@mutmutco/kilo-plugin 4.2.4 → 4.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/kilo-plugin",
-  "version": "4.2.4",
+  "version": "4.2.5",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/scripts/command-ladder-core.mjs

@@ -322,7 +322,12 @@ export function analyzeGhLadder(command) {
         replacement: hit.replacement,
         mapped,
         reason:
-          `Command ladder (#2347): use \`${hit.replacement}\` instead of raw \`gh ${hit.object} ${hit.verb}\`. ` +
+          `Command ladder (#2347): use \`${hit.replacement}\` instead of raw \`gh ${hit.object} ${hit.verb}\` — ` +
+          // #5858: the deny aborts the ENTIRE tool call, and the remedy line below invites retrying only
+          // the corrected verb — the one retry that cannot work when a heredoc wrote the body file in the
+          // same call. It fails with ENOENT, which reads as a path bug, not as a discarded write. Same
+          // sentence, same position, as the test-policy guard (#5726).
+          'the ENTIRE command was aborted before execution; no segment ran, so any file write or other step batched into the same call was NOT applied — re-run those steps separately. ' +
           runLine +
           'mmi-cli is the required path for covered board/issue/PR writes in org repos. ' +
           'Genuine gaps stay allowed: gh api reads, gh project, gh issue/pr view|list|close|edit, gh pr checks, gh auth/repo/workflow/run. ' +

package/scripts/edit-tool-paths.mjs

@@ -8,8 +8,10 @@
 //
 // One extractor, used by every edit-shaped hook, so a new host contract is taught in one place.
 
-/** Tool names that mean "this call writes files". */
-export const EDIT_TOOL_NAMES = new Set(['Edit', 'Write', 'apply_patch', 'ApplyPatch']);
+/** Tool names that mean "this call writes files". `StrReplace` is Cursor's in-place edit tool: it
+ *  carries its target in `tool_input.path` and was outside this set, so even once the adapter matched
+ *  it the gate would have read a non-edit tool and allowed (#5852). */
+export const EDIT_TOOL_NAMES = new Set(['Edit', 'Write', 'apply_patch', 'ApplyPatch', 'StrReplace']);
 
 export function isEditTool(toolName) {
   return typeof toolName === 'string' && EDIT_TOOL_NAMES.has(toolName);

package/server.mjs

@@ -5,13 +5,14 @@
 // that translation lives in a thin per-host shell, not in the gates. server.mjs is that shell for Kilo:
 // every hook translates the Kilo camelCase hook input into the snake_case shape and replays it through
 // scripts/hook-run.mjs, the same named-policy launcher every active host uses. The launcher stamps
-// MMI_HOOK_SURFACE=kilo (which also engages the shared redactor's rewrite channel) and owns the
-// fail-closed fallback for crashed deny gates.
+// MMI_HOOK_SURFACE=kilo and owns the fail-closed fallback for crashed deny gates.
 //
 // Kilo's contract differences, all confirmed on a real host (see plans/2026-07-31-kilo-code-plugin-port.md):
 //   - blocking a tool = throwing from `tool.execute.before`
-//   - rewriting output = mutating `output.output` in `tool.execute.after`, and `output.text` in
-//     `experimental.text.complete` — a WORKING redactor, unlike Codex/Kimi
+//   - the host CAN rewrite output — `output.output` in `tool.execute.after`, `output.text` in
+//     `experimental.text.complete` — but this module registers NEITHER. The post-tool redaction gate
+//     was retired with #5079, so what ships is two PreToolUse gates and nothing else; the surface's
+//     declared `postToolOutput`/`finalOutput` are `unsupported` and that is the honest ceiling (#5851)
 //   - tool names are lowercase (`bash`, `write`, `edit`, `patch`, `glob`, `grep`, `read`) and the bash
 //     args carry `command`, the write args carry `filePath`
 //   - npm lifecycle scripts are disabled, so first-run provisioning lives here, is idempotent and