kimi-plugin-cc 2.0.7

package/dist/commands/repair-sessions.js

@@ -0,0 +1,159 @@
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { RuntimeError } from "../errors.js";
+import { resolveRepoIdentity } from "../git.js";
+import { digestPrompt } from "../jobs.js";
+import { resolvePluginPaths } from "../paths.js";
+import { syncKimiSessionTitle } from "../session-title.js";
+// Repair is deliberately finite and local. Stream logs may be very large, but
+// the spawn record follows the invocation header: read only a bounded prefix.
+const MAX_JOBS = 1000;
+const MAX_SPAWN_BYTES = 2 * 1024 * 1024;
+export async function runRepairSessions(argv, context) {
+    const seen = new Set();
+    for (const arg of argv) {
+        if ((arg !== "--apply" && arg !== "--all") || seen.has(arg)) {
+            throw new RuntimeError("INVALID_ARGS", "Usage: repair-sessions [--apply] [--all]", "repair-sessions.args");
+        }
+        seen.add(arg);
+    }
+    const apply = seen.has("--apply");
+    const all = seen.has("--all");
+    const paths = resolvePluginPaths(context.env);
+    const repoId = all ? undefined : (await resolveRepoIdentity(context.cwd)).repoId;
+    const jobs = await readRepairJobs(paths.stateDbPath, repoId);
+    const sessions = new Set();
+    const results = [];
+    for (const job of jobs) {
+        if (sessions.has(job.kimi_session_id))
+            continue;
+        sessions.add(job.kimi_session_id);
+        const promptText = await readVerifiedPrompt(job, paths.logsDir, paths.worktreesDir);
+        const status = promptText === undefined
+            ? "unavailable-verified-prompt"
+            : await syncKimiSessionTitle({
+                env: context.env,
+                cwd: job.cwd,
+                sessionId: job.kimi_session_id,
+                title: "",
+                promptText,
+                dryRun: !apply,
+                preserveTitle: true,
+                requireNativeV2: true,
+                stderr: context.stderr,
+            });
+        results.push({ job_id: job.job_id, session_id: job.kimi_session_id, status });
+    }
+    const counts = {};
+    for (const { status } of results)
+        counts[status] = (counts[status] ?? 0) + 1;
+    return `${JSON.stringify({ mode: apply ? "apply" : "dry-run", scope: all ? "host" : "repository", sessions: results.length, counts, results }, null, 2)}\n`;
+}
+async function readRepairJobs(filename, repoId) {
+    try {
+        const stats = await lstat(filename);
+        if (!stats.isFile() || stats.isSymbolicLink()) {
+            throw new RuntimeError("SESSION_REPAIR_UNSAFE_STORE", "Repair requires a regular, non-symlink job database.", "repair-sessions.store");
+        }
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const require = createRequire(import.meta.url);
+    // Bind constructors before `new`: compiler emission must not turn the
+    // module-loader call into the constructor (new require(...).Database).
+    const db = (() => {
+        if (typeof Bun !== "undefined") {
+            const { Database } = require("bun:sqlite");
+            return new Database(filename, { readonly: true });
+        }
+        const { DatabaseSync } = require("node:sqlite");
+        return new DatabaseSync(filename, { readOnly: true });
+    })();
+    try {
+        // Never construct JobStore here: it performs migrations and stale-row
+        // reconciliation. Both preview and apply keep plugin job data read-only.
+        const columns = db.prepare("PRAGMA table_info(jobs)").all();
+        const names = new Set(columns.map((column) => column.name));
+        const required = ["job_id", "repo_id", "command_type", "operation_kind", "status", "kimi_session_id", "cwd", "kimi_version", "intended_engine", "observed_engine", "stream_log_path", "prompt_digest", "updated_at"];
+        if (required.some((name) => !names.has(name)))
+            return [];
+        const rows = db.prepare(`
+      SELECT j.job_id, j.repo_id, j.operation_kind, j.kimi_session_id, j.cwd, j.kimi_version, j.stream_log_path, j.prompt_digest
+      FROM jobs j
+      WHERE j.status = 'completed' AND j.intended_engine = 'native-v2' AND j.observed_engine = 'native-v2'
+        AND j.command_type != 'review_gate'
+        AND j.operation_kind IN ('ask', 'review', 'challenge', 'rescue', 'pursue', 'swarm', 'swarm-write')
+        AND j.kimi_session_id IS NOT NULL AND length(trim(j.kimi_session_id)) > 0
+        AND j.kimi_version IS NOT NULL
+        ${repoId === undefined ? "" : "AND j.repo_id = ?"}
+        AND NOT EXISTS (SELECT 1 FROM jobs active WHERE active.kimi_session_id = j.kimi_session_id AND active.status = 'running')
+      ORDER BY j.updated_at DESC, j.job_id DESC LIMIT ${MAX_JOBS + 1}
+    `).all(...(repoId === undefined ? [] : [repoId]));
+        if (rows.length > MAX_JOBS) {
+            throw new RuntimeError("SESSION_REPAIR_LIMIT", `More than ${MAX_JOBS} eligible jobs; narrow the repair to one repository.`, "repair-sessions.store");
+        }
+        return rows;
+    }
+    finally {
+        db.close();
+    }
+}
+async function readVerifiedPrompt(job, logsDir, worktreesDir) {
+    // All plugin stream logs are direct children. Refuse nested/escaped paths,
+    // symlinks and special files; opening nonblocking avoids FIFO hangs.
+    if (!path.isAbsolute(job.stream_log_path) || path.dirname(job.stream_log_path) !== logsDir)
+        return undefined;
+    try {
+        const root = await lstat(logsDir);
+        if (!root.isDirectory() || root.isSymbolicLink())
+            return undefined;
+        const file = await open(job.stream_log_path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stats = await file.stat();
+            if (!stats.isFile())
+                return undefined;
+            const buffer = Buffer.alloc(MAX_SPAWN_BYTES + 1);
+            const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+            const prefix = buffer.subarray(0, bytesRead).toString("utf8");
+            const lines = prefix.split("\n");
+            // A prefix cut mid-record must never be treated as a complete JSON line.
+            if (bytesRead > MAX_SPAWN_BYTES)
+                lines.pop();
+            for (const line of lines.slice(0, 32)) {
+                if (!line.trim())
+                    continue;
+                const record = JSON.parse(line);
+                if (record.event !== "spawn") {
+                    if (record.direction === "meta")
+                        continue;
+                    return undefined;
+                }
+                const expectedCwd = job.operation_kind === "swarm-write"
+                    ? path.join(worktreesDir, job.repo_id, `swarm-write-${job.job_id}`)
+                    : job.cwd;
+                if (record.intended_engine !== "native-v2" || record.kimi_version !== job.kimi_version ||
+                    record.operation_kind !== job.operation_kind || record.cwd !== expectedCwd)
+                    return undefined;
+                if (!Array.isArray(record.args) || record.args.length < 2)
+                    return undefined;
+                const args = record.args;
+                const prompt = args[args.length - 1];
+                if (args[args.length - 2] !== "-p" || typeof prompt !== "string" || !prompt.trim())
+                    return undefined;
+                return digestPrompt(prompt) === job.prompt_digest ? prompt : undefined;
+            }
+            return undefined;
+        }
+        finally {
+            await file.close();
+        }
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/commands/replay.js

@@ -0,0 +1,123 @@
+import { access, stat, readFile } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { RuntimeError } from "../errors.js";
+import { resolveRepoIdentity } from "../git.js";
+import { withJobStore } from "../job-store.js";
+import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
+import { renderManagedJobOutput } from "../render.js";
+import { sweepStaleJobs } from "../jobs.js";
+const MAX_REPLAY_LOG_BYTES = 32 * 1024 * 1024;
+export async function runReplay(argv, context) {
+    const [jobId, ...rest] = argv;
+    if (!jobId || rest.length > 0) {
+        throw new RuntimeError("INVALID_ARGS", "replay expects exactly one job id: replay <job-id>.", "replay.parse");
+    }
+    const paths = resolvePluginPaths(context.env);
+    await ensurePluginPaths(paths);
+    const repoIdentity = await resolveRepoIdentity(context.cwd);
+    return withJobStore(paths, async (store) => {
+        await sweepStaleJobs(store, paths);
+        const job = store.getJob(jobId);
+        if (!job || job.repo_id !== repoIdentity.repoId) {
+            throw new RuntimeError("JOB_NOT_FOUND", `No job matched ${jobId} for replay.`, "replay.lookup");
+        }
+        const replayed = await replayJob(job);
+        return `${replayed.rendered}${replayed.rendered.endsWith("\n") ? "" : "\n"}`;
+    });
+}
+export async function replayJob(job) {
+    if (!job.stream_log_path) {
+        throw new RuntimeError("REPLAY_LOG_MISSING", `Job ${job.job_id} does not have a stored stream log path to replay.`, "replay.lookup");
+    }
+    try {
+        await access(job.stream_log_path, fsConstants.R_OK);
+    }
+    catch {
+        throw new RuntimeError("REPLAY_LOG_MISSING", `Job ${job.job_id} cannot be replayed because ${job.stream_log_path} is missing.`, "replay.lookup");
+    }
+    const stats = await stat(job.stream_log_path);
+    if (stats.size > MAX_REPLAY_LOG_BYTES) {
+        throw new RuntimeError("REPLAY_LOG_TOO_LARGE", `Job ${job.job_id} stream log is ${stats.size} bytes, which exceeds the ${MAX_REPLAY_LOG_BYTES}-byte replay ceiling.`, "replay.lookup");
+    }
+    const finalText = await replayFinalText(job.stream_log_path);
+    const rendered = renderManagedJobOutput(job, finalText);
+    return {
+        rendered: rendered.rendered,
+        output: rendered.output,
+        summary: rendered.summary,
+    };
+}
+async function replayFinalText(logPath) {
+    const contents = await readFile(logPath, "utf8");
+    const rawLines = contents.split("\n");
+    let sawSpawn = false;
+    let sawExit = false;
+    let sawV1Event = false;
+    let sawV04Direction = false;
+    let assistantContent = "";
+    for (let lineNumber = 0; lineNumber < rawLines.length; lineNumber += 1) {
+        const line = rawLines[lineNumber].trim();
+        if (!line)
+            continue;
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch (error) {
+            // A truncated trailing line is the expected shape when a worker
+            // was SIGKILL'd mid-write. Drop it silently so replay still works
+            // on the consistent prefix.
+            if (lineNumber === rawLines.length - 1)
+                continue;
+            throw new RuntimeError("REPLAY_LOG_INVALID", `Stream log ${logPath}:${lineNumber + 1} is malformed JSON: ${error.message}`, "replay.log", { cause: error });
+        }
+        if (typeof entry.event === "string")
+            sawV1Event = true;
+        if (Object.prototype.hasOwnProperty.call(entry, "direction"))
+            sawV04Direction = true;
+        const event = typeof entry.event === "string" ? entry.event : "";
+        switch (event) {
+            case "spawn":
+                sawSpawn = true;
+                break;
+            case "record": {
+                const record = entry.record;
+                if (typeof record !== "object" || record === null || Array.isArray(record)) {
+                    throw new RuntimeError("REPLAY_LOG_INVALID", `Stream log ${logPath}:${lineNumber + 1} record entry is not an object.`, "replay.log");
+                }
+                const role = record.role;
+                const content = record.content;
+                if (role === "assistant" && typeof content === "string") {
+                    assistantContent += content;
+                }
+                // Non-string content (null/undefined/object) silently skipped —
+                // these are diagnostic-only records we don't render.
+                break;
+            }
+            case "exit":
+                sawExit = true;
+                break;
+            case "process_error": {
+                const detail = typeof entry.message === "string" ? entry.message : "<unknown>";
+                throw new RuntimeError("REPLAY_LOG_PROCESS_ERROR", `Stream log ${logPath} captured a subprocess error and cannot be replayed: ${detail}`, "replay.log", { details: { logPath, line: lineNumber + 1 } });
+            }
+            default:
+                // Unknown / malformed-line / future events are diagnostics — skip.
+                break;
+        }
+    }
+    if (!sawSpawn) {
+        // Differentiate "this is a v0.4 wire log" from "this is a v1.0 log
+        // that died before reaching the spawn event". v0.4 logs had a
+        // `direction` field on every entry (out/in/meta/stderr); v1.0 logs
+        // use `event` instead.
+        if (sawV04Direction && !sawV1Event) {
+            throw new RuntimeError("REPLAY_LOG_UNREADABLE", `Stream log ${logPath} is a v0.4 wire log (no \`event\` key). v0.4 wire logs are not supported by the v1.0 replay command.`, "replay.log", { details: { logPath } });
+        }
+        throw new RuntimeError("REPLAY_LOG_NO_SPAWN", `Stream log ${logPath} contains no spawn event — the worker likely failed before launching kimi (e.g., synchronous spawn failure, early cancellation). No assistant content to replay.`, "replay.log", { details: { logPath } });
+    }
+    if (!sawExit && assistantContent.length === 0) {
+        throw new RuntimeError("REPLAY_LOG_INVALID", `Stream log ${logPath} did not capture any assistant content before truncation.`, "replay.log", { details: { logPath } });
+    }
+    return assistantContent;
+}

package/dist/commands/rescue.js

@@ -0,0 +1,333 @@
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { createCliCancellationHandlers } from "../cli-cancellation.js";
+import { runCliPromptWithBudget } from "../cli-client.js";
+import { assertPersistedResumeLineage, executionPlanFromPersisted, observedExecutionFields, persistedExecutionPlanFields, prepareKimiExecutionPlan, reconcileHistoricalJobProvenance, } from "../kimi-engine.js";
+import { getManagedCommandConfig } from "./registry.js";
+import { RuntimeError } from "../errors.js";
+import { resolveRepoIdentity } from "../git.js";
+import { digestPrompt, markJobCancelled, markJobFailed, sweepStaleJobs } from "../jobs.js";
+import { JobStore } from "../job-store.js";
+import { classifyManagedCommandFailure } from "../kimi-errors.js";
+import { KIMI_RESCUE_PROMPT_TIMEOUT_MS } from "../kimi-timeouts.js";
+import { writeInvocationLogHeader } from "../logging.js";
+import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
+import { parseRescueArgs } from "../parsing.js";
+import { readArtifact, renderManagedJobOutput, writeArtifact } from "../render.js";
+import { startBackgroundJob } from "../background-spawn.js";
+import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
+import { assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
+import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
+export { describeMissingResult } from "../background-spawn.js";
+// v1.0 cutover note (PR 3):
+//
+//   Rescue is the only write-capable command. v0.4 enforced safety
+//   in-band via `WireClient.approvalPolicy = createRescueApprovalPolicy(cwd)`,
+//   which called back into our runtime on every kimi-side approval
+//   request. v1.0 moves that enforcement into the PreToolUse hook
+//   (`runtime/hooks/approval-hook.ts`), which spawns under kimi-code
+//   and calls `evaluateRescueHookRequest` for `KIMI_PLUGIN_CC_CMD=rescue`
+//   tool calls. The runtime side now just sets the env var and lets
+//   the hook gate everything.
+//
+//   The security helpers in `runtime/rescue-approval.ts` are unchanged.
+// "Continue working on the bug" verbs that auto-attach to the latest
+// rescue session. Documented UX trap: a prompt matching this pattern
+// will resume the most recent rescue session regardless of whether
+// that session was about the same bug. Users should pass an explicit
+// `--resume <job-id>` or `--fresh` when the topic switches.
+const AUTO_RESUME_PATTERN = /\b(continue|resume|keep going|keep working|apply the top fix|dig deeper)\b/i;
+const RESCUE_SUMMARY_MAX = 120;
+const RESCUE_AGENT_PROFILE_PLACEHOLDER = "<cli-client>";
+export async function runRescue(argv, context) {
+    const parsed = parseRescueArgs(argv);
+    const paths = resolvePluginPaths(context.env);
+    await ensurePluginPaths(paths);
+    const repoIdentity = await resolveRepoIdentity(context.cwd);
+    const rescueConfig = getManagedCommandConfig("rescue");
+    const store = new JobStore(paths);
+    try {
+        await sweepStaleJobs(store, paths);
+        const sessionResolution = await resolveRescueSession(store, repoIdentity.repoId, parsed.prompt, parsed.fresh, parsed.resume, parsed.resumeTarget);
+        const prompt = buildRescuePrompt(parsed.prompt, sessionResolution.reusedSession);
+        const executionPlan = await prepareKimiExecutionPlan({
+            operationKind: "rescue",
+            cwd: context.cwd,
+            env: context.env,
+            resumedFromJobId: sessionResolution.resumedFromJobId,
+            resumeSessionId: sessionResolution.kimiSessionId ?? undefined,
+            resumeSource: sessionResolution.sourceJob,
+        });
+        const jobId = randomUUID();
+        const logPath = path.join(paths.logsDir, `rescue-${jobId}.jsonl`);
+        const job = store.createJob({
+            job_id: jobId,
+            repo_id: repoIdentity.repoId,
+            command_type: "rescue",
+            cwd: context.cwd,
+            model: parsed.model ?? null,
+            thinking: parsed.thinking ?? null,
+            background: parsed.background,
+            pid: parsed.background ? null : process.pid,
+            kimi_pid: null,
+            status: "running",
+            kimi_session_id: sessionResolution.kimiSessionId,
+            ...persistedExecutionPlanFields(executionPlan),
+            agent_profile: RESCUE_AGENT_PROFILE_PLACEHOLDER,
+            prompt_digest: digestPrompt(prompt),
+            summary: shorten(prompt, RESCUE_SUMMARY_MAX),
+            phase: parsed.background ? "queued" : "starting",
+            final_output_path: null,
+            stream_log_path: logPath,
+            error: null,
+        });
+        try {
+            await writeInvocationLogHeader(logPath, {
+                commandType: "rescue",
+                kimiSessionId: sessionResolution.kimiSessionId ?? "(pending)",
+                cwd: context.cwd,
+            });
+        }
+        catch (error) {
+            const classified = new RuntimeError("RESCUE_LOG_HEADER_FAILED", `Failed to write rescue invocation log header: ${error.message ?? String(error)}`, "rescue.log-header", error instanceof Error ? { cause: error } : undefined);
+            await markJobFailed(store, paths, job, classified, rescueConfig.cancellation.failedSummary, { phase: "failed" });
+            throw classified;
+        }
+        if (parsed.background) {
+            return startBackgroundJob(job, prompt, context, paths, {
+                workerKind: "rescue",
+                wait: parsed.wait,
+                promptEnvVar: "KIMI_PLUGIN_CC_RESCUE_PROMPT_B64",
+                reusedSessionEnvVar: "KIMI_PLUGIN_CC_RESCUE_REUSED_SESSION",
+                reusedSession: sessionResolution.reusedSession,
+                failedSummary: rescueConfig.cancellation.failedSummary,
+                missingResultErrorCode: "RESCUE_RESULT_MISSING",
+                spawnFailedErrorCode: "RESCUE_WORKER_SPAWN_FAILED",
+                earlyExitErrorCode: "RESCUE_WORKER_EXITED_EARLY",
+                nodeBinInvalidErrorCode: "RESCUE_NODE_BIN_INVALID",
+                waitStage: "rescue.wait",
+                spawnStage: "rescue.worker.spawn",
+            });
+        }
+        const completed = await executeRescueJob(job.job_id, prompt, context);
+        if (!completed.final_output_path) {
+            throw new RuntimeError("RESCUE_RESULT_MISSING", "Rescue finished without a rendered result.", "rescue.result");
+        }
+        return readArtifact(completed.final_output_path);
+    }
+    finally {
+        store.close();
+    }
+}
+export async function executeRescueJob(jobId, prompt, context, options) {
+    const paths = resolvePluginPaths(context.env);
+    await ensurePluginPaths(paths);
+    const store = new JobStore(paths);
+    const job = store.getJob(jobId);
+    if (!job) {
+        store.close();
+        throw new RuntimeError("JOB_NOT_FOUND", `Rescue job ${jobId} was not found.`, "rescue.worker");
+    }
+    const rescueConfig = getManagedCommandConfig("rescue");
+    const cancel = rescueConfig.cancellation;
+    // Rescue writes directly to the workspace. Without the PreToolUse hook,
+    // kimi-code's `-p` mode auto-approves every Bash/Write/Edit, including
+    // destructive ones. Refuse before the worker can spawn Kimi.
+    //
+    // The hook check happens BEFORE `createCliCancellationHandlers()` so
+    // an early return doesn't leak SIGTERM/SIGINT listeners. Tests /
+    // setup probes / intentional bypass: KIMI_PLUGIN_CC_SKIP_HOOK_CHECK=1.
+    if (context.env.KIMI_PLUGIN_CC_SKIP_HOOK_CHECK !== "1") {
+        const installStatus = await verifyHookInstalled(context.env);
+        if (!installStatus.installed) {
+            maybeWarnHookMissing(installStatus, "rescue", context.stderr);
+            const classified = new RuntimeError("RESCUE_HOOK_NOT_INSTALLED", [
+                "rescue refuses to run without the kimi-plugin-cc PreToolUse hook.",
+                `Hook check failed: ${installStatus.reason ?? "unknown"}.`,
+                "Repair by running Claude Code /kimi:setup or Codex $kimi-setup, then retry.",
+                "KIMI_PLUGIN_CC_SKIP_HOOK_CHECK=1 is only for deliberate tests or diagnostics.",
+                hookRefusalRetryProtocol(context.env),
+            ].join(" "), "rescue.hook-check", { details: hookRefusalDetails(installStatus) });
+            try {
+                return await markJobFailed(store, paths, job, classified, cancel.failedSummary, { phase: "failed" });
+            }
+            finally {
+                store.close();
+            }
+        }
+    }
+    const handlers = createCliCancellationHandlers();
+    try {
+        const executionPlan = executionPlanFromPersisted(job);
+        // Re-validate resume lineage from the store before spawning: a detached
+        // worker (or a forged queued row) reloads the persisted plan and would
+        // otherwise hand kimi_session_id to the spawn without the dispatch-time
+        // lineage check. Fresh sessions (no resumedFromJobId) are exempt.
+        if (job.kimi_session_id !== null) {
+            await assertPersistedResumeLineage(store, executionPlan, job.kimi_session_id, "rescue");
+        }
+        if (options?.workerPid) {
+            store.updateRunningJob(job.job_id, { pid: options.workerPid, phase: "worker-running" });
+        }
+        store.updateRunningJob(job.job_id, { phase: "turn-running" });
+        const result = await runCliPromptWithBudget({
+            cwd: job.cwd,
+            env: context.env,
+            command: executionPlan.command,
+            prefixArgs: [...executionPlan.prefixArgs],
+            executionPlan,
+            prompt,
+            commandLabel: "rescue",
+            trustedWorkspaceRoot: job.cwd,
+            model: job.model ?? undefined,
+            resumeSessionId: job.kimi_session_id ?? undefined,
+            logPath: job.stream_log_path,
+            signal: handlers.signal,
+            // SIGKILL escalation defaults to 1500ms inside cli-client —
+            // matches v0.4's cancellation.ts behavior for the wire client.
+        }, KIMI_RESCUE_PROMPT_TIMEOUT_MS, "rescue.prompt");
+        store.updateRunningJob(job.job_id, observedExecutionFields(result));
+        if (handlers.cancelling) {
+            throw new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.afterPrompt, "rescue.runtime");
+        }
+        assertCliResultSuccess(result, "rescue.runtime");
+        if (result.sessionId !== undefined &&
+            result.sessionId.length > 0 &&
+            result.sessionId !== job.kimi_session_id) {
+            // length>0 guard: empty-string capture would poison the row. (Kimi
+            // alpha.4 challenge finding #3.)
+            store.updateRunningJob(job.job_id, { kimi_session_id: result.sessionId });
+        }
+        await syncKimiSessionTitle({
+            promptText: prompt,
+            env: context.env,
+            cwd: job.cwd,
+            sessionId: result.sessionId ?? job.kimi_session_id,
+            title: buildKimiSessionTitle("rescue", prompt),
+            stderr: context.stderr,
+        });
+        if (job.kimi_session_id === null) {
+            warnIfSessionIdMissing(result, "rescue", job.job_id, context.stderr);
+        }
+        const finalText = reassembleProseFromRecords(result.records);
+        const rendered = renderManagedJobOutput(job, finalText);
+        let artifactPath;
+        try {
+            if (context.env.KIMI_PLUGIN_CC_TEST_FAIL_WRITE_ARTIFACT === "1") {
+                throw new Error("Simulated artifact write failure (test seam).");
+            }
+            artifactPath = await writeArtifact(paths, job, rendered.rendered);
+        }
+        catch (writeError) {
+            // LLM-caller discipline: writing the raw model output to stderr
+            // for a wrapper LLM-caller would corrupt its prose stream. Keep
+            // the raw text in the RuntimeError details — surfaces via
+            // /kimi:status / /kimi:result --json — and emit only a short
+            // human-facing line on stderr.
+            context.stderr.write(`[kimi-plugin-cc] rescue artifact write failed for job ${job.job_id}; raw output preserved in error details.\n`);
+            const classified = new RuntimeError("RESCUE_ARTIFACT_WRITE_FAILED", `Failed to write rescue artifact: ${writeError.message ?? String(writeError)}`, "rescue.artifact", {
+                ...(writeError instanceof Error ? { cause: writeError } : {}),
+                details: { rawOutput: finalText },
+            });
+            return await markJobFailed(store, paths, job, classified, cancel.failedSummary, { phase: "failed" });
+        }
+        if (handlers.cancelling) {
+            throw new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.afterArtifact, "rescue.runtime");
+        }
+        return (store.markCompleted(job.job_id, {
+            summary: rendered.summary,
+            phase: "done",
+            final_output_path: artifactPath,
+            error: null,
+        }) ?? job);
+    }
+    catch (error) {
+        if (handlers.cancelling) {
+            const cancelledError = new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.default, "rescue.runtime", error instanceof Error ? { cause: error } : undefined);
+            return await markJobCancelled(store, paths, job, cancel.cancelledSummary, cancelledError, { phase: "cancelled" });
+        }
+        const classified = classifyManagedCommandFailure(error, "rescue", job.job_id, {
+            preserveStage: true,
+        });
+        return await markJobFailed(store, paths, job, classified, cancel.failedSummary, { phase: "failed" });
+    }
+    finally {
+        handlers.dispose();
+        store.close();
+    }
+}
+function buildRescuePrompt(prompt, reusedSession) {
+    if (prompt?.trim()) {
+        return prompt.trim();
+    }
+    if (reusedSession) {
+        return "Continue the previous rescue task using the latest repository state.";
+    }
+    throw new RuntimeError("INVALID_ARGS", "rescue requires a task description.", "rescue.parse");
+}
+async function resolveRescueSession(store, repoId, prompt, fresh, resume, resumeTarget) {
+    if (fresh) {
+        return { kimiSessionId: null, reusedSession: false, resumedFromJobId: null, sourceJob: null };
+    }
+    if (resumeTarget) {
+        const byJob = store.getJob(resumeTarget);
+        const scoped = byJob?.repo_id === repoId && byJob.command_type === "rescue" ? byJob : null;
+        const exact = scoped ?? store.findRescueJobBySession(repoId, resumeTarget);
+        if (!exact) {
+            throw new RuntimeError("RESCUE_RESUME_NOT_FOUND", `No rescue job or session matched ${resumeTarget}.`, "rescue.resume");
+        }
+        const source = await reconcileHistoricalJobProvenance(store, exact);
+        ensureSessionIsNotRunning(source);
+        if (!source.kimi_session_id) {
+            throw new RuntimeError("RESCUE_RESUME_NOT_FOUND", `No rescue job or session matched ${resumeTarget}.`, "rescue.resume");
+        }
+        return {
+            kimiSessionId: source.kimi_session_id,
+            reusedSession: true,
+            resumedFromJobId: source.job_id,
+            sourceJob: source,
+        };
+    }
+    if (resume) {
+        const latest = store.findLatestJob({ repoId, commandType: "rescue" });
+        if (!latest) {
+            throw new RuntimeError("RESCUE_RESUME_NOT_FOUND", "No prior rescue session exists for this repository.", "rescue.resume");
+        }
+        const source = await reconcileHistoricalJobProvenance(store, latest);
+        ensureSessionIsNotRunning(source);
+        if (!source.kimi_session_id) {
+            throw new RuntimeError("RESCUE_RESUME_NOT_FOUND", "No prior rescue session exists for this repository.", "rescue.resume");
+        }
+        return {
+            kimiSessionId: source.kimi_session_id,
+            reusedSession: true,
+            resumedFromJobId: source.job_id,
+            sourceJob: source,
+        };
+    }
+    if (prompt && AUTO_RESUME_PATTERN.test(prompt)) {
+        const latest = store.findLatestJob({ repoId, commandType: "rescue" });
+        if (latest?.kimi_session_id && latest.status !== "running") {
+            const source = await reconcileHistoricalJobProvenance(store, latest);
+            return {
+                kimiSessionId: source.kimi_session_id,
+                reusedSession: true,
+                resumedFromJobId: source.job_id,
+                sourceJob: source,
+            };
+        }
+    }
+    return { kimiSessionId: null, reusedSession: false, resumedFromJobId: null, sourceJob: null };
+}
+function ensureSessionIsNotRunning(job) {
+    if (job.status === "running") {
+        throw new RuntimeError("RESCUE_ALREADY_RUNNING", `Rescue session ${job.kimi_session_id ?? "<unknown>"} is already active under job ${job.job_id}.`, "rescue.resume");
+    }
+}
+function shorten(text, max) {
+    const normalized = text.replace(/\s+/g, " ").trim();
+    if (normalized.length <= max) {
+        return normalized;
+    }
+    return `${normalized.slice(0, Math.max(0, max - 1)).trimEnd()}…`;
+}

package/dist/commands/result.js

@@ -0,0 +1,58 @@
+import { RuntimeError } from "../errors.js";
+import { resolveRepoIdentity } from "../git.js";
+import { sweepStaleJobs } from "../jobs.js";
+import { reconcileHistoricalJobProvenance } from "../kimi-engine.js";
+import { withJobStore } from "../job-store.js";
+import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
+import { parseJobLookupArgs } from "../parsing.js";
+import { readArtifact, renderTerminalJobArtifact } from "../render.js";
+export async function runResult(argv, context) {
+    const parsed = parseJobLookupArgs(argv);
+    const paths = resolvePluginPaths(context.env);
+    await ensurePluginPaths(paths);
+    const repoIdentity = await resolveRepoIdentity(context.cwd);
+    return withJobStore(paths, async (store) => {
+        await sweepStaleJobs(store, paths);
+        const found = parsed.jobId
+            ? store.getJob(parsed.jobId)
+            : store.findLatestJob({
+                repoId: repoIdentity.repoId,
+                commandType: parsed.type,
+                terminalOnly: true,
+            });
+        if (!found) {
+            throw new RuntimeError("JOB_NOT_FOUND", "No matching terminal job was found for result.", "result.lookup");
+        }
+        const job = await reconcileHistoricalJobProvenance(store, found);
+        if (job.status === "running") {
+            // `result --json` preserves the existing result contract: callers only
+            // receive terminal artifacts, never a partial/running envelope.
+            throw new RuntimeError("JOB_NOT_TERMINAL", `Job ${job.job_id} is still running.`, "result.lookup");
+        }
+        if (!job.final_output_path) {
+            const fallbackBody = `${renderTerminalJobArtifact(job)}\n`;
+            return parsed.json ? renderResultEnvelope(job, null, fallbackBody) : fallbackBody;
+        }
+        const body = await readArtifact(job.final_output_path);
+        return parsed.json ? renderResultEnvelope(job, job.final_output_path, body) : body;
+    });
+}
+function renderResultEnvelope(job, artifactPath, body) {
+    return `${JSON.stringify({
+        job_id: job.job_id,
+        kind: job.command_type,
+        status: job.status,
+        summary: job.summary,
+        error: job.error,
+        artifact_path: artifactPath,
+        body,
+        created_at: job.created_at,
+        completed_at: job.updated_at,
+        operation_kind: job.operation_kind,
+        intended_engine: job.intended_engine,
+        observed_engine: job.observed_engine,
+        kimi_version: job.kimi_version,
+        system_version: job.system_version,
+        resumed_from_job_id: job.resumed_from_job_id,
+    }, null, 2)}\n`;
+}