@kontextmind/kxm 0.7.0 → 0.7.4

package/plugins/kxm/src/role.ts

@@ -373,3 +373,338 @@ export function modifyRole(
   writeFileSync(filePath, stringify(updated), "utf8");
   return { id: roleId, role: updated, filePath, scope };
 }
+
+// ---------------------------------------------------------------------------
+// Role Seat & Host Mapping Governance (kxm.role-hosts.v1)
+// ---------------------------------------------------------------------------
+
+export const KXM_ROLE_HOSTS_SCHEMA = "kxm.role-hosts.v1" as const;
+
+export interface RoleSeatDefinition {
+  seatId: string;
+  description?: string | undefined;
+  defaultModel?: string | undefined;
+  defaultHost?: string | undefined;
+  allowedTools?: readonly string[] | undefined;
+  requiredEvidenceKind?: string | undefined;
+}
+
+export interface RoleSeatBinding {
+  model?: string | undefined;
+  host?: string | undefined;
+  effort?: "low" | "medium" | "high" | "xhigh" | undefined;
+}
+
+export interface RoleHostsConfig {
+  schema: typeof KXM_ROLE_HOSTS_SCHEMA;
+  seats?: Record<string, RoleSeatBinding> | undefined;
+  hostProviders?: Record<string, string> | undefined;
+}
+
+export const DEFAULT_ROLE_SEATS: Record<string, RoleSeatDefinition> = {
+  planner: {
+    seatId: "planner",
+    description: "Architecture breakdown, requirement decomposition, and safety boundary definition.",
+    defaultModel: "anthropic/claude-fable-5.1",
+    defaultHost: "pi",
+    allowedTools: ["view_file", "grep_search", "find_by_name", "list_dir"],
+    requiredEvidenceKind: "architecture_review",
+  },
+  writer: {
+    seatId: "writer",
+    description: "Primary implementation agent. Writes code, refactors components, and authors unit tests.",
+    defaultModel: "x-ai/grok-4.6",
+    defaultHost: "grok",
+    allowedTools: ["view_file", "replace_file_content", "write_to_file", "run_command"],
+    requiredEvidenceKind: "git_diff",
+  },
+  "critic-arch": {
+    seatId: "critic-arch",
+    description: "Independent critic reviewing implementation diffs for architectural integrity.",
+    defaultModel: "anthropic/claude-fable-5.1",
+    defaultHost: "pi",
+    allowedTools: ["view_file", "grep_search"],
+    requiredEvidenceKind: "architecture_review",
+  },
+  "critic-cli": {
+    seatId: "critic-cli",
+    description: "CLI, documentation, and developer ergonomics critic.",
+    defaultModel: "openai/gpt-5.6-sol",
+    defaultHost: "pi",
+    allowedTools: ["view_file", "grep_search"],
+    requiredEvidenceKind: "cli_review",
+  },
+  verifier: {
+    seatId: "verifier",
+    description: "Deterministic gate evaluation runner.",
+    defaultModel: "evaluator",
+    defaultHost: "pi",
+    allowedTools: ["run_command"],
+    requiredEvidenceKind: "test_run",
+  },
+};
+
+export function roleHostsFilePath(
+  scope: "global" | "local",
+  repoRoot = process.cwd(),
+  userConfigDir?: string,
+  preferJson = false,
+): string {
+  const dir = scope === "global" ? userConfigDirectory(userConfigDir) : repoConfigDirectory(repoRoot);
+  return join(dir, preferJson ? "role-hosts.json" : "role-hosts.yaml");
+}
+
+export function findExistingRoleHostsFile(
+  scope: "global" | "local",
+  repoRoot = process.cwd(),
+  userConfigDir?: string,
+): { filePath: string; exists: boolean; format: "yaml" | "json" } {
+  const dir = scope === "global" ? userConfigDirectory(userConfigDir) : repoConfigDirectory(repoRoot);
+  const yamlPath = join(dir, "role-hosts.yaml");
+  const ymlPath = join(dir, "role-hosts.yml");
+  const jsonPath = join(dir, "role-hosts.json");
+
+  if (existsSync(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
+  if (existsSync(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
+  if (existsSync(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
+  return { filePath: yamlPath, exists: false, format: "yaml" };
+}
+
+export function parseRoleHostsFile(filePath: string): RoleHostsConfig | undefined {
+  if (!existsSync(filePath)) return undefined;
+  try {
+    const raw = readFileSync(filePath, "utf8");
+    const parsed = parse(raw) as Partial<RoleHostsConfig>;
+    if (!parsed || typeof parsed !== "object") return undefined;
+    if (parsed.schema && parsed.schema !== KXM_ROLE_HOSTS_SCHEMA) return undefined;
+    return {
+      schema: KXM_ROLE_HOSTS_SCHEMA,
+      seats: parsed.seats && typeof parsed.seats === "object" ? parsed.seats : {},
+      hostProviders: parsed.hostProviders && typeof parsed.hostProviders === "object" ? parsed.hostProviders : {},
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+export function loadRoleHostsConfig(options: {
+  scope?: "all" | "global" | "local" | undefined;
+  repoRoot?: string | undefined;
+  userConfigDir?: string | undefined;
+} = {}): { config: RoleHostsConfig; filePath?: string | undefined; scope: "local" | "global" | "default" } {
+  const scopeFilter = options.scope ?? "all";
+  const repoRoot = options.repoRoot ?? process.cwd();
+
+  let localConfig: RoleHostsConfig | undefined;
+  let localPath: string | undefined;
+  if (scopeFilter !== "global") {
+    const localFound = findExistingRoleHostsFile("local", repoRoot, options.userConfigDir);
+    if (localFound.exists) {
+      localConfig = parseRoleHostsFile(localFound.filePath);
+      localPath = localFound.filePath;
+    }
+  }
+
+  let globalConfig: RoleHostsConfig | undefined;
+  let globalPath: string | undefined;
+  if (scopeFilter !== "local") {
+    const globalFound = findExistingRoleHostsFile("global", repoRoot, options.userConfigDir);
+    if (globalFound.exists) {
+      globalConfig = parseRoleHostsFile(globalFound.filePath);
+      globalPath = globalFound.filePath;
+    }
+  }
+
+  if (scopeFilter === "local") {
+    return {
+      config: localConfig ?? { schema: KXM_ROLE_HOSTS_SCHEMA, seats: {}, hostProviders: {} },
+      filePath: localPath,
+      scope: localPath ? "local" : "default",
+    };
+  }
+
+  if (scopeFilter === "global") {
+    return {
+      config: globalConfig ?? { schema: KXM_ROLE_HOSTS_SCHEMA, seats: {}, hostProviders: {} },
+      filePath: globalPath,
+      scope: globalPath ? "global" : "default",
+    };
+  }
+
+  // Merge: local seats override global seats; local hostProviders merge over global hostProviders
+  const mergedSeats: Record<string, RoleSeatBinding> = {
+    ...(globalConfig?.seats ?? {}),
+    ...(localConfig?.seats ?? {}),
+  };
+  const mergedHostProviders: Record<string, string> = {
+    ...(globalConfig?.hostProviders ?? {}),
+    ...(localConfig?.hostProviders ?? {}),
+  };
+
+  const primaryPath = localPath ?? globalPath;
+  const primaryScope = localPath ? "local" : (globalPath ? "global" : "default");
+
+  return {
+    config: {
+      schema: KXM_ROLE_HOSTS_SCHEMA,
+      seats: mergedSeats,
+      hostProviders: mergedHostProviders,
+    },
+    filePath: primaryPath,
+    scope: primaryScope,
+  };
+}
+
+export function saveRoleHostsConfig(
+  config: RoleHostsConfig,
+  options: {
+    scope?: "global" | "local" | undefined;
+    repoRoot?: string | undefined;
+    userConfigDir?: string | undefined;
+    format?: "yaml" | "json" | undefined;
+  } = {},
+): { filePath: string; scope: "global" | "local" } {
+  const scope = options.scope ?? "local";
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = scope === "global" ? userConfigDirectory(options.userConfigDir) : repoConfigDirectory(repoRoot);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+
+  const format = options.format ?? "yaml";
+  const filePath = join(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
+  const payload: RoleHostsConfig = {
+    schema: KXM_ROLE_HOSTS_SCHEMA,
+    seats: config.seats ?? {},
+    ...(config.hostProviders && Object.keys(config.hostProviders).length > 0 ? { hostProviders: config.hostProviders } : {}),
+  };
+
+  const content = format === "json" ? JSON.stringify(payload, null, 2) + "\n" : stringify(payload);
+  writeFileSync(filePath, content, "utf8");
+  return { filePath, scope };
+}
+
+export function setRoleSeatHost(
+  seatId: string,
+  host: string,
+  options: {
+    model?: string | undefined;
+    effort?: "low" | "medium" | "high" | "xhigh" | undefined;
+    scope?: "global" | "local" | undefined;
+    repoRoot?: string | undefined;
+    userConfigDir?: string | undefined;
+    format?: "yaml" | "json" | undefined;
+  } = {},
+): { filePath: string; seatId: string; binding: RoleSeatBinding; scope: "global" | "local" } {
+  const scope = options.scope ?? "local";
+  const current = loadRoleHostsConfig({
+    scope,
+    repoRoot: options.repoRoot,
+    userConfigDir: options.userConfigDir,
+  });
+
+  const seats = { ...(current.config.seats ?? {}) };
+  const existing = seats[seatId] ?? {};
+  const binding: RoleSeatBinding = {
+    ...existing,
+    host,
+    ...(options.model !== undefined ? { model: options.model } : {}),
+    ...(options.effort !== undefined ? { effort: options.effort } : {}),
+  };
+  seats[seatId] = binding;
+
+  const updatedConfig: RoleHostsConfig = {
+    ...current.config,
+    schema: KXM_ROLE_HOSTS_SCHEMA,
+    seats,
+  };
+
+  const saved = saveRoleHostsConfig(updatedConfig, {
+    scope,
+    repoRoot: options.repoRoot,
+    userConfigDir: options.userConfigDir,
+    format: options.format,
+  });
+
+  return { filePath: saved.filePath, seatId, binding, scope };
+}
+
+export function resolveRoleSeat(
+  seatId: string,
+  options: {
+    hostOverride?: string | undefined;
+    modelOverride?: string | undefined;
+    repoRoot?: string | undefined;
+    userConfigDir?: string | undefined;
+  } = {},
+): {
+  seatId: string;
+  host: string;
+  model?: string | undefined;
+  provider?: string | undefined;
+  effort?: "low" | "medium" | "high" | "xhigh" | undefined;
+  source: "override" | "role-hosts" | "seat-default" | "role-roster" | "fallback";
+} {
+  const hostsConfig = loadRoleHostsConfig({
+    scope: "all",
+    repoRoot: options.repoRoot,
+    userConfigDir: options.userConfigDir,
+  }).config;
+
+  const configuredSeat = hostsConfig.seats?.[seatId];
+  const defaultSeat = DEFAULT_ROLE_SEATS[seatId];
+  const roleDef = getRole(seatId, {
+    scope: "all",
+    repoRoot: options.repoRoot,
+    userConfigDir: options.userConfigDir,
+  })?.role ?? DEFAULT_ROLES[seatId];
+  const primaryRoster = roleDef?.roster?.[0];
+
+  // Resolve host
+  let host = "pi";
+  let source: "override" | "role-hosts" | "seat-default" | "role-roster" | "fallback" = "fallback";
+
+  if (options.hostOverride) {
+    host = options.hostOverride;
+    source = "override";
+  } else if (configuredSeat?.host) {
+    host = configuredSeat.host;
+    source = "role-hosts";
+  } else if (defaultSeat?.defaultHost) {
+    host = defaultSeat.defaultHost;
+    source = "seat-default";
+  } else if (primaryRoster?.harness) {
+    host = primaryRoster.harness;
+    source = "role-roster";
+  }
+
+  // Resolve model
+  let model: string | undefined;
+  if (options.modelOverride) {
+    model = options.modelOverride;
+  } else if (configuredSeat?.model) {
+    model = configuredSeat.model;
+  } else if (defaultSeat?.defaultModel) {
+    model = defaultSeat.defaultModel;
+  } else if (primaryRoster?.model) {
+    model = primaryRoster.model;
+  }
+
+  // Resolve provider
+  const provider = hostsConfig.hostProviders?.[host]
+    ?? roleDef?.roster?.find((r) => r.harness === host)?.provider;
+
+  // Resolve effort
+  const effort = configuredSeat?.effort
+    ?? roleDef?.roster?.find((r) => r.harness === host)?.effort;
+
+  return {
+    seatId,
+    host,
+    model,
+    provider,
+    effort,
+    source,
+  };
+}
+

package/plugins/kxm/src/safety-integrity.ts

@@ -0,0 +1,76 @@
+/**
+ * Safety, security, process integrity, and command seatbelts.
+ *
+ * Implements deterministic safety invariants:
+ * - Literal blocklist intercepting destructive shell mutations (rm -rf, git reset --hard, etc.)
+ * - Unbypassable raw byte fidelity brake for verification gates and critic reviews (bypassing lossy compression)
+ * - Pinned SSH host key verification policy for headless remote execution
+ */
+
+export const DESTRUCTIVE_COMMAND_PATTERNS: readonly RegExp[] = Object.freeze([
+  /^\s*rm\s+.*-[a-zA-Z]*r[a-zA-Z]*f/i,
+  /^\s*rm\s+.*-[a-zA-Z]*f[a-zA-Z]*r/i,
+  /^\s*rm\s+.*(-[a-zA-Z]*r[a-zA-Z]*\s+.*-[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*\s+.*-[a-zA-Z]*r[a-zA-Z]*)/i,
+  /^\s*git\s+reset\s+--hard/i,
+  /^\s*git\s+clean\s+-[a-zA-Z]*f/i,
+  /^\s*git\s+checkout\s+--\s+/i,
+  /^\s*git\s+restore\s+(\.|\*|--staged\s+(\.|\*))/i,
+]);
+
+/**
+ * Literal command seatbelt: blocks destructive mutations from autonomous agents.
+ * Throws a descriptive error if command matches any destructive pattern.
+ */
+export function assertCommandSeatbelt(command: string): void {
+  for (const pattern of DESTRUCTIVE_COMMAND_PATTERNS) {
+    if (pattern.test(command)) {
+      throw new Error(
+        `Command blocked by KXM safety seatbelt: "${command}". Destructive workspace mutations require explicit operator override.`,
+      );
+    }
+  }
+}
+
+export interface RtkBypassContext {
+  stepKind?: string | undefined;
+  agentRole?: string | undefined;
+  preset?: string | undefined;
+}
+
+const CRITIC_PRESETS = new Set(["critic-arch", "critic-cli", "auditor"]);
+const CRITIC_ROLES = new Set(["critic-arch", "critic-cli", "auditor", "reviewer-arch", "reviewer-cli"]);
+
+/**
+ * Gate and Critic RTK Brake:
+ * Hardcode an unbypassable check ensuring lossy command output compression (RTK)
+ * is strictly prohibited for:
+ * 1. Verification gates (stepKind === "gate")
+ * 2. Critic and auditor agents (critic-arch, critic-cli, auditor)
+ */
+export function isRtkBypassRequired(context: RtkBypassContext): boolean {
+  if (context.stepKind === "gate") return true;
+  if (context.agentRole && CRITIC_ROLES.has(context.agentRole)) return true;
+  if (context.preset && CRITIC_PRESETS.has(context.preset)) return true;
+  return false;
+}
+
+const INSECURE_SSH_HOST_KEY_PATTERNS: readonly RegExp[] = Object.freeze([
+  /StrictHostKeyChecking=(accept-new|no|off)/i,
+  /UserKnownHostsFile=\/dev\/null/i,
+]);
+
+/**
+ * Pinned host key verification policy for headless SSH remote execution.
+ * Rejects TOFU (accept-new) and disabled host key checking.
+ */
+export function assertPinnedSshHostKeyPolicy(sshArgs: readonly string[]): void {
+  for (const arg of sshArgs) {
+    for (const pattern of INSECURE_SSH_HOST_KEY_PATTERNS) {
+      if (pattern.test(arg)) {
+        throw new Error(
+          `Insecure SSH host key policy rejected: "${arg}". KXM headless SSH requires pinned host keys with StrictHostKeyChecking=yes and BatchMode=yes.`,
+        );
+      }
+    }
+  }
+}

package/plugins/kxm/src/sqlite.ts

@@ -0,0 +1,76 @@
+/** Runtime-portable SQLite constructor.
+ *
+ * Prefers Node's built-in `node:sqlite` (the supported runtime for the kxm
+ * CLI). Pi loads extensions inside its embedded Bun runtime, which does not
+ * provide `node:sqlite`, so fall back to Bun's `bun:sqlite` there.
+ *
+ * The two runtimes differ in one option this codebase uses: Node spells the
+ * flag `readOnly`, Bun spells it `readonly`. Options are normalized here so
+ * callers keep using the Node spelling everywhere.
+ */
+import { createRequire } from "node:module";
+
+export interface DatabaseSyncOptions {
+  readOnly?: boolean;
+  [key: string]: unknown;
+}
+
+export interface StatementSync {
+  run(...params: unknown[]): { changes: number | bigint; lastInsertRowid: number | bigint };
+  get(...params: unknown[]): Record<string, unknown> | undefined;
+  all(...params: unknown[]): Array<Record<string, unknown>>;
+}
+
+type NativeDatabase = {
+  prepare(sql: string): StatementSync;
+  exec(sql: string): unknown;
+  close(): void;
+};
+
+const requireFromHere = createRequire(import.meta.url);
+
+function loadNative(): { Ctor: new (path: string, options?: object) => NativeDatabase; bun: boolean } {
+  try {
+    const mod = requireFromHere("node:sqlite") as { DatabaseSync?: new (path: string, options?: object) => NativeDatabase };
+    if (mod.DatabaseSync) return { Ctor: mod.DatabaseSync, bun: false };
+  } catch {
+    // Not a Node runtime exposing node:sqlite (e.g. pi's embedded Bun).
+  }
+  try {
+    const mod = requireFromHere("bun:sqlite") as
+      | { DatabaseSync?: new (path: string, options?: object) => NativeDatabase; Database?: new (path: string, options?: object) => NativeDatabase }
+      | undefined;
+    const Ctor = mod?.DatabaseSync ?? mod?.Database;
+    if (Ctor) return { Ctor, bun: true };
+  } catch {
+    // No bun:sqlite either.
+  }
+  throw new Error("kxm: no supported sqlite module found (need node:sqlite or bun:sqlite)");
+}
+
+const native = loadNative();
+
+export class DatabaseSync {
+  private readonly inner: NativeDatabase;
+
+  constructor(path: string, options?: DatabaseSyncOptions) {
+    let normalized: object | undefined = options;
+    if (native.bun && options) {
+      const { readOnly, ...rest } = options;
+      normalized = readOnly === undefined ? rest : { ...rest, readonly: readOnly };
+    }
+    this.inner = normalized === undefined ? new native.Ctor(path) : new native.Ctor(path, normalized);
+  }
+
+  prepare(sql: string): StatementSync {
+    return this.inner.prepare(sql);
+  }
+
+  exec(sql: string): unknown {
+    return this.inner.exec(sql);
+  }
+
+  close(): void {
+    this.inner.close();
+  }
+}

package/plugins/kxm/src/store.ts

@@ -1,5 +1,5 @@
 import { resolve } from "node:path";
-import type { DatabaseSync } from "node:sqlite";
+import type { DatabaseSync } from "./sqlite.ts";
 import type { AgentRecord, MessageRecord } from "./protocol.ts";
 import type { ContextItem } from "./context.ts";
 import type { WorkflowJournalEntry, WorkflowRun } from "./workflow.ts";

package/plugins/kxm/src/vnext-bindings.ts

@@ -15,7 +15,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { DatabaseSync } from "node:sqlite";
+import { DatabaseSync } from "./sqlite.ts";
 import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import {
   VnextConfigError,

package/plugins/kxm/src/vnext-config.ts

@@ -1033,6 +1033,7 @@ function validateBundle(
   environments: readonly VnextResource[],
   options: VnextConfigOptions,
   gateRegistry?: VnextResource,
+  projectRoot?: string,
 ): VnextConfigIssue[] {
   const issues: VnextConfigIssue[] = [];
   const entries = valuesOf(project.value, "repositories").map((candidate) => objectValue(candidate)).filter((candidate): candidate is JsonObject => Boolean(candidate));
@@ -1105,6 +1106,42 @@ function validateBundle(
   const defaultWorkflow = stringValue(project.value.defaultWorkflow) ?? "default";
   if (!workflows.has(defaultWorkflow)) issues.push(issue("reference", "default_workflow_unknown", project.logicalPath, `default workflow ${defaultWorkflow} does not exist`));
   for (const workflow of workflows.values()) validateWorkflow(workflow, agents, models, repositoryIds, gates, issues);
+
+  if (projectRoot) {
+    const writerRolePath = join(projectRoot, ".kxm", "roles", "writer.yaml");
+    const implementerAgent = agents.get("implementer") ?? agents.get("writer");
+    if (existsSync(writerRolePath) && implementerAgent) {
+      try {
+        const rawRole = parseRestrictedYaml(readFileSync(writerRolePath, "utf8"));
+        const roleObj = objectValue(rawRole);
+        const rosterEntries = valuesOf(roleObj ?? {}, "roster")
+          .map((candidate) => objectValue(candidate))
+          .filter((entry): entry is JsonObject => Boolean(entry));
+        const enabledRosterModels = rosterEntries
+          .filter((entry) => entry.enabled !== false)
+          .map((entry) => stringValue(entry.model))
+          .filter((m): m is string => Boolean(m));
+
+        const agentModelObj = objectValue(implementerAgent.value.model);
+        const agentModelStr = stringValue(implementerAgent.value.model);
+        const agentProvider = agentModelObj ? stringValue(agentModelObj.provider) : undefined;
+        const agentModel = agentModelObj ? stringValue(agentModelObj.model) : agentModelStr;
+        const canonicalAgentModel = agentProvider && agentModel ? `${agentProvider}/${agentModel}` : agentModel;
+
+        if (enabledRosterModels.length > 0 && canonicalAgentModel) {
+          const matches = enabledRosterModels.some((rm) => rm === canonicalAgentModel || rm === agentModel || rm.endsWith(`/${agentModel}`));
+          if (!matches) {
+            issues.push(issue("semantic", "role_roster_conflicts_with_agent", ".kxm/roles/writer.yaml", `role roster in .kxm/roles/writer.yaml does not include agent model ${canonicalAgentModel} from ${implementerAgent.logicalPath}`));
+          }
+        }
+      } catch (error) {
+        if (error instanceof VnextConfigError) {
+          issues.push(...error.issues);
+        }
+      }
+    }
+  }
+
   return sortIssues(issues);
 }
 
@@ -1306,7 +1343,7 @@ export function loadVnextProject(projectRoot: string, options: VnextConfigOption
   }
   if (loadIssues.length > 0) throw new VnextConfigError(loadIssues);
 
-  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry);
+  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root);
   if (issues.length > 0) throw new VnextConfigError(issues);
   const resources = [project, ...repositories.values(), ...agents.values(), ...models.values(), ...workflows.values(), ...environments, ...(gateRegistry ? [gateRegistry] : [])]
     .sort((left, right) => compareCodeUnits(left.logicalPath, right.logicalPath));

package/plugins/kxm/src/vnext-engine-command.ts

@@ -3,6 +3,7 @@ import { createHash } from "node:crypto";
 import type { VnextGateObservationInput } from "./vnext-engine-gate-records.ts";
 import type { VnextGateErrorClass, VnextGateStopCause } from "./vnext-runtime-store.ts";
 import { runtimeError } from "./vnext-runtime-store.ts";
+import { assertCommandSeatbelt } from "./safety-integrity.ts";
 
 const MAX_DIRECT_TIMER_MS = 2_147_483_647;
 export const COMMAND_TERM_GRACE_MS = 2000;
@@ -176,6 +177,7 @@ class CommandObserver implements VnextCommandObserver {
     ) {
       throw runtimeError("run_events_illegal", "command", "command timeoutMs exceeds the direct timer bound");
     }
+    assertCommandSeatbelt(this.definition.argv.join(" "));
     this.startedAt = new Date().toISOString();
     let child: ChildProcess;
     try {

package/plugins/kxm/src/vnext-engine.ts

@@ -94,6 +94,21 @@ import {
   parseRoutingRecordV2,
   behavioralConfigHash,
 } from "./routing.ts";
+import {
+  assertCommandSeatbelt,
+  DESTRUCTIVE_COMMAND_PATTERNS,
+  isRtkBypassRequired,
+  assertPinnedSshHostKeyPolicy,
+  type RtkBypassContext,
+} from "./safety-integrity.ts";
+
+export {
+  assertCommandSeatbelt,
+  DESTRUCTIVE_COMMAND_PATTERNS,
+  isRtkBypassRequired,
+  assertPinnedSshHostKeyPolicy,
+  type RtkBypassContext,
+};
 
 const trustedProducers = new WeakSet<object>();
 const CAPABILITY_PREFIX = "kxm-attempt-capability\0";
@@ -557,6 +572,7 @@ async function runPreparedCommandGate(
   definition: { readonly kind: "command"; readonly argv: readonly string[]; readonly timeoutMs: number; readonly cwd?: "control" },
   token: string,
 ): Promise<VnextRunDriveResult> {
+  assertCommandSeatbelt(definition.argv.join(" "));
   const storePath = context.eventStore.path;
   const observer = createCommandObserver({
     definition,

package/plugins/kxm/src/vnext-harness.ts

@@ -414,6 +414,8 @@ const READ_ONLY_ONESHOT_ARGS = Object.freeze({
   claude: Object.freeze(["--tools", "Read,Glob,Grep", "--restricted", "--safe-mode", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}', "--disable-slash-commands", "--no-session-persistence"]),
   codex: Object.freeze(["--sandbox", "read-only", "--ignore-user-config", "-c", 'approval_policy="never"']),
   grok: Object.freeze(["--sandbox", "read-only", "--permission-mode", "plan", "--tools", "Read,Glob,Grep", "--no-subagents", "--disable-web-search"]),
+  agy: Object.freeze(["--mode", "plan", "--sandbox", "--disable-slash-commands"]),
+  kimi: Object.freeze(["--plan"]),
 });
 
 export function oneShotReadOnlyArgs(harness: string): readonly string[] | undefined {
@@ -469,7 +471,7 @@ export const BUILTIN_HARNESSES: readonly HarnessCatalogEntry[] = Object.freeze([
     authArgs: ["provider", "list"],
     update: { self: ["upgrade"] },
     oneShot: {
-      argv: ["--output-format", "stream-json", "-p"],
+      argv: [...oneShotReadOnlyArgs("kimi")!, "--output-format", "stream-json", "-p"],
       promptVia: "arg",
       outputFormat: "stream-json",
       usageParser: parseKimiOneShotUsage,
@@ -532,7 +534,7 @@ export const BUILTIN_HARNESSES: readonly HarnessCatalogEntry[] = Object.freeze([
     authArgs: ["models"],
     update: { self: ["update"] },
     oneShot: {
-      argv: ["--output-format", "json", "-p"],
+      argv: [...oneShotReadOnlyArgs("agy")!, "--output-format", "json", "-p"],
       promptVia: "arg",
       outputFormat: "json",
       usageParser: parseAgyOneShotUsage,

package/plugins/kxm/src/vnext-oneshot-process.ts

@@ -26,6 +26,26 @@ const KILL_GRACE_MS = 250;
 const DRAIN_GRACE_MS = 500;
 const REAP_GRACE_MS = 1000;
 
+/**
+ * POSIX process-group tree kill with fallback to direct child kill.
+ * Ensures orphaned subshells, test workers, and background daemons are pruned on cancellation/timeout.
+ */
+export function killProcessTree(child: ReturnType<typeof spawn>, signal: NodeJS.Signals = "SIGKILL"): void {
+  if (process.platform !== "win32" && child.pid) {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch {
+      // Fall through to direct child kill if process group is unavailable
+    }
+  }
+  try {
+    child.kill(signal);
+  } catch {
+    // Direct kill error if child already exited
+  }
+}
+
 /** Bound both execution and pipe drain. Observing exit is not proof of descendant death. */
 export function defaultSpawn(command: string, args: readonly string[], options: VnextOneShotSpawnOptions): Promise<VnextOneShotProcessResult> {
   if (options.signal?.aborted) {
@@ -63,10 +83,7 @@ export function defaultSpawn(command: string, args: readonly string[], options:
       resolve({ stdout: Buffer.concat(stdout).toString("utf8"), stderr: Buffer.concat(stderr).toString("utf8"), code, signal, started, observedChildExit, terminationRequested: stopping, ...(error ? { error } : {}) });
     };
     const kill = (requested: NodeJS.Signals): void => {
-      try {
-        if (process.platform !== "win32" && child.pid) process.kill(-child.pid, requested);
-        else child.kill(requested);
-      } catch { /* Reaping, not kill() success, establishes direct-child exit. */ }
+      killProcessTree(child, requested);
     };
     const stop = (reason: string): void => {
       if (finished) return;