kimi-plugin-cc 2.2.2 → 2.3.1

package/plugins/kimi-codex/dist/kimi-version-probe.js

@@ -1,1255 +1,68 @@
 // Probe the installed kimi-code CLI version and check it against the
 // range kimi-plugin-cc has been tested against.
 //
-// Why this exists (H6, Codex post-hotfix audit Area 8):
-//
-//   kimi-code 0.2.0 introduced wire protocol 1.1 and a new "warn-and-
-//   replay" code path for sessions from newer protocol versions. A
-//   future 0.3.0 could replay an older session with an invisible warning
-//   and produce flattened output that silently differs from what our
-//   plugin captured originally — see PR #49 (cf2227e) and PR #22
-//   (2004aed) in the 0.2.0 changeset. The alpha.5 hotfix exists because
-//   *this exact failure mode already happened once* (kimi-code 0.2.0
-//   moved the session resume hint from stderr to a stream-json meta
-//   record, and our plugin captured nothing until we noticed).
-//
-//   The defensible posture has two consumers: setup probes the installed
-//   command and warns outside the tested range; model jobs probe the exact
-//   command + prefix tuple to build a fail-closed execution plan before spawn.
-//   The latter is the durable engine-provenance gate: an operation outside its
-//   certified engine/version range is refused rather than guessed.
-//
-//   This is belt-and-suspenders for the alpha.4 `warnIfSessionIdMissing`
-//   surface: that warning fires when capture demonstrably fails on a
-//   completed job; this one fires before any job runs, on the theory
-//   that "you're running a kimi-code we haven't tested" is worth knowing
-//   even if the first job happens to work.
+// Setup probes the installed command and warns outside the tested range;
+// model jobs probe the exact command + prefix tuple to build a fail-closed
+// execution plan before spawn. The latter is the durable engine-provenance
+// gate: an operation outside its certified engine/version range is refused
+// rather than guessed.
 //
 // What this module is NOT:
 //
 //   - Not, by itself, the policy decision. setup still warns; the execution-
 //     plan layer (`kimi-engine.ts`) decides whether an exact result is certified.
-//   - Not a substitute for upstream compatibility testing. The right
-//     long-term answer is for kimi-code to advertise wire-protocol
-//     compatibility via a stable feature flag or version field in its
-//     stream-json output. Until upstream lands that, this is the best
-//     signal we can give users.
 //   - Not a license to infer historical versions. Old job rows remain unknown
 //     unless their saved logs contain positive evidence.
 import { spawn } from "node:child_process";
-/** Maximum time to wait for `kimi --version` to print and exit. */
 const KIMI_VERSION_PROBE_TIMEOUT_MS = 5_000;
 /**
- * The range of kimi-code package versions kimi-plugin-cc has been
- * actively tested against. Bump these when a new kimi-code release is
- * verified to work end-to-end (production smoke + full test suite).
+ * Legacy-v1 kimi-code minors tested for plugin use. Membership is by
+ * `{major, minor}`; every patch within a listed minor is accepted.
  *
- * Versions are matched as `<major>.<minor>` pairs — patch versions are
- * always accepted within a known minor. A version of `0.2.5` is
- * considered tested if `{0, 2}` is in this set.
- *
- * Why store as `{major, minor}` and not a semver range string: avoids a
- * semver parser dependency for a one-off comparison, and the range
- * shape is naturally tied to kimi-code's own release cadence (0.x
- * pre-1.0, minor bumps for behavioral change).
+ * This table intentionally never gains 0.42, which removed legacy v1.
+ * Exact per-operation native-v2 certification lives in `kimi-engine.ts`.
  */
 export const KIMI_TESTED_MINORS = [
     { major: 0, minor: 1 },
     { major: 0, minor: 2 },
-    // 0.3 and 0.4 added in v1.0.1 (2026-05-27) after the 4-reviewer audit
-    // verified compat through @moonshot-ai/kimi-code@0.4.0. See
-    // docs/upstream-compat-audit.md for the playbook and
-    // .claude/kimi-code-research/reports/31-35-* for the audit reports.
-    // Tag: compat-verified-kimi-code-0.4.0 on commit b67263c.
     { major: 0, minor: 3 },
     { major: 0, minor: 4 },
-    // 0.5 added in v1.0.2 (2026-05-28) after a same-day 4-reviewer audit
-    // verified compat through @moonshot-ai/kimi-code@0.5.0. The hook
-    // engine moved path (agent/hooks/ → session/hooks/) but is
-    // byte-identical; run-prompt.ts and rpc/events.ts are byte-identical;
-    // the new --auto CLI flag is rejected when combined with -p. See
-    // .claude/kimi-code-research/reports/36-40-* for the audit reports.
-    // Tag: compat-verified-kimi-code-0.5.0.
     { major: 0, minor: 5 },
-    // 0.6 added in v1.0.4 (2026-05-31) after a 4-reviewer audit verified
-    // compat through @moonshot-ai/kimi-code@0.6.0, backed by a GREEN
-    // real-binary smoke (`bun run smoke:real`) against the installed 0.6.0
-    // binary — "tested" is earned end-to-end, not source-reading-only. The
-    // hook engine (session/hooks/), policy queue order (policies/index.ts),
-    // and CLI argv (options.ts/commands.ts) are byte-identical; the
-    // stream-json resume-hint writer is byte-identical. The +17-line
-    // run-prompt.ts change is a resume-session workDir guard that runs
-    // before permission forcing and cannot fire for the plugin (we always
-    // resume from the originating cwd). The permission/index.ts
-    // `rpc?.requestApproval` refactor is dead code in -p mode (shadowed by
-    // auto-mode-approve at index 4; the hook policy is index 0;
-    // requestApproval is always present). See
-    // .claude/kimi-code-research/reports/47-51-* for the
-    // audit reports. Tag: compat-verified-kimi-code-0.6.0.
     { major: 0, minor: 6 },
-    // 0.7 / 0.8 / 0.9 added in v1.0.5 (2026-06-03) after a 4-reviewer audit
-    // + an independent cross-model (codex) adversarial pass certified compat
-    // through @moonshot-ai/kimi-code@0.9.0, backed by a GREEN real-binary
-    // smoke (`bun run smoke:real`) against BOTH the installed 0.8.0 binary
-    // and a temp-installed 0.9.0 binary (KIMI_PLUGIN_CC_KIMI_BIN override) —
-    // "tested" is earned end-to-end on 0.9.0, not source-reading-only. This
-    // was a 3-minor catch-up (61 commits). The safety chain is intact:
-    // PreToolCallHookPermissionPolicy is still index 0 (auto-approve index 4);
-    // the hook engine (session/hooks/engine.ts, runner.ts) and the
-    // policy/stream-json writers are byte-identical 0.6.0→0.9.0. The notable
-    // 0.7–0.9 additions are all compat-benign for a `kimi -p` wrapper:
-    //   - Permission approval hooks (PermissionRequest/PermissionResult, #336)
-    //     are fire-and-forget OBSERVABILITY (fireAndForgetTrigger + void) that
-    //     fire only in the rpc.requestApproval/ask branch — dead in -p auto
-    //     mode (shadowed by auto-mode-approve), cannot deny.
-    //   - Headless goal mode (kimi -p "/goal ...", #270) is double-gated:
-    //     experimental flag goal-command (default false, env
-    //     KIMI_CODE_EXPERIMENTAL_GOAL_COMMAND) AND a /goal-prefixed prompt.
-    //     The plugin's read-only and rescue commands set no
-    //     KIMI_CODE_EXPERIMENTAL_* env and never send /goal. (The v1.1
-    //     /kimi:pursue command intentionally opts into goal-command per-job
-    //     and sends /goal, but every tool call still passes the index-0
-    //     PreToolUse hook on every continuation turn — see docs/safety.md.)
-    //   - The new deny-all policy is unshift-ed only onto SUBAGENT policy
-    //     stacks (a deny, more restrictive) — never the main -p agent.
-    //   - New default-approved goal tools (GetGoal/SetGoalBudget/UpdateGoal)
-    //     have no fs/git/config side effects; the plugin enforces read-only by
-    //     allow-list (deny-by-default), so new upstream tools cannot slip
-    //     through. CreateGoal is NOT auto-approved.
-    //   - Background auto-upgrade (#334, default on) does not swap the binary
-    //     for the plugin's own -p spawns (source forced 'unsupported'); the
-    //     out-of-band drift it introduces is exactly what this probe catches.
-    // See .claude/kimi-code-research/reports/52-60 for the audit reports.
-    // Tag: compat-verified-kimi-code-0.9.0.
     { major: 0, minor: 7 },
     { major: 0, minor: 8 },
     { major: 0, minor: 9 },
-    // 0.10 / 0.11 / 0.12 added in v1.1.1 (2026-06-09) after a 4-reviewer audit
-    // (+ adversarial pass) certified compat through @moonshot-ai/kimi-code@0.12.0,
-    // backed by a GREEN real-binary smoke against the installed 0.12.0 binary
-    // (review/challenge/ask/review_gate all hook-denied; the pursue goal-mode
-    // safety smoke wrote zero files across a full budget). The safety chain is
-    // intact: PreToolCallHookPermissionPolicy is still index 0 (auto-approve
-    // index 4); the hook engine (session/hooks/{engine,runner,types}.ts) and the
-    // stream-json writer are byte-identical 0.9.0→0.12.0 (03-hooks.diff is 0 bytes
-    // across all five tags). Notable 0.10–0.12 changes, all compat-benign for a
-    // `kimi -p` wrapper:
-    //   - Goal-mode experimental gate REMOVED in 0.12.0 (#569, commit d7407b0):
-    //     headless goal mode now triggers on the `/^\/goal(\s|$)/` prompt prefix
-    //     ALONE — the KIMI_CODE_EXPERIMENTAL_GOAL_COMMAND env gate is gone (still
-    //     present 0.9.0–0.11.0). This WEAKENS the old "double-gated" claim to a
-    //     single gate, but the plugin never relied on the env gate: read-only
-    //     commands hard-prefix an English instruction line so their trimmed
-    //     prompt never starts with `/goal` (cannot enter goal mode), and the
-    //     index-0 hook denies every write regardless. /kimi:pursue still sets the
-    //     env var per-spawn — now redundant on 0.12 but harmless (unknown
-    //     experimental flag ids resolve to undefined) and still required on
-    //     0.8–0.11.
-    //   - AgentSwarm tool + swarm mode (#424): the new swarm-approve policy sits
-    //     at index ~14 (below hook(0)/auto-approve(4)), is approve-only and
-    //     double-guarded, and swarmMode.enter() runs INSIDE the tool's execute()
-    //     (after the index-0 hook already gated the AgentSwarm call). Swarm
-    //     subagents use the STANDARD permission stack (hook at index 0, NO
-    //     deny-all): the lone DenyAllPermissionPolicy.unshift in subagent-host.ts
-    //     is inside startBtw() (the side-question/"btw" path), NOT the swarm spawn
-    //     path (re-verified against the 0.18.0 checkout 2026-06-20 during the v1.4
-    //     write-swarm build — earlier notes here mis-cited it as "inherit
-    //     deny-all"). So a `coder` swarm subagent's write IS gated solely by our
-    //     index-0 hook — which is exactly what makes /kimi:swarm --write possible.
-    //   - New `doctor` subcommand + a `program.argument('[args...]')` unknown-
-    //     positional error: both unreachable — the plugin passes the prompt as
-    //     the VALUE of `-p, --prompt`, never a bare positional.
-    // See .claude/kimi-code-research/reports/61-65 for the audit reports.
-    // Tag: compat-verified-kimi-code-0.12.0.
     { major: 0, minor: 10 },
     { major: 0, minor: 11 },
     { major: 0, minor: 12 },
-    // 0.13 / 0.14 added in v1.2.3 (2026-06-12) after a 4-reviewer audit
-    // (+ adversarial pass) certified compat through @moonshot-ai/kimi-code@0.14.1,
-    // backed by a GREEN real-binary smoke against the installed 0.14.1 binary
-    // (review/challenge/ask/review_gate all hook-denied; pursue goal-mode wrote
-    // zero files across a multi-turn budget; the swarm smoke confirmed a spawned
-    // swarm subagent's forced write is hook-denied). The safety chain is intact:
-    //   - The hook engine (session/hooks/{engine,runner}.ts) and the
-    //     pre-tool-call-hook.ts policy are byte-identical 0.12.0→0.14.1; the only
-    //     change under session/hooks/ is an additive `Interrupt` event type
-    //     (types.ts), inert for a PreToolUse-only consumer.
-    //   - The stream-json writer (writeResumeHint/PromptJsonWriter) and the
-    //     records/ dir are byte-identical; the goal.summary shape is unchanged
-    //     (smoke parsed turnsUsed/tokensUsed/goalId cleanly on 0.14.1).
-    //   - CLI argv (options.ts/commands.ts) is byte-identical 0.12.0→0.14.1.
-    // PreToolCallHookPermissionPolicy is STILL index 0. Two permission-stack
-    // changes, both compat-benign:
-    //   - NEW AgentSwarmExclusiveDenyPermissionPolicy at index 1 (#643):
-    //     a pure DENY that fires only on multi/mixed-AgentSwarm batches
-    //     ("first non-undefined wins" → it can never pre-empt the index-0 hook).
-    //     It enforces "one AgentSwarm per response, alone in its batch" — a
-    //     behavioral refinement for /kimi:swarm coordinators, not a write surface.
-    //   - REMOVED CwdOutsideFileWriteAskPermissionPolicy: this was an `ask`
-    //     policy sitting AFTER auto-mode-approve, so it was already dead in `-p`
-    //     auto mode. Its removal opens zero new write surface — the plugin owns
-    //     workspace confinement via rescue-approval.ts, never kimi's cwd-ask.
-    //   NB: the new index-1 deny shifts AutoModeApprovePermissionPolicy from
-    //   index 4 (its position 0.6.0–0.12.0) to index 5 in 0.14.1. The STRUCTURAL
-    //   invariant is unchanged — every policy between the index-0 hook and the
-    //   first approve is a DENY, so nothing approves before the hook denies.
-    // Other 0.13/0.14 additions are off our `-p` path: a new packages/protocol/
-    // REST+WebSocket control API (a separate transport — run-prompt.ts does not
-    // import it; `-p` stdout stays the direct PromptJsonWriter), session-lifecycle
-    // changes that only HELP our cancellation story (active-turn cancel on close +
-    // BACKGROUND_KEEP_ALIVE_ON_EXIT default flipped true→false), an `alwaysThinking`
-    // model-capability flag (the H5 env request ships in plugin 2.2.1,
-    // but always-thinking models need not honour it), a SIGHUP cleanup handler (exit 129; SIGTERM still
-    // exits 143 and runs cleanup — our SIGTERM→SIGKILL reaping is unaffected), and
-    // a new builtin `import-from-cc-codex` skill (not a plugin surface).
-    // See .claude/kimi-code-research/reports/72-76 for the audit reports.
-    // Tag: compat-verified-kimi-code-0.14.1.
     { major: 0, minor: 13 },
     { major: 0, minor: 14 },
-    // 0.14.2 (patch, 2026-06-13) verified COMPAT-PRESERVED within the already-
-    // listed {0,14} — no array change needed (membership is minor-level).
-    // The 0.14.1→0.14.2 diff leaves our surfaces 0-byte: the permission policy
-    // queue (PreToolCallHookPermissionPolicy still index 0), the hook engine
-    // (session/hooks/), and the stream-json writer + records/ are all unchanged,
-    // and the AgentSwarm tool name is unchanged. The patch is a repo-wide
-    // `.md`→`.md?raw` bundler-import migration + a Bash-tool stdout/stderr
-    // streaming `onUpdate` callback (observability; approval path untouched) + a
-    // run-prompt.ts config-diagnostics line written to STDERR (humans-only) +
-    // removal of three `!promptMode`-gated CLI conflict checks (dead in `-p`).
-    // Backed by a GREEN `bun run smoke:real` on the operator's auto-upgraded
-    // 0.14.2 binary (review/challenge/ask/review_gate hook-denied; pursue
-    // goal-mode wrote zero files; swarm subagent write hook-denied).
-    // Tag: compat-verified-kimi-code-0.14.2.
-    // 0.14.3 (patch, 2026-06-14) verified COMPAT-PRESERVED within the already-
-    // listed {0,14} — no array change needed. All four scoped diffs
-    // (@moonshot-ai/kimi-code@0.14.2..0.14.3) are 0-byte: run-prompt.ts +
-    // options.ts/commands.ts, the permission policy queue
-    // (PreToolCallHookPermissionPolicy still index 0), the hook engine, and
-    // records/ + session/. The entire patch is one TUI change — PR #713,
-    // "Refresh provider model metadata before opening the model picker": the
-    // interactive `/model` slash command (tui/commands/config.ts +
-    // dispatch.ts) now calls a new `refreshOAuthProviderModels()` (a scoped
-    // 'oauth' variant added to tui/controllers/auth-flow.ts +
-    // tui/utils/refresh-providers.ts) with a 2s timeout before opening the
-    // picker. None of it is on the `-p` headless path (refreshAllProviderModels
-    // is invoked only from the TUI auth-flow controller; the sole reference
-    // outside tui/ is a JSDoc mention in cli/sub/provider.ts, the `kimi
-    // provider` subcommand we never invoke, which doesn't call it; the new
-    // `scope` param is optional, defaulting to 'all'). Backed by a GREEN `bun run
-    // smoke:real` on the operator's 0.14.3 binary (7 pass / 0 fail;
-    // review/challenge/ask/review_gate hook-denied; pursue goal-mode wrote
-    // zero files; swarm subagent write hook-denied).
-    // Tag: compat-verified-kimi-code-0.14.3.
-    // 0.15 (new minor, 2026-06-16) verified COMPAT-PRESERVED — added to the
-    // tested set because crossing the 0.14→0.15 minor boundary fired the H9
-    // "newer than tested max" probe warning (the operator's binary auto-upgraded
-    // to 0.15.0 out-of-band, PR #334 drift). All four scoped diffs
-    // (@moonshot-ai/kimi-code@0.14.3..0.15.0) leave our load-bearing surfaces
-    // 0-byte, re-confirmed independently by `git diff` byte-count (not just
-    // report 78): permission/ (PreToolCallHookPermissionPolicy STILL index 0,
-    // AgentSwarmExclusiveDenyPermissionPolicy still index 1), the hook engine
-    // (agent + session hooks/), run-prompt.ts, and cli commands.ts/options.ts.
-    // The only changed scoped surface is records/ + session/ (~5.3 KB), all
-    // internal persistence/plumbing off the -p path: PR #786 drops
-    // app_version/resumed from the persisted .records/ metadata artifact (NOT
-    // the -p stdout stream — that writer is the byte-identical PromptJsonWriter),
-    // a SessionSkillRegistry rename (#784), and a static model-capability lookup
-    // (#776). 0.15.0 also adds an ADDITIVE `transport:'sse'` MCP config variant
-    // (config/schema.ts) the plugin never writes, plus TUI/system-prompt churn.
-    // Backed by a GREEN `bun run smoke:real` on the operator's 0.15.0 binary
-    // (report 78: 7 pass / 0 fail; review/challenge/ask/review_gate hook-denied;
-    // pursue goal-mode wrote zero files, goal.summary parsed cleanly
-    // turnsUsed:2 tokensUsed:51199; swarm subagent write hook-denied).
-    // See .claude/kimi-code-research/reports/78-upstream-0150-surface.md.
-    // Tag: compat-verified-kimi-code-0.15.0.
     { major: 0, minor: 15 },
-    // 0.16 (new minor, 2026-06-17) verified COMPAT-PRESERVED — the operator's
-    // binary auto-upgraded 0.15.0→0.16.0 within a day (PR #334 drift), re-firing
-    // the H9 "newer than tested max" probe warning. permission/, the hook engine
-    // (agent + session hooks/), and run-prompt.ts are 0-byte vs 0.15.0
-    // (independent `git diff` byte-count). The only CLI argv change registers a
-    // new `kimi vis` subcommand (a visualization server) — off the -p path; our
-    // -p/-r/--output-format/-m/--skills-dir flags are untouched. The records/ +
-    // session/ + replay/ + agent/ changes (a compaction refactor, a new
-    // llm-request-logger, replay-build additions) are internal and off the -p
-    // stdout stream our parser reads. Backed by a GREEN `bun run smoke:real` on
-    // the operator's 0.16.0 binary (7 pass / 0 fail; review/challenge/ask/
-    // review_gate hook-denied; pursue goal-mode wrote zero files, goal.summary
-    // parsed cleanly turnsUsed:2 tokensUsed:52211; swarm subagent write denied).
-    // Tag: compat-verified-kimi-code-0.16.0.
     { major: 0, minor: 16 },
-    // 0.17 / 0.18 added in v1.2.6 (2026-06-19) — the 0.16.0→0.18.0 jump
-    // (0.17.0/0.17.1/0.18.0) verified COMPAT-PRESERVED by a reproduced
-    // source-level audit. The operator's binary auto-upgraded past the tested
-    // 0.16 max (PR #334 drift), firing the H9 "newer than tested max" probe
-    // warning. The safety chain is intact:
-    //   - 03-hooks.diff is 0 bytes (BOTH agent/hooks/ AND session/hooks/) and
-    //     pre-tool-call-hook.ts is 0-byte 0.16.0→0.18.0 — the hook engine and the
-    //     policy that wires our PreToolUse hook in are byte-identical.
-    //   - PreToolCallHookPermissionPolicy is STILL index 0,
-    //     AgentSwarmExclusiveDenyPermissionPolicy still index 1, and
-    //     AutoModeApprovePermissionPolicy still index 5 (the first approve; every
-    //     policy between the index-0 hook and it is a DENY). The ONLY permission
-    //     change is a NEW GoalStartReviewAskPermissionPolicy (#839, "guided goal
-    //     authoring") inserted at index ~10 (AFTER auto-mode-approve): an `ask`
-    //     gated to a MODEL-ISSUED CreateGoal in NON-auto mode (it returns early
-    //     when permission.mode === 'auto'), so it is triple-dead on the `-p` auto
-    //     path and is an `ask` that cannot approve a write. It does not affect
-    //     /kimi:pursue, which uses the /goal COMMAND path, runs auto, and is
-    //     governed by the index-0 hook on every turn.
-    //   - options.ts is BYTE-IDENTICAL (argv intact: -p/-r/--output-format/-m/
-    //     --skills-dir; --auto/--yolo/--plan still rejected with -p). run-prompt.ts
-    //     changes ONLY in a telemetry refactor (the `started` event moved into
-    //     harness `sessionStartedProperties`); the permission-forcing chain
-    //     (permission:'auto', forcePromptPermission, installHeadlessHandlers) and
-    //     the stream-json writer (PromptJsonWriter/resume_hint/goal.summary) are
-    //     unchanged.
-    // Off-path additions (all benign for a `kimi -p` wrapper):
-    //   - A new `kimi server`/`kimi web` subcommand stack (#625, "Kimi web app +
-    //     daemon gateway") — like `vis`/`doctor`, never invoked; the plugin passes
-    //     the prompt as the VALUE of `-p`, never a bare positional.
-    //   - Session ARCHIVE (#625): an `archived` flag + archive()/includeArchive in
-    //     the session store + rpc core-api (the surface the Kimi web UI lists/
-    //     archives sessions through). The plugin owns its OWN SQLite job store and
-    //     never reads kimi's session list — off our path.
-    //   - OAuth-error fidelity (provider-manager throws the original error instead
-    //     of re-wrapping every failure as loginRequired) — off the -p stdout shape;
-    //     an expired token still surfaces as auth.login_required (the smoke's
-    //     operator-auth false-alarm note in docs/upstream-compat-audit.md holds).
-    //   - git-context process disposal + a turn-counter restore fix
-    //     (records/index.ts, the record-RESTORE path) — both off the -p stdout
-    //     stream our parser reads.
-    //   - NEW in 0.18.0: KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY (#888) — an opt-in
-    //     HARD cap on concurrent AgentSwarm subagents. /kimi:swarm now sets it from
-    //     --cap (v1.2.6); older binaries ignore the unknown env var.
-    // SMOKE: the 0.16.0→0.18.0 source audit was prepared in a cloud session with
-    // no kimi binary, so its Phase 1b smoke was deferred. It was then run locally
-    // against the operator's installed 0.18.0 binary before merge — GREEN, 7 pass
-    // / 0 fail: review/challenge/ask/review_gate forced writes hook-denied; pursue
-    // multi-turn goal wrote zero files (`goal.summary` parsed cleanly turnsUsed:2);
-    // a spawned swarm subagent's forced write hook-denied. Six-reviewer + adversarial
-    // re-verification all returned CONFIRMED-SAFE (the new --cap → env wiring round-
-    // trips safely across 19 edge inputs; identical positive-integer validator).
-    // Tag: compat-verified-kimi-code-0.18.0.
     { major: 0, minor: 17 },
     { major: 0, minor: 18 },
-    // 0.19 (new minor, 2026-06-23) verified COMPAT-PRESERVED — added to the
-    // tested set in v1.5.1 because crossing the 0.18→0.19 minor fired the H9
-    // "newer than tested max" probe warning (the operator's binary auto-upgraded
-    // 0.18.0→0.19.1 out-of-band, PR #334 drift). Backed by a GREEN
-    // `bun run smoke:real` on the operator's 0.19.1 binary (9 pass / 0 fail):
-    // review/challenge/ask/review_gate forced writes hook-denied; pursue
-    // multi-turn goal wrote zero files (`goal.summary` parsed cleanly
-    // turnsUsed:2 tokensUsed:73631); a spawned read-only swarm subagent's forced
-    // write hook-denied; and BOTH write-swarm assertions held on 0.19.1 — a
-    // `coder` subagent's edits landed only in the throwaway worktree
-    // (patchBytes=306, userTreeClean=true) and an out-of-trusted-root absolute
-    // write was hook-denied. The safety chain is intact:
-    //   - 03-hooks.diff is 0 bytes (BOTH agent/hooks/ AND session/hooks/) —
-    //     the hook engine is byte-identical 0.18.0→0.19.1.
-    //   - The permission policy queue (policies/index.ts) is BYTE-IDENTICAL:
-    //     PreToolCallHookPermissionPolicy STILL index 0,
-    //     AgentSwarmExclusiveDenyPermissionPolicy index 1,
-    //     AutoModeApprovePermissionPolicy index 5 (first approve; every policy
-    //     between the index-0 hook and it is a DENY). `permission:'auto'` is
-    //     still hard-coded in run-prompt.ts createSession.
-    // The minor that bumped 0.18→0.19.0 is #812 "workspace add-dir support"
-    // (commit c0eeca2): a new repeatable --add-dir <dir> flag, additionalDirs
-    // plumbed through Session, and GitCwdWriteApprovePermissionPolicy widened to
-    // approve writes within cwd OR any additional dir. Compat-benign for the
-    // plugin — but NOT because additionalDirs is empty (see the CORRECTION
-    // below). The real reasons:
-    //   - GitCwdWriteApprovePermissionPolicy is the ONLY permission consumer of
-    //     additionalDirs (git-cwd-write-approve.ts:26 is the sole
-    //     getAdditionalDirs() call in agent/permission/), and it sits at index 17
-    //     — the last approve before FallbackAsk (the tail at index 18), BELOW
-    //     AutoModeApprovePermissionPolicy (index 5). On the `-p` auto path
-    //     auto-approve decides first for anything the index-0 hook did not deny,
-    //     so GitCwdWriteApprove is STRUCTURALLY UNREACHABLE → its add-dir
-    //     widening is dead for us regardless of what additionalDirs contains.
-    //   - Read-only commands: the index-0 hook denies every write before any
-    //     approve policy runs. Write commands (rescue/pursue/swarm-write): the
-    //     index-0 hook confines to a SINGLE root via rescue-approval.ts, which
-    //     never reads additionalDirs — the upstream widening cannot leak into our
-    //     allowlist. The 0.19.1 smoke proves it empirically (write-swarm
-    //     userTreeClean=true; an out-of-trusted-root write hook-denied).
-    //   - isWithinWorkspace with additionalDirs=[] is byte-for-byte the old
-    //     isWithinDirectory(cwd) (path-access.ts:159-163 checks workspaceDir then
-    //     loops the list), so even in the non-`-p` modes where GitCwdWriteApprove
-    //     DOES run, the empty-list case is unchanged.
-    // CORRECTION to an earlier mental model: additionalDirs is NOT guaranteed
-    // empty for a plugin `-p` spawn even with no --add-dir. #812 also wired an
-    // UNCONDITIONAL read of the project-local <root>/.kimi-code/local.toml
-    // `[workspace] additional_dir` into BOTH the -p create AND resume bootstraps
-    // (rpc/core-impl.ts:238 createSessionWithOverrides + :363
-    // resumeSessionWithOverrides, via config/workspace-local.ts; both ABSENT at
-    // 0.18.0). So getAdditionalDirs() can be non-empty whenever such a file
-    // exists in the repo — but per the reasons above that changes no approve/deny
-    // decision on our path. (Swarm `coder` subagents inherit the coordinator's
-    // additionalDirs; the same index-0 hook gating applies.)
-    // Other 0.18.0→0.19.1 changes are off the `-p` path: #963 (commit 4292ae9)
-    // adds a new `turn.ended` terminal `reason:'filtered'` (provider content
-    // filter) surfaced as a human string — a new failure REASON, not a new
-    // stdout record SHAPE, so the role-keyed stream-json parser is unaffected;
-    // #821 (detach-to-background) was already triaged in the forward-scans; and
-    // 0.19.1 over 0.19.0 is ci/ACP/kimi-web-UI only (0-byte load-bearing diff —
-    // its #992 `fix(acp)` only re-routes the workspace-local read's kaos handle).
-    // NEXT-AUDIT NOTE: the workspace-local additional_dir auto-load is LIVE on
-    // the -p path NOW (shipped 0.19.0/#812, not a future risk). It stays
-    // hook-bound for us, but the "plugin never passes --add-dir ⟹ additionalDirs
-    // empty" assumption is broken upstream — re-confirm each audit that the
-    // index-0 hook still pre-empts GitCwdWriteApprove, and consider a defensive
-    // assert/scrub if a future minor lets additionalDirs reach a policy ABOVE our
-    // hook. See .claude/kimi-code-research/reports/85-upstream-0191-surface.md.
-    // Tag: compat-verified-kimi-code-0.19.1.
     { major: 0, minor: 19 },
-    // 0.20 (new minor, 2026-06-26) verified COMPAT-PRESERVED — the operator's
-    // binary auto-upgraded 0.19.2→0.20.0 (PR #334 drift), crossing the 0.19→0.20
-    // minor and firing the H9 "newer than tested max" probe warning. (npm went
-    // straight 0.19.2→0.20.0; no 0.19.3. 0.19.1→0.19.2 was already 0-byte on all
-    // load-bearing surfaces — report 86 — so the 0.19.1..0.20.0 diff below loses
-    // no signal.) The safety chain is intact, re-verified by `git diff … | wc -c`:
-    //   - 02-permission.diff is 0 bytes AND 03-hooks.diff is 0 bytes (BOTH
-    //     agent/hooks/ AND session/hooks/) — the permission policy queue and the
-    //     hook engine are byte-identical 0.19.1→0.20.0.
-    //   - policies/index.ts, pre-tool-call-hook.ts, run-prompt.ts, options.ts, and
-    //     agent/records/ are ALL 0-byte. PreToolCallHookPermissionPolicy STILL
-    //     index 0, AgentSwarmExclusiveDeny index 1, AutoModeApprove index 5 (the
-    //     first approve; every policy between the index-0 hook and it is a DENY).
-    //     `permission:'auto'` still hard-coded in run-prompt.ts.
-    //   - A broad-sweep risk scan over EVERY file changed OUTSIDE the five scoped
-    //     diffs found ZERO new permission/approval decisions anywhere outside the
-    //     (0-byte) permission+hooks dirs, and no swarm-subagent spawn/permission
-    //     change — so read/write-swarm `coder` subagents are still gated solely by
-    //     the index-0 hook.
-    // Notable 0.20.0 changes, all compat-benign for a `kimi -p` wrapper:
-    //   - #1040 AGENTS.md-oversized `warning` agent event: SWALLOWED on -p
-    //     (run-prompt.ts:495 `case 'warning': return;` — no stdout.write, shared
-    //     with subagent.*/compaction.*/goal.updated). Invisible to our role-keyed
-    //     runtime/stream-json.ts parser; reaches only the RPC getSessionWarnings
-    //     accessor (TUI/kimi-web) + the logger.
-    //   - #1065 Write auto-creates missing parent dirs (ensureParentDirectory
-    //     recursive mkdir on ENOENT). The `path` field name is INTACT
-    //     (WriteInputSchema = z.object({ path, content }); Bash still `command`),
-    //     so rescue-approval.ts::extractFilePath is unaffected (the v1.4.1 lesson).
-    //     mkdir runs on the parent of an ALREADY-hook-approved path → can only
-    //     create dirs INSIDE a path the index-0 hook approved; no workspace escape.
-    //   - #1062 tool-result budget: adds a `truncated` flag to tool-result CONTENT
-    //     (loop/tool-call.ts normalizeToolResult), NOT the serialized record SHAPE
-    //     (records/ + run-prompt.ts 0-byte). It ALSO persists tool results >50,000
-    //     chars to `<agent.homedir>/tool-results/<stem>-<uuid>.txt`
-    //     (agent/turn/tool-result-budget.ts, homedir = this.agent.homedir = the
-    //     KIMI home, NOT the workspace cwd) — a kimi-internal artifact off the
-    //     user's tree, same class as ~/.kimi-code/logs/. Does NOT touch the user
-    //     tree → no violation of "read-only commands write zero files in the repo".
-    //   - commands.ts `-C`→`-c` continue rename (+ hidden `-C` alias): off our flag
-    //     set (-p/-r/--output-format/-m/--skills-dir); run-prompt.ts/options.ts 0-byte.
-    //   - NEW RPC runShellCommand/cancelShellCommand (CoreAPI/SessionAPI): a
-    //     HOST-initiated shell exec (TUI `!command` / kimi-web) that calls
-    //     bash.resolveExecution().execute() DIRECTLY, bypassing the permission
-    //     stack + PreToolUse hook. NOT model-reachable: it is not a model tool
-    //     (absent from the tool registry) and absent from installHeadlessHandlers /
-    //     the whole apps/kimi-code/src/cli/ -p path. The plugin spawns `kimi -p`
-    //     and never opens an RPC channel → unreachable. WATCH (next audit):
-    //     re-confirm it stays RPC/TUI-only and never reaches the -p headless path
-    //     or the model tool registry — it is the first permission-bypassing
-    //     shell-exec in agent-core.
-    //   - forcePluginSessionStartReminder resume override (rpc/core-impl.ts): set
-    //     ONLY via reloadSession (the /reload RPC flow). The plugin's -p -r resume
-    //     uses plain harness.resumeSession → never set; appendPluginSessionStart
-    //     Reminder cannot fire on our path. config/ is 0-byte (the 0.19.0/#812
-    //     workspace-local additional_dir auto-load is unchanged; GitCwdWriteApprove,
-    //     its sole consumer at index 17, stays dead below auto-approve on -p).
-    //   - kimi server/web daemon stack (cli/sub/server/* — access-urls, networks,
-    //     rotate-token, daemon lifecycle): a separate transport, never invoked; the
-    //     new stdout.writes there are off the -p path.
-    // SMOKE: NOT run for this certification. `bun run smoke:real` against the
-    // operator's 0.20.0 binary went RED on a provider 403 "usage limit for this
-    // billing cycle" — records:[] on every label, the model never issued a single
-    // tool call (0 hook-bypasses observed). This is the operator-billing-state
-    // false-alarm class (cf. the auth.login_required note in
-    // docs/upstream-compat-audit.md), NOT a compat break — a true break shows the
-    // model ATTEMPTING a write and the hook NOT denying. The operator elected to
-    // certify on the source audit (manual byte-level + multi-agent re-audit) and
-    // skip the quota-blocked smoke; re-run `bun run smoke:real` once quota refreshes
-    // to earn the end-to-end proof. See
-    // .claude/kimi-code-research/reports/88-upstream-0200-surface.md.
-    // Tag: compat-verified-kimi-code-0.20.0.
-    // 0.20.1 / 0.20.2 (patches, 2026-06-27 / 2026-06-29) verified COMPAT-PRESERVED
-    // within the already-listed {0,20} — no array change (membership is minor-level;
-    // H9 stays silent). 02-permission.diff 0-byte (PreToolCallHookPermissionPolicy
-    // still index 0, AutoModeApprove index 5); agent/records/ 0-byte (stream-json
-    // shape unchanged); run-prompt.ts permission/writer chain unchanged (only
-    // telemetry property renames, #1184). The hook engine DID change — #1127 "support
-    // hooks in plugins" (0.20.1): rpc/core-impl.ts create+resume now merge enabled
-    // kimi-code PLUGIN manifest hooks into the -p session hook list ([...config.hooks,
-    // ...plugins.enabledHooks()]). Compat-benign: engine aggregation is any-block-wins
-    // (session/hooks/engine.ts blockDecision = first action:'block' wins; an allow
-    // never pre-empts a block), so a plugin hook can only ADD denials, never override
-    // our managed PreToolUse deny. Our config.toml managed block is unaffected: the
-    // config HookDefSchema is .strict(), so the new per-hook cwd/env fields are
-    // programmatic/plugin-only (no config-injection vector). NEW load-bearing
-    // invariant: hook AGGREGATION semantics (we are no longer the sole -p hook) —
-    // re-verify blockDecision stays find-first-block each audit. Off-path: #1170/#1186
-    // Anthropic-protocol/betaApi transport plumbing (config protocol/betaApi alias
-    // fields + provider-manager; off the -p stdout shape + permission stack), #1125
-    // upgrade->update alias, #1129/#1156 compaction cap, #1128 server --allowed-host.
-    // 0.20.0 runShellCommand/cancelShellCommand RPC WATCH discharged (still RPC/TUI-
-    // only, unreachable from kimi -p). SMOKE: GREEN on 0.20.2 — `bun run smoke:real`
-    // 9 pass / 0 fail (2026-06-29) on the operator's 0.20.2 binary: review/challenge/
-    // ask/review_gate forced writes hook-denied; pursue multi-turn goal wrote zero
-    // files (goal.summary parsed cleanly turnsUsed:2 tokensUsed:85770); a read-only
-    // swarm subagent's forced write hook-denied; and BOTH write-swarm assertions held
-    // (coder edits confined to the throwaway worktree, patchBytes=334,
-    // userTreeClean=true; an out-of-trusted-root absolute write hook-denied). The
-    // earlier report-88 0.20.0 quota block (provider 403 "usage limit") was the
-    // operator-billing-state false alarm, now cleared — the {0,20} line is end-to-end
-    // proven on 0.20.2. Tag: compat-verified-kimi-code-0.20.2.
-    // See .claude/kimi-code-research/reports/89, 90, 91-upstream-020x-surface.md.
     { major: 0, minor: 20 },
-    // 0.21 (new minor, 2026-07-01) verified COMPAT-PRESERVED — the operator's
-    // binary auto-upgraded to 0.21.1 (PR #334 drift), crossing the 0.20→0.21
-    // minor and firing the H9 "newer than tested max" probe warning. Report 93's
-    // source audit found the two load-bearing surfaces byte-identical across the
-    // full 0.20.2→0.21.1 span: 02-permission.diff 0 bytes (hook still index 0,
-    // AutoModeApprove still index 5, every policy between is a DENY) and
-    // 03-hooks.diff 0 bytes (hook engine and any-block-wins aggregation intact).
-    // Also 0-byte: options.ts (argv), agent/records/ (stream-json shape),
-    // workspace-local.ts (additional_dir auto-load unchanged), and
-    // tools/builtin/file/{write,edit}.ts (`path` field intact). run-prompt.ts
-    // still hard-codes permission:'auto' and installHeadlessHandlers; its only
-    // scoped change is a cleanup timeout (#1233) after resume_hint/goal.summary
-    // flush, which helps process reaping.
-    // New 0.21.0 surfaces are compat-benign for a `kimi -p` wrapper:
-    //   - #1204 plugin slash commands are RPC/host-initiated, absent from the
-    //     cli/ -p path, not model tools, and macro-expand into prompt text that
-    //     still goes through the index-0 hook. They are main-agent-only; swarm
-    //     coders do not receive them. NEXT-AUDIT: re-confirm activation stays
-    //     off the -p path and never becomes a model tool.
-    //   - The thinking-effort/model-catalog refactor is provider config plumbing
-    //     the plugin does not set or consume. H5 opportunity, not a risk.
-    //   - Compaction rework and record migrations are internal replay/history
-    //     changes; the live PromptJsonWriter + agent/records/ shape is unchanged.
-    //   - The 0.20.0 runShellCommand/cancelShellCommand RPC WATCH is discharged
-    //     again: still RPC/TUI-only, absent from cli/, and unreachable from kimi -p.
-    // Backed by a GREEN `bun run smoke:real` on the operator's 0.21.1 binary
-    // (2026-07-01): 9 pass / 0 fail. review/challenge/ask/review_gate forced
-    // writes hook-denied; pursue goal mode wrote zero files and parsed
-    // goal.summary (turnsUsed:2 tokensUsed:57595); a read-only swarm subagent's
-    // forced write was hook-denied; write-swarm kept coder edits in the throwaway
-    // worktree (patchBytes=334, userTreeClean=true, worktreeCleaned=true); and an
-    // out-of-trusted-root absolute write was hook-denied. Reports:
-    // .claude/kimi-code-research/reports/93-upstream-021-surface.md and
-    // 93-upstream-021-adversarial.md. Tag: compat-verified-kimi-code-0.21.1.
     { major: 0, minor: 21 },
-    // 0.22 (new minor, 2026-07-05) verified COMPAT-PRESERVED through
-    // @moonshot-ai/kimi-code@0.22.3 after report 94's source-only 0.22.0 scan and
-    // report 95's incremental 0.22.0→0.22.3 scan. Hook engine remained unchanged
-    // (03-hooks.diff 0 bytes); policy order stayed hook-first with
-    // PreToolCallHookPermissionPolicy at index 0 and AutoModeApprove at index 5;
-    // Write/Edit still use `path`, Bash still uses `command`, and AgentSwarm still
-    // uses the standard stack. New 0.22.x surfaces are compat-benign for this
-    // `kimi -p` wrapper: prompt-mode background-drain runs after assistant output
-    // flush and remains bounded by the plugin's AbortController budgets; shell
-    // output caps affect huge tool-result content only; image originals are stored
-    // under Kimi session state, not the user worktree; model/thinking/provider
-    // config changes do not touch permissions; server auth-bypass flags remain
-    // off the `-p` path. Backed by a GREEN `bun run smoke:real` against a
-    // temp-installed 0.22.3 binary (2026-07-05): 9 pass / 0 fail. Read-only labels
-    // denied forced writes; pursue wrote zero files and parsed goal.summary
-    // (turnsUsed:2 tokensUsed:93029); read-only swarm denied a spawned subagent
-    // write; write-swarm confined coder edits to the throwaway worktree
-    // (patchBytes=334, userTreeClean=true, worktreeCleaned=true); and an
-    // out-of-trusted-root absolute write was hook-denied. Reports:
-    // .claude/kimi-code-research/reports/94-upstream-0220-surface.md and
-    // 95-upstream-0223-surface.md. Tag: compat-verified-kimi-code-0.22.3.
     { major: 0, minor: 22 },
-    // 0.23 (new minor, 2026-07-07) verified COMPAT-PRESERVED through
-    // @moonshot-ai/kimi-code@0.23.1 in report 96 plus a GREEN temp-binary
-    // smoke (9 pass / 0 fail). Hook engine remained unchanged (03-hooks.diff
-    // 0 bytes); policy order stayed hook-first with PreToolCallHookPermissionPolicy
-    // at index 0 and AutoModeApprove at index 5; `kimi -p` still writes the same
-    // stream-json records plus session.resume_hint/goal.summary; Write/Edit still
-    // use `path`; plugin hooks remain merged any-block-wins; AgentSwarm read and
-    // write-smoke confinement both held. New 0.23.x surfaces are compat-benign:
-    // `select_tools` is an upstream default-approved MCP schema disclosure tool,
-    // but our hook still denies unknown tools before default approval and the
-    // smoke passed without broadening READ_ONLY_TOOLS; observability wire records,
-    // session workDir/index repair, thinking-keep defaults, and workspace-skill
-    // listing do not change the plugin's hook or stdout contract. Report:
-    // .claude/kimi-code-research/reports/96-upstream-0231-surface.md. Tag:
-    // compat-verified-kimi-code-0.23.1.
-    // 0.23.2 (patch, 2026-07-08) verified COMPAT-PRESERVED within the already-
-    // listed {0,23}: scoped 0.23.1→0.23.2 diffs changed only `run-prompt.ts`
-    // cleanup/exit behavior and `session/hooks/runner.ts` Windows spawn UX.
-    // `02-permission.diff` stayed 0 bytes (hook still index 0; first approve
-    // still index 5), `05-session-bootstrap.diff` stayed 0 bytes, and the
-    // non-empty `04-wire-records.diff` was only the same `session/hooks/runner.ts`
-    // hunk re-included by the broader `session/` scope — no
-    // session.resume_hint/goal.summary/output-shape drift. The 0.23.2
-    // `run-prompt.ts` change (#1483) keeps the cleanup timeout ref'd so a
-    // failed headless `-p` run cannot drain the event loop and exit 0 before the
-    // rejection propagates; this is exit-code correctness, not a permission or
-    // writer change. The hook-runner change (#1466) adds `windowsHide:true` to
-    // hook child-process spawn options, eliminating flashing console windows on
-    // Windows without altering stdin JSON shape, exit-2-as-deny semantics, or
-    // any-block-wins aggregation. Backed by a GREEN temp-binary `bun run
-    // smoke:real` on 0.23.2 (2026-07-08): 9 pass / 0 fail. Read-only labels
-    // denied forced writes; pursue wrote zero files and parsed goal.summary;
-    // read-only swarm denied a spawned subagent write; write-swarm confined
-    // coder edits to the throwaway worktree (patchBytes=306, userTreeClean=true,
-    // worktreeCleaned=true); and an out-of-trusted-root absolute write was
-    // hook-denied. Report:
-    // .claude/kimi-code-research/daily-monitor/2026-07-08-upstream-monitor.md.
-    // Tag: compat-verified-kimi-code-0.23.2.
-    // 0.23.3/0.23.4 (patches, 2026-07-09) verified COMPAT-PRESERVED within the
-    // already-listed {0,23}: scoped 0.23.2→0.23.4 diffs left permission and both
-    // hook trees byte-identical (`02-permission.diff` and `03-hooks.diff` both 0
-    // bytes). Hook ordering remains PreToolCallHookPermissionPolicy index 0 and
-    // AutoModeApprove index 5; aggregation remains any-block-wins; Bash still
-    // uses `command`, Write/Edit still use `path`, and AgentSwarm subagents still
-    // use the standard permission stack. The load-bearing `run-prompt.ts` change
-    // (#1516) makes `kimi -p "/goal ..."` wait across continuation turns until
-    // the goal is terminal instead of resolving after the first completed turn.
-    // `permission:'auto'`, `installHeadlessHandlers`, PromptJsonWriter,
-    // session.resume_hint, and goal.summary shapes remain intact. The non-empty
-    // `04-wire-records.diff` is internal provider-auth/media projection/session
-    // plumbing, not new stdout NDJSON; the non-empty `05-session-bootstrap.diff`
-    // adds owner-scoped `[image]` limits without changing additionalDirs, hook
-    // merging, or permission construction. The 0.23.3 provider-auth patch now
-    // surfaces the upstream 401 reason as PROVIDER_AUTH_ERROR instead of falsely
-    // demanding relogin; it does not affect tool or hook execution. Backed by a
-    // GREEN temp-binary `bun run smoke:real` on exact 0.23.4 (2026-07-09):
-    // 9 pass / 0 fail. Read-only labels denied forced writes; pursue ran to its
-    // two-minute budget across continuation turns with no file written;
-    // read-only swarm denied a spawned subagent write; write-swarm confined coder
-    // edits to the throwaway worktree (patchBytes=278, userTreeClean=true,
-    // worktreeCleaned=true); and an out-of-trusted-root absolute write was
-    // hook-denied. Report:
-    // .claude/kimi-code-research/daily-monitor/2026-07-09-upstream-monitor.md.
-    // Tag: compat-verified-kimi-code-0.23.4.
-    // 0.23.5 (patch, 2026-07-11) verified COMPAT-PRESERVED within the already-
-    // listed {0,23} at released tag commit 352a4492. Permission, both hook trees,
-    // and session bootstrap stayed byte-identical (`02-permission.diff`,
-    // `03-hooks.diff`, and `05-session-bootstrap.diff` all 0 bytes), so hook-first
-    // ordering, any-block-wins aggregation, field names, and create/resume config
-    // loading remain intact. `04-wire-records.diff` only adds the internal
-    // `media-stripped` projection type. The load-bearing change is additive
-    // `PromptJsonWriter` metadata: `role:"meta", type:"turn.step.retrying"` on
-    // provider retry events. v1.8.0 models its exact shape, normalizes it, and
-    // filters it from consumer records while retaining malformed-shape diagnostics.
-    // The post-change exact-0.23.5 `bun run smoke:real` was GREEN (2026-07-11):
-    // 9 pass / 0 fail in 229.56s. Read-only labels denied forced writes; pursue
-    // ran to its full two-minute budget with no file written; read-only swarm
-    // spawned coder subagents whose writes were denied; write-swarm confined edits
-    // to the throwaway worktree (patchBytes=334, userTreeClean=true,
-    // worktreeCleaned=true); and an out-of-trusted-root absolute write was denied.
-    // Report: .claude/kimi-code-research/daily-monitor/2026-07-11-upstream-monitor.md.
-    // Tag: compat-verified-kimi-code-0.23.5.
-    // 0.23.6 (patch, 2026-07-12) verified COMPAT-PRESERVED within the already-
-    // listed {0,23} at released tag commit b5c236d0. Permission and both hook
-    // trees stayed byte-identical (`02-permission.diff` and `03-hooks.diff` were
-    // 0 bytes): hook-first order, any-block-wins aggregation, Bash.command,
-    // Write.path, and Edit.path remain intact. `run-prompt.ts` now keeps `-p`
-    // alive while a goal is active or cron work is pending and optionally across
-    // background-task steering; the plugin does not enable steer mode and its
-    // mandatory AbortController budgets remain the outer bound. Upstream also
-    // makes subagent timeout configurable and raises its default to two hours,
-    // without changing AgentSwarm's standard permission stack; plugin budgets
-    // and hard concurrency caps still bound every swarm run. The provider
-    // capability rename from select_tools to dynamically_loaded_tools is
-    // internal tool-disclosure plumbing, not a permission or stdout-shape change.
-    // Exact-0.23.6 `bun run smoke:real` was GREEN (2026-07-12): 9 pass / 0 fail
-    // in 274.55s. Read-only labels denied forced writes; pursue ran to its full
-    // two-minute budget with no file written; read-only swarm denied a spawned
-    // subagent write; write-swarm stayed confined (patchBytes=306,
-    // userTreeClean=true, worktreeCleaned=true); and an out-of-root absolute
-    // write was hook-denied after a real AgentSwarm dispatch. Report:
-    // .claude/kimi-code-research/daily-monitor/2026-07-12-upstream-monitor.md.
-    // Tag: compat-verified-kimi-code-0.23.6.
     { major: 0, minor: 23 },
-    // 0.24.2 (minor, 2026-07-15) verified COMPAT-PRESERVED across the cumulative
-    // 0.23.6→0.24.2 release delta. The default v1 permission and live
-    // session/hooks surfaces are 0-byte diffs: PreToolCallHook remains index 0,
-    // AutoModeApprove remains the first approve at index 5, aggregation remains
-    // any-block-wins, and Bash.command / Write.path / Edit.path are unchanged.
-    // The large prompt-mode refactor keeps the explicit argv and v1 auto-mode
-    // contract intact. A truthy ambient KIMI_CODE_EXPERIMENTAL_FLAG now selects
-    // native agent-core-v2; source tracing confirmed its strict configured-hook
-    // schema, configured+plugin hook merge, snake_case tool payload, awaited
-    // pre-execution deny, and per-agent hook service. A targeted exact-v2 review
-    // smoke denied a forced write. V2 also emits role:"meta",
-    // type:"system.version" before normal output; the parser tolerates it as one
-    // non-fatal diagnostic, keeps it out of records/onRecord, and still pins the
-    // terminal session.resume_hint, so explicit modeling is optional polish.
-    // Upstream print mode now defaults background completion to steering and its
-    // own task timeouts can be unbounded, but the plugin's finite budgets,
-    // concurrency caps, and identity-safe cancellation teardown remain outer
-    // bounds. The complete exact-0.24.2 v1 `bun run smoke:real` was GREEN:
-    // 9 pass / 0 fail, 39 assertions in 261.33s. Read-only labels denied writes;
-    // pursue wrote no file through its full two-minute budget; read swarm denied
-    // a subagent write; write-swarm stayed confined (patchBytes=278,
-    // userTreeClean=true, worktreeCleaned=true); and the out-of-root write was
-    // denied. Phase-1 reports: 97-100; synthesis: 101. Tag:
-    // compat-verified-kimi-code-0.24.2.
     { major: 0, minor: 24 },
-    // 0.25.0 (minor, 2026-07-16) verified COMPAT-PRESERVED across the
-    // 0.24.2→0.25.0 release delta. The two primary safety surfaces are 0-byte
-    // diffs: 01-cli-prompt-mode and 03-hooks are byte-identical, so argv,
-    // default-v1 routing, auto permission, headless handlers, the hook payload,
-    // exit-2 denial, matcher behavior, and any-block-wins aggregation are
-    // unchanged. The remaining scoped deltas are compat-benign: 02-permission
-    // (943 B) only adds `trace_id` to two permission telemetry events (no policy
-    // construction, queue order, or resolution change); 04-wire-records (2 KB)
-    // touches only session/provider-manager.ts to forward Anthropic
-    // supportEfforts/adaptive-thinking capability data (no new PromptJsonWriter
-    // record, role/meta type, session-id field, or goal-summary shape);
-    // 05-session-bootstrap (3.9 KB) derives thinking efforts from the resolved
-    // provider profile while still loading workspace dirs, building the
-    // permission context, and merging configured + plugin hooks on create AND
-    // resume. Direct invariant checks on the released 0.25.0 tag confirmed
-    // PreToolCallHook index 0, AgentSwarmExclusiveDeny index 1, AutoModeApprove
-    // the first approve at index 5 (every intervening policy a deny), any-block-
-    // wins, empty matcher = all tools, exit 2 blocks, Bash.command /
-    // Write.path / Edit.path, `kimi -p` default v1 unless a truthy ambient
-    // KIMI_CODE_EXPERIMENTAL_FLAG selects agent-core-v2 (still opt-in, still
-    // safety-preserving), AgentSwarm subagents on the standard permission stack
-    // (deny-all remains startBtw()-only), and KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY
-    // as the hard concurrent-subagent ceiling. The complete exact-0.25.0 v1
-    // `bun run smoke:real` was GREEN on the clean v1.8.2 tree: 9 pass / 0 fail,
-    // 39 assertions in 419.12s. Read-only labels denied writes; pursue wrote no
-    // file through its full budget (aborted at the wall-clock ceiling); read
-    // swarm denied a subagent write; write-swarm stayed confined (patchBytes=278,
-    // userTreeClean=true, worktreeCleaned=true); and the out-of-root write was
-    // denied. A supplementary KIMI_CODE_EXPERIMENTAL_FLAG=1 targeted v2 review
-    // denial also passed (1 pass). Daily monitor: 2026-07-16. Tag:
-    // compat-verified-kimi-code-0.25.0.
     { major: 0, minor: 25 },
-    // 0.26.0 (minor, 2026-07-16) verified COMPAT-PRESERVED across the
-    // 0.25.0→0.26.0 release delta. All THREE primary safety surfaces are 0-byte
-    // diffs: 01-cli-prompt-mode, 02-permission, AND 03-hooks are byte-identical,
-    // so argv, default-v1 routing, auto permission, headless handlers, the whole
-    // policy queue (PreToolCallHook index 0), the hook engine, exit-2 denial,
-    // matcher behavior, and any-block-wins aggregation are unchanged from the
-    // certified 0.25.0. The two non-empty scoped surfaces are compat-benign:
-    // 04-wire-records (32 KB) is session-store workDir normalization (Windows
-    // case-insensitive drive paths), session forking (a persisted `forked`
-    // AgentRecord + a new internal `context.update_token_count` record — neither
-    // is a `-p` stdout record the parser consumes, and an unknown type fails safe
-    // to the diagnostic channel), provider-manager thinking plumbing, and a
-    // subagent-host `drainChildBackgroundTasks` addition that holds a subagent
-    // open until its background tasks settle and suppresses their terminal
-    // notifications (a lifecycle/settlement change, NOT a permission-stack change;
-    // drained tasks still fire the index-0 hook — it aligns with the plugin's own
-    // settlement-barrier cancellation). 05-session-bootstrap (16 KB) is
-    // config/model.ts thinking-profile plumbing, an optional `auth:'oauth'` field
-    // added to the MCP HTTP/SSE schemas (NOT HookDefSchema, which stays
-    // `.strict()`), and additive rpc/core-impl.ts Global-MCP management + OAuth
-    // flows + deleteSession/importContext (all RPC/host methods off the `-p`
-    // path) plus a setAdditionalDirs→setBaseAdditionalDirs rename and an
-    // `includeSubagents` resume flag the plugin never passes; the create/resume
-    // hook merge is unchanged. Direct checks on the 0.26.0 tag: tools/builtin/file
-    // is a 0-byte diff (Write.path/Edit.path byte-identical), the deny-all unshift
-    // is still startBtw()-only (subagent-host.ts, inside startBtw(), never the
-    // swarm spawn path), and installHeadlessHandlers + the v1 default persist. The
-    // complete exact-0.26.0 v1 `bun run smoke:real` (temp-installed 0.26.0 binary
-    // via the KIMI_PLUGIN_CC_KIMI_BIN override) was GREEN: 9 pass / 0 fail, 39
-    // assertions in 376.06s. Read-only labels denied writes; pursue wrote no file
-    // through its full budget (aborted at the ceiling); read swarm denied a
-    // subagent write; write-swarm stayed confined (patchBytes=278,
-    // userTreeClean=true, worktreeCleaned=true); and the out-of-root write was
-    // denied. Tag: compat-verified-kimi-code-0.26.0.
     { major: 0, minor: 26 },
-    // 0.27.0 (minor, 2026-07-17) verified COMPAT-PRESERVED across the
-    // 0.26.0→0.27.0 release delta. All THREE primary safety surfaces are 0-byte
-    // diffs: 01-cli-prompt-mode, 02-permission, AND 03-hooks are byte-identical,
-    // so argv, default-v1 routing, auto permission, headless handlers, the whole
-    // policy queue, the hook engine, exit-2 denial, matcher behavior, and
-    // any-block-wins aggregation are unchanged from the certified 0.26.0. The two
-    // non-empty scoped surfaces are compat-benign: 04-wire-records (12.3 KB) is
-    // session-storage identity + debug-export naming work (timestamped export
-    // filenames instead of repeatedly overwriting `<session-id>.zip`; an optional
-    // workspace-id registry reuse for the same physical root with Windows-shaped
-    // case/slash folding and safe-id validation + legacy-hash fallback — session
-    // directory bookkeeping, NOT PromptJsonWriter NDJSON records, session.resume_
-    // hint, hook execution, permission ordering, or workspace-write policy), and
-    // 05-session-bootstrap (1.7 KB) only wires the optional `resolveWorkspaceId`
-    // callback through KimiCoreOptions into SessionStore (no config schema,
-    // workspace-local additional_dir, hook merge, or permission-context change;
-    // HookDefSchema stays `.strict()`). The release notes' new `/copy` slash
-    // command is off the monitored `-p` path (scoped CLI delta 0 bytes; not a
-    // model tool). Direct invariant checks on the released 0.27.0 tag confirmed
-    // PreToolCallHook index 0, AgentSwarmExclusiveDeny index 1, AutoModeApprove
-    // the first approve at index 5 (every intervening policy a deny), any-block-
-    // wins via the first action:'block' result, empty matcher = all tools, exit 2
-    // blocks, Bash.command / Write.path / Edit.path, `kimi -p` fresh sessions at
-    // permission:'auto' with resumed sessions force-overridden, AgentSwarm
-    // subagents on the standard permission stack (deny-all unshift remains
-    // startBtw()-only), and KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY as the hard
-    // concurrent-subagent ceiling. The complete exact-0.27.0 `bun run smoke:real`
-    // (temp-installed 0.27.0 binary via KIMI_PLUGIN_CC_KIMI_BIN) was GREEN: 10
-    // pass / 0 fail, 43 assertions in 587.74s — read-only labels denied writes,
-    // the v2 lane (KIMI_CODE_EXPERIMENTAL_FLAG=1) denied AND emitted the modeled
-    // system-version signal, pursue wrote no file through its full budget, read
-    // swarm denied a subagent write, write-swarm stayed confined (patchBytes=278,
-    // userTreeClean=true, worktreeCleaned=true), and the out-of-root write was
-    // denied. Daily monitor: 2026-07-18. Tag: compat-verified-kimi-code-0.27.0.
     { major: 0, minor: 27 },
-    // 0.28.1 (0.28.0 + patch 0.28.1, 2026-07-20) verified COMPAT-PRESERVED across
-    // the 0.27.0→0.28.1 release delta (chained on the 0.27.0 audit above, so the
-    // full 0.26.0→0.28.1 span is covered). The two load-bearing safety surfaces
-    // are 0-byte diffs: 02-permission AND 03-hooks byte-identical; 04-wire-records
-    // is also 0 bytes incrementally (the 12.3 KB 0.26.0→0.28.1 total is entirely
-    // the previously audited 0.27.0 storage work). 01-cli-prompt-mode (1.7 KB) is
-    // commands.ts ONLY: the top-level `server` registration is replaced by `web`
-    // and the YOLO-vs-Auto help text is corrected — run-prompt.ts and options.ts
-    // are byte-identical, and the plugin passes its prompt as the VALUE of `-p`,
-    // so neither change alters consumed argv or `-p` routing. 05-session-bootstrap
-    // (4.8 KB incremental) adds a one-shot `thinking.effort = "max" -> "high"`
-    // config migration that strictly parses and reserializes config.toml via
-    // configToTomlData/setHooks: validated hooks[] entries are preserved but ALL
-    // comments are stripped — exactly the markerless-hook condition the plugin has
-    // handled since v1.8.2 (`hasCleanEnforcingHookEntry`, the real-smol-toml
-    // parser-based, byte-exact, matcher-rejecting absent-state fallback), so a
-    // post-migration config still verifies installed. The 0.28.1 v2 change
-    // broadcasting session-level permission-mode switches to already-running
-    // subagents is a propagation fix, not a hook bypass — the v2 external-hook
-    // runner and tool-executor hook slots are byte-identical across the delta.
-    // Direct checks on the released 0.28.1 tag reconfirmed the full invariant set
-    // (PreToolCallHook index 0, AgentSwarmExclusiveDeny index 1, AutoModeApprove
-    // first approve at index 5 with only denies between, any-block-wins, empty
-    // matcher = all tools, exit 2 blocks, Bash.command / Write.path / Edit.path,
-    // `-p` auto + headless handlers + resume-hint emission, plugin slash-command
-    // activation still RPC/host-initiated and absent from the `-p` path). The
-    // complete exact-0.28.1 `bun run smoke:real` (temp-installed 0.28.1 binary via
-    // KIMI_PLUGIN_CC_KIMI_BIN) was GREEN: 10 pass / 0 fail, 43 assertions in
-    // 626.72s — same full matrix as 0.27.0 including the v2 denial lane, pursue
-    // budget abort, read-swarm subagent denial, write-swarm confinement
-    // (patchBytes=278, userTreeClean=true, worktreeCleaned=true), and the
-    // out-of-root absolute write denial. Daily monitor: 2026-07-21. Tag:
-    // compat-verified-kimi-code-0.28.1.
     { major: 0, minor: 28 },
-    // 0.29.1 (0.29.0 + patch 0.29.1, 2026-07-24) verified
-    // COMPAT-PRESERVED across the 0.28.1→0.29.1 release span. The staged scoped
-    // audits found: 0.28.1→0.29.0 — 01-cli-prompt-mode 3,909 B,
-    // 02-permission 0 B, 03-hooks 0 B, 04-wire-records 8,322 B, and
-    // 05-session-bootstrap 7,655 B; 0.29.0→0.29.1 — 01/02/03 all 0 B,
-    // 04-wire-records 938 B, and 05-session-bootstrap 8,700 B. The v1
-    // load-bearing contract therefore remains intact: PreToolCallHook index 0,
-    // AgentSwarmExclusiveDeny index 1, AutoModeApprove the first approve at index
-    // 5 with only denies between; empty matcher = all tools; exit 2 blocks;
-    // aggregation is any-block-wins; Bash.command / Write.path / Edit.path are
-    // unchanged; fresh and resumed `kimi -p` sessions remain auto with headless
-    // handlers; AgentSwarm subagents retain the standard permission stack and
-    // KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY remains the hard concurrency gate.
-    // The non-empty v1 changes are compat-benign provider/model capability,
-    // session/record identity, replay-limit, MCP timeout, and web endpoint/env
-    // plumbing; none changes PromptJsonWriter records, session.resume_hint,
-    // configured+plugin hook merging, HookDefSchema, workspace-local
-    // additional_dir loading, or permission-context construction.
-    //
-    // 0.29.1 substantially refactors experimental agent-core-v2 tool
-    // adjudication from ordered hook slots to an awaited BeforeToolExecuteEmitter.
-    // The 2026-07-24 audit correctly proved the ordinary awaited external-hook
-    // veto and the smoke below, but its production-order conclusion was wrong.
-    // 2026-07-31 correction: global service registration actually orders
-    // permission gate → plan → swarm → external hooks. Active plan mode can
-    // final-allow the exact KIMI_CODE_HOME plan-file Write/Edit before the hook.
-    // The app hook runner and hook command/config engine are byte-identical across
-    // the patch, so empty-matcher, exit-2 denial, and first-block-wins aggregation
-    // remain true for calls that reach them; they do not prove every v2 call does.
-    // v1.9.4 therefore refuses experimental-v2 across the tested range pending an
-    // upstream ordering guarantee. See the 0.31 entry for reachability/mitigation.
-    //
-    // The exact-0.29.1 temp-binary `bun run smoke:real` was GREEN: 10 pass /
-    // 0 fail, 43 assertions in 339.80s. Review/challenge/ask/review_gate forced
-    // writes were denied; the asserted KIMI_CODE_EXPERIMENTAL_FLAG=1 lane emitted
-    // the v2 signal and denied through the new veto path; pursue hit its finite
-    // budget with zero writes; read swarm denied a spawned subagent write;
-    // write-swarm stayed confined (patchBytes=306, userTreeClean=true,
-    // worktreeCleaned=true); and the non-vacuous out-of-root absolute write was
-    // denied. No auth/quota/hook-bypass/user-tree-write blocker occurred.
-    // Headless goal resume remains absent: parseHeadlessGoalCreate and both print
-    // drivers still expose create only; resumeGoal stays TUI/RPC-only. Daily
-    // monitors: 2026-07-23 and 2026-07-24. Tag:
-    // compat-verified-kimi-code-0.29.1.
-    //
-    // 0.29.2 patch checkup (2026-07-27) verified COMPAT-PRESERVED inside the
-    // already-tested 0.29.x minor. Scoped 0.29.1→0.29.2 diffs were:
-    // 01-cli-prompt-mode 0 B, 02-permission 0 B, 03-hooks 0 B,
-    // 04-wire-records 757 B, and 05-session-bootstrap 0 B. The sole canonical
-    // delta makes a main-agent `steer` refresh prompt metadata like `prompt`;
-    // it does not alter stream-json output, session pinning, hook matching or
-    // aggregation, permission construction, or tool dispatch. V1 goal pursuit
-    // now treats `loop_control.max_steps_per_turn` as a continuation boundary
-    // instead of pausing the goal; the plugin's mandatory finite wall-clock
-    // AbortController budget remains the hard bound.
-    //
-    // Experimental v2 replaced its hand-maintained eager-service startup list
-    // with dependency-driven `ScopeActivation.OnScopeCreated` construction and
-    // moved mutable service state into agent/session state containers.
-    // `AgentExternalHooksService` still awaits configured/plugin PreToolUse and
-    // vetoes on block; `run-v2-print.ts`, `BeforeToolExecuteEmitter`, the hook
-    // aggregation runner, and the hook command runner are all 0-byte diffs.
-    // The exact-0.29.2 temp-binary `bun run smoke:real` was GREEN: 10 pass /
-    // 0 fail, 43 assertions in 502.40s. It non-vacuously denied the asserted-v2
-    // forced write, kept pursue at zero writes through its finite-budget abort,
-    // denied a read-swarm subagent write, confined write-swarm
-    // (patchBytes=278, userTreeClean=true, worktreeCleaned=true), and denied the
-    // out-of-root absolute write. Headless goal resume remains absent because
-    // both print drivers are byte-identical across the patch. Daily monitor:
-    // 2026-07-27. Tag: compat-verified-kimi-code-0.29.2.
     { major: 0, minor: 29 },
-    // 0.30.0 certified in v1.9.3 (2026-07-29). SCOPE NOTE, because it is easy to
-    // audit the wrong tree: the released `@moonshot-ai/kimi-code@0.30.0` tag is
-    // EIGHT commits behind `origin/main`. Everything interesting in main — v1
-    // custom agent files (#2232), plugin-contributed agents (#2365), plugin
-    // `systemPrompt` (#2314), the `secondary-model` flag — is queued for 0.31.0
-    // and is NOT in the released binary. This entry certifies the RELEASED tag;
-    // contracts were verified at main as well (the stricter state) and hold in
-    // both.
-    //
-    // Re-verified against 0.30.0 source, all byte-identical to 0.29.2 unless
-    // noted: policy queue keeps PreToolCallHookPermissionPolicy at index 0 with
-    // indices 1-4 ALL pure denies (AgentSwarmExclusiveDeny, AutoModeAskUserQuestionDeny,
-    // PlanModeGuardDeny, UserConfiguredDeny) before the first approve at index 5,
-    // so nothing auto-approves ahead of the hook; hook engine keeps
-    // first-block-wins (`engine.ts` `results.find(r => r.action === 'block')`),
-    // empty-matcher-means-all, exit-2 denial, and fail-open on internal error;
-    // `Bash` still takes `command` and `Write`/`Edit` still take `path` (NOT
-    // `file_path`) with no new write-shaped builtin tool; `-p` still defaults to
-    // the v1 driver with `permission: 'auto'` + installHeadlessHandlers, still
-    // writes stream-json via PromptJsonWriter, still emits the `session.resume_hint`
-    // meta record and the role-less `goal.summary`, and still rejects
-    // --auto/--yolo/--plan with -p; goal mode still triggers on the `/^\/goal(\s|$)/`
-    // prefix ALONE; plugin hooks still merge any-block-wins and `HookDefSchema`
-    // is still `.strict()` (no config-injection vector for per-hook cwd/env).
-    //
-    // AgentSwarm subagents still use the STANDARD permission stack:
-    // `DenyAllPermissionPolicy` has exactly ONE call site repo-wide, inside
-    // `startBtw()`, and `spawn()`/`configureChild()` never touch
-    // `permission.policies`; children still share `parent.config.cwd`. The
-    // adversarial check that matters most: `agent.hooks` is OPTIONAL, so an
-    // unwired subagent would silently fail open through index 0 — it is wired
-    // unconditionally by `createAgent`'s `config.hookEngine ?? this.hookEngine`
-    // fallback, and NO production call site supplies `config.hookEngine`. Every
-    // swarm subagent therefore fires the session hook engine.
-    //
-    // KNOWN CAVEAT, characterized not hand-waved: 0.30.0 activates the KAP
-    // global search service in EVERY agent-core-v2 App bootstrap, not just the
-    // server, so an experimental-v2 run (`KIMI_CODE_EXPERIMENTAL_FLAG` truthy,
-    // which the plugin inherits) performs an unasked-for cross-session index
-    // pass and creates `<KIMI_CODE_HOME>/search-index`. It is NOT a hook bypass,
-    // NOT a user-worktree write, and NOT a credential read: the index is engine
-    // -internal (never a tool call) and confined to KIMI_CODE_HOME. The DEFAULT
-    // v1 engine is unaffected (`sdk-rpc-client.ts` bootstraps no App scope).
-    // Upstream fix: MoonshotAI/kimi-code#2376 (App-scope OnDemand), which removes
-    // the caveat in a later release.
-    //
-    // The exact-0.30.0 `bun run smoke:real` was GREEN: 11 pass / 0 fail, 49
-    // assertions in 348.05s. It denied review/challenge/ask/review_gate forced
-    // writes; the asserted KIMI_CODE_EXPERIMENTAL_FLAG=1 lane emitted the v2
-    // signal and still denied; pursue hit its finite budget with zero writes;
-    // read swarm denied a spawned subagent write; write-swarm stayed confined
-    // (patchBytes=334, userTreeClean=true, worktreeCleaned=true); and the
-    // out-of-root absolute write was denied. NEW this release, and the reason the
-    // previous 0.30.0 smoke was green for the wrong reason: every isolated
-    // KIMI_CODE_HOME starts EMPTY and the indexer short-circuits on zero
-    // sessions, so the caveat path never ran. The populated-home case now asserts
-    // its OWN precondition (wire files > 0) and failed-loudly-or-proved rather
-    // than passing vacuously — it recorded index PRESENT with wire files=1 while
-    // writes stayed denied and no search index ever appeared in the workspace.
-    //
-    // RESIDUAL: write-swarm still runs against a session-less home, so "an
-    // un-awaited index sync cannot race the patch capture" is COMPOSED from two
-    // tests (index confined to KIMI_CODE_HOME; patch capture reads the ephemeral
-    // worktree) rather than observed end to end in one.
-    //
-    // 0.31 FOLLOW-UP (completed in v1.9.4): v1 custom agent files auto-scan project roots
-    // (`<git-root>/.kimi-code/agents`, `<git-root>/.agents/agents`) with NO flag
-    // gating, and an `override: true` file can replace the default `agent`
-    // profile. `AgentFileDefinition` carries no permission/hook/cwd field, so it
-    // reshapes the system prompt and the tool list only — every call still hits
-    // policy index 0, and our label allowlist fails closed on an unknown tool.
-    // It is a PROMPT-INJECTION surface for repo-scoped rescue/swarm-write, not a
-    // hook bypass. v1.9.4 documents this trust boundary in docs/safety.md.
-    // Daily monitor: 2026-07-29. Tag: compat-verified-kimi-code-0.30.0.
     { major: 0, minor: 30 },
-    // 0.31.0 certified in v1.9.4 (2026-07-31) with one fail-closed runtime
-    // mitigation. Immutable tag audit: bc28e9d802fbec29395a7aed85e880679a050145.
-    // Canonical 0.30.0→0.31.0 scoped diffs were CLI 4,025 B, permission 0 B,
-    // hooks 0 B, wire/session 37,804 B, bootstrap/config 22,220 B, and the
-    // previously-audited v2 denial path 0 B. V1 keeps the index-0 hook, all-deny
-    // gap before first approve, any-block-wins hook aggregation, tool-input keys,
-    // standard swarm child stack, consumed argv, PromptJsonWriter shapes, terminal
-    // session hint, and create-only headless goal behavior. Parser/client tests
-    // passed 98/0/247 against the unchanged wire envelope.
-    //
-    // New v1 trust surface, documented rather than flattened: 0.31 discovers
-    // user/project/plugin custom agents and plugin system-prompt contributions.
-    // Project `override: true` can replace builtin `agent` or `coder` instructions
-    // and tool availability; the bound profile persists with the session. Profile
-    // schema cannot set hooks/permission/cwd or widen this plugin's allowlist, so
-    // this is prompt/task-fidelity risk, not a confinement bypass. Write-capable
-    // use in an untrusted repo must inspect those files first.
-    //
-    // CORRECTION to the 0.30.0 v2 judgement: external PreToolUse is awaited on
-    // ordinary calls, but production service order is permission gate → plan →
-    // swarm → external hooks. While plan mode is active, AgentPlanService
-    // final-allows a Write/Edit whose accesses target only the exact plan file;
-    // final allow stops listener iteration before our hook. The path is confined
-    // to KIMI_CODE_HOME, not the worktree, but violates the every-tool managed
-    // hook contract. It is reachable fresh via user `default_plan_mode=true` and
-    // on resume via restored PlanModel. The code is byte-identical in 0.30/0.31,
-    // so this is newly discovered inherited evidence, not a new 0.31 regression.
-    //
-    // v1.9.4 therefore refuses upstream-equivalent truthy
-    // KIMI_CODE_EXPERIMENTAL_FLAG values before spawn with
-    // CLI_V2_HOOK_ORDER_UNSAFE / refusal_kind `v2-hook-order-unsafe`; unset/false
-    // values preserve fresh and resumed default-v1 behavior. EnterPlanMode is
-    // also explicitly denied for every managed label as defense in depth. Do not
-    // re-enable v2 until an exact released tag orders external-hook veto before
-    // every final allow and non-vacuous fresh-default-plan + restored-plan smoke
-    // cases both prove the hook blocks the exact plan-file write.
-    //
-    // Exact-0.31.0 pre-mitigation smoke was GREEN 11/0/49 in 944.47s: all default
-    // v1 forced writes, pursue budget, read-swarm child denial, write-swarm patch
-    // capture/cleanup, and out-of-root denial passed; the populated-home case had
-    // wire files=1 and kept the eager KAP index inside KIMI_CODE_HOME. The
-    // ordinary fresh-v2 forced-write lane also denied, but did not cover
-    // default_plan_mode and is not v2 certification. v1.9.4 replaces that lane
-    // with an exact pre-spawn refusal assertion. The released 0.31.0 still
-    // contains the KAP eager-index behavior; it is unreachable from plugin flows
-    // while v2 is refused. MoonshotAI/kimi-code#2376 remains unmerged.
-    //
-    // 0.31.1 patch checkup (2026-08-01) verified COMPAT-PRESERVED inside the
-    // already-tested 0.31.x minor. Scoped 0.31.0→0.31.1 diffs were:
-    // 01-cli-prompt-mode 0 B, 02-permission 0 B, 03-hooks 0 B,
-    // 04-wire-records 1,850 B, and 05-session-bootstrap 0 B. The sole canonical
-    // delta adds a helper that strips the disabled no-op `model` parameter from
-    // the Agent/AgentSwarm schemas. AgentSwarm keeps its exact tool name and
-    // executor; the standard child permission stack, hook inheritance, cwd,
-    // concurrency/timeout plumbing, and dispatch path are unchanged.
-    //
-    // The patch carries a large experimental-v2 refactor, but the print-mode
-    // selection file and upstream truth table are byte-identical. The plugin
-    // therefore still refuses every upstream-truthy KIMI_CODE_EXPERIMENTAL_FLAG
-    // before spawn. The release supplies no external-hook-before-every-final-
-    // allow guarantee, so it is not evidence for re-enabling v2. KAP global
-    // search also remains App-scoped OnScopeCreated; #2376 is still unmerged.
-    //
-    // Exact-0.31.1 temp-binary smoke was GREEN: 10 pass / 0 fail, 42 assertions
-    // in 349.27s. It denied every forced-write label, refused v2 before spawn,
-    // kept pursue at zero writes through its finite-budget abort, denied a real
-    // read-swarm child write, confined write-swarm (patchBytes=278,
-    // userTreeClean=true, worktreeCleaned=true), and denied the non-vacuous
-    // out-of-root coder write. Daily monitor: 2026-08-01. Tag:
-    // compat-verified-kimi-code-0.31.1.
     { major: 0, minor: 31 },
-    // 0.32–0.34 added in v1.9.6 (2026-08-08) after
-    // auditing the cumulative 0.31.1→0.34.0 jump at immutable upstream commit
-    // f0614c53e59f7e1e257412063b059b9eb82764cf. The scoped legacy-v1 permission,
-    // hook, and bootstrap/config trees are 0-byte diffs; wire/session adds 55
-    // internal v2-to-v1 resume lines without changing the consumed v1 envelope.
-    //
-    // The audit corrected a scope omission: 0.33.0 changed the selector in
-    // experimental-v2.ts so unflagged print mode defaults to native v2. That
-    // engine is still unsafe for this plugin because plan-file final allow can
-    // stop listener iteration before the external PreToolUse hook. The runtime
-    // containment therefore overwrites KIMI_CODE_LEGACY_FLAG=1 in every accepted
-    // fresh/resumed child environment; truthy KIMI_CODE_EXPERIMENTAL_FLAG stays
-    // an independent pre-spawn refusal. Older upstream releases ignore the
-    // legacy flag. Native v2 is not certified or re-enabled by these entries.
-    //
-    // Exact-0.34.0 temp-binary smoke was GREEN: 11 pass / 0 fail, 54 assertions
-    // in 460.09s. It proved fresh default_plan_mode=true and resumed sessions
-    // remained on v1 with non-vacuous hook denials, denied every forced-write
-    // label, bounded pursue, denied a real read-swarm child write, confined
-    // write-swarm (patchBytes=278; user tree clean; worktree removed), and denied
-    // the out-of-root coder write. Daily monitor: 2026-08-08.
     { major: 0, minor: 32 },
     { major: 0, minor: 33 },
     { major: 0, minor: 34 },
-    // 0.35 added in v1.9.8 (2026-08-12) after the scoped source audit and
-    // exact-binary smoke against immutable upstream commit
-    // f6ee44e42641498f26635eec2e6799d13372885c. The canonical CLI, v1
-    // permission, hook, and consumed wire/session surfaces were 0-byte diffs.
-    // The 3,347-byte bootstrap diff only adds global MCP OAuth-status RPC
-    // helpers; it does not alter -p session construction, hook merging,
-    // permission context, cwd, or workspace-local config loading.
-    //
-    // Native v2 remains fail-closed: 0.35.0 still allows the plan listener to
-    // final-allow exact plan-file writes before external hooks, so accepted
-    // children stay pinned to legacy v1 and truthy experimental selectors still
-    // refuse before spawn. The builtin coder profile also removes nested
-    // Agent/AgentSwarm by default and builtin profiles are cloned per session;
-    // neither change widens the plugin's write surface.
-    //
-    // Exact-0.35.0 temp-binary smoke was GREEN: 12 pass / 0 fail, 55 assertions
-    // in 525.01s. Fresh/resumed default-plan runs stayed on v1 with hook-denied
-    // writes; forced-write labels, pursue, read-swarm, write-swarm confinement,
-    // and out-of-root denial all passed. Daily monitor: 2026-08-12.
     { major: 0, minor: 35 },
-    // 0.36 added in v1.9.9 (2026-08-13) after the scoped source audit and
-    // exact-binary smoke against immutable upstream commit
-    // b6144f94ea6b22455a4e750d1750d220987e7bc2. The canonical CLI, v1
-    // permission, and hook surfaces were 0-byte diffs. The wire/session diff
-    // adds MCP OAuth credential coordination; bootstrap/config adds MCP OAuth
-    // inspection plus v2 secondary-model pool config round-tripping. Neither
-    // changes the supported -p stream, hook merge, permission context, cwd, or
-    // workspace-local config loading.
-    //
-    // Native v2 remains fail-closed: 0.36.0 still allows the plan listener to
-    // final-allow exact plan-file writes before external hooks, so accepted
-    // children stay pinned to legacy v1 and truthy experimental selectors still
-    // refuse before spawn. The added secondary-model pool keys are excluded
-    // from the v1 derived-model patch recipe and do not widen write capability.
-    //
-    // Exact-0.36.0 temp-binary smoke was GREEN: 12 pass / 0 fail, 55 assertions
-    // in 534.57s. Fresh/resumed default-plan runs stayed on v1 with hook-denied
-    // writes; forced-write labels, v2 refusal, pursue, read-swarm, write-swarm
-    // confinement, and out-of-root denial all passed. Daily monitor: 2026-08-13.
     { major: 0, minor: 36 },
-    // 0.37–0.38 added in the 2026-08-24 compatibility catch-up after the
-    // cumulative audit through immutable upstream commit
-    // 0999454bdcb5ddd98f39bffee434dcf0a810f394 (tag @moonshot-ai/kimi-code@0.38.0).
-    // Intermediate 0.37.0→0.37.1 and 0.37.1→0.37.2 scoped diffs were 0 bytes
-    // across CLI prompt mode, permission, hooks, wire/session, and
-    // session-bootstrap/config. The cumulative 0.36.1→0.38.0 audit likewise
-    // found 0-byte CLI (except the off-path hidden __update_download command),
-    // permission, and hook surfaces; 8,525 bytes of wire/session MCP OAuth and
-    // background-write-drain plumbing; and 47,360 bytes of bootstrap/config
-    // MCP registry/OAuth plus create/resume wiring with hook merge/cwd unchanged.
-    // The 0.38.0 WaitFor tool is v2-only and remains outside the read-only
-    // allowlist. Native v2 remains fail-closed: accepted children force
-    // KIMI_CODE_LEGACY_FLAG=1, while truthy KIMI_CODE_EXPERIMENTAL_FLAG values
-    // refuse before spawn; the plan-file final-allow ordering gap and KAP
-    // follow-up therefore remain contained and uncertified.
-    //
-    // Exact-0.38.0 temp-binary smoke was GREEN: 12 pass / 0 fail, 55 assertions
-    // in 381.64s. It denied every forced-write label, refused v2 before spawn,
-    // kept fresh/resumed default-plan runs on v1, enforced the hook on every
-    // pursue turn, denied a read-swarm child write, confined write-swarm
-    // (patchBytes=278; user tree clean; worktree removed), and denied the
-    // non-vacuous out-of-root coder write. Daily monitor: 2026-08-24.
     { major: 0, minor: 37 },
     { major: 0, minor: 38 },
-    // 0.39.0 certified 2026-08-27 (same-day: npm publish 11:36Z, operator binary
-    // self-upgraded within hours; tag @moonshot-ai/kimi-code@0.39.0, commit
-    // 52e8d19d). Scoped diffs vs 0.38.0: CLI prompt mode (incl. the engine
-    // selector experimental-v2.ts), permission, hooks, and wire/session all
-    // 0-byte; bootstrap/config was 9,060 bytes of MCP-registry cwd threading +
-    // OAuth verify tri-state only (create/resume session bootstrap and the
-    // config/ dir byte-unchanged). The v1 tool-layer files outside the scoped
-    // diffs (tools/policies/path-access.ts, tools/builtin/shell/bash.ts) are a
-    // win32-only cygpath shell-path-bridge refactor, provably identity on POSIX
-    // and post-hook defense-in-depth regardless; audits now also scope
-    // packages/node-sdk/src (v1 portions) and packages/kaos/src, which are on
-    // the -p path but were previously un-scoped (this release: additive/benign).
-    //
-    // New experimental features are both agent-core-v2-only and unreachable on
-    // the pinned path: tower (KIMI_CODE_EXPERIMENTAL_TOWER; TUI /tower command;
-    // zero agent-core presence, node-sdk setTowerMode hard-throws on v1) and
-    // subagent fork (KIMI_CODE_EXPERIMENTAL_SUBAGENT_FORK / [experimental]
-    // subagent_fork; the v1 flag registry cannot express either flag, and the
-    // v1 AgentSwarm input schema is .strict() so a model-supplied fork arg is
-    // rejected). Both are subsumed by KIMI_CODE_EXPERIMENTAL_FLAG, which still
-    // refuses before spawn. Native v2 remains fail-closed: the plan listener
-    // still final-allows exact plan-file writes before external hooks (sole
-    // event.allow() call site; ordering is import-order with no contract, and
-    // upstream's Permission.md documents the bypass as intended with listener
-    // ordering an open design question), so accepted children stay pinned to
-    // legacy v1. Remote Control (0.39.0, experimental) can patch hooks via a
-    // tunneled config API; the per-spawn byte-exact hook verification catches
-    // that as RECOVERABLE drift — fail-closed, no runtime change needed.
-    //
-    // Exact-0.39.0 temp-binary smoke was GREEN: 12 pass / 0 fail, 55 assertions
-    // in 554.49s. It denied every forced-write label, refused v2 before spawn,
-    // kept fresh/resumed default-plan runs on v1, enforced the hook on every
-    // pursue turn, denied a read-swarm child write, confined write-swarm
-    // (patchBytes=278; user tree clean; worktree removed), and denied the
-    // non-vacuous out-of-root coder write. Reports 111-116; monitor 2026-08-27.
-    //
-    // 0.39.1 patch check certified 2026-08-29 (tag
-    // @moonshot-ai/kimi-code@0.39.1, immutable commit 5efca0c3; published
-    // 2026-08-28T10:01:03.520Z). All six playbook scopes are byte-identical to
-    // 0.39.0: CLI prompt mode, permission, hooks, wire/session,
-    // bootstrap/config, and v1 tools/SDK. Exact 0.39.1 and live upstream main
-    // 9d2304c retain the same v2 plan-before-external-hook final-allow path; no
-    // upstream issue/PR or released ordering API exists, so native v2 remains
-    // fail-closed and the production capability matrix stays empty.
-    //
-    // The exact-0.39.1 temp binary passed the v1.9.12 release-candidate
-    // smoke: 12 pass / 0 fail / 55 assertions in 400.68s. It proved forced-write
-    // denials, v2 pre-spawn refusal, fresh/resumed default-plan legacy pinning,
-    // pursue every-turn enforcement, real read-swarm child denial,
-    // write-swarm confinement (patchBytes=278; user tree clean; worktree
-    // removed), and out-of-root denial. Monitor: 2026-08-29.
     { major: 0, minor: 39 },
-    // 0.40.0 certified 2026-09-02 (same-day: npm publish 05:58Z; tag
-    // @moonshot-ai/kimi-code@0.40.0, immutable commit e27ee608; 48 commits
-    // past 0.39.1). Scoped diffs vs 0.39.1: permission, hooks, and wire/session
-    // all 0 bytes; CLI prompt mode is --yolo/--auto help text plus new
-    // top-level `fork`/`session` subcommands (off the -p path — the plugin
-    // passes the prompt as the VALUE of -p, never a bare positional);
-    // bootstrap/config is one additive line (ModelAliasBaseSchema.protocol
-    // widens to 'anthropic' | 'openai_responses'); v1 tools/SDK is additive
-    // telemetry/session-list/tower plumbing with tool schemas (Write/Edit
-    // `path`, Bash `command`), kaos, and the v1 createKimiHarness entry point
-    // unchanged (the KimiHarness class gains one optional telemetry field that
-    // entry point does not wire). The
-    // whole packages/agent-core source tree changed by that one schema line.
-    // KIMI_CODE_LEGACY_FLAG=1 still forces v1 for fresh and resumed -p at the
-    // top of runPrompt(); engine selection reads only that env var and never
-    // config, so no config.toml key (incl. [experimental] tables, which can
-    // enable registered v1 flags without the env master switch — v1 registry
-    // holds only tool-select/secondary-model) can defeat the pin. #3427's
-    // config-beats-env flag precedence and #3434's legacy acp-adapter removal are
-    // v2-only / off the -p transport.
-    //
-    // Native v2 stays fail-closed: plan feature (index.ts:330) still registers
-    // before externalHooks (:338); planService.ts:112 is still the sole
-    // event.allow(); toolExecutor/ is a 0-byte diff; MoonshotAI/kimi-code#3431
-    // is open with no maintainer response. 0.40.0 ADDS a v2-only reason to keep
-    // refusing: #3444 removed the RuntimeWorkspaceView.resolve() root assertion,
-    // so v2 Bash can run with an out-of-workspace cwd (zero shared code with v1
-    // or kaos). The new v2 dangerous-command ask policy sits before the first
-    // approve but is skipped under nonInteractive (v2 print sets it) — inert
-    // and not an ordering fix. The 2026-09-01 live repro, re-run 2026-09-02 on the
-    // 0.40.0 binary, still bypasses the hook (REPRO_0391.md Run D).
-    //
-    // Operator-facing, not contract: v2 config writeback (#3392) now preserves
-    // config.toml formatting per domain, so managed-block markers may survive
-    // login/settings writes more often — the marker-less fallback fires less,
-    // never incorrectly; `kimi doctor` now validates config against the v2
-    // schema, whose hook schema is field-for-field identical to v1's.
-    //
-    // Exact-0.40.0 temp-binary smoke was GREEN: 12 pass / 0 fail / 55
-    // assertions in 383.45s (after a morning auth-expiry false alarm — 3/9 with
-    // auth.login_required and records=[] — cleared once operator auth was valid
-    // again; an isolated-home kimi -p probe answered OK before the re-run). It
-    // denied every forced-write label, refused v2 before spawn, kept
-    // fresh/resumed default-plan runs on v1, enforced the hook on every pursue
-    // turn, denied a read-swarm child write, confined write-swarm
-    // (patchBytes=306; user tree clean; worktree removed), and denied the
-    // non-vacuous out-of-root coder write. Reports 117-120; monitor 2026-09-02.
     { major: 0, minor: 40 },
-    // 0.41.0 certified 2026-09-06; exact release commit 95478e8c.
-    // Compared with 0.40.0: CLI prompt mode, permission, hooks, wire/session,
-    // and bootstrap/config are 0 bytes; the entire v1 core is unchanged.
-    // SDK suggestFiles is additive (v1 returns undefined), plus a comment edit.
-    // Shared prompt-render/goal-prompt/prompt-session are also unchanged.
-    // Env-only legacy selection, the two-entry v1 flag registry, hook index 0,
-    // any-block-wins aggregation, tool input keys and trusted-root confinement
-    // remain load-bearing. No parser, permission or engine-routing change.
-    // Native v2 is NOT certified: plan still precedes external hooks
-    // (index.ts:329/341); planService.ts:110 final-allows the exact plan file.
-    // staleGuard and the old Permission.md are removed; auto-mode dangerous
-    // command checks are skipped. None establishes external-hook precedence.
-    // Exact same-day monitor smoke: 12 pass / 0 fail / 55 assertions, 383.88s.
-    // Fresh v2 reproduction: hook blocks Glob, plan Write bypasses it; v1
-    // control blocks Write. Reused evidence predates only this boundary/docs
-    // patch, not a behavior change. Reports 121-125; monitor 2026-09-06.
     { major: 0, minor: 41 },
 ];
 /**
@@ -1257,10 +70,6 @@ export const KIMI_TESTED_MINORS = [
  * failures resolve to `{kind: "failed", reason}` so callers can decide
  * the policy. The kimi binary path defaults to bare `kimi` (PATH
  * lookup); callers that need an explicit absolute path should pass it.
- *
- * Output contract: kimi-code 0.1.x and 0.2.x both write a single line
- * like `0.2.0` (sometimes with leading "v") to stdout and exit 0. We
- * tolerate either form and any trailing whitespace.
  */
 export async function probeKimiVersion(options) {
     const bin = options.kimiBin ?? "kimi";
@@ -1304,7 +113,6 @@ export async function probeKimiVersion(options) {
                 child.kill("SIGTERM");
             }
             catch {
-                // best effort
             }
             settle({
                 kind: "failed",
@@ -1355,7 +163,7 @@ export async function probeKimiVersion(options) {
  * pre-release / build metadata is preserved in `raw` but doesn't
  * affect the tested-range check.
  *
- * Returns undefined when the leading line doesn't look like a version.
+ * Returns undefined when the first nonempty line doesn't look like a version.
  */
 export function parseVersionLine(stdout) {
     const firstLine = stdout.split(/\r?\n/).find((line) => line.trim().length > 0);
@@ -1376,11 +184,10 @@ export function isInTestedRange(major, minor) {
     return KIMI_TESTED_MINORS.some((entry) => entry.major === major && entry.minor === minor);
 }
 /**
- * The newest `{major, minor}` in the tested set — the known-good upper bound
- * (H9). Set-membership in `isInTestedRange` already warns for anything outside
- * the tested range; this lets the warning distinguish the COMMON case (a kimi
- * release NEWER than our last compat audit — likely fine but unverified) from a
- * below/gap version, which is the more suspicious shape.
+ * The newest `{major, minor}` in the legacy-v1 tested set. Native-v2-certified
+ * versions lie outside this table. Set membership already warns for anything
+ * outside the legacy range; this upper bound lets the warning distinguish a
+ * newer, unverified legacy release from a below/gap version.
  */
 export function maxTestedMinor() {
     return KIMI_TESTED_MINORS.reduce((max, entry) => entry.major > max.major || (entry.major === max.major && entry.minor > max.minor)
@@ -1400,9 +207,8 @@ export function formatVersionOutOfRangeWarning(probe, pluginVersion) {
         `WARNING: kimi-code version ${probe.version} is outside the range kimi-plugin-cc ${pluginVersion} was tested against (${tested}).`,
     ];
     if (aboveMax) {
-        // H9: the known-good upper bound. Above it = a release newer than our last
-        // compat audit — unverified, and exactly the case the version probe exists
-        // to flag when out-of-band auto-upgrade drifts the binary.
+        // Above the legacy-v1 tested upper bound is a release newer than the last
+        // legacy compatibility audit, commonly from out-of-band auto-upgrade drift.
         lines.push(`  This is NEWER than the newest version we have tested (${max.major}.${max.minor}.x) and is not yet certified for model execution.`);
     }
     lines.push(`  Setup can complete, but model-spawning commands will refuse before Kimi starts rather than run an unreviewed engine/version route.`, `  Update kimi-plugin-cc to a release that certifies this minor, or point KIMI_PLUGIN_CC_KIMI_BIN at a certified kimi-code binary and retry setup.`, `  KIMI_PLUGIN_CC_SKIP_VERSION_PROBE is a test/smoke seam, not a production compatibility override.`);