kimi-plugin-cc 2.3.1 → 2.4.1

package/plugins/kimi-codex/dist/commands/swarm.js

@@ -1,8 +1,9 @@
-import { randomUUID } from "node:crypto";
+import { allocateJobId } from "../job-id.js";
 import { mkdir, readdir, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { createCliCancellationHandlers } from "../cli-cancellation.js";
-import { runCliPromptWithBudget } from "../cli-client.js";
+import { ResponseTimeoutError, runCliPromptWithBudget } from "../cli-client.js";
+import { deactivateSwarmSession, preactivateSwarmSession, requiresSwarmPreactivation, } from "../swarm-activation.js";
 import { executionPlanFromPersisted, observedExecutionFields, persistedExecutionPlanFields, prepareKimiExecutionPlan, } from "../kimi-engine.js";
 import { RuntimeError } from "../errors.js";
 import { captureWorktreePatch, createEphemeralWorktree, hasBornHead, isWorkingTreeDirty, pruneWorktrees, removeWorktree, resolveRepoIdentity, } from "../git.js";
@@ -24,7 +25,8 @@ import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js
 // only the wall-clock hard bound. Read/write modes reuse review/rescue lineage,
 // and the mandatory PreToolUse hook enforces read-only policy or trusted-worktree
 // write confinement on the coordinator and every subagent. Write mode requires
-// kimi-code 0.18.0+.
+// kimi-code 0.18.0+. Exact 2.3.2 additionally activates a same-job session through
+// a bounded loopback web lifecycle, then resumes it through the normal print path.
 const SWARM_SUMMARY_MAX = 120;
 const SWARM_AGENT_PROFILE = "<swarm>";
 const SWARM_WRITE_AGENT_PROFILE = "<swarm-write>";
@@ -87,7 +89,7 @@ export function resolveSwarmWriteMaxConcurrency(requested) {
  * subagent, so slimming this text does not move the safety boundary. The optional
  * `cap` is a SOFT subagent-count hint (the hook cannot enforce a count). The HARD
  * concurrency ceiling is separate: --max-concurrency →
- * KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY (see executeSwarmJob / cli-client buildEnv).
+ * KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY (see executeSwarmJob / cli-client buildKimiCliEnvironment).
  * The --budget wall-clock ceiling is the always-on hard bound on the whole run.
  */
 export function buildSwarmPrompt(objective, cap) {
@@ -180,7 +182,7 @@ async function runReadSwarm(parsed, objective, context) {
             env: context.env,
         });
         const prompt = buildSwarmPrompt(objective, parsed.cap);
-        const jobId = randomUUID();
+        const jobId = allocateJobId(context);
         const logPath = path.join(paths.logsDir, `swarm-${jobId}.jsonl`);
         const job = store.createJob({
             job_id: jobId,
@@ -257,7 +259,7 @@ async function runWriteSwarm(parsed, objective, context) {
             context.stderr.write("[kimi-plugin-cc] /kimi:swarm --write bases its worktree on HEAD — your uncommitted changes are NOT visible to the swarm. Commit or stash them first if the swarm needs them.\n");
         }
         const prompt = buildSwarmWritePrompt(objective, parsed.cap);
-        const jobId = randomUUID();
+        const jobId = allocateJobId(context);
         const logPath = path.join(paths.logsDir, `swarm-write-${jobId}.jsonl`);
         // Namespace worktrees per repo so the cross-repo sweep below only ever
         // touches THIS repo's subtree (the worktreesDir is a single global dir shared
@@ -343,7 +345,7 @@ async function runWriteSwarm(parsed, objective, context) {
         }
         finally {
             if (preserveWorktree) {
-                context.stderr.write(`[kimi-plugin-cc] swarm-write patch capture failed; worktree retained at ${worktreePath}.\n`);
+                context.stderr.write(`[kimi-plugin-cc] swarm-write patch capture or session cleanup failed; worktree retained at ${worktreePath}.\n`);
             }
             else {
                 await removeWorktree(repoIdentity.repoRoot, worktreePath);
@@ -465,43 +467,163 @@ writeMode) {
         }
     }
     const handlers = createCliCancellationHandlers();
+    const budgetDeadline = Date.now() + budgetMs;
+    let activationOptions;
+    let preactivated;
+    let deactivationRequired = false;
+    let cleanupAttempted = false;
+    let cleanupFailure;
+    let finalText;
+    const commandLabel = writeMode ? "swarm-write" : "swarm";
+    const recoveryCleanupTimeoutMs = 2_000;
+    const cleanupSignal = (timeoutMs) => AbortSignal.any([
+        handlers.signal,
+        AbortSignal.timeout(Math.max(1, timeoutMs)),
+    ]);
+    const attemptDeactivation = async (identity, fallbackStage, timeoutMs = Math.max(1, budgetDeadline - Date.now())) => {
+        cleanupAttempted = true;
+        try {
+            await deactivateSwarmSession({
+                ...activationOptions,
+                ...identity,
+                signal: cleanupSignal(timeoutMs),
+            });
+            deactivationRequired = false;
+            return undefined;
+        }
+        catch (error) {
+            return error instanceof RuntimeError
+                ? error
+                : new RuntimeError("SWARM_SESSION_CLEANUP_FAILED", "Swarm session cleanup failed without a safe diagnostic payload.", fallbackStage);
+        }
+    };
     try {
         const executionPlan = executionPlanFromPersisted(job);
+        activationOptions = {
+            cwd: writeMode?.spawnCwd ?? job.cwd,
+            env: context.env,
+            command: executionPlan.command,
+            prefixArgs: executionPlan.prefixArgs,
+            executionPlan,
+            commandLabel,
+            model: job.model ?? undefined,
+            thinkingEffort: job.thinking_effort ?? undefined,
+            swarmMaxConcurrency: maxConcurrency,
+            trustedWorkspaceRoot: writeMode?.workspaceRoot,
+            expectedVersion: executionPlan.kimiVersion ?? undefined,
+        };
+        if (requiresSwarmPreactivation(executionPlan.kimiVersion)) {
+            store.updateRunningJob(job.job_id, { phase: "turn-running" });
+            const activationController = new AbortController();
+            const onParentAbort = () => activationController.abort();
+            let activationTimedOut = false;
+            handlers.signal.addEventListener("abort", onParentAbort, { once: true });
+            if (handlers.signal.aborted)
+                onParentAbort();
+            const activationTimer = setTimeout(() => {
+                activationTimedOut = true;
+                activationController.abort();
+            }, Math.max(1, budgetDeadline - Date.now()));
+            activationTimer.unref();
+            try {
+                preactivated = await preactivateSwarmSession({
+                    ...activationOptions,
+                    signal: activationController.signal,
+                });
+                deactivationRequired = true;
+                store.updateRunningJob(job.job_id, {
+                    kimi_session_id: preactivated.sessionId,
+                    kimi_session_id_source: "preactivated",
+                });
+            }
+            catch (error) {
+                const activationDidTimeOut = activationTimedOut;
+                clearTimeout(activationTimer);
+                handlers.signal.removeEventListener("abort", onParentAbort);
+                const details = error instanceof RuntimeError ? error.details : {};
+                const sessionId = typeof details.session_id === "string" ? details.session_id : undefined;
+                const workspaceId = typeof details.workspace_id === "string" ? details.workspace_id : undefined;
+                const hasSessionIdentity = sessionId !== undefined && workspaceId !== undefined;
+                if (error instanceof RuntimeError &&
+                    error.code === "SWARM_SESSION_CLEANUP_FAILED" &&
+                    details.process_cleanup_unverified === true) {
+                    cleanupFailure = error;
+                }
+                if (hasSessionIdentity) {
+                    store.updateRunningJob(job.job_id, {
+                        kimi_session_id: sessionId,
+                        kimi_session_id_source: "preactivated",
+                    });
+                }
+                if (hasSessionIdentity && !handlers.cancelling) {
+                    const sessionCleanupFailure = await attemptDeactivation({ sessionId, workspaceId }, "swarm.activation-cleanup", recoveryCleanupTimeoutMs);
+                    if (sessionCleanupFailure)
+                        cleanupFailure = sessionCleanupFailure;
+                }
+                else if (hasSessionIdentity && cleanupFailure === undefined) {
+                    cleanupFailure = new RuntimeError("SWARM_SESSION_CLEANUP_FAILED", "Swarm session cleanup was not completed after activation was cancelled.", "swarm.activation-cleanup", { details: { cancelled: true, cleanup_unverified: true } });
+                }
+                if (activationDidTimeOut && !handlers.cancelling) {
+                    throw new ResponseTimeoutError(budgetMs, "swarm.activation", commandLabel, undefined, error);
+                }
+                throw error;
+            }
+            finally {
+                clearTimeout(activationTimer);
+                handlers.signal.removeEventListener("abort", onParentAbort);
+            }
+        }
+        const promptBudgetMs = budgetDeadline - Date.now();
+        if (promptBudgetMs <= 0)
+            throw new ResponseTimeoutError(budgetMs, "swarm.prompt", commandLabel);
         store.updateRunningJob(job.job_id, { phase: "turn-running" });
         const result = await runCliPromptWithBudget({
-            // Read mode spawns in the user's cwd; WRITE mode spawns in the throwaway
-            // worktree so coder subagents edit there (job.cwd stays the user's real
-            // cwd for lineage). This is the load-bearing isolation seam.
-            cwd: writeMode?.spawnCwd ?? job.cwd,
+            cwd: activationOptions.cwd,
             env: context.env,
             command: executionPlan.command,
             prefixArgs: [...executionPlan.prefixArgs],
             executionPlan,
             prompt,
-            // "swarm" → read-only-plus-AgentSwarm allowlist; "swarm-write" → the same
-            // PLUS rescue-grade write confinement to the trusted worktree root. The
-            // label drives the hook for the coordinator AND every spawned subagent.
-            commandLabel: writeMode ? "swarm-write" : "swarm",
-            // Always exported as KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY. kimi-code
-            // 0.18.0+ enforces this hard peak ceiling; older read-only binaries ignore
-            // it and retain only the wall-clock hard bound. Write mode requires
-            // 0.18.0+. Distinct from --cap, the soft total-count prompt hint.
+            commandLabel,
             swarmMaxConcurrency: maxConcurrency,
-            // Trusted allowlist root for the swarm-write hook (forge-proof; ignored
-            // by other labels). Only set in write mode.
             trustedWorkspaceRoot: writeMode?.workspaceRoot,
             model: job.model ?? undefined,
             thinkingEffort: job.thinking_effort ?? undefined,
+            resumeSessionId: preactivated?.sessionId,
             logPath: job.stream_log_path,
+            onSpawn: (pid) => { store.updateRunningJob(job.job_id, { kimi_pid: pid }); },
             signal: handlers.signal,
-        }, budgetMs, "swarm.prompt");
+        }, promptBudgetMs, "swarm.prompt");
         store.updateRunningJob(job.job_id, observedExecutionFields(result));
+        finalText = reassembleProseFromRecords(result.records);
+        let resultError;
         if (handlers.cancelling) {
-            throw new RuntimeError("SWARM_CANCELLED", "Swarm cancelled by user request.", "swarm.runtime");
+            resultError = new RuntimeError("SWARM_CANCELLED", "Swarm cancelled by user request.", "swarm.runtime");
+        }
+        else {
+            try {
+                assertCliResultSuccess(result, "swarm.runtime");
+                if (preactivated && result.sessionId !== preactivated.sessionId) {
+                    throw new RuntimeError("SWARM_SESSION_MISMATCH", "The resumed print session differs from the preactivated swarm session.", "swarm.session-provenance", { details: { expected_session_id: preactivated.sessionId, actual_session_id: result.sessionId ?? null } });
+                }
+            }
+            catch (error) {
+                resultError = error;
+            }
         }
-        assertCliResultSuccess(result, "swarm.runtime");
         warnHookEscapes(result, "swarm", context.stderr);
-        if (result.sessionId !== undefined &&
+        if (preactivated) {
+            cleanupFailure = await attemptDeactivation(preactivated, "swarm.cleanup");
+        }
+        if (resultError !== undefined)
+            throw resultError;
+        if (handlers.cancelling) {
+            throw new RuntimeError("SWARM_CANCELLED", "Swarm cancelled by user request.", "swarm.runtime");
+        }
+        if (cleanupFailure)
+            throw cleanupFailure;
+        if (!preactivated &&
+            result.sessionId !== undefined &&
             result.sessionId.length > 0 &&
             result.sessionId !== job.kimi_session_id) {
             store.updateRunningJob(job.job_id, { kimi_session_id_source: "announced", kimi_session_id: result.sessionId });
@@ -516,7 +638,7 @@ writeMode) {
         });
         warnIfSessionIdMissing(result, "swarm", job.job_id, context.stderr);
         const prose = reassembleProseFromRecords(result.records);
-        let finalText = prose;
+        finalText = prose;
         if (writeMode) {
             const captured = await capturePatchArtifact(paths, job.job_id, writeMode.workspaceRoot, context.stderr, writeMode.onPatchCaptureFailure);
             if (captured === null) {
@@ -548,6 +670,21 @@ writeMode) {
         }) ?? job);
     }
     catch (error) {
+        if (preactivated && deactivationRequired && activationOptions) {
+            if (handlers.cancelling) {
+                cleanupFailure = new RuntimeError("SWARM_SESSION_CLEANUP_FAILED", "Swarm session cleanup was not completed after cancellation.", "swarm.cleanup", { details: { cancelled: true, cleanup_unverified: true } });
+            }
+            else if (!cleanupAttempted) {
+                cleanupFailure = await attemptDeactivation(preactivated, "swarm.cleanup", recoveryCleanupTimeoutMs);
+            }
+            else if (error instanceof RuntimeError && error.code === "SWARM_SESSION_CLEANUP_FAILED") {
+                cleanupFailure ??= error;
+            }
+        }
+        if (cleanupFailure) {
+            writeMode?.onPatchCaptureFailure?.();
+            context.stderr.write(`[kimi-plugin-cc] swarm session cleanup also failed: ${cleanupFailure.message}\n`);
+        }
         let captureFailed = writeMode !== undefined && error instanceof RuntimeError && error.code === "SWARM_PATCH_CAPTURE_FAILED";
         if (writeMode && !(error instanceof RuntimeError && error.code === "SWARM_PATCH_CAPTURE_FAILED")) {
             const captured = await capturePatchArtifact(paths, job.job_id, writeMode.workspaceRoot, context.stderr, writeMode.onPatchCaptureFailure);
@@ -556,34 +693,55 @@ writeMode) {
                 context.stderr.write(`[kimi-plugin-cc] swarm-write run ended early; partial patch captured at ${captured.path}.\n`);
             }
         }
-        const recoveryDetails = captureFailed && writeMode ? { worktreePath: writeMode.workspaceRoot } : {};
+        const recoveryDetails = {
+            ...(error instanceof RuntimeError && typeof error.details.exit_code === "number"
+                ? { exit_code: error.details.exit_code }
+                : {}),
+            ...((captureFailed || cleanupFailure) && writeMode ? { worktreePath: writeMode.workspaceRoot } : {}),
+            ...(cleanupFailure
+                ? {
+                    cleanup_error: {
+                        code: cleanupFailure.code,
+                        stage: cleanupFailure.stage,
+                        cancelled: handlers.cancelling,
+                        unverified: true,
+                    },
+                    ...(finalText !== undefined ? { rawOutput: finalText } : {}),
+                }
+                : {}),
+        };
         if (handlers.cancelling) {
+            const cancellationCause = classifyManagedCommandFailure(error, writeMode ? "rescue" : "review", job.job_id, {
+                preserveStage: true,
+            });
             const cancelledError = new RuntimeError("SWARM_CANCELLED", captureFailed && writeMode
                 ? `Swarm cancelled; patch capture failed and worktree retained at ${writeMode.workspaceRoot}.`
                 : "Swarm cancelled by user request.", "swarm.runtime", {
                 ...(error instanceof Error ? { cause: error } : {}),
-                details: recoveryDetails,
+                details: {
+                    ...(cancellationCause instanceof RuntimeError ? cancellationCause.details : {}),
+                    ...recoveryDetails,
+                },
             });
             return await markJobCancelled(store, paths, job, "Swarm cancelled by user request.", cancelledError, {
                 phase: "cancelled",
             });
         }
+        if (error === cleanupFailure && budgetDeadline <= Date.now() && !(error instanceof ResponseTimeoutError)) {
+            error = new ResponseTimeoutError(budgetMs, "swarm.cleanup", commandLabel, undefined, cleanupFailure);
+        }
         const classified = classifyManagedCommandFailure(error, writeMode ? "rescue" : "review", job.job_id, {
             preserveStage: true,
         });
-        if (captureFailed && writeMode) {
-            const withRecovery = classified instanceof RuntimeError
+        const withRecovery = captureFailed || cleanupFailure
+            ? classified instanceof RuntimeError
                 ? new RuntimeError(classified.code, classified.message, classified.stage, {
                     cause: classified,
                     details: { ...classified.details, ...recoveryDetails },
                 })
-                : new RuntimeError("SWARM_PATCH_CAPTURE_FAILED", classified.message, "swarm.patch-capture", {
-                    cause: classified,
-                    details: recoveryDetails,
-                });
-            return await markJobFailed(store, paths, job, withRecovery, "Swarm failed.", { phase: "failed" });
-        }
-        return await markJobFailed(store, paths, job, classified, "Swarm failed.", { phase: "failed" });
+                : new RuntimeError(cleanupFailure?.code ?? "SWARM_PATCH_CAPTURE_FAILED", classified.message, cleanupFailure?.stage ?? "swarm.patch-capture", { cause: classified, details: recoveryDetails })
+            : classified;
+        return await markJobFailed(store, paths, job, withRecovery, "Swarm failed.", { phase: "failed" });
     }
     finally {
         handlers.dispose();

package/plugins/kimi-codex/dist/companion.js

@@ -1,20 +1,17 @@
 import { companionHelp } from "./help.js";
-import { runAsk } from "./commands/ask.js";
 import { runModelInventory } from "./commands/models.js";
 import { runCancel } from "./commands/cancel.js";
-import { notImplementedCompanionCommand } from "./commands/not-implemented.js";
 import { runReplay } from "./commands/replay.js";
 import { runRepairSessions } from "./commands/repair-sessions.js";
 import { runResult } from "./commands/result.js";
-import { runReview } from "./commands/review.js";
-import { runRescue } from "./commands/rescue.js";
-import { runPursue } from "./commands/pursue.js";
-import { runSwarm } from "./commands/swarm.js";
 import { renderSetupResult, runSetup } from "./commands/setup.js";
 import { runStatus } from "./commands/status.js";
 import { runWorker } from "./commands/worker.js";
 import { formatError, RuntimeError } from "./errors.js";
 import { resolveKimiHome } from "./kimi-home.js";
+import { runModelCommand } from "./model-command.js";
+import { runMcpChild } from "./mcp/supervised-child.js";
+import { runMcpServer } from "./mcp/server.js";
 async function main(argv) {
     const help = companionHelp(argv);
     if (help !== undefined) {
@@ -27,11 +24,16 @@ async function main(argv) {
         cwd,
         env: {
             ...process.env,
-            KIMI_CODE_HOME: resolveKimiHome(process.env, cwd),
+            KIMI_CODE_HOME: command === "mcp" ? process.env.KIMI_CODE_HOME : resolveKimiHome(process.env, cwd),
         },
         stdout: process.stdout,
         stderr: process.stderr,
     };
+    const modelResult = await runModelCommand(argv, context);
+    if (modelResult !== undefined) {
+        context.stdout.write(modelResult);
+        return;
+    }
     switch (command) {
         case "setup": {
             if (rest.includes("--models")) {
@@ -57,41 +59,12 @@ async function main(argv) {
             }
             return;
         }
-        case "review": {
-            const result = await runReview(rest, context, "review");
-            context.stdout.write(`${result}\n`);
-            return;
-        }
-        case "task": {
-            const [taskType, ...taskArgs] = rest;
-            if (taskType === "rescue") {
-                const result = await runRescue(taskArgs, context);
-                context.stdout.write(result);
-                return;
-            }
-            if (taskType === "challenge") {
-                const result = await runReview(taskArgs, context, "challenge");
-                context.stdout.write(`${result}\n`);
-                return;
-            }
-            if (taskType === "pursue") {
-                const result = await runPursue(taskArgs, context);
-                context.stdout.write(result);
-                return;
-            }
-            if (taskType === "swarm") {
-                const result = await runSwarm(taskArgs, context);
-                context.stdout.write(result);
-                return;
-            }
-            notImplementedCompanionCommand(taskType ? `task ${taskType}` : "task");
+        case "mcp":
+            await runMcpServer(context);
             return;
-        }
-        case "ask": {
-            const result = await runAsk(rest, context);
-            context.stdout.write(`${result}\n`);
+        case "mcp-child":
+            context.stdout.write(await runMcpChild(rest, context));
             return;
-        }
         case "status":
             context.stdout.write(await runStatus(rest, context));
             return;

package/plugins/kimi-codex/dist/help.js

@@ -35,6 +35,8 @@ export function companionHelp(argv) {
         case "replay": return usage(command, "<job-id>", REPLAY_SUPPORTED_FLAGS, "Replay a completed job's persisted stream log.");
         case "repair-sessions": return usage(command, "[options]", REPAIR_SESSIONS_SUPPORTED_FLAGS, "Preview session metadata repair; --apply writes, --all selects all host-owned repositories.");
         case "worker": return "Usage: companion.sh worker <ask|rescue> <job-id>. Internal detached-worker entry point; launched by ask/rescue, not manually.";
+        case "mcp": return "Usage: companion.sh mcp. Run the Kimi MCP stdio server; normally launched by Claude Code or Codex plugin configuration.";
+        case "mcp-child": return "Usage: companion.sh mcp-child <job-uuid> <model-operation> [arguments]. Internal supervised MCP child; launched by the MCP server, not manually.";
         default: return undefined;
     }
 }

package/plugins/kimi-codex/dist/hooks/config-safety.js

@@ -594,8 +594,8 @@ function validateVersionSensitiveEvents(events, version) {
     }
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
     // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3),
-    // 2.3.0 (b5e28fd6) and 2.3.1 (684bae9e): the additive events and HookDefSchema
-    // are unchanged. Require the full version string AND matching components;
+    // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e) and 2.3.2 (b8dd3a13): the additive
+    // events and HookDefSchema are unchanged. Require the full version string AND matching components;
     // no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
         (version.version === "2.0.1" && version.patch === 1) ||
@@ -604,7 +604,8 @@ function validateVersionSensitiveEvents(events, version) {
             (version.version === "2.1.1" && version.patch === 1))) ||
         (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))) ||
         (version.minor === 3 && ((version.version === "2.3.0" && version.patch === 0) ||
-            (version.version === "2.3.1" && version.patch === 1))))) {
+            (version.version === "2.3.1" && version.patch === 1) ||
+            (version.version === "2.3.2" && version.patch === 2))))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/plugins/kimi-codex/dist/job-id.js

@@ -0,0 +1,12 @@
+import { randomUUID } from "node:crypto";
+import { RuntimeError } from "./errors.js";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export function allocateJobId(context) {
+    const fixed = context.mcpJobId;
+    if (fixed === undefined)
+        return randomUUID();
+    if (!UUID_PATTERN.test(fixed)) {
+        throw new RuntimeError("MCP_INVALID_JOB_ID", "The supervised job ID must be a valid UUID.", "mcp.child");
+    }
+    return fixed;
+}

package/plugins/kimi-codex/dist/job-store.js

@@ -99,6 +99,25 @@ export class JobStore {
                 }
             }
             this.db.exec(`
+      CREATE TABLE IF NOT EXISTS mcp_tasks (
+        task_id TEXT PRIMARY KEY,
+        operation_kind TEXT NOT NULL,
+        repo_id TEXT NOT NULL,
+        workspace_cwd TEXT NOT NULL,
+        companion_pid INTEGER,
+        companion_identity TEXT,
+        kimi_identity TEXT,
+        stdout_path TEXT NOT NULL,
+        stderr_path TEXT NOT NULL,
+        launch_state TEXT NOT NULL,
+        launch_error TEXT,
+        created_at TEXT NOT NULL,
+        attached_at TEXT,
+        updated_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS mcp_tasks_workspace_updated_idx
+        ON mcp_tasks (workspace_cwd, updated_at DESC);
 
       CREATE INDEX IF NOT EXISTS jobs_repo_updated_idx
         ON jobs (repo_id, updated_at DESC);
@@ -150,6 +169,9 @@ export class JobStore {
       -- 0.1.6 migration: rename adversarial_review to challenge
       UPDATE jobs SET command_type = 'challenge' WHERE command_type = 'adversarial_review';
     `);
+            if (!mcpTableHasColumn(this.db, "kimi_identity")) {
+                this.db.exec("ALTER TABLE mcp_tasks ADD COLUMN kimi_identity TEXT;");
+            }
         }
         catch (error) {
             // Migration failed — close the adapter so the OS handle is released
@@ -258,6 +280,40 @@ export class JobStore {
       `, repoId, sessionId);
         return row ? hydrateRow(row) : null;
     }
+    createMcpTask(input) {
+        const now = new Date().toISOString();
+        try {
+            this.db.run(`
+        INSERT INTO mcp_tasks (
+          task_id, operation_kind, repo_id, workspace_cwd, companion_pid, companion_identity, kimi_identity,
+          stdout_path, stderr_path, launch_state, launch_error, created_at, attached_at, updated_at
+        ) VALUES (
+          @task_id, @operation_kind, @repo_id, @workspace_cwd, NULL, NULL, NULL,
+          @stdout_path, @stderr_path, 'starting', NULL, @created_at, NULL, @updated_at
+        )
+      `, { ...input, created_at: now, updated_at: now });
+        }
+        catch (error) {
+            throw translateSqliteError(error);
+        }
+        return this.getMcpTask(input.task_id);
+    }
+    getMcpTask(taskId) {
+        return this.db.get("SELECT * FROM mcp_tasks WHERE task_id = ?", taskId) ?? null;
+    }
+    updateMcpTask(taskId, patch) {
+        const updates = ["updated_at = @updated_at"];
+        const params = { task_id: taskId, updated_at: new Date().toISOString() };
+        for (const key of ["companion_pid", "companion_identity", "kimi_identity", "launch_state", "launch_error", "attached_at"]) {
+            const value = patch[key];
+            if (value === undefined)
+                continue;
+            updates.push(`${key} = @${key}`);
+            params[key] = value;
+        }
+        this.db.run(`UPDATE mcp_tasks SET ${updates.join(", ")} WHERE task_id = @task_id`, params);
+        return this.getMcpTask(taskId);
+    }
     updateRunningJob(jobId, patch) {
         return this.updateWhere(jobId, patch, "status = 'running'");
     }
@@ -524,6 +580,9 @@ function tableHasColumn(db, columnName) {
     const columns = db.all(`PRAGMA table_info(jobs)`);
     return columns.some((column) => column.name === columnName);
 }
+function mcpTableHasColumn(db, columnName) {
+    return db.all("PRAGMA table_info(mcp_tasks)").some((column) => column.name === columnName);
+}
 function isSqliteConstraintError(error) {
     const message = formatError(error).toLowerCase();
     return message.includes("unique constraint") || message.includes("constraint failed");

package/plugins/kimi-codex/dist/jobs.js

@@ -30,6 +30,9 @@ export function normalizeJobError(error) {
     };
 }
 export async function markJobFailed(store, paths, job, error, summary = "Job failed.", options) {
+    const current = store.getJob(job.job_id) ?? job;
+    if (current.status !== "running")
+        return current;
     if (options?.partialOutput) {
         const label = job.command_type[0].toUpperCase() + job.command_type.slice(1);
         summary = `${label} timed out after ${formatBudgetDuration(options.partialOutput.budgetMs)}; partial output captured (${options.partialOutput.text.trim().length} chars).`;
@@ -55,6 +58,9 @@ export async function markJobFailed(store, paths, job, error, summary = "Job fai
     }) ?? artifactJob);
 }
 export async function markJobCancelled(store, paths, job, summary, error, options) {
+    const current = store.getJob(job.job_id) ?? job;
+    if (current.status !== "running")
+        return current;
     const normalized = error ? normalizeJobError(error) : null;
     const phase = options?.phase;
     const artifactJob = {
@@ -77,6 +83,8 @@ export async function markJobCancelled(store, paths, job, summary, error, option
 }
 export async function sweepStaleJobs(store, paths) {
     for (const job of store.listRunningJobsWithProcessHints()) {
+        if (store.getMcpTask(job.job_id))
+            continue;
         if (!isStaleEnoughToSweep(job)) {
             continue;
         }
@@ -109,7 +117,7 @@ export async function sweepStaleJobs(store, paths) {
         await markJobFailed(store, paths, job, new RuntimeError("FOREGROUND_PROCESS_DISAPPEARED", describeMissingForegroundProcess(job, companionMissing, kimiMissing), "jobs.sweep"), "Foreground Kimi job disappeared before reporting a terminal state.", job.command_type === "ask" || job.command_type === "rescue" ? { phase: "failed" } : undefined);
     }
 }
-const STALE_SWEEP_GRACE_MS = 15_000;
+export const STALE_SWEEP_GRACE_MS = 15_000;
 function isStaleEnoughToSweep(job) {
     const updatedAt = Date.parse(job.updated_at);
     return Number.isFinite(updatedAt) && Date.now() - updatedAt >= STALE_SWEEP_GRACE_MS;

package/plugins/kimi-codex/dist/kimi-engine.js

@@ -41,6 +41,7 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.2.0",
     "2.3.0",
     "2.3.1",
+    "2.3.2",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([

package/plugins/kimi-codex/dist/mcp/binding.js

@@ -0,0 +1,58 @@
+import { realpath } from "node:fs/promises";
+import { RuntimeError } from "../errors.js";
+export async function assertMcpJobBinding(task, job) {
+    if (!job)
+        throw bindingError(task, "The supervised job row does not exist.");
+    if (job.job_id !== task.task_id)
+        throw bindingError(task, "Task and job IDs differ.");
+    if (job.operation_kind !== task.operation_kind)
+        throw bindingError(task, "Task and job operation kinds differ.");
+    if (job.repo_id !== task.repo_id)
+        throw bindingError(task, "Task and job repositories differ.");
+    if (job.background)
+        throw bindingError(task, "Supervised MCP jobs must retain foreground companion ownership.");
+    if (job.status === "running" && (task.companion_pid === null || job.pid !== task.companion_pid)) {
+        throw bindingError(task, "Task and job companion process IDs differ or are missing.");
+    }
+    let jobCwd;
+    try {
+        jobCwd = await realpath(job.cwd);
+    }
+    catch (error) {
+        throw bindingError(task, "The job workspace cannot be resolved.", error);
+    }
+    if (jobCwd !== task.workspace_cwd)
+        throw bindingError(task, "Task and job workspaces differ.");
+    return job;
+}
+export function mcpCompanionIdentity(task) {
+    return parseIdentity(task.companion_identity, task.companion_pid, task, "companion");
+}
+export function mcpKimiIdentity(task, job) {
+    return parseIdentity(task.kimi_identity, job.kimi_pid, task, "Kimi");
+}
+function parseIdentity(serialized, expectedPid, task, label) {
+    if (serialized === null)
+        return null;
+    try {
+        const value = JSON.parse(serialized);
+        if (!Number.isInteger(value.pid) || (value.pid ?? 0) <= 0 ||
+            !Number.isInteger(value.processGroupId) ||
+            typeof value.startToken !== "string" || value.startToken.length === 0 ||
+            typeof value.state !== "string") {
+            throw new Error("invalid identity shape");
+        }
+        if (expectedPid !== null && expectedPid !== value.pid)
+            throw new Error("identity and recorded PID differ");
+        return value;
+    }
+    catch (error) {
+        throw bindingError(task, `The ${label} process identity is invalid.`, error);
+    }
+}
+function bindingError(task, message, cause) {
+    return new RuntimeError("MCP_JOB_BINDING_FAILED", message, "mcp.binding", {
+        ...(cause instanceof Error ? { cause } : {}),
+        details: { job_id: task.task_id, operation_kind: task.operation_kind },
+    });
+}