kimi-plugin-cc 2.2.2 → 2.4.0

package/plugins/kimi-codex/dist/cli-client.js

@@ -1,17 +1,5 @@
 // Subprocess client for `kimi -p --output-format stream-json`.
 //
-// Replaces runtime/wire/client.ts for v1.0. Both modules coexist during the
-// PR 1-3 transition; PR 4 deletes wire/. The contract is intentionally
-// narrower than the v0.4 wire client — one process per prompt, no in-band
-// approvals (PreToolUse hook handles those), no resumable JSON-RPC channel.
-//
-// Where v0.4 streamed turn events to a TurnCapture state machine,
-// stream-json gives us flattened OpenAI-shaped records that callers
-// reassemble at their own seam. The buffered result is the primary return
-// shape; callers needing incremental visibility (e.g., updating SQLite
-// phase as tools run) can pass `onRecord` to observe records as they arrive
-// without paying for a separate event-stream API.
-//
 // Per-job env (`KIMI_PLUGIN_CC_CMD`) is set on this spawn so the
 // PreToolUse hook can branch per command (review vs rescue vs ask). It is
 // passed via the spawn `env` option, not exported to a shell, so concurrent
@@ -32,12 +20,7 @@ import { collectDescendantIdentities, revalidateProcessIdentities, waitForProces
 const STDERR_TAIL_BYTES = 8192;
 /** Hard cap on awaiting diagnostics log drain before resolving the result. */
 const LOG_DRAIN_TIMEOUT_MS = 250;
-/**
- * Default delay between SIGTERM and SIGKILL when an abort fires.
- * Matches v0.4's `cancellation.ts` escalation timing for wire clients,
- * so rescue/ask/review continue to feel identical to a stuck-kimi user
- * after the v1.0 cutover.
- */
+/** Default 1500 ms delay between SIGTERM and SIGKILL after an abort. */
 const DEFAULT_ESCALATION_MS = 1_500;
 /** Maximum time spent confirming POSIX tree exit after SIGKILL dispatch. */
 const POST_KILL_QUIESCENCE_MS = 500;
@@ -199,11 +182,8 @@ export async function runCliPrompt(opts) {
                 continue;
             }
             if (outcome.unknownRecord !== undefined) {
-                // H3 forward-compat: a stream-json line with a role we don't model
-                // (a future kimi-code role). Log it for diagnostics but keep it OUT of
-                // records[] and out of onRecord — consumers iterate records[] expecting
-                // assistant/tool only. Tolerated, not treated as malformed/error —
-                // EXCEPT that on a native-v2 plan nothing may precede the marker.
+                // Unknown roles are diagnostic-only and excluded from consumer records;
+                // native-v2 still refuses any output before its marker.
                 if (requireMarkerBeforeOutput(`an unknown-role (${outcome.unknownRecord.role}) record`)) {
                     return;
                 }
@@ -216,9 +196,7 @@ export async function runCliPrompt(opts) {
             if (outcome.goalSummary !== undefined) {
                 if (requireMarkerBeforeOutput("goal.summary"))
                     return;
-                // Goal-mode summary is out-of-band metadata for our wrapper, not a
-                // consumer-facing record. First-announce wins (a run emits exactly one,
-                // at session end); capture and skip so records[] stays assistant/tool.
+                // Out-of-band metadata; first-announce-wins, excluded from consumer records.
                 if (announcedGoalSummary === undefined) {
                     announcedGoalSummary = outcome.goalSummary;
                     appendLogLine({
@@ -327,7 +305,7 @@ export async function runCliPrompt(opts) {
         args,
         command_label: opts.commandLabel ?? null,
     });
-    return await new Promise((resolve, reject) => {
+    return await new Promise(async (resolve, reject) => {
         let aborted = false;
         let cancellationTeardown;
         let settlementStarted = false;
@@ -552,21 +530,22 @@ export async function runCliPrompt(opts) {
             });
         };
         opts.signal?.addEventListener("abort", onAbort, { once: true });
-        // Re-check `aborted` AFTER attaching the listener. `await mkdir` above
-        // is the first synchronous yield point after the pre-spawn aborted
-        // check — if abort fired during that await, the signal is already in
-        // an aborted state by the time we reach addEventListener, which does
-        // NOT re-fire for already-aborted signals (per the AbortSignal spec).
-        // Without this re-check the spawned child is orphaned: SIGTERM/SIGKILL
-        // is never sent and the process keeps holding the SQLite row + model
-        // tokens. Audit report 28 (Codex H1) tracked this fix.
+        // Abort may occur during any pre-spawn await, and addEventListener does not
+        // replay an already-aborted signal. Re-check after attaching the listener so
+        // the spawned child cannot escape cancellation teardown.
         if (opts.signal?.aborted === true) {
             onAbort();
         }
-        // Swap the pre-attached early listener for the real handler. These two
-        // statements are synchronous and execute as one unit; no event can
-        // interleave between marking earlyErrorHandled and attaching the new
-        // listener.
+        if (child.pid !== undefined && opts.onSpawn) {
+            try {
+                await opts.onSpawn(child.pid);
+            }
+            catch (error) {
+                onAbort();
+                settle("reject", new RuntimeError("CLI_SPAWN_CALLBACK_FAILED", `Failed to record the spawned kimi process: ${formatError(error)}`, "cli-client.spawn", error instanceof Error ? { cause: error, details: errorDetails() } : { details: errorDetails() }));
+                return;
+            }
+        }
         earlyErrorHandled = true;
         child.on("error", (err) => {
             appendLogLine({ event: "process_error", message: formatError(err) });
@@ -614,7 +593,7 @@ export async function runCliPrompt(opts) {
             await raceWithTimeout(logChain, LOG_DRAIN_TIMEOUT_MS);
             settle("resolve", {
                 spawnedAt,
-                settledAt: 0, // Filled at settlement, after the teardown barrier.
+                settledAt: 0,
                 sessionId,
                 goalSummary: announcedGoalSummary,
                 cliError: announcedCliError,
@@ -722,14 +701,6 @@ export class ResponseTimeoutError extends RuntimeError {
  *
  *   The generic `withTimeout` (runtime/kimi-timeouts.ts) only rejects
  *   the outer Promise — it has no handle on the kimi child process.
- *   review/ask/review-gate previously wrapped `runCliPrompt` with
- *   `withTimeout` and let the orphaned subprocess keep running until
- *   it crashed or finished on its own. The reviewers (reports 17 +
- *   18) flagged this as critical for review_gate in particular: the
- *   8 s budget fires inside Claude Code's Stop hook, the parent
- *   returns "allow stop", and a runaway kimi keeps holding the
- *   SQLite row + model tokens. Subsequent `/kimi:cancel` can't reach
- *   it because `kimi_pid` is null.
  *
  * Behavior:
  *
@@ -811,11 +782,6 @@ function buildArgs(opts) {
             args.push("--skills-dir", dir);
         }
     }
-    // NOTE: thinking effort is requested through the env binding, never CLI argv.
-    // Non-trait-driven providers or a base level already off ignore it silently;
-    // an alwaysThinking model receives off unnormalized. stream-json carries no
-    // thinking deltas (writeThinkingDelta() {} in the JSON writer), so the plugin
-    // cannot observe whether the request was honoured.
     // -p accepts the prompt as the option value. We pass it as a separate argv
     // entry so prompts with leading dashes or whitespace are not interpreted as
     // additional flags.
@@ -826,15 +792,12 @@ function buildEnv(opts) {
     const env = { ...opts.env };
     if (opts.thinkingEffort !== undefined)
         env.KIMI_MODEL_THINKING_EFFORT = opts.thinkingEffort;
-    // 2.2.0 audit: ambient trust starts project MCP stdio servers outside PreToolUse.
+    // Ambient workspace trust starts project MCP stdio servers outside PreToolUse.
     delete env.KIMI_CODE_TRUST_WORKSPACE;
-    // kimi-code 0.33.0 inverted its CLI engine default: an unflagged `kimi -p`
-    // now selects native agent-core-v2, while this upstream-documented flag pins
-    // the legacy-v1 path. Native v2 still has a final-allow plan-file path that
-    // can skip our later external PreToolUse hook, so the engine choice must be a
-    // plugin-owned spawn invariant rather than ambient operator state. Older
-    // kimi-code releases ignore the unknown flag. Always overwrite ambient false
-    // values; accepting one would silently reopen v2 on 0.33+.
+    // Legacy-v1 plans use this flag on releases whose unflagged -p default can
+    // route to native-v2. Always overwrite ambient false values; older releases
+    // ignore it. The engine choice stays plugin-owned, while certified native-v2
+    // plans use the no-plan construction rather than a legacy pin.
     if (opts.executionPlan.intendedEngine === "legacy-v1") {
         env[KIMI_LEGACY_ENV] = KIMI_LEGACY_FORCED_VALUE;
     }
@@ -850,8 +813,6 @@ function buildEnv(opts) {
         env.KIMI_PLUGIN_CC_CMD = opts.commandLabel;
     }
     if (opts.swarmMaxConcurrency !== undefined) {
-        // kimi-code 0.18.0+ caps AgentSwarm's normal-phase concurrency at this
-        // value; older binaries ignore it. See the field doc on CliClientOptions.
         env.KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY = String(opts.swarmMaxConcurrency);
     }
     if (opts.trustedWorkspaceRoot !== undefined) {

package/plugins/kimi-codex/dist/commands/ask.js

@@ -1,5 +1,5 @@
 import { companionHelp } from "../help.js";
-import { randomUUID } from "node:crypto";
+import { allocateJobId } from "../job-id.js";
 import path from "node:path";
 import { createCliCancellationHandlers } from "../cli-cancellation.js";
 import { runCliPromptWithBudget } from "../cli-client.js";
@@ -19,32 +19,28 @@ import { startBackgroundJob } from "../background-spawn.js";
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
 import { warnInheritedBudget, captureTimeoutPartialOutput, assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing, warnHookEscapes } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
-// v1.0 cutover note (PR 2):
-//
-//   The v0.4 wire client/initialize/prompt sequence is replaced with a
-//   single `runCliPrompt` against `kimi -p --output-format stream-json`.
-//   The PreToolUse hook reads `KIMI_PLUGIN_CC_CMD=ask` and applies the
-//   same read-only tool policy as review/challenge/review_gate.
-//
-// Session id handling differs from v0.4:
-//
-//   - v0.4 the client assigned the kimi session id upfront (passed via
-//     `--session <uuid>` on the wire command line).
-//   - v1.0 kimi-code assigns the session id and announces it via stderr
-//     ("To resume this session: kimi -r <uuid>"). We capture that id
-//     after the call and update the JobStore row.
-//   - For `--resume`, we pass the prior session id via `-r`; kimi-code
-//     keeps it across resumes.
 const ASK_SUMMARY_MAX = 120;
 const ASK_AGENT_PROFILE_PLACEHOLDER = "<cli-client>";
-const ASK_PROMPT_PREFIX = [
-    "Answer the user's question directly in free-form prose.",
-    "Stay read-only.",
+const ASK_PROMPT_CONTRACT = [
+    "Answer directly in free-form prose.",
+    "For repository-dependent questions, inspect the relevant code with the allowed read tools and cite file:line for concrete code claims where useful.",
+    "Distinguish evidence from inference and state unknowns explicitly.",
+    "Do not use shell/Bash, writes, background tasks, or delegated operations.",
     "Do not emit JSON unless the user explicitly asks for it.",
+    "Do not narrate tool progress; make the final response self-contained.",
+];
+const ASK_PROMPT_PREFIX = [
+    ...ASK_PROMPT_CONTRACT,
     "",
     "User question:",
     "",
 ].join("\n");
+const ASK_CONTINUE_TASK = "Continue the previous ask conversation and answer any outstanding question.";
+const ASK_RESUME_PROMPT = [
+    ...ASK_PROMPT_CONTRACT,
+    "",
+    ASK_CONTINUE_TASK,
+].join("\n");
 export async function runAsk(argv, context) {
     const parsed = parseAskArgs(argv);
     if (parsed.help)
@@ -59,7 +55,7 @@ export async function runAsk(argv, context) {
     const store = new JobStore(paths);
     try {
         await sweepStaleJobs(store, paths);
-        const jobId = randomUUID();
+        const jobId = allocateJobId(context);
         const sessionResolution = await resolveAskSession(store, repoIdentity.repoId, parsed.fresh, parsed.resume, parsed.resumeTarget);
         const askPrompt = buildAskPrompt(parsed.prompt, sessionResolution.reusedSession);
         const executionPlan = await prepareKimiExecutionPlan({
@@ -91,7 +87,7 @@ export async function runAsk(argv, context) {
             ...persistedExecutionPlanFields(executionPlan),
             agent_profile: ASK_AGENT_PROFILE_PLACEHOLDER,
             prompt_digest: digestPrompt(askPrompt),
-            summary: shorten(parsed.prompt ?? askPrompt, ASK_SUMMARY_MAX),
+            summary: shorten(askPromptSubject(askPrompt), ASK_SUMMARY_MAX),
             phase: parsed.background ? "queued" : "starting",
             final_output_path: null,
             stream_log_path: logPath,
@@ -156,6 +152,7 @@ export async function executeAskJob(jobId, prompt, context, options) {
         }
         handlers = createCliCancellationHandlers();
         const executionPlan = executionPlanFromPersisted(job);
+        store.updateRunningJob(job.job_id, { phase: "turn-running" });
         // Re-validate resume lineage from the store before spawning: a detached
         // worker (or a forged queued row) reloads the persisted plan and would
         // otherwise hand kimi_session_id to the spawn without the dispatch-time
@@ -178,6 +175,7 @@ export async function executeAskJob(jobId, prompt, context, options) {
             thinkingEffort: job.thinking_effort ?? undefined,
             resumeSessionId: job.kimi_session_id ?? undefined,
             logPath: job.stream_log_path,
+            onSpawn: (pid) => { store.updateRunningJob(job.job_id, { kimi_pid: pid }); },
             signal: handlers.signal,
         }, job.budget_ms ?? KIMI_ASK_PROMPT_TIMEOUT_MS, "ask.prompt");
         store.updateRunningJob(job.job_id, observedExecutionFields(result));
@@ -192,9 +190,7 @@ export async function executeAskJob(jobId, prompt, context, options) {
         // kimi-code mints a new id on each turn.
         if (result.sessionId !== undefined &&
             result.sessionId.length > 0) {
-            // length>0 guard: empty-string capture would poison the row. The
-            // warning helper's null-ish check would also fire but only after
-            // the bad write. (Kimi alpha.4 challenge finding #3.)
+            // Never persist an empty ID because NULL represents a missing session ID.
             store.updateRunningJob(job.job_id, { kimi_session_id_source: "announced", kimi_session_id: result.sessionId });
         }
         await syncKimiSessionTitle({
@@ -202,7 +198,7 @@ export async function executeAskJob(jobId, prompt, context, options) {
             env: context.env,
             cwd: job.cwd,
             sessionId: result.sessionId ?? job.kimi_session_id,
-            title: buildKimiSessionTitle("ask", prompt.startsWith(ASK_PROMPT_PREFIX) ? prompt.slice(ASK_PROMPT_PREFIX.length) : prompt),
+            title: buildKimiSessionTitle("ask", askPromptSubject(prompt)),
             stderr: context.stderr,
         });
         // For ask, missing session id breaks both -r (latest-resume) and
@@ -322,14 +318,15 @@ function buildAskPrompt(question, reusedSession) {
         return ASK_PROMPT_PREFIX + question.trim();
     }
     if (reusedSession) {
-        return [
-            "Continue the previous ask conversation in free-form prose.",
-            "Stay read-only.",
-            "Do not emit JSON unless the user explicitly asks for it.",
-        ].join("\n");
+        return ASK_RESUME_PROMPT;
     }
     throw new RuntimeError("INVALID_ARGS", "ask requires a question after the flags.", "ask.parse");
 }
+function askPromptSubject(prompt) {
+    if (prompt.startsWith(ASK_PROMPT_PREFIX))
+        return prompt.slice(ASK_PROMPT_PREFIX.length);
+    return prompt === ASK_RESUME_PROMPT ? ASK_CONTINUE_TASK : prompt;
+}
 function shorten(text, max) {
     const normalized = text.replace(/\s+/g, " ").trim();
     if (normalized.length <= max) {

package/plugins/kimi-codex/dist/commands/cancel.js

@@ -5,6 +5,7 @@ import { markJobCancelled, sweepStaleJobs } from "../jobs.js";
 import { JobStore, withJobStore } from "../job-store.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { parseJobLookupArgs } from "../parsing.js";
+import { revalidateProcessIdentities } from "../process-tree.js";
 import { getManagedCommandConfig } from "./registry.js";
 export async function runCancel(argv, context) {
     const parsed = parseJobLookupArgs(argv);
@@ -31,30 +32,22 @@ export async function runCancel(argv, context) {
                 message: "cancel is a no-op for terminal jobs.",
             }, null, 2)}\n`;
         }
+        if (store.getMcpTask(job.job_id) &&
+            (context.mcpCompanionIdentity === undefined || context.mcpKimiIdentity === undefined)) {
+            throw new RuntimeError("MCP_CANCEL_REQUIRES_BINDING", `MCP job ${job.job_id} requires MCP job-control cancellation with recorded identities; use tasks/cancel or kimi_job_cancel.`, "mcp.cancel");
+        }
         if (job.pid === null && job.kimi_pid === null) {
             throw new RuntimeError("CANCEL_NOT_SUPPORTED", `Job ${job.job_id} does not have a recorded process id to cancel.`, "cancel.runtime");
         }
-        // review_gate runs in a Stop hook; SIGTERMing kimi_pid causes the wire
-        // process to exit with WIRE_PROCESS_EXITED, which the hook's catch path
-        // would persist as `failed`. Pre-mark the row as `cancelled` here so the
-        // user's intent is recorded canonically — the subsequent wire exit is a
-        // no-op against an already-terminal row (markFailed has a WHERE
-        // status='running' guard).
+        // review_gate runs in a Stop hook. Pre-mark the row as cancelled before
+        // signaling so the subprocess close/result path cannot persist a failure
+        // over the user's intent; later updates are no-ops on a terminal row.
         //
-        // Because the row is now terminal, waitForCancellation returns
-        // immediately on the status check and never escalates to SIGKILL. Run
-        // an unconditional SIGTERM→1s→SIGKILL sequence on the recorded pids
-        // here and return early so the lower-level wait/escalation path does
-        // not skip cleanup. (v0.2.4)
+        // The terminal row also makes waitForCancellation return before its own
+        // escalation, so this path always attempts SIGTERM after the pre-mark
+        // attempt, waits 1s, and sends SIGKILL only if a recorded process remains
+        // live. A pre-mark failure is rethrown only after termination is attempted.
         if (job.command_type === "review_gate") {
-            // Pre-mark before signaling so the row persists as `cancelled` rather
-            // than the `failed` the hook's catch path would write on WIRE_PROCESS_EXITED.
-            //
-            // If the pre-mark itself fails (disk I/O, SQLite contention), we must
-            // STILL signal the Kimi child — otherwise the user's cancel command
-            // produces an alive-but-marked-cancelled stuck state. Capture the
-            // pre-mark failure, run the SIGTERM→SIGKILL escalation unconditionally,
-            // and rethrow at the end so the user sees the underlying error.
             let preMarkError;
             try {
                 await withJobStore(paths, async (preMarkStore) => {
@@ -65,6 +58,7 @@ export async function runCancel(argv, context) {
             catch (error) {
                 preMarkError = error;
             }
+            await assertMcpCompanionIdentity(job, context.mcpCompanionIdentity);
             signalJobProcesses(job, "SIGTERM");
             await sleep(1_000);
             if (hasLiveRecordedProcess(job)) {
@@ -79,6 +73,8 @@ export async function runCancel(argv, context) {
                 message: "review_gate cancelled; SIGTERM→SIGKILL escalation completed.",
             }, null, 2)}\n`;
         }
+        await assertMcpCompanionIdentity(job, context.mcpCompanionIdentity);
+        await assertMcpKimiIdentity(job, context.mcpKimiIdentity);
         signalJobProcesses(job, "SIGTERM");
         const cancelled = await waitForCancellation(paths, job.job_id);
         if (cancelled) {
@@ -88,7 +84,11 @@ export async function runCancel(argv, context) {
                 message: "Cancellation completed.",
             }, null, 2)}\n`;
         }
-        signalJobProcesses(job, "SIGKILL");
+        const companionMatches = await assertMcpCompanionIdentity(job, context.mcpCompanionIdentity, true);
+        const kimiMatches = await assertMcpKimiIdentity(job, context.mcpKimiIdentity, true);
+        if (companionMatches || kimiMatches) {
+            signalJobProcesses(job, "SIGKILL", { companion: companionMatches, kimi: kimiMatches });
+        }
         await withJobStore(paths, async (forcedStore) => {
             const current = forcedStore.getJob(job.job_id);
             if (current?.status === "running") {
@@ -105,11 +105,38 @@ export async function runCancel(argv, context) {
         store.close();
     }
 }
-function signalJobProcesses(job, signal) {
+async function assertMcpCompanionIdentity(job, expected, allowMissing = false) {
+    return assertMcpProcessIdentity(job.pid, expected, "companion", allowMissing);
+}
+async function assertMcpKimiIdentity(job, expected, allowMissing = false) {
+    return assertMcpProcessIdentity(job.kimi_pid, expected, "Kimi", allowMissing);
+}
+async function assertMcpProcessIdentity(actualPid, expected, label, allowMissing) {
+    if (expected === undefined)
+        return true;
+    if (expected === null) {
+        if (actualPid === null)
+            return false;
+        throw new RuntimeError("CANCEL_NOT_SUPPORTED", `MCP job ${actualPid} has no verified ${label} identity; refusing PID-only cancellation.`, "mcp.cancel");
+    }
+    if (actualPid !== expected.pid) {
+        throw new RuntimeError("MCP_PROCESS_IDENTITY_MISMATCH", `The recorded ${label} process identity no longer matches; no signal was sent.`, "mcp.cancel");
+    }
+    const validation = await revalidateProcessIdentities([expected]);
+    if (!validation.complete) {
+        throw new RuntimeError("MCP_PROCESS_IDENTITY_UNAVAILABLE", `The ${label} identity probe was inconclusive; no further signal was sent and the job was not changed.`, "mcp.cancel");
+    }
+    const matches = validation.identities.length > 0;
+    if (!matches && !allowMissing) {
+        throw new RuntimeError("MCP_PROCESS_IDENTITY_MISMATCH", `The recorded ${label} process identity no longer matches; no signal was sent.`, "mcp.cancel");
+    }
+    return matches;
+}
+function signalJobProcesses(job, signal, include = { companion: true, kimi: true }) {
     const pids = new Set();
-    if (job.pid !== null)
+    if (include.companion && job.pid !== null)
         pids.add(job.pid);
-    if (job.kimi_pid !== null)
+    if (include.kimi && job.kimi_pid !== null)
         pids.add(job.kimi_pid);
     for (const pid of pids) {
         try {

package/plugins/kimi-codex/dist/commands/cli-helpers.js

@@ -44,29 +44,20 @@ export function reassembleProseFromRecords(records) {
     return out;
 }
 /**
- * Loud-fail warning when kimi finished a job but never announced a
- * session id on stderr. We persist `kimi_session_id` as NULL in that
- * case (the row is unresumable), and the user is silently surprised
- * later when `-r` or `/kimi:replay` returns nothing.
+ * Warn when kimi finishes without announcing a session ID. The job keeps
+ * `kimi_session_id` NULL, so resume is unavailable.
  *
- * The right surface is human-readable stderr per the LLM-caller
- * discipline invariant — load-bearing context still goes via the SQLite
- * row (`kimi_session_id IS NULL`), but the user sees this warning
- * inline immediately after the prompt completes so they know resume is
- * unavailable for this job.
- *
- * Called at the end of every command that captures sessionId (review,
- * challenge, ask, rescue). Review-gate intentionally skips: it's a Stop
- * hook with no resume semantics and we don't want a runtime warning to
- * leak into Claude Code's transcript on every assistant turn.
+ * This warning belongs on human stderr; load-bearing state remains in SQLite.
+ * Review-gate intentionally skips it because a Stop hook has no resume
+ * semantics and should not warn on every assistant turn.
  */
 export function warnIfSessionIdMissing(result, commandLabel, jobId, stderr) {
     if (result.sessionId !== undefined && result.sessionId.length > 0) {
         return;
     }
     stderr.write(`[${commandLabel}] kimi did not announce a session id for job ${jobId}. ` +
-        `Resume and replay will not work for this job. ` +
-        `If this happens repeatedly, check kimi-code's stderr format (the " To resume this session" line) and report upstream.\n`);
+        `Resume will not work for this job. Replay from the stored stream log is unaffected. ` +
+        `If this happens repeatedly, check kimi-code's session.resume_hint record (and the legacy stderr resume announcement) and report upstream.\n`);
 }
 /**
  * Translate a cli-client `CliClientResult` into the kind of error

package/plugins/kimi-codex/dist/commands/pursue.js

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { allocateJobId } from "../job-id.js";
 import path from "node:path";
 import { createCliCancellationHandlers } from "../cli-cancellation.js";
 import { runCliPromptWithBudget } from "../cli-client.js";
@@ -16,36 +16,13 @@ import { readArtifact, renderManagedJobOutput, writeArtifact } from "../render.j
 import { hookRefusalDetails, hookRefusalRetryProtocol, maybeWarnHookMissing, verifyHookInstalled, } from "../hooks/install.js";
 import { assertCliResultSuccess, reassembleProseFromRecords, warnIfSessionIdMissing, warnHookEscapes } from "./cli-helpers.js";
 import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js";
-// /kimi:pursue — autonomous goal mode (kimi-code 0.8.0+ headless `/goal`).
-//
-// PROTOTYPE SCOPE (v1.1 experimental). Deliberately narrow:
-//   - FOREGROUND ONLY. No --background/--detach yet. Goal mode is experimental
-//     upstream and its cancellation semantics want a human watching; a hard
-//     wall-clock budget bounds the run. (kimi's own shape-consult, report 60.)
-//   - NO --resume. In goal mode `goal.summary` emits a *goalId* that is
-//     DISTINCT from the resume-hint *sessionId*; `kimi -r <sessionId>` re-enters
-//     the session but not necessarily the goal continuation. Exposing resume
-//     before that split is reconciled upstream would be a silent-failure trap,
-//     so we capture+surface the goalId but don't offer resume yet.
-//   - Reuses the RESCUE job lineage (command_type "rescue", KIMI_PLUGIN_CC_CMD=
-//     "rescue") so the PreToolUse hook applies the workspace write allowlist to
-//     EVERY continuation turn, and /kimi:status / /kimi:result / /kimi:cancel
-//     work unchanged. Promoting pursue to a first-class command_type is a
-//     follow-up (would ripple through ManagedCommandType + the registry).
-//
-// SAFETY: the hook fires on every tool call in every continuation turn (policy
-// index 0, verified against kimi-code 0.9.0 — report 58 — and re-verified through
-// 0.12.0 by the goal-mode real-binary smoke, reports 61-65). So a goal-mode run
-// is exactly as write-gated as a single-turn rescue. The only NEW risk is
-// unboundedness, bounded here by the AbortController wall-clock ceiling.
+// /kimi:pursue — experimental autonomous goal mode (kimi-code 0.8.0+).
+// Runtime-foreground-only, with a mandatory finite wall-clock budget. No resume:
+// goalId is distinct from sessionId. Rescue lineage and the "rescue" hook label
+// apply the workspace write allowlist on every continuation turn, and the hook
+// is mandatory. Status, result, and cancellation use the same rescue lineage.
 const PURSUE_SUMMARY_MAX = 120;
 const PURSUE_AGENT_PROFILE = "<goal-mode>";
-/**
- * Map a headless goal-mode exit code to a terminal status. complete=0 is
- * success; blocked=3 and paused=6 are terminal-but-resumable (NOT failures);
- * anything else is a genuine process failure. Source:
- * apps/kimi-code/src/cli/goal-prompt.ts::GOAL_EXIT_CODES.
- */
 /**
  * Goal-terminal exits (3 = blocked, 6 = paused) are NOT failures, so
  * `assertCliResultSuccess` never runs for them — which means a native-v2 plan
@@ -69,6 +46,12 @@ export function assertGoalRunProvenance(plan, result) {
         },
     });
 }
+/**
+ * Map a headless goal-mode exit code to a terminal status. complete=0 is
+ * success; blocked=3 and paused=6 are terminal non-failures; anything else is
+ * a genuine process failure. Source:
+ * apps/kimi-code/src/cli/goal-prompt.ts::GOAL_EXIT_CODES.
+ */
 export function classifyGoalExit(exitCode) {
     switch (exitCode) {
         case 0:
@@ -88,9 +71,16 @@ export function classifyGoalExit(exitCode) {
  * wall-clock AbortController; goal budget mutation is not authorized.
  */
 export function buildGoalPrompt(objective, turns) {
-    const trimmed = objective.trim();
-    const turnHint = turns !== undefined ? ` Stop after at most ${turns} turns; this is a soft instruction, not an enforced turn budget.` : "";
-    return `/goal ${trimmed}${turnHint}`;
+    const trimmed = objective.trim().split(/\s+/).join(" ");
+    const turnHint = turns !== undefined
+        ? ` The plugin owns the outer wall-clock budget; do not call SetGoalBudget. Stop after at most ${turns} turns (soft instruction). Unfinished work at the soft stop is not completion.`
+        : "";
+    if (trimmed.length + turnHint.length > 4_000) {
+        throw new RuntimeError("INVALID_ARGS", turns === undefined
+            ? "pursue objective exceeds Kimi's 4000-character goal limit; shorten the objective."
+            : "pursue objective plus --turns guidance exceeds Kimi's 4000-character goal limit; shorten the objective or omit --turns.", "pursue.parse");
+    }
+    return `/goal -- ${trimmed}${turnHint}`;
 }
 function renderGoalHeader(summary, exitStatus) {
     const status = summary?.status ?? exitStatus;
@@ -132,7 +122,7 @@ export async function runPursue(argv, context) {
             env: context.env,
         });
         const prompt = buildGoalPrompt(objective, parsed.turns);
-        const jobId = randomUUID();
+        const jobId = allocateJobId(context);
         const logPath = path.join(paths.logsDir, `pursue-${jobId}.jsonl`);
         const job = store.createJob({
             job_id: jobId,
@@ -236,6 +226,7 @@ async function executePursueJob(jobId, prompt, objective, budgetMs, context) {
             model: job.model ?? undefined,
             thinkingEffort: job.thinking_effort ?? undefined,
             logPath: job.stream_log_path,
+            onSpawn: (pid) => { store.updateRunningJob(job.job_id, { kimi_pid: pid }); },
             signal: handlers.signal,
         }, budgetMs, "pursue.prompt");
         store.updateRunningJob(job.job_id, observedExecutionFields(result));

package/plugins/kimi-codex/dist/commands/registry.js

@@ -3,11 +3,8 @@ const passthroughOutput = "passthrough";
 const parsedOutput = "parsed";
 const DEFAULT_ESCALATION_MS = 1_500;
 /**
- * Build the cancellation config from a short prefix. The prefix is
- * both the title-cased noun ("Ask"/"Rescue"/...) and the SCREAMING
- * uppercase error-code stem ("ASK_"/"RESCUE_"/...). Centralizes the
- * pattern that ask/rescue/review used to inline in three near-identical
- * variants.
+ * Build cancellation config from the display name used verbatim in messages
+ * and the uppercase stem used in error codes.
  */
 function makeCancellationConfig(prefix) {
     const { displayName, errorCodeStem } = prefix;
@@ -28,21 +25,11 @@ function makeCancellationConfig(prefix) {
     };
 }
 /**
- * Single source of truth for per-command behavior. Keyed by
- * `ManagedCommandType` — only commands that actually run the
- * managed-cancellation flow participate. `setup` and `task` are
- * intentionally NOT here: they don't go through the SIGTERM/cancel
- * path that this registry configures, so adding placeholder entries
- * for them would be type-system noise without behavior.
+ * Single source of truth for per-command behavior. Only commands using the
+ * managed-cancellation flow participate; `setup` and `task` do not.
  *
- * Casing note: `ask`, `rescue`, and `review_gate` carry capitalized
- * `displayName` values matching their pre-registry hardcoded strings
- * ("Ask cancelled...", "Rescue failed.", "review_gate cancelled..."
- * for the lowercased compound noun). `review` and `challenge` carry
- * lowercase displayName values to match their pre-registry pattern
- * (the old code interpolated `${commandType}` directly). Mixed casing
- * is established prior art — the registry preserves it rather than
- * homogenizing.
+ * Display-name casing is part of the user-visible contract: `Ask` and `Rescue`
+ * are title-cased, while `review`, `challenge`, and `review_gate` are lowercase.
  */
 export const COMMAND_REGISTRY = {
     ask: {