kimi-plugin-cc 2.2.1 → 2.2.2

package/.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
   },
   "metadata": {
     "description": "Kimi for Claude Code: code questions, reviews, fixes, and parallel tasks through the local Kimi Code CLI.",
-    "version": "2.2.1"
+    "version": "2.2.2"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi",
   "description": "Claude Code plugin that delegates read-only review, challenge, free-form ask, and write-capable rescue work to the local kimi-code CLI. Includes an opt-in stop-time review gate and a PreToolUse hook that enforces per-command safety.",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "homepage": "https://github.com/linxule/kimi-plugin-cc",
   "repository": "https://github.com/linxule/kimi-plugin-cc",
   "license": "Apache-2.0",

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 > **Post-1.0 release history (v1.0.1 -> present) lives in [ROADMAP-TO-GA.md § Post-GA audit log](./ROADMAP-TO-GA.md#post-ga-audit-log)** and the "Version" / "Upstream compat" lines of [AGENTS.md](./AGENTS.md). Docs-only kimi-code compat checkups that don't bump the plugin version (e.g. the 0.14.2 / 0.14.3 patches) are recorded there, not here. Notable releases are summarized below; the GA entry and full pre-GA detail follow.
 
+## 2.2.2 — 2026-10-22
+
+- Certify exact kimi-code 2.3.0 for all eight native-v2 operations after its
+  source scan, plan-ON/OFF controls and full candidate smoke; legacy support
+  remains capped at 0.41.x. See [evidence](docs/upstream-2.3.0-certification.md).
+
+- Preserve CLI 2.3.0's stdout-only occupied-session refusal as bounded structured
+  diagnostics, without treating it as prose, session lineage or an exit-status
+  override. Marker-first provenance checks are unchanged.
+- Audit and pin the new stale-session reload path. Concurrent edits to trusted
+  operator journals remain an explicit residual; no new hook bypass within the
+  existing trust boundary was demonstrated. Clarify the no-plan certification
+  gates and remove stale ordering-gate instructions.
+
 ## 2.2.1 — 2026-10-15
 
 - Request per-run thinking effort with `--thinking <effort>` through the upstream environment binding; persist requested effort and replay it in detached workers without changing saved defaults. The review gate requests `off` by default; provider/model no-op cases remain explicit.

package/README.md

@@ -40,7 +40,7 @@ You need:
 - macOS or Linux
 - Claude Code or Codex with plugin support
 - Node.js 22.5 or newer
-- Kimi Code CLI 2.2.0 (2.1.1 also certified), the recommended version for plugin 2.2.0
+- Kimi Code CLI 2.3.0 (2.2.0 also certified), the recommended version for plugin 2.2.2
 
 Windows is not currently supported. Check your versions in a terminal:
 
@@ -108,7 +108,7 @@ needed to use the package. Kimi Code CLI and Node are still prerequisites.
 For an explicitly versioned local Claude Code plugin:
 
 ```sh
-npm install --prefix ~/.local/share/kimi-plugin-cc kimi-plugin-cc@2.2.1
+npm install --prefix ~/.local/share/kimi-plugin-cc kimi-plugin-cc@2.2.2
 claude --plugin-dir ~/.local/share/kimi-plugin-cc/node_modules/kimi-plugin-cc
 ```
 
@@ -249,7 +249,7 @@ Contributors need Bun to run `bun run check`. The detailed engineering documents
 - macOS 或 Linux
 - 支持插件的 Claude Code 或 Codex
 - Node.js 22.5 或更高版本
-- Kimi Code CLI 2.2.0（2.1.1 亦已认证），这是插件 2.2.0 的推荐版本
+- Kimi Code CLI 2.3.0（2.2.0 亦已认证），这是插件 2.2.2 的推荐版本
 
 目前不支持 Windows。在终端检查版本：
 
@@ -433,7 +433,7 @@ Il vous faut :
 - macOS ou Linux
 - une version de Claude Code ou de Codex prenant en charge les plugins
 - Node.js 22.5 ou une version ultérieure
-- Kimi Code CLI 2.2.0 (2.1.1 également certifiée), la version recommandée pour le plugin 2.2.0
+- Kimi Code CLI 2.3.0 (2.2.0 également certifiée), la version recommandée pour le plugin 2.2.2
 
 Windows n'est pas pris en charge actuellement. Vérifiez les versions dans un terminal :
 
@@ -617,7 +617,7 @@ Les contributeurs ont besoin de Bun pour exécuter `bun run check`. La documenta
 - macOS または Linux
 - プラグインに対応した Claude Code または Codex
 - Node.js 22.5 以降
-- Kimi Code CLI 2.2.0（2.1.1 も認証済み。プラグイン 2.2.0 の推奨バージョン）
+- Kimi Code CLI 2.3.0（2.2.0 も認証済み。プラグイン 2.2.2 の推奨バージョン）
 
 現在、Windows には対応していません。ターミナルでバージョンを確認します。
 

package/dist/cli-client.js

@@ -126,6 +126,7 @@ export async function runCliPrompt(opts) {
     let stderrTail = "";
     let announcedSessionId;
     let announcedGoalSummary;
+    let announcedCliError;
     let announcedSystemVersion;
     const hookMonitor = createHookEscapeMonitor({ commandLabel: opts.commandLabel,
         operationKind: opts.executionPlan.operationKind, trustedWorkspaceRoot: opts.trustedWorkspaceRoot, cwd: opts.cwd });
@@ -190,6 +191,13 @@ export async function runCliPrompt(opts) {
         for (const outcome of outcomes) {
             if (engineMismatchDetected)
                 return;
+            if (outcome.cliError !== undefined) {
+                if (requireMarkerBeforeOutput("a CLI error record"))
+                    return;
+                announcedCliError ??= outcome.cliError;
+                appendLogLine({ event: "cli_error", ...outcome.cliError });
+                continue;
+            }
             if (outcome.unknownRecord !== undefined) {
                 // H3 forward-compat: a stream-json line with a role we don't model
                 // (a future kimi-code role). Log it for diagnostics but keep it OUT of
@@ -609,6 +617,7 @@ export async function runCliPrompt(opts) {
                 settledAt: 0, // Filled at settlement, after the teardown barrier.
                 sessionId,
                 goalSummary: announcedGoalSummary,
+                cliError: announcedCliError,
                 systemVersion: announcedSystemVersion,
                 observedEngine: announcedSystemVersion !== undefined
                     ? "native-v2"

package/dist/commands/cli-helpers.js

@@ -99,7 +99,7 @@ export function assertCliResultSuccess(result, stage) {
         });
     }
     if (result.exitCode !== 0) {
-        const tail = result.stderrTail.trim();
+        const tail = result.cliError?.message ?? result.stderrTail.trim();
         throw new RuntimeError("CLI_NONZERO_EXIT", [
             `kimi subprocess exited with code ${result.exitCode}`,
             result.signal ? ` (signal ${result.signal})` : "",
@@ -110,6 +110,7 @@ export function assertCliResultSuccess(result, stage) {
                 signal: result.signal,
                 record_count: result.records.length,
                 malformed_count: result.malformed.length,
+                ...(result.cliError !== undefined && { cli_error: result.cliError }),
                 stderr_tail_len: result.stderrTail.length,
             },
         });

package/dist/hooks/config-safety.js

@@ -593,7 +593,7 @@ function validateVersionSensitiveEvents(events, version) {
         return invalidHookSet(`version-sensitive event ${JSON.stringify(first.event)} requires a verified kimi-code version`, first.entry, first.line);
     }
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
-    // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398) and 2.2.0 (472192c3):
+    // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3) and 2.3.0 (b5e28fd6):
     // the additive events and HookDefSchema are unchanged. Require the full
     // version string AND matching components; no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
@@ -601,7 +601,8 @@ function validateVersionSensitiveEvents(events, version) {
         (version.version === "2.0.2" && version.patch === 2))) ||
         (version.minor === 1 && ((version.version === "2.1.0" && version.patch === 0) ||
             (version.version === "2.1.1" && version.patch === 1))) ||
-        (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))))) {
+        (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))) ||
+        (version.minor === 3 && version.version === "2.3.0" && version.patch === 0))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/dist/kimi-engine.js

@@ -39,6 +39,7 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.1.0",
     "2.1.1",
     "2.2.0",
+    "2.3.0",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([

package/dist/stream-json.js

@@ -12,6 +12,8 @@
 //   {"role":"meta","type":"turn.step.retrying","failed_attempt":1,"next_attempt":2,"max_attempts":3,"delay_ms":300,"error_name":"APIProviderRateLimitError","error_message":"...","status_code":429}
 //   {"role":"meta","type":"system.version","version":"0.24.2"} // experimental v2 only; modeled since v1.8.5 (SystemVersionRecord), filtered like other meta
 //
+//   {"type":"error","code":"session.occupied","message":"...","details":{...}} // 2.3.0; stdout-only refusal, exit 4
+//
 // Notes on what does and does not appear here:
 //   - The session.resume_hint meta record is NEW in kimi-code 0.2.0
 //     (introduced at run-prompt.ts:477-505 in 0.2.0; the writer region —
@@ -263,6 +265,20 @@ function parseLine(line) {
     if (role === undefined && parsed["type"] === "goal.summary") {
         return validateGoalSummary(parsed, line);
     }
+    if (role === undefined && parsed["type"] === "error") {
+        if (typeof parsed["code"] !== "string" || parsed["code"].length === 0 ||
+            typeof parsed["message"] !== "string" || parsed["message"].length === 0 ||
+            (parsed["details"] !== undefined && !isRecord(parsed["details"]))) {
+            return { malformedLine: line, malformedReason: "error record field has unexpected type" };
+        }
+        // Keep bounded diagnostic fields only; holder metadata is not needed and
+        // must not become a session-id source or be copied into persisted errors.
+        return { cliError: {
+                type: "error",
+                code: parsed["code"].slice(0, 200),
+                message: parsed["message"].slice(0, 4000),
+            } };
+    }
     // H3 forward-compat: a non-empty string role we don't model (a role a future
     // kimi-code adds). Surface it out-of-band on the unknownRecord channel —
     // tolerated, not malformed — so the parser keeps working and the diagnostic

package/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.2.1";
+export const KIMI_PLUGIN_CC_VERSION = "2.2.2";

package/docs/registry-releases.md

@@ -6,10 +6,12 @@ remain available. The package has no install scripts and no separate CLI.
 
 ## Publishing status
 
-As of October 15, 2026, [2.2.0 is live on npm](https://www.npmjs.com/package/kimi-plugin-cc/v/2.2.0), published by
-the release-event run of `publish.yml` (run 38658918855) through GitHub Actions OIDC with a signed
-provenance statement (sigstore log index 3256863983) — the first release where the tag-triggered
-path worked end to end without a manual dispatch. 2.0.8 (same day, run 38650044033) was the first
+As of October 15, 2026, [2.2.1 is live on npm](https://www.npmjs.com/package/kimi-plugin-cc/v/2.2.1), published by
+the release-event run of `publish.yml` (run 38720071707) through GitHub Actions OIDC with a signed
+provenance statement (sigstore log index 3263398504; tarball shasum
+`03907c66d440155763a860ab52b5107c0233938b`, registry propagation took a few minutes this time).
+2.2.0 (same day, run 38658918855, log index 3256863983) was the first release where the tag-triggered
+path worked end to end without a manual dispatch; 2.0.8 (same day, run 38650044033) was the first
 OIDC publication; 2.0.7 (September 26) was the hand-published bootstrap.
 The first upload used the validated GitHub Actions artifact and interactive npm
 authentication. Its public tarball matched that artifact byte-for-byte, and a
@@ -19,7 +21,7 @@ The trusted publisher is configured for `linxule/kimi-plugin-cc`, workflow
 `publish.yml`, environment `npm`, with direct publishing allowed.
 `NPM_TRUSTED_PUBLISHING=true` is enabled in GitHub Actions. Future GitHub releases
 use short-lived OIDC credentials, without a stored npm token or interactive 2FA.
-The first npm OIDC publication will be the next release; do not republish 2.0.7.
+OIDC publication is established; never republish an existing version.
 
 **2026-10-15 status.** The `v2.0.8` release triggered the first OIDC attempt. It
 failed twice on the publish step for reasons unrelated to the package: current

package/docs/safety.md

@@ -1,8 +1,8 @@
 # Safety
 
-This guide describes the shipped 2.2.0 runtime. Read-only tasks deny file writes and shell commands. Rescue and pursue can edit your workspace. Write-swarm returns a patch from a temporary Git worktree.
+This guide describes the current checkout runtime; 2.3.0 certification is unreleased. Read-only tasks deny file writes and shell commands. Rescue and pursue can edit your workspace. Write-swarm returns a patch from a temporary Git worktree.
 
-Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, and `2.1.1`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
+Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, and `2.3.0`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
 
 ## Why the safety story is hook-based
 
@@ -156,6 +156,8 @@ Provenance: a native-v2 plan requires the `system.version` marker as the first s
 
 Residuals, unchanged from v1 and stated plainly: `config.toml` and the session journals are trusted operator state (an actor who can write them could already delete the `[[hooks]]` entry); the upstream hook runner fails open on its own internal errors; the plan-path comparison does not realpath (a symlink there would need a prior hook-allowed write). Native plan mode, tower, subagent fork, Remote Control and `--add-dir` are out of scope.
 
+In CLI 2.3.0, stale-session retry can reread those same journals. Do not concurrently operate on or edit a plugin-managed session from another client. The upstream session lock is not a security boundary; no parent-side rescan can make that reload atomic.
+
 ## The rescue allowlist
 
 For `/kimi:rescue`, the hook delegates to [`evaluateRescueHookRequest`](../runtime/rescue-approval.ts). The allowlist has been extended since the original Wire-transport implementation. Highlights:
@@ -368,7 +370,7 @@ If you find a way to coax /kimi:review, /kimi:challenge, /kimi:review_gate, or /
 
 **Hook-escape monitor** (§1): the cli-client replays the pure hook policy on every streamed `tool_calls` entry; a call the policy denies whose tool result is not the hook's denial (byte-exact, or with upstream's repeat-breaker `<system-reminder>` decoration / handoff text) is recorded as `mismatch`, and a denied call still without a result at settlement as `unresolved`. Findings are **detection evidence, never a failure**: logged (`hook_escape`), persisted on the job row (`hook_escapes`, JSON), exposed by `status`/`result --json`, printed as a stderr `safety hook notice`, and carried in timeout details; the run continues, the job's outcome is unchanged, and the review gate stays fail-open and only annotates. The stream has no outcome field, so a mismatch is equally an upstream pre-hook rejection (unknown tool, disabled tool, invalid args, sensitive path, per-tool resolve errors), a coexisting hook or permission policy blocking first, or hook drift — failing the job needs positive execution evidence this stream does not provide. Streamed calls under read-only labels are covered (swarm subagents are in-process, not streamed); write labels only for the pure denials (plan/goal tools).
 
-A denied attempt alone is not a finding: the hook's denial text in the corresponding tool result (byte-exact, or carrying upstream's repeat-breaker decoration) proves enforcement and clears it. Anything else is recorded as `mismatch` with a 200-character excerpt; a denied call with no result at settlement as `unresolved`. **What a finding means:** the model received something other than the managed denial. On certified 2.2.0 that is produced just as readily by calls upstream rejects before the hook runs (`Tool "LS" not found`, `Invalid args for tool …`, the sensitive-path `PathSecurityError` for `.env`, per-tool resolve errors, `Tool skipped because a previous tool call stopped the turn.`), by a coexisting PreToolUse hook ahead of the managed block or an upstream permission policy blocking first, or by a cancel/budget abort landing before the result — none of which executed anything — as by a hook that failed open. Because the stream carries no outcome field, the plugin cannot tell these apart, so it reports and does not fail: the job completes or fails on its own merits, `status`/`result --json` carry `hook_escapes`, stderr prints a `safety hook notice`, and the review gate annotates `systemMessage` without changing its decision. Treat a finding as a prompt to run `/kimi:setup --check` and read the excerpt, not as proof of a breach; treat a *recurring* `mismatch` whose excerpt looks like tool output (`Wrote N bytes to …`) as a drifted hook. Coverage is streamed calls under read-only labels and pure denials under write labels — not filesystem-dependent rescue allowlist decisions, not swarm subagent calls (in-process, never streamed). Non-vacuous live control (CLI 2.2.0, 2026-10-15): with the hook command pointed at a nonexistent script upstream failed open, `Write` created the file, and the finding was `mismatch` with excerpt `Wrote 7 bytes to ESCAPE.txt`; with the hook intact the same prompt produced the byte-exact denial and no finding. Enforcement (stopping the run, failing the job) is deliberately not shipped: it needs positive execution evidence. The parked upstream ask is an `outcome: executed|vetoed|rejected` field on print-mode tool records; a plugin-side alternative is a per-job trace the hook writes before it exits.
+A denied attempt alone is not a finding: the hook's denial text in the corresponding tool result (byte-exact, or carrying upstream's repeat-breaker decoration) proves enforcement and clears it. Anything else is recorded as `mismatch` with a 200-character excerpt; a denied call with no result at settlement as `unresolved`. **What a finding means:** the model received something other than the managed denial. On certified 2.2.0 that is produced just as readily by calls upstream rejects before the hook runs (`Tool "LS" not found`, `Invalid args for tool …`, the sensitive-path `PathSecurityError` for `.env`, per-tool resolve errors, `Tool skipped because a previous tool call stopped the turn.`), by a coexisting PreToolUse hook ahead of the managed block or an upstream permission policy blocking first, or by a cancel/budget abort landing before the result — none of which executed anything — as by a hook that failed open. Because the stream carries no outcome field, the plugin cannot tell these apart, so it reports and does not fail: the job completes or fails on its own merits, `status`/`result --json` carry `hook_escapes`, stderr prints a `safety hook notice`, and the review gate annotates `systemMessage` without changing its decision. Treat a finding as a prompt to run `/kimi:setup --check` and read the excerpt, not as proof of a breach; treat a *recurring* `mismatch` whose excerpt looks like tool output (`Wrote N bytes to …`) as a drifted hook. Coverage is streamed calls under read-only labels and pure denials under write labels — not filesystem-dependent rescue allowlist decisions, not swarm subagent calls (in-process, never streamed). Non-vacuous live control (CLI 2.2.0, 2026-10-15): with the hook command pointed at a nonexistent script upstream failed open, `Write` created the file, and the finding was `mismatch` with excerpt `Wrote 7 bytes to ESCAPE.txt`; with the hook intact the same prompt produced the byte-exact denial and no finding. Enforcement (stopping the run, failing the job) is deliberately not shipped: it needs positive execution evidence. The upstream ask, filed as MoonshotAI/kimi-code#4241, is an `outcome: executed|vetoed|rejected` field on print-mode tool records; a plugin-side alternative is a per-job trace the hook writes before it exits.
 
 ## Review-gate thinking request
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "Kimi for Claude Code and Codex: code questions, reviews, fixes, and parallel tasks through the local Kimi Code CLI.",
   "type": "module",
   "engines": {

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "Codex plugin that delegates review, challenge, ask, rescue, pursue, and swarm workflows to the local kimi-code CLI through the kimi-plugin-cc companion runtime.",
   "author": {
     "name": "linxule"

package/plugins/kimi-codex/dist/cli-client.js

@@ -126,6 +126,7 @@ export async function runCliPrompt(opts) {
     let stderrTail = "";
     let announcedSessionId;
     let announcedGoalSummary;
+    let announcedCliError;
     let announcedSystemVersion;
     const hookMonitor = createHookEscapeMonitor({ commandLabel: opts.commandLabel,
         operationKind: opts.executionPlan.operationKind, trustedWorkspaceRoot: opts.trustedWorkspaceRoot, cwd: opts.cwd });
@@ -190,6 +191,13 @@ export async function runCliPrompt(opts) {
         for (const outcome of outcomes) {
             if (engineMismatchDetected)
                 return;
+            if (outcome.cliError !== undefined) {
+                if (requireMarkerBeforeOutput("a CLI error record"))
+                    return;
+                announcedCliError ??= outcome.cliError;
+                appendLogLine({ event: "cli_error", ...outcome.cliError });
+                continue;
+            }
             if (outcome.unknownRecord !== undefined) {
                 // H3 forward-compat: a stream-json line with a role we don't model
                 // (a future kimi-code role). Log it for diagnostics but keep it OUT of
@@ -609,6 +617,7 @@ export async function runCliPrompt(opts) {
                 settledAt: 0, // Filled at settlement, after the teardown barrier.
                 sessionId,
                 goalSummary: announcedGoalSummary,
+                cliError: announcedCliError,
                 systemVersion: announcedSystemVersion,
                 observedEngine: announcedSystemVersion !== undefined
                     ? "native-v2"

package/plugins/kimi-codex/dist/commands/cli-helpers.js

@@ -99,7 +99,7 @@ export function assertCliResultSuccess(result, stage) {
         });
     }
     if (result.exitCode !== 0) {
-        const tail = result.stderrTail.trim();
+        const tail = result.cliError?.message ?? result.stderrTail.trim();
         throw new RuntimeError("CLI_NONZERO_EXIT", [
             `kimi subprocess exited with code ${result.exitCode}`,
             result.signal ? ` (signal ${result.signal})` : "",
@@ -110,6 +110,7 @@ export function assertCliResultSuccess(result, stage) {
                 signal: result.signal,
                 record_count: result.records.length,
                 malformed_count: result.malformed.length,
+                ...(result.cliError !== undefined && { cli_error: result.cliError }),
                 stderr_tail_len: result.stderrTail.length,
             },
         });

package/plugins/kimi-codex/dist/hooks/config-safety.js

@@ -593,7 +593,7 @@ function validateVersionSensitiveEvents(events, version) {
         return invalidHookSet(`version-sensitive event ${JSON.stringify(first.event)} requires a verified kimi-code version`, first.entry, first.line);
     }
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
-    // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398) and 2.2.0 (472192c3):
+    // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3) and 2.3.0 (b5e28fd6):
     // the additive events and HookDefSchema are unchanged. Require the full
     // version string AND matching components; no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
@@ -601,7 +601,8 @@ function validateVersionSensitiveEvents(events, version) {
         (version.version === "2.0.2" && version.patch === 2))) ||
         (version.minor === 1 && ((version.version === "2.1.0" && version.patch === 0) ||
             (version.version === "2.1.1" && version.patch === 1))) ||
-        (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))))) {
+        (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))) ||
+        (version.minor === 3 && version.version === "2.3.0" && version.patch === 0))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/plugins/kimi-codex/dist/kimi-engine.js

@@ -39,6 +39,7 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.1.0",
     "2.1.1",
     "2.2.0",
+    "2.3.0",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([

package/plugins/kimi-codex/dist/stream-json.js

@@ -12,6 +12,8 @@
 //   {"role":"meta","type":"turn.step.retrying","failed_attempt":1,"next_attempt":2,"max_attempts":3,"delay_ms":300,"error_name":"APIProviderRateLimitError","error_message":"...","status_code":429}
 //   {"role":"meta","type":"system.version","version":"0.24.2"} // experimental v2 only; modeled since v1.8.5 (SystemVersionRecord), filtered like other meta
 //
+//   {"type":"error","code":"session.occupied","message":"...","details":{...}} // 2.3.0; stdout-only refusal, exit 4
+//
 // Notes on what does and does not appear here:
 //   - The session.resume_hint meta record is NEW in kimi-code 0.2.0
 //     (introduced at run-prompt.ts:477-505 in 0.2.0; the writer region —
@@ -263,6 +265,20 @@ function parseLine(line) {
     if (role === undefined && parsed["type"] === "goal.summary") {
         return validateGoalSummary(parsed, line);
     }
+    if (role === undefined && parsed["type"] === "error") {
+        if (typeof parsed["code"] !== "string" || parsed["code"].length === 0 ||
+            typeof parsed["message"] !== "string" || parsed["message"].length === 0 ||
+            (parsed["details"] !== undefined && !isRecord(parsed["details"]))) {
+            return { malformedLine: line, malformedReason: "error record field has unexpected type" };
+        }
+        // Keep bounded diagnostic fields only; holder metadata is not needed and
+        // must not become a session-id source or be copied into persisted errors.
+        return { cliError: {
+                type: "error",
+                code: parsed["code"].slice(0, 200),
+                message: parsed["message"].slice(0, 4000),
+            } };
+    }
     // H3 forward-compat: a non-empty string role we don't model (a role a future
     // kimi-code adds). Surface it out-of-band on the unknownRecord channel —
     // tolerated, not malformed — so the parser keeps working and the diagnostic

package/plugins/kimi-codex/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.2.1";
+export const KIMI_PLUGIN_CC_VERSION = "2.2.2";