@kontextmind/kxm 0.7.0 → 0.7.10

package/plugins/kxm/dist/server.js

@@ -7431,6 +7431,61 @@ function parseBoundedInteger(value, field, fallback, min, max) {
   }
   return value;
 }
+var TERMINAL_RECEIPT_SCHEMA = "kxm.terminal-receipt.v1";
+var VALID_TERMINAL_STATUSES = /* @__PURE__ */ new Set(["accepted", "audit_escalation", "rejected", "error"]);
+function validateTerminalReceipt(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new ProtocolError(400, "terminal receipt must be an object", "invalid_terminal_receipt");
+  }
+  const record = value;
+  if (record.schema !== void 0 && record.schema !== TERMINAL_RECEIPT_SCHEMA) {
+    throw new ProtocolError(400, `terminal receipt schema must be ${TERMINAL_RECEIPT_SCHEMA}`, "invalid_terminal_receipt");
+  }
+  const status = record.status;
+  if (!status || !VALID_TERMINAL_STATUSES.has(status)) {
+    throw new ProtocolError(
+      400,
+      `terminal receipt status must be one of: ${Array.from(VALID_TERMINAL_STATUSES).join(", ")}`,
+      "invalid_terminal_receipt"
+    );
+  }
+  const seat = requireString(record.seat, "seat", { max: 64 });
+  const runId = requireString(record.runId, "runId", { max: 128 });
+  const stageId = requireString(record.stageId, "stageId", { max: 128 });
+  const timestamp = requireString(record.timestamp, "timestamp", { max: 64 });
+  const host2 = requireString(record.host, "host", { max: 64 });
+  const model = requireString(record.model, "model", { max: 128 });
+  let evidence;
+  if (record.evidence !== void 0) {
+    if (!record.evidence || typeof record.evidence !== "object" || Array.isArray(record.evidence)) {
+      throw new ProtocolError(400, "terminal receipt evidence must be an object", "invalid_terminal_receipt");
+    }
+    evidence = record.evidence;
+  }
+  let metrics;
+  if (record.metrics !== void 0) {
+    if (!record.metrics || typeof record.metrics !== "object" || Array.isArray(record.metrics)) {
+      throw new ProtocolError(400, "terminal receipt metrics must be an object", "invalid_terminal_receipt");
+    }
+    metrics = record.metrics;
+  }
+  const escalationReason = optionalString(record.escalationReason, "escalationReason", 1024);
+  const ruling = optionalString(record.ruling, "ruling", 2048);
+  return {
+    schema: TERMINAL_RECEIPT_SCHEMA,
+    status,
+    seat,
+    runId,
+    stageId,
+    timestamp,
+    host: host2,
+    model,
+    ...evidence ? { evidence } : {},
+    ...metrics ? { metrics } : {},
+    ...escalationReason ? { escalationReason } : {},
+    ...ruling ? { ruling } : {}
+  };
+}
 
 // plugins/kxm/src/diagnostics.ts
 function workflowScopeExtras(operation, assignedCoordinatorName) {
@@ -7982,12 +8037,17 @@ function parseWorkflowDefinitions(raw, environment = process.env, onWarning) {
       if (stageMaxTransitions !== void 0 && (!Number.isInteger(stageMaxTransitions) || stageMaxTransitions < 1 || stageMaxTransitions > 100)) {
         throw new Error(`stage ${stageId} maxTransitions must be an integer between 1 and 100`);
       }
+      const autoResumeLimit = stage.autoResumeLimit;
+      if (autoResumeLimit !== void 0 && (!Number.isInteger(autoResumeLimit) || autoResumeLimit < 1 || autoResumeLimit > 20)) {
+        throw new Error(`stage ${stageId} autoResumeLimit must be an integer between 1 and 20`);
+      }
       return {
         id: stageId,
         label: requireString(stage.label ?? stageId, "stage.label", { max: 128 }),
         instructions: requireString(stage.instructions, "stage.instructions", { max: 4e3 }),
         requiredEvidence,
         maxAttempts,
+        ...autoResumeLimit !== void 0 ? { autoResumeLimit } : {},
         ...area ? { area } : {},
         ...evidencePolicies ? { evidencePolicies } : {},
         ...on ? { on } : {},
@@ -8266,6 +8326,31 @@ function checkpointRun(run, stageId, status, summary, evidence, timestamp, verif
       delete run.currentStage;
       return { retry: false, completed: false, run };
     }
+    if (stage.autoResumeLimit !== void 0 && stage.attempts >= stage.autoResumeLimit) {
+      stage.status = "in_progress";
+      const reason = summary || `autoResumeLimit of ${stage.autoResumeLimit} reached on stage ${stage.id}`;
+      const receipt = validateTerminalReceipt({
+        schema: TERMINAL_RECEIPT_SCHEMA,
+        status: "audit_escalation",
+        seat: stage.id,
+        runId: run.id,
+        stageId: stage.id,
+        timestamp,
+        host: "pi",
+        model: "default",
+        escalationReason: reason
+      });
+      const expiresAt = new Date(Date.parse(timestamp) + 24 * 60 * 60 * 1e3).toISOString();
+      waitForWorkflowSignal(run, stage.id, "audit_escalation", reason, timestamp, expiresAt);
+      stage.receipt = receipt;
+      stage.auditEscalation = {
+        reason,
+        timestamp,
+        receipt
+      };
+      return { retry: false, completed: false, run };
+    }
+    stage.status = status;
     const outcomeKey = outcome ?? status;
     const rule = resolveOutcomeRule(stage, outcomeKey);
     if (rule && stage.attempts < stage.maxAttempts) {
@@ -10833,7 +10918,45 @@ import {
   writeFileSync as writeFileSync4
 } from "node:fs";
 import { basename as basename3, dirname as dirname3, join as join4, resolve as resolve4 } from "node:path";
-import { DatabaseSync } from "node:sqlite";
+
+// plugins/kxm/src/sqlite.ts
+import { createRequire } from "node:module";
+var requireFromHere = createRequire(import.meta.url);
+function loadNative() {
+  try {
+    const mod = requireFromHere("node:sqlite");
+    if (mod.DatabaseSync) return { Ctor: mod.DatabaseSync, bun: false };
+  } catch {
+  }
+  try {
+    const mod = requireFromHere("bun:sqlite");
+    const Ctor = mod?.DatabaseSync ?? mod?.Database;
+    if (Ctor) return { Ctor, bun: true };
+  } catch {
+  }
+  throw new Error("kxm: no supported sqlite module found (need node:sqlite or bun:sqlite)");
+}
+var native = loadNative();
+var DatabaseSync = class {
+  inner;
+  constructor(path, options) {
+    let normalized = options;
+    if (native.bun && options) {
+      const { readOnly, ...rest } = options;
+      normalized = readOnly === void 0 ? rest : { ...rest, readonly: readOnly };
+    }
+    this.inner = normalized === void 0 ? new native.Ctor(path) : new native.Ctor(path, normalized);
+  }
+  prepare(sql) {
+    return this.inner.prepare(sql);
+  }
+  exec(sql) {
+    return this.inner.exec(sql);
+  }
+  close() {
+    this.inner.close();
+  }
+};
 
 // plugins/kxm/src/vnext-config.ts
 import { basename as basename2, dirname as dirname2, extname as extname2, isAbsolute, join as join3, relative, resolve as resolve3, sep } from "node:path";
@@ -11090,7 +11213,9 @@ function parseAgyOneShotUsage(stdout, _stderr) {
 var READ_ONLY_ONESHOT_ARGS = Object.freeze({
   claude: Object.freeze(["--tools", "Read,Glob,Grep", "--restricted", "--safe-mode", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}', "--disable-slash-commands", "--no-session-persistence"]),
   codex: Object.freeze(["--sandbox", "read-only", "--ignore-user-config", "-c", 'approval_policy="never"']),
-  grok: Object.freeze(["--sandbox", "read-only", "--permission-mode", "plan", "--tools", "Read,Glob,Grep", "--no-subagents", "--disable-web-search"])
+  grok: Object.freeze(["--sandbox", "read-only", "--permission-mode", "plan", "--tools", "Read,Glob,Grep", "--no-subagents", "--disable-web-search"]),
+  agy: Object.freeze(["--mode", "plan", "--sandbox", "--disable-slash-commands"]),
+  kimi: Object.freeze(["--plan"])
 });
 function oneShotReadOnlyArgs(harness) {
   return Object.hasOwn(READ_ONLY_ONESHOT_ARGS, harness) ? READ_ONLY_ONESHOT_ARGS[harness] : void 0;
@@ -11144,7 +11269,7 @@ var BUILTIN_HARNESSES = Object.freeze([
     authArgs: ["provider", "list"],
     update: { self: ["upgrade"] },
     oneShot: {
-      argv: ["--output-format", "stream-json", "-p"],
+      argv: [...oneShotReadOnlyArgs("kimi"), "--output-format", "stream-json", "-p"],
       promptVia: "arg",
       outputFormat: "stream-json",
       usageParser: parseKimiOneShotUsage
@@ -11207,7 +11332,7 @@ var BUILTIN_HARNESSES = Object.freeze([
     authArgs: ["models"],
     update: { self: ["update"] },
     oneShot: {
-      argv: ["--output-format", "json", "-p"],
+      argv: [...oneShotReadOnlyArgs("agy"), "--output-format", "json", "-p"],
       promptVia: "arg",
       outputFormat: "json",
       usageParser: parseAgyOneShotUsage

package/plugins/kxm/dist/vnext-runtime-supervisor.js

@@ -15126,6 +15126,19 @@ var OUTPUT_LIMIT = 8 * 1024 * 1024;
 var KILL_GRACE_MS = 250;
 var DRAIN_GRACE_MS = 500;
 var REAP_GRACE_MS = 1e3;
+function killProcessTree(child, signal = "SIGKILL") {
+  if (process.platform !== "win32" && child.pid) {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch {
+    }
+  }
+  try {
+    child.kill(signal);
+  } catch {
+  }
+}
 function defaultSpawn(command, args, options) {
   if (options.signal?.aborted) {
     return Promise.resolve({ stdout: "", stderr: "", code: null, started: false, observedChildExit: false, error: new Error("process_aborted") });
@@ -15150,6 +15163,7 @@ function defaultSpawn(command, args, options) {
     let child;
     const finish = () => {
       if (finished) return;
+      if (stopping && !killSent) return;
       finished = true;
       for (const timer of [wallTimer, killTimer, drainTimer, reapTimer]) clearTimeout(timer);
       options.signal?.removeEventListener("abort", onAbort);
@@ -15159,14 +15173,21 @@ function defaultSpawn(command, args, options) {
       child?.unref();
       const started = Boolean(child?.pid);
       if (started && !observedChildExit) error ??= new Error("process_exit_unobserved");
-      resolve7({ stdout: Buffer.concat(stdout).toString("utf8"), stderr: Buffer.concat(stderr).toString("utf8"), code, signal, started, observedChildExit, terminationRequested: stopping, ...error ? { error } : {} });
+      const unverifiedDescendants = stopping || started && !observedChildExit;
+      resolve7({
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        code,
+        signal,
+        started,
+        observedChildExit,
+        terminationRequested: stopping,
+        ...unverifiedDescendants ? { unverifiedDescendants: true } : {},
+        ...error ? { error } : {}
+      });
     };
     const kill = (requested) => {
-      try {
-        if (process.platform !== "win32" && child.pid) process.kill(-child.pid, requested);
-        else child.kill(requested);
-      } catch {
-      }
+      killProcessTree(child, requested);
     };
     const stop = (reason) => {
       if (finished) return;
@@ -15194,7 +15215,7 @@ function defaultSpawn(command, args, options) {
         cwd: options.cwd,
         env: options.env ?? process.env,
         stdio: ["pipe", "pipe", "pipe"],
-        shell: false,
+        shell: options.shell === true,
         windowsHide: true,
         detached: process.platform !== "win32"
       });
@@ -15238,7 +15259,7 @@ function defaultSpawn(command, args, options) {
       closed = true;
       code = exitCode;
       signal = exitSignal;
-      if (!stopping || killSent) finish();
+      finish();
     });
     options.signal?.addEventListener("abort", onAbort, { once: true });
     if (options.signal?.aborted) onAbort();
@@ -15493,7 +15514,9 @@ function parseAgyOneShotUsage(stdout, _stderr) {
 var READ_ONLY_ONESHOT_ARGS = Object.freeze({
   claude: Object.freeze(["--tools", "Read,Glob,Grep", "--restricted", "--safe-mode", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}', "--disable-slash-commands", "--no-session-persistence"]),
   codex: Object.freeze(["--sandbox", "read-only", "--ignore-user-config", "-c", 'approval_policy="never"']),
-  grok: Object.freeze(["--sandbox", "read-only", "--permission-mode", "plan", "--tools", "Read,Glob,Grep", "--no-subagents", "--disable-web-search"])
+  grok: Object.freeze(["--sandbox", "read-only", "--permission-mode", "plan", "--tools", "Read,Glob,Grep", "--no-subagents", "--disable-web-search"]),
+  agy: Object.freeze(["--mode", "plan", "--sandbox", "--disable-slash-commands"]),
+  kimi: Object.freeze(["--plan"])
 });
 function oneShotReadOnlyArgs(harness) {
   return Object.hasOwn(READ_ONLY_ONESHOT_ARGS, harness) ? READ_ONLY_ONESHOT_ARGS[harness] : void 0;
@@ -15547,7 +15570,7 @@ var BUILTIN_HARNESSES = Object.freeze([
     authArgs: ["provider", "list"],
     update: { self: ["upgrade"] },
     oneShot: {
-      argv: ["--output-format", "stream-json", "-p"],
+      argv: [...oneShotReadOnlyArgs("kimi"), "--output-format", "stream-json", "-p"],
       promptVia: "arg",
       outputFormat: "stream-json",
       usageParser: parseKimiOneShotUsage
@@ -15610,7 +15633,7 @@ var BUILTIN_HARNESSES = Object.freeze([
     authArgs: ["models"],
     update: { self: ["update"] },
     oneShot: {
-      argv: ["--output-format", "json", "-p"],
+      argv: [...oneShotReadOnlyArgs("agy"), "--output-format", "json", "-p"],
       promptVia: "arg",
       outputFormat: "json",
       usageParser: parseAgyOneShotUsage
@@ -15677,6 +15700,31 @@ function defaultRunner(env) {
     }
   };
 }
+function commandResultFromSpawn(result) {
+  const errno = result.error && "code" in result.error ? result.error.code : void 0;
+  const error = (typeof errno === "string" && errno ? errno : void 0) ?? result.error?.message ?? (result.observedChildExit !== true ? "auth_probe_exit_unobserved" : void 0);
+  return {
+    ok: result.code === 0 && !error,
+    code: result.code,
+    stdout: result.stdout,
+    stderr: result.stderr,
+    ...error ? { error } : {}
+  };
+}
+function defaultAsyncRunner(env, signal) {
+  return async (command, args, timeoutMs) => {
+    try {
+      return commandResultFromSpawn(await defaultSpawn(command, args, {
+        env,
+        timeoutMs,
+        signal,
+        shell: harnessSpawnUsesShell(command)
+      }));
+    } catch (error) {
+      return { ok: false, code: null, stdout: "", stderr: "", error: error instanceof Error ? error.message : "spawn_failed" };
+    }
+  };
+}
 function firstLine(text) {
   const line = text.split(/\r?\n/).map((candidate) => candidate.trim()).find(Boolean);
   return line && line.length <= 200 ? line : void 0;
@@ -16092,35 +16140,31 @@ var PendingHarnessCommand = class {
     this.key = key;
   }
 };
-async function probeHarnessAssignmentAsync(options) {
+async function replayHarnessProbe(run, execute, limit) {
   const observed = /* @__PURE__ */ new Map();
-  const run = options.runCommand ?? (async (command, args, timeoutMs) => {
-    const result = await defaultSpawn(command, args, { env: options.env, timeoutMs, signal: options.signal });
-    const error = result.error?.message ?? (result.observedChildExit !== true ? "auth_probe_exit_unobserved" : void 0);
-    return {
-      ok: result.code === 0 && !error,
-      code: result.code,
-      stdout: result.stdout,
-      stderr: result.stderr,
-      ...error ? { error } : {}
-    };
-  });
-  for (let commands = 0; commands <= 32; commands++) {
+  for (let commands = 0; commands <= limit; commands++) {
     try {
-      return probeHarnessAssignment({ ...options, runCommand(command, args, timeoutMs) {
+      return execute((command, args, timeoutMs) => {
         const key = JSON.stringify([command, args, timeoutMs]);
         const result = observed.get(key);
         if (result) return result;
         throw new PendingHarnessCommand(command, args, timeoutMs, key);
-      } });
+      });
     } catch (pending) {
       if (!(pending instanceof PendingHarnessCommand)) throw pending;
-      if (commands === 32) throw new Error("auth_probe_command_limit");
+      if (commands === limit) throw new Error("auth_probe_command_limit");
       observed.set(pending.key, await run(pending.command, pending.args, pending.timeoutMs));
     }
   }
   throw new Error("auth_probe_command_limit");
 }
+async function probeHarnessAssignmentAsync(options) {
+  return replayHarnessProbe(
+    options.runCommand ?? defaultAsyncRunner(options.env ?? process.env, options.signal),
+    (runCommand) => probeHarnessAssignment({ ...options, runCommand }),
+    32
+  );
+}
 
 // plugins/kxm/src/vnext-config.ts
 var VnextConfigError = class extends Error {
@@ -16905,7 +16949,7 @@ function validateModelReferences(models, issues) {
   };
   for (const id of models.keys()) walk(id, []);
 }
-function validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry) {
+function validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, projectRoot) {
   const issues = [];
   const entries = valuesOf(project.value, "repositories").map((candidate) => objectValue(candidate)).filter((candidate) => Boolean(candidate));
   const repositoryIds = /* @__PURE__ */ new Set();
@@ -16973,6 +17017,33 @@ function validateBundle(project, repositories, agents, models, workflows, enviro
   const defaultWorkflow = stringValue(project.value.defaultWorkflow) ?? "default";
   if (!workflows.has(defaultWorkflow)) issues.push(issue2("reference", "default_workflow_unknown", project.logicalPath, `default workflow ${defaultWorkflow} does not exist`));
   for (const workflow of workflows.values()) validateWorkflow(workflow, agents, models, repositoryIds, gates, issues);
+  if (projectRoot) {
+    const writerRolePath = join(projectRoot, ".kxm", "roles", "writer.yaml");
+    const implementerAgent = agents.get("implementer") ?? agents.get("writer");
+    if (existsSync2(writerRolePath) && implementerAgent) {
+      try {
+        const rawRole = parseRestrictedYaml2(readFileSync(writerRolePath, "utf8"));
+        const roleObj = objectValue(rawRole);
+        const rosterEntries = valuesOf(roleObj ?? {}, "roster").map((candidate) => objectValue(candidate)).filter((entry) => Boolean(entry));
+        const enabledRosterModels = rosterEntries.filter((entry) => entry.enabled !== false).map((entry) => stringValue(entry.model)).filter((m) => Boolean(m));
+        const agentModelObj = objectValue(implementerAgent.value.model);
+        const agentModelStr = stringValue(implementerAgent.value.model);
+        const agentProvider = agentModelObj ? stringValue(agentModelObj.provider) : void 0;
+        const agentModel = agentModelObj ? stringValue(agentModelObj.model) : agentModelStr;
+        const canonicalAgentModel = agentProvider && agentModel ? `${agentProvider}/${agentModel}` : agentModel;
+        if (enabledRosterModels.length > 0 && canonicalAgentModel) {
+          const matches = enabledRosterModels.some((rm) => rm === canonicalAgentModel || rm === agentModel || rm.endsWith(`/${agentModel}`));
+          if (!matches) {
+            issues.push(issue2("semantic", "role_roster_conflicts_with_agent", ".kxm/roles/writer.yaml", `role roster in .kxm/roles/writer.yaml does not include agent model ${canonicalAgentModel} from ${implementerAgent.logicalPath}`));
+          }
+        }
+      } catch (error) {
+        if (error instanceof VnextConfigError) {
+          issues.push(...error.issues);
+        }
+      }
+    }
+  }
   return sortIssues2(issues);
 }
 function vnextCanonicalJson(value) {
@@ -17153,7 +17224,7 @@ function loadVnextProject(projectRoot, options = {}) {
     }
   }
   if (loadIssues.length > 0) throw new VnextConfigError(loadIssues);
-  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry);
+  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root);
   if (issues.length > 0) throw new VnextConfigError(issues);
   const resources = [project, ...repositories.values(), ...agents.values(), ...models.values(), ...workflows.values(), ...environments, ...gateRegistry ? [gateRegistry] : []].sort((left, right) => compareCodeUnits3(left.logicalPath, right.logicalPath));
   return {
@@ -17265,7 +17336,47 @@ import { dirname as dirname4, join as join4, resolve as resolve4 } from "node:pa
 
 // plugins/kxm/src/vnext-bindings.ts
 import { homedir } from "node:os";
-import { DatabaseSync } from "node:sqlite";
+
+// plugins/kxm/src/sqlite.ts
+import { createRequire } from "node:module";
+var requireFromHere = createRequire(import.meta.url);
+function loadNative() {
+  try {
+    const mod = requireFromHere("node:sqlite");
+    if (mod.DatabaseSync) return { Ctor: mod.DatabaseSync, bun: false };
+  } catch {
+  }
+  try {
+    const mod = requireFromHere("bun:sqlite");
+    const Ctor = mod?.DatabaseSync ?? mod?.Database;
+    if (Ctor) return { Ctor, bun: true };
+  } catch {
+  }
+  throw new Error("kxm: no supported sqlite module found (need node:sqlite or bun:sqlite)");
+}
+var native = loadNative();
+var DatabaseSync = class {
+  inner;
+  constructor(path, options) {
+    let normalized = options;
+    if (native.bun && options) {
+      const { readOnly, ...rest } = options;
+      normalized = readOnly === void 0 ? rest : { ...rest, readonly: readOnly };
+    }
+    this.inner = normalized === void 0 ? new native.Ctor(path) : new native.Ctor(path, normalized);
+  }
+  prepare(sql) {
+    return this.inner.prepare(sql);
+  }
+  exec(sql) {
+    return this.inner.exec(sql);
+  }
+  close() {
+    this.inner.close();
+  }
+};
+
+// plugins/kxm/src/vnext-bindings.ts
 import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, parse, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
 var MAX_BINDING_RECORD_BYTES = 256 * 1024;
 var BINDING_LABEL = "Runtime-local repository bindings";
@@ -17308,7 +17419,6 @@ import {
   writeFileSync
 } from "node:fs";
 import { basename as basename2, dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
-import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 function databaseError(code, file, message) {
   const issue3 = { phase: "semantic", code, file, message };
   return new VnextConfigError([issue3]);
@@ -17388,7 +17498,7 @@ function openDatabase(file, description, spec) {
       }
     }
   }
-  const database = new DatabaseSync2(file);
+  const database = new DatabaseSync(file);
   let transaction = false;
   try {
     database.exec(`PRAGMA busy_timeout = ${spec.timeoutMs ?? 5e3}`);
@@ -21827,9 +21937,28 @@ import { join as join11 } from "node:path";
 import { createHash as createHash6, randomUUID as randomUUID3 } from "node:crypto";
 import { lstat, mkdir, open, rename } from "node:fs/promises";
 import { join as join6 } from "node:path";
+var ONESHOT_EVIDENCE_SCHEMA = "kxm.oneshot-evidence.v2";
+var RETIRED_ONESHOT_EVIDENCE_SCHEMAS = /* @__PURE__ */ new Set(["kxm.oneshot-evidence.v1"]);
 var TEXT_LIMIT = 4 * 1024 * 1024;
+var ARGV_LIMIT = 64 * 1024;
 var RECORD_LIMIT = 16 * 1024 * 1024;
 var digest = (value) => `sha256:${createHash6("sha256").update(value).digest("hex")}`;
+function parseOneShotEvidenceRecord(bytes) {
+  let parsed;
+  try {
+    parsed = JSON.parse(bytes);
+  } catch {
+    throw new Error("oneshot_evidence_record_invalid");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("oneshot_evidence_record_invalid");
+  }
+  const schema = parsed.schema;
+  if (typeof schema !== "string") throw new Error("oneshot_evidence_record_invalid");
+  if (RETIRED_ONESHOT_EVIDENCE_SCHEMAS.has(schema)) throw new Error("oneshot_evidence_schema_retired");
+  if (schema !== ONESHOT_EVIDENCE_SCHEMA) throw new Error("oneshot_evidence_schema_unknown");
+  return parsed;
+}
 async function beginOneShotEvidence(root, intent, sensitive) {
   await mkdir(root, { recursive: true, mode: 448 });
   const stat = await lstat(root);
@@ -21843,11 +21972,11 @@ async function beginOneShotEvidence(root, intent, sensitive) {
   const redact = (value) => {
     let text = value;
     for (const secret of secrets) text = text.replaceAll(secret, "[REDACTED]");
-    return text.replace(/(\b(?:authorization|api[_-]?key|access[_-]?token|refresh[_-]?token|password|secret)\b["']?\s*[:=]\s*["']?)(?:Bearer\s+)?[^\s"',;}]+/gi, "$1[REDACTED]");
+    return text.replace(/(\b(?:authorization|api[_-]?key|access[_-]?token|refresh[_-]?token|password|secret)\b["']?\s*[:=]\s*["']?)(?:Bearer\s+)?[^\s"',;}]+/gi, "$1[REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]");
   };
-  const bounded = (value) => {
+  const bounded = (value, max = TEXT_LIMIT) => {
     const bytes = Buffer.from(redact(value));
-    return { text: bytes.subarray(0, TEXT_LIMIT).toString("utf8"), truncated: bytes.length > TEXT_LIMIT, sha256: digest(value) };
+    return { text: bytes.subarray(0, max).toString("utf8"), truncated: bytes.length > max, sha256: digest(redact(value)) };
   };
   const write = async (name, value) => {
     const current = await lstat(dir);
@@ -21856,6 +21985,7 @@ async function beginOneShotEvidence(root, intent, sensitive) {
     }
     const bytes = JSON.stringify(value);
     if (Buffer.byteLength(bytes) > RECORD_LIMIT) throw new Error("oneshot_evidence_record_limit");
+    parseOneShotEvidenceRecord(bytes);
     const target = join6(dir, name);
     const partial = `${target}.partial`;
     const file = await open(partial, "wx", 384);
@@ -21877,7 +22007,7 @@ async function beginOneShotEvidence(root, intent, sensitive) {
     return digest(bytes);
   };
   await write("intent.json", {
-    schema: "kxm.oneshot-evidence.v1",
+    schema: ONESHOT_EVIDENCE_SCHEMA,
     id,
     recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
     runId: intent.runId,
@@ -21888,9 +22018,10 @@ async function beginOneShotEvidence(root, intent, sensitive) {
     provider: intent.provider,
     requestedModel: intent.model,
     cwd: intent.cwd,
-    command: intent.command,
-    argv: bounded(JSON.stringify(intent.args)),
+    command: redact(intent.command),
+    argv: bounded(JSON.stringify(intent.args), ARGV_LIMIT),
     stdin: intent.input === void 0 ? null : bounded(intent.input),
+    env: null,
     acceptance: false
   });
   let finished = false;
@@ -21900,7 +22031,7 @@ async function beginOneShotEvidence(root, intent, sensitive) {
       if (finished) throw new Error("oneshot_evidence_already_finished");
       finished = true;
       return write("result.json", {
-        schema: "kxm.oneshot-evidence.v1",
+        schema: ONESHOT_EVIDENCE_SCHEMA,
         id,
         recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
         stdout: bounded(result.stdout),
@@ -21910,6 +22041,7 @@ async function beginOneShotEvidence(root, intent, sensitive) {
         started: result.started ?? null,
         observedChildExit: result.observedChildExit ?? null,
         terminationRequested: result.terminationRequested ?? null,
+        unverifiedDescendants: result.unverifiedDescendants ?? null,
         error: result.error ? bounded(result.error.message) : null,
         observation: bounded(JSON.stringify(observation)),
         acceptance: false
@@ -22465,6 +22597,32 @@ function evaluateArtifactsGate(context, definition) {
 // plugins/kxm/src/vnext-engine-command.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
+
+// plugins/kxm/src/safety-integrity.ts
+var DESTRUCTIVE_COMMAND_PATTERNS = Object.freeze([
+  /^\s*rm\s+.*-[a-zA-Z]*r[a-zA-Z]*f/i,
+  /^\s*rm\s+.*-[a-zA-Z]*f[a-zA-Z]*r/i,
+  /^\s*rm\s+.*(-[a-zA-Z]*r[a-zA-Z]*\s+.*-[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*\s+.*-[a-zA-Z]*r[a-zA-Z]*)/i,
+  /^\s*git\s+reset\s+--hard/i,
+  /^\s*git\s+clean\s+-[a-zA-Z]*f/i,
+  /^\s*git\s+checkout\s+--\s+/i,
+  /^\s*git\s+restore\s+(\.|\*|--staged\s+(\.|\*))/i
+]);
+function assertCommandSeatbelt(command) {
+  for (const pattern of DESTRUCTIVE_COMMAND_PATTERNS) {
+    if (pattern.test(command)) {
+      throw new Error(
+        `Command blocked by KXM safety seatbelt: "${command}". Destructive workspace mutations require explicit operator override.`
+      );
+    }
+  }
+}
+var INSECURE_SSH_HOST_KEY_PATTERNS = Object.freeze([
+  /StrictHostKeyChecking=(accept-new|no|off)/i,
+  /UserKnownHostsFile=\/dev\/null/i
+]);
+
+// plugins/kxm/src/vnext-engine-command.ts
 var MAX_DIRECT_TIMER_MS = 2147483647;
 var COMMAND_TERM_GRACE_MS = 2e3;
 var COMMAND_FINAL_WAIT_MS = 2e3;
@@ -22581,6 +22739,7 @@ var CommandObserver = class {
     if (!Number.isInteger(this.definition.timeoutMs) || this.definition.timeoutMs < 1 || this.definition.timeoutMs > MAX_DIRECT_TIMER_MS) {
       throw runtimeError("run_events_illegal", "command", "command timeoutMs exceeds the direct timer bound");
     }
+    assertCommandSeatbelt(this.definition.argv.join(" "));
     this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
     let child;
     try {
@@ -23706,6 +23865,7 @@ async function stepLocked(context, runId, producer, token) {
   return drivePanel(context, prepared.panel, producer);
 }
 async function runPreparedCommandGate(context, prepared, definition, token) {
+  assertCommandSeatbelt(definition.argv.join(" "));
   const storePath = context.eventStore.path;
   const observer = createCommandObserver({
     definition,
@@ -25483,6 +25643,24 @@ function createVnextOneShotProducer(options = {}) {
         "--output-format",
         "json"
       ];
+    } else if (harness === "agy") {
+      args = [
+        "-m",
+        resolved.model,
+        ...permissionArgs,
+        "--output-format",
+        "json",
+        "-p"
+      ];
+    } else if (harness === "kimi") {
+      args = [
+        "-m",
+        resolved.model,
+        ...permissionArgs,
+        "--output-format",
+        "stream-json",
+        "-p"
+      ];
     } else {
       throw new Error(`oneshot_harness_unsupported: ${harness} permission_profile_unaudited`);
     }
@@ -25525,7 +25703,8 @@ Return a final JSON object with an "outcome" field chosen from ${JSON.stringify(
       parsed = { text: "", isError: true };
     }
     const aborted = request.signal.aborted || procResult.error?.message === "process_aborted";
-    const effectUncertain = procResult.terminationRequested === true || Boolean(procResult.signal) || procResult.error?.message === "process_exit_unobserved" || procResult.observedChildExit === false && procResult.started !== false;
+    const unverifiedDescendants = procResult.unverifiedDescendants === true || procResult.terminationRequested === true || procResult.error?.message === "process_exit_unobserved" || procResult.observedChildExit === false && procResult.started !== false;
+    const effectUncertain = unverifiedDescendants || Boolean(procResult.signal);
     const transportFailed = procResult.code !== 0 || Boolean(procResult.error) || effectUncertain;
     const outcome = aborted ? "cancelled" : transportFailed || parsed.isError ? "failed" : determineOutcome(parsed.text, request.allowedOutcomes);
     const providerMetadata = {
@@ -25537,6 +25716,7 @@ Return a final JSON object with an "outcome" field chosen from ${JSON.stringify(
     if (procResult.observedChildExit !== void 0) providerMetadata.observedChildExit = procResult.observedChildExit;
     if (procResult.started !== void 0) providerMetadata.processStarted = procResult.started;
     if (procResult.terminationRequested !== void 0) providerMetadata.terminationRequested = procResult.terminationRequested;
+    if (unverifiedDescendants) providerMetadata.descendantEffects = "unverified";
     if (procResult.error) {
       const reason = procResult.error.message;
       providerMetadata.processError = /^process_(aborted|timeout|output_limit|stdin_error|stdio_error|stdio_unclosed|exit_unobserved)$/.test(reason) ? reason : "process_error";
@@ -26017,7 +26197,6 @@ async function startVnextRuntimeSupervisorInner(paths, requestedPortOption, now)
               });
             } catch (err) {
               earlyError = err;
-              drivePromise = Promise.reject(err);
             }
             await Promise.resolve();
             if (earlyError) {
@@ -26043,6 +26222,7 @@ async function startVnextRuntimeSupervisorInner(paths, requestedPortOption, now)
                 } catch {
                 }
               }
+            }).catch(() => {
             });
             sendJson(response, 202, {
               ok: true,