kimi-plugin-cc 2.4.5 → 2.5.2

package/docs/registry-releases.md

@@ -1,16 +1,18 @@
 # Registry releases
 
 The npm package `kimi-plugin-cc` ships the Claude plugin at its root and the
-self-contained Codex plugin under `plugins/kimi-codex`. GitHub marketplaces
-remain available. The package has no install scripts and no separate CLI.
+self-contained Codex and DSH plugins under `plugins/`. DSH users install that
+same root package with `dsh plugin --profile <name> add kimi-plugin-cc`.
+GitHub marketplaces remain available. The package has no install scripts and
+no separate CLI.
 
 ## Publishing status
 
-Plugin **2.4.5** adds exact CLI **2.4.1** certification for all eight operations,
-with the existing host-preactivated swarm lifecycle and durable recovery.
-See the [certification record](./upstream-2.4.1-certification.md).
-Release execution and registry verification are recorded in the release notes;
-publication uses the same validated-tarball OIDC workflow below.
+Plugin **2.5.2** hardens setup recovery and DSH dependency ownership. Its real Kimi Code **2.4.1** smoke passed **24 tests and 167 assertions with no skips**; the exact-source audit passed **16 tests and 97 assertions**. Normal npm installation keeps DSH host services optional. DSH use requires explicitly patched host/profile dependencies and both installation audits described below. Exact CLI certification remains unchanged.
+
+Plugin **2.5.1** adds DeepSeek Harness through the existing root npm package and its established OIDC workflow. [Release v2.5.1](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.1) is anchored at `afe68ee2f0e7744e1fc97eb0f1e4007585d969d0`; its [CI check](https://github.com/linxule/kimi-plugin-cc/actions/runs/41335810767) and [release-event publishing run](https://github.com/linxule/kimi-plugin-cc/actions/runs/41336273042) passed. The registry tarball has SHA-1 `f0e42febcb14082be6a654b9b0830885242fd92a`, contains 328 files, matches the CI artifact, and carries signed provenance (sigstore log index `3635166158`). A fresh registry installation into an isolated DSH profile composed all seven providers and booted the Web host. DSH users install with `dsh plugin --profile <name> add kimi-plugin-cc`; no second npm package or Trusted Publishing binding is required.
+
+Plugin **2.4.5** certifies exact CLI **2.4.1** for all eight operations with host-preactivated swarm sessions. [Release v2.4.5](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.5) is anchored at `de8c195c2986443a088b674717133b164d2e4ef2`; its [CI check](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226096281) and [release-event publishing run](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226438326) passed. The registry tarball has SHA-1 `39f97a6de4b26ad51ac77305054682fcd5cd0164`, contains 233 files, and matches the CI artifact byte-for-byte. Fresh registry installs passed setup/check and unsupported-version refusal for both Claude Code and Codex, and both compiled mirrors are byte-identical to the release checkout. See the [certification record](./upstream-2.4.1-certification.md) and structured verification at `.claude/kimi-code-research/release-2.4.5/registry-verification.json`.
 
 Plugin **2.4.2** adds durable interrupted-swarm recovery and Windows spawn diagnostics.
 Exact CLI certification remains unchanged through **2.3.2**; this is not a new
@@ -80,9 +82,11 @@ file at the tag, so fixes to `publish.yml` reach an existing tag only through
 ## Validation
 
 Use the repository's normal version bump and generated-surface procedure in
-AGENTS.md. Keep plugin and npm versions identical. Certification for new Kimi
-Code versions still requires the source audit and real-binary controls; adding
-a registry channel does not certify another CLI version.
+AGENTS.md. Keep plugin and npm versions identical, and update
+`DSH_PUBLISH_TIMESTAMP` with the actual publication time so the generated DSH
+Discover index stays current. Certification for new Kimi Code versions still
+requires the source audit and real-binary controls; adding a registry channel
+does not certify another CLI version.
 
 ```sh
 bun install --frozen-lockfile
@@ -90,15 +94,73 @@ bun run build
 bun run generate:surfaces
 # Review and stage generated distributions before the drift gate.
 bun run check
-bun run check:package .tmp/npm
+bun run check:consumer-security
+node scripts/check-package.mjs .tmp/npm
+node scripts/check-dsh-package.mjs .tmp/dsh-npm
 ```
 
-The package check inspects the actual tarball, rejects sync-conflict copies in
+The root package check inspects the actual tarball, rejects sync-conflict copies in
 any path component, verifies runtime copies and vendored licenses, and
-installs/checks the safety hook in isolated homes for both hosts. It also
+installs/checks the safety hook in isolated homes for all three hosts. It also
 exercises unsupported-version refusal using a fake CLI and modern MCP discovery
-plus legacy initialization on both extracted compiled distributions. It does
-not invoke a model or read the maintainer's Kimi configuration.
+plus legacy initialization on the extracted compiled distributions. The DSH
+check installs that same root tarball into an isolated DSH home, verifies all
+seven tools, and boots the Web host. Neither check invokes a model or reads the
+maintainer's Kimi configuration.
+
+The consumer-security gate installs the packed package into a fresh npm project
+and audits the resolved production dependency graph. DSH services and its tool
+adapter are optional peers supplied by the DSH host; ordinary npm installation
+for Claude Code or Codex does not install the harness. Optional peers still
+carry compatibility ranges when present. The gate runs in CI and release
+validation and refuses high/critical advisories, failed audits, and incomplete
+reports. The checkout's overrides do not constrain downstream npm resolution.
+
+### Patched DSH host and profiles
+
+DSH 0.2.1-rc.5 and 0.2.2-alpha.2 still pin vulnerable `zod` and `undici`
+versions. See the [upstream dependency report](https://github.com/deepseek-ai/deepseek-harness/discussions/10847).
+Use a patched DSH host installation with `zod >=4.6.6` and `undici >=8.12.2`.
+This is an explicit installation requirement; the plugin does not rewrite the
+host or profiles automatically. A profile override alone does not patch copies
+inside a separately installed DSH CLI.
+
+For example, create a dedicated npm host project (Node >=24.9), then use its
+DSH binary for plugin installation and launch:
+
+```sh
+mkdir -p ~/.local/share/kimi-dsh-host
+cd ~/.local/share/kimi-dsh-host
+npm init -y
+npm pkg set 'overrides.zod=^4.6.6' 'overrides.undici=^8.12.2'
+npm install @deepseek-ai/dsh@0.2.1-rc.5
+npm audit --omit=dev --audit-level=high
+./node_modules/.bin/dsh plugin --profile web add kimi-plugin-cc
+./node_modules/.bin/dsh plugin --profile web audit --prod --audit-level high
+./node_modules/.bin/dsh web --no-open
+```
+
+The host project is separate from `$DSH_HOME/profiles/web`. Keep using that
+project's DSH binary so the audited host is the one that runs. The commands
+above install the published plugin; use a validated local tarball when testing
+an unpublished change.
+
+If an existing profile separately installs DSH packages, its owner must also
+patch and audit that profile:
+
+```sh
+dsh plugin --profile web pkg set 'pnpm.overrides.zod=^4.6.6' 'pnpm.overrides.undici=^8.12.2'
+dsh plugin --profile web install
+dsh plugin --profile web audit --prod --audit-level high
+```
+
+Replace `web` with the intended profile, and run these commands with the patched
+host binary. Overrides affect dependency resolution and require application
+checks. The DSH package gate creates a fresh host with the declared overrides,
+audits both that host and the installed profile for high/critical advisories,
+then verifies all seven tool compositions and Web boot using that same host.
+These checks do not claim that every moderate/low advisory is fixed or that
+upstream has published a patched release.
 
 ## First publication (completed bootstrap reference)
 
@@ -135,8 +197,10 @@ operations; Bun remains the development toolchain.
 
 Push the reviewed release commit, wait for CI, tag it, and publish its GitHub
 release. `.github/workflows/publish.yml` runs on `release.published`; it checks
-the tag against `package.json`, runs the full gate and package smoke, then
-publishes the validated tarball through OIDC with provenance. The publish job
-has no source checkout or build scripts. A manual dispatch with an existing
-release tag is available for recovery after a verified publication failure.
-Check npm before retrying; released versions are immutable.
+the tag against `package.json`, runs the full gate and both package smokes, then
+publishes the root tarball through OIDC with provenance. The DSH smoke installs
+that same tarball directly into an isolated DSH profile, so no second npm
+package or Trusted Publishing binding is needed. The publish job has no source
+checkout or build scripts. A manual dispatch with an existing release tag is
+available for recovery after a verified publication failure. Check npm before
+retrying; released versions are immutable.

package/docs/safety.md

@@ -72,26 +72,29 @@ Key constraints (verified by [`runtime/hooks/managed-block.ts`](../runtime/hooks
 1. **No `matcher` line.** kimi-code compiles the matcher field via `new RegExp(matcher)`. An empty matcher means "fire for every tool." `new RegExp("*")` throws, which kimi-code catches and treats as "no matcher" → silently disables the hook. The installer omits the field intentionally; the verifier rejects any block that contains a `matcher = ...` line.
 2. **Absolute Node path.** kimi-code spawns hook commands via `/bin/sh -c "<command>"`. If we wrote bare `node`, the shell would resolve it against kimi-code's PATH at execution time. On a system where kimi-code launches from a GUI/LaunchAgent with a sanitized PATH (nvm/asdf/mise users), bare `node` would exit 127 → hook protocol treats non-{0,2} as **allow** → safety contract collapses with no user-visible signal.
 3. **TOML basic-string escaping.** The command field is a TOML basic string. Quotes, backslashes, newlines, and control characters in the resolved hook path are escaped during install; paths containing characters that cannot be safely escaped (literal `"`, raw control chars) are rejected up front with `SETUP_HOOK_PATH_UNSAFE`.
-4. **Exact marker grammar.** The verifier rejects stray comments containing the marker tag, partial references, duplicate blocks (from a setup race), and orphan markers (from a manual edit). The same parser is used by both the installer and the per-call verifier so the two cannot disagree.
+4. **Exact marker grammar.** The verifier rejects duplicate blocks and orphan or mismatched host markers. Install removes lexically proven unpaired marker comments across hosts, preserving surrounding content and all foreign hook tables, and warns. Text inside TOML strings is not a marker. The verifier remains fail-closed until repair and full validation succeed.
 5. **Exact command equality, per host.** The verifier reconstructs the canonical command byte string from the current env and equality-checks the installed `command` (never a substring — a crafted `true # /path/to/approval-hook.js` runs only `true` and would auto-allow). This holds *per host id* (below): each host verifies its own block.
 6. **Full-config parse and whole-hook-array validation.** The verifier parses the complete file with vendored `smol-toml@1.9.1` with upstream fixes included and no local JavaScript modifications (see `runtime/vendor/smol-toml/README.md`), before inspecting the managed block. It then applies upstream's strict config schema to every configured hook (`event`, optional string `matcher`, non-empty `command`, optional integer `timeout` 1–600, no extra fields). A malformed unrelated TOML value or one invalid foreign hook can make kimi-code discard enforcement; both therefore fail verification.
 7. **Serialized, identity-bound setup mutations.** Install and uninstall hold a private `0o600` sibling lock across the complete read-modify-write transaction. The candidate lock is published atomically; lock reads are no-follow, nonblocking, regular-file-only, and capped at 4 KiB. Acquisition is bounded, live owners are never stolen, stale recovery is guarded by a nonrecursive recovery lease, and inode/token ownership is rechecked before config mutation or lock removal. Simultaneous Claude Code/Codex setup runs therefore cannot lose either host's block, and a replaced lock is never treated as ours. A newly created Kimi home is `0o700`; atomic config writes remain `0o600`.
 8. **Inline hook arrays are normalized before insertion.** kimi-code accepts both `hooks = [...]` and `[[hooks]]`, but appending a managed array-of-tables block after an inline assignment can produce a conflicting document. Setup converts a valid inline hook array to canonical `[[hooks]]` tables before inserting the host block and emits an explicit warning that formatting and comments inside that assignment are normalized. Surrounding config bytes are preserved.
 
-### Host scoping (Claude Code ↔ Codex share one config)
+### Host scoping (all hosts share one config)
 
 Claude Code and Codex install this plugin to **different, version-stamped
-paths** (`~/.claude/plugins/cache/…` vs `~/.codex/plugins/cache/…`) but read
-the **same** `~/.kimi-code/config.toml`. So the managed block is **host-scoped**:
+paths** (`~/.claude/plugins/cache/…` vs `~/.codex/plugins/cache/…`), while DSH
+uses its own profile package path. All read the **same**
+`~/.kimi-code/config.toml`. So the managed block is **host-scoped**:
 its marker carries a `:<host-id>` suffix, and each host owns, verifies, and
 uninstalls only its **own** block.
 
 - **Host id** (`runtime/hooks/install-paths.ts::resolveHostId`) is derived
   version-independently from the hook path: `~/.claude/…` → `claude-code`,
-  `~/.codex/…` → `codex`, else a stable `host-<sha1>` for dev checkouts. A
-  plugin upgrade *refreshes* the same host's block rather than adding a new one.
-- **No clobbering.** `/kimi:setup` (Claude) and `$kimi-setup` (Codex) each write
-  their own block and leave the other's byte-identical. Before v1.7.0 there was
+  `~/.codex/…` → `codex`, else a stable `host-<sha1>` for dev checkouts. DSH
+  explicitly pins `dsh`. A plugin upgrade *refreshes* the same host's block
+  rather than adding a new one.
+- **No clobbering.** `/kimi:setup` (Claude), `$kimi-setup` (Codex), and
+  `/kimi-setup` (DSH) each write their own block and leave the others
+  byte-identical. Before v1.7.0 there was
   a single block exact-matched to the running host, so the two hosts overwrote
   each other and the loser's write-commands refused with "hook path drift."
 - **Enforcement is redundant-safe.** kimi-code fires *every* `[[hooks]]` entry
@@ -103,8 +106,8 @@ uninstalls only its **own** block.
 - **Migration + cleanup.** A pre-v1.7.0 un-suffixed block is adopted and
   converted in place by the current host on its next `/kimi:setup`. Orphaned,
   marker-less `[[hooks]]` entries that are unambiguously our approval hook
-  (canonical command, `approval-hook.js` under a kimi-marketplace/kimi-plugin-cc
-  tree) are pruned **host-scoped** (v1.8.2): install and scoped uninstall touch
+  (canonical command, `approval-hook.js` under a kimi-marketplace/kimi-plugin-cc/
+  dsh-kimi-plugin-cc tree) are pruned **host-scoped** (v1.8.2): install and scoped uninstall touch
   only tables whose command path derives to the *current* host. `/kimi:setup
   --uninstall` removes only the current host's block (plus legacy + this host's
   orphans); `/kimi:setup --uninstall --all` removes every host's block and every
@@ -123,6 +126,18 @@ uninstalls only its **own** block.
   hook and is left byte-untouched (pre-v1.8.2, the host-blind prune here caused
   each host's setup to disarm the other after any kimi login — the "seesaw").
 
+## DeepSeek Harness providers
+
+DSH's host and any profile-local harness packages must use patched `zod >=4.6.6` and `undici >=8.12.2`. The plugin treats DSH services as optional host-provided peers; it does not install the harness for other hosts or rewrite an existing DSH installation. Audit the actual host installation as well as the profile. See [patched DSH setup](./registry-releases.md#patched-dsh-host-and-profiles).
+
+The DSH bundle exposes the same seven operations as the other hosts: `kimi_ask`, `kimi_review`, `kimi_challenge`, `kimi_rescue`, `kimi_pursue`, `kimi_swarm`, and `kimi_swarm_write`. Each activation starts the existing companion through DSH's managed subprocess service and uses the same `kimi -p` transport, hook verification, exact-version certification, job store, and response or safety budgets. ACP is not used.
+
+Run `/kimi-setup` explicitly before delegating. Installing or enabling the bundle does not modify Kimi configuration. DSH uses host id `dsh` and `$DSH_HOME/plugin-data/kimi-plugin-cc` unless an absolute data-root override selects another store. Its provider-owned environment clears other-host roots/data, hook/script overrides, trusted roots, and verification bypasses instead of inheriting them.
+
+The parent receives only complete successful stdout. stderr remains on the host, and nonzero, empty, or truncated output becomes a bounded diagnostic rather than partial prose. Cancellation terminates the managed process range and waits for quiescence. DSH activation ids are distinct from companion job ids; use `/kimi-status`, `/kimi-result`, or `/kimi-cancel` for the persisted job.
+
+Write boundaries are identical to the companion commands: rescue and pursue edit the real selected workspace, ask/review/challenge and read-only swarm deny writes and shell commands, and swarm-write works from born HEAD in a temporary worktree and returns a patch without applying or committing it. `/kimi-setup --uninstall` removes only the DSH managed block; the all-host uninstall flag is not exposed.
+
 ## The hook's per-command policy
 
 [`runtime/hooks/approval-policy.ts`](../runtime/hooks/approval-policy.ts) is the single source of truth:

package/docs/upstream-2.4.1-certification.md

@@ -43,6 +43,12 @@ Controls used a task-authorized dedicated Agent Key in process memory/environmen
 - Codex's targeted re-review requested genuine error results, legacy-compatible turn starts, and a whole-workspace settlement assertion. A subsequent review added marker-prefix, call-derived turn-ID, and directory-entry requirements. The final production matrix (`production-prefix-smoke.log`) passed **24 tests and 167 assertions with no skips in 440.66 seconds**. All seven call-derived turn IDs had same-call Write denials with `isError: true` and the managed-message prefix, and the entire workspace was empty at settlement.
 - Literal standard `bun run check` (`check-standard-final.log`): **1,318 pass, 30 expected opt-in skips, 0 fail, 17,319 assertions across 79 files**, 358.83 seconds. Earlier parallel attempts hit timing-sensitive lifecycle failures; the focused suites and a complete serial run passed before the literal standard gate also passed. Codex's final targeted re-review returned **APPROVE**, closing all original and subsequent findings. Final edited-byte package validation (`package-standard-final.log`) passed **233 files** and includes this record.
 
+## Release and publication
+
+Plugin 2.4.5 was committed as `de8c195c2986443a088b674717133b164d2e4ef2` and pushed to `main`. [Release-commit CI 41226096281](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226096281) passed the full check/package and Windows spawn jobs. Annotated tag `v2.4.5` and [GitHub release](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.5) were created. [Publish workflow 41226438326](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226438326) passed its build and npm publish jobs.
+
+The registry tarball has SHA-1 `39f97a6de4b26ad51ac77305054682fcd5cd0164`, contains 233 files, and matches the CI artifact byte-for-byte. Fresh npm registry installations passed isolated setup/check and unsupported-version refusal for both hosts, and the compiled mirrors are byte-identical to the release checkout. Structured proof is retained at `.claude/kimi-code-research/release-2.4.5/registry-verification.json`. Installed hosts and operator CLI pins remain unchanged.
+
 ## Preserved boundaries
 
 Certification remains exact and per-operation. Legacy-v1 ends at 0.41.x. Plan mode and unsafe experimental selectors remain refused. Hook verification, trusted-root confinement, concurrency/defaults, one print runner, memory-only web tokens, finite budgets, process/session identity checks, deactivation, and recovery ownership are unchanged. Existing Git trust and hook-process failure residuals remain documented; this release does not make the hook an OS sandbox. Publication does not install or re-pin either host.

package/package.json

@@ -1,30 +1,94 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.4.5",
-  "description": "Kimi for Claude Code and Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
+  "version": "2.5.2",
+  "description": "Kimi for Claude Code, Codex, and DeepSeek Harness: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
   "type": "module",
+  "main": "dist/dsh/index.js",
   "engines": {
-    "node": ">=22.5.0"
+    "node": ">=22.5.0",
+    "dsh": ">=0.2.1-rc.5 <0.3.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./plugins/kimi-dsh/cordis.patch.yml"
+    }
   },
   "scripts": {
-    "check": "bun run build && bun run check:contracts && bun run check:surfaces && bunx tsc --noEmit && bun test && git diff --exit-code -- dist plugins/kimi-codex && UNTRACKED=\"$(git ls-files --others --exclude-standard -- dist plugins/kimi-codex)\" && { [ -z \"$UNTRACKED\" ] || { echo \"drift gate: untracked dist/codex files (stage them and re-run check):\"; echo \"$UNTRACKED\"; exit 1; }; }",
+    "check": "bun run build && bun run check:contracts && bun run check:surfaces && bunx tsc --noEmit && bun test && git diff --exit-code -- dist plugins/kimi-codex plugins/kimi-dsh && UNTRACKED=\"$(git ls-files --others --exclude-standard -- dist plugins/kimi-codex plugins/kimi-dsh)\" && { [ -z \"$UNTRACKED\" ] || { echo \"drift gate: untracked dist/codex/dsh files (stage them and re-run check):\"; echo \"$UNTRACKED\"; exit 1; }; }",
     "check:surfaces": "bun run scripts/generate-surfaces.ts --check",
     "generate:surfaces": "bun run scripts/generate-surfaces.ts",
     "build": "rm -rf dist && bunx tsc -p tsconfig.build.json && mkdir -p dist/vendor/shell-quote dist/vendor/smol-toml && cp runtime/vendor/shell-quote/LICENSE dist/vendor/shell-quote/LICENSE && cp runtime/vendor/smol-toml/*.js runtime/vendor/smol-toml/LICENSE dist/vendor/smol-toml/ && echo '{\"type\":\"module\"}' > dist/package.json",
     "companion": "node --import tsx runtime/companion.ts",
     "test": "bun test",
     "smoke:real": "KIMI_PLUGIN_CC_SMOKE=1 bun test tests/runtime/real-binary-smoke.test.ts --path-ignore-patterns '**/worktrees/**'",
-    "check:package": "node scripts/check-package.mjs",
+    "check:package": "node scripts/check-package.mjs && node scripts/check-dsh-package.mjs",
+    "check:consumer-security": "node scripts/check-consumer-security.mjs",
     "check:contracts": "node scripts/check-contract-size.mjs"
   },
   "devDependencies": {
-    "@types/bun": "^1.4.2",
-    "@types/node": "^26.5.1",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-commands": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-subagent": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tool-subagent": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-rc.5",
+    "@types/bun": "^1.4.4",
+    "@types/node": "^26.6.6",
     "smol-toml": "1.9.1",
     "tsx": "^4.23.13",
     "typescript": "^7.0.2"
   },
-  "dependencies": {},
+  "dependencies": {
+    "@deepseek-ai/dsh-brand": "0.2.1-rc.5",
+    "@deepseek-ai/schemastery": "3.18.5"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-commands": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-llm": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-session": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-subagent": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-subprocess": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-system-prompt": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-working-directory": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-tool-subagent": ">=0.2.1-rc.5 <0.3.0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-commands": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-llm": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-session": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-subagent": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-subprocess": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-system-prompt": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-working-directory": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-tool-subagent": {
+      "optional": true
+    }
+  },
+  "overrides": {
+    "zod": "^4.6.6",
+    "undici": "^8.12.2"
+  },
   "license": "Apache-2.0",
   "author": "Xule Lin",
   "repository": {
@@ -38,6 +102,8 @@
   "keywords": [
     "claude-code",
     "codex",
+    "deepseek-harness",
+    "dsh",
     "kimi",
     "kimi-code",
     "plugin",
@@ -58,6 +124,7 @@
     "hooks/",
     "dist/",
     "plugins/kimi-codex/",
+    "plugins/kimi-dsh/",
     "scripts/companion.sh",
     "scripts/review-gate-hook.sh",
     "docs/safety.md",

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.4.5",
+  "version": "2.5.2",
   "description": "Kimi for Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP job controls through the local Kimi Code CLI.",
   "author": {
     "name": "linxule"

package/plugins/kimi-codex/dist/commands/setup.js

@@ -9,7 +9,8 @@ import { SETUP_SUPPORTED_FLAGS } from "../parsing.js";
 // absolute Node path avoids PATH dependence under sanitized launches. Setup
 // probes the hook directly with resolveNodeBinary and through `/bin/sh -c`
 // using the exact installed command bytes. It also warns about broad permission
-// denies and refuses duplicate, orphaned, or malformed managed blocks.
+// denies, repairs orphan marker comments, and refuses remaining
+// duplicate, orphaned, or malformed managed blocks.
 //
 // Subcommands: install (default), --check, --uninstall [--all], and
 // --enable-review-gate/--disable-review-gate.
@@ -25,12 +26,13 @@ import { readPluginConfig, writePluginConfig } from "../config.js";
 import { RuntimeError } from "../errors.js";
 import { normalizeTopLevelInlineHooks, validateKimiHookSetForEnvironment, withKimiConfigLock, } from "../hooks/config-safety.js";
 import { buildHookShellCommand, hostIdFromHookCommand, resolveHookScriptPath, resolveHostId, resolveNodeBinary, } from "../hooks/install-paths.js";
-import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, MARKERS, parseManagedBlock, } from "../hooks/managed-block.js";
+import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, markerCommentLines, MARKERS, parseManagedBlock, } from "../hooks/managed-block.js";
 import { formatVersionOutOfRangeWarning, probeKimiVersion, } from "../kimi-version-probe.js";
 import { isNativeV2CertifiedVersion } from "../kimi-engine.js";
 import { resolveKimiHome } from "../kimi-home.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { KIMI_PLUGIN_CC_VERSION } from "../version.js";
+import { parse as parseToml } from "../vendor/smol-toml/parse.js";
 const BEGIN_MARKER_PREFIX = "# === BEGIN kimi-plugin-cc-managed";
 const DEFAULT_HOOK_TIMEOUT_S = 15;
 // Probe timing. The direct script probe is local and fast; allow 5s for
@@ -119,7 +121,17 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
     const mutation = await withKimiConfigLock(configPath, async () => {
         const original = await readConfigSafe(configPath);
         const lineEnding = detectLineEnding(original);
-        const inlineHooks = normalizeTopLevelInlineHooks(original, lineEnding);
+        try {
+            parseToml(original);
+        }
+        catch {
+            await assertKimiHookSetValid(original, configPath, "setup.install", context.env);
+        }
+        const repaired = removeOrphanMarkers(original);
+        if (repaired.count > 0) {
+            warnings.push(`Removed ${repaired.count} orphaned managed marker comment(s); surrounding config was preserved.`);
+        }
+        const inlineHooks = normalizeTopLevelInlineHooks(repaired.contents, lineEnding);
         if (inlineHooks.found) {
             // Validate before normalizing so an invalid inline entry is reported
             // against the user's original bytes and the config remains untouched.
@@ -133,7 +145,7 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
         // splice line numbers. Another host's marker-less table may be its live hook
         // after a config rewrite strips comments, so it must remain untouched.
         const expectedCommand = buildHookShellCommand(hookScriptPath, context.env);
-        const { pruned, count: prunedCount, commands: prunedCommands } = pruneOrphanApprovalHooks(inlineHooks.contents, lineEnding, hostId, expectedCommand);
+        const { pruned, count: prunedCount, commands: prunedCommands } = pruneOrphanApprovalHooks(inlineHooks.contents, hostId, expectedCommand);
         const existing = pruned;
         if (prunedCount > 0) {
             const readorned = prunedCommands.includes(expectedCommand);
@@ -145,7 +157,7 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
         if (state.kind === "orphan") {
             throw new RuntimeError("SETUP_ORPHAN_MARKERS", [
                 `kimi-code config at ${configPath} contains an orphaned ${state.detail} marker.`,
-                "Run `/kimi:setup --uninstall` to clean up, then re-run `/kimi:setup`.",
+                "Inspect the managed marker comments and re-run setup.",
             ].join(" "), "setup.install", { details: { configPath, orphan: state.detail } });
         }
         if (state.kind === "duplicate") {
@@ -393,12 +405,11 @@ async function runUninstallLocked(configPath, hookScriptPath, hostId, removeAllH
     // other hosts' blocks and live marker-less tables remain intact. `--all` is
     // the explicit every-host sweep for all of this plugin's hook tables.
     const { stripped: strippedMarkers, removedBlocks, orphansLeft } = stripManagedBlocks(existing, hostId, removeAllHosts);
-    const lineEnding = detectLineEnding(existing);
     // Exact current command bytes also identify this host's table when a host-id
     // override disagrees with path derivation or a dev path is outside the strict
     // ownership pattern.
     const expectedCommand = buildHookShellCommand(hookScriptPath, context.env);
-    const { pruned: stripped, count: prunedCount } = pruneOrphanApprovalHooks(strippedMarkers, lineEnding, removeAllHosts ? undefined : hostId, expectedCommand);
+    const { pruned: stripped, count: prunedCount } = pruneOrphanApprovalHooks(strippedMarkers, removeAllHosts ? undefined : hostId, expectedCommand);
     const changed = stripped !== existing;
     if (changed) {
         await writeConfigAtomic(configPath, stripped);
@@ -517,10 +528,10 @@ function detectLineEnding(contents) {
     return contents.includes("\r\n") ? "\r\n" : "\n";
 }
 function spliceBlock(contents, beginLine, endLine, replacement, lineEnding) {
-    const lines = splitPreservingEnding(contents);
-    const before = lines.slice(0, beginLine).join(lineEnding);
-    const after = lines.slice(endLine + 1).join(lineEnding);
-    const beforeWithSep = before.endsWith(lineEnding) || before.length === 0 ? before : `${before}${lineEnding}`;
+    const lines = contents.split(/(?<=\n)/);
+    const before = lines.slice(0, beginLine).join("");
+    const after = lines.slice(endLine + 1).join("");
+    const beforeWithSep = before.endsWith("\n") || before.length === 0 ? before : `${before}${lineEnding}`;
     const replacementWithEnding = replacement.endsWith(lineEnding) ? replacement : `${replacement}${lineEnding}`;
     return `${beforeWithSep}${replacementWithEnding}${after}`;
 }
@@ -536,14 +547,54 @@ function splitPreservingEnding(contents) {
     // pass the desired line ending).
     return contents.split("\n").map((line) => line.replace(/\r$/, ""));
 }
+// A partial upstream hooks-array rewrite can leave one marker comment behind.
+// Remove only unpaired marker comments, never the intervening content. The
+// normal full-file validation still gates writes.
+function removeOrphanMarkers(contents) {
+    const lines = splitPreservingEnding(contents);
+    const orphans = [];
+    const comments = markerCommentLines(contents);
+    let open = null;
+    for (let i = 0; i < lines.length; i += 1) {
+        if (!comments.has(i))
+            continue;
+        const line = lines[i].trim();
+        const begin = MARKERS.BEGIN_LINE_RE.exec(line);
+        if (begin !== null) {
+            if (open !== null)
+                orphans.push(open);
+            open = { index: i, host: begin[1]?.toLowerCase() ?? null };
+        }
+        else {
+            const end = MARKERS.END_LINE_RE.exec(line);
+            if (end === null)
+                continue;
+            const endMarker = { index: i, host: end[1]?.toLowerCase() ?? null };
+            if (open === null)
+                orphans.push(endMarker);
+            else {
+                if (open.host !== endMarker.host)
+                    orphans.push(open, endMarker);
+                open = null;
+            }
+        }
+    }
+    if (open !== null)
+        orphans.push(open);
+    const remove = new Set(orphans.map((marker) => marker.index));
+    return remove.size === 0
+        ? { contents, count: 0 }
+        : { contents: contents.split(/(?<=\n)/).filter((_, index) => !remove.has(index)).join(""), count: remove.size };
+}
 /**
  * Remove managed blocks owned by `currentHost`, or every host with `removeAll`.
  * Ownership comes from the marker suffix or a legacy command's derived host.
  * Orphan markers are removed individually so surrounding user content survives.
  */
 function stripManagedBlocks(contents, currentHost, removeAll) {
-    const lineEnding = detectLineEnding(contents);
     const lines = splitPreservingEnding(contents);
+    const rawLines = contents.split(/(?<=\n)/);
+    const markerLines = markerCommentLines(contents);
     const result = [];
     const orphansLeft = [];
     let removedBlocks = 0;
@@ -567,7 +618,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
     while (i < lines.length) {
         const line = lines[i];
         const trimmed = line.trim();
-        const begin = MARKERS.BEGIN_LINE_RE.exec(trimmed);
+        const begin = markerLines.has(i) ? MARKERS.BEGIN_LINE_RE.exec(trimmed) : null;
         if (begin !== null) {
             const beginHost = begin[1]?.toLowerCase() ?? null;
             // Look ahead for the matching END, capturing the block's command en route.
@@ -575,12 +626,14 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
             let blockCommand = null;
             for (let j = i + 1; j < lines.length; j += 1) {
                 const nextTrimmed = lines[j].trim();
-                if (MARKERS.BEGIN_LINE_RE.test(nextTrimmed)) {
+                if (markerLines.has(j) && MARKERS.BEGIN_LINE_RE.test(nextTrimmed)) {
                     // Two BEGINs in a row — the outer one is an orphan.
                     break;
                 }
-                if (MARKERS.END_LINE_RE.test(nextTrimmed)) {
-                    endIdx = j;
+                const end = markerLines.has(j) ? MARKERS.END_LINE_RE.exec(nextTrimmed) : null;
+                if (end !== null) {
+                    if ((end[1]?.toLowerCase() ?? null) === beginHost)
+                        endIdx = j;
                     break;
                 }
                 const decoded = decodeManagedCommandLine(nextTrimmed);
@@ -594,7 +647,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
                     i += 1;
                     continue;
                 }
-                result.push(line);
+                result.push(rawLines[i]);
                 i += 1;
                 continue;
             }
@@ -606,11 +659,11 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
             }
             // Another host's block — keep it verbatim.
             for (let k = i; k <= endIdx; k += 1)
-                result.push(lines[k]);
+                result.push(rawLines[k]);
             i = endIdx + 1;
             continue;
         }
-        const end = MARKERS.END_LINE_RE.exec(trimmed);
+        const end = markerLines.has(i) ? MARKERS.END_LINE_RE.exec(trimmed) : null;
         if (end !== null) {
             const endHost = end[1]?.toLowerCase() ?? null;
             // Orphan END with no preceding BEGIN: drop only this line (if ours).
@@ -619,27 +672,14 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
                 i += 1;
                 continue;
             }
-            result.push(line);
+            result.push(rawLines[i]);
             i += 1;
             continue;
         }
-        result.push(line);
+        result.push(rawLines[i]);
         i += 1;
     }
-    const collapsed = [];
-    let blankRun = 0;
-    for (const line of result) {
-        if (line.length === 0) {
-            blankRun += 1;
-            if (blankRun <= 2)
-                collapsed.push(line);
-        }
-        else {
-            blankRun = 0;
-            collapsed.push(line);
-        }
-    }
-    return { stripped: collapsed.join(lineEnding), removedBlocks, orphansLeft };
+    return { stripped: result.join(""), removedBlocks, orphansLeft };
 }
 /**
  * Remove orphaned, marker-less `[[hooks]]` tables that are unambiguously this
@@ -654,7 +694,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
  * host — REQUIRED for scoped install/uninstall so one host never disarms the
  * other's live (marker-stripped) hook. Omit only for `--uninstall --all`.
  */
-function pruneOrphanApprovalHooks(contents, lineEnding, ownedBy, alsoMatchCommand) {
+function pruneOrphanApprovalHooks(contents, ownedBy, alsoMatchCommand) {
     const ranges = findUnmanagedApprovalHookBlocks(contents, ownedBy, alsoMatchCommand);
     if (ranges.length === 0)
         return { pruned: contents, count: 0, commands: [] };
@@ -663,23 +703,10 @@ function pruneOrphanApprovalHooks(contents, lineEnding, ownedBy, alsoMatchComman
         for (let i = start; i < end; i += 1)
             remove.add(i);
     }
-    const lines = splitPreservingEnding(contents);
+    const lines = contents.split(/(?<=\n)/);
     const kept = lines.filter((_, idx) => !remove.has(idx));
-    const collapsed = [];
-    let blankRun = 0;
-    for (const line of kept) {
-        if (line.length === 0) {
-            blankRun += 1;
-            if (blankRun <= 2)
-                collapsed.push(line);
-        }
-        else {
-            blankRun = 0;
-            collapsed.push(line);
-        }
-    }
     return {
-        pruned: collapsed.join(lineEnding),
+        pruned: kept.join(""),
         count: ranges.length,
         commands: ranges.map((range) => range.command),
     };