create-snipara 2.0.12 → 2.0.14

package/README.md

@@ -25,7 +25,7 @@ behind the scenes.
 
 Use it for:
 
-- Hosted MCP onboarding for Claude Code, Cursor, Windsurf, Codex, Gemini, Mistral, VS Code/Copilot, Continue, ChatGPT Desktop, Orca-style MCP clients, LM Studio-backed local stacks, and similar clients
+- Hosted MCP onboarding for Claude Code, Cursor, Kimi Code CLI, Codex, Gemini, Mistral, VS Code/Copilot, Continue, ChatGPT Desktop, Orca-style MCP clients, LM Studio-backed local stacks, and similar clients
 - free account signup with reviewed Context + Memory
 - local project wiring, `doctor`, `repair`, and `upgrade`
 - local source activation without GitHub, plus optional GitHub repository sync and PR Answer Packs approval when the current folder is a GitHub repo
@@ -86,7 +86,7 @@ Free onboarding is now **Context + Memory**, not Context-only:
 
 - Context Free: three projects and 1,000 context queries/month
 - Memory Free: reviewed hosted memories for continuity across sessions
-- Hosted MCP: direct connection for Claude Code, Cursor, Windsurf, Codex, Gemini, Mistral, VS Code/Copilot, Continue, ChatGPT Desktop, Orca-style MCP clients, LM Studio-backed local stacks, and other MCP clients
+- Hosted MCP: direct connection for Claude Code, Cursor, Kimi Code CLI, Codex, Gemini, Mistral, VS Code/Copilot, Continue, ChatGPT Desktop, Orca-style MCP clients, LM Studio-backed local stacks, and other MCP clients
 
 The CLI opens a browser device-flow login when the user does not already have a key, auto-provisions the free Context + Memory account when needed, then writes the returned API key into the local MCP config.
 
@@ -122,6 +122,9 @@ That distinction matters:
 - creates `AGENTS.md` and `CLAUDE.md` when missing, or appends a marked Snipara section when those files already exist
 - creates `.cursor/rules/snipara.mdc` and `.codex/config.toml` when those files do not already exist
 - validates Codex config against Hosted MCP plus `bearer_token_env_var = "SNIPARA_API_KEY"` and tells users to restart Codex after MCP config changes
+- generates one opaque correlation session ID and reuses it in `.mcp.json`,
+  Companion, Codex, and Kimi configuration so served context can be joined to
+  later project outcomes without treating the ID as authentication
 - installs local code overlay Git hooks only for explicit companion/full-stack
   setups unless `--skip-hooks` is passed
 - runs a real hosted MCP `tools/list` check and warns if the server still advertises legacy `rlm_*` duplicate tools
@@ -200,6 +203,10 @@ that is expected. Use `snipara_help(query=...)` for routed guidance and
 `snipara-companion task-commit` as the reliable local fallback when the simple
 hosted tools are not callable.
 
+Codex also receives a static `X-Snipara-Session-Id` HTTP header. This value is
+opaque, non-secret telemetry generated per workspace; `repair` and `upgrade`
+reuse it when valid. It does not replace the bearer token or grant access.
+
 Existing root `AGENTS.md` and `CLAUDE.md` files are not replaced. The installer
 adds or refreshes a marked Snipara section so project-specific instructions stay
 intact.
@@ -413,10 +420,28 @@ companion add workflow ergonomics:
 - choose `hosted-only` or `--skip-companion` only in locked-down environments
 - use local `snipara-mcp` only for stdio compatibility, development, or tests
 
-Claude Code, Cursor, and Windsurf can receive generated automation files when
-that client has a useful local hook surface. Codex, Gemini, VS Code, Continue,
+Claude Code, Cursor, and Kimi Code CLI can receive generated automation files when
+that client has a useful local hook surface. Kimi receives a project-local MCP
+config and a reviewable plugin that must be installed explicitly; its hooks are
+fail-open. Codex, Gemini, VS Code, Continue,
 Mistral, ChatGPT, and custom clients are treated as MCP-first: they get the hosted MCP
 configuration/reference and agent instructions, not invented local hooks.
+
+For Kimi Code CLI:
+
+```bash
+npx -y create-snipara@latest init --client kimi --profile hosted-companion --with-hooks
+npx -y snipara-companion@latest automations install --client kimi
+# Then, in Kimi Code after reviewing the plugin:
+/plugins install .kimi-code/snipara-plugin
+```
+
+Export `SNIPARA_API_KEY` before starting Kimi. The generated
+`.kimi-code/mcp.json` stores only `bearerTokenEnvVar`, never the raw key. It
+also carries the same non-secret `X-Snipara-Session-Id` used by the project MCP
+and Companion configuration so Outcome Loop telemetry remains joinable. Kimi
+installs plugins per user, so the generated handler is project-neutral and
+no-ops outside workspaces carrying a Snipara project or Companion marker.
 For Mistral, request hooks from LangChain are documented as `ChatMistralAI`
 request lifecycle hooks (`beforeRequestHooks`, `requestErrorHooks`, and
 `responseHooks`), not as local agent lifecycle hooks.

package/dist/index.js

@@ -13,7 +13,7 @@ import { homedir } from "os";
 // package.json
 var package_default = {
   name: "create-snipara",
-  version: "2.0.12",
+  version: "2.0.14",
   description: "Onboard Snipara Hosted MCP Context + Memory with auth, companion workflows, and optional Snipara Sandbox",
   main: "dist/index.js",
   type: "module",
@@ -45,7 +45,7 @@ var package_default = {
     "chatgpt",
     "openai",
     "cursor",
-    "windsurf",
+    "kimi",
     "gemini",
     "mistral",
     "orca",
@@ -956,9 +956,9 @@ var AI_CLIENT_CHOICES = [
     description: "Hosted MCP plus Cursor rules and automation bundles"
   },
   {
-    title: "Windsurf",
-    value: "windsurf",
-    description: "Hosted MCP plus Windsurf automation bundles"
+    title: "Kimi Code CLI",
+    value: "kimi",
+    description: "Project MCP plus a reviewable Snipara Companion plugin"
   },
   {
     title: "OpenAI Codex",
@@ -1001,7 +1001,7 @@ function getCompanionInitClientFlag(aiClient) {
   const supportedClientMap = {
     "claude-code": "claude-code",
     cursor: "cursor",
-    windsurf: "windsurf",
+    kimi: "kimi",
     codex: "codex",
     gemini: "gemini",
     mistral: "mistral",
@@ -1027,7 +1027,7 @@ function buildProgram() {
   program.name("create-snipara").description("Scaffold hosted Snipara MCP config; advanced flags add local helpers").version(VERSION);
   program.command("init").description("Install and configure Snipara for this project").option("--api-key <key>", "Snipara API key").option("--slug <slug>", "Project slug").option("--project-id <id>", "Project ID").option(
     "--client <client>",
-    "AI client: claude-code, cursor, windsurf, codex, gemini, mistral, chatgpt, vscode, continue, claude-desktop, other"
+    "AI client: claude-code, cursor, kimi, codex, gemini, mistral, chatgpt, vscode, continue, claude-desktop, other"
   ).option("--advanced", "Show advanced profile, project id, hooks, GitHub, and sandbox prompts").option(
     "--profile <profile>",
     "Install profile: hosted-only, hosted-companion, full-stack, runtime-only"
@@ -1068,7 +1068,7 @@ function buildProgram() {
 function addSharedRootOptions(program) {
   program.option("--api-key <key>", "Snipara API key").option("--slug <slug>", "Project slug").option("--project-id <id>", "Project ID").option(
     "--client <client>",
-    "AI client: claude-code, cursor, windsurf, codex, gemini, mistral, chatgpt, vscode, continue, claude-desktop, other"
+    "AI client: claude-code, cursor, kimi, codex, gemini, mistral, chatgpt, vscode, continue, claude-desktop, other"
   ).option("--advanced", "Show advanced profile, project id, hooks, GitHub, and sandbox prompts").option(
     "--profile <profile>",
     "Install profile: hosted-only, hosted-companion, full-stack, runtime-only"
@@ -1682,7 +1682,7 @@ function normalizeClientOption(value) {
     "claude-desktop": "claude-desktop",
     claude_desktop: "claude-desktop",
     cursor: "cursor",
-    windsurf: "windsurf",
+    kimi: "kimi",
     codex: "codex",
     gemini: "gemini",
     mistral: "mistral",
@@ -1700,7 +1700,7 @@ function normalizeClientOption(value) {
   const client = aliases[normalized];
   if (!client) {
     throw new Error(
-      `Unknown client '${value}'. Use claude, claude-code, cursor, codex, mistral, or other.`
+      `Unknown client '${value}'. Use claude, claude-code, cursor, kimi, codex, mistral, or other.`
     );
   }
   return client;
@@ -2162,19 +2162,75 @@ async function createMcpConfig(answers) {
   }
   console.log(chalk.green("   \u2713 Created .mcp.json"));
   ensureGitignoreEntry(".mcp.json", "# Snipara MCP config (contains API key)");
+  if (answers.aiClient === "kimi" && answers.profile !== "runtime-only") {
+    createKimiMcpConfig(answers);
+  }
   if (answers.aiClient === "claude-desktop") {
     await createClaudeDesktopConfig(answers);
   }
 }
+function createKimiMcpConfig(answers) {
+  const kimiDir = path.join(process.cwd(), ".kimi-code");
+  const configPath = path.join(kimiDir, "mcp.json");
+  const existing = asObjectRecord(readJsonFile(configPath));
+  const existingServers = asObjectRecord(existing.mcpServers);
+  const config = {
+    ...existing,
+    mcpServers: {
+      ...existingServers,
+      snipara: {
+        url: buildHostedMcpEndpoint(answers),
+        bearerTokenEnvVar: "SNIPARA_API_KEY",
+        headers: {
+          "X-Snipara-Session-Id": getCorrelationSessionId(answers)
+        }
+      }
+    }
+  };
+  fs.mkdirSync(kimiDir, { recursive: true });
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  console.log(
+    chalk.green("   \u2713 Created .kimi-code/mcp.json") + chalk.dim(" - SNIPARA_API_KEY stays in the launch environment")
+  );
+}
 function buildHostedMcpServer(answers) {
   return {
     type: "http",
     url: buildHostedMcpEndpoint(answers),
     headers: {
-      "X-API-Key": answers.apiKey || "YOUR_API_KEY_HERE"
+      "X-API-Key": answers.apiKey || "YOUR_API_KEY_HERE",
+      "X-Snipara-Session-Id": getCorrelationSessionId(answers)
     }
   };
 }
+var CORRELATION_SESSION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._~:/@+-]{0,127}$/;
+function normalizeCorrelationSessionId(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const normalized = value.trim();
+  return CORRELATION_SESSION_ID_PATTERN.test(normalized) ? normalized : null;
+}
+function readExistingCorrelationSessionId() {
+  const companionConfig = readCompanionConfigFile(
+    path.join(process.cwd(), ".snipara", "companion", "config.json")
+  );
+  const projectMcpConfig = asObjectRecord(readJsonFile(path.join(process.cwd(), ".mcp.json")));
+  const projectMcpServer = asObjectRecord(asObjectRecord(projectMcpConfig.mcpServers).snipara);
+  const projectMcpHeaders = asObjectRecord(projectMcpServer.headers);
+  const kimiConfig = asObjectRecord(
+    readJsonFile(path.join(process.cwd(), ".kimi-code", "mcp.json"))
+  );
+  const kimiServer = asObjectRecord(asObjectRecord(kimiConfig.mcpServers).snipara);
+  const kimiHeaders = asObjectRecord(kimiServer.headers);
+  return normalizeCorrelationSessionId(companionConfig.sessionId) || normalizeCorrelationSessionId(projectMcpHeaders["X-Snipara-Session-Id"]) || normalizeCorrelationSessionId(kimiHeaders["X-Snipara-Session-Id"]);
+}
+function getCorrelationSessionId(answers) {
+  const existing = normalizeCorrelationSessionId(answers.correlationSessionId) || readExistingCorrelationSessionId();
+  const sessionId = existing || `sess_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+  answers.correlationSessionId = sessionId;
+  return sessionId;
+}
 function asObjectRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -2789,6 +2845,7 @@ function buildCodexConfigTemplate(answers) {
 type = "streamable_http"
 url = "${buildHostedMcpEndpoint(answers)}"
 bearer_token_env_var = "SNIPARA_API_KEY"
+http_headers = { "X-Snipara-Session-Id" = "${getCorrelationSessionId(answers)}" }
 `;
 }
 function buildChatGptMcpTemplate(answers) {
@@ -3330,7 +3387,7 @@ async function createCompanionConfig(answers) {
     apiKey: answers.apiKey,
     apiUrl: API_URL,
     projectId: answers.projectId || answers.projectSlug,
-    sessionId: typeof existingWorkspaceConfig.sessionId === "string" && existingWorkspaceConfig.sessionId ? existingWorkspaceConfig.sessionId : `sess_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+    sessionId: getCorrelationSessionId(answers),
     client: getAutomationClientId(answers.aiClient)
   };
   fs.writeFileSync(configPath, JSON.stringify(workspaceConfig, null, 2) + "\n");
@@ -3449,6 +3506,14 @@ function buildActivationSurfaceContract(client) {
       nextSurfaceAction: "Start a new Claude Code session and validate Snipara tools before enabling hooks or managed workflows."
     };
   }
+  if (client === "kimi") {
+    return {
+      ...shared,
+      entryPoint: "Kimi Code project MCP plus an explicitly installed Snipara plugin",
+      clientRole: "Agent-first CLI surface: load .kimi-code/mcp.json for Hosted MCP and install the generated Companion plugin only after review.",
+      nextSurfaceAction: "Start Kimi Code with SNIPARA_API_KEY exported, verify /mcp, then install .kimi-code/snipara-plugin when lifecycle automation is desired."
+    };
+  }
   return {
     ...shared,
     entryPoint: `${getClientDisplayName(client)} setup generated by create-snipara`,
@@ -3545,10 +3610,11 @@ function getClientGuidance(client) {
       "Use the companion CLI only for explicit upload, planning, chunk lookup, doctor, and task commit workflows outside the editor UI."
     ];
   }
-  if (client === "windsurf") {
+  if (client === "kimi") {
     return [
-      "Windsurf should use the hosted MCP surface plus generated Windsurf automation bundles when available.",
-      "Use npx -y snipara-companion@latest automations install --client windsurf when you want dashboard-managed hook files in the local project."
+      "Kimi Code CLI reads the project-local .kimi-code/mcp.json and resolves SNIPARA_API_KEY from the launch environment.",
+      "Use npx -y snipara-companion@latest automations install --client kimi to download the reviewable plugin bundle, then install it explicitly inside Kimi with /plugins install .kimi-code/snipara-plugin.",
+      "Kimi hooks are fail-open. Keep risky tool approvals enabled and use Hosted MCP tenant checks plus Companion guards as the authoritative boundary."
     ];
   }
   if (client === "codex") {
@@ -3765,7 +3831,7 @@ function getClientDisplayName(client) {
   const names = {
     "claude-code": "Claude Code",
     cursor: "Cursor",
-    windsurf: "Windsurf",
+    kimi: "Kimi Code CLI",
     codex: "OpenAI Codex",
     gemini: "Gemini",
     mistral: "Mistral Le Chat / Vibe",
@@ -3781,7 +3847,7 @@ function getClientPackFilename(client) {
   const names = {
     "claude-code": "CLAUDE_CODE.md",
     cursor: "CURSOR.md",
-    windsurf: "WINDSURF.md",
+    kimi: "KIMI.md",
     codex: "CODEX.md",
     gemini: "GEMINI.md",
     mistral: "MISTRAL.md",
@@ -3800,8 +3866,12 @@ function getClientConfigArtifacts(client) {
   if (client === "cursor") {
     return [".mcp.json", ".cursor/rules/snipara.mdc", "dashboard automation bundle when installed"];
   }
-  if (client === "windsurf") {
-    return [".mcp.json", "dashboard automation bundle when installed"];
+  if (client === "kimi") {
+    return [
+      "AGENTS.md",
+      ".kimi-code/mcp.json",
+      ".kimi-code/snipara-plugin when installed through Companion"
+    ];
   }
   if (client === "codex") {
     return ["AGENTS.md", ".codex/config.toml", ".snipara/templates/codex-config.toml"];
@@ -4823,6 +4893,11 @@ function printSuccess(answers, report, activationManifest) {
       chalk.green("   \u2713 Claude Code") + chalk.dim(" - .mcp.json MCP config, .claude/settings.json hooks when enabled")
     );
   }
+  if (answers.aiClient === "kimi" && answers.profile !== "runtime-only") {
+    console.log(
+      chalk.green("   \u2713 Kimi Code CLI") + chalk.dim(" - .kimi-code/mcp.json with environment-backed authentication")
+    );
+  }
   console.log(
     chalk.green("   \u2713 .snipara/companion") + chalk.dim(" - Doctor report and optional command references")
   );
@@ -4859,6 +4934,17 @@ function printSuccess(answers, report, activationManifest) {
       `If Snipara tools are missing, run: ${CREATE_SNIPARA_NPX_COMMAND} doctor --client claude-desktop`
     );
   }
+  if (answers.aiClient === "kimi") {
+    printNextStep(
+      "For Kimi Code CLI, export SNIPARA_API_KEY before launch and run /mcp to verify the project-local server."
+    );
+    printNextStep(
+      `To enable Companion lifecycle hooks, run ${COMPANION_NPX_COMMAND} automations install --client kimi, review .kimi-code/snipara-plugin, then install it in Kimi with /plugins install .kimi-code/snipara-plugin.`
+    );
+    printNextStep(
+      "Keep manual approval for risky tools because Kimi hooks are fail-open and are not a standalone security boundary."
+    );
+  }
   if (answers.aiClient === "codex") {
     printNextStep(
       "For Codex, merge .snipara/templates/codex-config.toml into ~/.codex/config.toml if the app does not read project .codex/config.toml."
@@ -5300,8 +5386,8 @@ function detectAiClient() {
   if (fs.existsSync(path.join(process.cwd(), ".cursor"))) {
     return "cursor";
   }
-  if (fs.existsSync(path.join(process.cwd(), ".windsurf"))) {
-    return "windsurf";
+  if (fs.existsSync(path.join(process.cwd(), ".kimi-code"))) {
+    return "kimi";
   }
   if (fs.existsSync(path.join(process.cwd(), ".gemini"))) {
     return "gemini";
@@ -5321,8 +5407,8 @@ function detectAiClient() {
   if (fs.existsSync(path.join(homedir(), ".cursor")) || process.env.CURSOR_EDITOR) {
     return "cursor";
   }
-  if (fs.existsSync(path.join(homedir(), ".windsurf")) || process.env.WINDSURF_EDITOR) {
-    return "windsurf";
+  if (fs.existsSync(path.join(homedir(), ".kimi-code")) || process.env.KIMI_CODE_HOME) {
+    return "kimi";
   }
   if (fs.existsSync(path.join(homedir(), ".gemini")) || process.env.GEMINI_CLI) {
     return "gemini";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-snipara",
-  "version": "2.0.12",
+  "version": "2.0.14",
   "description": "Onboard Snipara Hosted MCP Context + Memory with auth, companion workflows, and optional Snipara Sandbox",
   "main": "dist/index.js",
   "type": "module",
@@ -32,7 +32,7 @@
     "chatgpt",
     "openai",
     "cursor",
-    "windsurf",
+    "kimi",
     "gemini",
     "mistral",
     "orca",