kimi-plugin-cc 2.4.0 → 2.4.1

package/.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
   },
   "metadata": {
     "description": "Kimi for Claude Code: code questions, reviews, fixes, parallel tasks, and MCP tasks through the local Kimi Code CLI.",
-    "version": "2.4.0"
+    "version": "2.4.1"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi",
   "description": "Kimi for Claude Code: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tasks through the local Kimi Code CLI, with PreToolUse safety hooks.",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "homepage": "https://github.com/linxule/kimi-plugin-cc",
   "repository": "https://github.com/linxule/kimi-plugin-cc",
   "license": "Apache-2.0",

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 > **Post-1.0 release history (v1.0.1 -> present) lives in [ROADMAP-TO-GA.md § Post-GA audit log](./ROADMAP-TO-GA.md#post-ga-audit-log)** and the "Version" / "Upstream compat" lines of [AGENTS.md](./AGENTS.md). Docs-only kimi-code compat checkups that don't bump the plugin version (e.g. the 0.14.2 / 0.14.3 patches) are recorded there, not here. Notable releases are summarized below; the GA entry and full pre-GA detail follow.
 
+## 2.4.1 — 2026-10-25
+
+- Certify exact kimi-code 2.3.2 for all eight operations using the 15-test/92-assertion source scan, plan-ON/OFF controls, and the final 19-test/125-assertion production smoke. Keep the no-plan construction and legacy-v1 boundary at 0.41.x. See [evidence](docs/upstream-2.3.2-certification.md).
+- Preserve swarm support after upstream removed model self-activation: exact-version, authenticated loopback activation creates a same-job session with the selected model, auto permission, and plan mode off, then resumes through ordinary `kimi -p`. `runSwarm` solely owns bounded deactivation and verifies the journal; older certified versions stay on direct print.
+- Bind activation to exact provenance, finite budgets, process identity, and session identity (`preactivated`). Failure recovery is cancellation-aware and preserves primary print errors. Unknown late-fork or changed-PGID survivors remain unverified, never false quiescence or unproven signal targets. Cleanup failure blocks completion and retains raw output, structured diagnostics, and the write worktree. MCP uses the same implementation and existing task/job ownership.
+- Close a certification blind spot found by adversarial review: AgentSwarm call records, aggregate denial text, and coordinator-only patches no longer count as fan-out. Smoke requires distinct child journals and correlates each assigned Write/Edit path and toolCallId with its own denial or successful result; the final production run passed 19/19 with 125 assertions in 296.67 seconds.
+
+Contributors: **Kimi** (source audit, design, implementation, documentation, and verification), **Claude** and **Codex** (adversarial review and re-review).
+
 ## 2.4.0 — 2026-10-24
 
 - Add one dependency-free MCP stdio server for Claude Code and Codex, with typed schemas for seven model operations plus job status, result, and cancellation. The existing slash commands, skills, safety hooks, and review gate remain intact.

package/README.md

@@ -40,7 +40,7 @@ You need:
 - macOS or Linux
 - Claude Code or Codex with plugin support
 - Node.js 22.5 or newer
-- Kimi Code CLI 2.3.1 (2.3.0 also certified), the recommended version for plugin 2.4.0
+- Kimi Code CLI 2.3.2 (certified; 2.3.1 and 2.3.0 are also certified)
 
 Windows is not currently supported. Check your versions in a terminal:
 
@@ -100,12 +100,12 @@ If you use both Claude Code and Codex, run setup in each. Each app has its own h
 ## npm distribution (optional)
 
 The existing marketplace commands above remain the default for Claude Code and
-Codex. The same release is also available as
+Codex. Published releases are also available as
 [`kimi-plugin-cc` on npm](https://www.npmjs.com/package/kimi-plugin-cc), including
 both compiled plugin distributions. No Bun, TypeScript, or install scripts are
 needed to use the package. Kimi Code CLI and Node are still prerequisites.
 
-For an explicitly versioned local Claude Code plugin:
+For an explicitly versioned local Claude Code plugin, this example pins the published 2.4.0 package; 2.4.1 is not yet published:
 
 ```sh
 npm install --prefix ~/.local/share/kimi-plugin-cc kimi-plugin-cc@2.4.0
@@ -228,6 +228,8 @@ All refusal codes and their remedies are listed in the [refusal-code catalog](./
 
 The tool rules for ask, review, challenge, and read-only swarm deny file writes and shell commands. Rescue and pursue can write files in your workspace. Swarm with `--write` works in a temporary Git worktree. It starts from your latest commit, so it does not include uncommitted changes. It returns a patch without applying it to your project.
 
+For swarm on CLI 2.3.2, the plugin briefly starts an authenticated loopback `kimi web` process to activate a session and another to deactivate swarm mode afterward; one ordinary `kimi -p -r` process still performs the task. Activation counts against the time limit, the access token stays in memory and out of logs, and cleanup failure prevents success. Older certified versions use `kimi -p` directly.
+
 The plugin does not commit changes. Review changes before you keep or apply them.
 
 Only use tasks that can write files in repositories you trust. Rescue, pursue, and swarm with `--write` can run tests and similar commands. These commands execute code from your repository. The hook restricts tool use; it is not an operating-system sandbox.
@@ -262,7 +264,7 @@ Contributors need Bun to run `bun run check`. The detailed engineering documents
 - macOS 或 Linux
 - 支持插件的 Claude Code 或 Codex
 - Node.js 22.5 或更高版本
-- Kimi Code CLI 2.3.1（2.3.0 亦已认证），这是插件 2.4.0 的推荐版本
+- Kimi Code CLI 2.3.2（已认证；2.3.1 和 2.3.0 也已认证）
 
 目前不支持 Windows。在终端检查版本：
 
@@ -425,6 +427,8 @@ codex plugin add kimi@kimi-marketplace
 
 Ask、review、challenge 和只读 swarm 的工具规则禁止写入文件和执行 shell 命令。Rescue 和 pursue 可以修改工作区内的文件。带 `--write` 的 swarm 在临时 Git 工作树中操作。它从最新提交开始，不包含尚未提交的修改。任务结束后返回补丁，不会自动应用到项目。
 
+在 CLI 2.3.2 上运行 swarm 时，插件会短暂启动需要认证的本地回环 `kimi web` 进程来激活会话，并在结束后再次启动以停用 swarm 模式；任务本身仍由一个普通的 `kimi -p -r` 进程执行。激活计入任务时限，访问令牌只保存在内存且不会写入日志；无法确认清理完成时，任务不会报告成功。较早的已认证版本仍直接通过 `kimi -p` 运行。
+
 插件不会提交修改。保留或应用修改前，请先审查。
 
 只在你信任的仓库中运行能修改文件的任务。Rescue、pursue 和带 `--write` 的 swarm 可以运行测试等命令。这些命令会执行仓库中的代码。钩子限制的是工具调用，它不是操作系统沙箱。
@@ -459,7 +463,7 @@ Il vous faut :
 - macOS ou Linux
 - une version de Claude Code ou de Codex prenant en charge les plugins
 - Node.js 22.5 ou une version ultérieure
-- Kimi Code CLI 2.3.1 (2.3.0 également certifiée), la version recommandée pour le plugin 2.4.0
+- Kimi Code CLI 2.3.2 (certifiée ; les versions 2.3.1 et 2.3.0 sont également certifiées)
 
 Windows n'est pas pris en charge actuellement. Vérifiez les versions dans un terminal :
 
@@ -622,6 +626,8 @@ Tous les codes de refus et leurs remèdes sont répertoriés dans le [catalogue
 
 Les règles des modes ask, review, challenge et swarm en lecture seule interdisent les écritures et les commandes shell. Rescue et pursue peuvent modifier les fichiers de votre espace de travail. Swarm avec `--write` travaille dans un worktree Git temporaire. Il part du dernier commit et n'inclut donc pas les modifications non commitées. Il renvoie un patch sans l'appliquer à votre projet.
 
+Avec le CLI 2.3.2, les tâches swarm lancent brièvement un processus `kimi web` authentifié sur l'interface de boucle locale pour activer la session, puis un second pour désactiver le mode swarm ; un seul processus `kimi -p -r` ordinaire exécute toujours la tâche. L'activation est comptée dans la limite de temps, le jeton reste en mémoire et hors des journaux, et l'échec du nettoyage empêche de déclarer la réussite. Les versions certifiées antérieures utilisent directement `kimi -p`.
+
 Le plugin ne crée aucun commit. Examinez les modifications avant de les conserver ou de les appliquer.
 
 N'utilisez les tâches pouvant écrire des fichiers que dans des dépôts auxquels vous faites confiance. Rescue, pursue et swarm avec `--write` peuvent lancer des tests et des commandes similaires. Ces commandes exécutent du code du dépôt. Le hook limite l'utilisation des outils ; ce n'est pas un bac à sable du système d'exploitation.
@@ -656,7 +662,7 @@ Les contributeurs ont besoin de Bun pour exécuter `bun run check`. La documenta
 - macOS または Linux
 - プラグインに対応した Claude Code または Codex
 - Node.js 22.5 以降
-- Kimi Code CLI 2.3.1（2.3.0 も認証済み。プラグイン 2.4.0 の推奨バージョン）
+- Kimi Code CLI 2.3.2（認証済み。2.3.1 と 2.3.0 も認証済み）
 
 現在、Windows には対応していません。ターミナルでバージョンを確認します。
 
@@ -819,6 +825,8 @@ codex plugin add kimi@kimi-marketplace
 
 Ask、review、challenge、読み取り専用 swarm のツールルールでは、ファイルへの書き込みとシェルコマンドを禁止しています。Rescue と pursue はワークスペース内のファイルを変更できます。`--write` を指定した swarm は、一時的な Git ワークツリーで作業します。最新のコミットから開始するため、未コミットの変更は含まれません。パッチを返すだけで、プロジェクトには自動適用しません。
 
+CLI 2.3.2 の swarm では、セッションを有効化するため、そして終了後に swarm モードを無効化するため、認証付きのローカルループバック `kimi web` プロセスをそれぞれ短時間だけ起動します。タスク自体は従来どおり 1 つの `kimi -p -r` プロセスが実行します。有効化も制限時間に含まれ、トークンはメモリー内にのみ保持されてログには出ません。後処理を確認できない場合、タスクは成功と報告されません。以前の認証済みバージョンでは、引き続き `kimi -p` を直接使います。
+
 プラグインは変更をコミットしません。変更を残す、または適用する前に内容を確認してください。
 
 ファイルを書き換えるタスクは、信頼できるリポジトリでのみ実行してください。Rescue、pursue、`--write` 付きの swarm は、テストなどのコマンドを実行できます。これらのコマンドはリポジトリ内のコードを実行します。フックはツールの使用を制限しますが、OS のサンドボックスではありません。

package/dist/cli-client.js

@@ -60,7 +60,7 @@ export async function runCliPrompt(opts) {
         });
     }
     const args = buildArgs(opts);
-    const env = buildEnv(opts);
+    const env = buildKimiCliEnvironment(opts);
     if (opts.logPath !== undefined) {
         await mkdir(path.dirname(opts.logPath), { recursive: true }).catch(() => {
             // Best-effort; if mkdir fails the appendFile below will error and be
@@ -788,7 +788,7 @@ function buildArgs(opts) {
     args.push("-p", opts.prompt);
     return args;
 }
-function buildEnv(opts) {
+export function buildKimiCliEnvironment(opts) {
     const env = { ...opts.env };
     if (opts.thinkingEffort !== undefined)
         env.KIMI_MODEL_THINKING_EFFORT = opts.thinkingEffort;

package/dist/commands/cli-helpers.js

@@ -117,7 +117,11 @@ export async function captureTimeoutPartialOutput(classified, store, job, env, c
         return undefined;
     const result = timeout.partialResult;
     let sessionId = result.sessionId;
-    let source = sessionId ? "announced" : null;
+    let source = sessionId
+        ? sessionId === job.kimi_session_id
+            ? job.kimi_session_id_source
+            : "announced"
+        : null;
     const details = classified instanceof RuntimeError ? classified.details : timeout.details;
     details.kimi_session_id_source = job.kimi_session_id_source;
     // The persisted plan is plugin-owned. Recovery never runs on cancellation,

package/dist/commands/swarm.js

@@ -2,7 +2,8 @@ import { allocateJobId } from "../job-id.js";
 import { mkdir, readdir, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { createCliCancellationHandlers } from "../cli-cancellation.js";
-import { runCliPromptWithBudget } from "../cli-client.js";
+import { ResponseTimeoutError, runCliPromptWithBudget } from "../cli-client.js";
+import { deactivateSwarmSession, preactivateSwarmSession, requiresSwarmPreactivation, } from "../swarm-activation.js";
 import { executionPlanFromPersisted, observedExecutionFields, persistedExecutionPlanFields, prepareKimiExecutionPlan, } from "../kimi-engine.js";
 import { RuntimeError } from "../errors.js";
 import { captureWorktreePatch, createEphemeralWorktree, hasBornHead, isWorkingTreeDirty, pruneWorktrees, removeWorktree, resolveRepoIdentity, } from "../git.js";
@@ -24,7 +25,8 @@ import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js
 // only the wall-clock hard bound. Read/write modes reuse review/rescue lineage,
 // and the mandatory PreToolUse hook enforces read-only policy or trusted-worktree
 // write confinement on the coordinator and every subagent. Write mode requires
-// kimi-code 0.18.0+.
+// kimi-code 0.18.0+. Exact 2.3.2 additionally activates a same-job session through
+// a bounded loopback web lifecycle, then resumes it through the normal print path.
 const SWARM_SUMMARY_MAX = 120;
 const SWARM_AGENT_PROFILE = "<swarm>";
 const SWARM_WRITE_AGENT_PROFILE = "<swarm-write>";
@@ -87,7 +89,7 @@ export function resolveSwarmWriteMaxConcurrency(requested) {
  * subagent, so slimming this text does not move the safety boundary. The optional
  * `cap` is a SOFT subagent-count hint (the hook cannot enforce a count). The HARD
  * concurrency ceiling is separate: --max-concurrency →
- * KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY (see executeSwarmJob / cli-client buildEnv).
+ * KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY (see executeSwarmJob / cli-client buildKimiCliEnvironment).
  * The --budget wall-clock ceiling is the always-on hard bound on the whole run.
  */
 export function buildSwarmPrompt(objective, cap) {
@@ -343,7 +345,7 @@ async function runWriteSwarm(parsed, objective, context) {
         }
         finally {
             if (preserveWorktree) {
-                context.stderr.write(`[kimi-plugin-cc] swarm-write patch capture failed; worktree retained at ${worktreePath}.\n`);
+                context.stderr.write(`[kimi-plugin-cc] swarm-write patch capture or session cleanup failed; worktree retained at ${worktreePath}.\n`);
             }
             else {
                 await removeWorktree(repoIdentity.repoRoot, worktreePath);
@@ -465,44 +467,163 @@ writeMode) {
         }
     }
     const handlers = createCliCancellationHandlers();
+    const budgetDeadline = Date.now() + budgetMs;
+    let activationOptions;
+    let preactivated;
+    let deactivationRequired = false;
+    let cleanupAttempted = false;
+    let cleanupFailure;
+    let finalText;
+    const commandLabel = writeMode ? "swarm-write" : "swarm";
+    const recoveryCleanupTimeoutMs = 2_000;
+    const cleanupSignal = (timeoutMs) => AbortSignal.any([
+        handlers.signal,
+        AbortSignal.timeout(Math.max(1, timeoutMs)),
+    ]);
+    const attemptDeactivation = async (identity, fallbackStage, timeoutMs = Math.max(1, budgetDeadline - Date.now())) => {
+        cleanupAttempted = true;
+        try {
+            await deactivateSwarmSession({
+                ...activationOptions,
+                ...identity,
+                signal: cleanupSignal(timeoutMs),
+            });
+            deactivationRequired = false;
+            return undefined;
+        }
+        catch (error) {
+            return error instanceof RuntimeError
+                ? error
+                : new RuntimeError("SWARM_SESSION_CLEANUP_FAILED", "Swarm session cleanup failed without a safe diagnostic payload.", fallbackStage);
+        }
+    };
     try {
         const executionPlan = executionPlanFromPersisted(job);
+        activationOptions = {
+            cwd: writeMode?.spawnCwd ?? job.cwd,
+            env: context.env,
+            command: executionPlan.command,
+            prefixArgs: executionPlan.prefixArgs,
+            executionPlan,
+            commandLabel,
+            model: job.model ?? undefined,
+            thinkingEffort: job.thinking_effort ?? undefined,
+            swarmMaxConcurrency: maxConcurrency,
+            trustedWorkspaceRoot: writeMode?.workspaceRoot,
+            expectedVersion: executionPlan.kimiVersion ?? undefined,
+        };
+        if (requiresSwarmPreactivation(executionPlan.kimiVersion)) {
+            store.updateRunningJob(job.job_id, { phase: "turn-running" });
+            const activationController = new AbortController();
+            const onParentAbort = () => activationController.abort();
+            let activationTimedOut = false;
+            handlers.signal.addEventListener("abort", onParentAbort, { once: true });
+            if (handlers.signal.aborted)
+                onParentAbort();
+            const activationTimer = setTimeout(() => {
+                activationTimedOut = true;
+                activationController.abort();
+            }, Math.max(1, budgetDeadline - Date.now()));
+            activationTimer.unref();
+            try {
+                preactivated = await preactivateSwarmSession({
+                    ...activationOptions,
+                    signal: activationController.signal,
+                });
+                deactivationRequired = true;
+                store.updateRunningJob(job.job_id, {
+                    kimi_session_id: preactivated.sessionId,
+                    kimi_session_id_source: "preactivated",
+                });
+            }
+            catch (error) {
+                const activationDidTimeOut = activationTimedOut;
+                clearTimeout(activationTimer);
+                handlers.signal.removeEventListener("abort", onParentAbort);
+                const details = error instanceof RuntimeError ? error.details : {};
+                const sessionId = typeof details.session_id === "string" ? details.session_id : undefined;
+                const workspaceId = typeof details.workspace_id === "string" ? details.workspace_id : undefined;
+                const hasSessionIdentity = sessionId !== undefined && workspaceId !== undefined;
+                if (error instanceof RuntimeError &&
+                    error.code === "SWARM_SESSION_CLEANUP_FAILED" &&
+                    details.process_cleanup_unverified === true) {
+                    cleanupFailure = error;
+                }
+                if (hasSessionIdentity) {
+                    store.updateRunningJob(job.job_id, {
+                        kimi_session_id: sessionId,
+                        kimi_session_id_source: "preactivated",
+                    });
+                }
+                if (hasSessionIdentity && !handlers.cancelling) {
+                    const sessionCleanupFailure = await attemptDeactivation({ sessionId, workspaceId }, "swarm.activation-cleanup", recoveryCleanupTimeoutMs);
+                    if (sessionCleanupFailure)
+                        cleanupFailure = sessionCleanupFailure;
+                }
+                else if (hasSessionIdentity && cleanupFailure === undefined) {
+                    cleanupFailure = new RuntimeError("SWARM_SESSION_CLEANUP_FAILED", "Swarm session cleanup was not completed after activation was cancelled.", "swarm.activation-cleanup", { details: { cancelled: true, cleanup_unverified: true } });
+                }
+                if (activationDidTimeOut && !handlers.cancelling) {
+                    throw new ResponseTimeoutError(budgetMs, "swarm.activation", commandLabel, undefined, error);
+                }
+                throw error;
+            }
+            finally {
+                clearTimeout(activationTimer);
+                handlers.signal.removeEventListener("abort", onParentAbort);
+            }
+        }
+        const promptBudgetMs = budgetDeadline - Date.now();
+        if (promptBudgetMs <= 0)
+            throw new ResponseTimeoutError(budgetMs, "swarm.prompt", commandLabel);
         store.updateRunningJob(job.job_id, { phase: "turn-running" });
         const result = await runCliPromptWithBudget({
-            // Read mode spawns in the user's cwd; WRITE mode spawns in the throwaway
-            // worktree so coder subagents edit there (job.cwd stays the user's real
-            // cwd for lineage). This is the load-bearing isolation seam.
-            cwd: writeMode?.spawnCwd ?? job.cwd,
+            cwd: activationOptions.cwd,
             env: context.env,
             command: executionPlan.command,
             prefixArgs: [...executionPlan.prefixArgs],
             executionPlan,
             prompt,
-            // "swarm" → read-only-plus-AgentSwarm allowlist; "swarm-write" → the same
-            // PLUS rescue-grade write confinement to the trusted worktree root. The
-            // label drives the hook for the coordinator AND every spawned subagent.
-            commandLabel: writeMode ? "swarm-write" : "swarm",
-            // Always exported as KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY. kimi-code
-            // 0.18.0+ enforces this hard peak ceiling; older read-only binaries ignore
-            // it and retain only the wall-clock hard bound. Write mode requires
-            // 0.18.0+. Distinct from --cap, the soft total-count prompt hint.
+            commandLabel,
             swarmMaxConcurrency: maxConcurrency,
-            // Trusted allowlist root for the swarm-write hook (forge-proof; ignored
-            // by other labels). Only set in write mode.
             trustedWorkspaceRoot: writeMode?.workspaceRoot,
             model: job.model ?? undefined,
             thinkingEffort: job.thinking_effort ?? undefined,
+            resumeSessionId: preactivated?.sessionId,
             logPath: job.stream_log_path,
             onSpawn: (pid) => { store.updateRunningJob(job.job_id, { kimi_pid: pid }); },
             signal: handlers.signal,
-        }, budgetMs, "swarm.prompt");
+        }, promptBudgetMs, "swarm.prompt");
         store.updateRunningJob(job.job_id, observedExecutionFields(result));
+        finalText = reassembleProseFromRecords(result.records);
+        let resultError;
         if (handlers.cancelling) {
-            throw new RuntimeError("SWARM_CANCELLED", "Swarm cancelled by user request.", "swarm.runtime");
+            resultError = new RuntimeError("SWARM_CANCELLED", "Swarm cancelled by user request.", "swarm.runtime");
+        }
+        else {
+            try {
+                assertCliResultSuccess(result, "swarm.runtime");
+                if (preactivated && result.sessionId !== preactivated.sessionId) {
+                    throw new RuntimeError("SWARM_SESSION_MISMATCH", "The resumed print session differs from the preactivated swarm session.", "swarm.session-provenance", { details: { expected_session_id: preactivated.sessionId, actual_session_id: result.sessionId ?? null } });
+                }
+            }
+            catch (error) {
+                resultError = error;
+            }
         }
-        assertCliResultSuccess(result, "swarm.runtime");
         warnHookEscapes(result, "swarm", context.stderr);
-        if (result.sessionId !== undefined &&
+        if (preactivated) {
+            cleanupFailure = await attemptDeactivation(preactivated, "swarm.cleanup");
+        }
+        if (resultError !== undefined)
+            throw resultError;
+        if (handlers.cancelling) {
+            throw new RuntimeError("SWARM_CANCELLED", "Swarm cancelled by user request.", "swarm.runtime");
+        }
+        if (cleanupFailure)
+            throw cleanupFailure;
+        if (!preactivated &&
+            result.sessionId !== undefined &&
             result.sessionId.length > 0 &&
             result.sessionId !== job.kimi_session_id) {
             store.updateRunningJob(job.job_id, { kimi_session_id_source: "announced", kimi_session_id: result.sessionId });
@@ -517,7 +638,7 @@ writeMode) {
         });
         warnIfSessionIdMissing(result, "swarm", job.job_id, context.stderr);
         const prose = reassembleProseFromRecords(result.records);
-        let finalText = prose;
+        finalText = prose;
         if (writeMode) {
             const captured = await capturePatchArtifact(paths, job.job_id, writeMode.workspaceRoot, context.stderr, writeMode.onPatchCaptureFailure);
             if (captured === null) {
@@ -549,6 +670,21 @@ writeMode) {
         }) ?? job);
     }
     catch (error) {
+        if (preactivated && deactivationRequired && activationOptions) {
+            if (handlers.cancelling) {
+                cleanupFailure = new RuntimeError("SWARM_SESSION_CLEANUP_FAILED", "Swarm session cleanup was not completed after cancellation.", "swarm.cleanup", { details: { cancelled: true, cleanup_unverified: true } });
+            }
+            else if (!cleanupAttempted) {
+                cleanupFailure = await attemptDeactivation(preactivated, "swarm.cleanup", recoveryCleanupTimeoutMs);
+            }
+            else if (error instanceof RuntimeError && error.code === "SWARM_SESSION_CLEANUP_FAILED") {
+                cleanupFailure ??= error;
+            }
+        }
+        if (cleanupFailure) {
+            writeMode?.onPatchCaptureFailure?.();
+            context.stderr.write(`[kimi-plugin-cc] swarm session cleanup also failed: ${cleanupFailure.message}\n`);
+        }
         let captureFailed = writeMode !== undefined && error instanceof RuntimeError && error.code === "SWARM_PATCH_CAPTURE_FAILED";
         if (writeMode && !(error instanceof RuntimeError && error.code === "SWARM_PATCH_CAPTURE_FAILED")) {
             const captured = await capturePatchArtifact(paths, job.job_id, writeMode.workspaceRoot, context.stderr, writeMode.onPatchCaptureFailure);
@@ -557,34 +693,55 @@ writeMode) {
                 context.stderr.write(`[kimi-plugin-cc] swarm-write run ended early; partial patch captured at ${captured.path}.\n`);
             }
         }
-        const recoveryDetails = captureFailed && writeMode ? { worktreePath: writeMode.workspaceRoot } : {};
+        const recoveryDetails = {
+            ...(error instanceof RuntimeError && typeof error.details.exit_code === "number"
+                ? { exit_code: error.details.exit_code }
+                : {}),
+            ...((captureFailed || cleanupFailure) && writeMode ? { worktreePath: writeMode.workspaceRoot } : {}),
+            ...(cleanupFailure
+                ? {
+                    cleanup_error: {
+                        code: cleanupFailure.code,
+                        stage: cleanupFailure.stage,
+                        cancelled: handlers.cancelling,
+                        unverified: true,
+                    },
+                    ...(finalText !== undefined ? { rawOutput: finalText } : {}),
+                }
+                : {}),
+        };
         if (handlers.cancelling) {
+            const cancellationCause = classifyManagedCommandFailure(error, writeMode ? "rescue" : "review", job.job_id, {
+                preserveStage: true,
+            });
             const cancelledError = new RuntimeError("SWARM_CANCELLED", captureFailed && writeMode
                 ? `Swarm cancelled; patch capture failed and worktree retained at ${writeMode.workspaceRoot}.`
                 : "Swarm cancelled by user request.", "swarm.runtime", {
                 ...(error instanceof Error ? { cause: error } : {}),
-                details: recoveryDetails,
+                details: {
+                    ...(cancellationCause instanceof RuntimeError ? cancellationCause.details : {}),
+                    ...recoveryDetails,
+                },
             });
             return await markJobCancelled(store, paths, job, "Swarm cancelled by user request.", cancelledError, {
                 phase: "cancelled",
             });
         }
+        if (error === cleanupFailure && budgetDeadline <= Date.now() && !(error instanceof ResponseTimeoutError)) {
+            error = new ResponseTimeoutError(budgetMs, "swarm.cleanup", commandLabel, undefined, cleanupFailure);
+        }
         const classified = classifyManagedCommandFailure(error, writeMode ? "rescue" : "review", job.job_id, {
             preserveStage: true,
         });
-        if (captureFailed && writeMode) {
-            const withRecovery = classified instanceof RuntimeError
+        const withRecovery = captureFailed || cleanupFailure
+            ? classified instanceof RuntimeError
                 ? new RuntimeError(classified.code, classified.message, classified.stage, {
                     cause: classified,
                     details: { ...classified.details, ...recoveryDetails },
                 })
-                : new RuntimeError("SWARM_PATCH_CAPTURE_FAILED", classified.message, "swarm.patch-capture", {
-                    cause: classified,
-                    details: recoveryDetails,
-                });
-            return await markJobFailed(store, paths, job, withRecovery, "Swarm failed.", { phase: "failed" });
-        }
-        return await markJobFailed(store, paths, job, classified, "Swarm failed.", { phase: "failed" });
+                : new RuntimeError(cleanupFailure?.code ?? "SWARM_PATCH_CAPTURE_FAILED", classified.message, cleanupFailure?.stage ?? "swarm.patch-capture", { cause: classified, details: recoveryDetails })
+            : classified;
+        return await markJobFailed(store, paths, job, withRecovery, "Swarm failed.", { phase: "failed" });
     }
     finally {
         handlers.dispose();

package/dist/hooks/config-safety.js

@@ -594,8 +594,8 @@ function validateVersionSensitiveEvents(events, version) {
     }
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
     // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3),
-    // 2.3.0 (b5e28fd6) and 2.3.1 (684bae9e): the additive events and HookDefSchema
-    // are unchanged. Require the full version string AND matching components;
+    // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e) and 2.3.2 (b8dd3a13): the additive
+    // events and HookDefSchema are unchanged. Require the full version string AND matching components;
     // no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
         (version.version === "2.0.1" && version.patch === 1) ||
@@ -604,7 +604,8 @@ function validateVersionSensitiveEvents(events, version) {
             (version.version === "2.1.1" && version.patch === 1))) ||
         (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))) ||
         (version.minor === 3 && ((version.version === "2.3.0" && version.patch === 0) ||
-            (version.version === "2.3.1" && version.patch === 1))))) {
+            (version.version === "2.3.1" && version.patch === 1) ||
+            (version.version === "2.3.2" && version.patch === 2))))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/dist/kimi-engine.js

@@ -41,6 +41,7 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.2.0",
     "2.3.0",
     "2.3.1",
+    "2.3.2",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([

package/dist/process-tree.js

@@ -6,7 +6,7 @@ const MAX_DESCENDANT_DEPTH = 8;
 const MAX_DESCENDANT_PIDS = 512;
 const PROCESS_EXIT_POLL_MS = 10;
 const PROCESS_SNAPSHOT_TIMEOUT_MS = 1_000;
-const PROCESS_IDENTITY_PROBE_TIMEOUT_MS = 250;
+const PROCESS_IDENTITY_PROBE_TIMEOUT_MS = 1_000;
 const PROBE_TIMEOUT = Symbol("process-probe-timeout");
 /**
  * Capture descendant ancestry and reusable identities in the same bounded
@@ -23,6 +23,18 @@ export async function collectDescendantIdentities(rootPid) {
     }
     return snapshot;
 }
+/** Return current members of the selected process groups, or undefined when unreadable. */
+export async function collectProcessGroupsIdentities(processGroupIds) {
+    if (process.platform === "win32")
+        return undefined;
+    const groups = new Set(processGroupIds.filter((id) => Number.isInteger(id) && id > 0));
+    if (groups.size === 0)
+        return [];
+    const rows = await raceValueWithTimeout(collectProcessSnapshotRows(), PROCESS_SNAPSHOT_TIMEOUT_MS);
+    if (rows === PROBE_TIMEOUT || rows === undefined)
+        return undefined;
+    return rows.filter((row) => groups.has(row.processGroupId)).map(toProcessIdentity);
+}
 /**
  * Compatibility surface for callers that only need numeric process listings.
  * Cancellation must use collectDescendantIdentities so ancestry and identity
@@ -36,15 +48,21 @@ export async function collectDescendants(rootPid) {
         return [];
     }
 }
-/** Read one reusable process identity. PID alone is not stable across teardown. */
-export async function readProcessIdentity(pid) {
+/** Distinguish a missing process from a failed or timed-out identity probe. */
+export async function probeProcessIdentity(pid) {
     if (!Number.isInteger(pid) || pid <= 0 || process.platform === "win32")
-        return undefined;
+        return { complete: true };
     const read = process.platform === "linux"
         ? readProcessIdentityBatchFromProc([pid])
         : readProcessIdentityBatchWithPs([pid]);
     const batch = await raceValueWithTimeout(read, PROCESS_IDENTITY_PROBE_TIMEOUT_MS);
-    return batch === PROBE_TIMEOUT ? undefined : batch.identities.get(pid);
+    if (batch === PROBE_TIMEOUT)
+        return { complete: false };
+    return { identity: batch.identities.get(pid), complete: batch.complete };
+}
+/** Read one reusable process identity. PID alone is not stable across teardown. */
+export async function readProcessIdentity(pid) {
+    return (await probeProcessIdentity(pid)).identity;
 }
 /**
  * Revalidate all captured identities concurrently under one deadline. The
@@ -63,16 +81,26 @@ export async function revalidateProcessIdentities(expectedIdentities, options =
     if (batch === PROBE_TIMEOUT)
         return { identities: [], complete: false };
     const identities = [];
+    const groupChanged = [];
     for (const expectedIdentity of expected) {
         const current = batch.identities.get(expectedIdentity.pid);
-        if (current !== undefined &&
-            current.startToken === expectedIdentity.startToken &&
-            current.processGroupId === expectedIdentity.processGroupId &&
-            !isQuiescentState(current.state)) {
+        if (current === undefined ||
+            current.startToken !== expectedIdentity.startToken ||
+            isQuiescentState(current.state)) {
+            continue;
+        }
+        if (current.processGroupId !== expectedIdentity.processGroupId) {
+            groupChanged.push(current);
+        }
+        else {
             identities.push(current);
         }
     }
-    return { identities, complete: batch.complete };
+    return {
+        identities,
+        complete: batch.complete,
+        ...(groupChanged.length > 0 ? { groupChanged } : {}),
+    };
 }
 /** Return the current identity only when pid, start token, and PGID still match. */
 export async function revalidateProcessIdentity(expected, identityReader) {
@@ -104,7 +132,7 @@ export async function waitForProcessTreeExit(identities, timeoutMs, options = {}
                 identityReader: options.identityReader,
                 timeoutMs: probeTimeoutMs,
             });
-            active = !validation.complete || validation.identities.length > 0;
+            active = !validation.complete || validation.identities.length > 0 || (validation.groupChanged?.length ?? 0) > 0;
         }
         if (!active)
             return true;
@@ -117,13 +145,13 @@ export async function waitForProcessTreeExit(identities, timeoutMs, options = {}
 async function collectVerifiedDescendantIdentities(rootPid) {
     const initialRows = await collectProcessSnapshotRows();
     if (initialRows === undefined)
-        return [];
+        throw new Error("process snapshot unavailable");
     const candidateRows = descendantRowsFromSnapshot(rootPid, initialRows);
     const initialRoot = initialRows.find((row) => row.pid === rootPid);
     if (initialRoot === undefined || candidateRows.length === 0)
         return [];
-    // A second, targeted snapshot closes the cross-row /proc race: every child
-    // identity and every numeric parent edge must still match before acceptance.
+    // A second, targeted snapshot closes the cross-row /proc race: each child
+    // must retain its PID and start token. Reparenting and PGID changes are not exit.
     const expectedRows = [initialRoot, ...candidateRows];
     const expectedByPid = new Map(expectedRows.map((row) => [row.pid, row]));
     const verificationRows = await readCurrentSnapshotRows(expectedRows);
@@ -131,11 +159,9 @@ async function collectVerifiedDescendantIdentities(rootPid) {
         const expected = expectedByPid.get(current.pid);
         return (expected !== undefined &&
             current.startToken === expected.startToken &&
-            current.processGroupId === expected.processGroupId &&
-            current.parentPid === expected.parentPid &&
             !isQuiescentState(current.state));
     });
-    return descendantRowsFromSnapshot(rootPid, stableRows).map(toProcessIdentity);
+    return stableRows.map(toProcessIdentity);
 }
 function descendantRowsFromSnapshot(rootPid, rows) {
     const root = rows.find((row) => row.pid === rootPid);
@@ -186,6 +212,9 @@ async function readCurrentSnapshotRows(expectedRows) {
         Promise.all(procPids.map((pid) => readProcRow(pid))),
         collectProcessSnapshotRowsFromPs(psPids),
     ]);
+    if (procOutcomes.some((outcome) => outcome.status === "error") || (psPids.length > 0 && psRows === undefined)) {
+        throw new Error("process identity verification failed");
+    }
     return [
         ...procOutcomes.flatMap((outcome) => outcome.status === "found" ? [outcome.row] : []),
         ...(psRows ?? []),
@@ -212,6 +241,8 @@ async function collectProcessSnapshotRowsFromProc() {
     const outcomes = await Promise.all(entries
         .filter((entry) => /^\d+$/.test(entry))
         .map((entry) => readProcRow(Number.parseInt(entry, 10))));
+    if (outcomes.some((outcome) => outcome.status === "error"))
+        return undefined;
     return outcomes.flatMap((outcome) => outcome.status === "found" ? [outcome.row] : []);
 }
 async function collectProcessSnapshotRowsFromPs(pids) {