kimi-plugin-cc 2.0.7 → 2.2.0

package/.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
   },
   "metadata": {
     "description": "Kimi for Claude Code: code questions, reviews, fixes, and parallel tasks through the local Kimi Code CLI.",
-    "version": "2.0.7"
+    "version": "2.2.0"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi",
   "description": "Claude Code plugin that delegates read-only review, challenge, free-form ask, and write-capable rescue work to the local kimi-code CLI. Includes an opt-in stop-time review gate and a PreToolUse hook that enforces per-command safety.",
-  "version": "2.0.7",
+  "version": "2.2.0",
   "homepage": "https://github.com/linxule/kimi-plugin-cc",
   "repository": "https://github.com/linxule/kimi-plugin-cc",
   "license": "Apache-2.0",

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 > **Post-1.0 release history (v1.0.1 -> present) lives in [ROADMAP-TO-GA.md § Post-GA audit log](./ROADMAP-TO-GA.md#post-ga-audit-log)** and the "Version" / "Upstream compat" lines of [AGENTS.md](./AGENTS.md). Docs-only kimi-code compat checkups that don't bump the plugin version (e.g. the 0.14.2 / 0.14.3 patches) are recorded there, not here. Notable releases are summarized below; the GA entry and full pre-GA detail follow.
 
+## 2.2.0 — 2026-10-15
+
+- Port the vendored parser to unmodified smol-toml 1.9.1 JavaScript, closing
+  GHSA-r4xh-jqrq-34v2; adapt the config assignment walker and retain EOF-comment
+  protection with linear-scaling and shipped-mirror regressions.
+- Recover native-v2 timeout session IDs only from exactly one bounded, matching
+  session-store candidate: created between spawn and settlement in the job's cwd,
+  and whose main journal opens with a user message carrying the job's exact prompt
+  (`prompt_digest`), so attribution is proof, not proximity. Persist
+  announced/recovered provenance in `kimi_session_id_source`, report recovery
+  refusals in error details (`session_recovery`), skip recovery when no
+  `system.version` marker was observed, and retain the existing lineage and raw
+  journal plan-taint checks on every resume.
+- Expose `budget_source` in status and JSON results, and print inherited ask/rescue
+  budgets with their parent job at launch. Historical non-null budgets remain unknown.
+- Allow 30 seconds for installed-state spawn-heavy tests; refresh install examples
+  and preserve the settled result's abort flag in timeout details.
+- Permit deliberate plugin/CLI version-number alignment without treating the number
+  as compatibility evidence. CLI 2.2.0 remains the certified maximum, unchanged;
+  the certification table, hook policy, preflight closures and teardown remain unchanged.
+
+## 2.0.8 — 2026-10-14
+
+- Certify exact Kimi Code CLI 2.2.0 (`472192c3`) for all eight native-v2 operations under the
+  unchanged no-plan construction: four source reviews, 15/15 tag scan (all twelve pinned files
+  byte-identical to 2.1.1), plan-ON/OFF controls (bypass still reproduced; refusal still
+  load-bearing) and the full 15-test candidate smoke. Accept only the reviewed exact 2.2.0 hook
+  schema. See [certification evidence](docs/upstream-2.2.0-certification.md).
+- Add per-job `--budget` to ask, rescue, review, and challenge, with
+  defaults of 30m for ask/review/challenge and 45m for rescue, with a 24h ceiling. Detached workers
+  reload the persisted budget from SQLite; resumes inherit it unless overridden.
+  Pursue/swarm persist their effective ceilings. Backgrounding does not extend it.
+- Preserve settled partial assistant output on budget timeout (and the session ID
+  when Kimi announced it before the deadline; native v2 announces at session end). Jobs remain failed, artifacts label partial output as NOT a final
+  answer, and cancellation does not capture partial output.
+- Preserve clean, non-aborted exit-0 success at the timeout boundary; retain
+  `settled_post_abort` diagnostics for timeouts. Strip ambient workspace-trust
+  overrides from every child to prevent project MCP bootstrap outside tool hooks.
+- Remove misleading timeout race wording, expose budget/count metrics, and give
+  context-aware budget/scope advice with a pointer to the failed artifact.
+- Add stdout `--help`/`-h` for companion subcommands from shared flag definitions.
+  Review and challenge remain foreground-only.
+- Regenerate both host distributions and document budget and partial-output
+  behavior across commands, agents, and Codex skills.
+- Bump the test-only `smol-toml` dependency 1.8.0 → 1.9.1 for GHSA-r4xh-jqrq-34v2
+  (quadratic `parseKey`). The vendored 1.6.1 parser subset that the plugin ships shares
+  the bounded quadratic behaviour on the operator's own `config.toml` only; measured and
+  documented in `runtime/vendor/smol-toml/README.md`, with the 1.9.x port scheduled as its
+  own integration review.
+
 ## 2.0.7 — 2026-09-26
 
 - Add npm distribution as `kimi-plugin-cc`, with an explicit file allowlist and

package/README.md

@@ -4,7 +4,11 @@
 
 Use Kimi to explain code, review changes, challenge a design, or work toward a goal — an independent second opinion from a different model family, inside the Claude Code or Codex session you're already in.
 
-[Latest release](https://github.com/linxule/kimi-plugin-cc/releases/latest) · [Roadmap](./ROADMAP-TO-GA.md) · [Report an issue](https://github.com/linxule/kimi-plugin-cc/issues) · [Apache-2.0 license](./LICENSE)
+[![Kimi Ambassador — academia](./assets/kimi-ambassador-academia.webp)](https://www.kimi.ai/lp/kimi-ambassador)
+
+I'm a [Kimi Ambassador](https://www.kimi.ai/lp/kimi-ambassador) (academia). Kimi (Moonshot AI) supports this project through that role.
+
+[Latest release](https://github.com/linxule/kimi-plugin-cc/releases/latest) · [npm package](https://www.npmjs.com/package/kimi-plugin-cc) · [Roadmap](./ROADMAP-TO-GA.md) · [Report an issue](https://github.com/linxule/kimi-plugin-cc/issues) · [Apache-2.0 license](./LICENSE)
 
 ![Claude Code running /kimi:review on this repository, with Kimi's findings verified claim by claim in the same session](./assets/claude-code-kimi-review.jpg)
 
@@ -36,7 +40,7 @@ You need:
 - macOS or Linux
 - Claude Code or Codex with plugin support
 - Node.js 22.5 or newer
-- Kimi Code CLI 2.1.1, the recommended version for plugin 2.0.6
+- Kimi Code CLI 2.2.0 (2.1.1 also certified), the recommended version for plugin 2.2.0
 
 Windows is not currently supported. Check your versions in a terminal:
 
@@ -104,7 +108,7 @@ needed to use the package. Kimi Code CLI and Node are still prerequisites.
 For an explicitly versioned local Claude Code plugin:
 
 ```sh
-npm install --prefix ~/.local/share/kimi-plugin-cc kimi-plugin-cc@2.0.7
+npm install --prefix ~/.local/share/kimi-plugin-cc kimi-plugin-cc@2.2.0
 claude --plugin-dir ~/.local/share/kimi-plugin-cc/node_modules/kimi-plugin-cc
 ```
 
@@ -245,7 +249,7 @@ Contributors need Bun to run `bun run check`. The detailed engineering documents
 - macOS 或 Linux
 - 支持插件的 Claude Code 或 Codex
 - Node.js 22.5 或更高版本
-- Kimi Code CLI 2.1.1，这是插件 2.0.6 的推荐版本
+- Kimi Code CLI 2.2.0（2.1.1 亦已认证），这是插件 2.2.0 的推荐版本
 
 目前不支持 Windows。在终端检查版本：
 
@@ -302,6 +306,10 @@ codex plugin add kimi@kimi-marketplace
 
 如果同时使用 Claude Code 和 Codex，请分别运行 setup。两个应用各有自己的钩子，共用一份 Kimi 配置。
 
+## npm 分发（可选）
+
+完整插件也已发布到 [npm，包名为 `kimi-plugin-cc`](https://www.npmjs.com/package/kimi-plugin-cc)，包含 Claude Code 和 Codex 的预编译运行时，无需 Bun 或构建步骤。默认仍推荐上方的插件市场安装方式。需要通过 npm 安装本地 Claude Code 插件时，请参照 [npm 安装步骤](#npm-distribution-optional)。每个应用只加载一份插件；npm 不提供 `npx kimi-plugin-cc` 命令。Codex 用户继续使用上方的 GitHub 插件市场命令。
+
 ## 选择任务
 
 | 任务 | Claude Code 命令 | Codex 技能 | 文件操作范围 |
@@ -425,7 +433,7 @@ Il vous faut :
 - macOS ou Linux
 - une version de Claude Code ou de Codex prenant en charge les plugins
 - Node.js 22.5 ou une version ultérieure
-- Kimi Code CLI 2.1.1, la version recommandée pour le plugin 2.0.6
+- Kimi Code CLI 2.2.0 (2.1.1 également certifiée), la version recommandée pour le plugin 2.2.0
 
 Windows n'est pas pris en charge actuellement. Vérifiez les versions dans un terminal :
 
@@ -482,6 +490,10 @@ Utilise $kimi-ask pour expliquer le fonctionnement du point d'entrée principal
 
 Si vous utilisez Claude Code et Codex, lancez setup dans chaque application. Chacune possède son propre hook dans la configuration Kimi commune.
 
+## Distribution npm (facultative)
+
+Le plugin complet est aussi disponible sur [npm sous le nom `kimi-plugin-cc`](https://www.npmjs.com/package/kimi-plugin-cc), avec les runtimes précompilés pour Claude Code et Codex, sans Bun ni compilation. Les marketplaces ci-dessus restent le mode d'installation par défaut. Pour installer une copie locale dans Claude Code via npm, suivez les [étapes npm](#npm-distribution-optional) (en anglais). Ne chargez qu'une copie du plugin par application ; le paquet ne fournit pas de commande `npx kimi-plugin-cc`. Pour Codex, continuez à utiliser la marketplace GitHub ci-dessus.
+
 ## Choisir une tâche
 
 | Tâche | Commande Claude Code | Skill Codex | Accès aux fichiers |
@@ -605,7 +617,7 @@ Les contributeurs ont besoin de Bun pour exécuter `bun run check`. La documenta
 - macOS または Linux
 - プラグインに対応した Claude Code または Codex
 - Node.js 22.5 以降
-- Kimi Code CLI 2.1.1（プラグイン 2.0.6 の推奨バージョン）
+- Kimi Code CLI 2.2.0（2.1.1 も認証済み。プラグイン 2.2.0 の推奨バージョン）
 
 現在、Windows には対応していません。ターミナルでバージョンを確認します。
 
@@ -662,6 +674,10 @@ $kimi-ask を使って、このプロジェクトのメインのエントリー
 
 Claude Code と Codex の両方を使う場合は、それぞれで setup を実行します。共通の Kimi 設定内に、各アプリ専用のフックが作られます。
 
+## npm 配布（任意）
+
+完全なプラグインは [npm の `kimi-plugin-cc`](https://www.npmjs.com/package/kimi-plugin-cc) としても公開されています。Claude Code と Codex 向けのコンパイル済みランタイムを含み、Bun やビルド作業は不要です。通常は上記のマーケットプレイス経由でインストールしてください。npm から Claude Code 用のローカルコピーを入れる場合は、[npm のインストール手順](#npm-distribution-optional)（英語）を参照してください。各アプリで読み込むプラグインは一つにし、重複させないでください。`npx kimi-plugin-cc` コマンドはありません。Codex では引き続き上記の GitHub マーケットプレイスを使います。
+
 ## タスクを選ぶ
 
 | タスク | Claude Code コマンド | Codex スキル | ファイル操作の範囲 |

package/agents/kimi-ask.md

@@ -39,6 +39,8 @@ For subscription auth, guide native Kimi `/login`; for API keys or other provide
 
 When invoked:
 
+- preserve `--budget <dur>` (default 30m; `30m`, `1h`, `90s`, or bare minutes, maximum 24h). Backgrounding does not extend this budget. A timed-out job remains failed and its artifact holds partial assistant output labeled NOT a final answer; read it with `result <jobId>` or `result <jobId> --json`. A session ID is kept if Kimi announced it or, on a native-v2 budget timeout, recovered from the session store when exactly one session matches this spawn — created between spawn and settlement in the same directory AND whose journal opens with this job's exact prompt; `result --json` identifies the source in `kimi_session_id_source`, and `error.details.session_recovery` says why no ID was recovered (`none`, `journal_missing:<n>`, `digest_mismatch:<n>`, `ambiguous:<n>`, `enumeration_capped`, `engine_unobserved`). Cancellation does not capture partial output. A resume without `--budget` inherits the parent job's budget; an explicit budget overrides it. Inherited budgets are printed to stderr at launch; status and `result --json` expose `budget_source` (`explicit`, `inherited`, or `default`; old non-null budgets report `unknown`).
+
 - decide whether the task belongs to free-form ask rather than diff review (kimi-review / kimi-challenge) or implementation (kimi-rescue)
 - preserve the user's question text and flags exactly — rephrasing a free-form prompt loses the user's framing; pass `--background` / `--wait` when the user supplies them
 - call the shared companion runtime with one Bash invocation after any model-discovery step: `${CLAUDE_PLUGIN_ROOT}/scripts/companion.sh ask <args>`
@@ -47,6 +49,7 @@ When invoked:
 - choose foreground for focused, bounded questions that are likely to complete quickly
 - choose background (`--background`) for broad, open-ended, or long-running questions where the user does not need an immediate answer
 - when ask starts in background, return the `job_id` so the main thread can use `/kimi:status`, `/kimi:result`, or `/kimi:cancel`
+- a background job's completion is observable ONLY through `/kimi:status` / `/kimi:result <jobId>` (or `companion.sh status` / `result`). No notification reaches the caller when it finishes — the orchestrator re-checks on its own schedule (every few minutes for a long job) and never concludes a job is still running from the absence of a notification. If `result` reports a budget timeout, the artifact holds the partial output.
 - `/kimi:result <jobId> --json` returns a structured envelope with metadata plus the artifact body.
 - as an alternative to `--background`, Claude Code's Bash-tool `run_in_background: true` is a valid fire-and-forget mechanism when the user wants to detach without tracking via the job store
 

package/agents/kimi-challenge.md

@@ -39,11 +39,13 @@ For subscription auth, guide native Kimi `/login`; for API keys or other provide
 
 When invoked:
 
+- preserve `--budget <dur>` (default 30m; `30m`, `1h`, `90s`, or bare minutes, maximum 24h). Backgrounding does not extend this budget. A timed-out job remains failed and its artifact holds partial assistant output labeled NOT a final answer; read it with `result <jobId>` or `result <jobId> --json`. A session ID is kept if Kimi announced it or, on a native-v2 budget timeout, recovered from the session store when exactly one session matches this spawn — created between spawn and settlement in the same directory AND whose journal opens with this job's exact prompt; `result --json` identifies the source in `kimi_session_id_source`, and `error.details.session_recovery` says why no ID was recovered (`none`, `journal_missing:<n>`, `digest_mismatch:<n>`, `ambiguous:<n>`, `enumeration_capped`, `engine_unobserved`). Cancellation does not capture partial output.
+
 - decide whether the task belongs to adversarial challenge review rather than ordinary defect review (see kimi-review)
 - preserve any focus text the user supplies after the flags — the user's framing is what steers the challenge
 - call the shared companion runtime with one Bash invocation after any model-discovery step: `${CLAUDE_PLUGIN_ROOT}/scripts/companion.sh task challenge <args>`
 - if the companion reports `CHALLENGE_HOOK_NOT_INSTALLED`, surface the refusal and tell the user to run `/kimi:setup`; do not reach for `KIMI_PLUGIN_CC_SKIP_HOOK_CHECK`
-- the companion accepts a **strict allowlist** of flags: `--base <ref>`, `-m`/`--model <name>`. Everything else is trailing focus text — adversarial framing, not a content channel. Reasoning behavior follows the selected model and Kimi configuration; the parser hard-rejects `--thinking`/`--no-thinking`
+- the companion accepts a **strict allowlist** of flags: `--base <ref>`, `-m`/`--model <name>`, `--budget <dur>`. Everything else is trailing focus text — adversarial framing, not a content channel. Reasoning behavior follows the selected model and Kimi configuration; the parser hard-rejects `--thinking`/`--no-thinking`
 - do not invent flags (`--file`, `--context`, `--path`, etc.). The runtime hard-fails with `INVALID_ARGS` on unknown flag-shaped tokens. If you need to attach file content or extended context, switch to `kimi-ask` or paste a brief summary into the focus text — challenge's payload is the git diff, not arbitrary file content
 - do not pass `--background` or `--wait` to the companion — the runtime rejects both with `INVALID_FLAGS` for review and challenge
 - if the user wants fire-and-forget behavior on a broad challenge, detach the Bash call itself with `run_in_background: true` instead of reaching for a companion flag; after launching, tell the user to check `/kimi:status` for progress

package/agents/kimi-rescue.md

@@ -44,12 +44,15 @@ For subscription auth, guide native Kimi `/login`; for API keys or other provide
 
 When invoked:
 
+- preserve `--budget <dur>` (default 45m; `30m`, `1h`, `90s`, or bare minutes, maximum 24h). Backgrounding does not extend this budget. A timed-out job remains failed and its artifact holds partial assistant output labeled NOT a final answer; read it with `result <jobId>` or `result <jobId> --json`. A session ID is kept if Kimi announced it or, on a native-v2 budget timeout, recovered from the session store when exactly one session matches this spawn — created between spawn and settlement in the same directory AND whose journal opens with this job's exact prompt; `result --json` identifies the source in `kimi_session_id_source`, and `error.details.session_recovery` says why no ID was recovered (`none`, `journal_missing:<n>`, `digest_mismatch:<n>`, `ambiguous:<n>`, `enumeration_capped`, `engine_unobserved`). Cancellation does not capture partial output. A resume without `--budget` inherits the parent job's budget; an explicit budget overrides it. Inherited budgets are printed to stderr at launch; status and `result --json` expose `budget_source` (`explicit`, `inherited`, or `default`; old non-null budgets report `unknown`).
+
 - decide whether the task belongs to rescue rather than read-only review or ask
 - preserve the user's task text and explicit constraints with minimal reframing
 - choose foreground only for tightly bounded rescue work that is likely to finish quickly
 - choose background for open-ended debugging, multi-step implementation, or anything likely to run long
 - call the shared companion runtime instead of inspecting the repository or orchestrating the task yourself
 - when rescue starts, return the `job_id` so the main thread can use `/kimi:status`, `/kimi:result`, or `/kimi:cancel`
+- a background job's completion is observable ONLY through `/kimi:status` / `/kimi:result <jobId>` (or `companion.sh status` / `result`). No notification reaches the caller when it finishes — the orchestrator re-checks on its own schedule (every few minutes for a long job) and never concludes a job is still running from the absence of a notification. If `result` reports a budget timeout, the artifact holds the partial output.
 - `/kimi:result <jobId> --json` returns a structured envelope with metadata plus the artifact body.
 
 When rescue completes:

package/agents/kimi-review.md

@@ -39,11 +39,13 @@ For subscription auth, guide native Kimi `/login`; for API keys or other provide
 
 When invoked:
 
+- preserve `--budget <dur>` (default 30m; `30m`, `1h`, `90s`, or bare minutes, maximum 24h). Backgrounding does not extend this budget. A timed-out job remains failed and its artifact holds partial assistant output labeled NOT a final answer; read it with `result <jobId>` or `result <jobId> --json`. A session ID is kept if Kimi announced it or, on a native-v2 budget timeout, recovered from the session store when exactly one session matches this spawn — created between spawn and settlement in the same directory AND whose journal opens with this job's exact prompt; `result --json` identifies the source in `kimi_session_id_source`, and `error.details.session_recovery` says why no ID was recovered (`none`, `journal_missing:<n>`, `digest_mismatch:<n>`, `ambiguous:<n>`, `enumeration_capped`, `engine_unobserved`). Cancellation does not capture partial output.
+
 - decide whether the task belongs to a diff review rather than a free-form ask or a write-capable rescue
 - preserve the user's scope hints (`--base <ref>`, focus text) with minimal reframing
 - call the shared companion runtime with one Bash invocation after any model-discovery step: `${CLAUDE_PLUGIN_ROOT}/scripts/companion.sh review <args>`
 - if the companion reports `REVIEW_HOOK_NOT_INSTALLED`, surface the refusal and tell the user to run `/kimi:setup`; do not reach for `KIMI_PLUGIN_CC_SKIP_HOOK_CHECK`
-- the companion accepts a **strict allowlist** of flags: `--base <ref>`, `-m`/`--model <name>`. Everything else is trailing focus text — a short scope hint, not a content channel. Reasoning behavior follows the selected model and Kimi configuration; the parser hard-rejects `--thinking`/`--no-thinking`
+- the companion accepts a **strict allowlist** of flags: `--base <ref>`, `-m`/`--model <name>`, `--budget <dur>`. Everything else is trailing focus text — a short scope hint, not a content channel. Reasoning behavior follows the selected model and Kimi configuration; the parser hard-rejects `--thinking`/`--no-thinking`
 - do not invent flags (`--file`, `--context`, `--path`, etc.). The runtime hard-fails with `INVALID_ARGS` on unknown flag-shaped tokens. If you need to attach file content or extended context, switch to `kimi-ask` or paste a brief summary into the focus text — review's payload is the git diff, not arbitrary file content
 - do not pass `--background` or `--wait` to the companion — the runtime rejects both with `INVALID_FLAGS` for review and challenge
 - if the user wants fire-and-forget behavior on a long review (multi-file diff, unclear scope), detach the Bash call itself with `run_in_background: true` instead of reaching for a companion flag; after launching, tell the user to check `/kimi:status` for progress

package/commands/ask.md

@@ -1,6 +1,6 @@
 ---
 description: Ask Kimi a read-only question in free-form prose mode.
-argument-hint: "[--background] [--wait] [-r | --resume <id>] [--fresh] [-m <model>] <prompt>"
+argument-hint: "[--budget <30m|1h|90s>] [--background] [--wait] [-r | --resume <id>] [--fresh] [-m <model>] <prompt>"
 disable-model-invocation: true
 ---
 
@@ -10,6 +10,8 @@ Run the companion with any user-supplied flags appended after `ask`:
 
 Supported flags:
 
+- `--budget <dur>` — wall-clock ceiling (default 30m; `30m`, `1h`, `90s`, or bare minutes; maximum 24h)
+
 - `--background` — spawn as a background job and return `{job_id}` immediately
 - `--wait` — combined with `--background`, block until terminal state and return the rendered answer
 - `-r` — resume the latest ask session for the current repo; any trailing text becomes the next prompt
@@ -17,7 +19,9 @@ Supported flags:
 - `--fresh` — force a new ask session id instead of reusing a prior session
 - `-m`, `--model <name>`
 
-Reasoning behavior follows the selected model and Kimi configuration. The plugin does not force a thinking mode. The 15-minute budget leaves room for extended reasoning.
+Reasoning behavior follows the selected model and Kimi configuration. The plugin does not force a thinking mode. The default budget is 30m; use `--budget` to change it. Backgrounding does not extend the runtime budget.
+
+A budget timeout leaves the job `failed` and saves any partial assistant prose in its artifact, labeled **NOT a final answer**. Read it with `result <jobId>` or `result <jobId> --json`; tool-only runs explicitly report no assistant prose. A session ID is kept if Kimi announced it or, on a native-v2 budget timeout, recovered from the session store when exactly one session matches this spawn — created between spawn and settlement in the same directory AND whose journal opens with this job's exact prompt; `result --json` identifies the source in `kimi_session_id_source`, and `error.details.session_recovery` says why no ID was recovered (`none`, `journal_missing:<n>`, `digest_mismatch:<n>`, `ambiguous:<n>`, `enumeration_capped`, `engine_unobserved`). Cancellation does not capture partial output. A resume without `--budget` inherits the parent job's budget; an explicit budget overrides it. Inherited budgets are printed to stderr at launch; status and `result --json` expose `budget_source` (`explicit`, `inherited`, or `default`; old non-null budgets report `unknown`). Use `--help` or `-h` among the leading flags for usage; once prompt text starts, `-h` is part of the prompt. Other failures (nonzero exit, cancellation) do not capture partial output.
 
 Return the companion stdout verbatim.
 

package/commands/challenge.md

@@ -1,6 +1,6 @@
 ---
 description: Run a read-only Kimi challenge review that challenges assumptions and surfaces safer alternatives.
-argument-hint: "[--base <ref>] [-m <model>] [extra prose]"
+argument-hint: "[--budget <30m|1h|90s>] [--base <ref>] [-m <model>] [extra prose]"
 disable-model-invocation: true
 ---
 
@@ -10,11 +10,15 @@ Run the companion with any user-supplied flags appended after `task challenge`:
 
 Supported flags:
 
+- `--budget <dur>` — wall-clock ceiling (default 30m; `30m`, `1h`, `90s`, or bare minutes; maximum 24h)
+
 - `--base <ref>` — challenge against a branch/commit diff instead of the working tree
 - `-m`, `--model <name>`
 - trailing text — adversarial focus or framing to steer the challenge
 
-Reasoning behavior follows the selected model and Kimi configuration. The plugin does not force a thinking mode. Budget is 30 min so adversarial review has time to dig. Challenge runs foreground-synchronously; it does not support `--background` or `--wait`.
+Reasoning behavior follows the selected model and Kimi configuration. The plugin does not force a thinking mode. The default budget is 30m; use `--budget` to change it. Challenge runs foreground-synchronously; it does not support `--background` or `--wait`.
+
+A budget timeout leaves the job `failed` and saves any partial assistant prose in its artifact, labeled **NOT a final answer**. Read it with `result <jobId>` or `result <jobId> --json`; tool-only runs explicitly report no assistant prose. A session ID is kept if Kimi announced it or, on a native-v2 budget timeout, recovered from the session store when exactly one session matches this spawn — created between spawn and settlement in the same directory AND whose journal opens with this job's exact prompt; `result --json` identifies the source in `kimi_session_id_source`, and `error.details.session_recovery` says why no ID was recovered (`none`, `journal_missing:<n>`, `digest_mismatch:<n>`, `ambiguous:<n>`, `enumeration_capped`, `engine_unobserved`). Cancellation does not capture partial output. Use `--help` or `-h` among the leading flags for usage; once prompt text starts, `-h` is part of the prompt. Other failures (nonzero exit, cancellation) do not capture partial output.
 
 Return the companion stdout verbatim.
 

package/commands/rescue.md

@@ -1,6 +1,6 @@
 ---
 description: Run a write-capable Kimi rescue against the current repository with optional background execution and resume behavior.
-argument-hint: "[--background] [--wait] [-r | --resume <id>] [--fresh] [-m <model>] <prompt>"
+argument-hint: "[--budget <30m|1h|90s>] [--background] [--wait] [-r | --resume <id>] [--fresh] [-m <model>] <prompt>"
 disable-model-invocation: true
 ---
 
@@ -10,6 +10,8 @@ Run the companion with any user-supplied flags appended after `task rescue`:
 
 Supported flags:
 
+- `--budget <dur>` — wall-clock ceiling (default 45m; `30m`, `1h`, `90s`, or bare minutes; maximum 24h)
+
 - `--background` — spawn as a detached background job and return `{job_id}` immediately
 - `--wait` — combined with `--background`, block until terminal state and return the rendered result
 - `-r` — resume the latest rescue session for the current repo; any trailing text becomes the next prompt
@@ -17,7 +19,9 @@ Supported flags:
 - `--fresh` — force a new rescue session id instead of reusing a prior session
 - `-m`, `--model <name>`
 
-Reasoning behavior follows the selected model and Kimi configuration. The plugin does not force a thinking mode. Budget is 30 min for multi-step apply/test/verify loops; use `--background` to return control while the task runs. Backgrounding does not extend the runtime budget.
+Reasoning behavior follows the selected model and Kimi configuration. The plugin does not force a thinking mode. The default budget is 45m; use `--budget` to change it for multi-step apply/test/verify loops; use `--background` to return control while the task runs. Backgrounding does not extend the runtime budget.
+
+A budget timeout leaves the job `failed` and saves any partial assistant prose in its artifact, labeled **NOT a final answer**. Read it with `result <jobId>` or `result <jobId> --json`; tool-only runs explicitly report no assistant prose. A session ID is kept if Kimi announced it or, on a native-v2 budget timeout, recovered from the session store when exactly one session matches this spawn — created between spawn and settlement in the same directory AND whose journal opens with this job's exact prompt; `result --json` identifies the source in `kimi_session_id_source`, and `error.details.session_recovery` says why no ID was recovered (`none`, `journal_missing:<n>`, `digest_mismatch:<n>`, `ambiguous:<n>`, `enumeration_capped`, `engine_unobserved`). Cancellation does not capture partial output. A resume without `--budget` inherits the parent job's budget; an explicit budget overrides it. Inherited budgets are printed to stderr at launch; status and `result --json` expose `budget_source` (`explicit`, `inherited`, or `default`; old non-null budgets report `unknown`). Use `--help` or `-h` among the leading flags for usage; once prompt text starts, `-h` is part of the prompt. Other failures (nonzero exit, cancellation) do not capture partial output.
 
 Return the companion stdout verbatim.
 

package/commands/review.md

@@ -1,6 +1,6 @@
 ---
 description: Run a read-only Kimi review over the current working tree changes or a base ref diff.
-argument-hint: "[--base <ref>] [-m <model>] [extra prose]"
+argument-hint: "[--budget <30m|1h|90s>] [--base <ref>] [-m <model>] [extra prose]"
 disable-model-invocation: true
 ---
 
@@ -10,11 +10,15 @@ Run the companion with any user-supplied flags appended after `review`:
 
 Supported flags:
 
+- `--budget <dur>` — wall-clock ceiling (default 30m; `30m`, `1h`, `90s`, or bare minutes; maximum 24h)
+
 - `--base <ref>` — review against a branch/commit diff instead of the working tree
 - `-m`, `--model <name>`
 - trailing text — optional focus hint for the review
 
-Reasoning behavior follows the selected model and Kimi configuration. The plugin does not force a thinking mode. Budget is 30 min so a real workspace-wide analysis has headroom. Review runs foreground-synchronously; it does not support `--background` or `--wait`.
+Reasoning behavior follows the selected model and Kimi configuration. The plugin does not force a thinking mode. The default budget is 30m; use `--budget` to change it. Review runs foreground-synchronously; it does not support `--background` or `--wait`.
+
+A budget timeout leaves the job `failed` and saves any partial assistant prose in its artifact, labeled **NOT a final answer**. Read it with `result <jobId>` or `result <jobId> --json`; tool-only runs explicitly report no assistant prose. A session ID is kept if Kimi announced it or, on a native-v2 budget timeout, recovered from the session store when exactly one session matches this spawn — created between spawn and settlement in the same directory AND whose journal opens with this job's exact prompt; `result --json` identifies the source in `kimi_session_id_source`, and `error.details.session_recovery` says why no ID was recovered (`none`, `journal_missing:<n>`, `digest_mismatch:<n>`, `ambiguous:<n>`, `enumeration_capped`, `engine_unobserved`). Cancellation does not capture partial output. Use `--help` or `-h` among the leading flags for usage; once prompt text starts, `-h` is part of the prompt. Other failures (nonzero exit, cancellation) do not capture partial output.
 
 Return the companion stdout verbatim.
 

package/dist/cli-client.js

@@ -84,7 +84,9 @@ export async function runCliPrompt(opts) {
         });
     }
     let child;
+    let spawnedAt;
     try {
+        spawnedAt = Date.now();
         child = spawn(opts.command, args, {
             cwd: opts.cwd,
             env,
@@ -329,7 +331,7 @@ export async function runCliPrompt(opts) {
                     return;
                 }
                 if (kind === "resolve")
-                    resolve(payload);
+                    resolve({ ...payload, settledAt: Date.now() });
                 else
                     reject(payload);
             });
@@ -580,6 +582,8 @@ export async function runCliPrompt(opts) {
             // The result itself is in memory; diagnostics are best-effort.
             await raceWithTimeout(logChain, LOG_DRAIN_TIMEOUT_MS);
             settle("resolve", {
+                spawnedAt,
+                settledAt: 0, // Filled at settlement, after the teardown barrier.
                 sessionId,
                 goalSummary: announcedGoalSummary,
                 systemVersion: announcedSystemVersion,
@@ -656,6 +660,27 @@ export function requireSessionId(result, context) {
         },
     });
 }
+/** Settled timeout data; stream records are deliberately non-serializable.
+ * Without a partial result (teardown rejection), aborted means abort was issued,
+ * not that the process was observed aborting. */
+export class ResponseTimeoutError extends RuntimeError {
+    constructor(budgetMs, stage, commandLabel, partialResult, cause) {
+        super("RESPONSE_TIMEOUT", `${stage} timed out after ${budgetMs}ms.`, stage, {
+            ...(cause instanceof Error ? { cause } : {}),
+            details: {
+                budget_ms: budgetMs,
+                command_label: commandLabel ?? null,
+                record_count: partialResult?.records.length ?? 0,
+                partial_output_chars: partialResult?.records.reduce((count, record) => count + (record.role === "assistant" && typeof record.content === "string" ? record.content.length : 0), 0) ?? 0,
+                aborted: partialResult?.aborted ?? true,
+                ...(partialResult ? { settled_post_abort: true } : {}),
+            },
+        });
+        this.name = "ResponseTimeoutError";
+        // Never serialize stream records into job error details or error envelopes.
+        Object.defineProperty(this, "partialResult", { value: partialResult, enumerable: false });
+    }
+}
 /**
  * Run `kimi -p` under a budget that also tells the subprocess to die
  * when the budget expires.
@@ -682,7 +707,8 @@ export function requireSessionId(result, context) {
  *     subprocess/tree teardown, then reject with
  *     `RuntimeError("RESPONSE_TIMEOUT", …)` matching the legacy
  *     `withTimeout` code shape.
- *   - Result success path is unchanged from `runCliPrompt`.
+ *   - A clean non-aborted exit-0 result wins same-tick budget expiry.
+ *     Otherwise a settled result on timeout is carried as partial output.
  */
 export async function runCliPromptWithBudget(opts, budgetMs, stage) {
     const controller = new AbortController();
@@ -698,12 +724,7 @@ export async function runCliPromptWithBudget(opts, budgetMs, stage) {
         controller.abort();
     }, budgetMs);
     timer.unref();
-    const timeoutError = (raceDetected = false) => new RuntimeError("RESPONSE_TIMEOUT", `${stage} timed out after ${budgetMs}ms${raceDetected ? " (race detected post-result)" : ""}.`, stage, {
-        details: {
-            budget_ms: budgetMs,
-            command_label: opts.commandLabel ?? null,
-        },
-    });
+    const timeoutError = (partialResult, cause) => new ResponseTimeoutError(budgetMs, stage, opts.commandLabel, partialResult, cause);
     try {
         let result;
         try {
@@ -714,13 +735,13 @@ export async function runCliPromptWithBudget(opts, budgetMs, stage) {
         }
         catch (error) {
             if (timeoutFired)
-                throw timeoutError();
+                throw timeoutError(undefined, error);
             throw error;
         }
-        if (timeoutFired) {
-            // The timer and close can become runnable in the same event-loop turn.
-            // Teardown has still completed because runCliPrompt settled first.
-            throw timeoutError(true);
+        if (timeoutFired && (result.aborted || result.exitCode !== 0)) {
+            // A clean, non-aborted result won the settle/timeout boundary and is success.
+            // Budget aborts normally resolve with records, after owned teardown settles.
+            throw timeoutError(result);
         }
         return result;
     }
@@ -770,6 +791,8 @@ function buildArgs(opts) {
 }
 function buildEnv(opts) {
     const env = { ...opts.env };
+    // 2.2.0 audit: ambient trust starts project MCP stdio servers outside PreToolUse.
+    delete env.KIMI_CODE_TRUST_WORKSPACE;
     // kimi-code 0.33.0 inverted its CLI engine default: an unflagged `kimi -p`
     // now selects native agent-core-v2, while this upstream-documented flag pins
     // the legacy-v1 path. Native v2 still has a final-allow plan-file path that

package/dist/commands/ask.js

@@ -1,3 +1,4 @@
+import { companionHelp } from "../help.js";
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 import { createCliCancellationHandlers } from "../cli-cancellation.js";
@@ -16,7 +17,7 @@ import { readArtifact, renderManagedJobOutput, writeArtifact } from "../render.j
 import { classifyManagedCommandFailure } from "../kimi-errors.js";
 import { startBackgroundJob } from "../background-spawn.js";
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
-import { assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
+import { warnInheritedBudget, captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
 // v1.0 cutover note (PR 2):
 //
@@ -46,6 +47,8 @@ const ASK_PROMPT_PREFIX = [
 ].join("\n");
 export async function runAsk(argv, context) {
     const parsed = parseAskArgs(argv);
+    if (parsed.help)
+        return companionHelp(["ask", ...argv]);
     if (context.env.KIMI_PLUGIN_CC_SKIP_HOOK_CHECK !== "1") {
         await requireAskHookInstalled(context);
     }
@@ -76,10 +79,14 @@ export async function runAsk(argv, context) {
             model: parsed.model ?? null,
             thinking: parsed.thinking ?? null,
             background: parsed.background,
+            budget_ms: parsed.budgetMs ?? (sessionResolution.sourceJob?.operation_kind === "ask" ? sessionResolution.sourceJob.budget_ms : null) ?? null,
+            budget_source: parsed.budgetMs !== undefined ? "explicit"
+                : sessionResolution.sourceJob?.operation_kind === "ask" && sessionResolution.sourceJob.budget_ms !== null ? "inherited" : "default",
             pid: parsed.background ? null : process.pid,
             kimi_pid: null,
             status: "running",
             kimi_session_id: sessionResolution.kimiSessionId,
+            kimi_session_id_source: sessionResolution.sourceJob?.kimi_session_id_source ?? null,
             ...persistedExecutionPlanFields(executionPlan),
             agent_profile: ASK_AGENT_PROFILE_PLACEHOLDER,
             prompt_digest: digestPrompt(askPrompt),
@@ -101,6 +108,7 @@ export async function runAsk(argv, context) {
             await markJobFailed(store, paths, job, classified, askConfig.cancellation.failedSummary, { phase: "failed" });
             throw classified;
         }
+        warnInheritedBudget(job, context.stderr);
         if (parsed.background) {
             return startBackgroundJob(job, askPrompt, context, paths, {
                 workerKind: "ask",
@@ -169,7 +177,7 @@ export async function executeAskJob(jobId, prompt, context, options) {
             resumeSessionId: job.kimi_session_id ?? undefined,
             logPath: job.stream_log_path,
             signal: handlers.signal,
-        }, KIMI_ASK_PROMPT_TIMEOUT_MS, "ask.prompt");
+        }, job.budget_ms ?? KIMI_ASK_PROMPT_TIMEOUT_MS, "ask.prompt");
         store.updateRunningJob(job.job_id, observedExecutionFields(result));
         if (handlers.cancelling) {
             throw new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.afterPrompt, "ask.runtime");
@@ -180,12 +188,11 @@ export async function executeAskJob(jobId, prompt, context, options) {
         // sessions it should match the input, but capture anyway in case
         // kimi-code mints a new id on each turn.
         if (result.sessionId !== undefined &&
-            result.sessionId.length > 0 &&
-            result.sessionId !== job.kimi_session_id) {
+            result.sessionId.length > 0) {
             // length>0 guard: empty-string capture would poison the row. The
             // warning helper's null-ish check would also fire but only after
             // the bad write. (Kimi alpha.4 challenge finding #3.)
-            store.updateRunningJob(job.job_id, { kimi_session_id: result.sessionId });
+            store.updateRunningJob(job.job_id, { kimi_session_id_source: "announced", kimi_session_id: result.sessionId });
         }
         await syncKimiSessionTitle({
             promptText: prompt,
@@ -215,6 +222,9 @@ export async function executeAskJob(jobId, prompt, context, options) {
         }) ?? job);
     }
     catch (error) {
+        const classified = error instanceof RuntimeError && error.stage === "ask.hook-check" ? error
+            : classifyManagedCommandFailure(error, "ask", job.job_id, { background: job.background, budgetMs: job.budget_ms ?? KIMI_ASK_PROMPT_TIMEOUT_MS });
+        const partialOutput = await captureTimeoutPartialOutput(classified, store, job, context.env, handlers?.signal);
         if (handlers?.cancelling) {
             const cancelledError = new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.default, "ask.runtime", error instanceof Error ? { cause: error } : undefined);
             return await markJobCancelled(store, paths, job, cancel.cancelledSummary, cancelledError, { phase: "cancelled" });
@@ -227,8 +237,7 @@ export async function executeAskJob(jobId, prompt, context, options) {
             await markJobFailed(store, paths, job, error, cancel.failedSummary, { phase: "failed" });
             throw error;
         }
-        const classified = classifyManagedCommandFailure(error, "ask", job.job_id);
-        await markJobFailed(store, paths, job, classified, cancel.failedSummary, { phase: "failed" });
+        await markJobFailed(store, paths, job, classified, cancel.failedSummary, { phase: "failed", partialOutput });
         throw classified;
     }
     finally {