kimi-plugin-cc 2.4.4 → 2.5.1

package/dist/swarm-activation.js

@@ -9,7 +9,7 @@ import { assertExecutionPlanMatchesSpawn, assertNoUnsafeExperimentalSelector, }
 import { resolveKimiHome } from "./kimi-home.js";
 import { assertNativeV2Preflight } from "./native-v2-preflight.js";
 import { collectDescendantIdentities, collectProcessGroupsIdentities, probeProcessIdentity, revalidateProcessIdentities, waitForProcessTreeExit, } from "./process-tree.js";
-const PREACTIVATION_VERSIONS = ["2.3.2", "2.3.3", "2.4.0"];
+const PREACTIVATION_VERSIONS = ["2.3.2", "2.3.3", "2.4.0", "2.4.1"];
 const READY_TIMEOUT_MS = 10_000;
 const REST_TIMEOUT_MS = 5_000;
 // Exact 2.4.0 can take longer than 5s to drain session/workspace lifecycle work.

package/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.4.4";
+export const KIMI_PLUGIN_CC_VERSION = "2.5.1";

package/docs/migration.md

@@ -1,6 +1,6 @@
 # Compatibility and upgrades
 
-Plugin 2.4.4 certifies Kimi Code CLI 2.4.0 for all eight operations, alongside exact native-v2 versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, and `2.3.3`. Later patches and minor releases are not accepted automatically. The npm distribution adds an installation channel; it does not change this compatibility table.
+Plugin 2.4.5 certifies Kimi Code CLI 2.4.1 for all eight operations, alongside exact native-v2 versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, `2.3.3`, and `2.4.0`. Later patches and minor releases are not accepted automatically. The npm distribution adds an installation channel; it does not change this compatibility table.
 
 Explicitly pinned legacy-v1 binaries remain supported within `KIMI_TESTED_MINORS`, through 0.41.x, subject to each operation's minimum version. The [runtime table](../runtime/kimi-engine.ts) is the authority.
 
@@ -8,11 +8,11 @@ Use the [README installation and update steps](../README.md) for Claude Code or
 
 ## Plugin versions and upgrades
 
-Plugin versions advance independently using ordinary SemVer and may deliberately align with a certified CLI release. Plugin 2.4.4 certifies exact CLI 2.4.0; the nearby numbers do not imply version alignment. Published versions and tags are never reused. Every upstream patch requires its own certification. The native-v2 no-plan profile, plugin/marketplace IDs and existing job store are preserved.
+Plugin versions advance independently using ordinary SemVer and may deliberately align with a certified CLI release. Plugin 2.4.5 certifies exact CLI 2.4.1; the nearby numbers do not imply version alignment. Published versions and tags are never reused. Every upstream patch requires its own certification. The native-v2 no-plan profile, plugin/marketplace IDs and existing job store are preserved.
 
-## CLI 2.3.2, 2.3.3 and 2.4.0 swarm activation
+## CLI 2.3.2, 2.3.3, 2.4.0 and 2.4.1 swarm activation
 
-Upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print sessions. On exact 2.3.2, 2.3.3 and 2.4.0, swarm commands and MCP calls use the same `runSwarm` lifecycle:
+Upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print sessions. On exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1, swarm commands and MCP calls use the same `runSwarm` lifecycle:
 
 1. A short-lived `web --no-open --host 127.0.0.1 --port 0 --log-level error` process uses authenticated loopback routes to verify the exact v2 server, choose the explicit or configured default model, create a session, bind the model and auto permission, enable and verify `swarm_mode`, and shut down. The child environment sets `KIMI_CODE_SESSION_IDLE_RECLAIM_MS=0` to disable ambient idle-session reclamation.
 2. One ordinary `kimi -p -r` prompt runner resumes that session. Its recorded session-id source is `preactivated`, and the returned print session must match it.

package/docs/models.md

@@ -6,7 +6,7 @@ configured model for one task without changing that default.
 ## See configured models
 
 In Claude Code, run `/kimi:setup --models`. In Codex, ask `$kimi-setup` to list
-models. The underlying command is:
+models. In DSH, run `/kimi-setup --models` (or `--models --json`). The underlying command is:
 
 ```sh
 "<plugin-root>/scripts/companion.sh" setup --models
@@ -35,6 +35,8 @@ several, and guide setup when there is none. They do not guess model IDs or
 silently substitute the default after an error. An explicit `-m` remains a
 pass-through alias, so upstream can resolve it or report an error.
 
+DSH activations are one-shot and do not expose per-call model fields. Set `model` in the bundle's `kimi-plugin-cc` profile row to use one exact configured alias for every delegation from that profile; omit it to use the native Kimi default. This does not change the saved default or add fallback selection.
+
 Omitting `-m` uses the default for a **fresh** session. A resumed session keeps
 its previous model unless you supply `-m`. The optional review gate also uses
 the default unless `KIMI_PLUGIN_CC_REVIEW_GATE_MODEL` explicitly selects an alias.
@@ -87,6 +89,8 @@ including `kosongConfig/configSection.ts`, `envOverlay.ts`, and
 
 Use `--thinking off`, `--thinking high`, or `--thinking=<effort>` before the prompt. Values are lowercased and must match `/^[a-z][a-z0-9-]{0,31}$/` (a plugin-owned syntax bound; a future upstream token outside it is rejected before upstream sees it); upstream per-model `supportEfforts`, not a plugin enum, determines supported values. `--no-thinking` is an error: use `--thinking off`. In CLI 2.2.0 only the three Moonshot `kimi*` provider definitions are trait-driven. BYO providers ignore the request silently; an always-thinking model may remain thinking.
 
+DSH forwards the profile's `thinkingEffort` value as `--thinking <effort>` on every delegation. Omission preserves the ambient operator value; the same provider and observability limits apply.
+
 Jobs persist nullable `thinking_effort`; status and `result --json` expose `thinking_effort_requested`, not observed effort. Detached ask/rescue workers replay the request. A resume without `--thinking` exports no new override (any ambient operator value remains). No config.toml write occurs.
 
 The review gate requests `off` by default. `KIMI_PLUGIN_CC_REVIEW_GATE_THINKING=inherit` exports no override; another non-empty value is lowercased and must match the same regex. Unset or empty means `off`; an invalid value makes the gate skip visibly. The gate remains fail-open on its 8 s timeout: a BYO provider or always-thinking model can ignore the request, and even an honoured request does not guarantee completion within the budget.

package/docs/registry-releases.md

@@ -1,16 +1,14 @@
 # Registry releases
 
 The npm package `kimi-plugin-cc` ships the Claude plugin at its root and the
-self-contained Codex plugin under `plugins/kimi-codex`. GitHub marketplaces
-remain available. The package has no install scripts and no separate CLI.
+self-contained Codex and DSH plugins under `plugins/`. DSH users install that
+same root package with `dsh plugin --profile <name> add kimi-plugin-cc`.
+GitHub marketplaces remain available. The package has no install scripts and
+no separate CLI.
 
 ## Publishing status
 
-Plugin **2.4.4** adds exact CLI **2.4.0** certification for all eight operations,
-with the existing host-preactivated swarm lifecycle and durable recovery.
-See the [certification record](./upstream-2.4.0-certification.md).
-Release execution and registry verification are recorded in the release notes;
-publication uses the same validated-tarball OIDC workflow below.
+Plugin **2.4.5** certifies exact CLI **2.4.1** for all eight operations with host-preactivated swarm sessions. [Release v2.4.5](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.5) is anchored at `de8c195c2986443a088b674717133b164d2e4ef2`; its [CI check](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226096281) and [release-event publishing run](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226438326) passed. The registry tarball has SHA-1 `39f97a6de4b26ad51ac77305054682fcd5cd0164`, contains 233 files, and matches the CI artifact byte-for-byte. Fresh registry installs passed setup/check and unsupported-version refusal for both Claude Code and Codex, and both compiled mirrors are byte-identical to the release checkout. See the [certification record](./upstream-2.4.1-certification.md) and structured verification at `.claude/kimi-code-research/release-2.4.5/registry-verification.json`.
 
 Plugin **2.4.2** adds durable interrupted-swarm recovery and Windows spawn diagnostics.
 Exact CLI certification remains unchanged through **2.3.2**; this is not a new
@@ -90,15 +88,18 @@ bun run build
 bun run generate:surfaces
 # Review and stage generated distributions before the drift gate.
 bun run check
-bun run check:package .tmp/npm
+node scripts/check-package.mjs .tmp/npm
+node scripts/check-dsh-package.mjs .tmp/dsh-npm
 ```
 
-The package check inspects the actual tarball, rejects sync-conflict copies in
+The root package check inspects the actual tarball, rejects sync-conflict copies in
 any path component, verifies runtime copies and vendored licenses, and
-installs/checks the safety hook in isolated homes for both hosts. It also
+installs/checks the safety hook in isolated homes for all three hosts. It also
 exercises unsupported-version refusal using a fake CLI and modern MCP discovery
-plus legacy initialization on both extracted compiled distributions. It does
-not invoke a model or read the maintainer's Kimi configuration.
+plus legacy initialization on the extracted compiled distributions. The DSH
+check installs that same root tarball into an isolated DSH home, verifies all
+seven tools, and boots the Web host. Neither check invokes a model or reads the
+maintainer's Kimi configuration.
 
 ## First publication (completed bootstrap reference)
 
@@ -135,8 +136,10 @@ operations; Bun remains the development toolchain.
 
 Push the reviewed release commit, wait for CI, tag it, and publish its GitHub
 release. `.github/workflows/publish.yml` runs on `release.published`; it checks
-the tag against `package.json`, runs the full gate and package smoke, then
-publishes the validated tarball through OIDC with provenance. The publish job
-has no source checkout or build scripts. A manual dispatch with an existing
-release tag is available for recovery after a verified publication failure.
-Check npm before retrying; released versions are immutable.
+the tag against `package.json`, runs the full gate and both package smokes, then
+publishes the root tarball through OIDC with provenance. The DSH smoke installs
+that same tarball directly into an isolated DSH profile, so no second npm
+package or Trusted Publishing binding is needed. The publish job has no source
+checkout or build scripts. A manual dispatch with an existing release tag is
+available for recovery after a verified publication failure. Check npm before
+retrying; released versions are immutable.

package/docs/safety.md

@@ -2,7 +2,7 @@
 
 This guide describes the current checkout runtime. Read-only tasks deny file writes and shell commands. Rescue and pursue can edit your workspace. Write-swarm returns a patch from a temporary Git worktree.
 
-Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, `2.3.3`, and `2.4.0`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
+Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, `2.3.3`, `2.4.0`, and `2.4.1`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
 
 ## Why the safety story is hook-based
 
@@ -78,20 +78,23 @@ Key constraints (verified by [`runtime/hooks/managed-block.ts`](../runtime/hooks
 7. **Serialized, identity-bound setup mutations.** Install and uninstall hold a private `0o600` sibling lock across the complete read-modify-write transaction. The candidate lock is published atomically; lock reads are no-follow, nonblocking, regular-file-only, and capped at 4 KiB. Acquisition is bounded, live owners are never stolen, stale recovery is guarded by a nonrecursive recovery lease, and inode/token ownership is rechecked before config mutation or lock removal. Simultaneous Claude Code/Codex setup runs therefore cannot lose either host's block, and a replaced lock is never treated as ours. A newly created Kimi home is `0o700`; atomic config writes remain `0o600`.
 8. **Inline hook arrays are normalized before insertion.** kimi-code accepts both `hooks = [...]` and `[[hooks]]`, but appending a managed array-of-tables block after an inline assignment can produce a conflicting document. Setup converts a valid inline hook array to canonical `[[hooks]]` tables before inserting the host block and emits an explicit warning that formatting and comments inside that assignment are normalized. Surrounding config bytes are preserved.
 
-### Host scoping (Claude Code ↔ Codex share one config)
+### Host scoping (all hosts share one config)
 
 Claude Code and Codex install this plugin to **different, version-stamped
-paths** (`~/.claude/plugins/cache/…` vs `~/.codex/plugins/cache/…`) but read
-the **same** `~/.kimi-code/config.toml`. So the managed block is **host-scoped**:
+paths** (`~/.claude/plugins/cache/…` vs `~/.codex/plugins/cache/…`), while DSH
+uses its own profile package path. All read the **same**
+`~/.kimi-code/config.toml`. So the managed block is **host-scoped**:
 its marker carries a `:<host-id>` suffix, and each host owns, verifies, and
 uninstalls only its **own** block.
 
 - **Host id** (`runtime/hooks/install-paths.ts::resolveHostId`) is derived
   version-independently from the hook path: `~/.claude/…` → `claude-code`,
-  `~/.codex/…` → `codex`, else a stable `host-<sha1>` for dev checkouts. A
-  plugin upgrade *refreshes* the same host's block rather than adding a new one.
-- **No clobbering.** `/kimi:setup` (Claude) and `$kimi-setup` (Codex) each write
-  their own block and leave the other's byte-identical. Before v1.7.0 there was
+  `~/.codex/…` → `codex`, else a stable `host-<sha1>` for dev checkouts. DSH
+  explicitly pins `dsh`. A plugin upgrade *refreshes* the same host's block
+  rather than adding a new one.
+- **No clobbering.** `/kimi:setup` (Claude), `$kimi-setup` (Codex), and
+  `/kimi-setup` (DSH) each write their own block and leave the others
+  byte-identical. Before v1.7.0 there was
   a single block exact-matched to the running host, so the two hosts overwrote
   each other and the loser's write-commands refused with "hook path drift."
 - **Enforcement is redundant-safe.** kimi-code fires *every* `[[hooks]]` entry
@@ -103,8 +106,8 @@ uninstalls only its **own** block.
 - **Migration + cleanup.** A pre-v1.7.0 un-suffixed block is adopted and
   converted in place by the current host on its next `/kimi:setup`. Orphaned,
   marker-less `[[hooks]]` entries that are unambiguously our approval hook
-  (canonical command, `approval-hook.js` under a kimi-marketplace/kimi-plugin-cc
-  tree) are pruned **host-scoped** (v1.8.2): install and scoped uninstall touch
+  (canonical command, `approval-hook.js` under a kimi-marketplace/kimi-plugin-cc/
+  dsh-kimi-plugin-cc tree) are pruned **host-scoped** (v1.8.2): install and scoped uninstall touch
   only tables whose command path derives to the *current* host. `/kimi:setup
   --uninstall` removes only the current host's block (plus legacy + this host's
   orphans); `/kimi:setup --uninstall --all` removes every host's block and every
@@ -123,6 +126,16 @@ uninstalls only its **own** block.
   hook and is left byte-untouched (pre-v1.8.2, the host-blind prune here caused
   each host's setup to disarm the other after any kimi login — the "seesaw").
 
+## DeepSeek Harness providers
+
+The DSH bundle exposes the same seven operations as the other hosts: `kimi_ask`, `kimi_review`, `kimi_challenge`, `kimi_rescue`, `kimi_pursue`, `kimi_swarm`, and `kimi_swarm_write`. Each activation starts the existing companion through DSH's managed subprocess service and uses the same `kimi -p` transport, hook verification, exact-version certification, job store, and response or safety budgets. ACP is not used.
+
+Run `/kimi-setup` explicitly before delegating. Installing or enabling the bundle does not modify Kimi configuration. DSH uses host id `dsh` and `$DSH_HOME/plugin-data/kimi-plugin-cc` unless an absolute data-root override selects another store. Its provider-owned environment clears other-host roots/data, hook/script overrides, trusted roots, and verification bypasses instead of inheriting them.
+
+The parent receives only complete successful stdout. stderr remains on the host, and nonzero, empty, or truncated output becomes a bounded diagnostic rather than partial prose. Cancellation terminates the managed process range and waits for quiescence. DSH activation ids are distinct from companion job ids; use `/kimi-status`, `/kimi-result`, or `/kimi-cancel` for the persisted job.
+
+Write boundaries are identical to the companion commands: rescue and pursue edit the real selected workspace, ask/review/challenge and read-only swarm deny writes and shell commands, and swarm-write works from born HEAD in a temporary worktree and returns a patch without applying or committing it. `/kimi-setup --uninstall` removes only the DSH managed block; the all-host uninstall flag is not exposed.
+
 ## The hook's per-command policy
 
 [`runtime/hooks/approval-policy.ts`](../runtime/hooks/approval-policy.ts) is the single source of truth:
@@ -205,13 +218,13 @@ If another installed host still points to an older hook, that hook may veto thes
 - **Resume is intentionally not exposed yet.** In goal mode `goal.summary` emits a *goalId* distinct from the resume-hint *sessionId*; `kimi -r <sessionId>` re-enters the session but not necessarily the goal continuation. The plugin captures and surfaces the goalId but does not offer `--resume` for pursue until that split is reconciled upstream — exposing it now would be a silent-failure trap. **Re-verified against kimi-code 0.26.0 (2026-07-16):** the headless CLI still has no argv, prompt syntax, or session-resume path that calls `resumeGoal()`. `parseHeadlessGoalCreate` (`apps/kimi-code/src/cli/goal-prompt.ts`) accepts only the `/goal <objective>` *create* shape on both the v1 and experimental-v2 drivers, and upstream's own docs (`docs/en/guides/goals.md`, § "Use goal mode carefully") state that in non-interactive prompt mode *only goal creation is supported* — goal management is a TUI/kimi-web control. PR #552 makes a plain `-r <sessionId>` correctly *restore* the paused goal snapshot, but nothing in the headless path *acts* on it; the real `resumeGoal()` is wired only to the TUI (`/goal resume`) and kimi-web RPC (PR #1693, web-only). Implementing `--resume` would therefore require either prompt-injected model compliance (rejected — the plugin bounds autonomy with hard limits, not model goodwill) or abandoning the subprocess model for kimi-web's RPC. Re-check if upstream ever ships a headless `goal resume` verb.
 - **A model-invocable `kimi-pursue` agent (v1.3) wraps this command.** The main thread can dispatch autonomous goal mode, not just the human-typed `/kimi:pursue` — the same command↔agent mirror as rescue/review/swarm. Auto-dispatch does NOT widen the blast radius: pursue runs under `commandLabel: "rescue"`, so the managed PreToolUse hook + workspace allowlist gate every tool call on every continuation turn (no git mutation), and the mandatory `--budget` wall-clock ceiling bounds the autonomy regardless of who launched it. Because it is write-capable AND autonomous — the plugin's highest blast radius — the agent's description requires an explicit user request for hands-off multi-turn pursuit, steers single bounded tasks to `kimi-rescue`, and never auto-promotes a fix or a question into a goal loop. Like the command, it refuses without the hook and offers no `--resume`.
 
-## Swarm activation on CLI 2.3.2, 2.3.3 and 2.4.0
+## Swarm activation on CLI 2.3.2, 2.3.3, 2.4.0 and 2.4.1
 
 For interrupted runs, see [durable recovery and its explicit limits](swarm-recovery.md).
 
 Upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print sessions. A rejected call can therefore coexist with zero child journals and a successful exit; a tool-call record, aggregate denial, or coordinator-produced patch does not prove fan-out. The plugin does not use prompt workarounds or replace its print transport with general RPC.
 
-For versions requiring activation (currently exact 2.3.2, 2.3.3 and 2.4.0), both slash-command and MCP swarm operations use the same `runSwarm` implementation and one ordinary `kimi -p -r` prompt runner per job, bracketed by short-lived host-managed web lifecycles:
+For versions requiring activation (currently exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1), both slash-command and MCP swarm operations use the same `runSwarm` implementation and one ordinary `kimi -p -r` prompt runner per job, bracketed by short-lived host-managed web lifecycles:
 
 1. The exact planned CLI starts `web --no-open --host 127.0.0.1 --port 0 --log-level error`. The child environment sets `KIMI_CODE_SESSION_IDLE_RECLAIM_MS=0`, so ambient idle-session reclamation cannot disrupt the plugin-owned lifecycle. The plugin accepts only the expected loopback ready URL, uses a supplied token for authenticated REST requests, and keeps that token in memory, never writing it to logs. `/api/v1/meta` must confirm backend v2, the exact planned version, and no dangerous authentication bypass. The plugin uses the explicit model or environment-model alias, otherwise reading the default alias from `/api/v1/config`; creates a session in the job cwd; binds that model with `permission_mode:auto` and `swarm_mode:true`; verifies those settings and `plan_mode:false` through `/status`; verifies clean shutdown; and requires the main journal's manual `swarm_mode.enter` record.
 2. The ordinary stream-json print runner resumes that session with `kimi -p -r`. The job records `kimi_session_id_source:"preactivated"`, and the session returned by print must exactly match the preactivated id. Every coordinator and child tool call remains governed by the same managed PreToolUse hook and operation allowlist.
@@ -224,7 +237,7 @@ Older certified versions keep the direct `kimi -p` path. The web processes are n
 `/kimi:swarm` (v1.2) fans a **read-only** review out across subagents using kimi-code's `AgentSwarm` tool (kimi-code 0.12.0+). The coordinator launches one subagent per target (file/module/question); each inspects the workspace with read tools and reports findings, which the coordinator consolidates into one markdown report. It opens **zero new write surface**.
 
 - **The hook label is `swarm`, and it allows the read-only tool set PLUS `AgentSwarm`.** The coordinator must be allowed to call `AgentSwarm` (else the swarm never launches), but no write/edit/shell tool is allowed. The exact allowed tool name is `AgentSwarm` (verified at 0.42.0 against `packages/agent-core-v2/src/features/swarm/tools/agent-swarm/agentSwarmTool.ts`: `'AgentSwarm'`, strict schema). The singular `Agent` tool is deliberately *not* allowed — swarm is the fan-out surface, not arbitrary delegation.
-- **Every subagent inherits the `swarm` label and fires the same hook.** On native v2 (0.42.0) `AgentSwarm` children run in-process in a child DI scope with their OWN eager external-hooks service, so every child tool call passes the same before-execute channel and the same managed hook — there is no sub-vs-main branch and no deny-all shortcut on the swarm route. So a subagent's `Write`/`Edit`/`Bash` is denied exactly like a single-turn review's. The swarm listener in that channel is non-terminal and nothing auto-approves `AgentSwarm` ahead of the hook. (Legacy-v1 ≤ 0.41 reached the same result by placing the hook policy at index 0 of every agent's permission stack.) **Required for final certification evidence** (`tests/runtime/real-binary-smoke.test.ts`, run via `bun run smoke:real`): distinct child journals must exist, and each assigned Write/Edit `path` must be correlated through its `toolCallId` with the managed denial in that exact tool result; unrelated denials and coordinator-only reports are insufficient. On 2.3.2, 2.3.3 and 2.4.0, targeted controls also prove that direct OFF produces no children while the preactivated ON path produces the real child journals and denials.
+- **Every subagent inherits the `swarm` label and fires the same hook.** On native v2 (0.42.0) `AgentSwarm` children run in-process in a child DI scope with their OWN eager external-hooks service, so every child tool call passes the same before-execute channel and the same managed hook — there is no sub-vs-main branch and no deny-all shortcut on the swarm route. So a subagent's `Write`/`Edit`/`Bash` is denied exactly like a single-turn review's. The swarm listener in that channel is non-terminal and nothing auto-approves `AgentSwarm` ahead of the hook. (Legacy-v1 ≤ 0.41 reached the same result by placing the hook policy at index 0 of every agent's permission stack.) **Required for final certification evidence** (`tests/runtime/real-binary-smoke.test.ts`, run via `bun run smoke:real`): distinct child journals must exist, and each assigned Write/Edit `path` must be correlated through its `toolCallId` with the managed denial in that exact tool result; unrelated denials and coordinator-only reports are insufficient. On 2.3.2, 2.3.3, 2.4.0 and 2.4.1, targeted controls also prove that direct OFF produces no children while the preactivated ON path produces the real child journals and denials.
 - **The managed hook is the read-only boundary; no `explore`-profile second layer is assumed.** Production deliberately omits `subagent_type` for read-only swarm rather than selecting kimi-code's `explore` profile. Every coordinator and subagent tool call is enforced by the same managed hook.
 - **Swarm refuses without the hook, like every model-spawning command.** A swarm makes the reason especially acute: it asks for up to `--cap` subagents, but this total-count hint is advisory, so a missing hook would remove enforcement from all of them at once. `KIMI_PLUGIN_CC_SKIP_HOOK_CHECK=1` remains an explicit tests/diagnostics escape hatch, not a recovery path.
 - **The only new risk is COST, and the plugin bounds it.** Read-only swarm writes nothing, so the new risk is runaway cost from N parallel model runs (and possible nested `AgentSwarm`). `/kimi:swarm` enforces a **mandatory finite wall-clock ceiling** via its AbortController (`--budget`, default 30m); the SIGTERM→SIGKILL descendant-reaping cancellation reaps the whole subagent process tree. Two **distinct** subagent bounds: `--cap N` is a *soft* prompt-injected hint on TOTAL subagent count (the hook is stateless and cannot enforce a count, so the model may exceed it), and `--max-concurrency N` is a *hard* ceiling on how many subagents kimi-code's `SubagentBatch` runs concurrently — exported as `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` (PR #888) on **kimi-code 0.18.0+** (older binaries ignore the unknown env var, so on < 0.18 only the soft hint applies). It **defaults to 4** when the user passes none (`resolveSwarmMaxConcurrency` in swarm.ts), so every swarm run — agent-dispatched or human-typed — carries an enforced peak-parallelism ceiling on 0.18.0+ rather than falling back to kimi-code's internal ramp; pass an explicit value to widen or throttle. **Never merge them into one flag:** concurrency ≠ total count — a hard concurrency cap of N still permits more than N subagents over the life of the run, just never more than N at once. The `--budget` bounds elapsed time, not a dollar amount or total token count; `--max-concurrency` bounds *peak* parallelism (the spike in simultaneous model spend), and `--cap` is only an advisory total-count nudge. Folding both onto one flag would create the "cap-as-total-count illusion" — a user reading `--cap N` would expect a total bound but receive only a peak-parallelism one.
@@ -293,9 +306,9 @@ at it (the runtime resolves that path instead of `kimi` on `PATH`; every spawn
 still exports `KIMI_CODE_NO_AUTO_UPDATE=1`, so the pinned copy never drifts).
 
 ```sh
-PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.4.0
+PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.4.1
 mkdir -p "$PIN" && cd "$PIN" && printf '{"name":"kimi-plugin-cc-pin","private":true}\n' > package.json
-npm install @moonshot-ai/kimi-code@2.4.0
+npm install @moonshot-ai/kimi-code@2.4.1
 export KIMI_PLUGIN_CC_KIMI_BIN="$PIN/node_modules/.bin/kimi"   # e.g. in ~/.zshenv
 ```
 

package/docs/swarm-recovery.md

@@ -2,7 +2,7 @@
 
 Normal stop: use `scripts/companion.sh cancel` for a shell-owned run, or the MCP job cancel tool for an MCP-owned run. A hard kill cannot execute cleanup. Cancellation still starts no fresh cleanup server.
 
-For exact CLI 2.3.2, 2.3.3 and 2.4.0 swarm runs created by this runtime, status includes a durable `swarm_recovery` record. It contains the resolved home/workspace, companion identity, launch intent, verified process identities and session identity. It never contains the web authentication token, credentials, prompt or config contents. Session identity is committed before the request enabling swarm mode.
+For exact CLI 2.3.2, 2.3.3, 2.4.0 and 2.4.1 swarm runs created by this runtime, status includes a durable `swarm_recovery` record. It contains the resolved home/workspace, companion identity, launch intent, verified process identities and session identity. It never contains the web authentication token, credentials, prompt or config contents. Session identity is committed before the request enabling swarm mode.
 
 ## Preview, then recover
 

package/docs/upstream-2.4.1-certification.md

@@ -0,0 +1,54 @@
+# Kimi Code 2.4.1 certification evidence — 2026-10-31
+
+## Status and exact source
+
+**Exact CLI 2.4.1 is certified for all eight operations by plugin 2.4.5.** The exact-source gate, non-vacuous plan and swarm controls, expanded candidate and production matrices, literal standard `bun run check`, final edited-byte package, and independent Codex/Kimi reviews all passed. CI, commit, push, tag, publication, installed-host rollout, and operator CLI pin changes are not performed in this certification slice.
+
+Candidate: `@moonshot-ai/kimi-code@2.4.1`, release commit `2c73f3f50af4fa7f2540ca0d2e33b07a1408e3a7`, compared with certified 2.4.0 (`f26e4d91ef8d5d233f6c20b42a150f96924d4f5e`). npm published the candidate at 2026-10-30T09:55:26.630Z; its npm tarball SHA-1 is `660debae9ff145564c670fcc32444aed5cc7ab79`. A temporary isolated npm installation and its executable both report 2.4.1. The clean exact source checkout is `.claude/kimi-code-research/kimi-code-2.4.1-audit`.
+
+## Source review
+
+Codex's 2026-10-31 monitor supplied seven scoped diffs as leads. The main-thread certification review also covered every changed production TypeScript file, the complete release delta, Read's token helpers, profile composition, goal injection, DI and OS backends, wire reload/migrations, KAP activation dependencies, alternate final-allow spellings, and indirect plan entry. The synthesis is retained at `.claude/kimi-code-research/reports/2026-10-31-2.4.1-source-synthesis.md`.
+
+- The exact-tag scan passed **15 tests and 96 assertions**. All 15 load-bearing files are byte-identical to 2.4.0. The plan-file guard remains the sole production final allow; executor/subscriber order, hook schema/aggregation, eager child hooks, Write/Edit `path`, Bash `command`/`cwd`, stream shapes, CLI argv, and AgentSwarm behavior remain compatible.
+- Plan changes are reminder/profile prompts only. `EnterPlanMode` remains removed, fresh print still cancels configured default plan, and resumed plan sessions remain possible. The plugin retains its config preflight, Enter/ExitPlanMode deny policy, and every-agent journal-taint refusal.
+- Goal injection adds full/sparse reminder selection using context history, not another goal tool, executor route, terminal exit, or budget mechanism. Read lowers the default maximum to 100,000 characters and adds estimated-token-aware pagination. Write/Edit success notes and Bash rendered guidance do not change their input schemas or execution gates.
+- DI scope creation, OS backends, wire reload/migrations, KAP source, and the CLI/web activation surfaces are unchanged. No early session announcement or tool execution outcome was added; existing recovery and detection ambiguity remain.
+
+## Exact-binary controls
+
+Controls used a task-authorized dedicated Agent Key in process memory/environment and empty isolated homes, except the forced removed-tool control, which used a loopback scripted provider and a dummy key. No personal config or OAuth store was read, copied, or symlinked. All live controls ran sequentially. The plan and removed-tool controls install a custom deny-all control hook; the plugin's managed hook is separately installed and proved by the operation smoke. Raw evidence is under `.claude/kimi-code-research/cert-2.4.1-live/`.
+
+- **Plan OFF Write:** the exact 2.4.1 marker was first; Write reached the custom deny-all control hook and was denied on the same call ID. No target file or plan state was created.
+- **Plan ON:** an authenticated loopback session was explicitly placed in plan mode, shut down cleanly in 5.638 seconds, and resumed with a deny-all hook. The exact marker and `plan_mode.enter` were present. Glob and ExitPlanMode reached the deny hook; a **1,831-byte** plan file was written without a plan-Write hook invocation. The workspace remained empty.
+- **Removed EnterPlanMode:** the offered tools included Write but not EnterPlanMode. A scripted provider forced `call_enter_forced`; the exact binary returned `Tool "EnterPlanMode" not found` on that ID before any hook call and returned the rejection to the provider. No plan state or files appeared.
+- **Swarm OFF:** a real AgentSwarm call returned the inactive-mode result with zero child journals and no probe files.
+- **Swarm ON:** after adding the reviewed exact 2.4.1 activation selector and rebuilding, compiled activation produced `agent-0` and `agent-1`; each child attempted its assigned Write with a matching managed-denial result under the same toolCallId. The coordinator did not substitute writes, no probes landed, and deactivation verified `swarm_mode.exit`. Parent `KIMI_CODE_SESSION_IDLE_RECLAIM_MS=1` confirmed the child environment's `0` override remains effective.
+- Focused activation passed **36 tests and 130 assertions**. The focused setup/engine/activation set after the production row passed **142 tests and 2,282 assertions**.
+
+### Invalid setup attempts, not accepted as evidence
+
+- The first forced removed-tool run passed every safety assertion but failed `noWorkspaceFiles` because a relative artifact root made the child create its relative Kimi home beneath the workspace. A fresh run with an absolute artifact root passed all checks; the fixture failure is not counted.
+- The first combined swarm control passed OFF, then ON refused before any model call because `PREACTIVATION_VERSIONS` did not yet include 2.4.1. The unchanged KAP source justified adding only that exact activation selector. The focused activation suite and fresh ON control then passed. The refused attempt is not ON evidence.
+
+## Candidate and final gates
+
+- Expanded candidate matrix (`candidate-smoke.log`): **21 pass, 0 fail, 154 assertions, no skips**, 410.84 seconds. Real `runRescue` landed the confined sentinel and persisted operation/version/engine/session/artifact evidence. The absolute out-of-root Bash.cwd call received its exact same-call denial and created no file. Eight goal turns produced none of the three named goal files. Write-swarm produced a 278-byte child-authored patch, left the user tree clean, removed its worktree, and denied the out-of-root write.
+- Frozen dependency installation made no changes; `bun audit` found no vulnerabilities. Typecheck, contract-size, and generated-surface checks passed before the production matrix.
+- Compiled acceptance/refusal controls passed under Node and Bun against both root and Codex distributions: every operation accepts exact 2.4.1 and normalized `v2.4.1`; 2.4.2, prereleases, build metadata, and mismatched hook-schema components refuse.
+- Expanded production-table matrix (`production-smoke.log`) with the candidate override explicitly unset: **21 pass, 0 fail, 154 assertions, no skips**, 453.88 seconds. Real rescue and deterministic Bash.cwd passed the same confinement and provenance assertions. Twelve goal turns produced none of the three named goal files. Write-swarm captured a 278-byte child-authored patch, left the user tree clean, and removed its worktree.
+- Initial full repository check passed **1,315 tests with 30 expected opt-in skips, 0 failures and 17,073 assertions across 79 files** in 320.46 seconds. Initial package validation passed **232 files**. Subsequent iCloud-style `* 2` duplicates in root `dist/vendor` were verified byte-identical to canonical generated files and quarantined; the runtime mirrors match again.
+- Earlier review iterations (`production-review-smoke.log` and `goal-final-smoke.log`) passed **23 tests and 163 assertions** and a goal-only test respectively, but their Bash-inclusive goal evidence is **not accepted for certification**. The final edge-hardened matrix below supersedes those goal claims. Other operation evidence from those runs remains useful.
+- Clean full repository check (`check-review-final.log`) after review fixes: **1,317 pass, 30 expected opt-in skips, 0 fail, 17,314 assertions across 79 files**, 321.00 seconds. Clean package validation (`package-review-final.log`) passed **233 files**, both compiled distributions, isolated hook setup/check, version refusal, and modern/legacy MCP controls. `docs/upstream-2.4.1-certification.md` is confirmed in the archive.
+- Codex's targeted re-review requested genuine error results, legacy-compatible turn starts, and a whole-workspace settlement assertion. A subsequent review added marker-prefix, call-derived turn-ID, and directory-entry requirements. The final production matrix (`production-prefix-smoke.log`) passed **24 tests and 167 assertions with no skips in 440.66 seconds**. All seven call-derived turn IDs had same-call Write denials with `isError: true` and the managed-message prefix, and the entire workspace was empty at settlement.
+- Literal standard `bun run check` (`check-standard-final.log`): **1,318 pass, 30 expected opt-in skips, 0 fail, 17,319 assertions across 79 files**, 358.83 seconds. Earlier parallel attempts hit timing-sensitive lifecycle failures; the focused suites and a complete serial run passed before the literal standard gate also passed. Codex's final targeted re-review returned **APPROVE**, closing all original and subsequent findings. Final edited-byte package validation (`package-standard-final.log`) passed **233 files** and includes this record.
+
+## Release and publication
+
+Plugin 2.4.5 was committed as `de8c195c2986443a088b674717133b164d2e4ef2` and pushed to `main`. [Release-commit CI 41226096281](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226096281) passed the full check/package and Windows spawn jobs. Annotated tag `v2.4.5` and [GitHub release](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.5) were created. [Publish workflow 41226438326](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226438326) passed its build and npm publish jobs.
+
+The registry tarball has SHA-1 `39f97a6de4b26ad51ac77305054682fcd5cd0164`, contains 233 files, and matches the CI artifact byte-for-byte. Fresh npm registry installations passed isolated setup/check and unsupported-version refusal for both hosts, and the compiled mirrors are byte-identical to the release checkout. Structured proof is retained at `.claude/kimi-code-research/release-2.4.5/registry-verification.json`. Installed hosts and operator CLI pins remain unchanged.
+
+## Preserved boundaries
+
+Certification remains exact and per-operation. Legacy-v1 ends at 0.41.x. Plan mode and unsafe experimental selectors remain refused. Hook verification, trusted-root confinement, concurrency/defaults, one print runner, memory-only web tokens, finite budgets, process/session identity checks, deactivation, and recovery ownership are unchanged. Existing Git trust and hook-process failure residuals remain documented; this release does not make the hook an OS sandbox. Publication does not install or re-pin either host.

package/package.json

@@ -1,30 +1,61 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.4.4",
-  "description": "Kimi for Claude Code and Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
+  "version": "2.5.1",
+  "description": "Kimi for Claude Code, Codex, and DeepSeek Harness: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
   "type": "module",
+  "main": "dist/dsh/index.js",
   "engines": {
-    "node": ">=22.5.0"
+    "node": ">=22.5.0",
+    "dsh": ">=0.2.1-rc.5 <0.3.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./plugins/kimi-dsh/cordis.patch.yml"
+    }
   },
   "scripts": {
-    "check": "bun run build && bun run check:contracts && bun run check:surfaces && bunx tsc --noEmit && bun test && git diff --exit-code -- dist plugins/kimi-codex && UNTRACKED=\"$(git ls-files --others --exclude-standard -- dist plugins/kimi-codex)\" && { [ -z \"$UNTRACKED\" ] || { echo \"drift gate: untracked dist/codex files (stage them and re-run check):\"; echo \"$UNTRACKED\"; exit 1; }; }",
+    "check": "bun run build && bun run check:contracts && bun run check:surfaces && bunx tsc --noEmit && bun test && git diff --exit-code -- dist plugins/kimi-codex plugins/kimi-dsh && UNTRACKED=\"$(git ls-files --others --exclude-standard -- dist plugins/kimi-codex plugins/kimi-dsh)\" && { [ -z \"$UNTRACKED\" ] || { echo \"drift gate: untracked dist/codex/dsh files (stage them and re-run check):\"; echo \"$UNTRACKED\"; exit 1; }; }",
     "check:surfaces": "bun run scripts/generate-surfaces.ts --check",
     "generate:surfaces": "bun run scripts/generate-surfaces.ts",
     "build": "rm -rf dist && bunx tsc -p tsconfig.build.json && mkdir -p dist/vendor/shell-quote dist/vendor/smol-toml && cp runtime/vendor/shell-quote/LICENSE dist/vendor/shell-quote/LICENSE && cp runtime/vendor/smol-toml/*.js runtime/vendor/smol-toml/LICENSE dist/vendor/smol-toml/ && echo '{\"type\":\"module\"}' > dist/package.json",
     "companion": "node --import tsx runtime/companion.ts",
     "test": "bun test",
     "smoke:real": "KIMI_PLUGIN_CC_SMOKE=1 bun test tests/runtime/real-binary-smoke.test.ts --path-ignore-patterns '**/worktrees/**'",
-    "check:package": "node scripts/check-package.mjs",
+    "check:package": "node scripts/check-package.mjs && node scripts/check-dsh-package.mjs",
     "check:contracts": "node scripts/check-contract-size.mjs"
   },
   "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-commands": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-subagent": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-rc.5",
     "@types/bun": "^1.4.2",
     "@types/node": "^26.5.1",
     "smol-toml": "1.9.1",
     "tsx": "^4.23.13",
     "typescript": "^7.0.2"
   },
-  "dependencies": {},
+  "dependencies": {
+    "@deepseek-ai/dsh-brand": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tool-subagent": "0.2.1-rc.5",
+    "@deepseek-ai/schemastery": "3.18.5"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-commands": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-llm": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-session": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-subagent": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-subprocess": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-working-directory": ">=0.2.1-rc.5 <0.3.0"
+  },
+  "overrides": {
+    "zod": "^4.6.6",
+    "undici": "^8.12.2"
+  },
   "license": "Apache-2.0",
   "author": "Xule Lin",
   "repository": {
@@ -38,6 +69,8 @@
   "keywords": [
     "claude-code",
     "codex",
+    "deepseek-harness",
+    "dsh",
     "kimi",
     "kimi-code",
     "plugin",
@@ -58,6 +91,7 @@
     "hooks/",
     "dist/",
     "plugins/kimi-codex/",
+    "plugins/kimi-dsh/",
     "scripts/companion.sh",
     "scripts/review-gate-hook.sh",
     "docs/safety.md",
@@ -66,6 +100,7 @@
     "docs/migration.md",
     "docs/models.md",
     "docs/session-visibility.md",
+    "docs/upstream-2.4.1-certification.md",
     "README.md",
     "LICENSE",
     "CHANGELOG.md",

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.4.4",
+  "version": "2.5.1",
   "description": "Kimi for Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP job controls through the local Kimi Code CLI.",
   "author": {
     "name": "linxule"

package/plugins/kimi-codex/dist/commands/swarm.js

@@ -28,7 +28,7 @@ import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js
 // only the wall-clock hard bound. Read/write modes reuse review/rescue lineage,
 // and the mandatory PreToolUse hook enforces read-only policy or trusted-worktree
 // write confinement on the coordinator and every subagent. Write mode requires
-// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3 and 2.4.0 additionally activate a same-job
+// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1 additionally activate a same-job
 // session through a bounded loopback web lifecycle, then resume it through the normal print path.
 const SWARM_SUMMARY_MAX = 120;
 const SWARM_AGENT_PROFILE = "<swarm>";

package/plugins/kimi-codex/dist/dsh/companion.js

@@ -0,0 +1,174 @@
+import { randomUUID } from "node:crypto";
+import { brandString } from "@deepseek-ai/dsh-brand";
+import { assertUsableCwd, settleRunResult, subprocessRunHandle, } from "@deepseek-ai/dsh-subagent";
+export const DSH_COMPANION_OPERATIONS = [
+    "ask",
+    "review",
+    "challenge",
+    "rescue",
+    "pursue",
+    "swarm",
+    "swarm-write",
+];
+export function companionTextTask(prompt) {
+    if (prompt.length === 0 || prompt.some((block) => block.type !== "text")) {
+        throw new Error("kimi-plugin-cc: a delegation must contain only text blocks");
+    }
+    const text = prompt.map((block) => block.type === "text" ? block.text : "").join("\n\n");
+    if (text.trim().length === 0) {
+        throw new Error("kimi-plugin-cc: a delegation must not be empty");
+    }
+    return text;
+}
+export function companionArgv(operation, prompt, companionPath, nodeBin = process.execPath, options = {}) {
+    const command = operation === "ask" || operation === "review"
+        ? [operation]
+        : operation === "swarm-write"
+            ? ["task", "swarm", "--write"]
+            : ["task", operation];
+    return [
+        nodeBin,
+        companionPath,
+        ...command,
+        ...(operation === "ask" || operation === "rescue" ? ["--fresh"] : []),
+        ...(options.model === undefined ? [] : ["-m", options.model]),
+        ...(options.thinkingEffort === undefined ? [] : ["--thinking", options.thinkingEffort]),
+        ...(options.budget === undefined ? [] : ["--budget", options.budget]),
+        ...((operation === "review" || operation === "challenge") && options.reviewBase !== undefined
+            ? ["--base", options.reviewBase]
+            : []),
+        "--",
+        prompt,
+    ];
+}
+export function companionEnvironment(dataRoot, cwd, env, nodeBin = process.execPath) {
+    return {
+        ...env,
+        KIMI_PLUGIN_CC_DATA: dataRoot,
+        KIMI_PLUGIN_CC_HOST_ID: "dsh",
+        KIMI_PLUGIN_CC_NODE_BIN: nodeBin,
+        KIMI_PLUGIN_CC_WORKSPACE_CWD: cwd,
+        CLAUDE_PLUGIN_DATA: undefined,
+        PLUGIN_DATA: undefined,
+        CLAUDE_PLUGIN_ROOT: undefined,
+        PLUGIN_ROOT: undefined,
+        KIMI_PLUGIN_CC_SHELL_LAUNCH: undefined,
+        KIMI_PLUGIN_CC_MCP_WORKSPACE: undefined,
+        KIMI_PLUGIN_CC_WORKSPACE_ROOT: undefined,
+        KIMI_PLUGIN_CC_HOOK_SCRIPT: undefined,
+        KIMI_PLUGIN_CC_SKIP_HOOK_CHECK: undefined,
+        KIMI_PLUGIN_CC_SKIP_VERSION_PROBE: undefined,
+        KIMI_CODE_TRUST_WORKSPACE: undefined,
+    };
+}
+export async function startCompanionRun(request, operation, spec) {
+    const prompt = companionTextTask(request.prompt);
+    if (request.signal.aborted) {
+        throw new Error("kimi-plugin-cc: delegation was aborted before companion startup");
+    }
+    const cwd = assertUsableCwd("kimi-plugin-cc", "child cwd", request.cwd ?? process.cwd());
+    const termination = new AbortController();
+    let cancelled = false;
+    const requestCancel = () => {
+        cancelled = true;
+        if (!termination.signal.aborted) {
+            termination.abort(new Error("kimi-plugin-cc: delegation cancelled"));
+        }
+    };
+    const onAbort = () => requestCancel();
+    request.signal.addEventListener("abort", onAbort, { once: true });
+    let child;
+    try {
+        child = spec.spawn({
+            argv: companionArgv(operation, prompt, spec.companionPath, process.execPath, spec),
+            cwd,
+            stdio: {
+                stdin: "ignore",
+                stdout: { maxBytes: spec.maxOutputBytes },
+                stderr: "inherit",
+            },
+            graceMs: spec.disposeGraceMs,
+            signal: termination.signal,
+            env: companionEnvironment(spec.dataRoot, cwd, spec.env),
+        });
+    }
+    catch (error) {
+        request.signal.removeEventListener("abort", onAbort);
+        throw error;
+    }
+    let diagnostic;
+    const result = settleRunResult({
+        attempt: async () => {
+            let outcome;
+            try {
+                outcome = await child.done;
+            }
+            catch (error) {
+                diagnostic = `Kimi ${operation} companion failed before producing a terminal exit`;
+                throw error;
+            }
+            const collected = child.collected.stdout?.readFrom(0);
+            const text = collected?.text.trimEnd() ?? "";
+            if (!cancelled && outcome.exitCode === 0 && collected && !collected.lossy && text.trim().length > 0) {
+                return { output: [{ type: "text", text }], stopReason: "completed" };
+            }
+            const facts = [
+                `exit code: ${outcome.exitCode ?? "none"}`,
+                `signal: ${outcome.signal ?? "none"}`,
+                ...(collected?.lossy ? ["stdout truncated"] : []),
+                ...(text.trim().length === 0 ? ["stdout empty"] : []),
+            ];
+            diagnostic = `Kimi ${operation} companion failed (${facts.join("; ")})`;
+            return { output: [], diagnostic, stopReason: cancelled ? "aborted" : "error" };
+        },
+        collectOutput: () => [],
+        collectDiagnostic: () => diagnostic,
+        cancelled: () => cancelled,
+        signal: request.signal,
+        onAbort,
+    });
+    return subprocessRunHandle({
+        id: brandString(randomUUID()),
+        result,
+        signal: request.signal,
+        onAbort,
+        requestCancel,
+        teardown: async () => {
+            child.terminate();
+            await child.waitForExit();
+            await child.done.catch(() => { });
+        },
+    });
+}
+export async function runCompanionCommand(argv, cwd, spec, signal) {
+    const child = spec.spawn({
+        argv: [process.execPath, spec.companionPath, ...argv],
+        cwd,
+        stdio: {
+            stdin: "ignore",
+            stdout: { maxBytes: spec.maxOutputBytes },
+            stderr: { maxBytes: spec.maxOutputBytes },
+        },
+        graceMs: spec.disposeGraceMs,
+        signal,
+        env: companionEnvironment(spec.dataRoot, cwd, spec.env),
+    });
+    try {
+        const outcome = await child.done;
+        await child.waitForExit();
+        const stdout = child.collected.stdout?.readFrom(0);
+        const stderr = child.collected.stderr?.readFrom(0);
+        return {
+            exitCode: outcome.exitCode,
+            signal: outcome.signal,
+            stdout: stdout?.text ?? "",
+            stderr: stderr?.text ?? "",
+            truncated: Boolean(stdout?.lossy || stderr?.lossy),
+        };
+    }
+    catch (error) {
+        child.terminate();
+        await child.waitForExit().catch(() => false);
+        throw error;
+    }
+}