kimi-plugin-cc 2.2.0 → 2.2.2

package/dist/parsing.js

@@ -21,38 +21,30 @@ function looksLikeFlag(token) {
     // Short flag: a single dash followed by exactly one letter (`-r`, `-m`).
     return /^-[a-zA-Z]$/.test(token);
 }
-export const ASK_SUPPORTED_FLAGS = "-m/--model <name>, --budget <30m|1h|90s>, --background, --wait, --fresh, -r, --resume <job-id|session-id>";
-export const RESCUE_SUPPORTED_FLAGS = "-m/--model <name>, --budget <30m|1h|90s>, --background, --wait, --fresh, -r, --resume <job-id|session-id>";
-export const REVIEW_SUPPORTED_FLAGS = "--base <ref>, -m/--model <name>, --budget <30m|1h|90s>";
+export const ASK_SUPPORTED_FLAGS = "-m/--model <name>, --thinking <off|low|medium|high>, --budget <30m|1h|90s>, --background, --wait, --fresh, -r, --resume <job-id|session-id>";
+export const RESCUE_SUPPORTED_FLAGS = "-m/--model <name>, --thinking <off|low|medium|high>, --budget <30m|1h|90s>, --background, --wait, --fresh, -r, --resume <job-id|session-id>";
+export const REVIEW_SUPPORTED_FLAGS = "--base <ref>, -m/--model <name>, --thinking <off|low|medium|high>, --budget <30m|1h|90s>";
 export const JOB_LOOKUP_SUPPORTED_FLAGS = "--type <review|challenge|rescue|review_gate|ask>, --json";
 export const SETUP_SUPPORTED_FLAGS = "--check, --uninstall, --all (with --uninstall), --enable-review-gate, --disable-review-gate, --models [--json] (without other setup flags)";
 export const REPAIR_SESSIONS_SUPPORTED_FLAGS = "--apply, --all";
 export const REPLAY_SUPPORTED_FLAGS = "none (one job-id required)";
-// Thinking-on is always-on for user-facing commands in v1.0. review-gate
-// pins thinking=false via the cli-client options bag instead of an argv
-// flag (see runtime/cli-client.ts::CliClientOptions). The parser rejects
-// --thinking and --no-thinking with a hard error so a documented-removed
-// flag doesn't get silently accepted as a no-op. Both bare (`--thinking`)
-// and assignment (`--thinking=true`) forms are rejected — otherwise the
-// assignment form would fall through to the generic "Unknown flag" path
-// and a wrapper agent reading the error would think the cure is to drop
-// the `=value` rather than the flag itself.
-const THINKING_FLAG_REMOVED_MESSAGE = "--thinking / --no-thinking were removed in v1.0. Thinking is always on for user-facing commands.";
-function isRemovedThinkingFlag(token) {
-    return (token === "--thinking" ||
-        token === "--no-thinking" ||
-        token.startsWith("--thinking=") ||
-        token.startsWith("--no-thinking="));
+/** Validate syntax only; upstream per-model supportEfforts remains authoritative. */
+export function validateThinkingEffort(value, stage = "args.parse", lowercase = true) {
+    const effort = lowercase ? value?.toLowerCase() : value;
+    if (!effort || !/^[a-z][a-z0-9-]{0,31}$/.test(effort)) {
+        throw new RuntimeError("INVALID_ARGS", "--thinking requires an effort matching [a-z][a-z0-9-]{0,31} (e.g. off, low, medium, high).", stage);
+    }
+    return effort;
 }
-export const PURSUE_SUPPORTED_FLAGS = "-m/--model <name>, --budget <30m|1h|90s>, --turns <N>";
-export const SWARM_SUPPORTED_FLAGS = "-m/--model <name>, --budget <30m|1h|90s>, --cap <N>, --max-concurrency <N>, --write";
+export const PURSUE_SUPPORTED_FLAGS = "-m/--model <name>, --thinking <off|low|medium|high>, --budget <30m|1h|90s>, --turns <N>";
+export const SWARM_SUPPORTED_FLAGS = "-m/--model <name>, --thinking <off|low|medium|high>, --budget <30m|1h|90s>, --cap <N>, --max-concurrency <N>, --write";
 /**
  * Parser for /kimi:swarm (read-only parallel fan-out). Foreground-only:
  * no --background/--fresh/--resume. Trailing tokens are the objective.
  */
 export function parseSwarmArgs(argv) {
     let model;
-    const thinking = true;
+    let thinkingEffort;
     let budgetMs;
     let cap;
     let maxConcurrency;
@@ -60,6 +52,13 @@ export function parseSwarmArgs(argv) {
     let trailingTokens;
     for (let index = 0; index < argv.length; index += 1) {
         const token = argv[index];
+        if (token === "--thinking" || token.startsWith("--thinking=")) {
+            thinkingEffort = validateThinkingEffort(token === "--thinking" ? argv[++index] : token.slice("--thinking=".length));
+            continue;
+        }
+        if (token === "--no-thinking" || token.startsWith("--no-thinking=")) {
+            throw new RuntimeError("INVALID_ARGS", "--no-thinking is unsupported; use --thinking off", "args.parse");
+        }
         if (token === "--") {
             trailingTokens = argv.slice(index + 1);
             break;
@@ -105,9 +104,6 @@ export function parseSwarmArgs(argv) {
                 break;
             }
             default:
-                if (isRemovedThinkingFlag(token)) {
-                    throw new RuntimeError("INVALID_ARGS", THINKING_FLAG_REMOVED_MESSAGE, "swarm.parse");
-                }
                 if (looksLikeFlag(token)) {
                     throw new RuntimeError("INVALID_ARGS", `Unknown flag ${token} for swarm. Supported flags: ${SWARM_SUPPORTED_FLAGS}. Use \`--\` before flag-shaped objective text to pass it through.`, "swarm.parse");
                 }
@@ -122,7 +118,7 @@ export function parseSwarmArgs(argv) {
         maxConcurrency,
         write,
         model,
-        thinking,
+        thinkingEffort,
         objective: trailingTokens?.join(" "),
     };
 }
@@ -186,12 +182,19 @@ export function parseDurationMs(token, flag, stage, budgetKind) {
  */
 export function parsePursueArgs(argv) {
     let model;
-    const thinking = true;
+    let thinkingEffort;
     let budgetMs;
     let turns;
     let trailingTokens;
     for (let index = 0; index < argv.length; index += 1) {
         const token = argv[index];
+        if (token === "--thinking" || token.startsWith("--thinking=")) {
+            thinkingEffort = validateThinkingEffort(token === "--thinking" ? argv[++index] : token.slice("--thinking=".length));
+            continue;
+        }
+        if (token === "--no-thinking" || token.startsWith("--no-thinking=")) {
+            throw new RuntimeError("INVALID_ARGS", "--no-thinking is unsupported; use --thinking off", "args.parse");
+        }
         if (token === "--") {
             trailingTokens = argv.slice(index + 1);
             break;
@@ -237,9 +240,6 @@ export function parsePursueArgs(argv) {
                 break;
             }
             default:
-                if (isRemovedThinkingFlag(token)) {
-                    throw new RuntimeError("INVALID_ARGS", THINKING_FLAG_REMOVED_MESSAGE, "pursue.parse");
-                }
                 if (looksLikeFlag(token)) {
                     throw new RuntimeError("INVALID_ARGS", `Unknown flag ${token} for pursue. Supported flags: ${PURSUE_SUPPORTED_FLAGS}. Use \`--\` before flag-shaped objective text to pass it through.`, "pursue.parse");
                 }
@@ -252,12 +252,12 @@ export function parsePursueArgs(argv) {
         budgetMs,
         turns,
         model,
-        thinking,
+        thinkingEffort,
         objective: trailingTokens?.join(" "),
     };
 }
 /** Help before -- wins even over malformed flags or prose trailing-token mode. */
-const VALUE_TAKING_FLAGS = new Set(["-m", "--model", "--budget", "--resume", "--base", "--cap", "--max-concurrency", "--turns", "--type"]);
+const VALUE_TAKING_FLAGS = new Set(["--thinking", "-m", "--model", "--budget", "--resume", "--base", "--cap", "--max-concurrency", "--turns", "--type"]);
 /**
  * `--help` / `-h` counts only inside the leading flag region: before `--`
  * and before the first prose token. The value of a value-taking flag is
@@ -289,10 +289,7 @@ export function parseAskArgs(argv) {
         return { help: true, background: false, wait: false, fresh: false, resume: false };
     let budgetMs;
     let model;
-    // Thinking is on by default across ask/review/challenge/rescue. The
-    // parser rejects --thinking / --no-thinking; review-gate's runtime
-    // caller pins thinking=false via CliClientOptions instead.
-    let thinking = true;
+    let thinkingEffort;
     let background = false;
     let wait = false;
     let fresh = false;
@@ -302,6 +299,13 @@ export function parseAskArgs(argv) {
     let trailingTokens;
     for (let index = 0; index < argv.length; index += 1) {
         const token = argv[index];
+        if (token === "--thinking" || token.startsWith("--thinking=")) {
+            thinkingEffort = validateThinkingEffort(token === "--thinking" ? argv[++index] : token.slice("--thinking=".length));
+            continue;
+        }
+        if (token === "--no-thinking" || token.startsWith("--no-thinking=")) {
+            throw new RuntimeError("INVALID_ARGS", "--no-thinking is unsupported; use --thinking off", "args.parse");
+        }
         if (token === "--") {
             trailingTokens = argv.slice(index + 1);
             break;
@@ -357,9 +361,6 @@ export function parseAskArgs(argv) {
                 break;
             }
             default:
-                if (isRemovedThinkingFlag(token)) {
-                    throw new RuntimeError("INVALID_ARGS", THINKING_FLAG_REMOVED_MESSAGE, "args.parse");
-                }
                 if (looksLikeFlag(token)) {
                     throw new RuntimeError("INVALID_ARGS", `Unknown flag ${token} for ask. Supported flags: ${ASK_SUPPORTED_FLAGS}. Use \`--\` before flag-shaped prompt text to pass it through.`, "args.parse");
                 }
@@ -382,7 +383,7 @@ export function parseAskArgs(argv) {
         resume,
         resumeTarget,
         model,
-        thinking,
+        thinkingEffort,
         prompt: trailingTokens?.join(" "),
     };
 }
@@ -394,7 +395,7 @@ export function parseReviewArgs(argv, commandName = "review") {
         background: parsed.background,
         wait: parsed.wait,
         model: parsed.model,
-        thinking: parsed.thinking,
+        thinkingEffort: parsed.thinkingEffort,
         focus: parsed.trailingText,
     };
 }
@@ -403,7 +404,7 @@ export function parseRescueArgs(argv) {
         return { help: true, background: false, wait: false, fresh: false, resume: false };
     let budgetMs;
     let model;
-    let thinking = true;
+    let thinkingEffort;
     let background = false;
     let wait = false;
     let fresh = false;
@@ -413,6 +414,13 @@ export function parseRescueArgs(argv) {
     let trailingTokens;
     for (let index = 0; index < argv.length; index += 1) {
         const token = argv[index];
+        if (token === "--thinking" || token.startsWith("--thinking=")) {
+            thinkingEffort = validateThinkingEffort(token === "--thinking" ? argv[++index] : token.slice("--thinking=".length));
+            continue;
+        }
+        if (token === "--no-thinking" || token.startsWith("--no-thinking=")) {
+            throw new RuntimeError("INVALID_ARGS", "--no-thinking is unsupported; use --thinking off", "args.parse");
+        }
         if (token === "--") {
             trailingTokens = argv.slice(index + 1);
             break;
@@ -468,9 +476,6 @@ export function parseRescueArgs(argv) {
                 break;
             }
             default:
-                if (isRemovedThinkingFlag(token)) {
-                    throw new RuntimeError("INVALID_ARGS", THINKING_FLAG_REMOVED_MESSAGE, "args.parse");
-                }
                 if (looksLikeFlag(token)) {
                     throw new RuntimeError("INVALID_ARGS", `Unknown flag ${token} for rescue. Supported flags: ${RESCUE_SUPPORTED_FLAGS}. Use \`--\` before flag-shaped prompt text to pass it through.`, "args.parse");
                 }
@@ -493,7 +498,7 @@ export function parseRescueArgs(argv) {
         resume,
         resumeTarget,
         model,
-        thinking,
+        thinkingEffort,
         prompt: trailingTokens?.join(" "),
     };
 }
@@ -540,21 +545,25 @@ function isManagedCommandType(value) {
 function parseKnownFlags(argv, knownFlags, commandName) {
     let budgetMs;
     let model;
-    let thinking = true;
+    let thinkingEffort;
     let base;
     let background = false;
     let wait = false;
     let trailingTokens;
     for (let index = 0; index < argv.length; index += 1) {
         const token = argv[index];
+        if (token === "--thinking" || token.startsWith("--thinking=")) {
+            thinkingEffort = validateThinkingEffort(token === "--thinking" ? argv[++index] : token.slice("--thinking=".length));
+            continue;
+        }
+        if (token === "--no-thinking" || token.startsWith("--no-thinking=")) {
+            throw new RuntimeError("INVALID_ARGS", "--no-thinking is unsupported; use --thinking off", "args.parse");
+        }
         if (token === "--") {
             trailingTokens = argv.slice(index + 1);
             break;
         }
         if (!knownFlags.has(token)) {
-            if (isRemovedThinkingFlag(token)) {
-                throw new RuntimeError("INVALID_ARGS", THINKING_FLAG_REMOVED_MESSAGE, "args.parse");
-            }
             if (looksLikeFlag(token)) {
                 // Wrapper agents routinely hallucinate flags like `--file` /
                 // `--context` because that shape is common in other CLIs. Silently
@@ -610,9 +619,6 @@ function parseKnownFlags(argv, knownFlags, commandName) {
             // The early `if (!knownFlags.has(token))` gate above means we only
             // reach this switch with tokens that ARE in knownFlags, and every
             // member is handled above. A `default` arm would be unreachable.
-            // --thinking and --no-thinking are NOT in knownFlags any more (v1.0
-            // removed them); the early gate above hard-fails on them with
-            // THINKING_FLAG_REMOVED_MESSAGE.
         }
     }
     return {
@@ -621,7 +627,7 @@ function parseKnownFlags(argv, knownFlags, commandName) {
         background,
         wait,
         model,
-        thinking,
+        thinkingEffort,
         trailingText: trailingTokens?.join(" "),
     };
 }

package/dist/stream-json.js

@@ -12,6 +12,8 @@
 //   {"role":"meta","type":"turn.step.retrying","failed_attempt":1,"next_attempt":2,"max_attempts":3,"delay_ms":300,"error_name":"APIProviderRateLimitError","error_message":"...","status_code":429}
 //   {"role":"meta","type":"system.version","version":"0.24.2"} // experimental v2 only; modeled since v1.8.5 (SystemVersionRecord), filtered like other meta
 //
+//   {"type":"error","code":"session.occupied","message":"...","details":{...}} // 2.3.0; stdout-only refusal, exit 4
+//
 // Notes on what does and does not appear here:
 //   - The session.resume_hint meta record is NEW in kimi-code 0.2.0
 //     (introduced at run-prompt.ts:477-505 in 0.2.0; the writer region —
@@ -263,6 +265,20 @@ function parseLine(line) {
     if (role === undefined && parsed["type"] === "goal.summary") {
         return validateGoalSummary(parsed, line);
     }
+    if (role === undefined && parsed["type"] === "error") {
+        if (typeof parsed["code"] !== "string" || parsed["code"].length === 0 ||
+            typeof parsed["message"] !== "string" || parsed["message"].length === 0 ||
+            (parsed["details"] !== undefined && !isRecord(parsed["details"]))) {
+            return { malformedLine: line, malformedReason: "error record field has unexpected type" };
+        }
+        // Keep bounded diagnostic fields only; holder metadata is not needed and
+        // must not become a session-id source or be copied into persisted errors.
+        return { cliError: {
+                type: "error",
+                code: parsed["code"].slice(0, 200),
+                message: parsed["message"].slice(0, 4000),
+            } };
+    }
     // H3 forward-compat: a non-empty string role we don't model (a role a future
     // kimi-code adds). Surface it out-of-band on the unknownRecord channel —
     // tolerated, not malformed — so the parser keeps working and the diagnostic

package/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.2.0";
+export const KIMI_PLUGIN_CC_VERSION = "2.2.2";

package/docs/models.md

@@ -80,3 +80,13 @@ validator. Every task still uses the existing exact-version, hook, workspace,
 and no-plan checks. Source review is against kimi-code 2.0.0 (`1b89e4b0`),
 including `kosongConfig/configSection.ts`, `envOverlay.ts`, and
 `cli/v2/run-v2-print.ts`.
+
+## Requested thinking effort
+
+`--thinking <effort>` requests per-run effort through `KIMI_MODEL_THINKING_EFFORT`, never a CLI flag or saved-default change; omitted flags preserve the operator-owned ambient variable, and resume does not inherit a previous job's request. Providers that are not trait-driven silently ignore it, as does a base level already `off`; an `alwaysThinking` model receives `off` unnormalized. Stream-json carries no thinking deltas (`writeThinkingDelta() {}`), so the plugin cannot verify whether the request was honoured.
+
+Use `--thinking off`, `--thinking high`, or `--thinking=<effort>` before the prompt. Values are lowercased and must match `/^[a-z][a-z0-9-]{0,31}$/` (a plugin-owned syntax bound; a future upstream token outside it is rejected before upstream sees it); upstream per-model `supportEfforts`, not a plugin enum, determines supported values. `--no-thinking` is an error: use `--thinking off`. In CLI 2.2.0 only the three Moonshot `kimi*` provider definitions are trait-driven. BYO providers ignore the request silently; an always-thinking model may remain thinking.
+
+Jobs persist nullable `thinking_effort`; status and `result --json` expose `thinking_effort_requested`, not observed effort. Detached ask/rescue workers replay the request. A resume without `--thinking` exports no new override (any ambient operator value remains). No config.toml write occurs.
+
+The review gate requests `off` by default. `KIMI_PLUGIN_CC_REVIEW_GATE_THINKING=inherit` exports no override; another non-empty value is lowercased and must match the same regex. Unset or empty means `off`; an invalid value makes the gate skip visibly. The gate remains fail-open on its 8 s timeout: a BYO provider or always-thinking model can ignore the request, and even an honoured request does not guarantee completion within the budget.

package/docs/registry-releases.md

@@ -6,9 +6,13 @@ remain available. The package has no install scripts and no separate CLI.
 
 ## Publishing status
 
-As of October 15, 2026, [2.0.8 is live on npm](https://www.npmjs.com/package/kimi-plugin-cc/v/2.0.8), published through
-GitHub Actions OIDC with a signed provenance statement (run 38650044033). 2.0.7 (September 26) was the
-hand-published bootstrap.
+As of October 15, 2026, [2.2.1 is live on npm](https://www.npmjs.com/package/kimi-plugin-cc/v/2.2.1), published by
+the release-event run of `publish.yml` (run 38720071707) through GitHub Actions OIDC with a signed
+provenance statement (sigstore log index 3263398504; tarball shasum
+`03907c66d440155763a860ab52b5107c0233938b`, registry propagation took a few minutes this time).
+2.2.0 (same day, run 38658918855, log index 3256863983) was the first release where the tag-triggered
+path worked end to end without a manual dispatch; 2.0.8 (same day, run 38650044033) was the first
+OIDC publication; 2.0.7 (September 26) was the hand-published bootstrap.
 The first upload used the validated GitHub Actions artifact and interactive npm
 authentication. Its public tarball matched that artifact byte-for-byte, and a
 fresh registry install passed isolated setup/check for both hosts.
@@ -17,7 +21,7 @@ The trusted publisher is configured for `linxule/kimi-plugin-cc`, workflow
 `publish.yml`, environment `npm`, with direct publishing allowed.
 `NPM_TRUSTED_PUBLISHING=true` is enabled in GitHub Actions. Future GitHub releases
 use short-lived OIDC credentials, without a stored npm token or interactive 2FA.
-The first npm OIDC publication will be the next release; do not republish 2.0.7.
+OIDC publication is established; never republish an existing version.
 
 **2026-10-15 status.** The `v2.0.8` release triggered the first OIDC attempt. It
 failed twice on the publish step for reasons unrelated to the package: current

package/docs/safety.md

@@ -1,8 +1,8 @@
 # Safety
 
-This guide describes the shipped 2.2.0 runtime. Read-only tasks deny file writes and shell commands. Rescue and pursue can edit your workspace. Write-swarm returns a patch from a temporary Git worktree.
+This guide describes the current checkout runtime; 2.3.0 certification is unreleased. Read-only tasks deny file writes and shell commands. Rescue and pursue can edit your workspace. Write-swarm returns a patch from a temporary Git worktree.
 
-Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, and `2.1.1`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
+Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, and `2.3.0`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
 
 ## Why the safety story is hook-based
 
@@ -156,6 +156,8 @@ Provenance: a native-v2 plan requires the `system.version` marker as the first s
 
 Residuals, unchanged from v1 and stated plainly: `config.toml` and the session journals are trusted operator state (an actor who can write them could already delete the `[[hooks]]` entry); the upstream hook runner fails open on its own internal errors; the plan-path comparison does not realpath (a symlink there would need a prior hook-allowed write). Native plan mode, tower, subagent fork, Remote Control and `--add-dir` are out of scope.
 
+In CLI 2.3.0, stale-session retry can reread those same journals. Do not concurrently operate on or edit a plugin-managed session from another client. The upstream session lock is not a security boundary; no parent-side rescan can make that reload atomic.
+
 ## The rescue allowlist
 
 For `/kimi:rescue`, the hook delegates to [`evaluateRescueHookRequest`](../runtime/rescue-approval.ts). The allowlist has been extended since the original Wire-transport implementation. Highlights:
@@ -363,3 +365,13 @@ Agents use `retryable_after_setup`, not `drift_axis` alone. They run setup for t
 ## Reporting safety issues
 
 If you find a way to coax /kimi:review, /kimi:challenge, /kimi:review_gate, or /kimi:ask into running a non-read tool — or to make /kimi:rescue mutate `.git/` or escape the workspace — please open a GitHub security advisory rather than a public issue.
+
+## Hook-escape monitor: detection evidence
+
+**Hook-escape monitor** (§1): the cli-client replays the pure hook policy on every streamed `tool_calls` entry; a call the policy denies whose tool result is not the hook's denial (byte-exact, or with upstream's repeat-breaker `<system-reminder>` decoration / handoff text) is recorded as `mismatch`, and a denied call still without a result at settlement as `unresolved`. Findings are **detection evidence, never a failure**: logged (`hook_escape`), persisted on the job row (`hook_escapes`, JSON), exposed by `status`/`result --json`, printed as a stderr `safety hook notice`, and carried in timeout details; the run continues, the job's outcome is unchanged, and the review gate stays fail-open and only annotates. The stream has no outcome field, so a mismatch is equally an upstream pre-hook rejection (unknown tool, disabled tool, invalid args, sensitive path, per-tool resolve errors), a coexisting hook or permission policy blocking first, or hook drift — failing the job needs positive execution evidence this stream does not provide. Streamed calls under read-only labels are covered (swarm subagents are in-process, not streamed); write labels only for the pure denials (plan/goal tools).
+
+A denied attempt alone is not a finding: the hook's denial text in the corresponding tool result (byte-exact, or carrying upstream's repeat-breaker decoration) proves enforcement and clears it. Anything else is recorded as `mismatch` with a 200-character excerpt; a denied call with no result at settlement as `unresolved`. **What a finding means:** the model received something other than the managed denial. On certified 2.2.0 that is produced just as readily by calls upstream rejects before the hook runs (`Tool "LS" not found`, `Invalid args for tool …`, the sensitive-path `PathSecurityError` for `.env`, per-tool resolve errors, `Tool skipped because a previous tool call stopped the turn.`), by a coexisting PreToolUse hook ahead of the managed block or an upstream permission policy blocking first, or by a cancel/budget abort landing before the result — none of which executed anything — as by a hook that failed open. Because the stream carries no outcome field, the plugin cannot tell these apart, so it reports and does not fail: the job completes or fails on its own merits, `status`/`result --json` carry `hook_escapes`, stderr prints a `safety hook notice`, and the review gate annotates `systemMessage` without changing its decision. Treat a finding as a prompt to run `/kimi:setup --check` and read the excerpt, not as proof of a breach; treat a *recurring* `mismatch` whose excerpt looks like tool output (`Wrote N bytes to …`) as a drifted hook. Coverage is streamed calls under read-only labels and pure denials under write labels — not filesystem-dependent rescue allowlist decisions, not swarm subagent calls (in-process, never streamed). Non-vacuous live control (CLI 2.2.0, 2026-10-15): with the hook command pointed at a nonexistent script upstream failed open, `Write` created the file, and the finding was `mismatch` with excerpt `Wrote 7 bytes to ESCAPE.txt`; with the hook intact the same prompt produced the byte-exact denial and no finding. Enforcement (stopping the run, failing the job) is deliberately not shipped: it needs positive execution evidence. The upstream ask, filed as MoonshotAI/kimi-code#4241, is an `outcome: executed|vetoed|rejected` field on print-mode tool records; a plugin-side alternative is a per-job trace the hook writes before it exits.
+
+## Review-gate thinking request
+
+The gate requests `off` through `KIMI_MODEL_THINKING_EFFORT` by default. `KIMI_PLUGIN_CC_REVIEW_GATE_THINKING=inherit` leaves the ambient environment alone; any other non-empty value matching `/^[a-z][a-z0-9-]{0,31}$/` is passed verbatim. This is best-effort, never an enforced latency guarantee: non-trait-driven/BYO providers ignore it silently, an already-off base remains off, and an always-thinking model receives `off` unnormalized and may continue reasoning. Stream-json has no thinking deltas, so honouring the request cannot be observed. The 8 s budget and fail-open-on-timeout contract are unchanged; a hook-escape finding only annotates the gate's `systemMessage`. `KIMI_PLUGIN_CC_REVIEW_GATE_THINKING` is lowercased like `--thinking`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Kimi for Claude Code and Codex: code questions, reviews, fixes, and parallel tasks through the local Kimi Code CLI.",
   "type": "module",
   "engines": {

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Codex plugin that delegates review, challenge, ask, rescue, pursue, and swarm workflows to the local kimi-code CLI through the kimi-plugin-cc companion runtime.",
   "author": {
     "name": "linxule"

package/plugins/kimi-codex/dist/cli-client.js

@@ -19,6 +19,7 @@
 import { spawn } from "node:child_process";
 import { appendFile, mkdir } from "node:fs/promises";
 import path from "node:path";
+import { createHookEscapeMonitor } from "./hook-escape.js";
 import { RuntimeError, formatError } from "./errors.js";
 import { assertNoUnsafeExperimentalSelector, assertExecutionPlanMatchesSpawn, } from "./kimi-engine.js";
 import { assertPrefixArgsSafe } from "./kimi-command.js";
@@ -125,7 +126,16 @@ export async function runCliPrompt(opts) {
     let stderrTail = "";
     let announcedSessionId;
     let announcedGoalSummary;
+    let announcedCliError;
     let announcedSystemVersion;
+    const hookMonitor = createHookEscapeMonitor({ commandLabel: opts.commandLabel,
+        operationKind: opts.executionPlan.operationKind, trustedWorkspaceRoot: opts.trustedWorkspaceRoot, cwd: opts.cwd });
+    const hookEscapes = [];
+    const noteHookEscape = (escape) => {
+        hookEscapes.push(escape);
+        appendLogLine({ event: "hook_escape", ...escape, command_label: opts.commandLabel,
+            operation_kind: opts.executionPlan.operationKind });
+    };
     let engineMismatchDetected = false;
     let handleEngineMismatch;
     const plannedEngine = opts.executionPlan.intendedEngine;
@@ -181,6 +191,13 @@ export async function runCliPrompt(opts) {
         for (const outcome of outcomes) {
             if (engineMismatchDetected)
                 return;
+            if (outcome.cliError !== undefined) {
+                if (requireMarkerBeforeOutput("a CLI error record"))
+                    return;
+                announcedCliError ??= outcome.cliError;
+                appendLogLine({ event: "cli_error", ...outcome.cliError });
+                continue;
+            }
             if (outcome.unknownRecord !== undefined) {
                 // H3 forward-compat: a stream-json line with a role we don't model
                 // (a future kimi-code role). Log it for diagnostics but keep it OUT of
@@ -283,6 +300,9 @@ export async function runCliPrompt(opts) {
                 }
                 if (requireMarkerBeforeOutput(`a ${outcome.record.role} record`))
                     return;
+                const escape = hookMonitor.observe(outcome.record);
+                if (escape)
+                    noteHookEscape(escape);
                 records.push(outcome.record);
                 appendLogLine({ event: "record", record: outcome.record });
                 invokeOnRecord(outcome.record);
@@ -314,6 +334,13 @@ export async function runCliPrompt(opts) {
         const settle = (kind, payload) => {
             if (settlementStarted)
                 return;
+            // Denied calls still without a result (a cancel/budget race, an abnormal
+            // exit, or a turn that ended without the denial the hook owes) are reported
+            // alongside the real outcome, never instead of it.
+            for (const escape of hookMonitor.settle())
+                noteHookEscape(escape);
+            if (kind === "resolve" && hookEscapes.length > 0)
+                payload = { ...payload, hookEscapes: [...hookEscapes] };
             settlementStarted = true;
             opts.signal?.removeEventListener("abort", onAbort);
             // Abort teardown can outlive the direct child's close event while a
@@ -472,6 +499,11 @@ export async function runCliPrompt(opts) {
                 }
             }
         };
+        const stopForPolicyFailure = (error) => {
+            engineMismatchDetected = true; // Stops all further consumer output.
+            cancellationTeardown ??= teardownChildTree().then(() => ({ ok: true }), (error) => ({ ok: false, error }));
+            settle("reject", error);
+        };
         let engineMismatchError;
         handleEngineMismatch = (mismatch) => {
             if (engineMismatchError !== undefined)
@@ -493,8 +525,7 @@ export async function runCliPrompt(opts) {
                 system_version: mismatch.systemVersion ?? null,
                 reason: mismatch.reason,
             });
-            cancellationTeardown = teardownChildTree().then(() => ({ ok: true }), (error) => ({ ok: false, error }));
-            settle("reject", engineMismatchError);
+            stopForPolicyFailure(engineMismatchError);
         };
         const onAbort = () => {
             if (aborted)
@@ -586,6 +617,7 @@ export async function runCliPrompt(opts) {
                 settledAt: 0, // Filled at settlement, after the teardown barrier.
                 sessionId,
                 goalSummary: announcedGoalSummary,
+                cliError: announcedCliError,
                 systemVersion: announcedSystemVersion,
                 observedEngine: announcedSystemVersion !== undefined
                     ? "native-v2"
@@ -674,6 +706,7 @@ export class ResponseTimeoutError extends RuntimeError {
                 partial_output_chars: partialResult?.records.reduce((count, record) => count + (record.role === "assistant" && typeof record.content === "string" ? record.content.length : 0), 0) ?? 0,
                 aborted: partialResult?.aborted ?? true,
                 ...(partialResult ? { settled_post_abort: true } : {}),
+                ...(partialResult?.hookEscapes?.length ? { hook_escapes: partialResult.hookEscapes } : {}),
             },
         });
         this.name = "ResponseTimeoutError";
@@ -778,11 +811,11 @@ function buildArgs(opts) {
             args.push("--skills-dir", dir);
         }
     }
-    // NOTE: `opts.thinking === false` is intentionally NOT translated into a
-    // `--no-thinking` argv flag. kimi-code 0.1.1 rejects unknown options and
-    // has no per-spawn thinking control — the Round 2 multi-agent review
-    // caught this. The option stays in CliClientOptions for future wiring
-    // when upstream adds the flag (see field doc).
+    // NOTE: thinking effort is requested through the env binding, never CLI argv.
+    // Non-trait-driven providers or a base level already off ignore it silently;
+    // an alwaysThinking model receives off unnormalized. stream-json carries no
+    // thinking deltas (writeThinkingDelta() {} in the JSON writer), so the plugin
+    // cannot observe whether the request was honoured.
     // -p accepts the prompt as the option value. We pass it as a separate argv
     // entry so prompts with leading dashes or whitespace are not interpreted as
     // additional flags.
@@ -791,6 +824,8 @@ function buildArgs(opts) {
 }
 function buildEnv(opts) {
     const env = { ...opts.env };
+    if (opts.thinkingEffort !== undefined)
+        env.KIMI_MODEL_THINKING_EFFORT = opts.thinkingEffort;
     // 2.2.0 audit: ambient trust starts project MCP stdio servers outside PreToolUse.
     delete env.KIMI_CODE_TRUST_WORKSPACE;
     // kimi-code 0.33.0 inverted its CLI engine default: an unflagged `kimi -p`

package/plugins/kimi-codex/dist/commands/ask.js

@@ -17,7 +17,7 @@ import { readArtifact, renderManagedJobOutput, writeArtifact } from "../render.j
 import { classifyManagedCommandFailure } from "../kimi-errors.js";
 import { startBackgroundJob } from "../background-spawn.js";
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
-import { warnInheritedBudget, captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
+import { warnInheritedBudget, captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing, warnHookEscapes } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
 // v1.0 cutover note (PR 2):
 //
@@ -77,7 +77,8 @@ export async function runAsk(argv, context) {
             command_type: "ask",
             cwd: context.cwd,
             model: parsed.model ?? null,
-            thinking: parsed.thinking ?? null,
+            thinking: null,
+            thinking_effort: parsed.thinkingEffort ?? null,
             background: parsed.background,
             budget_ms: parsed.budgetMs ?? (sessionResolution.sourceJob?.operation_kind === "ask" ? sessionResolution.sourceJob.budget_ms : null) ?? null,
             budget_source: parsed.budgetMs !== undefined ? "explicit"
@@ -174,6 +175,7 @@ export async function executeAskJob(jobId, prompt, context, options) {
             prompt,
             commandLabel: "ask",
             model: job.model ?? undefined,
+            thinkingEffort: job.thinking_effort ?? undefined,
             resumeSessionId: job.kimi_session_id ?? undefined,
             logPath: job.stream_log_path,
             signal: handlers.signal,
@@ -183,6 +185,7 @@ export async function executeAskJob(jobId, prompt, context, options) {
             throw new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.afterPrompt, "ask.runtime");
         }
         assertCliResultSuccess(result, "ask.runtime");
+        warnHookEscapes(result, "ask", context.stderr);
         // Persist whichever session id kimi actually announced. For fresh
         // sessions this is the only chance to record it. For resumed
         // sessions it should match the input, but capture anyway in case

package/plugins/kimi-codex/dist/commands/cli-helpers.js

@@ -99,7 +99,7 @@ export function assertCliResultSuccess(result, stage) {
         });
     }
     if (result.exitCode !== 0) {
-        const tail = result.stderrTail.trim();
+        const tail = result.cliError?.message ?? result.stderrTail.trim();
         throw new RuntimeError("CLI_NONZERO_EXIT", [
             `kimi subprocess exited with code ${result.exitCode}`,
             result.signal ? ` (signal ${result.signal})` : "",
@@ -110,6 +110,7 @@ export function assertCliResultSuccess(result, stage) {
                 signal: result.signal,
                 record_count: result.records.length,
                 malformed_count: result.malformed.length,
+                ...(result.cliError !== undefined && { cli_error: result.cliError }),
                 stderr_tail_len: result.stderrTail.length,
             },
         });
@@ -185,6 +186,19 @@ export async function captureTimeoutPartialOutput(classified, store, job, env, c
         budgetMs: timeout.details.budget_ms,
     };
 }
+/** One-line human summary of hook-escape findings, or undefined when none. */
+export function describeHookEscapes(result) {
+    const escapes = result.hookEscapes ?? [];
+    if (escapes.length === 0)
+        return undefined;
+    const first = escapes[0];
+    return `safety hook notice: ${escapes.length} policy-denied tool call(s) did not come back as the managed hook's denial (first: ${first.tool_name} ${first.kind}). Detection evidence only — the call may have been rejected upstream before the hook ran, blocked by another hook, or executed because the hook drifted. Run /kimi:setup --check; details in \`result <jobId> --json\` (hook_escapes).`;
+}
+export function warnHookEscapes(result, commandType, stderr) {
+    const note = describeHookEscapes(result);
+    if (note !== undefined)
+        stderr.write(`[${commandType}] ${note}\n`);
+}
 export function warnInheritedBudget(job, stderr) {
     if (job.budget_source === "inherited" && job.budget_ms !== null) {
         stderr.write(`[${job.command_type}] budget ${formatBudgetDuration(job.budget_ms)} inherited from job ${job.resumed_from_job_id}; pass --budget to override\n`);

package/plugins/kimi-codex/dist/commands/pursue.js

@@ -14,7 +14,7 @@ import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { parsePursueArgs } from "../parsing.js";
 import { readArtifact, renderManagedJobOutput, writeArtifact } from "../render.js";
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
-import { assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
+import { assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing, warnHookEscapes } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
 // /kimi:pursue — autonomous goal mode (kimi-code 0.8.0+ headless `/goal`).
 //
@@ -141,7 +141,8 @@ export async function runPursue(argv, context) {
             command_type: "rescue",
             cwd: context.cwd,
             model: parsed.model ?? null,
-            thinking: parsed.thinking ?? null,
+            thinking: null,
+            thinking_effort: parsed.thinkingEffort ?? null,
             background: false,
             budget_ms: parsed.budgetMs ?? KIMI_PURSUE_DEFAULT_BUDGET_MS,
             budget_source: parsed.budgetMs !== undefined ? "explicit" : "default",
@@ -233,10 +234,12 @@ async function executePursueJob(jobId, prompt, objective, budgetMs, context) {
             commandLabel: "rescue",
             trustedWorkspaceRoot: job.cwd,
             model: job.model ?? undefined,
+            thinkingEffort: job.thinking_effort ?? undefined,
             logPath: job.stream_log_path,
             signal: handlers.signal,
         }, budgetMs, "pursue.prompt");
         store.updateRunningJob(job.job_id, observedExecutionFields(result));
+        warnHookEscapes(result, "pursue", context.stderr);
         if (handlers.cancelling) {
             throw new RuntimeError("PURSUE_CANCELLED", "Pursue cancelled by user request.", "pursue.runtime");
         }