/SDK_MIGRATION.md#统一-host-sdk-收口未发布).
 Worker-hosted embedded Runtime is no longer an option.
 
 ```bash
@@ -794,6 +828,98 @@ starts, upgrades, or waits. See
 Every v0.7.96 stable and v0.7.97-alpha.1/alpha.2/alpha.3 contract is
 retained.
 
+**v0.7.97-beta.2 release:** Script execution reliability hardening — VM
+call paths expose complete collision-safe tool aliases beside original
+names, typed program data carries normalized read windows and trusted
+structured JSON, and duplicate model output is projected only when the
+original receipt stays fully readable. Native tool names are encoded at
+the Anthropic-compatible wire boundary and restore canonical identity,
+arguments, permissions and deltas; an isolated optional sourceContent
+view preserves original content beside display output, and Host tools
+may declare outputSchema served on demand through `mcp_describe` without
+enlarging default menus; missing Node globals gain bounded contextual
+guidance without displacing original QuickJS error JSON or settled
+receipts. Shared Host recovery refreshes promoted observers, preserves
+owner-bound pending input recovery with idempotent withdrawal receipts,
+reclaims proven dead history locks and enforces trusted Agent mode before
+execution; Host-owned repo diagnostics/prewarm and durable Workflow
+finalization with physical task draining and protected project references
+land. Bounded real-model validation records Script model-facing
+reliability as recommend-iterate; no efficiency or general intelligence
+improvement is claimed. Tagging and publication remain separate. See the
+[v0.7.97-beta.2 release notes](docs/release.md#v0797-beta2-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through beta.1 contract is
+retained.
+
+**v0.7.97-beta.1 release:** Space-facing Host execution and Session seams
+complete — Main-owned capability-gated default Skills and consumption-time
+execution bindings select committed expert/connector state with fresh
+credential/tool leases at actual Product input consumption, and Quick Ask
+promotes Sessions through Host-owned revision checks with durable
+request-ID reconciliation while preserving the original Session and history.
+Plain redirect Run boundaries persist apart from legacy explicit Skill queues
+and survive cold recovery with strict missing-method rejection; Main bindings
+resolve before steer authority and retain the active Run's principal and
+lease boundaries. Every core configuration update publishes atomically under
+the shared lock with old bytes retained on failed writes, damaged provider
+collections rejected before mutation, secret-free errors and bounded Windows
+reader-denied replacement. The complete daemon schema ships as packaged data
+inside the npm inventory while the CLI keeps its size budget; owner-local
+temporary Run results stay awaitable after Host Session cleanup. Windows
+protected paths retain lexical and physical short-name fences, and bare
+`resume` discovery paints immediate `Finding sessions` feedback without
+extra startup work (Issue 371's historical first-read investigation remains
+open). Tagging and publication remain separate. See the
+[v0.7.97-beta.1 release notes](docs/release.md#v0797-beta1-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.12 contract is
+retained.
+
+**v0.7.97-alpha.12 release:** Public product execution converges on the
+independent shared Host — embedded/default Runtime construction, inline
+owner switching and function-based in-process external-agent Hosts are
+retired behind an explicit daemon launcher with one-way abandoned-owner
+policy migration, and `runtimeExitSettlement`/`settleKodaXRuntimeExit()`
+retire. FEATURE_302 provider/OAuth credential parity lands the native
+Responses transport, ordered history, native cloud protocols with scoped
+authentication, Mistral Pi, native media classification, shared file
+credentials bound to actual provider connections and hidden API-key setup;
+Claude 5.5 history fragments and per-message effort controls join the LLM
+layer; manual data moves out of the CLI JavaScript budget; and the
+2026-11-01 full-chain audit's Windows recovery, credential and permission
+hardening ships with lock diagnostics and a Windows streaming-history PTY
+CI gate. Tagging and publication remain separate. See the
+[v0.7.97-alpha.12 release notes](docs/release.md#v0797-alpha12-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.11 contract is
+retained.
+
+**v0.7.97-alpha.11 release:** Explicit Agent, Coding and experimental Script
+work modes land through the CLI, `/work-mode` and managed SDK/Session paths —
+Coding stays the default and Script runs supported leaf tools through the
+existing permission and receipt boundaries. Ark, MiMo and MiniMax catalogs
+refresh their reasoning and capacity metadata; non-interactive question
+outcomes are preserved with Host-owned deadlines; Skill `Bash(pattern)` rules
+admit a single parsed command; MCP tool originals stay readable through
+`part: 'original'` across daemon IPC and Host restart; structured task reports
+project into Product live views and recovered history; streaming progress
+shows consistent estimated tokens; Windows stale-process recovery and
+history-browsing cursor resync are corrected and sandbox filesystem
+capabilities are validated at startup. Tagging and publication remain
+separate. See the
+[v0.7.97-alpha.11 release notes](docs/release.md#v0797-alpha11-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.10 contract is
+retained.
+
+**v0.7.97-alpha.10 release:** Checkpointed Runs and task trees resume after
+Host restart with fresh scoped authority on top of durable context-capacity
+recovery boundaries; Kimi K3.1 provider routes join the registry with all
+seven effort levels; AskUser questions wait indefinitely by default with
+explicit skip and `unanswered` results. SDK startup callbacks expose internal
+Host phases, and exit recovery separates safe startup from historical unknown
+cleanup acknowledgements. Tagging and publication remain separate. See the
+[v0.7.97-alpha.10 release notes](docs/release.md#v0797-alpha10-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.9 contract is
+retained.
+
 **v0.7.97-alpha.9 release:** Checks Session admission through canonical
 identity metadata instead of loading complete historical transcripts, so a
 readable metadata header with an unreadable body (for example a Windows
@@ -1518,7 +1644,7 @@ KodaX has two layers that consumers should understand separately:
 | `packages/repl`   | `@kodax-ai/kodax/repl`    | Full package | Ink TUI + permission modes + commands (217 exports) | Terminal-UI consumers |
 | `packages/repl`   | `@kodax-ai/kodax/session` | **Narrow subset** | Session management only — `listSessions` / `loadFullTranscript` / `appendClientNotice` / `forkSession` / `compactSession` / `watchSessions` / ... (17 exports) | IDE plugins and desktop hosts reading session history |
 | `src`             | `@kodax-ai/kodax/client` | Product API | Shared Host connection and `KodaXProductClient` contract | TUI, desktop/IDE and automation applications |
-| `src`             | `@kodax-ai/kodax/runtime` | Host API | Explicit inline/daemon runtime facade, sessions/runs/events/permissions/catalog/MCP/artifacts/diagnostics/external agents, daemon protocol schema (10 exports) | Trusted Host integration |
+| `src`             | `@kodax-ai/kodax/runtime` | Host API | Shared-Host runtime facade, sessions/runs/events/permissions/catalog/MCP/artifacts/diagnostics/external agents, daemon protocol schema (10 exports) | Trusted Host integration |
 | `src`             | `@kodax-ai/kodax/sandbox` | Host API | Explicit ASRT capability/doctor/setup and host-owned contained command execution; unavailability never means silent ordinary execution | SDK hosts that need standalone process containment |
 | `src`             | `@kodax-ai/kodax/a2a` | Integration edge | A2A 1.0 Agent Card discovery, JSON-RPC/SSE F258 executor, safe fetch policy, and authenticated Runtime-backed Agent server | Agent orchestrators and KodaX hosts |
 
@@ -1532,7 +1658,7 @@ KodaX has two layers that consumers should understand separately:
 
 **Inline Workflow Authoring (FEATURE_246, v0.7.58; F270 update in v0.7.72)**: the Worker can author and run a workflow inline via the model-callable `run_workflow` tool when Workflow intent is explicit. It scouts the codebase first, bakes concrete findings into child prompts, and runs the script through the sandbox, static-validation, and postcondition-verification pipeline. F270 retires AMAW and complexity-driven activation; AMA keeps explicit `/workflow`, named/SDK, and natural-language Workflow requests. Workflow child Agents now run on the unified Actor control plane. See [docs/features/v0.7.58.md](docs/features/v0.7.58.md), [docs/features/v0.7.72.md](docs/features/v0.7.72.md), and ADR-044/046/047/048/049/055.
 
-**Historical Workflow Activation Tiers (FEATURE_248 + FEATURE_249, v0.7.59; superseded by F270 in v0.7.72)**: v0.7.59 introduced AMAW and explicit-request AMA behavior. F270 retires AMAW and its complexity-driven directive. SA remains solo; AMA is the single adaptive multi-Agent mode and activates Workflow only from explicit Workflow intent. See [docs/features/v0.7.59.md](docs/features/v0.7.59.md) and [docs/features/v0.7.72.md](docs/features/v0.7.72.md).
+**Historical Workflow Activation Tiers (FEATURE_248 + FEATURE_249, v0.7.59; superseded by F270 in v0.7.72)**: v0.7.59 introduced AMAW and explicit-request AMA behavior. F270 retires AMAW and its complexity-driven directive. CLI and REPL tasks use AMA; explicit SDK SA selection and the internal solo executor remain compatible. AMA is the single adaptive multi-Agent mode and activates Workflow only from explicit Workflow intent. See [docs/features/v0.7.59.md](docs/features/v0.7.59.md) and [docs/features/v0.7.72.md](docs/features/v0.7.72.md).
 
 **Progressive Disclosure on the Managed Tool Path (FEATURE_250, v0.7.60; current policy corrected in v0.7.74)**: the deferred-tool mechanism applies to the managed AMA path as well as SA. The current deferred set contains exactly 11 tools: six repo-intelligence tools, four web/code discovery tools, and `run_workflow`. Their `input_schema` remains directly callable while `tool_search` provides the full description on demand. The five fixed `mcp_*` facades and the `get_goal` / `create_goal` / `update_goal` lifecycle tools stay resident with their complete contracts. The v0.7.74 goal correction adds only about 109 estimated schema tokens versus the former hints (`get_goal` is actually 12 tokens smaller when resident), removes a discovery round trip, and changes no tool schema, handler, permission, goal state, or compaction-protection behavior. See [docs/features/v0.7.60.md](docs/features/v0.7.60.md) and [docs/features/v0.7.74.md](docs/features/v0.7.74.md#feature_250-v0774-correction-resident-goal-lifecycle-tools).
 
@@ -1544,7 +1670,7 @@ KodaX has two layers that consumers should understand separately:
 
 **Active-Run Interrupt Input (v0.7.74)**: embedded Runtime and the shared daemon advertise `interruptInput:1`. `runtime.runs.submitInput()` queues an immutable, ordered input for the current active Actor Run; all inputs admitted before one safe Runner boundary are delivered FIFO as separate user messages in the next LLM request, without creating continuation Runs. Queued/delivered state is visible in typed Run snapshots/events, delivery is acknowledged against the exact consumed IDs, and terminal cleanup prevents undelivered input from leaking into later Runs.
 
-**External Agent SDK Plane (FEATURE_258, v0.7.67)**: `/agent` exports the protocol-neutral executor, registration, policy, credential-broker, artifact-policy, catalog, and durable task contracts. `/runtime` exposes the installed plane through `admin.agentRegistrations`, `agents`, and `agentTasks`, with the same DTO service methods over embedded and daemon clients. Executor factories are host functions: install them in an inline owner or while creating a new in-process daemon owner; they cannot be injected through an existing daemon connection or across a Runtime Worker boundary. Plane shutdown is terminal: pending waits and all later service calls reject. Restricted Workflow scripts preserve validated `phase` and external `target` routing. See the [complete owner/consumer recipes and safety contract](public_docs/sdk/embedder-guide.md#18-external-agent-executor-plane-feature_258-v0767).
+**External Agent SDK Plane (FEATURE_258, v0.7.67)**: `/agent` exports the protocol-neutral executor, registration, policy, credential-broker, artifact-policy, catalog, and durable task contracts. `/runtime` exposes the installed plane through `admin.agentRegistrations`, `agents`, and `agentTasks`, through the shared Host DTO services. The unified Host cutover retires public executor-factory injection and in-process owner construction. Configure supported A2A agents in the Host; arbitrary executor functions remain a standalone library integration and have no transparent product Host equivalent. Plane shutdown is terminal: pending waits and all later service calls reject. Restricted Workflow scripts preserve validated `phase` and external `target` routing. See the [complete owner/consumer recipes and safety contract](public_docs/sdk/embedder-guide.md#18-external-agent-executor-plane-feature_258-v0767).
 
 **Cost-Disciplined Workflow SDK (FEATURE_259, v0.7.67)**: SDK callers configure run-scoped `modelTiers` and `workflow.maxConcurrency`, while workflow authors express semantic `fast` / `balanced` / `deep` intent. Terminal workflow events expose resolved tier/source/fallback/usage/duration facts, and each durable `run.json` contains an `efficiencyReport` with token coverage, role/tier starts, packet-read topology, review waves, and quality-gate outcomes. See the [routing and telemetry contract](public_docs/sdk/embedder-guide.md#20-cost-disciplined-workflow-routing-and-telemetry-feature_259-v0767).
 
@@ -1552,7 +1678,7 @@ KodaX has two layers that consumers should understand separately:
 
 **Experimental Memory Agent SDK (FEATURE_260 + FEATURE_292)**: `/experimental-memory` exposes the source-compatible `MemoryAgent`/`MemorySession` lifecycle plus the additive `MemoryManagementAgent` facade when `createMemoryAgent()` receives a `MemoryManagementController`. That facade provides governed `list()`, `remember()`, and `forget()` through the same plane used by the conversation-first product surface. Passive recall is zero-wait; `query()` is read-only and deliberate; recalled content stays low-authority, and safety/scope gates remain deterministic. See the [direct session and boundary guide](public_docs/sdk/embedder-guide.md#21-experimental-governed-memory--experimental-memory-feature_260--feature_275--feature_292-v0768v0785).
 
-**Bidirectional A2A 1.0 (FEATURE_267, v0.7.69)**: `/a2a` discovers allowed Agent Cards and installs a JSON-RPC/SSE executor through the existing F258 plane. Configured outbound Agents are also registered automatically as `external:<name>` in embedded CLI and user-daemon Runtimes, so the main Agent can orchestrate them without host code. One `a2a.json` may hold many outbound registrations and at most one inbound server, which publishes either the Runtime default or one validated `~/.kodax/agents/*.md` Agent behind an authenticated Runtime facade. The built-in listener is loopback-only and will not return a port blocked by Fetch-compatible clients; public deployment uses `handle()` behind host-owned TLS and authorization. A2A 0.3, gRPC, HTTP+JSON, push notifications, and automatic public exposure are not advertised. See the [client/server recipes and security boundaries](public_docs/sdk/embedder-guide.md#22-bidirectional-a2a-10--a2a-feature_267-v0769).
+**Bidirectional A2A 1.0 (FEATURE_267, v0.7.69)**: `/a2a` discovers allowed Agent Cards and installs a JSON-RPC/SSE executor through the existing F258 plane. Configured outbound Agents are also registered automatically as `external:<name>` in the shared Host, so the main Agent can orchestrate them without host code. One `a2a.json` may hold many outbound registrations and at most one inbound server, which publishes either the Runtime default or one validated `~/.kodax/agents/*.md` Agent behind an authenticated Runtime facade. The built-in listener is loopback-only and will not return a port blocked by Fetch-compatible clients; public deployment uses `handle()` behind host-owned TLS and authorization. A2A 0.3, gRPC, HTTP+JSON, push notifications, and automatic public exposure are not advertised. See the [client/server recipes and security boundaries](public_docs/sdk/embedder-guide.md#22-bidirectional-a2a-10--a2a-feature_267-v0769).
 
 **A2A interoperability and authentication hardening** keeps a discovered
 interface on the trusted Agent Card origin and sends credentials only when one
@@ -1641,11 +1767,11 @@ later re-enable. Private-address access and non-loopback plaintext HTTP are
 independent, persisted, default-deny permissions (`--allow-private` and
 `--allow-insecure-http`); exact loopback HTTP remains available without either.
 OAuth token endpoints retain their stricter HTTPS-or-exact-loopback rule.
-SDK hosts load this same configured plane by wiring
-`createConfiguredA2ARuntimeIntegration({ configHome })` and passing its
-`runtimeOptions` as `externalAgents` — the CLI does this for its embedded
-sessions and the daemon Host it launches, and the `worker.configuredA2A` opt-in
-was removed with the Worker facade in v0.7.97. `a2a serve` loads
+The shared Host loads this configured plane through its internal
+`createConfiguredA2ARuntimeIntegration({ configHome })` wiring. SDK clients
+connect to that Host; public `externalAgents` function injection is retired.
+The `worker.configuredA2A` opt-in was removed with the Worker facade in v0.7.97.
+`a2a serve` loads
 its configured MCP/Extension capability surface before listening and pins that
 execution authority; it hot-reloads publication, authentication, and limits.
 
@@ -1783,7 +1909,7 @@ import { SkillRegistry } from '@kodax-ai/kodax/skills';         // zero-dep skil
 import { loadConfig } from '@kodax-ai/kodax/repl';              // REPL config / session helpers
 import { createMcpManager } from '@kodax-ai/kodax/mcp';         // MCP popout manager (v0.7.42)
 import { listSessions } from '@kodax-ai/kodax/session';         // session history helpers
-import { createKodaXRuntime } from '@kodax-ai/kodax/runtime';   // embedded/daemon runtime API
+import { ensureKodaXRuntime } from '@kodax-ai/kodax/runtime';   // shared Host runtime API
 import { runKodaXSandboxed } from '@kodax-ai/kodax/sandbox';    // standalone ASRT containment
 import { createKodaXA2AServer } from '@kodax-ai/kodax/a2a';    // A2A 1.0 client/server edge
 import { createMemoryAgent } from '@kodax-ai/kodax/experimental-memory'; // opt-in memory SDK
@@ -1791,7 +1917,7 @@ import { createMemoryAgent } from '@kodax-ai/kodax/experimental-memory'; // opt-
 
 All 14 SDK entries (root + 13 subpaths, including `/client`) share internal code via ESM chunk splitting — importing from `/agent` does not pull in `/repl`'s Ink + React surface.
 
-For the product contract and separate low-level inline/daemon ownership,
+For the product contract and low-level shared Host connections,
 external-agent registration and task control, session cursor pagination, workflow
 model-tier routing, and efficiency telemetry — see the
 [SDK Embedder Integration Guide](public_docs/sdk/embedder-guide.md).
@@ -2115,7 +2241,7 @@ This development tree exposes 17 SDK subpaths plus the root. Shared product
 applications use `@kodax-ai/kodax/client`; independent libraries and trusted Host
 APIs remain available through the other subpaths. See the [Client contract](docs/CLIENT_CONTRACT.md)
 and [SDK migration guide](docs/SDK_MIGRATION.md). This documentation was checked
-against package version `0.7.97-alpha.9`; npm publication is separate from
+against package version `0.7.97-beta.2`; npm publication is separate from
 the current development-tree contract.
 
 ```bash
@@ -2133,7 +2259,7 @@ import { runInkInteractiveMode } from '@kodax-ai/kodax/repl';     // Ink TUI ent
 import { SkillRegistry } from '@kodax-ai/kodax/skills';           // zero-dep skill loader
 import { createMcpManager } from '@kodax-ai/kodax/mcp';           // MCP popout manager (v0.7.42)
 import { listSessions } from '@kodax-ai/kodax/session';           // session history helpers
-import { createKodaXRuntime } from '@kodax-ai/kodax/runtime';     // embedded/daemon runtime API
+import { ensureKodaXRuntime } from '@kodax-ai/kodax/runtime';     // shared Host runtime API
 import { runKodaXSandboxed } from '@kodax-ai/kodax/sandbox';      // explicit standalone containment
 import { createKodaXA2AServer } from '@kodax-ai/kodax/a2a';      // A2A 1.0 client/server edge
 import { createMemoryAgent } from '@kodax-ai/kodax/experimental-memory'; // opt-in experimental memory SDK
@@ -2304,17 +2430,17 @@ await runInkInteractiveMode({ provider: 'zhipu-coding', effort: 'auto' });
 |----------|----------------------|-------------------|---------------|
 | anthropic | `ANTHROPIC_API_KEY` | Native | claude-sonnet-4-6 (`claude-opus-4-6` / `claude-haiku-4-5` via `/model`) |
 | openai | `OPENAI_API_KEY` | Native | gpt-5.3-codex (`gpt-5.4` / `gpt-5.3-codex-spark` via `/model`) |
-| kimi | `KIMI_API_KEY` | Native | kimi-k2.7-code (262,144-token context; `kimi-k3` 1M / `kimi-k2.7-code-highspeed` / `kimi-k2.6` / `kimi-k2.5` via `/model`) |
-| kimi-code | `KIMI_CODE_API_KEY` | Native | k3-256k (Moderato+, 256K, direct upstream ID; `k3` 1M / `kimi-for-coding` K2.7 Code / `kimi-for-coding-highspeed` via `/model`) |
+| kimi | `KIMI_API_KEY` | Native | kimi-k2.7-code (262,144-token context; `kimi-k3.1-pro` / `kimi-k3.1-pro-highspeed` / `kimi-k3` 1M / `kimi-k2.7-code-highspeed` / `kimi-k2.6` / `kimi-k2.5` via `/model`) |
+| kimi-code | `KIMI_CODE_API_KEY` | Native | k3-256k (Moderato+, 256K, direct upstream ID; `k3.1-pro` / `k3.1-pro-highspeed` / `k3` 1M / `kimi-for-coding` / `kimi-for-coding-highspeed` via `/model`; K3.1 requires thinking) |
 | qwen | `QWEN_API_KEY` | Native | qwen3.5-plus |
 | qwen-token-plan | `QWEN_TOKEN_API_KEY` | Native | qwen3.8-max (Anthropic-compat; legacy `qwen3.8-max-preview` plus `qwen3.7-max` / `qwen3.7-plus` / `qwen3.6-flash` / `glm-5.2` / `deepseek-v4-pro` via `/model`; all 1M context; image input on both Qwen 3.8 IDs / 3.7 Plus / 3.6 Flash) |
 | zhipu | `ZHIPU_API_KEY` | Native | glm-5 (`glm-5.3` / `glm-5.2` 1M ctx, plus `glm-5.1` / `glm-5-turbo` via `/model`; GLM-5.3 is pre-registered while the public API remains marked upcoming) |
 | zhipu-coding | `ZHIPU_CODING_API_KEY` | Native | glm-5.3 (1M ctx, 128K output; `glm-5.2` rollback plus `glm-5-turbo` / `glm-4.7` via `/model`; raw upstream IDs) |
 | zai-coding | `ZAI_CODING_API_KEY` | Native | glm-5.3 (`glm-5.2` rollback; raw upstream IDs; switched from glm-5.2 default on 2026-08-15) |
-| minimax-coding | `MINIMAX_CODING_API_KEY` | Native | MiniMax-M3 (Frontier Coding, native multimodal + 1M ctx; legacy `MiniMax-M2.7` / `MiniMax-M2.7-highspeed` remain selectable via `/model`) |
-| mimo | `MIMO_API_KEY` | Native | mimo-v2.5-pro (Xiaomi MiMo pay-per-token, Anthropic-compat) |
-| mimo-coding | `MIMO_CODING_API_KEY` | Native | mimo-v2.5-pro (Xiaomi Token Plan, Anthropic-compat) |
-| ark-coding | `ARK_CODING_API_KEY` | Native | glm-5.3 (Volcengine Ark Coding Plan — GLM-5.3 (1M ctx, 128K out) · GLM-5.2 (alias: `glm-latest`) · Kimi K2.7 Code / K2.6 · MiniMax M3 / M2.7 · DeepSeek V4 Pro / V4 Flash · Doubao Seed 2.0 Code / Pro / Lite · Doubao Seed Code) |
+| minimax-coding | `MINIMAX_CODING_API_KEY` | Native | MiniMax-M3.1-Flash (M Plan, 1M ctx, five effort levels; always-on thinking) |
+| mimo | `MIMO_API_KEY` | Native | mimo-v2.6-pro (Xiaomi MiMo pay-per-token; V2.6 Flash also selectable) |
+| mimo-coding | `MIMO_CODING_API_KEY` | Native | mimo-v2.6-pro (Xiaomi Token Plan; V2.6 Flash also selectable, image input, thinking on/off) |
+| ark-coding | `ARK_CODING_API_KEY` | Native | glm-5.3 (Ark Coding Plan; new `deepseek-v4.1-flash` / `deepseek-v4.1-flash-economy`, `glm-5.3-flash`, `kimi-k3.1-pro` / `kimi-k3` / `kimi-k2.8-preview`; all six accept images; previous configured IDs retained) |
 | deepseek | `DEEPSEEK_API_KEY` | Native | deepseek-flash (Anthropic-compat; DeepSeek-V4.1-Flash, 1M ctx, native image input; legacy text-only `deepseek-v4-pro`, via `/model`) |
 | gemini-cli | Provider CLI authentication (no KodaX API-key variable) | Prompt-only / CLI bridge | (via gemini CLI) |
 | codex-cli | Provider CLI authentication (no KodaX API-key variable) | Prompt-only / CLI bridge | (via codex CLI) |
@@ -2341,7 +2467,7 @@ kodax --session list
 kodax --parallel "Read package.json and tsconfig.json"
 
 # Adaptive multi-agent (AMA) mode — V2 Worker single-loop with Actor collaboration
-kodax --agent-mode ama "Analyze code structure, check test coverage, find bugs"
+kodax "Analyze code structure, check test coverage, find bugs"
 ```
 
 ---
@@ -2430,10 +2556,25 @@ kodax "please use /skill:code-review src/"
 
 Set `disable-model-invocation: true` for a Skill that must only be loaded after an explicit slash invocation. This keeps it out of natural-language model discovery without disabling `/<name>` or `/skill:<name>`.
 
-Built-in skills include:
-- **code-review** - Code review and quality analysis
-- **tdd** - Test-driven development workflow
-- **git-workflow** - Git commit and workflow automation
+The five core built-in Skills are model-discoverable:
+
+- **code-review** — Review changes without editing; includes read-only Git inspection.
+- **tdd** — Regression-first fixes or test-first work; tests-only requests may pass on the first run and do not authorize production edits.
+- **git-workflow** — Perform requested Git operations; explaining Git alone does not invoke the workflow.
+- **skill-creator** — Create, change, validate, package or evaluate reusable Skills; packaging does not install into the user's catalog.
+- **visual-review** — Review actual visual evidence and state unchecked scope honestly.
+
+Skill shell declarations match the entire command, for example `Bash(git *, npm *)`,
+and retain Host permission and sandbox checks. The optional `artifact-review`
+Skill is registered with the [Artifact adapter](docs/ARTIFACT_SDK.md); it documents
+that adapter's supported formats and parameters. Both visual Skills may use the
+existing managed preparation flow within the task's authorization; denied or
+missing capabilities leave the affected scope unverified.
+
+Skill Creator helpers use the public SDK, with a separately configured Provider,
+model and cwd. `run-trigger-eval.js` performs single-description semantic screening;
+actual triggering requires observed `skill` calls with the complete visible catalog.
+See its [evaluation reference](packages/agent/src/capabilities/skills/builtin/skill-creator/references/evaluation.md).
 
 Skills are stored in `~/.kodax/skills/` and can be extended with custom skills.
 F263 background learning is Memory-first: a single correction does not create

package/README_CN.md

@@ -36,6 +36,26 @@
 
 ---
 
+## alpha.10 之后的当前开发
+
+随 `v0.7.97-alpha.12` 标签发布的统一 Host 收口已退役 `runtimeExitSettlement` 与
+`settleKodaXRuntimeExit()`。下文带版本的发布记录保留历史事实；当前接口以
+[SDK 迁移指南](docs/SDK_MIGRATION.md)为准，凭证与账号保持见
+[接入契约](docs/LLM_INTEGRATION.md)。既有 SDK、配置与 API_KEY 环境入口继续有效。
+
+Agent / Coding / 实验性 Script 工作模式已随 `v0.7.97-alpha.11` 标签发布,默认 Coding。
+CLI 使用 `--work-mode`，REPL 使用 `/work-mode`，Product Client 使用 Session
+`workMode`；它与权限、模型选择独立。SDK/Host 的相关设置、问题结算、工具原文读取、
+结构化任务报告和 token 估算进度已接入对应契约，见
+[SDK 一致性与迁移清单](docs/SDK_MIGRATION.md#2026-10-29-未发布改动对齐)。
+`v0.7.97-alpha.12` 标签发布统一共享 Host 收口、FEATURE_302 供应商/OAuth 凭据
+对齐栈，以及 2026-11-01 全链路审计的 Windows 恢复、凭据与权限修复；
+`v0.7.97-beta.1` 标签完成 Space 侧 Host 执行与会话接缝——Main 默认 Skills、
+Quick Ask Session promotion 与核心配置原子发布;`v0.7.97-beta.2` 标签加固
+Script 执行可靠性——类型化程序数据、原生工具名 wire 保真、按需输出契约与
+共享 Host 恢复/Workflow 终结修复。
+Issue 371 的历史首次读取延迟及 Script 模型效率验收仍未关闭。
+
 ## 30 秒上手
 
 ```bash
@@ -98,9 +118,9 @@ try {
 
 `connectKodaXClient` 只连接已有兼容 Host；`ensureKodaXClient` 通过统一启动器启动或正常更新空闲 Host。Node 连接器不提供浏览器 HTTP/WebSocket transport。
 
-两个产品入口均支持可选 `onStartupProgress` 和共享 `ClientStartupProgress` 类型。启动 `ready` 表示 Client 接口可用；Session 加载与 UI 渲染仍有独立完成边界。详见[启动进度示例](public_docs/sdk/embedder-guide.md#show-local-startup-progress)。
+两个产品入口均支持可选 `onStartupProgress` 和共享 `ClientStartupProgress` 类型；新 Host 通过 `initializing/phase` 报告内部初始化步骤，不增加额外探测或等待。启动 `ready` 表示 Client 接口可用；Session 加载与 UI 渲染仍有独立完成边界。详见[启动进度示例](public_docs/sdk/embedder-guide.md#show-local-startup-progress)。
 
-底层 `/runtime` 仍支持显式 inline embedded 与 daemon，供受信任宿主处理凭据桥、Host Tools、启动和诊断；Worker-hosted embedded、通用 operation receipt/journal 已移除。不能在产品连接失败时退回私有 Runtime。下方结构化 Runtime 错误说明仅属于底层接口，不能假定 Product Client 暴露相同字段。
+底层 `/runtime` 连接唯一共享 Host，供受信任客户端处理凭据桥、Host Tools、启动和诊断；Worker-hosted embedded、通用 operation receipt/journal 已移除。不能在产品连接失败时退回私有 Runtime。下方结构化 Runtime 错误说明仅属于底层接口，不能假定 Product Client 暴露相同字段。
 
 ### 结构化且凭据安全的 Runtime 错误
 
@@ -314,6 +334,70 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 [v0.7.97-alpha.4 发布清单](docs/release.md#v0797-alpha4-release-preparation)。
 所有 v0.7.96 稳定与 v0.7.97-alpha.1/alpha.2/alpha.3 契约全部保留。
 
+**v0.7.97-beta.2 发布**：Script 执行可靠性加固——VM 调用路径在原名之外提供
+无冲突安全别名,类型化程序数据承载规范化读取窗口与可信结构化 JSON,仅在原
+回执保持完整可读时才投影重复的模型输出。原生工具名在 Anthropic 兼容 wire
+边界编码并恢复 canonical 身份、参数、权限与增量;独立可选 sourceContent 视图
+在展示输出之外保留原文,Host 工具可声明 outputSchema 经 `mcp_describe` 按需
+返回而不扩大默认菜单;缺失 Node 全局仅追加有界上下文指引,不覆盖原始 QuickJS
+错误 JSON 或已定回执。共享 Host 恢复刷新已提升观察者、以幂等撤回回执保留
+owner 绑定的 pending 输入恢复、回收已证死锁并在执行前核验可信 Agent 模式;
+Host 自有的 repo 诊断/预热与持久 Workflow 终结（物理任务排空、受保护项目
+引用）一并落地。有界真实模型验证将 Script 面向模型的可靠性记为
+recommend-iterate,不宣称效率或通用智能提升。代码提交、版本标签与实际发布
+分别判断。
+详见 [v0.7.97-beta.2 发布清单](docs/release.md#v0797-beta2-release-preparation)。
+所有 v0.7.96 稳定与 v0.7.97-alpha.1 至 beta.1 契约全部保留。
+
+**v0.7.97-beta.1 发布**：Space 侧 Host 执行与会话接缝收尾——Main 持有的
+能力门禁默认 Skills 与消费时执行绑定在实际 Product 输入消费点选取已提交
+专家/连接器状态并重新获取凭证/工具 lease;Quick Ask 通过 Host 掌握的修订
+检查与持久 request-ID 对账完成 Session promotion,保留原 Session 与历史。
+普通 redirect 的 Run 边界与遗留显式 Skill 队列分离并持久化,冷恢复后仍保持
+严格缺失方法拒绝;Main 绑定先于 steer 权限解析,保留活动 Run 的 principal
+与 lease 边界。所有核心配置更新在同一共享锁下原子发布——失败写入保留旧
+字节、损坏的 provider 集合变更前拒绝、配置错误不含秘密,Windows reader
+拒绝的替换在同一 staged 文件与写锁内有界重试。完整 daemon schema 作为
+打包数据进入 npm 清单且 CLI 保持体积预算;owner 本地临时 Run 结果在 Host
+Session 清理后仍可等待。Windows 保护路径保留词法与物理短名围栏;裸
+`resume` 会话发现立即显示 `Finding sessions` 反馈且不增加启动工作
+（Issue 371 的历史首次读取调查仍未关闭）。代码提交、版本标签与实际发布
+分别判断。
+详见 [v0.7.97-beta.1 发布清单](docs/release.md#v0797-beta1-release-preparation)。
+所有 v0.7.96 稳定与 v0.7.97-alpha.1 至 alpha.12 契约全部保留。
+
+**v0.7.97-alpha.12 发布**：公开产品执行收口到独立共享 Host——内嵌/默认
+Runtime 构造、内联 owner 切换与函数式进程内外部 Agent Host 退役，由显式
+daemon 启动器接管，并对废弃 owner 策略做单向迁移;`runtimeExitSettlement`
+与 `settleKodaXRuntimeExit()` 退役。FEATURE_302 供应商/OAuth 凭据对齐落地
+原生 Responses 传输、有序历史、带作用域认证的原生云协议、Mistral Pi、
+原生媒体分类、绑定实际供应商连接的共享文件凭据与隐藏 API Key 配置;
+Claude 5.5 历史片段与逐消息 effort 控制进入 LLM 层;manual 数据移出 CLI
+JavaScript 预算;2026-11-01 全链路审计的 Windows 恢复、凭据与权限加固
+随锁诊断与 Windows 流式历史 PTY CI 门禁一并发布。代码提交、版本标签与
+实际发布分别判断。
+详见 [v0.7.97-alpha.12 发布清单](docs/release.md#v0797-alpha12-release-preparation)。
+所有 v0.7.96 稳定与 v0.7.97-alpha.1 至 alpha.11 契约全部保留。
+
+**v0.7.97-alpha.11 发布**：显式 Agent、Coding 与实验性 Script 工作模式通过
+CLI、`/work-mode` 与托管 SDK/Session 路径落地——Coding 保持默认，Script 在既有
+权限与回执边界内执行受支持的叶子工具。Ark、MiMo、MiniMax 目录刷新推理与容量
+元数据；非交互问题结算保留结果且截止期限由 Host 掌握;Skill `Bash(pattern)`
+规则仅放行单条解析命令;MCP 工具原文经 `part: 'original'` 跨 daemon IPC 与
+Host 重启可读;结构化任务报告投影到 Product 视图与恢复历史;流式进度统一以
+token 估算展示;修正 Windows 陈旧进程恢复与历史浏览游标重同步，启动时校验
+沙箱文件系统能力。代码提交、版本标签与实际发布分别判断。
+详见 [v0.7.97-alpha.11 发布清单](docs/release.md#v0797-alpha11-release-preparation)。
+所有 v0.7.96 稳定与 v0.7.97-alpha.1 至 alpha.10 契约全部保留。
+
+**v0.7.97-alpha.10 发布**：Host 重启后可恢复检查点 Run 与任务树(全新作用域
+授权);上下文容量恢复到达持久代边界;Kimi K3.1 供应商路由覆盖全部七档
+effort;AskUser 默认无限等待、支持显式跳过并返回带原因的 `unanswered` 结果。
+SDK 启动回调透传 Host 内部阶段；退出恢复将安全启动与历史清理未知事实分开。
+代码提交、版本标签与实际发布分别判断。
+详见 [v0.7.97-alpha.10 发布清单](docs/release.md#v0797-alpha10-release-preparation)。
+所有 v0.7.96 稳定与 v0.7.97-alpha.1 至 alpha.9 契约全部保留。
+
 **v0.7.97-alpha.9 发布**：Session 准入检查改用规范身份元数据而非加载完整
 历史 transcript——元数据头可读而正文不可读(例如损坏存储上的 Windows
 ERROR_CRC 以 EIO 呈现)不再阻塞无关的 Run 列表、daemon 检查或空闲退出检查。
@@ -998,7 +1082,7 @@ import { SkillRegistry } from '@kodax-ai/kodax/skills';         // 零依赖 ski
 import { loadConfig } from '@kodax-ai/kodax/repl';              // REPL 配置 / session 工具
 import { createMcpManager } from '@kodax-ai/kodax/mcp';         // MCP popout manager（v0.7.42 起）
 import { listSessions } from '@kodax-ai/kodax/session';         // session 历史工具
-import { createKodaXRuntime } from '@kodax-ai/kodax/runtime';   // inline/daemon 宿主 API
+import { createKodaXRuntime } from '@kodax-ai/kodax/runtime';   // 共享 Host 连接 API
 import { runKodaXSandboxed } from '@kodax-ai/kodax/sandbox';    // 独立 ASRT 受控执行
 import { createKodaXA2AServer } from '@kodax-ai/kodax/a2a';    // A2A 1.0 双向接入
 import { createMemoryAgent } from '@kodax-ai/kodax/experimental-memory'; // opt-in 实验性记忆 SDK
@@ -1038,11 +1122,13 @@ import { createMemoryAgent } from '@kodax-ai/kodax/experimental-memory'; // opt-
 请把自定义 provider 的真实 API Key 设置到 `MY_LLM_API_KEY` 环境变量中，然后关闭
 当前终端、打开新终端，再运行 `kodax`。
 
+原生 OpenAI Responses 可在自定义 provider 中设置 `"api": "responses"`；省略时保持 Chat Completions。Responses 使用客户端历史并保留输出块顺序；配置方式、离线验证及当前范围见 [Custom Providers](public_docs/configuration/custom-providers.md#native-responses-api)。
+
 `userAgentMode` 默认 `"compat"`（发送 `KodaX` 而非上游 SDK 的 User-Agent）；如果你的网关要求原生 SDK header，再切到 `"sdk"`。
 
 自定义 reasoning 模型优先使用 v0.7.57 的 `reasoning: { efforts, default }`；无 thinking 能力的模型使用 `"reasoning": "none"`。SDK 宿主的 effort 选择器应从 `reasoningProfile.supportedEfforts` / `defaultEffort` 动态生成，不要假定固定五档。
 
-OpenAI-compatible provider 未声明 reasoning profile 表示能力未知。未设置 effort 时使用 `auto`：优先采用已声明默认档，否则从 `max` 开始，仅在明确的参数／档位拒绝后逐档降低。`none` 会尝试关闭；关闭被拒绝后尝试最低可用思考档。SDK 宿主通过 `onReasoningResolved` 收到用户意图、实际发送档位、回退原因和 `verified: false`；请求成功不代表模型已按该强度执行。缓存和推理数据回传规则见[详细设计](docs/DD.md#23-custom-openai-compatible-reasoning)。
+默认 Chat Completions 路径下，OpenAI-compatible provider 未声明 reasoning profile 表示能力未知。未设置 effort 时使用 `auto`：优先采用已声明默认档，否则从 `max` 开始，仅在明确的参数／档位拒绝后逐档降低。`none` 会尝试关闭；关闭被拒绝后尝试最低可用思考档。SDK 宿主通过 `onReasoningResolved` 收到用户意图、实际发送档位、回退原因和 `verified: false`；请求成功不代表模型已按该强度执行。缓存和推理数据回传规则见[详细设计](docs/DD.md#23-custom-openai-compatible-reasoning)。
 
 #### OpenAI 兼容推理模型
 
@@ -1147,7 +1233,7 @@ kodax daemon stop --profile default
 
 daemon 可承载多个 Session；不同 Session 可以并发，同一 Session 的交付由 Host 串行协调。`after_turn` 可在当前 Run 的安全点交付，不必等整个长任务结束。客户端关闭观察或断开连接不会停止 Run。停止任务使用 `runs.stop` 或 `sessions.cancel`；关闭空闲 Host 才使用 `host.shutdown`/daemon stop。
 
-显式独立库嵌入仍可使用 `/runtime` 的 `createKodaXRuntime({mode:'embedded'})`，其 owner 和退出责任属于调用者。这不是 CLI 的可选运行模式，也不是产品客户端的连接失败回退。当前包版本与发布状态见[SDK 迁移指南](docs/SDK_MIGRATION.md)。
+未发布的统一 Host 收口已退役公开 embedded 构造与 inline 所有权切换；完整产品能力统一使用 `/client`。独立 llm/agent/coding 库仍可单独使用。旧状态自动迁移与降级限制见 SDK 迁移指南。当前包版本与发布状态见[SDK 迁移指南](docs/SDK_MIGRATION.md)。
 
 普通 CLI 自动拉起的 Host 在最后一个客户端断开、后台工作持续空闲 30 秒后退出；重新连接会取消空闲退出。显式 `kodax daemon start` 会保留当前 Host，即使它原先是临时 Host；承载已配置 A2A 服务的 Host 也会在没有 CLI 客户端时继续常驻。
 
@@ -1191,17 +1277,17 @@ dist/binary/linux-x64/
 |----------|----------|-----------|-----------|
 | anthropic | `ANTHROPIC_API_KEY` | Native | claude-sonnet-4-6（可 `/model` 切换 `claude-opus-4-6` / `claude-haiku-4-5`） |
 | openai | `OPENAI_API_KEY` | Native | gpt-5.3-codex（可 `/model` 切换 `gpt-5.4` / `gpt-5.3-codex-spark`） |
-| kimi | `KIMI_API_KEY` | Native | kimi-k2.7-code（262,144 token；可 `/model` 切换 `kimi-k3`〔1M〕/ `kimi-k2.7-code-highspeed` / `kimi-k2.6` / `kimi-k2.5`） |
-| kimi-code | `KIMI_CODE_API_KEY` | Native | k3-256k（Moderato+，256K，直接请求同名上游模型；可 `/model` 切换 `k3`〔Allegretto+，1M〕/ `kimi-for-coding`〔K2.7 Code〕/ `kimi-for-coding-highspeed`） |
+| kimi | `KIMI_API_KEY` | Native | kimi-k2.7-code（262,144 token；可 `/model` 切换 `kimi-k3.1-pro` / `kimi-k3.1-pro-highspeed` / `kimi-k3`〔1M〕/ `kimi-k2.7-code-highspeed` / `kimi-k2.6` / `kimi-k2.5`） |
+| kimi-code | `KIMI_CODE_API_KEY` | Native | k3-256k（Moderato+，256K，直接请求同名上游模型；可 `/model` 切换 `k3.1-pro` / `k3.1-pro-highspeed` / `k3`〔1M〕/ `kimi-for-coding` / `kimi-for-coding-highspeed`；K3.1 必须开启思考） |
 | qwen | `QWEN_API_KEY` | Native | qwen3.5-plus |
 | qwen-token-plan | `QWEN_TOKEN_API_KEY` | Native | qwen3.8-max（Anthropic 协议；可 `/model` 切换兼容项 `qwen3.8-max-preview` 及 `qwen3.7-max` / `qwen3.7-plus` / `qwen3.6-flash` / `glm-5.2` / `deepseek-v4-pro`；均为 1M ctx；两个 Qwen 3.8 ID / 3.7 Plus / 3.6 Flash 支持图片理解） |
 | zhipu | `ZHIPU_API_KEY` | Native | glm-5（可 `/model` 切换 `glm-5.3` / `glm-5.2`，均为 1M ctx，另有 `glm-5.1` / `glm-5-turbo`；GLM-5.3 开放平台 API 仍标注为即将上线） |
 | zhipu-coding | `ZHIPU_CODING_API_KEY` | Native | glm-5.3（1M ctx、128K 最大输出；可回退到 `glm-5.2`，也可切换 `glm-5-turbo` / `glm-4.7`；原样发送上游 ID） |
 | zai-coding | `ZAI_CODING_API_KEY` | Native | glm-5.3（保留 `glm-5.2` 回退；原样发送上游 ID；2026-08-15 起默认从 glm-5.2 切换） |
-| minimax-coding | `MINIMAX_CODING_API_KEY` | Native | MiniMax-M3（Frontier Coding，原生多模态 + 1M ctx；仍可通过 `/model` 显式选择兼容模型 `MiniMax-M2.7` / `MiniMax-M2.7-highspeed`） |
-| mimo | `MIMO_API_KEY` | Native | mimo-v2.5-pro（小米 MiMo 按量计费，Anthropic 协议） |
-| mimo-coding | `MIMO_CODING_API_KEY` | Native | mimo-v2.5-pro（小米 MiMo Token Plan，Anthropic 协议） |
-| ark-coding | `ARK_CODING_API_KEY` | Native | glm-5.3（火山方舟 Coding Plan — GLM-5.3（1M ctx、128K out） · GLM-5.2（别名 `glm-latest`） · Kimi K2.7 Code / K2.6 · MiniMax M3 / M2.7 · DeepSeek V4 Pro / V4 Flash · Doubao Seed 2.0 Code / Pro / Lite · Doubao Seed Code） |
+| minimax-coding | `MINIMAX_CODING_API_KEY` | Native | MiniMax-M3.1-Flash（M Plan，1M 上下文，原生五档推理，思考始终开启） |
+| mimo | `MIMO_API_KEY` | Native | mimo-v2.6-pro（小米 MiMo 按量计费，也可选 V2.6 Flash） |
+| mimo-coding | `MIMO_CODING_API_KEY` | Native | mimo-v2.6-pro（小米 MiMo Token Plan，也可选 V2.6 Flash；支持图片、思考开关） |
+| ark-coding | `ARK_CODING_API_KEY` | Native | glm-5.3（方舟 Coding Plan；新增 `deepseek-v4.1-flash` / `deepseek-v4.1-flash-economy`、`glm-5.3-flash`、`kimi-k3.1-pro` / `kimi-k3` / `kimi-k2.8-preview`；六款均支持图片；保留历史配置 ID） |
 | deepseek | `DEEPSEEK_API_KEY` | Native | deepseek-flash（Anthropic 协议；DeepSeek-V4.1-Flash，1M ctx，原生图片理解；可 `/model` 切换纯文本兼容名 `deepseek-v4-pro`） |
 | gemini-cli | 由 Provider CLI 完成认证（无 KodaX API-key 环境变量） | Prompt-only / CLI bridge | （通过 gemini CLI） |
 | codex-cli | 由 Provider CLI 完成认证（无 KodaX API-key 环境变量） | Prompt-only / CLI bridge | （通过 codex CLI） |
@@ -1273,6 +1359,19 @@ KodaX 有 50+ 个内置工具，按类别分组如下（实际暴露给 LLM 是
 | `ask_user_question` | 向用户发起单选 / 多选 / 自由文本提问 |
 | `exit_plan_mode` | 仅在当前 REPL/宿主提供审批回调时提交最终方案 |
 
+## 内置 Skills
+
+五个核心 Skill（git-workflow、tdd、code-review、skill-creator、visual-review）
+默认开放自然语言发现；概念解释与无关任务不应触发工作流。TDD 的“仅补测试”
+分支允许首次通过，不扩大生产代码改动；Skill Creator 按创建、打包、评测分支
+执行，分享包不默认安装到个人目录。`Bash(git *, npm *)` 匹配完整命令，仍保留
+Host 授权与沙箱。
+
+描述语义筛查不等于观察到真实 Skill 调用。独立 SDK 评测需明确 Provider、model、
+cwd 和预算，见[评测方法](packages/agent/src/capabilities/skills/builtin/skill-creator/references/evaluation.md)。
+可选 artifact-review 聚焦已注册 Artifact 工具；与 visual-review 一样，受管准备
+被拒绝或能力缺失时，受影响范围保留为未验证。
+
 ## Repo Intelligence（内置 full/light 引擎）
 
 KodaX 内置 repo intelligence（`repo_overview` / `module_context` / `symbol_context` / `process_context` / `impact_estimate` 等），让 coding agent 不靠零散 grep/glob 就能理解大型仓库。
@@ -1318,7 +1417,7 @@ KodaX 有两层结构，SDK 用户需要分开理解：
 | `packages/repl`   | `@kodax-ai/kodax/repl`    | 完整包 | Ink TUI + 权限模式 + 命令系统 (217 exports) | 终端 UI 消费者 |
 | `packages/repl`   | `@kodax-ai/kodax/session` | **窄子集** | 仅会话管理 —— `listSessions` / `loadFullTranscript` / `appendClientNotice` / `forkSession` / `compactSession` / `watchSessions` 等 (17 exports) | 读取 session 历史的 IDE 插件和桌面宿主 |
 | `src`             | `@kodax-ai/kodax/client` | 产品 API | 共享 Host 连接与 `KodaXProductClient` 统一契约 | TUI、桌面/IDE 和自动化应用 |
-| `src`             | `@kodax-ai/kodax/runtime` | 宿主 API | Explicit inline/daemon facade，含 sessions/runs/events/permissions/catalog/MCP/artifacts/diagnostics/外部 Agent 和 daemon schema (10 exports) | 受信任宿主集成 |
+| `src`             | `@kodax-ai/kodax/runtime` | 宿主 API | Shared-Host facade，含 sessions/runs/events/permissions/catalog/MCP/artifacts/diagnostics/外部 Agent 和 daemon schema (10 exports) | 受信任宿主集成 |
 | `src`             | `@kodax-ai/kodax/sandbox` | 宿主 API | 显式 ASRT capability/doctor/setup 与宿主自有受控命令执行；不可用时绝不静默普通执行 | 需要独立进程 containment 的 SDK 宿主 |
 | `src`             | `@kodax-ai/kodax/a2a` | 集成边界 | A2A 1.0 Agent Card 发现、JSON-RPC/SSE F258 executor、安全 fetch 与鉴权 Runtime Agent server | Agent 编排器和 KodaX 宿主 |
 
@@ -1413,9 +1512,9 @@ MCP、A2A、Extension 分别使用 `~/.kodax/integrations/` 下的一个用户
 停用条目可随时重新启用。私网地址访问与非 loopback 明文 HTTP 是两项独立、
 持久化且默认拒绝的权限（`--allow-private` 与 `--allow-insecure-http`）；精确
 loopback HTTP 无需这两项授权。OAuth token endpoint 仍保持更严格的
-HTTPS 或精确 loopback 规则。SDK 宿主通过 `createConfiguredA2ARuntimeIntegration({ configHome })` 装载同一
-配置执行平面，并把其 `runtimeOptions` 作为 `externalAgents` 传入——CLI 为其嵌入式
-会话和它启动的 daemon Host 完成同样的接线；`worker.configuredA2A` 选项已随
+HTTPS 或精确 loopback 规则。共享 Host 在内部通过 `createConfiguredA2ARuntimeIntegration({ configHome })`
+装载配置执行平面；SDK 客户端连接这个 Host，公开 `externalAgents` 函数注入已退役。
+`worker.configuredA2A` 选项已随
 Worker facade 在 v0.7.97 移除。
 `a2a serve` 会在监听前装载已配置的 MCP/Extension 能力并固定执行权威，同时热加载
 公开信息、鉴权和限额。Agent、Skill、Extension 工具权威、工作区、tool policy
@@ -1441,13 +1540,13 @@ REPL 显示、唤醒或消费。
 
 当前源码中，`kodax -r` 按最近真实对话消息排序并显示对应时间，旧记录缺少可靠消息时间时回退创建时间。SDK 的 `lastMessageAt`、Host 列表与选择器共用规则；标题、设置、Actor 保存和压缩不刷新对话时间。共享 Host 在取得所有权后统一恢复历史进程，连接客户端不重复清扫；加载提示继续使用统一启动进度契约。
 
-**外部 Agent SDK plane（FEATURE_258，v0.7.67）**：`/agent` 导出协议中立的 executor、registration、policy、credential broker、artifact policy、catalog 和 durable task 契约；`/runtime` 通过 `admin.agentRegistrations`、`agents`、`agentTasks` 向 embedded 与 daemon client 提供同一组 DTO API。Executor factory 是宿主函数，只能装入 inline owner，或在创建新的 in-process daemon owner 时装入；不能通过既有 daemon 连接或 Runtime Worker 边界注入。Plane 关闭后是终态：未完成的 wait 和后续所有服务调用都会拒绝；受限 Workflow 脚本会完整校验并传递 `phase` 与外部 `target`。完整所有权、注册、preflight、启动/等待/继续/取消/对账和安全边界见 [SDK Embedder Guide §18](public_docs/sdk/embedder-guide.md#18-external-agent-executor-plane-feature_258-v0767)。
+**外部 Agent SDK plane（FEATURE_258，v0.7.67）**：`/agent` 导出协议中立的 executor、registration、policy、credential broker、artifact policy、catalog 和 durable task 契约；`/runtime` 通过 `admin.agentRegistrations`、`agents`、`agentTasks` 向共享 Host 客户端提供 DTO API。统一 Host 收口退役公开 executor factory 注入和进程内 owner 构造；支持的 A2A Agent 通过 Host 配置接入。任意 executor 函数仍可用于独立库，但没有透明等价的产品 Host API。Plane 关闭后是终态：未完成的 wait 和后续所有服务调用都会拒绝；受限 Workflow 脚本会完整校验并传递 `phase` 与外部 `target`。完整所有权、注册、preflight、启动/等待/继续/取消/对账和安全边界见 [SDK Embedder Guide §18](public_docs/sdk/embedder-guide.md#18-external-agent-executor-plane-feature_258-v0767)。
 
 **成本受控 Workflow SDK（FEATURE_259，v0.7.67）**：SDK 调用方用 run-scoped `modelTiers` 与 `workflow.maxConcurrency` 配置路由和并发，workflow 作者只表达 `fast` / `balanced` / `deep` 语义意图。terminal workflow event 回显 tier/source/fallback/usage/duration，持久化 `run.json.efficiencyReport` 给出 token coverage、role/tier 启动数、packet-read 拓扑、review wave 和 quality gate 结果。完整配置与遥测读取方式见 [SDK Embedder Guide §20](public_docs/sdk/embedder-guide.md#20-cost-disciplined-workflow-routing-and-telemetry-feature_259-v0767)。
 
 **Inline workflow authoring（FEATURE_246，v0.7.58；F270 于 v0.7.72 更新）**：Worker 在明确表达 Workflow 意图时，可通过 model-callable 的 `run_workflow` 工具在会话内编写并运行工作流。F270 退役 AMAW 与复杂度驱动激活；AMA 保留显式 `/workflow`、named/SDK 和自然语言 Workflow 请求。Workflow 子 Agent 统一运行在 Actor 控制面。详见 [docs/features/v0.7.58.md](docs/features/v0.7.58.md)、[docs/features/v0.7.72.md](docs/features/v0.7.72.md) 与 ADR-044/046/047/048/049/055。
 
-**历史工作流激活分层（FEATURE_248 + FEATURE_249，v0.7.59；F270 于 v0.7.72 取代）**：v0.7.59 引入 AMAW 和 AMA 的显式请求行为。F270 退役 AMAW 及其复杂度驱动指令；SA 保持单独作业，AMA 成为唯一自适应多 Agent 模式，并且只在明确 Workflow 意图下激活 Workflow。详见 [docs/features/v0.7.59.md](docs/features/v0.7.59.md) 与 [docs/features/v0.7.72.md](docs/features/v0.7.72.md)。
+**历史工作流激活分层（FEATURE_248 + FEATURE_249，v0.7.59；F270 于 v0.7.72 取代）**：v0.7.59 引入 AMAW 和 AMA 的显式请求行为。F270 退役 AMAW 及其复杂度驱动指令；CLI/REPL 使用 AMA；SDK 显式 SA 和内部单 Agent 执行器继续兼容。AMA 是唯一自适应多 Agent 模式，并且只在明确 Workflow 意图下激活 Workflow。详见 [docs/features/v0.7.59.md](docs/features/v0.7.59.md) 与 [docs/features/v0.7.72.md](docs/features/v0.7.72.md)。
 
 **managed 工具路径的渐进披露（FEATURE_250，v0.7.60；当前策略于 v0.7.74 纠偏）**：deferred-tool 机制同时应用于 AMA managed path 与 SA。当前延迟集合精确包含 11 个工具：6 个 repo-intelligence、4 个 web/code discovery，以及 `run_workflow`；其 `input_schema` 仍可直接调用，完整描述按需由 `tool_search` 返回。5 个固定 `mcp_*` facade 与 `get_goal` / `create_goal` / `update_goal` 生命周期工具常驻完整契约。v0.7.74 的 Goal 纠偏相对旧 hint 仅增加约 109 个估算 schema token（其中常驻的 `get_goal` 反而少 12 token），消除一次发现往返，并且不改变工具 schema、handler、权限、Goal 状态或压缩保护。详见 [docs/features/v0.7.60.md](docs/features/v0.7.60.md) 与 [docs/features/v0.7.74.md](docs/features/v0.7.74.md#feature_250-v0774-correction-resident-goal-lifecycle-tools)。
 

package/config-templates/config.example.jsonc

@@ -22,14 +22,13 @@
   // "reasoningMode": "auto",
   // "thinking": true,
 
-  // Agent harness: "ama" enables adaptive multi-agent use; "sa" forces one
-  // agent. Permission profiles are "plan", "accept-edits", sandbox-first
+  // New product tasks use AMA with adaptive multi-agent use.
+  // Permission profiles are "plan", "accept-edits", sandbox-first
   // "auto", or direct-host "full-access". Full Access has no sandbox or
   // approval prompts; built-in dangerous-command fallbacks do not apply.
   // Explicit forbidden rules still block; explicit prompt rules cannot prompt.
   // Exec Policy is separate:
   // ~/.kodax/exec-policy.jsonc (and explicitly trusted project policy).
-  // "agentMode": "ama",
   // "permissionMode": "accept-edits",
   // User-level Bash allow patterns. Project additions belong in
   // <project>/.kodax/config.local.json. Broad Bash(*) is rejected.