kimi-plugin-cc 2.0.8 → 2.2.1

package/plugins/kimi-codex/dist/commands/status.js

@@ -2,7 +2,7 @@ import { RuntimeError } from "../errors.js";
 import { resolveRepoIdentity } from "../git.js";
 import { sweepStaleJobs } from "../jobs.js";
 import { reconcileHistoricalJobProvenance } from "../kimi-engine.js";
-import { withJobStore } from "../job-store.js";
+import { parseHookEscapes, renderBudgetSource, withJobStore } from "../job-store.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { parseJobLookupArgs } from "../parsing.js";
 export async function runStatus(argv, context) {
@@ -22,6 +22,6 @@ export async function runStatus(argv, context) {
             throw new RuntimeError("JOB_NOT_FOUND", "No matching job was found for status.", "status.lookup");
         }
         const job = await reconcileHistoricalJobProvenance(store, found);
-        return `${JSON.stringify(job, null, 2)}\n`;
+        return `${JSON.stringify({ ...job, thinking_effort_requested: job.thinking_effort ?? null, hook_escapes: parseHookEscapes(job.hook_escapes), budget_source: renderBudgetSource(job) }, null, 2)}\n`;
     });
 }

package/plugins/kimi-codex/dist/commands/swarm.js

@@ -15,7 +15,7 @@ import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { MAX_DURATION_MS, parseSwarmArgs } from "../parsing.js";
 import { readArtifact, renderManagedJobOutput, writeArtifact } from "../render.js";
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
-import { assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
+import { assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing, warnHookEscapes } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
 // /kimi:swarm — READ-ONLY parallel fan-out (kimi-code 0.12.0 AgentSwarm tool).
 //
@@ -208,9 +208,11 @@ async function runReadSwarm(parsed, objective, context) {
             command_type: "review",
             cwd: context.cwd,
             model: parsed.model ?? null,
-            thinking: parsed.thinking ?? null,
+            thinking: null,
+            thinking_effort: parsed.thinkingEffort ?? null,
             background: false,
             budget_ms: parsed.budgetMs ?? KIMI_SWARM_DEFAULT_BUDGET_MS,
+            budget_source: parsed.budgetMs !== undefined ? "explicit" : "default",
             pid: process.pid,
             kimi_pid: null,
             status: "running",
@@ -307,9 +309,11 @@ async function runWriteSwarm(parsed, objective, context) {
                 command_type: "rescue",
                 cwd: context.cwd,
                 model: parsed.model ?? null,
-                thinking: parsed.thinking ?? null,
+                thinking: null,
+                thinking_effort: parsed.thinkingEffort ?? null,
                 background: false,
                 budget_ms: parsed.budgetMs ?? KIMI_SWARM_DEFAULT_BUDGET_MS,
+                budget_source: parsed.budgetMs !== undefined ? "explicit" : "default",
                 pid: process.pid,
                 kimi_pid: null,
                 status: "running",
@@ -491,6 +495,7 @@ writeMode) {
             // by other labels). Only set in write mode.
             trustedWorkspaceRoot: writeMode?.workspaceRoot,
             model: job.model ?? undefined,
+            thinkingEffort: job.thinking_effort ?? undefined,
             logPath: job.stream_log_path,
             signal: handlers.signal,
         }, budgetMs, "swarm.prompt");
@@ -499,10 +504,11 @@ writeMode) {
             throw new RuntimeError("SWARM_CANCELLED", "Swarm cancelled by user request.", "swarm.runtime");
         }
         assertCliResultSuccess(result, "swarm.runtime");
+        warnHookEscapes(result, "swarm", context.stderr);
         if (result.sessionId !== undefined &&
             result.sessionId.length > 0 &&
             result.sessionId !== job.kimi_session_id) {
-            store.updateRunningJob(job.job_id, { kimi_session_id: result.sessionId });
+            store.updateRunningJob(job.job_id, { kimi_session_id_source: "announced", kimi_session_id: result.sessionId });
         }
         await syncKimiSessionTitle({
             promptText: objective,

package/plugins/kimi-codex/dist/help.js

@@ -11,7 +11,7 @@ export function companionHelp(argv) {
             : 1;
     if (!hasHelpFlag(argv.slice(argumentStart)))
         return undefined;
-    const suffix = " Use --help or -h among the leading flags (before any prompt text or --) to show this usage.";
+    const suffix = " Thinking effort is a per-run request, not a guarantee. Use --help or -h among the leading flags (before any prompt text or --) to show this usage.";
     const usage = (name, positionals, flags, description) => `Usage: companion.sh ${name}${positionals ? ` ${positionals}` : ""}. ${description} Supported flags: ${flags}.${suffix}`;
     switch (command) {
         case "--help":

package/plugins/kimi-codex/dist/hook-escape.js

@@ -0,0 +1,71 @@
+import { decideHookOutcomePure } from "./hooks/approval-policy.js";
+// Upstream decorates results it still delivers verbatim otherwise (2.2.0,
+// `agent/toolDedupe/toolDedupeService.ts`): the repeat breaker appends one
+// `\n\n<system-reminder>…</system-reminder>` block from the 3rd identical call
+// (`appendReminder`, also for vetoed results — `finalizeToolResult` runs the
+// `onDidExecuteTool` hooks on every settled result), and at the 12th call it
+// replaces the result with a fixed "not executed" text (`HANDOFF_VETO_TEXT`).
+// Both still mean the hook's veto stood. Re-verify each certification.
+const REMINDER_SUFFIX = /^(?:\n\n<system-reminder>[\s\S]*?<\/system-reminder>)+$/;
+const HANDOFF_VETO_PREFIX = "This turn was ended by the repeat breaker after the same tool call was issued ";
+/** True when `content` is the hook's denial, possibly carrying upstream's repeat-breaker decoration. */
+export function carriesDenial(content, reason) {
+    if (content === reason)
+        return true;
+    if (content.startsWith(reason) && REMINDER_SUFFIX.test(content.slice(reason.length)))
+        return true;
+    return content.startsWith(HANDOFF_VETO_PREFIX);
+}
+/** Detection evidence, never enforcement. Results arrive after a tool may have
+ * executed, and the stream carries no outcome field: a result other than the
+ * managed denial is also what upstream emits for calls it rejected BEFORE the
+ * hook ran (unknown tool, disabled tool, invalid args, sensitive path, per-tool
+ * resolve errors) and what a coexisting hook or permission policy emits when it
+ * blocks first. So an escape is reported — logged, persisted, shown — and the
+ * run continues; failing the job needs positive execution evidence this stream
+ * does not provide. Filesystem policy is never replayed here. */
+export function createHookEscapeMonitor(ctx) {
+    const pending = new Map();
+    return {
+        observe(record) {
+            if (!ctx.commandLabel)
+                return;
+            if (record.role === "assistant") {
+                for (const call of record.tool_calls ?? []) {
+                    let args;
+                    try {
+                        args = JSON.parse(call.function.arguments);
+                    }
+                    catch {
+                        args = {};
+                    }
+                    if (typeof args !== "object" || args === null || Array.isArray(args))
+                        args = {};
+                    const result = decideHookOutcomePure({
+                        hook_event_name: "PreToolUse", tool_name: call.function.name,
+                        tool_input: args, tool_call_id: call.id, cwd: ctx.cwd,
+                    }, ctx);
+                    if (!("evaluator" in result) && result.decision === "deny") {
+                        pending.set(call.id, { reason: result.reason, tool_name: call.function.name });
+                    }
+                }
+            }
+            else if (record.role === "tool") {
+                const denied = pending.get(record.tool_call_id);
+                if (denied) {
+                    pending.delete(record.tool_call_id);
+                    if (!carriesDenial(record.content, denied.reason)) {
+                        return { tool_call_id: record.tool_call_id, tool_name: denied.tool_name,
+                            kind: "mismatch", content_excerpt: record.content.slice(0, 200) };
+                    }
+                }
+            }
+        },
+        /** Every denied call still without a result; call once at settlement. */
+        settle() {
+            const unresolved = [...pending.entries()].map(([tool_call_id, { tool_name }]) => ({ tool_call_id, tool_name, kind: "unresolved" }));
+            pending.clear();
+            return unresolved;
+        },
+    };
+}

package/plugins/kimi-codex/dist/hooks/approval-policy.js

@@ -81,6 +81,21 @@ const KNOWN_LABELS = new Set([
     "swarm-write",
 ]);
 export async function decideHookOutcome(input, ctx) {
+    const result = decideHookOutcomePure(input, ctx);
+    if (!("evaluator" in result))
+        return result;
+    const toolName = typeof input.tool_name === "string" ? input.tool_name : "";
+    if (ctx.rescueEvaluator !== undefined) {
+        return await ctx.rescueEvaluator(result.workspaceRoot, toolName, input.tool_input);
+    }
+    if (READ_ONLY_TOOLS.has(toolName))
+        return { decision: "allow" };
+    return {
+        decision: "deny",
+        reason: `kimi-plugin-cc safety hook: ${ctx.commandLabel} evaluator not configured; tool "${toolName}" denied as a safety default.`,
+    };
+}
+export function decideHookOutcomePure(input, ctx) {
     const label = typeof ctx.commandLabel === "string" ? ctx.commandLabel : undefined;
     // Out-of-plugin context: any kimi process spawned without our env var
     // is direct user usage. The hook MUST NOT restrict it.
@@ -176,18 +191,7 @@ export async function decideHookOutcome(input, ctx) {
                         "This is a plugin misconfiguration — writes are refused rather than risk the user's working tree.",
                 };
             }
-            if (ctx.rescueEvaluator !== undefined) {
-                return await ctx.rescueEvaluator(workspaceRoot, toolName, input.tool_input);
-            }
-            // Stub for callers that didn't inject the evaluator (tests of the policy
-            // function alone). The production entry script always injects it.
-            if (READ_ONLY_TOOLS.has(toolName)) {
-                return { decision: "allow" };
-            }
-            return {
-                decision: "deny",
-                reason: `kimi-plugin-cc safety hook: swarm-write evaluator not configured; tool "${toolName}" denied as a safety default.`,
-            };
+            return { evaluator: "rescue", workspaceRoot };
         }
         case "rescue": {
             const workspaceRoot = typeof ctx.trustedWorkspaceRoot === "string" ? ctx.trustedWorkspaceRoot : "";
@@ -200,21 +204,7 @@ export async function decideHookOutcome(input, ctx) {
                         "This is a plugin misconfiguration — writes are refused rather than trusting hook payload cwd.",
                 };
             }
-            if (ctx.rescueEvaluator !== undefined) {
-                return await ctx.rescueEvaluator(workspaceRoot, toolName, input.tool_input);
-            }
-            // Stub for callers that didn't inject the evaluator (e.g.,
-            // tests that exercise only the policy function). Allow
-            // Read/Grep/Glob and friends; deny everything else. The
-            // production entry script wires the real evaluator from
-            // runtime/rescue-approval.ts.
-            if (READ_ONLY_TOOLS.has(toolName)) {
-                return { decision: "allow" };
-            }
-            return {
-                decision: "deny",
-                reason: `kimi-plugin-cc safety hook: rescue evaluator not configured; tool "${toolName}" denied as a safety default.`,
-            };
+            return { evaluator: "rescue", workspaceRoot };
         }
         default:
             if (KNOWN_LABELS.has(label)) {

package/plugins/kimi-codex/dist/hooks/config-safety.js

@@ -417,15 +417,23 @@ export function normalizeTopLevelInlineHooks(contents, lineEnding) {
         entryCount: hooks.length,
     };
 }
+// Same defaults as smol-toml 1.9.1 parse(); this walker only locates assignments.
+// tests/runtime/toml-walker-context.test.ts asserts these against the vendored parse().
+export function assignmentParseContext(s) {
+    return { s, p: s.charCodeAt(0) === 0xfeff ? 1 : 0, d: 1_000, bi: false, ld: true, uk: 0 };
+}
 function findTopLevelHooksAssignment(contents) {
-    let ptr = skipVoid(contents, 0);
-    while (ptr < contents.length) {
+    const ctx = assignmentParseContext(contents);
+    skipVoid(ctx);
+    while (ctx.p < contents.length) {
         // A root-level direct assignment cannot resume after entering a table.
-        if (contents[ptr] === "[")
+        if (contents[ctx.p] === "[")
             return null;
-        const declarationStart = ptr;
-        const [key, valueStart] = parseKey(contents, ptr);
-        const [, valueEnd] = extractValue(contents, valueStart, undefined, 1_000, undefined);
+        const declarationStart = ctx.p;
+        const key = parseKey(ctx);
+        skipVoid(ctx, true, true);
+        extractValue(ctx, undefined);
+        const valueEnd = ctx.p;
         if (key.length === 1 && key[0] === "hooks") {
             const lineStart = contents.lastIndexOf("\n", declarationStart - 1) + 1;
             const start = /^[\t ]*$/.test(contents.slice(lineStart, declarationStart))
@@ -445,7 +453,7 @@ function findTopLevelHooksAssignment(contents) {
             }
             return { start, end, hadLineEnding };
         }
-        ptr = skipVoid(contents, valueEnd);
+        skipVoid(ctx);
     }
     return null;
 }

package/plugins/kimi-codex/dist/job-store.js

@@ -11,8 +11,11 @@ export class JobStore {
         let db;
         try {
             db = createSqliteAdapter(paths.stateDbPath);
-            db.pragma("journal_mode = WAL");
+            // busy_timeout FIRST: switching the journal mode takes a brief write lock,
+            // and a second opener (status/result racing a worker) otherwise fails
+            // immediately with SQLITE_BUSY instead of waiting (seen 2026-10-14).
             db.pragma("busy_timeout = 5000");
+            db.pragma("journal_mode = WAL");
         }
         catch (error) {
             try {
@@ -70,6 +73,11 @@ export class JobStore {
             if (!tableHasColumn(this.db, "budget_ms")) {
                 this.db.exec(`ALTER TABLE jobs ADD COLUMN budget_ms INTEGER;`);
             }
+            for (const column of ["kimi_session_id_source", "budget_source", "thinking_effort", "hook_escapes"]) {
+                if (!tableHasColumn(this.db, column)) {
+                    this.db.exec("ALTER TABLE jobs ADD COLUMN " + column + " TEXT;");
+                }
+            }
             // Additive provenance migration. Existing rows deliberately remain NULL:
             // v1.9.5 plus kimi-code 0.33/0.34 could have routed to native v2 before the
             // legacy pin landed, so a blanket historical v1 backfill would invent fact.
@@ -98,6 +106,8 @@ export class JobStore {
       CREATE INDEX IF NOT EXISTS jobs_repo_type_updated_idx
         ON jobs (repo_id, command_type, updated_at DESC);
 
+      CREATE INDEX IF NOT EXISTS jobs_session_id_idx ON jobs (kimi_session_id);
+
       CREATE INDEX IF NOT EXISTS jobs_session_idx
         ON jobs (repo_id, kimi_session_id, updated_at DESC);
 
@@ -162,15 +172,15 @@ export class JobStore {
         try {
             this.db.run(`
           INSERT INTO jobs (
-            job_id, repo_id, command_type, created_at, updated_at, cwd, model, thinking,
-            background, pid, kimi_pid, status, kimi_session_id,
+            job_id, repo_id, command_type, created_at, updated_at, cwd, model, thinking, thinking_effort,
+            background, pid, kimi_pid, status, kimi_session_id, kimi_session_id_source, budget_source,
             operation_kind, intended_engine, observed_engine, kimi_version, system_version,
             kimi_command, kimi_prefix_args, plan_certification, resumed_from_job_id, safety_profile,
             agent_profile, prompt_digest, summary, phase, budget_ms, final_output_path, stream_log_path, error
           )
           VALUES (
-            @job_id, @repo_id, @command_type, @created_at, @updated_at, @cwd, @model, @thinking,
-            @background, @pid, @kimi_pid, @status, @kimi_session_id,
+            @job_id, @repo_id, @command_type, @created_at, @updated_at, @cwd, @model, @thinking, @thinking_effort,
+            @background, @pid, @kimi_pid, @status, @kimi_session_id, @kimi_session_id_source, @budget_source,
             @operation_kind, @intended_engine, @observed_engine, @kimi_version, @system_version,
             @kimi_command, @kimi_prefix_args, @plan_certification, @resumed_from_job_id, @safety_profile,
             @agent_profile, @prompt_digest, @summary, @phase, @budget_ms, @final_output_path, @stream_log_path, @error
@@ -198,6 +208,10 @@ export class JobStore {
         const row = this.db.get("SELECT * FROM jobs WHERE job_id = ?", jobId);
         return row ? hydrateRow(row) : null;
     }
+    /** Global across repos and terminal states; optionally exclude the current row. */
+    hasSessionId(sessionId, exceptJobId = "") {
+        return Boolean(this.db.get("SELECT 1 FROM jobs WHERE kimi_session_id = ? AND job_id != ? LIMIT 1", sessionId, exceptJobId));
+    }
     findLatestJob(options) {
         const conditions = ["repo_id = @repo_id"];
         const params = {
@@ -247,6 +261,18 @@ export class JobStore {
     updateRunningJob(jobId, patch) {
         return this.updateWhere(jobId, patch, "status = 'running'");
     }
+    /** Recheck uniqueness atomically: another worker can claim an ID during the
+     * asynchronous directory scan. Ordinary announced/resumed IDs may be shared. */
+    claimRecoveredSessionId(jobId, sessionId) {
+        this.db.run(`UPDATE jobs
+      SET kimi_session_id = @session_id, kimi_session_id_source = 'recovered_session_dir',
+          updated_at = @updated_at
+      WHERE job_id = @job_id AND status = 'running' AND kimi_session_id IS NULL
+        AND NOT EXISTS (SELECT 1 FROM jobs WHERE kimi_session_id = @session_id AND job_id != @job_id)`, { job_id: jobId, session_id: sessionId, updated_at: new Date().toISOString() });
+        const job = this.getJob(jobId);
+        return job?.status === "running" && job.kimi_session_id === sessionId &&
+            job.kimi_session_id_source === "recovered_session_dir" ? job : null;
+    }
     /**
      * Evidence-only backfill for pre-provenance rows. COALESCE prevents forensic
      * inspection from overwriting a field already recorded at execution time.
@@ -280,10 +306,10 @@ export class JobStore {
         return this.updateWhere(jobId, { ...patch, status: "cancelled", pid: null, kimi_pid: null }, "status = 'running'");
     }
     static JOBS_COLUMNS = new Set([
-        "status", "summary", "phase", "budget_ms", "pid", "kimi_pid",
+        "status", "summary", "phase", "budget_ms", "budget_source", "kimi_session_id_source", "pid", "kimi_pid",
         "final_output_path", "stream_log_path", "kimi_session_id",
         "error", "command_type", "prompt_digest", "repo_id",
-        "cwd", "model", "thinking", "background", "agent_profile",
+        "cwd", "model", "thinking", "thinking_effort", "hook_escapes", "background", "agent_profile",
         "operation_kind", "intended_engine", "observed_engine", "kimi_version",
         "system_version", "kimi_command", "kimi_prefix_args", "plan_certification",
         "resumed_from_job_id", "safety_profile",
@@ -323,8 +349,11 @@ function hydrateRow(row) {
 function serializeRecord(record) {
     return {
         ...record,
+        thinking_effort: record.thinking_effort ?? null,
         phase: record.phase ?? null,
         budget_ms: record.budget_ms ?? null,
+        budget_source: record.budget_source ?? null,
+        kimi_session_id_source: record.kimi_session_id_source ?? null,
         operation_kind: record.operation_kind ?? null,
         intended_engine: record.intended_engine ?? null,
         observed_engine: record.observed_engine ?? null,
@@ -562,3 +591,19 @@ export function withJobStoreSync(paths, fn) {
         store?.close();
     }
 }
+/** Old non-null budgets have unknown provenance; never invent explicit intent. */
+/** Parsed `hook_escapes` column for JSON envelopes: [] when NULL or unreadable. */
+export function parseHookEscapes(raw) {
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+export function renderBudgetSource(job) {
+    return job.budget_source ?? (job.budget_ms === null ? "default" : "unknown");
+}

package/plugins/kimi-codex/dist/kimi-engine.js

@@ -206,6 +206,8 @@ export function observedExecutionFields(result) {
     return {
         observed_engine: result.observedEngine,
         system_version: result.systemVersion ?? null,
+        // Detection evidence from runtime/hook-escape.ts, JSON array or NULL.
+        hook_escapes: result.hookEscapes && result.hookEscapes.length > 0 ? JSON.stringify(result.hookEscapes) : null,
     };
 }
 export function executionPlanFromPersisted(fields) {

package/plugins/kimi-codex/dist/kimi-errors.js

@@ -45,7 +45,7 @@ export function classifyManagedCommandFailure(error, commandType, jobId, options
     if (error instanceof RuntimeError) {
         details.cause_code = error.code;
         if (error.code === "RESPONSE_TIMEOUT") {
-            for (const key of ["budget_ms", "record_count", "partial_output_chars", "aborted", "settled_post_abort"]) {
+            for (const key of ["budget_ms", "record_count", "partial_output_chars", "aborted", "settled_post_abort", "hook_escapes"]) {
                 if (error.details[key] !== undefined)
                     details[key] = error.details[key];
             }

package/plugins/kimi-codex/dist/kimi-timeouts.js

@@ -8,7 +8,7 @@
 // startup failures surface as CLI_SPAWN_FAILED / CLI_PROCESS_ERROR —
 // not as separate timeouts. So only the per-command response budgets
 // remain.
-// Budgets are sized for thinking-on workflow (the default since v1.0).
+// Budgets accommodate thinking-capable workflows; per-run effort is only a request.
 // kimi-code spends real wallclock on extended reasoning before emitting
 // the first assistant record; pre-alpha.4 budgets (300s/600s) were sized
 // against the non-thinking path and timed out in production smoke
@@ -49,15 +49,11 @@ export const KIMI_SWARM_DEFAULT_BUDGET_MS = 1_800_000; // 30 minutes
  * Review-gate budget. Fires inside Claude Code's Stop hook so any value
  * above the user's perceptible wait makes the gate feel broken.
  *
- * kimi-code 0.1.1 has no per-spawn CLI flag for thinking control
- * (Round 2 multi-agent review caught this — emitting `--no-thinking`
- * triggers an unknown-option crash). The 8s budget assumes the user
- * has either `default_thinking = false` or `[thinking].mode = "off"`
- * in `~/.kimi-code/config.toml`, OR a non-thinking-capable model
- * selected for review-gate (via KIMI_PLUGIN_CC_REVIEW_GATE_MODEL).
- * Under thinking-on the gate will time out — the gate is fail-open on
- * timeout by design, so the worst case is the gate becomes
- * always-allow. See docs/safety.md.
+ * The gate requests off through KIMI_MODEL_THINKING_EFFORT by default;
+ * KIMI_PLUGIN_CC_REVIEW_GATE_THINKING can inherit or request another effort.
+ * BYO/non-trait-driven providers and always-thinking models can ignore it.
+ * The 8s timeout remains fail-open; a request never guarantees completion.
+ * Hook-enforcement escape is a separate blocking failure. See docs/safety.md.
  */
 export const KIMI_REVIEW_GATE_TIMEOUT_MS = 8_000;
 export function isTimeoutCode(code) {

package/plugins/kimi-codex/dist/kimi-version-probe.js

@@ -198,8 +198,8 @@ export const KIMI_TESTED_MINORS = [
     // import it; `-p` stdout stays the direct PromptJsonWriter), session-lifecycle
     // changes that only HELP our cancellation story (active-turn cancel on close +
     // BACKGROUND_KEEP_ALIVE_ON_EXIT default flipped true→false), an `alwaysThinking`
-    // model-capability flag (read-only detection, the H5 thinking-control knob is
-    // still upstream-blocked), a SIGHUP cleanup handler (exit 129; SIGTERM still
+    // model-capability flag (the H5 env request ships in plugin 2.2.1,
+    // but always-thinking models need not honour it), a SIGHUP cleanup handler (exit 129; SIGTERM still
     // exits 143 and runs cleanup — our SIGTERM→SIGKILL reaping is unaffected), and
     // a new builtin `import-from-cc-codex` skill (not a plugin surface).
     // See .claude/kimi-code-research/reports/72-76 for the audit reports.