kimi-plugin-cc 2.5.1 → 2.5.3

package/dist/hooks/managed-block.js

@@ -45,10 +45,80 @@ const MATCHER_LINE_RE = /^matcher\s*=/;
 /** `timeout = <int>` — the only other key our managed [[hooks]] table emits. */
 const TIMEOUT_LINE_RE = /^timeout\s*=\s*\d+\s*$/;
 const HOOKS_TABLE_RE = /^\[\[hooks\]\]\s*$/;
+// Recognize comment lines lexically, not text inside TOML string values.
+// Whole-document parsing remains the authority for TOML validity.
+function scanTomlLines(contents) {
+    const markers = new Set();
+    const tables = new Set();
+    let state = "plain";
+    let line = 0;
+    let blankPrefix = true;
+    for (let i = 0; i < contents.length; i += 1) {
+        const c = contents[i];
+        if (c === "\n") {
+            line += 1;
+            blankPrefix = true;
+            continue;
+        }
+        const onlyWhitespaceBefore = blankPrefix;
+        if (c !== " " && c !== "\t" && c !== "\r")
+            blankPrefix = false;
+        if (state === "plain") {
+            if (c === "[" && onlyWhitespaceBefore)
+                tables.add(line);
+            if (c === "#") {
+                if (onlyWhitespaceBefore) {
+                    const end = contents.indexOf("\n", i);
+                    const comment = contents.slice(i, end < 0 ? contents.length : end).trim();
+                    if (BEGIN_LINE_RE.test(comment) || END_LINE_RE.test(comment))
+                        markers.add(line);
+                }
+                const end = contents.indexOf("\n", i);
+                if (end < 0)
+                    break;
+                i = end - 1;
+            }
+            else if (c === '"' || c === "'") {
+                const triple = contents.slice(i, i + 3) === c.repeat(3);
+                state = c === '"' ? (triple ? "multibasic" : "basic") : (triple ? "multiliteral" : "literal");
+                if (triple)
+                    i += 2;
+            }
+        }
+        else {
+            const basic = state === "basic" || state === "multibasic";
+            const quote = basic ? '"' : "'";
+            if (basic && c === "\\") {
+                if (contents[i + 1] === "\n") {
+                    line += 1;
+                    blankPrefix = true;
+                }
+                i += 1;
+                continue;
+            }
+            if (c !== quote)
+                continue;
+            if (state === "basic" || state === "literal")
+                state = "plain";
+            else if (contents.slice(i, i + 3) === quote.repeat(3)) {
+                while (contents[i + 1] === quote)
+                    i += 1;
+                state = "plain";
+            }
+        }
+    }
+    return { markers, tables };
+}
+export function markerCommentLines(contents) {
+    return scanTomlLines(contents).markers;
+}
 /** Locate every BEGIN/END marker line, in order, with its parsed host id. */
 function findMarkers(lines) {
     const hits = [];
+    const comments = markerCommentLines(lines.join("\n"));
     for (let i = 0; i < lines.length; i += 1) {
+        if (!comments.has(i))
+            continue;
         const trimmed = lines[i].trim();
         const begin = BEGIN_LINE_RE.exec(trimmed);
         if (begin !== null) {
@@ -66,7 +136,7 @@ function findMarkers(lines) {
 }
 /**
  * Pair BEGIN/END markers into well-formed blocks. Return the first orphan
- * (BEGIN-without-END or END-without-BEGIN); either is a hard error for install.
+ * (BEGIN-without-END or END-without-BEGIN); verification fails closed on either.
  */
 function pairBlocks(lines) {
     const markers = findMarkers(lines);
@@ -83,6 +153,8 @@ function pairBlocks(lines) {
         // end
         if (open === null)
             return { orphan: "END-without-BEGIN" };
+        if (open.hostId !== marker.hostId)
+            return { orphan: "BEGIN-without-END" };
         const body = validateBlockBody(lines.slice(open.index + 1, marker.index));
         blocks.push({
             hostId: open.hostId,
@@ -436,13 +508,13 @@ export function evaluateInstalled(contents, expectedCommand, opts) {
  * The deletion range `[start, end)` is conservative: only the contiguous
  * non-blank body after `[[hooks]]`, stopping at a blank line, table header, or
  * managed marker so adjacent user content is preserved. A separate full-span
- * scan rejects matcher lines recognized by MATCHER_LINE_RE to avoid half-cutting
- * a table. That scan is deliberately heuristic and does not claim to recognize
- * every quoted or dotted TOML matcher spelling. `command` is decoded for the
- * caller's ownership checks.
+ * scan refuses any further TOML field before the next table, including quoted
+ * and dotted keys, so pruning cannot attach those fields to another table.
+ * `command` is decoded for the caller's ownership checks.
  */
 export function findBareApprovalHookTables(contents) {
     const lines = contents.split("\n").map((line) => line.replace(/\r$/, ""));
+    const tableLines = scanTomlLines(contents).tables;
     const managed = new Set();
     const paired = pairBlocks(lines);
     if ("blocks" in paired) {
@@ -455,7 +527,7 @@ export function findBareApprovalHookTables(contents) {
     for (let i = 0; i < lines.length; i += 1) {
         if (managed.has(i))
             continue;
-        if (!HOOKS_TABLE_RE.test(lines[i].trim()))
+        if (!tableLines.has(i) || !HOOKS_TABLE_RE.test(lines[i].trim()))
             continue;
         // Collect the contiguous table body.
         let j = i + 1;
@@ -500,22 +572,16 @@ export function findBareApprovalHookTables(contents) {
             }
             j += 1;
         }
-        // A blank line does NOT end a TOML table; membership continues to the next
-        // header or EOF. The deletion range nevertheless stops at the blank to
-        // preserve adjacent user content. Scan the remaining span for matcher lines
-        // this scanner recognizes and reject the table rather than half-cutting it:
-        // matcher is schema-valid but can disable the hook at runtime. Foreign keys
-        // and other TOML spellings are handled by whole-file schema validation and
-        // the parser-based installed checks, not by this prune heuristic.
-        let matcherBeyondBody = false;
+        // Blank lines and marker comments do not end a TOML table. Never leave any
+        // field behind to be rebound to a preceding table after pruning, regardless
+        // of the field's spelling or whether it is valid for a hook.
+        let fieldBeyondBody = false;
         for (let k = j; k < lines.length; k += 1) {
             const t = lines[k].trim();
-            // The current table's TOML span ends at the next table header or a
-            // managed marker; a matcher past that point belongs to a different table.
-            if (t.startsWith("[") || BEGIN_LINE_RE.test(t) || END_LINE_RE.test(t))
+            if (tableLines.has(k))
                 break;
-            if (MATCHER_LINE_RE.test(t)) {
-                matcherBeyondBody = true;
+            if (t.length > 0 && !t.startsWith("#")) {
+                fieldBeyondBody = true;
                 break;
             }
         }
@@ -527,7 +593,7 @@ export function findBareApprovalHookTables(contents) {
             commandDecoded.length > 0 &&
             hasPreToolUseEvent &&
             !hasMatcher &&
-            !matcherBeyondBody) {
+            !fieldBeyondBody) {
             ranges.push({ start: i, end: j, command: commandDecoded });
         }
     }

package/dist/kimi-command.js

@@ -47,6 +47,7 @@ const RESERVED_PREFIX_FLAGS = new Set([
     "--plan", "--auto", "-y", "--yolo", "--yes", "--auto-approve", "--manual",
     // Model / profile / roots.
     "-m", "--model", "--skills-dir", "--agent", "--agent-file", "--add-dir",
+    "--environment", "--environment-cwd",
     // Terminal informational flags (would replace the run with a banner).
     "-V", "--version", "-h", "--help",
 ]);

package/dist/kimi-engine.js

@@ -45,6 +45,8 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.3.3",
     "2.4.0",
     "2.4.1",
+    "2.5.0",
+    "2.5.1",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([
@@ -127,6 +129,7 @@ export async function prepareKimiExecutionPlan(options) {
             kimiHome: resolveKimiHome(options.env, options.cwd),
             env: options.env,
             resumeSessionId: options.resumeSessionId,
+            expectedExecutionRoot: options.cwd,
             stage: "kimi-engine.plan",
         });
     };

package/dist/native-v2-preflight.js

@@ -13,9 +13,10 @@
 //     B. the EnterPlanMode tool (already hook-denied for every label);
 //     C. resuming a session whose agent wire journal holds a durable
 //        `plan_mode.enter` record (restore() folds ONLY agents/*/wire.jsonl).
-//   This module closes A and C before any process is spawned, and refuses the
+//   This module closes A and C before any process is spawned, refuses the
 //   v2-only experimental features (tower, subagent fork) that this plugin does
-//   not certify. B stays in runtime/hooks/approval-policy.ts.
+//   not certify, and requires local execution for configured and resumed sessions.
+//   B stays in runtime/hooks/approval-policy.ts.
 //
 // Contract:
 //   - Pure inspection: never writes, never rewrites operator config, never
@@ -155,6 +156,48 @@ export async function inspectPlanModeConfig(kimiHome) {
         reason: `\`${offending.join("`, `")}\` (upstream setting \`default_plan_mode\`) is set in ${configPath} and is not \`false\`.`,
     };
 }
+export async function inspectEnvironmentConfig(kimiHome) {
+    const parsed = await readParsedConfig(kimiHome);
+    if (parsed.kind === "unreadable") {
+        return { kind: "refuse", refusalKind: "v2-config-unreadable", reason: parsed.reason };
+    }
+    const section = parsed.config?.["environments"];
+    if (section !== undefined) {
+        if (section === null || typeof section !== "object" || Array.isArray(section)) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-environment-configured",
+                reason: "The [environments] section is not a table, so the execution environment cannot be verified as local.",
+            };
+        }
+        if (section["default"] !== undefined) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-environment-configured",
+                reason: "A default remote execution environment is configured in [environments]; plugin-managed jobs require the local environment.",
+            };
+        }
+    }
+    const workspace = parsed.config?.["workspace"];
+    if (workspace !== undefined) {
+        if (workspace === null || typeof workspace !== "object" || Array.isArray(workspace)) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-workspace-trust-disabled",
+                reason: "The [workspace] section is not a table, so project trust requirements cannot be verified.",
+            };
+        }
+        const trustDisabled = Object.entries(workspace).some(([key, value]) => upstreamSnakeToCamel(key) === "requireTrust" && value !== true);
+        if (trustDisabled) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-workspace-trust-disabled",
+                reason: "Workspace trust is disabled in [workspace]; plugin-managed jobs require project trust enforcement to remain enabled.",
+            };
+        }
+    }
+    return { kind: "ok" };
+}
 /**
  * Refuse v2-only experimental features this plugin does not certify.
  * Sources (per-flag precedence upstream is env → [experimental] config →
@@ -239,40 +282,39 @@ async function openJournalSafely(journalPath, maxBytes) {
     }
     return { kind: "ok", handle };
 }
-/**
- * Scan one open journal's lines for a plan-mode control record. Returns the
- * record `type` string on a match, "<unparseable>" for a suspicious line
- * that fails to parse, or null when the journal is clean.
- */
-async function scanJournalLines(handle) {
+async function scanJournalLines(handle, expectedExecutionRoot) {
     const rl = createInterface({ input: handle.createReadStream() });
     try {
         for await (const rawLine of rl) {
             const line = rawLine.trim();
             if (line.length === 0)
                 continue;
-            // Parse EVERY record and check its DECODED `type`. A raw-substring filter
-            // is unsafe on its own: a JSON-escaped type such as
-            // {"type":"plan_mode.enter"} contains no literal "plan_mode." yet
-            // upstream JSON.parse decodes it to "plan_mode.enter" and restores active
-            // plan mode. So parse first (this catches the escape). If a line FAILS to
-            // parse, upstream cannot fold it into a plan event either — but be
-            // conservative: a malformed line that still LOOKS plan-related is treated
-            // as tainted rather than skipped, so a hand-corrupted journal cannot hide
-            // a plan record behind a parse error.
             let parsed;
             try {
                 parsed = JSON.parse(line);
             }
             catch {
                 if (line.includes('"plan_mode.') || line.includes('"plan.')) {
-                    return "<unparseable>";
+                    return { kind: "tainted", recordType: "<unparseable>" };
+                }
+                if (line.includes('"environment.set_binding')) {
+                    return { kind: "environment", recordType: "<unparseable-environment-binding>" };
                 }
                 continue;
             }
-            const type = parsed?.["type"];
+            const record = parsed;
+            const type = record?.["type"];
             if (typeof type === "string" && (type.startsWith("plan_mode.") || type.startsWith("plan."))) {
-                return type;
+                return { kind: "tainted", recordType: type };
+            }
+            if (type === "environment.set_binding") {
+                if (record?.["environmentId"] !== "local") {
+                    return { kind: "environment", recordType: type };
+                }
+                const cwd = record?.["cwd"];
+                if (expectedExecutionRoot !== undefined && cwd !== undefined && cwd !== expectedExecutionRoot) {
+                    return { kind: "environment", recordType: "environment.set_binding.cwd" };
+                }
             }
         }
         return null;
@@ -281,16 +323,48 @@ async function scanJournalLines(handle) {
         rl.close();
     }
 }
+async function inspectSessionMetadataEnvironment(statePath, expectedExecutionRoot) {
+    const read = await readSmallFileSafe(statePath, CONFIG_MAX_BYTES);
+    if (read.kind === "absent")
+        return null;
+    if (read.kind === "unreadable") {
+        return { kind: "unavailable", reason: `${statePath}: ${read.reason}` };
+    }
+    let metadata;
+    try {
+        metadata = JSON.parse(read.contents);
+    }
+    catch {
+        return { kind: "unavailable", reason: `${statePath}: malformed session metadata` };
+    }
+    if (metadata === null || typeof metadata !== "object" || Array.isArray(metadata)) {
+        return { kind: "unavailable", reason: `${statePath}: invalid session metadata` };
+    }
+    const record = metadata;
+    const environmentId = record["environmentId"];
+    if (environmentId !== undefined && environmentId !== "local") {
+        return { kind: "environment", journal: statePath, recordType: "session.metadata.environmentId" };
+    }
+    const environmentCwd = record["environmentCwd"];
+    if ((environmentId === undefined || environmentId === "local") &&
+        expectedExecutionRoot !== undefined &&
+        environmentCwd !== undefined &&
+        environmentCwd !== expectedExecutionRoot) {
+        return { kind: "environment", journal: statePath, recordType: "session.metadata.environmentCwd" };
+    }
+    return null;
+}
 /**
- * Scan every agent wire journal of a saved session for plan-mode records.
- * Layout at 0.42.0: `<kimiHome>/sessions/<workspaceId>/<sessionId>/agents/<agentId>/wire.jsonl`
+ * Scan saved session metadata and every agent wire journal for plan-mode records
+ * and nonlocal environment bindings. Layout at 0.42.0:
+ * `<kimiHome>/sessions/<workspaceId>/<sessionId>/agents/<agentId>/wire.jsonl`
  * (workspaceId is unknown to the plugin → enumerate `sessions/*` with bounded
  * readdir). Raw-line scan of EVERY agent journal: a JSON line whose `type`
- * starts with `plan_mode.` or `plan.` → tainted (fail-closed on a line that
- * looks suspicious but does not parse). No session dir, no journal, unreadable,
+ * starts with `plan_mode.` or `plan.` → tainted; `environment.set_binding` must
+ * name `environmentId:"local"`. No session dir, no journal, unreadable metadata,
  * or any single journal above the size cap → unavailable. Never modifies files.
  */
-export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
+export async function scanSessionJournalsForPlan(kimiHome, sessionId, expectedExecutionRoot) {
     const sessionsDir = path.join(kimiHome, "sessions");
     const workspaceEntries = await boundedReaddir(sessionsDir, DIR_ENUM_CAP);
     if (workspaceEntries.kind === "absent") {
@@ -316,7 +390,11 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
         }
         if (!workspaceEntry.isDirectory())
             continue;
-        const agentsDir = path.join(sessionsDir, workspaceEntry.name, sessionId, "agents");
+        const sessionDir = path.join(sessionsDir, workspaceEntry.name, sessionId);
+        const metadataFinding = await inspectSessionMetadataEnvironment(path.join(sessionDir, "state.json"), expectedExecutionRoot);
+        if (metadataFinding !== null)
+            return metadataFinding;
+        const agentsDir = path.join(sessionDir, "agents");
         const agentEntries = await boundedReaddir(agentsDir, DIR_ENUM_CAP);
         if (agentEntries.kind === "absent")
             continue;
@@ -347,9 +425,12 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
             return { kind: "unavailable", reason: `${journalPath}: ${opened.reason}` };
         }
         try {
-            const taintedType = await scanJournalLines(opened.handle);
-            if (taintedType !== null) {
-                return { kind: "tainted", journal: journalPath, recordType: taintedType };
+            const finding = await scanJournalLines(opened.handle, expectedExecutionRoot);
+            if (finding?.kind === "tainted") {
+                return { kind: "tainted", journal: journalPath, recordType: finding.recordType };
+            }
+            if (finding?.kind === "environment") {
+                return { kind: "environment", journal: journalPath, recordType: finding.recordType };
             }
         }
         finally {
@@ -363,6 +444,8 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
  *   CLI_V2_PLAN_MODE_CONFIGURED   details.refusal_kind = "v2-plan-mode-configured"
  *   CLI_V2_CONFIG_UNREADABLE      details.refusal_kind = "v2-config-unreadable"
  *   CLI_V2_EXPERIMENTAL_UNSAFE    details.refusal_kind = "v2-experimental-unsafe", details.selectors
+ *   CLI_V2_ENVIRONMENT_UNSAFE / CLI_V2_WORKSPACE_TRUST_UNSAFE for unsafe config
+ *   KIMI_SESSION_ENVIRONMENT_UNSAFE details.refusal_kind = "session-environment-unsafe"
  *   KIMI_SESSION_PLAN_TAINTED     details.refusal_kind = "session-plan-tainted", details.record_type
  *   KIMI_SESSION_JOURNAL_UNAVAILABLE details.refusal_kind = "session-journal-unavailable"
  * Every message carries a truthful remedy (edit the named setting / start a
@@ -384,6 +467,22 @@ export async function assertNativeV2Preflight(options) {
             details: { refusal_kind: planMode.refusalKind, retryable_after_setup: false },
         });
     }
+    const environment = await inspectEnvironmentConfig(options.kimiHome);
+    if (environment.kind === "refuse") {
+        const code = environment.refusalKind === "v2-environment-configured"
+            ? "CLI_V2_ENVIRONMENT_UNSAFE"
+            : environment.refusalKind === "v2-workspace-trust-disabled"
+                ? "CLI_V2_WORKSPACE_TRUST_UNSAFE"
+                : "CLI_V2_CONFIG_UNREADABLE";
+        const remedy = environment.refusalKind === "v2-environment-configured"
+            ? `Remove \`environments.default\` in ${configPath} so plugin-managed sessions stay local.`
+            : environment.refusalKind === "v2-workspace-trust-disabled"
+                ? `Set \`workspace.require_trust = true\` (or remove it) in ${configPath}.`
+                : `Fix or remove the unreadable file at ${configPath} so the execution environment can be verified as local.`;
+        throw new RuntimeError(code, `${environment.reason} ${remedy}`, stage, {
+            details: { refusal_kind: environment.refusalKind, retryable_after_setup: false },
+        });
+    }
     const experimental = await inspectExperimentalSelectors(options.kimiHome, options.env);
     if (experimental.kind === "refuse") {
         throw new RuntimeError("CLI_V2_EXPERIMENTAL_UNSAFE", `${experimental.reason} Unset the listed selector(s) before retrying.`, stage, {
@@ -395,7 +494,16 @@ export async function assertNativeV2Preflight(options) {
         });
     }
     if (options.resumeSessionId !== undefined) {
-        const journalScan = await scanSessionJournalsForPlan(options.kimiHome, options.resumeSessionId);
+        const journalScan = await scanSessionJournalsForPlan(options.kimiHome, options.resumeSessionId, options.expectedExecutionRoot);
+        if (journalScan.kind === "environment") {
+            throw new RuntimeError("KIMI_SESSION_ENVIRONMENT_UNSAFE", `Saved session ${options.resumeSessionId} has an unsafe execution environment binding (${journalScan.recordType} in ${journalScan.journal}). Start a fresh local session; saved session state was not modified.`, stage, {
+                details: {
+                    refusal_kind: "session-environment-unsafe",
+                    record_type: journalScan.recordType,
+                    retryable_after_setup: false,
+                },
+            });
+        }
         if (journalScan.kind === "tainted") {
             throw new RuntimeError("KIMI_SESSION_PLAN_TAINTED", `Saved session ${options.resumeSessionId} previously entered plan mode (record type "${journalScan.recordType}" in ${journalScan.journal}). Start a fresh session; saved session state was not modified.`, stage, {
                 details: {