kimi-plugin-cc 2.4.5 → 2.5.1

package/docs/safety.md

@@ -78,20 +78,23 @@ Key constraints (verified by [`runtime/hooks/managed-block.ts`](../runtime/hooks
 7. **Serialized, identity-bound setup mutations.** Install and uninstall hold a private `0o600` sibling lock across the complete read-modify-write transaction. The candidate lock is published atomically; lock reads are no-follow, nonblocking, regular-file-only, and capped at 4 KiB. Acquisition is bounded, live owners are never stolen, stale recovery is guarded by a nonrecursive recovery lease, and inode/token ownership is rechecked before config mutation or lock removal. Simultaneous Claude Code/Codex setup runs therefore cannot lose either host's block, and a replaced lock is never treated as ours. A newly created Kimi home is `0o700`; atomic config writes remain `0o600`.
 8. **Inline hook arrays are normalized before insertion.** kimi-code accepts both `hooks = [...]` and `[[hooks]]`, but appending a managed array-of-tables block after an inline assignment can produce a conflicting document. Setup converts a valid inline hook array to canonical `[[hooks]]` tables before inserting the host block and emits an explicit warning that formatting and comments inside that assignment are normalized. Surrounding config bytes are preserved.
 
-### Host scoping (Claude Code ↔ Codex share one config)
+### Host scoping (all hosts share one config)
 
 Claude Code and Codex install this plugin to **different, version-stamped
-paths** (`~/.claude/plugins/cache/…` vs `~/.codex/plugins/cache/…`) but read
-the **same** `~/.kimi-code/config.toml`. So the managed block is **host-scoped**:
+paths** (`~/.claude/plugins/cache/…` vs `~/.codex/plugins/cache/…`), while DSH
+uses its own profile package path. All read the **same**
+`~/.kimi-code/config.toml`. So the managed block is **host-scoped**:
 its marker carries a `:<host-id>` suffix, and each host owns, verifies, and
 uninstalls only its **own** block.
 
 - **Host id** (`runtime/hooks/install-paths.ts::resolveHostId`) is derived
   version-independently from the hook path: `~/.claude/…` → `claude-code`,
-  `~/.codex/…` → `codex`, else a stable `host-<sha1>` for dev checkouts. A
-  plugin upgrade *refreshes* the same host's block rather than adding a new one.
-- **No clobbering.** `/kimi:setup` (Claude) and `$kimi-setup` (Codex) each write
-  their own block and leave the other's byte-identical. Before v1.7.0 there was
+  `~/.codex/…` → `codex`, else a stable `host-<sha1>` for dev checkouts. DSH
+  explicitly pins `dsh`. A plugin upgrade *refreshes* the same host's block
+  rather than adding a new one.
+- **No clobbering.** `/kimi:setup` (Claude), `$kimi-setup` (Codex), and
+  `/kimi-setup` (DSH) each write their own block and leave the others
+  byte-identical. Before v1.7.0 there was
   a single block exact-matched to the running host, so the two hosts overwrote
   each other and the loser's write-commands refused with "hook path drift."
 - **Enforcement is redundant-safe.** kimi-code fires *every* `[[hooks]]` entry
@@ -103,8 +106,8 @@ uninstalls only its **own** block.
 - **Migration + cleanup.** A pre-v1.7.0 un-suffixed block is adopted and
   converted in place by the current host on its next `/kimi:setup`. Orphaned,
   marker-less `[[hooks]]` entries that are unambiguously our approval hook
-  (canonical command, `approval-hook.js` under a kimi-marketplace/kimi-plugin-cc
-  tree) are pruned **host-scoped** (v1.8.2): install and scoped uninstall touch
+  (canonical command, `approval-hook.js` under a kimi-marketplace/kimi-plugin-cc/
+  dsh-kimi-plugin-cc tree) are pruned **host-scoped** (v1.8.2): install and scoped uninstall touch
   only tables whose command path derives to the *current* host. `/kimi:setup
   --uninstall` removes only the current host's block (plus legacy + this host's
   orphans); `/kimi:setup --uninstall --all` removes every host's block and every
@@ -123,6 +126,16 @@ uninstalls only its **own** block.
   hook and is left byte-untouched (pre-v1.8.2, the host-blind prune here caused
   each host's setup to disarm the other after any kimi login — the "seesaw").
 
+## DeepSeek Harness providers
+
+The DSH bundle exposes the same seven operations as the other hosts: `kimi_ask`, `kimi_review`, `kimi_challenge`, `kimi_rescue`, `kimi_pursue`, `kimi_swarm`, and `kimi_swarm_write`. Each activation starts the existing companion through DSH's managed subprocess service and uses the same `kimi -p` transport, hook verification, exact-version certification, job store, and response or safety budgets. ACP is not used.
+
+Run `/kimi-setup` explicitly before delegating. Installing or enabling the bundle does not modify Kimi configuration. DSH uses host id `dsh` and `$DSH_HOME/plugin-data/kimi-plugin-cc` unless an absolute data-root override selects another store. Its provider-owned environment clears other-host roots/data, hook/script overrides, trusted roots, and verification bypasses instead of inheriting them.
+
+The parent receives only complete successful stdout. stderr remains on the host, and nonzero, empty, or truncated output becomes a bounded diagnostic rather than partial prose. Cancellation terminates the managed process range and waits for quiescence. DSH activation ids are distinct from companion job ids; use `/kimi-status`, `/kimi-result`, or `/kimi-cancel` for the persisted job.
+
+Write boundaries are identical to the companion commands: rescue and pursue edit the real selected workspace, ask/review/challenge and read-only swarm deny writes and shell commands, and swarm-write works from born HEAD in a temporary worktree and returns a patch without applying or committing it. `/kimi-setup --uninstall` removes only the DSH managed block; the all-host uninstall flag is not exposed.
+
 ## The hook's per-command policy
 
 [`runtime/hooks/approval-policy.ts`](../runtime/hooks/approval-policy.ts) is the single source of truth:

package/docs/upstream-2.4.1-certification.md

@@ -43,6 +43,12 @@ Controls used a task-authorized dedicated Agent Key in process memory/environmen
 - Codex's targeted re-review requested genuine error results, legacy-compatible turn starts, and a whole-workspace settlement assertion. A subsequent review added marker-prefix, call-derived turn-ID, and directory-entry requirements. The final production matrix (`production-prefix-smoke.log`) passed **24 tests and 167 assertions with no skips in 440.66 seconds**. All seven call-derived turn IDs had same-call Write denials with `isError: true` and the managed-message prefix, and the entire workspace was empty at settlement.
 - Literal standard `bun run check` (`check-standard-final.log`): **1,318 pass, 30 expected opt-in skips, 0 fail, 17,319 assertions across 79 files**, 358.83 seconds. Earlier parallel attempts hit timing-sensitive lifecycle failures; the focused suites and a complete serial run passed before the literal standard gate also passed. Codex's final targeted re-review returned **APPROVE**, closing all original and subsequent findings. Final edited-byte package validation (`package-standard-final.log`) passed **233 files** and includes this record.
 
+## Release and publication
+
+Plugin 2.4.5 was committed as `de8c195c2986443a088b674717133b164d2e4ef2` and pushed to `main`. [Release-commit CI 41226096281](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226096281) passed the full check/package and Windows spawn jobs. Annotated tag `v2.4.5` and [GitHub release](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.5) were created. [Publish workflow 41226438326](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226438326) passed its build and npm publish jobs.
+
+The registry tarball has SHA-1 `39f97a6de4b26ad51ac77305054682fcd5cd0164`, contains 233 files, and matches the CI artifact byte-for-byte. Fresh npm registry installations passed isolated setup/check and unsupported-version refusal for both hosts, and the compiled mirrors are byte-identical to the release checkout. Structured proof is retained at `.claude/kimi-code-research/release-2.4.5/registry-verification.json`. Installed hosts and operator CLI pins remain unchanged.
+
 ## Preserved boundaries
 
 Certification remains exact and per-operation. Legacy-v1 ends at 0.41.x. Plan mode and unsafe experimental selectors remain refused. Hook verification, trusted-root confinement, concurrency/defaults, one print runner, memory-only web tokens, finite budgets, process/session identity checks, deactivation, and recovery ownership are unchanged. Existing Git trust and hook-process failure residuals remain documented; this release does not make the hook an OS sandbox. Publication does not install or re-pin either host.

package/package.json

@@ -1,30 +1,61 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.4.5",
-  "description": "Kimi for Claude Code and Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
+  "version": "2.5.1",
+  "description": "Kimi for Claude Code, Codex, and DeepSeek Harness: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
   "type": "module",
+  "main": "dist/dsh/index.js",
   "engines": {
-    "node": ">=22.5.0"
+    "node": ">=22.5.0",
+    "dsh": ">=0.2.1-rc.5 <0.3.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./plugins/kimi-dsh/cordis.patch.yml"
+    }
   },
   "scripts": {
-    "check": "bun run build && bun run check:contracts && bun run check:surfaces && bunx tsc --noEmit && bun test && git diff --exit-code -- dist plugins/kimi-codex && UNTRACKED=\"$(git ls-files --others --exclude-standard -- dist plugins/kimi-codex)\" && { [ -z \"$UNTRACKED\" ] || { echo \"drift gate: untracked dist/codex files (stage them and re-run check):\"; echo \"$UNTRACKED\"; exit 1; }; }",
+    "check": "bun run build && bun run check:contracts && bun run check:surfaces && bunx tsc --noEmit && bun test && git diff --exit-code -- dist plugins/kimi-codex plugins/kimi-dsh && UNTRACKED=\"$(git ls-files --others --exclude-standard -- dist plugins/kimi-codex plugins/kimi-dsh)\" && { [ -z \"$UNTRACKED\" ] || { echo \"drift gate: untracked dist/codex/dsh files (stage them and re-run check):\"; echo \"$UNTRACKED\"; exit 1; }; }",
     "check:surfaces": "bun run scripts/generate-surfaces.ts --check",
     "generate:surfaces": "bun run scripts/generate-surfaces.ts",
     "build": "rm -rf dist && bunx tsc -p tsconfig.build.json && mkdir -p dist/vendor/shell-quote dist/vendor/smol-toml && cp runtime/vendor/shell-quote/LICENSE dist/vendor/shell-quote/LICENSE && cp runtime/vendor/smol-toml/*.js runtime/vendor/smol-toml/LICENSE dist/vendor/smol-toml/ && echo '{\"type\":\"module\"}' > dist/package.json",
     "companion": "node --import tsx runtime/companion.ts",
     "test": "bun test",
     "smoke:real": "KIMI_PLUGIN_CC_SMOKE=1 bun test tests/runtime/real-binary-smoke.test.ts --path-ignore-patterns '**/worktrees/**'",
-    "check:package": "node scripts/check-package.mjs",
+    "check:package": "node scripts/check-package.mjs && node scripts/check-dsh-package.mjs",
     "check:contracts": "node scripts/check-contract-size.mjs"
   },
   "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-commands": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-subagent": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-rc.5",
     "@types/bun": "^1.4.2",
     "@types/node": "^26.5.1",
     "smol-toml": "1.9.1",
     "tsx": "^4.23.13",
     "typescript": "^7.0.2"
   },
-  "dependencies": {},
+  "dependencies": {
+    "@deepseek-ai/dsh-brand": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tool-subagent": "0.2.1-rc.5",
+    "@deepseek-ai/schemastery": "3.18.5"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-commands": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-llm": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-session": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-subagent": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-subprocess": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-working-directory": ">=0.2.1-rc.5 <0.3.0"
+  },
+  "overrides": {
+    "zod": "^4.6.6",
+    "undici": "^8.12.2"
+  },
   "license": "Apache-2.0",
   "author": "Xule Lin",
   "repository": {
@@ -38,6 +69,8 @@
   "keywords": [
     "claude-code",
     "codex",
+    "deepseek-harness",
+    "dsh",
     "kimi",
     "kimi-code",
     "plugin",
@@ -58,6 +91,7 @@
     "hooks/",
     "dist/",
     "plugins/kimi-codex/",
+    "plugins/kimi-dsh/",
     "scripts/companion.sh",
     "scripts/review-gate-hook.sh",
     "docs/safety.md",

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.4.5",
+  "version": "2.5.1",
   "description": "Kimi for Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP job controls through the local Kimi Code CLI.",
   "author": {
     "name": "linxule"

package/plugins/kimi-codex/dist/dsh/companion.js

@@ -0,0 +1,174 @@
+import { randomUUID } from "node:crypto";
+import { brandString } from "@deepseek-ai/dsh-brand";
+import { assertUsableCwd, settleRunResult, subprocessRunHandle, } from "@deepseek-ai/dsh-subagent";
+export const DSH_COMPANION_OPERATIONS = [
+    "ask",
+    "review",
+    "challenge",
+    "rescue",
+    "pursue",
+    "swarm",
+    "swarm-write",
+];
+export function companionTextTask(prompt) {
+    if (prompt.length === 0 || prompt.some((block) => block.type !== "text")) {
+        throw new Error("kimi-plugin-cc: a delegation must contain only text blocks");
+    }
+    const text = prompt.map((block) => block.type === "text" ? block.text : "").join("\n\n");
+    if (text.trim().length === 0) {
+        throw new Error("kimi-plugin-cc: a delegation must not be empty");
+    }
+    return text;
+}
+export function companionArgv(operation, prompt, companionPath, nodeBin = process.execPath, options = {}) {
+    const command = operation === "ask" || operation === "review"
+        ? [operation]
+        : operation === "swarm-write"
+            ? ["task", "swarm", "--write"]
+            : ["task", operation];
+    return [
+        nodeBin,
+        companionPath,
+        ...command,
+        ...(operation === "ask" || operation === "rescue" ? ["--fresh"] : []),
+        ...(options.model === undefined ? [] : ["-m", options.model]),
+        ...(options.thinkingEffort === undefined ? [] : ["--thinking", options.thinkingEffort]),
+        ...(options.budget === undefined ? [] : ["--budget", options.budget]),
+        ...((operation === "review" || operation === "challenge") && options.reviewBase !== undefined
+            ? ["--base", options.reviewBase]
+            : []),
+        "--",
+        prompt,
+    ];
+}
+export function companionEnvironment(dataRoot, cwd, env, nodeBin = process.execPath) {
+    return {
+        ...env,
+        KIMI_PLUGIN_CC_DATA: dataRoot,
+        KIMI_PLUGIN_CC_HOST_ID: "dsh",
+        KIMI_PLUGIN_CC_NODE_BIN: nodeBin,
+        KIMI_PLUGIN_CC_WORKSPACE_CWD: cwd,
+        CLAUDE_PLUGIN_DATA: undefined,
+        PLUGIN_DATA: undefined,
+        CLAUDE_PLUGIN_ROOT: undefined,
+        PLUGIN_ROOT: undefined,
+        KIMI_PLUGIN_CC_SHELL_LAUNCH: undefined,
+        KIMI_PLUGIN_CC_MCP_WORKSPACE: undefined,
+        KIMI_PLUGIN_CC_WORKSPACE_ROOT: undefined,
+        KIMI_PLUGIN_CC_HOOK_SCRIPT: undefined,
+        KIMI_PLUGIN_CC_SKIP_HOOK_CHECK: undefined,
+        KIMI_PLUGIN_CC_SKIP_VERSION_PROBE: undefined,
+        KIMI_CODE_TRUST_WORKSPACE: undefined,
+    };
+}
+export async function startCompanionRun(request, operation, spec) {
+    const prompt = companionTextTask(request.prompt);
+    if (request.signal.aborted) {
+        throw new Error("kimi-plugin-cc: delegation was aborted before companion startup");
+    }
+    const cwd = assertUsableCwd("kimi-plugin-cc", "child cwd", request.cwd ?? process.cwd());
+    const termination = new AbortController();
+    let cancelled = false;
+    const requestCancel = () => {
+        cancelled = true;
+        if (!termination.signal.aborted) {
+            termination.abort(new Error("kimi-plugin-cc: delegation cancelled"));
+        }
+    };
+    const onAbort = () => requestCancel();
+    request.signal.addEventListener("abort", onAbort, { once: true });
+    let child;
+    try {
+        child = spec.spawn({
+            argv: companionArgv(operation, prompt, spec.companionPath, process.execPath, spec),
+            cwd,
+            stdio: {
+                stdin: "ignore",
+                stdout: { maxBytes: spec.maxOutputBytes },
+                stderr: "inherit",
+            },
+            graceMs: spec.disposeGraceMs,
+            signal: termination.signal,
+            env: companionEnvironment(spec.dataRoot, cwd, spec.env),
+        });
+    }
+    catch (error) {
+        request.signal.removeEventListener("abort", onAbort);
+        throw error;
+    }
+    let diagnostic;
+    const result = settleRunResult({
+        attempt: async () => {
+            let outcome;
+            try {
+                outcome = await child.done;
+            }
+            catch (error) {
+                diagnostic = `Kimi ${operation} companion failed before producing a terminal exit`;
+                throw error;
+            }
+            const collected = child.collected.stdout?.readFrom(0);
+            const text = collected?.text.trimEnd() ?? "";
+            if (!cancelled && outcome.exitCode === 0 && collected && !collected.lossy && text.trim().length > 0) {
+                return { output: [{ type: "text", text }], stopReason: "completed" };
+            }
+            const facts = [
+                `exit code: ${outcome.exitCode ?? "none"}`,
+                `signal: ${outcome.signal ?? "none"}`,
+                ...(collected?.lossy ? ["stdout truncated"] : []),
+                ...(text.trim().length === 0 ? ["stdout empty"] : []),
+            ];
+            diagnostic = `Kimi ${operation} companion failed (${facts.join("; ")})`;
+            return { output: [], diagnostic, stopReason: cancelled ? "aborted" : "error" };
+        },
+        collectOutput: () => [],
+        collectDiagnostic: () => diagnostic,
+        cancelled: () => cancelled,
+        signal: request.signal,
+        onAbort,
+    });
+    return subprocessRunHandle({
+        id: brandString(randomUUID()),
+        result,
+        signal: request.signal,
+        onAbort,
+        requestCancel,
+        teardown: async () => {
+            child.terminate();
+            await child.waitForExit();
+            await child.done.catch(() => { });
+        },
+    });
+}
+export async function runCompanionCommand(argv, cwd, spec, signal) {
+    const child = spec.spawn({
+        argv: [process.execPath, spec.companionPath, ...argv],
+        cwd,
+        stdio: {
+            stdin: "ignore",
+            stdout: { maxBytes: spec.maxOutputBytes },
+            stderr: { maxBytes: spec.maxOutputBytes },
+        },
+        graceMs: spec.disposeGraceMs,
+        signal,
+        env: companionEnvironment(spec.dataRoot, cwd, spec.env),
+    });
+    try {
+        const outcome = await child.done;
+        await child.waitForExit();
+        const stdout = child.collected.stdout?.readFrom(0);
+        const stderr = child.collected.stderr?.readFrom(0);
+        return {
+            exitCode: outcome.exitCode,
+            signal: outcome.signal,
+            stdout: stdout?.text ?? "",
+            stderr: stderr?.text ?? "",
+            truncated: Boolean(stdout?.lossy || stderr?.lossy),
+        };
+    }
+    catch (error) {
+        child.terminate();
+        await child.waitForExit().catch(() => false);
+        throw error;
+    }
+}

package/plugins/kimi-codex/dist/dsh/index.js

@@ -0,0 +1,156 @@
+import { homedir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { CommandDefinitionId } from "@deepseek-ai/dsh-commands/brand";
+import z from "@deepseek-ai/schemastery";
+import { NO_START_CAPABILITIES, } from "@deepseek-ai/dsh-subagent";
+import { DSH_COMPANION_OPERATIONS, runCompanionCommand, startCompanionRun, } from "./companion.js";
+import { parseDurationMs } from "../parsing.js";
+export const name = "kimi-plugin-cc";
+export const inject = ["subagents", "subprocess"];
+const DEFAULT_DISPOSE_GRACE_MS = 6_000;
+const DEFAULT_MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
+const COMPANION_PATH = fileURLToPath(new URL("../../dist/companion.js", import.meta.url));
+export const Config = z.object({
+    dataRoot: z.string().min(1),
+    env: z.dict(z.string()).default({}),
+    disposeGraceMs: z.number().default(DEFAULT_DISPOSE_GRACE_MS),
+    maxOutputBytes: z.number().default(DEFAULT_MAX_OUTPUT_BYTES),
+    model: z.string().min(1),
+    thinkingEffort: z.string().min(1),
+    budget: z.string().min(1),
+    reviewBase: z.string().min(1),
+});
+export function defaultDshDataRoot(env = process.env) {
+    const explicit = env.KIMI_PLUGIN_CC_DATA;
+    if (explicit !== undefined) {
+        if (!path.isAbsolute(explicit)) {
+            throw new Error("kimi-plugin-cc: KIMI_PLUGIN_CC_DATA must be absolute");
+        }
+        return path.normalize(explicit);
+    }
+    const dshHome = env.DSH_HOME ?? path.join(env.HOME || homedir(), ".dsh");
+    if (!path.isAbsolute(dshHome)) {
+        throw new Error("kimi-plugin-cc: DSH_HOME must be absolute");
+    }
+    return path.join(dshHome, "plugin-data", "kimi-plugin-cc");
+}
+function resolveConfig(config) {
+    const resolved = {
+        dataRoot: config.dataRoot ?? defaultDshDataRoot(),
+        env: config.env ?? {},
+        disposeGraceMs: config.disposeGraceMs ?? DEFAULT_DISPOSE_GRACE_MS,
+        maxOutputBytes: config.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES,
+        model: config.model,
+        thinkingEffort: config.thinkingEffort,
+        budget: config.budget,
+        reviewBase: config.reviewBase,
+    };
+    if (!path.isAbsolute(resolved.dataRoot)) {
+        throw new Error("kimi-plugin-cc: dataRoot must be absolute");
+    }
+    if (!Number.isFinite(resolved.disposeGraceMs) || resolved.disposeGraceMs <= 0 || resolved.disposeGraceMs > MAX_TIMER_DELAY_MS) {
+        throw new Error(`kimi-plugin-cc: disposeGraceMs must be positive, finite, and no greater than ${MAX_TIMER_DELAY_MS}`);
+    }
+    if (!Number.isSafeInteger(resolved.maxOutputBytes) || resolved.maxOutputBytes <= 0) {
+        throw new Error("kimi-plugin-cc: maxOutputBytes must be a positive safe integer");
+    }
+    for (const [field, value] of [["model", resolved.model], ["thinkingEffort", resolved.thinkingEffort], ["reviewBase", resolved.reviewBase]]) {
+        if (value?.startsWith("-"))
+            throw new Error(`kimi-plugin-cc: ${field} must not start with '-'`);
+    }
+    if (resolved.budget !== undefined)
+        parseDurationMs(resolved.budget, "--budget", "dsh.config", "safety");
+    return resolved;
+}
+class KimiCompanionProvider {
+    name;
+    operation;
+    spec;
+    capabilities = NO_START_CAPABILITIES;
+    inheritsParentContext = false;
+    constructor(name, operation, spec) {
+        this.name = name;
+        this.operation = operation;
+        this.spec = spec;
+    }
+    start(request) {
+        return startCompanionRun(request, this.operation, this.spec);
+    }
+}
+function commandArguments(rawInput) {
+    const trimmed = rawInput.trim();
+    return trimmed.length === 0 ? [] : trimmed.split(/\s+/);
+}
+function commandText(result) {
+    return [result.stdout.trimEnd(), result.stderr.trimEnd()]
+        .filter((text) => text.length > 0)
+        .join("\n");
+}
+export function apply(ctx, config) {
+    const resolved = resolveConfig(config);
+    const spec = {
+        companionPath: COMPANION_PATH,
+        dataRoot: resolved.dataRoot,
+        env: resolved.env,
+        disposeGraceMs: resolved.disposeGraceMs,
+        maxOutputBytes: resolved.maxOutputBytes,
+        model: resolved.model,
+        thinkingEffort: resolved.thinkingEffort,
+        budget: resolved.budget,
+        reviewBase: resolved.reviewBase,
+        spawn: (spawnSpec) => ctx.subprocess.spawn(spawnSpec),
+    };
+    for (const operation of DSH_COMPANION_OPERATIONS) {
+        ctx.subagents.registerProvider(new KimiCompanionProvider(`kimi-${operation}`, operation, spec));
+    }
+    ctx.inject(["commands"], (commandCtx) => {
+        const execute = async (invocation, argv) => {
+            const directories = commandCtx.get("workingDirectory");
+            if (directories === undefined) {
+                return { kind: "error", text: "Kimi commands require the DSH working-directory service." };
+            }
+            const cwd = await directories.ensure(invocation.agent, invocation.signal);
+            const result = await runCompanionCommand(argv, cwd, spec, invocation.signal);
+            const text = commandText(result);
+            if (result.truncated) {
+                return { kind: "error", text: `${text}\nKimi command output exceeded the configured byte limit.`.trim() };
+            }
+            if (result.exitCode !== 0) {
+                return {
+                    kind: "error",
+                    text: `${text}\nKimi command failed (exit code: ${result.exitCode ?? "none"}; signal: ${result.signal ?? "none"}).`.trim(),
+                };
+            }
+            return { kind: "success", text: text.length > 0 ? text : "Kimi command completed." };
+        };
+        commandCtx.commands.register({
+            definitionId: CommandDefinitionId("kimi-plugin-cc/dsh/setup"),
+            name: "kimi-setup",
+            description: "Install, check, or remove the DSH-owned Kimi PreToolUse hook; list configured models",
+            input: { hint: "[--check|--uninstall|--models [--json]]" },
+            recordInput: false,
+            handler: (invocation) => {
+                const args = commandArguments(invocation.rawInput);
+                const valid = args.length === 0
+                    || (args.length === 1 && ["--check", "--uninstall", "--models"].includes(args[0]))
+                    || (args.length === 2 && args[0] === "--models" && args[1] === "--json");
+                if (!valid) {
+                    return { kind: "error", text: "Usage: /kimi-setup [--check|--uninstall|--models [--json]]" };
+                }
+                return execute(invocation, ["setup", ...args]);
+            },
+        });
+        for (const command of ["status", "result", "cancel"]) {
+            commandCtx.commands.register({
+                definitionId: CommandDefinitionId(`kimi-plugin-cc/dsh/${command}`),
+                name: `kimi-${command}`,
+                description: `${command === "cancel" ? "Cancel" : command === "status" ? "Inspect" : "Return"} a companion Kimi job`,
+                input: { hint: "[job-id]" },
+                recordInput: false,
+                handler: (invocation) => execute(invocation, [command, ...commandArguments(invocation.rawInput)]),
+            });
+        }
+    });
+}

package/plugins/kimi-codex/dist/hooks/install-paths.js

@@ -410,7 +410,7 @@ export function hostIdFromHookCommand(command) {
 }
 /**
  * True only for a canonical two-single-quoted-token command whose script is
- * `approval-hook.js` under a kimi-plugin-cc/kimi-marketplace install tree.
+ * `approval-hook.js` under a kimi-plugin-cc/dsh-kimi-plugin-cc/kimi-marketplace install tree.
  * This strict ownership test protects hand-rolled and non-canonical user hooks
  * from orphan pruning.
  */
@@ -424,5 +424,5 @@ export function isOurApprovalHookCommand(decodedCommand) {
     const normalized = parsed.hookScript.replace(/\\/g, "/");
     // Require a real path segment, not an arbitrary substring, so a user hook in
     // a similarly named wrapper directory is never misclassified and pruned.
-    return normalized.includes("/kimi-plugin-cc/") || normalized.includes("/kimi-marketplace/");
+    return normalized.includes("/kimi-plugin-cc/") || normalized.includes("/dsh-kimi-plugin-cc/") || normalized.includes("/kimi-marketplace/");
 }

package/plugins/kimi-codex/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.4.5";
+export const KIMI_PLUGIN_CC_VERSION = "2.5.1";