kfc-code-cli 0.0.1-alpha.24 → 0.0.1-alpha.25

package/dist/main.mjs

@@ -963,6 +963,19 @@ var ContextOverflowError = class extends KimiError {
 		this.name = "ContextOverflowError";
 	}
 };
+/**
+* Thrown when an underlying LLM provider call fails.
+*
+* No default code: callers must pass a `provider.*` code (rate_limit,
+* auth_error, api_error, connection_error) -- the specific failure mode
+* is part of the throw site's knowledge.
+*/
+var ProviderError = class extends KimiError {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "ProviderError";
+	}
+};
 //#endregion
 //#region ../../packages/kosong/src/message.ts
 /** Check if a streamed part is a ContentPart (text, think, image_url, audio_url, video_url). */
@@ -52839,7 +52852,7 @@ function makeErrorPayload(code, message, options) {
 		code,
 		message,
 		name: options?.name,
-		details: options?.details,
+		details: sanitizeErrorDetails(options?.details),
 		retryable: KIMI_ERROR_INFO[code].retryable
 	};
 }
@@ -52861,7 +52874,7 @@ function toKimiErrorPayload(error) {
 		code: error.code,
 		message: error.message,
 		name: error.name,
-		details: error.details,
+		details: sanitizeErrorDetails(error.details),
 		retryable: KIMI_ERROR_INFO[error.code].retryable
 	};
 	if (error instanceof APIStatusError) {
@@ -52870,10 +52883,10 @@ function toKimiErrorPayload(error) {
 			code,
 			message: error.message,
 			name: error.name,
-			details: {
+			details: sanitizeErrorDetails({
 				statusCode: error.statusCode,
 				requestId: error.requestId
-			},
+			}),
 			retryable: KIMI_ERROR_INFO[code].retryable
 		};
 	}
@@ -52908,6 +52921,26 @@ function toKimiErrorPayload(error) {
 	};
 }
 /**
+* Rehydrate a KimiErrorPayload into a KimiError. Used by SDK boundary code
+* receiving errors over RPC to re-surface them with a real class so
+* in-process consumers can still use `instanceof`.
+*
+* Returns `ProviderError` for `provider.*` codes; otherwise plain
+* `KimiError`. We deliberately do not reconstruct the full subclass tree
+* because the boundary already lost class identity and the SDK only needs
+* one stable wrapper payload.
+*/
+function fromKimiErrorPayload(payload) {
+	if (payload.code.startsWith("provider.")) return new ProviderError(payload.message, {
+		code: payload.code,
+		details: payload.details
+	});
+	return new KimiError(payload.message, {
+		code: payload.code,
+		details: payload.details
+	});
+}
+/**
 * Heuristic: kosong's `createProvider` throws plain `Error("Model not set")`
 * / `Error("Provider not set")` when the runtime provider config is missing.
 * Detect by message until upstream surfaces a typed error.
@@ -52916,6 +52949,51 @@ function isLlmNotSetError(error) {
 	if (!(error instanceof Error)) return false;
 	return error.message === "Model not set" || error.message === "Provider not set";
 }
+function sanitizeErrorDetails(details) {
+	if (details === void 0) return void 0;
+	const sanitized = sanitizeJsonValue(details, /* @__PURE__ */ new WeakSet());
+	if (sanitized === void 0 || sanitized === null || typeof sanitized !== "object") return;
+	if (Array.isArray(sanitized)) return void 0;
+	return Object.keys(sanitized).length === 0 ? void 0 : sanitized;
+}
+function sanitizeJsonValue(value, seen) {
+	if (value === null) return null;
+	switch (typeof value) {
+		case "string":
+		case "boolean": return value;
+		case "number": return Number.isFinite(value) ? value : null;
+		case "bigint": return value.toString();
+		case "undefined":
+		case "function":
+		case "symbol": return;
+	}
+	if (value instanceof Date) return Number.isNaN(value.valueOf()) ? value.toString() : value.toISOString();
+	if (value instanceof Error) return {
+		name: value.name,
+		message: value.message
+	};
+	if (seen.has(value)) return "[Circular]";
+	seen.add(value);
+	if (Array.isArray(value)) {
+		const result = value.map((item) => sanitizeJsonValue(item, seen) ?? null);
+		seen.delete(value);
+		return result;
+	}
+	const result = {};
+	for (const key of Object.keys(value)) {
+		let rawItem;
+		try {
+			rawItem = value[key];
+		} catch (error) {
+			result[key] = error instanceof Error ? error.message : String(error);
+			continue;
+		}
+		const item = sanitizeJsonValue(rawItem, seen);
+		if (item !== void 0) result[key] = item;
+	}
+	seen.delete(value);
+	return result;
+}
 //#endregion
 //#region ../../packages/kimi-core/src/profile/types.ts
 const RawSubagentProfileSchema = z.object({ description: z.string().optional() });
@@ -60467,6 +60545,7 @@ var BackgroundProcessManager = class {
 	terminalCallbacks = [];
 	constructor(options = {}) {
 		this.options = options;
+		this.sessionDir = options.sessionDir;
 	}
 	/**
 	* Register a callback that fires when any task reaches a terminal
@@ -60559,14 +60638,12 @@ var BackgroundProcessManager = class {
 			});
 		}
 		this.persistLive(entry);
-		entry.lifecyclePromise = proc.wait().then((exitCode) => {
-			this.settleProcessExit(entry, exitCode);
-		}).catch((_err) => {
+		entry.lifecyclePromise = proc.wait().then((exitCode) => this.settleProcessExit(entry, exitCode)).catch(async (_err) => {
 			if (!TERMINAL_STATUSES.has(entry.status)) {
 				entry.status = "failed";
 				entry.endedAt = Date.now();
 			}
-			this.persistLive(entry);
+			await this.persistLive(entry);
 			this.fireTerminalCallbacks(entry);
 			this.resolveWaiters(entry);
 		});
@@ -60634,7 +60711,10 @@ var BackgroundProcessManager = class {
 	async stop(taskId, reason) {
 		const entry = this.processes.get(taskId);
 		if (!entry) return void 0;
-		if (TERMINAL_STATUSES.has(entry.status)) return this.toInfo(entry);
+		if (TERMINAL_STATUSES.has(entry.status)) {
+			await entry.persistWriteQueue;
+			return this.toInfo(entry);
+		}
 		entry.status = "killed";
 		entry.approvalReason = void 0;
 		entry.stopReason = reason;
@@ -60649,7 +60729,7 @@ var BackgroundProcessManager = class {
 			await entry.proc.kill("SIGKILL");
 		} catch {}
 		entry.endedAt ??= Date.now();
-		this.persistLive(entry);
+		await this.persistLive(entry);
 		this.fireTerminalCallbacks(entry);
 		this.resolveWaiters(entry);
 		return this.toInfo(entry);
@@ -60661,7 +60741,10 @@ var BackgroundProcessManager = class {
 	async wait(taskId, timeoutMs = 3e4) {
 		const entry = this.processes.get(taskId);
 		if (!entry) return void 0;
-		if (TERMINAL_STATUSES.has(entry.status)) return this.toInfo(entry);
+		if (TERMINAL_STATUSES.has(entry.status)) {
+			await entry.persistWriteQueue;
+			return this.toInfo(entry);
+		}
 		let terminalWaiter;
 		let timeout;
 		try {
@@ -60678,6 +60761,7 @@ var BackgroundProcessManager = class {
 				if (index !== -1) entry.waiters.splice(index, 1);
 			}
 		}
+		if (TERMINAL_STATUSES.has(entry.status)) await entry.persistWriteQueue;
 		return this.toInfo(entry);
 	}
 	/**
@@ -60741,6 +60825,12 @@ var BackgroundProcessManager = class {
 				resolve(deadlineTimeout);
 			}, opts.timeoutMs);
 		}));
+		const finalizeLifecycle = async () => {
+			if (deadlineTimer !== void 0) clearTimeout(deadlineTimer);
+			await this.persistLive(entry);
+			this.fireTerminalCallbacks(entry);
+			this.resolveWaiters(entry);
+		};
 		entry.lifecyclePromise = Promise.race(raceInputs).then((outcome) => {
 			if (outcome === deadlineTimeout) {
 				if (TERMINAL_STATUSES.has(entry.status)) return;
@@ -60768,12 +60858,9 @@ var BackgroundProcessManager = class {
 			entry.status = "failed";
 			entry.exitCode = 1;
 			entry.endedAt = Date.now();
-		}).finally(() => {
-			if (deadlineTimer !== void 0) clearTimeout(deadlineTimer);
-			this.persistLive(entry);
-			this.fireTerminalCallbacks(entry);
-			this.resolveWaiters(entry);
-		});
+		}).then(finalizeLifecycle, (error) => finalizeLifecycle().then(() => {
+			throw error;
+		}));
 		entry.lifecyclePromise;
 		return taskId;
 	}
@@ -60818,10 +60905,14 @@ var BackgroundProcessManager = class {
 	async waitForTerminal(taskId) {
 		const entry = this.processes.get(taskId);
 		if (entry === void 0) return this.ghosts.get(taskId);
-		if (TERMINAL_STATUSES.has(entry.status)) return this.toInfo(entry);
+		if (TERMINAL_STATUSES.has(entry.status)) {
+			await entry.persistWriteQueue;
+			return this.toInfo(entry);
+		}
 		await new Promise((resolve) => {
 			entry.waiters.push(resolve);
 		});
+		await entry.persistWriteQueue;
 		return this.toInfo(entry);
 	}
 	/** Reset internal state (for testing). */
@@ -60896,7 +60987,7 @@ var BackgroundProcessManager = class {
 	* `register()` and the lifecycle finally block. No-op unless attached.
 	*/
 	persistLive(entry) {
-		if (this.sessionDir === void 0) return;
+		if (this.sessionDir === void 0) return Promise.resolve();
 		const sessionDir = this.sessionDir;
 		const task = {
 			task_id: entry.taskId,
@@ -60912,6 +61003,7 @@ var BackgroundProcessManager = class {
 			stop_reason: entry.stopReason
 		};
 		entry.persistWriteQueue = entry.persistWriteQueue.then(() => writeTask(sessionDir, task)).catch(() => {});
+		return entry.persistWriteQueue;
 	}
 	appendOutput(entry, chunk) {
 		entry.outputChunks.push(chunk);
@@ -60925,12 +61017,12 @@ var BackgroundProcessManager = class {
 		if (outputSessionDir === void 0) return;
 		entry.outputWriteQueue = entry.outputWriteQueue.then(() => appendTaskOutput(outputSessionDir, entry.taskId, chunk)).catch(() => {});
 	}
-	settleProcessExit(entry, exitCode) {
+	async settleProcessExit(entry, exitCode) {
 		if (entry.exitCode !== null && entry.endedAt !== null && TERMINAL_STATUSES.has(entry.status)) return;
 		if (entry.status !== "killed") entry.status = exitCode === 0 ? "completed" : "failed";
 		entry.exitCode = exitCode;
 		entry.endedAt = Date.now();
-		this.persistLive(entry);
+		await this.persistLive(entry);
 		this.fireTerminalCallbacks(entry);
 		this.resolveWaiters(entry);
 	}
@@ -72324,7 +72416,7 @@ function stripLeadingDotSlash(value) {
 * Mode overlay:
 *   - `yolo`: deny rules still win; everything else is allow.
 *   - `manual`: rule walk drives the decision; unmatched → ask.
-*   - `auto`: callers usually skip this function and allow immediately.
+*   - `auto`: deny rules still win; everything else is allow.
 *   - Default auto-allow tools are allowed after deny rules — these
 *     are built-ins that do not call `Approval.request()`.
 */
@@ -72351,8 +72443,9 @@ var PermissionManager = class {
 	mode = "manual";
 	rules = [];
 	sessionApprovedActions = /* @__PURE__ */ new Set();
-	constructor(agent) {
+	constructor(agent, initialRules = []) {
 		this.agent = agent;
+		this.rules = [...initialRules];
 	}
 	data() {
 		return {
@@ -72397,6 +72490,11 @@ var PermissionManager = class {
 		const id = context.toolCall.id;
 		const name = context.toolCall.function.name;
 		const args = context.args;
+		const { decision, matchedRule } = checkRules(this.rules, name, args, this.mode);
+		if (decision === "deny") return {
+			block: true,
+			reason: this.formatMessage(name, matchedRule?.reason)
+		};
 		if (name === "EnterPlanMode") return void 0;
 		if (this.mode === "auto") {
 			if (name === "AskUserQuestion") return {
@@ -72412,11 +72510,6 @@ var PermissionManager = class {
 			detail: args
 		};
 		const action = describeApprovalAction(name, args, display);
-		const { decision, matchedRule } = checkRules(this.rules, name, args, this.mode);
-		if (decision === "deny") return {
-			block: true,
-			reason: this.formatMessage(name, matchedRule?.reason)
-		};
 		if (this.sessionApprovedActions.has(action)) return;
 		if (decision === "allow") return;
 		const result = await this.agent.rpc.requestApproval({
@@ -73985,7 +74078,7 @@ function createChatStreamingCallbacks(deps) {
 * enforcement, usage aggregation, optional continuation after non-tool stops,
 * and final `TurnResult` mapping. One-step execution lives in `turn-step.ts`.
 */
-const DEFAULT_MAX_STEPS = 500;
+const DEFAULT_MAX_STEPS = 1e3;
 async function runTurn(input) {
 	const { turnId, signal, llm, buildMessages, dispatchEvent, tools, hooks, maxSteps = DEFAULT_MAX_STEPS, maxRetryAttempts } = input;
 	let usage = emptyUsage();
@@ -74345,6 +74438,7 @@ var TurnFlow = class {
 			const model = this.agent.config.model;
 			const provider = this.agent.config.provider.withThinking(this.agent.config.thinkingLevel);
 			const modelAlias = this.agent.config.modelAlias;
+			const loopControl = this.agent.providerManager?.config.loopControl;
 			const resolveAuth = modelAlias === void 0 ? void 0 : this.agent.providerManager?.createAuthResolverForModel(modelAlias);
 			try {
 				return (await runTurn({
@@ -74361,7 +74455,8 @@ var TurnFlow = class {
 					buildMessages: () => this.agent.context.messages,
 					dispatchEvent: this.buildDispatchEvent(turnId),
 					tools: this.agent.tools.loopTools,
-					maxRetryAttempts: this.agent.providerManager?.config.loopControl?.maxRetriesPerStep,
+					maxSteps: loopControl?.maxStepsPerTurn,
+					maxRetryAttempts: loopControl?.maxRetriesPerStep,
 					hooks: {
 						beforeStep: async ({ signal: stepSignal }) => {
 							this.flushSteerBuffer();
@@ -74600,11 +74695,14 @@ var Agent = class {
 		this.config = new ConfigState(this);
 		this.turn = new TurnFlow(this);
 		this.injection = new InjectionManager(this);
-		this.permission = new PermissionManager(this);
+		this.permission = new PermissionManager(this, config.permissionRules);
 		this.planMode = new PlanMode(this);
 		this.usage = new UsageRecorder(this);
 		this.tools = new ToolManager(this);
-		this.background = new BackgroundManager(this, { maxRunningTasks: config.backgroundMaxRunningTasks });
+		this.background = new BackgroundManager(this, {
+			maxRunningTasks: config.backgroundMaxRunningTasks,
+			sessionDir: config.backgroundSessionDir
+		});
 		this.replayBuilder = new ReplayBuilder(this);
 	}
 	useProfile(profile, context) {
@@ -74807,7 +74905,7 @@ var SessionSubagentHost = class {
 				text: request.prompt
 			}], request.origin);
 			const turnEnded = await child.turn.waitForCurrentTurn(request.signal);
-			if (turnEnded.reason !== "completed") throw new Error(turnEnded.error?.message ?? `Subagent turn ${turnEnded.reason}`);
+			if (turnEnded.reason !== "completed") throw new Error(turnEnded.error === void 0 ? `Subagent turn ${turnEnded.reason}` : `[${turnEnded.error.code}] ${turnEnded.error.message}`);
 			const result = lastAssistantText(child);
 			const usage = child.usage.data().total;
 			parent.emitEvent({
@@ -74904,9 +75002,10 @@ var Session$1 = class {
 				rpc: proxyWithExtraPayload(this.rpc, { agentId: id }),
 				providerManager: this.config.providerManager,
 				subagentHost: new SessionSubagentHost(this, id, this.backgroundTaskTimeoutMs()),
-				backgroundMaxRunningTasks: this.config.background?.maxRunningTasks
+				backgroundMaxRunningTasks: this.config.background?.maxRunningTasks,
+				backgroundSessionDir: config.homedir,
+				permissionRules: this.config.permissionRules
 			});
-			if (config.homedir !== void 0) agent.background.attachSessionDir(config.homedir);
 			this.agents.set(id, agent);
 			await agent.resume();
 			await agent.background.loadFromDisk();
@@ -74926,9 +75025,10 @@ var Session$1 = class {
 			rpc: proxyWithExtraPayload(this.rpc, { agentId: id }),
 			providerManager: this.config.providerManager,
 			subagentHost: config.subagentHost ?? new SessionSubagentHost(this, id, this.backgroundTaskTimeoutMs()),
-			backgroundMaxRunningTasks: this.config.background?.maxRunningTasks
+			backgroundMaxRunningTasks: this.config.background?.maxRunningTasks,
+			backgroundSessionDir: homedir,
+			permissionRules: this.config.permissionRules
 		});
-		agent.background.attachSessionDir(homedir);
 		if (this.config.cwd !== void 0) agent.config.update({ cwd: this.config.cwd });
 		if (profile) {
 			const context = await prepareSystemPromptContext(this.config.runtime.kaos, agent.config.cwd);
@@ -74938,7 +75038,7 @@ var Session$1 = class {
 		this.metadata.agents[id] = {
 			homedir,
 			type,
-			parentAgentId
+			parentAgentId: parentAgentId ?? null
 		};
 		this.writeMetadata();
 		return {
@@ -75072,7 +75172,22 @@ function createRPC() {
 			const signal = options?.signal;
 			const rpcPayload = await simulateNetwork(payload);
 			signal?.throwIfAborted();
-			return simulateNetwork(await abortableRpc(Promise.resolve(fn(rpcPayload)), signal));
+			let response;
+			try {
+				response = {
+					ok: true,
+					value: await abortableRpc(Promise.resolve(fn(rpcPayload)), signal)
+				};
+			} catch (error) {
+				signal?.throwIfAborted();
+				response = {
+					ok: false,
+					error: toKimiErrorPayload(error)
+				};
+			}
+			const remoteResponse = await simulateNetwork(response);
+			if (remoteResponse.ok) return remoteResponse.value;
+			throw fromKimiErrorPayload(remoteResponse.error);
 		};
 	}
 	function bindAllFunctions(obj) {
@@ -75142,6 +75257,24 @@ const PermissionModeSchema = z.enum([
 	"manual",
 	"auto"
 ]);
+const PermissionRuleDecisionSchema = z.enum([
+	"allow",
+	"deny",
+	"ask"
+]);
+const PermissionRuleScopeSchema = z.enum([
+	"turn-override",
+	"session-runtime",
+	"project",
+	"user"
+]);
+const PermissionRuleSchema = z.object({
+	decision: PermissionRuleDecisionSchema,
+	scope: PermissionRuleScopeSchema.default("user"),
+	pattern: z.string().min(1).refine(isValidPermissionPattern, { message: "Invalid permission rule pattern" }),
+	reason: z.string().optional()
+});
+const PermissionConfigSchema = z.object({ rules: z.array(PermissionRuleSchema).optional() });
 const LoopControlSchema = z.object({
 	maxStepsPerTurn: z.number().int().min(1).optional(),
 	maxRetriesPerStep: z.number().int().min(0).optional(),
@@ -75178,6 +75311,7 @@ const KimiConfigSchema = z.object({
 	defaultThinking: z.boolean().optional(),
 	defaultPermissionMode: PermissionModeSchema.optional(),
 	defaultPlanMode: z.boolean().optional(),
+	permission: PermissionConfigSchema.optional(),
 	hooks: z.array(z.unknown()).optional(),
 	services: ServicesConfigSchema.optional(),
 	mergeAllAvailableSkills: z.boolean().optional(),
@@ -75191,6 +75325,7 @@ const KimiConfigSchema = z.object({
 const ProviderConfigPatchSchema = ProviderConfigSchema.partial();
 const ModelAliasPatchSchema = ModelAliasSchema.partial();
 const ThinkingConfigPatchSchema = ThinkingConfigSchema.partial();
+const PermissionConfigPatchSchema = PermissionConfigSchema.partial();
 const LoopControlPatchSchema = LoopControlSchema.partial();
 const BackgroundConfigPatchSchema = BackgroundConfigSchema.partial();
 const MoonshotServiceConfigPatchSchema = MoonshotServiceConfigSchema.partial();
@@ -75210,6 +75345,7 @@ const KimiConfigPatchSchema = z.object({
 	defaultThinking: z.boolean().optional(),
 	defaultPermissionMode: PermissionModeSchema.optional(),
 	defaultPlanMode: z.boolean().optional(),
+	permission: PermissionConfigPatchSchema.optional(),
 	hooks: z.array(z.unknown()).optional(),
 	services: ServicesConfigPatchSchema.optional(),
 	mergeAllAvailableSkills: z.boolean().optional(),
@@ -75241,6 +75377,14 @@ function missingModelContextSizeMessage(error) {
 		if (section === "models" && typeof modelName === "string" && field === "maxContextSize") return `Model "${modelName}" must define a positive max_context_size in config.toml.`;
 	}
 }
+function isValidPermissionPattern(pattern) {
+	try {
+		parsePattern(pattern);
+		return true;
+	} catch {
+		return false;
+	}
+}
 //#endregion
 //#region ../../packages/kimi-core/src/harness/configs/merge.ts
 function mergeConfigPatch(config, patch) {
@@ -75326,6 +75470,7 @@ function transformTomlData(data) {
 		if (targetKey === "providers" && isPlainObject(value)) result[targetKey] = transformRecord(value, transformProviderData);
 		else if (targetKey === "models" && isPlainObject(value)) result[targetKey] = transformRecord(value, transformModelData);
 		else if (targetKey === "thinking" && isPlainObject(value)) result[targetKey] = transformPlainObject(value);
+		else if (targetKey === "permission" && isPlainObject(value)) result[targetKey] = transformPermissionData(value);
 		else if (targetKey === "services" && isPlainObject(value)) result[targetKey] = transformRecord(value, transformServiceData, snakeToCamel);
 		else if (targetKey === "loopControl" && isPlainObject(value)) result[targetKey] = transformLoopControlData(value);
 		else if (targetKey === "background" && isPlainObject(value)) result[targetKey] = transformPlainObject(value);
@@ -75357,6 +75502,39 @@ function transformProviderData(data) {
 function transformModelData(data) {
 	return transformPlainObject(data);
 }
+function transformPermissionData(data) {
+	const raw = transformPlainObject(data);
+	const out = {};
+	const rules = [];
+	appendPermissionRules(rules, raw["rules"]);
+	appendPermissionRules(rules, raw["deny"], "deny");
+	appendPermissionRules(rules, raw["allow"], "allow");
+	appendPermissionRules(rules, raw["ask"], "ask");
+	if (rules.length > 0) out["rules"] = rules;
+	return out;
+}
+function appendPermissionRules(target, value, decision) {
+	if (value === void 0) return;
+	const entries = Array.isArray(value) ? value : [value];
+	for (const entry of entries) target.push(transformPermissionRule(entry, decision));
+}
+function transformPermissionRule(value, decision) {
+	if (!isPlainObject(value)) return value;
+	const rule = transformPlainObject(value);
+	const tool = rule["tool"];
+	const match = rule["match"];
+	const pattern = rule["pattern"];
+	const out = {};
+	if (decision !== void 0) out["decision"] = decision;
+	else out["decision"] = rule["decision"];
+	out["scope"] = rule["scope"];
+	out["reason"] = rule["reason"];
+	if (typeof tool === "string") {
+		const argPattern = typeof match === "string" ? match : pattern;
+		out["pattern"] = typeof argPattern === "string" ? `${tool}(${argPattern})` : tool;
+	} else out["pattern"] = pattern;
+	return out;
+}
 function transformServiceData(data) {
 	const out = {};
 	for (const [key, value] of Object.entries(data)) {
@@ -75415,6 +75593,7 @@ function configToTomlData(config) {
 	setSection(out, "loop_control", config.loopControl, loopControlToToml);
 	setSection(out, "background", config.background, backgroundToToml);
 	setSection(out, "mcp", config.mcp, mcpToToml);
+	setSection(out, "permission", config.permission, permissionToToml);
 	return out;
 }
 function setRecordSection(out, snakeKey, value, toToml) {
@@ -75455,6 +75634,20 @@ function thinkingToToml(thinking, rawThinking) {
 	for (const [key, value] of Object.entries(thinking)) setDefined(out, camelToSnake(key), value);
 	return out;
 }
+function permissionToToml(permission, rawPermission) {
+	const out = cloneRecord(rawPermission);
+	delete out["deny"];
+	delete out["allow"];
+	delete out["ask"];
+	if (permission.rules !== void 0) out["rules"] = permission.rules.map(permissionRuleToToml);
+	else delete out["rules"];
+	return out;
+}
+function permissionRuleToToml(rule) {
+	const out = {};
+	for (const [key, value] of Object.entries(rule)) setDefined(out, camelToSnake(key), value);
+	return out;
+}
 function servicesToToml(services, rawServices) {
 	const out = cloneRecord(rawServices);
 	if (services.moonshotSearch !== void 0) out["moonshot_search"] = serviceToToml(services.moonshotSearch);
@@ -89701,6 +89894,7 @@ var HarnessAPI = class {
 			cwd: workDir,
 			providerManager: this.providerManager,
 			background: config.background,
+			permissionRules: config.permission?.rules,
 			skills: this.resolveSessionSkillConfig(config)
 		});
 		session.metadata = {
@@ -89740,6 +89934,7 @@ var HarnessAPI = class {
 			cwd: summary.workDir,
 			providerManager: this.providerManager,
 			background: config.background,
+			permissionRules: config.permission?.rules,
 			skills: this.resolveSessionSkillConfig(config),
 			initializeMainAgent: false
 		});
@@ -94387,7 +94582,7 @@ function detectFdPath() {
 }
 //#endregion
 //#region src/tui/constant/symbols.ts
-const STATUS_BULLET = "⏺︎ ";
+const STATUS_BULLET = "● ";
 const USER_MESSAGE_BULLET = "✨ ";
 const FAILURE_MARK = "✗ ";
 //#endregion
@@ -96196,6 +96391,58 @@ function formatActivityLine(verb, toolName, args, workspaceDir) {
 	return keyArg ? `${verb} ${toolName} (${keyArg})` : `${verb} ${toolName}`;
 }
 //#endregion
+//#region src/tui/utils/event-payload.ts
+function unescapeJsonString(s) {
+	return s.replaceAll(/\\(["\\/bfnrt])/g, (_, ch) => {
+		switch (ch) {
+			case "n": return "\n";
+			case "t": return "	";
+			case "r": return "\r";
+			case "b": return "\b";
+			case "f": return "\f";
+			case "\"": return "\"";
+			case "\\": return "\\";
+			case "/": return "/";
+			default: return ch;
+		}
+	});
+}
+function parseStreamingArgs(argumentsText) {
+	if (argumentsText.trim().length === 0) return {};
+	if (argumentsText.trimEnd().endsWith("}")) try {
+		const parsed = JSON.parse(argumentsText);
+		if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) return parsed;
+	} catch {}
+	const result = {};
+	for (const match of argumentsText.matchAll(STREAMING_ARGS_FIELD_RE)) {
+		const key = match[1];
+		const rawValue = match[2];
+		if (key === void 0 || rawValue === void 0) continue;
+		if (!(key in result)) result[key] = unescapeJsonString(rawValue);
+	}
+	return result;
+}
+function argsRecord(args) {
+	return typeof args === "object" && args !== null && !Array.isArray(args) ? args : {};
+}
+function serializeToolResultOutput(output) {
+	if (typeof output === "string") return output;
+	return JSON.stringify(output, null, 2);
+}
+function isTodoItemShape(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const rec = value;
+	if (typeof rec.title !== "string" || rec.title.length === 0) return false;
+	return rec.status === "pending" || rec.status === "in_progress" || rec.status === "done";
+}
+function formatErrorMessage$1(error) {
+	if (isKimiError(error)) return `[${error.code}] ${error.message}`;
+	return error instanceof Error ? error.message : String(error);
+}
+function stringValue(value) {
+	return typeof value === "string" ? value : void 0;
+}
+//#endregion
 //#region src/tui/utils/media-url.ts
 function mediaUrlPartToText(kind, url) {
 	const summary = summarizeDataUrl(url);
@@ -96260,7 +96507,7 @@ async function hydrateTranscriptFromReplay(state, hooks, session) {
 		hooks.setAppState(appStateFromResumeAgent(main));
 		return true;
 	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
+		const message = formatErrorMessage$1(error);
 		hooks.emitError(`Failed to replay session history: ${message}`);
 		return false;
 	} finally {
@@ -100830,69 +101077,6 @@ function hasDispose(value) {
 	return typeof value === "object" && value !== null && "dispose" in value && typeof value.dispose === "function";
 }
 //#endregion
-//#region src/tui/utils/event-payload.ts
-function unescapeJsonString(s) {
-	return s.replaceAll(/\\(["\\/bfnrt])/g, (_, ch) => {
-		switch (ch) {
-			case "n": return "\n";
-			case "t": return "	";
-			case "r": return "\r";
-			case "b": return "\b";
-			case "f": return "\f";
-			case "\"": return "\"";
-			case "\\": return "\\";
-			case "/": return "/";
-			default: return ch;
-		}
-	});
-}
-function parseStreamingArgs(argumentsText) {
-	if (argumentsText.trim().length === 0) return {};
-	if (argumentsText.trimEnd().endsWith("}")) try {
-		const parsed = JSON.parse(argumentsText);
-		if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) return parsed;
-	} catch {}
-	const result = {};
-	for (const match of argumentsText.matchAll(STREAMING_ARGS_FIELD_RE)) {
-		const key = match[1];
-		const rawValue = match[2];
-		if (key === void 0 || rawValue === void 0) continue;
-		if (!(key in result)) result[key] = unescapeJsonString(rawValue);
-	}
-	return result;
-}
-function argsRecord(args) {
-	return typeof args === "object" && args !== null && !Array.isArray(args) ? args : {};
-}
-function serializeToolResultOutput(output) {
-	if (typeof output === "string") return output;
-	return JSON.stringify(output, null, 2);
-}
-function isTodoItemShape(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const rec = value;
-	if (typeof rec.title !== "string" || rec.title.length === 0) return false;
-	return rec.status === "pending" || rec.status === "in_progress" || rec.status === "done";
-}
-function sessionErrorTitle(code) {
-	switch (code) {
-		case "auth.login_required": return "Login required";
-		case "provider.auth_error": return "Authentication error";
-		case "provider.api_error": return "API error";
-		case "provider.rate_limit": return "Rate limit";
-		case "provider.connection_error": return "Connection error";
-		case "context.overflow": return "Context overflow";
-		case "loop.max_steps_exceeded": return "Max steps exceeded";
-		case "tool_error": return "Tool error";
-		case "internal": return "Internal error";
-		case void 0: return "Error";
-		default: return "Error";
-	}
-}
-function stringValue(value) {
-	return typeof value === "string" ? value : void 0;
-}
-//#endregion
 //#region src/tui/utils/errors.ts
 function isAbortMessage(message) {
 	return message === "Aborted" || message.endsWith(": Aborted");
@@ -101798,7 +101982,7 @@ var KimiTUI = class {
 			const result = await editInExternalEditor(seed, cmd);
 			if (result !== void 0) this.state.editor.setText(result.replaceAll("\r\n", "\n").replace(/\n$/, ""));
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`External editor failed: ${msg}`);
 		} finally {
 			if (typeof process.stdin.pause === "function") process.stdin.pause();
@@ -101859,7 +102043,7 @@ var KimiTUI = class {
 				try {
 					await this.handleBuiltInSlashCommand(intent.name, intent.args);
 				} catch (error) {
-					this.showError(error instanceof Error ? error.message : String(error));
+					this.showError(formatErrorMessage$1(error));
 				}
 				return;
 		}
@@ -102042,14 +102226,14 @@ var KimiTUI = class {
 		this.beginSessionRequest();
 		const sdkInput = options?.parts ?? input;
 		session.prompt(sdkInput).catch((error) => {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = formatErrorMessage$1(error);
 			this.failSessionRequest(`Failed to send: ${message}`);
 		});
 	}
 	sendSkillActivation(session, skillName, skillArgs) {
 		this.beginSessionRequest();
 		session.activateSkill(skillName, skillArgs).catch((error) => {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = formatErrorMessage$1(error);
 			this.failSessionRequest(`Skill "${skillName}" failed: ${message}`);
 		});
 	}
@@ -102077,7 +102261,7 @@ var KimiTUI = class {
 			content: part
 		});
 		session.steer(input.join("\n\n")).catch((error) => {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = formatErrorMessage$1(error);
 			this.showError(`Failed to steer: ${message}`);
 		});
 	}
@@ -102090,7 +102274,7 @@ var KimiTUI = class {
 		const session = this.session;
 		if (session === void 0) return;
 		session.cancelCompaction().catch((error) => {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = formatErrorMessage$1(error);
 			this.showError(`Failed to cancel compaction: ${message}`);
 		});
 	}
@@ -102295,7 +102479,7 @@ var KimiTUI = class {
 		try {
 			session = await this.harness.resumeSession({ id: targetSessionId });
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`Failed to resume session ${targetSessionId}: ${msg}`);
 			return false;
 		}
@@ -102314,7 +102498,7 @@ var KimiTUI = class {
 		try {
 			await hydrateTranscriptFromReplay(this.state, this.replayHydrationHooks(), session);
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`Failed to replay session history: ${msg}`);
 		} finally {
 			this.startSessionEventSubscription();
@@ -102330,7 +102514,7 @@ var KimiTUI = class {
 		try {
 			session = await this.createSessionFromCurrentState();
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`Failed to start a new session: ${msg}`);
 			return;
 		}
@@ -102343,7 +102527,7 @@ var KimiTUI = class {
 		try {
 			await this.activateRuntime();
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`Post-create setup failed: ${msg}`);
 			return;
 		}
@@ -102670,12 +102854,7 @@ var KimiTUI = class {
 	handleSessionError(event) {
 		this.resetLiveToolUiState();
 		this.finalizeLiveTextBuffers("idle");
-		if (event.code === "model.not_configured") {
-			this.showError(event.message);
-			return;
-		}
-		const title = sessionErrorTitle(event.code);
-		this.showError(`${title}: ${event.message}`);
+		this.showError(`[${event.code}] ${event.message}`);
 	}
 	handleSkillActivated(event) {
 		if (this.state.renderedSkillActivationIds.has(event.activationId)) return;
@@ -103395,7 +103574,7 @@ var KimiTUI = class {
 				notifications: this.state.appState.notifications
 			});
 		} catch (error) {
-			this.showStatus(`Failed to save editor: ${error instanceof Error ? error.message : String(error)}`, this.state.theme.colors.error);
+			this.showStatus(`Failed to save editor: ${formatErrorMessage$1(error)}`, this.state.theme.colors.error);
 			return;
 		}
 		this.setAppState({ editorCommand });
@@ -103467,7 +103646,7 @@ var KimiTUI = class {
 			});
 			this.showStatus(`Switched to ${alias} with thinking ${level}.`, this.state.theme.colors.success);
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`Failed to switch model: ${msg}`);
 		}
 	}
@@ -103536,7 +103715,7 @@ var KimiTUI = class {
 		try {
 			await this.requireSession().setPermission(mode);
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`Failed to set permission mode: ${msg}`);
 			return;
 		}
@@ -103559,7 +103738,7 @@ var KimiTUI = class {
 				notifications: this.state.appState.notifications
 			});
 		} catch (error) {
-			this.showStatus(`Failed to save theme: ${error instanceof Error ? error.message : String(error)}`, this.state.theme.colors.error);
+			this.showStatus(`Failed to save theme: ${formatErrorMessage$1(error)}`, this.state.theme.colors.error);
 			return;
 		}
 		const resolved = theme === "auto" ? this.state.theme.resolvedTheme : theme;
@@ -103613,7 +103792,7 @@ var KimiTUI = class {
 		try {
 			return { usage: await this.requireSession().getUsage() };
 		} catch (error) {
-			return { error: error instanceof Error ? error.message : String(error) };
+			return { error: formatErrorMessage$1(error) };
 		}
 	}
 	async loadRuntimeStatusReport() {
@@ -103631,7 +103810,7 @@ var KimiTUI = class {
 		try {
 			res = await this.harness.auth.getManagedUsage(providerKey);
 		} catch (error) {
-			return { error: error instanceof Error ? error.message : String(error) };
+			return { error: formatErrorMessage$1(error) };
 		}
 		if (res.kind === "error") return { error: res.message };
 		return { usage: {
@@ -103680,7 +103859,7 @@ var KimiTUI = class {
 			}
 			this.showNotice("Plan mode: OFF");
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`Failed to set plan mode: ${msg}`);
 		}
 	}
@@ -103735,7 +103914,7 @@ var KimiTUI = class {
 				title: newTitle
 			});
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`Failed to set title: ${msg}`);
 			return;
 		}
@@ -103755,14 +103934,14 @@ var KimiTUI = class {
 				title: `Fork: ${sourceTitle}`
 			});
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`Failed to fork session: ${msg}`);
 			return;
 		}
 		try {
 			await this.switchToSession(forked, `Session forked (${forked.id}).`);
 		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
+			const msg = formatErrorMessage$1(error);
 			this.showError(`Failed to switch to forked session: ${msg}`);
 		}
 	}
@@ -103875,7 +104054,7 @@ var KimiTUI = class {
 			try {
 				await this.refreshConfigAfterLogin();
 			} catch (refreshError) {
-				const message = refreshError instanceof Error ? refreshError.message : String(refreshError);
+				const message = formatErrorMessage$1(refreshError);
 				this.showError(`Authentication successful, but failed to refresh config: ${message}`);
 				return;
 			}
@@ -103888,7 +104067,7 @@ var KimiTUI = class {
 			});
 			spinner = void 0;
 			if (cancelled) return;
-			const message = error instanceof Error ? error.message : String(error);
+			const message = formatErrorMessage$1(error);
 			this.showError(`Login failed: ${message}`);
 		} finally {
 			if (this.cancelInFlight === cancelLogin) this.cancelInFlight = void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kfc-code-cli",
-  "version": "0.0.1-alpha.24",
+  "version": "0.0.1-alpha.25",
   "description": "KFC crazy ",
   "license": "MIT",
   "bin": {
@@ -37,8 +37,8 @@
     "@types/semver": "^7.7.0",
     "@types/yazl": "^2.4.6",
     "tsx": "^4.21.0",
-    "@moonshot-ai/kimi-telemetry": "^0.1.0",
     "@moonshot-ai/kimi-oauth": "^0.1.0",
+    "@moonshot-ai/kimi-telemetry": "^0.1.0",
     "@moonshot-ai/sdk": "^0.1.0"
   },
   "scripts": {