kimi-plugin-cc 2.2.0 → 2.2.2

package/plugins/kimi-codex/dist/commands/rescue.js

@@ -17,7 +17,7 @@ import { parseRescueArgs } from "../parsing.js";
 import { readArtifact, renderManagedJobOutput, writeArtifact } from "../render.js";
 import { startBackgroundJob } from "../background-spawn.js";
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
-import { warnInheritedBudget, captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
+import { warnInheritedBudget, captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing, warnHookEscapes } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
 export { describeMissingResult } from "../background-spawn.js";
 // v1.0 cutover note (PR 3):
@@ -69,7 +69,8 @@ export async function runRescue(argv, context) {
             command_type: "rescue",
             cwd: context.cwd,
             model: parsed.model ?? null,
-            thinking: parsed.thinking ?? null,
+            thinking: null,
+            thinking_effort: parsed.thinkingEffort ?? null,
             background: parsed.background,
             budget_ms: parsed.budgetMs ?? (sessionResolution.sourceJob?.operation_kind === "rescue" ? sessionResolution.sourceJob.budget_ms : null) ?? null,
             budget_source: parsed.budgetMs !== undefined ? "explicit"
@@ -188,6 +189,7 @@ export async function executeRescueJob(jobId, prompt, context, options) {
             commandLabel: "rescue",
             trustedWorkspaceRoot: job.cwd,
             model: job.model ?? undefined,
+            thinkingEffort: job.thinking_effort ?? undefined,
             resumeSessionId: job.kimi_session_id ?? undefined,
             logPath: job.stream_log_path,
             signal: handlers.signal,
@@ -199,6 +201,7 @@ export async function executeRescueJob(jobId, prompt, context, options) {
             throw new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.afterPrompt, "rescue.runtime");
         }
         assertCliResultSuccess(result, "rescue.runtime");
+        warnHookEscapes(result, "rescue", context.stderr);
         if (result.sessionId !== undefined &&
             result.sessionId.length > 0) {
             // length>0 guard: empty-string capture would poison the row. (Kimi

package/plugins/kimi-codex/dist/commands/result.js

@@ -2,7 +2,7 @@ import { RuntimeError } from "../errors.js";
 import { resolveRepoIdentity } from "../git.js";
 import { sweepStaleJobs } from "../jobs.js";
 import { reconcileHistoricalJobProvenance } from "../kimi-engine.js";
-import { renderBudgetSource, withJobStore } from "../job-store.js";
+import { renderBudgetSource, withJobStore, parseHookEscapes } from "../job-store.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { parseJobLookupArgs } from "../parsing.js";
 import { readArtifact, renderTerminalJobArtifact } from "../render.js";
@@ -44,6 +44,8 @@ function renderResultEnvelope(job, artifactPath, body) {
         status: job.status,
         budget_ms: job.budget_ms,
         budget_source: renderBudgetSource(job),
+        thinking_effort_requested: job.thinking_effort ?? null,
+        hook_escapes: parseHookEscapes(job.hook_escapes),
         kimi_session_id_source: job.kimi_session_id_source,
         kimi_session_id: job.kimi_session_id,
         // True when a budget timeout preserved assistant prose in the artifact.

package/plugins/kimi-codex/dist/commands/review-gate.js

@@ -15,9 +15,10 @@ import { KIMI_REVIEW_GATE_TIMEOUT_MS, isTimeoutCode } from "../kimi-timeouts.js"
 import { writeInvocationLogHeader } from "../logging.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { renderManagedJobOutput, writeArtifact, } from "../render.js";
+import { validateThinkingEffort } from "../parsing.js";
 import { maybeWarnHookMissing, verifyHookInstalled } from "../hooks/install.js";
 import { resolveKimiHome } from "../kimi-home.js";
-import { assertCliResultSuccess, reassembleProseFromRecords } from "./cli-helpers.js";
+import { assertCliResultSuccess, describeHookEscapes, reassembleProseFromRecords } from "./cli-helpers.js";
 const REVIEW_GATE_AGENT_PROFILE_PLACEHOLDER = "<cli-client>";
 // v1.0 cutover note (PR 2):
 //
@@ -82,18 +83,19 @@ export async function runReviewGateStopHook(payload, context) {
             ...payload,
             cwd,
         }, assistantMessage, context);
+        const note = output.hookEscapeNote !== undefined ? `Kimi review gate ${output.hookEscapeNote}` : undefined;
         if (output.decision === "BLOCK" && output.confidence === "high") {
             return {
                 decision: "block",
                 reason: buildBlockReason(output),
+                ...(note !== undefined ? { systemMessage: note } : {}),
             };
         }
         if (output.decision === "BLOCK") {
-            return {
-                systemMessage: `Kimi review gate noted concerns but allowed stop: ${output.summary}`,
-            };
+            const concern = `Kimi review gate noted concerns but allowed stop: ${output.summary}`;
+            return { systemMessage: note !== undefined ? `${concern}\n${note}` : concern };
         }
-        return {};
+        return note !== undefined ? { systemMessage: note } : {};
     }
     catch (error) {
         return {
@@ -105,6 +107,7 @@ function reviewGateSkipped(reason) {
     return { systemMessage: `review-gate skipped: ${reason}` };
 }
 async function executeReviewGate(payload, assistantMessage, context) {
+    let hookEscapeNote;
     const paths = resolvePluginPaths(context.env);
     await ensurePluginPaths(paths);
     const repoIdentity = await resolveRepoIdentity(payload.cwd);
@@ -121,6 +124,10 @@ async function executeReviewGate(payload, assistantMessage, context) {
             cwd: payload.cwd,
             repoRoot: repoIdentity.repoRoot,
         });
+        // Unset or empty → request "off" (the 8 s budget is why); "inherit" → export
+        // nothing; anything else is lowercased and syntax-checked like --thinking.
+        const gateThinking = context.env.KIMI_PLUGIN_CC_REVIEW_GATE_THINKING?.trim() || "off";
+        const thinkingEffort = gateThinking.toLowerCase() === "inherit" ? undefined : validateThinkingEffort(gateThinking, "review_gate.parse");
         const configuredModel = context.env.KIMI_PLUGIN_CC_REVIEW_GATE_MODEL;
         const model = configuredModel?.trim() ? configuredModel : undefined;
         const executionPlan = await prepareKimiExecutionPlan({
@@ -148,6 +155,7 @@ async function executeReviewGate(payload, assistantMessage, context) {
             cwd: payload.cwd,
             model: model ?? null,
             thinking: false,
+            thinking_effort: thinkingEffort ?? null,
             background: false,
             pid: null,
             kimi_pid: null,
@@ -178,17 +186,15 @@ async function executeReviewGate(payload, assistantMessage, context) {
                 prompt,
                 commandLabel: "review_gate",
                 model,
-                // Intent: thinking-off so the 8s Stop-hook budget is achievable.
-                // Mechanism: currently advisory — kimi-code 0.1.1 has no CLI
-                // flag for this; control is config-based (default_thinking /
-                // [thinking].mode). The field carries intent through the
-                // contract; when upstream adds a per-spawn flag, buildArgs will
-                // translate it. (Round 2 Codex finding.)
-                thinking: false,
+                // Requested via env; provider/model may ignore it. The 8s budget still applies.
+                thinkingEffort,
                 logPath,
             }, KIMI_REVIEW_GATE_TIMEOUT_MS, "review_gate.runtime");
             activeStore.updateRunningJob(job.job_id, observedExecutionFields(result));
             assertCliResultSuccess(result, "review_gate.runtime");
+            // Detection evidence only (runtime/hook-escape.ts): the gate stays fail-open
+            // and annotates its decision; the finding is also on the job row.
+            hookEscapeNote = describeHookEscapes(result);
             if (result.sessionId !== undefined && result.sessionId.length > 0) {
                 // length>0 guard matches the other commands (Kimi alpha.4
                 // challenge finding #3 — defense-in-depth, since
@@ -217,7 +223,7 @@ async function executeReviewGate(payload, assistantMessage, context) {
                 final_output_path: artifactPath,
                 error: null,
             });
-            return rendered.output;
+            return { ...rendered.output, hookEscapeNote };
         }
         catch (error) {
             const classified = classifyManagedCommandFailure(error, "review_gate", job.job_id);

package/plugins/kimi-codex/dist/commands/review.js

@@ -17,7 +17,7 @@ import { renderManagedJobOutput, writeArtifact } from "../render.js";
 import { RuntimeError } from "../errors.js";
 import { resolveRepoIdentity } from "../git.js";
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
-import { captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
+import { captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing, warnHookEscapes } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
 // v1.0 cutover note (PR 2):
 //
@@ -79,7 +79,8 @@ export async function runReview(argv, context, commandType) {
         command_type: commandType,
         cwd: context.cwd,
         model: parsed.model ?? null,
-        thinking: parsed.thinking ?? null,
+        thinking: null,
+        thinking_effort: parsed.thinkingEffort ?? null,
         background: false,
         budget_ms: parsed.budgetMs ?? null,
         budget_source: parsed.budgetMs !== undefined ? "explicit" : "default",
@@ -113,6 +114,7 @@ export async function runReview(argv, context, commandType) {
             prompt: previewPrompt,
             commandLabel: commandType,
             model: parsed.model,
+            thinkingEffort: parsed.thinkingEffort,
             logPath,
             signal: handlers.signal,
         }, job.budget_ms ?? KIMI_REVIEW_PROMPT_TIMEOUT_MS, `${commandType}.prompt`);
@@ -121,6 +123,7 @@ export async function runReview(argv, context, commandType) {
             throw new RuntimeError(cancel.errorCodes.cancelled, cancel.cancelMessages.afterPrompt, `${commandType}.runtime`);
         }
         assertCliResultSuccess(result, `${commandType}.runtime`);
+        warnHookEscapes(result, commandType, context.stderr);
         // Persist whichever session id kimi announced. Review never resumes,
         // but the id is the only handle for post-hoc replay against
         // ~/.kimi-code/sessions/.

package/plugins/kimi-codex/dist/commands/status.js

@@ -2,7 +2,7 @@ import { RuntimeError } from "../errors.js";
 import { resolveRepoIdentity } from "../git.js";
 import { sweepStaleJobs } from "../jobs.js";
 import { reconcileHistoricalJobProvenance } from "../kimi-engine.js";
-import { renderBudgetSource, withJobStore } from "../job-store.js";
+import { parseHookEscapes, renderBudgetSource, withJobStore } from "../job-store.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { parseJobLookupArgs } from "../parsing.js";
 export async function runStatus(argv, context) {
@@ -22,6 +22,6 @@ export async function runStatus(argv, context) {
             throw new RuntimeError("JOB_NOT_FOUND", "No matching job was found for status.", "status.lookup");
         }
         const job = await reconcileHistoricalJobProvenance(store, found);
-        return `${JSON.stringify({ ...job, budget_source: renderBudgetSource(job) }, null, 2)}\n`;
+        return `${JSON.stringify({ ...job, thinking_effort_requested: job.thinking_effort ?? null, hook_escapes: parseHookEscapes(job.hook_escapes), budget_source: renderBudgetSource(job) }, null, 2)}\n`;
     });
 }

package/plugins/kimi-codex/dist/commands/swarm.js

@@ -15,7 +15,7 @@ import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { MAX_DURATION_MS, parseSwarmArgs } from "../parsing.js";
 import { readArtifact, renderManagedJobOutput, writeArtifact } from "../render.js";
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
-import { assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing } from "./cli-helpers.js";
+import { assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing, warnHookEscapes } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
 // /kimi:swarm — READ-ONLY parallel fan-out (kimi-code 0.12.0 AgentSwarm tool).
 //
@@ -208,7 +208,8 @@ async function runReadSwarm(parsed, objective, context) {
             command_type: "review",
             cwd: context.cwd,
             model: parsed.model ?? null,
-            thinking: parsed.thinking ?? null,
+            thinking: null,
+            thinking_effort: parsed.thinkingEffort ?? null,
             background: false,
             budget_ms: parsed.budgetMs ?? KIMI_SWARM_DEFAULT_BUDGET_MS,
             budget_source: parsed.budgetMs !== undefined ? "explicit" : "default",
@@ -308,7 +309,8 @@ async function runWriteSwarm(parsed, objective, context) {
                 command_type: "rescue",
                 cwd: context.cwd,
                 model: parsed.model ?? null,
-                thinking: parsed.thinking ?? null,
+                thinking: null,
+                thinking_effort: parsed.thinkingEffort ?? null,
                 background: false,
                 budget_ms: parsed.budgetMs ?? KIMI_SWARM_DEFAULT_BUDGET_MS,
                 budget_source: parsed.budgetMs !== undefined ? "explicit" : "default",
@@ -493,6 +495,7 @@ writeMode) {
             // by other labels). Only set in write mode.
             trustedWorkspaceRoot: writeMode?.workspaceRoot,
             model: job.model ?? undefined,
+            thinkingEffort: job.thinking_effort ?? undefined,
             logPath: job.stream_log_path,
             signal: handlers.signal,
         }, budgetMs, "swarm.prompt");
@@ -501,6 +504,7 @@ writeMode) {
             throw new RuntimeError("SWARM_CANCELLED", "Swarm cancelled by user request.", "swarm.runtime");
         }
         assertCliResultSuccess(result, "swarm.runtime");
+        warnHookEscapes(result, "swarm", context.stderr);
         if (result.sessionId !== undefined &&
             result.sessionId.length > 0 &&
             result.sessionId !== job.kimi_session_id) {

package/plugins/kimi-codex/dist/help.js

@@ -11,7 +11,7 @@ export function companionHelp(argv) {
             : 1;
     if (!hasHelpFlag(argv.slice(argumentStart)))
         return undefined;
-    const suffix = " Use --help or -h among the leading flags (before any prompt text or --) to show this usage.";
+    const suffix = " Thinking effort is a per-run request, not a guarantee. Use --help or -h among the leading flags (before any prompt text or --) to show this usage.";
     const usage = (name, positionals, flags, description) => `Usage: companion.sh ${name}${positionals ? ` ${positionals}` : ""}. ${description} Supported flags: ${flags}.${suffix}`;
     switch (command) {
         case "--help":

package/plugins/kimi-codex/dist/hook-escape.js

@@ -0,0 +1,71 @@
+import { decideHookOutcomePure } from "./hooks/approval-policy.js";
+// Upstream decorates results it still delivers verbatim otherwise (2.2.0,
+// `agent/toolDedupe/toolDedupeService.ts`): the repeat breaker appends one
+// `\n\n<system-reminder>…</system-reminder>` block from the 3rd identical call
+// (`appendReminder`, also for vetoed results — `finalizeToolResult` runs the
+// `onDidExecuteTool` hooks on every settled result), and at the 12th call it
+// replaces the result with a fixed "not executed" text (`HANDOFF_VETO_TEXT`).
+// Both still mean the hook's veto stood. Re-verify each certification.
+const REMINDER_SUFFIX = /^(?:\n\n<system-reminder>[\s\S]*?<\/system-reminder>)+$/;
+const HANDOFF_VETO_PREFIX = "This turn was ended by the repeat breaker after the same tool call was issued ";
+/** True when `content` is the hook's denial, possibly carrying upstream's repeat-breaker decoration. */
+export function carriesDenial(content, reason) {
+    if (content === reason)
+        return true;
+    if (content.startsWith(reason) && REMINDER_SUFFIX.test(content.slice(reason.length)))
+        return true;
+    return content.startsWith(HANDOFF_VETO_PREFIX);
+}
+/** Detection evidence, never enforcement. Results arrive after a tool may have
+ * executed, and the stream carries no outcome field: a result other than the
+ * managed denial is also what upstream emits for calls it rejected BEFORE the
+ * hook ran (unknown tool, disabled tool, invalid args, sensitive path, per-tool
+ * resolve errors) and what a coexisting hook or permission policy emits when it
+ * blocks first. So an escape is reported — logged, persisted, shown — and the
+ * run continues; failing the job needs positive execution evidence this stream
+ * does not provide. Filesystem policy is never replayed here. */
+export function createHookEscapeMonitor(ctx) {
+    const pending = new Map();
+    return {
+        observe(record) {
+            if (!ctx.commandLabel)
+                return;
+            if (record.role === "assistant") {
+                for (const call of record.tool_calls ?? []) {
+                    let args;
+                    try {
+                        args = JSON.parse(call.function.arguments);
+                    }
+                    catch {
+                        args = {};
+                    }
+                    if (typeof args !== "object" || args === null || Array.isArray(args))
+                        args = {};
+                    const result = decideHookOutcomePure({
+                        hook_event_name: "PreToolUse", tool_name: call.function.name,
+                        tool_input: args, tool_call_id: call.id, cwd: ctx.cwd,
+                    }, ctx);
+                    if (!("evaluator" in result) && result.decision === "deny") {
+                        pending.set(call.id, { reason: result.reason, tool_name: call.function.name });
+                    }
+                }
+            }
+            else if (record.role === "tool") {
+                const denied = pending.get(record.tool_call_id);
+                if (denied) {
+                    pending.delete(record.tool_call_id);
+                    if (!carriesDenial(record.content, denied.reason)) {
+                        return { tool_call_id: record.tool_call_id, tool_name: denied.tool_name,
+                            kind: "mismatch", content_excerpt: record.content.slice(0, 200) };
+                    }
+                }
+            }
+        },
+        /** Every denied call still without a result; call once at settlement. */
+        settle() {
+            const unresolved = [...pending.entries()].map(([tool_call_id, { tool_name }]) => ({ tool_call_id, tool_name, kind: "unresolved" }));
+            pending.clear();
+            return unresolved;
+        },
+    };
+}

package/plugins/kimi-codex/dist/hooks/approval-policy.js

@@ -81,6 +81,21 @@ const KNOWN_LABELS = new Set([
     "swarm-write",
 ]);
 export async function decideHookOutcome(input, ctx) {
+    const result = decideHookOutcomePure(input, ctx);
+    if (!("evaluator" in result))
+        return result;
+    const toolName = typeof input.tool_name === "string" ? input.tool_name : "";
+    if (ctx.rescueEvaluator !== undefined) {
+        return await ctx.rescueEvaluator(result.workspaceRoot, toolName, input.tool_input);
+    }
+    if (READ_ONLY_TOOLS.has(toolName))
+        return { decision: "allow" };
+    return {
+        decision: "deny",
+        reason: `kimi-plugin-cc safety hook: ${ctx.commandLabel} evaluator not configured; tool "${toolName}" denied as a safety default.`,
+    };
+}
+export function decideHookOutcomePure(input, ctx) {
     const label = typeof ctx.commandLabel === "string" ? ctx.commandLabel : undefined;
     // Out-of-plugin context: any kimi process spawned without our env var
     // is direct user usage. The hook MUST NOT restrict it.
@@ -176,18 +191,7 @@ export async function decideHookOutcome(input, ctx) {
                         "This is a plugin misconfiguration — writes are refused rather than risk the user's working tree.",
                 };
             }
-            if (ctx.rescueEvaluator !== undefined) {
-                return await ctx.rescueEvaluator(workspaceRoot, toolName, input.tool_input);
-            }
-            // Stub for callers that didn't inject the evaluator (tests of the policy
-            // function alone). The production entry script always injects it.
-            if (READ_ONLY_TOOLS.has(toolName)) {
-                return { decision: "allow" };
-            }
-            return {
-                decision: "deny",
-                reason: `kimi-plugin-cc safety hook: swarm-write evaluator not configured; tool "${toolName}" denied as a safety default.`,
-            };
+            return { evaluator: "rescue", workspaceRoot };
         }
         case "rescue": {
             const workspaceRoot = typeof ctx.trustedWorkspaceRoot === "string" ? ctx.trustedWorkspaceRoot : "";
@@ -200,21 +204,7 @@ export async function decideHookOutcome(input, ctx) {
                         "This is a plugin misconfiguration — writes are refused rather than trusting hook payload cwd.",
                 };
             }
-            if (ctx.rescueEvaluator !== undefined) {
-                return await ctx.rescueEvaluator(workspaceRoot, toolName, input.tool_input);
-            }
-            // Stub for callers that didn't inject the evaluator (e.g.,
-            // tests that exercise only the policy function). Allow
-            // Read/Grep/Glob and friends; deny everything else. The
-            // production entry script wires the real evaluator from
-            // runtime/rescue-approval.ts.
-            if (READ_ONLY_TOOLS.has(toolName)) {
-                return { decision: "allow" };
-            }
-            return {
-                decision: "deny",
-                reason: `kimi-plugin-cc safety hook: rescue evaluator not configured; tool "${toolName}" denied as a safety default.`,
-            };
+            return { evaluator: "rescue", workspaceRoot };
         }
         default:
             if (KNOWN_LABELS.has(label)) {

package/plugins/kimi-codex/dist/hooks/config-safety.js

@@ -593,7 +593,7 @@ function validateVersionSensitiveEvents(events, version) {
         return invalidHookSet(`version-sensitive event ${JSON.stringify(first.event)} requires a verified kimi-code version`, first.entry, first.line);
     }
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
-    // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398) and 2.2.0 (472192c3):
+    // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3) and 2.3.0 (b5e28fd6):
     // the additive events and HookDefSchema are unchanged. Require the full
     // version string AND matching components; no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
@@ -601,7 +601,8 @@ function validateVersionSensitiveEvents(events, version) {
         (version.version === "2.0.2" && version.patch === 2))) ||
         (version.minor === 1 && ((version.version === "2.1.0" && version.patch === 0) ||
             (version.version === "2.1.1" && version.patch === 1))) ||
-        (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))))) {
+        (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))) ||
+        (version.minor === 3 && version.version === "2.3.0" && version.patch === 0))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/plugins/kimi-codex/dist/job-store.js

@@ -73,7 +73,7 @@ export class JobStore {
             if (!tableHasColumn(this.db, "budget_ms")) {
                 this.db.exec(`ALTER TABLE jobs ADD COLUMN budget_ms INTEGER;`);
             }
-            for (const column of ["kimi_session_id_source", "budget_source"]) {
+            for (const column of ["kimi_session_id_source", "budget_source", "thinking_effort", "hook_escapes"]) {
                 if (!tableHasColumn(this.db, column)) {
                     this.db.exec("ALTER TABLE jobs ADD COLUMN " + column + " TEXT;");
                 }
@@ -172,14 +172,14 @@ export class JobStore {
         try {
             this.db.run(`
           INSERT INTO jobs (
-            job_id, repo_id, command_type, created_at, updated_at, cwd, model, thinking,
+            job_id, repo_id, command_type, created_at, updated_at, cwd, model, thinking, thinking_effort,
             background, pid, kimi_pid, status, kimi_session_id, kimi_session_id_source, budget_source,
             operation_kind, intended_engine, observed_engine, kimi_version, system_version,
             kimi_command, kimi_prefix_args, plan_certification, resumed_from_job_id, safety_profile,
             agent_profile, prompt_digest, summary, phase, budget_ms, final_output_path, stream_log_path, error
           )
           VALUES (
-            @job_id, @repo_id, @command_type, @created_at, @updated_at, @cwd, @model, @thinking,
+            @job_id, @repo_id, @command_type, @created_at, @updated_at, @cwd, @model, @thinking, @thinking_effort,
             @background, @pid, @kimi_pid, @status, @kimi_session_id, @kimi_session_id_source, @budget_source,
             @operation_kind, @intended_engine, @observed_engine, @kimi_version, @system_version,
             @kimi_command, @kimi_prefix_args, @plan_certification, @resumed_from_job_id, @safety_profile,
@@ -309,7 +309,7 @@ export class JobStore {
         "status", "summary", "phase", "budget_ms", "budget_source", "kimi_session_id_source", "pid", "kimi_pid",
         "final_output_path", "stream_log_path", "kimi_session_id",
         "error", "command_type", "prompt_digest", "repo_id",
-        "cwd", "model", "thinking", "background", "agent_profile",
+        "cwd", "model", "thinking", "thinking_effort", "hook_escapes", "background", "agent_profile",
         "operation_kind", "intended_engine", "observed_engine", "kimi_version",
         "system_version", "kimi_command", "kimi_prefix_args", "plan_certification",
         "resumed_from_job_id", "safety_profile",
@@ -349,6 +349,7 @@ function hydrateRow(row) {
 function serializeRecord(record) {
     return {
         ...record,
+        thinking_effort: record.thinking_effort ?? null,
         phase: record.phase ?? null,
         budget_ms: record.budget_ms ?? null,
         budget_source: record.budget_source ?? null,
@@ -591,6 +592,18 @@ export function withJobStoreSync(paths, fn) {
     }
 }
 /** Old non-null budgets have unknown provenance; never invent explicit intent. */
+/** Parsed `hook_escapes` column for JSON envelopes: [] when NULL or unreadable. */
+export function parseHookEscapes(raw) {
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
 export function renderBudgetSource(job) {
     return job.budget_source ?? (job.budget_ms === null ? "default" : "unknown");
 }

package/plugins/kimi-codex/dist/kimi-engine.js

@@ -39,6 +39,7 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.1.0",
     "2.1.1",
     "2.2.0",
+    "2.3.0",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([
@@ -206,6 +207,8 @@ export function observedExecutionFields(result) {
     return {
         observed_engine: result.observedEngine,
         system_version: result.systemVersion ?? null,
+        // Detection evidence from runtime/hook-escape.ts, JSON array or NULL.
+        hook_escapes: result.hookEscapes && result.hookEscapes.length > 0 ? JSON.stringify(result.hookEscapes) : null,
     };
 }
 export function executionPlanFromPersisted(fields) {

package/plugins/kimi-codex/dist/kimi-errors.js

@@ -45,7 +45,7 @@ export function classifyManagedCommandFailure(error, commandType, jobId, options
     if (error instanceof RuntimeError) {
         details.cause_code = error.code;
         if (error.code === "RESPONSE_TIMEOUT") {
-            for (const key of ["budget_ms", "record_count", "partial_output_chars", "aborted", "settled_post_abort"]) {
+            for (const key of ["budget_ms", "record_count", "partial_output_chars", "aborted", "settled_post_abort", "hook_escapes"]) {
                 if (error.details[key] !== undefined)
                     details[key] = error.details[key];
             }

package/plugins/kimi-codex/dist/kimi-timeouts.js

@@ -8,7 +8,7 @@
 // startup failures surface as CLI_SPAWN_FAILED / CLI_PROCESS_ERROR —
 // not as separate timeouts. So only the per-command response budgets
 // remain.
-// Budgets are sized for thinking-on workflow (the default since v1.0).
+// Budgets accommodate thinking-capable workflows; per-run effort is only a request.
 // kimi-code spends real wallclock on extended reasoning before emitting
 // the first assistant record; pre-alpha.4 budgets (300s/600s) were sized
 // against the non-thinking path and timed out in production smoke
@@ -49,15 +49,11 @@ export const KIMI_SWARM_DEFAULT_BUDGET_MS = 1_800_000; // 30 minutes
  * Review-gate budget. Fires inside Claude Code's Stop hook so any value
  * above the user's perceptible wait makes the gate feel broken.
  *
- * kimi-code 0.1.1 has no per-spawn CLI flag for thinking control
- * (Round 2 multi-agent review caught this — emitting `--no-thinking`
- * triggers an unknown-option crash). The 8s budget assumes the user
- * has either `default_thinking = false` or `[thinking].mode = "off"`
- * in `~/.kimi-code/config.toml`, OR a non-thinking-capable model
- * selected for review-gate (via KIMI_PLUGIN_CC_REVIEW_GATE_MODEL).
- * Under thinking-on the gate will time out — the gate is fail-open on
- * timeout by design, so the worst case is the gate becomes
- * always-allow. See docs/safety.md.
+ * The gate requests off through KIMI_MODEL_THINKING_EFFORT by default;
+ * KIMI_PLUGIN_CC_REVIEW_GATE_THINKING can inherit or request another effort.
+ * BYO/non-trait-driven providers and always-thinking models can ignore it.
+ * The 8s timeout remains fail-open; a request never guarantees completion.
+ * Hook-enforcement escape is a separate blocking failure. See docs/safety.md.
  */
 export const KIMI_REVIEW_GATE_TIMEOUT_MS = 8_000;
 export function isTimeoutCode(code) {

package/plugins/kimi-codex/dist/kimi-version-probe.js

@@ -198,8 +198,8 @@ export const KIMI_TESTED_MINORS = [
     // import it; `-p` stdout stays the direct PromptJsonWriter), session-lifecycle
     // changes that only HELP our cancellation story (active-turn cancel on close +
     // BACKGROUND_KEEP_ALIVE_ON_EXIT default flipped true→false), an `alwaysThinking`
-    // model-capability flag (read-only detection, the H5 thinking-control knob is
-    // still upstream-blocked), a SIGHUP cleanup handler (exit 129; SIGTERM still
+    // model-capability flag (the H5 env request ships in plugin 2.2.1,
+    // but always-thinking models need not honour it), a SIGHUP cleanup handler (exit 129; SIGTERM still
     // exits 143 and runs cleanup — our SIGTERM→SIGKILL reaping is unaffected), and
     // a new builtin `import-from-cc-codex` skill (not a plugin surface).
     // See .claude/kimi-code-research/reports/72-76 for the audit reports.