kimi-plugin-cc 2.5.1 → 2.5.2

package/dist/hooks/managed-block.js

@@ -45,10 +45,80 @@ const MATCHER_LINE_RE = /^matcher\s*=/;
 /** `timeout = <int>` — the only other key our managed [[hooks]] table emits. */
 const TIMEOUT_LINE_RE = /^timeout\s*=\s*\d+\s*$/;
 const HOOKS_TABLE_RE = /^\[\[hooks\]\]\s*$/;
+// Recognize comment lines lexically, not text inside TOML string values.
+// Whole-document parsing remains the authority for TOML validity.
+function scanTomlLines(contents) {
+    const markers = new Set();
+    const tables = new Set();
+    let state = "plain";
+    let line = 0;
+    let blankPrefix = true;
+    for (let i = 0; i < contents.length; i += 1) {
+        const c = contents[i];
+        if (c === "\n") {
+            line += 1;
+            blankPrefix = true;
+            continue;
+        }
+        const onlyWhitespaceBefore = blankPrefix;
+        if (c !== " " && c !== "\t" && c !== "\r")
+            blankPrefix = false;
+        if (state === "plain") {
+            if (c === "[" && onlyWhitespaceBefore)
+                tables.add(line);
+            if (c === "#") {
+                if (onlyWhitespaceBefore) {
+                    const end = contents.indexOf("\n", i);
+                    const comment = contents.slice(i, end < 0 ? contents.length : end).trim();
+                    if (BEGIN_LINE_RE.test(comment) || END_LINE_RE.test(comment))
+                        markers.add(line);
+                }
+                const end = contents.indexOf("\n", i);
+                if (end < 0)
+                    break;
+                i = end - 1;
+            }
+            else if (c === '"' || c === "'") {
+                const triple = contents.slice(i, i + 3) === c.repeat(3);
+                state = c === '"' ? (triple ? "multibasic" : "basic") : (triple ? "multiliteral" : "literal");
+                if (triple)
+                    i += 2;
+            }
+        }
+        else {
+            const basic = state === "basic" || state === "multibasic";
+            const quote = basic ? '"' : "'";
+            if (basic && c === "\\") {
+                if (contents[i + 1] === "\n") {
+                    line += 1;
+                    blankPrefix = true;
+                }
+                i += 1;
+                continue;
+            }
+            if (c !== quote)
+                continue;
+            if (state === "basic" || state === "literal")
+                state = "plain";
+            else if (contents.slice(i, i + 3) === quote.repeat(3)) {
+                while (contents[i + 1] === quote)
+                    i += 1;
+                state = "plain";
+            }
+        }
+    }
+    return { markers, tables };
+}
+export function markerCommentLines(contents) {
+    return scanTomlLines(contents).markers;
+}
 /** Locate every BEGIN/END marker line, in order, with its parsed host id. */
 function findMarkers(lines) {
     const hits = [];
+    const comments = markerCommentLines(lines.join("\n"));
     for (let i = 0; i < lines.length; i += 1) {
+        if (!comments.has(i))
+            continue;
         const trimmed = lines[i].trim();
         const begin = BEGIN_LINE_RE.exec(trimmed);
         if (begin !== null) {
@@ -66,7 +136,7 @@ function findMarkers(lines) {
 }
 /**
  * Pair BEGIN/END markers into well-formed blocks. Return the first orphan
- * (BEGIN-without-END or END-without-BEGIN); either is a hard error for install.
+ * (BEGIN-without-END or END-without-BEGIN); verification fails closed on either.
  */
 function pairBlocks(lines) {
     const markers = findMarkers(lines);
@@ -83,6 +153,8 @@ function pairBlocks(lines) {
         // end
         if (open === null)
             return { orphan: "END-without-BEGIN" };
+        if (open.hostId !== marker.hostId)
+            return { orphan: "BEGIN-without-END" };
         const body = validateBlockBody(lines.slice(open.index + 1, marker.index));
         blocks.push({
             hostId: open.hostId,
@@ -436,13 +508,13 @@ export function evaluateInstalled(contents, expectedCommand, opts) {
  * The deletion range `[start, end)` is conservative: only the contiguous
  * non-blank body after `[[hooks]]`, stopping at a blank line, table header, or
  * managed marker so adjacent user content is preserved. A separate full-span
- * scan rejects matcher lines recognized by MATCHER_LINE_RE to avoid half-cutting
- * a table. That scan is deliberately heuristic and does not claim to recognize
- * every quoted or dotted TOML matcher spelling. `command` is decoded for the
- * caller's ownership checks.
+ * scan refuses any further TOML field before the next table, including quoted
+ * and dotted keys, so pruning cannot attach those fields to another table.
+ * `command` is decoded for the caller's ownership checks.
  */
 export function findBareApprovalHookTables(contents) {
     const lines = contents.split("\n").map((line) => line.replace(/\r$/, ""));
+    const tableLines = scanTomlLines(contents).tables;
     const managed = new Set();
     const paired = pairBlocks(lines);
     if ("blocks" in paired) {
@@ -455,7 +527,7 @@ export function findBareApprovalHookTables(contents) {
     for (let i = 0; i < lines.length; i += 1) {
         if (managed.has(i))
             continue;
-        if (!HOOKS_TABLE_RE.test(lines[i].trim()))
+        if (!tableLines.has(i) || !HOOKS_TABLE_RE.test(lines[i].trim()))
             continue;
         // Collect the contiguous table body.
         let j = i + 1;
@@ -500,22 +572,16 @@ export function findBareApprovalHookTables(contents) {
             }
             j += 1;
         }
-        // A blank line does NOT end a TOML table; membership continues to the next
-        // header or EOF. The deletion range nevertheless stops at the blank to
-        // preserve adjacent user content. Scan the remaining span for matcher lines
-        // this scanner recognizes and reject the table rather than half-cutting it:
-        // matcher is schema-valid but can disable the hook at runtime. Foreign keys
-        // and other TOML spellings are handled by whole-file schema validation and
-        // the parser-based installed checks, not by this prune heuristic.
-        let matcherBeyondBody = false;
+        // Blank lines and marker comments do not end a TOML table. Never leave any
+        // field behind to be rebound to a preceding table after pruning, regardless
+        // of the field's spelling or whether it is valid for a hook.
+        let fieldBeyondBody = false;
         for (let k = j; k < lines.length; k += 1) {
             const t = lines[k].trim();
-            // The current table's TOML span ends at the next table header or a
-            // managed marker; a matcher past that point belongs to a different table.
-            if (t.startsWith("[") || BEGIN_LINE_RE.test(t) || END_LINE_RE.test(t))
+            if (tableLines.has(k))
                 break;
-            if (MATCHER_LINE_RE.test(t)) {
-                matcherBeyondBody = true;
+            if (t.length > 0 && !t.startsWith("#")) {
+                fieldBeyondBody = true;
                 break;
             }
         }
@@ -527,7 +593,7 @@ export function findBareApprovalHookTables(contents) {
             commandDecoded.length > 0 &&
             hasPreToolUseEvent &&
             !hasMatcher &&
-            !matcherBeyondBody) {
+            !fieldBeyondBody) {
             ranges.push({ start: i, end: j, command: commandDecoded });
         }
     }

package/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.5.1";
+export const KIMI_PLUGIN_CC_VERSION = "2.5.2";

package/docs/migration.md

@@ -1,6 +1,8 @@
 # Compatibility and upgrades
 
-Plugin 2.4.5 certifies Kimi Code CLI 2.4.1 for all eight operations, alongside exact native-v2 versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, `2.3.3`, and `2.4.0`. Later patches and minor releases are not accepted automatically. The npm distribution adds an installation channel; it does not change this compatibility table.
+Plugin 2.5.1 certifies Kimi Code CLI 2.4.1 for all eight operations, alongside exact native-v2 versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, `2.3.3`, and `2.4.0`. Later patches and minor releases are not accepted automatically. The npm distribution adds an installation channel; it does not change this compatibility table.
+
+Plugin 2.5.1 also adds DeepSeek Harness as a third host with all seven operations and a DSH-specific bundle, data root, and managed hook id. Existing Claude Code and Codex certification, job stores, and host-scoped hooks are unchanged; no migration is required for those hosts. New DSH installations follow the [README DSH section](../README.md#install-in-deepseek-harness), including `/kimi-setup` on that host.
 
 Explicitly pinned legacy-v1 binaries remain supported within `KIMI_TESTED_MINORS`, through 0.41.x, subject to each operation's minimum version. The [runtime table](../runtime/kimi-engine.ts) is the authority.
 
@@ -8,7 +10,7 @@ Use the [README installation and update steps](../README.md) for Claude Code or
 
 ## Plugin versions and upgrades
 
-Plugin versions advance independently using ordinary SemVer and may deliberately align with a certified CLI release. Plugin 2.4.5 certifies exact CLI 2.4.1; the nearby numbers do not imply version alignment. Published versions and tags are never reused. Every upstream patch requires its own certification. The native-v2 no-plan profile, plugin/marketplace IDs and existing job store are preserved.
+Plugin versions advance independently using ordinary SemVer and may deliberately align with a certified CLI release. Plugin 2.5.1 certifies exact CLI 2.4.1; the nearby numbers do not imply version alignment. Published versions and tags are never reused. Every upstream patch requires its own certification. The native-v2 no-plan profile, plugin/marketplace IDs and existing job store are preserved.
 
 ## CLI 2.3.2, 2.3.3, 2.4.0 and 2.4.1 swarm activation
 

package/docs/registry-releases.md

@@ -8,6 +8,10 @@ no separate CLI.
 
 ## Publishing status
 
+Plugin **2.5.2** hardens setup recovery and DSH dependency ownership. Its real Kimi Code **2.4.1** smoke passed **24 tests and 167 assertions with no skips**; the exact-source audit passed **16 tests and 97 assertions**. Normal npm installation keeps DSH host services optional. DSH use requires explicitly patched host/profile dependencies and both installation audits described below. Exact CLI certification remains unchanged.
+
+Plugin **2.5.1** adds DeepSeek Harness through the existing root npm package and its established OIDC workflow. [Release v2.5.1](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.1) is anchored at `afe68ee2f0e7744e1fc97eb0f1e4007585d969d0`; its [CI check](https://github.com/linxule/kimi-plugin-cc/actions/runs/41335810767) and [release-event publishing run](https://github.com/linxule/kimi-plugin-cc/actions/runs/41336273042) passed. The registry tarball has SHA-1 `f0e42febcb14082be6a654b9b0830885242fd92a`, contains 328 files, matches the CI artifact, and carries signed provenance (sigstore log index `3635166158`). A fresh registry installation into an isolated DSH profile composed all seven providers and booted the Web host. DSH users install with `dsh plugin --profile <name> add kimi-plugin-cc`; no second npm package or Trusted Publishing binding is required.
+
 Plugin **2.4.5** certifies exact CLI **2.4.1** for all eight operations with host-preactivated swarm sessions. [Release v2.4.5](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.5) is anchored at `de8c195c2986443a088b674717133b164d2e4ef2`; its [CI check](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226096281) and [release-event publishing run](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226438326) passed. The registry tarball has SHA-1 `39f97a6de4b26ad51ac77305054682fcd5cd0164`, contains 233 files, and matches the CI artifact byte-for-byte. Fresh registry installs passed setup/check and unsupported-version refusal for both Claude Code and Codex, and both compiled mirrors are byte-identical to the release checkout. See the [certification record](./upstream-2.4.1-certification.md) and structured verification at `.claude/kimi-code-research/release-2.4.5/registry-verification.json`.
 
 Plugin **2.4.2** adds durable interrupted-swarm recovery and Windows spawn diagnostics.
@@ -78,9 +82,11 @@ file at the tag, so fixes to `publish.yml` reach an existing tag only through
 ## Validation
 
 Use the repository's normal version bump and generated-surface procedure in
-AGENTS.md. Keep plugin and npm versions identical. Certification for new Kimi
-Code versions still requires the source audit and real-binary controls; adding
-a registry channel does not certify another CLI version.
+AGENTS.md. Keep plugin and npm versions identical, and update
+`DSH_PUBLISH_TIMESTAMP` with the actual publication time so the generated DSH
+Discover index stays current. Certification for new Kimi Code versions still
+requires the source audit and real-binary controls; adding a registry channel
+does not certify another CLI version.
 
 ```sh
 bun install --frozen-lockfile
@@ -88,6 +94,7 @@ bun run build
 bun run generate:surfaces
 # Review and stage generated distributions before the drift gate.
 bun run check
+bun run check:consumer-security
 node scripts/check-package.mjs .tmp/npm
 node scripts/check-dsh-package.mjs .tmp/dsh-npm
 ```
@@ -101,6 +108,60 @@ check installs that same root tarball into an isolated DSH home, verifies all
 seven tools, and boots the Web host. Neither check invokes a model or reads the
 maintainer's Kimi configuration.
 
+The consumer-security gate installs the packed package into a fresh npm project
+and audits the resolved production dependency graph. DSH services and its tool
+adapter are optional peers supplied by the DSH host; ordinary npm installation
+for Claude Code or Codex does not install the harness. Optional peers still
+carry compatibility ranges when present. The gate runs in CI and release
+validation and refuses high/critical advisories, failed audits, and incomplete
+reports. The checkout's overrides do not constrain downstream npm resolution.
+
+### Patched DSH host and profiles
+
+DSH 0.2.1-rc.5 and 0.2.2-alpha.2 still pin vulnerable `zod` and `undici`
+versions. See the [upstream dependency report](https://github.com/deepseek-ai/deepseek-harness/discussions/10847).
+Use a patched DSH host installation with `zod >=4.6.6` and `undici >=8.12.2`.
+This is an explicit installation requirement; the plugin does not rewrite the
+host or profiles automatically. A profile override alone does not patch copies
+inside a separately installed DSH CLI.
+
+For example, create a dedicated npm host project (Node >=24.9), then use its
+DSH binary for plugin installation and launch:
+
+```sh
+mkdir -p ~/.local/share/kimi-dsh-host
+cd ~/.local/share/kimi-dsh-host
+npm init -y
+npm pkg set 'overrides.zod=^4.6.6' 'overrides.undici=^8.12.2'
+npm install @deepseek-ai/dsh@0.2.1-rc.5
+npm audit --omit=dev --audit-level=high
+./node_modules/.bin/dsh plugin --profile web add kimi-plugin-cc
+./node_modules/.bin/dsh plugin --profile web audit --prod --audit-level high
+./node_modules/.bin/dsh web --no-open
+```
+
+The host project is separate from `$DSH_HOME/profiles/web`. Keep using that
+project's DSH binary so the audited host is the one that runs. The commands
+above install the published plugin; use a validated local tarball when testing
+an unpublished change.
+
+If an existing profile separately installs DSH packages, its owner must also
+patch and audit that profile:
+
+```sh
+dsh plugin --profile web pkg set 'pnpm.overrides.zod=^4.6.6' 'pnpm.overrides.undici=^8.12.2'
+dsh plugin --profile web install
+dsh plugin --profile web audit --prod --audit-level high
+```
+
+Replace `web` with the intended profile, and run these commands with the patched
+host binary. Overrides affect dependency resolution and require application
+checks. The DSH package gate creates a fresh host with the declared overrides,
+audits both that host and the installed profile for high/critical advisories,
+then verifies all seven tool compositions and Web boot using that same host.
+These checks do not claim that every moderate/low advisory is fixed or that
+upstream has published a patched release.
+
 ## First publication (completed bootstrap reference)
 
 The package must first exist on npm before its package settings can be configured.

package/docs/safety.md

@@ -72,7 +72,7 @@ Key constraints (verified by [`runtime/hooks/managed-block.ts`](../runtime/hooks
 1. **No `matcher` line.** kimi-code compiles the matcher field via `new RegExp(matcher)`. An empty matcher means "fire for every tool." `new RegExp("*")` throws, which kimi-code catches and treats as "no matcher" → silently disables the hook. The installer omits the field intentionally; the verifier rejects any block that contains a `matcher = ...` line.
 2. **Absolute Node path.** kimi-code spawns hook commands via `/bin/sh -c "<command>"`. If we wrote bare `node`, the shell would resolve it against kimi-code's PATH at execution time. On a system where kimi-code launches from a GUI/LaunchAgent with a sanitized PATH (nvm/asdf/mise users), bare `node` would exit 127 → hook protocol treats non-{0,2} as **allow** → safety contract collapses with no user-visible signal.
 3. **TOML basic-string escaping.** The command field is a TOML basic string. Quotes, backslashes, newlines, and control characters in the resolved hook path are escaped during install; paths containing characters that cannot be safely escaped (literal `"`, raw control chars) are rejected up front with `SETUP_HOOK_PATH_UNSAFE`.
-4. **Exact marker grammar.** The verifier rejects stray comments containing the marker tag, partial references, duplicate blocks (from a setup race), and orphan markers (from a manual edit). The same parser is used by both the installer and the per-call verifier so the two cannot disagree.
+4. **Exact marker grammar.** The verifier rejects duplicate blocks and orphan or mismatched host markers. Install removes lexically proven unpaired marker comments across hosts, preserving surrounding content and all foreign hook tables, and warns. Text inside TOML strings is not a marker. The verifier remains fail-closed until repair and full validation succeed.
 5. **Exact command equality, per host.** The verifier reconstructs the canonical command byte string from the current env and equality-checks the installed `command` (never a substring — a crafted `true # /path/to/approval-hook.js` runs only `true` and would auto-allow). This holds *per host id* (below): each host verifies its own block.
 6. **Full-config parse and whole-hook-array validation.** The verifier parses the complete file with vendored `smol-toml@1.9.1` with upstream fixes included and no local JavaScript modifications (see `runtime/vendor/smol-toml/README.md`), before inspecting the managed block. It then applies upstream's strict config schema to every configured hook (`event`, optional string `matcher`, non-empty `command`, optional integer `timeout` 1–600, no extra fields). A malformed unrelated TOML value or one invalid foreign hook can make kimi-code discard enforcement; both therefore fail verification.
 7. **Serialized, identity-bound setup mutations.** Install and uninstall hold a private `0o600` sibling lock across the complete read-modify-write transaction. The candidate lock is published atomically; lock reads are no-follow, nonblocking, regular-file-only, and capped at 4 KiB. Acquisition is bounded, live owners are never stolen, stale recovery is guarded by a nonrecursive recovery lease, and inode/token ownership is rechecked before config mutation or lock removal. Simultaneous Claude Code/Codex setup runs therefore cannot lose either host's block, and a replaced lock is never treated as ours. A newly created Kimi home is `0o700`; atomic config writes remain `0o600`.
@@ -128,6 +128,8 @@ uninstalls only its **own** block.
 
 ## DeepSeek Harness providers
 
+DSH's host and any profile-local harness packages must use patched `zod >=4.6.6` and `undici >=8.12.2`. The plugin treats DSH services as optional host-provided peers; it does not install the harness for other hosts or rewrite an existing DSH installation. Audit the actual host installation as well as the profile. See [patched DSH setup](./registry-releases.md#patched-dsh-host-and-profiles).
+
 The DSH bundle exposes the same seven operations as the other hosts: `kimi_ask`, `kimi_review`, `kimi_challenge`, `kimi_rescue`, `kimi_pursue`, `kimi_swarm`, and `kimi_swarm_write`. Each activation starts the existing companion through DSH's managed subprocess service and uses the same `kimi -p` transport, hook verification, exact-version certification, job store, and response or safety budgets. ACP is not used.
 
 Run `/kimi-setup` explicitly before delegating. Installing or enabling the bundle does not modify Kimi configuration. DSH uses host id `dsh` and `$DSH_HOME/plugin-data/kimi-plugin-cc` unless an absolute data-root override selects another store. Its provider-owned environment clears other-host roots/data, hook/script overrides, trusted roots, and verification bypasses instead of inheriting them.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "description": "Kimi for Claude Code, Codex, and DeepSeek Harness: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
   "type": "module",
   "main": "dist/dsh/index.js",
@@ -22,6 +22,7 @@
     "test": "bun test",
     "smoke:real": "KIMI_PLUGIN_CC_SMOKE=1 bun test tests/runtime/real-binary-smoke.test.ts --path-ignore-patterns '**/worktrees/**'",
     "check:package": "node scripts/check-package.mjs && node scripts/check-dsh-package.mjs",
+    "check:consumer-security": "node scripts/check-consumer-security.mjs",
     "check:contracts": "node scripts/check-contract-size.mjs"
   },
   "devDependencies": {
@@ -31,16 +32,17 @@
     "@deepseek-ai/dsh-session": "0.2.1-rc.5",
     "@deepseek-ai/dsh-subagent": "0.2.1-rc.5",
     "@deepseek-ai/dsh-subprocess": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tool-subagent": "0.2.1-rc.5",
     "@deepseek-ai/dsh-working-directory": "0.2.1-rc.5",
-    "@types/bun": "^1.4.2",
-    "@types/node": "^26.5.1",
+    "@types/bun": "^1.4.4",
+    "@types/node": "^26.6.6",
     "smol-toml": "1.9.1",
     "tsx": "^4.23.13",
     "typescript": "^7.0.2"
   },
   "dependencies": {
     "@deepseek-ai/dsh-brand": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-tool-subagent": "0.2.1-rc.5",
     "@deepseek-ai/schemastery": "3.18.5"
   },
   "peerDependencies": {
@@ -50,7 +52,38 @@
     "@deepseek-ai/dsh-session": ">=0.2.1-rc.5 <0.3.0",
     "@deepseek-ai/dsh-subagent": ">=0.2.1-rc.5 <0.3.0",
     "@deepseek-ai/dsh-subprocess": ">=0.2.1-rc.5 <0.3.0",
-    "@deepseek-ai/dsh-working-directory": ">=0.2.1-rc.5 <0.3.0"
+    "@deepseek-ai/dsh-system-prompt": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-working-directory": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-tool-subagent": ">=0.2.1-rc.5 <0.3.0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-commands": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-llm": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-session": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-subagent": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-subprocess": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-system-prompt": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-working-directory": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-tool-subagent": {
+      "optional": true
+    }
   },
   "overrides": {
     "zod": "^4.6.6",

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "description": "Kimi for Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP job controls through the local Kimi Code CLI.",
   "author": {
     "name": "linxule"