cmdr-mcp 0.4.0 → 0.6.0

package/plugins/cmdr/dist/dashboard/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>cmdr</title>
+    <link rel="stylesheet" href="/app.css" />
+    <script type="module" src="/app.js"></script>
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>

package/plugins/cmdr/dist/hook.mjs

@@ -85,10 +85,11 @@ function observedHook(event, agent) {
 import { existsSync } from "node:fs";
 
 // src/shared/env.ts
-var cmdrTool = /(?:^|[_:])cmdr(?:__|:)(list|join|report|leave|ask|send|read)$/;
+var cmdrTool = /(?:^|[_:])cmdr(?:__|:)(list|join|report|leave|ask|send|read|task|artifact)$/;
 function detectAgent(env = process.env, hook) {
   if (env.CMDR_AGENT && /^[a-z][a-z0-9_-]{0,63}$/.test(env.CMDR_AGENT)) return env.CMDR_AGENT;
   if (env.ZCODE_PLUGIN_ROOT || env.ZCODE_PLUGIN_ID) return "zcode";
+  if (env.KIMI_PLUGIN_ROOT) return "kimi";
   if (env.CLAUDE_CODE_SESSION_ID || env.CLAUDE_CODE_ENTRYPOINT) return "claude";
   if (hook?.transcript_path && String(hook.transcript_path).includes("/.claude/")) return "claude";
   if (env.CODEX_HOME || env.CODEX_THREAD_ID || env.CODEX_SESSION_ID || hook?.turn_id)
@@ -254,7 +255,7 @@ var Rpc = class extends EventEmitter {
 };
 
 // src/shared/version.ts
-var VERSION = true ? "0.4.0" : MIN_CLIENT_VERSION;
+var VERSION = true ? "0.6.0" : MIN_CLIENT_VERSION;
 var PROTOCOL = 1;
 function newer(a, b) {
   const x = a.split(".").map(Number), y = b.split(".").map(Number);
@@ -391,6 +392,13 @@ async function runHook(input, event = input.hook_event_name) {
     return;
   }
   if (event === "PreToolUse" && cmdrTool.test(input.tool_name || "")) {
+    if (agent === "kimi") {
+      if ((input.tool_input || {})._cmdr_session === input.session_id) return;
+      return {
+        decision: "block",
+        reason: `[cmdr] Kimi Code shares one cmdr MCP process per workspace; retry this call with _cmdr_session="${input.session_id}".`
+      };
+    }
     if (agent !== "claude")
       return {
         hookSpecificOutput: {
@@ -424,8 +432,18 @@ try {
     input += chunk;
     if (input.length > 2 * 1024 * 1024) throw new Error("large input");
   }
-  const result = await runHook(JSON.parse(input), process.argv[2]);
-  if (result) process.stdout.write(JSON.stringify(result) + "\n");
+  const parsed = JSON.parse(input);
+  const agent = detectAgent(process.env, parsed);
+  const result = await runHook(parsed, process.argv[2]);
+  if (result) {
+    if (agent === "kimi") {
+      if (result.decision === "block")
+        process.stderr.write(`${result.reason}
+`, () => process.exit(2));
+      else if (process.argv[2] === "UserPromptSubmit" && result.hookSpecificOutput?.additionalContext)
+        process.stdout.write(result.hookSpecificOutput.additionalContext + "\n");
+    } else process.stdout.write(JSON.stringify(result) + "\n");
+  }
 } catch (e) {
   diagnostic(e.code === "DAEMON_UNAVAILABLE" ? "hook-unavailable" : "hook-error");
 }

package/plugins/cmdr/dist/integrity.json

@@ -1,29 +1,34 @@
 {
-  "version": "0.4.0",
+  "version": "0.6.0",
   "files": {
-    ".claude-plugin/plugin.json": "6d9ae2514ca252e356ebf46ab54b2a9aa3599ae3b3630f89aba16721e73be055",
-    ".codex-plugin/plugin.json": "7dc3738401bb0a78758a5ac906aebba1d74883c4d34a757ae84093b35bc8e7fa",
+    ".claude-plugin/plugin.json": "03daaf06535131d19dc7444907f1af1100a9deeb2b07553862805c33d49f878d",
+    ".codex-plugin/plugin.json": "36b3066ada5434eda049904b6a90ef867f093a3f861e6a61e9df7fddb5963156",
+    ".kimi-plugin/plugin.json": "7634842fb15abaf7a6ccc9d4500cd27447515e3d6c99de0a3249bf0f74631bc6",
     ".mcp.json": "34e310a2874c8fda625745672a54df19614f32dabd2be4013f8ce871260e88c4",
-    ".zcode-plugin/plugin.json": "c30588e54d76fee931aaf329637cf004cc4f19155a21a3061d9d1707bc039313",
-    "THIRD_PARTY_NOTICES.txt": "acad9112a321e2c4a630e422c3aa78eb7d40093548bf476d6bd0133ea45dd52d",
+    ".zcode-plugin/plugin.json": "6a5f67567958487a9a10db5bf879641de790c5734fafaeab7ce39a978ddab43a",
+    "THIRD_PARTY_NOTICES.txt": "061121858596143e1ec0609aeee0d45ec839e53f05a4b7c23a48ec7df33194fc",
     "bin/cmdr": "be6ea6b84ce121738ca729e9c6dbfb87bbf349a84d251acc711e3ea11f8dd8fd",
-    "bin/cmdr-check.mjs": "6192d158606b253637635416e706f8ba782b8e8d63c1613c76f5011c09a58a85",
+    "bin/cmdr-check.mjs": "669204363e26323af6abd623e9039c2c7e9ca9626ee9418e9ab9e2a85be7fc67",
     "bin/cmdr-daemon": "7f8ed3a755f975751ddda077242adf661834dddbb8be7d3a88caee0c70cce5db",
     "bin/cmdr-hook": "e1fa5950325775e467e4e01aeff3c5cb8c1dba35c4535d7cb569f658f95e7f15",
     "bin/cmdr-mcp": "356bea13c2b82075c09fd663106791edab9e06fdb04fc679a98de33514b10a83",
-    "bin/cmdr-node": "ce5952648b9a7deccdd855808331d51ff8569675100278379ef1fc84cd3d528e",
-    "commands/cmdr.md": "e13c9b8d6ec9518c277b83ae0794009bdb354d21e6e7ce42e9ada1bdfeb8de85",
-    "dist/cli.mjs": "b7498f59eedcfb1bf312cd8bcddddbd6d24c0278f1bc0617c1d6192da4f703dc",
-    "dist/daemon.mjs": "d67b67d5cc27ce7e445cd5a05abed82842f502be646aaa971124e82f399ea5d1",
-    "dist/hook.mjs": "fabbfd17629992d9f31575921c61668aebfe79a94e9b4bc5aeed1fe92d849053",
-    "dist/mcp.mjs": "a23acd329ad5f10c55a4edfc378294e27b480d2b7401215d6e1bd6ca2f5e4dd3",
+    "bin/cmdr-node": "d4005e39ec1edc05a45413f38172a239a234cc457fd17a320db5e24bdbc2e6c8",
+    "commands/cmdr.md": "c46d1d3d38af10ac75f8793b998e0889a9136da82b883816a724502689184e49",
+    "dist/cli.mjs": "99ffbb22e10223c012100896ed7fe571fe0e1095c34003f54fdc9b389987cd22",
+    "dist/daemon.mjs": "21335e66c4eb808e8f9e8d6c6de0daf3a3e733616eb4c89547c7621a9e51c690",
+    "dist/dashboard/app.css": "58d74d9a98c39bef501a53f2530a99906d2fbb8ef5a619ff7a8ee432005d65d3",
+    "dist/dashboard/app.js": "c3549fce634931de741df6883e63e246969eedfedd8af4e81e7afe0687a10d1e",
+    "dist/dashboard/index.html": "670b1a05ca906b352ed5d8f53d2adc1a9ad5bb937e758a09ae200752f4e25356",
+    "dist/hook.mjs": "ce32d8fda6272f9cbfe0fb8bde9d68ce55a10c3ceacb6f3166787115df96e793",
+    "dist/mcp.mjs": "55950f4e6be2600881e8ca9c89e316b41a2039c98278199b8c846900869e41ba",
     "hooks/hooks.json": "6ff937910fc04eb81db4a84dfeb91a92ab971364d684a45a85f3a9953eb21259",
-    "skills/cmdr/SKILL.md": "afb3a67d00f0e7253448395d88d3743121cfb75f4316674456d7efdb11555164",
-    "skills/cmdr/references/commander.md": "69ba658f21ac07a7d254e11d6a66ef06e3d56e1e17b6eb49f349257ccf0026e2",
-    "skills/cmdr/references/executor.md": "361db0b48b2151eab56d7cb1d501ff547a03ba379081f36345cfd27741da0225",
-    "skills/cmdr/references/setup.md": "2ba2db967820ee2ded81730a5ff02bf7306dd8d6c1480818bc8223210392be97",
-    "skills/cmdr-commander/SKILL.md": "e29e3e49392f603e87e61d8d54a93a07ed8e643bea7016e1e69809d58733a77d",
-    "skills/cmdr-executor/SKILL.md": "acaf559c9d49bb86d6bb6c4bc5f5100859f62babbde5ce4ec0f9d2b06fa3c176",
-    "skills/using-cmdr/SKILL.md": "fb52c602a81e2f8582cb91fabb7a362345ede2ea4f4cb10894023dc375bfcf1e"
+    "kimi-identity/SKILL.md": "967454ed3a9c1ddeeb87c5f419ce6303399caec1563192777c564445e6e6d59f",
+    "skills/cmdr/SKILL.md": "f95875b0b54877547a16158403dbdf7162c9a10d417dc956907acd81fd174305",
+    "skills/cmdr/references/commander.md": "48728f778a53cd2ae9d38cafcfa5f6c00f9b92a29acad452eecba1c07d04985d",
+    "skills/cmdr/references/executor.md": "c7527c2a15cb593407b9547dd431bc499d6eaa7216e8fae5c14402c6c748b9ad",
+    "skills/cmdr/references/setup.md": "8049617af8d441a586e498a8c6fb6bd84836b5d8ffd7199c4cec2b589fdcf4ad",
+    "skills/cmdr-commander/SKILL.md": "2b39799de58cef778d2009acede67701e2ec3fef5e0e617480a79d048fc0a692",
+    "skills/cmdr-executor/SKILL.md": "dad00e3f9116b19d0009bbeb9f2527e0ffcbce20c7b70ab5208656e091bfbd14",
+    "skills/using-cmdr/SKILL.md": "921ac245e5884cf4e5bf9a07520b186ebdf47c0cfc93e6e171c4072d163e03fd"
   }
 }

package/plugins/cmdr/dist/mcp.mjs

@@ -2232,10 +2232,10 @@ var require_resolve = __commonJS({
       }
       return count;
     }
-    function getFullPath(resolver, id = "", normalize) {
+    function getFullPath(resolver, id2 = "", normalize) {
       if (normalize !== false)
-        id = normalizeId(id);
-      const p = resolver.parse(id);
+        id2 = normalizeId(id2);
+      const p = resolver.parse(id2);
       return _getFullPath(resolver, p);
     }
     exports.getFullPath = getFullPath;
@@ -2245,13 +2245,13 @@ var require_resolve = __commonJS({
     }
     exports._getFullPath = _getFullPath;
     var TRAILING_SLASH_HASH = /#\/?$/;
-    function normalizeId(id) {
-      return id ? id.replace(TRAILING_SLASH_HASH, "") : "";
+    function normalizeId(id2) {
+      return id2 ? id2.replace(TRAILING_SLASH_HASH, "") : "";
     }
     exports.normalizeId = normalizeId;
-    function resolveUrl(resolver, baseId, id) {
-      id = normalizeId(id);
-      return resolver.resolve(baseId, id);
+    function resolveUrl(resolver, baseId, id2) {
+      id2 = normalizeId(id2);
+      return resolver.resolve(baseId, id2);
     }
     exports.resolveUrl = resolveUrl;
     var ANCHOR = /^[a-z_][-a-z0-9._]*$/i;
@@ -3021,8 +3021,8 @@ var require_compile = __commonJS({
       if (Object.keys(root.schema).length > 0 && refPath === baseId) {
         return getJsonPointer.call(this, p, root);
       }
-      const id = (0, resolve_1.normalizeId)(refPath);
-      const schOrRef = this.refs[id] || this.schemas[id];
+      const id2 = (0, resolve_1.normalizeId)(refPath);
+      const schOrRef = this.refs[id2] || this.schemas[id2];
       if (typeof schOrRef == "string") {
         const sch = resolveSchema.call(this, root, schOrRef);
         if (typeof (sch === null || sch === void 0 ? void 0 : sch.schema) !== "object")
@@ -3033,7 +3033,7 @@ var require_compile = __commonJS({
         return;
       if (!schOrRef.validate)
         compileSchema.call(this, schOrRef);
-      if (id === (0, resolve_1.normalizeId)(ref)) {
+      if (id2 === (0, resolve_1.normalizeId)(ref)) {
         const { schema } = schOrRef;
         const { schemaId } = this.opts;
         const schId = schema[schemaId];
@@ -4459,15 +4459,15 @@ var require_core = __commonJS({
             this.addSchema(sch, void 0, _meta, _validateSchema);
           return this;
         }
-        let id;
+        let id2;
         if (typeof schema === "object") {
           const { schemaId } = this.opts;
-          id = schema[schemaId];
-          if (id !== void 0 && typeof id != "string") {
+          id2 = schema[schemaId];
+          if (id2 !== void 0 && typeof id2 != "string") {
             throw new Error(`schema ${schemaId} must be string`);
           }
         }
-        key = (0, resolve_1.normalizeId)(key || id);
+        key = (0, resolve_1.normalizeId)(key || id2);
         this._checkUnique(key);
         this.schemas[key] = this._addSchema(schema, _meta, key, _validateSchema, true);
         return this;
@@ -4546,11 +4546,11 @@ var require_core = __commonJS({
           case "object": {
             const cacheKey = schemaKeyRef;
             this._cache.delete(cacheKey);
-            let id = schemaKeyRef[this.opts.schemaId];
-            if (id) {
-              id = (0, resolve_1.normalizeId)(id);
-              delete this.schemas[id];
-              delete this.refs[id];
+            let id2 = schemaKeyRef[this.opts.schemaId];
+            if (id2) {
+              id2 = (0, resolve_1.normalizeId)(id2);
+              delete this.schemas[id2];
+              delete this.refs[id2];
             }
             return this;
           }
@@ -4621,7 +4621,7 @@ var require_core = __commonJS({
       errorsText(errors = this.errors, { separator = ", ", dataVar = "data" } = {}) {
         if (!errors || errors.length === 0)
           return "No errors";
-        return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text2, msg) => text2 + separator + msg);
+        return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text3, msg) => text3 + separator + msg);
       }
       $dataMetaSchema(metaSchema, keywordsJsonPointers) {
         const rules = this.RULES.all;
@@ -4657,10 +4657,10 @@ var require_core = __commonJS({
         }
       }
       _addSchema(schema, meta, baseId, validateSchema = this.opts.validateSchema, addSchema = this.opts.addUsedSchema) {
-        let id;
+        let id2;
         const { schemaId } = this.opts;
         if (typeof schema == "object") {
-          id = schema[schemaId];
+          id2 = schema[schemaId];
         } else {
           if (this.opts.jtd)
             throw new Error("schema must be object");
@@ -4670,7 +4670,7 @@ var require_core = __commonJS({
         let sch = this._cache.get(schema);
         if (sch !== void 0)
           return sch;
-        baseId = (0, resolve_1.normalizeId)(id || baseId);
+        baseId = (0, resolve_1.normalizeId)(id2 || baseId);
         const localRefs = resolve_1.getSchemaRefs.call(this, schema, baseId);
         sch = new compile_1.SchemaEnv({ schema, schemaId, meta, baseId, localRefs });
         this._cache.set(sch.schema, sch);
@@ -4683,9 +4683,9 @@ var require_core = __commonJS({
           this.validateSchema(schema, true);
         return sch;
       }
-      _checkUnique(id) {
-        if (this.schemas[id] || this.refs[id]) {
-          throw new Error(`schema with key or id "${id}" already exists`);
+      _checkUnique(id2) {
+        if (this.schemas[id2] || this.refs[id2]) {
+          throw new Error(`schema with key or id "${id2}" already exists`);
         }
       }
       _compileSchemaEnv(sch) {
@@ -7217,7 +7217,9 @@ var methods = {
   report: "msg.report",
   ask: "msg.ask",
   read: "msg.read",
-  leave: "session.leave"
+  leave: "session.leave",
+  task: "dashboard.task",
+  artifact: "dashboard.artifact"
 };
 
 // node_modules/zod/v3/external.js
@@ -13031,38 +13033,38 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     doc.write(`const newResult = {}`);
     for (const key of normalized.keys) {
       if (normalized.optionalKeys.has(key)) {
-        const id = ids[key];
-        doc.write(`const ${id} = ${parseStr(key)};`);
+        const id2 = ids[key];
+        doc.write(`const ${id2} = ${parseStr(key)};`);
         const k = esc(key);
         doc.write(`
-        if (${id}.issues.length) {
+        if (${id2}.issues.length) {
           if (input[${k}] === undefined) {
             if (${k} in input) {
               newResult[${k}] = undefined;
             }
           } else {
             payload.issues = payload.issues.concat(
-              ${id}.issues.map((iss) => ({
+              ${id2}.issues.map((iss) => ({
                 ...iss,
                 path: iss.path ? [${k}, ...iss.path] : [${k}],
               }))
             );
           }
-        } else if (${id}.value === undefined) {
+        } else if (${id2}.value === undefined) {
           if (${k} in input) newResult[${k}] = undefined;
         } else {
-          newResult[${k}] = ${id}.value;
+          newResult[${k}] = ${id2}.value;
         }
         `);
       } else {
-        const id = ids[key];
-        doc.write(`const ${id} = ${parseStr(key)};`);
+        const id2 = ids[key];
+        doc.write(`const ${id2} = ${parseStr(key)};`);
         doc.write(`
-          if (${id}.issues.length) payload.issues = payload.issues.concat(${id}.issues.map(iss => ({
+          if (${id2}.issues.length) payload.issues = payload.issues.concat(${id2}.issues.map(iss => ({
             ...iss,
             path: iss.path ? [${esc(key)}, ...iss.path] : [${esc(key)}]
           })));`);
-        doc.write(`newResult[${esc(key)}] = ${id}.value`);
+        doc.write(`newResult[${esc(key)}] = ${id2}.value`);
       }
     }
     doc.write(`payload.value = newResult;`);
@@ -14795,13 +14797,13 @@ var JSONSchemaGenerator = class {
       const defsSegment = this.target === "draft-2020-12" ? "$defs" : "definitions";
       if (params.external) {
         const externalId = params.external.registry.get(entry[0])?.id;
-        const uriGenerator = params.external.uri ?? ((id2) => id2);
+        const uriGenerator = params.external.uri ?? ((id3) => id3);
         if (externalId) {
           return { ref: uriGenerator(externalId) };
         }
-        const id = entry[1].defId ?? entry[1].schema.id ?? `schema${this.counter++}`;
-        entry[1].defId = id;
-        return { defId: id, ref: `${uriGenerator("__shared")}#/${defsSegment}/${id}` };
+        const id2 = entry[1].defId ?? entry[1].schema.id ?? `schema${this.counter++}`;
+        entry[1].defId = id2;
+        return { defId: id2, ref: `${uriGenerator("__shared")}#/${defsSegment}/${id2}` };
       }
       if (entry[1] === root) {
         return { ref: "#" };
@@ -14849,8 +14851,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
           continue;
         }
       }
-      const id = this.metadataRegistry.get(entry[0])?.id;
-      if (id) {
+      const id2 = this.metadataRegistry.get(entry[0])?.id;
+      if (id2) {
         extractToDef(entry);
         continue;
       }
@@ -14904,10 +14906,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       console.warn(`Invalid target: ${this.target}`);
     }
     if (params.external?.uri) {
-      const id = params.external.registry.get(schema)?.id;
-      if (!id)
+      const id2 = params.external.registry.get(schema)?.id;
+      if (!id2)
         throw new Error("Schema is missing an `id` property");
-      result.$id = params.external.uri(id);
+      result.$id = params.external.uri(id2);
     }
     Object.assign(result, root.def);
     const defs = params.external?.defs ?? {};
@@ -19940,7 +19942,7 @@ var ExperimentalServerTasks = class {
       if (hasPreviousToolUse) {
         const toolUseIds = new Set(previousContent.filter((c) => c.type === "tool_use").map((c) => c.id));
         const toolResultIds = new Set(lastContent.filter((c) => c.type === "tool_result").map((c) => c.toolUseId));
-        if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id) => toolResultIds.has(id))) {
+        if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id2) => toolResultIds.has(id2))) {
           throw new Error("ids of tool_result blocks and tool_use blocks from previous message do not match");
         }
       }
@@ -20365,7 +20367,7 @@ var Server = class extends Protocol {
       if (hasPreviousToolUse) {
         const toolUseIds = new Set(previousContent.filter((c) => c.type === "tool_use").map((c) => c.id));
         const toolResultIds = new Set(lastContent.filter((c) => c.type === "tool_result").map((c) => c.toolUseId));
-        if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id) => toolResultIds.has(id))) {
+        if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id2) => toolResultIds.has(id2))) {
           throw new Error("ids of tool_result blocks and tool_use blocks from previous message do not match");
         }
       }
@@ -21457,8 +21459,70 @@ var StdioServerTransport = class {
   }
 };
 
+// src/shared/dashboard.ts
+var DASHBOARD_LIMITS = {
+  recordsPerKind: 200,
+  runsPerTask: 100,
+  htmlBytes: 256 * 1024,
+  htmlBytesPerSquad: 8 * 1024 * 1024
+};
+
+// src/shared/dashboard-schemas.ts
+var id = external_exports.string().min(1).max(128);
+var text = external_exports.string().max(8e3);
+var artifacts = external_exports.array(id).max(8);
+var taskFields = {
+  action: external_exports.enum(["create", "update", "get", "list", "archive", "restore"]).default("list"),
+  id: id.optional(),
+  title: external_exports.string().trim().min(1).max(200).optional(),
+  description: text.optional(),
+  acceptance: text.optional(),
+  position: external_exports.number().finite().optional(),
+  artifact_ids: artifacts.optional(),
+  archived: external_exports.boolean().optional(),
+  offset: external_exports.number().int().min(0).default(0),
+  limit: external_exports.number().int().min(1).max(50).default(20)
+};
+var questionFields = {
+  target: external_exports.enum(["commander", "user"]).default("commander"),
+  action: external_exports.enum(["create", "update", "get", "list", "withdraw", "handle"]).default("create"),
+  id: id.optional(),
+  task_id: id.optional(),
+  version: external_exports.number().int().positive().optional(),
+  description: text.optional(),
+  kind: external_exports.enum(["single", "multiple", "text", "confirm"]).optional(),
+  options: external_exports.array(external_exports.object({ id, label: external_exports.string().trim().min(1).max(300) }).strict()).max(20).optional(),
+  artifact_ids: artifacts.optional(),
+  result: text.optional(),
+  status: external_exports.enum(["pending", "answered", "handled", "withdrawn"]).optional(),
+  offset: external_exports.number().int().min(0).default(0),
+  limit: external_exports.number().int().min(1).max(50).default(20)
+};
+var artifactFields = {
+  action: external_exports.enum(["publish", "get", "list"]).default("publish"),
+  id: id.optional(),
+  version: external_exports.number().int().positive().optional(),
+  title: external_exports.string().trim().min(1).max(200).optional(),
+  html: external_exports.string().min(1).refine((s) => Buffer.byteLength(s) <= DASHBOARD_LIMITS.htmlBytes, "MESSAGE_TOO_LARGE").optional(),
+  offset: external_exports.number().int().min(0).default(0),
+  limit: external_exports.number().int().min(1).max(50).default(20)
+};
+var answerSchema = external_exports.object({
+  question_id: id,
+  version: external_exports.number().int().positive(),
+  submission_id: external_exports.string().uuid(),
+  selected: external_exports.array(id).max(20).default([]),
+  text: text.default(""),
+  confirmed: external_exports.boolean().optional()
+}).strict();
+var userMessageSchema = external_exports.object({
+  squad_id: id,
+  submission_id: external_exports.string().uuid(),
+  text: external_exports.string().trim().min(1).max(8e3)
+}).strict();
+
 // src/shared/schemas.ts
-var text = external_exports.string().min(1).refine((v) => Buffer.byteLength(v) <= LIMITS.maxBody, "MESSAGE_TOO_LARGE");
+var text2 = external_exports.string().min(1).refine((v) => Buffer.byteLength(v) <= LIMITS.maxBody, "MESSAGE_TOO_LARGE");
 var data = external_exports.record(external_exports.unknown()).refine((v) => Buffer.byteLength(JSON.stringify(v)) <= LIMITS.maxData, "MESSAGE_TOO_LARGE").optional();
 var wait = external_exports.number().min(0).max(300).default(0);
 var identity = { _cmdr_session: external_exports.string().min(1).max(256).optional() };
@@ -21468,7 +21532,7 @@ var schemas = {
     role: external_exports.enum(["commander", "executor"]).optional(),
     squad: external_exports.string().optional(),
     name: external_exports.string().trim().min(1).max(64).optional(),
-    note: text.optional(),
+    note: text2.optional(),
     squad_name: external_exports.string().trim().min(1).max(64).optional(),
     takeover: external_exports.boolean().default(false),
     standby: external_exports.enum(["auto", "manual"]).optional(),
@@ -21483,17 +21547,27 @@ var schemas = {
   report: external_exports.object({
     ...identity,
     status: external_exports.enum(["ready", "working", "blocked", "done", "failed", "cancelled"]),
-    message: text,
+    message: text2,
     reply_to: external_exports.string().optional(),
     data
   }).strict(),
-  ask: external_exports.object({ ...identity, question: text, wait, reply_to: external_exports.string().optional(), data }).strict(),
+  ask: external_exports.object({
+    ...identity,
+    ...questionFields,
+    question: text2.optional(),
+    wait,
+    reply_to: external_exports.string().optional(),
+    data
+  }).strict(),
+  task: external_exports.object({ ...identity, ...taskFields }).strict(),
+  artifact: external_exports.object({ ...identity, ...artifactFields }).strict(),
   send: external_exports.object({
     ...identity,
     to: external_exports.union([external_exports.string().min(1), external_exports.array(external_exports.string().min(1)).min(1).max(1e3)]),
-    message: text,
+    message: text2,
     type: external_exports.enum(["command", "cancel", "answer", "info"]).default("command"),
     task_key: external_exports.string().min(1).max(128).optional(),
+    task_id: external_exports.string().min(1).max(128).optional(),
     reassign: external_exports.string().optional(),
     attention: external_exports.boolean().optional(),
     priority: external_exports.enum(["high", "normal", "low"]).optional(),
@@ -21511,11 +21585,11 @@ var schemas = {
     recover: external_exports.boolean().default(false),
     full: external_exports.boolean().default(false)
   }).strict(),
-  leave: external_exports.object({ ...identity, dissolve: external_exports.boolean().default(false), message: text.optional() }).strict()
+  leave: external_exports.object({ ...identity, dissolve: external_exports.boolean().default(false), message: text2.optional() }).strict()
 };
 
 // src/shared/version.ts
-var VERSION = true ? "0.4.0" : MIN_CLIENT_VERSION;
+var VERSION = true ? "0.6.0" : MIN_CLIENT_VERSION;
 var PROTOCOL = 1;
 function newer(a, b) {
   const x = a.split(".").map(Number), y = b.split(".").map(Number);
@@ -21529,6 +21603,7 @@ function newer(a, b) {
 function detectAgent(env = process.env, hook) {
   if (env.CMDR_AGENT && /^[a-z][a-z0-9_-]{0,63}$/.test(env.CMDR_AGENT)) return env.CMDR_AGENT;
   if (env.ZCODE_PLUGIN_ROOT || env.ZCODE_PLUGIN_ID) return "zcode";
+  if (env.KIMI_PLUGIN_ROOT) return "kimi";
   if (env.CLAUDE_CODE_SESSION_ID || env.CLAUDE_CODE_ENTRYPOINT) return "claude";
   if (hook?.transcript_path && String(hook.transcript_path).includes("/.claude/")) return "claude";
   if (env.CODEX_HOME || env.CODEX_THREAD_ID || env.CODEX_SESSION_ID || hook?.turn_id)
@@ -21736,26 +21811,26 @@ var Rpc = class extends EventEmitter {
     if (this.socket.destroyed) return Promise.reject(new CmdrError("DAEMON_UNAVAILABLE"));
     if (signal?.aborted) return Promise.reject(new CmdrError("REQUEST_CANCELLED"));
     return new Promise((resolve2, reject) => {
-      const id = this.next++;
+      const id2 = this.next++;
       const cancel = (code) => {
-        const p = this.pending.get(id);
+        const p = this.pending.get(id2);
         if (!p) return;
-        this.pending.delete(id);
+        this.pending.delete(id2);
         clearTimeout(p.timer);
         p.cleanup();
-        this.notify("rpc.cancel", { id });
+        this.notify("rpc.cancel", { id: id2 });
         reject(new CmdrError(code));
       };
       const abort = () => cancel("REQUEST_CANCELLED");
       const timer = setTimeout(() => cancel("DAEMON_UNAVAILABLE"), timeout);
-      this.pending.set(id, {
+      this.pending.set(id2, {
         resolve: resolve2,
         reject,
         timer,
         cleanup: () => signal?.removeEventListener("abort", abort)
       });
       signal?.addEventListener("abort", abort, { once: true });
-      this.send({ jsonrpc: "2.0", id, method, params });
+      this.send({ jsonrpc: "2.0", id: id2, method, params });
     });
   }
   notify(method, params) {
@@ -22047,12 +22122,14 @@ function closeClients() {
 }
 var server = new McpServer({ name: "cmdr", version: VERSION });
 var descriptions = {
-  join: "Create/join a squad. For /cmdr <name>, pass squad_name for atomic find-or-create; role defaults to executor. Explicitly claim role=commander, use takeover=true for handover or rebind=member_id for a new endpoint. Otherwise specify role and optional squad ID/name. Use standby=auto; Claude/ZCode must run listener.arm.command with the indicated native host tool, and re-arm on termination. Codex is daemon driven. Inspect listener health before ending the turn. Executors report ready after joining. Reply with user_reply and follow listener health; bounded read(wait=me.recommended_wait) is the manual fallback.",
+  join: "Create/join a squad. For /cmdr <name>, pass squad_name for atomic find-or-create; role defaults to executor. Explicitly claim role=commander, use takeover=true for handover or rebind=member_id for a new endpoint. Otherwise specify role and optional squad ID/name. Use standby=auto; Claude/ZCode/Kimi must run listener.arm.command with the indicated native host tool, and re-arm on termination. Codex is daemon driven. Inspect listener health before ending the turn. Executors report ready after joining. Reply with user_reply and follow listener health; bounded read(wait=me.recommended_wait) is the manual fallback.",
   list: "Show task ownership, unacked_for, execution activity, connection presence and listener health. Offline never authorizes reassignment. Use full=true for expanded session metadata; listings never include command bodies. Read your own messages with read(id=...). scope=all lists squads and sessions.",
-  send: "Commander: dispatch clear tasks with acceptance criteria, or answer an ask using type=answer and reply_to. Use task_key to prevent duplicate tickets and reassign=<command id> for a gated handover preserving the original task_key. type=cancel with reply_to requests a safe stop. to accepts all, member_id, sid, unique sid prefix or member name.",
+  send: "Commander: dispatch clear tasks with acceptance criteria, optionally linked to task_id from the dashboard task tool, or answer an executor ask using type=answer and reply_to. Use task_key to prevent duplicate tickets and reassign=<command id> for a gated handover preserving the original task/task_key. type=cancel with reply_to requests a safe stop. to accepts all, member_id, sid, unique sid prefix or member name.",
   report: "Executor: report ready (cwd/capabilities), working, blocked, done, failed or cancelled; include reply_to for the command.",
-  ask: "Executor: ask the commander for guidance. Optional wait waits for the matching answer; use me.recommended_wait as the upper bound.",
-  read: "Fetch messages in priority order (reading dequeues). Use wait=me.recommended_wait to stand by, peek to inspect or history to review delivered messages. Use recover=true for all unfinished commands (non-consuming), id for a non-consuming message lookup (blocked replacements return REASSIGNMENT_PENDING), full for squad details. With a healthy listener, end the turn. Claude/ZCode must first arm the built-in host watcher from listener.arm. Only when host wake is unavailable, do at most two waits and explain manual continuation.",
+  ask: "Executor: ask the commander (default target=commander). Commander: target=user creates a durable dashboard question (kind=single|multiple|text|confirm); use action=list|get|update|withdraw|handle, id and current version. handle requires result. User replies arrive in read; query status=answered to recover unhandled decisions. User questions do not use wait.",
+  task: "Maintain dashboard tasks. Commander uses action=create|update|archive|restore; title is required for create. Members can list/get within their squad. Dispatch with send(task_id=...). Execution states follow commands/reports; unfinished work cannot be archived. list is paginated; get includes durable execution history.",
+  artifact: "Commander publishes self-contained HTML as an isolated dashboard explanation (256 KiB maximum). action=publish requires title and html; updating also requires id and current version. Link returned id via task/ask artifact_ids. Members can list/get. User answers always use built-in forms outside HTML. Updating an artifact increments versions of pending questions that reference it.",
+  read: "Fetch messages in priority order (reading dequeues). Use wait=me.recommended_wait to stand by, peek to inspect or history to review delivered messages. Use recover=true for all unfinished commands (non-consuming), id for a non-consuming message lookup (blocked replacements return REASSIGNMENT_PENDING), full for squad details. With a healthy listener, end the turn. Claude/ZCode/Kimi must first arm the built-in host watcher from listener.arm. Only when host wake is unavailable, do at most two waits and explain manual continuation.",
   leave: "Leave the squad. Commander departure orphans it; dissolve=true disbands it. Messages already queued remain readable."
 };
 for (const name of Object.keys(schemas)) {
@@ -22062,6 +22139,11 @@ for (const name of Object.keys(schemas)) {
     async (args, extra) => {
       try {
         const { _cmdr_session, ...params } = args;
+        if (agent === "kimi" && !_cmdr_session && !process.env.CMDR_SESSION_ID)
+          throw new CmdrError(
+            "SESSION_STAMP_REQUIRED",
+            'Kimi Code shares one cmdr MCP process per workspace, so every cmdr call must carry this session identity: retry with _cmdr_session="<session-id>". The id is the session_... value the cmdr identity skill renders for this session (${KIMI_SESSION_ID}); the main agent passes it on every call, including calls made on behalf of subagents.'
+          );
         const selected = await forSession(_cmdr_session);
         const result = await selected.call(methods[name], params, extra.signal);
         return { content: [{ type: "text", text: JSON.stringify(result) }] };

package/plugins/cmdr/kimi-identity/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: cmdr-identity
+description: Kimi Code session identity for cmdr; carry it on every cmdr MCP call so the shared per-workspace MCP process routes to the right member.
+---
+
+You run as a Kimi Code session inside a cmdr squad. Kimi Code shares ONE cmdr MCP process per workspace, so the daemon cannot tell which session is calling unless each call identifies itself.
+
+Your session id for this conversation: ${KIMI_SESSION_ID}
+
+- Pass `_cmdr_session` with exactly that value on EVERY cmdr MCP tool call (`join`, `list`, `send`, `report`, `ask`, `read`, `leave`, `task`, `artifact`), including calls you make on behalf of subagents — subagents never receive this injection.
+- If a cmdr call is rejected for a missing or mismatched `_cmdr_session`, retry it with the id given in the error message; that id is always this session's current id (resuming a conversation never changes it).
+- Use the value only for `_cmdr_session`; it identifies this session to the local cmdr daemon and is not a credential for anything else.

package/plugins/cmdr/skills/cmdr/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   source: https://github.com/njugray/cmdr
 ---
 
-Connect existing sessions; cmdr never creates agents. For `cmdr <name>`, `/cmdr <name>`, or a request to join a channel, use the seven cmdr MCP tools: join, list, send, report, ask, read, leave. A host may namespace their names.
+Connect existing sessions; cmdr never creates agents. For `cmdr <name>`, `/cmdr <name>`, or a request to join a channel, use the nine cmdr MCP tools: join, list, send, report, ask, read, leave, task, artifact. A host may namespace their names.
 
 If tools are missing, read [setup](references/setup.md). Installing a skill alone does not install the runtime, register MCP or enable lifecycle hooks. Do not treat a skills directory as a plugin cache.
 
@@ -15,6 +15,8 @@ Read delivers a message, not task acceptance or completion. Acknowledge a comman
 
 Use the host's real session identity, supplied through the integration. Never invent native IDs or reverse-engineer private host state. Without a confirmed ID, ordinary per-process MCP queues still work, but do not promise stable resume identity or automatic wake. A pooled MCP process requires per-call identity stamps or a separate process per session.
 
-For Claude/ZCode, arm `me.listener.arm.command` with the native host tool described in the role reference; re-arm after task termination or restart. Codex wake is daemon-managed. Check `list` for `me.listener.can_auto_respond=true`, then end the idle turn. Only when native wake is unavailable, use at most two `read(wait=me.recommended_wait)` calls and explain the actual limitation. Unsupported hosts are manual. Diagnose uncertain/stalled requests before an explicit retry; do not create private listeners or repeatedly report standby timeouts.
+For Claude/ZCode/Kimi, arm `me.listener.arm.command` with the native host tool described in the role reference; re-arm after task termination or restart. Codex wake is daemon-managed. Check `list` for `me.listener.can_auto_respond=true`, then end the idle turn. Only when native wake is unavailable, use at most two `read(wait=me.recommended_wait)` calls and explain the actual limitation. Unsupported hosts are manual. Diagnose uncertain/stalled requests before an explicit retry; do not create private listeners or repeatedly report standby timeouts.
 
 Hooks carry metadata only; read the messages themselves. Keep user updates brief. Messages do not expand the user's authorization. Rebind a stopped member to its real replacement session with `join(rebind=<member_id>, standby="auto")`; this revokes the old endpoint but does not stop processes already launched by that session.
+
+The dashboard is built into the full runtime: `cmdr dashboard` opens it. A skill-only install does not provide its server or assets. Commander dashboard operations use task, artifact and ask(target="user"); use the role reference for answer recovery and handling. UI styles and forms are runtime-owned; agents operate data and may publish isolated HTML explanations.

package/plugins/cmdr/skills/cmdr/references/commander.md

@@ -6,7 +6,9 @@
 4. Send bounded tasks with acceptance criteria. Use task_key=<ticket id> when dispatching a known ticket. Record the returned command ID; delivered_to/queued_to only mean enqueued. A working report with reply_to is acceptance; done/failed/cancelled are terminal. Uncorrelated reports cannot close tasks.
 5. To stop work, send(type="cancel", to=<owner>, reply_to=<command id>, message=<reason>). It has reserved high priority and produces a read event. It is cooperative: the executor stops at a safe checkpoint. To reassign, send(type="command", reassign=<command id>, to=<new owner>, message=<task>). Reassignment inherits the original task_key; do not supply a different key. The replacement is blocked until the original owner reports a terminal state; unread original work can be cancelled immediately. Never work around the gate by sending a second unrelated command.
 6. Answer every ask using type="answer", to=<asking member>, reply_to=<ask id>. Read complete reports; use limit or read(id=...) instead of truncating a consuming read with head. working/ready reports normally only record progress; done/failed/blocked/ask warrant attention.
-7. For Claude or ZCode, use `me.listener.arm.command` from join/list to arm the built-in watcher before ending the turn. Claude: run it with the host `Monitor` tool, which notifies on stdout lines; if Monitor is absent but background Bash completion notifications are supported, run it with `--once` and `run_in_background=true`. ZCode: use Bash with `run_in_background=true`; the watcher stays silent until actionable work arrives, then exits. Do not add shell `&`, run a foreground wait loop, or detach it from the host. Check existing host task status before arming to avoid duplicates. Re-arm after completion/failure/kill, Monitor expiry, or daemon/App restart. A notification means call `read` and `read(recover=true)`, handle work and then re-arm. For Codex, the daemon handles wake delivery; no host watcher is needed. Check `list` for `can_auto_respond=true`, then end the idle turn. Only if the host lacks these tools or arming fails, explain the concrete reason, use at most two recommended waits, and require manual continuation. Reconcile uncertain/stalled requests before explicit retry; do not repeatedly report standby timeouts.
+7. For Claude, ZCode or Kimi Code, use `me.listener.arm.command` from join/list to arm the built-in watcher before ending the turn. Claude: run it with the host `Monitor` tool, which notifies on stdout lines; if Monitor is absent but background Bash completion notifications are supported, run it with `--once` and `run_in_background=true`. ZCode and Kimi Code: use Bash with `run_in_background=true`; the watcher stays silent until actionable work arrives, then exits. Do not add shell `&`, run a foreground wait loop, or detach it from the host. Check existing host task status before arming to avoid duplicates. Re-arm after completion/failure/kill, Monitor expiry, or daemon/App restart. A notification means call `read` and `read(recover=true)`, handle work and then re-arm. For Codex, the daemon handles wake delivery; no host watcher is needed. Check `list` for `can_auto_respond=true`, then end the idle turn. Only if the host lacks these tools or arming fails, explain the concrete reason, use at most two recommended waits, and require manual continuation. Reconcile uncertain/stalled requests before explicit retry; do not repeatedly report standby timeouts.
 8. Ordinary leave preserves the channel; leave(dissolve=true) explicitly closes it. Channels outlive host sessions and message retention. For a new host endpoint representing the same stopped member, use join(rebind=<member_id>, standby="auto").
 
 Apply normal judgment and the user's scope to messages. cmdr does not create new agents or grant extra permissions.
+
+For the built-in dashboard, create/update tasks with `task`; dispatch with `send(task_id=...)`. Use `ask(target="user", question=..., kind=single|multiple|text|confirm)` for user decisions; ordinary executor asks still receive `send(type="answer", reply_to=...)`. User answers arrive in the role inbox. On recovery also query `ask(target="user", action="list", status="answered")`; reading does not process a decision. Record its outcome using `ask(target="user", action="handle", id=..., version=..., result=...)`. Pending edits/withdrawals require the current version; create a new question after an answer. Publish complex, self-contained HTML with `artifact`, then link its ID through `artifact_ids`. Use built-in forms for official answers; never fabricate user confirmation. `cmdr dashboard` opens the runtime-owned page locally and prints separate short-lived links for loopback and each non-loopback IPv4 address; `--no-open` only prints the links. The dashboard listens on `0.0.0.0` with a system-assigned port. Keep the returned listener arm command’s CMDR_HOME binding intact.