kimi-plugin-cc 2.2.2 → 2.4.0

package/plugins/kimi-codex/dist/mcp/tool-result.js

@@ -0,0 +1,7 @@
+export function textResult(text, structuredContent, isError = false) {
+    return {
+        content: [{ type: "text", text }],
+        ...(structuredContent ? { structuredContent } : {}),
+        isError,
+    };
+}

package/plugins/kimi-codex/dist/mcp/workspace.js

@@ -0,0 +1,34 @@
+import { realpath, stat } from "node:fs/promises";
+import path from "node:path";
+import { RuntimeError } from "../errors.js";
+import { resolveRepoIdentity } from "../git.js";
+export async function resolveMcpWorkspace(env, requested) {
+    const defaultCandidate = env.KIMI_PLUGIN_CC_MCP_WORKSPACE;
+    const candidate = requested ?? defaultCandidate;
+    if (!candidate) {
+        throw new RuntimeError("MCP_WORKSPACE_REQUIRED", "This MCP server has no default workspace. Supply the absolute workspace directory explicitly; Codex calls normally require it.", "mcp.workspace");
+    }
+    const cwd = await canonicalDirectory(candidate, "workspace");
+    if (defaultCandidate) {
+        const defaultCwd = await canonicalDirectory(defaultCandidate, "host workspace");
+        const relative = path.relative(defaultCwd, cwd);
+        if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+            throw new RuntimeError("MCP_WORKSPACE_OUTSIDE_DEFAULT", `workspace must be the host workspace or one of its descendants, not ${cwd} (host: ${defaultCwd}).`, "mcp.workspace");
+        }
+    }
+    return { cwd, repo: await resolveRepoIdentity(cwd) };
+}
+async function canonicalDirectory(candidate, label) {
+    if (!path.isAbsolute(candidate)) {
+        throw new RuntimeError("MCP_WORKSPACE_NOT_ABSOLUTE", `${label} must be an absolute existing directory.`, "mcp.workspace");
+    }
+    try {
+        const cwd = await realpath(candidate);
+        if (!(await stat(cwd)).isDirectory())
+            throw new Error("not a directory");
+        return cwd;
+    }
+    catch (error) {
+        throw new RuntimeError("MCP_WORKSPACE_INVALID", `${label} is not an accessible existing directory: ${candidate}`, "mcp.workspace", error instanceof Error ? { cause: error } : undefined);
+    }
+}

package/plugins/kimi-codex/dist/model-command.js

@@ -0,0 +1,32 @@
+import { runAsk } from "./commands/ask.js";
+import { notImplementedCompanionCommand } from "./commands/not-implemented.js";
+import { runPursue } from "./commands/pursue.js";
+import { runRescue } from "./commands/rescue.js";
+import { runReview } from "./commands/review.js";
+import { runSwarm } from "./commands/swarm.js";
+export async function runModelCommand(argv, context) {
+    const [command, ...rest] = argv;
+    switch (command) {
+        case "review":
+            return `${await runReview(rest, context, "review")}\n`;
+        case "ask":
+            return `${await runAsk(rest, context)}\n`;
+        case "task": {
+            const [taskType, ...taskArgs] = rest;
+            switch (taskType) {
+                case "rescue":
+                    return runRescue(taskArgs, context);
+                case "challenge":
+                    return `${await runReview(taskArgs, context, "challenge")}\n`;
+                case "pursue":
+                    return runPursue(taskArgs, context);
+                case "swarm":
+                    return runSwarm(taskArgs, context);
+                default:
+                    notImplementedCompanionCommand(taskType ? `task ${taskType}` : "task");
+            }
+        }
+        default:
+            return undefined;
+    }
+}

package/plugins/kimi-codex/dist/native-v2-preflight.js

@@ -6,7 +6,7 @@
 //   chain-breaking `event.allow()` is the plan-file guard
 //   (features/plan/planService.ts:110), and it fires only while plan mode is
 //   ACTIVE. Plan mode can arm in a plugin-spawned `kimi -p` session in exactly
-//   three ways (re-established at exact 0.42.0, 0.43.0, 0.43.1 and 2.0.0):
+//   three ways:
 //     A. `default_plan_mode = true` in <KIMI_CODE_HOME>/config.toml, read ONCE
 //        inside sessions.create() (single user file; no env, argv or project
 //        overlay; invalid values fall back to false upstream);

package/plugins/kimi-codex/dist/parsing.js

@@ -1,15 +1,7 @@
 import { RuntimeError } from "./errors.js";
 /**
- * Tokens like `--foo` or `-x` that aren't in a command's known-flags set are
- * almost certainly typos (e.g. `--from HEAD~2` instead of `--base HEAD~2`)
- * or — for agent-mediated callers — hallucinated flag names (e.g. wrappers
- * inventing `--file` / `--context` because that shape is common in other
- * CLIs). The historical behavior — silently treating them as free-form
- * trailing prompt/focus text with an advisory stderr warning — produced
- * misleading runs (Kimi chewing on a bloated blob, or hitting the prompt
- * timeout). All command parsers now hard-fail on unknown flag-shaped tokens
- * while still preserving prose mode after the first non-flag token and the
- * `--` escape.
+ * Unknown flag-shaped tokens hard-fail instead of being absorbed into prose.
+ * Parsing still switches to prose at the first non-flag token or after `--`.
  */
 function looksLikeFlag(token) {
     if (!token.startsWith("-")) {
@@ -39,8 +31,8 @@ export function validateThinkingEffort(value, stage = "args.parse", lowercase =
 export const PURSUE_SUPPORTED_FLAGS = "-m/--model <name>, --thinking <off|low|medium|high>, --budget <30m|1h|90s>, --turns <N>";
 export const SWARM_SUPPORTED_FLAGS = "-m/--model <name>, --thinking <off|low|medium|high>, --budget <30m|1h|90s>, --cap <N>, --max-concurrency <N>, --write";
 /**
- * Parser for /kimi:swarm (read-only parallel fan-out). Foreground-only:
- * no --background/--fresh/--resume. Trailing tokens are the objective.
+ * Parser for /kimi:swarm. Foreground-only: no --background/--fresh/--resume.
+ * Trailing tokens are the objective.
  */
 export function parseSwarmArgs(argv) {
     let model;
@@ -256,7 +248,6 @@ export function parsePursueArgs(argv) {
         objective: trailingTokens?.join(" "),
     };
 }
-/** Help before -- wins even over malformed flags or prose trailing-token mode. */
 const VALUE_TAKING_FLAGS = new Set(["--thinking", "-m", "--model", "--budget", "--resume", "--base", "--cap", "--max-concurrency", "--turns", "--type"]);
 /**
  * `--help` / `-h` counts only inside the leading flag region: before `--`
@@ -565,11 +556,6 @@ function parseKnownFlags(argv, knownFlags, commandName) {
         }
         if (!knownFlags.has(token)) {
             if (looksLikeFlag(token)) {
-                // Wrapper agents routinely hallucinate flags like `--file` /
-                // `--context` because that shape is common in other CLIs. Silently
-                // slurping them into focus text produced a bloated prompt that
-                // looked like a hang. Hard-fail with the supported list inline so
-                // the error message itself is the correction.
                 throw new RuntimeError("INVALID_ARGS", `Unknown flag ${token} for ${commandName}. Supported flags: ${REVIEW_SUPPORTED_FLAGS}. Use \`--\` before flag-shaped focus text to pass it through.`, "args.parse");
             }
             trailingTokens = argv.slice(index);

package/plugins/kimi-codex/dist/rescue-approval.js

@@ -1,36 +1,11 @@
 import { access, lstat, realpath } from "node:fs/promises";
 import path from "node:path";
 import { parse } from "./vendor/shell-quote/index.js";
-// v1.0 cutover note (PR 3):
-//
-//   The v0.4 entrypoint, `createRescueApprovalPolicy`, took
-//   ApprovalRequestPayload values from the wire JSON-RPC channel and
-//   returned approval policies for ApprovalDispatcher. Both of those
-//   types lived in `runtime/wire/` which PR 4 deletes.
-//
-//   The v1.0 entrypoint, `evaluateRescueHookRequest`, takes the
-//   PreToolUse hook shape (toolName + raw toolInput from kimi-code's
-//   hook stdin) and returns a `HookDecision`. All the security helpers
-//   below are unchanged from v0.4 — `checkApprovedPath`,
-//   `validateShellCommand`, `validateShellStage`, `hasUnsafeShellSyntax`,
-//   `hasMutatingFlag`, `validatePackageManagerCommand`, plus the
-//   constant tables — kept verbatim so the bug-history reasoning that
-//   went into them (e.g. git pre-subcommand flags, sed `-i.bak`,
-//   shell-quote pipeline parsing) doesn't have to be re-derived. The
-//   thin dispatcher at the top translates between the two surfaces.
-// Flags that direct a command to write its output to a file. Audit
-// report 28 (Codex M2) found that `git diff --output=secret.txt` slipped
-// through the allowlist: the path argument bypasses rescue's
-// workspace-bound file-edit check because the write happens via the
-// tool's own --output semantics, not via shell redirection. Treating
-// these as mutating closes that class (git diff, jq, dot, curl, openssl,
-// many compilers — anything that advertises `--output=PATH`).
-//
-// `-o` short form is intentionally NOT blanket-banned: too many
-// read-only commands use it for non-file purposes (rg -o, awk -o,
-// grep --only-matching aliases). The space-separated `--output PATH`
-// two-arg form is implicitly rejected because the scanner doesn't pair
-// args — `--output` exact match below catches the flag itself.
+// Tool-owned output flags write without shell redirection and therefore bypass
+// path checks unless treated as mutating. The `-o` short form is not banned
+// globally because tools such as rg and grep use it for read-only behavior;
+// per-tool checks handle it. Exact `--output` also rejects the two-argument
+// form because this scanner intentionally does not pair arguments.
 const MUTATING_FLAGS_EXACT = new Set([
     "--fix",
     "--write",
@@ -53,16 +28,10 @@ const MUTATING_FLAG_PREFIXES = [
     "--output-directory=",
     "--output-dir=",
 ];
-// Flags whose VALUE is executed as a command or external tool (RCE class).
-// Whole-repo audit 2026-05-28 (report 43) found that allowlisted commands
-// were trusted with arbitrary flags. No allowlisted read-only command uses
-// these legitimately, so they are rejected for EVERY tool:
-//   - `git grep --open-files-in-pager=touch /tmp/x needle` → git runs `touch`
-//     (F1, CRITICAL — same pager-smuggling class as the pre-subcommand
-//     `git -c core.pager=` defense, but via a subcommand flag)
-//   - `go vet -vettool=<bin>`, `go test -exec <bin>` / `-toolexec <bin>` → runs <bin>
-// The git `-O` short form of --open-files-in-pager is handled in the git
-// branch (it collides with `find -O<level>`, so it can't be banned globally).
+// Flags whose VALUE is executed as a command or external tool are rejected for
+// every tool: Git pager overrides and Go -vettool/-exec/-toolexec are direct
+// command-execution escapes. Git's -O short form is handled in its own branch
+// because it collides with find's read-only -O<level> syntax.
 const EXEC_DELEGATING_FLAGS_EXACT = new Set([
     "--open-files-in-pager",
     "-vettool",
@@ -71,9 +40,8 @@ const EXEC_DELEGATING_FLAGS_EXACT = new Set([
     "--toolexec",
     "-exec",
     "-execdir",
-    // `rg --pre <CMD>` runs CMD as a per-file preprocessor (RCE); `rg --hostname-bin
-    // <CMD>` runs CMD to resolve the hostname; `sort --compress-program <CMD>` execs
-    // CMD to (de)compress spill files (RCE on GNU sort). Verified 2026-07-17.
+    // rg --pre/--hostname-bin and GNU sort --compress-program also execute their
+    // values as commands.
     "--pre",
     "--hostname-bin",
     "--compress-program",
@@ -88,10 +56,9 @@ const EXEC_DELEGATING_FLAG_PREFIXES = [
     "--hostname-bin=",
     "--compress-program=",
 ];
-// Pytest/python -m pytest report flags write to arbitrary paths. Test
-// runners execute repo code by design (documented trust boundary, report 43
-// F4); this only stops them writing OUTSIDE the workspace. pytest parses argv
-// with argparse (allow_abbrev), so match these as abbreviation-aware prefixes.
+// Pytest report flags write to arbitrary paths. Test runners execute repo code
+// by design, so these checks block known runner-owned report outputs rather
+// than every possible write. Match argparse allow_abbrev prefixes as well.
 const PYTEST_REPORT_FLAGS = [
     "--junitxml",
     "--junit-xml",
@@ -114,7 +81,7 @@ const BANNED_FIND_ACTIONS = new Set([
     "-fls",
 ]);
 // Per-tool flags that write to an arbitrary path even in the tool's read/check
-// mode (verified 2026-07-17). Each takes a path value (space- or =-separated);
+// mode. Each takes a path value (space- or =-separated);
 // `hasFlagFromSet` matches both spellings.
 const GO_WRITE_FLAGS = new Set([
     "-coverprofile",
@@ -128,7 +95,7 @@ const GO_WRITE_FLAGS = new Set([
 const CARGO_WRITE_FLAGS = new Set(["--target-dir", "--out-dir"]);
 // tsc matches option names case-INSENSITIVELY (the compiler lowercases them via
 // optionsNameMap), so `--outdir` == `--outDir`. Stored lowercase; matched
-// against lowercased arg names (Opus review 2026-07-17).
+// against lowercased arg names.
 const TSC_WRITE_FLAGS_LC = new Set([
     "--generatecpuprofile",
     "--generatetrace",
@@ -140,25 +107,22 @@ const TSC_WRITE_FLAGS_LC = new Set([
 ]);
 // ruff --config accepts an inline `key=value` override (`--config 'fix=true'`
 // flips ruff into file-rewriting mode) or an arbitrary config path — reject it
-// alongside the direct write flags (Fable review 2026-07-17).
+// alongside the direct write flags.
 const RUFF_WRITE_FLAGS = new Set(["--add-noqa", "--fix-only", "--cache-dir", "--output-file", "--config"]);
 const ESLINT_WRITE_FLAGS = new Set(["--cache-location", "--output-file"]);
-// eslint LOADS AND EXECUTES the module these point at (a custom parser, a rules
-// directory, or the plugin-resolution root) — an arbitrary path is a code-exec
-// escape from the "linters run repo code" boundary. A reviewer uses the
-// project's eslintrc, not these CLI flags (Fable review 2026-07-17).
+// ESLint loads and executes the module named by these flags, so an arbitrary
+// parser/rules/plugin path is a code-execution escape. Normal linting uses the
+// project's own config instead of these overrides.
 const ESLINT_CODELOAD_FLAGS = new Set(["--parser", "--rulesdir", "--resolve-plugins-relative-to"]);
-// mypy runs no repo code, but writes reports/cache to arbitrary paths and can
-// pip-install. mypy uses argparse (allow_abbrev), so ANY unambiguous prefix of
-// these resolves (`--jun`→--junit-xml, `--html-rep`→--html-report,
-// `--cache-di`→--cache-dir); matched abbreviation-aware, not exact.
+// By default mypy does not execute repo code, but config plugins are imported
+// (the --config-file exception denied below). Reports/cache can target arbitrary
+// paths and --install-types runs pip. Match argparse allow_abbrev prefixes.
 const MYPY_WRITE_FLAGS_ABBREV = [
     "--junit-xml",
     "--cache-dir",
     "--install-types",
-    // A mypy config file can set `plugins = /path/to/plugin.py`, which mypy
-    // IMPORTS (executes) — an arbitrary `--config-file` is a code-exec escape
-    // (Fable review 2026-07-17). A reviewer uses the workspace mypy.ini.
+    // A mypy config file can import plugins, so an arbitrary --config-file is a
+    // code-execution escape; normal checks use the workspace mypy.ini.
     "--config-file",
     "--any-exprs-report",
     "--cobertura-xml-report",
@@ -203,9 +167,8 @@ function matchesAbbreviatedFlag(args, flags) {
     });
 }
 /**
- * Read-only tools that bypass the rescue allowlist entirely. Mirrors
- * the broader `READ_ONLY_TOOLS` in approval-policy.ts plus rescue's
- * historical "no harm done" defaults.
+ * Direct-read bypass for rescue. Keep this set identical to READ_ONLY_TOOLS in
+ * approval-policy.ts; the deliberate duplication must be updated in both places.
  */
 const RESCUE_READ_ONLY_TOOLS = new Set([
     "Read",
@@ -218,17 +181,9 @@ const RESCUE_READ_ONLY_TOOLS = new Set([
 /**
  * Evaluate a PreToolUse hook request under the rescue policy.
  *
- * Replaces the v0.4 `createRescueApprovalPolicy` factory. The new entry
- * is a single async function so the hook script can call it directly
- * without juggling a factory + a closure.
- *
- * Inputs come from kimi-code's hook stdin:
- *   - `workspaceRoot`: the plugin-owned trusted root — the per-spawn
- *     `KIMI_PLUGIN_CC_WORKSPACE_ROOT` the hook entry passes through, NEVER the
- *     hook payload's top-level `cwd` (at kimi-code 0.42.0 that field is the
- *     process cwd, and the model cannot forge an env var on its own process)
- *   - `toolName`: e.g. `Bash`, `Write`, `Edit`, `MultiEdit`, etc.
- *   - `toolInput`: the raw arguments kimi will pass to the tool
+ * `workspaceRoot` is the plugin-owned KIMI_PLUGIN_CC_WORKSPACE_ROOT passed by
+ * the hook entry, never the payload cwd; the model cannot forge that per-spawn
+ * environment value. `toolName` and `toolInput` are the raw upstream tool call.
  */
 export async function evaluateRescueHookRequest(workspaceRoot, toolName, toolInput) {
     if (RESCUE_READ_ONLY_TOOLS.has(toolName)) {
@@ -326,38 +281,21 @@ function extractBashCommand(toolInput) {
 function extractFilePath(toolInput) {
     if (!isObject(toolInput))
         return null;
-    // kimi-code's Write/Edit tools name the path field `path`
-    // (packages/agent-core/src/tools/builtin/file/{write,edit}.ts:
-    // z.object({ path: ... })) — NOT `file_path` (the Anthropic/Claude Code
-    // convention). The original `file_path`-only read meant EVERY real Write/Edit
-    // was denied with "no path field" (fail-closed but broken) for rescue/pursue/
-    // swarm-write — invisible to the unit tests, which all mock `file_path`, and
-    // only caught once the write-swarm real-binary smoke landed (v1.4.1). Prefer
-    // the kimi-code key; accept `file_path` too for forward/backward compat.
+    // kimi-code Write/Edit/MultiEdit call this field `path`, not Claude Code's
+    // `file_path`. Prefer the native key and accept the alias for compatibility.
     const candidate = toolInput.path ?? toolInput.file_path;
     return typeof candidate === "string" && candidate.length > 0 ? candidate : null;
 }
 function isObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-// ---------------------------------------------------------------------
-// Internal helpers — verbatim from v0.4 rescue-approval.ts. The bug
-// history that motivates each subtle check (e.g. git pre-subcommand
-// flags, sed -i.bak suffix, shell-quote pipeline collapse, .git
-// containment check) is documented inline and must NOT be removed.
-// ---------------------------------------------------------------------
 /**
- * TOCTOU note: this check runs at hook time, BEFORE kimi-code actually
- * writes the file. Between our allow decision and the write, an
- * attacker with workspace write access could swap the path with a
- * symlink that escapes the workspace. v0.4 had the same window (the
- * wire approval policy fired at the same point in time). Closing the
- * window would require either an open-by-fd dance under kimi-code's
- * Write tool (not available) or a recheck immediately before the
- * write (also unavailable to plugin code). The practical mitigation
- * is to trust the workspace's existing write controls — anything
- * able to swap a symlink can already mutate workspace files directly,
- * and rescue is intentionally write-capable.
+ * TOCTOU residual: this check runs before kimi-code writes. An attacker with
+ * workspace write access could replace the approved path with an escaping
+ * symlink before that write. The plugin cannot open-by-fd or recheck inside the
+ * Write tool, so the explicit trust boundary is the workspace's existing write
+ * controls: such an attacker can already mutate workspace files directly, and
+ * rescue is intentionally write-capable.
  */
 export async function checkApprovedPath(workspaceRoot, rawTargetPath) {
     const absoluteTarget = path.isAbsolute(rawTargetPath)
@@ -480,10 +418,9 @@ export function validateShellStage(tokens, pipelineMode) {
                 reason: `Rescue rejects git pre-subcommand flags (e.g. -c/-C/-p/--no-pager/--exec-path): ${tokens.join(" ")}. Put the read-only subcommand immediately after \`git\`.`,
             };
         }
-        // `git grep -O[<cmd>]` / `--open-files-in-pager[=<cmd>]` runs <cmd> as the
-        // pager (report 43 F1, CRITICAL RCE). The long form is caught by the
-        // global exec-delegating check above; the `-O` short form collides with
-        // `find -O<level>` so it is rejected here, git-locally.
+        // git grep -O/--open-files-in-pager executes its pager value. The long form
+        // is caught globally; reject -O here because find uses that spelling for a
+        // read-only optimization level.
         if (args.some((arg) => arg === "-O" || /^-O./.test(arg))) {
             return {
                 ok: false,
@@ -505,7 +442,7 @@ export function validateShellStage(tokens, pipelineMode) {
     if (command === "tsc") {
         // tsc option names are case-INSENSITIVE (compiler lowercases them), so match
         // lowercased. `--noemit`/`--noEmit` both suppress JS emit; `--outdir` is the
-        // same write flag as `--outDir` (Opus review 2026-07-17).
+        // same write flag as `--outDir`.
         const tscLowerNames = args.map((arg) => {
             const eq = arg.indexOf("=");
             return (eq === -1 ? arg : arg.slice(0, eq)).toLowerCase();
@@ -514,7 +451,7 @@ export function validateShellStage(tokens, pipelineMode) {
             return { ok: false, reason: "Rescue allows tsc only with --noEmit." };
         }
         // --noEmit suppresses JS emit but NOT the profile/trace/buildinfo/declaration
-        // writers, which write to arbitrary paths (verified 2026-07-17).
+        // writers, which write to arbitrary paths.
         if (tscLowerNames.some((name) => TSC_WRITE_FLAGS_LC.has(name))) {
             return {
                 ok: false,
@@ -527,9 +464,8 @@ export function validateShellStage(tokens, pipelineMode) {
         if (args[0] !== "check") {
             return { ok: false, reason: "Rescue allows biome only in check mode." };
         }
-        // biome check applies fixes with any --apply/--write/--fix variant, incl. the
-        // -unsafe/-only suffixes that dodge the global exact/prefix mutating-flag set
-        // (--apply is caught globally, --apply-unsafe is not). Verified 2026-07-17.
+        // biome check applies fixes for every --apply/--write/--fix variant,
+        // including -unsafe/-only suffixes missed by the global mutating-flag set.
         if (args.some((arg) => /^--(apply|write|fix)/.test(arg))) {
             return {
                 ok: false,
@@ -573,7 +509,7 @@ export function validateShellStage(tokens, pipelineMode) {
             return { ok: false, reason: `Rescue rejects cargo subcommand: ${tokens.join(" ")}` };
         }
         // --target-dir/--out-dir redirect the whole artifact tree to an arbitrary
-        // path outside the workspace (verified 2026-07-17).
+        // path outside the workspace.
         if (hasFlagFromSet(args, CARGO_WRITE_FLAGS)) {
             return {
                 ok: false,
@@ -586,9 +522,8 @@ export function validateShellStage(tokens, pipelineMode) {
         if (!GO_SUBCOMMANDS.has(args[0] ?? "")) {
             return { ok: false, reason: `Rescue rejects go subcommand: ${tokens.join(" ")}` };
         }
-        // `go build -o PATH` / `go test -c -o PATH` write a binary to an
-        // arbitrary path (report 43 F3). -vettool / -exec / -toolexec are caught
-        // by the global exec-delegating check above.
+        // go build/test -o writes a binary to an arbitrary path. Exec-delegating
+        // -vettool/-exec/-toolexec values are already rejected globally.
         if (hasWriteShortFlag(args)) {
             return {
                 ok: false,
@@ -596,7 +531,7 @@ export function validateShellStage(tokens, pipelineMode) {
             };
         }
         // Profile/trace/output-dir flags on `go test`/`go build` write to arbitrary
-        // paths without `-o` (verified 2026-07-17).
+        // paths without `-o`.
         if (hasFlagFromSet(args, GO_WRITE_FLAGS)) {
             return {
                 ok: false,
@@ -621,15 +556,11 @@ export function validateShellStage(tokens, pipelineMode) {
         return validatePackageManagerCommand(command, args);
     }
     if (command === "eslint") {
-        // ESLint's `-o` short form is `--output-file` — writes the lint
-        // report to an arbitrary path. The long form `--output-file=` is
-        // already caught by MUTATING_FLAG_PREFIXES; the short form needs an
-        // eslint-specific check because `-o` is a legitimate read flag in
-        // other tools (e.g. `rg -o` = --only-matching). Audit re-review
-        // (report 34 Codex HIGH) found this gap. `--fix` is also already
-        // in MUTATING_FLAGS_EXACT, so the eslint command surface is now
-        // read-only by construction.
-        // Match `-o` and the joined `-o<path>` spelling (eslint accepts both).
+        // Block ESLint's runner-owned report/cache paths. `-o` and joined
+        // `-o<path>` need a tool-specific check because rg/grep use `-o` read-only;
+        // the long --output-file form is already caught globally. These checks do
+        // not make linting read-only: project config and linter code still execute
+        // within rescue's repository trust boundary.
         if (args.some((arg) => arg === "-o" || /^-o./.test(arg))) {
             return {
                 ok: false,
@@ -637,7 +568,7 @@ export function validateShellStage(tokens, pipelineMode) {
             };
         }
         // --output-file (long form) is caught globally; --cache-location writes the
-        // cache tree to an arbitrary path (verified 2026-07-17).
+        // cache tree to an arbitrary path.
         if (hasFlagFromSet(args, ESLINT_WRITE_FLAGS)) {
             return {
                 ok: false,
@@ -645,7 +576,7 @@ export function validateShellStage(tokens, pipelineMode) {
             };
         }
         // --parser/--rulesdir/--resolve-plugins-relative-to LOAD AND EXECUTE a module
-        // from the given path (Fable review 2026-07-17) — a code-exec escape.
+        // from the given path — a code-exec escape.
         if (hasFlagFromSet(args, ESLINT_CODELOAD_FLAGS)) {
             return {
                 ok: false,
@@ -655,10 +586,9 @@ export function validateShellStage(tokens, pipelineMode) {
         return { ok: true };
     }
     if (command === "mypy") {
-        // mypy runs no repo code, but writes reports/cache to arbitrary paths and can
-        // pip-install. Matched abbreviation-aware because argparse allow_abbrev lets
-        // `--jun`→--junit-xml, `--html-rep`→--html-report, `--cache-di`→--cache-dir
-        // (verified 2026-07-17).
+        // By default mypy does not execute repo code, but --config-file can import
+        // plugins and is denied below. Block report/cache/install outputs and their
+        // argparse allow_abbrev prefixes.
         if (matchesAbbreviatedFlag(args, MYPY_WRITE_FLAGS_ABBREV)) {
             return {
                 ok: false,
@@ -668,9 +598,8 @@ export function validateShellStage(tokens, pipelineMode) {
         return { ok: true };
     }
     if (command === "pytest") {
-        // pytest executes repo code by design (documented trust boundary, report
-        // 43 F4); block only its file-writing report flags so it can't write
-        // outside the workspace.
+        // pytest executes repo code by design. Block its known runner-owned report
+        // flags, not every write that test code itself can perform.
         if (hasPytestReportFlag(args)) {
             return {
                 ok: false,
@@ -683,8 +612,8 @@ export function validateShellStage(tokens, pipelineMode) {
         return { ok: true };
     }
     if (pipelineMode && PIPELINE_PLUMBING.has(command)) {
-        // `sort -o FILE` writes anywhere (report 43 F2); `uniq IN OUT` writes its
-        // second positional. Piped plumbing reads stdin → it needs neither.
+        // sort -o and uniq's second positional are output writes, unnecessary for
+        // pipeline stages that read stdin.
         if (hasWriteShortFlag(args) || args.includes("--output")) {
             return {
                 ok: false,
@@ -718,7 +647,6 @@ export function validateShellStage(tokens, pipelineMode) {
     }
     return { ok: false, reason: `Rescue rejects shell command: ${tokens.join(" ")}` };
 }
-/** Thrown by `throwingExpansionEnv` when the parser resolves a real variable. */
 class ShellExpansionError extends Error {
 }
 /**
@@ -741,8 +669,7 @@ function throwingExpansionEnv(key) {
  * smuggled flag from every per-flag check:
  *   - `${VAR:-flag}` collapsed to an empty token (no `:-`-default modelling), and
  *   - `$IFS`-gluing (`rg x$IFS--pre$IFS'sh'` → one token here, but bash splits it
- *     into `rg x --pre sh` — an RCE). The word-boundary regex this replaced
- *     missed the glued form because `$` was preceded by a letter, not whitespace.
+ *     into `rg x --pre sh` — an RCE).
  * A malformed substitution (`${}`, unterminated) throws a plain parser Error;
  * that is itself unsafe to pass through, so any throw ⇒ unsafe (fail closed).
  */
@@ -854,14 +781,11 @@ function scanUnsafeUnquoted(command) {
     return false;
 }
 /**
- * Keystone syntax gate — runs BEFORE the per-flag allowlist in
- * `validateShellCommand`. Rejects any shell construct that bash would expand,
- * substitute, or split in a way the vendored shell-quote parser does NOT model,
- * because such a divergence smuggles a flag/command past every downstream check.
- * Two complementary, quote-aware passes: `scanUnsafeUnquoted` (backticks,
- * command/process substitution, `$'…'`/`$"…"` openers, brace expansion) and
- * `hasShellExpansion` (`$VAR`/`${…}` parameter expansion, incl. `$IFS`-gluing and
- * `${VAR:-flag}`). Verified against a bypass + false-positive battery 2026-07-17.
+ * Syntax gate before the per-flag allowlist. Reject the expansion/substitution
+ * classes shell-quote does not model: backticks, command/process substitution,
+ * `$'…'`/`$"…"` openers, brace expansion, and `$VAR`/`${…}` parameter expansion
+ * including `$IFS` gluing and default-value forms. Two complementary quote-aware
+ * passes prevent these forms from smuggling flags or commands downstream.
  */
 export function hasUnsafeShellSyntax(command) {
     return scanUnsafeUnquoted(command) || hasShellExpansion(command);
@@ -883,20 +807,15 @@ export function hasMutatingFlag(args) {
     }
     return false;
 }
-/**
- * True if any arg is a flag whose value is executed as a command/tool.
- * Rejected for every command (report 43 F1/F3).
- */
+/** True if any argument delegates execution to a command or external tool. */
 export function hasExecDelegatingFlag(args) {
     return args.some((arg) => EXEC_DELEGATING_FLAGS_EXACT.has(arg) ||
         EXEC_DELEGATING_FLAG_PREFIXES.some((prefix) => arg.startsWith(prefix)));
 }
 /**
- * True if any arg is the bare `-o` short form (`-o`, `-ofile`, `-o=file`),
- * the "write output to file" flag for go / sort / ruff. NOT banned globally:
- * `rg -o` / `grep -o` (--only-matching) are read-only, so this is applied
- * per-tool where `-o` writes a file (report 43 F2/F3/F5). The long
- * `--output*` forms are already covered by MUTATING_FLAG_PREFIXES.
+ * Per-tool check for `-o`, joined `-ofile`, and `-o=file` where that flag writes
+ * output (go, sort, ruff, and ESLint). It is not global because rg/grep use `-o`
+ * for read-only matching. Long --output forms are covered by the mutating set.
  */
 export function hasWriteShortFlag(args) {
     return args.some((arg) => arg === "-o" || /^-o./.test(arg));
@@ -906,7 +825,7 @@ export function hasWriteShortFlag(args) {
  * cluster (`-rT DIR`, `-ro FILE`) the plain `-o` check misses. getopt consumes a
  * cluster left to right; the first argument-taking option grabs the rest as its
  * value, so an `o`/`T` AFTER a `-t`/`-k`/`-S` (sort's other arg-taking options)
- * is that option's value, not a write flag. (Opus review 2026-07-17.)
+ * is that option's value, not a write flag.
  */
 function sortShortClusterWrites(token) {
     if (token.length < 2 || token[0] !== "-" || token[1] === "-")
@@ -924,15 +843,10 @@ function hasPytestReportFlag(args) {
     return matchesAbbreviatedFlag(args, PYTEST_REPORT_FLAGS);
 }
 export function validatePackageManagerCommand(command, args) {
-    // Direct `<pm> test` is the test-runner shorthand. Like `pytest`/`go test`/
-    // `cargo test`, it EXECUTES repo code by design (the package.json "test"
-    // script) — the SAME documented trust boundary (docs/safety.md): a test runner
-    // in a write-capable rescue/pursue run can already run arbitrary repo code, so
-    // rejecting `test` would only cripple the expected surface without adding
-    // safety. `run <arbitrary-script>` below is different: it is a fully general
-    // script executor (dev/deploy/publish), not a test entry point, so it stays
-    // rejected. (Fable review 2026-07-17 flagged the `test`/`run` asymmetry — this
-    // is the deliberate resolution, not an oversight.)
+    // Direct <pm> test executes the repository's test script by design, like
+    // pytest/go test/cargo test, and remains inside the documented test-runner
+    // trust boundary. `run <arbitrary-script>` is instead a general script
+    // executor (dev/deploy/publish), so this deliberate test/run asymmetry stays.
     if (args[0] === "test") {
         return { ok: true };
     }

package/plugins/kimi-codex/dist/session-recovery.js

@@ -2,16 +2,13 @@ import { constants } from "node:fs";
 import { lstat, open, opendir, realpath } from "node:fs/promises";
 import path from "node:path";
 import { digestPrompt } from "./jobs.js";
-// Total entries visited across both enumeration levels. A real store holds a
-// few thousand sessions (2,494 entries on the reference host when this was
-// written, growing by one per plugin run), so the preflight's 4,096 would have
-// switched recovery off within months; the cap is a guard against a
-// pathological tree, not a size budget. opendir streams, nothing is buffered.
-// Dot-entries (`.index-dirty`, `.index-cache`) are upstream index state, never
-// workspaces, and are skipped without being counted. Directories whose mtime
-// predates the spawn cannot have been created by this run and are skipped
-// before any read, so the byte budget scales with concurrent activity, not
-// with store size.
+// Total entries visited across both enumeration levels. The cap guards against
+// a pathological tree rather than budgeting normal store size. opendir streams,
+// so entries are not buffered. Dot-entries (`.index-dirty`, `.index-cache`) are
+// upstream index state, never workspaces, and are skipped without being counted.
+// Directories whose mtime predates the spawn cannot have been created by this
+// run and are skipped before any read, so the byte budget scales with concurrent
+// activity, not with store size.
 const DIR_ENUM_CAP = 65_536;
 const STATE_MAX_BYTES = 1024 * 1024;
 const JOURNAL_PREFIX_BYTES = 4 * 1024 * 1024; // The prompt is argv-bounded (< 1 MiB); the first user message follows a few config records.