kimi-plugin-cc 2.0.8 → 2.2.0

package/docs/registry-releases.md

@@ -6,7 +6,9 @@ remain available. The package has no install scripts and no separate CLI.
 
 ## Publishing status
 
-As of September 26, 2026, [2.0.7 is live on npm](https://www.npmjs.com/package/kimi-plugin-cc/v/2.0.7).
+As of October 15, 2026, [2.0.8 is live on npm](https://www.npmjs.com/package/kimi-plugin-cc/v/2.0.8), published through
+GitHub Actions OIDC with a signed provenance statement (run 38650044033). 2.0.7 (September 26) was the
+hand-published bootstrap.
 The first upload used the validated GitHub Actions artifact and interactive npm
 authentication. Its public tarball matched that artifact byte-for-byte, and a
 fresh registry install passed isolated setup/check for both hosts.
@@ -17,6 +19,25 @@ The trusted publisher is configured for `linxule/kimi-plugin-cc`, workflow
 use short-lived OIDC credentials, without a stored npm token or interactive 2FA.
 The first npm OIDC publication will be the next release; do not republish 2.0.7.
 
+**2026-10-15 status.** The `v2.0.8` release triggered the first OIDC attempt. It
+failed twice on the publish step for reasons unrelated to the package: current
+npm parses a bare `package/<file>.tgz` argument as the GitHub shorthand
+`github:package/<file>` (fixed in `publish.yml`, which now locates the tarball
+and publishes an anchored `./` path), and the manual re-dispatch then received
+`404 Not Found - PUT https://registry.npmjs.org/kimi-plugin-cc`, the response
+npm gives when the OIDC token exchange is refused. The GitHub Actions side
+checks out (environment `npm` exists with no protection rules;
+`NPM_TRUSTED_PUBLISHING=true`), so the cause was on npmjs.com: the trusted-publisher binding created on
+September 26 had **expired unused** (npm expires a binding that never publishes).
+Deleting it and creating a new one (GitHub Actions, `linxule` / `kimi-plugin-cc` /
+`publish.yml` / environment `npm`, with *Allow npm publish* ticked) and
+dispatching `publish.yml` with `tag=v2.0.8` published 2.0.8 with provenance. A new
+binding shows *Pending validation* until its first publish, which must happen
+within about a day; publish promptly after creating one, and expect to recreate it
+after a long gap between releases. Note that a `release` event runs the workflow
+file at the tag, so fixes to `publish.yml` reach an existing tag only through
+`workflow_dispatch`.
+
 ## Validation
 
 Use the repository's normal version bump and generated-surface procedure in

package/docs/safety.md

@@ -1,6 +1,6 @@
 # Safety
 
-This guide describes the shipped 2.0.6 runtime. Read-only tasks deny file writes and shell commands. Rescue and pursue can edit your workspace. Write-swarm returns a patch from a temporary Git worktree.
+This guide describes the shipped 2.2.0 runtime. Read-only tasks deny file writes and shell commands. Rescue and pursue can edit your workspace. Write-swarm returns a patch from a temporary Git worktree.
 
 Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, and `2.1.1`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
 
@@ -74,7 +74,7 @@ Key constraints (verified by [`runtime/hooks/managed-block.ts`](../runtime/hooks
 3. **TOML basic-string escaping.** The command field is a TOML basic string. Quotes, backslashes, newlines, and control characters in the resolved hook path are escaped during install; paths containing characters that cannot be safely escaped (literal `"`, raw control chars) are rejected up front with `SETUP_HOOK_PATH_UNSAFE`.
 4. **Exact marker grammar.** The verifier rejects stray comments containing the marker tag, partial references, duplicate blocks (from a setup race), and orphan markers (from a manual edit). The same parser is used by both the installer and the per-call verifier so the two cannot disagree.
 5. **Exact command equality, per host.** The verifier reconstructs the canonical command byte string from the current env and equality-checks the installed `command` (never a substring — a crafted `true # /path/to/approval-hook.js` runs only `true` and would auto-allow). This holds *per host id* (below): each host verifies its own block.
-6. **Full-config parse and whole-hook-array validation.** The verifier parses the complete file with vendored `smol-toml@1.6.1` with the upstream GHSA-7w5x-hrqm-74c2 fix backported (see `runtime/vendor/smol-toml/README.md`), before inspecting the managed block. It then applies upstream's strict config schema to every configured hook (`event`, optional string `matcher`, non-empty `command`, optional integer `timeout` 1–600, no extra fields). A malformed unrelated TOML value or one invalid foreign hook can make kimi-code discard enforcement; both therefore fail verification.
+6. **Full-config parse and whole-hook-array validation.** The verifier parses the complete file with vendored `smol-toml@1.9.1` with upstream fixes included and no local JavaScript modifications (see `runtime/vendor/smol-toml/README.md`), before inspecting the managed block. It then applies upstream's strict config schema to every configured hook (`event`, optional string `matcher`, non-empty `command`, optional integer `timeout` 1–600, no extra fields). A malformed unrelated TOML value or one invalid foreign hook can make kimi-code discard enforcement; both therefore fail verification.
 7. **Serialized, identity-bound setup mutations.** Install and uninstall hold a private `0o600` sibling lock across the complete read-modify-write transaction. The candidate lock is published atomically; lock reads are no-follow, nonblocking, regular-file-only, and capped at 4 KiB. Acquisition is bounded, live owners are never stolen, stale recovery is guarded by a nonrecursive recovery lease, and inode/token ownership is rechecked before config mutation or lock removal. Simultaneous Claude Code/Codex setup runs therefore cannot lose either host's block, and a replaced lock is never treated as ours. A newly created Kimi home is `0o700`; atomic config writes remain `0o600`.
 8. **Inline hook arrays are normalized before insertion.** kimi-code accepts both `hooks = [...]` and `[[hooks]]`, but appending a managed array-of-tables block after an inline assignment can produce a conflicting document. Setup converts a valid inline hook array to canonical `[[hooks]]` tables before inserting the host block and emits an explicit warning that formatting and comments inside that assignment are normalized. Surrounding config bytes are preserved.
 
@@ -225,6 +225,53 @@ If another installed host still points to an older hook, that hook may veto thes
 - **Field-proven by a real-binary smoke.** `tests/runtime/real-binary-smoke.test.ts` runs the real `runSwarm --write` and asserts the POSITIVE end-to-end (a `coder` subagent's edits land in the worktree, captured as a patch; the user's real tree is byte-identical + git-clean; the worktree is cleaned up) plus the NEGATIVE (an absolute-path write outside the trusted root is hook-denied). It is the check that catches `tool_input` field-name drift — `Write`/`Edit` carry `path`, not `file_path`, and reading the wrong key denies every real write silently.
 - **Model-invocable agent (v1.5), patch-only by construction.** Following the field-proof above, `--write` now has a `kimi-swarm-write` subagent so the main Claude thread can dispatch a write fan-out on its own judgement — the same human-command + model-invocable-agent split the rest of the suite uses. Auto-dispatch is a safe extension here because it widens **no** write surface and removes **no** bound: the agent path runs the identical `runSwarm --write` code, so edits still land only in the throwaway worktree, the managed hook still gates every `coder` subagent, the patch is still handed back for the user to apply (**the plugin never applies or commits**), and `--budget` + default `--max-concurrency` 1 + the hook requirement all still hold. In fact write-swarm is a *less* dangerous agent than the `kimi-pursue` agent already shipped: pursue writes directly into the workspace, whereas write-swarm's output is a patch the human reviews before anything reaches a real tree. Because it is still a write surface, the agent description demands BOTH signals — many disjoint write targets AND explicit fan-out intent — and steers single edits to `kimi-rescue`, read-only fan-outs to `kimi-swarm`, and autonomous loops to `kimi-pursue`. Default `--max-concurrency` stays **1**; raising it (concurrent writers) remains a deliberate, human-or-explicitly-requested choice.
 
+## Response budgets and partial output (2.2.0)
+
+Every single-turn command runs under a wall-clock budget: ask, review and
+challenge default to 30 minutes, rescue to 45, and `--budget <dur>` (at most
+24h) overrides it per job. The budget is persisted on the job row, so a detached
+worker and a same-operation resume use the same ceiling. For these commands the
+budget is a response-time limit, not a safety bound: a timeout is a safe
+failure. The job stays `failed`; whatever assistant prose had settled is written
+into the artifact under a heading that says it is NOT a final answer, and
+`result <jobId> --json` reports `partial_output: true` when prose exists.
+Cancellation and nonzero exits do not capture partial output. A session ID is kept if Kimi announced it or, on a native-v2 budget timeout, recovered from the session store when exactly one session matches this spawn — created between spawn and settlement in the same directory AND whose journal opens with this job's exact prompt; `result --json` identifies the source in `kimi_session_id_source`, and `error.details.session_recovery` says why no ID was recovered (`none`, `journal_missing:<n>`, `digest_mismatch:<n>`, `ambiguous:<n>`, `enumeration_capped`, `engine_unobserved`). Recovery is bounded and refuses ambiguity, incomplete enumeration, and IDs already used by another job on this host. The prompt binding is what makes attribution proof rather than probability: a concurrent interactive session in the same directory, another host's finished job (host stores cannot see each other's IDs) or a `state.json` planted by repository code running under rescue all fail it unless they carry the exact prompt, and a planted clean journal could otherwise replay attacker-written turns into the next resume. Recovery is skipped when the run never emitted the `system.version` marker, since resume would refuse the row as lineage-unknown anyway. Recovered sessions still require proven native-v2 lineage and the raw plan-taint scan before resume. Inherited budgets are printed to stderr at launch; status and `result --json` expose `budget_source` (`explicit`, `inherited`, or `default`; old non-null budgets report `unknown`).
+
+Pursue and swarm keep their ceilings as the sole hard bound on autonomy and
+cost. One nuance: a run whose process exits cleanly in the same event-loop tick
+as the budget timer is accepted as a success rather than discarded, so a goal
+can complete at most one tick past its ceiling — teardown has already settled by
+then, and nothing runs longer.
+
+Every spawn also deletes `KIMI_CODE_TRUST_WORKSPACE` from the child
+environment (kimi-code 2.2.0): a trusted workspace boots repo-defined project
+MCP servers at bootstrap, outside the PreToolUse hook, and an inherited value
+would have trusted every plugin spawn including swarm-write's throwaway
+worktree. A directory the operator trusted interactively in the Kimi TUI still
+has that property; that persisted-trust route is a documented residual, not
+something the plugin can close.
+
+## Running a newer Kimi than the plugin certifies
+
+The plugin refuses any kimi-code version it has not certified, so an operator
+who tracks `@latest` loses every `/kimi:*` command until the next certification.
+The clean way to have both is to give the plugin its own binary: install the
+highest certified version somewhere stable and point `KIMI_PLUGIN_CC_KIMI_BIN`
+at it (the runtime resolves that path instead of `kimi` on `PATH`; every spawn
+still exports `KIMI_CODE_NO_AUTO_UPDATE=1`, so the pinned copy never drifts).
+
+```sh
+PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.2.0
+mkdir -p "$PIN" && cd "$PIN" && printf '{"name":"kimi-plugin-cc-pin","private":true}\n' > package.json
+bun add @moonshot-ai/kimi-code@2.2.0
+export KIMI_PLUGIN_CC_KIMI_BIN="$PIN/node_modules/.bin/kimi"   # e.g. in ~/.zshenv
+```
+
+Both binaries share `~/.kimi-code` (login, config, hook), so nothing else
+changes. The certified maximum can be read from the installed plugin
+(`NATIVE_V2_CERTIFIED_VERSIONS` in `dist/kimi-engine.js`), which lets an upgrade
+script bump the pin automatically after each certification.
+
 ## The setup probe
 
 `/kimi:setup` runs a two-layer probe before reporting success:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.0.8",
+  "version": "2.2.0",
   "description": "Kimi for Claude Code and Codex: code questions, reviews, fixes, and parallel tasks through the local Kimi Code CLI.",
   "type": "module",
   "engines": {

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.0.8",
+  "version": "2.2.0",
   "description": "Codex plugin that delegates review, challenge, ask, rescue, pursue, and swarm workflows to the local kimi-code CLI through the kimi-plugin-cc companion runtime.",
   "author": {
     "name": "linxule"

package/plugins/kimi-codex/dist/cli-client.js

@@ -84,7 +84,9 @@ export async function runCliPrompt(opts) {
         });
     }
     let child;
+    let spawnedAt;
     try {
+        spawnedAt = Date.now();
         child = spawn(opts.command, args, {
             cwd: opts.cwd,
             env,
@@ -329,7 +331,7 @@ export async function runCliPrompt(opts) {
                     return;
                 }
                 if (kind === "resolve")
-                    resolve(payload);
+                    resolve({ ...payload, settledAt: Date.now() });
                 else
                     reject(payload);
             });
@@ -580,6 +582,8 @@ export async function runCliPrompt(opts) {
             // The result itself is in memory; diagnostics are best-effort.
             await raceWithTimeout(logChain, LOG_DRAIN_TIMEOUT_MS);
             settle("resolve", {
+                spawnedAt,
+                settledAt: 0, // Filled at settlement, after the teardown barrier.
                 sessionId,
                 goalSummary: announcedGoalSummary,
                 systemVersion: announcedSystemVersion,
@@ -656,7 +660,9 @@ export function requireSessionId(result, context) {
         },
     });
 }
-/** Settled timeout data; stream records are deliberately non-serializable. */
+/** Settled timeout data; stream records are deliberately non-serializable.
+ * Without a partial result (teardown rejection), aborted means abort was issued,
+ * not that the process was observed aborting. */
 export class ResponseTimeoutError extends RuntimeError {
     constructor(budgetMs, stage, commandLabel, partialResult, cause) {
         super("RESPONSE_TIMEOUT", `${stage} timed out after ${budgetMs}ms.`, stage, {
@@ -666,7 +672,7 @@ export class ResponseTimeoutError extends RuntimeError {
                 command_label: commandLabel ?? null,
                 record_count: partialResult?.records.length ?? 0,
                 partial_output_chars: partialResult?.records.reduce((count, record) => count + (record.role === "assistant" && typeof record.content === "string" ? record.content.length : 0), 0) ?? 0,
-                aborted: true,
+                aborted: partialResult?.aborted ?? true,
                 ...(partialResult ? { settled_post_abort: true } : {}),
             },
         });

package/plugins/kimi-codex/dist/commands/ask.js

@@ -17,7 +17,7 @@ import { readArtifact, renderManagedJobOutput, writeArtifact } from "../render.j
 import { classifyManagedCommandFailure } from "../kimi-errors.js";
 import { startBackgroundJob } from "../background-spawn.js";
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
-import { captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
+import { warnInheritedBudget, captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
 // v1.0 cutover note (PR 2):
 //
@@ -80,10 +80,13 @@ export async function runAsk(argv, context) {
             thinking: parsed.thinking ?? null,
             background: parsed.background,
             budget_ms: parsed.budgetMs ?? (sessionResolution.sourceJob?.operation_kind === "ask" ? sessionResolution.sourceJob.budget_ms : null) ?? null,
+            budget_source: parsed.budgetMs !== undefined ? "explicit"
+                : sessionResolution.sourceJob?.operation_kind === "ask" && sessionResolution.sourceJob.budget_ms !== null ? "inherited" : "default",
             pid: parsed.background ? null : process.pid,
             kimi_pid: null,
             status: "running",
             kimi_session_id: sessionResolution.kimiSessionId,
+            kimi_session_id_source: sessionResolution.sourceJob?.kimi_session_id_source ?? null,
             ...persistedExecutionPlanFields(executionPlan),
             agent_profile: ASK_AGENT_PROFILE_PLACEHOLDER,
             prompt_digest: digestPrompt(askPrompt),
@@ -105,6 +108,7 @@ export async function runAsk(argv, context) {
             await markJobFailed(store, paths, job, classified, askConfig.cancellation.failedSummary, { phase: "failed" });
             throw classified;
         }
+        warnInheritedBudget(job, context.stderr);
         if (parsed.background) {
             return startBackgroundJob(job, askPrompt, context, paths, {
                 workerKind: "ask",
@@ -184,12 +188,11 @@ export async function executeAskJob(jobId, prompt, context, options) {
         // sessions it should match the input, but capture anyway in case
         // kimi-code mints a new id on each turn.
         if (result.sessionId !== undefined &&
-            result.sessionId.length > 0 &&
-            result.sessionId !== job.kimi_session_id) {
+            result.sessionId.length > 0) {
             // length>0 guard: empty-string capture would poison the row. The
             // warning helper's null-ish check would also fire but only after
             // the bad write. (Kimi alpha.4 challenge finding #3.)
-            store.updateRunningJob(job.job_id, { kimi_session_id: result.sessionId });
+            store.updateRunningJob(job.job_id, { kimi_session_id_source: "announced", kimi_session_id: result.sessionId });
         }
         await syncKimiSessionTitle({
             promptText: prompt,
@@ -219,6 +222,9 @@ export async function executeAskJob(jobId, prompt, context, options) {
         }) ?? job);
     }
     catch (error) {
+        const classified = error instanceof RuntimeError && error.stage === "ask.hook-check" ? error
+            : classifyManagedCommandFailure(error, "ask", job.job_id, { background: job.background, budgetMs: job.budget_ms ?? KIMI_ASK_PROMPT_TIMEOUT_MS });
+        const partialOutput = await captureTimeoutPartialOutput(classified, store, job, context.env, handlers?.signal);
         if (handlers?.cancelling) {
             const cancelledError = new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.default, "ask.runtime", error instanceof Error ? { cause: error } : undefined);
             return await markJobCancelled(store, paths, job, cancel.cancelledSummary, cancelledError, { phase: "cancelled" });
@@ -231,8 +237,6 @@ export async function executeAskJob(jobId, prompt, context, options) {
             await markJobFailed(store, paths, job, error, cancel.failedSummary, { phase: "failed" });
             throw error;
         }
-        const classified = classifyManagedCommandFailure(error, "ask", job.job_id, { background: job.background, budgetMs: job.budget_ms ?? KIMI_ASK_PROMPT_TIMEOUT_MS });
-        const partialOutput = captureTimeoutPartialOutput(classified, store, job);
         await markJobFailed(store, paths, job, classified, cancel.failedSummary, { phase: "failed", partialOutput });
         throw classified;
     }

package/plugins/kimi-codex/dist/commands/cli-helpers.js

@@ -1,6 +1,9 @@
 import { RuntimeError } from "../errors.js";
 import { ResponseTimeoutError } from "../cli-client.js";
 import { observedExecutionFields } from "../kimi-engine.js";
+import { resolveKimiHome } from "../kimi-home.js";
+import { recoverSessionIdFromStore } from "../session-recovery.js";
+import { formatBudgetDuration } from "../render.js";
 /**
  * Reassemble prose final text from cli-client records.
  *
@@ -112,12 +115,42 @@ export function assertCliResultSuccess(result, stage) {
         });
     }
 }
-/** Timeout-only capture, called after cancellation has taken precedence. No title sync on failure. */
-export function captureTimeoutPartialOutput(classified, store, job) {
+/** Timeout-only capture. Cancellation takes precedence, including while the
+ * asynchronous store scan is in flight. No title sync on failure. */
+export async function captureTimeoutPartialOutput(classified, store, job, env, cancellationSignal) {
+    if (cancellationSignal?.aborted)
+        return undefined;
     const timeout = classified.cause;
     if (!(timeout instanceof ResponseTimeoutError) || !timeout.partialResult)
         return undefined;
     const result = timeout.partialResult;
+    let sessionId = result.sessionId;
+    let source = sessionId ? "announced" : null;
+    const details = classified instanceof RuntimeError ? classified.details : timeout.details;
+    details.kimi_session_id_source = job.kimi_session_id_source;
+    // The persisted plan is plugin-owned. Recovery never runs on cancellation,
+    // v1, successful turns, teardown rejection, or an already-known resume id.
+    if (!sessionId && !job.kimi_session_id && job.intended_engine === "native-v2") {
+        // Without the system.version marker the row has no proven engine, and
+        // resume would refuse the id as lineage-unknown; do not advertise one.
+        if (result.observedEngine === null) {
+            details.session_recovery = "engine_unobserved";
+        }
+        else {
+            const recovered = await recoverSessionIdFromStore({
+                kimiHome: resolveKimiHome(env, job.cwd), cwd: job.cwd,
+                spawnedAt: result.spawnedAt, settledAt: result.settledAt, promptDigest: job.prompt_digest,
+                store, jobId: job.job_id,
+            });
+            sessionId = recovered.sessionId;
+            if (sessionId)
+                source = "recovered_session_dir";
+            else
+                details.session_recovery = recovered.reason;
+        }
+    }
+    if (cancellationSignal?.aborted)
+        return undefined;
     // Best-effort metadata only. The row is still `running`, and a session id
     // written here can collide with `jobs_running_session_idx` when a resume of
     // the same session was started while this job ran. A store error must never
@@ -125,11 +158,22 @@ export function captureTimeoutPartialOutput(classified, store, job) {
     // than the metadata, so swallow and fall through.
     try {
         store.updateRunningJob(job.job_id, observedExecutionFields(result));
-        if (result.sessionId !== undefined && result.sessionId.length > 0 && result.sessionId !== job.kimi_session_id) {
-            store.updateRunningJob(job.job_id, { kimi_session_id: result.sessionId });
+        if (sessionId) {
+            const updated = source === "recovered_session_dir"
+                ? store.claimRecoveredSessionId(job.job_id, sessionId)
+                : store.updateRunningJob(job.job_id, { kimi_session_id: sessionId, kimi_session_id_source: source });
+            if (updated?.kimi_session_id === sessionId && updated.kimi_session_id_source === source) {
+                details.kimi_session_id = sessionId;
+                details.kimi_session_id_source = source;
+            }
+            else
+                details[source === "recovered_session_dir" ? "session_recovery" : "session_id_persistence"] = "persistence_failed";
         }
     }
     catch {
+        // `session_recovery` describes only the recovery branch; an announced id or
+        // the provenance update failing is a different fact.
+        details[source === "recovered_session_dir" ? "session_recovery" : "session_id_persistence"] = "persistence_failed";
         // Diagnostics stay in the stream log; the failure transition proceeds.
     }
     return {
@@ -141,3 +185,8 @@ export function captureTimeoutPartialOutput(classified, store, job) {
         budgetMs: timeout.details.budget_ms,
     };
 }
+export function warnInheritedBudget(job, stderr) {
+    if (job.budget_source === "inherited" && job.budget_ms !== null) {
+        stderr.write(`[${job.command_type}] budget ${formatBudgetDuration(job.budget_ms)} inherited from job ${job.resumed_from_job_id}; pass --budget to override\n`);
+    }
+}

package/plugins/kimi-codex/dist/commands/pursue.js

@@ -144,6 +144,7 @@ export async function runPursue(argv, context) {
             thinking: parsed.thinking ?? null,
             background: false,
             budget_ms: parsed.budgetMs ?? KIMI_PURSUE_DEFAULT_BUDGET_MS,
+            budget_source: parsed.budgetMs !== undefined ? "explicit" : "default",
             pid: process.pid,
             kimi_pid: null,
             status: "running",
@@ -250,7 +251,7 @@ async function executePursueJob(jobId, prompt, objective, budgetMs, context) {
         if (result.sessionId !== undefined &&
             result.sessionId.length > 0 &&
             result.sessionId !== job.kimi_session_id) {
-            store.updateRunningJob(job.job_id, { kimi_session_id: result.sessionId });
+            store.updateRunningJob(job.job_id, { kimi_session_id_source: "announced", kimi_session_id: result.sessionId });
         }
         await syncKimiSessionTitle({
             promptText: objective,

package/plugins/kimi-codex/dist/commands/rescue.js

@@ -17,7 +17,7 @@ import { parseRescueArgs } from "../parsing.js";
 import { readArtifact, renderManagedJobOutput, writeArtifact } from "../render.js";
 import { startBackgroundJob } from "../background-spawn.js";
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
-import { captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
+import { warnInheritedBudget, captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
 export { describeMissingResult } from "../background-spawn.js";
 // v1.0 cutover note (PR 3):
@@ -72,10 +72,13 @@ export async function runRescue(argv, context) {
             thinking: parsed.thinking ?? null,
             background: parsed.background,
             budget_ms: parsed.budgetMs ?? (sessionResolution.sourceJob?.operation_kind === "rescue" ? sessionResolution.sourceJob.budget_ms : null) ?? null,
+            budget_source: parsed.budgetMs !== undefined ? "explicit"
+                : sessionResolution.sourceJob?.operation_kind === "rescue" && sessionResolution.sourceJob.budget_ms !== null ? "inherited" : "default",
             pid: parsed.background ? null : process.pid,
             kimi_pid: null,
             status: "running",
             kimi_session_id: sessionResolution.kimiSessionId,
+            kimi_session_id_source: sessionResolution.sourceJob?.kimi_session_id_source ?? null,
             ...persistedExecutionPlanFields(executionPlan),
             agent_profile: RESCUE_AGENT_PROFILE_PLACEHOLDER,
             prompt_digest: digestPrompt(prompt),
@@ -97,6 +100,7 @@ export async function runRescue(argv, context) {
             await markJobFailed(store, paths, job, classified, rescueConfig.cancellation.failedSummary, { phase: "failed" });
             throw classified;
         }
+        warnInheritedBudget(job, context.stderr);
         if (parsed.background) {
             return startBackgroundJob(job, prompt, context, paths, {
                 workerKind: "rescue",
@@ -196,11 +200,10 @@ export async function executeRescueJob(jobId, prompt, context, options) {
         }
         assertCliResultSuccess(result, "rescue.runtime");
         if (result.sessionId !== undefined &&
-            result.sessionId.length > 0 &&
-            result.sessionId !== job.kimi_session_id) {
+            result.sessionId.length > 0) {
             // length>0 guard: empty-string capture would poison the row. (Kimi
             // alpha.4 challenge finding #3.)
-            store.updateRunningJob(job.job_id, { kimi_session_id: result.sessionId });
+            store.updateRunningJob(job.job_id, { kimi_session_id_source: "announced", kimi_session_id: result.sessionId });
         }
         await syncKimiSessionTitle({
             promptText: prompt,
@@ -246,16 +249,16 @@ export async function executeRescueJob(jobId, prompt, context, options) {
         }) ?? job);
     }
     catch (error) {
-        if (handlers.cancelling) {
-            const cancelledError = new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.default, "rescue.runtime", error instanceof Error ? { cause: error } : undefined);
-            return await markJobCancelled(store, paths, job, cancel.cancelledSummary, cancelledError, { phase: "cancelled" });
-        }
         const classified = classifyManagedCommandFailure(error, "rescue", job.job_id, {
             preserveStage: true,
             background: job.background,
             budgetMs: job.budget_ms ?? KIMI_RESCUE_PROMPT_TIMEOUT_MS,
         });
-        const partialOutput = captureTimeoutPartialOutput(classified, store, job);
+        const partialOutput = await captureTimeoutPartialOutput(classified, store, job, context.env, handlers.signal);
+        if (handlers.cancelling) {
+            const cancelledError = new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.default, "rescue.runtime", error instanceof Error ? { cause: error } : undefined);
+            return await markJobCancelled(store, paths, job, cancel.cancelledSummary, cancelledError, { phase: "cancelled" });
+        }
         return await markJobFailed(store, paths, job, classified, cancel.failedSummary, { phase: "failed", partialOutput });
     }
     finally {

package/plugins/kimi-codex/dist/commands/result.js

@@ -2,7 +2,7 @@ import { RuntimeError } from "../errors.js";
 import { resolveRepoIdentity } from "../git.js";
 import { sweepStaleJobs } from "../jobs.js";
 import { reconcileHistoricalJobProvenance } from "../kimi-engine.js";
-import { withJobStore } from "../job-store.js";
+import { renderBudgetSource, withJobStore } from "../job-store.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { parseJobLookupArgs } from "../parsing.js";
 import { readArtifact, renderTerminalJobArtifact } from "../render.js";
@@ -43,6 +43,8 @@ function renderResultEnvelope(job, artifactPath, body) {
         kind: job.command_type,
         status: job.status,
         budget_ms: job.budget_ms,
+        budget_source: renderBudgetSource(job),
+        kimi_session_id_source: job.kimi_session_id_source,
         kimi_session_id: job.kimi_session_id,
         // True when a budget timeout preserved assistant prose in the artifact.
         partial_output: job.status === "failed" && Number(job.error?.details?.partial_output_chars ?? 0) > 0,

package/plugins/kimi-codex/dist/commands/review-gate.js

@@ -153,6 +153,7 @@ async function executeReviewGate(payload, assistantMessage, context) {
             kimi_pid: null,
             status: "running",
             kimi_session_id: null,
+            budget_source: "default",
             ...persistedExecutionPlanFields(executionPlan),
             agent_profile: REVIEW_GATE_AGENT_PROFILE_PLACEHOLDER,
             prompt_digest: digestPrompt(prompt),
@@ -195,7 +196,7 @@ async function executeReviewGate(payload, assistantMessage, context) {
                 // can't synthesize empty strings today, but the guard locks the
                 // SQLite contract independent of upstream behavior).
                 activeStore.updateRunningJob(job.job_id, {
-                    kimi_session_id: result.sessionId,
+                    kimi_session_id_source: "announced", kimi_session_id: result.sessionId,
                 });
             }
             const finalText = reassembleProseFromRecords(result.records);

package/plugins/kimi-codex/dist/commands/review.js

@@ -82,6 +82,7 @@ export async function runReview(argv, context, commandType) {
         thinking: parsed.thinking ?? null,
         background: false,
         budget_ms: parsed.budgetMs ?? null,
+        budget_source: parsed.budgetMs !== undefined ? "explicit" : "default",
         pid: process.pid,
         kimi_pid: null,
         status: "running",
@@ -128,7 +129,7 @@ export async function runReview(argv, context, commandType) {
             // poison the row — consumers reading SQLite distinguish "missing"
             // (NULL) from "captured" (non-empty UUID) only via NULL-ness.
             // (Kimi alpha.4 challenge finding #3.)
-            store.updateRunningJob(job.job_id, { kimi_session_id: result.sessionId });
+            store.updateRunningJob(job.job_id, { kimi_session_id_source: "announced", kimi_session_id: result.sessionId });
         }
         await syncKimiSessionTitle({
             promptText: previewPrompt,
@@ -159,13 +160,13 @@ export async function runReview(argv, context, commandType) {
         return rendered.output;
     }
     catch (error) {
+        const classified = classifyManagedCommandFailure(error, commandType, job.job_id, { background: job.background, budgetMs: job.budget_ms ?? KIMI_REVIEW_PROMPT_TIMEOUT_MS });
+        const partialOutput = await captureTimeoutPartialOutput(classified, store, job, context.env, handlers.signal);
         if (handlers.cancelling) {
             const cancelledError = new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.default, `${commandType}.runtime`, error instanceof Error ? { cause: error } : undefined);
             await markJobCancelled(store, paths, job, cancel.cancelledSummary, cancelledError);
             throw cancelledError;
         }
-        const classified = classifyManagedCommandFailure(error, commandType, job.job_id, { background: job.background, budgetMs: job.budget_ms ?? KIMI_REVIEW_PROMPT_TIMEOUT_MS });
-        const partialOutput = captureTimeoutPartialOutput(classified, store, job);
         await markJobFailed(store, paths, job, classified, cancel.failedSummary, { partialOutput });
         throw classified;
     }

package/plugins/kimi-codex/dist/commands/status.js

@@ -2,7 +2,7 @@ import { RuntimeError } from "../errors.js";
 import { resolveRepoIdentity } from "../git.js";
 import { sweepStaleJobs } from "../jobs.js";
 import { reconcileHistoricalJobProvenance } from "../kimi-engine.js";
-import { withJobStore } from "../job-store.js";
+import { renderBudgetSource, withJobStore } from "../job-store.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { parseJobLookupArgs } from "../parsing.js";
 export async function runStatus(argv, context) {
@@ -22,6 +22,6 @@ export async function runStatus(argv, context) {
             throw new RuntimeError("JOB_NOT_FOUND", "No matching job was found for status.", "status.lookup");
         }
         const job = await reconcileHistoricalJobProvenance(store, found);
-        return `${JSON.stringify(job, null, 2)}\n`;
+        return `${JSON.stringify({ ...job, budget_source: renderBudgetSource(job) }, null, 2)}\n`;
     });
 }

package/plugins/kimi-codex/dist/commands/swarm.js

@@ -211,6 +211,7 @@ async function runReadSwarm(parsed, objective, context) {
             thinking: parsed.thinking ?? null,
             background: false,
             budget_ms: parsed.budgetMs ?? KIMI_SWARM_DEFAULT_BUDGET_MS,
+            budget_source: parsed.budgetMs !== undefined ? "explicit" : "default",
             pid: process.pid,
             kimi_pid: null,
             status: "running",
@@ -310,6 +311,7 @@ async function runWriteSwarm(parsed, objective, context) {
                 thinking: parsed.thinking ?? null,
                 background: false,
                 budget_ms: parsed.budgetMs ?? KIMI_SWARM_DEFAULT_BUDGET_MS,
+                budget_source: parsed.budgetMs !== undefined ? "explicit" : "default",
                 pid: process.pid,
                 kimi_pid: null,
                 status: "running",
@@ -502,7 +504,7 @@ writeMode) {
         if (result.sessionId !== undefined &&
             result.sessionId.length > 0 &&
             result.sessionId !== job.kimi_session_id) {
-            store.updateRunningJob(job.job_id, { kimi_session_id: result.sessionId });
+            store.updateRunningJob(job.job_id, { kimi_session_id_source: "announced", kimi_session_id: result.sessionId });
         }
         await syncKimiSessionTitle({
             promptText: objective,

package/plugins/kimi-codex/dist/hooks/config-safety.js

@@ -417,15 +417,23 @@ export function normalizeTopLevelInlineHooks(contents, lineEnding) {
         entryCount: hooks.length,
     };
 }
+// Same defaults as smol-toml 1.9.1 parse(); this walker only locates assignments.
+// tests/runtime/toml-walker-context.test.ts asserts these against the vendored parse().
+export function assignmentParseContext(s) {
+    return { s, p: s.charCodeAt(0) === 0xfeff ? 1 : 0, d: 1_000, bi: false, ld: true, uk: 0 };
+}
 function findTopLevelHooksAssignment(contents) {
-    let ptr = skipVoid(contents, 0);
-    while (ptr < contents.length) {
+    const ctx = assignmentParseContext(contents);
+    skipVoid(ctx);
+    while (ctx.p < contents.length) {
         // A root-level direct assignment cannot resume after entering a table.
-        if (contents[ptr] === "[")
+        if (contents[ctx.p] === "[")
             return null;
-        const declarationStart = ptr;
-        const [key, valueStart] = parseKey(contents, ptr);
-        const [, valueEnd] = extractValue(contents, valueStart, undefined, 1_000, undefined);
+        const declarationStart = ctx.p;
+        const key = parseKey(ctx);
+        skipVoid(ctx, true, true);
+        extractValue(ctx, undefined);
+        const valueEnd = ctx.p;
         if (key.length === 1 && key[0] === "hooks") {
             const lineStart = contents.lastIndexOf("\n", declarationStart - 1) + 1;
             const start = /^[\t ]*$/.test(contents.slice(lineStart, declarationStart))
@@ -445,7 +453,7 @@ function findTopLevelHooksAssignment(contents) {
             }
             return { start, end, hadLineEnding };
         }
-        ptr = skipVoid(contents, valueEnd);
+        skipVoid(ctx);
     }
     return null;
 }