kimi-plugin-cc 2.3.1 → 2.4.0

package/dist/mcp/protocol.js

@@ -0,0 +1,275 @@
+import { formatError, RuntimeError } from "../errors.js";
+import { KIMI_PLUGIN_CC_VERSION } from "../version.js";
+import { cancelMcpJob, getMcpJobResult, getMcpJobStatus, getMcpTaskView } from "./job-control.js";
+import { launchMcpOperation } from "./launcher.js";
+import { buildMcpOperationInvocation, isMcpModelToolName, MCP_TOOL_DEFINITIONS, } from "./operations.js";
+import { textResult } from "./tool-result.js";
+const MODERN_VERSION = "2026-07-28";
+const LEGACY_VERSIONS = new Set(["2024-11-05", "2025-03-26", "2025-06-18", "2025-11-25"]);
+const PROTOCOL_VERSION_META = "io.modelcontextprotocol/protocolVersion";
+const CLIENT_INFO_META = "io.modelcontextprotocol/clientInfo";
+const CLIENT_CAPABILITIES_META = "io.modelcontextprotocol/clientCapabilities";
+const TASKS_EXTENSION = "io.modelcontextprotocol/tasks";
+const SERVER_INFO_META = "io.modelcontextprotocol/serverInfo";
+export function createMcpMessageHandler(env) {
+    let mode;
+    return async (message) => {
+        let requestId = isRecord(message) && "id" in message &&
+            (typeof message.id === "string" || typeof message.id === "number" || message.id === null)
+            ? message.id
+            : null;
+        try {
+            const request = parseRequest(message);
+            if (!request)
+                return undefined;
+            requestId = request.id;
+            const { id, method, params } = request;
+            if (method === "server/discover") {
+                requireModernMetadata(params);
+                mode = "modern";
+                return response(id, {
+                    resultType: "complete",
+                    supportedVersions: [MODERN_VERSION],
+                    capabilities: { tools: {}, extensions: { [TASKS_EXTENSION]: {} } },
+                    _meta: { [SERVER_INFO_META]: { name: "kimi-plugin-cc", version: KIMI_PLUGIN_CC_VERSION } },
+                    ttlMs: 0,
+                    cacheScope: "private",
+                });
+            }
+            if (method === "initialize") {
+                const requested = params.protocolVersion;
+                if (typeof requested !== "string" || !LEGACY_VERSIONS.has(requested)) {
+                    throw rpcError(-32_602, "Unsupported protocol version", { supportedVersions: [...LEGACY_VERSIONS] });
+                }
+                mode = "legacy";
+                return response(id, {
+                    protocolVersion: requested,
+                    capabilities: { tools: {} },
+                    serverInfo: { name: "kimi-plugin-cc", version: KIMI_PLUGIN_CC_VERSION },
+                });
+            }
+            if (method === "notifications/initialized")
+                return undefined;
+            if (method.startsWith("notifications/"))
+                return undefined;
+            if (!mode && hasModernVersion(params))
+                mode = "modern";
+            if (!mode)
+                throw rpcError(-32_002, "Server is not initialized");
+            const modern = requireProtocolMode(mode, method);
+            const capabilities = modern ? requireModernMetadata(params) : undefined;
+            switch (method) {
+                case "ping":
+                    return response(id, modern ? { resultType: "complete" } : {});
+                case "tools/list":
+                    return response(id, modern
+                        ? { resultType: "complete", tools: MCP_TOOL_DEFINITIONS, ttlMs: 0, cacheScope: "private" }
+                        : { tools: MCP_TOOL_DEFINITIONS });
+                case "tools/call":
+                    return response(id, await callTool(env, params, modern, capabilities));
+                case "tasks/get": {
+                    requireModern(method, modern);
+                    requireTasksCapability(method, capabilities);
+                    const taskId = requiredTaskId(params);
+                    try {
+                        const view = await getMcpTaskView(env, { job_id: taskId });
+                        return response(id, { resultType: "complete", ...view });
+                    }
+                    catch (error) {
+                        if (error instanceof RuntimeError && error.code === "JOB_NOT_FOUND") {
+                            throw rpcError(-32_602, `Unknown task ID: ${taskId}`);
+                        }
+                        throw error;
+                    }
+                }
+                case "tasks/cancel": {
+                    requireModern(method, modern);
+                    requireTasksCapability(method, capabilities);
+                    const taskId = requiredTaskId(params);
+                    try {
+                        await cancelMcpJob(env, { job_id: taskId });
+                        return response(id, { resultType: "complete" });
+                    }
+                    catch (error) {
+                        if (error instanceof RuntimeError && error.code === "JOB_NOT_FOUND") {
+                            throw rpcError(-32_602, `Unknown task ID: ${taskId}`);
+                        }
+                        throw error;
+                    }
+                }
+                default:
+                    throw rpcError(-32_601, `Method not found: ${method}`);
+            }
+        }
+        catch (error) {
+            if (isRpcError(error))
+                return response(requestId, undefined, error);
+            if (error instanceof RuntimeError) {
+                return response(requestId, undefined, rpcError(-32_603, formatError(error), error.details));
+            }
+            return response(requestId, undefined, rpcError(-32_603, error instanceof Error ? error.message : String(error)));
+        }
+    };
+}
+async function callTool(env, params, modern, capabilities) {
+    const name = params.name;
+    if (typeof name !== "string")
+        throw rpcError(-32_602, "tools/call requires a tool name");
+    try {
+        let result;
+        if (isMcpModelToolName(name)) {
+            const launched = await launchMcpOperation(buildMcpOperationInvocation(name, params.arguments), env);
+            if (modern && hasTasksCapability(capabilities))
+                return taskHandle(launched);
+            result = launched.job.status === "running"
+                ? launchResult(launched)
+                : await getMcpJobResult(env, { job_id: launched.task.task_id });
+        }
+        else {
+            switch (name) {
+                case "kimi_job_status":
+                    result = await getMcpJobStatus(env, params.arguments);
+                    break;
+                case "kimi_job_result":
+                    result = await getMcpJobResult(env, params.arguments);
+                    break;
+                case "kimi_job_cancel":
+                    result = await cancelMcpJob(env, params.arguments);
+                    break;
+                default:
+                    throw rpcError(-32_602, `Unknown tool: ${name}`);
+            }
+        }
+        return modern ? { resultType: "complete", ...result } : result;
+    }
+    catch (error) {
+        if (isRpcError(error))
+            throw error;
+        if (error instanceof RuntimeError) {
+            const result = textResult(formatError(error), {
+                error: { code: error.code, stage: error.stage, details: error.details },
+            }, true);
+            return modern ? { resultType: "complete", ...result } : result;
+        }
+        throw error;
+    }
+}
+function launchResult(launched) {
+    const { task, job } = launched;
+    const metadata = {
+        job_id: task.task_id,
+        operation_kind: task.operation_kind,
+        workspace: task.workspace_cwd,
+        status: job.status,
+        phase: job.phase,
+        created_at: task.created_at,
+    };
+    return textResult(`Started ${task.operation_kind} job ${task.task_id}. This is a launch handle, not the finished answer. Use kimi_job_status and kimi_job_result with this job_id until the job is terminal; use kimi_job_cancel to stop it.`, metadata);
+}
+function taskHandle({ task, job }) {
+    return {
+        resultType: "task",
+        taskId: task.task_id,
+        status: job.status === "running" ? "working" : job.status === "cancelled" ? "cancelled" : "completed",
+        ...(job.status === "running" ? { statusMessage: `${task.operation_kind}: ${job.phase ?? "running"}` } : job.summary ? { statusMessage: job.summary } : {}),
+        createdAt: task.created_at,
+        lastUpdatedAt: job.updated_at,
+        ttlMs: null,
+        pollIntervalMs: 2_000,
+    };
+}
+function parseRequest(message) {
+    if (!isRecord(message))
+        throw new McpJsonRpcError(-32_600, "Invalid JSON-RPC request");
+    if (!("method" in message))
+        return undefined;
+    if (message.jsonrpc !== "2.0" || typeof message.method !== "string" || message.method.length === 0) {
+        throw new McpJsonRpcError(-32_600, "Invalid JSON-RPC request");
+    }
+    if (!("id" in message))
+        return undefined;
+    const id = message.id;
+    if (id !== null && typeof id !== "string" &&
+        (typeof id !== "number" || !Number.isFinite(id))) {
+        throw new McpJsonRpcError(-32_600, "Invalid JSON-RPC request ID");
+    }
+    const params = message.params === undefined ? {} : message.params;
+    if (!isRecord(params))
+        throw new McpJsonRpcError(-32_602, "Request params must be an object");
+    return { id, method: message.method, params };
+}
+function requireProtocolMode(mode, method) {
+    if (mode === "modern")
+        return true;
+    if (method === "tasks/get" || method === "tasks/cancel") {
+        throw new McpJsonRpcError(-32_601, `Method not found: ${method}`);
+    }
+    return false;
+}
+function requireModern(method, modern) {
+    if (!modern)
+        throw new McpJsonRpcError(-32_601, `Method not found: ${method}`);
+}
+function hasModernVersion(params) {
+    return isRecord(params._meta) && params._meta[PROTOCOL_VERSION_META] === MODERN_VERSION;
+}
+function requireModernMetadata(params) {
+    const meta = params._meta;
+    if (!meta || typeof meta !== "object" || Array.isArray(meta)) {
+        throw new McpJsonRpcError(-32_602, "Modern MCP requests require protocol metadata");
+    }
+    const record = meta;
+    if (record[PROTOCOL_VERSION_META] !== MODERN_VERSION) {
+        throw new McpJsonRpcError(-32_022, "Unsupported protocol version", {
+            supported: [MODERN_VERSION],
+            requested: record[PROTOCOL_VERSION_META],
+        });
+    }
+    if (record[CLIENT_INFO_META] !== undefined && !isRecord(record[CLIENT_INFO_META])) {
+        throw new McpJsonRpcError(-32_602, "clientInfo must be an object when supplied");
+    }
+    if (!isRecord(record[CLIENT_CAPABILITIES_META])) {
+        throw new McpJsonRpcError(-32_602, "Modern MCP requests require client capabilities");
+    }
+    return record[CLIENT_CAPABILITIES_META];
+}
+function hasTasksCapability(capabilities) {
+    if (!capabilities || !isRecord(capabilities.extensions))
+        return false;
+    return isRecord(capabilities.extensions[TASKS_EXTENSION]);
+}
+function requireTasksCapability(method, capabilities) {
+    if (!hasTasksCapability(capabilities)) {
+        throw new McpJsonRpcError(-32_021, "Missing required client capability", {
+            requiredCapabilities: { extensions: { [TASKS_EXTENSION]: {} } },
+        });
+    }
+}
+function requiredTaskId(params) {
+    if (typeof params.taskId !== "string" || params.taskId.length === 0 || params.taskId.length > 128 || !/^[\x21-\x7e]+$/.test(params.taskId)) {
+        throw new McpJsonRpcError(-32_602, "taskId must be 1-128 printable ASCII characters without spaces");
+    }
+    return params.taskId;
+}
+function response(id, result, error) {
+    return error ? { jsonrpc: "2.0", id, error: { code: error.code, message: error.message, ...(error.data !== undefined ? { data: error.data } : {}) } } : { jsonrpc: "2.0", id, result };
+}
+function rpcError(code, message, data) {
+    return new McpJsonRpcError(code, message, data);
+}
+class McpJsonRpcError extends Error {
+    code;
+    data;
+    constructor(code, message, data) {
+        super(message);
+        this.code = code;
+        this.data = data;
+        this.name = "McpJsonRpcError";
+    }
+}
+function isRpcError(error) {
+    return error instanceof McpJsonRpcError || (error instanceof Error && "code" in error && typeof error.code === "number");
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}

package/dist/mcp/server.js

@@ -0,0 +1,8 @@
+import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
+import { createMcpMessageHandler } from "./protocol.js";
+import { serveMcpStdio } from "./stdio.js";
+export async function runMcpServer(context) {
+    const paths = resolvePluginPaths(context.env);
+    await ensurePluginPaths(paths);
+    await serveMcpStdio(process.stdin, process.stdout, createMcpMessageHandler(context.env));
+}

package/dist/mcp/stdio.js

@@ -0,0 +1,78 @@
+const MAX_MESSAGE_BYTES = 8 * 1024 * 1024;
+export async function serveMcpStdio(input, output, handle) {
+    let buffer = Buffer.alloc(0);
+    let writeTail = Promise.resolve();
+    let writeError;
+    const pending = new Set();
+    output.on("error", (error) => { writeError ??= error; });
+    const write = (message) => {
+        if (writeError)
+            return Promise.reject(writeError);
+        const frame = `${JSON.stringify(message)}\n`;
+        writeTail = writeTail.then(() => new Promise((resolve, reject) => {
+            try {
+                if (output.write(frame))
+                    resolve();
+                else
+                    output.once("drain", resolve);
+            }
+            catch (error) {
+                reject(error);
+            }
+        }));
+        return writeTail;
+    };
+    const track = (promise) => {
+        const tracked = promise.catch((error) => { writeError ??= error; }).finally(() => pending.delete(tracked));
+        pending.add(tracked);
+    };
+    try {
+        for await (const chunk of input) {
+            buffer = Buffer.concat([buffer, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]);
+            for (;;) {
+                const newline = buffer.indexOf(0x0a);
+                if (newline < 0)
+                    break;
+                const line = buffer.subarray(0, newline);
+                buffer = buffer.subarray(newline + 1);
+                if (line.length > MAX_MESSAGE_BYTES)
+                    throw new Error("MCP frame exceeds 8 MiB");
+                if (line.toString("utf8").trim().length === 0)
+                    continue;
+                let parsed;
+                try {
+                    parsed = JSON.parse(line.toString("utf8"));
+                }
+                catch {
+                    track(write({ jsonrpc: "2.0", id: null, error: { code: -32_700, message: "Parse error" } }));
+                    continue;
+                }
+                track((async () => {
+                    try {
+                        const response = await handle(parsed);
+                        if (response !== undefined)
+                            await write(response);
+                    }
+                    catch (error) {
+                        await write({
+                            jsonrpc: "2.0",
+                            id: null,
+                            error: { code: -32_603, message: error instanceof Error ? error.message : String(error) },
+                        });
+                    }
+                })());
+            }
+            if (buffer.length > MAX_MESSAGE_BYTES)
+                throw new Error("MCP frame exceeds 8 MiB");
+        }
+    }
+    catch (error) {
+        await write({ jsonrpc: "2.0", id: null, error: { code: -32_700, message: error instanceof Error ? error.message : String(error) } });
+    }
+    finally {
+        await Promise.all(pending);
+        await writeTail;
+        if (writeError)
+            throw writeError;
+    }
+}

package/dist/mcp/supervised-child.js

@@ -0,0 +1,15 @@
+import { RuntimeError } from "../errors.js";
+import { allocateJobId } from "../job-id.js";
+import { runModelCommand } from "../model-command.js";
+export async function runMcpChild(argv, context) {
+    const [jobId, ...command] = argv;
+    if (!jobId || command.length === 0) {
+        throw new RuntimeError("MCP_INVALID_CHILD", "mcp-child expects a job UUID followed by one model operation.", "mcp.child");
+    }
+    const mcpJobId = allocateJobId({ ...context, mcpJobId: jobId });
+    const result = await runModelCommand(command, { ...context, mcpJobId });
+    if (result === undefined) {
+        throw new RuntimeError("MCP_INVALID_CHILD", "mcp-child accepts only the public model operations.", "mcp.child");
+    }
+    return result;
+}

package/dist/mcp/tool-result.js

@@ -0,0 +1,7 @@
+export function textResult(text, structuredContent, isError = false) {
+    return {
+        content: [{ type: "text", text }],
+        ...(structuredContent ? { structuredContent } : {}),
+        isError,
+    };
+}

package/dist/mcp/workspace.js

@@ -0,0 +1,34 @@
+import { realpath, stat } from "node:fs/promises";
+import path from "node:path";
+import { RuntimeError } from "../errors.js";
+import { resolveRepoIdentity } from "../git.js";
+export async function resolveMcpWorkspace(env, requested) {
+    const defaultCandidate = env.KIMI_PLUGIN_CC_MCP_WORKSPACE;
+    const candidate = requested ?? defaultCandidate;
+    if (!candidate) {
+        throw new RuntimeError("MCP_WORKSPACE_REQUIRED", "This MCP server has no default workspace. Supply the absolute workspace directory explicitly; Codex calls normally require it.", "mcp.workspace");
+    }
+    const cwd = await canonicalDirectory(candidate, "workspace");
+    if (defaultCandidate) {
+        const defaultCwd = await canonicalDirectory(defaultCandidate, "host workspace");
+        const relative = path.relative(defaultCwd, cwd);
+        if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+            throw new RuntimeError("MCP_WORKSPACE_OUTSIDE_DEFAULT", `workspace must be the host workspace or one of its descendants, not ${cwd} (host: ${defaultCwd}).`, "mcp.workspace");
+        }
+    }
+    return { cwd, repo: await resolveRepoIdentity(cwd) };
+}
+async function canonicalDirectory(candidate, label) {
+    if (!path.isAbsolute(candidate)) {
+        throw new RuntimeError("MCP_WORKSPACE_NOT_ABSOLUTE", `${label} must be an absolute existing directory.`, "mcp.workspace");
+    }
+    try {
+        const cwd = await realpath(candidate);
+        if (!(await stat(cwd)).isDirectory())
+            throw new Error("not a directory");
+        return cwd;
+    }
+    catch (error) {
+        throw new RuntimeError("MCP_WORKSPACE_INVALID", `${label} is not an accessible existing directory: ${candidate}`, "mcp.workspace", error instanceof Error ? { cause: error } : undefined);
+    }
+}

package/dist/model-command.js

@@ -0,0 +1,32 @@
+import { runAsk } from "./commands/ask.js";
+import { notImplementedCompanionCommand } from "./commands/not-implemented.js";
+import { runPursue } from "./commands/pursue.js";
+import { runRescue } from "./commands/rescue.js";
+import { runReview } from "./commands/review.js";
+import { runSwarm } from "./commands/swarm.js";
+export async function runModelCommand(argv, context) {
+    const [command, ...rest] = argv;
+    switch (command) {
+        case "review":
+            return `${await runReview(rest, context, "review")}\n`;
+        case "ask":
+            return `${await runAsk(rest, context)}\n`;
+        case "task": {
+            const [taskType, ...taskArgs] = rest;
+            switch (taskType) {
+                case "rescue":
+                    return runRescue(taskArgs, context);
+                case "challenge":
+                    return `${await runReview(taskArgs, context, "challenge")}\n`;
+                case "pursue":
+                    return runPursue(taskArgs, context);
+                case "swarm":
+                    return runSwarm(taskArgs, context);
+                default:
+                    notImplementedCompanionCommand(taskType ? `task ${taskType}` : "task");
+            }
+        }
+        default:
+            return undefined;
+    }
+}

package/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.3.1";
+export const KIMI_PLUGIN_CC_VERSION = "2.4.0";

package/docs/migration.md

@@ -1,6 +1,6 @@
 # Compatibility and upgrades
 
-For plugin 2.3.1, use Kimi Code CLI 2.3.1. The plugin certifies exact native-v2 versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, and `2.3.1` for all eight operations. It does not automatically accept later patches or minor releases. The npm distribution adds an installation channel; it does not change this compatibility table.
+For plugin 2.4.0, use Kimi Code CLI 2.3.1. The plugin certifies exact native-v2 versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, and `2.3.1` for all eight operations. It does not automatically accept later patches or minor releases. The npm distribution adds an installation channel; it does not change this compatibility table.
 
 Explicitly pinned legacy-v1 binaries remain supported within `KIMI_TESTED_MINORS`, through 0.41.x, subject to each operation's minimum version. The [runtime table](../runtime/kimi-engine.ts) is the authority.
 
@@ -8,7 +8,7 @@ Use the [README installation and update steps](../README.md) for Claude Code or
 
 ## Plugin versions and upgrades
 
-Plugin versions advance independently using ordinary SemVer and may deliberately align with a certified CLI release. Plugin 2.3.1 certifies CLI 2.3.1; the runtime table records that mapping. Published versions and tags are never reused. Every upstream patch requires its own certification. The native-v2 no-plan profile, plugin/marketplace IDs and existing job store are preserved.
+Plugin versions advance independently using ordinary SemVer and may deliberately align with a certified CLI release. Plugin 2.4.0 certifies CLI 2.3.1; the runtime table records that mapping. Published versions and tags are never reused. Every upstream patch requires its own certification. The native-v2 no-plan profile, plugin/marketplace IDs and existing job store are preserved.
 
 After updating the plugin, run Claude Code `/kimi:setup` or Codex `$kimi-setup`
 from that host's active install to re-pin its version-stamped hook path, then

package/docs/registry-releases.md

@@ -6,7 +6,7 @@ remain available. The package has no install scripts and no separate CLI.
 
 ## Publishing status
 
-The current release candidate is plugin **2.3.1**, certifying exact CLI **2.3.1**; publication is pending final repository and CI gates. See the [certification evidence](./upstream-2.3.1-certification.md).
+Plugin **2.3.1** certifies exact CLI **2.3.1**. [Release v2.3.1](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.3.1) is anchored at `20011ff0554c611afe0a426b30a68c2473175568`; its [CI check](https://github.com/linxule/kimi-plugin-cc/actions/runs/39977037533) and [release-event publishing run](https://github.com/linxule/kimi-plugin-cc/actions/runs/39977818482) passed. The registry tarball has SHA-1 `e309448480a2ce841b49840cdaeeed37acc6c50b`, contains 196 files, and matches the CI artifact byte-for-byte. See the [certification evidence](./upstream-2.3.1-certification.md).
 The previous verified publication was **2.2.2**:
 [Release v2.2.2](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.2.2)
 is anchored at `256e78ff7cbf302fb19e8e523d8e3f943f7cb366`; its
@@ -78,8 +78,9 @@ bun run check:package .tmp/npm
 
 The package check inspects the actual tarball, verifies runtime copies and
 vendored licenses, and installs/checks the safety hook in isolated homes for
-both hosts. It also exercises unsupported-version refusal using a fake CLI.
-It does not invoke a model or read the maintainer's Kimi configuration.
+both hosts. It also exercises unsupported-version refusal using a fake CLI and
+modern MCP discovery plus legacy initialization on both extracted compiled
+distributions. It does not invoke a model or read the maintainer's Kimi configuration.
 
 ## First publication (completed bootstrap reference)
 
@@ -119,8 +120,5 @@ release. `.github/workflows/publish.yml` runs on `release.published`; it checks
 the tag against `package.json`, runs the full gate and package smoke, then
 publishes the validated tarball through OIDC with provenance. The publish job
 has no source checkout or build scripts. A manual dispatch with an existing
-release tag is available for a first OIDC release or recovery after a verified
-publication failure. Check npm before retrying; released versions are immutable.
-
-A locally bootstrapped first version is already published: do not dispatch it
-again. The next release is the first OIDC publication.
+release tag is available for recovery after a verified publication failure.
+Check npm before retrying; released versions are immutable.

package/docs/safety.md

@@ -229,6 +229,20 @@ If another installed host still points to an older hook, that hook may veto thes
 - **Field-proven by a real-binary smoke.** `tests/runtime/real-binary-smoke.test.ts` runs the real `runSwarm --write` and asserts the POSITIVE end-to-end (a `coder` subagent's edits land in the worktree, captured as a patch; the user's real tree is byte-identical + git-clean; the worktree is cleaned up) plus the NEGATIVE (an absolute-path write outside the trusted root is hook-denied). It is the check that catches `tool_input` field-name drift — `Write`/`Edit` carry `path`, not `file_path`, and reading the wrong key denies every real write silently.
 - **Model-invocable agent (v1.5), patch-only by construction.** Following the field-proof above, `--write` now has a `kimi-swarm-write` subagent so the main thread can dispatch a write fan-out on its own judgement — the same human-command + model-invocable-agent split the rest of the suite uses. Auto-dispatch is a safe extension here because it widens **no** write surface and removes **no** bound: the agent path runs the identical `runSwarm --write` code, so edits still land only in the throwaway worktree, the managed hook still gates every `coder` subagent, the patch is still handed back for the user to apply (**the plugin never applies or commits**), and `--budget` + default `--max-concurrency` 1 + the hook requirement all still hold. In fact write-swarm is a *less* dangerous agent than the `kimi-pursue` agent already shipped: pursue writes directly into the workspace, whereas write-swarm's output is a patch the human reviews before anything reaches a real tree. Because it is still a write surface, the agent description demands BOTH signals — many disjoint write targets AND explicit fan-out intent — and steers single edits to `kimi-rescue`, read-only fan-outs to `kimi-swarm`, and autonomous loops to `kimi-pursue`. Default `--max-concurrency` stays **1**; raising it (concurrent writers) remains a deliberate, human-or-explicitly-requested choice.
 
+## MCP transport and long-running jobs
+
+The plugin also bundles an MCP stdio server for Claude Code and Codex. This is an additive transport, not a second execution engine or a way around the managed hook. The seven model tools run the same certified companion operations, exact-version checks, native-v2 preflight, workspace allowlists, finite budgets, and artifact rendering as the slash commands and skills. The review gate remains a separate Stop-hook feature.
+
+Claude Code task-capable calls return durable MCP task IDs and use `tasks/get` and `tasks/cancel`. Codex currently consumes ordinary MCP tool results, not this task extension: after attachment, model tools return a job handle when the job is still running or its terminal result when already settled. `kimi_job_status`, `kimi_job_result`, and `kimi_job_cancel` provide polling and cancellation. Do not describe the Codex path as native MCP tasks.
+
+Claude supplies its project directory as the default workspace. A configured host workspace is a containment boundary: an explicit workspace must be that directory or a descendant, not an arbitrary override. Codex calls normally supply an absolute `workspace` on the initial operation because its packaged stdio server runs from the plugin root; that explicit path is the operation's trust choice. Subsequent job control can use the persisted binding. Job controls manage only MCP-launched jobs, require the same canonical workspace and repository, and cannot inspect or cancel an arbitrary CLI job by ID.
+
+Attachment waits for the operation to install cancellation handlers, with a 60-second bound. Verified teardown can close a stalled launch; missing identity or inconclusive termination evidence keeps it starting and recoverable by ID. `kimi_pid` is recorded at actual spawn rather than inferred from a later process-list match.
+
+The MCP task/job ID is preassigned and bound to the job's real `operation_kind`, not merely its lineage. `mcp_tasks` stores launch and ownership metadata; the normal `jobs` table remains the outcome authority. Failed jobs, including budget timeouts, produce completed tasks with `isError:true` and the failed-job artifact, so partial output is not mistaken for a final answer. Supervisor and protocol failures are distinct from ordinary Kimi failures.
+
+Closing an MCP connection does not cancel work. A later server reopens the same store and resumes status/result handling by ID. Generic stale sweeps skip MCP-owned rows, and direct CLI cancellation refuses them; use MCP job controls for those jobs. Companion and observed Kimi-descendant identities include start tokens and process groups; MCP cancellation and stale cleanup revalidate them rather than signalling a recycled PID. Cancellation remains cooperative and does not roll back edits. Pursue teardown and write-swarm patch capture still run through the existing companion path; write-swarm captures its patch on every terminal path before removing the worktree.
+
 ## Response budgets and partial output (2.2.0)
 
 Every single-turn command runs under a wall-clock budget: ask, review and
@@ -265,9 +279,9 @@ at it (the runtime resolves that path instead of `kimi` on `PATH`; every spawn
 still exports `KIMI_CODE_NO_AUTO_UPDATE=1`, so the pinned copy never drifts).
 
 ```sh
-PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.2.0
+PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.3.1
 mkdir -p "$PIN" && cd "$PIN" && printf '{"name":"kimi-plugin-cc-pin","private":true}\n' > package.json
-bun add @moonshot-ai/kimi-code@2.2.0
+bun add @moonshot-ai/kimi-code@2.3.1
 export KIMI_PLUGIN_CC_KIMI_BIN="$PIN/node_modules/.bin/kimi"   # e.g. in ~/.zshenv
 ```
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.3.1",
-  "description": "Kimi for Claude Code and Codex: code questions, independent reviews, bounded fixes, autonomous goals, and parallel tasks through the local Kimi Code CLI.",
+  "version": "2.4.0",
+  "description": "Kimi for Claude Code and Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
   "type": "module",
   "engines": {
     "node": ">=22.5.0"
@@ -38,14 +38,18 @@
     "claude-code",
     "codex",
     "kimi",
+    "kimi-code",
     "plugin",
-    "code-review"
+    "code-review",
+    "mcp",
+    "model-context-protocol"
   ],
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
   "files": [
+    ".mcp.json",
     ".claude-plugin/",
     ".agents/plugins/marketplace.json",
     "agents/",

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi",
-  "version": "2.3.1",
-  "description": "Kimi for Codex: code questions, independent reviews, bounded fixes, autonomous goals, and parallel tasks through the local Kimi Code CLI.",
+  "version": "2.4.0",
+  "description": "Kimi for Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP job controls through the local Kimi Code CLI.",
   "author": {
     "name": "linxule"
   },
@@ -14,13 +14,16 @@
     "review",
     "code-review",
     "delegation",
-    "multi-model"
+    "multi-model",
+    "mcp",
+    "model-context-protocol"
   ],
   "skills": "./skills/",
+  "mcpServers": "./.mcp.json",
   "interface": {
     "displayName": "Kimi",
     "shortDescription": "Ask, review, and build with Kimi",
-    "longDescription": "Kimi Code workflows for Codex: read-only explanations and reviews, bounded workspace fixes, autonomous goals, and parallel tasks. Codex skills call a self-contained shell runtime; no MCP server is required.",
+    "longDescription": "Kimi Code workflows for Codex: read-only explanations and reviews, bounded workspace fixes, autonomous goals, and parallel tasks. Codex skills call a self-contained shell runtime, with MCP tools provided by the bundled server.",
     "developerName": "linxule",
     "category": "Developer Tools",
     "capabilities": [

package/plugins/kimi-codex/.mcp.json

@@ -0,0 +1,28 @@
+{
+  "mcpServers": {
+    "kimi": {
+      "type": "stdio",
+      "command": "./scripts/companion.sh",
+      "args": [
+        "mcp"
+      ],
+      "cwd": ".",
+      "env_vars": [
+        "KIMI_PLUGIN_CC_DATA",
+        "CLAUDE_PLUGIN_DATA",
+        "PLUGIN_DATA",
+        "KIMI_CODE_HOME",
+        "KIMI_PLUGIN_CC_KIMI_BIN",
+        "KIMI_PLUGIN_CC_KIMI_PREFIX_ARGS",
+        "KIMI_PLUGIN_CC_NODE_BIN",
+        "KIMI_PLUGIN_CC_HOOK_SCRIPT",
+        "KIMI_PLUGIN_CC_HOST_ID",
+        "KIMI_MODEL_NAME",
+        "KIMI_MODEL_API_KEY",
+        "KIMI_MODEL_PROVIDER_TYPE",
+        "KIMI_MODEL_BASE_URL",
+        "KIMI_MODEL_THINKING_EFFORT"
+      ]
+    }
+  }
+}