kimi-plugin-cc 2.3.1 → 2.4.1

package/.claude-plugin/marketplace.json

@@ -4,8 +4,8 @@
     "name": "linxule"
   },
   "metadata": {
-    "description": "Kimi for Claude Code: code questions, reviews, fixes, and parallel tasks through the local Kimi Code CLI.",
-    "version": "2.3.1"
+    "description": "Kimi for Claude Code: code questions, reviews, fixes, parallel tasks, and MCP tasks through the local Kimi Code CLI.",
+    "version": "2.4.1"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi",
-  "description": "Kimi for Claude Code: ask, review, challenge, rescue, pursue, and swarm through the local Kimi Code CLI, with per-command PreToolUse safety hooks and an optional Stop-hook review gate.",
-  "version": "2.3.1",
+  "description": "Kimi for Claude Code: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tasks through the local Kimi Code CLI, with PreToolUse safety hooks.",
+  "version": "2.4.1",
   "homepage": "https://github.com/linxule/kimi-plugin-cc",
   "repository": "https://github.com/linxule/kimi-plugin-cc",
   "license": "Apache-2.0",
@@ -11,7 +11,9 @@
     "review",
     "code-review",
     "delegation",
-    "multi-model"
+    "multi-model",
+    "mcp",
+    "model-context-protocol"
   ],
   "author": {
     "name": "linxule"

package/.mcp.json

@@ -0,0 +1,13 @@
+{
+  "mcpServers": {
+    "kimi": {
+      "command": "${CLAUDE_PLUGIN_ROOT}/scripts/companion.sh",
+      "args": [
+        "mcp"
+      ],
+      "env": {
+        "KIMI_PLUGIN_CC_MCP_WORKSPACE": "${CLAUDE_PROJECT_DIR}"
+      }
+    }
+  }
+}

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 > **Post-1.0 release history (v1.0.1 -> present) lives in [ROADMAP-TO-GA.md § Post-GA audit log](./ROADMAP-TO-GA.md#post-ga-audit-log)** and the "Version" / "Upstream compat" lines of [AGENTS.md](./AGENTS.md). Docs-only kimi-code compat checkups that don't bump the plugin version (e.g. the 0.14.2 / 0.14.3 patches) are recorded there, not here. Notable releases are summarized below; the GA entry and full pre-GA detail follow.
 
+## 2.4.1 — 2026-10-25
+
+- Certify exact kimi-code 2.3.2 for all eight operations using the 15-test/92-assertion source scan, plan-ON/OFF controls, and the final 19-test/125-assertion production smoke. Keep the no-plan construction and legacy-v1 boundary at 0.41.x. See [evidence](docs/upstream-2.3.2-certification.md).
+- Preserve swarm support after upstream removed model self-activation: exact-version, authenticated loopback activation creates a same-job session with the selected model, auto permission, and plan mode off, then resumes through ordinary `kimi -p`. `runSwarm` solely owns bounded deactivation and verifies the journal; older certified versions stay on direct print.
+- Bind activation to exact provenance, finite budgets, process identity, and session identity (`preactivated`). Failure recovery is cancellation-aware and preserves primary print errors. Unknown late-fork or changed-PGID survivors remain unverified, never false quiescence or unproven signal targets. Cleanup failure blocks completion and retains raw output, structured diagnostics, and the write worktree. MCP uses the same implementation and existing task/job ownership.
+- Close a certification blind spot found by adversarial review: AgentSwarm call records, aggregate denial text, and coordinator-only patches no longer count as fan-out. Smoke requires distinct child journals and correlates each assigned Write/Edit path and toolCallId with its own denial or successful result; the final production run passed 19/19 with 125 assertions in 296.67 seconds.
+
+Contributors: **Kimi** (source audit, design, implementation, documentation, and verification), **Claude** and **Codex** (adversarial review and re-review).
+
+## 2.4.0 — 2026-10-24
+
+- Add one dependency-free MCP stdio server for Claude Code and Codex, with typed schemas for seven model operations plus job status, result, and cancellation. The existing slash commands, skills, safety hooks, and review gate remain intact.
+- Return native MCP task handles for Claude calls that negotiate the tasks extension per request. Codex receives ordinary launch handles and uses explicit job-control tools; this does not claim native task-extension support for Codex.
+- Supervise each operation through a fixed task/job UUID, bounded attachment, durable reconnects, and PID/PGID/start-token identity checks. Preserve recoverable launches and their public IDs after inconclusive probes, reconcile stale dead companions, and keep cancellation from signalling a changed identity.
+- Preserve exact CLI 2.3.1 certification, workspace containment, data-root isolation, hook verification, resume lineage, and trusted write roots. Terminal jobs retain their artifact semantics: failed jobs complete tasks with `isError:true`, and cancelled jobs map to `cancelled`.
+- Document the transport, lifecycle, ownership, safety, comment-hygiene, and contributor rules. Align package and marketplace descriptions and keywords with the MCP surface.
+
+Contributors: **Kimi** (design, implementation, documentation, and verification), **Claude** and **Codex** (adversarial review and re-review).
+
 ## 2.3.1 — 2026-10-23
 
 - Certify exact kimi-code 2.3.1 for all eight native-v2 operations after the source scan, plan-ON/OFF controls and full 15-test candidate smoke. Preserve the no-plan construction and document the new session-lock, internal-`ps`/PATH and legacy-trust-migration residuals. See [evidence](docs/upstream-2.3.1-certification.md).

package/README.md

@@ -40,7 +40,7 @@ You need:
 - macOS or Linux
 - Claude Code or Codex with plugin support
 - Node.js 22.5 or newer
-- Kimi Code CLI 2.3.1 (2.3.0 also certified), the recommended version for plugin 2.3.1
+- Kimi Code CLI 2.3.2 (certified; 2.3.1 and 2.3.0 are also certified)
 
 Windows is not currently supported. Check your versions in a terminal:
 
@@ -100,15 +100,15 @@ If you use both Claude Code and Codex, run setup in each. Each app has its own h
 ## npm distribution (optional)
 
 The existing marketplace commands above remain the default for Claude Code and
-Codex. The same release is also available as
+Codex. Published releases are also available as
 [`kimi-plugin-cc` on npm](https://www.npmjs.com/package/kimi-plugin-cc), including
 both compiled plugin distributions. No Bun, TypeScript, or install scripts are
 needed to use the package. Kimi Code CLI and Node are still prerequisites.
 
-For an explicitly versioned local Claude Code plugin:
+For an explicitly versioned local Claude Code plugin, this example pins the published 2.4.0 package; 2.4.1 is not yet published:
 
 ```sh
-npm install --prefix ~/.local/share/kimi-plugin-cc kimi-plugin-cc@2.3.1
+npm install --prefix ~/.local/share/kimi-plugin-cc kimi-plugin-cc@2.4.0
 claude --plugin-dir ~/.local/share/kimi-plugin-cc/node_modules/kimi-plugin-cc
 ```
 
@@ -180,6 +180,19 @@ Canceling a task does not undo changes it has already made.
 
 Ask and rescue support resuming a session. For example, `/kimi:ask -r Explain the next step.` continues your latest ask session. In Codex, ask `$kimi-ask` to resume it. See the [ask options](./commands/ask.md) and [rescue options](./commands/rescue.md).
 
+### Use the MCP server
+
+The plugin also bundles one MCP stdio server for Claude Code and Codex, alongside the existing slash commands and skills. Those interfaces remain available, and the existing safety-hook setup is still mandatory.
+
+The seven model tools are `kimi_ask`, `kimi_review`, `kimi_challenge`, `kimi_rescue`, `kimi_pursue`, `kimi_swarm`, and `kimi_swarm_write`. Job control uses `kimi_job_status`, `kimi_job_result`, and `kimi_job_cancel`.
+
+- **Claude Code:** task-capable calls return durable MCP tasks. Poll them with `tasks/get` and cancel them with `tasks/cancel`.
+- **Codex:** calls currently use ordinary MCP results, not native MCP tasks. After attachment, a running job returns a launch handle; an already settled job returns its terminal result. Use the three job-control tools to check, read, or cancel it.
+
+Claude supplies the project directory as the default workspace. When the host has no default, as is normal for Codex, the initial operation requires an absolute `workspace` path. Later job-control calls can rely on the job's persisted workspace binding. An MCP server disconnect does not cancel jobs. The jobs table owns status and outcomes; the terminal artifact is the result authority. Failed jobs return `isError: true` with their artifacts.
+
+For example: “Use `kimi_review` to check this diff. In Claude Code, poll the returned task with `tasks/get`; in Codex, use the returned handle with `kimi_job_status` and then `kimi_job_result`.”
+
 ## Update or remove the plugin
 
 ### Update in Claude Code
@@ -215,6 +228,8 @@ All refusal codes and their remedies are listed in the [refusal-code catalog](./
 
 The tool rules for ask, review, challenge, and read-only swarm deny file writes and shell commands. Rescue and pursue can write files in your workspace. Swarm with `--write` works in a temporary Git worktree. It starts from your latest commit, so it does not include uncommitted changes. It returns a patch without applying it to your project.
 
+For swarm on CLI 2.3.2, the plugin briefly starts an authenticated loopback `kimi web` process to activate a session and another to deactivate swarm mode afterward; one ordinary `kimi -p -r` process still performs the task. Activation counts against the time limit, the access token stays in memory and out of logs, and cleanup failure prevents success. Older certified versions use `kimi -p` directly.
+
 The plugin does not commit changes. Review changes before you keep or apply them.
 
 Only use tasks that can write files in repositories you trust. Rescue, pursue, and swarm with `--write` can run tests and similar commands. These commands execute code from your repository. The hook restricts tool use; it is not an operating-system sandbox.
@@ -249,7 +264,7 @@ Contributors need Bun to run `bun run check`. The detailed engineering documents
 - macOS 或 Linux
 - 支持插件的 Claude Code 或 Codex
 - Node.js 22.5 或更高版本
-- Kimi Code CLI 2.3.1（2.3.0 亦已认证），这是插件 2.3.1 的推荐版本
+- Kimi Code CLI 2.3.2（已认证；2.3.1 和 2.3.0 也已认证）
 
 目前不支持 Windows。在终端检查版本：
 
@@ -364,6 +379,19 @@ Claude Code 还提供可选的[自动审查功能](./commands/setup.md)，在 Cl
 
 Ask 和 rescue 支持恢复会话。例如，`/kimi:ask -r 解释下一步。` 会继续最近一次 ask 会话。在 Codex 中，请 `$kimi-ask` 恢复该会话。参见 [ask 参数](./commands/ask.md)和 [rescue 参数](./commands/rescue.md)。
 
+### 使用 MCP 服务器
+
+插件现在还内置了一个同时供 Claude Code 和 Codex 使用的 MCP stdio 服务器，与现有斜杠命令和技能并存。这些界面仍然可用，现有的安全钩子配置也仍是必需步骤。
+
+七个模型工具是 `kimi_ask`、`kimi_review`、`kimi_challenge`、`kimi_rescue`、`kimi_pursue`、`kimi_swarm` 和 `kimi_swarm_write`。任务控制使用 `kimi_job_status`、`kimi_job_result` 和 `kimi_job_cancel`。
+
+- **Claude Code：** 支持任务式调用的工具会返回持久 MCP 任务，通过 `tasks/get` 轮询，通过 `tasks/cancel` 取消。
+- **Codex：** 目前使用普通 MCP 结果，而不是原生 MCP 任务。附加完成后，仍在运行的任务返回启动句柄；已结束的任务直接返回最终结果。使用上述三个任务控制工具查看进度、读取结果或取消任务。
+
+Claude 默认提供项目目录作为工作区。如果宿主没有默认工作区（Codex 通常如此），首次操作必须提供绝对的 `workspace` 路径。之后的任务控制调用可以使用为该任务保存的工作区绑定关系。MCP 服务器断开连接不会取消任务。`jobs` 表是任务状态与结局的依据，最终产物（artifact）是结果内容的依据。任务失败时会返回 `isError: true` 以及相应产物。
+
+例如：“使用 `kimi_review` 检查这次差异。在 Claude Code 中，用 `tasks/get` 轮询返回的任务；在 Codex 中，用返回的句柄调用 `kimi_job_status`，然后调用 `kimi_job_result`。”
+
 ## 更新或移除插件
 
 ### 在 Claude Code 中更新
@@ -399,6 +427,8 @@ codex plugin add kimi@kimi-marketplace
 
 Ask、review、challenge 和只读 swarm 的工具规则禁止写入文件和执行 shell 命令。Rescue 和 pursue 可以修改工作区内的文件。带 `--write` 的 swarm 在临时 Git 工作树中操作。它从最新提交开始，不包含尚未提交的修改。任务结束后返回补丁，不会自动应用到项目。
 
+在 CLI 2.3.2 上运行 swarm 时，插件会短暂启动需要认证的本地回环 `kimi web` 进程来激活会话，并在结束后再次启动以停用 swarm 模式；任务本身仍由一个普通的 `kimi -p -r` 进程执行。激活计入任务时限，访问令牌只保存在内存且不会写入日志；无法确认清理完成时，任务不会报告成功。较早的已认证版本仍直接通过 `kimi -p` 运行。
+
 插件不会提交修改。保留或应用修改前，请先审查。
 
 只在你信任的仓库中运行能修改文件的任务。Rescue、pursue 和带 `--write` 的 swarm 可以运行测试等命令。这些命令会执行仓库中的代码。钩子限制的是工具调用，它不是操作系统沙箱。
@@ -433,7 +463,7 @@ Il vous faut :
 - macOS ou Linux
 - une version de Claude Code ou de Codex prenant en charge les plugins
 - Node.js 22.5 ou une version ultérieure
-- Kimi Code CLI 2.3.1 (2.3.0 également certifiée), la version recommandée pour le plugin 2.3.1
+- Kimi Code CLI 2.3.2 (certifiée ; les versions 2.3.1 et 2.3.0 sont également certifiées)
 
 Windows n'est pas pris en charge actuellement. Vérifiez les versions dans un terminal :
 
@@ -548,6 +578,19 @@ Annuler une tâche n'annule pas les modifications déjà effectuées.
 
 Ask et rescue permettent de reprendre une session. Par exemple, `/kimi:ask -r Explique l'étape suivante.` reprend votre dernière session ask. Dans Codex, demandez à `$kimi-ask` de la reprendre. Consultez les [options d'ask](./commands/ask.md) et les [options de rescue](./commands/rescue.md).
 
+### Utiliser le serveur MCP
+
+Le plugin intègre aussi un serveur MCP stdio unique pour Claude Code et Codex, en plus des commandes slash et skills existants. Ces interfaces restent disponibles et la configuration du hook de sécurité reste obligatoire.
+
+Les sept outils de modèle sont `kimi_ask`, `kimi_review`, `kimi_challenge`, `kimi_rescue`, `kimi_pursue`, `kimi_swarm` et `kimi_swarm_write`. Le contrôle des tâches utilise `kimi_job_status`, `kimi_job_result` et `kimi_job_cancel`.
+
+- **Claude Code :** les appels compatibles avec les tâches renvoient des tâches MCP durables. Interrogez-les avec `tasks/get` et annulez-les avec `tasks/cancel`.
+- **Codex :** les appels utilisent actuellement des résultats MCP ordinaires, et non des tâches MCP natives. Après l'attachement, un job encore actif renvoie un handle de lancement ; un job déjà terminé renvoie directement son résultat final. Utilisez les trois outils de contrôle pour suivre, lire ou annuler le job.
+
+Claude fournit le répertoire du projet comme espace de travail par défaut. Sans espace de travail par défaut côté hôte, ce qui est normal pour Codex, l'opération initiale exige un chemin `workspace` absolu. Les contrôles ultérieurs peuvent utiliser l'association enregistrée entre la tâche et l'espace de travail. Une déconnexion du serveur MCP n'annule pas les tâches. La table jobs fait autorité pour l'état et l'issue des jobs ; l'artefact final fait autorité pour le contenu du résultat. Une tâche en échec renvoie `isError: true` avec ses artefacts.
+
+Par exemple : « Utilise `kimi_review` pour vérifier ce diff. Dans Claude Code, interroge la tâche renvoyée avec `tasks/get` ; dans Codex, utilise le handle renvoyé avec `kimi_job_status`, puis `kimi_job_result`. »
+
 ## Mettre à jour ou supprimer le plugin
 
 ### Mettre à jour dans Claude Code
@@ -583,6 +626,8 @@ Tous les codes de refus et leurs remèdes sont répertoriés dans le [catalogue
 
 Les règles des modes ask, review, challenge et swarm en lecture seule interdisent les écritures et les commandes shell. Rescue et pursue peuvent modifier les fichiers de votre espace de travail. Swarm avec `--write` travaille dans un worktree Git temporaire. Il part du dernier commit et n'inclut donc pas les modifications non commitées. Il renvoie un patch sans l'appliquer à votre projet.
 
+Avec le CLI 2.3.2, les tâches swarm lancent brièvement un processus `kimi web` authentifié sur l'interface de boucle locale pour activer la session, puis un second pour désactiver le mode swarm ; un seul processus `kimi -p -r` ordinaire exécute toujours la tâche. L'activation est comptée dans la limite de temps, le jeton reste en mémoire et hors des journaux, et l'échec du nettoyage empêche de déclarer la réussite. Les versions certifiées antérieures utilisent directement `kimi -p`.
+
 Le plugin ne crée aucun commit. Examinez les modifications avant de les conserver ou de les appliquer.
 
 N'utilisez les tâches pouvant écrire des fichiers que dans des dépôts auxquels vous faites confiance. Rescue, pursue et swarm avec `--write` peuvent lancer des tests et des commandes similaires. Ces commandes exécutent du code du dépôt. Le hook limite l'utilisation des outils ; ce n'est pas un bac à sable du système d'exploitation.
@@ -617,7 +662,7 @@ Les contributeurs ont besoin de Bun pour exécuter `bun run check`. La documenta
 - macOS または Linux
 - プラグインに対応した Claude Code または Codex
 - Node.js 22.5 以降
-- Kimi Code CLI 2.3.1（2.3.0 も認証済み。プラグイン 2.3.1 の推奨バージョン）
+- Kimi Code CLI 2.3.2（認証済み。2.3.1 と 2.3.0 も認証済み）
 
 現在、Windows には対応していません。ターミナルでバージョンを確認します。
 
@@ -732,6 +777,19 @@ Codex では「$kimi-review を使い、設定済みの『……』というモ
 
 Ask と rescue はセッションの再開に対応しています。たとえば `/kimi:ask -r 次の手順を説明してください。` は、直近の ask セッションを続けます。Codex では `$kimi-ask` に再開を依頼してください。[ask のオプション](./commands/ask.md)と [rescue のオプション](./commands/rescue.md)を参照できます。
 
+### MCP サーバーを使う
+
+プラグインには、既存のスラッシュコマンドとスキルに加え、Claude Code と Codex の両方で使える MCP stdio サーバーが 1 つ同梱されています。既存のコマンドとスキルも引き続き使え、既存の安全フックの設定も必須です。
+
+7 つのモデルツールは `kimi_ask`、`kimi_review`、`kimi_challenge`、`kimi_rescue`、`kimi_pursue`、`kimi_swarm`、`kimi_swarm_write` です。ジョブ制御には `kimi_job_status`、`kimi_job_result`、`kimi_job_cancel` を使います。
+
+- **Claude Code：** タスク対応の呼び出しは永続的な MCP タスクを返します。`tasks/get` でポーリングし、`tasks/cancel` でキャンセルします。
+- **Codex：** 現在はネイティブの MCP タスクではなく、通常の MCP 結果を使います。アタッチ後、実行中のジョブには起動ハンドルを返し、すでに終了したジョブには最終結果を直接返します。進捗確認・結果取得・キャンセルには 3 つのジョブ制御ツールを使います。
+
+Claude はプロジェクトディレクトリをデフォルトのワークスペースとして提供します。ホスト側にデフォルトがない場合（Codex ではこれが通常です）、最初の操作では絶対パスの `workspace` が必要です。後続のジョブ制御では、そのジョブに保存されたワークスペースの関連付けを利用できます。MCP サーバーとの接続が切れても、ジョブはキャンセルされません。`jobs` テーブルがジョブの状態と結果を管理し、最終成果物（artifact）が結果内容の正規の情報源となります。失敗したジョブも成果物とともに `isError: true` を返します。
+
+例：「`kimi_review` でこの差分を確認してください。Claude Code では返されたタスクを `tasks/get` でポーリングし、Codex では返されたハンドルを使って `kimi_job_status`、`kimi_job_result` の順に呼び出してください。」
+
 ## プラグインを更新または削除する
 
 ### Claude Code で更新する
@@ -767,6 +825,8 @@ codex plugin add kimi@kimi-marketplace
 
 Ask、review、challenge、読み取り専用 swarm のツールルールでは、ファイルへの書き込みとシェルコマンドを禁止しています。Rescue と pursue はワークスペース内のファイルを変更できます。`--write` を指定した swarm は、一時的な Git ワークツリーで作業します。最新のコミットから開始するため、未コミットの変更は含まれません。パッチを返すだけで、プロジェクトには自動適用しません。
 
+CLI 2.3.2 の swarm では、セッションを有効化するため、そして終了後に swarm モードを無効化するため、認証付きのローカルループバック `kimi web` プロセスをそれぞれ短時間だけ起動します。タスク自体は従来どおり 1 つの `kimi -p -r` プロセスが実行します。有効化も制限時間に含まれ、トークンはメモリー内にのみ保持されてログには出ません。後処理を確認できない場合、タスクは成功と報告されません。以前の認証済みバージョンでは、引き続き `kimi -p` を直接使います。
+
 プラグインは変更をコミットしません。変更を残す、または適用する前に内容を確認してください。
 
 ファイルを書き換えるタスクは、信頼できるリポジトリでのみ実行してください。Rescue、pursue、`--write` 付きの swarm は、テストなどのコマンドを実行できます。これらのコマンドはリポジトリ内のコードを実行します。フックはツールの使用を制限しますが、OS のサンドボックスではありません。

package/dist/cli-client.js

@@ -60,7 +60,7 @@ export async function runCliPrompt(opts) {
         });
     }
     const args = buildArgs(opts);
-    const env = buildEnv(opts);
+    const env = buildKimiCliEnvironment(opts);
     if (opts.logPath !== undefined) {
         await mkdir(path.dirname(opts.logPath), { recursive: true }).catch(() => {
             // Best-effort; if mkdir fails the appendFile below will error and be
@@ -305,7 +305,7 @@ export async function runCliPrompt(opts) {
         args,
         command_label: opts.commandLabel ?? null,
     });
-    return await new Promise((resolve, reject) => {
+    return await new Promise(async (resolve, reject) => {
         let aborted = false;
         let cancellationTeardown;
         let settlementStarted = false;
@@ -536,6 +536,16 @@ export async function runCliPrompt(opts) {
         if (opts.signal?.aborted === true) {
             onAbort();
         }
+        if (child.pid !== undefined && opts.onSpawn) {
+            try {
+                await opts.onSpawn(child.pid);
+            }
+            catch (error) {
+                onAbort();
+                settle("reject", new RuntimeError("CLI_SPAWN_CALLBACK_FAILED", `Failed to record the spawned kimi process: ${formatError(error)}`, "cli-client.spawn", error instanceof Error ? { cause: error, details: errorDetails() } : { details: errorDetails() }));
+                return;
+            }
+        }
         earlyErrorHandled = true;
         child.on("error", (err) => {
             appendLogLine({ event: "process_error", message: formatError(err) });
@@ -778,7 +788,7 @@ function buildArgs(opts) {
     args.push("-p", opts.prompt);
     return args;
 }
-function buildEnv(opts) {
+export function buildKimiCliEnvironment(opts) {
     const env = { ...opts.env };
     if (opts.thinkingEffort !== undefined)
         env.KIMI_MODEL_THINKING_EFFORT = opts.thinkingEffort;

package/dist/commands/ask.js

@@ -1,5 +1,5 @@
 import { companionHelp } from "../help.js";
-import { randomUUID } from "node:crypto";
+import { allocateJobId } from "../job-id.js";
 import path from "node:path";
 import { createCliCancellationHandlers } from "../cli-cancellation.js";
 import { runCliPromptWithBudget } from "../cli-client.js";
@@ -55,7 +55,7 @@ export async function runAsk(argv, context) {
     const store = new JobStore(paths);
     try {
         await sweepStaleJobs(store, paths);
-        const jobId = randomUUID();
+        const jobId = allocateJobId(context);
         const sessionResolution = await resolveAskSession(store, repoIdentity.repoId, parsed.fresh, parsed.resume, parsed.resumeTarget);
         const askPrompt = buildAskPrompt(parsed.prompt, sessionResolution.reusedSession);
         const executionPlan = await prepareKimiExecutionPlan({
@@ -152,6 +152,7 @@ export async function executeAskJob(jobId, prompt, context, options) {
         }
         handlers = createCliCancellationHandlers();
         const executionPlan = executionPlanFromPersisted(job);
+        store.updateRunningJob(job.job_id, { phase: "turn-running" });
         // Re-validate resume lineage from the store before spawning: a detached
         // worker (or a forged queued row) reloads the persisted plan and would
         // otherwise hand kimi_session_id to the spawn without the dispatch-time
@@ -174,6 +175,7 @@ export async function executeAskJob(jobId, prompt, context, options) {
             thinkingEffort: job.thinking_effort ?? undefined,
             resumeSessionId: job.kimi_session_id ?? undefined,
             logPath: job.stream_log_path,
+            onSpawn: (pid) => { store.updateRunningJob(job.job_id, { kimi_pid: pid }); },
             signal: handlers.signal,
         }, job.budget_ms ?? KIMI_ASK_PROMPT_TIMEOUT_MS, "ask.prompt");
         store.updateRunningJob(job.job_id, observedExecutionFields(result));

package/dist/commands/cancel.js

@@ -5,6 +5,7 @@ import { markJobCancelled, sweepStaleJobs } from "../jobs.js";
 import { JobStore, withJobStore } from "../job-store.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { parseJobLookupArgs } from "../parsing.js";
+import { revalidateProcessIdentities } from "../process-tree.js";
 import { getManagedCommandConfig } from "./registry.js";
 export async function runCancel(argv, context) {
     const parsed = parseJobLookupArgs(argv);
@@ -31,6 +32,10 @@ export async function runCancel(argv, context) {
                 message: "cancel is a no-op for terminal jobs.",
             }, null, 2)}\n`;
         }
+        if (store.getMcpTask(job.job_id) &&
+            (context.mcpCompanionIdentity === undefined || context.mcpKimiIdentity === undefined)) {
+            throw new RuntimeError("MCP_CANCEL_REQUIRES_BINDING", `MCP job ${job.job_id} requires MCP job-control cancellation with recorded identities; use tasks/cancel or kimi_job_cancel.`, "mcp.cancel");
+        }
         if (job.pid === null && job.kimi_pid === null) {
             throw new RuntimeError("CANCEL_NOT_SUPPORTED", `Job ${job.job_id} does not have a recorded process id to cancel.`, "cancel.runtime");
         }
@@ -53,6 +58,7 @@ export async function runCancel(argv, context) {
             catch (error) {
                 preMarkError = error;
             }
+            await assertMcpCompanionIdentity(job, context.mcpCompanionIdentity);
             signalJobProcesses(job, "SIGTERM");
             await sleep(1_000);
             if (hasLiveRecordedProcess(job)) {
@@ -67,6 +73,8 @@ export async function runCancel(argv, context) {
                 message: "review_gate cancelled; SIGTERM→SIGKILL escalation completed.",
             }, null, 2)}\n`;
         }
+        await assertMcpCompanionIdentity(job, context.mcpCompanionIdentity);
+        await assertMcpKimiIdentity(job, context.mcpKimiIdentity);
         signalJobProcesses(job, "SIGTERM");
         const cancelled = await waitForCancellation(paths, job.job_id);
         if (cancelled) {
@@ -76,7 +84,11 @@ export async function runCancel(argv, context) {
                 message: "Cancellation completed.",
             }, null, 2)}\n`;
         }
-        signalJobProcesses(job, "SIGKILL");
+        const companionMatches = await assertMcpCompanionIdentity(job, context.mcpCompanionIdentity, true);
+        const kimiMatches = await assertMcpKimiIdentity(job, context.mcpKimiIdentity, true);
+        if (companionMatches || kimiMatches) {
+            signalJobProcesses(job, "SIGKILL", { companion: companionMatches, kimi: kimiMatches });
+        }
         await withJobStore(paths, async (forcedStore) => {
             const current = forcedStore.getJob(job.job_id);
             if (current?.status === "running") {
@@ -93,11 +105,38 @@ export async function runCancel(argv, context) {
         store.close();
     }
 }
-function signalJobProcesses(job, signal) {
+async function assertMcpCompanionIdentity(job, expected, allowMissing = false) {
+    return assertMcpProcessIdentity(job.pid, expected, "companion", allowMissing);
+}
+async function assertMcpKimiIdentity(job, expected, allowMissing = false) {
+    return assertMcpProcessIdentity(job.kimi_pid, expected, "Kimi", allowMissing);
+}
+async function assertMcpProcessIdentity(actualPid, expected, label, allowMissing) {
+    if (expected === undefined)
+        return true;
+    if (expected === null) {
+        if (actualPid === null)
+            return false;
+        throw new RuntimeError("CANCEL_NOT_SUPPORTED", `MCP job ${actualPid} has no verified ${label} identity; refusing PID-only cancellation.`, "mcp.cancel");
+    }
+    if (actualPid !== expected.pid) {
+        throw new RuntimeError("MCP_PROCESS_IDENTITY_MISMATCH", `The recorded ${label} process identity no longer matches; no signal was sent.`, "mcp.cancel");
+    }
+    const validation = await revalidateProcessIdentities([expected]);
+    if (!validation.complete) {
+        throw new RuntimeError("MCP_PROCESS_IDENTITY_UNAVAILABLE", `The ${label} identity probe was inconclusive; no further signal was sent and the job was not changed.`, "mcp.cancel");
+    }
+    const matches = validation.identities.length > 0;
+    if (!matches && !allowMissing) {
+        throw new RuntimeError("MCP_PROCESS_IDENTITY_MISMATCH", `The recorded ${label} process identity no longer matches; no signal was sent.`, "mcp.cancel");
+    }
+    return matches;
+}
+function signalJobProcesses(job, signal, include = { companion: true, kimi: true }) {
     const pids = new Set();
-    if (job.pid !== null)
+    if (include.companion && job.pid !== null)
         pids.add(job.pid);
-    if (job.kimi_pid !== null)
+    if (include.kimi && job.kimi_pid !== null)
         pids.add(job.kimi_pid);
     for (const pid of pids) {
         try {

package/dist/commands/cli-helpers.js

@@ -117,7 +117,11 @@ export async function captureTimeoutPartialOutput(classified, store, job, env, c
         return undefined;
     const result = timeout.partialResult;
     let sessionId = result.sessionId;
-    let source = sessionId ? "announced" : null;
+    let source = sessionId
+        ? sessionId === job.kimi_session_id
+            ? job.kimi_session_id_source
+            : "announced"
+        : null;
     const details = classified instanceof RuntimeError ? classified.details : timeout.details;
     details.kimi_session_id_source = job.kimi_session_id_source;
     // The persisted plan is plugin-owned. Recovery never runs on cancellation,

package/dist/commands/pursue.js

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { allocateJobId } from "../job-id.js";
 import path from "node:path";
 import { createCliCancellationHandlers } from "../cli-cancellation.js";
 import { runCliPromptWithBudget } from "../cli-client.js";
@@ -122,7 +122,7 @@ export async function runPursue(argv, context) {
             env: context.env,
         });
         const prompt = buildGoalPrompt(objective, parsed.turns);
-        const jobId = randomUUID();
+        const jobId = allocateJobId(context);
         const logPath = path.join(paths.logsDir, `pursue-${jobId}.jsonl`);
         const job = store.createJob({
             job_id: jobId,
@@ -226,6 +226,7 @@ async function executePursueJob(jobId, prompt, objective, budgetMs, context) {
             model: job.model ?? undefined,
             thinkingEffort: job.thinking_effort ?? undefined,
             logPath: job.stream_log_path,
+            onSpawn: (pid) => { store.updateRunningJob(job.job_id, { kimi_pid: pid }); },
             signal: handlers.signal,
         }, budgetMs, "pursue.prompt");
         store.updateRunningJob(job.job_id, observedExecutionFields(result));

package/dist/commands/rescue.js

@@ -1,5 +1,5 @@
 import { companionHelp } from "../help.js";
-import { randomUUID } from "node:crypto";
+import { allocateJobId } from "../job-id.js";
 import path from "node:path";
 import { createCliCancellationHandlers } from "../cli-cancellation.js";
 import { runCliPromptWithBudget } from "../cli-client.js";
@@ -61,7 +61,7 @@ export async function runRescue(argv, context) {
             resumeSessionId: sessionResolution.kimiSessionId ?? undefined,
             resumeSource: sessionResolution.sourceJob,
         });
-        const jobId = randomUUID();
+        const jobId = allocateJobId(context);
         const logPath = path.join(paths.logsDir, `rescue-${jobId}.jsonl`);
         const job = store.createJob({
             job_id: jobId,
@@ -192,6 +192,7 @@ export async function executeRescueJob(jobId, prompt, context, options) {
             thinkingEffort: job.thinking_effort ?? undefined,
             resumeSessionId: job.kimi_session_id ?? undefined,
             logPath: job.stream_log_path,
+            onSpawn: (pid) => { store.updateRunningJob(job.job_id, { kimi_pid: pid }); },
             signal: handlers.signal,
         }, job.budget_ms ?? KIMI_RESCUE_PROMPT_TIMEOUT_MS, "rescue.prompt");
         store.updateRunningJob(job.job_id, observedExecutionFields(result));

package/dist/commands/review-gate.js

@@ -166,10 +166,7 @@ async function executeReviewGate(payload, assistantMessage, context) {
         try {
             const activeStore = store;
             // runCliPromptWithBudget ties the 8 s timeout to an AbortController
-            // that kills the kimi child on expiry — review_gate runs inside
-            // Claude Code's Stop hook, so a runaway kimi after timeout would
-            // hold model tokens with no way for /kimi:cancel to reach it
-            // (the SQLite row's kimi_pid is null). See reports/17 and 18.
+            // that kills the kimi child on expiry and records its PID at spawn.
             const result = await runCliPromptWithBudget({
                 cwd: payload.cwd,
                 env: context.env,
@@ -182,6 +179,7 @@ async function executeReviewGate(payload, assistantMessage, context) {
                 // Requested via env; provider/model may ignore it. The 8s budget still applies.
                 thinkingEffort,
                 logPath,
+                onSpawn: (pid) => { activeStore.updateRunningJob(job.job_id, { kimi_pid: pid }); },
             }, KIMI_REVIEW_GATE_TIMEOUT_MS, "review_gate.runtime");
             activeStore.updateRunningJob(job.job_id, observedExecutionFields(result));
             assertCliResultSuccess(result, "review_gate.runtime");

package/dist/commands/review.js

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { allocateJobId } from "../job-id.js";
 import path from "node:path";
 import process from "node:process";
 import { createCliCancellationHandlers } from "../cli-cancellation.js";
@@ -38,7 +38,7 @@ export async function runReview(argv, context, commandType) {
         env: context.env,
     });
     const store = new JobStore(paths);
-    const jobId = randomUUID();
+    const jobId = allocateJobId(context);
     // Leave kimi_session_id NULL until kimi announces an actual ID; never invent
     // one that no on-disk session matches.
     const reviewSessionId = null;
@@ -75,6 +75,7 @@ export async function runReview(argv, context, commandType) {
     const reviewConfig = getManagedCommandConfig(commandType);
     const cancel = reviewConfig.cancellation;
     const handlers = createCliCancellationHandlers();
+    store.updateRunningJob(job.job_id, { phase: "turn-running" });
     try {
         const result = await runCliPromptWithBudget({
             cwd: context.cwd,
@@ -87,6 +88,7 @@ export async function runReview(argv, context, commandType) {
             model: parsed.model,
             thinkingEffort: parsed.thinkingEffort,
             logPath,
+            onSpawn: (pid) => { store.updateRunningJob(job.job_id, { kimi_pid: pid }); },
             signal: handlers.signal,
         }, job.budget_ms ?? KIMI_REVIEW_PROMPT_TIMEOUT_MS, `${commandType}.prompt`);
         store.updateRunningJob(job.job_id, observedExecutionFields(result));