kimi-plugin-cc 2.5.1 → 2.5.3

package/.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
   },
   "metadata": {
     "description": "Kimi for Claude Code: code questions, reviews, fixes, parallel tasks, and MCP tasks through the local Kimi Code CLI.",
-    "version": "2.5.1"
+    "version": "2.5.3"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi",
   "description": "Kimi for Claude Code: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tasks through the local Kimi Code CLI, with PreToolUse safety hooks.",
-  "version": "2.5.1",
+  "version": "2.5.3",
   "homepage": "https://github.com/linxule/kimi-plugin-cc",
   "repository": "https://github.com/linxule/kimi-plugin-cc",
   "license": "Apache-2.0",

package/CHANGELOG.md

@@ -2,11 +2,25 @@
 
 > **Post-1.0 release history (v1.0.1 -> present) lives in [ROADMAP-TO-GA.md § Post-GA audit log](./ROADMAP-TO-GA.md#post-ga-audit-log)** and the "Version" / "Upstream compat" lines of [AGENTS.md](./AGENTS.md). Docs-only kimi-code compat checkups that don't bump the plugin version (e.g. the 0.14.2 / 0.14.3 patches) are recorded there, not here. Notable releases are summarized below; the GA entry and full pre-GA detail follow.
 
+## 2.5.3 — 2026-11-06
+
+- Certify exact kimi-code 2.5.0 and 2.5.1 for all eight native-v2 operations. Preserve the no-plan construction, local execution and workspace-trust enforcement, authenticated WebSocket swarm state, bounded lifecycle cleanup, and the legacy-v1 0.41.x boundary. See the [2.5.0](docs/upstream-2.5.0-certification.md) and [2.5.1](docs/upstream-2.5.1-certification.md) evidence.
+- Review every exact-version branch for fresh `--environment local`, hook schemas, preactivation, local environment/cwd binding, and protocol-v2 agent state. Require a clean WebSocket close before accepting final agent state, preserving timeout and abnormal-close refusals across Bun platforms. The 2.5.1 source scan passed 18 tests with 153 assertions; candidate and production matrices each passed 24 tests with 167 assertions and no skips, including real rescue, Bash.cwd confinement, resume/taint refusal, goal-turn denials, and child-authored patches.
+- Pass the full repository gate with 1,412 tests and 18,282 assertions, 330-file package checks across all three distributions, isolated consumer security, and independent read-only `claude -p` review with no must-fix findings. Update the manual smoke default to exact 2.5.1 and the current compatibility documentation; publication does not update installed hosts or operator pins.
+
+## 2.5.2 — 2026-11-02
+
+- Preserve TOML multiline values, line endings, and foreign hook fields during setup; repair mixed-host orphan marker comments without altering foreign hooks.
+- Keep the DSH disposal grace at least 6000ms, pin a stable Node path, and expose each Kimi tool's write boundary to the model.
+- Treat DSH services and its tool adapter as host-provided peers so ordinary npm consumers do not install the harness. Require patched DSH host/profile dependencies and audit both installations before the seven-tool composition and Web-boot smoke.
+- Add an installed-consumer security gate to CI and publication; reject failed or incomplete audits as well as high/critical advisories. Upstream DSH pins remain vulnerable, so existing installations require the documented explicit overrides.
+- Validate exact Kimi Code 2.4.1 with 24 real-binary smoke tests (167 assertions, no skips) and the 16-test exact-source audit; certification remains unchanged.
+
 ## 2.5.1 — 2026-11-01
 
 - Consolidate DSH distribution into the existing `kimi-plugin-cc` npm package and its established OIDC publication path. DSH users install the same root artifact with `dsh plugin --profile <name> add kimi-plugin-cc`; no second npm package or Trusted Publishing binding is required.
 - Declare the root DSH bundle entry, runtime dependencies, and peer compatibility directly in `package.json`, and validate root-tarball installation, seven-tool composition, and Web boot in an isolated DSH profile.
-- Pin safe transitive `zod` and `undici` versions, remove the unnecessary full DSH CLI development dependency, install pnpm explicitly in CI, and exclude dependency directories from installed-script fixtures.
+- Pin transitive `zod` and `undici` versions in the checkout lockfile, remove the unnecessary full DSH CLI development dependency, install pnpm explicitly in CI, and exclude dependency directories from installed-script fixtures. Downstream npm consumers do not inherit those overrides; see the consumer-security release gate.
 
 ## 2.5.0 — 2026-11-01
 

package/README.md

@@ -99,6 +99,8 @@ If you use multiple hosts, run setup in each. Each app has its own hook in the s
 
 ## Install in DeepSeek Harness
 
+DSH requires patched host and profile dependencies (`zod >=4.6.6`, `undici >=8.12.2`). Follow the [host installation and audit instructions](./docs/registry-releases.md#patched-dsh-host-and-profiles) before installing this plugin.
+
 The DSH bundle provides the same seven operations as the other hosts: `kimi_ask`, `kimi_review`, `kimi_challenge`, `kimi_rescue`, `kimi_pursue`, `kimi_swarm`, and `kimi_swarm_write`. They use the same companion runtime, safety hooks, jobs, budgets, and artifacts. Rescue and pursue edit the selected workspace; swarm-write returns a patch without applying or committing it.
 
 From this repository checkout, run:
@@ -109,6 +111,8 @@ dsh plugin --profile web add ./plugins/kimi-dsh
 
 For the published npm bundle, run `dsh plugin --profile web add kimi-plugin-cc` instead.
 
+For DSH Discover, enable **Custom plugin indexes** and add `https://raw.githubusercontent.com/linxule/kimi-plugin-cc/main/dsh/index.json` as an index source.
+
 Restart DSH when requested, then run `/kimi-setup` and `/kimi-setup --check`. Ask DSH to use one of the seven tools with a self-contained task. Job controls are `/kimi-status`, `/kimi-result`, and `/kimi-cancel`. `/kimi-setup --models` lists configured models, and `/kimi-setup --uninstall` removes only the DSH hook.
 
 DSH requires Node.js 24.9 or newer and DSH `>=0.2.1-rc.5 <0.3.0`. See the [DSH bundle guide](./plugins/kimi-dsh/README.md) for profile-level model, thinking, budget, review-base, and other configuration.
@@ -337,9 +341,27 @@ codex plugin add kimi@kimi-marketplace
 
 如果同时使用 Claude Code 和 Codex，请分别运行 setup。两个应用各有自己的钩子，共用一份 Kimi 配置。
 
+## 在 DeepSeek Harness（DSH）中安装
+
+DSH 宿主及各配置所用的依赖需要修补（`zod >=4.6.6`、`undici >=8.12.2`）。安装插件前，请按[宿主安装与审计说明](./docs/registry-releases.md#patched-dsh-host-and-profiles)操作。
+
+DSH 与其他宿主一样提供七类操作：`kimi_ask`、`kimi_review`、`kimi_challenge`、`kimi_rescue`、`kimi_pursue`、`kimi_swarm` 和 `kimi_swarm_write`。它们使用同一套 companion 运行时、安全钩子、任务记录、预算和产物。Rescue 和 pursue 会修改所选工作区；swarm-write 只返回补丁，不会应用或提交它。
+
+从此仓库检出安装：
+
+```sh
+dsh plugin --profile web add ./plugins/kimi-dsh
+```
+
+从已发布的根包安装时，改为运行 `dsh plugin --profile web add kimi-plugin-cc`。
+
+按提示重启 DSH，然后运行 `/kimi-setup` 和 `/kimi-setup --check`。让 DSH 使用上述任一工具，并提供独立完整的任务。任务控制命令为 `/kimi-status`、`/kimi-result` 和 `/kimi-cancel`。`/kimi-setup --models` 列出已配置模型，`/kimi-setup --uninstall` 只移除 DSH 自己的钩子。
+
+DSH 需要 Node.js 24.9 或更高版本，以及 DSH `>=0.2.1-rc.5 <0.3.0`。配置模型、思考强度、预算、review base 等选项，请参阅 [DSH 指南](./plugins/kimi-dsh/README.md)。
+
 ## npm 分发（可选）
 
-完整插件也已发布到 [npm，包名为 `kimi-plugin-cc`](https://www.npmjs.com/package/kimi-plugin-cc)，包含 Claude Code 和 Codex 的预编译运行时，无需 Bun 或构建步骤。默认仍推荐上方的插件市场安装方式。需要通过 npm 安装本地 Claude Code 插件时，请参照 [npm 安装步骤](#npm-distribution-optional)。每个应用只加载一份插件；npm 不提供 `npx kimi-plugin-cc` 命令。Codex 用户继续使用上方的 GitHub 插件市场命令。
+完整插件也已发布到 [npm，包名为 `kimi-plugin-cc`](https://www.npmjs.com/package/kimi-plugin-cc)，包含 Claude Code、Codex 和 DSH 的预编译运行时，无需 Bun 或构建步骤。默认仍推荐上方的插件市场安装方式。需要通过 npm 安装本地 Claude Code 插件时，请参照 [npm 安装步骤](#npm-distribution-optional)。每个应用只加载一份插件；npm 不提供 `npx kimi-plugin-cc` 命令。Codex 用户继续使用上方的 GitHub 插件市场命令。
 
 ## 选择任务
 
@@ -470,7 +492,9 @@ Demandez à Kimi d'expliquer du code, de faire une revue de code, de remettre en
 
 Le plugin exécute Kimi Code CLI sur votre ordinateur. Il utilise votre abonnement Kimi ou un fournisseur configuré dans Kimi. Les appels consomment votre quota d'abonnement ou sont facturés sur votre compte API. La connexion à l'application hôte ne change pas. Le fournisseur choisi reçoit les prompts et le code nécessaires à la tâche.
 
-Commencez par une question ou une revue de code. Ces modes autorisent la lecture des fichiers, mais interdisent leur modification et l'exécution de commandes shell. D'autres modes peuvent modifier des fichiers ; DSH propose les sept mêmes opérations avec les mêmes limites d'écriture. Consultez les [limites de sécurité](./docs/safety.md) avant de demander des modifications à Kimi. Voir le [guide DSH en anglais](#install-in-deepseek-harness) pour l'installation.
+Commencez par une question ou une revue de code. Ces modes autorisent la lecture des fichiers, mais interdisent leur modification et l'exécution de commandes shell. D'autres modes peuvent modifier des fichiers ; DSH nécessite des dépendances corrigées dans son installation et ses profils (`zod >=4.6.6`, `undici >=8.12.2`). Suivez les [instructions d’installation et d’audit](./docs/registry-releases.md#patched-dsh-host-and-profiles) avant d’installer ce plugin.
+
+DSH propose les sept mêmes opérations avec les mêmes limites d'écriture. Consultez les [limites de sécurité](./docs/safety.md) avant de demander des modifications à Kimi. Voir le [guide DSH en anglais](#install-in-deepseek-harness) pour l'installation.
 
 ## Préparer l'installation
 
@@ -536,9 +560,25 @@ Utilise $kimi-ask pour expliquer le fonctionnement du point d'entrée principal
 
 Si vous utilisez Claude Code et Codex, lancez setup dans chaque application. Chacune possède son propre hook dans la configuration Kimi commune.
 
+## Installer dans DeepSeek Harness (DSH)
+
+DSH propose les sept mêmes opérations que les autres hôtes : `kimi_ask`, `kimi_review`, `kimi_challenge`, `kimi_rescue`, `kimi_pursue`, `kimi_swarm` et `kimi_swarm_write`. Elles utilisent le même runtime companion, les mêmes hooks de sécurité, jobs, budgets et artefacts. Rescue et pursue modifient l'espace de travail sélectionné ; swarm-write renvoie un patch sans l'appliquer ni le committer.
+
+Depuis une copie de ce dépôt, exécutez :
+
+```sh
+dsh plugin --profile web add ./plugins/kimi-dsh
+```
+
+Pour installer le paquet racine publié, exécutez plutôt `dsh plugin --profile web add kimi-plugin-cc`.
+
+Redémarrez DSH si demandé, puis lancez `/kimi-setup` et `/kimi-setup --check`. Demandez à DSH d'utiliser l'un des sept outils avec une tâche autonome. Les contrôles sont `/kimi-status`, `/kimi-result` et `/kimi-cancel`. `/kimi-setup --models` liste les modèles configurés, et `/kimi-setup --uninstall` supprime uniquement le hook DSH.
+
+DSH requiert Node.js 24.9 ou supérieur et DSH `>=0.2.1-rc.5 <0.3.0`. Consultez le [guide DSH](./plugins/kimi-dsh/README.md) pour configurer le modèle, l'effort de réflexion, le budget, la base de revue et les autres options.
+
 ## Distribution npm (facultative)
 
-Le plugin complet est aussi disponible sur [npm sous le nom `kimi-plugin-cc`](https://www.npmjs.com/package/kimi-plugin-cc), avec les runtimes précompilés pour Claude Code et Codex, sans Bun ni compilation. Les marketplaces ci-dessus restent le mode d'installation par défaut. Pour installer une copie locale dans Claude Code via npm, suivez les [étapes npm](#npm-distribution-optional) (en anglais). Ne chargez qu'une copie du plugin par application ; le paquet ne fournit pas de commande `npx kimi-plugin-cc`. Pour Codex, continuez à utiliser la marketplace GitHub ci-dessus.
+Le plugin complet est aussi disponible sur [npm sous le nom `kimi-plugin-cc`](https://www.npmjs.com/package/kimi-plugin-cc), avec les runtimes précompilés pour Claude Code, Codex et DSH, sans Bun ni compilation. Les marketplaces ci-dessus restent le mode d'installation par défaut. Pour installer une copie locale dans Claude Code via npm, suivez les [étapes npm](#npm-distribution-optional) (en anglais). Ne chargez qu'une copie du plugin par application ; le paquet ne fournit pas de commande `npx kimi-plugin-cc`. Pour Codex, continuez à utiliser la marketplace GitHub ci-dessus.
 
 ## Choisir une tâche
 
@@ -735,9 +775,27 @@ $kimi-ask を使って、このプロジェクトのメインのエントリー
 
 Claude Code と Codex の両方を使う場合は、それぞれで setup を実行します。共通の Kimi 設定内に、各アプリ専用のフックが作られます。
 
+## DeepSeek Harness（DSH）にインストールする
+
+DSH 本体とプロファイルの依存パッケージには修正版（`zod >=4.6.6`、`undici >=8.12.2`）が必要です。プラグインのインストール前に[本体のインストールと監査の手順](./docs/registry-releases.md#patched-dsh-host-and-profiles)を確認してください。
+
+DSH でも、ほかのホストと同じ 7 種類の操作を提供します：`kimi_ask`、`kimi_review`、`kimi_challenge`、`kimi_rescue`、`kimi_pursue`、`kimi_swarm`、`kimi_swarm_write`。同じ companion ランタイム、安全フック、ジョブ、予算、成果物を使用します。Rescue と pursue は選択したワークスペースを変更し、swarm-write はパッチを返すだけで、適用やコミットは行いません。
+
+このリポジトリのチェックアウトからインストールする場合：
+
+```sh
+dsh plugin --profile web add ./plugins/kimi-dsh
+```
+
+公開されているルートパッケージからインストールする場合は、代わりに `dsh plugin --profile web add kimi-plugin-cc` を実行します。
+
+案内に従って DSH を再起動したら、`/kimi-setup` と `/kimi-setup --check` を実行します。独立した内容のタスクを指定して、上記のいずれかのツールを使ってください。ジョブ制御は `/kimi-status`、`/kimi-result`、`/kimi-cancel` です。`/kimi-setup --models` で設定済みモデルを一覧でき、`/kimi-setup --uninstall` は DSH のフックだけを削除します。
+
+DSH には Node.js 24.9 以降と、DSH `>=0.2.1-rc.5 <0.3.0` が必要です。モデル、思考強度、予算、review base などの設定は [DSH ガイド](./plugins/kimi-dsh/README.md)を参照してください。
+
 ## npm 配布（任意）
 
-完全なプラグインは [npm の `kimi-plugin-cc`](https://www.npmjs.com/package/kimi-plugin-cc) としても公開されています。Claude Code と Codex 向けのコンパイル済みランタイムを含み、Bun やビルド作業は不要です。通常は上記のマーケットプレイス経由でインストールしてください。npm から Claude Code 用のローカルコピーを入れる場合は、[npm のインストール手順](#npm-distribution-optional)（英語）を参照してください。各アプリで読み込むプラグインは一つにし、重複させないでください。`npx kimi-plugin-cc` コマンドはありません。Codex では引き続き上記の GitHub マーケットプレイスを使います。
+完全なプラグインは [npm の `kimi-plugin-cc`](https://www.npmjs.com/package/kimi-plugin-cc) としても公開されています。Claude Code、Codex、DSH 向けのコンパイル済みランタイムを含み、Bun やビルド作業は不要です。通常は上記のマーケットプレイス経由でインストールしてください。npm から Claude Code 用のローカルコピーを入れる場合は、[npm のインストール手順](#npm-distribution-optional)（英語）を参照してください。各アプリで読み込むプラグインは一つにし、重複させないでください。`npx kimi-plugin-cc` コマンドはありません。Codex では引き続き上記の GitHub マーケットプレイスを使います。
 
 ## タスクを選ぶ
 

package/dist/cli-client.js

@@ -65,6 +65,7 @@ export async function runCliPrompt(opts) {
             kimiHome: resolveKimiHome(opts.env, opts.cwd),
             env: opts.env,
             resumeSessionId: opts.resumeSessionId,
+            expectedExecutionRoot: opts.trustedWorkspaceRoot ?? opts.cwd,
             stage: "cli-client.spawn",
         });
     }
@@ -781,6 +782,13 @@ const KIMI_LEGACY_FORCED_VALUE = "1";
 function buildArgs(opts) {
     const args = [...(opts.prefixArgs ?? [])];
     args.push("--output-format", "stream-json");
+    const smokeCandidate = opts.executionPlan.certification === "test-bypass" && opts.env.KIMI_PLUGIN_CC_SMOKE === "1"
+        ? opts.env.KIMI_PLUGIN_CC_SMOKE_V2_CANDIDATE
+        : undefined;
+    if (opts.resumeSessionId === undefined &&
+        ["2.5.0", "2.5.1"].includes(opts.executionPlan.kimiVersion ?? smokeCandidate ?? "")) {
+        args.push("--environment", "local");
+    }
     if (opts.resumeSessionId !== undefined) {
         args.push("-r", opts.resumeSessionId);
     }

package/dist/commands/setup.js

@@ -9,7 +9,8 @@ import { SETUP_SUPPORTED_FLAGS } from "../parsing.js";
 // absolute Node path avoids PATH dependence under sanitized launches. Setup
 // probes the hook directly with resolveNodeBinary and through `/bin/sh -c`
 // using the exact installed command bytes. It also warns about broad permission
-// denies and refuses duplicate, orphaned, or malformed managed blocks.
+// denies, repairs orphan marker comments, and refuses remaining
+// duplicate, orphaned, or malformed managed blocks.
 //
 // Subcommands: install (default), --check, --uninstall [--all], and
 // --enable-review-gate/--disable-review-gate.
@@ -25,12 +26,13 @@ import { readPluginConfig, writePluginConfig } from "../config.js";
 import { RuntimeError } from "../errors.js";
 import { normalizeTopLevelInlineHooks, validateKimiHookSetForEnvironment, withKimiConfigLock, } from "../hooks/config-safety.js";
 import { buildHookShellCommand, hostIdFromHookCommand, resolveHookScriptPath, resolveHostId, resolveNodeBinary, } from "../hooks/install-paths.js";
-import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, MARKERS, parseManagedBlock, } from "../hooks/managed-block.js";
+import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, markerCommentLines, MARKERS, parseManagedBlock, } from "../hooks/managed-block.js";
 import { formatVersionOutOfRangeWarning, probeKimiVersion, } from "../kimi-version-probe.js";
 import { isNativeV2CertifiedVersion } from "../kimi-engine.js";
 import { resolveKimiHome } from "../kimi-home.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { KIMI_PLUGIN_CC_VERSION } from "../version.js";
+import { parse as parseToml } from "../vendor/smol-toml/parse.js";
 const BEGIN_MARKER_PREFIX = "# === BEGIN kimi-plugin-cc-managed";
 const DEFAULT_HOOK_TIMEOUT_S = 15;
 // Probe timing. The direct script probe is local and fast; allow 5s for
@@ -119,7 +121,17 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
     const mutation = await withKimiConfigLock(configPath, async () => {
         const original = await readConfigSafe(configPath);
         const lineEnding = detectLineEnding(original);
-        const inlineHooks = normalizeTopLevelInlineHooks(original, lineEnding);
+        try {
+            parseToml(original);
+        }
+        catch {
+            await assertKimiHookSetValid(original, configPath, "setup.install", context.env);
+        }
+        const repaired = removeOrphanMarkers(original);
+        if (repaired.count > 0) {
+            warnings.push(`Removed ${repaired.count} orphaned managed marker comment(s); surrounding config was preserved.`);
+        }
+        const inlineHooks = normalizeTopLevelInlineHooks(repaired.contents, lineEnding);
         if (inlineHooks.found) {
             // Validate before normalizing so an invalid inline entry is reported
             // against the user's original bytes and the config remains untouched.
@@ -133,7 +145,7 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
         // splice line numbers. Another host's marker-less table may be its live hook
         // after a config rewrite strips comments, so it must remain untouched.
         const expectedCommand = buildHookShellCommand(hookScriptPath, context.env);
-        const { pruned, count: prunedCount, commands: prunedCommands } = pruneOrphanApprovalHooks(inlineHooks.contents, lineEnding, hostId, expectedCommand);
+        const { pruned, count: prunedCount, commands: prunedCommands } = pruneOrphanApprovalHooks(inlineHooks.contents, hostId, expectedCommand);
         const existing = pruned;
         if (prunedCount > 0) {
             const readorned = prunedCommands.includes(expectedCommand);
@@ -145,7 +157,7 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
         if (state.kind === "orphan") {
             throw new RuntimeError("SETUP_ORPHAN_MARKERS", [
                 `kimi-code config at ${configPath} contains an orphaned ${state.detail} marker.`,
-                "Run `/kimi:setup --uninstall` to clean up, then re-run `/kimi:setup`.",
+                "Inspect the managed marker comments and re-run setup.",
             ].join(" "), "setup.install", { details: { configPath, orphan: state.detail } });
         }
         if (state.kind === "duplicate") {
@@ -393,12 +405,11 @@ async function runUninstallLocked(configPath, hookScriptPath, hostId, removeAllH
     // other hosts' blocks and live marker-less tables remain intact. `--all` is
     // the explicit every-host sweep for all of this plugin's hook tables.
     const { stripped: strippedMarkers, removedBlocks, orphansLeft } = stripManagedBlocks(existing, hostId, removeAllHosts);
-    const lineEnding = detectLineEnding(existing);
     // Exact current command bytes also identify this host's table when a host-id
     // override disagrees with path derivation or a dev path is outside the strict
     // ownership pattern.
     const expectedCommand = buildHookShellCommand(hookScriptPath, context.env);
-    const { pruned: stripped, count: prunedCount } = pruneOrphanApprovalHooks(strippedMarkers, lineEnding, removeAllHosts ? undefined : hostId, expectedCommand);
+    const { pruned: stripped, count: prunedCount } = pruneOrphanApprovalHooks(strippedMarkers, removeAllHosts ? undefined : hostId, expectedCommand);
     const changed = stripped !== existing;
     if (changed) {
         await writeConfigAtomic(configPath, stripped);
@@ -517,10 +528,10 @@ function detectLineEnding(contents) {
     return contents.includes("\r\n") ? "\r\n" : "\n";
 }
 function spliceBlock(contents, beginLine, endLine, replacement, lineEnding) {
-    const lines = splitPreservingEnding(contents);
-    const before = lines.slice(0, beginLine).join(lineEnding);
-    const after = lines.slice(endLine + 1).join(lineEnding);
-    const beforeWithSep = before.endsWith(lineEnding) || before.length === 0 ? before : `${before}${lineEnding}`;
+    const lines = contents.split(/(?<=\n)/);
+    const before = lines.slice(0, beginLine).join("");
+    const after = lines.slice(endLine + 1).join("");
+    const beforeWithSep = before.endsWith("\n") || before.length === 0 ? before : `${before}${lineEnding}`;
     const replacementWithEnding = replacement.endsWith(lineEnding) ? replacement : `${replacement}${lineEnding}`;
     return `${beforeWithSep}${replacementWithEnding}${after}`;
 }
@@ -536,14 +547,54 @@ function splitPreservingEnding(contents) {
     // pass the desired line ending).
     return contents.split("\n").map((line) => line.replace(/\r$/, ""));
 }
+// A partial upstream hooks-array rewrite can leave one marker comment behind.
+// Remove only unpaired marker comments, never the intervening content. The
+// normal full-file validation still gates writes.
+function removeOrphanMarkers(contents) {
+    const lines = splitPreservingEnding(contents);
+    const orphans = [];
+    const comments = markerCommentLines(contents);
+    let open = null;
+    for (let i = 0; i < lines.length; i += 1) {
+        if (!comments.has(i))
+            continue;
+        const line = lines[i].trim();
+        const begin = MARKERS.BEGIN_LINE_RE.exec(line);
+        if (begin !== null) {
+            if (open !== null)
+                orphans.push(open);
+            open = { index: i, host: begin[1]?.toLowerCase() ?? null };
+        }
+        else {
+            const end = MARKERS.END_LINE_RE.exec(line);
+            if (end === null)
+                continue;
+            const endMarker = { index: i, host: end[1]?.toLowerCase() ?? null };
+            if (open === null)
+                orphans.push(endMarker);
+            else {
+                if (open.host !== endMarker.host)
+                    orphans.push(open, endMarker);
+                open = null;
+            }
+        }
+    }
+    if (open !== null)
+        orphans.push(open);
+    const remove = new Set(orphans.map((marker) => marker.index));
+    return remove.size === 0
+        ? { contents, count: 0 }
+        : { contents: contents.split(/(?<=\n)/).filter((_, index) => !remove.has(index)).join(""), count: remove.size };
+}
 /**
  * Remove managed blocks owned by `currentHost`, or every host with `removeAll`.
  * Ownership comes from the marker suffix or a legacy command's derived host.
  * Orphan markers are removed individually so surrounding user content survives.
  */
 function stripManagedBlocks(contents, currentHost, removeAll) {
-    const lineEnding = detectLineEnding(contents);
     const lines = splitPreservingEnding(contents);
+    const rawLines = contents.split(/(?<=\n)/);
+    const markerLines = markerCommentLines(contents);
     const result = [];
     const orphansLeft = [];
     let removedBlocks = 0;
@@ -567,7 +618,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
     while (i < lines.length) {
         const line = lines[i];
         const trimmed = line.trim();
-        const begin = MARKERS.BEGIN_LINE_RE.exec(trimmed);
+        const begin = markerLines.has(i) ? MARKERS.BEGIN_LINE_RE.exec(trimmed) : null;
         if (begin !== null) {
             const beginHost = begin[1]?.toLowerCase() ?? null;
             // Look ahead for the matching END, capturing the block's command en route.
@@ -575,12 +626,14 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
             let blockCommand = null;
             for (let j = i + 1; j < lines.length; j += 1) {
                 const nextTrimmed = lines[j].trim();
-                if (MARKERS.BEGIN_LINE_RE.test(nextTrimmed)) {
+                if (markerLines.has(j) && MARKERS.BEGIN_LINE_RE.test(nextTrimmed)) {
                     // Two BEGINs in a row — the outer one is an orphan.
                     break;
                 }
-                if (MARKERS.END_LINE_RE.test(nextTrimmed)) {
-                    endIdx = j;
+                const end = markerLines.has(j) ? MARKERS.END_LINE_RE.exec(nextTrimmed) : null;
+                if (end !== null) {
+                    if ((end[1]?.toLowerCase() ?? null) === beginHost)
+                        endIdx = j;
                     break;
                 }
                 const decoded = decodeManagedCommandLine(nextTrimmed);
@@ -594,7 +647,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
                     i += 1;
                     continue;
                 }
-                result.push(line);
+                result.push(rawLines[i]);
                 i += 1;
                 continue;
             }
@@ -606,11 +659,11 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
             }
             // Another host's block — keep it verbatim.
             for (let k = i; k <= endIdx; k += 1)
-                result.push(lines[k]);
+                result.push(rawLines[k]);
             i = endIdx + 1;
             continue;
         }
-        const end = MARKERS.END_LINE_RE.exec(trimmed);
+        const end = markerLines.has(i) ? MARKERS.END_LINE_RE.exec(trimmed) : null;
         if (end !== null) {
             const endHost = end[1]?.toLowerCase() ?? null;
             // Orphan END with no preceding BEGIN: drop only this line (if ours).
@@ -619,27 +672,14 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
                 i += 1;
                 continue;
             }
-            result.push(line);
+            result.push(rawLines[i]);
             i += 1;
             continue;
         }
-        result.push(line);
+        result.push(rawLines[i]);
         i += 1;
     }
-    const collapsed = [];
-    let blankRun = 0;
-    for (const line of result) {
-        if (line.length === 0) {
-            blankRun += 1;
-            if (blankRun <= 2)
-                collapsed.push(line);
-        }
-        else {
-            blankRun = 0;
-            collapsed.push(line);
-        }
-    }
-    return { stripped: collapsed.join(lineEnding), removedBlocks, orphansLeft };
+    return { stripped: result.join(""), removedBlocks, orphansLeft };
 }
 /**
  * Remove orphaned, marker-less `[[hooks]]` tables that are unambiguously this
@@ -654,7 +694,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
  * host — REQUIRED for scoped install/uninstall so one host never disarms the
  * other's live (marker-stripped) hook. Omit only for `--uninstall --all`.
  */
-function pruneOrphanApprovalHooks(contents, lineEnding, ownedBy, alsoMatchCommand) {
+function pruneOrphanApprovalHooks(contents, ownedBy, alsoMatchCommand) {
     const ranges = findUnmanagedApprovalHookBlocks(contents, ownedBy, alsoMatchCommand);
     if (ranges.length === 0)
         return { pruned: contents, count: 0, commands: [] };
@@ -663,23 +703,10 @@ function pruneOrphanApprovalHooks(contents, lineEnding, ownedBy, alsoMatchComman
         for (let i = start; i < end; i += 1)
             remove.add(i);
     }
-    const lines = splitPreservingEnding(contents);
+    const lines = contents.split(/(?<=\n)/);
     const kept = lines.filter((_, idx) => !remove.has(idx));
-    const collapsed = [];
-    let blankRun = 0;
-    for (const line of kept) {
-        if (line.length === 0) {
-            blankRun += 1;
-            if (blankRun <= 2)
-                collapsed.push(line);
-        }
-        else {
-            blankRun = 0;
-            collapsed.push(line);
-        }
-    }
     return {
-        pruned: collapsed.join(lineEnding),
+        pruned: kept.join(""),
         count: ranges.length,
         commands: ranges.map((range) => range.command),
     };

package/dist/commands/swarm.js

@@ -28,8 +28,8 @@ import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js
 // only the wall-clock hard bound. Read/write modes reuse review/rescue lineage,
 // and the mandatory PreToolUse hook enforces read-only policy or trusted-worktree
 // write confinement on the coordinator and every subagent. Write mode requires
-// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1 additionally activate a same-job
-// session through a bounded loopback web lifecycle, then resume it through the normal print path.
+// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.5.0 and 2.5.1 additionally
+// activate a same-job session through a bounded loopback web lifecycle, then resume it through the normal print path.
 const SWARM_SUMMARY_MAX = 120;
 const SWARM_AGENT_PROFILE = "<swarm>";
 const SWARM_WRITE_AGENT_PROFILE = "<swarm-write>";

package/dist/dsh/companion.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { brandString } from "@deepseek-ai/dsh-brand";
 import { assertUsableCwd, settleRunResult, subprocessRunHandle, } from "@deepseek-ai/dsh-subagent";
+import { preferStableNodePath } from "../hooks/install-paths.js";
 export const DSH_COMPANION_OPERATIONS = [
     "ask",
     "review",
@@ -20,7 +21,7 @@ export function companionTextTask(prompt) {
     }
     return text;
 }
-export function companionArgv(operation, prompt, companionPath, nodeBin = process.execPath, options = {}) {
+export function companionArgv(operation, prompt, companionPath, nodeBin = preferStableNodePath(process.execPath), options = {}) {
     const command = operation === "ask" || operation === "review"
         ? [operation]
         : operation === "swarm-write"
@@ -41,7 +42,7 @@ export function companionArgv(operation, prompt, companionPath, nodeBin = proces
         prompt,
     ];
 }
-export function companionEnvironment(dataRoot, cwd, env, nodeBin = process.execPath) {
+export function companionEnvironment(dataRoot, cwd, env, nodeBin = preferStableNodePath(process.execPath)) {
     return {
         ...env,
         KIMI_PLUGIN_CC_DATA: dataRoot,
@@ -79,8 +80,9 @@ export async function startCompanionRun(request, operation, spec) {
     request.signal.addEventListener("abort", onAbort, { once: true });
     let child;
     try {
+        const nodeBin = preferStableNodePath(process.execPath);
         child = spec.spawn({
-            argv: companionArgv(operation, prompt, spec.companionPath, process.execPath, spec),
+            argv: companionArgv(operation, prompt, spec.companionPath, nodeBin, spec),
             cwd,
             stdio: {
                 stdin: "ignore",
@@ -89,7 +91,7 @@ export async function startCompanionRun(request, operation, spec) {
             },
             graceMs: spec.disposeGraceMs,
             signal: termination.signal,
-            env: companionEnvironment(spec.dataRoot, cwd, spec.env),
+            env: companionEnvironment(spec.dataRoot, cwd, spec.env, nodeBin),
         });
     }
     catch (error) {
@@ -141,8 +143,9 @@ export async function startCompanionRun(request, operation, spec) {
     });
 }
 export async function runCompanionCommand(argv, cwd, spec, signal) {
+    const nodeBin = preferStableNodePath(process.execPath);
     const child = spec.spawn({
-        argv: [process.execPath, spec.companionPath, ...argv],
+        argv: [nodeBin, spec.companionPath, ...argv],
         cwd,
         stdio: {
             stdin: "ignore",
@@ -151,7 +154,7 @@ export async function runCompanionCommand(argv, cwd, spec, signal) {
         },
         graceMs: spec.disposeGraceMs,
         signal,
-        env: companionEnvironment(spec.dataRoot, cwd, spec.env),
+        env: companionEnvironment(spec.dataRoot, cwd, spec.env, nodeBin),
     });
     try {
         const outcome = await child.done;

package/dist/dsh/index.js

@@ -8,6 +8,12 @@ import { DSH_COMPANION_OPERATIONS, runCompanionCommand, startCompanionRun, } fro
 import { parseDurationMs } from "../parsing.js";
 export const name = "kimi-plugin-cc";
 export const inject = ["subagents", "subprocess"];
+export const DSH_TOOL_GUIDANCE = [
+    "Kimi delegation tools have different write boundaries:",
+    "kimi_ask, kimi_review, and kimi_challenge are read-only; kimi_swarm is a read-only parallel review.",
+    "kimi_rescue and kimi_pursue can edit the selected workspace; kimi_pursue continues toward a bounded goal.",
+    "kimi_swarm_write edits a temporary worktree and returns a patch without applying it.",
+].join(" ");
 const DEFAULT_DISPOSE_GRACE_MS = 6_000;
 const DEFAULT_MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
 const MAX_TIMER_DELAY_MS = 2_147_483_647;
@@ -50,8 +56,8 @@ function resolveConfig(config) {
     if (!path.isAbsolute(resolved.dataRoot)) {
         throw new Error("kimi-plugin-cc: dataRoot must be absolute");
     }
-    if (!Number.isFinite(resolved.disposeGraceMs) || resolved.disposeGraceMs <= 0 || resolved.disposeGraceMs > MAX_TIMER_DELAY_MS) {
-        throw new Error(`kimi-plugin-cc: disposeGraceMs must be positive, finite, and no greater than ${MAX_TIMER_DELAY_MS}`);
+    if (!Number.isFinite(resolved.disposeGraceMs) || resolved.disposeGraceMs < DEFAULT_DISPOSE_GRACE_MS || resolved.disposeGraceMs > MAX_TIMER_DELAY_MS) {
+        throw new Error(`kimi-plugin-cc: disposeGraceMs must be at least ${DEFAULT_DISPOSE_GRACE_MS} and no greater than ${MAX_TIMER_DELAY_MS}`);
     }
     if (!Number.isSafeInteger(resolved.maxOutputBytes) || resolved.maxOutputBytes <= 0) {
         throw new Error("kimi-plugin-cc: maxOutputBytes must be a positive safe integer");
@@ -105,6 +111,13 @@ export function apply(ctx, config) {
     for (const operation of DSH_COMPANION_OPERATIONS) {
         ctx.subagents.registerProvider(new KimiCompanionProvider(`kimi-${operation}`, operation, spec));
     }
+    ctx.inject(["systemPrompt"], (promptCtx) => {
+        promptCtx.systemPrompt.section({
+            name: "kimi-plugin-cc:tool-boundaries",
+            order: promptCtx.systemPrompt.getSectionOrder("TOOL_SUBAGENT"),
+            text: () => DSH_TOOL_GUIDANCE,
+        });
+    });
     ctx.inject(["commands"], (commandCtx) => {
         const execute = async (invocation, argv) => {
             const directories = commandCtx.get("workingDirectory");

package/dist/hooks/config-safety.js

@@ -595,7 +595,8 @@ function validateVersionSensitiveEvents(events, version) {
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
     // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3),
     // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e), 2.3.2 (b8dd3a13), 2.3.3 (ec495f0c),
-    // 2.4.0 (f26e4d91), and 2.4.1 (2c73f3f5): the additive events and HookDefSchema are unchanged.
+    // 2.4.0 (f26e4d91), 2.4.1 (2c73f3f5), 2.5.0 (41c34143), and 2.5.1 (1b02030d):
+    // the additive events and HookDefSchema are unchanged.
     // Require the full version string AND matching components; no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
         (version.version === "2.0.1" && version.patch === 1) ||
@@ -608,7 +609,9 @@ function validateVersionSensitiveEvents(events, version) {
             (version.version === "2.3.2" && version.patch === 2) ||
             (version.version === "2.3.3" && version.patch === 3))) ||
         (version.minor === 4 && ((version.version === "2.4.0" && version.patch === 0) ||
-            (version.version === "2.4.1" && version.patch === 1))))) {
+            (version.version === "2.4.1" && version.patch === 1))) ||
+        (version.minor === 5 && ((version.version === "2.5.0" && version.patch === 0) ||
+            (version.version === "2.5.1" && version.patch === 1))))) {
         return { valid: true };
     }
     if (version.major !== 0) {