gestalt-mobile 0.35.4 → 0.36.0

package/dist/server/server/composition.js

@@ -13,9 +13,18 @@ import { FilesystemWorkspaceFiles } from './platform/filesystem/filesystem-works
 import { protocolCompatibility } from './platform/codex/protocol-compatibility.js';
 import { launchCodexAppServer } from './platform/codex/codex-process-launcher.js';
 import { CodexModelCatalog } from './platform/codex/codex-model-catalog.js';
+import { ProviderModelCatalog } from './platform/catalog/provider-model-catalog.js';
 import { createRecentThreadLister } from './platform/codex/recent-thread-lister.js';
 import { CodexSessionRuntime } from './platform/codex/session-runtime.js';
 import { normalizeCodexNotification } from './platform/codex/normalizer.js';
+import { KimiSessionRuntime } from './platform/kimi/kimi-session-runtime.js';
+import { KimiWebServerManager } from './platform/kimi/kimi-web-server-manager.js';
+import { KimiModelCatalog } from './platform/kimi/kimi-model-catalog.js';
+import { KimiSkillCatalog } from './platform/kimi/kimi-skill-catalog.js';
+import { createKimiRecentSessionLister } from './platform/kimi/kimi-recent-session-lister.js';
+import { kimiStateBase } from './platform/kimi/kimi-share-dir.js';
+import { normalizeKimiEvent } from './platform/kimi/kimi-normalizer.js';
+import { decodeKimiActivityFacts } from './platform/kimi/kimi-activity-facts.js';
 import { isMissingCodexThreadRollout } from './platform/codex/json-rpc-client.js';
 import { migrate } from './platform/persistence/migrate.js';
 import { openRelayDatabase } from './platform/persistence/sqlite.js';
@@ -139,7 +148,30 @@ export async function composeRelayApp(options) {
             ((sessionId, code) => console.warn(`agent activity ${code} session=${sessionId}`)),
         reconcile: async (sessionId) => {
             const session = sessions.find(sessionId);
-            if (!session || !runtime)
+            if (!session)
+                return;
+            // Kimi sessions own no child-process projection; one detached history
+            // read supplies the whole reconciliation, mirroring the codex tail.
+            if (session.provider === 'kimi') {
+                if (!kimiRuntime)
+                    return;
+                const history = await kimiRuntime.readHistory(session);
+                // Forget may commit while the detached history reader is still in
+                // flight. Revalidate ownership before handing its result to the
+                // registry, whose publisher intentionally keeps the journal strict.
+                if (!sessions.find(sessionId))
+                    return;
+                const occurredAt = new Date().toISOString();
+                activity.observe({
+                    sessionId,
+                    occurredAt,
+                    kind: history.activeTurnId ? 'turnStarted' : 'turnCompleted',
+                    ...(session.threadId ? { threadId: session.threadId } : {}),
+                    ...(history.activeTurnId ? { turnId: history.activeTurnId } : {}),
+                });
+                return;
+            }
+            if (!runtime)
                 return;
             const history = await runtime.readHistory(session);
             // Forget may commit while the detached history reader is still in
@@ -327,13 +359,39 @@ export async function composeRelayApp(options) {
     options.onAutopilotCoordinator?.(autopilot);
     const workspaces = new FilesystemWorkspaceCatalog(root);
     const workspaceFiles = new FilesystemWorkspaceFiles();
-    const models = new CodexModelCatalog(root, options.launchAppServer ?? launchCodexAppServer);
+    const homeDirectory = options.homeDirectory ?? homedir();
+    // Constructing the manager is cheap (no spawn until `ensure`); building it
+    // before the model catalog lets the catalog reuse the gestalt-owned servers.
+    const kimiManager = options.kimiServerManager ??
+        (options.installedKimiVersion != null && options.startAppServers
+            ? new KimiWebServerManager({
+                stateBase: kimiStateBase(homeDirectory),
+                sourceShareDir: join(homeDirectory, '.kimi-code'),
+            })
+            : undefined);
+    const kimiModels = new KimiModelCatalog(kimiManager ?? null, kimiManager != null);
+    const models = new ProviderModelCatalog({
+        codex: options.installedCodexVersion === null
+            ? { list: async () => [] }
+            : new CodexModelCatalog(root, options.launchAppServer ?? launchCodexAppServer),
+        kimi: kimiModels,
+    });
+    const sessionModels = options.sessionModelCatalog ?? {
+        list: (provider) => (provider === 'kimi' ? kimiModels.listForSession() : models.list(provider)),
+    };
     const skillProfiles = new FilesystemSkillProfileStore(options.homeDirectory ?? homedir());
-    const skillCatalog = (profile) => new CodexSkillCatalog(profile, options.launchAppServer ?? launchCodexAppServer);
-    const editorSkillCatalog = new CachedSkillCatalog((profile, workspace) => skillCatalog(profile).list(workspace));
+    // kimi discovery is workspace-scoped, not profile-scoped: the profile only
+    // decides which discovered skills a session's server materializes.
+    const kimiSkillCatalog = new KimiSkillCatalog(kimiManager ?? null, kimiManager != null);
+    const skillCatalog = (provider, profile) => provider === 'kimi'
+        ? kimiSkillCatalog
+        : new CodexSkillCatalog(profile, options.launchAppServer ?? launchCodexAppServer);
+    const editorSkillCatalog = new CachedSkillCatalog((provider, profile, workspace) => skillCatalog(provider, profile).list(workspace));
     const workspacePlanCatalog = new FilesystemWorkspacePlanCatalog();
     const resolveSkills = async (session) => {
-        const catalog = await skillCatalog(session.profile).list(session.workspacePath);
+        const catalog = session.provider === 'kimi'
+            ? await kimiSkillCatalog.list(session.workspacePath)
+            : await skillCatalog('codex', session.profile).list(session.workspacePath);
         if (session.effectiveSkillSelection)
             return compileSkillOverride({
                 discovered: catalog.skills,
@@ -353,6 +411,15 @@ export async function composeRelayApp(options) {
         profiles: options.profiles,
         launch: options.launchAppServer ?? launchCodexAppServer,
     });
+    const kimiRecentSessions = createKimiRecentSessionLister({
+        servers: kimiManager ?? null,
+        available: kimiManager != null,
+    });
+    // The relay's recent list spans both llm services; execution-policy metadata
+    // stays a codex rollout concern, so the codex lister remains the source.
+    const recentThreadsForRelay = {
+        list: async () => [...(await recentThreads.list()), ...(await kimiRecentSessions.list())],
+    };
     const recoverExecutionPolicy = async (session) => {
         if (session.executionPolicy || !session.threadId)
             return session;
@@ -362,9 +429,20 @@ export async function composeRelayApp(options) {
             : session;
     };
     const protocol = protocolCompatibility(options.installedCodexVersion, generatedProtocolVersion);
+    const providerAvailability = {
+        codex: {
+            available: options.installedCodexVersion !== null && protocol.compatible,
+            ...(options.installedCodexVersion === null ? {} : { version: options.installedCodexVersion }),
+        },
+        kimi: {
+            available: options.installedKimiVersion != null,
+            ...(options.installedKimiVersion ? { version: options.installedKimiVersion } : {}),
+        },
+    };
     const gitFetches = new GitFetchCoordinator(fetchUpstream);
     const gitSummaries = new GitSummaryCache(inspectGit);
     let recoverExitedSession = () => { };
+    let recoverExitedKimiSession = () => { };
     let scheduleAgentCapacityRecovery = () => false;
     let planMeasurementRefresh;
     const publishInteractionResolved = (sessionId, requestId, occurredAt, outcome) => {
@@ -486,6 +564,36 @@ export async function composeRelayApp(options) {
     };
     let closing = false;
     let runtime = null;
+    let kimiRuntime = null;
+    /**
+     * Shared acceptance path for a provider-neutral pending interaction: it
+     * enters the durable store, requests human attention, and notifies autopilot.
+     * Both the codex JSON-RPC handler and the kimi polling handler land here.
+     */
+    const acceptPendingInteraction = (sessionId, rawInteraction, session) => {
+        const interaction = {
+            ...rawInteraction,
+            turnId: session.activeTurnId,
+            requestedAt: new Date().toISOString(),
+        };
+        interactions.add(sessionId, interaction);
+        activity.observe({
+            sessionId,
+            occurredAt: interaction.requestedAt,
+            kind: 'interactionPending',
+            ...(interaction.kind === 'orgPlanAttention'
+                ? { attentionReason: interaction.payload.reason }
+                : {}),
+        });
+        autopilot.semanticEvent(sessionId, 'interactionChanged');
+        const updated = RelaySession.rehydrate(session).requestInteraction(interaction, new Date().toISOString()).snapshot;
+        sessions.save(updated);
+        events.publish(journal.append(sessionId, 'interaction.requested', interaction, updated.updatedAt));
+        if (interaction.kind === 'orgPlanAttention')
+            events.publish(journal.append(sessionId, 'org-plan.attention-required', interaction, updated.updatedAt));
+        autopilot.evaluate(sessionId);
+        return true;
+    };
     const acceptPlanUpdate = (sessionId, update) => {
         if (closing)
             return;
@@ -668,28 +776,7 @@ export async function composeRelayApp(options) {
                 // is cancelled solely by the JSON-RPC write-settlement callback.
                 return true;
             }
-            const interaction = {
-                ...rawInteraction,
-                turnId: session.activeTurnId,
-                requestedAt: new Date().toISOString(),
-            };
-            interactions.add(sessionId, interaction);
-            activity.observe({
-                sessionId,
-                occurredAt: interaction.requestedAt,
-                kind: 'interactionPending',
-                ...(interaction.kind === 'orgPlanAttention'
-                    ? { attentionReason: interaction.payload.reason }
-                    : {}),
-            });
-            autopilot.semanticEvent(sessionId, 'interactionChanged');
-            const updated = RelaySession.rehydrate(session).requestInteraction(interaction, new Date().toISOString()).snapshot;
-            sessions.save(updated);
-            events.publish(journal.append(sessionId, 'interaction.requested', interaction, updated.updatedAt));
-            if (interaction.kind === 'orgPlanAttention')
-                events.publish(journal.append(sessionId, 'org-plan.attention-required', interaction, updated.updatedAt));
-            autopilot.evaluate(sessionId);
-            return true;
+            return acceptPendingInteraction(sessionId, rawInteraction, session);
         }, (sessionId) => {
             activity.disconnected(sessionId, new Date().toISOString());
             failPendingCheckpointHandoffs(sessionId, false);
@@ -697,6 +784,59 @@ export async function composeRelayApp(options) {
             recoverExitedSession(sessionId);
         }, resolveSkills, planStatusSource, acceptPlanUpdate, options.planMeasurementBaseUrl, 30_000, 64, root)
         : null;
+    const handleKimiNotification = (sessionId, event) => {
+        const occurredAt = new Date().toISOString();
+        const session = sessions.find(sessionId);
+        const context = kimiRuntime?.eventContext(sessionId) ?? {
+            resolveTurnId: () => null,
+            isChildAgent: () => false,
+        };
+        for (const fact of decodeKimiActivityFacts(sessionId, occurredAt, event, context))
+            activity.observe(fact);
+        const normalized = normalizeKimiEvent(sessionId, 0, occurredAt, event, {
+            ...context,
+            workspacePath: session?.workspacePath,
+            activeTurnId: session?.activeTurnId,
+        });
+        if (!normalized)
+            return;
+        let completedSession;
+        if (normalized.type === 'turnCompleted' || normalized.type === 'turnInterrupted') {
+            const turnId = normalized.payload.turn?.id;
+            if (session && turnId && session.activeTurnId === turnId) {
+                completedSession = RelaySession.rehydrate(session).completeTurn(turnId, occurredAt).snapshot;
+                sessions.save(completedSession);
+            }
+        }
+        events.publish(journal.append(sessionId, normalized.type, normalized.payload, occurredAt));
+        if (completedSession)
+            events.publish(journal.append(sessionId, 'session.updated', completedSession, occurredAt));
+    };
+    const handleKimiServerRequest = (sessionId, request) => {
+        const rawInteraction = toPendingInteraction(request);
+        const session = withPendingInteractions(sessions.find(sessionId));
+        return Boolean(rawInteraction && session && acceptPendingInteraction(sessionId, rawInteraction, session));
+    };
+    kimiRuntime = kimiManager
+        ? new KimiSessionRuntime({
+            servers: kimiManager,
+            skillsFor: async (session) => {
+                const config = await resolveSkills(session);
+                return config?.map((entry) => ({
+                    name: basename(entry.path),
+                    path: entry.path,
+                    enabled: entry.enabled,
+                }));
+            },
+            onNotification: (sessionId, event) => handleKimiNotification(sessionId, event),
+            onServerRequest: (sessionId, request) => handleKimiServerRequest(sessionId, request),
+            onExit: (sessionId) => {
+                activity.disconnected(sessionId, new Date().toISOString());
+                dismissPendingInteractions(sessionId, new Date().toISOString(), 'failed');
+                recoverExitedKimiSession(sessionId);
+            },
+        })
+        : null;
     runtime?.onServerResponseSettled((sessionId, requestId, outcome) => {
         const interaction = interactions.find(sessionId, requestId);
         if (interaction?.kind !== 'orgPlanCheckpoint')
@@ -726,13 +866,27 @@ export async function composeRelayApp(options) {
             prior.state !== 'ready' &&
             prior.state !== 'turnActive' &&
             (session.state === 'ready' || session.state === 'turnActive');
-        if (runtime &&
+        if ((runtime || kimiRuntime) &&
             session.threadId &&
             (!prior || prior.threadId !== session.threadId || becameRuntimeReady))
             void activity.refresh(session.id);
         if (becameRuntimeReady)
             autopilot.restore(session.id);
     };
+    if (kimiRuntime) {
+        // A gestalt-owned kimi web process exited or its websocket dropped: stop
+        // the durable session like the codex supervisor does, without a resume
+        // retry (a later activation reattaches through the normal writer path).
+        recoverExitedKimiSession = (sessionId) => {
+            const session = sessions.find(sessionId);
+            if (session) {
+                autopilot.cancel(sessionId, 'sessionEnded');
+                saveSession(RelaySession.rehydrate(session).stop(new Date().toISOString()).snapshot);
+            }
+        };
+    }
+    /** Routes a session to the runtime owning its provider's llm service. */
+    const ownerRuntime = (session) => session.provider === 'kimi' ? kimiRuntime : runtime;
     if (runtime) {
         const capacityRecoveries = new Set();
         scheduleAgentCapacityRecovery = (sessionId, acknowledge) => {
@@ -842,6 +996,7 @@ export async function composeRelayApp(options) {
                             protocolVersion: generatedProtocolVersion,
                             compatible: protocol.compatible,
                         },
+                        providers: providerAvailability,
                     };
                 },
             },
@@ -859,7 +1014,7 @@ export async function composeRelayApp(options) {
             },
             logger: console,
             staticDir: options.staticDir,
-            recentThreads,
+            recentThreads: recentThreadsForRelay,
             bootstrap: {
                 workspaces,
                 profiles: options.profiles,
@@ -875,6 +1030,7 @@ export async function composeRelayApp(options) {
                 },
                 versions: options.componentVersions,
                 protocolCompatible: protocol.compatible,
+                providers: providerAvailability,
             },
             sessionRoutes: {
                 createId: randomUUID,
@@ -888,30 +1044,40 @@ export async function composeRelayApp(options) {
                 skillProfiles,
                 skillCatalog,
                 defaultSkillProfile: options.explicitSkillProfile,
-                activate: runtime
+                activate: runtime || kimiRuntime
                     ? async (session) => {
                         const now = new Date().toISOString();
                         dismissPendingInteractions(session.id, now);
-                        const started = await runtime.start(session, now);
-                        return started;
+                        const owner = ownerRuntime(session);
+                        if (!owner)
+                            throw new Error('LLM_RUNTIME_UNAVAILABLE');
+                        return owner.start(session, now);
                     }
                     : undefined,
-                startTurn: runtime
+                startTurn: runtime || kimiRuntime
                     ? async (session, text, clientUserMessageId) => {
                         autopilot.manualSend(session.id);
-                        return runtime.startTurn(session, text, clientUserMessageId, new Date().toISOString());
+                        const owner = ownerRuntime(session);
+                        if (!owner)
+                            throw new Error('LLM_RUNTIME_UNAVAILABLE');
+                        return owner.startTurn(session, text, clientUserMessageId, new Date().toISOString());
                     }
                     : undefined,
-                ensureWriter: runtime
+                ensureWriter: runtime || kimiRuntime
                     ? async (session) => {
                         dismissPendingInteractions(session.id, new Date().toISOString());
-                        return runtime.ensureWriter(await recoverExecutionPolicy(session), new Date().toISOString());
+                        const owner = ownerRuntime(session);
+                        if (!owner)
+                            throw new Error('LLM_RUNTIME_UNAVAILABLE');
+                        return owner.ensureWriter(await recoverExecutionPolicy(session), new Date().toISOString());
                     }
                     : undefined,
-                releaseWriter: runtime
+                releaseWriter: runtime || kimiRuntime
                     ? (id) => {
                         dismissPendingInteractions(id, new Date().toISOString());
-                        return runtime.release(id);
+                        const session = sessions.find(id);
+                        const owner = session ? ownerRuntime(session) : null;
+                        return owner ? owner.release(id) : Promise.resolve();
                     }
                     : undefined,
                 onTurnStarted: (session) => {
@@ -930,24 +1096,41 @@ export async function composeRelayApp(options) {
                 autopilotAudit: (id, limit) => journal.autopilotAuditTail(id, limit),
                 refreshActivity: (id) => activity.refresh(id),
                 models,
-                readHistory: runtime ? (session) => runtime.readHistory(session) : undefined,
+                sessionModels,
+                readHistory: runtime || kimiRuntime
+                    ? (session) => {
+                        const owner = ownerRuntime(session);
+                        if (!owner)
+                            return Promise.reject(new Error('LLM_RUNTIME_UNAVAILABLE'));
+                        return owner.readHistory(session);
+                    }
+                    : undefined,
                 currentSequence: (sessionId) => journal.since(sessionId, 0).at(-1)?.sequence ?? 0,
                 activityHistory: (sessionId, throughSequence) => journal.since(sessionId, 0).filter((event) => event.sequence <= throughSequence),
-                interruptTurn: runtime
-                    ? (session, turnId) => runtime.interruptTurn(session, turnId)
+                interruptTurn: runtime || kimiRuntime
+                    ? (session, turnId) => {
+                        const owner = ownerRuntime(session);
+                        return owner ? owner.interruptTurn(session, turnId) : Promise.resolve();
+                    }
                     : undefined,
-                queueTurnInput: runtime
+                queueTurnInput: runtime || kimiRuntime
                     ? (session, turnId, text, clientUserMessageId) => {
                         autopilot.manualSend(session.id);
-                        return runtime.queueTurnInput(session, turnId, text, clientUserMessageId);
+                        const owner = ownerRuntime(session);
+                        if (!owner)
+                            return Promise.resolve();
+                        return owner.queueTurnInput(session, turnId, text, clientUserMessageId);
                     }
                     : undefined,
-                restore: runtime
+                restore: runtime || kimiRuntime
                     ? async (session) => {
-                        const restored = await runtime.restoreWithOutcome(await recoverExecutionPolicy(session), new Date().toISOString());
+                        const owner = ownerRuntime(session);
+                        if (!owner)
+                            throw new Error('LLM_RUNTIME_UNAVAILABLE');
+                        const restored = await owner.restoreWithOutcome(await recoverExecutionPolicy(session), new Date().toISOString());
                         // An exit can be reported while resume is resolving. Do not let the
                         // route persist a stale ready snapshot over that recovered exit.
-                        if (!runtime.ownsWriter(session.id))
+                        if (!owner.ownsWriter(session.id))
                             return {
                                 ...restored,
                                 session: RelaySession.rehydrate(restored.session).stop(new Date().toISOString())
@@ -956,15 +1139,26 @@ export async function composeRelayApp(options) {
                         return restored;
                     }
                     : undefined,
-                ownsWriter: runtime ? (id) => runtime.ownsWriter(id) : undefined,
-                promoteRecent: runtime
+                ownsWriter: (id) => {
+                    const session = sessions.find(id);
+                    const owner = session ? ownerRuntime(session) : null;
+                    return owner ? owner.ownsWriter(id) : false;
+                },
+                promoteRecent: runtime || kimiRuntime
                     ? (thread) => promoteRecentThread(thread, {
                         createId: randomUUID,
                         now: () => new Date().toISOString(),
                         list: () => sessions.list(),
                         save: saveSession,
-                        read: (session) => runtime.readHistory(session),
-                        executionPolicy: (candidate) => recentThreads.executionPolicy(candidate.id),
+                        read: (session) => {
+                            const owner = ownerRuntime(session);
+                            if (!owner)
+                                throw new Error('LLM_RUNTIME_UNAVAILABLE');
+                            return owner.readHistory(session);
+                        },
+                        executionPolicy: (candidate) => candidate.provider === 'kimi'
+                            ? Promise.resolve(undefined)
+                            : recentThreads.executionPolicy(candidate.id),
                     })
                     : undefined,
                 release: (session) => {
@@ -977,17 +1171,28 @@ export async function composeRelayApp(options) {
                     sessions.remove(id);
                 },
                 idempotency,
-                close: runtime
+                close: runtime || kimiRuntime
                     ? (id) => {
                         autopilot.cancel(id, 'sessionEnded');
                         planMeasurementRefresh?.stop(id);
                         dismissPendingInteractions(id, new Date().toISOString());
                         activity.dispose(id);
-                        return runtime.release(id);
+                        const session = sessions.find(id);
+                        const owner = session ? ownerRuntime(session) : null;
+                        return owner ? owner.release(id) : Promise.resolve();
                     }
                     : undefined,
-                replyInteraction: runtime
-                    ? (sessionId, requestId, value) => runtime.resolveServerRequest(sessionId, requestId, value) ? 'accepted' : 'cleared'
+                replyInteraction: runtime || kimiRuntime
+                    ? async (sessionId, requestId, value) => {
+                        const session = sessions.find(sessionId);
+                        const owner = session ? ownerRuntime(session) : null;
+                        if (await owner?.resolveServerRequest(sessionId, requestId, value))
+                            return 'accepted';
+                        // Codex reports false when its app-server has already cleared a
+                        // request. Kimi returns false for a failed provider delivery and
+                        // retains the pending request for retry.
+                        return session?.provider === 'kimi' ? 'unavailable' : 'cleared';
+                    }
                     : undefined,
                 interactionResolved: (sessionId, requestId, occurredAt, outcome) => {
                     const remaining = interactions.list(sessionId);
@@ -1217,7 +1422,7 @@ export async function composeRelayApp(options) {
             // not a human disable: a later fenced continuation can reacquire it safely.
             if (session.desiredState === 'active') {
                 saveSession(RelaySession.rehydrate(session).stop(new Date().toISOString()).snapshot);
-                await runtime?.release(session.id);
+                await (session.provider === 'kimi' ? kimiRuntime : runtime)?.release(session.id);
             }
             await runtime?.watchPlanStatus(session);
             autopilot.restore(session.id);
@@ -1230,7 +1435,10 @@ export async function composeRelayApp(options) {
     app.addHook('onListen', async () => {
         const profile = (await options.profiles.list()).find((item) => item.state === 'ok')?.name;
         if (profile)
-            await editorSkillCatalog.refresh(profile, root);
+            await editorSkillCatalog.refresh('codex', profile, root);
+        // Kimi discovery owns a provider process, so passive relay startup must not
+        // refresh it. Explicit session creation and user-requested skill refreshes
+        // enter KimiSkillCatalog through their normal operation paths instead.
         await detachActiveSessions();
     });
     app.addHook('onClose', async () => {
@@ -1261,6 +1469,8 @@ export async function composeRelayApp(options) {
             }
         }
         runtime?.stopAll();
+        kimiRuntime?.stopAll();
+        await kimiManager?.stopAll();
         planStatusSource.closeAll();
         database.close();
         authorization?.close();

package/dist/server/server/features/autopilot/application/policy.js

@@ -3,8 +3,8 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-export const AUTOPILOT_PROMPT_VERSION = 'v9';
-export const AUTOPILOT_CONTINUATION_PROMPT = 'Inspect the active supervised Org Plan. Refer to every L1 as L<a> and each nested L2 as L<a>.<b>, using one-based positions. Spawn exactly one executor per L1 and pass the exact literal task_name l<a>: l1 for L1, l2 for L2, and so on. Never create an L2-specific task name or append a title, role, nickname, plan name, or generated label. A validated DONE L2 and an accepted L1 are mandatory answer boundaries. The corresponding gestalt_org_plan_checkpoint call must be the last tool call of that root turn: immediately emit exactly one boundary final and end the turn, without followup_task, review, executor launch, or later milestone work. On this later Autopilot turn, resume the same executor after an L2 boundary or launch the next executor after an accepted-L1 boundary. Treat a status question as an interruption: answer briefly, then perform the applicable continuation in the same turn. Before sending any blocker response or yielding because progress cannot continue safely, call gestalt_org_plan_attention for the matching decision-table blocker; never rely on blocker prose as the signal. Do not call it for routine progress or a recoverable failure. Before yielding for known long work, call gestalt_autopilot_wait_lease version 2 with relevant observable wake conditions and a bounded maxWaitMs; it is one episode, so reassess before registering another in a later turn. For GitHub PR CI, start an owned gh pr checks --watch process and lease processExited plus processResultAvailable while it runs. When the Autopilot probe is active, register the compatible wait lease, declare genuine attention, or immediately do actionable work; never acknowledge waiting in prose. Do not send a status-only response.';
+export const AUTOPILOT_PROMPT_VERSION = 'v10';
+export const AUTOPILOT_CONTINUATION_PROMPT = 'Inspect the active supervised Org Plan. Refer to every L1 as L<a> and each nested L2 as L<a>.<b>, using one-based positions. Spawn exactly one executor per L1 and pass the exact literal task_name l<a>: l1 for L1, l2 for L2, and so on. Never create an L2-specific task name or append a title, role, nickname, plan name, or generated label. A validated DONE L2 and an accepted L1 are mandatory answer boundaries. The corresponding gestalt_org_plan_checkpoint call must be the last tool call of that root turn: immediately emit exactly one boundary final and end the turn, without followup_task, review, executor launch, or later milestone work. Roll up commentary, files, verification, and commands since the previous boundary into that one answer; all later milestone activity belongs to a new root turn. On this later Autopilot turn, resume the same executor after an L2 boundary or launch the next executor after an accepted-L1 boundary. Treat a status question as an interruption: answer briefly, then perform the applicable continuation in the same turn. Before sending any blocker response or yielding because progress cannot continue safely, call gestalt_org_plan_attention for the matching decision-table blocker; never rely on blocker prose as the signal. Do not call it for routine progress or a recoverable failure. Before yielding for known long work, call gestalt_autopilot_wait_lease version 2 with relevant observable wake conditions and a bounded maxWaitMs; it is one episode, so reassess before registering another in a later turn. Yield only when its response contains accepted:true; accepted:false means no continuation was registered and requires same-turn supervision. For GitHub PR CI, start an owned gh pr checks --watch process and lease processExited plus processResultAvailable while it runs. When the Autopilot probe is active, register the compatible wait lease, declare genuine attention, or immediately do actionable work; never acknowledge waiting in prose. Do not send a status-only response.';
 export const AUTOPILOT_EXECUTOR_CONTINUATION_PROMPT = 'Continue the same assigned Org L1 from its durable state. A prior turn ending did not complete the objective. Consume any supplied process result and take the next legal L2 action. Whenever an L2 reaches DONE, return its concise structured evidence and end the executor turn so the root can publish that mandatory answer boundary. Also report at the L1 review boundary or through structured attention.';
 /** Builds a physical launch instruction while keeping durable L1 identity canonical. */
 export function autopilotExecutorLaunchPrompt(identity) {

package/dist/server/server/features/autopilot/register-routes.js

@@ -4,6 +4,6 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 import { registerAutopilotToggle } from './toggle/endpoint.js';
-export function registerAutopilotRoutes(app, coordinator, idempotency) {
-    registerAutopilotToggle(app, coordinator, idempotency);
+export function registerAutopilotRoutes(app, coordinator, idempotency, providerFor) {
+    registerAutopilotToggle(app, coordinator, idempotency, providerFor);
 }

package/dist/server/server/features/autopilot/toggle/endpoint.js

@@ -4,13 +4,17 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 import { createHash } from 'node:crypto';
-export function registerAutopilotToggle(app, coordinator, idempotency) {
+export function registerAutopilotToggle(app, coordinator, idempotency, providerFor) {
     app.put('/api/sessions/:id/autopilot', async (request, reply) => {
         const enabled = request.body?.enabled;
         if (typeof enabled !== 'boolean')
             return reply.code(400).send({ code: 'AUTOPILOT_ENABLED_REQUIRED' });
         const key = request.headers['idempotency-key'];
         const sessionId = request.params.id;
+        // Autopilot orchestration (executors, plan measurement, wait leases) is
+        // codex-only; kimi sessions must not toggle it at all, in either direction.
+        if (providerFor?.(sessionId) === 'kimi')
+            return reply.code(409).send({ code: 'AUTOPILOT_PROVIDER_UNSUPPORTED' });
         const scope = `autopilot-toggle:${sessionId}`;
         const fingerprint = createHash('sha256').update(String(enabled)).digest('hex');
         if (typeof key === 'string' && key && idempotency) {

package/dist/server/server/features/catalog/get-bootstrap/use-case.js

@@ -4,15 +4,16 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 export async function getBootstrap(deps) {
-    const [workspaces, profiles, models] = await Promise.all([
+    const [workspaces, profiles, codexModels, kimiModels] = await Promise.all([
         deps.workspaces.list(),
         deps.profiles.list(),
-        deps.models?.list().catch(() => []) ?? [],
+        deps.models?.list('codex').catch(() => []) ?? [],
+        deps.models?.list('kimi').catch(() => []) ?? [],
     ]);
     return {
         workspaces,
         profiles,
-        models,
+        models: { codex: codexModels, kimi: kimiModels },
         sessions: deps.sessions.list(),
         versions: deps.versions ?? [],
         capabilities: {
@@ -20,6 +21,7 @@ export async function getBootstrap(deps) {
             userInput: true,
             git: true,
             protocolCompatible: deps.protocolCompatible,
+            providers: deps.providers,
         },
     };
 }

package/dist/server/server/features/plans/application/parse-supervised-plan.js

@@ -201,9 +201,10 @@ function measurementFor(heading) {
         if (value === undefined)
             continue;
         if (property.endsWith('_AT')) {
-            if (!isUtcIsoInstant(value))
+            const instant = normalizeUtcIsoInstant(value);
+            if (!instant)
                 return null;
-            measurement[field] = value;
+            measurement[field] = instant;
             continue;
         }
         if (!/^\d+$/.test(value))
@@ -215,14 +216,38 @@ function measurementFor(heading) {
     }
     return Object.keys(measurement).length === 0 ? undefined : measurement;
 }
-function isUtcIsoInstant(value) {
-    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(value))
-        return false;
+function normalizeUtcIsoInstant(value) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{3}))?(Z|[+-]\d{2}:\d{2})$/.exec(value);
+    if (!match)
+        return null;
+    const [, yearValue, monthValue, dayValue, hourValue, minuteValue, secondValue, , zone] = match;
+    const [year, month, day, hour, minute, second] = [
+        yearValue,
+        monthValue,
+        dayValue,
+        hourValue,
+        minuteValue,
+        secondValue,
+    ].map(Number);
+    const offset = zone === 'Z' ? null : zone.slice(1).split(':').map(Number);
+    if (year < 1 ||
+        month < 1 ||
+        month > 12 ||
+        day < 1 ||
+        day > new Date(Date.UTC(year, month, 0)).getUTCDate() ||
+        hour > 23 ||
+        minute > 59 ||
+        second > 59 ||
+        (offset && (offset[0] > 23 || offset[1] > 59)))
+        return null;
     const instant = new Date(value);
     if (Number.isNaN(instant.getTime()))
-        return false;
-    const canonical = instant.toISOString();
-    return value === canonical || value === canonical.replace('.000Z', 'Z');
+        return null;
+    if (zone === 'Z') {
+        const canonical = instant.toISOString();
+        return value === canonical || value === canonical.replace('.000Z', 'Z') ? value : null;
+    }
+    return instant.toISOString().replace('.000Z', 'Z');
 }
 function descriptionFor(heading) {
     const fields = heading.level === 1 ? ['Effort', 'Goal', 'Notes'] : ['Why', 'Change', 'Tests', 'Done when'];

package/dist/server/server/features/sessions/get-session/endpoint.js

@@ -27,7 +27,7 @@ export function registerGetSession(app, find, activity, autopilot, plan) {
                 pendingAttention: Boolean(session.pendingInteractions?.length),
                 observedAt: new Date().toISOString(),
             }),
-            resumeCommand: session.threadId ? buildResumeCommand(session) : null,
+            resumeCommand: session.threadId && session.provider !== 'kimi' ? buildResumeCommand(session) : null,
         });
     });
 }