kimi-plugin-cc 2.0.7

package/plugins/kimi-codex/dist/companion.js

@@ -0,0 +1,114 @@
+import { runAsk } from "./commands/ask.js";
+import { runModelInventory } from "./commands/models.js";
+import { runCancel } from "./commands/cancel.js";
+import { notImplementedCompanionCommand } from "./commands/not-implemented.js";
+import { runReplay } from "./commands/replay.js";
+import { runRepairSessions } from "./commands/repair-sessions.js";
+import { runResult } from "./commands/result.js";
+import { runReview } from "./commands/review.js";
+import { runRescue } from "./commands/rescue.js";
+import { runPursue } from "./commands/pursue.js";
+import { runSwarm } from "./commands/swarm.js";
+import { renderSetupResult, runSetup } from "./commands/setup.js";
+import { runStatus } from "./commands/status.js";
+import { runWorker } from "./commands/worker.js";
+import { formatError, RuntimeError } from "./errors.js";
+import { resolveKimiHome } from "./kimi-home.js";
+async function main(argv) {
+    const [command, ...rest] = argv;
+    const cwd = process.env.KIMI_PLUGIN_CC_WORKSPACE_CWD || process.cwd();
+    const context = {
+        cwd,
+        env: {
+            ...process.env,
+            KIMI_CODE_HOME: resolveKimiHome(process.env, cwd),
+        },
+        stdout: process.stdout,
+        stderr: process.stderr,
+    };
+    switch (command) {
+        case "setup": {
+            if (rest.includes("--models")) {
+                const args = [...rest];
+                args.splice(args.indexOf("--models"), 1);
+                context.stdout.write(`${await runModelInventory(args, context)}\n`);
+                return;
+            }
+            const result = await runSetup(rest, context);
+            context.stdout.write(`${renderSetupResult(result)}\n`);
+            // A failed probe means the hook did not actually deny when exercised —
+            // enforcement is NOT in place, whichever action produced it. This must be
+            // nonzero for `install` too, not just `check`: since v1.9.0 an agent may
+            // run setup and then RETRY the refused command, and it keys that decision
+            // on the exit code. Exiting 0 after a failed probe would walk it straight
+            // past a proven-dead hook (a byte-exact command + a readable-but-broken
+            // script passes `verifyHookInstalled`, since only the probe can tell that
+            // the script cannot deny — e.g. a truncated `approval-hook.js`, which has
+            // happened here via iCloud sync, or a half-extracted plugin cache).
+            // `probe: "skipped"` (uninstall) is deliberately untouched.
+            if (result.probe === "failed") {
+                process.exitCode = 1;
+            }
+            return;
+        }
+        case "review": {
+            const result = await runReview(rest, context, "review");
+            context.stdout.write(`${result}\n`);
+            return;
+        }
+        case "task": {
+            const [taskType, ...taskArgs] = rest;
+            if (taskType === "rescue") {
+                const result = await runRescue(taskArgs, context);
+                context.stdout.write(result);
+                return;
+            }
+            if (taskType === "challenge") {
+                const result = await runReview(taskArgs, context, "challenge");
+                context.stdout.write(`${result}\n`);
+                return;
+            }
+            if (taskType === "pursue") {
+                const result = await runPursue(taskArgs, context);
+                context.stdout.write(result);
+                return;
+            }
+            if (taskType === "swarm") {
+                const result = await runSwarm(taskArgs, context);
+                context.stdout.write(result);
+                return;
+            }
+            notImplementedCompanionCommand(taskType ? `task ${taskType}` : "task");
+            return;
+        }
+        case "ask": {
+            const result = await runAsk(rest, context);
+            context.stdout.write(`${result}\n`);
+            return;
+        }
+        case "status":
+            context.stdout.write(await runStatus(rest, context));
+            return;
+        case "result":
+            context.stdout.write(await runResult(rest, context));
+            return;
+        case "cancel":
+            context.stdout.write(await runCancel(rest, context));
+            return;
+        case "replay":
+            context.stdout.write(await runReplay(rest, context));
+            return;
+        case "repair-sessions":
+            context.stdout.write(await runRepairSessions(rest, context));
+            return;
+        case "worker":
+            await runWorker(rest, context);
+            return;
+        default:
+            throw new RuntimeError("INVALID_COMMAND", `Unknown or missing companion subcommand: ${command ?? "<none>"}. Expected one of setup, review, task, ask, status, result, cancel, replay, repair-sessions.`, "companion");
+    }
+}
+main(process.argv.slice(2)).catch((error) => {
+    process.stderr.write(`${formatError(error)}\n`);
+    process.exitCode = 1;
+});

package/plugins/kimi-codex/dist/config.js

@@ -0,0 +1,22 @@
+import { readFile, writeFile } from "node:fs/promises";
+const DEFAULT_CONFIG = {
+    reviewGateEnabled: false,
+};
+export async function readPluginConfig(paths) {
+    try {
+        const contents = await readFile(paths.configPath, "utf8");
+        const parsed = JSON.parse(contents);
+        return {
+            reviewGateEnabled: parsed.reviewGateEnabled ?? DEFAULT_CONFIG.reviewGateEnabled,
+        };
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return DEFAULT_CONFIG;
+        }
+        throw error;
+    }
+}
+export async function writePluginConfig(paths, config) {
+    await writeFile(paths.configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+}

package/plugins/kimi-codex/dist/errors.js

@@ -0,0 +1,40 @@
+export class RuntimeError extends Error {
+    code;
+    stage;
+    details;
+    constructor(code, message, stage, options) {
+        super(message, options);
+        this.name = "RuntimeError";
+        this.code = code;
+        this.stage = stage;
+        this.details = options?.details ?? {};
+    }
+}
+export function formatError(error) {
+    if (error instanceof RuntimeError) {
+        const base = `[${error.code}] [${error.stage}] ${error.message}`;
+        // Serialize structured context so an LLM caller can act on it. Without
+        // this, `details` existed only in the SQLite job row — reachable via
+        // `result <jobId> --json` for BACKGROUND jobs, but simply lost for
+        // foreground ones (review/challenge/ask), whose only output is this
+        // string. v1.9.0 needs `drift_axis` to reach the caller on every path, so
+        // it is rendered here as one deterministic JSON line. (Kimi's pre-release
+        // review caught that the agents were told to branch on a field no channel
+        // actually carried.)
+        const details = error.details;
+        if (details !== undefined && Object.keys(details).length > 0) {
+            try {
+                return `${base}\ndetails: ${JSON.stringify(details)}`;
+            }
+            catch {
+                // A non-serializable value must never suppress the error itself.
+                return base;
+            }
+        }
+        return base;
+    }
+    if (error instanceof Error) {
+        return error.message;
+    }
+    return String(error);
+}

package/plugins/kimi-codex/dist/git.js

@@ -0,0 +1,215 @@
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { realpath, rm } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { RuntimeError } from "./errors.js";
+const execFileAsync = promisify(execFile);
+const MAX_DIFF_CHARS = 80_000;
+/**
+ * Buffer ceiling for a write-swarm capture patch. Unlike review diffs (capped at
+ * MAX_DIFF_CHARS for prompt budget), a capture patch MUST be byte-complete to
+ * `git apply`, so it is never truncated — only bounded by this generous buffer to
+ * avoid an unbounded RSS spike. A swarm patch larger than this is pathological.
+ */
+const MAX_PATCH_BYTES = 64 * 1024 * 1024;
+export async function collectReviewContext(cwd, base) {
+    const { repoRoot } = await resolveRepoIdentity(cwd);
+    const statusSummary = (await runGit(["status", "--short", "--untracked-files=all"], cwd)).trim();
+    if (base) {
+        const diffText = await getBaseDiff(cwd, base);
+        return {
+            repoRoot,
+            statusSummary,
+            diffText: truncateDiff(diffText),
+            targetDescription: `branch diff against ${base}`,
+        };
+    }
+    // Working-tree review is repo-wide. status --short is already repo-wide; limiting diff to
+    // the caller's subdirectory would mask unrelated-but-relevant changes elsewhere in the repo.
+    const headDiff = await runGitAllowFailure(["diff", "--no-ext-diff", "--unified=3", "HEAD", "--"], cwd);
+    const diffText = headDiff.ok && headDiff.stdout.trim().length > 0
+        ? headDiff.stdout
+        : await runGit(["diff", "--no-ext-diff", "--unified=3", "--"], cwd);
+    return {
+        repoRoot,
+        statusSummary,
+        diffText: truncateDiff(diffText),
+        targetDescription: "current working tree changes",
+    };
+}
+export async function resolveRepoIdentity(cwd) {
+    const workspaceRoot = await realpath(cwd);
+    const result = await runGitAllowFailure(["rev-parse", "--show-toplevel", "--git-common-dir"], cwd);
+    if (!result.ok) {
+        return {
+            repoId: sha256(workspaceRoot),
+            repoRoot: workspaceRoot,
+            gitCommonDir: null,
+            isGitRepo: false,
+        };
+    }
+    const [repoRootRaw, gitCommonDirRaw] = result.stdout
+        .trim()
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+    const repoRoot = repoRootRaw ? await realpath(repoRootRaw) : workspaceRoot;
+    const gitCommonDir = gitCommonDirRaw && gitCommonDirRaw.length > 0
+        ? await realpath(path.resolve(cwd, gitCommonDirRaw))
+        : null;
+    return {
+        repoId: sha256(`${gitCommonDir ?? repoRoot}::${repoRoot}`),
+        repoRoot,
+        gitCommonDir,
+        isGitRepo: true,
+    };
+}
+async function getBaseDiff(cwd, base) {
+    // --end-of-options is a git safety marker (since 2.24) telling git every token after it is
+    // a refspec, not a flag. Defense in depth against argument injection via --base.
+    const threeDot = await runGitAllowFailure(["diff", "--no-ext-diff", "--unified=3", "--end-of-options", `${base}...HEAD`, "--"], cwd);
+    if (threeDot.ok) {
+        return threeDot.stdout;
+    }
+    return runGit(["diff", "--no-ext-diff", "--unified=3", "--end-of-options", base, "--"], cwd);
+}
+async function runGit(args, cwd) {
+    const result = await runGitAllowFailure(args, cwd);
+    if (!result.ok) {
+        throw new RuntimeError("GIT_COMMAND_FAILED", `git ${args.join(" ")} failed: ${result.stderr || "unknown error"}`, "review.git");
+    }
+    return result.stdout;
+}
+async function runGitAllowFailure(args, cwd) {
+    try {
+        const { stdout, stderr } = await execFileAsync("git", args, {
+            cwd,
+            env: process.env,
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        return { ok: true, stdout, stderr };
+    }
+    catch (error) {
+        const execError = error;
+        return {
+            ok: false,
+            stdout: execError.stdout ?? "",
+            stderr: execError.stderr ?? execError.message,
+        };
+    }
+}
+function truncateDiff(diffText) {
+    if (diffText.length <= MAX_DIFF_CHARS) {
+        return diffText;
+    }
+    return `${diffText.slice(0, MAX_DIFF_CHARS)}\n\n[diff truncated by companion after ${MAX_DIFF_CHARS} characters]`;
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+// ---------------------------------------------------------------------
+// Ephemeral worktree lifecycle — write-swarm (v1.4).
+//
+// A write-swarm spawns its coordinator `kimi -p` with cwd = a throwaway
+// detached worktree off the user's HEAD, so `coder` subagents edit there and
+// never touch the user's checkout. The worktree is a LINKED worktree: its
+// working tree + index are isolated and disposable, but it SHARES the main
+// repo's object DB and refs. The PreToolUse hook (swarm-write label) confines
+// every subagent write to this worktree; the plugin captures the result as a
+// patch and removes the worktree. See .claude/docs/write-swarm-spec.md.
+// ---------------------------------------------------------------------
+/**
+ * True if the repo at `cwd` has a born HEAD (at least one commit). `git worktree
+ * add --detach HEAD` fails on an unborn HEAD (fresh repo, no commits) and on a
+ * bare repo, so write-swarm gates on this before creating any job state.
+ */
+export async function hasBornHead(cwd) {
+    const result = await runGitAllowFailure(["rev-parse", "--verify", "--quiet", "HEAD"], cwd);
+    return result.ok && result.stdout.trim().length > 0;
+}
+/**
+ * Create a throwaway detached worktree at `worktreePath` checked out to `base`
+ * (write-swarm hard-codes "HEAD"; never user input). `worktreePath` MUST be
+ * outside the repo (the plugin's worktrees dir). Throws GIT_WORKTREE_ADD_FAILED
+ * on failure. Caller owns removal (`removeWorktree`) on EVERY terminal path.
+ */
+export async function createEphemeralWorktree(repoRoot, base, worktreePath) {
+    const result = await runGitAllowFailure(["worktree", "add", "--detach", worktreePath, base], repoRoot);
+    if (!result.ok) {
+        throw new RuntimeError("GIT_WORKTREE_ADD_FAILED", `git worktree add failed: ${result.stderr || "unknown error"}`, "swarm.worktree", { details: { repoRoot, worktreePath, base } });
+    }
+}
+/**
+ * Capture the full change set in a worktree as a byte-complete, applyable patch.
+ *
+ * `git add -N -- .` records intent-to-add index entries for untracked files so
+ * the diff includes their content — WITHOUT writing blob objects into the shared
+ * object DB (intent-to-add stores a zero-oid entry in the worktree's OWN index
+ * only). This keeps the "plugin never mutates git state" invariant literally
+ * true: no loose objects, no ref/HEAD movement.
+ *
+ * The diff is taken against **HEAD** (the worktree's base commit), NOT the index:
+ * `git diff HEAD` captures the complete change set regardless of index state, so
+ * the patch is invariant to any intermediate staging (e.g. if a tool ever
+ * `git add`s a file, a plain `git diff` would silently omit it; `git diff HEAD`
+ * still captures it). `--binary` makes binary changes applyable; the diff is
+ * NEVER truncated (a capture patch must apply cleanly) and uses a raised
+ * maxBuffer. Mirrors `collectReviewContext`'s HEAD-based diff.
+ *
+ * Returns the patch text (empty string if the swarm changed nothing).
+ */
+export async function captureWorktreePatch(worktreePath) {
+    // Best-effort intent-to-add so untracked files surface in `git diff HEAD`
+    // (without -N, git diff ignores untracked files entirely). A failure here just
+    // means new files are omitted from the diff, surfaced as a smaller patch.
+    await runGitAllowFailure(["add", "-N", "--", "."], worktreePath);
+    try {
+        const { stdout } = await execFileAsync("git", ["diff", "--binary", "HEAD", "--"], {
+            cwd: worktreePath,
+            env: process.env,
+            maxBuffer: MAX_PATCH_BYTES,
+        });
+        return stdout;
+    }
+    catch (error) {
+        const execError = error;
+        throw new RuntimeError("GIT_WORKTREE_DIFF_FAILED", `git diff (worktree capture) failed: ${execError.stderr || execError.message || "unknown error"}`, "swarm.worktree", { details: { worktreePath } });
+    }
+}
+/**
+ * Remove a worktree (best-effort, idempotent). `--force` discards the dirty tree,
+ * so callers MUST capture the patch BEFORE calling this. Falls back to pruning the
+ * admin entry and removing the on-disk dir if `worktree remove` cannot (e.g. the
+ * dir was partially deleted). Never throws — cleanup must not mask the real error
+ * on a failure path.
+ */
+export async function removeWorktree(repoRoot, worktreePath) {
+    const removed = await runGitAllowFailure(["worktree", "remove", "--force", worktreePath], repoRoot);
+    if (!removed.ok) {
+        // Prune the admin entry (handles the case where the dir is already gone) then
+        // force-delete any on-disk remnant so no orphan accretes in the plugin dir.
+        await runGitAllowFailure(["worktree", "prune"], repoRoot);
+        await rm(worktreePath, { recursive: true, force: true }).catch(() => {
+            // Best-effort; a residual dir is swept on the next run.
+        });
+    }
+}
+/**
+ * Prune stale worktree admin entries (entries whose on-disk dir is gone). Cheap;
+ * run at the start of every write-swarm. Does NOT remove on-disk worktrees whose
+ * dirs still exist — the caller sweeps those by path. Never throws.
+ */
+export async function pruneWorktrees(repoRoot) {
+    await runGitAllowFailure(["worktree", "prune"], repoRoot);
+}
+/**
+ * True if the working tree at `cwd` has uncommitted changes (tracked or
+ * untracked). write-swarm bases its worktree on HEAD, so a dirty tree means the
+ * user's in-progress work is NOT visible to the swarm — the caller warns. Returns
+ * false on a git failure (don't block the run on a status probe).
+ */
+export async function isWorkingTreeDirty(cwd) {
+    const result = await runGitAllowFailure(["status", "--porcelain", "--untracked-files=all"], cwd);
+    return result.ok && result.stdout.trim().length > 0;
+}

package/plugins/kimi-codex/dist/hooks/approval-hook.js

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+// Entry script for the kimi-code PreToolUse hook.
+//
+// Installed by /kimi:setup as a managed block in ~/.kimi-code/config.toml:
+//
+//   [[hooks]]
+//   event = "PreToolUse"
+//   command = "node /abs/path/to/dist/hooks/approval-hook.js"
+//   timeout = 15
+//
+// Hook protocol (kimi-code agent-core/src/session/hooks/runner.ts —
+// path was agent/hooks/ in 0.4.0 and earlier; relocated to session/hooks/
+// in 0.5.0 with byte-identical file contents):
+//
+//   stdin:  full hook payload as JSON
+//   stdout: optional structured JSON (only consulted when exit code is 0)
+//   stderr: free-form reason
+//   exit 0: allow (with optional structured override)
+//   exit 2: deny — `stderr.trim()` becomes the reason surfaced to the model
+//   any other exit code: fall through to allow (fail-open)
+//
+// We use exit-code signaling rather than structured JSON because:
+//
+//   1. Exit 2 + stderr is the simpler contract — fewer surfaces for a
+//      version skew between us and kimi-code to break safety.
+//   2. The runner short-circuits exit-2 before structuredOutput() is
+//      called, so emitting both would be redundant.
+//   3. A crash in our hook would normally exit non-zero and silently
+//      allow (fail-open). We compensate by wrapping every code path in
+//      try/catch and exiting 2 with a "hook misconfigured" reason on
+//      any unexpected error.
+//
+// Process boundary:
+//
+//   kimi-code spawns this hook with `shell: true` (see runner.ts:46-53,
+//   where `spawn(command, { shell: true, ... })` is invoked).
+//   The TOML command is parsed by `/bin/sh -c "..."` so the resolved
+//   `node /abs/path/...` works regardless of where it's invoked from.
+import { decideHookOutcome } from "./approval-policy.js";
+import { evaluateRescueHookRequest } from "../rescue-approval.js";
+const STDIN_TIMEOUT_MS = 5_000;
+async function main() {
+    const stdinText = await readStdinWithTimeout(STDIN_TIMEOUT_MS);
+    let input;
+    try {
+        const parsed = JSON.parse(stdinText);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error("hook payload must be a JSON object");
+        }
+        input = parsed;
+    }
+    catch (err) {
+        failClosed(`stdin was not a JSON object: ${formatErr(err)}`);
+        return;
+    }
+    const decision = await decideHookOutcome(input, {
+        commandLabel: process.env.KIMI_PLUGIN_CC_CMD,
+        operationKind: process.env.KIMI_PLUGIN_CC_OPERATION,
+        rescueEvaluator: evaluateRescueHookRequest,
+        // Trusted root for rescue/pursue/swarm-write. Set by the plugin spawn; the
+        // model inside kimi cannot forge it and hook payload cwd is not trusted.
+        trustedWorkspaceRoot: process.env.KIMI_PLUGIN_CC_WORKSPACE_ROOT,
+    });
+    if (decision.decision === "deny") {
+        // stderr.trim() in runner.ts:118 becomes the model-visible reason.
+        process.stderr.write(`${decision.reason ?? "denied"}\n`);
+        process.exit(2);
+        return;
+    }
+    process.exit(0);
+}
+function failClosed(reason) {
+    process.stderr.write(`kimi-plugin-cc safety hook misconfigured: ${reason}\n`);
+    process.exit(2);
+}
+function formatErr(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function readStdinWithTimeout(timeoutMs) {
+    return new Promise((resolve, reject) => {
+        let buf = "";
+        let settled = false;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (value instanceof Error)
+                reject(value);
+            else
+                resolve(value);
+        };
+        const timer = setTimeout(() => {
+            finish(new Error(`stdin did not close within ${timeoutMs}ms`));
+        }, timeoutMs);
+        timer.unref();
+        try {
+            process.stdin.setEncoding("utf8");
+        }
+        catch {
+            // some test harnesses pre-encode; fine to ignore
+        }
+        process.stdin.on("data", (chunk) => {
+            buf += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        });
+        process.stdin.on("end", () => finish(buf));
+        process.stdin.on("error", (err) => finish(err instanceof Error ? err : new Error(String(err))));
+    });
+}
+main().catch((err) => {
+    failClosed(`uncaught error: ${formatErr(err)}`);
+});