kimi-plugin-cc 2.4.5 → 2.5.2

package/plugins/kimi-dsh/dist/git.js

@@ -0,0 +1,224 @@
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { realpath, rm } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { RuntimeError } from "./errors.js";
+const execFileAsync = promisify(execFile);
+const MAX_DIFF_CHARS = 80_000;
+/**
+ * Buffer ceiling for a write-swarm capture patch. Unlike review diffs (capped at
+ * MAX_DIFF_CHARS for prompt budget), a capture patch MUST be byte-complete to
+ * `git apply`, so it is never truncated — only bounded by this generous buffer to
+ * avoid an unbounded RSS spike. A swarm patch larger than this is pathological.
+ */
+const MAX_PATCH_BYTES = 64 * 1024 * 1024;
+export async function collectReviewContext(cwd, base) {
+    const { repoRoot } = await resolveRepoIdentity(cwd);
+    const statusSummary = (await runGit(["status", "--short", "--untracked-files=all"], cwd)).trim();
+    if (base) {
+        const diffText = await getBaseDiff(cwd, base);
+        return {
+            repoRoot,
+            statusSummary,
+            diffText: truncateDiff(diffText),
+            diffTruncated: diffText.length > MAX_DIFF_CHARS,
+            scope: "base",
+            targetDescription: `branch diff against ${base}`,
+        };
+    }
+    // Working-tree review is repo-wide. status --short is already repo-wide; limiting diff to
+    // the caller's subdirectory would mask unrelated-but-relevant changes elsewhere in the repo.
+    const headDiff = await runGitAllowFailure(["diff", "--no-ext-diff", "--unified=3", "HEAD", "--"], cwd);
+    const diffText = headDiff.ok && headDiff.stdout.trim().length > 0
+        ? headDiff.stdout
+        : await runGit(["diff", "--no-ext-diff", "--unified=3", "--"], cwd);
+    return {
+        repoRoot,
+        statusSummary,
+        diffText: truncateDiff(diffText),
+        diffTruncated: diffText.length > MAX_DIFF_CHARS,
+        scope: "working-tree",
+        targetDescription: "current working tree changes",
+    };
+}
+export async function resolveRepoIdentity(cwd) {
+    const workspaceRoot = await realpath(cwd);
+    const result = await runGitAllowFailure(["rev-parse", "--show-toplevel", "--git-common-dir"], cwd);
+    if (!result.ok) {
+        return {
+            repoId: sha256(workspaceRoot),
+            repoRoot: workspaceRoot,
+            gitCommonDir: null,
+            isGitRepo: false,
+        };
+    }
+    const [repoRootRaw, gitCommonDirRaw] = result.stdout
+        .trim()
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+    const repoRoot = repoRootRaw ? await realpath(repoRootRaw) : workspaceRoot;
+    const gitCommonDir = gitCommonDirRaw && gitCommonDirRaw.length > 0
+        ? await realpath(path.resolve(cwd, gitCommonDirRaw))
+        : null;
+    return {
+        repoId: sha256(`${gitCommonDir ?? repoRoot}::${repoRoot}`),
+        repoRoot,
+        gitCommonDir,
+        isGitRepo: true,
+    };
+}
+async function getBaseDiff(cwd, base) {
+    // --end-of-options is a git safety marker (since 2.24) telling git every token after it is
+    // a refspec, not a flag. Defense in depth against argument injection via --base.
+    const threeDot = await runGitAllowFailure(["diff", "--no-ext-diff", "--unified=3", "--end-of-options", `${base}...HEAD`, "--"], cwd);
+    if (threeDot.ok) {
+        return threeDot.stdout;
+    }
+    return runGit(["diff", "--no-ext-diff", "--unified=3", "--end-of-options", base, "HEAD", "--"], cwd);
+}
+async function runGit(args, cwd) {
+    const result = await runGitAllowFailure(args, cwd);
+    if (!result.ok) {
+        throw new RuntimeError("GIT_COMMAND_FAILED", `git ${args.join(" ")} failed: ${result.stderr || "unknown error"}`, "review.git");
+    }
+    return result.stdout;
+}
+async function runGitAllowFailure(args, cwd, signal) {
+    try {
+        const { stdout, stderr } = await execFileAsync("git", args, {
+            cwd,
+            env: process.env,
+            maxBuffer: 10 * 1024 * 1024,
+            signal,
+        });
+        return { ok: true, stdout, stderr };
+    }
+    catch (error) {
+        const execError = error;
+        return {
+            ok: false,
+            stdout: execError.stdout ?? "",
+            stderr: execError.stderr ?? execError.message,
+        };
+    }
+}
+function truncateDiff(diffText) {
+    if (diffText.length <= MAX_DIFF_CHARS) {
+        return diffText;
+    }
+    return `${diffText.slice(0, MAX_DIFF_CHARS)}\n\n[diff truncated by companion after ${MAX_DIFF_CHARS} characters]`;
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+// ---------------------------------------------------------------------
+// Ephemeral worktree lifecycle — write-swarm.
+//
+// A write-swarm spawns its coordinator `kimi -p` with cwd = a throwaway
+// detached worktree off the user's HEAD, so `coder` subagents edit there and
+// never touch the user's checkout. The worktree is a LINKED worktree: its
+// working tree + index are isolated and disposable, but it SHARES the main
+// repo's object DB and refs. The PreToolUse hook (swarm-write label) confines
+// every subagent write to this worktree; the plugin captures the result as a
+// patch and removes the worktree. See docs/safety.md.
+// ---------------------------------------------------------------------
+/**
+ * True if the repo at `cwd` has a born HEAD (at least one commit). `git worktree
+ * add --detach HEAD` fails on an unborn HEAD (fresh repo, no commits) and on a
+ * bare repo, so write-swarm gates on this before creating any job state.
+ */
+export async function hasBornHead(cwd) {
+    const result = await runGitAllowFailure(["rev-parse", "--verify", "--quiet", "HEAD"], cwd);
+    return result.ok && result.stdout.trim().length > 0;
+}
+/**
+ * Create a throwaway detached worktree at `worktreePath` checked out to `base`
+ * (write-swarm hard-codes "HEAD"; never user input). `worktreePath` MUST be
+ * outside the repo (the plugin's worktrees dir). Throws GIT_WORKTREE_ADD_FAILED
+ * on failure. Caller owns removal (`removeWorktree`) on EVERY terminal path.
+ */
+export async function createEphemeralWorktree(repoRoot, base, worktreePath) {
+    const result = await runGitAllowFailure(["worktree", "add", "--detach", worktreePath, base], repoRoot);
+    if (!result.ok) {
+        throw new RuntimeError("GIT_WORKTREE_ADD_FAILED", `git worktree add failed: ${result.stderr || "unknown error"}`, "swarm.worktree", { details: { repoRoot, worktreePath, base } });
+    }
+}
+/**
+ * Capture the full change set in a worktree as a byte-complete, applyable patch.
+ *
+ * `git add -N -- .` records intent-to-add index entries for untracked files so
+ * the diff includes their content — WITHOUT writing blob objects into the shared
+ * object DB (intent-to-add stores a zero-oid entry in the worktree's OWN index
+ * only). This keeps the "plugin never mutates git state" invariant literally
+ * true: no loose objects, no ref/HEAD movement.
+ *
+ * The diff is taken against **HEAD** (the worktree's base commit), NOT the index:
+ * `git diff HEAD` captures the complete change set regardless of index state, so
+ * the patch is invariant to any intermediate staging (e.g. if a tool ever
+ * `git add`s a file, a plain `git diff` would silently omit it; `git diff HEAD`
+ * still captures it). `--binary` makes binary changes applyable; the diff is
+ * NEVER truncated (a capture patch must apply cleanly) and uses a raised
+ * maxBuffer. Mirrors `collectReviewContext`'s HEAD-based diff.
+ *
+ * Returns the patch text (empty string if the swarm changed nothing).
+ */
+export async function captureWorktreePatch(worktreePath, signal) {
+    // Intent-to-add is required so untracked files surface in `git diff HEAD`.
+    // An add -N failure aborts capture rather than returning a patch that omits
+    // new files.
+    const intentToAdd = await runGitAllowFailure(["add", "-N", "--", "."], worktreePath, signal);
+    if (!intentToAdd.ok) {
+        throw new RuntimeError("GIT_WORKTREE_INTENT_TO_ADD_FAILED", `git add -N (worktree capture) failed: ${intentToAdd.stderr || "unknown error"}`, "swarm.worktree", { details: { worktreePath } });
+    }
+    try {
+        const { stdout } = await execFileAsync("git", ["diff", "--binary", "HEAD", "--"], {
+            cwd: worktreePath,
+            env: process.env,
+            maxBuffer: MAX_PATCH_BYTES,
+            signal,
+        });
+        return stdout;
+    }
+    catch (error) {
+        const execError = error;
+        throw new RuntimeError("GIT_WORKTREE_DIFF_FAILED", `git diff (worktree capture) failed: ${execError.stderr || execError.message || "unknown error"}`, "swarm.worktree", { details: { worktreePath } });
+    }
+}
+/**
+ * Remove a worktree (best-effort, idempotent). `--force` discards the dirty tree,
+ * so callers MUST capture the patch BEFORE calling this. Falls back to pruning the
+ * admin entry and removing the on-disk dir if `worktree remove` cannot (e.g. the
+ * dir was partially deleted). Never throws — cleanup must not mask the real error
+ * on a failure path.
+ */
+export async function removeWorktree(repoRoot, worktreePath) {
+    const removed = await runGitAllowFailure(["worktree", "remove", "--force", worktreePath], repoRoot);
+    if (!removed.ok) {
+        // Prune the admin entry (handles the case where the dir is already gone) then
+        // force-delete any on-disk remnant so no orphan accretes in the plugin dir.
+        await runGitAllowFailure(["worktree", "prune"], repoRoot);
+        await rm(worktreePath, { recursive: true, force: true }).catch(() => {
+            // Best-effort; a residual dir is swept on the next run.
+        });
+    }
+}
+/**
+ * Prune stale worktree admin entries (entries whose on-disk dir is gone). Cheap;
+ * run at the start of every write-swarm. Does NOT remove on-disk worktrees whose
+ * dirs still exist — the caller sweeps those by path. Never throws.
+ */
+export async function pruneWorktrees(repoRoot) {
+    await runGitAllowFailure(["worktree", "prune"], repoRoot);
+}
+/**
+ * True if the working tree at `cwd` has uncommitted changes (tracked or
+ * untracked). write-swarm bases its worktree on HEAD, so a dirty tree means the
+ * user's in-progress work is NOT visible to the swarm — the caller warns. Returns
+ * false on a git failure (don't block the run on a status probe).
+ */
+export async function isWorkingTreeDirty(cwd) {
+    const result = await runGitAllowFailure(["status", "--porcelain", "--untracked-files=all"], cwd);
+    return result.ok && result.stdout.trim().length > 0;
+}

package/plugins/kimi-dsh/dist/help.js

@@ -0,0 +1,43 @@
+import { hasHelpFlag, ASK_SUPPORTED_FLAGS, RESCUE_SUPPORTED_FLAGS, REVIEW_SUPPORTED_FLAGS, PURSUE_SUPPORTED_FLAGS, SWARM_SUPPORTED_FLAGS, JOB_LOOKUP_SUPPORTED_FLAGS, SETUP_SUPPORTED_FLAGS, REPAIR_SESSIONS_SUPPORTED_FLAGS, REPLAY_SUPPORTED_FLAGS, RECOVER_SWARM_SUPPORTED_FLAGS, } from "./parsing.js";
+const SUBCOMMANDS = "setup, review, task, ask, status, result, cancel, replay, repair-sessions, recover-swarm";
+const TASK_KINDS = "rescue, challenge, pursue, swarm";
+/** Help is a dispatch-only, side-effect-free exception to normal argument parsing. */
+export function companionHelp(argv) {
+    const [command, kind] = argv;
+    // Scan only the argument region: the subcommand (and a task kind) are
+    // positional names, not prose, so they must not end the flag region.
+    const argumentStart = command === "--help" || command === "-h" ? 0
+        : command === "task" && kind !== undefined && !kind.startsWith("-") ? 2
+            : 1;
+    if (!hasHelpFlag(argv.slice(argumentStart)))
+        return undefined;
+    const suffix = " Thinking effort is a per-run request, not a guarantee. Use --help or -h among the leading flags (before any prompt text or --) to show this usage.";
+    const usage = (name, positionals, flags, description) => `Usage: companion.sh ${name}${positionals ? ` ${positionals}` : ""}. ${description} Supported flags: ${flags}.${suffix}`;
+    switch (command) {
+        case "--help":
+        case "-h":
+            return `Usage: companion.sh <subcommand> [arguments]. Subcommands: ${SUBCOMMANDS}. Use <subcommand> --help for usage.`;
+        case "task":
+            switch (kind) {
+                case "rescue": return usage("task rescue", "[options] [--] <task>", RESCUE_SUPPORTED_FLAGS, "Write-capable task; default budget 45m. Backgrounding does not extend the budget.");
+                case "challenge": return usage("task challenge", "[options] [--] [focus]", REVIEW_SUPPORTED_FLAGS, "Read-only challenge; default budget 30m. Foreground-only (no --background/--wait).");
+                case "pursue": return usage("task pursue", "[options] [--] <objective>", PURSUE_SUPPORTED_FLAGS, "Autonomous goal; default budget 45m. Runtime foreground-only.");
+                case "swarm": return usage("task swarm", "[options] [--] <objective>", SWARM_SUPPORTED_FLAGS, "Parallel task; default budget 30m. Runtime foreground-only; --write produces a patch.");
+                default: return `Usage: companion.sh task <kind> [arguments]. Task kinds: ${TASK_KINDS}. Use task <kind> --help for usage.`;
+            }
+        case "ask": return usage(command, "[options] [--] [prompt]", ASK_SUPPORTED_FLAGS, "Read-only question; default budget 30m. Backgrounding does not extend the budget.");
+        case "review": return usage(command, "[options] [--] [focus]", REVIEW_SUPPORTED_FLAGS, "Read-only review; default budget 30m. Foreground-only (no --background/--wait).");
+        case "setup": return usage(command, "[options]", SETUP_SUPPORTED_FLAGS, "Install, check, or remove this host's managed hook, or list configured models.");
+        case "status":
+        case "result":
+        case "cancel":
+            return usage(command, "[job-id] [options]", JOB_LOOKUP_SUPPORTED_FLAGS, command === "status" ? "Show job state as JSON." : command === "result" ? "Read a terminal artifact, optionally in a JSON envelope." : "Cancel a running job; without an id, target the repository's latest running job.");
+        case "replay": return usage(command, "<job-id>", REPLAY_SUPPORTED_FLAGS, "Replay a completed job's persisted stream log.");
+        case "recover-swarm": return `Usage: companion.sh recover-swarm <job-id> [${RECOVER_SWARM_SUPPORTED_FLAGS}]. Preview durable swarm recovery; --apply stops verified orphans, disables the recorded session and captures a patch. Never resumes prompts or changes terminal job outcomes.`;
+        case "repair-sessions": return usage(command, "[options]", REPAIR_SESSIONS_SUPPORTED_FLAGS, "Preview session metadata repair; --apply writes, --all selects all host-owned repositories.");
+        case "worker": return "Usage: companion.sh worker <ask|rescue> <job-id>. Internal detached-worker entry point; launched by ask/rescue, not manually.";
+        case "mcp": return "Usage: companion.sh mcp. Run the Kimi MCP stdio server; normally launched by Claude Code or Codex plugin configuration.";
+        case "mcp-child": return "Usage: companion.sh mcp-child <job-uuid> <model-operation> [arguments]. Internal supervised MCP child; launched by the MCP server, not manually.";
+        default: return undefined;
+    }
+}

package/plugins/kimi-dsh/dist/hook-escape.js

@@ -0,0 +1,71 @@
+import { decideHookOutcomePure } from "./hooks/approval-policy.js";
+// Upstream decorates results it still delivers verbatim otherwise (2.2.0,
+// `agent/toolDedupe/toolDedupeService.ts`): the repeat breaker appends one
+// `\n\n<system-reminder>…</system-reminder>` block from the 3rd identical call
+// (`appendReminder`, also for vetoed results — `finalizeToolResult` runs the
+// `onDidExecuteTool` hooks on every settled result), and at the 12th call it
+// replaces the result with a fixed "not executed" text (`HANDOFF_VETO_TEXT`).
+// Both still mean the hook's veto stood. Re-verify each certification.
+const REMINDER_SUFFIX = /^(?:\n\n<system-reminder>[\s\S]*?<\/system-reminder>)+$/;
+const HANDOFF_VETO_PREFIX = "This turn was ended by the repeat breaker after the same tool call was issued ";
+/** True when `content` is the hook's denial, possibly carrying upstream's repeat-breaker decoration. */
+export function carriesDenial(content, reason) {
+    if (content === reason)
+        return true;
+    if (content.startsWith(reason) && REMINDER_SUFFIX.test(content.slice(reason.length)))
+        return true;
+    return content.startsWith(HANDOFF_VETO_PREFIX);
+}
+/** Detection evidence, never enforcement. Results arrive after a tool may have
+ * executed, and the stream carries no outcome field: a result other than the
+ * managed denial is also what upstream emits for calls it rejected BEFORE the
+ * hook ran (unknown tool, disabled tool, invalid args, sensitive path, per-tool
+ * resolve errors) and what a coexisting hook or permission policy emits when it
+ * blocks first. So an escape is reported — logged, persisted, shown — and the
+ * run continues; failing the job needs positive execution evidence this stream
+ * does not provide. Filesystem policy is never replayed here. */
+export function createHookEscapeMonitor(ctx) {
+    const pending = new Map();
+    return {
+        observe(record) {
+            if (!ctx.commandLabel)
+                return;
+            if (record.role === "assistant") {
+                for (const call of record.tool_calls ?? []) {
+                    let args;
+                    try {
+                        args = JSON.parse(call.function.arguments);
+                    }
+                    catch {
+                        args = {};
+                    }
+                    if (typeof args !== "object" || args === null || Array.isArray(args))
+                        args = {};
+                    const result = decideHookOutcomePure({
+                        hook_event_name: "PreToolUse", tool_name: call.function.name,
+                        tool_input: args, tool_call_id: call.id, cwd: ctx.cwd,
+                    }, ctx);
+                    if (!("evaluator" in result) && result.decision === "deny") {
+                        pending.set(call.id, { reason: result.reason, tool_name: call.function.name });
+                    }
+                }
+            }
+            else if (record.role === "tool") {
+                const denied = pending.get(record.tool_call_id);
+                if (denied) {
+                    pending.delete(record.tool_call_id);
+                    if (!carriesDenial(record.content, denied.reason)) {
+                        return { tool_call_id: record.tool_call_id, tool_name: denied.tool_name,
+                            kind: "mismatch", content_excerpt: record.content.slice(0, 200) };
+                    }
+                }
+            }
+        },
+        /** Every denied call still without a result; call once at settlement. */
+        settle() {
+            const unresolved = [...pending.entries()].map(([tool_call_id, { tool_name }]) => ({ tool_call_id, tool_name, kind: "unresolved" }));
+            pending.clear();
+            return unresolved;
+        },
+    };
+}

package/plugins/kimi-dsh/dist/hooks/approval-hook.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+// Entry script for the kimi-code PreToolUse hook.
+//
+// Installed by /kimi:setup as a managed block in ~/.kimi-code/config.toml:
+//
+//   [[hooks]]
+//   event = "PreToolUse"
+//   command = "'/abs/path/to/node' '/abs/path/to/dist/hooks/approval-hook.js'"
+//   timeout = 15
+//
+// Hook protocol:
+//
+//   stdin:  full hook payload as JSON
+//   stdout: optional structured JSON (only consulted when exit code is 0)
+//   stderr: free-form reason
+//   exit 0: allow (with optional structured override)
+//   exit 2: deny — `stderr.trim()` becomes the reason surfaced to the model
+//   any other exit code: fall through to allow (fail-open)
+//
+// Exit 2 + stderr avoids structured-output version-skew hazards, and the
+// runner short-circuits it before reading structured output. Because any other
+// exit fails open upstream, every code path here is wrapped so an unexpected
+// error exits 2 with a "hook misconfigured" reason instead.
+//
+// kimi-code spawns the command with `shell: true`. The canonical command is two
+// shell-quoted absolute tokens — the resolved Node binary and hook script — so
+// `/bin/sh -c` does not depend on its working directory or PATH.
+import { decideHookOutcome } from "./approval-policy.js";
+import { evaluateRescueHookRequest } from "../rescue-approval.js";
+const STDIN_TIMEOUT_MS = 5_000;
+async function main() {
+    const stdinText = await readStdinWithTimeout(STDIN_TIMEOUT_MS);
+    let input;
+    try {
+        const parsed = JSON.parse(stdinText);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error("hook payload must be a JSON object");
+        }
+        input = parsed;
+    }
+    catch (err) {
+        failClosed(`stdin was not a JSON object: ${formatErr(err)}`);
+        return;
+    }
+    const decision = await decideHookOutcome(input, {
+        commandLabel: process.env.KIMI_PLUGIN_CC_CMD,
+        operationKind: process.env.KIMI_PLUGIN_CC_OPERATION,
+        rescueEvaluator: evaluateRescueHookRequest,
+        // Trusted root for rescue/pursue/swarm-write. Set by the plugin spawn; the
+        // model inside kimi cannot forge it and hook payload cwd is not trusted.
+        trustedWorkspaceRoot: process.env.KIMI_PLUGIN_CC_WORKSPACE_ROOT,
+    });
+    if (decision.decision === "deny") {
+        // stderr.trim() in runner.ts:118 becomes the model-visible reason.
+        process.stderr.write(`${decision.reason ?? "denied"}\n`);
+        process.exit(2);
+        return;
+    }
+    process.exit(0);
+}
+function failClosed(reason) {
+    process.stderr.write(`kimi-plugin-cc safety hook misconfigured: ${reason}\n`);
+    process.exit(2);
+}
+function formatErr(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function readStdinWithTimeout(timeoutMs) {
+    return new Promise((resolve, reject) => {
+        let buf = "";
+        let settled = false;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (value instanceof Error)
+                reject(value);
+            else
+                resolve(value);
+        };
+        const timer = setTimeout(() => {
+            finish(new Error(`stdin did not close within ${timeoutMs}ms`));
+        }, timeoutMs);
+        timer.unref();
+        try {
+            process.stdin.setEncoding("utf8");
+        }
+        catch {
+            // some test harnesses pre-encode; fine to ignore
+        }
+        process.stdin.on("data", (chunk) => {
+            buf += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        });
+        process.stdin.on("end", () => finish(buf));
+        process.stdin.on("error", (err) => finish(err instanceof Error ? err : new Error(String(err))));
+    });
+}
+main().catch((err) => {
+    failClosed(`uncaught error: ${formatErr(err)}`);
+});

package/plugins/kimi-dsh/dist/hooks/approval-policy.js

@@ -0,0 +1,211 @@
+// Pure decision logic for the kimi-code PreToolUse hook. The entry script owns
+// stdin/stdout/exit semantics so callers can test this policy without mocking
+// process IO.
+//
+// `kimi -p` hard-codes `permission: 'auto'`, and PreToolUse fires before
+// permission rules, so this hook is load-bearing for read-only commands.
+// Unknown command labels fail closed to READ_ONLY_TOOLS. An absent
+// KIMI_PLUGIN_CC_CMD means out-of-plugin use and remains unrestricted.
+/**
+ * Tools considered read-only across review/challenge/review_gate/rescue.
+ *
+ * Includes kimi-code's own local-read defaults (`Read`, `Grep`, `Glob`)
+ * plus a few additional read-safe tools the runtime auto-allows
+ * (`ReadMediaFile`, `TaskList`, `TaskOutput`). Excludes network
+ * operations (`WebSearch`, `FetchURL`) since review-style commands
+ * should stay on the local repo — adding them would silently broaden
+ * the safety contract for what is documented as a local-only review.
+ */
+export const READ_ONLY_TOOLS = new Set([
+    "Read",
+    "Grep",
+    "Glob",
+    "ReadMediaFile",
+    "TaskList",
+    "TaskOutput",
+]);
+/**
+ * Exact tool name for kimi-code's parallel fan-out. Every spawned subagent
+ * inherits KIMI_PLUGIN_CC_CMD. On native v2, each agent has its own eager
+ * external-hooks service, so this same hook denies subagent writes. Legacy v1
+ * separately relies on PreToolCallHookPermissionPolicy at policy index 0 for
+ * every agent. The singular `Agent` tool remains denied: only the AgentSwarm
+ * fan-out surface is allowlisted.
+ */
+const AGENT_SWARM_TOOL = "AgentSwarm";
+/**
+ * agent-core-v2's ONLY chain-breaking final allow is the plan-file guard, and
+ * it fires only while plan mode is ACTIVE. Native v2 is therefore certified on
+ * the invariant that plan mode is never armed in a plugin-managed session:
+ * `default_plan_mode` is refused pre-spawn (runtime/native-v2-preflight.ts),
+ * plan-tainted sessions are never resumed, and the model-reachable entry tool
+ * is denied HERE for every label. ExitPlanMode is denied too so the deny set
+ * is explicit rather than a side effect of the read-only allowlists.
+ */
+const PLAN_MODE_TOOLS = new Set(["EnterPlanMode", "ExitPlanMode"]);
+/**
+ * Recognized command labels. Sole source of truth; keep in sync with
+ * the strings emitted by `runCliPrompt` callers in
+ * `runtime/commands/*.ts`.
+ */
+const KNOWN_LABELS = new Set([
+    "ask",
+    "review",
+    "challenge",
+    "review_gate",
+    "rescue",
+    "swarm",
+    "swarm-write",
+]);
+export async function decideHookOutcome(input, ctx) {
+    const result = decideHookOutcomePure(input, ctx);
+    if (!("evaluator" in result))
+        return result;
+    const toolName = typeof input.tool_name === "string" ? input.tool_name : "";
+    if (ctx.rescueEvaluator !== undefined) {
+        return await ctx.rescueEvaluator(result.workspaceRoot, toolName, input.tool_input);
+    }
+    if (READ_ONLY_TOOLS.has(toolName))
+        return { decision: "allow" };
+    return {
+        decision: "deny",
+        reason: `kimi-plugin-cc safety hook: ${ctx.commandLabel} evaluator not configured; tool "${toolName}" denied as a safety default.`,
+    };
+}
+export function decideHookOutcomePure(input, ctx) {
+    const label = typeof ctx.commandLabel === "string" ? ctx.commandLabel : undefined;
+    // Out-of-plugin context: any kimi process spawned without our env var
+    // is direct user usage. The hook MUST NOT restrict it.
+    if (label === undefined || label.length === 0) {
+        return { decision: "allow" };
+    }
+    const toolName = typeof input.tool_name === "string" ? input.tool_name : "";
+    if (PLAN_MODE_TOOLS.has(toolName)) {
+        return {
+            decision: "deny",
+            reason: `kimi-plugin-cc safety hook: tool "${toolName}" is denied for plugin-managed sessions because agent-core-v2 plan-file writes can bypass later external hooks; native plan mode is never armed in plugin-managed sessions.`,
+        };
+    }
+    if (["GetGoal", "UpdateGoal", "CreateGoal", "SetGoalBudget"].includes(toolName)) {
+        // Pursue keeps the rescue write boundary, but must be able to inspect and
+        // terminally settle its existing goal. Never allow creating/reactivating a
+        // goal or changing its budget through this metadata-only exception.
+        if (toolName === "SetGoalBudget" && label === "rescue" && ctx.operationKind === "pursue") {
+            return {
+                decision: "deny",
+                reason: `kimi-plugin-cc safety hook: tool "SetGoalBudget" is denied. The outer plugin wall-clock budget already applies; continue the current goal without retrying SetGoalBudget or changing its budget.`,
+            };
+        }
+        const args = input.tool_input;
+        const objectArgs = typeof args === "object" && args !== null && !Array.isArray(args) &&
+            (Object.getPrototypeOf(args) === Object.prototype || Object.getPrototypeOf(args) === null);
+        const keys = objectArgs ? Reflect.ownKeys(args) : [];
+        const validArgs = objectArgs && ((toolName === "GetGoal" && keys.length === 0) ||
+            (toolName === "UpdateGoal" && keys.length === 1 && keys[0] === "status" &&
+                (args.status === "complete" || args.status === "blocked")));
+        if (label === "rescue" && ctx.operationKind === "pursue" &&
+            typeof ctx.trustedWorkspaceRoot === "string" && ctx.trustedWorkspaceRoot.trim().length > 0 && validArgs) {
+            return { decision: "allow" };
+        }
+        return {
+            decision: "deny",
+            reason: `kimi-plugin-cc safety hook: tool "${toolName}" requires a pursue run with a trusted workspace root and exact terminal goal metadata arguments; goal creation, reactivation, and budget changes are denied.`,
+        };
+    }
+    switch (label) {
+        case "ask":
+        case "review":
+        case "challenge":
+        case "review_gate":
+            // Read-only narrative surfaces share READ_ONLY_TOOLS. They run as
+            // non-interactive subprocesses, so interactive tool prompts cannot
+            // substitute for this allowlist.
+            if (READ_ONLY_TOOLS.has(toolName)) {
+                return { decision: "allow" };
+            }
+            return {
+                decision: "deny",
+                reason: denyReadOnlyMessage(label, toolName),
+            };
+        case "swarm":
+            // The coordinator may launch AgentSwarm; every subagent inherits this
+            // label and is evaluated by the same hook, so only READ_ONLY_TOOLS plus
+            // AgentSwarm are allowed and the singular Agent stays denied. This adds
+            // no direct tool-write permission within the repository/Git trust
+            // boundary: read-only Git context commands still trust repository Git
+            // configuration and can execute configured helpers. Nested AgentSwarm
+            // calls remain allowed, with their cost bounded by the command budget.
+            if (READ_ONLY_TOOLS.has(toolName) || toolName === AGENT_SWARM_TOOL) {
+                return { decision: "allow" };
+            }
+            return {
+                decision: "deny",
+                reason: denySwarmMessage(toolName),
+            };
+        case "swarm-write": {
+            // Write-capable fan-out runs in an ephemeral worktree. AgentSwarm and the
+            // read-only set are allowed; the singular Agent is denied. Every other
+            // tool goes through the rescue evaluator scoped to the plugin-exported
+            // KIMI_PLUGIN_CC_WORKSPACE_ROOT, never the payload cwd, so an in-process
+            // subagent cannot move the trust boundary or forge its root. A missing
+            // root fails closed for writes.
+            if (READ_ONLY_TOOLS.has(toolName) || toolName === AGENT_SWARM_TOOL) {
+                return { decision: "allow" };
+            }
+            const workspaceRoot = typeof ctx.trustedWorkspaceRoot === "string" ? ctx.trustedWorkspaceRoot : "";
+            if (workspaceRoot.length === 0) {
+                return {
+                    decision: "deny",
+                    reason: `kimi-plugin-cc safety hook: swarm-write received no trusted workspace root; tool "${toolName}" denied. ` +
+                        "This is a plugin misconfiguration — writes are refused rather than risk the user's working tree.",
+                };
+            }
+            return { evaluator: "rescue", workspaceRoot };
+        }
+        case "rescue": {
+            const workspaceRoot = typeof ctx.trustedWorkspaceRoot === "string" ? ctx.trustedWorkspaceRoot : "";
+            if (workspaceRoot.length === 0) {
+                if (READ_ONLY_TOOLS.has(toolName))
+                    return { decision: "allow" };
+                return {
+                    decision: "deny",
+                    reason: `kimi-plugin-cc safety hook: rescue received no trusted workspace root; tool "${toolName}" denied. ` +
+                        "This is a plugin misconfiguration — writes are refused rather than trusting hook payload cwd.",
+                };
+            }
+            return { evaluator: "rescue", workspaceRoot };
+        }
+        default:
+            if (KNOWN_LABELS.has(label)) {
+                return {
+                    decision: "deny",
+                    reason: `kimi-plugin-cc safety hook: command label "${label}" has no policy branch.`,
+                };
+            }
+            // Unknown label: fail closed to READ_ONLY_TOOLS only.
+            if (READ_ONLY_TOOLS.has(toolName)) {
+                return { decision: "allow" };
+            }
+            return {
+                decision: "deny",
+                reason: `kimi-plugin-cc safety hook: unrecognized command label "${label}"; tool "${toolName}" denied as a safety default.`,
+            };
+    }
+}
+function denyReadOnlyMessage(label, toolName) {
+    const tool = toolName.length > 0 ? toolName : "<unspecified>";
+    return [
+        `kimi-plugin-cc safety hook: ${label} is read-only.`,
+        `Tool "${tool}" is denied — use Read, Grep, or Glob to inspect the workspace instead.`,
+        "If you need to mutate state, the user must invoke /kimi:rescue (write-capable) rather than this command.",
+    ].join(" ");
+}
+function denySwarmMessage(toolName) {
+    const tool = toolName.length > 0 ? toolName : "<unspecified>";
+    return [
+        "kimi-plugin-cc safety hook: swarm is a read-only parallel review.",
+        `Tool "${tool}" is denied — every subagent may use Read, Grep, or Glob to inspect the workspace,`,
+        "and the coordinator may use AgentSwarm to fan out, but no write, edit, or shell operations are permitted.",
+        "Consolidate the subagents' findings into a markdown report instead.",
+    ].join(" ");
+}