kimi-plugin-cc 2.0.8 → 2.2.0

package/plugins/kimi-codex/dist/job-store.js

@@ -11,8 +11,11 @@ export class JobStore {
         let db;
         try {
             db = createSqliteAdapter(paths.stateDbPath);
-            db.pragma("journal_mode = WAL");
+            // busy_timeout FIRST: switching the journal mode takes a brief write lock,
+            // and a second opener (status/result racing a worker) otherwise fails
+            // immediately with SQLITE_BUSY instead of waiting (seen 2026-10-14).
             db.pragma("busy_timeout = 5000");
+            db.pragma("journal_mode = WAL");
         }
         catch (error) {
             try {
@@ -70,6 +73,11 @@ export class JobStore {
             if (!tableHasColumn(this.db, "budget_ms")) {
                 this.db.exec(`ALTER TABLE jobs ADD COLUMN budget_ms INTEGER;`);
             }
+            for (const column of ["kimi_session_id_source", "budget_source"]) {
+                if (!tableHasColumn(this.db, column)) {
+                    this.db.exec("ALTER TABLE jobs ADD COLUMN " + column + " TEXT;");
+                }
+            }
             // Additive provenance migration. Existing rows deliberately remain NULL:
             // v1.9.5 plus kimi-code 0.33/0.34 could have routed to native v2 before the
             // legacy pin landed, so a blanket historical v1 backfill would invent fact.
@@ -98,6 +106,8 @@ export class JobStore {
       CREATE INDEX IF NOT EXISTS jobs_repo_type_updated_idx
         ON jobs (repo_id, command_type, updated_at DESC);
 
+      CREATE INDEX IF NOT EXISTS jobs_session_id_idx ON jobs (kimi_session_id);
+
       CREATE INDEX IF NOT EXISTS jobs_session_idx
         ON jobs (repo_id, kimi_session_id, updated_at DESC);
 
@@ -163,14 +173,14 @@ export class JobStore {
             this.db.run(`
           INSERT INTO jobs (
             job_id, repo_id, command_type, created_at, updated_at, cwd, model, thinking,
-            background, pid, kimi_pid, status, kimi_session_id,
+            background, pid, kimi_pid, status, kimi_session_id, kimi_session_id_source, budget_source,
             operation_kind, intended_engine, observed_engine, kimi_version, system_version,
             kimi_command, kimi_prefix_args, plan_certification, resumed_from_job_id, safety_profile,
             agent_profile, prompt_digest, summary, phase, budget_ms, final_output_path, stream_log_path, error
           )
           VALUES (
             @job_id, @repo_id, @command_type, @created_at, @updated_at, @cwd, @model, @thinking,
-            @background, @pid, @kimi_pid, @status, @kimi_session_id,
+            @background, @pid, @kimi_pid, @status, @kimi_session_id, @kimi_session_id_source, @budget_source,
             @operation_kind, @intended_engine, @observed_engine, @kimi_version, @system_version,
             @kimi_command, @kimi_prefix_args, @plan_certification, @resumed_from_job_id, @safety_profile,
             @agent_profile, @prompt_digest, @summary, @phase, @budget_ms, @final_output_path, @stream_log_path, @error
@@ -198,6 +208,10 @@ export class JobStore {
         const row = this.db.get("SELECT * FROM jobs WHERE job_id = ?", jobId);
         return row ? hydrateRow(row) : null;
     }
+    /** Global across repos and terminal states; optionally exclude the current row. */
+    hasSessionId(sessionId, exceptJobId = "") {
+        return Boolean(this.db.get("SELECT 1 FROM jobs WHERE kimi_session_id = ? AND job_id != ? LIMIT 1", sessionId, exceptJobId));
+    }
     findLatestJob(options) {
         const conditions = ["repo_id = @repo_id"];
         const params = {
@@ -247,6 +261,18 @@ export class JobStore {
     updateRunningJob(jobId, patch) {
         return this.updateWhere(jobId, patch, "status = 'running'");
     }
+    /** Recheck uniqueness atomically: another worker can claim an ID during the
+     * asynchronous directory scan. Ordinary announced/resumed IDs may be shared. */
+    claimRecoveredSessionId(jobId, sessionId) {
+        this.db.run(`UPDATE jobs
+      SET kimi_session_id = @session_id, kimi_session_id_source = 'recovered_session_dir',
+          updated_at = @updated_at
+      WHERE job_id = @job_id AND status = 'running' AND kimi_session_id IS NULL
+        AND NOT EXISTS (SELECT 1 FROM jobs WHERE kimi_session_id = @session_id AND job_id != @job_id)`, { job_id: jobId, session_id: sessionId, updated_at: new Date().toISOString() });
+        const job = this.getJob(jobId);
+        return job?.status === "running" && job.kimi_session_id === sessionId &&
+            job.kimi_session_id_source === "recovered_session_dir" ? job : null;
+    }
     /**
      * Evidence-only backfill for pre-provenance rows. COALESCE prevents forensic
      * inspection from overwriting a field already recorded at execution time.
@@ -280,7 +306,7 @@ export class JobStore {
         return this.updateWhere(jobId, { ...patch, status: "cancelled", pid: null, kimi_pid: null }, "status = 'running'");
     }
     static JOBS_COLUMNS = new Set([
-        "status", "summary", "phase", "budget_ms", "pid", "kimi_pid",
+        "status", "summary", "phase", "budget_ms", "budget_source", "kimi_session_id_source", "pid", "kimi_pid",
         "final_output_path", "stream_log_path", "kimi_session_id",
         "error", "command_type", "prompt_digest", "repo_id",
         "cwd", "model", "thinking", "background", "agent_profile",
@@ -325,6 +351,8 @@ function serializeRecord(record) {
         ...record,
         phase: record.phase ?? null,
         budget_ms: record.budget_ms ?? null,
+        budget_source: record.budget_source ?? null,
+        kimi_session_id_source: record.kimi_session_id_source ?? null,
         operation_kind: record.operation_kind ?? null,
         intended_engine: record.intended_engine ?? null,
         observed_engine: record.observed_engine ?? null,
@@ -562,3 +590,7 @@ export function withJobStoreSync(paths, fn) {
         store?.close();
     }
 }
+/** Old non-null budgets have unknown provenance; never invent explicit intent. */
+export function renderBudgetSource(job) {
+    return job.budget_source ?? (job.budget_ms === null ? "default" : "unknown");
+}

package/plugins/kimi-codex/dist/session-recovery.js

@@ -0,0 +1,203 @@
+import { constants } from "node:fs";
+import { lstat, open, opendir, realpath } from "node:fs/promises";
+import path from "node:path";
+import { digestPrompt } from "./jobs.js";
+// Total entries visited across both enumeration levels. A real store holds a
+// few thousand sessions (2,494 entries on the reference host when this was
+// written, growing by one per plugin run), so the preflight's 4,096 would have
+// switched recovery off within months; the cap is a guard against a
+// pathological tree, not a size budget. opendir streams, nothing is buffered.
+// Dot-entries (`.index-dirty`, `.index-cache`) are upstream index state, never
+// workspaces, and are skipped without being counted. Directories whose mtime
+// predates the spawn cannot have been created by this run and are skipped
+// before any read, so the byte budget scales with concurrent activity, not
+// with store size.
+const DIR_ENUM_CAP = 65_536;
+const STATE_MAX_BYTES = 1024 * 1024;
+const JOURNAL_PREFIX_BYTES = 4 * 1024 * 1024; // The prompt is argv-bounded (< 1 MiB); the first user message follows a few config records.
+const SCAN_MAX_BYTES = 64 * 1024 * 1024;
+const MTIME_SLACK_MS = 1000; // Filesystems with coarse mtime granularity.
+const SESSION_ID = /^session_[0-9a-f-]{36}$/;
+/** Metadata recovery only, never a substitute for resume lineage/plan scans.
+ * A capped or unreadable enumeration cannot establish uniqueness and refuses;
+ * skipping symlinked or dot entries is not partial — neither can be a session
+ * the child created.
+ *
+ * A candidate is bound to THIS job by content, not only by time: the first
+ * user message in the session's main journal must carry a text item whose
+ * sha256 equals the job's `prompt_digest` (the exact `-p` argument). Time and
+ * cwd alone would admit a concurrent TUI session, another host's finished job
+ * (host-local stores cannot see each other's session ids), or a `state.json`
+ * planted by repository code running under rescue. The digest is not unique
+ * on its own either (the same prompt can run twice), so the window and the
+ * exactly-one rule stay in force. */
+export async function recoverSessionIdFromStore(options) {
+    const entryCap = options.entryCap ?? DIR_ENUM_CAP;
+    let entries = 0;
+    let bytes = 0;
+    let digestMismatches = 0;
+    let missingJournals = 0;
+    const candidates = [];
+    const capped = new Error("enumeration_capped");
+    async function* directories(dir) {
+        if ((await lstat(dir)).isSymbolicLink())
+            throw new Error("unreadable");
+        const handle = await opendir(dir);
+        for await (const entry of handle) {
+            if (entry.name.startsWith("."))
+                continue;
+            if (++entries > entryCap)
+                throw capped;
+            // A symlinked entry is never a session the child created; skipping it
+            // keeps one stray link from disabling recovery host-wide. Directories
+            // we descend are still lstat-anchored above.
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory())
+                yield entry.name;
+        }
+    }
+    // Bounded no-follow read of a regular file. Returns undefined when the file
+    // is absent; throws "unreadable" for anything that is not a plain file. With
+    // `prefix`, a larger file yields its first `maxBytes` instead of refusing.
+    async function readBounded(file, maxBytes, prefix = false) {
+        let handle;
+        try {
+            handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile() || (stat.size > maxBytes && !prefix))
+                throw new Error("unreadable");
+            const size = Math.min(stat.size, maxBytes);
+            bytes += size;
+            if (bytes > SCAN_MAX_BYTES)
+                throw capped;
+            const buffer = Buffer.alloc(size);
+            let offset = 0;
+            while (offset < buffer.length) {
+                const read = await handle.read(buffer, offset, buffer.length - offset, offset);
+                if (!read.bytesRead)
+                    break;
+                offset += read.bytesRead;
+            }
+            return buffer.subarray(0, offset);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    try {
+        if (!Number.isFinite(options.spawnedAt) || !Number.isFinite(options.settledAt) ||
+            options.settledAt < options.spawnedAt || !/^[0-9a-f]{64}$/.test(options.promptDigest)) {
+            return { reason: "none" };
+        }
+        const cwd = await realpath(options.cwd);
+        const sessions = path.join(options.kimiHome, "sessions");
+        // Missing nested dirs mean an incomplete scan; only a missing root is normal.
+        try {
+            await lstat(sessions);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return { reason: "none" };
+            throw error;
+        }
+        for await (const workspace of directories(sessions)) {
+            const workspacePath = path.join(sessions, workspace);
+            for await (const session of directories(workspacePath)) {
+                if (!SESSION_ID.test(session))
+                    continue;
+                const sessionPath = path.join(workspacePath, session);
+                // A directory this run created was modified at or after the spawn.
+                if ((await lstat(sessionPath)).mtimeMs < options.spawnedAt - MTIME_SLACK_MS)
+                    continue;
+                const raw = await readBounded(path.join(sessionPath, "state.json"), STATE_MAX_BYTES);
+                if (!raw)
+                    continue;
+                let state;
+                try {
+                    state = JSON.parse(raw.toString("utf8"));
+                }
+                catch {
+                    continue;
+                }
+                if (!state || typeof state !== "object")
+                    continue;
+                const value = state;
+                // The child writes createdAt after the parent stamped spawnedAt on the
+                // same clock, so causality orders them; no pre-spawn slack is justified.
+                if (value.version !== 2 || typeof value.cwd !== "string" || !path.isAbsolute(value.cwd) ||
+                    typeof value.id !== "string" || !SESSION_ID.test(value.id) || value.id !== session ||
+                    typeof value.createdAt !== "number" || !Number.isFinite(value.createdAt) ||
+                    value.createdAt < options.spawnedAt || value.createdAt > options.settledAt)
+                    continue;
+                let stateCwd;
+                try {
+                    stateCwd = await realpath(value.cwd);
+                }
+                catch {
+                    continue;
+                }
+                if (stateCwd !== cwd || options.store.hasSessionId(value.id, options.jobId))
+                    continue;
+                const journal = await readBounded(path.join(sessionPath, "agents", "main", "wire.jsonl"), JOURNAL_PREFIX_BYTES, true);
+                if (!journal) {
+                    missingJournals += 1;
+                    continue;
+                }
+                // A prefix cut mid-record must never be parsed as a complete line.
+                const text = journal.length === JOURNAL_PREFIX_BYTES
+                    ? journal.subarray(0, journal.lastIndexOf(0x0a) + 1).toString("utf8") : journal.toString("utf8");
+                if (!firstUserMessageMatches(text, options.promptDigest)) {
+                    digestMismatches += 1;
+                    continue;
+                }
+                candidates.push(value.id);
+            }
+        }
+        if (candidates.length === 1)
+            return { sessionId: candidates[0] };
+        if (candidates.length > 1)
+            return { reason: `ambiguous:${candidates.length}` };
+        if (digestMismatches > 0)
+            return { reason: `digest_mismatch:${digestMismatches}` };
+        return { reason: missingJournals > 0 ? `journal_missing:${missingJournals}` : "none" };
+    }
+    catch (error) {
+        return { reason: error === capped ? "enumeration_capped" : "unreadable" };
+    }
+}
+/** True when the FIRST user message in a native-v2 main journal carries a
+ * text item equal to the prompt the job spawned with. Later user turns are
+ * never consulted: only the opening prompt binds a session to its spawn. */
+export function firstUserMessageMatches(journal, promptDigest) {
+    for (const line of journal.split("\n")) {
+        if (!line.trim())
+            continue;
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!record || typeof record !== "object")
+            continue;
+        const message = record.message;
+        if (!message || typeof message !== "object" || message.role !== "user")
+            continue;
+        const content = message.content;
+        if (!Array.isArray(content))
+            return false;
+        return content.some((item) => item && typeof item === "object" && item.type === "text" &&
+            typeof item.text === "string" &&
+            digestPrompt(item.text) === promptDigest);
+    }
+    return false;
+}

package/plugins/kimi-codex/dist/vendor/smol-toml/date.js

@@ -25,39 +25,68 @@
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-let DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|[-+]\d{2}:\d{2})?$/i;
+let DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[Tt ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|z|[-+]\d{2}:\d{2})?$/i;
 export class TomlDate extends Date {
     #hasDate = false;
     #hasTime = false;
     #offset = null;
-    constructor(date) {
+    constructor(date, fasttype, unsafeDelim) {
         let hasDate = true;
         let hasTime = true;
         let offset = 'Z';
+        let c;
         if (typeof date === 'string') {
-            let match = date.match(DATE_TIME_RE);
-            if (match) {
-                if (!match[1]) {
-                    hasDate = false;
-                    date = `0000-01-01T${date}`;
+            if (fasttype)
+                prep: {
+                    // Date-time
+                    if (fasttype < 3) {
+                        if (+date.slice(11, 13) > 23) {
+                            date = '';
+                            break prep;
+                        }
+                        // Local
+                        if (fasttype === 2) {
+                            offset = null;
+                            date += 'Z';
+                        }
+                        // Offset; keep track of offset if not Z
+                        else if ((c = date.charCodeAt(date.length - 1)) !== 0x5a /* Z */ && c !== 0x7a /* z */) {
+                            offset = date.slice(date.length - 6);
+                        }
+                        if (unsafeDelim)
+                            date = date.slice(0, 10) + 'T' + date.slice(11);
+                    }
+                    // Time
+                    else if (fasttype === 4) {
+                        date = +date.slice(0, 2) > 23 ? '' : `0000-01-01T${date}Z`;
+                    }
+                    hasDate = fasttype !== 4;
+                    hasTime = fasttype !== 3;
                 }
-                hasTime = !!match[2];
-                // Make sure to use T instead of a space. Breaks in case of extreme values otherwise.
-                hasTime && date[10] === ' ' && (date = date.replace(' ', 'T'));
-                // Do not allow rollover hours.
-                if (match[2] && +match[2] > 23) {
-                    date = '';
+            else {
+                let match = date.match(DATE_TIME_RE);
+                if (match) {
+                    if (!match[1]) {
+                        hasDate = false;
+                        date = `0000-01-01T${date}`;
+                    }
+                    hasTime = !!match[2];
+                    // Make sure to use T instead of a space. Breaks in case of extreme values otherwise.
+                    hasTime && date[10] === ' ' && (date = date.replace(' ', 'T'));
+                    // Do not allow rollover hours.
+                    if (match[2] && +match[2] > 23) {
+                        date = '';
+                    }
+                    else {
+                        offset = match[3] || null;
+                        if (!offset && hasTime)
+                            date += 'Z';
+                    }
                 }
                 else {
-                    offset = match[3] || null;
-                    date = date.toUpperCase();
-                    if (!offset && hasTime)
-                        date += 'Z';
+                    date = '';
                 }
             }
-            else {
-                date = '';
-            }
         }
         super(date);
         if (!isNaN(this.getTime())) {
@@ -93,7 +122,7 @@ export class TomlDate extends Date {
         if (this.#offset === null)
             return iso.slice(0, -1);
         // Offset DateTime
-        if (this.#offset === 'Z')
+        if (this.#offset === 'Z' || this.#offset === 'z')
             return iso;
         // This part is quite annoying: JS strips the original timezone from the ISO string representation
         // Instead of using a "modified" date and "Z", we restore the representation "as authored"

package/plugins/kimi-codex/dist/vendor/smol-toml/error.js

@@ -26,11 +26,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 function getLineColFromPtr(string, ptr) {
-    let lines = string.slice(0, ptr).split(/\r\n|\n|\r/g);
+    let lines = string.slice(0, ptr).split(/\r?\n/);
     return [lines.length, lines.pop().length + 1];
 }
 function makeCodeBlock(string, line, column) {
-    let lines = string.split(/\r\n|\n|\r/g);
+    let lines = string.split(/\r?\n/);
     let codeblock = '';
     let numberLen = (Math.log10(line + 1) | 0) + 1;
     for (let i = line - 1; i <= line + 1; i++) {
@@ -60,4 +60,8 @@ export class TomlError extends Error {
         this.column = column;
         this.codeblock = codeblock;
     }
+    /** @internal */
+    static x(message, ctx, ptr) {
+        throw new TomlError(message, { toml: ctx.s, ptr: ptr ?? ctx.p });
+    }
 }