kimi-plugin-cc 2.4.2 → 2.4.4

package/.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
   },
   "metadata": {
     "description": "Kimi for Claude Code: code questions, reviews, fixes, parallel tasks, and MCP tasks through the local Kimi Code CLI.",
-    "version": "2.4.2"
+    "version": "2.4.4"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi",
   "description": "Kimi for Claude Code: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tasks through the local Kimi Code CLI, with PreToolUse safety hooks.",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "homepage": "https://github.com/linxule/kimi-plugin-cc",
   "repository": "https://github.com/linxule/kimi-plugin-cc",
   "license": "Apache-2.0",

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 > **Post-1.0 release history (v1.0.1 -> present) lives in [ROADMAP-TO-GA.md § Post-GA audit log](./ROADMAP-TO-GA.md#post-ga-audit-log)** and the "Version" / "Upstream compat" lines of [AGENTS.md](./AGENTS.md). Docs-only kimi-code compat checkups that don't bump the plugin version (e.g. the 0.14.2 / 0.14.3 patches) are recorded there, not here. Notable releases are summarized below; the GA entry and full pre-GA detail follow.
 
+## 2.4.4 — 2026-10-29
+
+- Certify exact kimi-code 2.4.0 for all eight native-v2 operations after exact-source review, revised plan and swarm controls, and candidate/production smoke. See [evidence](docs/upstream-2.4.0-certification.md).
+- Adapt certification to removed EnterPlanMode and fresh-print default-plan cancellation without relaxing config, hook-deny, or journal-taint closures. Add only the reviewed 2.4.0 activation and hook-schema entries.
+- Allow a bounded 15 seconds for graceful web shutdown after exact 2.4.0 exceeded the prior 5-second bound and exited cleanly in 6.743 seconds. Disable ambient idle-session reclamation for plugin-owned lifecycle processes. Preserve cleanup verification, process identity, durable recovery, workspace confinement, concurrency, and the legacy-v1 0.41.x boundary.
+- Reject ignored sync-conflict copies during package validation so local generated debris cannot silently enter the npm archive.
+
+## 2.4.3 — 2026-10-27
+
+- Certify exact kimi-code 2.3.3 for all eight native-v2 operations after exact-source review, plan and swarm controls, and candidate/production smoke. See [evidence](docs/upstream-2.3.3-certification.md).
+- Add only the reviewed 2.3.3 activation and hook-schema entries. Preserve no-plan enforcement, workspace confinement, concurrency, bounded cleanup and durable recovery; legacy-v1 remains capped at 0.41.x.
+- Expand the compatibility audit to cover the web activation server explicitly, and refresh current compatibility/status documentation without changing installed hosts.
+
 ## 2.4.2 — 2026-10-26
 
 - Integrate community PR #22's structured spawn-error classification, preserving contributor history. Bound the additional diagnostic message. Known argument/resource exhaustion no longer receives reinstall advice.

package/README.md

@@ -40,7 +40,7 @@ You need:
 - macOS or Linux
 - Claude Code or Codex with plugin support
 - Node.js 22.5 or newer
-- Kimi Code CLI 2.3.2 (certified; 2.3.1 and 2.3.0 are also certified)
+- Kimi Code CLI 2.4.0 (certified; 2.3.3, 2.3.2, 2.3.1 and 2.3.0 are also certified)
 
 Windows is not currently supported. Contributors can help with the [no-model Windows diagnostics checks](./docs/windows-validation.md). Check your versions in a terminal:
 
@@ -105,10 +105,10 @@ Codex. Published releases are also available as
 both compiled plugin distributions. No Bun, TypeScript, or install scripts are
 needed to use the package. Kimi Code CLI and Node are still prerequisites.
 
-For an explicitly versioned local Claude Code plugin, this example pins the published 2.4.2 package:
+For an explicitly versioned local Claude Code plugin, this example pins the 2.4.4 package:
 
 ```sh
-npm install --prefix ~/.local/share/kimi-plugin-cc kimi-plugin-cc@2.4.2
+npm install --prefix ~/.local/share/kimi-plugin-cc kimi-plugin-cc@2.4.4
 claude --plugin-dir ~/.local/share/kimi-plugin-cc/node_modules/kimi-plugin-cc
 ```
 
@@ -228,7 +228,7 @@ All refusal codes and their remedies are listed in the [refusal-code catalog](./
 
 The tool rules for ask, review, challenge, and read-only swarm deny file writes and shell commands. Rescue and pursue can write files in your workspace. Swarm with `--write` works in a temporary Git worktree. It starts from your latest commit, so it does not include uncommitted changes. It returns a patch without applying it to your project.
 
-For swarm on CLI 2.3.2, the plugin briefly starts an authenticated loopback `kimi web` process to activate a session and another to deactivate swarm mode afterward; one ordinary `kimi -p -r` process still performs the task. Activation counts against the time limit, the access token stays in memory and out of logs, and cleanup failure prevents success. Older certified versions use `kimi -p` directly.
+For swarm on CLI 2.3.2, 2.3.3 and 2.4.0, the plugin briefly starts an authenticated loopback `kimi web` process to activate a session and another to deactivate swarm mode afterward; one ordinary `kimi -p -r` process still performs the task. Activation counts against the time limit, the access token stays in memory and out of logs, and cleanup failure prevents success. Older certified versions use `kimi -p` directly.
 
 The plugin does not commit changes. Review changes before you keep or apply them.
 
@@ -264,7 +264,7 @@ Contributors need Bun to run `bun run check`. The detailed engineering documents
 - macOS 或 Linux
 - 支持插件的 Claude Code 或 Codex
 - Node.js 22.5 或更高版本
-- Kimi Code CLI 2.3.2（已认证；2.3.1 和 2.3.0 也已认证）
+- Kimi Code CLI 2.4.0（已认证；2.3.3、2.3.2、2.3.1 和 2.3.0 也已认证）
 
 目前不支持 Windows。在终端检查版本：
 
@@ -427,7 +427,7 @@ codex plugin add kimi@kimi-marketplace
 
 Ask、review、challenge 和只读 swarm 的工具规则禁止写入文件和执行 shell 命令。Rescue 和 pursue 可以修改工作区内的文件。带 `--write` 的 swarm 在临时 Git 工作树中操作。它从最新提交开始，不包含尚未提交的修改。任务结束后返回补丁，不会自动应用到项目。
 
-在 CLI 2.3.2 上运行 swarm 时，插件会短暂启动需要认证的本地回环 `kimi web` 进程来激活会话，并在结束后再次启动以停用 swarm 模式；任务本身仍由一个普通的 `kimi -p -r` 进程执行。激活计入任务时限，访问令牌只保存在内存且不会写入日志；无法确认清理完成时，任务不会报告成功。较早的已认证版本仍直接通过 `kimi -p` 运行。
+在 CLI 2.3.2、2.3.3 和 2.4.0 上运行 swarm 时，插件会短暂启动需要认证的本地回环 `kimi web` 进程来激活会话，并在结束后再次启动以停用 swarm 模式；任务本身仍由一个普通的 `kimi -p -r` 进程执行。激活计入任务时限，访问令牌只保存在内存且不会写入日志；无法确认清理完成时，任务不会报告成功。较早的已认证版本仍直接通过 `kimi -p` 运行。
 
 插件不会提交修改。保留或应用修改前，请先审查。
 
@@ -463,7 +463,7 @@ Il vous faut :
 - macOS ou Linux
 - une version de Claude Code ou de Codex prenant en charge les plugins
 - Node.js 22.5 ou une version ultérieure
-- Kimi Code CLI 2.3.2 (certifiée ; les versions 2.3.1 et 2.3.0 sont également certifiées)
+- Kimi Code CLI 2.4.0 (certifiée ; les versions 2.3.3, 2.3.2, 2.3.1 et 2.3.0 sont également certifiées)
 
 Windows n'est pas pris en charge actuellement. Vérifiez les versions dans un terminal :
 
@@ -626,7 +626,7 @@ Tous les codes de refus et leurs remèdes sont répertoriés dans le [catalogue
 
 Les règles des modes ask, review, challenge et swarm en lecture seule interdisent les écritures et les commandes shell. Rescue et pursue peuvent modifier les fichiers de votre espace de travail. Swarm avec `--write` travaille dans un worktree Git temporaire. Il part du dernier commit et n'inclut donc pas les modifications non commitées. Il renvoie un patch sans l'appliquer à votre projet.
 
-Avec le CLI 2.3.2, les tâches swarm lancent brièvement un processus `kimi web` authentifié sur l'interface de boucle locale pour activer la session, puis un second pour désactiver le mode swarm ; un seul processus `kimi -p -r` ordinaire exécute toujours la tâche. L'activation est comptée dans la limite de temps, le jeton reste en mémoire et hors des journaux, et l'échec du nettoyage empêche de déclarer la réussite. Les versions certifiées antérieures utilisent directement `kimi -p`.
+Avec le CLI 2.3.2, 2.3.3 et 2.4.0, les tâches swarm lancent brièvement un processus `kimi web` authentifié sur l'interface de boucle locale pour activer la session, puis un second pour désactiver le mode swarm ; un seul processus `kimi -p -r` ordinaire exécute toujours la tâche. L'activation est comptée dans la limite de temps, le jeton reste en mémoire et hors des journaux, et l'échec du nettoyage empêche de déclarer la réussite. Les versions certifiées antérieures utilisent directement `kimi -p`.
 
 Le plugin ne crée aucun commit. Examinez les modifications avant de les conserver ou de les appliquer.
 
@@ -662,7 +662,7 @@ Les contributeurs ont besoin de Bun pour exécuter `bun run check`. La documenta
 - macOS または Linux
 - プラグインに対応した Claude Code または Codex
 - Node.js 22.5 以降
-- Kimi Code CLI 2.3.2（認証済み。2.3.1 と 2.3.0 も認証済み）
+- Kimi Code CLI 2.4.0（認証済み。2.3.3、2.3.2、2.3.1 と 2.3.0 も認証済み）
 
 現在、Windows には対応していません。ターミナルでバージョンを確認します。
 
@@ -825,7 +825,7 @@ codex plugin add kimi@kimi-marketplace
 
 Ask、review、challenge、読み取り専用 swarm のツールルールでは、ファイルへの書き込みとシェルコマンドを禁止しています。Rescue と pursue はワークスペース内のファイルを変更できます。`--write` を指定した swarm は、一時的な Git ワークツリーで作業します。最新のコミットから開始するため、未コミットの変更は含まれません。パッチを返すだけで、プロジェクトには自動適用しません。
 
-CLI 2.3.2 の swarm では、セッションを有効化するため、そして終了後に swarm モードを無効化するため、認証付きのローカルループバック `kimi web` プロセスをそれぞれ短時間だけ起動します。タスク自体は従来どおり 1 つの `kimi -p -r` プロセスが実行します。有効化も制限時間に含まれ、トークンはメモリー内にのみ保持されてログには出ません。後処理を確認できない場合、タスクは成功と報告されません。以前の認証済みバージョンでは、引き続き `kimi -p` を直接使います。
+CLI 2.3.2 / 2.3.3 / 2.4.0 の swarm では、セッションを有効化するため、そして終了後に swarm モードを無効化するため、認証付きのローカルループバック `kimi web` プロセスをそれぞれ短時間だけ起動します。タスク自体は従来どおり 1 つの `kimi -p -r` プロセスが実行します。有効化も制限時間に含まれ、トークンはメモリー内にのみ保持されてログには出ません。後処理を確認できない場合、タスクは成功と報告されません。以前の認証済みバージョンでは、引き続き `kimi -p` を直接使います。
 
 プラグインは変更をコミットしません。変更を残す、または適用する前に内容を確認してください。
 

package/dist/cli-client.js

@@ -814,6 +814,8 @@ export function buildKimiCliEnvironment(opts) {
     // The update preflight runs on the `-p` path too; a plugin spawn must never
     // swap the certified binary underneath the execution plan.
     env.KIMI_CODE_NO_AUTO_UPDATE = "1";
+    // Plugin-owned web lifecycles must not inherit ambient idle-session reclamation.
+    env.KIMI_CODE_SESSION_IDLE_RECLAIM_MS = "0";
     // Rescue and pursue share the write label. Only the immutable execution
     // plan can grant pursue's narrow goal-metadata access; never trust ambient
     // state inherited from another plugin job.

package/dist/commands/swarm.js

@@ -28,8 +28,8 @@ import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js
 // only the wall-clock hard bound. Read/write modes reuse review/rescue lineage,
 // and the mandatory PreToolUse hook enforces read-only policy or trusted-worktree
 // write confinement on the coordinator and every subagent. Write mode requires
-// kimi-code 0.18.0+. Exact 2.3.2 additionally activates a same-job session through
-// a bounded loopback web lifecycle, then resumes it through the normal print path.
+// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3 and 2.4.0 additionally activate a same-job
+// session through a bounded loopback web lifecycle, then resume it through the normal print path.
 const SWARM_SUMMARY_MAX = 120;
 const SWARM_AGENT_PROFILE = "<swarm>";
 const SWARM_WRITE_AGENT_PROFILE = "<swarm-write>";

package/dist/hooks/config-safety.js

@@ -594,9 +594,9 @@ function validateVersionSensitiveEvents(events, version) {
     }
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
     // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3),
-    // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e) and 2.3.2 (b8dd3a13): the additive
-    // events and HookDefSchema are unchanged. Require the full version string AND matching components;
-    // no inferred 2.x compatibility.
+    // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e), 2.3.2 (b8dd3a13), 2.3.3 (ec495f0c),
+    // and 2.4.0 (f26e4d91): the additive events and HookDefSchema are unchanged.
+    // Require the full version string AND matching components; no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
         (version.version === "2.0.1" && version.patch === 1) ||
         (version.version === "2.0.2" && version.patch === 2))) ||
@@ -605,7 +605,9 @@ function validateVersionSensitiveEvents(events, version) {
         (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))) ||
         (version.minor === 3 && ((version.version === "2.3.0" && version.patch === 0) ||
             (version.version === "2.3.1" && version.patch === 1) ||
-            (version.version === "2.3.2" && version.patch === 2))))) {
+            (version.version === "2.3.2" && version.patch === 2) ||
+            (version.version === "2.3.3" && version.patch === 3))) ||
+        (version.minor === 4 && ((version.version === "2.4.0" && version.patch === 0))))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/dist/kimi-engine.js

@@ -42,6 +42,8 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.3.0",
     "2.3.1",
     "2.3.2",
+    "2.3.3",
+    "2.4.0",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([

package/dist/swarm-activation.js

@@ -9,10 +9,11 @@ import { assertExecutionPlanMatchesSpawn, assertNoUnsafeExperimentalSelector, }
 import { resolveKimiHome } from "./kimi-home.js";
 import { assertNativeV2Preflight } from "./native-v2-preflight.js";
 import { collectDescendantIdentities, collectProcessGroupsIdentities, probeProcessIdentity, revalidateProcessIdentities, waitForProcessTreeExit, } from "./process-tree.js";
-const PREACTIVATION_VERSION = "2.3.2";
+const PREACTIVATION_VERSIONS = ["2.3.2", "2.3.3", "2.4.0"];
 const READY_TIMEOUT_MS = 10_000;
 const REST_TIMEOUT_MS = 5_000;
-const SHUTDOWN_TIMEOUT_MS = 5_000;
+// Exact 2.4.0 can take longer than 5s to drain session/workspace lifecycle work.
+const SHUTDOWN_TIMEOUT_MS = 15_000;
 const JOURNAL_TIMEOUT_MS = 2_000;
 const JOURNAL_POLL_MS = 50;
 const READY_LINE_MAX_CHARS = 65_536;
@@ -25,7 +26,7 @@ const ESCALATION_MS = 1_500;
 const POST_KILL_QUIESCENCE_MS = 500;
 const ENV_MODEL_ALIAS = "__kimi_env_model__";
 export function requiresSwarmPreactivation(version) {
-    return version === PREACTIVATION_VERSION;
+    return version !== null && PREACTIVATION_VERSIONS.includes(version);
 }
 export async function preactivateSwarmSession(options) {
     const failureCode = "SWARM_ACTIVATION_FAILED";
@@ -116,7 +117,7 @@ async function prepareWebSpawn(options, failureCode) {
     }
     const expectedVersion = options.expectedVersion ?? options.executionPlan.kimiVersion;
     if (expectedVersion === null || !requiresSwarmPreactivation(expectedVersion)) {
-        throw failure(failureCode, "swarm-activation.version", `Swarm web preactivation requires exact kimi-code ${PREACTIVATION_VERSION}.`);
+        throw failure(failureCode, "swarm-activation.version", `Swarm web preactivation requires exact kimi-code ${PREACTIVATION_VERSIONS.join(" or ")}.`);
     }
     const kimiHome = resolveKimiHome(options.env, options.cwd);
     if (options.executionPlan.intendedEngine === "native-v2") {

package/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.4.2";
+export const KIMI_PLUGIN_CC_VERSION = "2.4.4";

package/docs/migration.md

@@ -1,6 +1,6 @@
 # Compatibility and upgrades
 
-Plugin 2.4.1 certifies Kimi Code CLI 2.3.2 for all eight operations, alongside exact native-v2 versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, and `2.3.1`. Later patches and minor releases are not accepted automatically. The npm distribution adds an installation channel; it does not change this compatibility table.
+Plugin 2.4.4 certifies Kimi Code CLI 2.4.0 for all eight operations, alongside exact native-v2 versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, and `2.3.3`. Later patches and minor releases are not accepted automatically. The npm distribution adds an installation channel; it does not change this compatibility table.
 
 Explicitly pinned legacy-v1 binaries remain supported within `KIMI_TESTED_MINORS`, through 0.41.x, subject to each operation's minimum version. The [runtime table](../runtime/kimi-engine.ts) is the authority.
 
@@ -8,17 +8,17 @@ Use the [README installation and update steps](../README.md) for Claude Code or
 
 ## Plugin versions and upgrades
 
-Plugin versions advance independently using ordinary SemVer and may deliberately align with a certified CLI release. Plugin 2.4.1 certifies exact CLI 2.3.2; the nearby numbers do not imply version alignment. Published versions and tags are never reused. Every upstream patch requires its own certification. The native-v2 no-plan profile, plugin/marketplace IDs and existing job store are preserved.
+Plugin versions advance independently using ordinary SemVer and may deliberately align with a certified CLI release. Plugin 2.4.4 certifies exact CLI 2.4.0; the nearby numbers do not imply version alignment. Published versions and tags are never reused. Every upstream patch requires its own certification. The native-v2 no-plan profile, plugin/marketplace IDs and existing job store are preserved.
 
-## CLI 2.3.2 swarm activation
+## CLI 2.3.2, 2.3.3 and 2.4.0 swarm activation
 
-Upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print sessions. On that exact version only, swarm commands and MCP calls use the same `runSwarm` lifecycle:
+Upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print sessions. On exact 2.3.2, 2.3.3 and 2.4.0, swarm commands and MCP calls use the same `runSwarm` lifecycle:
 
-1. A short-lived `web --no-open --host 127.0.0.1 --port 0 --log-level error` process uses authenticated loopback routes to verify the exact v2 server, choose the explicit or configured default model, create a session, bind the model and auto permission, enable and verify `swarm_mode`, and shut down.
+1. A short-lived `web --no-open --host 127.0.0.1 --port 0 --log-level error` process uses authenticated loopback routes to verify the exact v2 server, choose the explicit or configured default model, create a session, bind the model and auto permission, enable and verify `swarm_mode`, and shut down. The child environment sets `KIMI_CODE_SESSION_IDLE_RECLAIM_MS=0` to disable ambient idle-session reclamation.
 2. One ordinary `kimi -p -r` prompt runner resumes that session. Its recorded session-id source is `preactivated`, and the returned print session must match it.
 3. A second short-lived web lifecycle disables swarm mode, verifies status and the `swarm_mode.exit` journal record, and shuts down.
 
-Activation is inside the job's finite budget. `runSwarm` solely owns deactivation: normal cleanup uses the remaining budget, while failure recovery has a separate two-second cancellation-aware bound and is never retried. Print/session failures stay primary. The ready token stays in memory and out of logs, and success cannot complete if cleanup fails. Post-mutation identity or process/group uncertainty preserves diagnostics and, for write-swarm, the recovery worktree. Process groups are rechecked after teardown; unknown survivors are unverified and unproven groups are not signalled. Older certified versions still launch swarm directly with `kimi -p`. This narrow lifecycle is not a full RPC transport or a model-driven activation workaround; the managed hook and workspace boundaries still govern every tool call.
+Activation is inside the job's finite budget. Graceful process close has a bounded 15-second allowance. `runSwarm` solely owns deactivation: normal cleanup uses the remaining budget, while failure recovery has a separate two-second cancellation-aware bound and is never retried. Print/session failures stay primary. The ready token stays in memory and out of logs, and success cannot complete if cleanup fails. Post-mutation identity or process/group uncertainty preserves diagnostics and, for write-swarm, the recovery worktree. Process groups are rechecked after teardown; unknown survivors are unverified and unproven groups are not signalled. Older certified versions still launch swarm directly with `kimi -p`. This narrow lifecycle is not a full RPC transport or a model-driven activation workaround; the managed hook and workspace boundaries still govern every tool call.
 
 After updating the plugin, run Claude Code `/kimi:setup` or Codex `$kimi-setup`
 from that host's active install to re-pin its version-stamped hook path, then

package/docs/registry-releases.md

@@ -6,6 +6,12 @@ remain available. The package has no install scripts and no separate CLI.
 
 ## Publishing status
 
+Plugin **2.4.4** adds exact CLI **2.4.0** certification for all eight operations,
+with the existing host-preactivated swarm lifecycle and durable recovery.
+See the [certification record](./upstream-2.4.0-certification.md).
+Release execution and registry verification are recorded in the release notes;
+publication uses the same validated-tarball OIDC workflow below.
+
 Plugin **2.4.2** adds durable interrupted-swarm recovery and Windows spawn diagnostics.
 Exact CLI certification remains unchanged through **2.3.2**; this is not a new
 Windows-support or large-prompt-transport claim. See the [release](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.2),
@@ -87,11 +93,12 @@ bun run check
 bun run check:package .tmp/npm
 ```
 
-The package check inspects the actual tarball, verifies runtime copies and
-vendored licenses, and installs/checks the safety hook in isolated homes for
-both hosts. It also exercises unsupported-version refusal using a fake CLI and
-modern MCP discovery plus legacy initialization on both extracted compiled
-distributions. It does not invoke a model or read the maintainer's Kimi configuration.
+The package check inspects the actual tarball, rejects sync-conflict copies in
+any path component, verifies runtime copies and vendored licenses, and
+installs/checks the safety hook in isolated homes for both hosts. It also
+exercises unsupported-version refusal using a fake CLI and modern MCP discovery
+plus legacy initialization on both extracted compiled distributions. It does
+not invoke a model or read the maintainer's Kimi configuration.
 
 ## First publication (completed bootstrap reference)
 

package/docs/safety.md

@@ -2,7 +2,7 @@
 
 This guide describes the current checkout runtime. Read-only tasks deny file writes and shell commands. Rescue and pursue can edit your workspace. Write-swarm returns a patch from a temporary Git worktree.
 
-Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, and `2.3.2`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
+Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, `2.3.3`, and `2.4.0`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
 
 ## Why the safety story is hook-based
 
@@ -205,15 +205,15 @@ If another installed host still points to an older hook, that hook may veto thes
 - **Resume is intentionally not exposed yet.** In goal mode `goal.summary` emits a *goalId* distinct from the resume-hint *sessionId*; `kimi -r <sessionId>` re-enters the session but not necessarily the goal continuation. The plugin captures and surfaces the goalId but does not offer `--resume` for pursue until that split is reconciled upstream — exposing it now would be a silent-failure trap. **Re-verified against kimi-code 0.26.0 (2026-07-16):** the headless CLI still has no argv, prompt syntax, or session-resume path that calls `resumeGoal()`. `parseHeadlessGoalCreate` (`apps/kimi-code/src/cli/goal-prompt.ts`) accepts only the `/goal <objective>` *create* shape on both the v1 and experimental-v2 drivers, and upstream's own docs (`docs/en/guides/goals.md`, § "Use goal mode carefully") state that in non-interactive prompt mode *only goal creation is supported* — goal management is a TUI/kimi-web control. PR #552 makes a plain `-r <sessionId>` correctly *restore* the paused goal snapshot, but nothing in the headless path *acts* on it; the real `resumeGoal()` is wired only to the TUI (`/goal resume`) and kimi-web RPC (PR #1693, web-only). Implementing `--resume` would therefore require either prompt-injected model compliance (rejected — the plugin bounds autonomy with hard limits, not model goodwill) or abandoning the subprocess model for kimi-web's RPC. Re-check if upstream ever ships a headless `goal resume` verb.
 - **A model-invocable `kimi-pursue` agent (v1.3) wraps this command.** The main thread can dispatch autonomous goal mode, not just the human-typed `/kimi:pursue` — the same command↔agent mirror as rescue/review/swarm. Auto-dispatch does NOT widen the blast radius: pursue runs under `commandLabel: "rescue"`, so the managed PreToolUse hook + workspace allowlist gate every tool call on every continuation turn (no git mutation), and the mandatory `--budget` wall-clock ceiling bounds the autonomy regardless of who launched it. Because it is write-capable AND autonomous — the plugin's highest blast radius — the agent's description requires an explicit user request for hands-off multi-turn pursuit, steers single bounded tasks to `kimi-rescue`, and never auto-promotes a fix or a question into a goal loop. Like the command, it refuses without the hook and offers no `--resume`.
 
-## Swarm activation on CLI 2.3.2
+## Swarm activation on CLI 2.3.2, 2.3.3 and 2.4.0
 
 For interrupted runs, see [durable recovery and its explicit limits](swarm-recovery.md).
 
 Upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print sessions. A rejected call can therefore coexist with zero child journals and a successful exit; a tool-call record, aggregate denial, or coordinator-produced patch does not prove fan-out. The plugin does not use prompt workarounds or replace its print transport with general RPC.
 
-For versions requiring activation (currently exact 2.3.2), both slash-command and MCP swarm operations use the same `runSwarm` implementation and one ordinary `kimi -p -r` prompt runner per job, bracketed by short-lived host-managed web lifecycles:
+For versions requiring activation (currently exact 2.3.2, 2.3.3 and 2.4.0), both slash-command and MCP swarm operations use the same `runSwarm` implementation and one ordinary `kimi -p -r` prompt runner per job, bracketed by short-lived host-managed web lifecycles:
 
-1. The exact planned CLI starts `web --no-open --host 127.0.0.1 --port 0 --log-level error`. The plugin accepts only the expected loopback ready URL, uses a supplied token for authenticated REST requests, and keeps that token in memory, never writing it to logs. `/api/v1/meta` must confirm backend v2, the exact planned version, and no dangerous authentication bypass. The plugin uses the explicit model or environment-model alias, otherwise reading the default alias from `/api/v1/config`; creates a session in the job cwd; binds that model with `permission_mode:auto` and `swarm_mode:true`; verifies those settings and `plan_mode:false` through `/status`; verifies clean shutdown; and requires the main journal's manual `swarm_mode.enter` record.
+1. The exact planned CLI starts `web --no-open --host 127.0.0.1 --port 0 --log-level error`. The child environment sets `KIMI_CODE_SESSION_IDLE_RECLAIM_MS=0`, so ambient idle-session reclamation cannot disrupt the plugin-owned lifecycle. The plugin accepts only the expected loopback ready URL, uses a supplied token for authenticated REST requests, and keeps that token in memory, never writing it to logs. `/api/v1/meta` must confirm backend v2, the exact planned version, and no dangerous authentication bypass. The plugin uses the explicit model or environment-model alias, otherwise reading the default alias from `/api/v1/config`; creates a session in the job cwd; binds that model with `permission_mode:auto` and `swarm_mode:true`; verifies those settings and `plan_mode:false` through `/status`; verifies clean shutdown; and requires the main journal's manual `swarm_mode.enter` record.
 2. The ordinary stream-json print runner resumes that session with `kimi -p -r`. The job records `kimi_session_id_source:"preactivated"`, and the session returned by print must exactly match the preactivated id. Every coordinator and child tool call remains governed by the same managed PreToolUse hook and operation allowlist.
 3. After the print run, a second web lifecycle sets `swarm_mode:false`, verifies `/status`, shuts down cleanly, and requires `swarm_mode.exit` in the main journal. Activation consumes part of the same finite job budget rather than extending it. `runSwarm` solely owns session deactivation: normal cleanup uses the remaining budget, while failure recovery has a separate two-second cancellation-aware bound and is never retried. Print/session failures stay primary, with exit codes and cleanup diagnostics preserved. Cancellation aborts the owned lifecycle and never starts a fresh cleanup server. Every post-mutation failure retains the session identity; process/group uncertainty is marked without inventing an ID; process groups are rechecked after teardown, unknown survivors are unverified, unproven groups are never signalled, and a same-PID/start-token process that changes PGID remains active but is not a validated signal target. Root loss requires a previously observed matching identity; first-missing roots and actual probe errors/timeouts remain unverified. Reparenting and PGID moves preserve the current verified child identity for revalidation rather than treating it as exited. Unverified cleanup prevents success and preserves raw output, structured diagnostics, and the write worktree for recovery.
 
@@ -224,7 +224,7 @@ Older certified versions keep the direct `kimi -p` path. The web processes are n
 `/kimi:swarm` (v1.2) fans a **read-only** review out across subagents using kimi-code's `AgentSwarm` tool (kimi-code 0.12.0+). The coordinator launches one subagent per target (file/module/question); each inspects the workspace with read tools and reports findings, which the coordinator consolidates into one markdown report. It opens **zero new write surface**.
 
 - **The hook label is `swarm`, and it allows the read-only tool set PLUS `AgentSwarm`.** The coordinator must be allowed to call `AgentSwarm` (else the swarm never launches), but no write/edit/shell tool is allowed. The exact allowed tool name is `AgentSwarm` (verified at 0.42.0 against `packages/agent-core-v2/src/features/swarm/tools/agent-swarm/agentSwarmTool.ts`: `'AgentSwarm'`, strict schema). The singular `Agent` tool is deliberately *not* allowed — swarm is the fan-out surface, not arbitrary delegation.
-- **Every subagent inherits the `swarm` label and fires the same hook.** On native v2 (0.42.0) `AgentSwarm` children run in-process in a child DI scope with their OWN eager external-hooks service, so every child tool call passes the same before-execute channel and the same managed hook — there is no sub-vs-main branch and no deny-all shortcut on the swarm route. So a subagent's `Write`/`Edit`/`Bash` is denied exactly like a single-turn review's. The swarm listener in that channel is non-terminal and nothing auto-approves `AgentSwarm` ahead of the hook. (Legacy-v1 ≤ 0.41 reached the same result by placing the hook policy at index 0 of every agent's permission stack.) **Required for final certification evidence** (`tests/runtime/real-binary-smoke.test.ts`, run via `bun run smoke:real`): distinct child journals must exist, and each assigned Write/Edit `path` must be correlated through its `toolCallId` with the managed denial in that exact tool result; unrelated denials and coordinator-only reports are insufficient. On 2.3.2, targeted controls also prove that direct OFF produces no children while the preactivated ON path produces the real child journals and denials.
+- **Every subagent inherits the `swarm` label and fires the same hook.** On native v2 (0.42.0) `AgentSwarm` children run in-process in a child DI scope with their OWN eager external-hooks service, so every child tool call passes the same before-execute channel and the same managed hook — there is no sub-vs-main branch and no deny-all shortcut on the swarm route. So a subagent's `Write`/`Edit`/`Bash` is denied exactly like a single-turn review's. The swarm listener in that channel is non-terminal and nothing auto-approves `AgentSwarm` ahead of the hook. (Legacy-v1 ≤ 0.41 reached the same result by placing the hook policy at index 0 of every agent's permission stack.) **Required for final certification evidence** (`tests/runtime/real-binary-smoke.test.ts`, run via `bun run smoke:real`): distinct child journals must exist, and each assigned Write/Edit `path` must be correlated through its `toolCallId` with the managed denial in that exact tool result; unrelated denials and coordinator-only reports are insufficient. On 2.3.2, 2.3.3 and 2.4.0, targeted controls also prove that direct OFF produces no children while the preactivated ON path produces the real child journals and denials.
 - **The managed hook is the read-only boundary; no `explore`-profile second layer is assumed.** Production deliberately omits `subagent_type` for read-only swarm rather than selecting kimi-code's `explore` profile. Every coordinator and subagent tool call is enforced by the same managed hook.
 - **Swarm refuses without the hook, like every model-spawning command.** A swarm makes the reason especially acute: it asks for up to `--cap` subagents, but this total-count hint is advisory, so a missing hook would remove enforcement from all of them at once. `KIMI_PLUGIN_CC_SKIP_HOOK_CHECK=1` remains an explicit tests/diagnostics escape hatch, not a recovery path.
 - **The only new risk is COST, and the plugin bounds it.** Read-only swarm writes nothing, so the new risk is runaway cost from N parallel model runs (and possible nested `AgentSwarm`). `/kimi:swarm` enforces a **mandatory finite wall-clock ceiling** via its AbortController (`--budget`, default 30m); the SIGTERM→SIGKILL descendant-reaping cancellation reaps the whole subagent process tree. Two **distinct** subagent bounds: `--cap N` is a *soft* prompt-injected hint on TOTAL subagent count (the hook is stateless and cannot enforce a count, so the model may exceed it), and `--max-concurrency N` is a *hard* ceiling on how many subagents kimi-code's `SubagentBatch` runs concurrently — exported as `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` (PR #888) on **kimi-code 0.18.0+** (older binaries ignore the unknown env var, so on < 0.18 only the soft hint applies). It **defaults to 4** when the user passes none (`resolveSwarmMaxConcurrency` in swarm.ts), so every swarm run — agent-dispatched or human-typed — carries an enforced peak-parallelism ceiling on 0.18.0+ rather than falling back to kimi-code's internal ramp; pass an explicit value to widen or throttle. **Never merge them into one flag:** concurrency ≠ total count — a hard concurrency cap of N still permits more than N subagents over the life of the run, just never more than N at once. The `--budget` bounds elapsed time, not a dollar amount or total token count; `--max-concurrency` bounds *peak* parallelism (the spike in simultaneous model spend), and `--cap` is only an advisory total-count nudge. Folding both onto one flag would create the "cap-as-total-count illusion" — a user reading `--cap N` would expect a total bound but receive only a peak-parallelism one.
@@ -293,9 +293,9 @@ at it (the runtime resolves that path instead of `kimi` on `PATH`; every spawn
 still exports `KIMI_CODE_NO_AUTO_UPDATE=1`, so the pinned copy never drifts).
 
 ```sh
-PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.3.2
+PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.4.0
 mkdir -p "$PIN" && cd "$PIN" && printf '{"name":"kimi-plugin-cc-pin","private":true}\n' > package.json
-bun add @moonshot-ai/kimi-code@2.3.2
+npm install @moonshot-ai/kimi-code@2.4.0
 export KIMI_PLUGIN_CC_KIMI_BIN="$PIN/node_modules/.bin/kimi"   # e.g. in ~/.zshenv
 ```
 

package/docs/swarm-recovery.md

@@ -2,7 +2,7 @@
 
 Normal stop: use `scripts/companion.sh cancel` for a shell-owned run, or the MCP job cancel tool for an MCP-owned run. A hard kill cannot execute cleanup. Cancellation still starts no fresh cleanup server.
 
-For exact CLI 2.3.2 swarm runs created by this runtime, status includes a durable `swarm_recovery` record. It contains the resolved home/workspace, companion identity, launch intent, verified process identities and session identity. It never contains the web authentication token, credentials, prompt or config contents. Session identity is committed before the request enabling swarm mode.
+For exact CLI 2.3.2, 2.3.3 and 2.4.0 swarm runs created by this runtime, status includes a durable `swarm_recovery` record. It contains the resolved home/workspace, companion identity, launch intent, verified process identities and session identity. It never contains the web authentication token, credentials, prompt or config contents. Session identity is committed before the request enabling swarm mode.
 
 ## Preview, then recover
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "Kimi for Claude Code and Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
   "type": "module",
   "engines": {

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "Kimi for Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP job controls through the local Kimi Code CLI.",
   "author": {
     "name": "linxule"

package/plugins/kimi-codex/dist/cli-client.js

@@ -814,6 +814,8 @@ export function buildKimiCliEnvironment(opts) {
     // The update preflight runs on the `-p` path too; a plugin spawn must never
     // swap the certified binary underneath the execution plan.
     env.KIMI_CODE_NO_AUTO_UPDATE = "1";
+    // Plugin-owned web lifecycles must not inherit ambient idle-session reclamation.
+    env.KIMI_CODE_SESSION_IDLE_RECLAIM_MS = "0";
     // Rescue and pursue share the write label. Only the immutable execution
     // plan can grant pursue's narrow goal-metadata access; never trust ambient
     // state inherited from another plugin job.

package/plugins/kimi-codex/dist/commands/swarm.js

@@ -28,8 +28,8 @@ import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js
 // only the wall-clock hard bound. Read/write modes reuse review/rescue lineage,
 // and the mandatory PreToolUse hook enforces read-only policy or trusted-worktree
 // write confinement on the coordinator and every subagent. Write mode requires
-// kimi-code 0.18.0+. Exact 2.3.2 additionally activates a same-job session through
-// a bounded loopback web lifecycle, then resumes it through the normal print path.
+// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3 and 2.4.0 additionally activate a same-job
+// session through a bounded loopback web lifecycle, then resume it through the normal print path.
 const SWARM_SUMMARY_MAX = 120;
 const SWARM_AGENT_PROFILE = "<swarm>";
 const SWARM_WRITE_AGENT_PROFILE = "<swarm-write>";

package/plugins/kimi-codex/dist/hooks/config-safety.js

@@ -594,9 +594,9 @@ function validateVersionSensitiveEvents(events, version) {
     }
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
     // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3),
-    // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e) and 2.3.2 (b8dd3a13): the additive
-    // events and HookDefSchema are unchanged. Require the full version string AND matching components;
-    // no inferred 2.x compatibility.
+    // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e), 2.3.2 (b8dd3a13), 2.3.3 (ec495f0c),
+    // and 2.4.0 (f26e4d91): the additive events and HookDefSchema are unchanged.
+    // Require the full version string AND matching components; no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
         (version.version === "2.0.1" && version.patch === 1) ||
         (version.version === "2.0.2" && version.patch === 2))) ||
@@ -605,7 +605,9 @@ function validateVersionSensitiveEvents(events, version) {
         (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))) ||
         (version.minor === 3 && ((version.version === "2.3.0" && version.patch === 0) ||
             (version.version === "2.3.1" && version.patch === 1) ||
-            (version.version === "2.3.2" && version.patch === 2))))) {
+            (version.version === "2.3.2" && version.patch === 2) ||
+            (version.version === "2.3.3" && version.patch === 3))) ||
+        (version.minor === 4 && ((version.version === "2.4.0" && version.patch === 0))))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/plugins/kimi-codex/dist/kimi-engine.js

@@ -42,6 +42,8 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.3.0",
     "2.3.1",
     "2.3.2",
+    "2.3.3",
+    "2.4.0",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([

package/plugins/kimi-codex/dist/swarm-activation.js

@@ -9,10 +9,11 @@ import { assertExecutionPlanMatchesSpawn, assertNoUnsafeExperimentalSelector, }
 import { resolveKimiHome } from "./kimi-home.js";
 import { assertNativeV2Preflight } from "./native-v2-preflight.js";
 import { collectDescendantIdentities, collectProcessGroupsIdentities, probeProcessIdentity, revalidateProcessIdentities, waitForProcessTreeExit, } from "./process-tree.js";
-const PREACTIVATION_VERSION = "2.3.2";
+const PREACTIVATION_VERSIONS = ["2.3.2", "2.3.3", "2.4.0"];
 const READY_TIMEOUT_MS = 10_000;
 const REST_TIMEOUT_MS = 5_000;
-const SHUTDOWN_TIMEOUT_MS = 5_000;
+// Exact 2.4.0 can take longer than 5s to drain session/workspace lifecycle work.
+const SHUTDOWN_TIMEOUT_MS = 15_000;
 const JOURNAL_TIMEOUT_MS = 2_000;
 const JOURNAL_POLL_MS = 50;
 const READY_LINE_MAX_CHARS = 65_536;
@@ -25,7 +26,7 @@ const ESCALATION_MS = 1_500;
 const POST_KILL_QUIESCENCE_MS = 500;
 const ENV_MODEL_ALIAS = "__kimi_env_model__";
 export function requiresSwarmPreactivation(version) {
-    return version === PREACTIVATION_VERSION;
+    return version !== null && PREACTIVATION_VERSIONS.includes(version);
 }
 export async function preactivateSwarmSession(options) {
     const failureCode = "SWARM_ACTIVATION_FAILED";
@@ -116,7 +117,7 @@ async function prepareWebSpawn(options, failureCode) {
     }
     const expectedVersion = options.expectedVersion ?? options.executionPlan.kimiVersion;
     if (expectedVersion === null || !requiresSwarmPreactivation(expectedVersion)) {
-        throw failure(failureCode, "swarm-activation.version", `Swarm web preactivation requires exact kimi-code ${PREACTIVATION_VERSION}.`);
+        throw failure(failureCode, "swarm-activation.version", `Swarm web preactivation requires exact kimi-code ${PREACTIVATION_VERSIONS.join(" or ")}.`);
     }
     const kimiHome = resolveKimiHome(options.env, options.cwd);
     if (options.executionPlan.intendedEngine === "native-v2") {

package/plugins/kimi-codex/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.4.2";
+export const KIMI_PLUGIN_CC_VERSION = "2.4.4";