kimi-plugin-cc 2.5.1 → 2.5.3

package/dist/swarm-activation.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { open } from "node:fs/promises";
 import path from "node:path";
@@ -9,7 +10,7 @@ import { assertExecutionPlanMatchesSpawn, assertNoUnsafeExperimentalSelector, }
 import { resolveKimiHome } from "./kimi-home.js";
 import { assertNativeV2Preflight } from "./native-v2-preflight.js";
 import { collectDescendantIdentities, collectProcessGroupsIdentities, probeProcessIdentity, revalidateProcessIdentities, waitForProcessTreeExit, } from "./process-tree.js";
-const PREACTIVATION_VERSIONS = ["2.3.2", "2.3.3", "2.4.0", "2.4.1"];
+const PREACTIVATION_VERSIONS = ["2.3.2", "2.3.3", "2.4.0", "2.4.1", "2.5.0", "2.5.1"];
 const READY_TIMEOUT_MS = 10_000;
 const REST_TIMEOUT_MS = 5_000;
 // Exact 2.4.0 can take longer than 5s to drain session/workspace lifecycle work.
@@ -18,6 +19,8 @@ const JOURNAL_TIMEOUT_MS = 2_000;
 const JOURNAL_POLL_MS = 50;
 const READY_LINE_MAX_CHARS = 65_536;
 const REST_RESPONSE_MAX_BYTES = 1024 * 1024;
+const WEBSOCKET_MAX_FRAMES = 64;
+const WEBSOCKET_RESPONSE_MAX_CHARS = 1024 * 1024;
 const JOURNAL_MAX_BYTES = 64 * 1024 * 1024;
 const DESCENDANT_SNAPSHOT_TIMEOUT_MS = 2_000;
 const DESCENDANT_TRACK_INTERVAL_MS = 50;
@@ -39,11 +42,12 @@ export async function preactivateSwarmSession(options) {
         web = await startWebChild(options, prepared.env, failureCode);
         await verifyMeta(web, prepared.expectedVersion, options.signal, failureCode);
         const model = await resolveProfileModel(web, options, failureCode);
-        identity = await createSession(web, options, failureCode);
+        identity = await createSession(web, options, prepared.expectedVersion, failureCode);
+        await verifyLocalEnvironment(web, identity, options.cwd, prepared.expectedVersion, options.signal, failureCode);
         options.onRecoveryEvent?.({ kind: "session", ...identity });
         profileMutationAttempted = true;
         await postSwarmProfile(web, identity, true, model, options.signal, failureCode);
-        await verifySwarmStatus(web, identity, true, model, options.signal, failureCode);
+        await verifySwarmStatus(web, identity, true, model, prepared.expectedVersion, options.signal, failureCode);
         await shutdownWeb(web, options.signal, failureCode);
         await requireSwarmJournal(prepared.kimiHome, identity, "enter", options.signal, failureCode);
         throwIfAborted(options.signal, failureCode, "swarm-activation.complete");
@@ -86,8 +90,9 @@ export async function deactivateSwarmSession(options) {
         throwIfAborted(options.signal, failureCode, "swarm-deactivation.pre-spawn");
         web = await startWebChild(options, prepared.env, failureCode);
         await verifyMeta(web, prepared.expectedVersion, options.signal, failureCode);
+        await verifyLocalEnvironment(web, options, options.cwd, prepared.expectedVersion, options.signal, failureCode);
         await postSwarmProfile(web, options, false, undefined, options.signal, failureCode);
-        await verifySwarmStatus(web, options, false, undefined, options.signal, failureCode);
+        await verifySwarmStatus(web, options, false, undefined, prepared.expectedVersion, options.signal, failureCode);
         await shutdownWeb(web, options.signal, failureCode);
         await requireSwarmJournal(prepared.kimiHome, options, "exit", options.signal, failureCode);
         options.onRecoveryEvent?.({ kind: "disabled" });
@@ -124,6 +129,7 @@ async function prepareWebSpawn(options, failureCode) {
         await assertNativeV2Preflight({
             kimiHome,
             env: options.env,
+            expectedExecutionRoot: options.cwd,
             stage: "swarm-activation.pre-spawn",
         });
     }
@@ -329,13 +335,29 @@ async function resolveProfileModel(web, options, failureCode) {
     }
     return data.default_model;
 }
-async function createSession(web, options, failureCode) {
-    const data = await restData(web, "POST", "/api/v1/sessions", { metadata: { cwd: options.cwd } }, options.signal, failureCode);
+async function createSession(web, options, expectedVersion, failureCode) {
+    const request = { metadata: { cwd: options.cwd } };
+    if (["2.5.0", "2.5.1"].includes(expectedVersion)) {
+        request.environment_id = "local";
+        request.environment_cwd = options.cwd;
+    }
+    const data = await restData(web, "POST", "/api/v1/sessions", request, options.signal, failureCode);
     if (!isRecord(data) || !validPathId(data.id) || !validPathId(data.workspace_id)) {
         throw failure(failureCode, "swarm-activation.create-session", "Kimi web returned an invalid session identity.");
     }
     return { sessionId: data.id, workspaceId: data.workspace_id };
 }
+async function verifyLocalEnvironment(web, identity, expectedCwd, expectedVersion, signal, failureCode) {
+    if (!["2.5.0", "2.5.1"].includes(expectedVersion))
+        return;
+    const data = await restData(web, "GET", `/api/v1/sessions/${encodeURIComponent(identity.sessionId)}/environment`, undefined, signal, failureCode);
+    if (!isRecord(data)) {
+        throw failure(failureCode, "swarm-activation.environment", "Kimi web /environment returned an invalid payload.");
+    }
+    if (data.workspace_id !== identity.workspaceId || data.environment_id !== "local" || data.cwd !== expectedCwd) {
+        throw failure(failureCode, "swarm-activation.environment", "Kimi web /environment did not confirm the expected local workspace binding.");
+    }
+}
 async function postSwarmProfile(web, identity, active, model, signal, failureCode) {
     const agentConfig = {
         swarm_mode: active,
@@ -345,24 +367,264 @@ async function postSwarmProfile(web, identity, active, model, signal, failureCod
         agentConfig.model = model;
     await restData(web, "POST", `/api/v1/sessions/${encodeURIComponent(identity.sessionId)}/profile`, { agent_config: agentConfig }, signal, failureCode);
 }
-async function verifySwarmStatus(web, identity, active, model, signal, failureCode) {
-    const data = await restData(web, "GET", `/api/v1/sessions/${encodeURIComponent(identity.sessionId)}/status`, undefined, signal, failureCode);
+async function verifySwarmStatus(web, identity, active, model, expectedVersion, signal, failureCode) {
+    const data = ["2.5.0", "2.5.1"].includes(expectedVersion)
+        ? await readWebSocketAgentState(web, identity.sessionId, signal, failureCode)
+        : await restData(web, "GET", `/api/v1/sessions/${encodeURIComponent(identity.sessionId)}/status`, undefined, signal, failureCode);
+    const source = ["2.5.0", "2.5.1"].includes(expectedVersion) ? "agent state" : "/status";
     if (!isRecord(data)) {
-        throw failure(failureCode, "swarm-activation.status", "Kimi web /status returned an invalid payload.");
+        throw failure(failureCode, "swarm-activation.status", `Kimi web ${source} returned an invalid payload.`);
     }
     if (data.swarm_mode !== active) {
-        throw failure(failureCode, "swarm-activation.status", `Kimi web /status did not confirm swarm_mode=${active}.`, { expected_swarm_mode: active });
+        throw failure(failureCode, "swarm-activation.status", `Kimi web ${source} did not confirm swarm_mode=${active}.`, { expected_swarm_mode: active });
     }
     if (data.plan_mode !== false) {
-        throw failure(failureCode, "swarm-activation.status", "Kimi web /status did not confirm plan mode is off.");
+        throw failure(failureCode, "swarm-activation.status", `Kimi web ${source} did not confirm plan mode is off.`);
     }
-    if (data.permission !== "auto") {
-        throw failure(failureCode, "swarm-activation.status", "Kimi web /status did not confirm auto permission mode.");
+    if (["2.5.0", "2.5.1"].includes(expectedVersion) && data.tower_mode !== false) {
+        throw failure(failureCode, "swarm-activation.status", "Kimi web agent state did not confirm tower mode is off.");
+    }
+    const permission = ["2.5.0", "2.5.1"].includes(expectedVersion) ? data.permission_mode : data.permission;
+    if (permission !== "auto") {
+        throw failure(failureCode, "swarm-activation.status", `Kimi web ${source} did not confirm auto permission mode.`);
     }
     if (active && data.model !== model) {
-        throw failure(failureCode, "swarm-activation.status", "Kimi web /status did not confirm the selected model alias.");
+        throw failure(failureCode, "swarm-activation.status", `Kimi web ${source} did not confirm the selected model alias.`);
     }
 }
+async function readWebSocketAgentState(web, sessionId, signal, failureCode) {
+    throwIfAborted(signal, failureCode, "swarm-activation.status");
+    await refreshOwnedDescendants(web);
+    throwIfAborted(signal, failureCode, "swarm-activation.status");
+    try {
+        return await new Promise((resolve, reject) => {
+            let socket;
+            const bearerProtocol = `kimi-code.bearer.${web.token}`;
+            const helloId = `swarm-activation-hello-${randomUUID()}`;
+            const subscribeId = `swarm-activation-subscribe-${randomUUID()}`;
+            try {
+                const url = new URL(web.origin);
+                url.protocol = "ws:";
+                url.pathname = "/api/v1/ws";
+                socket = new WebSocket(url, bearerProtocol);
+            }
+            catch {
+                reject(failure(failureCode, "swarm-activation.status", "Could not open the authenticated Kimi web agent-state channel."));
+                return;
+            }
+            let settled = false;
+            let serverHello = false;
+            let clientHelloAcknowledged = false;
+            let subscribeSent = false;
+            let subscriptionAcknowledged = false;
+            let closeRequested = false;
+            let latestState;
+            let frames = 0;
+            let receivedChars = 0;
+            const timer = setTimeout(() => {
+                settle(failure(failureCode, "swarm-activation.status", "Kimi web agent-state verification timed out.", { timeout_ms: REST_TIMEOUT_MS }));
+            }, REST_TIMEOUT_MS);
+            const cleanup = () => {
+                clearTimeout(timer);
+                signal?.removeEventListener("abort", onAbort);
+                socket.removeEventListener("open", onOpen);
+                socket.removeEventListener("message", onMessage);
+                socket.removeEventListener("error", onError);
+                socket.removeEventListener("close", onClose);
+                try {
+                    socket.close();
+                }
+                catch {
+                }
+            };
+            const settle = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
+                if (result instanceof RuntimeError)
+                    reject(result);
+                else
+                    resolve(result);
+            };
+            const rejectState = (message) => {
+                settle(failure(failureCode, "swarm-activation.status", message));
+            };
+            const send = (frame) => {
+                try {
+                    socket.send(JSON.stringify(frame));
+                    return true;
+                }
+                catch {
+                    rejectState("Could not send a Kimi web agent-state control frame.");
+                    return false;
+                }
+            };
+            const completeIfReady = () => {
+                if (serverHello &&
+                    clientHelloAcknowledged &&
+                    subscriptionAcknowledged &&
+                    latestState !== undefined &&
+                    !closeRequested) {
+                    closeRequested = true;
+                    try {
+                        socket.close();
+                    }
+                    catch {
+                        rejectState("Could not close the Kimi web agent-state channel for final validation.");
+                    }
+                }
+            };
+            const onOpen = () => {
+                if (socket.protocol !== bearerProtocol) {
+                    rejectState("Kimi web did not authenticate the agent-state channel with the expected subprotocol.");
+                    return;
+                }
+                send({
+                    type: "client_hello",
+                    id: helloId,
+                    payload: { client_id: "kimi-plugin-cc-swarm-activation" },
+                });
+            };
+            const onMessage = (event) => {
+                if (settled)
+                    return;
+                if (typeof event.data !== "string") {
+                    rejectState("Kimi web agent-state channel returned a non-text frame.");
+                    return;
+                }
+                frames += 1;
+                receivedChars += event.data.length;
+                if (frames > WEBSOCKET_MAX_FRAMES || receivedChars > WEBSOCKET_RESPONSE_MAX_CHARS) {
+                    rejectState("Kimi web agent-state channel exceeded the bounded response limit.");
+                    return;
+                }
+                let frame;
+                try {
+                    frame = JSON.parse(event.data);
+                }
+                catch {
+                    rejectState("Kimi web agent-state channel returned malformed JSON.");
+                    return;
+                }
+                if (!isRecord(frame) || typeof frame.type !== "string") {
+                    rejectState("Kimi web agent-state channel returned an invalid frame.");
+                    return;
+                }
+                if (frame.type === "server_hello") {
+                    if (serverHello || !isRecord(frame.payload) ||
+                        frame.payload.protocol_version !== 2 ||
+                        typeof frame.payload.ws_connection_id !== "string" ||
+                        !isRecord(frame.payload.capabilities) ||
+                        frame.payload.capabilities.event_batching !== false ||
+                        frame.payload.capabilities.compression !== false) {
+                        rejectState("Kimi web agent-state channel did not provide the expected protocol-v2 hello.");
+                        return;
+                    }
+                    serverHello = true;
+                    return;
+                }
+                if (!serverHello) {
+                    rejectState("Kimi web agent-state channel sent data before its protocol hello.");
+                    return;
+                }
+                if (frame.type === "ack") {
+                    if (typeof frame.id !== "string" || typeof frame.code !== "number" || !isRecord(frame.payload)) {
+                        rejectState("Kimi web agent-state channel returned an invalid acknowledgement.");
+                        return;
+                    }
+                    if (frame.id === helloId) {
+                        if (clientHelloAcknowledged || frame.code !== 0) {
+                            rejectState("Kimi web agent-state channel rejected the client hello.");
+                            return;
+                        }
+                        clientHelloAcknowledged = true;
+                        subscribeSent = send({
+                            type: "subscribe_v2",
+                            id: subscribeId,
+                            payload: { session_id: sessionId, transcript: { main: "block" } },
+                        });
+                        return;
+                    }
+                    if (frame.id === subscribeId) {
+                        if (subscriptionAcknowledged || !subscribeSent || frame.code !== 0 ||
+                            !Array.isArray(frame.payload.accepted) ||
+                            frame.payload.accepted.length !== 1 ||
+                            frame.payload.accepted[0] !== sessionId ||
+                            !Array.isArray(frame.payload.not_found) ||
+                            frame.payload.not_found.length !== 0) {
+                            rejectState("Kimi web agent-state channel did not accept the exact main-session subscription.");
+                            return;
+                        }
+                        subscriptionAcknowledged = true;
+                        completeIfReady();
+                        return;
+                    }
+                    rejectState("Kimi web agent-state channel returned an unexpected acknowledgement.");
+                    return;
+                }
+                if (frame.type === "agent") {
+                    if (!subscribeSent || !isAgentStateFrame(frame, sessionId)) {
+                        rejectState("Kimi web agent-state channel returned invalid or misbound main-agent state.");
+                        return;
+                    }
+                    latestState = frame;
+                    completeIfReady();
+                    return;
+                }
+                if (frame.type === "ping") {
+                    if (isRecord(frame.payload) && typeof frame.payload.nonce === "string") {
+                        send({ type: "pong", payload: { nonce: frame.payload.nonce } });
+                    }
+                }
+            };
+            const onAbort = () => {
+                settle(cancelledFailure(failureCode, "swarm-activation.status"));
+            };
+            const onError = () => {
+                rejectState("Kimi web agent-state channel failed before valid state was received.");
+            };
+            const onClose = (event) => {
+                if (event.wasClean &&
+                    closeRequested &&
+                    serverHello &&
+                    clientHelloAcknowledged &&
+                    subscriptionAcknowledged &&
+                    latestState !== undefined) {
+                    settle(latestState);
+                    return;
+                }
+                rejectState("Kimi web agent-state channel closed before valid state was received.");
+            };
+            signal?.addEventListener("abort", onAbort, { once: true });
+            socket.addEventListener("open", onOpen);
+            socket.addEventListener("message", onMessage);
+            socket.addEventListener("error", onError);
+            socket.addEventListener("close", onClose);
+            if (signal?.aborted === true)
+                onAbort();
+        });
+    }
+    finally {
+        await refreshOwnedDescendants(web);
+    }
+}
+function isAgentStateFrame(frame, sessionId) {
+    return frame.session_id === sessionId &&
+        frame.agent_id === "main" &&
+        typeof frame.event_created_at === "string" &&
+        Number.isFinite(Date.parse(frame.event_created_at)) &&
+        (frame.status === "idle" || frame.status === "running") &&
+        (frame.model === undefined || typeof frame.model === "string") &&
+        (frame.thinking === undefined || typeof frame.thinking === "string") &&
+        (frame.permission_mode === undefined ||
+            frame.permission_mode === "manual" ||
+            frame.permission_mode === "yolo" ||
+            frame.permission_mode === "auto") &&
+        typeof frame.plan_mode === "boolean" &&
+        typeof frame.swarm_mode === "boolean" &&
+        typeof frame.tower_mode === "boolean";
+}
 async function shutdownWeb(web, signal, failureCode) {
     await restData(web, "POST", "/api/v1/shutdown", undefined, signal, failureCode);
     const settlement = await waitForChildClose(web, signal, failureCode);

package/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.5.1";
+export const KIMI_PLUGIN_CC_VERSION = "2.5.3";

package/docs/migration.md

@@ -1,6 +1,8 @@
 # Compatibility and upgrades
 
-Plugin 2.4.5 certifies Kimi Code CLI 2.4.1 for all eight operations, alongside exact native-v2 versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, `2.3.3`, and `2.4.0`. Later patches and minor releases are not accepted automatically. The npm distribution adds an installation channel; it does not change this compatibility table.
+Plugin 2.5.1 certifies Kimi Code CLI 2.4.1 for all eight operations, alongside exact native-v2 versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, `2.3.3`, and `2.4.0`. Later patches and minor releases are not accepted automatically. The npm distribution adds an installation channel; it does not change this compatibility table.
+
+Plugin 2.5.1 also adds DeepSeek Harness as a third host with all seven operations and a DSH-specific bundle, data root, and managed hook id. Existing Claude Code and Codex certification, job stores, and host-scoped hooks are unchanged; no migration is required for those hosts. New DSH installations follow the [README DSH section](../README.md#install-in-deepseek-harness), including `/kimi-setup` on that host.
 
 Explicitly pinned legacy-v1 binaries remain supported within `KIMI_TESTED_MINORS`, through 0.41.x, subject to each operation's minimum version. The [runtime table](../runtime/kimi-engine.ts) is the authority.
 
@@ -8,15 +10,15 @@ Use the [README installation and update steps](../README.md) for Claude Code or
 
 ## Plugin versions and upgrades
 
-Plugin versions advance independently using ordinary SemVer and may deliberately align with a certified CLI release. Plugin 2.4.5 certifies exact CLI 2.4.1; the nearby numbers do not imply version alignment. Published versions and tags are never reused. Every upstream patch requires its own certification. The native-v2 no-plan profile, plugin/marketplace IDs and existing job store are preserved.
+Plugin versions advance independently using ordinary SemVer and may deliberately align with a certified CLI release. Plugin 2.5.1 certifies exact CLI 2.4.1; the nearby numbers do not imply version alignment. Published versions and tags are never reused. Every upstream patch requires its own certification. The native-v2 no-plan profile, plugin/marketplace IDs and existing job store are preserved.
 
-## CLI 2.3.2, 2.3.3, 2.4.0 and 2.4.1 swarm activation
+## CLI 2.3.2, 2.3.3, 2.4.0, 2.4.1 and 2.5.0/2.5.1 swarm activation
 
-Upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print sessions. On exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1, swarm commands and MCP calls use the same `runSwarm` lifecycle:
+Upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print sessions. On exact 2.3.2, 2.3.3, 2.4.0, 2.4.1 and 2.5.0/2.5.1, swarm commands and MCP calls use the same `runSwarm` lifecycle:
 
-1. A short-lived `web --no-open --host 127.0.0.1 --port 0 --log-level error` process uses authenticated loopback routes to verify the exact v2 server, choose the explicit or configured default model, create a session, bind the model and auto permission, enable and verify `swarm_mode`, and shut down. The child environment sets `KIMI_CODE_SESSION_IDLE_RECLAIM_MS=0` to disable ambient idle-session reclamation.
+1. A short-lived `web --no-open --host 127.0.0.1 --port 0 --log-level error` process uses authenticated loopback routes to verify the exact v2 server, choose the explicit or configured default model, create a session, bind the model and auto permission, enable and verify `swarm_mode`, and shut down. On exact 2.5.0/2.5.1, creation explicitly selects the local environment and an authenticated `/environment` read proves its cwd before profile mutation; state verification uses protocol-v2 WebSocket main-agent frames because `/status` was removed. The child environment sets `KIMI_CODE_SESSION_IDLE_RECLAIM_MS=0` to disable ambient idle-session reclamation.
 2. One ordinary `kimi -p -r` prompt runner resumes that session. Its recorded session-id source is `preactivated`, and the returned print session must match it.
-3. A second short-lived web lifecycle disables swarm mode, verifies status and the `swarm_mode.exit` journal record, and shuts down.
+3. A second short-lived web lifecycle rechecks the local binding on 2.5.0/2.5.1, disables swarm mode, verifies the version-appropriate state proof and the `swarm_mode.exit` journal record, and shuts down.
 
 Activation is inside the job's finite budget. Graceful process close has a bounded 15-second allowance. `runSwarm` solely owns deactivation: normal cleanup uses the remaining budget, while failure recovery has a separate two-second cancellation-aware bound and is never retried. Print/session failures stay primary. The ready token stays in memory and out of logs, and success cannot complete if cleanup fails. Post-mutation identity or process/group uncertainty preserves diagnostics and, for write-swarm, the recovery worktree. Process groups are rechecked after teardown; unknown survivors are unverified and unproven groups are not signalled. Older certified versions still launch swarm directly with `kimi -p`. This narrow lifecycle is not a full RPC transport or a model-driven activation workaround; the managed hook and workspace boundaries still govern every tool call.
 

package/docs/registry-releases.md

@@ -8,6 +8,12 @@ no separate CLI.
 
 ## Publishing status
 
+Plugin **2.5.3** certifies exact Kimi Code **2.5.0 and 2.5.1** for all eight operations, adding local-execution/workspace-trust closures and authenticated WebSocket swarm activation with clean-close validation while preserving the no-plan construction and legacy-v1 0.41.x boundary. See the [2.5.0](./upstream-2.5.0-certification.md) and [2.5.1](./upstream-2.5.1-certification.md) certification records. The 2.5.1 source scan passed 18 tests with 153 assertions; candidate and production matrices each passed 24 tests with 167 assertions and no skips. The full check passed 1,412 tests with 18,282 assertions, package validation passed 330 files across all three distributions, isolated consumer security passed, and independent read-only `claude -p` review returned APPROVE. Release-commit CI, OIDC publication, registry artifact identity, and the final Discover timestamp are recorded here after publication.
+
+Plugin **2.5.2** hardens setup recovery and DSH dependency ownership. Its real Kimi Code **2.4.1** smoke passed **24 tests and 167 assertions with no skips**; the exact-source audit passed **16 tests and 97 assertions**. Normal npm installation keeps DSH host services optional. DSH use requires explicitly patched host/profile dependencies and both installation audits described below. Exact CLI certification remains unchanged. [Release v2.5.2](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.2) is anchored at `8b303bb6e49c581ad96c72bd031e8fd1643c9121`. [Release-commit CI](https://github.com/linxule/kimi-plugin-cc/actions/runs/41361753223) and [npm publication](https://github.com/linxule/kimi-plugin-cc/actions/runs/41362262009) passed. The 328-file registry tarball has SHA-1 `e620040dd35986a6929be7ad677642729a3126e7`, matches the validated workflow artifact byte-for-byte, and carries provenance (sigstore log index `3636981979`). A fresh registry npm installation has zero production advisories; isolated Claude Code, Codex, and DSH setup/checks pass, and all compiled runtime mirrors match. The Discover timestamp records npm publication at `2026-11-01T23:35:04.270Z`.
+
+Plugin **2.5.1** adds DeepSeek Harness through the existing root npm package and its established OIDC workflow. [Release v2.5.1](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.1) is anchored at `afe68ee2f0e7744e1fc97eb0f1e4007585d969d0`; its [CI check](https://github.com/linxule/kimi-plugin-cc/actions/runs/41335810767) and [release-event publishing run](https://github.com/linxule/kimi-plugin-cc/actions/runs/41336273042) passed. The registry tarball has SHA-1 `f0e42febcb14082be6a654b9b0830885242fd92a`, contains 328 files, matches the CI artifact, and carries signed provenance (sigstore log index `3635166158`). A fresh registry installation into an isolated DSH profile composed all seven providers and booted the Web host. DSH users install with `dsh plugin --profile <name> add kimi-plugin-cc`; no second npm package or Trusted Publishing binding is required.
+
 Plugin **2.4.5** certifies exact CLI **2.4.1** for all eight operations with host-preactivated swarm sessions. [Release v2.4.5](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.5) is anchored at `de8c195c2986443a088b674717133b164d2e4ef2`; its [CI check](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226096281) and [release-event publishing run](https://github.com/linxule/kimi-plugin-cc/actions/runs/41226438326) passed. The registry tarball has SHA-1 `39f97a6de4b26ad51ac77305054682fcd5cd0164`, contains 233 files, and matches the CI artifact byte-for-byte. Fresh registry installs passed setup/check and unsupported-version refusal for both Claude Code and Codex, and both compiled mirrors are byte-identical to the release checkout. See the [certification record](./upstream-2.4.1-certification.md) and structured verification at `.claude/kimi-code-research/release-2.4.5/registry-verification.json`.
 
 Plugin **2.4.2** adds durable interrupted-swarm recovery and Windows spawn diagnostics.
@@ -78,9 +84,11 @@ file at the tag, so fixes to `publish.yml` reach an existing tag only through
 ## Validation
 
 Use the repository's normal version bump and generated-surface procedure in
-AGENTS.md. Keep plugin and npm versions identical. Certification for new Kimi
-Code versions still requires the source audit and real-binary controls; adding
-a registry channel does not certify another CLI version.
+AGENTS.md. Keep plugin and npm versions identical, and update
+`DSH_PUBLISH_TIMESTAMP` with the actual publication time so the generated DSH
+Discover index stays current. Certification for new Kimi Code versions still
+requires the source audit and real-binary controls; adding a registry channel
+does not certify another CLI version.
 
 ```sh
 bun install --frozen-lockfile
@@ -88,6 +96,7 @@ bun run build
 bun run generate:surfaces
 # Review and stage generated distributions before the drift gate.
 bun run check
+bun run check:consumer-security
 node scripts/check-package.mjs .tmp/npm
 node scripts/check-dsh-package.mjs .tmp/dsh-npm
 ```
@@ -101,6 +110,60 @@ check installs that same root tarball into an isolated DSH home, verifies all
 seven tools, and boots the Web host. Neither check invokes a model or reads the
 maintainer's Kimi configuration.
 
+The consumer-security gate installs the packed package into a fresh npm project
+and audits the resolved production dependency graph. DSH services and its tool
+adapter are optional peers supplied by the DSH host; ordinary npm installation
+for Claude Code or Codex does not install the harness. Optional peers still
+carry compatibility ranges when present. The gate runs in CI and release
+validation and refuses high/critical advisories, failed audits, and incomplete
+reports. The checkout's overrides do not constrain downstream npm resolution.
+
+### Patched DSH host and profiles
+
+DSH 0.2.1-rc.5 and 0.2.2-alpha.2 still pin vulnerable `zod` and `undici`
+versions. See the [upstream dependency report](https://github.com/deepseek-ai/deepseek-harness/discussions/10847).
+Use a patched DSH host installation with `zod >=4.6.6` and `undici >=8.12.2`.
+This is an explicit installation requirement; the plugin does not rewrite the
+host or profiles automatically. A profile override alone does not patch copies
+inside a separately installed DSH CLI.
+
+For example, create a dedicated npm host project (Node >=24.9), then use its
+DSH binary for plugin installation and launch:
+
+```sh
+mkdir -p ~/.local/share/kimi-dsh-host
+cd ~/.local/share/kimi-dsh-host
+npm init -y
+npm pkg set 'overrides.zod=^4.6.6' 'overrides.undici=^8.12.2'
+npm install @deepseek-ai/dsh@0.2.1-rc.5
+npm audit --omit=dev --audit-level=high
+./node_modules/.bin/dsh plugin --profile web add kimi-plugin-cc
+./node_modules/.bin/dsh plugin --profile web audit --prod --audit-level high
+./node_modules/.bin/dsh web --no-open
+```
+
+The host project is separate from `$DSH_HOME/profiles/web`. Keep using that
+project's DSH binary so the audited host is the one that runs. The commands
+above install the published plugin; use a validated local tarball when testing
+an unpublished change.
+
+If an existing profile separately installs DSH packages, its owner must also
+patch and audit that profile:
+
+```sh
+dsh plugin --profile web pkg set 'pnpm.overrides.zod=^4.6.6' 'pnpm.overrides.undici=^8.12.2'
+dsh plugin --profile web install
+dsh plugin --profile web audit --prod --audit-level high
+```
+
+Replace `web` with the intended profile, and run these commands with the patched
+host binary. Overrides affect dependency resolution and require application
+checks. The DSH package gate creates a fresh host with the declared overrides,
+audits both that host and the installed profile for high/critical advisories,
+then verifies all seven tool compositions and Web boot using that same host.
+These checks do not claim that every moderate/low advisory is fixed or that
+upstream has published a patched release.
+
 ## First publication (completed bootstrap reference)
 
 The package must first exist on npm before its package settings can be configured.

package/docs/safety.md

@@ -2,7 +2,7 @@
 
 This guide describes the current checkout runtime. Read-only tasks deny file writes and shell commands. Rescue and pursue can edit your workspace. Write-swarm returns a patch from a temporary Git worktree.
 
-Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, `2.3.3`, `2.4.0`, and `2.4.1`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
+Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, `2.3.3`, `2.4.0`, `2.4.1`, `2.5.0`, and `2.5.1`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
 
 ## Why the safety story is hook-based
 
@@ -72,7 +72,7 @@ Key constraints (verified by [`runtime/hooks/managed-block.ts`](../runtime/hooks
 1. **No `matcher` line.** kimi-code compiles the matcher field via `new RegExp(matcher)`. An empty matcher means "fire for every tool." `new RegExp("*")` throws, which kimi-code catches and treats as "no matcher" → silently disables the hook. The installer omits the field intentionally; the verifier rejects any block that contains a `matcher = ...` line.
 2. **Absolute Node path.** kimi-code spawns hook commands via `/bin/sh -c "<command>"`. If we wrote bare `node`, the shell would resolve it against kimi-code's PATH at execution time. On a system where kimi-code launches from a GUI/LaunchAgent with a sanitized PATH (nvm/asdf/mise users), bare `node` would exit 127 → hook protocol treats non-{0,2} as **allow** → safety contract collapses with no user-visible signal.
 3. **TOML basic-string escaping.** The command field is a TOML basic string. Quotes, backslashes, newlines, and control characters in the resolved hook path are escaped during install; paths containing characters that cannot be safely escaped (literal `"`, raw control chars) are rejected up front with `SETUP_HOOK_PATH_UNSAFE`.
-4. **Exact marker grammar.** The verifier rejects stray comments containing the marker tag, partial references, duplicate blocks (from a setup race), and orphan markers (from a manual edit). The same parser is used by both the installer and the per-call verifier so the two cannot disagree.
+4. **Exact marker grammar.** The verifier rejects duplicate blocks and orphan or mismatched host markers. Install removes lexically proven unpaired marker comments across hosts, preserving surrounding content and all foreign hook tables, and warns. Text inside TOML strings is not a marker. The verifier remains fail-closed until repair and full validation succeed.
 5. **Exact command equality, per host.** The verifier reconstructs the canonical command byte string from the current env and equality-checks the installed `command` (never a substring — a crafted `true # /path/to/approval-hook.js` runs only `true` and would auto-allow). This holds *per host id* (below): each host verifies its own block.
 6. **Full-config parse and whole-hook-array validation.** The verifier parses the complete file with vendored `smol-toml@1.9.1` with upstream fixes included and no local JavaScript modifications (see `runtime/vendor/smol-toml/README.md`), before inspecting the managed block. It then applies upstream's strict config schema to every configured hook (`event`, optional string `matcher`, non-empty `command`, optional integer `timeout` 1–600, no extra fields). A malformed unrelated TOML value or one invalid foreign hook can make kimi-code discard enforcement; both therefore fail verification.
 7. **Serialized, identity-bound setup mutations.** Install and uninstall hold a private `0o600` sibling lock across the complete read-modify-write transaction. The candidate lock is published atomically; lock reads are no-follow, nonblocking, regular-file-only, and capped at 4 KiB. Acquisition is bounded, live owners are never stolen, stale recovery is guarded by a nonrecursive recovery lease, and inode/token ownership is rechecked before config mutation or lock removal. Simultaneous Claude Code/Codex setup runs therefore cannot lose either host's block, and a replaced lock is never treated as ours. A newly created Kimi home is `0o700`; atomic config writes remain `0o600`.
@@ -128,6 +128,8 @@ uninstalls only its **own** block.
 
 ## DeepSeek Harness providers
 
+DSH's host and any profile-local harness packages must use patched `zod >=4.6.6` and `undici >=8.12.2`. The plugin treats DSH services as optional host-provided peers; it does not install the harness for other hosts or rewrite an existing DSH installation. Audit the actual host installation as well as the profile. See [patched DSH setup](./registry-releases.md#patched-dsh-host-and-profiles).
+
 The DSH bundle exposes the same seven operations as the other hosts: `kimi_ask`, `kimi_review`, `kimi_challenge`, `kimi_rescue`, `kimi_pursue`, `kimi_swarm`, and `kimi_swarm_write`. Each activation starts the existing companion through DSH's managed subprocess service and uses the same `kimi -p` transport, hook verification, exact-version certification, job store, and response or safety budgets. ACP is not used.
 
 Run `/kimi-setup` explicitly before delegating. Installing or enabling the bundle does not modify Kimi configuration. DSH uses host id `dsh` and `$DSH_HOME/plugin-data/kimi-plugin-cc` unless an absolute data-root override selects another store. Its provider-owned environment clears other-host roots/data, hook/script overrides, trusted roots, and verification bypasses instead of inheriting them.
@@ -212,23 +214,23 @@ If another installed host still points to an older hook, that hook may veto thes
 
 > **Goal-mode entry gate (changed in 0.12.0).** Headless goal mode is reached by a `/goal`-prefixed prompt. On kimi-code 0.8–0.11 it is *additionally* gated by the `goal-command` experimental flag, which `pursue.ts` sets per-spawn (`KIMI_CODE_EXPERIMENTAL_GOAL_COMMAND=1`). kimi-code 0.12.0 (PR #569) **removed that experimental-flag gate**, so the `/goal` prefix alone triggers goal mode. This does not weaken plugin safety: read-only commands (review/challenge/ask/review_gate) hard-prefix an English instruction line, so their trimmed prompt never starts with `/goal` and they cannot enter goal mode on any version; and the managed PreToolUse hook denies every write under a read-only label regardless (see § Native agent-core-v2 for why the hook cannot be pre-empted). The env var `pursue.ts` sets is now redundant on 0.12.0 but harmless, and is kept for 0.8–0.11 compat.
 
-- **The hook fires on every tool call in every continuation turn.** On native v2 every tool execution passes `prepareToolCall` → `fireBeforeExecute`, where the external-hooks listener vetoes ahead of any terminal allow (the auto-approve gate uses non-terminal `pass()`; the engine's only `allow()` is the plan-file guard, never armed in a plugin-managed session — see § Native agent-core-v2). (On legacy-v1 ≤ 0.41 the same guarantee came from `PreToolCallHookPermissionPolicy` sitting at policy index 0.) Goal continuation turns are ordinary turns — there is no autonomous-continuation path that bypasses per-tool approval (verified against kimi-code 0.9.0, audit report 58; re-verified through 0.12.0 by the goal-mode real-binary smoke, reports 61-65). A goal-mode run is exactly as write-gated as a single-turn rescue. This is locked by a real-binary smoke (`tests/runtime/real-binary-smoke.test.ts`, run via `KIMI_PLUGIN_CC_SMOKE=1 bun test ... -t "goal mode"`): it runs real headless goal mode under a read-only label and asserts that **no file lands across the entire multi-turn run** — a hook miss on any continuation turn would land one.
+- **The hook fires on every tool call in every continuation turn.** On native v2 every tool execution passes `prepareToolCall` → `fireBeforeExecute`, where the external-hooks listener vetoes ahead of any terminal allow (the auto-approve gate uses non-terminal `pass()`; the engine's only `allow()` is the plan-file guard, never armed in a plugin-managed session — see § Native agent-core-v2). (On legacy-v1 ≤ 0.41 the same guarantee came from `PreToolCallHookPermissionPolicy` sitting at policy index 0.) Goal continuation turns are ordinary turns — there is no autonomous-continuation path that bypasses per-tool approval (verified against kimi-code 0.9.0, audit report 58; re-verified through 0.12.0 by the goal-mode real-binary smoke, reports 61-65). A goal-mode run is exactly as write-gated as a single-turn rescue. This is locked by a real-binary smoke (`tests/runtime/real-binary-smoke.test.ts`, run via `KIMI_PLUGIN_CC_SMOKE=1 bun test ... -t "goal mode"`): it runs real headless goal mode under a read-only label, asserts that the entire workspace is empty at settlement, and requires same-call managed error denials in at least two distinct turns. It does not prove that no transient file ever existed.
 - **The only new risk is unboundedness, and the plugin bounds it.** Headless goal create sets no token/turn budget, and the managed hook denies `SetGoalBudget`; the plugin's external wall-clock stop is therefore the guaranteed bound. `/kimi:pursue` enforces a **mandatory finite wall-clock ceiling** via its AbortController (`--budget`, default 45m) — the SIGTERM→SIGKILL descendant-reaping cancellation reaps the whole goal process tree. `--turns` is a *soft* instruction injected into the objective, never a request to call the denied `SetGoalBudget` tool; it is not enforceable headless, and stopping at that soft hint is not proof of completion. Treat `--budget` as the real bound.
 - **Loop runaway is now also capped upstream.** kimi-code 0.8.0 (#364) detects repeated identical tool calls and force-stops a turn at a repeat streak. This benefits `/kimi:rescue`, `/kimi:ask`, and `/kimi:pursue` alike: a force-stopped turn ends *normally* (exit 0, flows through the plugin's success path — not a failure), reducing the chance an autonomous run spins against the wall-clock budget. It is a complement to, not a replacement for, the wall-clock ceiling.
 - **Resume is intentionally not exposed yet.** In goal mode `goal.summary` emits a *goalId* distinct from the resume-hint *sessionId*; `kimi -r <sessionId>` re-enters the session but not necessarily the goal continuation. The plugin captures and surfaces the goalId but does not offer `--resume` for pursue until that split is reconciled upstream — exposing it now would be a silent-failure trap. **Re-verified against kimi-code 0.26.0 (2026-07-16):** the headless CLI still has no argv, prompt syntax, or session-resume path that calls `resumeGoal()`. `parseHeadlessGoalCreate` (`apps/kimi-code/src/cli/goal-prompt.ts`) accepts only the `/goal <objective>` *create* shape on both the v1 and experimental-v2 drivers, and upstream's own docs (`docs/en/guides/goals.md`, § "Use goal mode carefully") state that in non-interactive prompt mode *only goal creation is supported* — goal management is a TUI/kimi-web control. PR #552 makes a plain `-r <sessionId>` correctly *restore* the paused goal snapshot, but nothing in the headless path *acts* on it; the real `resumeGoal()` is wired only to the TUI (`/goal resume`) and kimi-web RPC (PR #1693, web-only). Implementing `--resume` would therefore require either prompt-injected model compliance (rejected — the plugin bounds autonomy with hard limits, not model goodwill) or abandoning the subprocess model for kimi-web's RPC. Re-check if upstream ever ships a headless `goal resume` verb.
 - **A model-invocable `kimi-pursue` agent (v1.3) wraps this command.** The main thread can dispatch autonomous goal mode, not just the human-typed `/kimi:pursue` — the same command↔agent mirror as rescue/review/swarm. Auto-dispatch does NOT widen the blast radius: pursue runs under `commandLabel: "rescue"`, so the managed PreToolUse hook + workspace allowlist gate every tool call on every continuation turn (no git mutation), and the mandatory `--budget` wall-clock ceiling bounds the autonomy regardless of who launched it. Because it is write-capable AND autonomous — the plugin's highest blast radius — the agent's description requires an explicit user request for hands-off multi-turn pursuit, steers single bounded tasks to `kimi-rescue`, and never auto-promotes a fix or a question into a goal loop. Like the command, it refuses without the hook and offers no `--resume`.
 
-## Swarm activation on CLI 2.3.2, 2.3.3, 2.4.0 and 2.4.1
+## Swarm activation on CLI 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.5.0 and 2.5.1
 
 For interrupted runs, see [durable recovery and its explicit limits](swarm-recovery.md).
 
 Upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print sessions. A rejected call can therefore coexist with zero child journals and a successful exit; a tool-call record, aggregate denial, or coordinator-produced patch does not prove fan-out. The plugin does not use prompt workarounds or replace its print transport with general RPC.
 
-For versions requiring activation (currently exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1), both slash-command and MCP swarm operations use the same `runSwarm` implementation and one ordinary `kimi -p -r` prompt runner per job, bracketed by short-lived host-managed web lifecycles:
+For versions requiring activation (currently exact 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.5.0 and 2.5.1), both slash-command and MCP swarm operations use the same `runSwarm` implementation and one ordinary `kimi -p -r` prompt runner per job, bracketed by short-lived host-managed web lifecycles:
 
-1. The exact planned CLI starts `web --no-open --host 127.0.0.1 --port 0 --log-level error`. The child environment sets `KIMI_CODE_SESSION_IDLE_RECLAIM_MS=0`, so ambient idle-session reclamation cannot disrupt the plugin-owned lifecycle. The plugin accepts only the expected loopback ready URL, uses a supplied token for authenticated REST requests, and keeps that token in memory, never writing it to logs. `/api/v1/meta` must confirm backend v2, the exact planned version, and no dangerous authentication bypass. The plugin uses the explicit model or environment-model alias, otherwise reading the default alias from `/api/v1/config`; creates a session in the job cwd; binds that model with `permission_mode:auto` and `swarm_mode:true`; verifies those settings and `plan_mode:false` through `/status`; verifies clean shutdown; and requires the main journal's manual `swarm_mode.enter` record.
+1. The exact planned CLI starts `web --no-open --host 127.0.0.1 --port 0 --log-level error`. The child environment sets `KIMI_CODE_SESSION_IDLE_RECLAIM_MS=0`, so ambient idle-session reclamation cannot disrupt the plugin-owned lifecycle. The plugin accepts only the expected loopback ready URL, uses a supplied token for authenticated REST requests, and keeps that token in memory, never writing it to logs. `/api/v1/meta` must confirm backend v2, the exact planned version, and no dangerous authentication bypass. The plugin uses the explicit model or environment-model alias, otherwise reading the default alias from `/api/v1/config`; creates a session in the job cwd; on exact 2.5.0/2.5.1 explicitly binds `environment_id:"local"` and the job cwd, then verifies that binding through authenticated `/environment` before either profile mutation; binds the selected model with `permission_mode:auto` and `swarm_mode:true`; verifies those settings and `plan_mode:false` through `/status` on earlier versions or protocol-v2 authenticated WebSocket main-agent state on 2.5.0/2.5.1, closing that channel cleanly before validating the latest frame; verifies clean shutdown; and requires the main journal's manual `swarm_mode.enter` record.
 2. The ordinary stream-json print runner resumes that session with `kimi -p -r`. The job records `kimi_session_id_source:"preactivated"`, and the session returned by print must exactly match the preactivated id. Every coordinator and child tool call remains governed by the same managed PreToolUse hook and operation allowlist.
-3. After the print run, a second web lifecycle sets `swarm_mode:false`, verifies `/status`, shuts down cleanly, and requires `swarm_mode.exit` in the main journal. Activation consumes part of the same finite job budget rather than extending it. `runSwarm` solely owns session deactivation: normal cleanup uses the remaining budget, while failure recovery has a separate two-second cancellation-aware bound and is never retried. Print/session failures stay primary, with exit codes and cleanup diagnostics preserved. Cancellation aborts the owned lifecycle and never starts a fresh cleanup server. Every post-mutation failure retains the session identity; process/group uncertainty is marked without inventing an ID; process groups are rechecked after teardown, unknown survivors are unverified, unproven groups are never signalled, and a same-PID/start-token process that changes PGID remains active but is not a validated signal target. Root loss requires a previously observed matching identity; first-missing roots and actual probe errors/timeouts remain unverified. Reparenting and PGID moves preserve the current verified child identity for revalidation rather than treating it as exited. Unverified cleanup prevents success and preserves raw output, structured diagnostics, and the write worktree for recovery.
+3. After the print run, a second web lifecycle rechecks the local binding on 2.5.0/2.5.1, sets `swarm_mode:false`, verifies the version-appropriate state proof, shuts down cleanly, and requires `swarm_mode.exit` in the main journal. Activation consumes part of the same finite job budget rather than extending it. `runSwarm` solely owns session deactivation: normal cleanup uses the remaining budget, while failure recovery has a separate two-second cancellation-aware bound and is never retried. Print/session failures stay primary, with exit codes and cleanup diagnostics preserved. Cancellation aborts the owned lifecycle and never starts a fresh cleanup server. Every post-mutation failure retains the session identity; process/group uncertainty is marked without inventing an ID; process groups are rechecked after teardown, unknown survivors are unverified, unproven groups are never signalled, and a same-PID/start-token process that changes PGID remains active but is not a validated signal target. Root loss requires a previously observed matching identity; first-missing roots and actual probe errors/timeouts remain unverified. Reparenting and PGID moves preserve the current verified child identity for revalidation rather than treating it as exited. Unverified cleanup prevents success and preserves raw output, structured diagnostics, and the write worktree for recovery.
 
 Older certified versions keep the direct `kimi -p` path. The web processes are narrow, planned lifecycle helpers, not a second model runner and not a general RPC transport.
 
@@ -237,7 +239,7 @@ Older certified versions keep the direct `kimi -p` path. The web processes are n
 `/kimi:swarm` (v1.2) fans a **read-only** review out across subagents using kimi-code's `AgentSwarm` tool (kimi-code 0.12.0+). The coordinator launches one subagent per target (file/module/question); each inspects the workspace with read tools and reports findings, which the coordinator consolidates into one markdown report. It opens **zero new write surface**.
 
 - **The hook label is `swarm`, and it allows the read-only tool set PLUS `AgentSwarm`.** The coordinator must be allowed to call `AgentSwarm` (else the swarm never launches), but no write/edit/shell tool is allowed. The exact allowed tool name is `AgentSwarm` (verified at 0.42.0 against `packages/agent-core-v2/src/features/swarm/tools/agent-swarm/agentSwarmTool.ts`: `'AgentSwarm'`, strict schema). The singular `Agent` tool is deliberately *not* allowed — swarm is the fan-out surface, not arbitrary delegation.
-- **Every subagent inherits the `swarm` label and fires the same hook.** On native v2 (0.42.0) `AgentSwarm` children run in-process in a child DI scope with their OWN eager external-hooks service, so every child tool call passes the same before-execute channel and the same managed hook — there is no sub-vs-main branch and no deny-all shortcut on the swarm route. So a subagent's `Write`/`Edit`/`Bash` is denied exactly like a single-turn review's. The swarm listener in that channel is non-terminal and nothing auto-approves `AgentSwarm` ahead of the hook. (Legacy-v1 ≤ 0.41 reached the same result by placing the hook policy at index 0 of every agent's permission stack.) **Required for final certification evidence** (`tests/runtime/real-binary-smoke.test.ts`, run via `bun run smoke:real`): distinct child journals must exist, and each assigned Write/Edit `path` must be correlated through its `toolCallId` with the managed denial in that exact tool result; unrelated denials and coordinator-only reports are insufficient. On 2.3.2, 2.3.3, 2.4.0 and 2.4.1, targeted controls also prove that direct OFF produces no children while the preactivated ON path produces the real child journals and denials.
+- **Every subagent inherits the `swarm` label and fires the same hook.** On native v2 (0.42.0) `AgentSwarm` children run in-process in a child DI scope with their OWN eager external-hooks service, so every child tool call passes the same before-execute channel and the same managed hook — there is no sub-vs-main branch and no deny-all shortcut on the swarm route. So a subagent's `Write`/`Edit`/`Bash` is denied exactly like a single-turn review's. The swarm listener in that channel is non-terminal and nothing auto-approves `AgentSwarm` ahead of the hook. (Legacy-v1 ≤ 0.41 reached the same result by placing the hook policy at index 0 of every agent's permission stack.) **Required for final certification evidence** (`tests/runtime/real-binary-smoke.test.ts`, run via `bun run smoke:real`): distinct child journals must exist, and each assigned Write/Edit `path` must be correlated through its `toolCallId` with the managed denial in that exact tool result; unrelated denials and coordinator-only reports are insufficient. On 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.5.0 and 2.5.1, targeted controls also prove that direct OFF produces no children while the preactivated ON path produces the real child journals and denials.
 - **The managed hook is the read-only boundary; no `explore`-profile second layer is assumed.** Production deliberately omits `subagent_type` for read-only swarm rather than selecting kimi-code's `explore` profile. Every coordinator and subagent tool call is enforced by the same managed hook.
 - **Swarm refuses without the hook, like every model-spawning command.** A swarm makes the reason especially acute: it asks for up to `--cap` subagents, but this total-count hint is advisory, so a missing hook would remove enforcement from all of them at once. `KIMI_PLUGIN_CC_SKIP_HOOK_CHECK=1` remains an explicit tests/diagnostics escape hatch, not a recovery path.
 - **The only new risk is COST, and the plugin bounds it.** Read-only swarm writes nothing, so the new risk is runaway cost from N parallel model runs (and possible nested `AgentSwarm`). `/kimi:swarm` enforces a **mandatory finite wall-clock ceiling** via its AbortController (`--budget`, default 30m); the SIGTERM→SIGKILL descendant-reaping cancellation reaps the whole subagent process tree. Two **distinct** subagent bounds: `--cap N` is a *soft* prompt-injected hint on TOTAL subagent count (the hook is stateless and cannot enforce a count, so the model may exceed it), and `--max-concurrency N` is a *hard* ceiling on how many subagents kimi-code's `SubagentBatch` runs concurrently — exported as `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` (PR #888) on **kimi-code 0.18.0+** (older binaries ignore the unknown env var, so on < 0.18 only the soft hint applies). It **defaults to 4** when the user passes none (`resolveSwarmMaxConcurrency` in swarm.ts), so every swarm run — agent-dispatched or human-typed — carries an enforced peak-parallelism ceiling on 0.18.0+ rather than falling back to kimi-code's internal ramp; pass an explicit value to widen or throttle. **Never merge them into one flag:** concurrency ≠ total count — a hard concurrency cap of N still permits more than N subagents over the life of the run, just never more than N at once. The `--budget` bounds elapsed time, not a dollar amount or total token count; `--max-concurrency` bounds *peak* parallelism (the spike in simultaneous model spend), and `--cap` is only an advisory total-count nudge. Folding both onto one flag would create the "cap-as-total-count illusion" — a user reading `--cap N` would expect a total bound but receive only a peak-parallelism one.
@@ -296,6 +298,8 @@ worktree. A directory the operator trusted interactively in the Kimi TUI still
 has that property; that persisted-trust route is a documented residual, not
 something the plugin can close.
 
+Plugin-managed execution must remain local. Unused remote declarations can remain in operator config, but a configured remote default refuses before spawn. Disabling workspace trust through `[workspace] require_trust = false` also refuses, because it would enable project MCP outside the managed hook. Launcher environment selectors are reserved. Fresh exact 2.5.0/2.5.1 print selects `--environment local`; resume instead inspects persisted metadata and every agent journal and refuses nonlocal or wrong-root records against the expected execution root (the isolated worktree for swarm-write); older sessions without environment records do not fail this check merely for lacking them.
+
 ## Running a newer Kimi than the plugin certifies
 
 The plugin refuses any kimi-code version it has not certified, so an operator
@@ -306,9 +310,9 @@ at it (the runtime resolves that path instead of `kimi` on `PATH`; every spawn
 still exports `KIMI_CODE_NO_AUTO_UPDATE=1`, so the pinned copy never drifts).
 
 ```sh
-PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.4.1
+PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.5.1
 mkdir -p "$PIN" && cd "$PIN" && printf '{"name":"kimi-plugin-cc-pin","private":true}\n' > package.json
-npm install @moonshot-ai/kimi-code@2.4.1
+npm install @moonshot-ai/kimi-code@2.5.1
 export KIMI_PLUGIN_CC_KIMI_BIN="$PIN/node_modules/.bin/kimi"   # e.g. in ~/.zshenv
 ```